diff --git a/.agents/skills/.gitignore b/.agents/skills/.gitignore
new file mode 100644
index 000000000..d8ccabddf
--- /dev/null
+++ b/.agents/skills/.gitignore
@@ -0,0 +1,5 @@
+*
+!.gitignore
+!/xcodegen/
+!/shadowsocksx-ng2-local-validation/
+
diff --git a/.agents/skills/shadowsocksx-ng2-local-validation/SKILL.md b/.agents/skills/shadowsocksx-ng2-local-validation/SKILL.md
new file mode 100644
index 000000000..28a8b0bf5
--- /dev/null
+++ b/.agents/skills/shadowsocksx-ng2-local-validation/SKILL.md
@@ -0,0 +1,43 @@
+---
+name: shadowsocksx-ng2-local-validation
+description: Validate ShadowsocksX-NG2 changes and diagnose retained local validation results.
+---
+
+# ShadowsocksX-NG2 local validation
+
+This repository copy is the maintained skill. Copies under `~/.codex/memories/skills/` are historical snapshots. Paths below are relative to the repository root unless stated otherwise.
+
+## Select the evidence
+
+1. Inspect the request, staged and unstaged diffs, `ShadowsocksX-NG2/AGENTS.md`, and relevant ADRs. Read `ShadowsocksX-NG2/README.md` for build/signing conventions and `ShadowsocksX-NG2/Taskfile.dist.yml` for current gate definitions.
+2. Identify the requested level: focused tests, full hostless suite, real-process smoke, Debug/Release build, native/manual UI, or real system-proxy behavior. Retain that scope; documentation-only changes do not require repeating full suites.
+3. For structural/resource changes, update authoritative `project.yml` and run `task gen:prj` from `ShadowsocksX-NG2/`; never hand-edit the generated project.
+
+## Run the selected checks
+
+- Work from `ShadowsocksX-NG2/`. For combined validation use `task --exit-code validate`. From another directory use `task --exit-code --taskfile /absolute/path/to/ShadowsocksX-NG2/Taskfile.dist.yml validate`.
+- Default gates are `lint test test:smoke build`, executed in order with fail-fast behavior. To select a non-duplicated subset, append e.g. `-- lint test`. Diagnose the first failure; later selected gates are `not_run`, not skipped tests.
+- `test` runs offline binary/rule checks before the hostless arm64 Xcode suite. Its Xcode test counts do not count those earlier checks. `test:smoke` uses the separate `ShadowsocksX-NG2Smoke` scheme and real processes. `build` is Debug; Release is a separate `task build:release` and is outside `validate`.
+- Run focused tests when appropriate using the existing Xcode scheme and test selection; a focused Xcode run does not cover the preceding Taskfile checks. Use isolated derived data when needed. Follow the repository Debug ad-hoc signing baseline; Release requires Developer ID signing and has no unsigned fallback.
+- `task format` and `task lint:fix` mutate source; use when requested or needed for the change, then inspect the diff. Current commands and options belong in Taskfile, not this skill.
+
+## Read retained evidence
+
+`validate` prints its run directory, `ShadowsocksX-NG2/.build/validation/<UTC>-<random>/`. Gate directories use the gate name with `:` replaced by `-` (`test:smoke` → `test-smoke/`). `task clean` removes these artifacts; copy them elsewhere if long-term retention is needed.
+
+1. Read the run's `summary.txt` first. It records the overall exit code, selected gates, gate status/exit codes, test counts and evidence warnings. Per-gate `status.txt` supplies the same gate summary.
+2. For failed Xcode tests, read that gate's `test-summary.json`, especially `testFailures`. Report each failing case using `testIdentifierString` (or `testName`) and its `failureText`. For example, `plutil -extract testFailures json -o - <gate-dir>/test-summary.json` reads the retained failures without reopening the result bundle.
+3. If the summary is absent, unreadable, or insufficient, read the relevant diagnostics: `test-summary.stderr.log` for extraction failure, `count-reader.log` for invalid counts, and `raw.log` for gate output, pre-Xcode failures, build/lint errors, or missing context. Query `result.xcresult` only for unresolved detail. When retained summaries answer the question, do not repeat `xcresulttool` extraction.
+4. Keep command outcome and evidence completeness separate. `validate:result` writes the original gate exit code; summary extraction does not replace it. A missing result bundle or unreadable/invalid test summary means `evidence incomplete` and unknown counts, never zero counts or an inferred pass. `validate:summary` preserves the overall exit code and marks unexecuted selected gates `not_run`. Build has no test-count summary; lint has no xcresult requirement.
+
+## Diagnose within the evidence boundary
+
+- If XcodeGen reports `No project spec found`, check cwd. Permission failures in Xcode, macros, signing or Git may be environment boundaries: retry the unchanged command through authorized macOS execution before changing source. Distinguish missing Release signing configuration from source failure.
+- Preserve assertions and default parallel execution when investigating flakes. Prefer deterministic readiness and explicit fixture release, cancellation and drainage over extra sleeps or increased timeouts. For parallelism claims, inspect runner evidence; configuration alone does not prove concurrent execution.
+- For connectivity/latency smoke, verify listener ownership by the spawned process (`RuntimeSocketOwnershipProbe` or its current equivalent), response-header deadlines, and process-group/temp-environment cleanup. Use local DNS/loopback fixtures and proxy-egress observations where routing assertions require them.
+- Keep inherited XCTest `test*` methods out of shared fixture bases to avoid duplicate execution. Measure slow rule/runtime segments before adding delay injection.
+- Hostless tests, real-process smoke, native/manual UI, and real system-proxy acceptance are separate evidence levels. Hostless/smoke success does not establish SystemConfiguration writes, helper approval, notification behavior, or visual acceptance.
+
+## Finish
+
+Inspect staged and unstaged diffs and run `git diff --check`. Report the actual commands, run directory, exit codes, counts in Xcode's summary convention (parameterized executions may differ), warnings, evidence gaps, and omitted acceptance levels. Commit locally only when requested; push only with explicit authorization.
diff --git a/.agents/skills/shadowsocksx-ng2-local-validation/agents/openai.yaml b/.agents/skills/shadowsocksx-ng2-local-validation/agents/openai.yaml
new file mode 100644
index 000000000..5b1f887a9
--- /dev/null
+++ b/.agents/skills/shadowsocksx-ng2-local-validation/agents/openai.yaml
@@ -0,0 +1,2 @@
+policy:
+  allow_implicit_invocation: false
diff --git a/.agents/skills/xcodegen/SKILL.md b/.agents/skills/xcodegen/SKILL.md
new file mode 100644
index 000000000..382e18633
--- /dev/null
+++ b/.agents/skills/xcodegen/SKILL.md
@@ -0,0 +1,76 @@
+---
+name: xcodegen
+description: Generate and manage Xcode projects with XcodeGen — write project.yml as the source of truth and produce .xcodeproj from it instead of hand-editing pbxproj files. Use this skill whenever creating or modifying an Xcode project's structure (targets, schemes, build settings, Info.plist, entitlements, dependencies like SPM packages or frameworks), when the user mentions xcodegen / project.yml / regenerating or fixing a .xcodeproj, or when asked to add files or targets to an Xcode project — even if they don't name XcodeGen explicitly. Also applies to CI project generation and migrating a repo to a generated-project workflow.
+---
+
+# XcodeGen
+
+XcodeGen generates `.xcodeproj` files from a declarative `project.yml` spec.
+
+**Core mental model: `project.yml` is the source of truth; `.xcodeproj` is a disposable build artifact.** Never hand-edit the `.xcodeproj` and never tell the user to add files through Xcode's UI — every structural change (new target, new source directory, new dependency) goes through `project.yml` + regeneration. That is the entire point of the tool: no pbxproj merge conflicts, and the project structure becomes reviewable YAML in git.
+
+## The workflow
+
+1. Check the tool exists: `which xcodegen` (install with `brew install xcodegen`). If the spec uses newer features, note them in `options.minimumXcodeGenVersion`.
+2. Write or edit `project.yml` at the repo/project root.
+3. Generate: `xcodegen generate` (add `--use-cache` in scripts/CI so unchanged specs skip regeneration).
+4. Verify the result — a generated project that doesn't build is not done:
+   - `xcodebuild -list -project <Name>.xcodeproj` — schemes and configurations are as expected.
+   - `xcodebuild -project <Name>.xcodeproj -scheme <Scheme> build` — the real gate.
+   - `xcodegen dump --spec project.yml` prints the fully-resolved spec; use it to debug `include:` merges or surprising settings presets.
+
+## Minimal working example
+
+macOS app + unit tests + scheme — the shape most projects need; adapt platform, paths, and deployment target:
+
+```yaml
+name: MyApp
+options:
+  bundleIdPrefix: com.example        # targets without PRODUCT_BUNDLE_IDENTIFIER get com.example.<TargetName>
+  deploymentTarget:
+    macOS: "13.0"
+  createIntermediateGroups: true
+targets:
+  MyApp:
+    type: application
+    platform: macOS
+    sources:
+      - path: MyApp                  # a directory: everything under it is picked up
+    info:
+      path: MyApp/Info.plist         # generated and written to disk; CFBundle* keys auto-filled
+      properties:
+        LSMinimumSystemVersion: "13.0"
+    scheme:
+      testTargets:
+        - MyAppTests                 # scheme "MyApp" builds app + runs tests
+  MyAppTests:
+    type: bundle.unit-test
+    platform: macOS
+    sources:
+      - path: MyAppTests
+    dependencies:
+      - target: MyApp                # TEST_HOST is set automatically for unit tests
+```
+
+```bash
+xcodegen generate
+xcodebuild -project MyApp.xcodeproj -scheme MyApp build
+```
+
+## Rules that prevent most mistakes
+
+- **Regenerate after adding/removing source files.** Source globs are resolved when `xcodegen generate` runs, not live by Xcode — a new `.swift` file on disk is invisible to the project until then. "My file isn't in the target" almost always means: run `xcodegen generate`. (Xcode auto-reloads a regenerated project that's already open.)
+- **Never mix settings styles.** In a `settings:` block, if you use `base:`, `configs:`, or `groups:`, a sibling plain map (e.g. `MARKETING_VERSION: 1.0` at the same level) is *silently ignored*. Pick one style per block; the plain-map style only works alone.
+- **Quote deployment targets**: `deploymentTarget: "14.0"`, not `14.0` (YAML parses the latter as a float and trailing zeros vanish).
+- **Prefer `info:` / `entitlements:` blocks** over committing static plists: XcodeGen writes the files and sets `INFOPLIST_FILE` / `CODE_SIGN_ENTITLEMENTS` for you, and fills `CFBundleIdentifier`, `CFBundleExecutable`, `CFBundleShortVersionString` etc. automatically. Anything you put in `properties:` wins. Info.plist files found in sources are never added to build phases.
+- **Mark generated/optional paths** with `optional: true` on a source, or generation fails when the directory doesn't exist yet.
+- **Test targets**: declare the app as a `dependencies: - target:` of the test target — that alone wires up `TEST_HOST` (unit tests) or `TEST_TARGET_NAME` (UI tests, type `bundle.ui-testing`).
+- **Extensions embed themselves**: a dependency of an `application` target defaults to `embed: true`, so `- target: MyExtension` is usually all an app needs — no copy-files phase to write.
+- **Extension bundle IDs must live under the app's bundle ID.** macOS/iOS validate that an embedded extension's bundle ID starts with the parent app's — `com.example.MyProxy.Tunnel`, not `com.example.Tunnel`. Since `bundleIdPrefix` auto-derivation gives every target `prefix.TargetName`, extensions fail a *build-validation* step (not compilation) with "Embedded binary's bundle identifier is not prefixed with the parent app's bundle identifier". Always set `PRODUCT_BUNDLE_IDENTIFIER` explicitly on extension targets (see recipes.md #2).
+- **`.gitignore` the generated project** (`*.xcodeproj`) so no one edits it by accident. If the repo currently tracks one, flag the migration step (remove from index, regenerate locally) rather than doing it silently.
+- **`xcodegen generate` is idempotent.** When in doubt, re-run it; there is no state to corrupt.
+
+## Choosing between the reference files
+
+- `references/project-spec.md` — syntax cheat sheet: every section of `project.yml` with exact key names. Read when you need a field you don't remember precisely (source exclude patterns, dependency options, scheme fields, SPM version constraints).
+- `references/recipes.md` — complete copy-pasteable `project.yml` examples: app + unit/UI tests, app extension (e.g. network extension) with entitlements, SPM remote/local packages, per-config xcconfig, vendored pre-built binaries/frameworks, build-script phases, splitting a spec with `include:`. Read before writing any non-trivial spec — reuse a recipe rather than assembling from memory.
diff --git a/.agents/skills/xcodegen/references/project-spec.md b/.agents/skills/xcodegen/references/project-spec.md
new file mode 100644
index 000000000..24510b48e
--- /dev/null
+++ b/.agents/skills/xcodegen/references/project-spec.md
@@ -0,0 +1,261 @@
+# project.yml Syntax Cheat Sheet
+
+Condensed from the official ProjectSpec docs (XcodeGen 2.4x). When this file and the official docs disagree, trust the docs: https://github.com/yonaskolb/XcodeGen/blob/master/Docs/ProjectSpec.md
+
+## Top level
+
+```yaml
+name: MyProject              # required
+include: [base.yml]          # merge other specs (see bottom of this file)
+options: {...}               # project-wide behavior (below)
+attributes: {...}            # raw PBXProject attributes (rarely needed)
+configs: {...}               # build configurations (default: Debug/Release)
+configFiles: {Debug: path.xcconfig}
+settingGroups: {name: {settings}}   # reusable settings, referenced via settings.groups
+settings: {...}              # project-level build settings
+targets: {TargetName: {...}} # the targets
+fileGroups: [dir-or-file]    # shown in project navigator, not in any target
+schemes: {SchemeName: {...}}
+schemeTemplates: {...}
+targetTemplates: {...}
+packages: {PackageName: {...}}      # Swift packages
+projectReferences: {Name: {path: Other.xcodeproj}}
+```
+
+## Options (commonly used)
+
+```yaml
+options:
+  bundleIdPrefix: com.example     # auto bundle IDs: prefix + target name
+  deploymentTarget:               # project-wide defaults
+    macOS: "13.0"
+    iOS: "16.0"
+  createIntermediateGroups: true  # groups for intermediate path components
+  minimumXcodeGenVersion: "2.38.0"
+  developmentLanguage: zh-Hans    # default "en"
+  transitivelyLinkDependencies: false   # link deps-of-deps (default false)
+  generateEmptyDirectories: false
+  groupSortPosition: bottom       # top | bottom | none
+  groupOrdering:                  # custom group order in navigator
+    - order: [Sources, Resources, Tests]
+  preGenCommand: make resources   # bash, skipped when cache skips generation
+  postGenCommand: pod install
+  defaultConfig: Debug
+  defaultSourceDirectoryType: group   # group | folder | syncedFolder (xcode16_0+)
+```
+
+Environment variable expansion works in any string: `${SOME_VAR}` (disable with `xcodegen generate -n`).
+
+## Configs
+
+Each config maps to a build type; anything other than `debug`/`release` gets no default settings:
+
+```yaml
+configs:
+  Debug: debug
+  Beta: release
+  AppStore: release
+```
+
+## Settings
+
+Two forms — **never mix them in one block** (plain keys are silently dropped if `base`/`configs`/`groups` is present):
+
+```yaml
+settings:
+  SWIFT_VERSION: "5.9"            # form 1: simple map
+
+settings:                          # form 2: structured
+  base:
+    MARKETING_VERSION: "1.0"
+  configs:                         # key matched case-insensitively/partially to config names
+    debug:
+      CODE_SIGN_IDENTITY: Apple Development
+    release:
+      CODE_SIGN_IDENTITY: Apple Distribution
+  groups: [shared-settings]        # references to settingGroups
+```
+
+## Target
+
+```yaml
+targets:
+  MyTarget:
+    type: application              # required, see list below
+    platform: macOS                # required: macOS | iOS | tvOS | watchOS | visionOS | auto
+    supportedDestinations: [macOS, macCatalyst]   # alternative to platform (Xcode 14+)
+    deploymentTarget: "13.0"       # or per-platform map for multi-platform targets
+    sources: [...]
+    dependencies: [...]
+    settings: {...}
+    configFiles: {Debug: path.xcconfig}
+    info: {...}                    # generates Info.plist
+    entitlements: {...}            # generates .entitlements
+    templates: [Name]              # from targetTemplates; ${target_name} substitution
+    templateAttributes: {attr: value}
+    preBuildScripts: [...]         # also postCompileScripts, postBuildScripts
+    buildRules: [...]
+    buildToolPlugins: [{plugin: P, package: PKG}]
+    scheme: {...}                  # per-target convenience scheme
+    attributes: {...}
+    transitivelyLinkDependencies: true
+    requiresObjCLinking: true      # default true only for library.static
+```
+
+Product types (attribute to `type:`): `application`, `app-extension`, `extensionkit-extension`, `framework`, `framework.static`, `library.static`, `library.dynamic`, `bundle`, `bundle.unit-test`, `bundle.ui-testing`, `tool`, `xpc-service`, `system-extension`, `watchkit2-extension`, `application.messages`, `application.watchapp2`, and friends.
+
+Settings set automatically for you (don't set by hand): `INFOPLIST_FILE` (if an Info.plist is found in sources or defined via `info:`), `TEST_HOST` (unit tests depending on an app), `TEST_TARGET_NAME` (UI tests depending on an app), `FRAMEWORK_SEARCH_PATHS` (Carthage), `OTHER_LDFLAGS` (ObjC linking).
+
+Multi-platform: `platform: [iOS, tvOS]` generates one target per platform named `Name_iOS`, `Name_tvOS`; `${platform}` interpolates inside the target spec.
+
+## Sources
+
+A source is a path string or an object. Directories are expanded at **generation time** — new files require regeneration.
+
+```yaml
+sources:
+  - Sources                       # whole directory
+  - path: Sources
+    excludes:                     # bash-4 globstar patterns, relative to `path`
+      - "**/*.md"
+      - "ios/*.[mh]"
+      - "*-Private.h"
+    includes: ["**/*.swift"]      # whitelist; excludes win on conflict
+    compilerFlags: ["-Werror"]
+    createIntermediateGroups: true
+    optional: true                # don't fail if the path doesn't exist
+    headerVisibility: public      # public | private | project
+    type: group                   # group (default for dirs) | file | folder | syncedFolder
+    buildPhase: sources           # sources | resources | headers | none, or copyFiles: {destination: …, subpath: …}
+  - path: Vendor/Binaries
+    buildPhase: none              # show in navigator only
+  - path: MyFile.swift            # single file
+    buildPhase:
+      copyFiles:
+        destination: wrapper      # absolutePath | productsDirectory | wrapper | executables |
+        subpath: Contents/Tools   # resources | javaResources | frameworks | sharedFrameworks |
+                                  # sharedSupport | plugins
+```
+
+## Dependencies
+
+```yaml
+dependencies:
+  - target: OtherTarget              # links; embeds if this is an application (embed default true)
+  - target: OtherProject/OtherTarget # via projectReferences
+  - package: SomePackage             # name from top-level packages
+    product: LibraryName             # only if product ≠ package name
+    products: [A, B]                 # multiple products
+  - framework: Vendor/Foo.xcframework
+    embed: true                      # default true for apps
+    codeSign: true
+    weak: false
+  - sdk: libc++.tbd                  # or Contacts.framework, libz.dylib
+  - carthage: Alamofire              # linkType: static|dynamic, findFrameworks: bool
+  - bundle: Prebuilt.bundle          # adds to Copy Resources
+```
+
+## Info.plist and entitlements (`info:` / `entitlements:`)
+
+Files are written to disk on every generation. `info` auto-fills CFBundleIdentifier, CFBundleInfoDictionaryVersion, CFBundleExecutable, CFBundleName, CFBundleDevelopmentRegion, CFBundleShortVersionString, CFBundleVersion, CFBundlePackageType where appropriate; `entitlements` requires all properties explicitly.
+
+```yaml
+info:
+  path: App/Info.plist
+  properties:
+    LSMinimumSystemVersion: "13.0"
+entitlements:
+  path: App/App.entitlements
+  properties:
+    com.apple.security.application-groups: [group.com.example.app]
+```
+
+## Build scripts
+
+```yaml
+preBuildScripts:                 # also postCompileScripts, postBuildScripts
+  - name: SwiftLint
+    script: swiftlint            # or path: scripts/lint.sh
+    inputFiles: ["$(SRCROOT)/file1"]
+    outputFileLists: ["$(SRCROOT)/outputs.xcfilelist"]
+    showEnvVars: false
+    basedOnDependencyAnalysis: true   # skip when inputs/outputs unchanged
+    runOnlyWhenInstalling: false
+```
+
+## Schemes
+
+Per-target convenience (preferred when one scheme ≈ one target):
+
+```yaml
+targets:
+  App:
+    scheme:
+      testTargets: [AppTests]
+      configVariants: [Staging, Production]   # generates one scheme per variant
+      gatherCoverageData: true
+      commandLineArguments: {"-MyArg": true}
+      environmentVariables: {KEY: VALUE}
+```
+
+Top-level (full control; `build.targets` is required):
+
+```yaml
+schemes:
+  MyApp:
+    build:
+      targets:
+        MyApp: all                 # all | none | [run, test, profile, analyze, archive]
+        MyAppTests: [test]
+    run:
+      config: Debug
+      commandLineArguments: {"-InMemory": true}
+      environmentVariables:
+        - variable: API_ENV
+          value: staging
+          isEnabled: true
+    test:
+      gatherCoverageData: true
+      targets:
+        - AppTests
+        - name: UITests
+          parallelizable: true
+          randomExecutionOrder: true
+          skippedTests: [UITests/testFlaky()]
+    archive:
+      config: Release
+      customArchiveName: MyApp
+```
+
+## Swift packages
+
+```yaml
+packages:
+  Yams:
+    url: https://github.com/jpsim/Yams
+    from: 2.0.0                # or majorVersion / minorVersion / exactVersion / version,
+                               # minVersion+maxVersion, branch, revision
+  Alamofire:
+    github: Alamofire/Alamofire   # shorthand for github URLs
+    exactVersion: 5.8.0
+  LocalLib:
+    path: Packages/LocalLib     # directory containing Package.swift
+    group: LocalPackages        # navigator group, default "Packages"
+```
+
+Link into targets with `dependencies: - package: Yams`.
+
+## Splitting the spec (`include`)
+
+Included files merge additively (dicts merge, arrays append); suffix a key with `:REPLACE` to override instead of append. Paths inside included files are relative to that file unless `relativePaths: false`.
+
+```yaml
+include:
+  - base.yml
+  - path: extra.yml
+    relativePaths: false
+    enable: ${INCLUDE_EXTRA}
+targets:
+  App:                # target defined in base.yml
+    sources:REPLACE: [NewSources]
+```
diff --git a/.agents/skills/xcodegen/references/recipes.md b/.agents/skills/xcodegen/references/recipes.md
new file mode 100644
index 000000000..f16859089
--- /dev/null
+++ b/.agents/skills/xcodegen/references/recipes.md
@@ -0,0 +1,252 @@
+# project.yml Recipes
+
+Complete, copy-pasteable specs. Combine the parts you need; trim what you don't. Each recipe is self-contained except where noted.
+
+## 1. iOS app + unit tests + UI tests
+
+```yaml
+name: MyApp
+options:
+  bundleIdPrefix: com.example
+  deploymentTarget:
+    iOS: "16.0"
+targets:
+  MyApp:
+    type: application
+    platform: iOS
+    sources: [MyApp]
+    info:
+      path: MyApp/Info.plist
+      properties:
+        UILaunchScreen: {}              # modern no-storyboard launch
+        UISupportedInterfaceOrientations: [UIInterfaceOrientationPortrait]
+    scheme:
+      testTargets: [MyAppTests, MyAppUITests]
+  MyAppTests:
+    type: bundle.unit-test
+    platform: iOS
+    sources: [MyAppTests]
+    dependencies:
+      - target: MyApp                   # TEST_HOST set automatically
+  MyAppUITests:
+    type: bundle.ui-testing
+    platform: iOS
+    sources: [MyAppUITests]
+    dependencies:
+      - target: MyApp                   # TEST_TARGET_NAME set automatically
+```
+
+## 2. macOS app with an embedded extension (network extension, share extension, …)
+
+Extensions need three things: the right `type`, an `NSExtension` (or `NSSystemExtension`) dict in Info.plist properties, and usually entitlements. The app embeds them automatically — no copy phase needed.
+
+```yaml
+name: MyProxy
+options:
+  bundleIdPrefix: com.example
+  deploymentTarget:
+    macOS: "13.0"
+targets:
+  MyProxy:
+    type: application
+    platform: macOS
+    sources:
+      - path: MyProxy
+    info:
+      path: MyProxy/Info.plist
+      properties:
+        LSMinimumSystemVersion: "13.0"
+    entitlements:
+      path: MyProxy/MyProxy.entitlements
+      properties:
+        com.apple.security.app-sandbox: true
+        com.apple.security.network.client: true
+        com.apple.security.network.server: true
+    dependencies:
+      - target: Tunnel                  # embedded into Contents/PlugIns automatically
+    scheme:
+      testTargets: [MyProxyTests]
+  Tunnel:
+    type: app-extension                 # Network Extension packet-tunnel providers use this type;
+                                        # use system-extension for DriverKit/transparent-proxy style
+    platform: macOS
+    sources: [Tunnel]
+    settings:
+      base:
+        PRODUCT_BUNDLE_IDENTIFIER: com.example.MyProxy.Tunnel   # must be prefixed by the app's
+                                        # bundle ID; bundleIdPrefix auto-derivation (com.example.Tunnel)
+                                        # fails at build validation, not compile
+    info:
+      path: Tunnel/Info.plist
+      properties:
+        CFBundleDisplayName: Tunnel
+        NSExtension:
+          NSExtensionPointIdentifier: com.apple.networkextension.packet-tunnel
+    entitlements:
+      path: Tunnel/Tunnel.entitlements
+      properties:
+        com.apple.security.app-sandbox: true
+        com.apple.security.network.client: true
+  MyProxyTests:
+    type: bundle.unit-test
+    platform: macOS
+    sources: [MyProxyTests]
+    dependencies:
+      - target: MyProxy
+```
+
+Note: Network Extension entitlements (`com.apple.developer.networking.networkextension`) require a provisioning profile from Apple; generation and local builds succeed without it, distribution signing does not. Don't "fix" a signing failure by inventing entitlement values.
+
+## 3. SPM dependencies (remote and local)
+
+```yaml
+name: MyApp
+options:
+  bundleIdPrefix: com.example
+packages:
+  SnapshotTesting:
+    url: https://github.com/pointfreeco/swift-snapshot-testing
+    from: 1.17.0
+  Alamofire:
+    github: Alamofire/Alamofire         # shorthand
+    exactVersion: 5.8.0
+  FeatureKit:
+    path: Packages/FeatureKit           # local package (dir with Package.swift)
+targets:
+  MyApp:
+    type: application
+    platform: iOS
+    sources: [MyApp]
+    dependencies:
+      - package: Alamofire
+      - package: FeatureKit
+        product: FeatureKitDomain       # only when product ≠ package name
+  MyAppTests:
+    type: bundle.unit-test
+    platform: iOS
+    sources: [MyAppTests]
+    dependencies:
+      - target: MyApp
+      - package: SnapshotTesting
+        products: [SnapshotTesting]     # or use `product:` for one
+```
+
+## 4. Custom configs + xcconfig files
+
+```yaml
+name: MyApp
+options:
+  bundleIdPrefix: com.example
+configs:
+  Debug: debug
+  Beta: release                          # maps to release-type defaults
+  AppStore: release
+configFiles:                             # project level
+  Debug: Configs/project-debug.xcconfig
+targets:
+  MyApp:
+    type: application
+    platform: iOS
+    sources: [MyApp]
+    configFiles:                         # target level overrides
+      Debug: Configs/app-debug.xcconfig
+      Beta: Configs/app-beta.xcconfig
+      AppStore: Configs/app-appstore.xcconfig
+    settings:
+      base:
+        XCConfigOnlyWhenNotInFile: value # xcconfig wins for keys it defines
+schemes:
+  MyApp-Beta:
+    build:
+      targets: {MyApp: all}
+    run:
+      config: Beta
+    archive:
+      config: AppStore
+```
+
+## 5. Vendored pre-built binaries and frameworks
+
+Pre-built CLI tools and xcframeworks checked into the repo (not built from source):
+
+```yaml
+targets:
+  MyApp:
+    type: application
+    platform: macOS
+    sources:
+      - path: MyApp
+      - path: Vendor/Tools/ss-local          # a single pre-built executable
+        buildPhase:
+          copyFiles:
+            destination: wrapper
+            subpath: Contents/Tools          # ends up at MyApp.app/Contents/Tools/ss-local
+      - path: Vendor/Tools/privoxy
+        buildPhase:
+          copyFiles:
+            destination: wrapper
+            subpath: Contents/Tools
+    dependencies:
+      - framework: Vendor/Frameworks/SwiftZip.xcframework
+```
+
+Keep vendored binaries out of any target's plain `sources:` glob (or exclude them), otherwise XcodeGen guesses a build phase from the extension. Executables without extension are left alone, but being explicit with `buildPhase: copyFiles` documents intent.
+
+## 6. Build script phases with proper inputs/outputs
+
+Scripts without declared inputs/outputs re-run every build and break incremental builds — declare them:
+
+```yaml
+targets:
+  MyApp:
+    type: application
+    platform: iOS
+    sources: [MyApp]
+    preBuildScripts:
+      - name: Generate Protos
+        script: |
+          ./scripts/generate-protos.sh
+        inputFiles:
+          - $(SRCROOT)/Protos/messages.proto
+        outputFiles:
+          - $(DERIVED_FILE_DIR)/Messages.pb.swift
+        basedOnDependencyAnalysis: true
+    postBuildScripts:
+      - name: SwiftLint
+        script: swiftlint
+        showEnvVars: false
+      - name: Crash Reporter Upload
+        script: ./scripts/upload-dsyms.sh
+        runOnlyWhenInstalling: true
+```
+
+## 7. Splitting a big spec across files
+
+`include` merges additively (dicts merge, arrays append); add `:REPLACE` to overwrite a list instead of appending to it.
+
+```yaml
+# project.yml
+name: MyApp
+include:
+  - project/targets.yml
+  - project/schemes.yml
+options:
+  bundleIdPrefix: com.example
+```
+
+```yaml
+# project/targets.yml
+targets:
+  MyApp:
+    type: application
+    platform: iOS
+    sources: [MyApp]
+  MyAppTests:
+    type: bundle.unit-test
+    platform: iOS
+    sources: [MyAppTests]
+    dependencies:
+      - target: MyApp
+```
+
+Use `xcodegen dump --spec project.yml` to inspect the merged result when an override doesn't behave.
diff --git a/.codegraph/.gitignore b/.codegraph/.gitignore
new file mode 100644
index 000000000..d20c0fe4b
--- /dev/null
+++ b/.codegraph/.gitignore
@@ -0,0 +1,5 @@
+# CodeGraph data files — local to each machine, not for committing.
+# Ignore everything in .codegraph/ except this file itself, so transient
+# files (the database, daemon.pid, sockets, logs) never show up in git.
+*
+!.gitignore
diff --git a/.codex/.gitignore b/.codex/.gitignore
new file mode 100644
index 000000000..30e723611
--- /dev/null
+++ b/.codex/.gitignore
@@ -0,0 +1,2 @@
+config.toml
+hooks.json
diff --git a/.github/ISSUE_TEMPLATE/Bug_report.md b/.github/ISSUE_TEMPLATE/Bug_report.md
deleted file mode 100644
index 0d5b07841..000000000
--- a/.github/ISSUE_TEMPLATE/Bug_report.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-
----
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
-
-**System and Shadowsocksx-NG version: (please complete the following information):**
- - OS Version: [e.g. 10.13.1]
- - Version [e.g. 22]
-
-**Diagnoisis file:**
-
-Please first upgrade to the latest version.
-Then export the diagnosis file and upload it to here.
-
-**ss-local.log**
-
-Please upload the ss-local.log file here the file is in `~/Library/Logs`
-1) Open 'Advanced Settings -> enable Verbose Mode'
-2) Continue run `Shadowsocksx-NG` for 5 minutes
-3) Upload the `~/Library/Logs/ss-local.log` here (with or without compress)
-
-**Application log**
-
-Open the `Console.app` and search `Shadowsocksx-NG`
-Copy paste the log here
-
-**Crash Log**
-
-If the app crashes and pop up a crash log, please copy and paste here
-
-**Additional context**
-Add any other context about the problem here.
diff --git a/.github/ISSUE_TEMPLATE/Feature_request.md b/.github/ISSUE_TEMPLATE/Feature_request.md
deleted file mode 100644
index 538429512..000000000
--- a/.github/ISSUE_TEMPLATE/Feature_request.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.
diff --git a/.github/actions/setup-ng2/action.yml b/.github/actions/setup-ng2/action.yml
new file mode 100644
index 000000000..1e41f3aa8
--- /dev/null
+++ b/.github/actions/setup-ng2/action.yml
@@ -0,0 +1,88 @@
+name: Set up NG2 dependencies
+description: Install Homebrew tools and optionally fetch verified external binaries.
+inputs:
+  packages:
+    description: Space-separated Homebrew formulae to install.
+    default: age go-task xcodegen swiftlint
+  external-binaries:
+    description: Whether to fetch and verify external binaries.
+    default: 'true'
+runs:
+  using: composite
+  steps:
+    - name: Prepare Homebrew download cache
+      shell: bash
+      env:
+        HOMEBREW_PACKAGES: ${{ inputs.packages }}
+      id: homebrew-cache-key
+      run: |
+        read -r -a packages <<< "$HOMEBREW_PACKAGES"
+        brew info --json=v2 "${packages[@]}" > "$RUNNER_TEMP/homebrew-formulae.json"
+        formula_hash=$(python3 - "$RUNNER_TEMP/homebrew-formulae.json" <<'PY'
+        import hashlib
+        import json
+        import sys
+
+        with open(sys.argv[1]) as source:
+            formulae = json.load(source)["formulae"]
+        versions = sorted(
+            (f["full_name"], f["versions"]["stable"], f["revision"], f["bottle"])
+            for f in formulae
+        )
+        print(hashlib.sha256(json.dumps(versions, sort_keys=True).encode()).hexdigest())
+        PY
+        )
+        echo "path=$(brew --cache)/downloads" >> "$GITHUB_OUTPUT"
+        echo "key=ng2-homebrew-downloads-v1-macos-$(sw_vers -productVersion)-$(uname -m)-$formula_hash" >> "$GITHUB_OUTPUT"
+
+    - name: Restore Homebrew download cache
+      id: homebrew-cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.homebrew-cache-key.outputs.path }}
+        key: ${{ steps.homebrew-cache-key.outputs.key }}
+
+    - name: Install build tools and test dependencies
+      id: install-build-tools
+      shell: bash
+      env:
+        HOMEBREW_PACKAGES: ${{ inputs.packages }}
+        HOMEBREW_NO_AUTO_UPDATE: '1'
+        HOMEBREW_NO_INSTALL_CLEANUP: '1'
+      run: |
+        read -r -a packages <<< "$HOMEBREW_PACKAGES"
+        brew install "${packages[@]}"
+
+    - name: Save Homebrew download cache
+      if: steps.install-build-tools.outcome == 'success' && steps.homebrew-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.homebrew-cache-key.outputs.path }}
+        key: ${{ steps.homebrew-cache.outputs.cache-primary-key }}
+
+    - name: Restore external binary archive cache
+      if: inputs.external-binaries == 'true'
+      id: external-binary-cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ShadowsocksX-NG2/.build/external-binary-archives
+        key: ng2-external-binaries-macos-arm64-${{ hashFiles('ShadowsocksX-NG2/Vendor/*/manifest.json') }}
+        restore-keys: |
+          ng2-external-binaries-macos-arm64-
+
+    - name: Fetch and verify external binaries
+      if: inputs.external-binaries == 'true'
+      shell: bash
+      id: fetch-external-binaries
+      working-directory: ShadowsocksX-NG2
+      env:
+        EXTERNAL_BINARY_CACHE_DIR: ${{ github.workspace }}/ShadowsocksX-NG2/.build/external-binary-archives
+      run: Scripts/fetch-external-binaries.sh
+
+    - name: Save external binary archive cache
+      if: inputs.external-binaries == 'true' && steps.fetch-external-binaries.outcome == 'success' && steps.external-binary-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ShadowsocksX-NG2/.build/external-binary-archives
+        key: ${{ steps.external-binary-cache.outputs.cache-primary-key }}
+
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..ca79ca5b4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
deleted file mode 100644
index 1c223c1f1..000000000
--- a/.github/workflows/main.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-name: CI
-
-on: [push,pull_request]
-
-jobs:
-  build:
-
-    runs-on: macos-10.15
-    
-    steps:
-    - uses: actions/checkout@v1
-    - name: Run unit test
-      run: |
-        set -o pipefail && xcodebuild test -workspace ShadowsocksX-NG.xcworkspace -scheme ShadowsocksX-NG|xcpretty
diff --git a/.github/workflows/shadowsocksx-ng2-ci.yml b/.github/workflows/shadowsocksx-ng2-ci.yml
new file mode 100644
index 000000000..2eb1a411a
--- /dev/null
+++ b/.github/workflows/shadowsocksx-ng2-ci.yml
@@ -0,0 +1,113 @@
+name: ShadowsocksX-NG2 CI
+
+on:
+  pull_request:
+    branches: [develop, master]
+    paths:
+      - "ShadowsocksX-NG2/**"
+  push:
+    branches: [develop, master]
+    paths:
+      - "ShadowsocksX-NG2/**"
+  workflow_dispatch:
+    paths:
+      - "ShadowsocksX-NG2/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ng2-ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    working-directory: ShadowsocksX-NG2
+
+jobs:
+  style:
+    name: Style (Xcode 27 arm64)
+    runs-on: xcode-27
+    timeout-minutes: 60
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up dependencies
+        uses: ./.github/actions/setup-ng2
+        with:
+          packages: go-task swiftlint
+          external-binaries: 'false'
+
+      - name: Check Swift formatting
+        run: task --exit-code validate -- format:check
+
+      - name: Lint
+        run: task --exit-code validate -- lint
+
+      - name: Upload failed validation evidence
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: validation-${{ github.job }}
+          path: ShadowsocksX-NG2/.build/validation/
+          include-hidden-files: true
+          retention-days: 7
+          if-no-files-found: warn
+
+  build-test:
+    name: Build and test (Xcode 27 arm64)
+    runs-on: xcode-27
+    timeout-minutes: 60
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up dependencies
+        uses: ./.github/actions/setup-ng2
+
+      - name: Build
+        run: task --exit-code validate -- build
+
+      - name: Test
+        run: task --exit-code validate -- test
+
+      - name: Upload failed validation evidence
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: validation-${{ github.job }}
+          path: ShadowsocksX-NG2/.build/validation/
+          include-hidden-files: true
+          retention-days: 7
+          if-no-files-found: warn
+
+  smoke:
+    name: Smoke tests (Xcode 27 arm64)
+    runs-on: xcode-27
+    timeout-minutes: 60
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up dependencies
+        uses: ./.github/actions/setup-ng2
+
+      - name: Smoke tests
+        run: task --exit-code validate -- test:smoke
+
+      - name: Upload failed validation evidence
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: validation-${{ github.job }}
+          path: ShadowsocksX-NG2/.build/validation/
+          include-hidden-files: true
+          retention-days: 7
+          if-no-files-found: warn
diff --git a/.github/workflows/shadowsocksx-ng2-codeql.yml b/.github/workflows/shadowsocksx-ng2-codeql.yml
new file mode 100644
index 000000000..c156da5b1
--- /dev/null
+++ b/.github/workflows/shadowsocksx-ng2-codeql.yml
@@ -0,0 +1,82 @@
+name: ShadowsocksX-NG2 CodeQL
+
+on:
+  push:
+    branches: [develop, master]
+    paths:
+      - "ShadowsocksX-NG2/**"
+  pull_request:
+    branches: [develop, master]
+    paths:
+      - "ShadowsocksX-NG2/**"
+  schedule:
+    - cron: '30 2 * * 1'
+  workflow_dispatch:
+    paths:
+      - "ShadowsocksX-NG2/**"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze-interpreted:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, python]
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5895b2c9be147bc7f1c75ce72c5cb577febb1907 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@5895b2c9be147bc7f1c75ce72c5cb577febb1907 # v4
+        with:
+          category: /language:${{ matrix.language }}
+
+  analyze:
+    name: Analyze Swift
+    # CodeQL build tracing does not support macOS 27 or Xcode 27.
+    runs-on: macos-26
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_26.4.1.app/Contents/Developer
+    timeout-minutes: 60
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up dependencies
+        uses: ./.github/actions/setup-ng2
+        with:
+          packages: age go-task xcodegen
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5895b2c9be147bc7f1c75ce72c5cb577febb1907 # v4
+        with:
+          languages: swift
+          build-mode: manual
+
+      - name: Build
+        working-directory: ShadowsocksX-NG2
+        run: >-
+          task build
+          BUILD_DESTINATION=generic/platform=macOS
+          BUILD_ALLOW_DEPRECATED=1
+          DERIVED_DATA_DIR="$(mktemp -d "${RUNNER_TEMP}/codeql-derived-data.XXXXXX")"
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@5895b2c9be147bc7f1c75ce72c5cb577febb1907 # v4
+        with:
+          category: /language:swift
diff --git a/.gitignore b/.gitignore
index 46e0a406b..c28d8eafc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,3 +69,42 @@ profile
 Carthage/Build
 
 IDEWorkspaceChecks.plist
+
+####
+# Local agent scratch space (local-markdown issue tracker; see docs/agents/issue-tracker.md)
+.scratch/
+
+####
+# New project build artifacts
+ShadowsocksX-NG2/.build/
+ShadowsocksX-NG2/dist/
+ShadowsocksX-NG2/DerivedData/
+
+####
+# NG2 generated build files (project.yml is the source of truth; run `xcodegen generate`)
+ShadowsocksX-NG2/*.xcodeproj
+# 本机签名身份（DEVELOPMENT_TEAM），构建期由 Configs/Signing.xcconfig 可选包含
+ShadowsocksX-NG2/Configs/Signing.local.xcconfig
+ShadowsocksX-NG2/App/Resources/Info.plist
+ShadowsocksX-NG2/App/Resources/ShadowsocksX-NG2.entitlements
+ShadowsocksX-NG2/Tests/Info.plist
+ShadowsocksX-NG2/Tests/Smoke/Info.plist
+
+####
+# NG2 external binary cache (fetched & hash-verified by
+# ShadowsocksX-NG2/Scripts/fetch-external-binaries.sh; manifests are committed)
+ShadowsocksX-NG2/Vendor/sslocal/sslocal
+ShadowsocksX-NG2/Vendor/sslocal/.fetched.sha256
+ShadowsocksX-NG2/Vendor/v2ray-plugin/v2ray-plugin
+ShadowsocksX-NG2/Vendor/v2ray-plugin/.fetched.sha256
+ShadowsocksX-NG2/Vendor/ck-client/ck-client
+ShadowsocksX-NG2/Vendor/ck-client/.fetched.sha256
+
+###
+# dotenv file
+.env
+
+###
+# cmux omx
+.omx
+
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 000000000..052f46683
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,27 @@
+minimum_pre_commit_version: "3.2.0"
+
+repos:
+  - repo: local
+    hooks:
+      - id: ng2-swift-format
+        name: Format staged NG2 Swift files
+        entry: swift format format --in-place --configuration ShadowsocksX-NG2/.swift-format
+        language: system
+        files: ^ShadowsocksX-NG2/.*\.swift$
+        stages: [pre-commit]
+
+      - id: ng2-swift-format-check
+        name: Check NG2 Swift formatting and style
+        entry: task --dir ShadowsocksX-NG2 format:check
+        language: system
+        files: ^ShadowsocksX-NG2/.*\.swift$
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: ng2-swiftlint
+        name: Lint staged NG2 Swift files
+        entry: swiftlint lint --config ShadowsocksX-NG2/.swiftlint.yml --no-cache --quiet
+        language: system
+        files: ^ShadowsocksX-NG2/.*\.swift$
+        stages: [pre-commit]
+        verbose: true
diff --git a/.zcodeignore b/.zcodeignore
new file mode 100644
index 000000000..2ce6b572e
--- /dev/null
+++ b/.zcodeignore
@@ -0,0 +1,112 @@
+#####
+# OS X temporary files that should never be committed
+.DS_Store
+*.swp
+*.lock
+profile
+
+####
+# Xcode temporary files that should never be committed
+*~.nib
+
+####
+# Objective-C/Swift specific
+*.hmap
+*.ipa
+
+####
+# Xcode build files
+DerivedData/
+build/
+Builds/
+
+#####
+# Xcode private settings (window sizes, bookmarks, breakpoints, custom executables, smart groups)
+*.pbxuser
+*.mode1v3
+*.mode2v3
+*.perspectivev3
+!default.pbxuser
+!default.mode1v3
+!default.mode2v3
+!default.perspectivev3
+
+####
+# Xcode 4
+xcuserdata
+!xcschemes
+# Xcode 4
+*.moved-aside
+
+####
+# XCode 4 workspaces - more detailed
+!xcshareddata
+!default.xcworkspace
+*.xcworkspacedata
+
+
+####
+# Xcode 5
+*.xccheckout
+*.xcuserstate
+
+####
+# Xcode 7
+*.xcscmblueprint
+
+####
+# AppCode
+.idea/
+
+####
+# Other Xcode files
+profile
+*.hmap
+*.ipa
+
+####
+# Carthage
+Carthage/Build
+
+IDEWorkspaceChecks.plist
+
+####
+# Local agent scratch space (local-markdown issue tracker; see docs/agents/issue-tracker.md)
+.scratch/
+
+####
+# New project build artifacts
+ShadowsocksX-NG2/.build/
+ShadowsocksX-NG2/DerivedData/
+
+# ===== ↑ 以上同步自 .gitignore（「从 .gitignore 同步」只重写以上部分）=====
+.git/
+.hg/
+.svn/
+node_modules/
+bower_components/
+jspm_packages/
+__pycache__/
+site-packages/
+venv/
+coverage/
+htmlcov/
+lcov-report/
+cmakefiles/
+cmake-build-*/
+bazel-*/
+pods/
+deriveddata/
+storybook-static/
+playwright-report/
+test-results/
+allure-results/
+allure-report/
+cdk.out/
+*.egg-info/
+*.dist-info/
+eggs/
+pip-wheel-metadata/
+wheels/
+# ----- ↑ 以上为 ZCode 默认排除规则（自定义规则请写在本行下方，不会被同步/恢复改动）-----
+# 自定义规则写在下方（本行提示可删除）
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000..a45d93bce
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,55 @@
+# ShadowsocksX-NG
+
+A macOS Shadowsocks client. The legacy implementation has been removed from this repository and archived on the [`legacy-v1`](https://github.com/shadowsocks/ShadowsocksX-NG/tree/legacy-v1) branch of [shadowsocks/ShadowsocksX-NG](https://github.com/shadowsocks/ShadowsocksX-NG) for read-only reference. The new implementation lives in `ShadowsocksX-NG2/`. Links to legacy source code in documentation and comments must point to that branch.
+
+## Agent skills
+
+### Local validation
+
+When validating ShadowsocksX-NG2 changes or diagnosing local validation artifacts, read the [local validation skill](.agents/skills/shadowsocksx-ng2-local-validation/SKILL.md). The repository copy is maintained; copies with the same name in memory are historical snapshots.
+
+### Git commits
+
+Write commit messages in English using Conventional Commits.
+
+### Issue tracker
+
+Issue tracker configuration is contributor-local.
+
+Before using an issue-tracking skill:
+
+1. Resolve the Git common directory:
+
+   `git rev-parse --path-format=absolute --git-common-dir`
+
+2. Read `<git-common-dir>/agent/issue-tracker.md`.
+
+3. Follow the tracker configuration found there.
+
+If the file does not exist, ask the contributor to
+configure their preferred tracker.
+
+Never assume GitHub Issues is the default.
+Never commit personal tracker configuration.
+Never reference personal tracker issues or tasks in code, commit messages, pull requests, or GitHub comments.
+
+### Triage labels
+
+Use the five default role names as triage label strings: `needs-triage`, `needs-info`, `ready-for-agent`, `ready-for-human`, and `wontfix`. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Use a single context: one root `GLOSSARY.md` plus `docs/adr/`, created on demand. See `docs/agents/domain.md`.
+
+Write the body of `GLOSSARY.md` and new ADRs in Simplified Chinese, retaining code identifiers and necessary English terms. Existing ADRs retain their original language.
+
+Current code, `GLOSSARY.md`, and `docs/adr/` define the current state and accepted designs. Only `GLOSSARY.md` and `docs/adr/` are continuously maintained as current documentation; use current code as the source of truth for implementation behavior. Before using a design document or research report as an implementation basis, verify the relevant descriptions against the code.
+
+`docs/design/` records requirements, designs, and specifications at the time of each task. It is historical reference and does not represent the latest implementation.
+
+`docs/research/` contains research reports. Each report records upstream capabilities, candidate solutions, and conclusions at the time of writing. It does not describe the project's current state or establish that a design has been adopted.
+
+## Contribution Guidelines
+
+Follow the project's CONTRIBUTING.md for all contributions, including AI-assisted development.
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 000000000..22eeb7d79
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,96 @@
+# Contributing to ShadowsocksX-NG
+
+Thanks for your interest in contributing to ShadowsocksX-NG.
+
+ShadowsocksX-NG2 is a new native macOS client, developed separately from the legacy 1.x application. Work on NG2 takes place in `ShadowsocksX-NG2/` on the `develop` branch. The legacy 1.x source is available on the [`legacy-v1` branch](https://github.com/shadowsocks/ShadowsocksX-NG/tree/legacy-v1).
+
+## Current contribution status
+
+NG2 is still under development. New GitHub Issues and pull requests are temporarily restricted until the v2 code is stable and officially released, as noted in the [project README](README.md). Until then, use [GitHub Discussions](https://github.com/shadowsocks/ShadowsocksX-NG/discussions) for bug reports, questions, feedback, and feature suggestions. Keep NG2 reports out of unrelated legacy 1.x issues.
+
+The guidelines below describe the contribution process once Issues and pull requests are open. The current restrictions still apply.
+
+## Before proposing a change
+
+Check existing Discussions, Issues, and documentation for related work. Small fixes and documentation improvements usually need less coordination. Discuss substantial features, protocol or configuration changes, system-proxy behavior, security-sensitive changes, and architectural refactoring before starting implementation.
+
+Explain the problem and the behavior you want to change. Maintainers may suggest another approach or decline changes outside the project's scope.
+
+## Development setup
+
+NG2 targets macOS 15 or later on Apple Silicon (arm64). Build and test with the Xcode/Swift toolchain, [Task](https://taskfile.dev/), XcodeGen, and SwiftLint. The [Development, Build, and Testing guide](docs/development.md) lists exact tool versions, prerequisites, and troubleshooting.
+
+From the repository root:
+
+```sh
+cd ShadowsocksX-NG2
+Scripts/fetch-external-binaries.sh
+task gen:prj
+task build
+```
+
+Fetch and verify external binaries before generating the Xcode project. `project.yml` defines Xcode project configuration and is the source of truth for the generated `.xcodeproj`. Debug builds use ad-hoc signing by default. Ordinary development and unit tests do not require a Developer ID certificate.
+
+## Quality and testing
+
+Keep changes focused and easy to review. Preserve existing behavior unless an intentional change has been agreed upon. Add or update tests when behavior changes, especially for regressions, configuration persistence, networking, process lifecycle, encryption, and system-proxy control.
+
+From the repository root, run:
+
+```sh
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml validate
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml format:check
+```
+
+The default validation sequence runs lint, unit tests, and a Debug build. Run real-process smoke tests separately with `task test:smoke` from `ShadowsocksX-NG2/`. Run the checks relevant to your changes, and explain any checks you skip. CI also runs formatting checks and separate test and smoke-test jobs.
+
+Follow the repository's Swift formatting and SwiftLint configuration. Prefer Swift Testing for new unit tests. Use XCTest when you need its UI-testing or performance APIs. Keep tests deterministic and isolated from real user configurations, credentials, and shared fixed ports. See [the development guide](docs/development.md) for test conventions and validation evidence.
+
+## Architecture and dependencies
+
+Before changing component boundaries or established behavior, read the [project structure guide](docs/project-structure.md), [glossary](GLOSSARY.md), and relevant [architecture decision records](docs/adr/). Check historical design and research documents against the current source code.
+
+Keep the boundaries clear between the SwiftUI app, domain code, background Agent, privileged helper, and bundled external executables. For changes to shared contracts, configuration formats, IPC, credentials, proxy routing, or packaging, describe compatibility and migration implications. Check licenses and provenance for new or updated third-party dependencies and binaries. Follow the [distribution and supply-chain guide](docs/distribution.md) when adding them.
+
+## Pull requests
+
+When pull requests are enabled:
+
+- Target `develop` for NG2 changes unless a maintainer requests another branch.
+- Keep each pull request focused on one coherent change, with unrelated refactoring separated where practical.
+- Describe the motivation, user-visible impact, implementation, and any compatibility or security considerations.
+- Summarize the tests you ran and their results. Explain checks you could not run.
+- Include screenshots or recordings for visible UI changes when helpful.
+- Link relevant **public GitHub Issues** when applicable; an Issue is not required for every small fix.
+- Address review feedback constructively. Maintainers decide whether and when a change is merged.
+
+Use English [Conventional Commits](https://www.conventionalcommits.org/) for commit messages, consistent with [`AGENTS.md`](AGENTS.md).
+
+## Public issue tracking and personal workflows
+
+GitHub Issues is the project's official tracker for public bug reports, feature requests, and contributor coordination when enabled. While Issues are restricted, use GitHub Discussions as described above.
+
+Use any tools you prefer for private planning and task management, including Beads, local Markdown files, or other trackers. The project does not require a particular issue tracker, AI agent, IDE, or worktree workflow. Internal tasks are not public project Issues, do not set project priorities, and do not establish maintainer commitments.
+
+Keep contributor-specific tracker configuration and internal task data out of tracked repository files. Never reference personal tracker issues, task IDs, or internal task links in source-code comments, commit messages, public GitHub Issues, pull requests, or GitHub comments. Use a relevant public GitHub Issue or Discussion as the shared reference. Write a clear, self-contained change description that reviewers can understand without internal task history.
+
+AI-assisted contributions follow the same standards as other contributions. Contributors are responsible for understanding, reviewing, and testing all code and content they propose, and for having the right to submit it. Keep secrets, user data, and confidential information out of external tools and submitted artifacts.
+
+## Security reports
+
+Do not report suspected security vulnerabilities in public Issues or Discussions. If GitHub's private vulnerability reporting mechanism is enabled for this repository, use it. Otherwise, contact the maintainers privately before sharing exploit details. Keep real server credentials, subscription URLs, private keys, and unredacted diagnostic logs out of public reports.
+
+## License and conduct
+
+Contributions must be compatible with the repository's [GNU GPL version 3 license](LICENSE). Submit only code, assets, and dependencies you have the right to contribute. Retain applicable copyright and third-party notices.
+
+Be respectful and constructive. Assume good intent, focus reviews on technical merits, and keep discussions useful to contributors with different levels of experience.
+
+## Further reading
+
+- [Project README](README.md)
+- [NG2 developer overview](ShadowsocksX-NG2/README.md)
+- [Development and validation](docs/development.md)
+- [Project structure](docs/project-structure.md)
+- [Architecture decisions](docs/adr/)
+- [Signing and distribution](docs/distribution.md)
diff --git a/GLOSSARY.md b/GLOSSARY.md
new file mode 100644
index 000000000..340f0f980
--- /dev/null
+++ b/GLOSSARY.md
@@ -0,0 +1,318 @@
+# ShadowsocksX-NG
+
+本领域涵盖 macOS Shadowsocks 客户端的服务器配置、订阅、代理规则与代理控制，以及用户管理这些内容的工作区。术语用于统一产品讨论与代码中的概念，英文名称保留为检索对应。
+
+## 领域术语
+
+### 配置与订阅
+
+**服务器库（Server library）**：
+用户持久保存的完整配置目录、订阅关联、收藏与所需凭据的集合。它不同于为后台代理服务生成的运行配置，也不同于单个配置组的导出快照。
+
+**配置目录（Configuration catalog）**：
+服务器配置与配置组组成的有序树的根，根本身不作为用户可见的配置组。
+
+**服务器配置（Server configuration）**：
+一个 Shadowsocks 服务器的连接资料，包含用户可见名称、来源归属和持久身份，是配置目录中的叶节点。
+
+**配置组（Configuration group）**：
+具有名称和子节点顺序的容器，可包含服务器配置和嵌套配置组；每个节点最多属于一个父节点，组之间不形成环。
+
+**收藏（Favorite）**：
+用户对一个服务器配置或配置组的独立标记，不改变节点的来源或目录位置，也不包含对其后代的标记。
+
+**收藏列表（Favorites list）**：
+用户排列的收藏节点序列，每个节点最多出现一次，配置组与服务器配置均作为单独一项，不展开后代。
+
+**节点时间戳（Node timestamps）**：
+配置目录中每个节点（服务器配置或配置组）的创建时间与修改时间事实。创建时间是节点进入目录的时刻；修改时间是节点自身资料、或分组的直接子节点集合与顺序最后一次变化的时刻，移动节点本身不算修改。历史文档未记录的时间是未知事实，不做回填。
+
+**配置组导出（Configuration group export）**：
+用户请求生成的可分享文件快照，包含一个配置组及其全部后代的连接资料和所需凭据。它可以包含不具备激活条件的服务器配置。
+
+**配置组分享（Configuration group share）**：
+通过 SIP-008 JSON 文件或逐行 `ss://` URI 列表（文本文件或剪贴板）传递一个配置组及其全部后代服务器的连接资料和所需凭据，供其他客户端使用。URI 列表不保留分组结构。
+
+**服务器分享（Server share）**：
+通过二维码（屏幕显示、复制图片或保存图片文件）或剪贴板传递单个服务器配置的 `ss://` URI，供其他设备使用。
+_避免用词_：导出（导出指配置组或诊断报告等文件快照）。
+
+**服务器导入（Server import）**：
+把剪贴板文本或文件中的服务器配置引入配置目录、形成独立手动子树的操作。来源资料中的标识只用于装配其内部结构，导入产生的每个节点都获得全新的本地持久身份；同一资料重复导入产生相互独立的服务器配置，不与既有节点合并或去重。
+
+**节点复制（Node duplication）**：
+在原节点之后的同级位置创建独立手动副本。组复制包含整棵子树，保留层级、顺序、连接字段、所需凭据和空组；所有节点获得全新身份，副本与原节点的凭据修改互不影响。支持手动服务器、手动组和根层订阅组，不支持订阅服务器或嵌套订阅子组。订阅副本不携带订阅来源资料；顶层副本名称加本地化后缀并在同级重名时追加序号；名称末尾已有“副本”或“Copy”（含编号）时沿用该后缀，以同级未占用的编号命名，避免重复追加后缀。目录和凭据作为一次逻辑变更提交，失败不发布部分子树或凭据变更。复制不切换活动目标；在活动组内新增的副本按普通目录变更进入运行时收敛。
+
+**导入来源（Import source）**：
+一次服务器导入中可独立处理的一份资料，例如剪贴板文本或单个文件。每个来源独立解码、独立提交，是成功、部分成功与失败报告的粒度单位；一个来源失败不影响其他来源。
+
+**服务器表单草稿（Server form draft）**：
+用户创建或编辑一个服务器配置时，尚未保存的连接字段集合。
+
+**插件参数草稿（Plugin parameter draft）**：
+服务器表单中尚未保存的有序插件参数集合，每项包含参数名及可选值。无等号的标志与等号后的空值是不同的参数形式。
+
+**手动组（Manual group）**：
+用户拥有的配置组，其后代也由用户拥有。
+
+**订阅（Subscription）**：
+具有持久身份的远程配置来源，对应一个固定的订阅组；订阅 URL 是可修改的访问地址，而非来源身份。
+
+**订阅资料（Subscription information）**：
+供应商随订阅提供的已用流量、剩余流量、服务到期时间与流量重置时间等事实。它不包含服务器连接资料、凭据或完整订阅响应。
+
+**订阅自动更新（Subscription automatic update）**：
+GUI 应用运行期间，按订阅的生效设置定期获取远程配置的行为。仅保留菜单栏也属于应用运行。
+
+**供应商自动更新策略（Provider automatic update policy）**：
+订阅供应商提供的自动更新设置（关闭、每天或每周）及是否允许用户覆盖的约束。允许覆盖时用户可选择本地设置或跟随供应商；禁止覆盖时供应商设置生效。
+
+**下次计划更新时间（Next scheduled update time）**：
+订阅下一次自动更新到期的时刻，与最后成功更新时间不同。自动更新关闭时没有该计划。
+
+**订阅组（Subscription group）**：
+一个订阅拥有的配置子树，内容和结构以远程资料为准，用户不能在本地覆盖其成员、名称或连接字段。
+
+**可删除节点（Deletable node）**：
+用户拥有且可从配置目录删除的服务器配置或手动组。移除订阅属于订阅管理，与删除节点是不同的操作。
+_避免用词_：可移除节点（Removable node）。
+
+**活动目标（Active target）**：
+用户选定并保存的代理目标，可以是服务器配置或配置组；选择配置组时，目标仍是该组，而非实际被选用的后代服务器。列表呈现上，活动目标自身标记实心闪电；子树内含活动目标的配置组标记空心闪电。
+
+**激活候选（Activation candidate）**：
+没有已知本地阻断问题、可用于生成代理配置的服务器配置。它不保证远程可达，也不表示插件参数已经验证有效。
+
+**服务器连通性测试（Server connectivity test）**：
+用户手动请求，经指定服务器配置向测试 URL 发起应用 TCP 请求并检查响应的操作。测试经过该配置的实际传输路径，包括使用 UDP 传输的插件隧道；它不验证应用 UDP 中继。
+
+**测试 URL（Connectivity test URL）**：
+服务器连通性测试请求访问的目标地址，是用户可修改的非敏感偏好信息，在展示、日志与诊断中无需脱敏。
+
+**代理响应延迟（Proxy response latency）**：
+完成目标地址选择与预热后，经指定服务器配置访问测试 URL 的 HTTP 响应头耗时，以成功样本的中位数表示。结果保留测试时间，不按固定时长或网络变化自动判为过期，用户结合测试时间自行判断参考价值。它与测试目标及测试条件有关，不表示服务器 IP 的纯网络往返时间或下载速度。
+
+**配置组最快响应延迟（Fastest group response latency）**：
+配置组全部后代服务器最近一次测试结果中的成功项，其最小代理响应延迟。最近一次结果失败的服务器不贡献更早的成功结果；汇总不按测试时间排除结果。它不表示活动配置组实际选用的服务器或负载均衡后的响应耗时。
+
+**托管插件（Managed plugin）**：
+由产品随应用发布的 SIP003 插件，其发布版本与来源事实属于随应用提供的程序，不代表用户自备的同名程序。
+
+**插件记录（Plugin record）**：
+一份可由多个名称引用的本机插件资料，包含可执行程序的选择、共享的本地启动参数与插件传输模式；用户记录具有独立于名称的持久身份。
+
+**插件传输模式（Plugin transport mode）**：
+一条插件记录承载的传输协议范围：`tcp_only` 表示插件仅承载 TCP，`tcp_and_udp` 表示插件承载 TCP 与 UDP。它不表示插件已经具备 SIP003u 支持，也不同于本地 SOCKS5 端点的 UDP 中继能力。
+
+**插件别名（Plugin alias）**：
+引用同一插件记录的名称之一。同一记录的名称共享程序、本地启动参数与插件传输模式，服务器资料保留自己使用的名称。
+
+**本地插件启动参数（Local plugin arguments）**：
+当前 macOS 用户为一条插件记录设置的有序命令行参数，由所有引用该记录的服务器共享。它与服务器连接资料中的插件选项不同，不随服务器资料分享。
+
+**用户插件映射（User plugin mapping）**：
+当前 macOS 用户维护的插件名称与本机插件记录之间的对应关系。同名映射覆盖托管插件的默认选择，但不改写服务器配置中的插件引用。
+
+**有效插件目录（Effective plugin catalog）**：
+由当前应用提供的托管插件与用户插件映射共同确定的插件名称、实际来源与可用性事实集合。失效的用户映射仍保留其覆盖关系，不自动退回同名托管插件。
+
+**旧版配置（Legacy configuration）**：
+冻结的旧版客户端保存的服务器列表与偏好设置。
+
+**旧版导入（Legacy import）**：
+经用户确认，将旧版服务器资料转换为新客户端独立手动组的操作。它只迁移服务器资料，保留旧版来源和新客户端现有偏好设置。
+
+### 代理规则
+
+**代理模式（Proxy mode）**：
+用户选择的流量路由方式，包括规则模式、全局模式和直连模式。全局模式下公共目标默认经 Shadowsocks 转发，固定本地目标仍直连。
+
+**规则模式（Rule mode）**：
+由内置规则和自定义规则决定各目标代理或直连的路由模式；未匹配目标的处理方式由规则默认动作决定。
+
+**规则默认动作（Rule default action）**：
+规则模式下，没有规则匹配目标时采用的代理或直连动作。
+_避免用词_：回退（Fallback，含义不明确）。
+
+**规则方案（Rule preset）**：
+规则模式内，具有固定匹配后行动和未匹配行动的规则组合，也是自定义规则、规则停用、浏览与离线规则测试的归属范围，包括仅GFW列表内目标代理、中国大陆目标直连和中国大陆目标代理三项方案。内置规则与自定义规则的匹配后行动由所属方案统一决定，固定本地目标始终直连。
+_避免用词_：规则预设（产品名称统一使用规则方案）。
+
+**内置规则快照（Built-in rule snapshot）**：
+随应用发布的固定规则集，包含来源、归属与转换报告等资料。它只保留转换后可决定路由的规则，不保留被吸收或遮蔽而省略的上游条目。
+
+**自定义规则（Custom rule）**：
+用户拥有的、具有持久身份的规则，以精确域名、域名后缀或 IPv4/IPv6 地址范围作为匹配条件，匹配后行动由所属规则方案决定。列表顺序不代表路由优先级。
+_避免用词_：用户规则（User rule）。
+
+**自定义规则集合（Custom rule collection）**：
+一项规则方案独立拥有的自定义规则集合，仅在该方案下参与规则模式路由。切换方案保留各集合，修改一个集合不影响其他方案。
+
+**规则身份（Rule identity）**：
+规范化匹配条件与路由动作的组合，用于识别不同来源中的等价规则。它与可编辑自定义条目的持久身份不同，单个 IP 地址与其完整前缀长度的 CIDR 等价。
+
+**规则来源归属（Rule source membership）**：
+一个规则身份所属的全部来源；等价条目合并展示时仍保留各来源归属。
+
+**规则停用（Rule disablement）**：
+用户为一项规则方案保存的、跨该方案全部来源排除某个规则身份的选择，不影响其他方案；来源条目仍保留，覆盖同一目标的更宽规则也不因此被停用。固定本地绕过策略不能停用。
+
+**规则吸收（Rule absorption）**：
+同动作规则之间的覆盖关系，其中较宽规则使较窄规则在路由判定中冗余。它与反动作遮蔽不同，也不删除已保存的自定义规则。
+
+**规则遮蔽（Rule shadowing）**：
+动作相反的规则之间的覆盖关系，可以是全部或部分覆盖，也可以涉及固定本地绕过策略。它与同动作吸收不同，也不表示规则已在运行中生效。
+
+**快照转换报告（Snapshot conversion report）**：
+生成内置规则快照时记录的转换、吸收、跳过与拒绝数量。它描述快照生成时的结果，而非当前规则集合的覆盖关系或运行状态。
+
+**离线规则测试（Offline rule test）**：
+针对域名、IP 地址或 URL 主机，依据指定规则方案的规则和默认动作，解释代理或直连结论及其原因的操作。各方案的测试状态相互独立，结果不受浏览筛选、实际代理模式或运行状态影响；测试不解析 DNS，也不测试连通性。
+
+### 代理控制与网络
+
+**代理模式选择器（Proxy mode selector）**：
+用户选择规则、全局或直连模式的统一入口，与代理服务开关、系统代理开关和自定义规则管理分别对应不同意图。
+
+**代理服务开关（Agent switch）**：
+用户保存的后台代理服务开启或关闭意图，与服务当前是否健康不同。
+_避免用词_：代理开关（Proxy switch，与系统代理开关混淆）。
+
+**系统代理开关（System proxy switch）**：
+用户保存的、通过 macOS 系统代理设置使用本地代理入口的意图，与设置当前是否已应用或暂停不同。
+_避免用词_：代理开关（Proxy switch，与代理服务开关混淆）。
+
+**系统代理配置（System proxy configuration）**：
+macOS 网络服务上的设备级代理设置，由不同应用与用户账户共享。
+_避免用词_：全局代理配置（Global proxy configuration，与全局代理模式混淆）。
+
+**网络服务（Network service）**：
+macOS 中具有独立代理设置的命名网络配置项，包括当前未连接的项。它与物理接口及终端命令地址候选不同。
+
+**期望系统代理配置（Desired system proxy configuration）**：
+新客户端已保存设置所要求的代理值，与各网络服务上实际存在的值不同。
+
+**受管系统代理配置（Typed system proxy configuration）**：
+新客户端负责管理的 SOCKS、HTTP、HTTPS、PAC、自动发现、简单主机名排除和例外值的完整集合。
+_避免用词_：完整代理字典（Complete proxy dictionary，可能包含产品管理范围外的值）。
+
+**系统代理配置差异（System proxy configuration difference）**：
+网络服务上的受管代理值与期望系统代理配置之间当前存在的语义差异。它不表示历史变更，也不能证明由哪个应用造成。
+
+**系统代理修复（System proxy repair）**：
+用户明确请求将存在差异的网络服务对齐到期望系统代理配置的操作。
+_避免用词_：恢复（Restore，可能暗示恢复其他应用的旧值）。
+
+**系统代理暂停（System proxy suspension）**：
+后台代理服务或当前模式的出口不可用时，系统代理设置已清除、但系统代理意图仍开启的临时状态。清除失败属于清理失败，不属于成功暂停。
+
+**附加系统代理例外（Additional system-proxy exception）**：
+用户添加的主机名、域名、IP 地址或 CIDR，用于让 macOS 将对应流量排除在系统代理之外。它不改变固定本地绕过策略或代理规则。
+_避免用词_：绕过列表（Bypass list，混淆用户附加项与产品固定策略）。
+
+**固定本地绕过策略（Fixed local bypass policy）**：
+产品规定始终直连的本地 IP 范围与主机名，适用于系统代理和本地代理入口。用户可查看该策略，但不能通过附加系统代理例外修改它。
+
+**HTTP 代理入口（HTTP proxy inbound）**：
+后台代理服务提供的本地 HTTP/HTTPS 请求入口，与代理模式和旧版 Privoxy 适配器不同。
+_避免用词_：HTTP 代理模式（HTTP proxy mode）。
+
+**SOCKS5 UDP 中继（SOCKS5 UDP relay）**：
+SOCKS5 入口接受 UDP ASSOCIATE 流量并通过代理服务中继的能力。它不表示系统全部 UDP 流量都会被代理。
+_避免用词_：系统级 UDP 代理、自动 UDP 代理。
+
+**旧版 Privoxy 适配器（Legacy Privoxy adapter）**：
+冻结旧版中，将 HTTP(S) 请求桥接到本地 SOCKS5 的组件，仅属于旧版实现。
+
+**本地监听（Local listening）**：
+仅供本机使用的 SOCKS 与 HTTP 代理入口，始终随后台代理客户端提供服务。
+
+**局域网监听（LAN listening）**：
+供网络设备访问的附加 SOCKS 与 HTTP 代理入口，与本地监听共存并使用不同端口；它可以独立关闭。
+
+**代理监听配置（Proxy listening configuration）**：
+用户保存的本地与局域网代理入口配置，包含端口、局域网启用状态、监听模式、UDP 中继和身份验证资料。它不包含代理模式、代理服务开关、系统代理开关或附加系统代理例外，也不同于派生的运行配置文件。
+
+**局域网身份验证（LAN authentication）**：
+局域网 SOCKS 与 HTTP 入口共用的用户名和密码验证，不表示 UDP 中继具备同等保护。身份验证启用时，保存要求用户名和密码符合形状。身份验证关闭时凭据是保留值，不拦其他局域网设置的保存。
+
+**监听模式（Listener mode）**：
+局域网监听启用时采用的地址族选项，包括所有 IPv4 接口、所有 IPv4 与 IPv6 接口、所有 IPv6 接口；与是否启用局域网监听独立。
+_避免用词_：监听范围（Listen scope）。
+
+**HTTP 代理环境命令（HTTP proxy environment command）**：
+仅设置本机 HTTP/HTTPS 代理环境变量的终端命令，目标为本地监听入口。
+
+**终端代理环境命令（Terminal proxy environment commands）**：
+按目标 shell 语法设置 HTTP 与 SOCKS 代理环境变量及本地主机例外的命令。它只影响遵循这些环境变量的子进程。
+
+**终端命令地址（Terminal command address）**：
+复制的终端代理环境命令中，HTTP 与 SOCKS 入口共同使用的 IP 地址。它是当前应用会话内的选择，与监听设置和系统代理设置独立。
+
+**代理运行服务（Proxy runtime）**：
+为当前用户提供代理入口与外部隧道服务的后台服务，其生命周期独立于图形界面。
+
+**运行配置文件（Runtime configuration file）**：
+供外部隧道服务使用、由活动目标派生的连接配置，包含端点、凭据、加密、插件、监听与规则信息。它与用户管理的服务器配置和订阅文档不同。
+
+**运行状态收敛（Runtime convergence）**：
+将已部署的代理服务对齐到期望运行配置的过程，与保存用户配置意图是不同的概念。
+
+### 设置与工作区
+
+**第三方组件与许可证窗口（Third-party components and licenses window）**：
+从关于对话框打开的独立资料窗口，展示当前安装应用随包提供的第三方组件、来源、版本、许可证与附加声明。
+
+**登录项（Login item）**：
+图形界面应用在用户登录项中的系统注册，是独立的偏好设置。
+
+**独立保存设置项（Independently saved setting item）**：
+用户作为一个整体明确保存的设置或一组关联值，其保存边界不包含其他未保存设置。
+_避免用词_：即时编辑（Immediate edit，可能暗示每次按键都应用）。
+
+**系统级快捷键（System-level shortcut）**：
+用户可配置的键盘操作，即使应用未获得焦点也能触发应用动作。
+_避免用词_：全局热键（Global hotkey）、全局快捷键（Global shortcut）。
+
+**窗口内默认动作快捷键（Window-local default action shortcut）**：
+绑定到当前聚焦窗口或表单的键盘操作，例如确认对话框；它与系统级快捷键不同。
+
+**工作区页面（Workspace destination）**：
+单一工作区中的顶层位置，例如首页、服务器、代理规则或设置。它只表示导航位置，不包含节点选择或功能草稿。
+
+**工作区路由（Workspace route）**：
+从工作区或其他应用入口切换工作区页面的导航选择与意图，与用户配置和功能局部状态不同。
+
+**工作区窗口（Workspace window）**：
+承载工作区的唯一主窗口；关闭后可从状态菜单重新打开。
+
+**诊断窗口（Diagnostics window）**：
+由状态菜单或应用菜单“诊断…”入口显式打开的唯一独立窗口（两入口同开一窗），承载状态摘要、日志查看与复制、脱敏报告导出。关闭后停止诊断轮询，不影响代理运行和日志记录；日志过滤选择在本次应用运行内保留。
+
+**自适应应用形态（Adaptive app form）**：
+随工作区、独立规则报告窗口、诊断窗口、关于对话框和第三方组件与许可证窗口的开启状态变化的应用呈现方式：有窗口时显示 Dock 图标并参与应用切换，最后一个窗口关闭后仅保留菜单栏状态菜单。
+_避免用词_：菜单栏形态（Menu bar form，应用形态并非恒定）。
+
+**静默启动（Silent launch）**：
+启动时不显示工作区窗口、从菜单栏形态开始的用户偏好。它只影响窗口呈现，与代理服务恢复和登录项分别对应不同设置。
+
+### 凭据与诊断
+
+**敏感信息（Sensitive information）**：
+服务器密码、完整插件选项，以及用户提供的非空远程 URL，包括订阅 URL，但不包括测试 URL。
+
+**凭据暴露边界（Credential exposure boundary）**：
+产品降低意外泄露及向其他用户账户暴露凭据的保护范围。该范围不包含同一用户进程被攻破、root 访问或快照与备份，也不承诺安全擦除。
+
+**诊断报告（Diagnostic report）**：
+用户请求生成的脱敏文档，包含允许披露的运行状态、端点元数据、配置汇总及安全事件资料。它排除敏感信息、服务器地址、备注和原始日志。
+
+**诊断日志视图（Diagnostic log view）**：
+用户明确查看或复制界面事件与后台服务日志行的入口；行正文为脱敏后的原始文本，所展示的日志行不属于诊断报告。
+
+**系统日志（System log）**：
+本应用图形界面、后台服务与特权系统代理 helper 写入 macOS 统一日志系统、供用户在 Console.app 中按来源与类别过滤查看的本地事件流。它面向本地排错，不是诊断报告的内容来源，也不替代诊断日志视图的显式查看与复制；特权系统代理 helper 的事件只有这一个查看面，不进诊断日志视图。
+_避免用词_：os_log 输出（实现机制名，不是领域概念）。
+
+**诊断事实（Diagnostic facts）**：
+可供诊断报告使用的配置目录与代理服务汇总事实，已经脱敏，且不暴露配置条目或敏感信息。
diff --git a/LaunchHelper/LaunchHelper.xcodeproj/project.pbxproj b/LaunchHelper/LaunchHelper.xcodeproj/project.pbxproj
deleted file mode 100644
index 868f153d7..000000000
--- a/LaunchHelper/LaunchHelper.xcodeproj/project.pbxproj
+++ /dev/null
@@ -1,331 +0,0 @@
-// !$*UTF8*$!
-{
-	archiveVersion = 1;
-	classes = {
-	};
-	objectVersion = 46;
-	objects = {
-
-/* Begin PBXBuildFile section */
-		9B9F13921E8A282C00DE4794 /* AppDelegate.m in Sources */ = {isa = PBXBuildFile; fileRef = 9B9F13911E8A282C00DE4794 /* AppDelegate.m */; };
-		9B9F13951E8A282C00DE4794 /* main.m in Sources */ = {isa = PBXBuildFile; fileRef = 9B9F13941E8A282C00DE4794 /* main.m */; };
-		9B9F13971E8A282C00DE4794 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 9B9F13961E8A282C00DE4794 /* Assets.xcassets */; };
-		9B9F139A1E8A282C00DE4794 /* MainMenu.xib in Resources */ = {isa = PBXBuildFile; fileRef = 9B9F13981E8A282C00DE4794 /* MainMenu.xib */; };
-/* End PBXBuildFile section */
-
-/* Begin PBXFileReference section */
-		9B9F138D1E8A282C00DE4794 /* LaunchHelper.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = LaunchHelper.app; sourceTree = BUILT_PRODUCTS_DIR; };
-		9B9F13901E8A282C00DE4794 /* AppDelegate.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = AppDelegate.h; sourceTree = "<group>"; };
-		9B9F13911E8A282C00DE4794 /* AppDelegate.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = AppDelegate.m; sourceTree = "<group>"; };
-		9B9F13941E8A282C00DE4794 /* main.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = main.m; sourceTree = "<group>"; };
-		9B9F13961E8A282C00DE4794 /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
-		9B9F13991E8A282C00DE4794 /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/MainMenu.xib; sourceTree = "<group>"; };
-		9B9F139B1E8A282C00DE4794 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
-/* End PBXFileReference section */
-
-/* Begin PBXFrameworksBuildPhase section */
-		9B9F138A1E8A282C00DE4794 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXFrameworksBuildPhase section */
-
-/* Begin PBXGroup section */
-		9B9F13841E8A282C00DE4794 = {
-			isa = PBXGroup;
-			children = (
-				9B9F138F1E8A282C00DE4794 /* LaunchHelper */,
-				9B9F138E1E8A282C00DE4794 /* Products */,
-			);
-			sourceTree = "<group>";
-		};
-		9B9F138E1E8A282C00DE4794 /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				9B9F138D1E8A282C00DE4794 /* LaunchHelper.app */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-		9B9F138F1E8A282C00DE4794 /* LaunchHelper */ = {
-			isa = PBXGroup;
-			children = (
-				9B9F13901E8A282C00DE4794 /* AppDelegate.h */,
-				9B9F13911E8A282C00DE4794 /* AppDelegate.m */,
-				9B9F13961E8A282C00DE4794 /* Assets.xcassets */,
-				9B9F13981E8A282C00DE4794 /* MainMenu.xib */,
-				9B9F139B1E8A282C00DE4794 /* Info.plist */,
-				9B9F13931E8A282C00DE4794 /* Supporting Files */,
-			);
-			path = LaunchHelper;
-			sourceTree = "<group>";
-		};
-		9B9F13931E8A282C00DE4794 /* Supporting Files */ = {
-			isa = PBXGroup;
-			children = (
-				9B9F13941E8A282C00DE4794 /* main.m */,
-			);
-			name = "Supporting Files";
-			sourceTree = "<group>";
-		};
-/* End PBXGroup section */
-
-/* Begin PBXNativeTarget section */
-		9B9F138C1E8A282C00DE4794 /* LaunchHelper */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 9B9F139E1E8A282C00DE4794 /* Build configuration list for PBXNativeTarget "LaunchHelper" */;
-			buildPhases = (
-				9B9F13891E8A282C00DE4794 /* Sources */,
-				9B9F138A1E8A282C00DE4794 /* Frameworks */,
-				9B9F138B1E8A282C00DE4794 /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = LaunchHelper;
-			productName = LaunchHelper;
-			productReference = 9B9F138D1E8A282C00DE4794 /* LaunchHelper.app */;
-			productType = "com.apple.product-type.application";
-		};
-/* End PBXNativeTarget section */
-
-/* Begin PBXProject section */
-		9B9F13851E8A282C00DE4794 /* Project object */ = {
-			isa = PBXProject;
-			attributes = {
-				LastUpgradeCheck = 1250;
-				ORGANIZATIONNAME = qiuyuzhou;
-				TargetAttributes = {
-					9B9F138C1E8A282C00DE4794 = {
-						CreatedOnToolsVersion = 8.2.1;
-						ProvisioningStyle = Manual;
-					};
-				};
-			};
-			buildConfigurationList = 9B9F13881E8A282C00DE4794 /* Build configuration list for PBXProject "LaunchHelper" */;
-			compatibilityVersion = "Xcode 3.2";
-			developmentRegion = English;
-			hasScannedForEncodings = 0;
-			knownRegions = (
-				English,
-				en,
-				Base,
-			);
-			mainGroup = 9B9F13841E8A282C00DE4794;
-			productRefGroup = 9B9F138E1E8A282C00DE4794 /* Products */;
-			projectDirPath = "";
-			projectRoot = "";
-			targets = (
-				9B9F138C1E8A282C00DE4794 /* LaunchHelper */,
-			);
-		};
-/* End PBXProject section */
-
-/* Begin PBXResourcesBuildPhase section */
-		9B9F138B1E8A282C00DE4794 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9B9F13971E8A282C00DE4794 /* Assets.xcassets in Resources */,
-				9B9F139A1E8A282C00DE4794 /* MainMenu.xib in Resources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXResourcesBuildPhase section */
-
-/* Begin PBXSourcesBuildPhase section */
-		9B9F13891E8A282C00DE4794 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9B9F13951E8A282C00DE4794 /* main.m in Sources */,
-				9B9F13921E8A282C00DE4794 /* AppDelegate.m in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXSourcesBuildPhase section */
-
-/* Begin PBXVariantGroup section */
-		9B9F13981E8A282C00DE4794 /* MainMenu.xib */ = {
-			isa = PBXVariantGroup;
-			children = (
-				9B9F13991E8A282C00DE4794 /* Base */,
-			);
-			name = MainMenu.xib;
-			sourceTree = "<group>";
-		};
-/* End PBXVariantGroup section */
-
-/* Begin XCBuildConfiguration section */
-		9B9F139C1E8A282C00DE4794 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				CODE_SIGN_IDENTITY = "-";
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu99;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"DEBUG=1",
-					"$(inherited)",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MTL_ENABLE_DEBUG_INFO = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				SDKROOT = macosx;
-			};
-			name = Debug;
-		};
-		9B9F139D1E8A282C00DE4794 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				CODE_SIGN_IDENTITY = "-";
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu99;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MTL_ENABLE_DEBUG_INFO = NO;
-				SDKROOT = macosx;
-			};
-			name = Release;
-		};
-		9B9F139F1E8A282C00DE4794 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_IDENTITY = "-";
-				CODE_SIGN_STYLE = Manual;
-				COMBINE_HIDPI_IMAGES = YES;
-				DEVELOPMENT_TEAM = "";
-				INFOPLIST_FILE = LaunchHelper/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.11;
-				PRODUCT_BUNDLE_IDENTIFIER = "com.qiuyuzhou.ShadowsocksX-NG.LaunchHelper";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SKIP_INSTALL = YES;
-			};
-			name = Debug;
-		};
-		9B9F13A01E8A282C00DE4794 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_IDENTITY = "-";
-				CODE_SIGN_STYLE = Manual;
-				COMBINE_HIDPI_IMAGES = YES;
-				DEVELOPMENT_TEAM = "";
-				INFOPLIST_FILE = LaunchHelper/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.11;
-				PRODUCT_BUNDLE_IDENTIFIER = "com.qiuyuzhou.ShadowsocksX-NG.LaunchHelper";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SKIP_INSTALL = YES;
-			};
-			name = Release;
-		};
-/* End XCBuildConfiguration section */
-
-/* Begin XCConfigurationList section */
-		9B9F13881E8A282C00DE4794 /* Build configuration list for PBXProject "LaunchHelper" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				9B9F139C1E8A282C00DE4794 /* Debug */,
-				9B9F139D1E8A282C00DE4794 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		9B9F139E1E8A282C00DE4794 /* Build configuration list for PBXNativeTarget "LaunchHelper" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				9B9F139F1E8A282C00DE4794 /* Debug */,
-				9B9F13A01E8A282C00DE4794 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-/* End XCConfigurationList section */
-	};
-	rootObject = 9B9F13851E8A282C00DE4794 /* Project object */;
-}
diff --git a/LaunchHelper/LaunchHelper/AppDelegate.h b/LaunchHelper/LaunchHelper/AppDelegate.h
deleted file mode 100644
index 20bacd10b..000000000
--- a/LaunchHelper/LaunchHelper/AppDelegate.h
+++ /dev/null
@@ -1,15 +0,0 @@
-//
-//  AppDelegate.h
-//  LaunchHelper
-//
-//  Created by 邱宇舟 on 2017/3/28.
-//  Copyright © 2017年 qiuyuzhou. All rights reserved.
-//
-
-#import <Cocoa/Cocoa.h>
-
-@interface AppDelegate : NSObject <NSApplicationDelegate>
-
-
-@end
-
diff --git a/LaunchHelper/LaunchHelper/AppDelegate.m b/LaunchHelper/LaunchHelper/AppDelegate.m
deleted file mode 100644
index 9fc364665..000000000
--- a/LaunchHelper/LaunchHelper/AppDelegate.m
+++ /dev/null
@@ -1,43 +0,0 @@
-//
-//  AppDelegate.m
-//  LaunchHelper
-//
-//  Created by 邱宇舟 on 2017/3/28.
-//  Copyright © 2017年 qiuyuzhou. All rights reserved.
-//
-
-#import "AppDelegate.h"
-
-@interface AppDelegate ()
-
-@property (weak) IBOutlet NSWindow *window;
-@end
-
-@implementation AppDelegate
-
-- (void)applicationDidFinishLaunching:(NSNotification *)aNotification {
-    // Insert code here to initialize your application
-    NSLog(@"ShadowsocksX-NG LaunchHelper");
-    
-    NSWorkspace* ws = [NSWorkspace sharedWorkspace];
-    BOOL bLaunched = NO;
-    bLaunched = [ws launchApplication: @"/Applications/ShadowsocksX-NG.app"];
-    if (!bLaunched) {
-        bLaunched = [ws launchApplication: @"ShadowsocksX-NG.app"];
-    }
-    if (!bLaunched) {
-        NSArray *pathComponents = [[[NSBundle mainBundle] bundlePath] pathComponents];
-        pathComponents = [pathComponents subarrayWithRange:NSMakeRange(0, [pathComponents count] - 4)];
-        NSString *path = [NSString pathWithComponents:pathComponents];
-        [[NSWorkspace sharedWorkspace] launchApplication:path];
-    }
-    [NSApp terminate:nil];
-}
-
-
-- (void)applicationWillTerminate:(NSNotification *)aNotification {
-    // Insert code here to tear down your application
-}
-
-
-@end
diff --git a/LaunchHelper/LaunchHelper/Assets.xcassets/AppIcon.appiconset/Contents.json b/LaunchHelper/LaunchHelper/Assets.xcassets/AppIcon.appiconset/Contents.json
deleted file mode 100644
index 2db2b1c7c..000000000
--- a/LaunchHelper/LaunchHelper/Assets.xcassets/AppIcon.appiconset/Contents.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  "images" : [
-    {
-      "idiom" : "mac",
-      "size" : "16x16",
-      "scale" : "1x"
-    },
-    {
-      "idiom" : "mac",
-      "size" : "16x16",
-      "scale" : "2x"
-    },
-    {
-      "idiom" : "mac",
-      "size" : "32x32",
-      "scale" : "1x"
-    },
-    {
-      "idiom" : "mac",
-      "size" : "32x32",
-      "scale" : "2x"
-    },
-    {
-      "idiom" : "mac",
-      "size" : "128x128",
-      "scale" : "1x"
-    },
-    {
-      "idiom" : "mac",
-      "size" : "128x128",
-      "scale" : "2x"
-    },
-    {
-      "idiom" : "mac",
-      "size" : "256x256",
-      "scale" : "1x"
-    },
-    {
-      "idiom" : "mac",
-      "size" : "256x256",
-      "scale" : "2x"
-    },
-    {
-      "idiom" : "mac",
-      "size" : "512x512",
-      "scale" : "1x"
-    },
-    {
-      "idiom" : "mac",
-      "size" : "512x512",
-      "scale" : "2x"
-    }
-  ],
-  "info" : {
-    "version" : 1,
-    "author" : "xcode"
-  }
-}
\ No newline at end of file
diff --git a/LaunchHelper/LaunchHelper/Base.lproj/MainMenu.xib b/LaunchHelper/LaunchHelper/Base.lproj/MainMenu.xib
deleted file mode 100644
index 0edb2c8bd..000000000
--- a/LaunchHelper/LaunchHelper/Base.lproj/MainMenu.xib
+++ /dev/null
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="11762" systemVersion="16D32" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
-    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="11762"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="NSApplication">
-            <connections>
-                <outlet property="delegate" destination="Voe-Tx-rLC" id="GzC-gU-4Uq"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <customObject id="Voe-Tx-rLC" customClass="AppDelegate"/>
-        <customObject id="YLy-65-1bz" customClass="NSFontManager"/>
-    </objects>
-</document>
diff --git a/LaunchHelper/LaunchHelper/Info.plist b/LaunchHelper/LaunchHelper/Info.plist
deleted file mode 100644
index 58edf891c..000000000
--- a/LaunchHelper/LaunchHelper/Info.plist
+++ /dev/null
@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>en</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIconFile</key>
-	<string></string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>APPL</string>
-	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
-	<key>CFBundleVersion</key>
-	<string>2</string>
-	<key>LSBackgroundOnly</key>
-	<true/>
-	<key>LSMinimumSystemVersion</key>
-	<string>$(MACOSX_DEPLOYMENT_TARGET)</string>
-	<key>NSHumanReadableCopyright</key>
-	<string>Copyright © 2017年 qiuyuzhou. All rights reserved.</string>
-	<key>NSMainNibFile</key>
-	<string>MainMenu</string>
-	<key>NSPrincipalClass</key>
-	<string>NSApplication</string>
-</dict>
-</plist>
diff --git a/LaunchHelper/LaunchHelper/main.m b/LaunchHelper/LaunchHelper/main.m
deleted file mode 100644
index c6f32860e..000000000
--- a/LaunchHelper/LaunchHelper/main.m
+++ /dev/null
@@ -1,13 +0,0 @@
-//
-//  main.m
-//  LaunchHelper
-//
-//  Created by 邱宇舟 on 2017/3/28.
-//  Copyright © 2017年 qiuyuzhou. All rights reserved.
-//
-
-#import <Cocoa/Cocoa.h>
-
-int main(int argc, const char * argv[]) {
-    return NSApplicationMain(argc, argv);
-}
diff --git a/Podfile b/Podfile
deleted file mode 100644
index 2cce1c50a..000000000
--- a/Podfile
+++ /dev/null
@@ -1,27 +0,0 @@
-# Uncomment this line to define a global platform for your project
-# platform :ios, '9.0'
-platform :macos, '10.12'
-
-target 'ShadowsocksX-NG' do
-  # Comment this line if you're not using Swift and don't want to use dynamic frameworks
-  use_frameworks!
-
-  # Pods for ShadowsocksX-NG
-  pod 'Alamofire', '~> 5.4.3'
-  pod "GCDWebServer", "~> 3.0"
-  pod 'MASShortcut', '~> 2'
-  
-  # https://github.com/ReactiveX/RxSwift/blob/master/Documentation/GettingStarted.md
-  pod 'RxSwift',    '~> 6.2.0'
-  pod 'RxCocoa',    '~> 6.2.0'
-
-  target 'ShadowsocksX-NGTests' do
-    inherit! :search_paths
-    # Pods for testing
-  end
-
-end
-
-target 'proxy_conf_helper' do
-  pod 'BRLOptionParser', '~> 0.3.1'
-end
diff --git a/Podfile.lock b/Podfile.lock
deleted file mode 100644
index ba9ec4fe5..000000000
--- a/Podfile.lock
+++ /dev/null
@@ -1,44 +0,0 @@
-PODS:
-  - Alamofire (5.4.3)
-  - BRLOptionParser (0.3.1)
-  - GCDWebServer (3.5.4):
-    - GCDWebServer/Core (= 3.5.4)
-  - GCDWebServer/Core (3.5.4)
-  - MASShortcut (2.4.0)
-  - RxCocoa (6.2.0):
-    - RxRelay (= 6.2.0)
-    - RxSwift (= 6.2.0)
-  - RxRelay (6.2.0):
-    - RxSwift (= 6.2.0)
-  - RxSwift (6.2.0)
-
-DEPENDENCIES:
-  - Alamofire (~> 5.4.3)
-  - BRLOptionParser (~> 0.3.1)
-  - GCDWebServer (~> 3.0)
-  - MASShortcut (~> 2)
-  - RxCocoa (~> 6.2.0)
-  - RxSwift (~> 6.2.0)
-
-SPEC REPOS:
-  trunk:
-    - Alamofire
-    - BRLOptionParser
-    - GCDWebServer
-    - MASShortcut
-    - RxCocoa
-    - RxRelay
-    - RxSwift
-
-SPEC CHECKSUMS:
-  Alamofire: e447a2774a40c996748296fa2c55112fdbbc42f9
-  BRLOptionParser: a03256a8ff003ca1f5376c55f55f210e085a3958
-  GCDWebServer: 2c156a56c8226e2d5c0c3f208a3621ccffbe3ce4
-  MASShortcut: d9e4909e878661cc42877cc9d6efbe638273ab57
-  RxCocoa: 4baf94bb35f2c0ab31bc0cb9f1900155f646ba42
-  RxRelay: e72dbfd157807478401ef1982e1c61c945c94b2f
-  RxSwift: d356ab7bee873611322f134c5f9ef379fa183d8f
-
-PODFILE CHECKSUM: 5e6ee339e4466d456309238c104e8625cd1e3e41
-
-COCOAPODS: 1.10.1
diff --git a/Pods/Alamofire/LICENSE b/Pods/Alamofire/LICENSE
deleted file mode 100644
index 6b4d719a7..000000000
--- a/Pods/Alamofire/LICENSE
+++ /dev/null
@@ -1,19 +0,0 @@
-Copyright (c) 2014-2021 Alamofire Software Foundation (http://alamofire.org/)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
diff --git a/Pods/Alamofire/README.md b/Pods/Alamofire/README.md
deleted file mode 100644
index 9a5a80631..000000000
--- a/Pods/Alamofire/README.md
+++ /dev/null
@@ -1,206 +0,0 @@
-![Alamofire: Elegant Networking in Swift](https://raw.githubusercontent.com/Alamofire/Alamofire/master/alamofire.png)
-
-[![Build Status](https://github.com/Alamofire/Alamofire/workflows/Alamofire%20CI/badge.svg?branch=master)](https://github.com/Alamofire/Alamofire/actions)
-[![CocoaPods Compatible](https://img.shields.io/cocoapods/v/Alamofire.svg)](https://img.shields.io/cocoapods/v/Alamofire.svg)
-[![Carthage Compatible](https://img.shields.io/badge/Carthage-compatible-4BC51D.svg?style=flat)](https://github.com/Carthage/Carthage)
-[![Platform](https://img.shields.io/cocoapods/p/Alamofire.svg?style=flat)](https://alamofire.github.io/Alamofire)
-[![Twitter](https://img.shields.io/badge/twitter-@AlamofireSF-blue.svg?style=flat)](https://twitter.com/AlamofireSF)
-[![Gitter](https://badges.gitter.im/Alamofire/Alamofire.svg)](https://gitter.im/Alamofire/Alamofire?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
-[![Open Source Helpers](https://www.codetriage.com/alamofire/alamofire/badges/users.svg)](https://www.codetriage.com/alamofire/alamofire)
-
-Alamofire is an HTTP networking library written in Swift.
-
-- [Features](#features)
-- [Component Libraries](#component-libraries)
-- [Requirements](#requirements)
-- [Migration Guides](#migration-guides)
-- [Communication](#communication)
-- [Installation](#installation)
-- [Usage](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#using-alamofire)
-    - [**Introduction -**](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#introduction) [Making Requests](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#making-requests), [Response Handling](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#response-handling), [Response Validation](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#response-validation), [Response Caching](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#response-caching)
-	- **HTTP -** [HTTP Methods](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#http-methods), [Parameters and Parameter Encoder](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md##request-parameters-and-parameter-encoders), [HTTP Headers](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#http-headers), [Authentication](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#authentication)
-	- **Large Data -** [Downloading Data to a File](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#downloading-data-to-a-file), [Uploading Data to a Server](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#uploading-data-to-a-server)
-	- **Tools -** [Statistical Metrics](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#statistical-metrics), [cURL Command Output](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Usage.md#curl-command-output)
-- [Advanced Usage](https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md)
-	- **URL Session -** [Session Manager](https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md#session), [Session Delegate](https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md#sessiondelegate), [Request](https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md#request)
-	- **Routing -** [Routing Requests](https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md#routing-requests), [Adapting and Retrying Requests](https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md#adapting-and-retrying-requests-with-requestinterceptor)
-	- **Model Objects -** [Custom Response Handlers](https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md#customizing-response-handlers)
-	- **Connection -** [Security](https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md#security), [Network Reachability](https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md#network-reachability)
-- [Open Radars](#open-radars)
-- [FAQ](#faq)
-- [Credits](#credits)
-- [Donations](#donations)
-- [License](#license)
-
-## Features
-
-- [x] Chainable Request / Response Methods
-- [x] Combine Support
-- [x] URL / JSON Parameter Encoding
-- [x] Upload File / Data / Stream / MultipartFormData
-- [x] Download File using Request or Resume Data
-- [x] Authentication with `URLCredential`
-- [x] HTTP Response Validation
-- [x] Upload and Download Progress Closures with Progress
-- [x] cURL Command Output
-- [x] Dynamically Adapt and Retry Requests
-- [x] TLS Certificate and Public Key Pinning
-- [x] Network Reachability
-- [x] Comprehensive Unit and Integration Test Coverage
-- [x] [Complete Documentation](https://alamofire.github.io/Alamofire)
-
-## Component Libraries
-
-In order to keep Alamofire focused specifically on core networking implementations, additional component libraries have been created by the [Alamofire Software Foundation](https://github.com/Alamofire/Foundation) to bring additional functionality to the Alamofire ecosystem.
-
-- [AlamofireImage](https://github.com/Alamofire/AlamofireImage) - An image library including image response serializers, `UIImage` and `UIImageView` extensions, custom image filters, an auto-purging in-memory cache, and a priority-based image downloading system.
-- [AlamofireNetworkActivityIndicator](https://github.com/Alamofire/AlamofireNetworkActivityIndicator) - Controls the visibility of the network activity indicator on iOS using Alamofire. It contains configurable delay timers to help mitigate flicker and can support `URLSession` instances not managed by Alamofire.
-
-## Requirements
-
-- iOS 10.0+ / macOS 10.12+ / tvOS 10.0+ / watchOS 3.0+
-- Xcode 11+
-- Swift 5.1+
-
-## Migration Guides
-
-- [Alamofire 5.0 Migration Guide](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Alamofire%205.0%20Migration%20Guide.md)
-- [Alamofire 4.0 Migration Guide](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Alamofire%204.0%20Migration%20Guide.md)
-- [Alamofire 3.0 Migration Guide](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Alamofire%203.0%20Migration%20Guide.md)
-- [Alamofire 2.0 Migration Guide](https://github.com/Alamofire/Alamofire/blob/master/Documentation/Alamofire%202.0%20Migration%20Guide.md)
-
-## Communication
-- If you **need help with making network requests** using Alamofire, use [Stack Overflow](https://stackoverflow.com/questions/tagged/alamofire) and tag `alamofire`.
-- If you need to **find or understand an API**, check [our documentation](http://alamofire.github.io/Alamofire/) or [Apple's documentation for `URLSession`](https://developer.apple.com/documentation/foundation/url_loading_system), on top of which Alamofire is built.
-- If you need **help with an Alamofire feature**, use [our forum on swift.org](https://forums.swift.org/c/related-projects/alamofire).
-- If you'd like to **discuss Alamofire best practices**, use [our forum on swift.org](https://forums.swift.org/c/related-projects/alamofire).
-- If you'd like to **discuss a feature request**, use [our forum on swift.org](https://forums.swift.org/c/related-projects/alamofire). 
-- If you **found a bug**, open an issue here on GitHub and follow the guide. The more detail the better!
-- If you **want to contribute**, submit a pull request!
-
-## Installation
-
-### CocoaPods
-
-[CocoaPods](https://cocoapods.org) is a dependency manager for Cocoa projects. For usage and installation instructions, visit their website. To integrate Alamofire into your Xcode project using CocoaPods, specify it in your `Podfile`:
-
-```ruby
-pod 'Alamofire', '~> 5.2'
-```
-
-### Carthage
-
-[Carthage](https://github.com/Carthage/Carthage) is a decentralized dependency manager that builds your dependencies and provides you with binary frameworks. To integrate Alamofire into your Xcode project using Carthage, specify it in your `Cartfile`:
-
-```ogdl
-github "Alamofire/Alamofire" ~> 5.2
-```
-
-### Swift Package Manager
-
-The [Swift Package Manager](https://swift.org/package-manager/) is a tool for automating the distribution of Swift code and is integrated into the `swift` compiler. It is in early development, but Alamofire does support its use on supported platforms.
-
-Once you have your Swift package set up, adding Alamofire as a dependency is as easy as adding it to the `dependencies` value of your `Package.swift`.
-
-```swift
-dependencies: [
-    .package(url: "https://github.com/Alamofire/Alamofire.git", .upToNextMajor(from: "5.2.0"))
-]
-```
-
-### Manually
-
-If you prefer not to use any of the aforementioned dependency managers, you can integrate Alamofire into your project manually.
-
-#### Embedded Framework
-
-- Open up Terminal, `cd` into your top-level project directory, and run the following command "if" your project is not initialized as a git repository:
-
-  ```bash
-  $ git init
-  ```
-
-- Add Alamofire as a git [submodule](https://git-scm.com/docs/git-submodule) by running the following command:
-
-  ```bash
-  $ git submodule add https://github.com/Alamofire/Alamofire.git
-  ```
-
-- Open the new `Alamofire` folder, and drag the `Alamofire.xcodeproj` into the Project Navigator of your application's Xcode project.
-
-    > It should appear nested underneath your application's blue project icon. Whether it is above or below all the other Xcode groups does not matter.
-
-- Select the `Alamofire.xcodeproj` in the Project Navigator and verify the deployment target matches that of your application target.
-- Next, select your application project in the Project Navigator (blue project icon) to navigate to the target configuration window and select the application target under the "Targets" heading in the sidebar.
-- In the tab bar at the top of that window, open the "General" panel.
-- Click on the `+` button under the "Embedded Binaries" section.
-- You will see two different `Alamofire.xcodeproj` folders each with two different versions of the `Alamofire.framework` nested inside a `Products` folder.
-
-    > It does not matter which `Products` folder you choose from, but it does matter whether you choose the top or bottom `Alamofire.framework`.
-
-- Select the top `Alamofire.framework` for iOS and the bottom one for macOS.
-
-    > You can verify which one you selected by inspecting the build log for your project. The build target for `Alamofire` will be listed as `Alamofire iOS`, `Alamofire macOS`, `Alamofire tvOS`, or `Alamofire watchOS`.
-
-- And that's it!
-
-  > The `Alamofire.framework` is automagically added as a target dependency, linked framework and embedded framework in a copy files build phase which is all you need to build on the simulator and a device.
-
-## Open Radars
-
-The following radars have some effect on the current implementation of Alamofire.
-
-- [`rdar://21349340`](http://www.openradar.me/radar?id=5517037090635776) - Compiler throwing warning due to toll-free bridging issue in the test case
-- `rdar://26870455` - Background URL Session Configurations do not work in the simulator
-- `rdar://26849668` - Some URLProtocol APIs do not properly handle `URLRequest`
-- `FB7624529` - `urlSession(_:task:didFinishCollecting:)` never called on watchOS
-
-## Resolved Radars
-
-The following radars have been resolved over time after being filed against the Alamofire project.
-
-- [`rdar://26761490`](http://www.openradar.me/radar?id=5010235949318144) - Swift string interpolation causing memory leak with common usage.
-  - (Resolved): 9/1/17 in Xcode 9 beta 6.
-- [`rdar://36082113`](http://openradar.appspot.com/radar?id=4942308441063424) - `URLSessionTaskMetrics` failing to link on watchOS 3.0+
-  - (Resolved): Just add `CFNetwork` to your linked frameworks.
-
-## Workarounds
-
-- Collection of `URLSessionTaskMetrics` is currently disabled on watchOS due to `FB7624529`.
-
-## FAQ
-
-### What's the origin of the name Alamofire?
-
-Alamofire is named after the [Alamo Fire flower](https://aggie-horticulture.tamu.edu/wildseed/alamofire.html), a hybrid variant of the Bluebonnet, the official state flower of Texas.
-
-## Credits
-
-Alamofire is owned and maintained by the [Alamofire Software Foundation](http://alamofire.org). You can follow them on Twitter at [@AlamofireSF](https://twitter.com/AlamofireSF) for project updates and releases.
-
-### Security Disclosure
-
-If you believe you have identified a security vulnerability with Alamofire, you should report it as soon as possible via email to security@alamofire.org. Please do not post it to a public issue tracker.
-
-## Donations
-
-The [ASF](https://github.com/Alamofire/Foundation#members) is looking to raise money to officially stay registered as a federal non-profit organization.
-Registering will allow Foundation members to gain some legal protections and also allow us to put donations to use, tax-free.
-Donating to the ASF will enable us to:
-
-- Pay our yearly legal fees to keep the non-profit in good status
-- Pay for our mail servers to help us stay on top of all questions and security issues
-- Potentially fund test servers to make it easier for us to test the edge cases
-- Potentially fund developers to work on one of our projects full-time
-
-The community adoption of the ASF libraries has been amazing.
-We are greatly humbled by your enthusiasm around the projects and want to continue to do everything we can to move the needle forward.
-With your continued support, the ASF will be able to improve its reach and also provide better legal safety for the core members.
-If you use any of our libraries for work, see if your employers would be interested in donating.
-Any amount you can donate today to help us reach our goal would be greatly appreciated.
-
-[![paypal](https://www.paypalobjects.com/en_US/i/btn/btn_donateCC_LG.gif)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=W34WPEE74APJQ)
-
-## License
-
-Alamofire is released under the MIT license. [See LICENSE](https://github.com/Alamofire/Alamofire/blob/master/LICENSE) for details.
diff --git a/Pods/Alamofire/Source/AFError.swift b/Pods/Alamofire/Source/AFError.swift
deleted file mode 100644
index e8e4fe832..000000000
--- a/Pods/Alamofire/Source/AFError.swift
+++ /dev/null
@@ -1,854 +0,0 @@
-//
-//  AFError.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// `AFError` is the error type returned by Alamofire. It encompasses a few different types of errors, each with
-/// their own associated reasons.
-public enum AFError: Error {
-    /// The underlying reason the `.multipartEncodingFailed` error occurred.
-    public enum MultipartEncodingFailureReason {
-        /// The `fileURL` provided for reading an encodable body part isn't a file `URL`.
-        case bodyPartURLInvalid(url: URL)
-        /// The filename of the `fileURL` provided has either an empty `lastPathComponent` or `pathExtension.
-        case bodyPartFilenameInvalid(in: URL)
-        /// The file at the `fileURL` provided was not reachable.
-        case bodyPartFileNotReachable(at: URL)
-        /// Attempting to check the reachability of the `fileURL` provided threw an error.
-        case bodyPartFileNotReachableWithError(atURL: URL, error: Error)
-        /// The file at the `fileURL` provided is actually a directory.
-        case bodyPartFileIsDirectory(at: URL)
-        /// The size of the file at the `fileURL` provided was not returned by the system.
-        case bodyPartFileSizeNotAvailable(at: URL)
-        /// The attempt to find the size of the file at the `fileURL` provided threw an error.
-        case bodyPartFileSizeQueryFailedWithError(forURL: URL, error: Error)
-        /// An `InputStream` could not be created for the provided `fileURL`.
-        case bodyPartInputStreamCreationFailed(for: URL)
-        /// An `OutputStream` could not be created when attempting to write the encoded data to disk.
-        case outputStreamCreationFailed(for: URL)
-        /// The encoded body data could not be written to disk because a file already exists at the provided `fileURL`.
-        case outputStreamFileAlreadyExists(at: URL)
-        /// The `fileURL` provided for writing the encoded body data to disk is not a file `URL`.
-        case outputStreamURLInvalid(url: URL)
-        /// The attempt to write the encoded body data to disk failed with an underlying error.
-        case outputStreamWriteFailed(error: Error)
-        /// The attempt to read an encoded body part `InputStream` failed with underlying system error.
-        case inputStreamReadFailed(error: Error)
-    }
-
-    /// Represents unexpected input stream length that occur when encoding the `MultipartFormData`. Instances will be
-    /// embedded within an `AFError.multipartEncodingFailed` `.inputStreamReadFailed` case.
-    public struct UnexpectedInputStreamLength: Error {
-        /// The expected byte count to read.
-        public var bytesExpected: UInt64
-        /// The actual byte count read.
-        public var bytesRead: UInt64
-    }
-
-    /// The underlying reason the `.parameterEncodingFailed` error occurred.
-    public enum ParameterEncodingFailureReason {
-        /// The `URLRequest` did not have a `URL` to encode.
-        case missingURL
-        /// JSON serialization failed with an underlying system error during the encoding process.
-        case jsonEncodingFailed(error: Error)
-        /// Custom parameter encoding failed due to the associated `Error`.
-        case customEncodingFailed(error: Error)
-    }
-
-    /// The underlying reason the `.parameterEncoderFailed` error occurred.
-    public enum ParameterEncoderFailureReason {
-        /// Possible missing components.
-        public enum RequiredComponent {
-            /// The `URL` was missing or unable to be extracted from the passed `URLRequest` or during encoding.
-            case url
-            /// The `HTTPMethod` could not be extracted from the passed `URLRequest`.
-            case httpMethod(rawValue: String)
-        }
-
-        /// A `RequiredComponent` was missing during encoding.
-        case missingRequiredComponent(RequiredComponent)
-        /// The underlying encoder failed with the associated error.
-        case encoderFailed(error: Error)
-    }
-
-    /// The underlying reason the `.responseValidationFailed` error occurred.
-    public enum ResponseValidationFailureReason {
-        /// The data file containing the server response did not exist.
-        case dataFileNil
-        /// The data file containing the server response at the associated `URL` could not be read.
-        case dataFileReadFailed(at: URL)
-        /// The response did not contain a `Content-Type` and the `acceptableContentTypes` provided did not contain a
-        /// wildcard type.
-        case missingContentType(acceptableContentTypes: [String])
-        /// The response `Content-Type` did not match any type in the provided `acceptableContentTypes`.
-        case unacceptableContentType(acceptableContentTypes: [String], responseContentType: String)
-        /// The response status code was not acceptable.
-        case unacceptableStatusCode(code: Int)
-        /// Custom response validation failed due to the associated `Error`.
-        case customValidationFailed(error: Error)
-    }
-
-    /// The underlying reason the response serialization error occurred.
-    public enum ResponseSerializationFailureReason {
-        /// The server response contained no data or the data was zero length.
-        case inputDataNilOrZeroLength
-        /// The file containing the server response did not exist.
-        case inputFileNil
-        /// The file containing the server response could not be read from the associated `URL`.
-        case inputFileReadFailed(at: URL)
-        /// String serialization failed using the provided `String.Encoding`.
-        case stringSerializationFailed(encoding: String.Encoding)
-        /// JSON serialization failed with an underlying system error.
-        case jsonSerializationFailed(error: Error)
-        /// A `DataDecoder` failed to decode the response due to the associated `Error`.
-        case decodingFailed(error: Error)
-        /// A custom response serializer failed due to the associated `Error`.
-        case customSerializationFailed(error: Error)
-        /// Generic serialization failed for an empty response that wasn't type `Empty` but instead the associated type.
-        case invalidEmptyResponse(type: String)
-    }
-
-    /// Underlying reason a server trust evaluation error occurred.
-    public enum ServerTrustFailureReason {
-        /// The output of a server trust evaluation.
-        public struct Output {
-            /// The host for which the evaluation was performed.
-            public let host: String
-            /// The `SecTrust` value which was evaluated.
-            public let trust: SecTrust
-            /// The `OSStatus` of evaluation operation.
-            public let status: OSStatus
-            /// The result of the evaluation operation.
-            public let result: SecTrustResultType
-
-            /// Creates an `Output` value from the provided values.
-            init(_ host: String, _ trust: SecTrust, _ status: OSStatus, _ result: SecTrustResultType) {
-                self.host = host
-                self.trust = trust
-                self.status = status
-                self.result = result
-            }
-        }
-
-        /// No `ServerTrustEvaluator` was found for the associated host.
-        case noRequiredEvaluator(host: String)
-        /// No certificates were found with which to perform the trust evaluation.
-        case noCertificatesFound
-        /// No public keys were found with which to perform the trust evaluation.
-        case noPublicKeysFound
-        /// During evaluation, application of the associated `SecPolicy` failed.
-        case policyApplicationFailed(trust: SecTrust, policy: SecPolicy, status: OSStatus)
-        /// During evaluation, setting the associated anchor certificates failed.
-        case settingAnchorCertificatesFailed(status: OSStatus, certificates: [SecCertificate])
-        /// During evaluation, creation of the revocation policy failed.
-        case revocationPolicyCreationFailed
-        /// `SecTrust` evaluation failed with the associated `Error`, if one was produced.
-        case trustEvaluationFailed(error: Error?)
-        /// Default evaluation failed with the associated `Output`.
-        case defaultEvaluationFailed(output: Output)
-        /// Host validation failed with the associated `Output`.
-        case hostValidationFailed(output: Output)
-        /// Revocation check failed with the associated `Output` and options.
-        case revocationCheckFailed(output: Output, options: RevocationTrustEvaluator.Options)
-        /// Certificate pinning failed.
-        case certificatePinningFailed(host: String, trust: SecTrust, pinnedCertificates: [SecCertificate], serverCertificates: [SecCertificate])
-        /// Public key pinning failed.
-        case publicKeyPinningFailed(host: String, trust: SecTrust, pinnedKeys: [SecKey], serverKeys: [SecKey])
-        /// Custom server trust evaluation failed due to the associated `Error`.
-        case customEvaluationFailed(error: Error)
-    }
-
-    /// The underlying reason the `.urlRequestValidationFailed`
-    public enum URLRequestValidationFailureReason {
-        /// URLRequest with GET method had body data.
-        case bodyDataInGETRequest(Data)
-    }
-
-    ///  `UploadableConvertible` threw an error in `createUploadable()`.
-    case createUploadableFailed(error: Error)
-    ///  `URLRequestConvertible` threw an error in `asURLRequest()`.
-    case createURLRequestFailed(error: Error)
-    /// `SessionDelegate` threw an error while attempting to move downloaded file to destination URL.
-    case downloadedFileMoveFailed(error: Error, source: URL, destination: URL)
-    /// `Request` was explicitly cancelled.
-    case explicitlyCancelled
-    /// `URLConvertible` type failed to create a valid `URL`.
-    case invalidURL(url: URLConvertible)
-    /// Multipart form encoding failed.
-    case multipartEncodingFailed(reason: MultipartEncodingFailureReason)
-    /// `ParameterEncoding` threw an error during the encoding process.
-    case parameterEncodingFailed(reason: ParameterEncodingFailureReason)
-    /// `ParameterEncoder` threw an error while running the encoder.
-    case parameterEncoderFailed(reason: ParameterEncoderFailureReason)
-    /// `RequestAdapter` threw an error during adaptation.
-    case requestAdaptationFailed(error: Error)
-    /// `RequestRetrier` threw an error during the request retry process.
-    case requestRetryFailed(retryError: Error, originalError: Error)
-    /// Response validation failed.
-    case responseValidationFailed(reason: ResponseValidationFailureReason)
-    /// Response serialization failed.
-    case responseSerializationFailed(reason: ResponseSerializationFailureReason)
-    /// `ServerTrustEvaluating` instance threw an error during trust evaluation.
-    case serverTrustEvaluationFailed(reason: ServerTrustFailureReason)
-    /// `Session` which issued the `Request` was deinitialized, most likely because its reference went out of scope.
-    case sessionDeinitialized
-    /// `Session` was explicitly invalidated, possibly with the `Error` produced by the underlying `URLSession`.
-    case sessionInvalidated(error: Error?)
-    /// `URLSessionTask` completed with error.
-    case sessionTaskFailed(error: Error)
-    /// `URLRequest` failed validation.
-    case urlRequestValidationFailed(reason: URLRequestValidationFailureReason)
-}
-
-extension Error {
-    /// Returns the instance cast as an `AFError`.
-    public var asAFError: AFError? {
-        self as? AFError
-    }
-
-    /// Returns the instance cast as an `AFError`. If casting fails, a `fatalError` with the specified `message` is thrown.
-    public func asAFError(orFailWith message: @autoclosure () -> String, file: StaticString = #file, line: UInt = #line) -> AFError {
-        guard let afError = self as? AFError else {
-            fatalError(message(), file: file, line: line)
-        }
-        return afError
-    }
-
-    /// Casts the instance as `AFError` or returns `defaultAFError`
-    func asAFError(or defaultAFError: @autoclosure () -> AFError) -> AFError {
-        self as? AFError ?? defaultAFError()
-    }
-}
-
-// MARK: - Error Booleans
-
-extension AFError {
-    /// Returns whether the instance is `.sessionDeinitialized`.
-    public var isSessionDeinitializedError: Bool {
-        if case .sessionDeinitialized = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.sessionInvalidated`.
-    public var isSessionInvalidatedError: Bool {
-        if case .sessionInvalidated = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.explicitlyCancelled`.
-    public var isExplicitlyCancelledError: Bool {
-        if case .explicitlyCancelled = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.invalidURL`.
-    public var isInvalidURLError: Bool {
-        if case .invalidURL = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.parameterEncodingFailed`. When `true`, the `underlyingError` property will
-    /// contain the associated value.
-    public var isParameterEncodingError: Bool {
-        if case .parameterEncodingFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.parameterEncoderFailed`. When `true`, the `underlyingError` property will
-    /// contain the associated value.
-    public var isParameterEncoderError: Bool {
-        if case .parameterEncoderFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.multipartEncodingFailed`. When `true`, the `url` and `underlyingError`
-    /// properties will contain the associated values.
-    public var isMultipartEncodingError: Bool {
-        if case .multipartEncodingFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.requestAdaptationFailed`. When `true`, the `underlyingError` property will
-    /// contain the associated value.
-    public var isRequestAdaptationError: Bool {
-        if case .requestAdaptationFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.responseValidationFailed`. When `true`, the `acceptableContentTypes`,
-    /// `responseContentType`,  `responseCode`, and `underlyingError` properties will contain the associated values.
-    public var isResponseValidationError: Bool {
-        if case .responseValidationFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.responseSerializationFailed`. When `true`, the `failedStringEncoding` and
-    /// `underlyingError` properties will contain the associated values.
-    public var isResponseSerializationError: Bool {
-        if case .responseSerializationFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `.serverTrustEvaluationFailed`. When `true`, the `underlyingError` property will
-    /// contain the associated value.
-    public var isServerTrustEvaluationError: Bool {
-        if case .serverTrustEvaluationFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `requestRetryFailed`. When `true`, the `underlyingError` property will
-    /// contain the associated value.
-    public var isRequestRetryError: Bool {
-        if case .requestRetryFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `createUploadableFailed`. When `true`, the `underlyingError` property will
-    /// contain the associated value.
-    public var isCreateUploadableError: Bool {
-        if case .createUploadableFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `createURLRequestFailed`. When `true`, the `underlyingError` property will
-    /// contain the associated value.
-    public var isCreateURLRequestError: Bool {
-        if case .createURLRequestFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `downloadedFileMoveFailed`. When `true`, the `destination` and `underlyingError` properties will
-    /// contain the associated values.
-    public var isDownloadedFileMoveError: Bool {
-        if case .downloadedFileMoveFailed = self { return true }
-        return false
-    }
-
-    /// Returns whether the instance is `createURLRequestFailed`. When `true`, the `underlyingError` property will
-    /// contain the associated value.
-    public var isSessionTaskError: Bool {
-        if case .sessionTaskFailed = self { return true }
-        return false
-    }
-}
-
-// MARK: - Convenience Properties
-
-extension AFError {
-    /// The `URLConvertible` associated with the error.
-    public var urlConvertible: URLConvertible? {
-        guard case let .invalidURL(url) = self else { return nil }
-        return url
-    }
-
-    /// The `URL` associated with the error.
-    public var url: URL? {
-        guard case let .multipartEncodingFailed(reason) = self else { return nil }
-        return reason.url
-    }
-
-    /// The underlying `Error` responsible for generating the failure associated with `.sessionInvalidated`,
-    /// `.parameterEncodingFailed`, `.parameterEncoderFailed`, `.multipartEncodingFailed`, `.requestAdaptationFailed`,
-    /// `.responseSerializationFailed`, `.requestRetryFailed` errors.
-    public var underlyingError: Error? {
-        switch self {
-        case let .multipartEncodingFailed(reason):
-            return reason.underlyingError
-        case let .parameterEncodingFailed(reason):
-            return reason.underlyingError
-        case let .parameterEncoderFailed(reason):
-            return reason.underlyingError
-        case let .requestAdaptationFailed(error):
-            return error
-        case let .requestRetryFailed(retryError, _):
-            return retryError
-        case let .responseValidationFailed(reason):
-            return reason.underlyingError
-        case let .responseSerializationFailed(reason):
-            return reason.underlyingError
-        case let .serverTrustEvaluationFailed(reason):
-            return reason.underlyingError
-        case let .sessionInvalidated(error):
-            return error
-        case let .createUploadableFailed(error):
-            return error
-        case let .createURLRequestFailed(error):
-            return error
-        case let .downloadedFileMoveFailed(error, _, _):
-            return error
-        case let .sessionTaskFailed(error):
-            return error
-        case .explicitlyCancelled,
-             .invalidURL,
-             .sessionDeinitialized,
-             .urlRequestValidationFailed:
-            return nil
-        }
-    }
-
-    /// The acceptable `Content-Type`s of a `.responseValidationFailed` error.
-    public var acceptableContentTypes: [String]? {
-        guard case let .responseValidationFailed(reason) = self else { return nil }
-        return reason.acceptableContentTypes
-    }
-
-    /// The response `Content-Type` of a `.responseValidationFailed` error.
-    public var responseContentType: String? {
-        guard case let .responseValidationFailed(reason) = self else { return nil }
-        return reason.responseContentType
-    }
-
-    /// The response code of a `.responseValidationFailed` error.
-    public var responseCode: Int? {
-        guard case let .responseValidationFailed(reason) = self else { return nil }
-        return reason.responseCode
-    }
-
-    /// The `String.Encoding` associated with a failed `.stringResponse()` call.
-    public var failedStringEncoding: String.Encoding? {
-        guard case let .responseSerializationFailed(reason) = self else { return nil }
-        return reason.failedStringEncoding
-    }
-
-    /// The `source` URL of a `.downloadedFileMoveFailed` error.
-    public var sourceURL: URL? {
-        guard case let .downloadedFileMoveFailed(_, source, _) = self else { return nil }
-        return source
-    }
-
-    /// The `destination` URL of a `.downloadedFileMoveFailed` error.
-    public var destinationURL: URL? {
-        guard case let .downloadedFileMoveFailed(_, _, destination) = self else { return nil }
-        return destination
-    }
-
-    /// The download resume data of any underlying network error. Only produced by `DownloadRequest`s.
-    public var downloadResumeData: Data? {
-        (underlyingError as? URLError)?.userInfo[NSURLSessionDownloadTaskResumeData] as? Data
-    }
-}
-
-extension AFError.ParameterEncodingFailureReason {
-    var underlyingError: Error? {
-        switch self {
-        case let .jsonEncodingFailed(error),
-             let .customEncodingFailed(error):
-            return error
-        case .missingURL:
-            return nil
-        }
-    }
-}
-
-extension AFError.ParameterEncoderFailureReason {
-    var underlyingError: Error? {
-        switch self {
-        case let .encoderFailed(error):
-            return error
-        case .missingRequiredComponent:
-            return nil
-        }
-    }
-}
-
-extension AFError.MultipartEncodingFailureReason {
-    var url: URL? {
-        switch self {
-        case let .bodyPartURLInvalid(url),
-             let .bodyPartFilenameInvalid(url),
-             let .bodyPartFileNotReachable(url),
-             let .bodyPartFileIsDirectory(url),
-             let .bodyPartFileSizeNotAvailable(url),
-             let .bodyPartInputStreamCreationFailed(url),
-             let .outputStreamCreationFailed(url),
-             let .outputStreamFileAlreadyExists(url),
-             let .outputStreamURLInvalid(url),
-             let .bodyPartFileNotReachableWithError(url, _),
-             let .bodyPartFileSizeQueryFailedWithError(url, _):
-            return url
-        case .outputStreamWriteFailed,
-             .inputStreamReadFailed:
-            return nil
-        }
-    }
-
-    var underlyingError: Error? {
-        switch self {
-        case let .bodyPartFileNotReachableWithError(_, error),
-             let .bodyPartFileSizeQueryFailedWithError(_, error),
-             let .outputStreamWriteFailed(error),
-             let .inputStreamReadFailed(error):
-            return error
-        case .bodyPartURLInvalid,
-             .bodyPartFilenameInvalid,
-             .bodyPartFileNotReachable,
-             .bodyPartFileIsDirectory,
-             .bodyPartFileSizeNotAvailable,
-             .bodyPartInputStreamCreationFailed,
-             .outputStreamCreationFailed,
-             .outputStreamFileAlreadyExists,
-             .outputStreamURLInvalid:
-            return nil
-        }
-    }
-}
-
-extension AFError.ResponseValidationFailureReason {
-    var acceptableContentTypes: [String]? {
-        switch self {
-        case let .missingContentType(types),
-             let .unacceptableContentType(types, _):
-            return types
-        case .dataFileNil,
-             .dataFileReadFailed,
-             .unacceptableStatusCode,
-             .customValidationFailed:
-            return nil
-        }
-    }
-
-    var responseContentType: String? {
-        switch self {
-        case let .unacceptableContentType(_, responseType):
-            return responseType
-        case .dataFileNil,
-             .dataFileReadFailed,
-             .missingContentType,
-             .unacceptableStatusCode,
-             .customValidationFailed:
-            return nil
-        }
-    }
-
-    var responseCode: Int? {
-        switch self {
-        case let .unacceptableStatusCode(code):
-            return code
-        case .dataFileNil,
-             .dataFileReadFailed,
-             .missingContentType,
-             .unacceptableContentType,
-             .customValidationFailed:
-            return nil
-        }
-    }
-
-    var underlyingError: Error? {
-        switch self {
-        case let .customValidationFailed(error):
-            return error
-        case .dataFileNil,
-             .dataFileReadFailed,
-             .missingContentType,
-             .unacceptableContentType,
-             .unacceptableStatusCode:
-            return nil
-        }
-    }
-}
-
-extension AFError.ResponseSerializationFailureReason {
-    var failedStringEncoding: String.Encoding? {
-        switch self {
-        case let .stringSerializationFailed(encoding):
-            return encoding
-        case .inputDataNilOrZeroLength,
-             .inputFileNil,
-             .inputFileReadFailed(_),
-             .jsonSerializationFailed(_),
-             .decodingFailed(_),
-             .customSerializationFailed(_),
-             .invalidEmptyResponse:
-            return nil
-        }
-    }
-
-    var underlyingError: Error? {
-        switch self {
-        case let .jsonSerializationFailed(error),
-             let .decodingFailed(error),
-             let .customSerializationFailed(error):
-            return error
-        case .inputDataNilOrZeroLength,
-             .inputFileNil,
-             .inputFileReadFailed,
-             .stringSerializationFailed,
-             .invalidEmptyResponse:
-            return nil
-        }
-    }
-}
-
-extension AFError.ServerTrustFailureReason {
-    var output: AFError.ServerTrustFailureReason.Output? {
-        switch self {
-        case let .defaultEvaluationFailed(output),
-             let .hostValidationFailed(output),
-             let .revocationCheckFailed(output, _):
-            return output
-        case .noRequiredEvaluator,
-             .noCertificatesFound,
-             .noPublicKeysFound,
-             .policyApplicationFailed,
-             .settingAnchorCertificatesFailed,
-             .revocationPolicyCreationFailed,
-             .trustEvaluationFailed,
-             .certificatePinningFailed,
-             .publicKeyPinningFailed,
-             .customEvaluationFailed:
-            return nil
-        }
-    }
-
-    var underlyingError: Error? {
-        switch self {
-        case let .customEvaluationFailed(error):
-            return error
-        case let .trustEvaluationFailed(error):
-            return error
-        case .noRequiredEvaluator,
-             .noCertificatesFound,
-             .noPublicKeysFound,
-             .policyApplicationFailed,
-             .settingAnchorCertificatesFailed,
-             .revocationPolicyCreationFailed,
-             .defaultEvaluationFailed,
-             .hostValidationFailed,
-             .revocationCheckFailed,
-             .certificatePinningFailed,
-             .publicKeyPinningFailed:
-            return nil
-        }
-    }
-}
-
-// MARK: - Error Descriptions
-
-extension AFError: LocalizedError {
-    public var errorDescription: String? {
-        switch self {
-        case .explicitlyCancelled:
-            return "Request explicitly cancelled."
-        case let .invalidURL(url):
-            return "URL is not valid: \(url)"
-        case let .parameterEncodingFailed(reason):
-            return reason.localizedDescription
-        case let .parameterEncoderFailed(reason):
-            return reason.localizedDescription
-        case let .multipartEncodingFailed(reason):
-            return reason.localizedDescription
-        case let .requestAdaptationFailed(error):
-            return "Request adaption failed with error: \(error.localizedDescription)"
-        case let .responseValidationFailed(reason):
-            return reason.localizedDescription
-        case let .responseSerializationFailed(reason):
-            return reason.localizedDescription
-        case let .requestRetryFailed(retryError, originalError):
-            return """
-            Request retry failed with retry error: \(retryError.localizedDescription), \
-            original error: \(originalError.localizedDescription)
-            """
-        case .sessionDeinitialized:
-            return """
-            Session was invalidated without error, so it was likely deinitialized unexpectedly. \
-            Be sure to retain a reference to your Session for the duration of your requests.
-            """
-        case let .sessionInvalidated(error):
-            return "Session was invalidated with error: \(error?.localizedDescription ?? "No description.")"
-        case let .serverTrustEvaluationFailed(reason):
-            return "Server trust evaluation failed due to reason: \(reason.localizedDescription)"
-        case let .urlRequestValidationFailed(reason):
-            return "URLRequest validation failed due to reason: \(reason.localizedDescription)"
-        case let .createUploadableFailed(error):
-            return "Uploadable creation failed with error: \(error.localizedDescription)"
-        case let .createURLRequestFailed(error):
-            return "URLRequest creation failed with error: \(error.localizedDescription)"
-        case let .downloadedFileMoveFailed(error, source, destination):
-            return "Moving downloaded file from: \(source) to: \(destination) failed with error: \(error.localizedDescription)"
-        case let .sessionTaskFailed(error):
-            return "URLSessionTask failed with error: \(error.localizedDescription)"
-        }
-    }
-}
-
-extension AFError.ParameterEncodingFailureReason {
-    var localizedDescription: String {
-        switch self {
-        case .missingURL:
-            return "URL request to encode was missing a URL"
-        case let .jsonEncodingFailed(error):
-            return "JSON could not be encoded because of error:\n\(error.localizedDescription)"
-        case let .customEncodingFailed(error):
-            return "Custom parameter encoder failed with error: \(error.localizedDescription)"
-        }
-    }
-}
-
-extension AFError.ParameterEncoderFailureReason {
-    var localizedDescription: String {
-        switch self {
-        case let .missingRequiredComponent(component):
-            return "Encoding failed due to a missing request component: \(component)"
-        case let .encoderFailed(error):
-            return "The underlying encoder failed with the error: \(error)"
-        }
-    }
-}
-
-extension AFError.MultipartEncodingFailureReason {
-    var localizedDescription: String {
-        switch self {
-        case let .bodyPartURLInvalid(url):
-            return "The URL provided is not a file URL: \(url)"
-        case let .bodyPartFilenameInvalid(url):
-            return "The URL provided does not have a valid filename: \(url)"
-        case let .bodyPartFileNotReachable(url):
-            return "The URL provided is not reachable: \(url)"
-        case let .bodyPartFileNotReachableWithError(url, error):
-            return """
-            The system returned an error while checking the provided URL for reachability.
-            URL: \(url)
-            Error: \(error)
-            """
-        case let .bodyPartFileIsDirectory(url):
-            return "The URL provided is a directory: \(url)"
-        case let .bodyPartFileSizeNotAvailable(url):
-            return "Could not fetch the file size from the provided URL: \(url)"
-        case let .bodyPartFileSizeQueryFailedWithError(url, error):
-            return """
-            The system returned an error while attempting to fetch the file size from the provided URL.
-            URL: \(url)
-            Error: \(error)
-            """
-        case let .bodyPartInputStreamCreationFailed(url):
-            return "Failed to create an InputStream for the provided URL: \(url)"
-        case let .outputStreamCreationFailed(url):
-            return "Failed to create an OutputStream for URL: \(url)"
-        case let .outputStreamFileAlreadyExists(url):
-            return "A file already exists at the provided URL: \(url)"
-        case let .outputStreamURLInvalid(url):
-            return "The provided OutputStream URL is invalid: \(url)"
-        case let .outputStreamWriteFailed(error):
-            return "OutputStream write failed with error: \(error)"
-        case let .inputStreamReadFailed(error):
-            return "InputStream read failed with error: \(error)"
-        }
-    }
-}
-
-extension AFError.ResponseSerializationFailureReason {
-    var localizedDescription: String {
-        switch self {
-        case .inputDataNilOrZeroLength:
-            return "Response could not be serialized, input data was nil or zero length."
-        case .inputFileNil:
-            return "Response could not be serialized, input file was nil."
-        case let .inputFileReadFailed(url):
-            return "Response could not be serialized, input file could not be read: \(url)."
-        case let .stringSerializationFailed(encoding):
-            return "String could not be serialized with encoding: \(encoding)."
-        case let .jsonSerializationFailed(error):
-            return "JSON could not be serialized because of error:\n\(error.localizedDescription)"
-        case let .invalidEmptyResponse(type):
-            return """
-            Empty response could not be serialized to type: \(type). \
-            Use Empty as the expected type for such responses.
-            """
-        case let .decodingFailed(error):
-            return "Response could not be decoded because of error:\n\(error.localizedDescription)"
-        case let .customSerializationFailed(error):
-            return "Custom response serializer failed with error:\n\(error.localizedDescription)"
-        }
-    }
-}
-
-extension AFError.ResponseValidationFailureReason {
-    var localizedDescription: String {
-        switch self {
-        case .dataFileNil:
-            return "Response could not be validated, data file was nil."
-        case let .dataFileReadFailed(url):
-            return "Response could not be validated, data file could not be read: \(url)."
-        case let .missingContentType(types):
-            return """
-            Response Content-Type was missing and acceptable content types \
-            (\(types.joined(separator: ","))) do not match "*/*".
-            """
-        case let .unacceptableContentType(acceptableTypes, responseType):
-            return """
-            Response Content-Type "\(responseType)" does not match any acceptable types: \
-            \(acceptableTypes.joined(separator: ",")).
-            """
-        case let .unacceptableStatusCode(code):
-            return "Response status code was unacceptable: \(code)."
-        case let .customValidationFailed(error):
-            return "Custom response validation failed with error: \(error.localizedDescription)"
-        }
-    }
-}
-
-extension AFError.ServerTrustFailureReason {
-    var localizedDescription: String {
-        switch self {
-        case let .noRequiredEvaluator(host):
-            return "A ServerTrustEvaluating value is required for host \(host) but none was found."
-        case .noCertificatesFound:
-            return "No certificates were found or provided for evaluation."
-        case .noPublicKeysFound:
-            return "No public keys were found or provided for evaluation."
-        case .policyApplicationFailed:
-            return "Attempting to set a SecPolicy failed."
-        case .settingAnchorCertificatesFailed:
-            return "Attempting to set the provided certificates as anchor certificates failed."
-        case .revocationPolicyCreationFailed:
-            return "Attempting to create a revocation policy failed."
-        case let .trustEvaluationFailed(error):
-            return "SecTrust evaluation failed with error: \(error?.localizedDescription ?? "None")"
-        case let .defaultEvaluationFailed(output):
-            return "Default evaluation failed for host \(output.host)."
-        case let .hostValidationFailed(output):
-            return "Host validation failed for host \(output.host)."
-        case let .revocationCheckFailed(output, _):
-            return "Revocation check failed for host \(output.host)."
-        case let .certificatePinningFailed(host, _, _, _):
-            return "Certificate pinning failed for host \(host)."
-        case let .publicKeyPinningFailed(host, _, _, _):
-            return "Public key pinning failed for host \(host)."
-        case let .customEvaluationFailed(error):
-            return "Custom trust evaluation failed with error: \(error.localizedDescription)"
-        }
-    }
-}
-
-extension AFError.URLRequestValidationFailureReason {
-    var localizedDescription: String {
-        switch self {
-        case let .bodyDataInGETRequest(data):
-            return """
-            Invalid URLRequest: Requests with GET method cannot have body data:
-            \(String(decoding: data, as: UTF8.self))
-            """
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/Alamofire.swift b/Pods/Alamofire/Source/Alamofire.swift
deleted file mode 100644
index bcf43d02e..000000000
--- a/Pods/Alamofire/Source/Alamofire.swift
+++ /dev/null
@@ -1,29 +0,0 @@
-//
-//  Alamofire.swift
-//
-//  Copyright (c) 2014-2021 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-/// Reference to `Session.default` for quick bootstrapping and examples.
-public let AF = Session.default
-
-/// Current Alamofire version. Necessary since SPM doesn't use dynamic libraries. Plus this will be more accurate.
-let version = "5.4.3"
diff --git a/Pods/Alamofire/Source/AlamofireExtended.swift b/Pods/Alamofire/Source/AlamofireExtended.swift
deleted file mode 100644
index 280c6de99..000000000
--- a/Pods/Alamofire/Source/AlamofireExtended.swift
+++ /dev/null
@@ -1,61 +0,0 @@
-//
-//  AlamofireExtended.swift
-//
-//  Copyright (c) 2019 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-/// Type that acts as a generic extension point for all `AlamofireExtended` types.
-public struct AlamofireExtension<ExtendedType> {
-    /// Stores the type or meta-type of any extended type.
-    public private(set) var type: ExtendedType
-
-    /// Create an instance from the provided value.
-    ///
-    /// - Parameter type: Instance being extended.
-    public init(_ type: ExtendedType) {
-        self.type = type
-    }
-}
-
-/// Protocol describing the `af` extension points for Alamofire extended types.
-public protocol AlamofireExtended {
-    /// Type being extended.
-    associatedtype ExtendedType
-
-    /// Static Alamofire extension point.
-    static var af: AlamofireExtension<ExtendedType>.Type { get set }
-    /// Instance Alamofire extension point.
-    var af: AlamofireExtension<ExtendedType> { get set }
-}
-
-extension AlamofireExtended {
-    /// Static Alamofire extension point.
-    public static var af: AlamofireExtension<Self>.Type {
-        get { AlamofireExtension<Self>.self }
-        set {}
-    }
-
-    /// Instance Alamofire extension point.
-    public var af: AlamofireExtension<Self> {
-        get { AlamofireExtension(self) }
-        set {}
-    }
-}
diff --git a/Pods/Alamofire/Source/AuthenticationInterceptor.swift b/Pods/Alamofire/Source/AuthenticationInterceptor.swift
deleted file mode 100644
index 9d7f8360d..000000000
--- a/Pods/Alamofire/Source/AuthenticationInterceptor.swift
+++ /dev/null
@@ -1,404 +0,0 @@
-//
-//  AuthenticationInterceptor.swift
-//
-//  Copyright (c) 2020 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// Types adopting the `AuthenticationCredential` protocol can be used to authenticate `URLRequest`s.
-///
-/// One common example of an `AuthenticationCredential` is an OAuth2 credential containing an access token used to
-/// authenticate all requests on behalf of a user. The access token generally has an expiration window of 60 minutes
-/// which will then require a refresh of the credential using the refresh token to generate a new access token.
-public protocol AuthenticationCredential {
-    /// Whether the credential requires a refresh. This property should always return `true` when the credential is
-    /// expired. It is also wise to consider returning `true` when the credential will expire in several seconds or
-    /// minutes depending on the expiration window of the credential.
-    ///
-    /// For example, if the credential is valid for 60 minutes, then it would be wise to return `true` when the
-    /// credential is only valid for 5 minutes or less. That ensures the credential will not expire as it is passed
-    /// around backend services.
-    var requiresRefresh: Bool { get }
-}
-
-// MARK: -
-
-/// Types adopting the `Authenticator` protocol can be used to authenticate `URLRequest`s with an
-/// `AuthenticationCredential` as well as refresh the `AuthenticationCredential` when required.
-public protocol Authenticator: AnyObject {
-    /// The type of credential associated with the `Authenticator` instance.
-    associatedtype Credential: AuthenticationCredential
-
-    /// Applies the `Credential` to the `URLRequest`.
-    ///
-    /// In the case of OAuth2, the access token of the `Credential` would be added to the `URLRequest` as a Bearer
-    /// token to the `Authorization` header.
-    ///
-    /// - Parameters:
-    ///   - credential: The `Credential`.
-    ///   - urlRequest: The `URLRequest`.
-    func apply(_ credential: Credential, to urlRequest: inout URLRequest)
-
-    /// Refreshes the `Credential` and executes the `completion` closure with the `Result` once complete.
-    ///
-    /// Refresh can be called in one of two ways. It can be called before the `Request` is actually executed due to
-    /// a `requiresRefresh` returning `true` during the adapt portion of the `Request` creation process. It can also
-    /// be triggered by a failed `Request` where the authentication server denied access due to an expired or
-    /// invalidated access token.
-    ///
-    /// In the case of OAuth2, this method would use the refresh token of the `Credential` to generate a new
-    /// `Credential` using the authentication service. Once complete, the `completion` closure should be called with
-    /// the new `Credential`, or the error that occurred.
-    ///
-    /// In general, if the refresh call fails with certain status codes from the authentication server (commonly a 401),
-    /// the refresh token in the `Credential` can no longer be used to generate a valid `Credential`. In these cases,
-    /// you will need to reauthenticate the user with their username / password.
-    ///
-    /// Please note, these are just general examples of common use cases. They are not meant to solve your specific
-    /// authentication server challenges. Please work with your authentication server team to ensure your
-    /// `Authenticator` logic matches their expectations.
-    ///
-    /// - Parameters:
-    ///   - credential: The `Credential` to refresh.
-    ///   - session:    The `Session` requiring the refresh.
-    ///   - completion: The closure to be executed once the refresh is complete.
-    func refresh(_ credential: Credential, for session: Session, completion: @escaping (Result<Credential, Error>) -> Void)
-
-    /// Determines whether the `URLRequest` failed due to an authentication error based on the `HTTPURLResponse`.
-    ///
-    /// If the authentication server **CANNOT** invalidate credentials after they are issued, then simply return `false`
-    /// for this method. If the authentication server **CAN** invalidate credentials due to security breaches, then you
-    /// will need to work with your authentication server team to understand how to identify when this occurs.
-    ///
-    /// In the case of OAuth2, where an authentication server can invalidate credentials, you will need to inspect the
-    /// `HTTPURLResponse` or possibly the `Error` for when this occurs. This is commonly handled by the authentication
-    /// server returning a 401 status code and some additional header to indicate an OAuth2 failure occurred.
-    ///
-    /// It is very important to understand how your authentication server works to be able to implement this correctly.
-    /// For example, if your authentication server returns a 401 when an OAuth2 error occurs, and your downstream
-    /// service also returns a 401 when you are not authorized to perform that operation, how do you know which layer
-    /// of the backend returned you a 401? You do not want to trigger a refresh unless you know your authentication
-    /// server is actually the layer rejecting the request. Again, work with your authentication server team to understand
-    /// how to identify an OAuth2 401 error vs. a downstream 401 error to avoid endless refresh loops.
-    ///
-    /// - Parameters:
-    ///   - urlRequest: The `URLRequest`.
-    ///   - response:   The `HTTPURLResponse`.
-    ///   - error:      The `Error`.
-    ///
-    /// - Returns: `true` if the `URLRequest` failed due to an authentication error, `false` otherwise.
-    func didRequest(_ urlRequest: URLRequest, with response: HTTPURLResponse, failDueToAuthenticationError error: Error) -> Bool
-
-    /// Determines whether the `URLRequest` is authenticated with the `Credential`.
-    ///
-    /// If the authentication server **CANNOT** invalidate credentials after they are issued, then simply return `true`
-    /// for this method. If the authentication server **CAN** invalidate credentials due to security breaches, then
-    /// read on.
-    ///
-    /// When an authentication server can invalidate credentials, it means that you may have a non-expired credential
-    /// that appears to be valid, but will be rejected by the authentication server when used. Generally when this
-    /// happens, a number of requests are all sent when the application is foregrounded, and all of them will be
-    /// rejected by the authentication server in the order they are received. The first failed request will trigger a
-    /// refresh internally, which will update the credential, and then retry all the queued requests with the new
-    /// credential. However, it is possible that some of the original requests will not return from the authentication
-    /// server until the refresh has completed. This is where this method comes in.
-    ///
-    /// When the authentication server rejects a credential, we need to check to make sure we haven't refreshed the
-    /// credential while the request was in flight. If it has already refreshed, then we don't need to trigger an
-    /// additional refresh. If it hasn't refreshed, then we need to refresh.
-    ///
-    /// Now that it is understood how the result of this method is used in the refresh lifecyle, let's walk through how
-    /// to implement it. You should return `true` in this method if the `URLRequest` is authenticated in a way that
-    /// matches the values in the `Credential`. In the case of OAuth2, this would mean that the Bearer token in the
-    /// `Authorization` header of the `URLRequest` matches the access token in the `Credential`. If it matches, then we
-    /// know the `Credential` was used to authenticate the `URLRequest` and should return `true`. If the Bearer token
-    /// did not match the access token, then you should return `false`.
-    ///
-    /// - Parameters:
-    ///   - urlRequest: The `URLRequest`.
-    ///   - credential: The `Credential`.
-    ///
-    /// - Returns: `true` if the `URLRequest` is authenticated with the `Credential`, `false` otherwise.
-    func isRequest(_ urlRequest: URLRequest, authenticatedWith credential: Credential) -> Bool
-}
-
-// MARK: -
-
-/// Represents various authentication failures that occur when using the `AuthenticationInterceptor`. All errors are
-/// still vended from Alamofire as `AFError` types. The `AuthenticationError` instances will be embedded within
-/// `AFError` `.requestAdaptationFailed` or `.requestRetryFailed` cases.
-public enum AuthenticationError: Error {
-    /// The credential was missing so the request could not be authenticated.
-    case missingCredential
-    /// The credential was refreshed too many times within the `RefreshWindow`.
-    case excessiveRefresh
-}
-
-// MARK: -
-
-/// The `AuthenticationInterceptor` class manages the queuing and threading complexity of authenticating requests.
-/// It relies on an `Authenticator` type to handle the actual `URLRequest` authentication and `Credential` refresh.
-public class AuthenticationInterceptor<AuthenticatorType>: RequestInterceptor where AuthenticatorType: Authenticator {
-    // MARK: Typealiases
-
-    /// Type of credential used to authenticate requests.
-    public typealias Credential = AuthenticatorType.Credential
-
-    // MARK: Helper Types
-
-    /// Type that defines a time window used to identify excessive refresh calls. When enabled, prior to executing a
-    /// refresh, the `AuthenticationInterceptor` compares the timestamp history of previous refresh calls against the
-    /// `RefreshWindow`. If more refreshes have occurred within the refresh window than allowed, the refresh is
-    /// cancelled and an `AuthorizationError.excessiveRefresh` error is thrown.
-    public struct RefreshWindow {
-        /// `TimeInterval` defining the duration of the time window before the current time in which the number of
-        /// refresh attempts is compared against `maximumAttempts`. For example, if `interval` is 30 seconds, then the
-        /// `RefreshWindow` represents the past 30 seconds. If more attempts occurred in the past 30 seconds than
-        /// `maximumAttempts`, an `.excessiveRefresh` error will be thrown.
-        public let interval: TimeInterval
-
-        /// Total refresh attempts allowed within `interval` before throwing an `.excessiveRefresh` error.
-        public let maximumAttempts: Int
-
-        /// Creates a `RefreshWindow` instance from the specified `interval` and `maximumAttempts`.
-        ///
-        /// - Parameters:
-        ///   - interval:        `TimeInterval` defining the duration of the time window before the current time.
-        ///   - maximumAttempts: The maximum attempts allowed within the `TimeInterval`.
-        public init(interval: TimeInterval = 30.0, maximumAttempts: Int = 5) {
-            self.interval = interval
-            self.maximumAttempts = maximumAttempts
-        }
-    }
-
-    private struct AdaptOperation {
-        let urlRequest: URLRequest
-        let session: Session
-        let completion: (Result<URLRequest, Error>) -> Void
-    }
-
-    private enum AdaptResult {
-        case adapt(Credential)
-        case doNotAdapt(AuthenticationError)
-        case adaptDeferred
-    }
-
-    private struct MutableState {
-        var credential: Credential?
-
-        var isRefreshing = false
-        var refreshTimestamps: [TimeInterval] = []
-        var refreshWindow: RefreshWindow?
-
-        var adaptOperations: [AdaptOperation] = []
-        var requestsToRetry: [(RetryResult) -> Void] = []
-    }
-
-    // MARK: Properties
-
-    /// The `Credential` used to authenticate requests.
-    public var credential: Credential? {
-        get { mutableState.credential }
-        set { mutableState.credential = newValue }
-    }
-
-    let authenticator: AuthenticatorType
-    let queue = DispatchQueue(label: "org.alamofire.authentication.inspector")
-
-    @Protected
-    private var mutableState = MutableState()
-
-    // MARK: Initialization
-
-    /// Creates an `AuthenticationInterceptor` instance from the specified parameters.
-    ///
-    /// A `nil` `RefreshWindow` will result in the `AuthenticationInterceptor` not checking for excessive refresh calls.
-    /// It is recommended to always use a `RefreshWindow` to avoid endless refresh cycles.
-    ///
-    /// - Parameters:
-    ///   - authenticator: The `Authenticator` type.
-    ///   - credential:    The `Credential` if it exists. `nil` by default.
-    ///   - refreshWindow: The `RefreshWindow` used to identify excessive refresh calls. `RefreshWindow()` by default.
-    public init(authenticator: AuthenticatorType,
-                credential: Credential? = nil,
-                refreshWindow: RefreshWindow? = RefreshWindow()) {
-        self.authenticator = authenticator
-        mutableState.credential = credential
-        mutableState.refreshWindow = refreshWindow
-    }
-
-    // MARK: Adapt
-
-    public func adapt(_ urlRequest: URLRequest, for session: Session, completion: @escaping (Result<URLRequest, Error>) -> Void) {
-        let adaptResult: AdaptResult = $mutableState.write { mutableState in
-            // Queue the adapt operation if a refresh is already in place.
-            guard !mutableState.isRefreshing else {
-                let operation = AdaptOperation(urlRequest: urlRequest, session: session, completion: completion)
-                mutableState.adaptOperations.append(operation)
-                return .adaptDeferred
-            }
-
-            // Throw missing credential error is the credential is missing.
-            guard let credential = mutableState.credential else {
-                let error = AuthenticationError.missingCredential
-                return .doNotAdapt(error)
-            }
-
-            // Queue the adapt operation and trigger refresh operation if credential requires refresh.
-            guard !credential.requiresRefresh else {
-                let operation = AdaptOperation(urlRequest: urlRequest, session: session, completion: completion)
-                mutableState.adaptOperations.append(operation)
-                refresh(credential, for: session, insideLock: &mutableState)
-                return .adaptDeferred
-            }
-
-            return .adapt(credential)
-        }
-
-        switch adaptResult {
-        case let .adapt(credential):
-            var authenticatedRequest = urlRequest
-            authenticator.apply(credential, to: &authenticatedRequest)
-            completion(.success(authenticatedRequest))
-
-        case let .doNotAdapt(adaptError):
-            completion(.failure(adaptError))
-
-        case .adaptDeferred:
-            // No-op: adapt operation captured during refresh.
-            break
-        }
-    }
-
-    // MARK: Retry
-
-    public func retry(_ request: Request, for session: Session, dueTo error: Error, completion: @escaping (RetryResult) -> Void) {
-        // Do not attempt retry if there was not an original request and response from the server.
-        guard let urlRequest = request.request, let response = request.response else {
-            completion(.doNotRetry)
-            return
-        }
-
-        // Do not attempt retry unless the `Authenticator` verifies failure was due to authentication error (i.e. 401 status code).
-        guard authenticator.didRequest(urlRequest, with: response, failDueToAuthenticationError: error) else {
-            completion(.doNotRetry)
-            return
-        }
-
-        // Do not attempt retry if there is no credential.
-        guard let credential = credential else {
-            let error = AuthenticationError.missingCredential
-            completion(.doNotRetryWithError(error))
-            return
-        }
-
-        // Retry the request if the `Authenticator` verifies it was authenticated with a previous credential.
-        guard authenticator.isRequest(urlRequest, authenticatedWith: credential) else {
-            completion(.retry)
-            return
-        }
-
-        $mutableState.write { mutableState in
-            mutableState.requestsToRetry.append(completion)
-
-            guard !mutableState.isRefreshing else { return }
-
-            refresh(credential, for: session, insideLock: &mutableState)
-        }
-    }
-
-    // MARK: Refresh
-
-    private func refresh(_ credential: Credential, for session: Session, insideLock mutableState: inout MutableState) {
-        guard !isRefreshExcessive(insideLock: &mutableState) else {
-            let error = AuthenticationError.excessiveRefresh
-            handleRefreshFailure(error, insideLock: &mutableState)
-            return
-        }
-
-        mutableState.refreshTimestamps.append(ProcessInfo.processInfo.systemUptime)
-        mutableState.isRefreshing = true
-
-        // Dispatch to queue to hop out of the lock in case authenticator.refresh is implemented synchronously.
-        queue.async {
-            self.authenticator.refresh(credential, for: session) { result in
-                self.$mutableState.write { mutableState in
-                    switch result {
-                    case let .success(credential):
-                        self.handleRefreshSuccess(credential, insideLock: &mutableState)
-                    case let .failure(error):
-                        self.handleRefreshFailure(error, insideLock: &mutableState)
-                    }
-                }
-            }
-        }
-    }
-
-    private func isRefreshExcessive(insideLock mutableState: inout MutableState) -> Bool {
-        guard let refreshWindow = mutableState.refreshWindow else { return false }
-
-        let refreshWindowMin = ProcessInfo.processInfo.systemUptime - refreshWindow.interval
-
-        let refreshAttemptsWithinWindow = mutableState.refreshTimestamps.reduce(into: 0) { attempts, refreshTimestamp in
-            guard refreshWindowMin <= refreshTimestamp else { return }
-            attempts += 1
-        }
-
-        let isRefreshExcessive = refreshAttemptsWithinWindow >= refreshWindow.maximumAttempts
-
-        return isRefreshExcessive
-    }
-
-    private func handleRefreshSuccess(_ credential: Credential, insideLock mutableState: inout MutableState) {
-        mutableState.credential = credential
-
-        let adaptOperations = mutableState.adaptOperations
-        let requestsToRetry = mutableState.requestsToRetry
-
-        mutableState.adaptOperations.removeAll()
-        mutableState.requestsToRetry.removeAll()
-
-        mutableState.isRefreshing = false
-
-        // Dispatch to queue to hop out of the mutable state lock
-        queue.async {
-            adaptOperations.forEach { self.adapt($0.urlRequest, for: $0.session, completion: $0.completion) }
-            requestsToRetry.forEach { $0(.retry) }
-        }
-    }
-
-    private func handleRefreshFailure(_ error: Error, insideLock mutableState: inout MutableState) {
-        let adaptOperations = mutableState.adaptOperations
-        let requestsToRetry = mutableState.requestsToRetry
-
-        mutableState.adaptOperations.removeAll()
-        mutableState.requestsToRetry.removeAll()
-
-        mutableState.isRefreshing = false
-
-        // Dispatch to queue to hop out of the mutable state lock
-        queue.async {
-            adaptOperations.forEach { $0.completion(.failure(error)) }
-            requestsToRetry.forEach { $0(.doNotRetryWithError(error)) }
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/CachedResponseHandler.swift b/Pods/Alamofire/Source/CachedResponseHandler.swift
deleted file mode 100644
index b6e0d4b2a..000000000
--- a/Pods/Alamofire/Source/CachedResponseHandler.swift
+++ /dev/null
@@ -1,91 +0,0 @@
-//
-//  CachedResponseHandler.swift
-//
-//  Copyright (c) 2019 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// A type that handles whether the data task should store the HTTP response in the cache.
-public protocol CachedResponseHandler {
-    /// Determines whether the HTTP response should be stored in the cache.
-    ///
-    /// The `completion` closure should be passed one of three possible options:
-    ///
-    ///   1. The cached response provided by the server (this is the most common use case).
-    ///   2. A modified version of the cached response (you may want to modify it in some way before caching).
-    ///   3. A `nil` value to prevent the cached response from being stored in the cache.
-    ///
-    /// - Parameters:
-    ///   - task:       The data task whose request resulted in the cached response.
-    ///   - response:   The cached response to potentially store in the cache.
-    ///   - completion: The closure to execute containing cached response, a modified response, or `nil`.
-    func dataTask(_ task: URLSessionDataTask,
-                  willCacheResponse response: CachedURLResponse,
-                  completion: @escaping (CachedURLResponse?) -> Void)
-}
-
-// MARK: -
-
-/// `ResponseCacher` is a convenience `CachedResponseHandler` making it easy to cache, not cache, or modify a cached
-/// response.
-public struct ResponseCacher {
-    /// Defines the behavior of the `ResponseCacher` type.
-    public enum Behavior {
-        /// Stores the cached response in the cache.
-        case cache
-        /// Prevents the cached response from being stored in the cache.
-        case doNotCache
-        /// Modifies the cached response before storing it in the cache.
-        case modify((URLSessionDataTask, CachedURLResponse) -> CachedURLResponse?)
-    }
-
-    /// Returns a `ResponseCacher` with a follow `Behavior`.
-    public static let cache = ResponseCacher(behavior: .cache)
-    /// Returns a `ResponseCacher` with a do not follow `Behavior`.
-    public static let doNotCache = ResponseCacher(behavior: .doNotCache)
-
-    /// The `Behavior` of the `ResponseCacher`.
-    public let behavior: Behavior
-
-    /// Creates a `ResponseCacher` instance from the `Behavior`.
-    ///
-    /// - Parameter behavior: The `Behavior`.
-    public init(behavior: Behavior) {
-        self.behavior = behavior
-    }
-}
-
-extension ResponseCacher: CachedResponseHandler {
-    public func dataTask(_ task: URLSessionDataTask,
-                         willCacheResponse response: CachedURLResponse,
-                         completion: @escaping (CachedURLResponse?) -> Void) {
-        switch behavior {
-        case .cache:
-            completion(response)
-        case .doNotCache:
-            completion(nil)
-        case let .modify(closure):
-            let response = closure(task, response)
-            completion(response)
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/Combine.swift b/Pods/Alamofire/Source/Combine.swift
deleted file mode 100644
index a13824946..000000000
--- a/Pods/Alamofire/Source/Combine.swift
+++ /dev/null
@@ -1,622 +0,0 @@
-//
-//  Combine.swift
-//
-//  Copyright (c) 2020 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-#if canImport(Combine)
-
-import Combine
-import Dispatch
-import Foundation
-
-// MARK: - DataRequest / UploadRequest
-
-/// A Combine `Publisher` that publishes the `DataResponse<Value, AFError>` of the provided `DataRequest`.
-@available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-public struct DataResponsePublisher<Value>: Publisher {
-    public typealias Output = DataResponse<Value, AFError>
-    public typealias Failure = Never
-
-    private typealias Handler = (@escaping (_ response: DataResponse<Value, AFError>) -> Void) -> DataRequest
-
-    private let request: DataRequest
-    private let responseHandler: Handler
-
-    /// Creates an instance which will serialize responses using the provided `ResponseSerializer`.
-    ///
-    /// - Parameters:
-    ///   - request:    `DataRequest` for which to publish the response.
-    ///   - queue:      `DispatchQueue` on which the `DataResponse` value will be published. `.main` by default.
-    ///   - serializer: `ResponseSerializer` used to produce the published `DataResponse`.
-    public init<Serializer: ResponseSerializer>(_ request: DataRequest, queue: DispatchQueue, serializer: Serializer)
-        where Value == Serializer.SerializedObject {
-        self.request = request
-        responseHandler = { request.response(queue: queue, responseSerializer: serializer, completionHandler: $0) }
-    }
-
-    /// Creates an instance which will serialize responses using the provided `DataResponseSerializerProtocol`.
-    ///
-    /// - Parameters:
-    ///   - request:    `DataRequest` for which to publish the response.
-    ///   - queue:      `DispatchQueue` on which the `DataResponse` value will be published. `.main` by default.
-    ///   - serializer: `DataResponseSerializerProtocol` used to produce the published `DataResponse`.
-    public init<Serializer: DataResponseSerializerProtocol>(_ request: DataRequest,
-                                                            queue: DispatchQueue,
-                                                            serializer: Serializer)
-        where Value == Serializer.SerializedObject {
-        self.request = request
-        responseHandler = { request.response(queue: queue, responseSerializer: serializer, completionHandler: $0) }
-    }
-
-    /// Publishes only the `Result` of the `DataResponse` value.
-    ///
-    /// - Returns: The `AnyPublisher` publishing the `Result<Value, AFError>` value.
-    public func result() -> AnyPublisher<Result<Value, AFError>, Never> {
-        map { $0.result }.eraseToAnyPublisher()
-    }
-
-    /// Publishes the `Result` of the `DataResponse` as a single `Value` or fail with the `AFError` instance.
-    ///
-    /// - Returns: The `AnyPublisher<Value, AFError>` publishing the stream.
-    public func value() -> AnyPublisher<Value, AFError> {
-        setFailureType(to: AFError.self).flatMap { $0.result.publisher }.eraseToAnyPublisher()
-    }
-
-    public func receive<S>(subscriber: S) where S: Subscriber, DataResponsePublisher.Failure == S.Failure, DataResponsePublisher.Output == S.Input {
-        subscriber.receive(subscription: Inner(request: request,
-                                               responseHandler: responseHandler,
-                                               downstream: subscriber))
-    }
-
-    private final class Inner<Downstream: Subscriber>: Subscription, Cancellable
-        where Downstream.Input == Output {
-        typealias Failure = Downstream.Failure
-
-        @Protected
-        private var downstream: Downstream?
-        private let request: DataRequest
-        private let responseHandler: Handler
-
-        init(request: DataRequest, responseHandler: @escaping Handler, downstream: Downstream) {
-            self.request = request
-            self.responseHandler = responseHandler
-            self.downstream = downstream
-        }
-
-        func request(_ demand: Subscribers.Demand) {
-            assert(demand > 0)
-
-            guard let downstream = downstream else { return }
-
-            self.downstream = nil
-            responseHandler { response in
-                _ = downstream.receive(response)
-                downstream.receive(completion: .finished)
-            }.resume()
-        }
-
-        func cancel() {
-            request.cancel()
-            downstream = nil
-        }
-    }
-}
-
-@available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-extension DataResponsePublisher where Value == Data? {
-    /// Creates an instance which publishes a `DataResponse<Data?, AFError>` value without serialization.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public init(_ request: DataRequest, queue: DispatchQueue) {
-        self.request = request
-        responseHandler = { request.response(queue: queue, completionHandler: $0) }
-    }
-}
-
-extension DataRequest {
-    /// Creates a `DataResponsePublisher` for this instance using the given `ResponseSerializer` and `DispatchQueue`.
-    ///
-    /// - Parameters:
-    ///   - serializer: `ResponseSerializer` used to serialize response `Data`.
-    ///   - queue:      `DispatchQueue` on which the `DataResponse` will be published. `.main` by default.
-    ///
-    /// - Returns:      The `DataResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishResponse<Serializer: ResponseSerializer, T>(using serializer: Serializer, on queue: DispatchQueue = .main) -> DataResponsePublisher<T>
-        where Serializer.SerializedObject == T {
-        DataResponsePublisher(self, queue: queue, serializer: serializer)
-    }
-
-    /// Creates a `DataResponsePublisher` for this instance and uses a `DataResponseSerializer` to serialize the
-    /// response.
-    ///
-    /// - Parameters:
-    ///   - queue:               `DispatchQueue` on which the `DataResponse` will be published. `.main` by default.
-    ///   - preprocessor:        `DataPreprocessor` which filters the `Data` before serialization. `PassthroughPreprocessor()`
-    ///                          by default.
-    ///   - emptyResponseCodes:  `Set<Int>` of HTTP status codes for which empty responses are allowed. `[204, 205]` by
-    ///                          default.
-    ///   - emptyRequestMethods: `Set<HTTPMethod>` of `HTTPMethod`s for which empty responses are allowed, regardless of
-    ///                          status code. `[.head]` by default.
-    /// - Returns:               The `DataResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishData(queue: DispatchQueue = .main,
-                            preprocessor: DataPreprocessor = DataResponseSerializer.defaultDataPreprocessor,
-                            emptyResponseCodes: Set<Int> = DataResponseSerializer.defaultEmptyResponseCodes,
-                            emptyRequestMethods: Set<HTTPMethod> = DataResponseSerializer.defaultEmptyRequestMethods) -> DataResponsePublisher<Data> {
-        publishResponse(using: DataResponseSerializer(dataPreprocessor: preprocessor,
-                                                      emptyResponseCodes: emptyResponseCodes,
-                                                      emptyRequestMethods: emptyRequestMethods),
-                        on: queue)
-    }
-
-    /// Creates a `DataResponsePublisher` for this instance and uses a `StringResponseSerializer` to serialize the
-    /// response.
-    ///
-    /// - Parameters:
-    ///   - queue:               `DispatchQueue` on which the `DataResponse` will be published. `.main` by default.
-    ///   - preprocessor:        `DataPreprocessor` which filters the `Data` before serialization. `PassthroughPreprocessor()`
-    ///                          by default.
-    ///   - encoding:            `String.Encoding` to parse the response. `nil` by default, in which case the encoding
-    ///                          will be determined by the server response, falling back to the default HTTP character
-    ///                          set, `ISO-8859-1`.
-    ///   - emptyResponseCodes:  `Set<Int>` of HTTP status codes for which empty responses are allowed. `[204, 205]` by
-    ///                          default.
-    ///   - emptyRequestMethods: `Set<HTTPMethod>` of `HTTPMethod`s for which empty responses are allowed, regardless of
-    ///                          status code. `[.head]` by default.
-    ///
-    /// - Returns:               The `DataResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishString(queue: DispatchQueue = .main,
-                              preprocessor: DataPreprocessor = StringResponseSerializer.defaultDataPreprocessor,
-                              encoding: String.Encoding? = nil,
-                              emptyResponseCodes: Set<Int> = StringResponseSerializer.defaultEmptyResponseCodes,
-                              emptyRequestMethods: Set<HTTPMethod> = StringResponseSerializer.defaultEmptyRequestMethods) -> DataResponsePublisher<String> {
-        publishResponse(using: StringResponseSerializer(dataPreprocessor: preprocessor,
-                                                        encoding: encoding,
-                                                        emptyResponseCodes: emptyResponseCodes,
-                                                        emptyRequestMethods: emptyRequestMethods),
-                        on: queue)
-    }
-
-    /// Creates a `DataResponsePublisher` for this instance and uses a `DecodableResponseSerializer` to serialize the
-    /// response.
-    ///
-    /// - Parameters:
-    ///   - type:                `Decodable` type to which to decode response `Data`. Inferred from the context by default.
-    ///   - queue:               `DispatchQueue` on which the `DataResponse` will be published. `.main` by default.
-    ///   - preprocessor:        `DataPreprocessor` which filters the `Data` before serialization. `PassthroughPreprocessor()`
-    ///                          by default.
-    ///   - decoder:             `DataDecoder` instance used to decode response `Data`. `JSONDecoder()` by default.
-    ///   - emptyResponseCodes:  `Set<Int>` of HTTP status codes for which empty responses are allowed. `[204, 205]` by
-    ///                          default.
-    ///   - emptyRequestMethods: `Set<HTTPMethod>` of `HTTPMethod`s for which empty responses are allowed, regardless of
-    ///                          status code. `[.head]` by default.
-    ///
-    /// - Returns:               The `DataResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishDecodable<T: Decodable>(type: T.Type = T.self,
-                                               queue: DispatchQueue = .main,
-                                               preprocessor: DataPreprocessor = DecodableResponseSerializer<T>.defaultDataPreprocessor,
-                                               decoder: DataDecoder = JSONDecoder(),
-                                               emptyResponseCodes: Set<Int> = DecodableResponseSerializer<T>.defaultEmptyResponseCodes,
-                                               emptyResponseMethods: Set<HTTPMethod> = DecodableResponseSerializer<T>.defaultEmptyRequestMethods) -> DataResponsePublisher<T> {
-        publishResponse(using: DecodableResponseSerializer(dataPreprocessor: preprocessor,
-                                                           decoder: decoder,
-                                                           emptyResponseCodes: emptyResponseCodes,
-                                                           emptyRequestMethods: emptyResponseMethods),
-                        on: queue)
-    }
-
-    /// Creates a `DataResponsePublisher` for this instance which does not serialize the response before publishing.
-    ///
-    ///   - queue: `DispatchQueue` on which the `DataResponse` will be published. `.main` by default.
-    ///
-    /// - Returns: The `DataResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishUnserialized(queue: DispatchQueue = .main) -> DataResponsePublisher<Data?> {
-        DataResponsePublisher(self, queue: queue)
-    }
-}
-
-// A Combine `Publisher` that publishes a sequence of `Stream<Value, AFError>` values received by the provided `DataStreamRequest`.
-@available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-public struct DataStreamPublisher<Value>: Publisher {
-    public typealias Output = DataStreamRequest.Stream<Value, AFError>
-    public typealias Failure = Never
-
-    private typealias Handler = (@escaping DataStreamRequest.Handler<Value, AFError>) -> DataStreamRequest
-
-    private let request: DataStreamRequest
-    private let streamHandler: Handler
-
-    /// Creates an instance which will serialize responses using the provided `DataStreamSerializer`.
-    ///
-    /// - Parameters:
-    ///   - request:    `DataStreamRequest` for which to publish the response.
-    ///   - queue:      `DispatchQueue` on which the `Stream<Value, AFError>` values will be published. `.main` by
-    ///                 default.
-    ///   - serializer: `DataStreamSerializer` used to produce the published `Stream<Value, AFError>` values.
-    public init<Serializer: DataStreamSerializer>(_ request: DataStreamRequest, queue: DispatchQueue, serializer: Serializer)
-        where Value == Serializer.SerializedObject {
-        self.request = request
-        streamHandler = { request.responseStream(using: serializer, on: queue, stream: $0) }
-    }
-
-    /// Publishes only the `Result` of the `DataStreamRequest.Stream`'s `Event`s.
-    ///
-    /// - Returns: The `AnyPublisher` publishing the `Result<Value, AFError>` value.
-    public func result() -> AnyPublisher<Result<Value, AFError>, Never> {
-        compactMap { stream in
-            switch stream.event {
-            case let .stream(result):
-                return result
-            // If the stream has completed with an error, send the error value downstream as a `.failure`.
-            case let .complete(completion):
-                return completion.error.map(Result.failure)
-            }
-        }
-        .eraseToAnyPublisher()
-    }
-
-    /// Publishes the streamed values of the `DataStreamRequest.Stream` as a sequence of `Value` or fail with the
-    /// `AFError` instance.
-    ///
-    /// - Returns: The `AnyPublisher<Value, AFError>` publishing the stream.
-    public func value() -> AnyPublisher<Value, AFError> {
-        result().setFailureType(to: AFError.self).flatMap { $0.publisher }.eraseToAnyPublisher()
-    }
-
-    public func receive<S>(subscriber: S) where S: Subscriber, DataStreamPublisher.Failure == S.Failure, DataStreamPublisher.Output == S.Input {
-        subscriber.receive(subscription: Inner(request: request,
-                                               streamHandler: streamHandler,
-                                               downstream: subscriber))
-    }
-
-    private final class Inner<Downstream: Subscriber>: Subscription, Cancellable
-        where Downstream.Input == Output {
-        typealias Failure = Downstream.Failure
-
-        @Protected
-        private var downstream: Downstream?
-        private let request: DataStreamRequest
-        private let streamHandler: Handler
-
-        init(request: DataStreamRequest, streamHandler: @escaping Handler, downstream: Downstream) {
-            self.request = request
-            self.streamHandler = streamHandler
-            self.downstream = downstream
-        }
-
-        func request(_ demand: Subscribers.Demand) {
-            assert(demand > 0)
-
-            guard let downstream = downstream else { return }
-
-            self.downstream = nil
-            streamHandler { stream in
-                _ = downstream.receive(stream)
-                if case .complete = stream.event {
-                    downstream.receive(completion: .finished)
-                }
-            }.resume()
-        }
-
-        func cancel() {
-            request.cancel()
-            downstream = nil
-        }
-    }
-}
-
-extension DataStreamRequest {
-    /// Creates a `DataStreamPublisher` for this instance using the given `DataStreamSerializer` and `DispatchQueue`.
-    ///
-    /// - Parameters:
-    ///   - serializer: `DataStreamSerializer` used to serialize the streamed `Data`.
-    ///   - queue:      `DispatchQueue` on which the `DataRequest.Stream` values will be published. `.main` by default.
-    /// - Returns:      The `DataStreamPublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishStream<Serializer: DataStreamSerializer>(using serializer: Serializer,
-                                                                on queue: DispatchQueue = .main) -> DataStreamPublisher<Serializer.SerializedObject> {
-        DataStreamPublisher(self, queue: queue, serializer: serializer)
-    }
-
-    /// Creates a `DataStreamPublisher` for this instance which uses a `PassthroughStreamSerializer` to stream `Data`
-    /// unserialized.
-    ///
-    /// - Parameters:
-    ///   - queue:      `DispatchQueue` on which the `DataRequest.Stream` values will be published. `.main` by default.
-    /// - Returns:      The `DataStreamPublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishData(queue: DispatchQueue = .main) -> DataStreamPublisher<Data> {
-        publishStream(using: PassthroughStreamSerializer(), on: queue)
-    }
-
-    /// Creates a `DataStreamPublisher` for this instance which uses a `StringStreamSerializer` to serialize stream
-    /// `Data` values into `String` values.
-    ///
-    /// - Parameters:
-    ///   - queue:      `DispatchQueue` on which the `DataRequest.Stream` values will be published. `.main` by default.
-    /// - Returns:      The `DataStreamPublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishString(queue: DispatchQueue = .main) -> DataStreamPublisher<String> {
-        publishStream(using: StringStreamSerializer(), on: queue)
-    }
-
-    /// Creates a `DataStreamPublisher` for this instance which uses a `DecodableStreamSerializer` with the provided
-    /// parameters to serialize stream `Data` values into the provided type.
-    ///
-    /// - Parameters:
-    ///   - type:         `Decodable` type to which to decode stream `Data`. Inferred from the context by default.
-    ///   - queue:        `DispatchQueue` on which the `DataRequest.Stream` values will be published. `.main` by default.
-    ///   - decoder:      `DataDecoder` instance used to decode stream `Data`. `JSONDecoder()` by default.
-    ///   - preprocessor: `DataPreprocessor` which filters incoming stream `Data` before serialization.
-    ///                   `PassthroughPreprocessor()` by default.
-    /// - Returns:        The `DataStreamPublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishDecodable<T: Decodable>(type: T.Type = T.self,
-                                               queue: DispatchQueue = .main,
-                                               decoder: DataDecoder = JSONDecoder(),
-                                               preprocessor: DataPreprocessor = PassthroughPreprocessor()) -> DataStreamPublisher<T> {
-        publishStream(using: DecodableStreamSerializer(decoder: decoder,
-                                                       dataPreprocessor: preprocessor),
-                      on: queue)
-    }
-}
-
-/// A Combine `Publisher` that publishes the `DownloadResponse<Value, AFError>` of the provided `DownloadRequest`.
-@available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-public struct DownloadResponsePublisher<Value>: Publisher {
-    public typealias Output = DownloadResponse<Value, AFError>
-    public typealias Failure = Never
-
-    private typealias Handler = (@escaping (_ response: DownloadResponse<Value, AFError>) -> Void) -> DownloadRequest
-
-    private let request: DownloadRequest
-    private let responseHandler: Handler
-
-    /// Creates an instance which will serialize responses using the provided `ResponseSerializer`.
-    ///
-    /// - Parameters:
-    ///   - request:    `DownloadRequest` for which to publish the response.
-    ///   - queue:      `DispatchQueue` on which the `DownloadResponse` value will be published. `.main` by default.
-    ///   - serializer: `ResponseSerializer` used to produce the published `DownloadResponse`.
-    public init<Serializer: ResponseSerializer>(_ request: DownloadRequest, queue: DispatchQueue, serializer: Serializer)
-        where Value == Serializer.SerializedObject {
-        self.request = request
-        responseHandler = { request.response(queue: queue, responseSerializer: serializer, completionHandler: $0) }
-    }
-
-    /// Creates an instance which will serialize responses using the provided `DownloadResponseSerializerProtocol` value.
-    ///
-    /// - Parameters:
-    ///   - request:    `DownloadRequest` for which to publish the response.
-    ///   - queue:      `DispatchQueue` on which the `DataResponse` value will be published. `.main` by default.
-    ///   - serializer: `DownloadResponseSerializerProtocol` used to produce the published `DownloadResponse`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public init<Serializer: DownloadResponseSerializerProtocol>(_ request: DownloadRequest,
-                                                                queue: DispatchQueue,
-                                                                serializer: Serializer)
-        where Value == Serializer.SerializedObject {
-        self.request = request
-        responseHandler = { request.response(queue: queue, responseSerializer: serializer, completionHandler: $0) }
-    }
-
-    /// Publishes only the `Result` of the `DownloadResponse` value.
-    ///
-    /// - Returns: The `AnyPublisher` publishing the `Result<Value, AFError>` value.
-    public func result() -> AnyPublisher<Result<Value, AFError>, Never> {
-        map { $0.result }.eraseToAnyPublisher()
-    }
-
-    /// Publishes the `Result` of the `DownloadResponse` as a single `Value` or fail with the `AFError` instance.
-    ///
-    /// - Returns: The `AnyPublisher<Value, AFError>` publishing the stream.
-    public func value() -> AnyPublisher<Value, AFError> {
-        setFailureType(to: AFError.self).flatMap { $0.result.publisher }.eraseToAnyPublisher()
-    }
-
-    public func receive<S>(subscriber: S) where S: Subscriber, DownloadResponsePublisher.Failure == S.Failure, DownloadResponsePublisher.Output == S.Input {
-        subscriber.receive(subscription: Inner(request: request,
-                                               responseHandler: responseHandler,
-                                               downstream: subscriber))
-    }
-
-    private final class Inner<Downstream: Subscriber>: Subscription, Cancellable
-        where Downstream.Input == Output {
-        typealias Failure = Downstream.Failure
-
-        @Protected
-        private var downstream: Downstream?
-        private let request: DownloadRequest
-        private let responseHandler: Handler
-
-        init(request: DownloadRequest, responseHandler: @escaping Handler, downstream: Downstream) {
-            self.request = request
-            self.responseHandler = responseHandler
-            self.downstream = downstream
-        }
-
-        func request(_ demand: Subscribers.Demand) {
-            assert(demand > 0)
-
-            guard let downstream = downstream else { return }
-
-            self.downstream = nil
-            responseHandler { response in
-                _ = downstream.receive(response)
-                downstream.receive(completion: .finished)
-            }.resume()
-        }
-
-        func cancel() {
-            request.cancel()
-            downstream = nil
-        }
-    }
-}
-
-extension DownloadRequest {
-    /// Creates a `DownloadResponsePublisher` for this instance using the given `ResponseSerializer` and `DispatchQueue`.
-    ///
-    /// - Parameters:
-    ///   - serializer: `ResponseSerializer` used to serialize the response `Data` from disk.
-    ///   - queue:      `DispatchQueue` on which the `DownloadResponse` will be published.`.main` by default.
-    ///
-    /// - Returns:      The `DownloadResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishResponse<Serializer: ResponseSerializer, T>(using serializer: Serializer, on queue: DispatchQueue = .main) -> DownloadResponsePublisher<T>
-        where Serializer.SerializedObject == T {
-        DownloadResponsePublisher(self, queue: queue, serializer: serializer)
-    }
-
-    /// Creates a `DownloadResponsePublisher` for this instance using the given `DownloadResponseSerializerProtocol` and
-    /// `DispatchQueue`.
-    ///
-    /// - Parameters:
-    ///   - serializer: `DownloadResponseSerializer` used to serialize the response `Data` from disk.
-    ///   - queue:      `DispatchQueue` on which the `DownloadResponse` will be published.`.main` by default.
-    ///
-    /// - Returns:      The `DownloadResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishResponse<Serializer: DownloadResponseSerializerProtocol, T>(using serializer: Serializer, on queue: DispatchQueue = .main) -> DownloadResponsePublisher<T>
-        where Serializer.SerializedObject == T {
-        DownloadResponsePublisher(self, queue: queue, serializer: serializer)
-    }
-
-    /// Creates a `DownloadResponsePublisher` for this instance and uses a `URLResponseSerializer` to serialize the
-    /// response.
-    ///
-    /// - Parameter queue: `DispatchQueue` on which the `DownloadResponse` will be published. `.main` by default.
-    ///
-    /// - Returns:         The `DownloadResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishURL(queue: DispatchQueue = .main) -> DownloadResponsePublisher<URL> {
-        publishResponse(using: URLResponseSerializer(), on: queue)
-    }
-
-    /// Creates a `DownloadResponsePublisher` for this instance and uses a `DataResponseSerializer` to serialize the
-    /// response.
-    ///
-    /// - Parameters:
-    ///   - queue:               `DispatchQueue` on which the `DownloadResponse` will be published. `.main` by default.
-    ///   - preprocessor:        `DataPreprocessor` which filters the `Data` before serialization. `PassthroughPreprocessor()`
-    ///                          by default.
-    ///   - emptyResponseCodes:  `Set<Int>` of HTTP status codes for which empty responses are allowed. `[204, 205]` by
-    ///                          default.
-    ///   - emptyRequestMethods: `Set<HTTPMethod>` of `HTTPMethod`s for which empty responses are allowed, regardless of
-    ///                          status code. `[.head]` by default.
-    ///
-    /// - Returns:               The `DownloadResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishData(queue: DispatchQueue = .main,
-                            preprocessor: DataPreprocessor = DataResponseSerializer.defaultDataPreprocessor,
-                            emptyResponseCodes: Set<Int> = DataResponseSerializer.defaultEmptyResponseCodes,
-                            emptyRequestMethods: Set<HTTPMethod> = DataResponseSerializer.defaultEmptyRequestMethods) -> DownloadResponsePublisher<Data> {
-        publishResponse(using: DataResponseSerializer(dataPreprocessor: preprocessor,
-                                                      emptyResponseCodes: emptyResponseCodes,
-                                                      emptyRequestMethods: emptyRequestMethods),
-                        on: queue)
-    }
-
-    /// Creates a `DataResponsePublisher` for this instance and uses a `StringResponseSerializer` to serialize the
-    /// response.
-    ///
-    /// - Parameters:
-    ///   - queue:               `DispatchQueue` on which the `DataResponse` will be published. `.main` by default.
-    ///   - preprocessor:        `DataPreprocessor` which filters the `Data` before serialization. `PassthroughPreprocessor()`
-    ///                          by default.
-    ///   - encoding:            `String.Encoding` to parse the response. `nil` by default, in which case the encoding
-    ///                          will be determined by the server response, falling back to the default HTTP character
-    ///                          set, `ISO-8859-1`.
-    ///   - emptyResponseCodes:  `Set<Int>` of HTTP status codes for which empty responses are allowed. `[204, 205]` by
-    ///                          default.
-    ///   - emptyRequestMethods: `Set<HTTPMethod>` of `HTTPMethod`s for which empty responses are allowed, regardless of
-    ///                          status code. `[.head]` by default.
-    ///
-    /// - Returns:               The `DownloadResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishString(queue: DispatchQueue = .main,
-                              preprocessor: DataPreprocessor = StringResponseSerializer.defaultDataPreprocessor,
-                              encoding: String.Encoding? = nil,
-                              emptyResponseCodes: Set<Int> = StringResponseSerializer.defaultEmptyResponseCodes,
-                              emptyRequestMethods: Set<HTTPMethod> = StringResponseSerializer.defaultEmptyRequestMethods) -> DownloadResponsePublisher<String> {
-        publishResponse(using: StringResponseSerializer(dataPreprocessor: preprocessor,
-                                                        encoding: encoding,
-                                                        emptyResponseCodes: emptyResponseCodes,
-                                                        emptyRequestMethods: emptyRequestMethods),
-                        on: queue)
-    }
-
-    /// Creates a `DataResponsePublisher` for this instance and uses a `DecodableResponseSerializer` to serialize the
-    /// response.
-    ///
-    /// - Parameters:
-    ///   - type:                `Decodable` type to which to decode response `Data`. Inferred from the context by default.
-    ///   - queue:               `DispatchQueue` on which the `DataResponse` will be published. `.main` by default.
-    ///   - preprocessor:        `DataPreprocessor` which filters the `Data` before serialization. `PassthroughPreprocessor()`
-    ///                          by default.
-    ///   - decoder:             `DataDecoder` instance used to decode response `Data`. `JSONDecoder()` by default.
-    ///   - emptyResponseCodes:  `Set<Int>` of HTTP status codes for which empty responses are allowed. `[204, 205]` by
-    ///                          default.
-    ///   - emptyRequestMethods: `Set<HTTPMethod>` of `HTTPMethod`s for which empty responses are allowed, regardless of
-    ///                          status code. `[.head]` by default.
-    ///
-    /// - Returns:               The `DownloadResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishDecodable<T: Decodable>(type: T.Type = T.self,
-                                               queue: DispatchQueue = .main,
-                                               preprocessor: DataPreprocessor = DecodableResponseSerializer<T>.defaultDataPreprocessor,
-                                               decoder: DataDecoder = JSONDecoder(),
-                                               emptyResponseCodes: Set<Int> = DecodableResponseSerializer<T>.defaultEmptyResponseCodes,
-                                               emptyResponseMethods: Set<HTTPMethod> = DecodableResponseSerializer<T>.defaultEmptyRequestMethods) -> DownloadResponsePublisher<T> {
-        publishResponse(using: DecodableResponseSerializer(dataPreprocessor: preprocessor,
-                                                           decoder: decoder,
-                                                           emptyResponseCodes: emptyResponseCodes,
-                                                           emptyRequestMethods: emptyResponseMethods),
-                        on: queue)
-    }
-}
-
-@available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-extension DownloadResponsePublisher where Value == URL? {
-    /// Creates an instance which publishes a `DownloadResponse<URL?, AFError>` value without serialization.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public init(_ request: DownloadRequest, queue: DispatchQueue) {
-        self.request = request
-        responseHandler = { request.response(queue: queue, completionHandler: $0) }
-    }
-}
-
-extension DownloadRequest {
-    /// Creates a `DownloadResponsePublisher` for this instance which does not serialize the response before publishing.
-    ///
-    /// - Parameter queue: `DispatchQueue` on which the `DownloadResponse` will be published. `.main` by default.
-    ///
-    /// - Returns:         The `DownloadResponsePublisher`.
-    @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, *)
-    public func publishUnserialized(on queue: DispatchQueue = .main) -> DownloadResponsePublisher<URL?> {
-        DownloadResponsePublisher(self, queue: queue)
-    }
-}
-
-#endif
diff --git a/Pods/Alamofire/Source/DispatchQueue+Alamofire.swift b/Pods/Alamofire/Source/DispatchQueue+Alamofire.swift
deleted file mode 100644
index 10cd273ee..000000000
--- a/Pods/Alamofire/Source/DispatchQueue+Alamofire.swift
+++ /dev/null
@@ -1,37 +0,0 @@
-//
-//  DispatchQueue+Alamofire.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Dispatch
-import Foundation
-
-extension DispatchQueue {
-    /// Execute the provided closure after a `TimeInterval`.
-    ///
-    /// - Parameters:
-    ///   - delay:   `TimeInterval` to delay execution.
-    ///   - closure: Closure to execute.
-    func after(_ delay: TimeInterval, execute closure: @escaping () -> Void) {
-        asyncAfter(deadline: .now() + delay, execute: closure)
-    }
-}
diff --git a/Pods/Alamofire/Source/EventMonitor.swift b/Pods/Alamofire/Source/EventMonitor.swift
deleted file mode 100644
index 3b096712f..000000000
--- a/Pods/Alamofire/Source/EventMonitor.swift
+++ /dev/null
@@ -1,892 +0,0 @@
-//
-//  EventMonitor.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// Protocol outlining the lifetime events inside Alamofire. It includes both events received from the various
-/// `URLSession` delegate protocols as well as various events from the lifetime of `Request` and its subclasses.
-public protocol EventMonitor {
-    /// The `DispatchQueue` onto which Alamofire's root `CompositeEventMonitor` will dispatch events. `.main` by default.
-    var queue: DispatchQueue { get }
-
-    // MARK: - URLSession Events
-
-    // MARK: URLSessionDelegate Events
-
-    /// Event called during `URLSessionDelegate`'s `urlSession(_:didBecomeInvalidWithError:)` method.
-    func urlSession(_ session: URLSession, didBecomeInvalidWithError error: Error?)
-
-    // MARK: URLSessionTaskDelegate Events
-
-    /// Event called during `URLSessionTaskDelegate`'s `urlSession(_:task:didReceive:completionHandler:)` method.
-    func urlSession(_ session: URLSession, task: URLSessionTask, didReceive challenge: URLAuthenticationChallenge)
-
-    /// Event called during `URLSessionTaskDelegate`'s `urlSession(_:task:didSendBodyData:totalBytesSent:totalBytesExpectedToSend:)` method.
-    func urlSession(_ session: URLSession,
-                    task: URLSessionTask,
-                    didSendBodyData bytesSent: Int64,
-                    totalBytesSent: Int64,
-                    totalBytesExpectedToSend: Int64)
-
-    /// Event called during `URLSessionTaskDelegate`'s `urlSession(_:task:needNewBodyStream:)` method.
-    func urlSession(_ session: URLSession, taskNeedsNewBodyStream task: URLSessionTask)
-
-    /// Event called during `URLSessionTaskDelegate`'s `urlSession(_:task:willPerformHTTPRedirection:newRequest:completionHandler:)` method.
-    func urlSession(_ session: URLSession,
-                    task: URLSessionTask,
-                    willPerformHTTPRedirection response: HTTPURLResponse,
-                    newRequest request: URLRequest)
-
-    /// Event called during `URLSessionTaskDelegate`'s `urlSession(_:task:didFinishCollecting:)` method.
-    func urlSession(_ session: URLSession, task: URLSessionTask, didFinishCollecting metrics: URLSessionTaskMetrics)
-
-    /// Event called during `URLSessionTaskDelegate`'s `urlSession(_:task:didCompleteWithError:)` method.
-    func urlSession(_ session: URLSession, task: URLSessionTask, didCompleteWithError error: Error?)
-
-    /// Event called during `URLSessionTaskDelegate`'s `urlSession(_:taskIsWaitingForConnectivity:)` method.
-    @available(macOS 10.13, iOS 11.0, tvOS 11.0, watchOS 4.0, *)
-    func urlSession(_ session: URLSession, taskIsWaitingForConnectivity task: URLSessionTask)
-
-    // MARK: URLSessionDataDelegate Events
-
-    /// Event called during `URLSessionDataDelegate`'s `urlSession(_:dataTask:didReceive:)` method.
-    func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive data: Data)
-
-    /// Event called during `URLSessionDataDelegate`'s `urlSession(_:dataTask:willCacheResponse:completionHandler:)` method.
-    func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, willCacheResponse proposedResponse: CachedURLResponse)
-
-    // MARK: URLSessionDownloadDelegate Events
-
-    /// Event called during `URLSessionDownloadDelegate`'s `urlSession(_:downloadTask:didResumeAtOffset:expectedTotalBytes:)` method.
-    func urlSession(_ session: URLSession,
-                    downloadTask: URLSessionDownloadTask,
-                    didResumeAtOffset fileOffset: Int64,
-                    expectedTotalBytes: Int64)
-
-    /// Event called during `URLSessionDownloadDelegate`'s `urlSession(_:downloadTask:didWriteData:totalBytesWritten:totalBytesExpectedToWrite:)` method.
-    func urlSession(_ session: URLSession,
-                    downloadTask: URLSessionDownloadTask,
-                    didWriteData bytesWritten: Int64,
-                    totalBytesWritten: Int64,
-                    totalBytesExpectedToWrite: Int64)
-
-    /// Event called during `URLSessionDownloadDelegate`'s `urlSession(_:downloadTask:didFinishDownloadingTo:)` method.
-    func urlSession(_ session: URLSession, downloadTask: URLSessionDownloadTask, didFinishDownloadingTo location: URL)
-
-    // MARK: - Request Events
-
-    /// Event called when a `URLRequest` is first created for a `Request`. If a `RequestAdapter` is active, the
-    /// `URLRequest` will be adapted before being issued.
-    func request(_ request: Request, didCreateInitialURLRequest urlRequest: URLRequest)
-
-    /// Event called when the attempt to create a `URLRequest` from a `Request`'s original `URLRequestConvertible` value fails.
-    func request(_ request: Request, didFailToCreateURLRequestWithError error: AFError)
-
-    /// Event called when a `RequestAdapter` adapts the `Request`'s initial `URLRequest`.
-    func request(_ request: Request, didAdaptInitialRequest initialRequest: URLRequest, to adaptedRequest: URLRequest)
-
-    /// Event called when a `RequestAdapter` fails to adapt the `Request`'s initial `URLRequest`.
-    func request(_ request: Request, didFailToAdaptURLRequest initialRequest: URLRequest, withError error: AFError)
-
-    /// Event called when a final `URLRequest` is created for a `Request`.
-    func request(_ request: Request, didCreateURLRequest urlRequest: URLRequest)
-
-    /// Event called when a `URLSessionTask` subclass instance is created for a `Request`.
-    func request(_ request: Request, didCreateTask task: URLSessionTask)
-
-    /// Event called when a `Request` receives a `URLSessionTaskMetrics` value.
-    func request(_ request: Request, didGatherMetrics metrics: URLSessionTaskMetrics)
-
-    /// Event called when a `Request` fails due to an error created by Alamofire. e.g. When certificate pinning fails.
-    func request(_ request: Request, didFailTask task: URLSessionTask, earlyWithError error: AFError)
-
-    /// Event called when a `Request`'s task completes, possibly with an error. A `Request` may receive this event
-    /// multiple times if it is retried.
-    func request(_ request: Request, didCompleteTask task: URLSessionTask, with error: AFError?)
-
-    /// Event called when a `Request` is about to be retried.
-    func requestIsRetrying(_ request: Request)
-
-    /// Event called when a `Request` finishes and response serializers are being called.
-    func requestDidFinish(_ request: Request)
-
-    /// Event called when a `Request` receives a `resume` call.
-    func requestDidResume(_ request: Request)
-
-    /// Event called when a `Request`'s associated `URLSessionTask` is resumed.
-    func request(_ request: Request, didResumeTask task: URLSessionTask)
-
-    /// Event called when a `Request` receives a `suspend` call.
-    func requestDidSuspend(_ request: Request)
-
-    /// Event called when a `Request`'s associated `URLSessionTask` is suspended.
-    func request(_ request: Request, didSuspendTask task: URLSessionTask)
-
-    /// Event called when a `Request` receives a `cancel` call.
-    func requestDidCancel(_ request: Request)
-
-    /// Event called when a `Request`'s associated `URLSessionTask` is cancelled.
-    func request(_ request: Request, didCancelTask task: URLSessionTask)
-
-    // MARK: DataRequest Events
-
-    /// Event called when a `DataRequest` calls a `Validation`.
-    func request(_ request: DataRequest,
-                 didValidateRequest urlRequest: URLRequest?,
-                 response: HTTPURLResponse,
-                 data: Data?,
-                 withResult result: Request.ValidationResult)
-
-    /// Event called when a `DataRequest` creates a `DataResponse<Data?>` value without calling a `ResponseSerializer`.
-    func request(_ request: DataRequest, didParseResponse response: DataResponse<Data?, AFError>)
-
-    /// Event called when a `DataRequest` calls a `ResponseSerializer` and creates a generic `DataResponse<Value, AFError>`.
-    func request<Value>(_ request: DataRequest, didParseResponse response: DataResponse<Value, AFError>)
-
-    // MARK: DataStreamRequest Events
-
-    /// Event called when a `DataStreamRequest` calls a `Validation` closure.
-    ///
-    /// - Parameters:
-    ///   - request:    `DataStreamRequest` which is calling the `Validation`.
-    ///   - urlRequest: `URLRequest` of the request being validated.
-    ///   - response:   `HTTPURLResponse` of the request being validated.
-    ///   - result:      Produced `ValidationResult`.
-    func request(_ request: DataStreamRequest,
-                 didValidateRequest urlRequest: URLRequest?,
-                 response: HTTPURLResponse,
-                 withResult result: Request.ValidationResult)
-
-    /// Event called when a `DataStreamSerializer` produces a value from streamed `Data`.
-    ///
-    /// - Parameters:
-    ///   - request: `DataStreamRequest` for which the value was serialized.
-    ///   - result:  `Result` of the serialization attempt.
-    func request<Value>(_ request: DataStreamRequest, didParseStream result: Result<Value, AFError>)
-
-    // MARK: UploadRequest Events
-
-    /// Event called when an `UploadRequest` creates its `Uploadable` value, indicating the type of upload it represents.
-    func request(_ request: UploadRequest, didCreateUploadable uploadable: UploadRequest.Uploadable)
-
-    /// Event called when an `UploadRequest` failed to create its `Uploadable` value due to an error.
-    func request(_ request: UploadRequest, didFailToCreateUploadableWithError error: AFError)
-
-    /// Event called when an `UploadRequest` provides the `InputStream` from its `Uploadable` value. This only occurs if
-    /// the `InputStream` does not wrap a `Data` value or file `URL`.
-    func request(_ request: UploadRequest, didProvideInputStream stream: InputStream)
-
-    // MARK: DownloadRequest Events
-
-    /// Event called when a `DownloadRequest`'s `URLSessionDownloadTask` finishes and the temporary file has been moved.
-    func request(_ request: DownloadRequest, didFinishDownloadingUsing task: URLSessionTask, with result: Result<URL, AFError>)
-
-    /// Event called when a `DownloadRequest`'s `Destination` closure is called and creates the destination URL the
-    /// downloaded file will be moved to.
-    func request(_ request: DownloadRequest, didCreateDestinationURL url: URL)
-
-    /// Event called when a `DownloadRequest` calls a `Validation`.
-    func request(_ request: DownloadRequest,
-                 didValidateRequest urlRequest: URLRequest?,
-                 response: HTTPURLResponse,
-                 fileURL: URL?,
-                 withResult result: Request.ValidationResult)
-
-    /// Event called when a `DownloadRequest` creates a `DownloadResponse<URL?, AFError>` without calling a `ResponseSerializer`.
-    func request(_ request: DownloadRequest, didParseResponse response: DownloadResponse<URL?, AFError>)
-
-    /// Event called when a `DownloadRequest` calls a `DownloadResponseSerializer` and creates a generic `DownloadResponse<Value, AFError>`
-    func request<Value>(_ request: DownloadRequest, didParseResponse response: DownloadResponse<Value, AFError>)
-}
-
-extension EventMonitor {
-    /// The default queue on which `CompositeEventMonitor`s will call the `EventMonitor` methods. `.main` by default.
-    public var queue: DispatchQueue { .main }
-
-    // MARK: Default Implementations
-
-    public func urlSession(_ session: URLSession, didBecomeInvalidWithError error: Error?) {}
-    public func urlSession(_ session: URLSession,
-                           task: URLSessionTask,
-                           didReceive challenge: URLAuthenticationChallenge) {}
-    public func urlSession(_ session: URLSession,
-                           task: URLSessionTask,
-                           didSendBodyData bytesSent: Int64,
-                           totalBytesSent: Int64,
-                           totalBytesExpectedToSend: Int64) {}
-    public func urlSession(_ session: URLSession, taskNeedsNewBodyStream task: URLSessionTask) {}
-    public func urlSession(_ session: URLSession,
-                           task: URLSessionTask,
-                           willPerformHTTPRedirection response: HTTPURLResponse,
-                           newRequest request: URLRequest) {}
-    public func urlSession(_ session: URLSession,
-                           task: URLSessionTask,
-                           didFinishCollecting metrics: URLSessionTaskMetrics) {}
-    public func urlSession(_ session: URLSession, task: URLSessionTask, didCompleteWithError error: Error?) {}
-    public func urlSession(_ session: URLSession, taskIsWaitingForConnectivity task: URLSessionTask) {}
-    public func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive data: Data) {}
-    public func urlSession(_ session: URLSession,
-                           dataTask: URLSessionDataTask,
-                           willCacheResponse proposedResponse: CachedURLResponse) {}
-    public func urlSession(_ session: URLSession,
-                           downloadTask: URLSessionDownloadTask,
-                           didResumeAtOffset fileOffset: Int64,
-                           expectedTotalBytes: Int64) {}
-    public func urlSession(_ session: URLSession,
-                           downloadTask: URLSessionDownloadTask,
-                           didWriteData bytesWritten: Int64,
-                           totalBytesWritten: Int64,
-                           totalBytesExpectedToWrite: Int64) {}
-    public func urlSession(_ session: URLSession,
-                           downloadTask: URLSessionDownloadTask,
-                           didFinishDownloadingTo location: URL) {}
-    public func request(_ request: Request, didCreateInitialURLRequest urlRequest: URLRequest) {}
-    public func request(_ request: Request, didFailToCreateURLRequestWithError error: AFError) {}
-    public func request(_ request: Request,
-                        didAdaptInitialRequest initialRequest: URLRequest,
-                        to adaptedRequest: URLRequest) {}
-    public func request(_ request: Request,
-                        didFailToAdaptURLRequest initialRequest: URLRequest,
-                        withError error: AFError) {}
-    public func request(_ request: Request, didCreateURLRequest urlRequest: URLRequest) {}
-    public func request(_ request: Request, didCreateTask task: URLSessionTask) {}
-    public func request(_ request: Request, didGatherMetrics metrics: URLSessionTaskMetrics) {}
-    public func request(_ request: Request, didFailTask task: URLSessionTask, earlyWithError error: AFError) {}
-    public func request(_ request: Request, didCompleteTask task: URLSessionTask, with error: AFError?) {}
-    public func requestIsRetrying(_ request: Request) {}
-    public func requestDidFinish(_ request: Request) {}
-    public func requestDidResume(_ request: Request) {}
-    public func request(_ request: Request, didResumeTask task: URLSessionTask) {}
-    public func requestDidSuspend(_ request: Request) {}
-    public func request(_ request: Request, didSuspendTask task: URLSessionTask) {}
-    public func requestDidCancel(_ request: Request) {}
-    public func request(_ request: Request, didCancelTask task: URLSessionTask) {}
-    public func request(_ request: DataRequest,
-                        didValidateRequest urlRequest: URLRequest?,
-                        response: HTTPURLResponse,
-                        data: Data?,
-                        withResult result: Request.ValidationResult) {}
-    public func request(_ request: DataRequest, didParseResponse response: DataResponse<Data?, AFError>) {}
-    public func request<Value>(_ request: DataRequest, didParseResponse response: DataResponse<Value, AFError>) {}
-    public func request(_ request: DataStreamRequest,
-                        didValidateRequest urlRequest: URLRequest?,
-                        response: HTTPURLResponse,
-                        withResult result: Request.ValidationResult) {}
-    public func request<Value>(_ request: DataStreamRequest, didParseStream result: Result<Value, AFError>) {}
-    public func request(_ request: UploadRequest, didCreateUploadable uploadable: UploadRequest.Uploadable) {}
-    public func request(_ request: UploadRequest, didFailToCreateUploadableWithError error: AFError) {}
-    public func request(_ request: UploadRequest, didProvideInputStream stream: InputStream) {}
-    public func request(_ request: DownloadRequest, didFinishDownloadingUsing task: URLSessionTask, with result: Result<URL, AFError>) {}
-    public func request(_ request: DownloadRequest, didCreateDestinationURL url: URL) {}
-    public func request(_ request: DownloadRequest,
-                        didValidateRequest urlRequest: URLRequest?,
-                        response: HTTPURLResponse,
-                        fileURL: URL?,
-                        withResult result: Request.ValidationResult) {}
-    public func request(_ request: DownloadRequest, didParseResponse response: DownloadResponse<URL?, AFError>) {}
-    public func request<Value>(_ request: DownloadRequest, didParseResponse response: DownloadResponse<Value, AFError>) {}
-}
-
-/// An `EventMonitor` which can contain multiple `EventMonitor`s and calls their methods on their queues.
-public final class CompositeEventMonitor: EventMonitor {
-    public let queue = DispatchQueue(label: "org.alamofire.compositeEventMonitor", qos: .utility)
-
-    let monitors: [EventMonitor]
-
-    init(monitors: [EventMonitor]) {
-        self.monitors = monitors
-    }
-
-    func performEvent(_ event: @escaping (EventMonitor) -> Void) {
-        queue.async {
-            for monitor in self.monitors {
-                monitor.queue.async { event(monitor) }
-            }
-        }
-    }
-
-    public func urlSession(_ session: URLSession, didBecomeInvalidWithError error: Error?) {
-        performEvent { $0.urlSession(session, didBecomeInvalidWithError: error) }
-    }
-
-    public func urlSession(_ session: URLSession,
-                           task: URLSessionTask,
-                           didReceive challenge: URLAuthenticationChallenge) {
-        performEvent { $0.urlSession(session, task: task, didReceive: challenge) }
-    }
-
-    public func urlSession(_ session: URLSession,
-                           task: URLSessionTask,
-                           didSendBodyData bytesSent: Int64,
-                           totalBytesSent: Int64,
-                           totalBytesExpectedToSend: Int64) {
-        performEvent {
-            $0.urlSession(session,
-                          task: task,
-                          didSendBodyData: bytesSent,
-                          totalBytesSent: totalBytesSent,
-                          totalBytesExpectedToSend: totalBytesExpectedToSend)
-        }
-    }
-
-    public func urlSession(_ session: URLSession, taskNeedsNewBodyStream task: URLSessionTask) {
-        performEvent {
-            $0.urlSession(session, taskNeedsNewBodyStream: task)
-        }
-    }
-
-    public func urlSession(_ session: URLSession,
-                           task: URLSessionTask,
-                           willPerformHTTPRedirection response: HTTPURLResponse,
-                           newRequest request: URLRequest) {
-        performEvent {
-            $0.urlSession(session,
-                          task: task,
-                          willPerformHTTPRedirection: response,
-                          newRequest: request)
-        }
-    }
-
-    public func urlSession(_ session: URLSession, task: URLSessionTask, didFinishCollecting metrics: URLSessionTaskMetrics) {
-        performEvent { $0.urlSession(session, task: task, didFinishCollecting: metrics) }
-    }
-
-    public func urlSession(_ session: URLSession, task: URLSessionTask, didCompleteWithError error: Error?) {
-        performEvent { $0.urlSession(session, task: task, didCompleteWithError: error) }
-    }
-
-    @available(macOS 10.13, iOS 11.0, tvOS 11.0, watchOS 4.0, *)
-    public func urlSession(_ session: URLSession, taskIsWaitingForConnectivity task: URLSessionTask) {
-        performEvent { $0.urlSession(session, taskIsWaitingForConnectivity: task) }
-    }
-
-    public func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive data: Data) {
-        performEvent { $0.urlSession(session, dataTask: dataTask, didReceive: data) }
-    }
-
-    public func urlSession(_ session: URLSession,
-                           dataTask: URLSessionDataTask,
-                           willCacheResponse proposedResponse: CachedURLResponse) {
-        performEvent { $0.urlSession(session, dataTask: dataTask, willCacheResponse: proposedResponse) }
-    }
-
-    public func urlSession(_ session: URLSession,
-                           downloadTask: URLSessionDownloadTask,
-                           didResumeAtOffset fileOffset: Int64,
-                           expectedTotalBytes: Int64) {
-        performEvent {
-            $0.urlSession(session,
-                          downloadTask: downloadTask,
-                          didResumeAtOffset: fileOffset,
-                          expectedTotalBytes: expectedTotalBytes)
-        }
-    }
-
-    public func urlSession(_ session: URLSession,
-                           downloadTask: URLSessionDownloadTask,
-                           didWriteData bytesWritten: Int64,
-                           totalBytesWritten: Int64,
-                           totalBytesExpectedToWrite: Int64) {
-        performEvent {
-            $0.urlSession(session,
-                          downloadTask: downloadTask,
-                          didWriteData: bytesWritten,
-                          totalBytesWritten: totalBytesWritten,
-                          totalBytesExpectedToWrite: totalBytesExpectedToWrite)
-        }
-    }
-
-    public func urlSession(_ session: URLSession,
-                           downloadTask: URLSessionDownloadTask,
-                           didFinishDownloadingTo location: URL) {
-        performEvent { $0.urlSession(session, downloadTask: downloadTask, didFinishDownloadingTo: location) }
-    }
-
-    public func request(_ request: Request, didCreateInitialURLRequest urlRequest: URLRequest) {
-        performEvent { $0.request(request, didCreateInitialURLRequest: urlRequest) }
-    }
-
-    public func request(_ request: Request, didFailToCreateURLRequestWithError error: AFError) {
-        performEvent { $0.request(request, didFailToCreateURLRequestWithError: error) }
-    }
-
-    public func request(_ request: Request, didAdaptInitialRequest initialRequest: URLRequest, to adaptedRequest: URLRequest) {
-        performEvent { $0.request(request, didAdaptInitialRequest: initialRequest, to: adaptedRequest) }
-    }
-
-    public func request(_ request: Request, didFailToAdaptURLRequest initialRequest: URLRequest, withError error: AFError) {
-        performEvent { $0.request(request, didFailToAdaptURLRequest: initialRequest, withError: error) }
-    }
-
-    public func request(_ request: Request, didCreateURLRequest urlRequest: URLRequest) {
-        performEvent { $0.request(request, didCreateURLRequest: urlRequest) }
-    }
-
-    public func request(_ request: Request, didCreateTask task: URLSessionTask) {
-        performEvent { $0.request(request, didCreateTask: task) }
-    }
-
-    public func request(_ request: Request, didGatherMetrics metrics: URLSessionTaskMetrics) {
-        performEvent { $0.request(request, didGatherMetrics: metrics) }
-    }
-
-    public func request(_ request: Request, didFailTask task: URLSessionTask, earlyWithError error: AFError) {
-        performEvent { $0.request(request, didFailTask: task, earlyWithError: error) }
-    }
-
-    public func request(_ request: Request, didCompleteTask task: URLSessionTask, with error: AFError?) {
-        performEvent { $0.request(request, didCompleteTask: task, with: error) }
-    }
-
-    public func requestIsRetrying(_ request: Request) {
-        performEvent { $0.requestIsRetrying(request) }
-    }
-
-    public func requestDidFinish(_ request: Request) {
-        performEvent { $0.requestDidFinish(request) }
-    }
-
-    public func requestDidResume(_ request: Request) {
-        performEvent { $0.requestDidResume(request) }
-    }
-
-    public func request(_ request: Request, didResumeTask task: URLSessionTask) {
-        performEvent { $0.request(request, didResumeTask: task) }
-    }
-
-    public func requestDidSuspend(_ request: Request) {
-        performEvent { $0.requestDidSuspend(request) }
-    }
-
-    public func request(_ request: Request, didSuspendTask task: URLSessionTask) {
-        performEvent { $0.request(request, didSuspendTask: task) }
-    }
-
-    public func requestDidCancel(_ request: Request) {
-        performEvent { $0.requestDidCancel(request) }
-    }
-
-    public func request(_ request: Request, didCancelTask task: URLSessionTask) {
-        performEvent { $0.request(request, didCancelTask: task) }
-    }
-
-    public func request(_ request: DataRequest,
-                        didValidateRequest urlRequest: URLRequest?,
-                        response: HTTPURLResponse,
-                        data: Data?,
-                        withResult result: Request.ValidationResult) {
-        performEvent { $0.request(request,
-                                  didValidateRequest: urlRequest,
-                                  response: response,
-                                  data: data,
-                                  withResult: result)
-        }
-    }
-
-    public func request(_ request: DataRequest, didParseResponse response: DataResponse<Data?, AFError>) {
-        performEvent { $0.request(request, didParseResponse: response) }
-    }
-
-    public func request<Value>(_ request: DataRequest, didParseResponse response: DataResponse<Value, AFError>) {
-        performEvent { $0.request(request, didParseResponse: response) }
-    }
-
-    public func request(_ request: DataStreamRequest,
-                        didValidateRequest urlRequest: URLRequest?,
-                        response: HTTPURLResponse,
-                        withResult result: Request.ValidationResult) {
-        performEvent { $0.request(request,
-                                  didValidateRequest: urlRequest,
-                                  response: response,
-                                  withResult: result)
-        }
-    }
-
-    public func request<Value>(_ request: DataStreamRequest, didParseStream result: Result<Value, AFError>) {
-        performEvent { $0.request(request, didParseStream: result) }
-    }
-
-    public func request(_ request: UploadRequest, didCreateUploadable uploadable: UploadRequest.Uploadable) {
-        performEvent { $0.request(request, didCreateUploadable: uploadable) }
-    }
-
-    public func request(_ request: UploadRequest, didFailToCreateUploadableWithError error: AFError) {
-        performEvent { $0.request(request, didFailToCreateUploadableWithError: error) }
-    }
-
-    public func request(_ request: UploadRequest, didProvideInputStream stream: InputStream) {
-        performEvent { $0.request(request, didProvideInputStream: stream) }
-    }
-
-    public func request(_ request: DownloadRequest, didFinishDownloadingUsing task: URLSessionTask, with result: Result<URL, AFError>) {
-        performEvent { $0.request(request, didFinishDownloadingUsing: task, with: result) }
-    }
-
-    public func request(_ request: DownloadRequest, didCreateDestinationURL url: URL) {
-        performEvent { $0.request(request, didCreateDestinationURL: url) }
-    }
-
-    public func request(_ request: DownloadRequest,
-                        didValidateRequest urlRequest: URLRequest?,
-                        response: HTTPURLResponse,
-                        fileURL: URL?,
-                        withResult result: Request.ValidationResult) {
-        performEvent { $0.request(request,
-                                  didValidateRequest: urlRequest,
-                                  response: response,
-                                  fileURL: fileURL,
-                                  withResult: result) }
-    }
-
-    public func request(_ request: DownloadRequest, didParseResponse response: DownloadResponse<URL?, AFError>) {
-        performEvent { $0.request(request, didParseResponse: response) }
-    }
-
-    public func request<Value>(_ request: DownloadRequest, didParseResponse response: DownloadResponse<Value, AFError>) {
-        performEvent { $0.request(request, didParseResponse: response) }
-    }
-}
-
-/// `EventMonitor` that allows optional closures to be set to receive events.
-open class ClosureEventMonitor: EventMonitor {
-    /// Closure called on the `urlSession(_:didBecomeInvalidWithError:)` event.
-    open var sessionDidBecomeInvalidWithError: ((URLSession, Error?) -> Void)?
-
-    /// Closure called on the `urlSession(_:task:didReceive:completionHandler:)`.
-    open var taskDidReceiveChallenge: ((URLSession, URLSessionTask, URLAuthenticationChallenge) -> Void)?
-
-    /// Closure that receives `urlSession(_:task:didSendBodyData:totalBytesSent:totalBytesExpectedToSend:)` event.
-    open var taskDidSendBodyData: ((URLSession, URLSessionTask, Int64, Int64, Int64) -> Void)?
-
-    /// Closure called on the `urlSession(_:task:needNewBodyStream:)` event.
-    open var taskNeedNewBodyStream: ((URLSession, URLSessionTask) -> Void)?
-
-    /// Closure called on the `urlSession(_:task:willPerformHTTPRedirection:newRequest:completionHandler:)` event.
-    open var taskWillPerformHTTPRedirection: ((URLSession, URLSessionTask, HTTPURLResponse, URLRequest) -> Void)?
-
-    /// Closure called on the `urlSession(_:task:didFinishCollecting:)` event.
-    open var taskDidFinishCollectingMetrics: ((URLSession, URLSessionTask, URLSessionTaskMetrics) -> Void)?
-
-    /// Closure called on the `urlSession(_:task:didCompleteWithError:)` event.
-    open var taskDidComplete: ((URLSession, URLSessionTask, Error?) -> Void)?
-
-    /// Closure called on the `urlSession(_:taskIsWaitingForConnectivity:)` event.
-    open var taskIsWaitingForConnectivity: ((URLSession, URLSessionTask) -> Void)?
-
-    /// Closure that receives the `urlSession(_:dataTask:didReceive:)` event.
-    open var dataTaskDidReceiveData: ((URLSession, URLSessionDataTask, Data) -> Void)?
-
-    /// Closure called on the `urlSession(_:dataTask:willCacheResponse:completionHandler:)` event.
-    open var dataTaskWillCacheResponse: ((URLSession, URLSessionDataTask, CachedURLResponse) -> Void)?
-
-    /// Closure called on the `urlSession(_:downloadTask:didFinishDownloadingTo:)` event.
-    open var downloadTaskDidFinishDownloadingToURL: ((URLSession, URLSessionDownloadTask, URL) -> Void)?
-
-    /// Closure called on the `urlSession(_:downloadTask:didWriteData:totalBytesWritten:totalBytesExpectedToWrite:)`
-    /// event.
-    open var downloadTaskDidWriteData: ((URLSession, URLSessionDownloadTask, Int64, Int64, Int64) -> Void)?
-
-    /// Closure called on the `urlSession(_:downloadTask:didResumeAtOffset:expectedTotalBytes:)` event.
-    open var downloadTaskDidResumeAtOffset: ((URLSession, URLSessionDownloadTask, Int64, Int64) -> Void)?
-
-    // MARK: - Request Events
-
-    /// Closure called on the `request(_:didCreateInitialURLRequest:)` event.
-    open var requestDidCreateInitialURLRequest: ((Request, URLRequest) -> Void)?
-
-    /// Closure called on the `request(_:didFailToCreateURLRequestWithError:)` event.
-    open var requestDidFailToCreateURLRequestWithError: ((Request, AFError) -> Void)?
-
-    /// Closure called on the `request(_:didAdaptInitialRequest:to:)` event.
-    open var requestDidAdaptInitialRequestToAdaptedRequest: ((Request, URLRequest, URLRequest) -> Void)?
-
-    /// Closure called on the `request(_:didFailToAdaptURLRequest:withError:)` event.
-    open var requestDidFailToAdaptURLRequestWithError: ((Request, URLRequest, AFError) -> Void)?
-
-    /// Closure called on the `request(_:didCreateURLRequest:)` event.
-    open var requestDidCreateURLRequest: ((Request, URLRequest) -> Void)?
-
-    /// Closure called on the `request(_:didCreateTask:)` event.
-    open var requestDidCreateTask: ((Request, URLSessionTask) -> Void)?
-
-    /// Closure called on the `request(_:didGatherMetrics:)` event.
-    open var requestDidGatherMetrics: ((Request, URLSessionTaskMetrics) -> Void)?
-
-    /// Closure called on the `request(_:didFailTask:earlyWithError:)` event.
-    open var requestDidFailTaskEarlyWithError: ((Request, URLSessionTask, AFError) -> Void)?
-
-    /// Closure called on the `request(_:didCompleteTask:with:)` event.
-    open var requestDidCompleteTaskWithError: ((Request, URLSessionTask, AFError?) -> Void)?
-
-    /// Closure called on the `requestIsRetrying(_:)` event.
-    open var requestIsRetrying: ((Request) -> Void)?
-
-    /// Closure called on the `requestDidFinish(_:)` event.
-    open var requestDidFinish: ((Request) -> Void)?
-
-    /// Closure called on the `requestDidResume(_:)` event.
-    open var requestDidResume: ((Request) -> Void)?
-
-    /// Closure called on the `request(_:didResumeTask:)` event.
-    open var requestDidResumeTask: ((Request, URLSessionTask) -> Void)?
-
-    /// Closure called on the `requestDidSuspend(_:)` event.
-    open var requestDidSuspend: ((Request) -> Void)?
-
-    /// Closure called on the `request(_:didSuspendTask:)` event.
-    open var requestDidSuspendTask: ((Request, URLSessionTask) -> Void)?
-
-    /// Closure called on the `requestDidCancel(_:)` event.
-    open var requestDidCancel: ((Request) -> Void)?
-
-    /// Closure called on the `request(_:didCancelTask:)` event.
-    open var requestDidCancelTask: ((Request, URLSessionTask) -> Void)?
-
-    /// Closure called on the `request(_:didValidateRequest:response:data:withResult:)` event.
-    open var requestDidValidateRequestResponseDataWithResult: ((DataRequest, URLRequest?, HTTPURLResponse, Data?, Request.ValidationResult) -> Void)?
-
-    /// Closure called on the `request(_:didParseResponse:)` event.
-    open var requestDidParseResponse: ((DataRequest, DataResponse<Data?, AFError>) -> Void)?
-
-    /// Closure called on the `request(_:didValidateRequest:response:withResult:)` event.
-    open var requestDidValidateRequestResponseWithResult: ((DataStreamRequest, URLRequest?, HTTPURLResponse, Request.ValidationResult) -> Void)?
-
-    /// Closure called on the `request(_:didCreateUploadable:)` event.
-    open var requestDidCreateUploadable: ((UploadRequest, UploadRequest.Uploadable) -> Void)?
-
-    /// Closure called on the `request(_:didFailToCreateUploadableWithError:)` event.
-    open var requestDidFailToCreateUploadableWithError: ((UploadRequest, AFError) -> Void)?
-
-    /// Closure called on the `request(_:didProvideInputStream:)` event.
-    open var requestDidProvideInputStream: ((UploadRequest, InputStream) -> Void)?
-
-    /// Closure called on the `request(_:didFinishDownloadingUsing:with:)` event.
-    open var requestDidFinishDownloadingUsingTaskWithResult: ((DownloadRequest, URLSessionTask, Result<URL, AFError>) -> Void)?
-
-    /// Closure called on the `request(_:didCreateDestinationURL:)` event.
-    open var requestDidCreateDestinationURL: ((DownloadRequest, URL) -> Void)?
-
-    /// Closure called on the `request(_:didValidateRequest:response:temporaryURL:destinationURL:withResult:)` event.
-    open var requestDidValidateRequestResponseFileURLWithResult: ((DownloadRequest, URLRequest?, HTTPURLResponse, URL?, Request.ValidationResult) -> Void)?
-
-    /// Closure called on the `request(_:didParseResponse:)` event.
-    open var requestDidParseDownloadResponse: ((DownloadRequest, DownloadResponse<URL?, AFError>) -> Void)?
-
-    public let queue: DispatchQueue
-
-    /// Creates an instance using the provided queue.
-    ///
-    /// - Parameter queue: `DispatchQueue` on which events will fired. `.main` by default.
-    public init(queue: DispatchQueue = .main) {
-        self.queue = queue
-    }
-
-    open func urlSession(_ session: URLSession, didBecomeInvalidWithError error: Error?) {
-        sessionDidBecomeInvalidWithError?(session, error)
-    }
-
-    open func urlSession(_ session: URLSession, task: URLSessionTask, didReceive challenge: URLAuthenticationChallenge) {
-        taskDidReceiveChallenge?(session, task, challenge)
-    }
-
-    open func urlSession(_ session: URLSession,
-                         task: URLSessionTask,
-                         didSendBodyData bytesSent: Int64,
-                         totalBytesSent: Int64,
-                         totalBytesExpectedToSend: Int64) {
-        taskDidSendBodyData?(session, task, bytesSent, totalBytesSent, totalBytesExpectedToSend)
-    }
-
-    open func urlSession(_ session: URLSession, taskNeedsNewBodyStream task: URLSessionTask) {
-        taskNeedNewBodyStream?(session, task)
-    }
-
-    open func urlSession(_ session: URLSession,
-                         task: URLSessionTask,
-                         willPerformHTTPRedirection response: HTTPURLResponse,
-                         newRequest request: URLRequest) {
-        taskWillPerformHTTPRedirection?(session, task, response, request)
-    }
-
-    open func urlSession(_ session: URLSession, task: URLSessionTask, didFinishCollecting metrics: URLSessionTaskMetrics) {
-        taskDidFinishCollectingMetrics?(session, task, metrics)
-    }
-
-    open func urlSession(_ session: URLSession, task: URLSessionTask, didCompleteWithError error: Error?) {
-        taskDidComplete?(session, task, error)
-    }
-
-    open func urlSession(_ session: URLSession, taskIsWaitingForConnectivity task: URLSessionTask) {
-        taskIsWaitingForConnectivity?(session, task)
-    }
-
-    open func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive data: Data) {
-        dataTaskDidReceiveData?(session, dataTask, data)
-    }
-
-    open func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, willCacheResponse proposedResponse: CachedURLResponse) {
-        dataTaskWillCacheResponse?(session, dataTask, proposedResponse)
-    }
-
-    open func urlSession(_ session: URLSession,
-                         downloadTask: URLSessionDownloadTask,
-                         didResumeAtOffset fileOffset: Int64,
-                         expectedTotalBytes: Int64) {
-        downloadTaskDidResumeAtOffset?(session, downloadTask, fileOffset, expectedTotalBytes)
-    }
-
-    open func urlSession(_ session: URLSession,
-                         downloadTask: URLSessionDownloadTask,
-                         didWriteData bytesWritten: Int64,
-                         totalBytesWritten: Int64,
-                         totalBytesExpectedToWrite: Int64) {
-        downloadTaskDidWriteData?(session, downloadTask, bytesWritten, totalBytesWritten, totalBytesExpectedToWrite)
-    }
-
-    open func urlSession(_ session: URLSession, downloadTask: URLSessionDownloadTask, didFinishDownloadingTo location: URL) {
-        downloadTaskDidFinishDownloadingToURL?(session, downloadTask, location)
-    }
-
-    // MARK: Request Events
-
-    open func request(_ request: Request, didCreateInitialURLRequest urlRequest: URLRequest) {
-        requestDidCreateInitialURLRequest?(request, urlRequest)
-    }
-
-    open func request(_ request: Request, didFailToCreateURLRequestWithError error: AFError) {
-        requestDidFailToCreateURLRequestWithError?(request, error)
-    }
-
-    open func request(_ request: Request, didAdaptInitialRequest initialRequest: URLRequest, to adaptedRequest: URLRequest) {
-        requestDidAdaptInitialRequestToAdaptedRequest?(request, initialRequest, adaptedRequest)
-    }
-
-    open func request(_ request: Request, didFailToAdaptURLRequest initialRequest: URLRequest, withError error: AFError) {
-        requestDidFailToAdaptURLRequestWithError?(request, initialRequest, error)
-    }
-
-    open func request(_ request: Request, didCreateURLRequest urlRequest: URLRequest) {
-        requestDidCreateURLRequest?(request, urlRequest)
-    }
-
-    open func request(_ request: Request, didCreateTask task: URLSessionTask) {
-        requestDidCreateTask?(request, task)
-    }
-
-    open func request(_ request: Request, didGatherMetrics metrics: URLSessionTaskMetrics) {
-        requestDidGatherMetrics?(request, metrics)
-    }
-
-    open func request(_ request: Request, didFailTask task: URLSessionTask, earlyWithError error: AFError) {
-        requestDidFailTaskEarlyWithError?(request, task, error)
-    }
-
-    open func request(_ request: Request, didCompleteTask task: URLSessionTask, with error: AFError?) {
-        requestDidCompleteTaskWithError?(request, task, error)
-    }
-
-    open func requestIsRetrying(_ request: Request) {
-        requestIsRetrying?(request)
-    }
-
-    open func requestDidFinish(_ request: Request) {
-        requestDidFinish?(request)
-    }
-
-    open func requestDidResume(_ request: Request) {
-        requestDidResume?(request)
-    }
-
-    public func request(_ request: Request, didResumeTask task: URLSessionTask) {
-        requestDidResumeTask?(request, task)
-    }
-
-    open func requestDidSuspend(_ request: Request) {
-        requestDidSuspend?(request)
-    }
-
-    public func request(_ request: Request, didSuspendTask task: URLSessionTask) {
-        requestDidSuspendTask?(request, task)
-    }
-
-    open func requestDidCancel(_ request: Request) {
-        requestDidCancel?(request)
-    }
-
-    public func request(_ request: Request, didCancelTask task: URLSessionTask) {
-        requestDidCancelTask?(request, task)
-    }
-
-    open func request(_ request: DataRequest,
-                      didValidateRequest urlRequest: URLRequest?,
-                      response: HTTPURLResponse,
-                      data: Data?,
-                      withResult result: Request.ValidationResult) {
-        requestDidValidateRequestResponseDataWithResult?(request, urlRequest, response, data, result)
-    }
-
-    open func request(_ request: DataRequest, didParseResponse response: DataResponse<Data?, AFError>) {
-        requestDidParseResponse?(request, response)
-    }
-
-    public func request(_ request: DataStreamRequest, didValidateRequest urlRequest: URLRequest?, response: HTTPURLResponse, withResult result: Request.ValidationResult) {
-        requestDidValidateRequestResponseWithResult?(request, urlRequest, response, result)
-    }
-
-    open func request(_ request: UploadRequest, didCreateUploadable uploadable: UploadRequest.Uploadable) {
-        requestDidCreateUploadable?(request, uploadable)
-    }
-
-    open func request(_ request: UploadRequest, didFailToCreateUploadableWithError error: AFError) {
-        requestDidFailToCreateUploadableWithError?(request, error)
-    }
-
-    open func request(_ request: UploadRequest, didProvideInputStream stream: InputStream) {
-        requestDidProvideInputStream?(request, stream)
-    }
-
-    open func request(_ request: DownloadRequest, didFinishDownloadingUsing task: URLSessionTask, with result: Result<URL, AFError>) {
-        requestDidFinishDownloadingUsingTaskWithResult?(request, task, result)
-    }
-
-    open func request(_ request: DownloadRequest, didCreateDestinationURL url: URL) {
-        requestDidCreateDestinationURL?(request, url)
-    }
-
-    open func request(_ request: DownloadRequest,
-                      didValidateRequest urlRequest: URLRequest?,
-                      response: HTTPURLResponse,
-                      fileURL: URL?,
-                      withResult result: Request.ValidationResult) {
-        requestDidValidateRequestResponseFileURLWithResult?(request,
-                                                            urlRequest,
-                                                            response,
-                                                            fileURL,
-                                                            result)
-    }
-
-    open func request(_ request: DownloadRequest, didParseResponse response: DownloadResponse<URL?, AFError>) {
-        requestDidParseDownloadResponse?(request, response)
-    }
-}
diff --git a/Pods/Alamofire/Source/HTTPHeaders.swift b/Pods/Alamofire/Source/HTTPHeaders.swift
deleted file mode 100644
index 7829fc69b..000000000
--- a/Pods/Alamofire/Source/HTTPHeaders.swift
+++ /dev/null
@@ -1,449 +0,0 @@
-//
-//  HTTPHeaders.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// An order-preserving and case-insensitive representation of HTTP headers.
-public struct HTTPHeaders {
-    private var headers: [HTTPHeader] = []
-
-    /// Creates an empty instance.
-    public init() {}
-
-    /// Creates an instance from an array of `HTTPHeader`s. Duplicate case-insensitive names are collapsed into the last
-    /// name and value encountered.
-    public init(_ headers: [HTTPHeader]) {
-        self.init()
-
-        headers.forEach { update($0) }
-    }
-
-    /// Creates an instance from a `[String: String]`. Duplicate case-insensitive names are collapsed into the last name
-    /// and value encountered.
-    public init(_ dictionary: [String: String]) {
-        self.init()
-
-        dictionary.forEach { update(HTTPHeader(name: $0.key, value: $0.value)) }
-    }
-
-    /// Case-insensitively updates or appends an `HTTPHeader` into the instance using the provided `name` and `value`.
-    ///
-    /// - Parameters:
-    ///   - name:  The `HTTPHeader` name.
-    ///   - value: The `HTTPHeader value.
-    public mutating func add(name: String, value: String) {
-        update(HTTPHeader(name: name, value: value))
-    }
-
-    /// Case-insensitively updates or appends the provided `HTTPHeader` into the instance.
-    ///
-    /// - Parameter header: The `HTTPHeader` to update or append.
-    public mutating func add(_ header: HTTPHeader) {
-        update(header)
-    }
-
-    /// Case-insensitively updates or appends an `HTTPHeader` into the instance using the provided `name` and `value`.
-    ///
-    /// - Parameters:
-    ///   - name:  The `HTTPHeader` name.
-    ///   - value: The `HTTPHeader value.
-    public mutating func update(name: String, value: String) {
-        update(HTTPHeader(name: name, value: value))
-    }
-
-    /// Case-insensitively updates or appends the provided `HTTPHeader` into the instance.
-    ///
-    /// - Parameter header: The `HTTPHeader` to update or append.
-    public mutating func update(_ header: HTTPHeader) {
-        guard let index = headers.index(of: header.name) else {
-            headers.append(header)
-            return
-        }
-
-        headers.replaceSubrange(index...index, with: [header])
-    }
-
-    /// Case-insensitively removes an `HTTPHeader`, if it exists, from the instance.
-    ///
-    /// - Parameter name: The name of the `HTTPHeader` to remove.
-    public mutating func remove(name: String) {
-        guard let index = headers.index(of: name) else { return }
-
-        headers.remove(at: index)
-    }
-
-    /// Sort the current instance by header name, case insensitively.
-    public mutating func sort() {
-        headers.sort { $0.name.lowercased() < $1.name.lowercased() }
-    }
-
-    /// Returns an instance sorted by header name.
-    ///
-    /// - Returns: A copy of the current instance sorted by name.
-    public func sorted() -> HTTPHeaders {
-        var headers = self
-        headers.sort()
-
-        return headers
-    }
-
-    /// Case-insensitively find a header's value by name.
-    ///
-    /// - Parameter name: The name of the header to search for, case-insensitively.
-    ///
-    /// - Returns:        The value of header, if it exists.
-    public func value(for name: String) -> String? {
-        guard let index = headers.index(of: name) else { return nil }
-
-        return headers[index].value
-    }
-
-    /// Case-insensitively access the header with the given name.
-    ///
-    /// - Parameter name: The name of the header.
-    public subscript(_ name: String) -> String? {
-        get { value(for: name) }
-        set {
-            if let value = newValue {
-                update(name: name, value: value)
-            } else {
-                remove(name: name)
-            }
-        }
-    }
-
-    /// The dictionary representation of all headers.
-    ///
-    /// This representation does not preserve the current order of the instance.
-    public var dictionary: [String: String] {
-        let namesAndValues = headers.map { ($0.name, $0.value) }
-
-        return Dictionary(namesAndValues, uniquingKeysWith: { _, last in last })
-    }
-}
-
-extension HTTPHeaders: ExpressibleByDictionaryLiteral {
-    public init(dictionaryLiteral elements: (String, String)...) {
-        self.init()
-
-        elements.forEach { update(name: $0.0, value: $0.1) }
-    }
-}
-
-extension HTTPHeaders: ExpressibleByArrayLiteral {
-    public init(arrayLiteral elements: HTTPHeader...) {
-        self.init(elements)
-    }
-}
-
-extension HTTPHeaders: Sequence {
-    public func makeIterator() -> IndexingIterator<[HTTPHeader]> {
-        headers.makeIterator()
-    }
-}
-
-extension HTTPHeaders: Collection {
-    public var startIndex: Int {
-        headers.startIndex
-    }
-
-    public var endIndex: Int {
-        headers.endIndex
-    }
-
-    public subscript(position: Int) -> HTTPHeader {
-        headers[position]
-    }
-
-    public func index(after i: Int) -> Int {
-        headers.index(after: i)
-    }
-}
-
-extension HTTPHeaders: CustomStringConvertible {
-    public var description: String {
-        headers.map { $0.description }
-            .joined(separator: "\n")
-    }
-}
-
-// MARK: - HTTPHeader
-
-/// A representation of a single HTTP header's name / value pair.
-public struct HTTPHeader: Hashable {
-    /// Name of the header.
-    public let name: String
-
-    /// Value of the header.
-    public let value: String
-
-    /// Creates an instance from the given `name` and `value`.
-    ///
-    /// - Parameters:
-    ///   - name:  The name of the header.
-    ///   - value: The value of the header.
-    public init(name: String, value: String) {
-        self.name = name
-        self.value = value
-    }
-}
-
-extension HTTPHeader: CustomStringConvertible {
-    public var description: String {
-        "\(name): \(value)"
-    }
-}
-
-extension HTTPHeader {
-    /// Returns an `Accept` header.
-    ///
-    /// - Parameter value: The `Accept` value.
-    /// - Returns:         The header.
-    public static func accept(_ value: String) -> HTTPHeader {
-        HTTPHeader(name: "Accept", value: value)
-    }
-
-    /// Returns an `Accept-Charset` header.
-    ///
-    /// - Parameter value: The `Accept-Charset` value.
-    /// - Returns:         The header.
-    public static func acceptCharset(_ value: String) -> HTTPHeader {
-        HTTPHeader(name: "Accept-Charset", value: value)
-    }
-
-    /// Returns an `Accept-Language` header.
-    ///
-    /// Alamofire offers a default Accept-Language header that accumulates and encodes the system's preferred languages.
-    /// Use `HTTPHeader.defaultAcceptLanguage`.
-    ///
-    /// - Parameter value: The `Accept-Language` value.
-    ///
-    /// - Returns:         The header.
-    public static func acceptLanguage(_ value: String) -> HTTPHeader {
-        HTTPHeader(name: "Accept-Language", value: value)
-    }
-
-    /// Returns an `Accept-Encoding` header.
-    ///
-    /// Alamofire offers a default accept encoding value that provides the most common values. Use
-    /// `HTTPHeader.defaultAcceptEncoding`.
-    ///
-    /// - Parameter value: The `Accept-Encoding` value.
-    ///
-    /// - Returns:         The header
-    public static func acceptEncoding(_ value: String) -> HTTPHeader {
-        HTTPHeader(name: "Accept-Encoding", value: value)
-    }
-
-    /// Returns a `Basic` `Authorization` header using the `username` and `password` provided.
-    ///
-    /// - Parameters:
-    ///   - username: The username of the header.
-    ///   - password: The password of the header.
-    ///
-    /// - Returns:    The header.
-    public static func authorization(username: String, password: String) -> HTTPHeader {
-        let credential = Data("\(username):\(password)".utf8).base64EncodedString()
-
-        return authorization("Basic \(credential)")
-    }
-
-    /// Returns a `Bearer` `Authorization` header using the `bearerToken` provided
-    ///
-    /// - Parameter bearerToken: The bearer token.
-    ///
-    /// - Returns:               The header.
-    public static func authorization(bearerToken: String) -> HTTPHeader {
-        authorization("Bearer \(bearerToken)")
-    }
-
-    /// Returns an `Authorization` header.
-    ///
-    /// Alamofire provides built-in methods to produce `Authorization` headers. For a Basic `Authorization` header use
-    /// `HTTPHeader.authorization(username:password:)`. For a Bearer `Authorization` header, use
-    /// `HTTPHeader.authorization(bearerToken:)`.
-    ///
-    /// - Parameter value: The `Authorization` value.
-    ///
-    /// - Returns:         The header.
-    public static func authorization(_ value: String) -> HTTPHeader {
-        HTTPHeader(name: "Authorization", value: value)
-    }
-
-    /// Returns a `Content-Disposition` header.
-    ///
-    /// - Parameter value: The `Content-Disposition` value.
-    ///
-    /// - Returns:         The header.
-    public static func contentDisposition(_ value: String) -> HTTPHeader {
-        HTTPHeader(name: "Content-Disposition", value: value)
-    }
-
-    /// Returns a `Content-Type` header.
-    ///
-    /// All Alamofire `ParameterEncoding`s and `ParameterEncoder`s set the `Content-Type` of the request, so it may not be necessary to manually
-    /// set this value.
-    ///
-    /// - Parameter value: The `Content-Type` value.
-    ///
-    /// - Returns:         The header.
-    public static func contentType(_ value: String) -> HTTPHeader {
-        HTTPHeader(name: "Content-Type", value: value)
-    }
-
-    /// Returns a `User-Agent` header.
-    ///
-    /// - Parameter value: The `User-Agent` value.
-    ///
-    /// - Returns:         The header.
-    public static func userAgent(_ value: String) -> HTTPHeader {
-        HTTPHeader(name: "User-Agent", value: value)
-    }
-}
-
-extension Array where Element == HTTPHeader {
-    /// Case-insensitively finds the index of an `HTTPHeader` with the provided name, if it exists.
-    func index(of name: String) -> Int? {
-        let lowercasedName = name.lowercased()
-        return firstIndex { $0.name.lowercased() == lowercasedName }
-    }
-}
-
-// MARK: - Defaults
-
-extension HTTPHeaders {
-    /// The default set of `HTTPHeaders` used by Alamofire. Includes `Accept-Encoding`, `Accept-Language`, and
-    /// `User-Agent`.
-    public static let `default`: HTTPHeaders = [.defaultAcceptEncoding,
-                                                .defaultAcceptLanguage,
-                                                .defaultUserAgent]
-}
-
-extension HTTPHeader {
-    /// Returns Alamofire's default `Accept-Encoding` header, appropriate for the encodings supported by particular OS
-    /// versions.
-    ///
-    /// See the [Accept-Encoding HTTP header documentation](https://tools.ietf.org/html/rfc7230#section-4.2.3) .
-    public static let defaultAcceptEncoding: HTTPHeader = {
-        let encodings: [String]
-        if #available(iOS 11.0, macOS 10.13, tvOS 11.0, watchOS 4.0, *) {
-            encodings = ["br", "gzip", "deflate"]
-        } else {
-            encodings = ["gzip", "deflate"]
-        }
-
-        return .acceptEncoding(encodings.qualityEncoded())
-    }()
-
-    /// Returns Alamofire's default `Accept-Language` header, generated by querying `Locale` for the user's
-    /// `preferredLanguages`.
-    ///
-    /// See the [Accept-Language HTTP header documentation](https://tools.ietf.org/html/rfc7231#section-5.3.5).
-    public static let defaultAcceptLanguage: HTTPHeader = {
-        .acceptLanguage(Locale.preferredLanguages.prefix(6).qualityEncoded())
-    }()
-
-    /// Returns Alamofire's default `User-Agent` header.
-    ///
-    /// See the [User-Agent header documentation](https://tools.ietf.org/html/rfc7231#section-5.5.3).
-    ///
-    /// Example: `iOS Example/1.0 (org.alamofire.iOS-Example; build:1; iOS 13.0.0) Alamofire/5.0.0`
-    public static let defaultUserAgent: HTTPHeader = {
-        let info = Bundle.main.infoDictionary
-        let executable = (info?[kCFBundleExecutableKey as String] as? String) ??
-            (ProcessInfo.processInfo.arguments.first?.split(separator: "/").last.map(String.init)) ??
-            "Unknown"
-        let bundle = info?[kCFBundleIdentifierKey as String] as? String ?? "Unknown"
-        let appVersion = info?["CFBundleShortVersionString"] as? String ?? "Unknown"
-        let appBuild = info?[kCFBundleVersionKey as String] as? String ?? "Unknown"
-
-        let osNameVersion: String = {
-            let version = ProcessInfo.processInfo.operatingSystemVersion
-            let versionString = "\(version.majorVersion).\(version.minorVersion).\(version.patchVersion)"
-            let osName: String = {
-                #if os(iOS)
-                #if targetEnvironment(macCatalyst)
-                return "macOS(Catalyst)"
-                #else
-                return "iOS"
-                #endif
-                #elseif os(watchOS)
-                return "watchOS"
-                #elseif os(tvOS)
-                return "tvOS"
-                #elseif os(macOS)
-                return "macOS"
-                #elseif os(Linux)
-                return "Linux"
-                #elseif os(Windows)
-                return "Windows"
-                #else
-                return "Unknown"
-                #endif
-            }()
-
-            return "\(osName) \(versionString)"
-        }()
-
-        let alamofireVersion = "Alamofire/\(version)"
-
-        let userAgent = "\(executable)/\(appVersion) (\(bundle); build:\(appBuild); \(osNameVersion)) \(alamofireVersion)"
-
-        return .userAgent(userAgent)
-    }()
-}
-
-extension Collection where Element == String {
-    func qualityEncoded() -> String {
-        enumerated().map { index, encoding in
-            let quality = 1.0 - (Double(index) * 0.1)
-            return "\(encoding);q=\(quality)"
-        }.joined(separator: ", ")
-    }
-}
-
-// MARK: - System Type Extensions
-
-extension URLRequest {
-    /// Returns `allHTTPHeaderFields` as `HTTPHeaders`.
-    public var headers: HTTPHeaders {
-        get { allHTTPHeaderFields.map(HTTPHeaders.init) ?? HTTPHeaders() }
-        set { allHTTPHeaderFields = newValue.dictionary }
-    }
-}
-
-extension HTTPURLResponse {
-    /// Returns `allHeaderFields` as `HTTPHeaders`.
-    public var headers: HTTPHeaders {
-        (allHeaderFields as? [String: String]).map(HTTPHeaders.init) ?? HTTPHeaders()
-    }
-}
-
-extension URLSessionConfiguration {
-    /// Returns `httpAdditionalHeaders` as `HTTPHeaders`.
-    public var headers: HTTPHeaders {
-        get { (httpAdditionalHeaders as? [String: String]).map(HTTPHeaders.init) ?? HTTPHeaders() }
-        set { httpAdditionalHeaders = newValue.dictionary }
-    }
-}
diff --git a/Pods/Alamofire/Source/HTTPMethod.swift b/Pods/Alamofire/Source/HTTPMethod.swift
deleted file mode 100644
index 4867c1e9d..000000000
--- a/Pods/Alamofire/Source/HTTPMethod.swift
+++ /dev/null
@@ -1,54 +0,0 @@
-//
-//  HTTPMethod.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-/// Type representing HTTP methods. Raw `String` value is stored and compared case-sensitively, so
-/// `HTTPMethod.get != HTTPMethod(rawValue: "get")`.
-///
-/// See https://tools.ietf.org/html/rfc7231#section-4.3
-public struct HTTPMethod: RawRepresentable, Equatable, Hashable {
-    /// `CONNECT` method.
-    public static let connect = HTTPMethod(rawValue: "CONNECT")
-    /// `DELETE` method.
-    public static let delete = HTTPMethod(rawValue: "DELETE")
-    /// `GET` method.
-    public static let get = HTTPMethod(rawValue: "GET")
-    /// `HEAD` method.
-    public static let head = HTTPMethod(rawValue: "HEAD")
-    /// `OPTIONS` method.
-    public static let options = HTTPMethod(rawValue: "OPTIONS")
-    /// `PATCH` method.
-    public static let patch = HTTPMethod(rawValue: "PATCH")
-    /// `POST` method.
-    public static let post = HTTPMethod(rawValue: "POST")
-    /// `PUT` method.
-    public static let put = HTTPMethod(rawValue: "PUT")
-    /// `TRACE` method.
-    public static let trace = HTTPMethod(rawValue: "TRACE")
-
-    public let rawValue: String
-
-    public init(rawValue: String) {
-        self.rawValue = rawValue
-    }
-}
diff --git a/Pods/Alamofire/Source/MultipartFormData.swift b/Pods/Alamofire/Source/MultipartFormData.swift
deleted file mode 100644
index d9cecef5e..000000000
--- a/Pods/Alamofire/Source/MultipartFormData.swift
+++ /dev/null
@@ -1,553 +0,0 @@
-//
-//  MultipartFormData.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-#if os(iOS) || os(watchOS) || os(tvOS)
-import MobileCoreServices
-#elseif os(macOS)
-import CoreServices
-#endif
-
-/// Constructs `multipart/form-data` for uploads within an HTTP or HTTPS body. There are currently two ways to encode
-/// multipart form data. The first way is to encode the data directly in memory. This is very efficient, but can lead
-/// to memory issues if the dataset is too large. The second way is designed for larger datasets and will write all the
-/// data to a single file on disk with all the proper boundary segmentation. The second approach MUST be used for
-/// larger datasets such as video content, otherwise your app may run out of memory when trying to encode the dataset.
-///
-/// For more information on `multipart/form-data` in general, please refer to the RFC-2388 and RFC-2045 specs as well
-/// and the w3 form documentation.
-///
-/// - https://www.ietf.org/rfc/rfc2388.txt
-/// - https://www.ietf.org/rfc/rfc2045.txt
-/// - https://www.w3.org/TR/html401/interact/forms.html#h-17.13
-open class MultipartFormData {
-    // MARK: - Helper Types
-
-    enum EncodingCharacters {
-        static let crlf = "\r\n"
-    }
-
-    enum BoundaryGenerator {
-        enum BoundaryType {
-            case initial, encapsulated, final
-        }
-
-        static func randomBoundary() -> String {
-            let first = UInt32.random(in: UInt32.min...UInt32.max)
-            let second = UInt32.random(in: UInt32.min...UInt32.max)
-
-            return String(format: "alamofire.boundary.%08x%08x", first, second)
-        }
-
-        static func boundaryData(forBoundaryType boundaryType: BoundaryType, boundary: String) -> Data {
-            let boundaryText: String
-
-            switch boundaryType {
-            case .initial:
-                boundaryText = "--\(boundary)\(EncodingCharacters.crlf)"
-            case .encapsulated:
-                boundaryText = "\(EncodingCharacters.crlf)--\(boundary)\(EncodingCharacters.crlf)"
-            case .final:
-                boundaryText = "\(EncodingCharacters.crlf)--\(boundary)--\(EncodingCharacters.crlf)"
-            }
-
-            return Data(boundaryText.utf8)
-        }
-    }
-
-    class BodyPart {
-        let headers: HTTPHeaders
-        let bodyStream: InputStream
-        let bodyContentLength: UInt64
-        var hasInitialBoundary = false
-        var hasFinalBoundary = false
-
-        init(headers: HTTPHeaders, bodyStream: InputStream, bodyContentLength: UInt64) {
-            self.headers = headers
-            self.bodyStream = bodyStream
-            self.bodyContentLength = bodyContentLength
-        }
-    }
-
-    // MARK: - Properties
-
-    /// Default memory threshold used when encoding `MultipartFormData`, in bytes.
-    public static let encodingMemoryThreshold: UInt64 = 10_000_000
-
-    /// The `Content-Type` header value containing the boundary used to generate the `multipart/form-data`.
-    open lazy var contentType: String = "multipart/form-data; boundary=\(self.boundary)"
-
-    /// The content length of all body parts used to generate the `multipart/form-data` not including the boundaries.
-    public var contentLength: UInt64 { bodyParts.reduce(0) { $0 + $1.bodyContentLength } }
-
-    /// The boundary used to separate the body parts in the encoded form data.
-    public let boundary: String
-
-    let fileManager: FileManager
-
-    private var bodyParts: [BodyPart]
-    private var bodyPartError: AFError?
-    private let streamBufferSize: Int
-
-    // MARK: - Lifecycle
-
-    /// Creates an instance.
-    ///
-    /// - Parameters:
-    ///   - fileManager: `FileManager` to use for file operations, if needed.
-    ///   - boundary: Boundary `String` used to separate body parts.
-    public init(fileManager: FileManager = .default, boundary: String? = nil) {
-        self.fileManager = fileManager
-        self.boundary = boundary ?? BoundaryGenerator.randomBoundary()
-        bodyParts = []
-
-        //
-        // The optimal read/write buffer size in bytes for input and output streams is 1024 (1KB). For more
-        // information, please refer to the following article:
-        //   - https://developer.apple.com/library/mac/documentation/Cocoa/Conceptual/Streams/Articles/ReadingInputStreams.html
-        //
-        streamBufferSize = 1024
-    }
-
-    // MARK: - Body Parts
-
-    /// Creates a body part from the data and appends it to the instance.
-    ///
-    /// The body part data will be encoded using the following format:
-    ///
-    /// - `Content-Disposition: form-data; name=#{name}; filename=#{filename}` (HTTP Header)
-    /// - `Content-Type: #{mimeType}` (HTTP Header)
-    /// - Encoded file data
-    /// - Multipart form boundary
-    ///
-    /// - Parameters:
-    ///   - data:     `Data` to encoding into the instance.
-    ///   - name:     Name to associate with the `Data` in the `Content-Disposition` HTTP header.
-    ///   - fileName: Filename to associate with the `Data` in the `Content-Disposition` HTTP header.
-    ///   - mimeType: MIME type to associate with the data in the `Content-Type` HTTP header.
-    public func append(_ data: Data, withName name: String, fileName: String? = nil, mimeType: String? = nil) {
-        let headers = contentHeaders(withName: name, fileName: fileName, mimeType: mimeType)
-        let stream = InputStream(data: data)
-        let length = UInt64(data.count)
-
-        append(stream, withLength: length, headers: headers)
-    }
-
-    /// Creates a body part from the file and appends it to the instance.
-    ///
-    /// The body part data will be encoded using the following format:
-    ///
-    /// - `Content-Disposition: form-data; name=#{name}; filename=#{generated filename}` (HTTP Header)
-    /// - `Content-Type: #{generated mimeType}` (HTTP Header)
-    /// - Encoded file data
-    /// - Multipart form boundary
-    ///
-    /// The filename in the `Content-Disposition` HTTP header is generated from the last path component of the
-    /// `fileURL`. The `Content-Type` HTTP header MIME type is generated by mapping the `fileURL` extension to the
-    /// system associated MIME type.
-    ///
-    /// - Parameters:
-    ///   - fileURL: `URL` of the file whose content will be encoded into the instance.
-    ///   - name:    Name to associate with the file content in the `Content-Disposition` HTTP header.
-    public func append(_ fileURL: URL, withName name: String) {
-        let fileName = fileURL.lastPathComponent
-        let pathExtension = fileURL.pathExtension
-
-        if !fileName.isEmpty && !pathExtension.isEmpty {
-            let mime = mimeType(forPathExtension: pathExtension)
-            append(fileURL, withName: name, fileName: fileName, mimeType: mime)
-        } else {
-            setBodyPartError(withReason: .bodyPartFilenameInvalid(in: fileURL))
-        }
-    }
-
-    /// Creates a body part from the file and appends it to the instance.
-    ///
-    /// The body part data will be encoded using the following format:
-    ///
-    /// - Content-Disposition: form-data; name=#{name}; filename=#{filename} (HTTP Header)
-    /// - Content-Type: #{mimeType} (HTTP Header)
-    /// - Encoded file data
-    /// - Multipart form boundary
-    ///
-    /// - Parameters:
-    ///   - fileURL:  `URL` of the file whose content will be encoded into the instance.
-    ///   - name:     Name to associate with the file content in the `Content-Disposition` HTTP header.
-    ///   - fileName: Filename to associate with the file content in the `Content-Disposition` HTTP header.
-    ///   - mimeType: MIME type to associate with the file content in the `Content-Type` HTTP header.
-    public func append(_ fileURL: URL, withName name: String, fileName: String, mimeType: String) {
-        let headers = contentHeaders(withName: name, fileName: fileName, mimeType: mimeType)
-
-        //============================================================
-        //                 Check 1 - is file URL?
-        //============================================================
-
-        guard fileURL.isFileURL else {
-            setBodyPartError(withReason: .bodyPartURLInvalid(url: fileURL))
-            return
-        }
-
-        //============================================================
-        //              Check 2 - is file URL reachable?
-        //============================================================
-
-        do {
-            let isReachable = try fileURL.checkPromisedItemIsReachable()
-            guard isReachable else {
-                setBodyPartError(withReason: .bodyPartFileNotReachable(at: fileURL))
-                return
-            }
-        } catch {
-            setBodyPartError(withReason: .bodyPartFileNotReachableWithError(atURL: fileURL, error: error))
-            return
-        }
-
-        //============================================================
-        //            Check 3 - is file URL a directory?
-        //============================================================
-
-        var isDirectory: ObjCBool = false
-        let path = fileURL.path
-
-        guard fileManager.fileExists(atPath: path, isDirectory: &isDirectory) && !isDirectory.boolValue else {
-            setBodyPartError(withReason: .bodyPartFileIsDirectory(at: fileURL))
-            return
-        }
-
-        //============================================================
-        //          Check 4 - can the file size be extracted?
-        //============================================================
-
-        let bodyContentLength: UInt64
-
-        do {
-            guard let fileSize = try fileManager.attributesOfItem(atPath: path)[.size] as? NSNumber else {
-                setBodyPartError(withReason: .bodyPartFileSizeNotAvailable(at: fileURL))
-                return
-            }
-
-            bodyContentLength = fileSize.uint64Value
-        } catch {
-            setBodyPartError(withReason: .bodyPartFileSizeQueryFailedWithError(forURL: fileURL, error: error))
-            return
-        }
-
-        //============================================================
-        //       Check 5 - can a stream be created from file URL?
-        //============================================================
-
-        guard let stream = InputStream(url: fileURL) else {
-            setBodyPartError(withReason: .bodyPartInputStreamCreationFailed(for: fileURL))
-            return
-        }
-
-        append(stream, withLength: bodyContentLength, headers: headers)
-    }
-
-    /// Creates a body part from the stream and appends it to the instance.
-    ///
-    /// The body part data will be encoded using the following format:
-    ///
-    /// - `Content-Disposition: form-data; name=#{name}; filename=#{filename}` (HTTP Header)
-    /// - `Content-Type: #{mimeType}` (HTTP Header)
-    /// - Encoded stream data
-    /// - Multipart form boundary
-    ///
-    /// - Parameters:
-    ///   - stream:   `InputStream` to encode into the instance.
-    ///   - length:   Length, in bytes, of the stream.
-    ///   - name:     Name to associate with the stream content in the `Content-Disposition` HTTP header.
-    ///   - fileName: Filename to associate with the stream content in the `Content-Disposition` HTTP header.
-    ///   - mimeType: MIME type to associate with the stream content in the `Content-Type` HTTP header.
-    public func append(_ stream: InputStream,
-                       withLength length: UInt64,
-                       name: String,
-                       fileName: String,
-                       mimeType: String) {
-        let headers = contentHeaders(withName: name, fileName: fileName, mimeType: mimeType)
-        append(stream, withLength: length, headers: headers)
-    }
-
-    /// Creates a body part with the stream, length, and headers and appends it to the instance.
-    ///
-    /// The body part data will be encoded using the following format:
-    ///
-    /// - HTTP headers
-    /// - Encoded stream data
-    /// - Multipart form boundary
-    ///
-    /// - Parameters:
-    ///   - stream:  `InputStream` to encode into the instance.
-    ///   - length:  Length, in bytes, of the stream.
-    ///   - headers: `HTTPHeaders` for the body part.
-    public func append(_ stream: InputStream, withLength length: UInt64, headers: HTTPHeaders) {
-        let bodyPart = BodyPart(headers: headers, bodyStream: stream, bodyContentLength: length)
-        bodyParts.append(bodyPart)
-    }
-
-    // MARK: - Data Encoding
-
-    /// Encodes all appended body parts into a single `Data` value.
-    ///
-    /// - Note: This method will load all the appended body parts into memory all at the same time. This method should
-    ///         only be used when the encoded data will have a small memory footprint. For large data cases, please use
-    ///         the `writeEncodedData(to:))` method.
-    ///
-    /// - Returns: The encoded `Data`, if encoding is successful.
-    /// - Throws:  An `AFError` if encoding encounters an error.
-    public func encode() throws -> Data {
-        if let bodyPartError = bodyPartError {
-            throw bodyPartError
-        }
-
-        var encoded = Data()
-
-        bodyParts.first?.hasInitialBoundary = true
-        bodyParts.last?.hasFinalBoundary = true
-
-        for bodyPart in bodyParts {
-            let encodedData = try encode(bodyPart)
-            encoded.append(encodedData)
-        }
-
-        return encoded
-    }
-
-    /// Writes all appended body parts to the given file `URL`.
-    ///
-    /// This process is facilitated by reading and writing with input and output streams, respectively. Thus,
-    /// this approach is very memory efficient and should be used for large body part data.
-    ///
-    /// - Parameter fileURL: File `URL` to which to write the form data.
-    /// - Throws:            An `AFError` if encoding encounters an error.
-    public func writeEncodedData(to fileURL: URL) throws {
-        if let bodyPartError = bodyPartError {
-            throw bodyPartError
-        }
-
-        if fileManager.fileExists(atPath: fileURL.path) {
-            throw AFError.multipartEncodingFailed(reason: .outputStreamFileAlreadyExists(at: fileURL))
-        } else if !fileURL.isFileURL {
-            throw AFError.multipartEncodingFailed(reason: .outputStreamURLInvalid(url: fileURL))
-        }
-
-        guard let outputStream = OutputStream(url: fileURL, append: false) else {
-            throw AFError.multipartEncodingFailed(reason: .outputStreamCreationFailed(for: fileURL))
-        }
-
-        outputStream.open()
-        defer { outputStream.close() }
-
-        bodyParts.first?.hasInitialBoundary = true
-        bodyParts.last?.hasFinalBoundary = true
-
-        for bodyPart in bodyParts {
-            try write(bodyPart, to: outputStream)
-        }
-    }
-
-    // MARK: - Private - Body Part Encoding
-
-    private func encode(_ bodyPart: BodyPart) throws -> Data {
-        var encoded = Data()
-
-        let initialData = bodyPart.hasInitialBoundary ? initialBoundaryData() : encapsulatedBoundaryData()
-        encoded.append(initialData)
-
-        let headerData = encodeHeaders(for: bodyPart)
-        encoded.append(headerData)
-
-        let bodyStreamData = try encodeBodyStream(for: bodyPart)
-        encoded.append(bodyStreamData)
-
-        if bodyPart.hasFinalBoundary {
-            encoded.append(finalBoundaryData())
-        }
-
-        return encoded
-    }
-
-    private func encodeHeaders(for bodyPart: BodyPart) -> Data {
-        let headerText = bodyPart.headers.map { "\($0.name): \($0.value)\(EncodingCharacters.crlf)" }
-            .joined()
-            + EncodingCharacters.crlf
-
-        return Data(headerText.utf8)
-    }
-
-    private func encodeBodyStream(for bodyPart: BodyPart) throws -> Data {
-        let inputStream = bodyPart.bodyStream
-        inputStream.open()
-        defer { inputStream.close() }
-
-        var encoded = Data()
-
-        while inputStream.hasBytesAvailable {
-            var buffer = [UInt8](repeating: 0, count: streamBufferSize)
-            let bytesRead = inputStream.read(&buffer, maxLength: streamBufferSize)
-
-            if let error = inputStream.streamError {
-                throw AFError.multipartEncodingFailed(reason: .inputStreamReadFailed(error: error))
-            }
-
-            if bytesRead > 0 {
-                encoded.append(buffer, count: bytesRead)
-            } else {
-                break
-            }
-        }
-
-        guard UInt64(encoded.count) == bodyPart.bodyContentLength else {
-            let error = AFError.UnexpectedInputStreamLength(bytesExpected: bodyPart.bodyContentLength,
-                                                            bytesRead: UInt64(encoded.count))
-            throw AFError.multipartEncodingFailed(reason: .inputStreamReadFailed(error: error))
-        }
-
-        return encoded
-    }
-
-    // MARK: - Private - Writing Body Part to Output Stream
-
-    private func write(_ bodyPart: BodyPart, to outputStream: OutputStream) throws {
-        try writeInitialBoundaryData(for: bodyPart, to: outputStream)
-        try writeHeaderData(for: bodyPart, to: outputStream)
-        try writeBodyStream(for: bodyPart, to: outputStream)
-        try writeFinalBoundaryData(for: bodyPart, to: outputStream)
-    }
-
-    private func writeInitialBoundaryData(for bodyPart: BodyPart, to outputStream: OutputStream) throws {
-        let initialData = bodyPart.hasInitialBoundary ? initialBoundaryData() : encapsulatedBoundaryData()
-        return try write(initialData, to: outputStream)
-    }
-
-    private func writeHeaderData(for bodyPart: BodyPart, to outputStream: OutputStream) throws {
-        let headerData = encodeHeaders(for: bodyPart)
-        return try write(headerData, to: outputStream)
-    }
-
-    private func writeBodyStream(for bodyPart: BodyPart, to outputStream: OutputStream) throws {
-        let inputStream = bodyPart.bodyStream
-
-        inputStream.open()
-        defer { inputStream.close() }
-
-        while inputStream.hasBytesAvailable {
-            var buffer = [UInt8](repeating: 0, count: streamBufferSize)
-            let bytesRead = inputStream.read(&buffer, maxLength: streamBufferSize)
-
-            if let streamError = inputStream.streamError {
-                throw AFError.multipartEncodingFailed(reason: .inputStreamReadFailed(error: streamError))
-            }
-
-            if bytesRead > 0 {
-                if buffer.count != bytesRead {
-                    buffer = Array(buffer[0..<bytesRead])
-                }
-
-                try write(&buffer, to: outputStream)
-            } else {
-                break
-            }
-        }
-    }
-
-    private func writeFinalBoundaryData(for bodyPart: BodyPart, to outputStream: OutputStream) throws {
-        if bodyPart.hasFinalBoundary {
-            return try write(finalBoundaryData(), to: outputStream)
-        }
-    }
-
-    // MARK: - Private - Writing Buffered Data to Output Stream
-
-    private func write(_ data: Data, to outputStream: OutputStream) throws {
-        var buffer = [UInt8](repeating: 0, count: data.count)
-        data.copyBytes(to: &buffer, count: data.count)
-
-        return try write(&buffer, to: outputStream)
-    }
-
-    private func write(_ buffer: inout [UInt8], to outputStream: OutputStream) throws {
-        var bytesToWrite = buffer.count
-
-        while bytesToWrite > 0, outputStream.hasSpaceAvailable {
-            let bytesWritten = outputStream.write(buffer, maxLength: bytesToWrite)
-
-            if let error = outputStream.streamError {
-                throw AFError.multipartEncodingFailed(reason: .outputStreamWriteFailed(error: error))
-            }
-
-            bytesToWrite -= bytesWritten
-
-            if bytesToWrite > 0 {
-                buffer = Array(buffer[bytesWritten..<buffer.count])
-            }
-        }
-    }
-
-    // MARK: - Private - Mime Type
-
-    private func mimeType(forPathExtension pathExtension: String) -> String {
-        if
-            let id = UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, pathExtension as CFString, nil)?.takeRetainedValue(),
-            let contentType = UTTypeCopyPreferredTagWithClass(id, kUTTagClassMIMEType)?.takeRetainedValue() {
-            return contentType as String
-        }
-
-        return "application/octet-stream"
-    }
-
-    // MARK: - Private - Content Headers
-
-    private func contentHeaders(withName name: String, fileName: String? = nil, mimeType: String? = nil) -> HTTPHeaders {
-        var disposition = "form-data; name=\"\(name)\""
-        if let fileName = fileName { disposition += "; filename=\"\(fileName)\"" }
-
-        var headers: HTTPHeaders = [.contentDisposition(disposition)]
-        if let mimeType = mimeType { headers.add(.contentType(mimeType)) }
-
-        return headers
-    }
-
-    // MARK: - Private - Boundary Encoding
-
-    private func initialBoundaryData() -> Data {
-        BoundaryGenerator.boundaryData(forBoundaryType: .initial, boundary: boundary)
-    }
-
-    private func encapsulatedBoundaryData() -> Data {
-        BoundaryGenerator.boundaryData(forBoundaryType: .encapsulated, boundary: boundary)
-    }
-
-    private func finalBoundaryData() -> Data {
-        BoundaryGenerator.boundaryData(forBoundaryType: .final, boundary: boundary)
-    }
-
-    // MARK: - Private - Errors
-
-    private func setBodyPartError(withReason reason: AFError.MultipartEncodingFailureReason) {
-        guard bodyPartError == nil else { return }
-        bodyPartError = AFError.multipartEncodingFailed(reason: reason)
-    }
-}
diff --git a/Pods/Alamofire/Source/MultipartUpload.swift b/Pods/Alamofire/Source/MultipartUpload.swift
deleted file mode 100644
index 606bd33ee..000000000
--- a/Pods/Alamofire/Source/MultipartUpload.swift
+++ /dev/null
@@ -1,89 +0,0 @@
-//
-//  MultipartUpload.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// Internal type which encapsulates a `MultipartFormData` upload.
-final class MultipartUpload {
-    lazy var result = Result { try build() }
-
-    @Protected
-    private(set) var multipartFormData: MultipartFormData
-    let encodingMemoryThreshold: UInt64
-    let request: URLRequestConvertible
-    let fileManager: FileManager
-
-    init(encodingMemoryThreshold: UInt64,
-         request: URLRequestConvertible,
-         multipartFormData: MultipartFormData) {
-        self.encodingMemoryThreshold = encodingMemoryThreshold
-        self.request = request
-        fileManager = multipartFormData.fileManager
-        self.multipartFormData = multipartFormData
-    }
-
-    func build() throws -> UploadRequest.Uploadable {
-        let uploadable: UploadRequest.Uploadable
-        if multipartFormData.contentLength < encodingMemoryThreshold {
-            let data = try multipartFormData.encode()
-
-            uploadable = .data(data)
-        } else {
-            let tempDirectoryURL = fileManager.temporaryDirectory
-            let directoryURL = tempDirectoryURL.appendingPathComponent("org.alamofire.manager/multipart.form.data")
-            let fileName = UUID().uuidString
-            let fileURL = directoryURL.appendingPathComponent(fileName)
-
-            try fileManager.createDirectory(at: directoryURL, withIntermediateDirectories: true, attributes: nil)
-
-            do {
-                try multipartFormData.writeEncodedData(to: fileURL)
-            } catch {
-                // Cleanup after attempted write if it fails.
-                try? fileManager.removeItem(at: fileURL)
-                throw error
-            }
-
-            uploadable = .file(fileURL, shouldRemove: true)
-        }
-
-        return uploadable
-    }
-}
-
-extension MultipartUpload: UploadConvertible {
-    func asURLRequest() throws -> URLRequest {
-        var urlRequest = try request.asURLRequest()
-
-        $multipartFormData.read { multipartFormData in
-            urlRequest.headers.add(.contentType(multipartFormData.contentType))
-        }
-
-        return urlRequest
-    }
-
-    func createUploadable() throws -> UploadRequest.Uploadable {
-        try result.get()
-    }
-}
diff --git a/Pods/Alamofire/Source/NetworkReachabilityManager.swift b/Pods/Alamofire/Source/NetworkReachabilityManager.swift
deleted file mode 100644
index b97b62fa4..000000000
--- a/Pods/Alamofire/Source/NetworkReachabilityManager.swift
+++ /dev/null
@@ -1,267 +0,0 @@
-//
-//  NetworkReachabilityManager.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-#if !(os(watchOS) || os(Linux))
-
-import Foundation
-import SystemConfiguration
-
-/// The `NetworkReachabilityManager` class listens for reachability changes of hosts and addresses for both cellular and
-/// WiFi network interfaces.
-///
-/// Reachability can be used to determine background information about why a network operation failed, or to retry
-/// network requests when a connection is established. It should not be used to prevent a user from initiating a network
-/// request, as it's possible that an initial request may be required to establish reachability.
-open class NetworkReachabilityManager {
-    /// Defines the various states of network reachability.
-    public enum NetworkReachabilityStatus {
-        /// It is unknown whether the network is reachable.
-        case unknown
-        /// The network is not reachable.
-        case notReachable
-        /// The network is reachable on the associated `ConnectionType`.
-        case reachable(ConnectionType)
-
-        init(_ flags: SCNetworkReachabilityFlags) {
-            guard flags.isActuallyReachable else { self = .notReachable; return }
-
-            var networkStatus: NetworkReachabilityStatus = .reachable(.ethernetOrWiFi)
-
-            if flags.isCellular { networkStatus = .reachable(.cellular) }
-
-            self = networkStatus
-        }
-
-        /// Defines the various connection types detected by reachability flags.
-        public enum ConnectionType {
-            /// The connection type is either over Ethernet or WiFi.
-            case ethernetOrWiFi
-            /// The connection type is a cellular connection.
-            case cellular
-        }
-    }
-
-    /// A closure executed when the network reachability status changes. The closure takes a single argument: the
-    /// network reachability status.
-    public typealias Listener = (NetworkReachabilityStatus) -> Void
-
-    /// Default `NetworkReachabilityManager` for the zero address and a `listenerQueue` of `.main`.
-    public static let `default` = NetworkReachabilityManager()
-
-    // MARK: - Properties
-
-    /// Whether the network is currently reachable.
-    open var isReachable: Bool { isReachableOnCellular || isReachableOnEthernetOrWiFi }
-
-    /// Whether the network is currently reachable over the cellular interface.
-    ///
-    /// - Note: Using this property to decide whether to make a high or low bandwidth request is not recommended.
-    ///         Instead, set the `allowsCellularAccess` on any `URLRequest`s being issued.
-    ///
-    open var isReachableOnCellular: Bool { status == .reachable(.cellular) }
-
-    /// Whether the network is currently reachable over Ethernet or WiFi interface.
-    open var isReachableOnEthernetOrWiFi: Bool { status == .reachable(.ethernetOrWiFi) }
-
-    /// `DispatchQueue` on which reachability will update.
-    public let reachabilityQueue = DispatchQueue(label: "org.alamofire.reachabilityQueue")
-
-    /// Flags of the current reachability type, if any.
-    open var flags: SCNetworkReachabilityFlags? {
-        var flags = SCNetworkReachabilityFlags()
-
-        return (SCNetworkReachabilityGetFlags(reachability, &flags)) ? flags : nil
-    }
-
-    /// The current network reachability status.
-    open var status: NetworkReachabilityStatus {
-        flags.map(NetworkReachabilityStatus.init) ?? .unknown
-    }
-
-    /// Mutable state storage.
-    struct MutableState {
-        /// A closure executed when the network reachability status changes.
-        var listener: Listener?
-        /// `DispatchQueue` on which listeners will be called.
-        var listenerQueue: DispatchQueue?
-        /// Previously calculated status.
-        var previousStatus: NetworkReachabilityStatus?
-    }
-
-    /// `SCNetworkReachability` instance providing notifications.
-    private let reachability: SCNetworkReachability
-
-    /// Protected storage for mutable state.
-    @Protected
-    private var mutableState = MutableState()
-
-    // MARK: - Initialization
-
-    /// Creates an instance with the specified host.
-    ///
-    /// - Note: The `host` value must *not* contain a scheme, just the hostname.
-    ///
-    /// - Parameters:
-    ///   - host:          Host used to evaluate network reachability. Must *not* include the scheme (e.g. `https`).
-    public convenience init?(host: String) {
-        guard let reachability = SCNetworkReachabilityCreateWithName(nil, host) else { return nil }
-
-        self.init(reachability: reachability)
-    }
-
-    /// Creates an instance that monitors the address 0.0.0.0.
-    ///
-    /// Reachability treats the 0.0.0.0 address as a special token that causes it to monitor the general routing
-    /// status of the device, both IPv4 and IPv6.
-    public convenience init?() {
-        var zero = sockaddr()
-        zero.sa_len = UInt8(MemoryLayout<sockaddr>.size)
-        zero.sa_family = sa_family_t(AF_INET)
-
-        guard let reachability = SCNetworkReachabilityCreateWithAddress(nil, &zero) else { return nil }
-
-        self.init(reachability: reachability)
-    }
-
-    private init(reachability: SCNetworkReachability) {
-        self.reachability = reachability
-    }
-
-    deinit {
-        stopListening()
-    }
-
-    // MARK: - Listening
-
-    /// Starts listening for changes in network reachability status.
-    ///
-    /// - Note: Stops and removes any existing listener.
-    ///
-    /// - Parameters:
-    ///   - queue:    `DispatchQueue` on which to call the `listener` closure. `.main` by default.
-    ///   - listener: `Listener` closure called when reachability changes.
-    ///
-    /// - Returns: `true` if listening was started successfully, `false` otherwise.
-    @discardableResult
-    open func startListening(onQueue queue: DispatchQueue = .main,
-                             onUpdatePerforming listener: @escaping Listener) -> Bool {
-        stopListening()
-
-        $mutableState.write { state in
-            state.listenerQueue = queue
-            state.listener = listener
-        }
-
-        var context = SCNetworkReachabilityContext(version: 0,
-                                                   info: Unmanaged.passUnretained(self).toOpaque(),
-                                                   retain: nil,
-                                                   release: nil,
-                                                   copyDescription: nil)
-        let callback: SCNetworkReachabilityCallBack = { _, flags, info in
-            guard let info = info else { return }
-
-            let instance = Unmanaged<NetworkReachabilityManager>.fromOpaque(info).takeUnretainedValue()
-            instance.notifyListener(flags)
-        }
-
-        let queueAdded = SCNetworkReachabilitySetDispatchQueue(reachability, reachabilityQueue)
-        let callbackAdded = SCNetworkReachabilitySetCallback(reachability, callback, &context)
-
-        // Manually call listener to give initial state, since the framework may not.
-        if let currentFlags = flags {
-            reachabilityQueue.async {
-                self.notifyListener(currentFlags)
-            }
-        }
-
-        return callbackAdded && queueAdded
-    }
-
-    /// Stops listening for changes in network reachability status.
-    open func stopListening() {
-        SCNetworkReachabilitySetCallback(reachability, nil, nil)
-        SCNetworkReachabilitySetDispatchQueue(reachability, nil)
-        $mutableState.write { state in
-            state.listener = nil
-            state.listenerQueue = nil
-            state.previousStatus = nil
-        }
-    }
-
-    // MARK: - Internal - Listener Notification
-
-    /// Calls the `listener` closure of the `listenerQueue` if the computed status hasn't changed.
-    ///
-    /// - Note: Should only be called from the `reachabilityQueue`.
-    ///
-    /// - Parameter flags: `SCNetworkReachabilityFlags` to use to calculate the status.
-    func notifyListener(_ flags: SCNetworkReachabilityFlags) {
-        let newStatus = NetworkReachabilityStatus(flags)
-
-        $mutableState.write { state in
-            guard state.previousStatus != newStatus else { return }
-
-            state.previousStatus = newStatus
-
-            let listener = state.listener
-            state.listenerQueue?.async { listener?(newStatus) }
-        }
-    }
-}
-
-// MARK: -
-
-extension NetworkReachabilityManager.NetworkReachabilityStatus: Equatable {}
-
-extension SCNetworkReachabilityFlags {
-    var isReachable: Bool { contains(.reachable) }
-    var isConnectionRequired: Bool { contains(.connectionRequired) }
-    var canConnectAutomatically: Bool { contains(.connectionOnDemand) || contains(.connectionOnTraffic) }
-    var canConnectWithoutUserInteraction: Bool { canConnectAutomatically && !contains(.interventionRequired) }
-    var isActuallyReachable: Bool { isReachable && (!isConnectionRequired || canConnectWithoutUserInteraction) }
-    var isCellular: Bool {
-        #if os(iOS) || os(tvOS)
-        return contains(.isWWAN)
-        #else
-        return false
-        #endif
-    }
-
-    /// Human readable `String` for all states, to help with debugging.
-    var readableDescription: String {
-        let W = isCellular ? "W" : "-"
-        let R = isReachable ? "R" : "-"
-        let c = isConnectionRequired ? "c" : "-"
-        let t = contains(.transientConnection) ? "t" : "-"
-        let i = contains(.interventionRequired) ? "i" : "-"
-        let C = contains(.connectionOnTraffic) ? "C" : "-"
-        let D = contains(.connectionOnDemand) ? "D" : "-"
-        let l = contains(.isLocalAddress) ? "l" : "-"
-        let d = contains(.isDirect) ? "d" : "-"
-        let a = contains(.connectionAutomatic) ? "a" : "-"
-
-        return "\(W)\(R) \(c)\(t)\(i)\(C)\(D)\(l)\(d)\(a)"
-    }
-}
-#endif
diff --git a/Pods/Alamofire/Source/Notifications.swift b/Pods/Alamofire/Source/Notifications.swift
deleted file mode 100644
index 66434b6e7..000000000
--- a/Pods/Alamofire/Source/Notifications.swift
+++ /dev/null
@@ -1,115 +0,0 @@
-//
-//  Notifications.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-extension Request {
-    /// Posted when a `Request` is resumed. The `Notification` contains the resumed `Request`.
-    public static let didResumeNotification = Notification.Name(rawValue: "org.alamofire.notification.name.request.didResume")
-    /// Posted when a `Request` is suspended. The `Notification` contains the suspended `Request`.
-    public static let didSuspendNotification = Notification.Name(rawValue: "org.alamofire.notification.name.request.didSuspend")
-    /// Posted when a `Request` is cancelled. The `Notification` contains the cancelled `Request`.
-    public static let didCancelNotification = Notification.Name(rawValue: "org.alamofire.notification.name.request.didCancel")
-    /// Posted when a `Request` is finished. The `Notification` contains the completed `Request`.
-    public static let didFinishNotification = Notification.Name(rawValue: "org.alamofire.notification.name.request.didFinish")
-
-    /// Posted when a `URLSessionTask` is resumed. The `Notification` contains the `Request` associated with the `URLSessionTask`.
-    public static let didResumeTaskNotification = Notification.Name(rawValue: "org.alamofire.notification.name.request.didResumeTask")
-    /// Posted when a `URLSessionTask` is suspended. The `Notification` contains the `Request` associated with the `URLSessionTask`.
-    public static let didSuspendTaskNotification = Notification.Name(rawValue: "org.alamofire.notification.name.request.didSuspendTask")
-    /// Posted when a `URLSessionTask` is cancelled. The `Notification` contains the `Request` associated with the `URLSessionTask`.
-    public static let didCancelTaskNotification = Notification.Name(rawValue: "org.alamofire.notification.name.request.didCancelTask")
-    /// Posted when a `URLSessionTask` is completed. The `Notification` contains the `Request` associated with the `URLSessionTask`.
-    public static let didCompleteTaskNotification = Notification.Name(rawValue: "org.alamofire.notification.name.request.didCompleteTask")
-}
-
-// MARK: -
-
-extension Notification {
-    /// The `Request` contained by the instance's `userInfo`, `nil` otherwise.
-    public var request: Request? {
-        userInfo?[String.requestKey] as? Request
-    }
-
-    /// Convenience initializer for a `Notification` containing a `Request` payload.
-    ///
-    /// - Parameters:
-    ///   - name:    The name of the notification.
-    ///   - request: The `Request` payload.
-    init(name: Notification.Name, request: Request) {
-        self.init(name: name, object: nil, userInfo: [String.requestKey: request])
-    }
-}
-
-extension NotificationCenter {
-    /// Convenience function for posting notifications with `Request` payloads.
-    ///
-    /// - Parameters:
-    ///   - name:    The name of the notification.
-    ///   - request: The `Request` payload.
-    func postNotification(named name: Notification.Name, with request: Request) {
-        let notification = Notification(name: name, request: request)
-        post(notification)
-    }
-}
-
-extension String {
-    /// User info dictionary key representing the `Request` associated with the notification.
-    fileprivate static let requestKey = "org.alamofire.notification.key.request"
-}
-
-/// `EventMonitor` that provides Alamofire's notifications.
-public final class AlamofireNotifications: EventMonitor {
-    public func requestDidResume(_ request: Request) {
-        NotificationCenter.default.postNotification(named: Request.didResumeNotification, with: request)
-    }
-
-    public func requestDidSuspend(_ request: Request) {
-        NotificationCenter.default.postNotification(named: Request.didSuspendNotification, with: request)
-    }
-
-    public func requestDidCancel(_ request: Request) {
-        NotificationCenter.default.postNotification(named: Request.didCancelNotification, with: request)
-    }
-
-    public func requestDidFinish(_ request: Request) {
-        NotificationCenter.default.postNotification(named: Request.didFinishNotification, with: request)
-    }
-
-    public func request(_ request: Request, didResumeTask task: URLSessionTask) {
-        NotificationCenter.default.postNotification(named: Request.didResumeTaskNotification, with: request)
-    }
-
-    public func request(_ request: Request, didSuspendTask task: URLSessionTask) {
-        NotificationCenter.default.postNotification(named: Request.didSuspendTaskNotification, with: request)
-    }
-
-    public func request(_ request: Request, didCancelTask task: URLSessionTask) {
-        NotificationCenter.default.postNotification(named: Request.didCancelTaskNotification, with: request)
-    }
-
-    public func request(_ request: Request, didCompleteTask task: URLSessionTask, with error: AFError?) {
-        NotificationCenter.default.postNotification(named: Request.didCompleteTaskNotification, with: request)
-    }
-}
diff --git a/Pods/Alamofire/Source/OperationQueue+Alamofire.swift b/Pods/Alamofire/Source/OperationQueue+Alamofire.swift
deleted file mode 100644
index b06a0ccc3..000000000
--- a/Pods/Alamofire/Source/OperationQueue+Alamofire.swift
+++ /dev/null
@@ -1,49 +0,0 @@
-//
-//  OperationQueue+Alamofire.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-extension OperationQueue {
-    /// Creates an instance using the provided parameters.
-    ///
-    /// - Parameters:
-    ///   - qualityOfService:            `QualityOfService` to be applied to the queue. `.default` by default.
-    ///   - maxConcurrentOperationCount: Maximum concurrent operations.
-    ///                                  `OperationQueue.defaultMaxConcurrentOperationCount` by default.
-    ///   - underlyingQueue: Underlying  `DispatchQueue`. `nil` by default.
-    ///   - name:                        Name for the queue. `nil` by default.
-    ///   - startSuspended:              Whether the queue starts suspended. `false` by default.
-    convenience init(qualityOfService: QualityOfService = .default,
-                     maxConcurrentOperationCount: Int = OperationQueue.defaultMaxConcurrentOperationCount,
-                     underlyingQueue: DispatchQueue? = nil,
-                     name: String? = nil,
-                     startSuspended: Bool = false) {
-        self.init()
-        self.qualityOfService = qualityOfService
-        self.maxConcurrentOperationCount = maxConcurrentOperationCount
-        self.underlyingQueue = underlyingQueue
-        self.name = name
-        isSuspended = startSuspended
-    }
-}
diff --git a/Pods/Alamofire/Source/ParameterEncoder.swift b/Pods/Alamofire/Source/ParameterEncoder.swift
deleted file mode 100644
index f4facbee3..000000000
--- a/Pods/Alamofire/Source/ParameterEncoder.swift
+++ /dev/null
@@ -1,184 +0,0 @@
-//
-//  ParameterEncoder.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// A type that can encode any `Encodable` type into a `URLRequest`.
-public protocol ParameterEncoder {
-    /// Encode the provided `Encodable` parameters into `request`.
-    ///
-    /// - Parameters:
-    ///   - parameters: The `Encodable` parameter value.
-    ///   - request:    The `URLRequest` into which to encode the parameters.
-    ///
-    /// - Returns:      A `URLRequest` with the result of the encoding.
-    /// - Throws:       An `Error` when encoding fails. For Alamofire provided encoders, this will be an instance of
-    ///                 `AFError.parameterEncoderFailed` with an associated `ParameterEncoderFailureReason`.
-    func encode<Parameters: Encodable>(_ parameters: Parameters?, into request: URLRequest) throws -> URLRequest
-}
-
-/// A `ParameterEncoder` that encodes types as JSON body data.
-///
-/// If no `Content-Type` header is already set on the provided `URLRequest`s, it's set to `application/json`.
-open class JSONParameterEncoder: ParameterEncoder {
-    /// Returns an encoder with default parameters.
-    public static var `default`: JSONParameterEncoder { JSONParameterEncoder() }
-
-    /// Returns an encoder with `JSONEncoder.outputFormatting` set to `.prettyPrinted`.
-    public static var prettyPrinted: JSONParameterEncoder {
-        let encoder = JSONEncoder()
-        encoder.outputFormatting = .prettyPrinted
-
-        return JSONParameterEncoder(encoder: encoder)
-    }
-
-    /// Returns an encoder with `JSONEncoder.outputFormatting` set to `.sortedKeys`.
-    @available(macOS 10.13, iOS 11.0, tvOS 11.0, watchOS 4.0, *)
-    public static var sortedKeys: JSONParameterEncoder {
-        let encoder = JSONEncoder()
-        encoder.outputFormatting = .sortedKeys
-
-        return JSONParameterEncoder(encoder: encoder)
-    }
-
-    /// `JSONEncoder` used to encode parameters.
-    public let encoder: JSONEncoder
-
-    /// Creates an instance with the provided `JSONEncoder`.
-    ///
-    /// - Parameter encoder: The `JSONEncoder`. `JSONEncoder()` by default.
-    public init(encoder: JSONEncoder = JSONEncoder()) {
-        self.encoder = encoder
-    }
-
-    open func encode<Parameters: Encodable>(_ parameters: Parameters?,
-                                            into request: URLRequest) throws -> URLRequest {
-        guard let parameters = parameters else { return request }
-
-        var request = request
-
-        do {
-            let data = try encoder.encode(parameters)
-            request.httpBody = data
-            if request.headers["Content-Type"] == nil {
-                request.headers.update(.contentType("application/json"))
-            }
-        } catch {
-            throw AFError.parameterEncodingFailed(reason: .jsonEncodingFailed(error: error))
-        }
-
-        return request
-    }
-}
-
-/// A `ParameterEncoder` that encodes types as URL-encoded query strings to be set on the URL or as body data, depending
-/// on the `Destination` set.
-///
-/// If no `Content-Type` header is already set on the provided `URLRequest`s, it will be set to
-/// `application/x-www-form-urlencoded; charset=utf-8`.
-///
-/// Encoding behavior can be customized by passing an instance of `URLEncodedFormEncoder` to the initializer.
-open class URLEncodedFormParameterEncoder: ParameterEncoder {
-    /// Defines where the URL-encoded string should be set for each `URLRequest`.
-    public enum Destination {
-        /// Applies the encoded query string to any existing query string for `.get`, `.head`, and `.delete` request.
-        /// Sets it to the `httpBody` for all other methods.
-        case methodDependent
-        /// Applies the encoded query string to any existing query string from the `URLRequest`.
-        case queryString
-        /// Applies the encoded query string to the `httpBody` of the `URLRequest`.
-        case httpBody
-
-        /// Determines whether the URL-encoded string should be applied to the `URLRequest`'s `url`.
-        ///
-        /// - Parameter method: The `HTTPMethod`.
-        ///
-        /// - Returns:          Whether the URL-encoded string should be applied to a `URL`.
-        func encodesParametersInURL(for method: HTTPMethod) -> Bool {
-            switch self {
-            case .methodDependent: return [.get, .head, .delete].contains(method)
-            case .queryString: return true
-            case .httpBody: return false
-            }
-        }
-    }
-
-    /// Returns an encoder with default parameters.
-    public static var `default`: URLEncodedFormParameterEncoder { URLEncodedFormParameterEncoder() }
-
-    /// The `URLEncodedFormEncoder` to use.
-    public let encoder: URLEncodedFormEncoder
-
-    /// The `Destination` for the URL-encoded string.
-    public let destination: Destination
-
-    /// Creates an instance with the provided `URLEncodedFormEncoder` instance and `Destination` value.
-    ///
-    /// - Parameters:
-    ///   - encoder:     The `URLEncodedFormEncoder`. `URLEncodedFormEncoder()` by default.
-    ///   - destination: The `Destination`. `.methodDependent` by default.
-    public init(encoder: URLEncodedFormEncoder = URLEncodedFormEncoder(), destination: Destination = .methodDependent) {
-        self.encoder = encoder
-        self.destination = destination
-    }
-
-    open func encode<Parameters: Encodable>(_ parameters: Parameters?,
-                                            into request: URLRequest) throws -> URLRequest {
-        guard let parameters = parameters else { return request }
-
-        var request = request
-
-        guard let url = request.url else {
-            throw AFError.parameterEncoderFailed(reason: .missingRequiredComponent(.url))
-        }
-
-        guard let method = request.method else {
-            let rawValue = request.method?.rawValue ?? "nil"
-            throw AFError.parameterEncoderFailed(reason: .missingRequiredComponent(.httpMethod(rawValue: rawValue)))
-        }
-
-        if destination.encodesParametersInURL(for: method),
-           var components = URLComponents(url: url, resolvingAgainstBaseURL: false) {
-            let query: String = try Result<String, Error> { try encoder.encode(parameters) }
-                .mapError { AFError.parameterEncoderFailed(reason: .encoderFailed(error: $0)) }.get()
-            let newQueryString = [components.percentEncodedQuery, query].compactMap { $0 }.joinedWithAmpersands()
-            components.percentEncodedQuery = newQueryString.isEmpty ? nil : newQueryString
-
-            guard let newURL = components.url else {
-                throw AFError.parameterEncoderFailed(reason: .missingRequiredComponent(.url))
-            }
-
-            request.url = newURL
-        } else {
-            if request.headers["Content-Type"] == nil {
-                request.headers.update(.contentType("application/x-www-form-urlencoded; charset=utf-8"))
-            }
-
-            request.httpBody = try Result<Data, Error> { try encoder.encode(parameters) }
-                .mapError { AFError.parameterEncoderFailed(reason: .encoderFailed(error: $0)) }.get()
-        }
-
-        return request
-    }
-}
diff --git a/Pods/Alamofire/Source/ParameterEncoding.swift b/Pods/Alamofire/Source/ParameterEncoding.swift
deleted file mode 100644
index 6e72604c7..000000000
--- a/Pods/Alamofire/Source/ParameterEncoding.swift
+++ /dev/null
@@ -1,317 +0,0 @@
-//
-//  ParameterEncoding.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// A dictionary of parameters to apply to a `URLRequest`.
-public typealias Parameters = [String: Any]
-
-/// A type used to define how a set of parameters are applied to a `URLRequest`.
-public protocol ParameterEncoding {
-    /// Creates a `URLRequest` by encoding parameters and applying them on the passed request.
-    ///
-    /// - Parameters:
-    ///   - urlRequest: `URLRequestConvertible` value onto which parameters will be encoded.
-    ///   - parameters: `Parameters` to encode onto the request.
-    ///
-    /// - Returns:      The encoded `URLRequest`.
-    /// - Throws:       Any `Error` produced during parameter encoding.
-    func encode(_ urlRequest: URLRequestConvertible, with parameters: Parameters?) throws -> URLRequest
-}
-
-// MARK: -
-
-/// Creates a url-encoded query string to be set as or appended to any existing URL query string or set as the HTTP
-/// body of the URL request. Whether the query string is set or appended to any existing URL query string or set as
-/// the HTTP body depends on the destination of the encoding.
-///
-/// The `Content-Type` HTTP header field of an encoded request with HTTP body is set to
-/// `application/x-www-form-urlencoded; charset=utf-8`.
-///
-/// There is no published specification for how to encode collection types. By default the convention of appending
-/// `[]` to the key for array values (`foo[]=1&foo[]=2`), and appending the key surrounded by square brackets for
-/// nested dictionary values (`foo[bar]=baz`) is used. Optionally, `ArrayEncoding` can be used to omit the
-/// square brackets appended to array keys.
-///
-/// `BoolEncoding` can be used to configure how boolean values are encoded. The default behavior is to encode
-/// `true` as 1 and `false` as 0.
-public struct URLEncoding: ParameterEncoding {
-    // MARK: Helper Types
-
-    /// Defines whether the url-encoded query string is applied to the existing query string or HTTP body of the
-    /// resulting URL request.
-    public enum Destination {
-        /// Applies encoded query string result to existing query string for `GET`, `HEAD` and `DELETE` requests and
-        /// sets as the HTTP body for requests with any other HTTP method.
-        case methodDependent
-        /// Sets or appends encoded query string result to existing query string.
-        case queryString
-        /// Sets encoded query string result as the HTTP body of the URL request.
-        case httpBody
-
-        func encodesParametersInURL(for method: HTTPMethod) -> Bool {
-            switch self {
-            case .methodDependent: return [.get, .head, .delete].contains(method)
-            case .queryString: return true
-            case .httpBody: return false
-            }
-        }
-    }
-
-    /// Configures how `Array` parameters are encoded.
-    public enum ArrayEncoding {
-        /// An empty set of square brackets is appended to the key for every value. This is the default behavior.
-        case brackets
-        /// No brackets are appended. The key is encoded as is.
-        case noBrackets
-
-        func encode(key: String) -> String {
-            switch self {
-            case .brackets:
-                return "\(key)[]"
-            case .noBrackets:
-                return key
-            }
-        }
-    }
-
-    /// Configures how `Bool` parameters are encoded.
-    public enum BoolEncoding {
-        /// Encode `true` as `1` and `false` as `0`. This is the default behavior.
-        case numeric
-        /// Encode `true` and `false` as string literals.
-        case literal
-
-        func encode(value: Bool) -> String {
-            switch self {
-            case .numeric:
-                return value ? "1" : "0"
-            case .literal:
-                return value ? "true" : "false"
-            }
-        }
-    }
-
-    // MARK: Properties
-
-    /// Returns a default `URLEncoding` instance with a `.methodDependent` destination.
-    public static var `default`: URLEncoding { URLEncoding() }
-
-    /// Returns a `URLEncoding` instance with a `.queryString` destination.
-    public static var queryString: URLEncoding { URLEncoding(destination: .queryString) }
-
-    /// Returns a `URLEncoding` instance with an `.httpBody` destination.
-    public static var httpBody: URLEncoding { URLEncoding(destination: .httpBody) }
-
-    /// The destination defining where the encoded query string is to be applied to the URL request.
-    public let destination: Destination
-
-    /// The encoding to use for `Array` parameters.
-    public let arrayEncoding: ArrayEncoding
-
-    /// The encoding to use for `Bool` parameters.
-    public let boolEncoding: BoolEncoding
-
-    // MARK: Initialization
-
-    /// Creates an instance using the specified parameters.
-    ///
-    /// - Parameters:
-    ///   - destination:   `Destination` defining where the encoded query string will be applied. `.methodDependent` by
-    ///                    default.
-    ///   - arrayEncoding: `ArrayEncoding` to use. `.brackets` by default.
-    ///   - boolEncoding:  `BoolEncoding` to use. `.numeric` by default.
-    public init(destination: Destination = .methodDependent,
-                arrayEncoding: ArrayEncoding = .brackets,
-                boolEncoding: BoolEncoding = .numeric) {
-        self.destination = destination
-        self.arrayEncoding = arrayEncoding
-        self.boolEncoding = boolEncoding
-    }
-
-    // MARK: Encoding
-
-    public func encode(_ urlRequest: URLRequestConvertible, with parameters: Parameters?) throws -> URLRequest {
-        var urlRequest = try urlRequest.asURLRequest()
-
-        guard let parameters = parameters else { return urlRequest }
-
-        if let method = urlRequest.method, destination.encodesParametersInURL(for: method) {
-            guard let url = urlRequest.url else {
-                throw AFError.parameterEncodingFailed(reason: .missingURL)
-            }
-
-            if var urlComponents = URLComponents(url: url, resolvingAgainstBaseURL: false), !parameters.isEmpty {
-                let percentEncodedQuery = (urlComponents.percentEncodedQuery.map { $0 + "&" } ?? "") + query(parameters)
-                urlComponents.percentEncodedQuery = percentEncodedQuery
-                urlRequest.url = urlComponents.url
-            }
-        } else {
-            if urlRequest.headers["Content-Type"] == nil {
-                urlRequest.headers.update(.contentType("application/x-www-form-urlencoded; charset=utf-8"))
-            }
-
-            urlRequest.httpBody = Data(query(parameters).utf8)
-        }
-
-        return urlRequest
-    }
-
-    /// Creates a percent-escaped, URL encoded query string components from the given key-value pair recursively.
-    ///
-    /// - Parameters:
-    ///   - key:   Key of the query component.
-    ///   - value: Value of the query component.
-    ///
-    /// - Returns: The percent-escaped, URL encoded query string components.
-    public func queryComponents(fromKey key: String, value: Any) -> [(String, String)] {
-        var components: [(String, String)] = []
-        switch value {
-        case let dictionary as [String: Any]:
-            for (nestedKey, value) in dictionary {
-                components += queryComponents(fromKey: "\(key)[\(nestedKey)]", value: value)
-            }
-        case let array as [Any]:
-            for value in array {
-                components += queryComponents(fromKey: arrayEncoding.encode(key: key), value: value)
-            }
-        case let number as NSNumber:
-            if number.isBool {
-                components.append((escape(key), escape(boolEncoding.encode(value: number.boolValue))))
-            } else {
-                components.append((escape(key), escape("\(number)")))
-            }
-        case let bool as Bool:
-            components.append((escape(key), escape(boolEncoding.encode(value: bool))))
-        default:
-            components.append((escape(key), escape("\(value)")))
-        }
-        return components
-    }
-
-    /// Creates a percent-escaped string following RFC 3986 for a query string key or value.
-    ///
-    /// - Parameter string: `String` to be percent-escaped.
-    ///
-    /// - Returns:          The percent-escaped `String`.
-    public func escape(_ string: String) -> String {
-        string.addingPercentEncoding(withAllowedCharacters: .afURLQueryAllowed) ?? string
-    }
-
-    private func query(_ parameters: [String: Any]) -> String {
-        var components: [(String, String)] = []
-
-        for key in parameters.keys.sorted(by: <) {
-            let value = parameters[key]!
-            components += queryComponents(fromKey: key, value: value)
-        }
-        return components.map { "\($0)=\($1)" }.joined(separator: "&")
-    }
-}
-
-// MARK: -
-
-/// Uses `JSONSerialization` to create a JSON representation of the parameters object, which is set as the body of the
-/// request. The `Content-Type` HTTP header field of an encoded request is set to `application/json`.
-public struct JSONEncoding: ParameterEncoding {
-    // MARK: Properties
-
-    /// Returns a `JSONEncoding` instance with default writing options.
-    public static var `default`: JSONEncoding { JSONEncoding() }
-
-    /// Returns a `JSONEncoding` instance with `.prettyPrinted` writing options.
-    public static var prettyPrinted: JSONEncoding { JSONEncoding(options: .prettyPrinted) }
-
-    /// The options for writing the parameters as JSON data.
-    public let options: JSONSerialization.WritingOptions
-
-    // MARK: Initialization
-
-    /// Creates an instance using the specified `WritingOptions`.
-    ///
-    /// - Parameter options: `JSONSerialization.WritingOptions` to use.
-    public init(options: JSONSerialization.WritingOptions = []) {
-        self.options = options
-    }
-
-    // MARK: Encoding
-
-    public func encode(_ urlRequest: URLRequestConvertible, with parameters: Parameters?) throws -> URLRequest {
-        var urlRequest = try urlRequest.asURLRequest()
-
-        guard let parameters = parameters else { return urlRequest }
-
-        do {
-            let data = try JSONSerialization.data(withJSONObject: parameters, options: options)
-
-            if urlRequest.headers["Content-Type"] == nil {
-                urlRequest.headers.update(.contentType("application/json"))
-            }
-
-            urlRequest.httpBody = data
-        } catch {
-            throw AFError.parameterEncodingFailed(reason: .jsonEncodingFailed(error: error))
-        }
-
-        return urlRequest
-    }
-
-    /// Encodes any JSON compatible object into a `URLRequest`.
-    ///
-    /// - Parameters:
-    ///   - urlRequest: `URLRequestConvertible` value into which the object will be encoded.
-    ///   - jsonObject: `Any` value (must be JSON compatible` to be encoded into the `URLRequest`. `nil` by default.
-    ///
-    /// - Returns:      The encoded `URLRequest`.
-    /// - Throws:       Any `Error` produced during encoding.
-    public func encode(_ urlRequest: URLRequestConvertible, withJSONObject jsonObject: Any? = nil) throws -> URLRequest {
-        var urlRequest = try urlRequest.asURLRequest()
-
-        guard let jsonObject = jsonObject else { return urlRequest }
-
-        do {
-            let data = try JSONSerialization.data(withJSONObject: jsonObject, options: options)
-
-            if urlRequest.headers["Content-Type"] == nil {
-                urlRequest.headers.update(.contentType("application/json"))
-            }
-
-            urlRequest.httpBody = data
-        } catch {
-            throw AFError.parameterEncodingFailed(reason: .jsonEncodingFailed(error: error))
-        }
-
-        return urlRequest
-    }
-}
-
-// MARK: -
-
-extension NSNumber {
-    fileprivate var isBool: Bool {
-        // Use Obj-C type encoding to check whether the underlying type is a `Bool`, as it's guaranteed as part of
-        // swift-corelibs-foundation, per [this discussion on the Swift forums](https://forums.swift.org/t/alamofire-on-linux-possible-but-not-release-ready/34553/22).
-        String(cString: objCType) == "c"
-    }
-}
diff --git a/Pods/Alamofire/Source/Protected.swift b/Pods/Alamofire/Source/Protected.swift
deleted file mode 100644
index 6288205e6..000000000
--- a/Pods/Alamofire/Source/Protected.swift
+++ /dev/null
@@ -1,224 +0,0 @@
-//
-//  Protected.swift
-//
-//  Copyright (c) 2014-2020 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-private protocol Lock {
-    func lock()
-    func unlock()
-}
-
-extension Lock {
-    /// Executes a closure returning a value while acquiring the lock.
-    ///
-    /// - Parameter closure: The closure to run.
-    ///
-    /// - Returns:           The value the closure generated.
-    func around<T>(_ closure: () -> T) -> T {
-        lock(); defer { unlock() }
-        return closure()
-    }
-
-    /// Execute a closure while acquiring the lock.
-    ///
-    /// - Parameter closure: The closure to run.
-    func around(_ closure: () -> Void) {
-        lock(); defer { unlock() }
-        closure()
-    }
-}
-
-#if os(Linux)
-/// A `pthread_mutex_t` wrapper.
-final class MutexLock: Lock {
-    private var mutex: UnsafeMutablePointer<pthread_mutex_t>
-
-    init() {
-        mutex = .allocate(capacity: 1)
-
-        var attr = pthread_mutexattr_t()
-        pthread_mutexattr_init(&attr)
-        pthread_mutexattr_settype(&attr, .init(PTHREAD_MUTEX_ERRORCHECK))
-
-        let error = pthread_mutex_init(mutex, &attr)
-        precondition(error == 0, "Failed to create pthread_mutex")
-    }
-
-    deinit {
-        let error = pthread_mutex_destroy(mutex)
-        precondition(error == 0, "Failed to destroy pthread_mutex")
-    }
-
-    fileprivate func lock() {
-        let error = pthread_mutex_lock(mutex)
-        precondition(error == 0, "Failed to lock pthread_mutex")
-    }
-
-    fileprivate func unlock() {
-        let error = pthread_mutex_unlock(mutex)
-        precondition(error == 0, "Failed to unlock pthread_mutex")
-    }
-}
-#endif
-
-#if os(macOS) || os(iOS) || os(watchOS) || os(tvOS)
-/// An `os_unfair_lock` wrapper.
-final class UnfairLock: Lock {
-    private let unfairLock: os_unfair_lock_t
-
-    init() {
-        unfairLock = .allocate(capacity: 1)
-        unfairLock.initialize(to: os_unfair_lock())
-    }
-
-    deinit {
-        unfairLock.deinitialize(count: 1)
-        unfairLock.deallocate()
-    }
-
-    fileprivate func lock() {
-        os_unfair_lock_lock(unfairLock)
-    }
-
-    fileprivate func unlock() {
-        os_unfair_lock_unlock(unfairLock)
-    }
-}
-#endif
-
-/// A thread-safe wrapper around a value.
-@propertyWrapper
-@dynamicMemberLookup
-final class Protected<T> {
-    #if os(macOS) || os(iOS) || os(watchOS) || os(tvOS)
-    private let lock = UnfairLock()
-    #elseif os(Linux)
-    private let lock = MutexLock()
-    #endif
-    private var value: T
-
-    init(_ value: T) {
-        self.value = value
-    }
-
-    /// The contained value. Unsafe for anything more than direct read or write.
-    var wrappedValue: T {
-        get { lock.around { value } }
-        set { lock.around { value = newValue } }
-    }
-
-    var projectedValue: Protected<T> { self }
-
-    init(wrappedValue: T) {
-        value = wrappedValue
-    }
-
-    /// Synchronously read or transform the contained value.
-    ///
-    /// - Parameter closure: The closure to execute.
-    ///
-    /// - Returns:           The return value of the closure passed.
-    func read<U>(_ closure: (T) -> U) -> U {
-        lock.around { closure(self.value) }
-    }
-
-    /// Synchronously modify the protected value.
-    ///
-    /// - Parameter closure: The closure to execute.
-    ///
-    /// - Returns:           The modified value.
-    @discardableResult
-    func write<U>(_ closure: (inout T) -> U) -> U {
-        lock.around { closure(&self.value) }
-    }
-
-    subscript<Property>(dynamicMember keyPath: WritableKeyPath<T, Property>) -> Property {
-        get { lock.around { value[keyPath: keyPath] } }
-        set { lock.around { value[keyPath: keyPath] = newValue } }
-    }
-}
-
-extension Protected where T: RangeReplaceableCollection {
-    /// Adds a new element to the end of this protected collection.
-    ///
-    /// - Parameter newElement: The `Element` to append.
-    func append(_ newElement: T.Element) {
-        write { (ward: inout T) in
-            ward.append(newElement)
-        }
-    }
-
-    /// Adds the elements of a sequence to the end of this protected collection.
-    ///
-    /// - Parameter newElements: The `Sequence` to append.
-    func append<S: Sequence>(contentsOf newElements: S) where S.Element == T.Element {
-        write { (ward: inout T) in
-            ward.append(contentsOf: newElements)
-        }
-    }
-
-    /// Add the elements of a collection to the end of the protected collection.
-    ///
-    /// - Parameter newElements: The `Collection` to append.
-    func append<C: Collection>(contentsOf newElements: C) where C.Element == T.Element {
-        write { (ward: inout T) in
-            ward.append(contentsOf: newElements)
-        }
-    }
-}
-
-extension Protected where T == Data? {
-    /// Adds the contents of a `Data` value to the end of the protected `Data`.
-    ///
-    /// - Parameter data: The `Data` to be appended.
-    func append(_ data: Data) {
-        write { (ward: inout T) in
-            ward?.append(data)
-        }
-    }
-}
-
-extension Protected where T == Request.MutableState {
-    /// Attempts to transition to the passed `State`.
-    ///
-    /// - Parameter state: The `State` to attempt transition to.
-    ///
-    /// - Returns:         Whether the transition occurred.
-    func attemptToTransitionTo(_ state: Request.State) -> Bool {
-        lock.around {
-            guard value.state.canTransitionTo(state) else { return false }
-
-            value.state = state
-
-            return true
-        }
-    }
-
-    /// Perform a closure while locked with the provided `Request.State`.
-    ///
-    /// - Parameter perform: The closure to perform while locked.
-    func withState(perform: (Request.State) -> Void) {
-        lock.around { perform(value.state) }
-    }
-}
diff --git a/Pods/Alamofire/Source/RedirectHandler.swift b/Pods/Alamofire/Source/RedirectHandler.swift
deleted file mode 100644
index b6c069cad..000000000
--- a/Pods/Alamofire/Source/RedirectHandler.swift
+++ /dev/null
@@ -1,95 +0,0 @@
-//
-//  RedirectHandler.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// A type that handles how an HTTP redirect response from a remote server should be redirected to the new request.
-public protocol RedirectHandler {
-    /// Determines how the HTTP redirect response should be redirected to the new request.
-    ///
-    /// The `completion` closure should be passed one of three possible options:
-    ///
-    ///   1. The new request specified by the redirect (this is the most common use case).
-    ///   2. A modified version of the new request (you may want to route it somewhere else).
-    ///   3. A `nil` value to deny the redirect request and return the body of the redirect response.
-    ///
-    /// - Parameters:
-    ///   - task:       The `URLSessionTask` whose request resulted in a redirect.
-    ///   - request:    The `URLRequest` to the new location specified by the redirect response.
-    ///   - response:   The `HTTPURLResponse` containing the server's response to the original request.
-    ///   - completion: The closure to execute containing the new `URLRequest`, a modified `URLRequest`, or `nil`.
-    func task(_ task: URLSessionTask,
-              willBeRedirectedTo request: URLRequest,
-              for response: HTTPURLResponse,
-              completion: @escaping (URLRequest?) -> Void)
-}
-
-// MARK: -
-
-/// `Redirector` is a convenience `RedirectHandler` making it easy to follow, not follow, or modify a redirect.
-public struct Redirector {
-    /// Defines the behavior of the `Redirector` type.
-    public enum Behavior {
-        /// Follow the redirect as defined in the response.
-        case follow
-        /// Do not follow the redirect defined in the response.
-        case doNotFollow
-        /// Modify the redirect request defined in the response.
-        case modify((URLSessionTask, URLRequest, HTTPURLResponse) -> URLRequest?)
-    }
-
-    /// Returns a `Redirector` with a `.follow` `Behavior`.
-    public static let follow = Redirector(behavior: .follow)
-    /// Returns a `Redirector` with a `.doNotFollow` `Behavior`.
-    public static let doNotFollow = Redirector(behavior: .doNotFollow)
-
-    /// The `Behavior` of the `Redirector`.
-    public let behavior: Behavior
-
-    /// Creates a `Redirector` instance from the `Behavior`.
-    ///
-    /// - Parameter behavior: The `Behavior`.
-    public init(behavior: Behavior) {
-        self.behavior = behavior
-    }
-}
-
-// MARK: -
-
-extension Redirector: RedirectHandler {
-    public func task(_ task: URLSessionTask,
-                     willBeRedirectedTo request: URLRequest,
-                     for response: HTTPURLResponse,
-                     completion: @escaping (URLRequest?) -> Void) {
-        switch behavior {
-        case .follow:
-            completion(request)
-        case .doNotFollow:
-            completion(nil)
-        case let .modify(closure):
-            let request = closure(task, request, response)
-            completion(request)
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/Request.swift b/Pods/Alamofire/Source/Request.swift
deleted file mode 100644
index 849f87847..000000000
--- a/Pods/Alamofire/Source/Request.swift
+++ /dev/null
@@ -1,1882 +0,0 @@
-//
-//  Request.swift
-//
-//  Copyright (c) 2014-2020 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// `Request` is the common superclass of all Alamofire request types and provides common state, delegate, and callback
-/// handling.
-public class Request {
-    /// State of the `Request`, with managed transitions between states set when calling `resume()`, `suspend()`, or
-    /// `cancel()` on the `Request`.
-    public enum State {
-        /// Initial state of the `Request`.
-        case initialized
-        /// `State` set when `resume()` is called. Any tasks created for the `Request` will have `resume()` called on
-        /// them in this state.
-        case resumed
-        /// `State` set when `suspend()` is called. Any tasks created for the `Request` will have `suspend()` called on
-        /// them in this state.
-        case suspended
-        /// `State` set when `cancel()` is called. Any tasks created for the `Request` will have `cancel()` called on
-        /// them. Unlike `resumed` or `suspended`, once in the `cancelled` state, the `Request` can no longer transition
-        /// to any other state.
-        case cancelled
-        /// `State` set when all response serialization completion closures have been cleared on the `Request` and
-        /// enqueued on their respective queues.
-        case finished
-
-        /// Determines whether `self` can be transitioned to the provided `State`.
-        func canTransitionTo(_ state: State) -> Bool {
-            switch (self, state) {
-            case (.initialized, _):
-                return true
-            case (_, .initialized), (.cancelled, _), (.finished, _):
-                return false
-            case (.resumed, .cancelled), (.suspended, .cancelled), (.resumed, .suspended), (.suspended, .resumed):
-                return true
-            case (.suspended, .suspended), (.resumed, .resumed):
-                return false
-            case (_, .finished):
-                return true
-            }
-        }
-    }
-
-    // MARK: - Initial State
-
-    /// `UUID` providing a unique identifier for the `Request`, used in the `Hashable` and `Equatable` conformances.
-    public let id: UUID
-    /// The serial queue for all internal async actions.
-    public let underlyingQueue: DispatchQueue
-    /// The queue used for all serialization actions. By default it's a serial queue that targets `underlyingQueue`.
-    public let serializationQueue: DispatchQueue
-    /// `EventMonitor` used for event callbacks.
-    public let eventMonitor: EventMonitor?
-    /// The `Request`'s interceptor.
-    public let interceptor: RequestInterceptor?
-    /// The `Request`'s delegate.
-    public private(set) weak var delegate: RequestDelegate?
-
-    // MARK: - Mutable State
-
-    /// Type encapsulating all mutable state that may need to be accessed from anything other than the `underlyingQueue`.
-    struct MutableState {
-        /// State of the `Request`.
-        var state: State = .initialized
-        /// `ProgressHandler` and `DispatchQueue` provided for upload progress callbacks.
-        var uploadProgressHandler: (handler: ProgressHandler, queue: DispatchQueue)?
-        /// `ProgressHandler` and `DispatchQueue` provided for download progress callbacks.
-        var downloadProgressHandler: (handler: ProgressHandler, queue: DispatchQueue)?
-        /// `RedirectHandler` provided for to handle request redirection.
-        var redirectHandler: RedirectHandler?
-        /// `CachedResponseHandler` provided to handle response caching.
-        var cachedResponseHandler: CachedResponseHandler?
-        /// Queue and closure called when the `Request` is able to create a cURL description of itself.
-        var cURLHandler: (queue: DispatchQueue, handler: (String) -> Void)?
-        /// Queue and closure called when the `Request` creates a `URLRequest`.
-        var urlRequestHandler: (queue: DispatchQueue, handler: (URLRequest) -> Void)?
-        /// Queue and closure called when the `Request` creates a `URLSessionTask`.
-        var urlSessionTaskHandler: (queue: DispatchQueue, handler: (URLSessionTask) -> Void)?
-        /// Response serialization closures that handle response parsing.
-        var responseSerializers: [() -> Void] = []
-        /// Response serialization completion closures executed once all response serializers are complete.
-        var responseSerializerCompletions: [() -> Void] = []
-        /// Whether response serializer processing is finished.
-        var responseSerializerProcessingFinished = false
-        /// `URLCredential` used for authentication challenges.
-        var credential: URLCredential?
-        /// All `URLRequest`s created by Alamofire on behalf of the `Request`.
-        var requests: [URLRequest] = []
-        /// All `URLSessionTask`s created by Alamofire on behalf of the `Request`.
-        var tasks: [URLSessionTask] = []
-        /// All `URLSessionTaskMetrics` values gathered by Alamofire on behalf of the `Request`. Should correspond
-        /// exactly the the `tasks` created.
-        var metrics: [URLSessionTaskMetrics] = []
-        /// Number of times any retriers provided retried the `Request`.
-        var retryCount = 0
-        /// Final `AFError` for the `Request`, whether from various internal Alamofire calls or as a result of a `task`.
-        var error: AFError?
-        /// Whether the instance has had `finish()` called and is running the serializers. Should be replaced with a
-        /// representation in the state machine in the future.
-        var isFinishing = false
-    }
-
-    /// Protected `MutableState` value that provides thread-safe access to state values.
-    @Protected
-    fileprivate var mutableState = MutableState()
-
-    /// `State` of the `Request`.
-    public var state: State { mutableState.state }
-    /// Returns whether `state` is `.initialized`.
-    public var isInitialized: Bool { state == .initialized }
-    /// Returns whether `state is `.resumed`.
-    public var isResumed: Bool { state == .resumed }
-    /// Returns whether `state` is `.suspended`.
-    public var isSuspended: Bool { state == .suspended }
-    /// Returns whether `state` is `.cancelled`.
-    public var isCancelled: Bool { state == .cancelled }
-    /// Returns whether `state` is `.finished`.
-    public var isFinished: Bool { state == .finished }
-
-    // MARK: Progress
-
-    /// Closure type executed when monitoring the upload or download progress of a request.
-    public typealias ProgressHandler = (Progress) -> Void
-
-    /// `Progress` of the upload of the body of the executed `URLRequest`. Reset to `0` if the `Request` is retried.
-    public let uploadProgress = Progress(totalUnitCount: 0)
-    /// `Progress` of the download of any response data. Reset to `0` if the `Request` is retried.
-    public let downloadProgress = Progress(totalUnitCount: 0)
-    /// `ProgressHandler` called when `uploadProgress` is updated, on the provided `DispatchQueue`.
-    private var uploadProgressHandler: (handler: ProgressHandler, queue: DispatchQueue)? {
-        get { mutableState.uploadProgressHandler }
-        set { mutableState.uploadProgressHandler = newValue }
-    }
-
-    /// `ProgressHandler` called when `downloadProgress` is updated, on the provided `DispatchQueue`.
-    fileprivate var downloadProgressHandler: (handler: ProgressHandler, queue: DispatchQueue)? {
-        get { mutableState.downloadProgressHandler }
-        set { mutableState.downloadProgressHandler = newValue }
-    }
-
-    // MARK: Redirect Handling
-
-    /// `RedirectHandler` set on the instance.
-    public private(set) var redirectHandler: RedirectHandler? {
-        get { mutableState.redirectHandler }
-        set { mutableState.redirectHandler = newValue }
-    }
-
-    // MARK: Cached Response Handling
-
-    /// `CachedResponseHandler` set on the instance.
-    public private(set) var cachedResponseHandler: CachedResponseHandler? {
-        get { mutableState.cachedResponseHandler }
-        set { mutableState.cachedResponseHandler = newValue }
-    }
-
-    // MARK: URLCredential
-
-    /// `URLCredential` used for authentication challenges. Created by calling one of the `authenticate` methods.
-    public private(set) var credential: URLCredential? {
-        get { mutableState.credential }
-        set { mutableState.credential = newValue }
-    }
-
-    // MARK: Validators
-
-    /// `Validator` callback closures that store the validation calls enqueued.
-    @Protected
-    fileprivate var validators: [() -> Void] = []
-
-    // MARK: URLRequests
-
-    /// All `URLRequests` created on behalf of the `Request`, including original and adapted requests.
-    public var requests: [URLRequest] { mutableState.requests }
-    /// First `URLRequest` created on behalf of the `Request`. May not be the first one actually executed.
-    public var firstRequest: URLRequest? { requests.first }
-    /// Last `URLRequest` created on behalf of the `Request`.
-    public var lastRequest: URLRequest? { requests.last }
-    /// Current `URLRequest` created on behalf of the `Request`.
-    public var request: URLRequest? { lastRequest }
-
-    /// `URLRequest`s from all of the `URLSessionTask`s executed on behalf of the `Request`. May be different from
-    /// `requests` due to `URLSession` manipulation.
-    public var performedRequests: [URLRequest] { $mutableState.read { $0.tasks.compactMap { $0.currentRequest } } }
-
-    // MARK: HTTPURLResponse
-
-    /// `HTTPURLResponse` received from the server, if any. If the `Request` was retried, this is the response of the
-    /// last `URLSessionTask`.
-    public var response: HTTPURLResponse? { lastTask?.response as? HTTPURLResponse }
-
-    // MARK: Tasks
-
-    /// All `URLSessionTask`s created on behalf of the `Request`.
-    public var tasks: [URLSessionTask] { mutableState.tasks }
-    /// First `URLSessionTask` created on behalf of the `Request`.
-    public var firstTask: URLSessionTask? { tasks.first }
-    /// Last `URLSessionTask` crated on behalf of the `Request`.
-    public var lastTask: URLSessionTask? { tasks.last }
-    /// Current `URLSessionTask` created on behalf of the `Request`.
-    public var task: URLSessionTask? { lastTask }
-
-    // MARK: Metrics
-
-    /// All `URLSessionTaskMetrics` gathered on behalf of the `Request`. Should correspond to the `tasks` created.
-    public var allMetrics: [URLSessionTaskMetrics] { mutableState.metrics }
-    /// First `URLSessionTaskMetrics` gathered on behalf of the `Request`.
-    public var firstMetrics: URLSessionTaskMetrics? { allMetrics.first }
-    /// Last `URLSessionTaskMetrics` gathered on behalf of the `Request`.
-    public var lastMetrics: URLSessionTaskMetrics? { allMetrics.last }
-    /// Current `URLSessionTaskMetrics` gathered on behalf of the `Request`.
-    public var metrics: URLSessionTaskMetrics? { lastMetrics }
-
-    // MARK: Retry Count
-
-    /// Number of times the `Request` has been retried.
-    public var retryCount: Int { mutableState.retryCount }
-
-    // MARK: Error
-
-    /// `Error` returned from Alamofire internally, from the network request directly, or any validators executed.
-    public fileprivate(set) var error: AFError? {
-        get { mutableState.error }
-        set { mutableState.error = newValue }
-    }
-
-    /// Default initializer for the `Request` superclass.
-    ///
-    /// - Parameters:
-    ///   - id:                 `UUID` used for the `Hashable` and `Equatable` implementations. `UUID()` by default.
-    ///   - underlyingQueue:    `DispatchQueue` on which all internal `Request` work is performed.
-    ///   - serializationQueue: `DispatchQueue` on which all serialization work is performed. By default targets
-    ///                         `underlyingQueue`, but can be passed another queue from a `Session`.
-    ///   - eventMonitor:       `EventMonitor` called for event callbacks from internal `Request` actions.
-    ///   - interceptor:        `RequestInterceptor` used throughout the request lifecycle.
-    ///   - delegate:           `RequestDelegate` that provides an interface to actions not performed by the `Request`.
-    init(id: UUID = UUID(),
-         underlyingQueue: DispatchQueue,
-         serializationQueue: DispatchQueue,
-         eventMonitor: EventMonitor?,
-         interceptor: RequestInterceptor?,
-         delegate: RequestDelegate) {
-        self.id = id
-        self.underlyingQueue = underlyingQueue
-        self.serializationQueue = serializationQueue
-        self.eventMonitor = eventMonitor
-        self.interceptor = interceptor
-        self.delegate = delegate
-    }
-
-    // MARK: - Internal Event API
-
-    // All API must be called from underlyingQueue.
-
-    /// Called when an initial `URLRequest` has been created on behalf of the instance. If a `RequestAdapter` is active,
-    /// the `URLRequest` will be adapted before being issued.
-    ///
-    /// - Parameter request: The `URLRequest` created.
-    func didCreateInitialURLRequest(_ request: URLRequest) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        $mutableState.write { $0.requests.append(request) }
-
-        eventMonitor?.request(self, didCreateInitialURLRequest: request)
-    }
-
-    /// Called when initial `URLRequest` creation has failed, typically through a `URLRequestConvertible`.
-    ///
-    /// - Note: Triggers retry.
-    ///
-    /// - Parameter error: `AFError` thrown from the failed creation.
-    func didFailToCreateURLRequest(with error: AFError) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        self.error = error
-
-        eventMonitor?.request(self, didFailToCreateURLRequestWithError: error)
-
-        callCURLHandlerIfNecessary()
-
-        retryOrFinish(error: error)
-    }
-
-    /// Called when a `RequestAdapter` has successfully adapted a `URLRequest`.
-    ///
-    /// - Parameters:
-    ///   - initialRequest: The `URLRequest` that was adapted.
-    ///   - adaptedRequest: The `URLRequest` returned by the `RequestAdapter`.
-    func didAdaptInitialRequest(_ initialRequest: URLRequest, to adaptedRequest: URLRequest) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        $mutableState.write { $0.requests.append(adaptedRequest) }
-
-        eventMonitor?.request(self, didAdaptInitialRequest: initialRequest, to: adaptedRequest)
-    }
-
-    /// Called when a `RequestAdapter` fails to adapt a `URLRequest`.
-    ///
-    /// - Note: Triggers retry.
-    ///
-    /// - Parameters:
-    ///   - request: The `URLRequest` the adapter was called with.
-    ///   - error:   The `AFError` returned by the `RequestAdapter`.
-    func didFailToAdaptURLRequest(_ request: URLRequest, withError error: AFError) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        self.error = error
-
-        eventMonitor?.request(self, didFailToAdaptURLRequest: request, withError: error)
-
-        callCURLHandlerIfNecessary()
-
-        retryOrFinish(error: error)
-    }
-
-    /// Final `URLRequest` has been created for the instance.
-    ///
-    /// - Parameter request: The `URLRequest` created.
-    func didCreateURLRequest(_ request: URLRequest) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        $mutableState.read { state in
-            state.urlRequestHandler?.queue.async { state.urlRequestHandler?.handler(request) }
-        }
-
-        eventMonitor?.request(self, didCreateURLRequest: request)
-
-        callCURLHandlerIfNecessary()
-    }
-
-    /// Asynchronously calls any stored `cURLHandler` and then removes it from `mutableState`.
-    private func callCURLHandlerIfNecessary() {
-        $mutableState.write { mutableState in
-            guard let cURLHandler = mutableState.cURLHandler else { return }
-
-            cURLHandler.queue.async { cURLHandler.handler(self.cURLDescription()) }
-
-            mutableState.cURLHandler = nil
-        }
-    }
-
-    /// Called when a `URLSessionTask` is created on behalf of the instance.
-    ///
-    /// - Parameter task: The `URLSessionTask` created.
-    func didCreateTask(_ task: URLSessionTask) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        $mutableState.write { state in
-            state.tasks.append(task)
-
-            guard let urlSessionTaskHandler = state.urlSessionTaskHandler else { return }
-
-            urlSessionTaskHandler.queue.async { urlSessionTaskHandler.handler(task) }
-        }
-
-        eventMonitor?.request(self, didCreateTask: task)
-    }
-
-    /// Called when resumption is completed.
-    func didResume() {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        eventMonitor?.requestDidResume(self)
-    }
-
-    /// Called when a `URLSessionTask` is resumed on behalf of the instance.
-    ///
-    /// - Parameter task: The `URLSessionTask` resumed.
-    func didResumeTask(_ task: URLSessionTask) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        eventMonitor?.request(self, didResumeTask: task)
-    }
-
-    /// Called when suspension is completed.
-    func didSuspend() {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        eventMonitor?.requestDidSuspend(self)
-    }
-
-    /// Called when a `URLSessionTask` is suspended on behalf of the instance.
-    ///
-    /// - Parameter task: The `URLSessionTask` suspended.
-    func didSuspendTask(_ task: URLSessionTask) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        eventMonitor?.request(self, didSuspendTask: task)
-    }
-
-    /// Called when cancellation is completed, sets `error` to `AFError.explicitlyCancelled`.
-    func didCancel() {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        error = error ?? AFError.explicitlyCancelled
-
-        eventMonitor?.requestDidCancel(self)
-    }
-
-    /// Called when a `URLSessionTask` is cancelled on behalf of the instance.
-    ///
-    /// - Parameter task: The `URLSessionTask` cancelled.
-    func didCancelTask(_ task: URLSessionTask) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        eventMonitor?.request(self, didCancelTask: task)
-    }
-
-    /// Called when a `URLSessionTaskMetrics` value is gathered on behalf of the instance.
-    ///
-    /// - Parameter metrics: The `URLSessionTaskMetrics` gathered.
-    func didGatherMetrics(_ metrics: URLSessionTaskMetrics) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        $mutableState.write { $0.metrics.append(metrics) }
-
-        eventMonitor?.request(self, didGatherMetrics: metrics)
-    }
-
-    /// Called when a `URLSessionTask` fails before it is finished, typically during certificate pinning.
-    ///
-    /// - Parameters:
-    ///   - task:  The `URLSessionTask` which failed.
-    ///   - error: The early failure `AFError`.
-    func didFailTask(_ task: URLSessionTask, earlyWithError error: AFError) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        self.error = error
-
-        // Task will still complete, so didCompleteTask(_:with:) will handle retry.
-        eventMonitor?.request(self, didFailTask: task, earlyWithError: error)
-    }
-
-    /// Called when a `URLSessionTask` completes. All tasks will eventually call this method.
-    ///
-    /// - Note: Response validation is synchronously triggered in this step.
-    ///
-    /// - Parameters:
-    ///   - task:  The `URLSessionTask` which completed.
-    ///   - error: The `AFError` `task` may have completed with. If `error` has already been set on the instance, this
-    ///            value is ignored.
-    func didCompleteTask(_ task: URLSessionTask, with error: AFError?) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        self.error = self.error ?? error
-
-        validators.forEach { $0() }
-
-        eventMonitor?.request(self, didCompleteTask: task, with: error)
-
-        retryOrFinish(error: self.error)
-    }
-
-    /// Called when the `RequestDelegate` is going to retry this `Request`. Calls `reset()`.
-    func prepareForRetry() {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        $mutableState.write { $0.retryCount += 1 }
-
-        reset()
-
-        eventMonitor?.requestIsRetrying(self)
-    }
-
-    /// Called to determine whether retry will be triggered for the particular error, or whether the instance should
-    /// call `finish()`.
-    ///
-    /// - Parameter error: The possible `AFError` which may trigger retry.
-    func retryOrFinish(error: AFError?) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        guard let error = error, let delegate = delegate else { finish(); return }
-
-        delegate.retryResult(for: self, dueTo: error) { retryResult in
-            switch retryResult {
-            case .doNotRetry:
-                self.finish()
-            case let .doNotRetryWithError(retryError):
-                self.finish(error: retryError.asAFError(orFailWith: "Received retryError was not already AFError"))
-            case .retry, .retryWithDelay:
-                delegate.retryRequest(self, withDelay: retryResult.delay)
-            }
-        }
-    }
-
-    /// Finishes this `Request` and starts the response serializers.
-    ///
-    /// - Parameter error: The possible `Error` with which the instance will finish.
-    func finish(error: AFError? = nil) {
-        dispatchPrecondition(condition: .onQueue(underlyingQueue))
-
-        guard !mutableState.isFinishing else { return }
-
-        mutableState.isFinishing = true
-
-        if let error = error { self.error = error }
-
-        // Start response handlers
-        processNextResponseSerializer()
-
-        eventMonitor?.requestDidFinish(self)
-    }
-
-    /// Appends the response serialization closure to the instance.
-    ///
-    ///  - Note: This method will also `resume` the instance if `delegate.startImmediately` returns `true`.
-    ///
-    /// - Parameter closure: The closure containing the response serialization call.
-    func appendResponseSerializer(_ closure: @escaping () -> Void) {
-        $mutableState.write { mutableState in
-            mutableState.responseSerializers.append(closure)
-
-            if mutableState.state == .finished {
-                mutableState.state = .resumed
-            }
-
-            if mutableState.responseSerializerProcessingFinished {
-                underlyingQueue.async { self.processNextResponseSerializer() }
-            }
-
-            if mutableState.state.canTransitionTo(.resumed) {
-                underlyingQueue.async { if self.delegate?.startImmediately == true { self.resume() } }
-            }
-        }
-    }
-
-    /// Returns the next response serializer closure to execute if there's one left.
-    ///
-    /// - Returns: The next response serialization closure, if there is one.
-    func nextResponseSerializer() -> (() -> Void)? {
-        var responseSerializer: (() -> Void)?
-
-        $mutableState.write { mutableState in
-            let responseSerializerIndex = mutableState.responseSerializerCompletions.count
-
-            if responseSerializerIndex < mutableState.responseSerializers.count {
-                responseSerializer = mutableState.responseSerializers[responseSerializerIndex]
-            }
-        }
-
-        return responseSerializer
-    }
-
-    /// Processes the next response serializer and calls all completions if response serialization is complete.
-    func processNextResponseSerializer() {
-        guard let responseSerializer = nextResponseSerializer() else {
-            // Execute all response serializer completions and clear them
-            var completions: [() -> Void] = []
-
-            $mutableState.write { mutableState in
-                completions = mutableState.responseSerializerCompletions
-
-                // Clear out all response serializers and response serializer completions in mutable state since the
-                // request is complete. It's important to do this prior to calling the completion closures in case
-                // the completions call back into the request triggering a re-processing of the response serializers.
-                // An example of how this can happen is by calling cancel inside a response completion closure.
-                mutableState.responseSerializers.removeAll()
-                mutableState.responseSerializerCompletions.removeAll()
-
-                if mutableState.state.canTransitionTo(.finished) {
-                    mutableState.state = .finished
-                }
-
-                mutableState.responseSerializerProcessingFinished = true
-                mutableState.isFinishing = false
-            }
-
-            completions.forEach { $0() }
-
-            // Cleanup the request
-            cleanup()
-
-            return
-        }
-
-        serializationQueue.async { responseSerializer() }
-    }
-
-    /// Notifies the `Request` that the response serializer is complete.
-    ///
-    /// - Parameter completion: The completion handler provided with the response serializer, called when all serializers
-    ///                         are complete.
-    func responseSerializerDidComplete(completion: @escaping () -> Void) {
-        $mutableState.write { $0.responseSerializerCompletions.append(completion) }
-        processNextResponseSerializer()
-    }
-
-    /// Resets all task and response serializer related state for retry.
-    func reset() {
-        error = nil
-
-        uploadProgress.totalUnitCount = 0
-        uploadProgress.completedUnitCount = 0
-        downloadProgress.totalUnitCount = 0
-        downloadProgress.completedUnitCount = 0
-
-        $mutableState.write { state in
-            state.isFinishing = false
-            state.responseSerializerCompletions = []
-        }
-    }
-
-    /// Called when updating the upload progress.
-    ///
-    /// - Parameters:
-    ///   - totalBytesSent: Total bytes sent so far.
-    ///   - totalBytesExpectedToSend: Total bytes expected to send.
-    func updateUploadProgress(totalBytesSent: Int64, totalBytesExpectedToSend: Int64) {
-        uploadProgress.totalUnitCount = totalBytesExpectedToSend
-        uploadProgress.completedUnitCount = totalBytesSent
-
-        uploadProgressHandler?.queue.async { self.uploadProgressHandler?.handler(self.uploadProgress) }
-    }
-
-    /// Perform a closure on the current `state` while locked.
-    ///
-    /// - Parameter perform: The closure to perform.
-    func withState(perform: (State) -> Void) {
-        $mutableState.withState(perform: perform)
-    }
-
-    // MARK: Task Creation
-
-    /// Called when creating a `URLSessionTask` for this `Request`. Subclasses must override.
-    ///
-    /// - Parameters:
-    ///   - request: `URLRequest` to use to create the `URLSessionTask`.
-    ///   - session: `URLSession` which creates the `URLSessionTask`.
-    ///
-    /// - Returns:   The `URLSessionTask` created.
-    func task(for request: URLRequest, using session: URLSession) -> URLSessionTask {
-        fatalError("Subclasses must override.")
-    }
-
-    // MARK: - Public API
-
-    // These APIs are callable from any queue.
-
-    // MARK: State
-
-    /// Cancels the instance. Once cancelled, a `Request` can no longer be resumed or suspended.
-    ///
-    /// - Returns: The instance.
-    @discardableResult
-    public func cancel() -> Self {
-        $mutableState.write { mutableState in
-            guard mutableState.state.canTransitionTo(.cancelled) else { return }
-
-            mutableState.state = .cancelled
-
-            underlyingQueue.async { self.didCancel() }
-
-            guard let task = mutableState.tasks.last, task.state != .completed else {
-                underlyingQueue.async { self.finish() }
-                return
-            }
-
-            // Resume to ensure metrics are gathered.
-            task.resume()
-            task.cancel()
-            underlyingQueue.async { self.didCancelTask(task) }
-        }
-
-        return self
-    }
-
-    /// Suspends the instance.
-    ///
-    /// - Returns: The instance.
-    @discardableResult
-    public func suspend() -> Self {
-        $mutableState.write { mutableState in
-            guard mutableState.state.canTransitionTo(.suspended) else { return }
-
-            mutableState.state = .suspended
-
-            underlyingQueue.async { self.didSuspend() }
-
-            guard let task = mutableState.tasks.last, task.state != .completed else { return }
-
-            task.suspend()
-            underlyingQueue.async { self.didSuspendTask(task) }
-        }
-
-        return self
-    }
-
-    /// Resumes the instance.
-    ///
-    /// - Returns: The instance.
-    @discardableResult
-    public func resume() -> Self {
-        $mutableState.write { mutableState in
-            guard mutableState.state.canTransitionTo(.resumed) else { return }
-
-            mutableState.state = .resumed
-
-            underlyingQueue.async { self.didResume() }
-
-            guard let task = mutableState.tasks.last, task.state != .completed else { return }
-
-            task.resume()
-            underlyingQueue.async { self.didResumeTask(task) }
-        }
-
-        return self
-    }
-
-    // MARK: - Closure API
-
-    /// Associates a credential using the provided values with the instance.
-    ///
-    /// - Parameters:
-    ///   - username:    The username.
-    ///   - password:    The password.
-    ///   - persistence: The `URLCredential.Persistence` for the created `URLCredential`. `.forSession` by default.
-    ///
-    /// - Returns:       The instance.
-    @discardableResult
-    public func authenticate(username: String, password: String, persistence: URLCredential.Persistence = .forSession) -> Self {
-        let credential = URLCredential(user: username, password: password, persistence: persistence)
-
-        return authenticate(with: credential)
-    }
-
-    /// Associates the provided credential with the instance.
-    ///
-    /// - Parameter credential: The `URLCredential`.
-    ///
-    /// - Returns:              The instance.
-    @discardableResult
-    public func authenticate(with credential: URLCredential) -> Self {
-        mutableState.credential = credential
-
-        return self
-    }
-
-    /// Sets a closure to be called periodically during the lifecycle of the instance as data is read from the server.
-    ///
-    /// - Note: Only the last closure provided is used.
-    ///
-    /// - Parameters:
-    ///   - queue:   The `DispatchQueue` to execute the closure on. `.main` by default.
-    ///   - closure: The closure to be executed periodically as data is read from the server.
-    ///
-    /// - Returns:   The instance.
-    @discardableResult
-    public func downloadProgress(queue: DispatchQueue = .main, closure: @escaping ProgressHandler) -> Self {
-        mutableState.downloadProgressHandler = (handler: closure, queue: queue)
-
-        return self
-    }
-
-    /// Sets a closure to be called periodically during the lifecycle of the instance as data is sent to the server.
-    ///
-    /// - Note: Only the last closure provided is used.
-    ///
-    /// - Parameters:
-    ///   - queue:   The `DispatchQueue` to execute the closure on. `.main` by default.
-    ///   - closure: The closure to be executed periodically as data is sent to the server.
-    ///
-    /// - Returns:   The instance.
-    @discardableResult
-    public func uploadProgress(queue: DispatchQueue = .main, closure: @escaping ProgressHandler) -> Self {
-        mutableState.uploadProgressHandler = (handler: closure, queue: queue)
-
-        return self
-    }
-
-    // MARK: Redirects
-
-    /// Sets the redirect handler for the instance which will be used if a redirect response is encountered.
-    ///
-    /// - Note: Attempting to set the redirect handler more than once is a logic error and will crash.
-    ///
-    /// - Parameter handler: The `RedirectHandler`.
-    ///
-    /// - Returns:           The instance.
-    @discardableResult
-    public func redirect(using handler: RedirectHandler) -> Self {
-        $mutableState.write { mutableState in
-            precondition(mutableState.redirectHandler == nil, "Redirect handler has already been set.")
-            mutableState.redirectHandler = handler
-        }
-
-        return self
-    }
-
-    // MARK: Cached Responses
-
-    /// Sets the cached response handler for the `Request` which will be used when attempting to cache a response.
-    ///
-    /// - Note: Attempting to set the cache handler more than once is a logic error and will crash.
-    ///
-    /// - Parameter handler: The `CachedResponseHandler`.
-    ///
-    /// - Returns:           The instance.
-    @discardableResult
-    public func cacheResponse(using handler: CachedResponseHandler) -> Self {
-        $mutableState.write { mutableState in
-            precondition(mutableState.cachedResponseHandler == nil, "Cached response handler has already been set.")
-            mutableState.cachedResponseHandler = handler
-        }
-
-        return self
-    }
-
-    // MARK: - Lifetime APIs
-
-    /// Sets a handler to be called when the cURL description of the request is available.
-    ///
-    /// - Note: When waiting for a `Request`'s `URLRequest` to be created, only the last `handler` will be called.
-    ///
-    /// - Parameters:
-    ///   - queue:   `DispatchQueue` on which `handler` will be called.
-    ///   - handler: Closure to be called when the cURL description is available.
-    ///
-    /// - Returns:           The instance.
-    @discardableResult
-    public func cURLDescription(on queue: DispatchQueue, calling handler: @escaping (String) -> Void) -> Self {
-        $mutableState.write { mutableState in
-            if mutableState.requests.last != nil {
-                queue.async { handler(self.cURLDescription()) }
-            } else {
-                mutableState.cURLHandler = (queue, handler)
-            }
-        }
-
-        return self
-    }
-
-    /// Sets a handler to be called when the cURL description of the request is available.
-    ///
-    /// - Note: When waiting for a `Request`'s `URLRequest` to be created, only the last `handler` will be called.
-    ///
-    /// - Parameter handler: Closure to be called when the cURL description is available. Called on the instance's
-    ///                      `underlyingQueue` by default.
-    ///
-    /// - Returns:           The instance.
-    @discardableResult
-    public func cURLDescription(calling handler: @escaping (String) -> Void) -> Self {
-        $mutableState.write { mutableState in
-            if mutableState.requests.last != nil {
-                underlyingQueue.async { handler(self.cURLDescription()) }
-            } else {
-                mutableState.cURLHandler = (underlyingQueue, handler)
-            }
-        }
-
-        return self
-    }
-
-    /// Sets a closure to called whenever Alamofire creates a `URLRequest` for this instance.
-    ///
-    /// - Note: This closure will be called multiple times if the instance adapts incoming `URLRequest`s or is retried.
-    ///
-    /// - Parameters:
-    ///   - queue:   `DispatchQueue` on which `handler` will be called. `.main` by default.
-    ///   - handler: Closure to be called when a `URLRequest` is available.
-    ///
-    /// - Returns:   The instance.
-    @discardableResult
-    public func onURLRequestCreation(on queue: DispatchQueue = .main, perform handler: @escaping (URLRequest) -> Void) -> Self {
-        $mutableState.write { state in
-            if let request = state.requests.last {
-                queue.async { handler(request) }
-            }
-
-            state.urlRequestHandler = (queue, handler)
-        }
-
-        return self
-    }
-
-    /// Sets a closure to be called whenever the instance creates a `URLSessionTask`.
-    ///
-    /// - Note: This API should only be used to provide `URLSessionTask`s to existing API, like `NSFileProvider`. It
-    ///         **SHOULD NOT** be used to interact with tasks directly, as that may be break Alamofire features.
-    ///         Additionally, this closure may be called multiple times if the instance is retried.
-    ///
-    /// - Parameters:
-    ///   - queue:   `DispatchQueue` on which `handler` will be called. `.main` by default.
-    ///   - handler: Closure to be called when the `URLSessionTask` is available.
-    ///
-    /// - Returns:   The instance.
-    @discardableResult
-    public func onURLSessionTaskCreation(on queue: DispatchQueue = .main, perform handler: @escaping (URLSessionTask) -> Void) -> Self {
-        $mutableState.write { state in
-            if let task = state.tasks.last {
-                queue.async { handler(task) }
-            }
-
-            state.urlSessionTaskHandler = (queue, handler)
-        }
-
-        return self
-    }
-
-    // MARK: Cleanup
-
-    /// Final cleanup step executed when the instance finishes response serialization.
-    func cleanup() {
-        delegate?.cleanup(after: self)
-        // No-op: override in subclass
-    }
-}
-
-// MARK: - Protocol Conformances
-
-extension Request: Equatable {
-    public static func ==(lhs: Request, rhs: Request) -> Bool {
-        lhs.id == rhs.id
-    }
-}
-
-extension Request: Hashable {
-    public func hash(into hasher: inout Hasher) {
-        hasher.combine(id)
-    }
-}
-
-extension Request: CustomStringConvertible {
-    /// A textual representation of this instance, including the `HTTPMethod` and `URL` if the `URLRequest` has been
-    /// created, as well as the response status code, if a response has been received.
-    public var description: String {
-        guard let request = performedRequests.last ?? lastRequest,
-              let url = request.url,
-              let method = request.httpMethod else { return "No request created yet." }
-
-        let requestDescription = "\(method) \(url.absoluteString)"
-
-        return response.map { "\(requestDescription) (\($0.statusCode))" } ?? requestDescription
-    }
-}
-
-extension Request {
-    /// cURL representation of the instance.
-    ///
-    /// - Returns: The cURL equivalent of the instance.
-    public func cURLDescription() -> String {
-        guard
-            let request = lastRequest,
-            let url = request.url,
-            let host = url.host,
-            let method = request.httpMethod else { return "$ curl command could not be created" }
-
-        var components = ["$ curl -v"]
-
-        components.append("-X \(method)")
-
-        if let credentialStorage = delegate?.sessionConfiguration.urlCredentialStorage {
-            let protectionSpace = URLProtectionSpace(host: host,
-                                                     port: url.port ?? 0,
-                                                     protocol: url.scheme,
-                                                     realm: host,
-                                                     authenticationMethod: NSURLAuthenticationMethodHTTPBasic)
-
-            if let credentials = credentialStorage.credentials(for: protectionSpace)?.values {
-                for credential in credentials {
-                    guard let user = credential.user, let password = credential.password else { continue }
-                    components.append("-u \(user):\(password)")
-                }
-            } else {
-                if let credential = credential, let user = credential.user, let password = credential.password {
-                    components.append("-u \(user):\(password)")
-                }
-            }
-        }
-
-        if let configuration = delegate?.sessionConfiguration, configuration.httpShouldSetCookies {
-            if
-                let cookieStorage = configuration.httpCookieStorage,
-                let cookies = cookieStorage.cookies(for: url), !cookies.isEmpty {
-                let allCookies = cookies.map { "\($0.name)=\($0.value)" }.joined(separator: ";")
-
-                components.append("-b \"\(allCookies)\"")
-            }
-        }
-
-        var headers = HTTPHeaders()
-
-        if let sessionHeaders = delegate?.sessionConfiguration.headers {
-            for header in sessionHeaders where header.name != "Cookie" {
-                headers[header.name] = header.value
-            }
-        }
-
-        for header in request.headers where header.name != "Cookie" {
-            headers[header.name] = header.value
-        }
-
-        for header in headers {
-            let escapedValue = header.value.replacingOccurrences(of: "\"", with: "\\\"")
-            components.append("-H \"\(header.name): \(escapedValue)\"")
-        }
-
-        if let httpBodyData = request.httpBody {
-            let httpBody = String(decoding: httpBodyData, as: UTF8.self)
-            var escapedBody = httpBody.replacingOccurrences(of: "\\\"", with: "\\\\\"")
-            escapedBody = escapedBody.replacingOccurrences(of: "\"", with: "\\\"")
-
-            components.append("-d \"\(escapedBody)\"")
-        }
-
-        components.append("\"\(url.absoluteString)\"")
-
-        return components.joined(separator: " \\\n\t")
-    }
-}
-
-/// Protocol abstraction for `Request`'s communication back to the `SessionDelegate`.
-public protocol RequestDelegate: AnyObject {
-    /// `URLSessionConfiguration` used to create the underlying `URLSessionTask`s.
-    var sessionConfiguration: URLSessionConfiguration { get }
-
-    /// Determines whether the `Request` should automatically call `resume()` when adding the first response handler.
-    var startImmediately: Bool { get }
-
-    /// Notifies the delegate the `Request` has reached a point where it needs cleanup.
-    ///
-    /// - Parameter request: The `Request` to cleanup after.
-    func cleanup(after request: Request)
-
-    /// Asynchronously ask the delegate whether a `Request` will be retried.
-    ///
-    /// - Parameters:
-    ///   - request:    `Request` which failed.
-    ///   - error:      `Error` which produced the failure.
-    ///   - completion: Closure taking the `RetryResult` for evaluation.
-    func retryResult(for request: Request, dueTo error: AFError, completion: @escaping (RetryResult) -> Void)
-
-    /// Asynchronously retry the `Request`.
-    ///
-    /// - Parameters:
-    ///   - request:   `Request` which will be retried.
-    ///   - timeDelay: `TimeInterval` after which the retry will be triggered.
-    func retryRequest(_ request: Request, withDelay timeDelay: TimeInterval?)
-}
-
-// MARK: - Subclasses
-
-// MARK: - DataRequest
-
-/// `Request` subclass which handles in-memory `Data` download using `URLSessionDataTask`.
-public class DataRequest: Request {
-    /// `URLRequestConvertible` value used to create `URLRequest`s for this instance.
-    public let convertible: URLRequestConvertible
-    /// `Data` read from the server so far.
-    public var data: Data? { mutableData }
-
-    /// Protected storage for the `Data` read by the instance.
-    @Protected
-    private var mutableData: Data? = nil
-
-    /// Creates a `DataRequest` using the provided parameters.
-    ///
-    /// - Parameters:
-    ///   - id:                 `UUID` used for the `Hashable` and `Equatable` implementations. `UUID()` by default.
-    ///   - convertible:        `URLRequestConvertible` value used to create `URLRequest`s for this instance.
-    ///   - underlyingQueue:    `DispatchQueue` on which all internal `Request` work is performed.
-    ///   - serializationQueue: `DispatchQueue` on which all serialization work is performed. By default targets
-    ///                         `underlyingQueue`, but can be passed another queue from a `Session`.
-    ///   - eventMonitor:       `EventMonitor` called for event callbacks from internal `Request` actions.
-    ///   - interceptor:        `RequestInterceptor` used throughout the request lifecycle.
-    ///   - delegate:           `RequestDelegate` that provides an interface to actions not performed by the `Request`.
-    init(id: UUID = UUID(),
-         convertible: URLRequestConvertible,
-         underlyingQueue: DispatchQueue,
-         serializationQueue: DispatchQueue,
-         eventMonitor: EventMonitor?,
-         interceptor: RequestInterceptor?,
-         delegate: RequestDelegate) {
-        self.convertible = convertible
-
-        super.init(id: id,
-                   underlyingQueue: underlyingQueue,
-                   serializationQueue: serializationQueue,
-                   eventMonitor: eventMonitor,
-                   interceptor: interceptor,
-                   delegate: delegate)
-    }
-
-    override func reset() {
-        super.reset()
-
-        mutableData = nil
-    }
-
-    /// Called when `Data` is received by this instance.
-    ///
-    /// - Note: Also calls `updateDownloadProgress`.
-    ///
-    /// - Parameter data: The `Data` received.
-    func didReceive(data: Data) {
-        if self.data == nil {
-            mutableData = data
-        } else {
-            $mutableData.write { $0?.append(data) }
-        }
-
-        updateDownloadProgress()
-    }
-
-    override func task(for request: URLRequest, using session: URLSession) -> URLSessionTask {
-        let copiedRequest = request
-        return session.dataTask(with: copiedRequest)
-    }
-
-    /// Called to updated the `downloadProgress` of the instance.
-    func updateDownloadProgress() {
-        let totalBytesReceived = Int64(data?.count ?? 0)
-        let totalBytesExpected = task?.response?.expectedContentLength ?? NSURLSessionTransferSizeUnknown
-
-        downloadProgress.totalUnitCount = totalBytesExpected
-        downloadProgress.completedUnitCount = totalBytesReceived
-
-        downloadProgressHandler?.queue.async { self.downloadProgressHandler?.handler(self.downloadProgress) }
-    }
-
-    /// Validates the request, using the specified closure.
-    ///
-    /// - Note: If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - Parameter validation: `Validation` closure used to validate the response.
-    ///
-    /// - Returns:              The instance.
-    @discardableResult
-    public func validate(_ validation: @escaping Validation) -> Self {
-        let validator: () -> Void = { [unowned self] in
-            guard self.error == nil, let response = self.response else { return }
-
-            let result = validation(self.request, response, self.data)
-
-            if case let .failure(error) = result { self.error = error.asAFError(or: .responseValidationFailed(reason: .customValidationFailed(error: error))) }
-
-            self.eventMonitor?.request(self,
-                                       didValidateRequest: self.request,
-                                       response: response,
-                                       data: self.data,
-                                       withResult: result)
-        }
-
-        $validators.write { $0.append(validator) }
-
-        return self
-    }
-}
-
-// MARK: - DataStreamRequest
-
-/// `Request` subclass which streams HTTP response `Data` through a `Handler` closure.
-public final class DataStreamRequest: Request {
-    /// Closure type handling `DataStreamRequest.Stream` values.
-    public typealias Handler<Success, Failure: Error> = (Stream<Success, Failure>) throws -> Void
-
-    /// Type encapsulating an `Event` as it flows through the stream, as well as a `CancellationToken` which can be used
-    /// to stop the stream at any time.
-    public struct Stream<Success, Failure: Error> {
-        /// Latest `Event` from the stream.
-        public let event: Event<Success, Failure>
-        /// Token used to cancel the stream.
-        public let token: CancellationToken
-
-        /// Cancel the ongoing stream by canceling the underlying `DataStreamRequest`.
-        public func cancel() {
-            token.cancel()
-        }
-    }
-
-    /// Type representing an event flowing through the stream. Contains either the `Result` of processing streamed
-    /// `Data` or the completion of the stream.
-    public enum Event<Success, Failure: Error> {
-        /// Output produced every time the instance receives additional `Data`. The associated value contains the
-        /// `Result` of processing the incoming `Data`.
-        case stream(Result<Success, Failure>)
-        /// Output produced when the instance has completed, whether due to stream end, cancellation, or an error.
-        /// Associated `Completion` value contains the final state.
-        case complete(Completion)
-    }
-
-    /// Value containing the state of a `DataStreamRequest` when the stream was completed.
-    public struct Completion {
-        /// Last `URLRequest` issued by the instance.
-        public let request: URLRequest?
-        /// Last `HTTPURLResponse` received by the instance.
-        public let response: HTTPURLResponse?
-        /// Last `URLSessionTaskMetrics` produced for the instance.
-        public let metrics: URLSessionTaskMetrics?
-        /// `AFError` produced for the instance, if any.
-        public let error: AFError?
-    }
-
-    /// Type used to cancel an ongoing stream.
-    public struct CancellationToken {
-        weak var request: DataStreamRequest?
-
-        init(_ request: DataStreamRequest) {
-            self.request = request
-        }
-
-        /// Cancel the ongoing stream by canceling the underlying `DataStreamRequest`.
-        public func cancel() {
-            request?.cancel()
-        }
-    }
-
-    /// `URLRequestConvertible` value used to create `URLRequest`s for this instance.
-    public let convertible: URLRequestConvertible
-    /// Whether or not the instance will be cancelled if stream parsing encounters an error.
-    public let automaticallyCancelOnStreamError: Bool
-
-    /// Internal mutable state specific to this type.
-    struct StreamMutableState {
-        /// `OutputStream` bound to the `InputStream` produced by `asInputStream`, if it has been called.
-        var outputStream: OutputStream?
-        /// Stream closures called as `Data` is received.
-        var streams: [(_ data: Data) -> Void] = []
-        /// Number of currently executing streams. Used to ensure completions are only fired after all streams are
-        /// enqueued.
-        var numberOfExecutingStreams = 0
-        /// Completion calls enqueued while streams are still executing.
-        var enqueuedCompletionEvents: [() -> Void] = []
-    }
-
-    @Protected
-    var streamMutableState = StreamMutableState()
-
-    /// Creates a `DataStreamRequest` using the provided parameters.
-    ///
-    /// - Parameters:
-    ///   - id:                               `UUID` used for the `Hashable` and `Equatable` implementations. `UUID()`
-    ///                                        by default.
-    ///   - convertible:                      `URLRequestConvertible` value used to create `URLRequest`s for this
-    ///                                        instance.
-    ///   - automaticallyCancelOnStreamError: `Bool` indicating whether the instance will be cancelled when an `Error`
-    ///                                       is thrown while serializing stream `Data`.
-    ///   - underlyingQueue:                  `DispatchQueue` on which all internal `Request` work is performed.
-    ///   - serializationQueue:               `DispatchQueue` on which all serialization work is performed. By default
-    ///                                       targets
-    ///                                       `underlyingQueue`, but can be passed another queue from a `Session`.
-    ///   - eventMonitor:                     `EventMonitor` called for event callbacks from internal `Request` actions.
-    ///   - interceptor:                      `RequestInterceptor` used throughout the request lifecycle.
-    ///   - delegate:                         `RequestDelegate` that provides an interface to actions not performed by
-    ///                                       the `Request`.
-    init(id: UUID = UUID(),
-         convertible: URLRequestConvertible,
-         automaticallyCancelOnStreamError: Bool,
-         underlyingQueue: DispatchQueue,
-         serializationQueue: DispatchQueue,
-         eventMonitor: EventMonitor?,
-         interceptor: RequestInterceptor?,
-         delegate: RequestDelegate) {
-        self.convertible = convertible
-        self.automaticallyCancelOnStreamError = automaticallyCancelOnStreamError
-
-        super.init(id: id,
-                   underlyingQueue: underlyingQueue,
-                   serializationQueue: serializationQueue,
-                   eventMonitor: eventMonitor,
-                   interceptor: interceptor,
-                   delegate: delegate)
-    }
-
-    override func task(for request: URLRequest, using session: URLSession) -> URLSessionTask {
-        let copiedRequest = request
-        return session.dataTask(with: copiedRequest)
-    }
-
-    override func finish(error: AFError? = nil) {
-        $streamMutableState.write { state in
-            state.outputStream?.close()
-        }
-
-        super.finish(error: error)
-    }
-
-    func didReceive(data: Data) {
-        $streamMutableState.write { state in
-            if let stream = state.outputStream {
-                underlyingQueue.async {
-                    var bytes = Array(data)
-                    stream.write(&bytes, maxLength: bytes.count)
-                }
-            }
-            state.numberOfExecutingStreams += state.streams.count
-            let localState = state
-            underlyingQueue.async { localState.streams.forEach { $0(data) } }
-        }
-    }
-
-    /// Validates the `URLRequest` and `HTTPURLResponse` received for the instance using the provided `Validation` closure.
-    ///
-    /// - Parameter validation: `Validation` closure used to validate the request and response.
-    ///
-    /// - Returns:              The `DataStreamRequest`.
-    @discardableResult
-    public func validate(_ validation: @escaping Validation) -> Self {
-        let validator: () -> Void = { [unowned self] in
-            guard self.error == nil, let response = self.response else { return }
-
-            let result = validation(self.request, response)
-
-            if case let .failure(error) = result {
-                self.error = error.asAFError(or: .responseValidationFailed(reason: .customValidationFailed(error: error)))
-            }
-
-            self.eventMonitor?.request(self,
-                                       didValidateRequest: self.request,
-                                       response: response,
-                                       withResult: result)
-        }
-
-        $validators.write { $0.append(validator) }
-
-        return self
-    }
-
-    /// Produces an `InputStream` that receives the `Data` received by the instance.
-    ///
-    /// - Note: The `InputStream` produced by this method must have `open()` called before being able to read `Data`.
-    ///         Additionally, this method will automatically call `resume()` on the instance, regardless of whether or
-    ///         not the creating session has `startRequestsImmediately` set to `true`.
-    ///
-    /// - Parameter bufferSize: Size, in bytes, of the buffer between the `OutputStream` and `InputStream`.
-    ///
-    /// - Returns:              The `InputStream` bound to the internal `OutboundStream`.
-    public func asInputStream(bufferSize: Int = 1024) -> InputStream? {
-        defer { resume() }
-
-        var inputStream: InputStream?
-        $streamMutableState.write { state in
-            Foundation.Stream.getBoundStreams(withBufferSize: bufferSize,
-                                              inputStream: &inputStream,
-                                              outputStream: &state.outputStream)
-            state.outputStream?.open()
-        }
-
-        return inputStream
-    }
-
-    func capturingError(from closure: () throws -> Void) {
-        do {
-            try closure()
-        } catch {
-            self.error = error.asAFError(or: .responseSerializationFailed(reason: .customSerializationFailed(error: error)))
-            cancel()
-        }
-    }
-
-    func appendStreamCompletion<Success, Failure>(on queue: DispatchQueue,
-                                                  stream: @escaping Handler<Success, Failure>) {
-        appendResponseSerializer {
-            self.underlyingQueue.async {
-                self.responseSerializerDidComplete {
-                    self.$streamMutableState.write { state in
-                        guard state.numberOfExecutingStreams == 0 else {
-                            state.enqueuedCompletionEvents.append {
-                                self.enqueueCompletion(on: queue, stream: stream)
-                            }
-
-                            return
-                        }
-
-                        self.enqueueCompletion(on: queue, stream: stream)
-                    }
-                }
-            }
-        }
-    }
-
-    func enqueueCompletion<Success, Failure>(on queue: DispatchQueue,
-                                             stream: @escaping Handler<Success, Failure>) {
-        queue.async {
-            do {
-                let completion = Completion(request: self.request,
-                                            response: self.response,
-                                            metrics: self.metrics,
-                                            error: self.error)
-                try stream(.init(event: .complete(completion), token: .init(self)))
-            } catch {
-                // Ignore error, as errors on Completion can't be handled anyway.
-            }
-        }
-    }
-}
-
-extension DataStreamRequest.Stream {
-    /// Incoming `Result` values from `Event.stream`.
-    public var result: Result<Success, Failure>? {
-        guard case let .stream(result) = event else { return nil }
-
-        return result
-    }
-
-    /// `Success` value of the instance, if any.
-    public var value: Success? {
-        guard case let .success(value) = result else { return nil }
-
-        return value
-    }
-
-    /// `Failure` value of the instance, if any.
-    public var error: Failure? {
-        guard case let .failure(error) = result else { return nil }
-
-        return error
-    }
-
-    /// `Completion` value of the instance, if any.
-    public var completion: DataStreamRequest.Completion? {
-        guard case let .complete(completion) = event else { return nil }
-
-        return completion
-    }
-}
-
-// MARK: - DownloadRequest
-
-/// `Request` subclass which downloads `Data` to a file on disk using `URLSessionDownloadTask`.
-public class DownloadRequest: Request {
-    /// A set of options to be executed prior to moving a downloaded file from the temporary `URL` to the destination
-    /// `URL`.
-    public struct Options: OptionSet {
-        /// Specifies that intermediate directories for the destination URL should be created.
-        public static let createIntermediateDirectories = Options(rawValue: 1 << 0)
-        /// Specifies that any previous file at the destination `URL` should be removed.
-        public static let removePreviousFile = Options(rawValue: 1 << 1)
-
-        public let rawValue: Int
-
-        public init(rawValue: Int) {
-            self.rawValue = rawValue
-        }
-    }
-
-    // MARK: Destination
-
-    /// A closure executed once a `DownloadRequest` has successfully completed in order to determine where to move the
-    /// temporary file written to during the download process. The closure takes two arguments: the temporary file URL
-    /// and the `HTTPURLResponse`, and returns two values: the file URL where the temporary file should be moved and
-    /// the options defining how the file should be moved.
-    ///
-    /// - Note: Downloads from a local `file://` `URL`s do not use the `Destination` closure, as those downloads do not
-    ///         return an `HTTPURLResponse`. Instead the file is merely moved within the temporary directory.
-    public typealias Destination = (_ temporaryURL: URL,
-                                    _ response: HTTPURLResponse) -> (destinationURL: URL, options: Options)
-
-    /// Creates a download file destination closure which uses the default file manager to move the temporary file to a
-    /// file URL in the first available directory with the specified search path directory and search path domain mask.
-    ///
-    /// - Parameters:
-    ///   - directory: The search path directory. `.documentDirectory` by default.
-    ///   - domain:    The search path domain mask. `.userDomainMask` by default.
-    ///   - options:   `DownloadRequest.Options` used when moving the downloaded file to its destination. None by
-    ///                default.
-    /// - Returns: The `Destination` closure.
-    public class func suggestedDownloadDestination(for directory: FileManager.SearchPathDirectory = .documentDirectory,
-                                                   in domain: FileManager.SearchPathDomainMask = .userDomainMask,
-                                                   options: Options = []) -> Destination {
-        { temporaryURL, response in
-            let directoryURLs = FileManager.default.urls(for: directory, in: domain)
-            let url = directoryURLs.first?.appendingPathComponent(response.suggestedFilename!) ?? temporaryURL
-
-            return (url, options)
-        }
-    }
-
-    /// Default `Destination` used by Alamofire to ensure all downloads persist. This `Destination` prepends
-    /// `Alamofire_` to the automatically generated download name and moves it within the temporary directory. Files
-    /// with this destination must be additionally moved if they should survive the system reclamation of temporary
-    /// space.
-    static let defaultDestination: Destination = { url, _ in
-        (defaultDestinationURL(url), [])
-    }
-
-    /// Default `URL` creation closure. Creates a `URL` in the temporary directory with `Alamofire_` prepended to the
-    /// provided file name.
-    static let defaultDestinationURL: (URL) -> URL = { url in
-        let filename = "Alamofire_\(url.lastPathComponent)"
-        let destination = url.deletingLastPathComponent().appendingPathComponent(filename)
-
-        return destination
-    }
-
-    // MARK: Downloadable
-
-    /// Type describing the source used to create the underlying `URLSessionDownloadTask`.
-    public enum Downloadable {
-        /// Download should be started from the `URLRequest` produced by the associated `URLRequestConvertible` value.
-        case request(URLRequestConvertible)
-        /// Download should be started from the associated resume `Data` value.
-        case resumeData(Data)
-    }
-
-    // MARK: Mutable State
-
-    /// Type containing all mutable state for `DownloadRequest` instances.
-    private struct DownloadRequestMutableState {
-        /// Possible resume `Data` produced when cancelling the instance.
-        var resumeData: Data?
-        /// `URL` to which `Data` is being downloaded.
-        var fileURL: URL?
-    }
-
-    /// Protected mutable state specific to `DownloadRequest`.
-    @Protected
-    private var mutableDownloadState = DownloadRequestMutableState()
-
-    /// If the download is resumable and is eventually cancelled or fails, this value may be used to resume the download
-    /// using the `download(resumingWith data:)` API.
-    ///
-    /// - Note: For more information about `resumeData`, see [Apple's documentation](https://developer.apple.com/documentation/foundation/urlsessiondownloadtask/1411634-cancel).
-    public var resumeData: Data? { mutableDownloadState.resumeData ?? error?.downloadResumeData }
-    /// If the download is successful, the `URL` where the file was downloaded.
-    public var fileURL: URL? { mutableDownloadState.fileURL }
-
-    // MARK: Initial State
-
-    /// `Downloadable` value used for this instance.
-    public let downloadable: Downloadable
-    /// The `Destination` to which the downloaded file is moved.
-    let destination: Destination
-
-    /// Creates a `DownloadRequest` using the provided parameters.
-    ///
-    /// - Parameters:
-    ///   - id:                 `UUID` used for the `Hashable` and `Equatable` implementations. `UUID()` by default.
-    ///   - downloadable:       `Downloadable` value used to create `URLSessionDownloadTasks` for the instance.
-    ///   - underlyingQueue:    `DispatchQueue` on which all internal `Request` work is performed.
-    ///   - serializationQueue: `DispatchQueue` on which all serialization work is performed. By default targets
-    ///                         `underlyingQueue`, but can be passed another queue from a `Session`.
-    ///   - eventMonitor:       `EventMonitor` called for event callbacks from internal `Request` actions.
-    ///   - interceptor:        `RequestInterceptor` used throughout the request lifecycle.
-    ///   - delegate:           `RequestDelegate` that provides an interface to actions not performed by the `Request`
-    ///   - destination:        `Destination` closure used to move the downloaded file to its final location.
-    init(id: UUID = UUID(),
-         downloadable: Downloadable,
-         underlyingQueue: DispatchQueue,
-         serializationQueue: DispatchQueue,
-         eventMonitor: EventMonitor?,
-         interceptor: RequestInterceptor?,
-         delegate: RequestDelegate,
-         destination: @escaping Destination) {
-        self.downloadable = downloadable
-        self.destination = destination
-
-        super.init(id: id,
-                   underlyingQueue: underlyingQueue,
-                   serializationQueue: serializationQueue,
-                   eventMonitor: eventMonitor,
-                   interceptor: interceptor,
-                   delegate: delegate)
-    }
-
-    override func reset() {
-        super.reset()
-
-        $mutableDownloadState.write {
-            $0.resumeData = nil
-            $0.fileURL = nil
-        }
-    }
-
-    /// Called when a download has finished.
-    ///
-    /// - Parameters:
-    ///   - task:   `URLSessionTask` that finished the download.
-    ///   - result: `Result` of the automatic move to `destination`.
-    func didFinishDownloading(using task: URLSessionTask, with result: Result<URL, AFError>) {
-        eventMonitor?.request(self, didFinishDownloadingUsing: task, with: result)
-
-        switch result {
-        case let .success(url): mutableDownloadState.fileURL = url
-        case let .failure(error): self.error = error
-        }
-    }
-
-    /// Updates the `downloadProgress` using the provided values.
-    ///
-    /// - Parameters:
-    ///   - bytesWritten:              Total bytes written so far.
-    ///   - totalBytesExpectedToWrite: Total bytes expected to write.
-    func updateDownloadProgress(bytesWritten: Int64, totalBytesExpectedToWrite: Int64) {
-        downloadProgress.totalUnitCount = totalBytesExpectedToWrite
-        downloadProgress.completedUnitCount += bytesWritten
-
-        downloadProgressHandler?.queue.async { self.downloadProgressHandler?.handler(self.downloadProgress) }
-    }
-
-    override func task(for request: URLRequest, using session: URLSession) -> URLSessionTask {
-        session.downloadTask(with: request)
-    }
-
-    /// Creates a `URLSessionTask` from the provided resume data.
-    ///
-    /// - Parameters:
-    ///   - data:    `Data` used to resume the download.
-    ///   - session: `URLSession` used to create the `URLSessionTask`.
-    ///
-    /// - Returns:   The `URLSessionTask` created.
-    public func task(forResumeData data: Data, using session: URLSession) -> URLSessionTask {
-        session.downloadTask(withResumeData: data)
-    }
-
-    /// Cancels the instance. Once cancelled, a `DownloadRequest` can no longer be resumed or suspended.
-    ///
-    /// - Note: This method will NOT produce resume data. If you wish to cancel and produce resume data, use
-    ///         `cancel(producingResumeData:)` or `cancel(byProducingResumeData:)`.
-    ///
-    /// - Returns: The instance.
-    @discardableResult
-    override public func cancel() -> Self {
-        cancel(producingResumeData: false)
-    }
-
-    /// Cancels the instance, optionally producing resume data. Once cancelled, a `DownloadRequest` can no longer be
-    /// resumed or suspended.
-    ///
-    /// - Note: If `producingResumeData` is `true`, the `resumeData` property will be populated with any resume data, if
-    ///         available.
-    ///
-    /// - Returns: The instance.
-    @discardableResult
-    public func cancel(producingResumeData shouldProduceResumeData: Bool) -> Self {
-        cancel(optionallyProducingResumeData: shouldProduceResumeData ? { _ in } : nil)
-    }
-
-    /// Cancels the instance while producing resume data. Once cancelled, a `DownloadRequest` can no longer be resumed
-    /// or suspended.
-    ///
-    /// - Note: The resume data passed to the completion handler will also be available on the instance's `resumeData`
-    ///         property.
-    ///
-    /// - Parameter completionHandler: The completion handler that is called when the download has been successfully
-    ///                                cancelled. It is not guaranteed to be called on a particular queue, so you may
-    ///                                want use an appropriate queue to perform your work.
-    ///
-    /// - Returns:                     The instance.
-    @discardableResult
-    public func cancel(byProducingResumeData completionHandler: @escaping (_ data: Data?) -> Void) -> Self {
-        cancel(optionallyProducingResumeData: completionHandler)
-    }
-
-    /// Internal implementation of cancellation that optionally takes a resume data handler. If no handler is passed,
-    /// cancellation is performed without producing resume data.
-    ///
-    /// - Parameter completionHandler: Optional resume data handler.
-    ///
-    /// - Returns:                     The instance.
-    private func cancel(optionallyProducingResumeData completionHandler: ((_ resumeData: Data?) -> Void)?) -> Self {
-        $mutableState.write { mutableState in
-            guard mutableState.state.canTransitionTo(.cancelled) else { return }
-
-            mutableState.state = .cancelled
-
-            underlyingQueue.async { self.didCancel() }
-
-            guard let task = mutableState.tasks.last as? URLSessionDownloadTask, task.state != .completed else {
-                underlyingQueue.async { self.finish() }
-                return
-            }
-
-            if let completionHandler = completionHandler {
-                // Resume to ensure metrics are gathered.
-                task.resume()
-                task.cancel { resumeData in
-                    self.mutableDownloadState.resumeData = resumeData
-                    self.underlyingQueue.async { self.didCancelTask(task) }
-                    completionHandler(resumeData)
-                }
-            } else {
-                // Resume to ensure metrics are gathered.
-                task.resume()
-                task.cancel(byProducingResumeData: { _ in })
-                self.underlyingQueue.async { self.didCancelTask(task) }
-            }
-        }
-
-        return self
-    }
-
-    /// Validates the request, using the specified closure.
-    ///
-    /// - Note: If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - Parameter validation: `Validation` closure to validate the response.
-    ///
-    /// - Returns:              The instance.
-    @discardableResult
-    public func validate(_ validation: @escaping Validation) -> Self {
-        let validator: () -> Void = { [unowned self] in
-            guard self.error == nil, let response = self.response else { return }
-
-            let result = validation(self.request, response, self.fileURL)
-
-            if case let .failure(error) = result {
-                self.error = error.asAFError(or: .responseValidationFailed(reason: .customValidationFailed(error: error)))
-            }
-
-            self.eventMonitor?.request(self,
-                                       didValidateRequest: self.request,
-                                       response: response,
-                                       fileURL: self.fileURL,
-                                       withResult: result)
-        }
-
-        $validators.write { $0.append(validator) }
-
-        return self
-    }
-}
-
-// MARK: - UploadRequest
-
-/// `DataRequest` subclass which handles `Data` upload from memory, file, or stream using `URLSessionUploadTask`.
-public class UploadRequest: DataRequest {
-    /// Type describing the origin of the upload, whether `Data`, file, or stream.
-    public enum Uploadable {
-        /// Upload from the provided `Data` value.
-        case data(Data)
-        /// Upload from the provided file `URL`, as well as a `Bool` determining whether the source file should be
-        /// automatically removed once uploaded.
-        case file(URL, shouldRemove: Bool)
-        /// Upload from the provided `InputStream`.
-        case stream(InputStream)
-    }
-
-    // MARK: Initial State
-
-    /// The `UploadableConvertible` value used to produce the `Uploadable` value for this instance.
-    public let upload: UploadableConvertible
-
-    /// `FileManager` used to perform cleanup tasks, including the removal of multipart form encoded payloads written
-    /// to disk.
-    public let fileManager: FileManager
-
-    // MARK: Mutable State
-
-    /// `Uploadable` value used by the instance.
-    public var uploadable: Uploadable?
-
-    /// Creates an `UploadRequest` using the provided parameters.
-    ///
-    /// - Parameters:
-    ///   - id:                 `UUID` used for the `Hashable` and `Equatable` implementations. `UUID()` by default.
-    ///   - convertible:        `UploadConvertible` value used to determine the type of upload to be performed.
-    ///   - underlyingQueue:    `DispatchQueue` on which all internal `Request` work is performed.
-    ///   - serializationQueue: `DispatchQueue` on which all serialization work is performed. By default targets
-    ///                         `underlyingQueue`, but can be passed another queue from a `Session`.
-    ///   - eventMonitor:       `EventMonitor` called for event callbacks from internal `Request` actions.
-    ///   - interceptor:        `RequestInterceptor` used throughout the request lifecycle.
-    ///   - delegate:           `RequestDelegate` that provides an interface to actions not performed by the `Request`.
-    init(id: UUID = UUID(),
-         convertible: UploadConvertible,
-         underlyingQueue: DispatchQueue,
-         serializationQueue: DispatchQueue,
-         eventMonitor: EventMonitor?,
-         interceptor: RequestInterceptor?,
-         fileManager: FileManager,
-         delegate: RequestDelegate) {
-        upload = convertible
-        self.fileManager = fileManager
-
-        super.init(id: id,
-                   convertible: convertible,
-                   underlyingQueue: underlyingQueue,
-                   serializationQueue: serializationQueue,
-                   eventMonitor: eventMonitor,
-                   interceptor: interceptor,
-                   delegate: delegate)
-    }
-
-    /// Called when the `Uploadable` value has been created from the `UploadConvertible`.
-    ///
-    /// - Parameter uploadable: The `Uploadable` that was created.
-    func didCreateUploadable(_ uploadable: Uploadable) {
-        self.uploadable = uploadable
-
-        eventMonitor?.request(self, didCreateUploadable: uploadable)
-    }
-
-    /// Called when the `Uploadable` value could not be created.
-    ///
-    /// - Parameter error: `AFError` produced by the failure.
-    func didFailToCreateUploadable(with error: AFError) {
-        self.error = error
-
-        eventMonitor?.request(self, didFailToCreateUploadableWithError: error)
-
-        retryOrFinish(error: error)
-    }
-
-    override func task(for request: URLRequest, using session: URLSession) -> URLSessionTask {
-        guard let uploadable = uploadable else {
-            fatalError("Attempting to create a URLSessionUploadTask when Uploadable value doesn't exist.")
-        }
-
-        switch uploadable {
-        case let .data(data): return session.uploadTask(with: request, from: data)
-        case let .file(url, _): return session.uploadTask(with: request, fromFile: url)
-        case .stream: return session.uploadTask(withStreamedRequest: request)
-        }
-    }
-
-    override func reset() {
-        // Uploadable must be recreated on every retry.
-        uploadable = nil
-
-        super.reset()
-    }
-
-    /// Produces the `InputStream` from `uploadable`, if it can.
-    ///
-    /// - Note: Calling this method with a non-`.stream` `Uploadable` is a logic error and will crash.
-    ///
-    /// - Returns: The `InputStream`.
-    func inputStream() -> InputStream {
-        guard let uploadable = uploadable else {
-            fatalError("Attempting to access the input stream but the uploadable doesn't exist.")
-        }
-
-        guard case let .stream(stream) = uploadable else {
-            fatalError("Attempted to access the stream of an UploadRequest that wasn't created with one.")
-        }
-
-        eventMonitor?.request(self, didProvideInputStream: stream)
-
-        return stream
-    }
-
-    override public func cleanup() {
-        defer { super.cleanup() }
-
-        guard
-            let uploadable = self.uploadable,
-            case let .file(url, shouldRemove) = uploadable,
-            shouldRemove
-        else { return }
-
-        try? fileManager.removeItem(at: url)
-    }
-}
-
-/// A type that can produce an `UploadRequest.Uploadable` value.
-public protocol UploadableConvertible {
-    /// Produces an `UploadRequest.Uploadable` value from the instance.
-    ///
-    /// - Returns: The `UploadRequest.Uploadable`.
-    /// - Throws:  Any `Error` produced during creation.
-    func createUploadable() throws -> UploadRequest.Uploadable
-}
-
-extension UploadRequest.Uploadable: UploadableConvertible {
-    public func createUploadable() throws -> UploadRequest.Uploadable {
-        self
-    }
-}
-
-/// A type that can be converted to an upload, whether from an `UploadRequest.Uploadable` or `URLRequestConvertible`.
-public protocol UploadConvertible: UploadableConvertible & URLRequestConvertible {}
diff --git a/Pods/Alamofire/Source/RequestInterceptor.swift b/Pods/Alamofire/Source/RequestInterceptor.swift
deleted file mode 100644
index 1912e9c16..000000000
--- a/Pods/Alamofire/Source/RequestInterceptor.swift
+++ /dev/null
@@ -1,244 +0,0 @@
-//
-//  RequestInterceptor.swift
-//
-//  Copyright (c) 2019 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// A type that can inspect and optionally adapt a `URLRequest` in some manner if necessary.
-public protocol RequestAdapter {
-    /// Inspects and adapts the specified `URLRequest` in some manner and calls the completion handler with the Result.
-    ///
-    /// - Parameters:
-    ///   - urlRequest: The `URLRequest` to adapt.
-    ///   - session:    The `Session` that will execute the `URLRequest`.
-    ///   - completion: The completion handler that must be called when adaptation is complete.
-    func adapt(_ urlRequest: URLRequest, for session: Session, completion: @escaping (Result<URLRequest, Error>) -> Void)
-}
-
-// MARK: -
-
-/// Outcome of determination whether retry is necessary.
-public enum RetryResult {
-    /// Retry should be attempted immediately.
-    case retry
-    /// Retry should be attempted after the associated `TimeInterval`.
-    case retryWithDelay(TimeInterval)
-    /// Do not retry.
-    case doNotRetry
-    /// Do not retry due to the associated `Error`.
-    case doNotRetryWithError(Error)
-}
-
-extension RetryResult {
-    var retryRequired: Bool {
-        switch self {
-        case .retry, .retryWithDelay: return true
-        default: return false
-        }
-    }
-
-    var delay: TimeInterval? {
-        switch self {
-        case let .retryWithDelay(delay): return delay
-        default: return nil
-        }
-    }
-
-    var error: Error? {
-        guard case let .doNotRetryWithError(error) = self else { return nil }
-        return error
-    }
-}
-
-/// A type that determines whether a request should be retried after being executed by the specified session manager
-/// and encountering an error.
-public protocol RequestRetrier {
-    /// Determines whether the `Request` should be retried by calling the `completion` closure.
-    ///
-    /// This operation is fully asynchronous. Any amount of time can be taken to determine whether the request needs
-    /// to be retried. The one requirement is that the completion closure is called to ensure the request is properly
-    /// cleaned up after.
-    ///
-    /// - Parameters:
-    ///   - request:    `Request` that failed due to the provided `Error`.
-    ///   - session:    `Session` that produced the `Request`.
-    ///   - error:      `Error` encountered while executing the `Request`.
-    ///   - completion: Completion closure to be executed when a retry decision has been determined.
-    func retry(_ request: Request, for session: Session, dueTo error: Error, completion: @escaping (RetryResult) -> Void)
-}
-
-// MARK: -
-
-/// Type that provides both `RequestAdapter` and `RequestRetrier` functionality.
-public protocol RequestInterceptor: RequestAdapter, RequestRetrier {}
-
-extension RequestInterceptor {
-    public func adapt(_ urlRequest: URLRequest, for session: Session, completion: @escaping (Result<URLRequest, Error>) -> Void) {
-        completion(.success(urlRequest))
-    }
-
-    public func retry(_ request: Request,
-                      for session: Session,
-                      dueTo error: Error,
-                      completion: @escaping (RetryResult) -> Void) {
-        completion(.doNotRetry)
-    }
-}
-
-/// `RequestAdapter` closure definition.
-public typealias AdaptHandler = (URLRequest, Session, _ completion: @escaping (Result<URLRequest, Error>) -> Void) -> Void
-/// `RequestRetrier` closure definition.
-public typealias RetryHandler = (Request, Session, Error, _ completion: @escaping (RetryResult) -> Void) -> Void
-
-// MARK: -
-
-/// Closure-based `RequestAdapter`.
-open class Adapter: RequestInterceptor {
-    private let adaptHandler: AdaptHandler
-
-    /// Creates an instance using the provided closure.
-    ///
-    /// - Parameter adaptHandler: `AdaptHandler` closure to be executed when handling request adaptation.
-    public init(_ adaptHandler: @escaping AdaptHandler) {
-        self.adaptHandler = adaptHandler
-    }
-
-    open func adapt(_ urlRequest: URLRequest, for session: Session, completion: @escaping (Result<URLRequest, Error>) -> Void) {
-        adaptHandler(urlRequest, session, completion)
-    }
-}
-
-// MARK: -
-
-/// Closure-based `RequestRetrier`.
-open class Retrier: RequestInterceptor {
-    private let retryHandler: RetryHandler
-
-    /// Creates an instance using the provided closure.
-    ///
-    /// - Parameter retryHandler: `RetryHandler` closure to be executed when handling request retry.
-    public init(_ retryHandler: @escaping RetryHandler) {
-        self.retryHandler = retryHandler
-    }
-
-    open func retry(_ request: Request,
-                    for session: Session,
-                    dueTo error: Error,
-                    completion: @escaping (RetryResult) -> Void) {
-        retryHandler(request, session, error, completion)
-    }
-}
-
-// MARK: -
-
-/// `RequestInterceptor` which can use multiple `RequestAdapter` and `RequestRetrier` values.
-open class Interceptor: RequestInterceptor {
-    /// All `RequestAdapter`s associated with the instance. These adapters will be run until one fails.
-    public let adapters: [RequestAdapter]
-    /// All `RequestRetrier`s associated with the instance. These retriers will be run one at a time until one triggers retry.
-    public let retriers: [RequestRetrier]
-
-    /// Creates an instance from `AdaptHandler` and `RetryHandler` closures.
-    ///
-    /// - Parameters:
-    ///   - adaptHandler: `AdaptHandler` closure to be used.
-    ///   - retryHandler: `RetryHandler` closure to be used.
-    public init(adaptHandler: @escaping AdaptHandler, retryHandler: @escaping RetryHandler) {
-        adapters = [Adapter(adaptHandler)]
-        retriers = [Retrier(retryHandler)]
-    }
-
-    /// Creates an instance from `RequestAdapter` and `RequestRetrier` values.
-    ///
-    /// - Parameters:
-    ///   - adapter: `RequestAdapter` value to be used.
-    ///   - retrier: `RequestRetrier` value to be used.
-    public init(adapter: RequestAdapter, retrier: RequestRetrier) {
-        adapters = [adapter]
-        retriers = [retrier]
-    }
-
-    /// Creates an instance from the arrays of `RequestAdapter` and `RequestRetrier` values.
-    ///
-    /// - Parameters:
-    ///   - adapters:     `RequestAdapter` values to be used.
-    ///   - retriers:     `RequestRetrier` values to be used.
-    ///   - interceptors: `RequestInterceptor`s to be used.
-    public init(adapters: [RequestAdapter] = [], retriers: [RequestRetrier] = [], interceptors: [RequestInterceptor] = []) {
-        self.adapters = adapters + interceptors
-        self.retriers = retriers + interceptors
-    }
-
-    open func adapt(_ urlRequest: URLRequest, for session: Session, completion: @escaping (Result<URLRequest, Error>) -> Void) {
-        adapt(urlRequest, for: session, using: adapters, completion: completion)
-    }
-
-    private func adapt(_ urlRequest: URLRequest,
-                       for session: Session,
-                       using adapters: [RequestAdapter],
-                       completion: @escaping (Result<URLRequest, Error>) -> Void) {
-        var pendingAdapters = adapters
-
-        guard !pendingAdapters.isEmpty else { completion(.success(urlRequest)); return }
-
-        let adapter = pendingAdapters.removeFirst()
-
-        adapter.adapt(urlRequest, for: session) { result in
-            switch result {
-            case let .success(urlRequest):
-                self.adapt(urlRequest, for: session, using: pendingAdapters, completion: completion)
-            case .failure:
-                completion(result)
-            }
-        }
-    }
-
-    open func retry(_ request: Request,
-                    for session: Session,
-                    dueTo error: Error,
-                    completion: @escaping (RetryResult) -> Void) {
-        retry(request, for: session, dueTo: error, using: retriers, completion: completion)
-    }
-
-    private func retry(_ request: Request,
-                       for session: Session,
-                       dueTo error: Error,
-                       using retriers: [RequestRetrier],
-                       completion: @escaping (RetryResult) -> Void) {
-        var pendingRetriers = retriers
-
-        guard !pendingRetriers.isEmpty else { completion(.doNotRetry); return }
-
-        let retrier = pendingRetriers.removeFirst()
-
-        retrier.retry(request, for: session, dueTo: error) { result in
-            switch result {
-            case .retry, .retryWithDelay, .doNotRetryWithError:
-                completion(result)
-            case .doNotRetry:
-                // Only continue to the next retrier if retry was not triggered and no error was encountered
-                self.retry(request, for: session, dueTo: error, using: pendingRetriers, completion: completion)
-            }
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/RequestTaskMap.swift b/Pods/Alamofire/Source/RequestTaskMap.swift
deleted file mode 100644
index 85b58f377..000000000
--- a/Pods/Alamofire/Source/RequestTaskMap.swift
+++ /dev/null
@@ -1,149 +0,0 @@
-//
-//  RequestTaskMap.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// A type that maintains a two way, one to one map of `URLSessionTask`s to `Request`s.
-struct RequestTaskMap {
-    private typealias Events = (completed: Bool, metricsGathered: Bool)
-
-    private var tasksToRequests: [URLSessionTask: Request]
-    private var requestsToTasks: [Request: URLSessionTask]
-    private var taskEvents: [URLSessionTask: Events]
-
-    var requests: [Request] {
-        Array(tasksToRequests.values)
-    }
-
-    init(tasksToRequests: [URLSessionTask: Request] = [:],
-         requestsToTasks: [Request: URLSessionTask] = [:],
-         taskEvents: [URLSessionTask: (completed: Bool, metricsGathered: Bool)] = [:]) {
-        self.tasksToRequests = tasksToRequests
-        self.requestsToTasks = requestsToTasks
-        self.taskEvents = taskEvents
-    }
-
-    subscript(_ request: Request) -> URLSessionTask? {
-        get { requestsToTasks[request] }
-        set {
-            guard let newValue = newValue else {
-                guard let task = requestsToTasks[request] else {
-                    fatalError("RequestTaskMap consistency error: no task corresponding to request found.")
-                }
-
-                requestsToTasks.removeValue(forKey: request)
-                tasksToRequests.removeValue(forKey: task)
-                taskEvents.removeValue(forKey: task)
-
-                return
-            }
-
-            requestsToTasks[request] = newValue
-            tasksToRequests[newValue] = request
-            taskEvents[newValue] = (completed: false, metricsGathered: false)
-        }
-    }
-
-    subscript(_ task: URLSessionTask) -> Request? {
-        get { tasksToRequests[task] }
-        set {
-            guard let newValue = newValue else {
-                guard let request = tasksToRequests[task] else {
-                    fatalError("RequestTaskMap consistency error: no request corresponding to task found.")
-                }
-
-                tasksToRequests.removeValue(forKey: task)
-                requestsToTasks.removeValue(forKey: request)
-                taskEvents.removeValue(forKey: task)
-
-                return
-            }
-
-            tasksToRequests[task] = newValue
-            requestsToTasks[newValue] = task
-            taskEvents[task] = (completed: false, metricsGathered: false)
-        }
-    }
-
-    var count: Int {
-        precondition(tasksToRequests.count == requestsToTasks.count,
-                     "RequestTaskMap.count invalid, requests.count: \(tasksToRequests.count) != tasks.count: \(requestsToTasks.count)")
-
-        return tasksToRequests.count
-    }
-
-    var eventCount: Int {
-        precondition(taskEvents.count == count, "RequestTaskMap.eventCount invalid, count: \(count) != taskEvents.count: \(taskEvents.count)")
-
-        return taskEvents.count
-    }
-
-    var isEmpty: Bool {
-        precondition(tasksToRequests.isEmpty == requestsToTasks.isEmpty,
-                     "RequestTaskMap.isEmpty invalid, requests.isEmpty: \(tasksToRequests.isEmpty) != tasks.isEmpty: \(requestsToTasks.isEmpty)")
-
-        return tasksToRequests.isEmpty
-    }
-
-    var isEventsEmpty: Bool {
-        precondition(taskEvents.isEmpty == isEmpty, "RequestTaskMap.isEventsEmpty invalid, isEmpty: \(isEmpty) != taskEvents.isEmpty: \(taskEvents.isEmpty)")
-
-        return taskEvents.isEmpty
-    }
-
-    mutating func disassociateIfNecessaryAfterGatheringMetricsForTask(_ task: URLSessionTask) -> Bool {
-        guard let events = taskEvents[task] else {
-            fatalError("RequestTaskMap consistency error: no events corresponding to task found.")
-        }
-
-        switch (events.completed, events.metricsGathered) {
-        case (_, true): fatalError("RequestTaskMap consistency error: duplicate metricsGatheredForTask call.")
-        case (false, false): taskEvents[task] = (completed: false, metricsGathered: true); return false
-        case (true, false): self[task] = nil; return true
-        }
-    }
-
-    mutating func disassociateIfNecessaryAfterCompletingTask(_ task: URLSessionTask) -> Bool {
-        guard let events = taskEvents[task] else {
-            fatalError("RequestTaskMap consistency error: no events corresponding to task found.")
-        }
-
-        switch (events.completed, events.metricsGathered) {
-        case (true, _): fatalError("RequestTaskMap consistency error: duplicate completionReceivedForTask call.")
-        #if os(Linux) // Linux doesn't gather metrics, so unconditionally remove the reference and return true.
-        default: self[task] = nil; return true
-        #else
-        case (false, false):
-            if #available(macOS 10.12, iOS 10, watchOS 7, tvOS 10, *) {
-                taskEvents[task] = (completed: true, metricsGathered: false); return false
-            } else {
-                // watchOS < 7 doesn't gather metrics, so unconditionally remove the reference and return true.
-                self[task] = nil; return true
-            }
-        case (false, true):
-            self[task] = nil; return true
-        #endif
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/Response.swift b/Pods/Alamofire/Source/Response.swift
deleted file mode 100644
index 92e9c44eb..000000000
--- a/Pods/Alamofire/Source/Response.swift
+++ /dev/null
@@ -1,454 +0,0 @@
-//
-//  Response.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// Default type of `DataResponse` returned by Alamofire, with an `AFError` `Failure` type.
-public typealias AFDataResponse<Success> = DataResponse<Success, AFError>
-/// Default type of `DownloadResponse` returned by Alamofire, with an `AFError` `Failure` type.
-public typealias AFDownloadResponse<Success> = DownloadResponse<Success, AFError>
-
-/// Type used to store all values associated with a serialized response of a `DataRequest` or `UploadRequest`.
-public struct DataResponse<Success, Failure: Error> {
-    /// The URL request sent to the server.
-    public let request: URLRequest?
-
-    /// The server's response to the URL request.
-    public let response: HTTPURLResponse?
-
-    /// The data returned by the server.
-    public let data: Data?
-
-    /// The final metrics of the response.
-    ///
-    /// - Note: Due to `FB7624529`, collection of `URLSessionTaskMetrics` on watchOS is currently disabled.`
-    ///
-    public let metrics: URLSessionTaskMetrics?
-
-    /// The time taken to serialize the response.
-    public let serializationDuration: TimeInterval
-
-    /// The result of response serialization.
-    public let result: Result<Success, Failure>
-
-    /// Returns the associated value of the result if it is a success, `nil` otherwise.
-    public var value: Success? { result.success }
-
-    /// Returns the associated error value if the result if it is a failure, `nil` otherwise.
-    public var error: Failure? { result.failure }
-
-    /// Creates a `DataResponse` instance with the specified parameters derived from the response serialization.
-    ///
-    /// - Parameters:
-    ///   - request:               The `URLRequest` sent to the server.
-    ///   - response:              The `HTTPURLResponse` from the server.
-    ///   - data:                  The `Data` returned by the server.
-    ///   - metrics:               The `URLSessionTaskMetrics` of the `DataRequest` or `UploadRequest`.
-    ///   - serializationDuration: The duration taken by serialization.
-    ///   - result:                The `Result` of response serialization.
-    public init(request: URLRequest?,
-                response: HTTPURLResponse?,
-                data: Data?,
-                metrics: URLSessionTaskMetrics?,
-                serializationDuration: TimeInterval,
-                result: Result<Success, Failure>) {
-        self.request = request
-        self.response = response
-        self.data = data
-        self.metrics = metrics
-        self.serializationDuration = serializationDuration
-        self.result = result
-    }
-}
-
-// MARK: -
-
-extension DataResponse: CustomStringConvertible, CustomDebugStringConvertible {
-    /// The textual representation used when written to an output stream, which includes whether the result was a
-    /// success or failure.
-    public var description: String {
-        "\(result)"
-    }
-
-    /// The debug textual representation used when written to an output stream, which includes (if available) a summary
-    /// of the `URLRequest`, the request's headers and body (if decodable as a `String` below 100KB); the
-    /// `HTTPURLResponse`'s status code, headers, and body; the duration of the network and serialization actions; and
-    /// the `Result` of serialization.
-    public var debugDescription: String {
-        guard let urlRequest = request else { return "[Request]: None\n[Result]: \(result)" }
-
-        let requestDescription = DebugDescription.description(of: urlRequest)
-
-        let responseDescription = response.map { response in
-            let responseBodyDescription = DebugDescription.description(for: data, headers: response.headers)
-
-            return """
-            \(DebugDescription.description(of: response))
-                \(responseBodyDescription.indentingNewlines())
-            """
-        } ?? "[Response]: None"
-
-        let networkDuration = metrics.map { "\($0.taskInterval.duration)s" } ?? "None"
-
-        return """
-        \(requestDescription)
-        \(responseDescription)
-        [Network Duration]: \(networkDuration)
-        [Serialization Duration]: \(serializationDuration)s
-        [Result]: \(result)
-        """
-    }
-}
-
-// MARK: -
-
-extension DataResponse {
-    /// Evaluates the specified closure when the result of this `DataResponse` is a success, passing the unwrapped
-    /// result value as a parameter.
-    ///
-    /// Use the `map` method with a closure that does not throw. For example:
-    ///
-    ///     let possibleData: DataResponse<Data> = ...
-    ///     let possibleInt = possibleData.map { $0.count }
-    ///
-    /// - parameter transform: A closure that takes the success value of the instance's result.
-    ///
-    /// - returns: A `DataResponse` whose result wraps the value returned by the given closure. If this instance's
-    ///            result is a failure, returns a response wrapping the same failure.
-    public func map<NewSuccess>(_ transform: (Success) -> NewSuccess) -> DataResponse<NewSuccess, Failure> {
-        DataResponse<NewSuccess, Failure>(request: request,
-                                          response: response,
-                                          data: data,
-                                          metrics: metrics,
-                                          serializationDuration: serializationDuration,
-                                          result: result.map(transform))
-    }
-
-    /// Evaluates the given closure when the result of this `DataResponse` is a success, passing the unwrapped result
-    /// value as a parameter.
-    ///
-    /// Use the `tryMap` method with a closure that may throw an error. For example:
-    ///
-    ///     let possibleData: DataResponse<Data> = ...
-    ///     let possibleObject = possibleData.tryMap {
-    ///         try JSONSerialization.jsonObject(with: $0)
-    ///     }
-    ///
-    /// - parameter transform: A closure that takes the success value of the instance's result.
-    ///
-    /// - returns: A success or failure `DataResponse` depending on the result of the given closure. If this instance's
-    ///            result is a failure, returns the same failure.
-    public func tryMap<NewSuccess>(_ transform: (Success) throws -> NewSuccess) -> DataResponse<NewSuccess, Error> {
-        DataResponse<NewSuccess, Error>(request: request,
-                                        response: response,
-                                        data: data,
-                                        metrics: metrics,
-                                        serializationDuration: serializationDuration,
-                                        result: result.tryMap(transform))
-    }
-
-    /// Evaluates the specified closure when the `DataResponse` is a failure, passing the unwrapped error as a parameter.
-    ///
-    /// Use the `mapError` function with a closure that does not throw. For example:
-    ///
-    ///     let possibleData: DataResponse<Data> = ...
-    ///     let withMyError = possibleData.mapError { MyError.error($0) }
-    ///
-    /// - Parameter transform: A closure that takes the error of the instance.
-    ///
-    /// - Returns: A `DataResponse` instance containing the result of the transform.
-    public func mapError<NewFailure: Error>(_ transform: (Failure) -> NewFailure) -> DataResponse<Success, NewFailure> {
-        DataResponse<Success, NewFailure>(request: request,
-                                          response: response,
-                                          data: data,
-                                          metrics: metrics,
-                                          serializationDuration: serializationDuration,
-                                          result: result.mapError(transform))
-    }
-
-    /// Evaluates the specified closure when the `DataResponse` is a failure, passing the unwrapped error as a parameter.
-    ///
-    /// Use the `tryMapError` function with a closure that may throw an error. For example:
-    ///
-    ///     let possibleData: DataResponse<Data> = ...
-    ///     let possibleObject = possibleData.tryMapError {
-    ///         try someFailableFunction(taking: $0)
-    ///     }
-    ///
-    /// - Parameter transform: A throwing closure that takes the error of the instance.
-    ///
-    /// - Returns: A `DataResponse` instance containing the result of the transform.
-    public func tryMapError<NewFailure: Error>(_ transform: (Failure) throws -> NewFailure) -> DataResponse<Success, Error> {
-        DataResponse<Success, Error>(request: request,
-                                     response: response,
-                                     data: data,
-                                     metrics: metrics,
-                                     serializationDuration: serializationDuration,
-                                     result: result.tryMapError(transform))
-    }
-}
-
-// MARK: -
-
-/// Used to store all data associated with a serialized response of a download request.
-public struct DownloadResponse<Success, Failure: Error> {
-    /// The URL request sent to the server.
-    public let request: URLRequest?
-
-    /// The server's response to the URL request.
-    public let response: HTTPURLResponse?
-
-    /// The final destination URL of the data returned from the server after it is moved.
-    public let fileURL: URL?
-
-    /// The resume data generated if the request was cancelled.
-    public let resumeData: Data?
-
-    /// The final metrics of the response.
-    ///
-    /// - Note: Due to `FB7624529`, collection of `URLSessionTaskMetrics` on watchOS is currently disabled.`
-    ///
-    public let metrics: URLSessionTaskMetrics?
-
-    /// The time taken to serialize the response.
-    public let serializationDuration: TimeInterval
-
-    /// The result of response serialization.
-    public let result: Result<Success, Failure>
-
-    /// Returns the associated value of the result if it is a success, `nil` otherwise.
-    public var value: Success? { result.success }
-
-    /// Returns the associated error value if the result if it is a failure, `nil` otherwise.
-    public var error: Failure? { result.failure }
-
-    /// Creates a `DownloadResponse` instance with the specified parameters derived from response serialization.
-    ///
-    /// - Parameters:
-    ///   - request:               The `URLRequest` sent to the server.
-    ///   - response:              The `HTTPURLResponse` from the server.
-    ///   - temporaryURL:          The temporary destination `URL` of the data returned from the server.
-    ///   - destinationURL:        The final destination `URL` of the data returned from the server, if it was moved.
-    ///   - resumeData:            The resume `Data` generated if the request was cancelled.
-    ///   - metrics:               The `URLSessionTaskMetrics` of the `DownloadRequest`.
-    ///   - serializationDuration: The duration taken by serialization.
-    ///   - result:                The `Result` of response serialization.
-    public init(request: URLRequest?,
-                response: HTTPURLResponse?,
-                fileURL: URL?,
-                resumeData: Data?,
-                metrics: URLSessionTaskMetrics?,
-                serializationDuration: TimeInterval,
-                result: Result<Success, Failure>) {
-        self.request = request
-        self.response = response
-        self.fileURL = fileURL
-        self.resumeData = resumeData
-        self.metrics = metrics
-        self.serializationDuration = serializationDuration
-        self.result = result
-    }
-}
-
-// MARK: -
-
-extension DownloadResponse: CustomStringConvertible, CustomDebugStringConvertible {
-    /// The textual representation used when written to an output stream, which includes whether the result was a
-    /// success or failure.
-    public var description: String {
-        "\(result)"
-    }
-
-    /// The debug textual representation used when written to an output stream, which includes the URL request, the URL
-    /// response, the temporary and destination URLs, the resume data, the durations of the network and serialization
-    /// actions, and the response serialization result.
-    public var debugDescription: String {
-        guard let urlRequest = request else { return "[Request]: None\n[Result]: \(result)" }
-
-        let requestDescription = DebugDescription.description(of: urlRequest)
-        let responseDescription = response.map(DebugDescription.description(of:)) ?? "[Response]: None"
-        let networkDuration = metrics.map { "\($0.taskInterval.duration)s" } ?? "None"
-        let resumeDataDescription = resumeData.map { "\($0)" } ?? "None"
-
-        return """
-        \(requestDescription)
-        \(responseDescription)
-        [File URL]: \(fileURL?.path ?? "None")
-        [Resume Data]: \(resumeDataDescription)
-        [Network Duration]: \(networkDuration)
-        [Serialization Duration]: \(serializationDuration)s
-        [Result]: \(result)
-        """
-    }
-}
-
-// MARK: -
-
-extension DownloadResponse {
-    /// Evaluates the given closure when the result of this `DownloadResponse` is a success, passing the unwrapped
-    /// result value as a parameter.
-    ///
-    /// Use the `map` method with a closure that does not throw. For example:
-    ///
-    ///     let possibleData: DownloadResponse<Data> = ...
-    ///     let possibleInt = possibleData.map { $0.count }
-    ///
-    /// - parameter transform: A closure that takes the success value of the instance's result.
-    ///
-    /// - returns: A `DownloadResponse` whose result wraps the value returned by the given closure. If this instance's
-    ///            result is a failure, returns a response wrapping the same failure.
-    public func map<NewSuccess>(_ transform: (Success) -> NewSuccess) -> DownloadResponse<NewSuccess, Failure> {
-        DownloadResponse<NewSuccess, Failure>(request: request,
-                                              response: response,
-                                              fileURL: fileURL,
-                                              resumeData: resumeData,
-                                              metrics: metrics,
-                                              serializationDuration: serializationDuration,
-                                              result: result.map(transform))
-    }
-
-    /// Evaluates the given closure when the result of this `DownloadResponse` is a success, passing the unwrapped
-    /// result value as a parameter.
-    ///
-    /// Use the `tryMap` method with a closure that may throw an error. For example:
-    ///
-    ///     let possibleData: DownloadResponse<Data> = ...
-    ///     let possibleObject = possibleData.tryMap {
-    ///         try JSONSerialization.jsonObject(with: $0)
-    ///     }
-    ///
-    /// - parameter transform: A closure that takes the success value of the instance's result.
-    ///
-    /// - returns: A success or failure `DownloadResponse` depending on the result of the given closure. If this
-    /// instance's result is a failure, returns the same failure.
-    public func tryMap<NewSuccess>(_ transform: (Success) throws -> NewSuccess) -> DownloadResponse<NewSuccess, Error> {
-        DownloadResponse<NewSuccess, Error>(request: request,
-                                            response: response,
-                                            fileURL: fileURL,
-                                            resumeData: resumeData,
-                                            metrics: metrics,
-                                            serializationDuration: serializationDuration,
-                                            result: result.tryMap(transform))
-    }
-
-    /// Evaluates the specified closure when the `DownloadResponse` is a failure, passing the unwrapped error as a parameter.
-    ///
-    /// Use the `mapError` function with a closure that does not throw. For example:
-    ///
-    ///     let possibleData: DownloadResponse<Data> = ...
-    ///     let withMyError = possibleData.mapError { MyError.error($0) }
-    ///
-    /// - Parameter transform: A closure that takes the error of the instance.
-    ///
-    /// - Returns: A `DownloadResponse` instance containing the result of the transform.
-    public func mapError<NewFailure: Error>(_ transform: (Failure) -> NewFailure) -> DownloadResponse<Success, NewFailure> {
-        DownloadResponse<Success, NewFailure>(request: request,
-                                              response: response,
-                                              fileURL: fileURL,
-                                              resumeData: resumeData,
-                                              metrics: metrics,
-                                              serializationDuration: serializationDuration,
-                                              result: result.mapError(transform))
-    }
-
-    /// Evaluates the specified closure when the `DownloadResponse` is a failure, passing the unwrapped error as a parameter.
-    ///
-    /// Use the `tryMapError` function with a closure that may throw an error. For example:
-    ///
-    ///     let possibleData: DownloadResponse<Data> = ...
-    ///     let possibleObject = possibleData.tryMapError {
-    ///         try someFailableFunction(taking: $0)
-    ///     }
-    ///
-    /// - Parameter transform: A throwing closure that takes the error of the instance.
-    ///
-    /// - Returns: A `DownloadResponse` instance containing the result of the transform.
-    public func tryMapError<NewFailure: Error>(_ transform: (Failure) throws -> NewFailure) -> DownloadResponse<Success, Error> {
-        DownloadResponse<Success, Error>(request: request,
-                                         response: response,
-                                         fileURL: fileURL,
-                                         resumeData: resumeData,
-                                         metrics: metrics,
-                                         serializationDuration: serializationDuration,
-                                         result: result.tryMapError(transform))
-    }
-}
-
-private enum DebugDescription {
-    static func description(of request: URLRequest) -> String {
-        let requestSummary = "\(request.httpMethod!) \(request)"
-        let requestHeadersDescription = DebugDescription.description(for: request.headers)
-        let requestBodyDescription = DebugDescription.description(for: request.httpBody, headers: request.headers)
-
-        return """
-        [Request]: \(requestSummary)
-            \(requestHeadersDescription.indentingNewlines())
-            \(requestBodyDescription.indentingNewlines())
-        """
-    }
-
-    static func description(of response: HTTPURLResponse) -> String {
-        """
-        [Response]:
-            [Status Code]: \(response.statusCode)
-            \(DebugDescription.description(for: response.headers).indentingNewlines())
-        """
-    }
-
-    static func description(for headers: HTTPHeaders) -> String {
-        guard !headers.isEmpty else { return "[Headers]: None" }
-
-        let headerDescription = "\(headers.sorted())".indentingNewlines()
-        return """
-        [Headers]:
-            \(headerDescription)
-        """
-    }
-
-    static func description(for data: Data?,
-                            headers: HTTPHeaders,
-                            allowingPrintableTypes printableTypes: [String] = ["json", "xml", "text"],
-                            maximumLength: Int = 100_000) -> String {
-        guard let data = data, !data.isEmpty else { return "[Body]: None" }
-
-        guard
-            data.count <= maximumLength,
-            printableTypes.compactMap({ headers["Content-Type"]?.contains($0) }).contains(true)
-        else { return "[Body]: \(data.count) bytes" }
-
-        return """
-        [Body]:
-            \(String(decoding: data, as: UTF8.self)
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .indentingNewlines())
-        """
-    }
-}
-
-extension String {
-    fileprivate func indentingNewlines(by spaceCount: Int = 4) -> String {
-        let spaces = String(repeating: " ", count: spaceCount)
-        return replacingOccurrences(of: "\n", with: "\n\(spaces)")
-    }
-}
diff --git a/Pods/Alamofire/Source/ResponseSerialization.swift b/Pods/Alamofire/Source/ResponseSerialization.swift
deleted file mode 100644
index 1b77016d5..000000000
--- a/Pods/Alamofire/Source/ResponseSerialization.swift
+++ /dev/null
@@ -1,1116 +0,0 @@
-//
-//  ResponseSerialization.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-// MARK: Protocols
-
-/// The type to which all data response serializers must conform in order to serialize a response.
-public protocol DataResponseSerializerProtocol {
-    /// The type of serialized object to be created.
-    associatedtype SerializedObject
-
-    /// Serialize the response `Data` into the provided type..
-    ///
-    /// - Parameters:
-    ///   - request:  `URLRequest` which was used to perform the request, if any.
-    ///   - response: `HTTPURLResponse` received from the server, if any.
-    ///   - data:     `Data` returned from the server, if any.
-    ///   - error:    `Error` produced by Alamofire or the underlying `URLSession` during the request.
-    ///
-    /// - Returns:    The `SerializedObject`.
-    /// - Throws:     Any `Error` produced during serialization.
-    func serialize(request: URLRequest?, response: HTTPURLResponse?, data: Data?, error: Error?) throws -> SerializedObject
-}
-
-/// The type to which all download response serializers must conform in order to serialize a response.
-public protocol DownloadResponseSerializerProtocol {
-    /// The type of serialized object to be created.
-    associatedtype SerializedObject
-
-    /// Serialize the downloaded response `Data` from disk into the provided type..
-    ///
-    /// - Parameters:
-    ///   - request:  `URLRequest` which was used to perform the request, if any.
-    ///   - response: `HTTPURLResponse` received from the server, if any.
-    ///   - fileURL:  File `URL` to which the response data was downloaded.
-    ///   - error:    `Error` produced by Alamofire or the underlying `URLSession` during the request.
-    ///
-    /// - Returns:    The `SerializedObject`.
-    /// - Throws:     Any `Error` produced during serialization.
-    func serializeDownload(request: URLRequest?, response: HTTPURLResponse?, fileURL: URL?, error: Error?) throws -> SerializedObject
-}
-
-/// A serializer that can handle both data and download responses.
-public protocol ResponseSerializer: DataResponseSerializerProtocol & DownloadResponseSerializerProtocol {
-    /// `DataPreprocessor` used to prepare incoming `Data` for serialization.
-    var dataPreprocessor: DataPreprocessor { get }
-    /// `HTTPMethod`s for which empty response bodies are considered appropriate.
-    var emptyRequestMethods: Set<HTTPMethod> { get }
-    /// HTTP response codes for which empty response bodies are considered appropriate.
-    var emptyResponseCodes: Set<Int> { get }
-}
-
-/// Type used to preprocess `Data` before it handled by a serializer.
-public protocol DataPreprocessor {
-    /// Process           `Data` before it's handled by a serializer.
-    /// - Parameter data: The raw `Data` to process.
-    func preprocess(_ data: Data) throws -> Data
-}
-
-/// `DataPreprocessor` that returns passed `Data` without any transform.
-public struct PassthroughPreprocessor: DataPreprocessor {
-    public init() {}
-
-    public func preprocess(_ data: Data) throws -> Data { data }
-}
-
-/// `DataPreprocessor` that trims Google's typical `)]}',\n` XSSI JSON header.
-public struct GoogleXSSIPreprocessor: DataPreprocessor {
-    public init() {}
-
-    public func preprocess(_ data: Data) throws -> Data {
-        (data.prefix(6) == Data(")]}',\n".utf8)) ? data.dropFirst(6) : data
-    }
-}
-
-extension ResponseSerializer {
-    /// Default `DataPreprocessor`. `PassthroughPreprocessor` by default.
-    public static var defaultDataPreprocessor: DataPreprocessor { PassthroughPreprocessor() }
-    /// Default `HTTPMethod`s for which empty response bodies are considered appropriate. `[.head]` by default.
-    public static var defaultEmptyRequestMethods: Set<HTTPMethod> { [.head] }
-    /// HTTP response codes for which empty response bodies are considered appropriate. `[204, 205]` by default.
-    public static var defaultEmptyResponseCodes: Set<Int> { [204, 205] }
-
-    public var dataPreprocessor: DataPreprocessor { Self.defaultDataPreprocessor }
-    public var emptyRequestMethods: Set<HTTPMethod> { Self.defaultEmptyRequestMethods }
-    public var emptyResponseCodes: Set<Int> { Self.defaultEmptyResponseCodes }
-
-    /// Determines whether the `request` allows empty response bodies, if `request` exists.
-    ///
-    /// - Parameter request: `URLRequest` to evaluate.
-    ///
-    /// - Returns:           `Bool` representing the outcome of the evaluation, or `nil` if `request` was `nil`.
-    public func requestAllowsEmptyResponseData(_ request: URLRequest?) -> Bool? {
-        request.flatMap { $0.httpMethod }
-            .flatMap(HTTPMethod.init)
-            .map { emptyRequestMethods.contains($0) }
-    }
-
-    /// Determines whether the `response` allows empty response bodies, if `response` exists`.
-    ///
-    /// - Parameter response: `HTTPURLResponse` to evaluate.
-    ///
-    /// - Returns:            `Bool` representing the outcome of the evaluation, or `nil` if `response` was `nil`.
-    public func responseAllowsEmptyResponseData(_ response: HTTPURLResponse?) -> Bool? {
-        response.flatMap { $0.statusCode }
-            .map { emptyResponseCodes.contains($0) }
-    }
-
-    /// Determines whether `request` and `response` allow empty response bodies.
-    ///
-    /// - Parameters:
-    ///   - request:  `URLRequest` to evaluate.
-    ///   - response: `HTTPURLResponse` to evaluate.
-    ///
-    /// - Returns:    `true` if `request` or `response` allow empty bodies, `false` otherwise.
-    public func emptyResponseAllowed(forRequest request: URLRequest?, response: HTTPURLResponse?) -> Bool {
-        (requestAllowsEmptyResponseData(request) == true) || (responseAllowsEmptyResponseData(response) == true)
-    }
-}
-
-/// By default, any serializer declared to conform to both types will get file serialization for free, as it just feeds
-/// the data read from disk into the data response serializer.
-extension DownloadResponseSerializerProtocol where Self: DataResponseSerializerProtocol {
-    public func serializeDownload(request: URLRequest?, response: HTTPURLResponse?, fileURL: URL?, error: Error?) throws -> Self.SerializedObject {
-        guard error == nil else { throw error! }
-
-        guard let fileURL = fileURL else {
-            throw AFError.responseSerializationFailed(reason: .inputFileNil)
-        }
-
-        let data: Data
-        do {
-            data = try Data(contentsOf: fileURL)
-        } catch {
-            throw AFError.responseSerializationFailed(reason: .inputFileReadFailed(at: fileURL))
-        }
-
-        do {
-            return try serialize(request: request, response: response, data: data, error: error)
-        } catch {
-            throw error
-        }
-    }
-}
-
-// MARK: - Default
-
-extension DataRequest {
-    /// Adds a handler to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:             The queue on which the completion handler is dispatched. `.main` by default.
-    ///   - completionHandler: The code to be executed once the request has finished.
-    ///
-    /// - Returns:             The request.
-    @discardableResult
-    public func response(queue: DispatchQueue = .main, completionHandler: @escaping (AFDataResponse<Data?>) -> Void) -> Self {
-        appendResponseSerializer {
-            // Start work that should be on the serialization queue.
-            let result = AFResult<Data?>(value: self.data, error: self.error)
-            // End work that should be on the serialization queue.
-
-            self.underlyingQueue.async {
-                let response = DataResponse(request: self.request,
-                                            response: self.response,
-                                            data: self.data,
-                                            metrics: self.metrics,
-                                            serializationDuration: 0,
-                                            result: result)
-
-                self.eventMonitor?.request(self, didParseResponse: response)
-
-                self.responseSerializerDidComplete { queue.async { completionHandler(response) } }
-            }
-        }
-
-        return self
-    }
-
-    /// Adds a handler to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:              The queue on which the completion handler is dispatched. `.main` by default
-    ///   - responseSerializer: The response serializer responsible for serializing the request, response, and data.
-    ///   - completionHandler:  The code to be executed once the request has finished.
-    ///
-    /// - Returns:              The request.
-    @discardableResult
-    public func response<Serializer: DataResponseSerializerProtocol>(queue: DispatchQueue = .main,
-                                                                     responseSerializer: Serializer,
-                                                                     completionHandler: @escaping (AFDataResponse<Serializer.SerializedObject>) -> Void)
-        -> Self {
-        appendResponseSerializer {
-            // Start work that should be on the serialization queue.
-            let start = ProcessInfo.processInfo.systemUptime
-            let result: AFResult<Serializer.SerializedObject> = Result {
-                try responseSerializer.serialize(request: self.request,
-                                                 response: self.response,
-                                                 data: self.data,
-                                                 error: self.error)
-            }.mapError { error in
-                error.asAFError(or: .responseSerializationFailed(reason: .customSerializationFailed(error: error)))
-            }
-
-            let end = ProcessInfo.processInfo.systemUptime
-            // End work that should be on the serialization queue.
-
-            self.underlyingQueue.async {
-                let response = DataResponse(request: self.request,
-                                            response: self.response,
-                                            data: self.data,
-                                            metrics: self.metrics,
-                                            serializationDuration: end - start,
-                                            result: result)
-
-                self.eventMonitor?.request(self, didParseResponse: response)
-
-                guard let serializerError = result.failure, let delegate = self.delegate else {
-                    self.responseSerializerDidComplete { queue.async { completionHandler(response) } }
-                    return
-                }
-
-                delegate.retryResult(for: self, dueTo: serializerError) { retryResult in
-                    var didComplete: (() -> Void)?
-
-                    defer {
-                        if let didComplete = didComplete {
-                            self.responseSerializerDidComplete { queue.async { didComplete() } }
-                        }
-                    }
-
-                    switch retryResult {
-                    case .doNotRetry:
-                        didComplete = { completionHandler(response) }
-
-                    case let .doNotRetryWithError(retryError):
-                        let result: AFResult<Serializer.SerializedObject> = .failure(retryError.asAFError(orFailWith: "Received retryError was not already AFError"))
-
-                        let response = DataResponse(request: self.request,
-                                                    response: self.response,
-                                                    data: self.data,
-                                                    metrics: self.metrics,
-                                                    serializationDuration: end - start,
-                                                    result: result)
-
-                        didComplete = { completionHandler(response) }
-
-                    case .retry, .retryWithDelay:
-                        delegate.retryRequest(self, withDelay: retryResult.delay)
-                    }
-                }
-            }
-        }
-
-        return self
-    }
-}
-
-extension DownloadRequest {
-    /// Adds a handler to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:             The queue on which the completion handler is dispatched. `.main` by default.
-    ///   - completionHandler: The code to be executed once the request has finished.
-    ///
-    /// - Returns:             The request.
-    @discardableResult
-    public func response(queue: DispatchQueue = .main,
-                         completionHandler: @escaping (AFDownloadResponse<URL?>) -> Void)
-        -> Self {
-        appendResponseSerializer {
-            // Start work that should be on the serialization queue.
-            let result = AFResult<URL?>(value: self.fileURL, error: self.error)
-            // End work that should be on the serialization queue.
-
-            self.underlyingQueue.async {
-                let response = DownloadResponse(request: self.request,
-                                                response: self.response,
-                                                fileURL: self.fileURL,
-                                                resumeData: self.resumeData,
-                                                metrics: self.metrics,
-                                                serializationDuration: 0,
-                                                result: result)
-
-                self.eventMonitor?.request(self, didParseResponse: response)
-
-                self.responseSerializerDidComplete { queue.async { completionHandler(response) } }
-            }
-        }
-
-        return self
-    }
-
-    /// Adds a handler to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:              The queue on which the completion handler is dispatched. `.main` by default.
-    ///   - responseSerializer: The response serializer responsible for serializing the request, response, and data
-    ///                         contained in the destination `URL`.
-    ///   - completionHandler:  The code to be executed once the request has finished.
-    ///
-    /// - Returns:              The request.
-    @discardableResult
-    public func response<Serializer: DownloadResponseSerializerProtocol>(queue: DispatchQueue = .main,
-                                                                         responseSerializer: Serializer,
-                                                                         completionHandler: @escaping (AFDownloadResponse<Serializer.SerializedObject>) -> Void)
-        -> Self {
-        appendResponseSerializer {
-            // Start work that should be on the serialization queue.
-            let start = ProcessInfo.processInfo.systemUptime
-            let result: AFResult<Serializer.SerializedObject> = Result {
-                try responseSerializer.serializeDownload(request: self.request,
-                                                         response: self.response,
-                                                         fileURL: self.fileURL,
-                                                         error: self.error)
-            }.mapError { error in
-                error.asAFError(or: .responseSerializationFailed(reason: .customSerializationFailed(error: error)))
-            }
-            let end = ProcessInfo.processInfo.systemUptime
-            // End work that should be on the serialization queue.
-
-            self.underlyingQueue.async {
-                let response = DownloadResponse(request: self.request,
-                                                response: self.response,
-                                                fileURL: self.fileURL,
-                                                resumeData: self.resumeData,
-                                                metrics: self.metrics,
-                                                serializationDuration: end - start,
-                                                result: result)
-
-                self.eventMonitor?.request(self, didParseResponse: response)
-
-                guard let serializerError = result.failure, let delegate = self.delegate else {
-                    self.responseSerializerDidComplete { queue.async { completionHandler(response) } }
-                    return
-                }
-
-                delegate.retryResult(for: self, dueTo: serializerError) { retryResult in
-                    var didComplete: (() -> Void)?
-
-                    defer {
-                        if let didComplete = didComplete {
-                            self.responseSerializerDidComplete { queue.async { didComplete() } }
-                        }
-                    }
-
-                    switch retryResult {
-                    case .doNotRetry:
-                        didComplete = { completionHandler(response) }
-
-                    case let .doNotRetryWithError(retryError):
-                        let result: AFResult<Serializer.SerializedObject> = .failure(retryError.asAFError(orFailWith: "Received retryError was not already AFError"))
-
-                        let response = DownloadResponse(request: self.request,
-                                                        response: self.response,
-                                                        fileURL: self.fileURL,
-                                                        resumeData: self.resumeData,
-                                                        metrics: self.metrics,
-                                                        serializationDuration: end - start,
-                                                        result: result)
-
-                        didComplete = { completionHandler(response) }
-
-                    case .retry, .retryWithDelay:
-                        delegate.retryRequest(self, withDelay: retryResult.delay)
-                    }
-                }
-            }
-        }
-
-        return self
-    }
-}
-
-// MARK: - URL
-
-/// A `DownloadResponseSerializerProtocol` that performs only `Error` checking and ensures that a downloaded `fileURL`
-/// is present.
-public struct URLResponseSerializer: DownloadResponseSerializerProtocol {
-    /// Creates an instance.
-    public init() {}
-
-    public func serializeDownload(request: URLRequest?,
-                                  response: HTTPURLResponse?,
-                                  fileURL: URL?,
-                                  error: Error?) throws -> URL {
-        guard error == nil else { throw error! }
-
-        guard let url = fileURL else {
-            throw AFError.responseSerializationFailed(reason: .inputFileNil)
-        }
-
-        return url
-    }
-}
-
-extension DownloadRequest {
-    /// Adds a handler using a `URLResponseSerializer` to be called once the request is finished.
-    ///
-    /// - Parameters:
-    ///   - queue:             The queue on which the completion handler is called. `.main` by default.
-    ///   - completionHandler: A closure to be executed once the request has finished.
-    ///
-    /// - Returns:             The request.
-    @discardableResult
-    public func responseURL(queue: DispatchQueue = .main,
-                            completionHandler: @escaping (AFDownloadResponse<URL>) -> Void) -> Self {
-        response(queue: queue, responseSerializer: URLResponseSerializer(), completionHandler: completionHandler)
-    }
-}
-
-// MARK: - Data
-
-/// A `ResponseSerializer` that performs minimal response checking and returns any response `Data` as-is. By default, a
-/// request returning `nil` or no data is considered an error. However, if the request has an `HTTPMethod` or the
-/// response has an  HTTP status code valid for empty responses, then an empty `Data` value is returned.
-public final class DataResponseSerializer: ResponseSerializer {
-    public let dataPreprocessor: DataPreprocessor
-    public let emptyResponseCodes: Set<Int>
-    public let emptyRequestMethods: Set<HTTPMethod>
-
-    /// Creates an instance using the provided values.
-    ///
-    /// - Parameters:
-    ///   - dataPreprocessor:    `DataPreprocessor` used to prepare the received `Data` for serialization.
-    ///   - emptyResponseCodes:  The HTTP response codes for which empty responses are allowed. `[204, 205]` by default.
-    ///   - emptyRequestMethods: The HTTP request methods for which empty responses are allowed. `[.head]` by default.
-    public init(dataPreprocessor: DataPreprocessor = DataResponseSerializer.defaultDataPreprocessor,
-                emptyResponseCodes: Set<Int> = DataResponseSerializer.defaultEmptyResponseCodes,
-                emptyRequestMethods: Set<HTTPMethod> = DataResponseSerializer.defaultEmptyRequestMethods) {
-        self.dataPreprocessor = dataPreprocessor
-        self.emptyResponseCodes = emptyResponseCodes
-        self.emptyRequestMethods = emptyRequestMethods
-    }
-
-    public func serialize(request: URLRequest?, response: HTTPURLResponse?, data: Data?, error: Error?) throws -> Data {
-        guard error == nil else { throw error! }
-
-        guard var data = data, !data.isEmpty else {
-            guard emptyResponseAllowed(forRequest: request, response: response) else {
-                throw AFError.responseSerializationFailed(reason: .inputDataNilOrZeroLength)
-            }
-
-            return Data()
-        }
-
-        data = try dataPreprocessor.preprocess(data)
-
-        return data
-    }
-}
-
-extension DataRequest {
-    /// Adds a handler using a `DataResponseSerializer` to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:               The queue on which the completion handler is called. `.main` by default.
-    ///   - dataPreprocessor:    `DataPreprocessor` which processes the received `Data` before calling the
-    ///                          `completionHandler`. `PassthroughPreprocessor()` by default.
-    ///   - emptyResponseCodes:  HTTP status codes for which empty responses are always valid. `[204, 205]` by default.
-    ///   - emptyRequestMethods: `HTTPMethod`s for which empty responses are always valid. `[.head]` by default.
-    ///   - completionHandler:   A closure to be executed once the request has finished.
-    ///
-    /// - Returns:               The request.
-    @discardableResult
-    public func responseData(queue: DispatchQueue = .main,
-                             dataPreprocessor: DataPreprocessor = DataResponseSerializer.defaultDataPreprocessor,
-                             emptyResponseCodes: Set<Int> = DataResponseSerializer.defaultEmptyResponseCodes,
-                             emptyRequestMethods: Set<HTTPMethod> = DataResponseSerializer.defaultEmptyRequestMethods,
-                             completionHandler: @escaping (AFDataResponse<Data>) -> Void) -> Self {
-        response(queue: queue,
-                 responseSerializer: DataResponseSerializer(dataPreprocessor: dataPreprocessor,
-                                                            emptyResponseCodes: emptyResponseCodes,
-                                                            emptyRequestMethods: emptyRequestMethods),
-                 completionHandler: completionHandler)
-    }
-}
-
-extension DownloadRequest {
-    /// Adds a handler using a `DataResponseSerializer` to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:               The queue on which the completion handler is called. `.main` by default.
-    ///   - dataPreprocessor:    `DataPreprocessor` which processes the received `Data` before calling the
-    ///                          `completionHandler`. `PassthroughPreprocessor()` by default.
-    ///   - emptyResponseCodes:  HTTP status codes for which empty responses are always valid. `[204, 205]` by default.
-    ///   - emptyRequestMethods: `HTTPMethod`s for which empty responses are always valid. `[.head]` by default.
-    ///   - completionHandler:   A closure to be executed once the request has finished.
-    ///
-    /// - Returns:               The request.
-    @discardableResult
-    public func responseData(queue: DispatchQueue = .main,
-                             dataPreprocessor: DataPreprocessor = DataResponseSerializer.defaultDataPreprocessor,
-                             emptyResponseCodes: Set<Int> = DataResponseSerializer.defaultEmptyResponseCodes,
-                             emptyRequestMethods: Set<HTTPMethod> = DataResponseSerializer.defaultEmptyRequestMethods,
-                             completionHandler: @escaping (AFDownloadResponse<Data>) -> Void) -> Self {
-        response(queue: queue,
-                 responseSerializer: DataResponseSerializer(dataPreprocessor: dataPreprocessor,
-                                                            emptyResponseCodes: emptyResponseCodes,
-                                                            emptyRequestMethods: emptyRequestMethods),
-                 completionHandler: completionHandler)
-    }
-}
-
-// MARK: - String
-
-/// A `ResponseSerializer` that decodes the response data as a `String`. By default, a request returning `nil` or no
-/// data is considered an error. However, if the request has an `HTTPMethod` or the response has an  HTTP status code
-/// valid for empty responses, then an empty `String` is returned.
-public final class StringResponseSerializer: ResponseSerializer {
-    public let dataPreprocessor: DataPreprocessor
-    /// Optional string encoding used to validate the response.
-    public let encoding: String.Encoding?
-    public let emptyResponseCodes: Set<Int>
-    public let emptyRequestMethods: Set<HTTPMethod>
-
-    /// Creates an instance with the provided values.
-    ///
-    /// - Parameters:
-    ///   - dataPreprocessor:    `DataPreprocessor` used to prepare the received `Data` for serialization.
-    ///   - encoding:            A string encoding. Defaults to `nil`, in which case the encoding will be determined
-    ///                          from the server response, falling back to the default HTTP character set, `ISO-8859-1`.
-    ///   - emptyResponseCodes:  The HTTP response codes for which empty responses are allowed. `[204, 205]` by default.
-    ///   - emptyRequestMethods: The HTTP request methods for which empty responses are allowed. `[.head]` by default.
-    public init(dataPreprocessor: DataPreprocessor = StringResponseSerializer.defaultDataPreprocessor,
-                encoding: String.Encoding? = nil,
-                emptyResponseCodes: Set<Int> = StringResponseSerializer.defaultEmptyResponseCodes,
-                emptyRequestMethods: Set<HTTPMethod> = StringResponseSerializer.defaultEmptyRequestMethods) {
-        self.dataPreprocessor = dataPreprocessor
-        self.encoding = encoding
-        self.emptyResponseCodes = emptyResponseCodes
-        self.emptyRequestMethods = emptyRequestMethods
-    }
-
-    public func serialize(request: URLRequest?, response: HTTPURLResponse?, data: Data?, error: Error?) throws -> String {
-        guard error == nil else { throw error! }
-
-        guard var data = data, !data.isEmpty else {
-            guard emptyResponseAllowed(forRequest: request, response: response) else {
-                throw AFError.responseSerializationFailed(reason: .inputDataNilOrZeroLength)
-            }
-
-            return ""
-        }
-
-        data = try dataPreprocessor.preprocess(data)
-
-        var convertedEncoding = encoding
-
-        if let encodingName = response?.textEncodingName, convertedEncoding == nil {
-            convertedEncoding = String.Encoding(ianaCharsetName: encodingName)
-        }
-
-        let actualEncoding = convertedEncoding ?? .isoLatin1
-
-        guard let string = String(data: data, encoding: actualEncoding) else {
-            throw AFError.responseSerializationFailed(reason: .stringSerializationFailed(encoding: actualEncoding))
-        }
-
-        return string
-    }
-}
-
-extension DataRequest {
-    /// Adds a handler using a `StringResponseSerializer` to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:               The queue on which the completion handler is dispatched. `.main` by default.
-    ///   - dataPreprocessor:    `DataPreprocessor` which processes the received `Data` before calling the
-    ///                          `completionHandler`. `PassthroughPreprocessor()` by default.
-    ///   - encoding:            The string encoding. Defaults to `nil`, in which case the encoding will be determined
-    ///                          from the server response, falling back to the default HTTP character set, `ISO-8859-1`.
-    ///   - emptyResponseCodes:  HTTP status codes for which empty responses are always valid. `[204, 205]` by default.
-    ///   - emptyRequestMethods: `HTTPMethod`s for which empty responses are always valid. `[.head]` by default.
-    ///   - completionHandler:   A closure to be executed once the request has finished.
-    ///
-    /// - Returns:               The request.
-    @discardableResult
-    public func responseString(queue: DispatchQueue = .main,
-                               dataPreprocessor: DataPreprocessor = StringResponseSerializer.defaultDataPreprocessor,
-                               encoding: String.Encoding? = nil,
-                               emptyResponseCodes: Set<Int> = StringResponseSerializer.defaultEmptyResponseCodes,
-                               emptyRequestMethods: Set<HTTPMethod> = StringResponseSerializer.defaultEmptyRequestMethods,
-                               completionHandler: @escaping (AFDataResponse<String>) -> Void) -> Self {
-        response(queue: queue,
-                 responseSerializer: StringResponseSerializer(dataPreprocessor: dataPreprocessor,
-                                                              encoding: encoding,
-                                                              emptyResponseCodes: emptyResponseCodes,
-                                                              emptyRequestMethods: emptyRequestMethods),
-                 completionHandler: completionHandler)
-    }
-}
-
-extension DownloadRequest {
-    /// Adds a handler using a `StringResponseSerializer` to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:               The queue on which the completion handler is dispatched. `.main` by default.
-    ///   - dataPreprocessor:    `DataPreprocessor` which processes the received `Data` before calling the
-    ///                          `completionHandler`. `PassthroughPreprocessor()` by default.
-    ///   - encoding:            The string encoding. Defaults to `nil`, in which case the encoding will be determined
-    ///                          from the server response, falling back to the default HTTP character set, `ISO-8859-1`.
-    ///   - emptyResponseCodes:  HTTP status codes for which empty responses are always valid. `[204, 205]` by default.
-    ///   - emptyRequestMethods: `HTTPMethod`s for which empty responses are always valid. `[.head]` by default.
-    ///   - completionHandler:   A closure to be executed once the request has finished.
-    ///
-    /// - Returns:               The request.
-    @discardableResult
-    public func responseString(queue: DispatchQueue = .main,
-                               dataPreprocessor: DataPreprocessor = StringResponseSerializer.defaultDataPreprocessor,
-                               encoding: String.Encoding? = nil,
-                               emptyResponseCodes: Set<Int> = StringResponseSerializer.defaultEmptyResponseCodes,
-                               emptyRequestMethods: Set<HTTPMethod> = StringResponseSerializer.defaultEmptyRequestMethods,
-                               completionHandler: @escaping (AFDownloadResponse<String>) -> Void) -> Self {
-        response(queue: queue,
-                 responseSerializer: StringResponseSerializer(dataPreprocessor: dataPreprocessor,
-                                                              encoding: encoding,
-                                                              emptyResponseCodes: emptyResponseCodes,
-                                                              emptyRequestMethods: emptyRequestMethods),
-                 completionHandler: completionHandler)
-    }
-}
-
-// MARK: - JSON
-
-/// A `ResponseSerializer` that decodes the response data using `JSONSerialization`. By default, a request returning
-/// `nil` or no data is considered an error. However, if the request has an `HTTPMethod` or the response has an
-/// HTTP status code valid for empty responses, then an `NSNull` value is returned.
-public final class JSONResponseSerializer: ResponseSerializer {
-    public let dataPreprocessor: DataPreprocessor
-    public let emptyResponseCodes: Set<Int>
-    public let emptyRequestMethods: Set<HTTPMethod>
-    /// `JSONSerialization.ReadingOptions` used when serializing a response.
-    public let options: JSONSerialization.ReadingOptions
-
-    /// Creates an instance with the provided values.
-    ///
-    /// - Parameters:
-    ///   - dataPreprocessor:    `DataPreprocessor` used to prepare the received `Data` for serialization.
-    ///   - emptyResponseCodes:  The HTTP response codes for which empty responses are allowed. `[204, 205]` by default.
-    ///   - emptyRequestMethods: The HTTP request methods for which empty responses are allowed. `[.head]` by default.
-    ///   - options:             The options to use. `.allowFragments` by default.
-    public init(dataPreprocessor: DataPreprocessor = JSONResponseSerializer.defaultDataPreprocessor,
-                emptyResponseCodes: Set<Int> = JSONResponseSerializer.defaultEmptyResponseCodes,
-                emptyRequestMethods: Set<HTTPMethod> = JSONResponseSerializer.defaultEmptyRequestMethods,
-                options: JSONSerialization.ReadingOptions = .allowFragments) {
-        self.dataPreprocessor = dataPreprocessor
-        self.emptyResponseCodes = emptyResponseCodes
-        self.emptyRequestMethods = emptyRequestMethods
-        self.options = options
-    }
-
-    public func serialize(request: URLRequest?, response: HTTPURLResponse?, data: Data?, error: Error?) throws -> Any {
-        guard error == nil else { throw error! }
-
-        guard var data = data, !data.isEmpty else {
-            guard emptyResponseAllowed(forRequest: request, response: response) else {
-                throw AFError.responseSerializationFailed(reason: .inputDataNilOrZeroLength)
-            }
-
-            return NSNull()
-        }
-
-        data = try dataPreprocessor.preprocess(data)
-
-        do {
-            return try JSONSerialization.jsonObject(with: data, options: options)
-        } catch {
-            throw AFError.responseSerializationFailed(reason: .jsonSerializationFailed(error: error))
-        }
-    }
-}
-
-extension DataRequest {
-    /// Adds a handler using a `JSONResponseSerializer` to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:               The queue on which the completion handler is dispatched. `.main` by default.
-    ///   - dataPreprocessor:    `DataPreprocessor` which processes the received `Data` before calling the
-    ///                          `completionHandler`. `PassthroughPreprocessor()` by default.
-    ///   - encoding:            The string encoding. Defaults to `nil`, in which case the encoding will be determined
-    ///                          from the server response, falling back to the default HTTP character set, `ISO-8859-1`.
-    ///   - emptyResponseCodes:  HTTP status codes for which empty responses are always valid. `[204, 205]` by default.
-    ///   - emptyRequestMethods: `HTTPMethod`s for which empty responses are always valid. `[.head]` by default.
-    ///   - options:             `JSONSerialization.ReadingOptions` used when parsing the response. `.allowFragments`
-    ///                          by default.
-    ///   - completionHandler:   A closure to be executed once the request has finished.
-    ///
-    /// - Returns:               The request.
-    @discardableResult
-    public func responseJSON(queue: DispatchQueue = .main,
-                             dataPreprocessor: DataPreprocessor = JSONResponseSerializer.defaultDataPreprocessor,
-                             emptyResponseCodes: Set<Int> = JSONResponseSerializer.defaultEmptyResponseCodes,
-                             emptyRequestMethods: Set<HTTPMethod> = JSONResponseSerializer.defaultEmptyRequestMethods,
-                             options: JSONSerialization.ReadingOptions = .allowFragments,
-                             completionHandler: @escaping (AFDataResponse<Any>) -> Void) -> Self {
-        response(queue: queue,
-                 responseSerializer: JSONResponseSerializer(dataPreprocessor: dataPreprocessor,
-                                                            emptyResponseCodes: emptyResponseCodes,
-                                                            emptyRequestMethods: emptyRequestMethods,
-                                                            options: options),
-                 completionHandler: completionHandler)
-    }
-}
-
-extension DownloadRequest {
-    /// Adds a handler using a `JSONResponseSerializer` to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - queue:               The queue on which the completion handler is dispatched. `.main` by default.
-    ///   - dataPreprocessor:    `DataPreprocessor` which processes the received `Data` before calling the
-    ///                          `completionHandler`. `PassthroughPreprocessor()` by default.
-    ///   - encoding:            The string encoding. Defaults to `nil`, in which case the encoding will be determined
-    ///                          from the server response, falling back to the default HTTP character set, `ISO-8859-1`.
-    ///   - emptyResponseCodes:  HTTP status codes for which empty responses are always valid. `[204, 205]` by default.
-    ///   - emptyRequestMethods: `HTTPMethod`s for which empty responses are always valid. `[.head]` by default.
-    ///   - options:             `JSONSerialization.ReadingOptions` used when parsing the response. `.allowFragments`
-    ///                          by default.
-    ///   - completionHandler:   A closure to be executed once the request has finished.
-    ///
-    /// - Returns:               The request.
-    @discardableResult
-    public func responseJSON(queue: DispatchQueue = .main,
-                             dataPreprocessor: DataPreprocessor = JSONResponseSerializer.defaultDataPreprocessor,
-                             emptyResponseCodes: Set<Int> = JSONResponseSerializer.defaultEmptyResponseCodes,
-                             emptyRequestMethods: Set<HTTPMethod> = JSONResponseSerializer.defaultEmptyRequestMethods,
-                             options: JSONSerialization.ReadingOptions = .allowFragments,
-                             completionHandler: @escaping (AFDownloadResponse<Any>) -> Void) -> Self {
-        response(queue: queue,
-                 responseSerializer: JSONResponseSerializer(dataPreprocessor: dataPreprocessor,
-                                                            emptyResponseCodes: emptyResponseCodes,
-                                                            emptyRequestMethods: emptyRequestMethods,
-                                                            options: options),
-                 completionHandler: completionHandler)
-    }
-}
-
-// MARK: - Empty
-
-/// Protocol representing an empty response. Use `T.emptyValue()` to get an instance.
-public protocol EmptyResponse {
-    /// Empty value for the conforming type.
-    ///
-    /// - Returns: Value of `Self` to use for empty values.
-    static func emptyValue() -> Self
-}
-
-/// Type representing an empty value. Use `Empty.value` to get the static instance.
-public struct Empty: Codable {
-    /// Static `Empty` instance used for all `Empty` responses.
-    public static let value = Empty()
-}
-
-extension Empty: EmptyResponse {
-    public static func emptyValue() -> Empty {
-        value
-    }
-}
-
-// MARK: - DataDecoder Protocol
-
-/// Any type which can decode `Data` into a `Decodable` type.
-public protocol DataDecoder {
-    /// Decode `Data` into the provided type.
-    ///
-    /// - Parameters:
-    ///   - type:  The `Type` to be decoded.
-    ///   - data:  The `Data` to be decoded.
-    ///
-    /// - Returns: The decoded value of type `D`.
-    /// - Throws:  Any error that occurs during decode.
-    func decode<D: Decodable>(_ type: D.Type, from data: Data) throws -> D
-}
-
-/// `JSONDecoder` automatically conforms to `DataDecoder`.
-extension JSONDecoder: DataDecoder {}
-/// `PropertyListDecoder` automatically conforms to `DataDecoder`.
-extension PropertyListDecoder: DataDecoder {}
-
-// MARK: - Decodable
-
-/// A `ResponseSerializer` that decodes the response data as a generic value using any type that conforms to
-/// `DataDecoder`. By default, this is an instance of `JSONDecoder`. Additionally, a request returning `nil` or no data
-/// is considered an error. However, if the request has an `HTTPMethod` or the response has an HTTP status code valid
-/// for empty responses then an empty value will be returned. If the decoded type conforms to `EmptyResponse`, the
-/// type's `emptyValue()` will be returned. If the decoded type is `Empty`, the `.value` instance is returned. If the
-/// decoded type *does not* conform to `EmptyResponse` and isn't `Empty`, an error will be produced.
-public final class DecodableResponseSerializer<T: Decodable>: ResponseSerializer {
-    public let dataPreprocessor: DataPreprocessor
-    /// The `DataDecoder` instance used to decode responses.
-    public let decoder: DataDecoder
-    public let emptyResponseCodes: Set<Int>
-    public let emptyRequestMethods: Set<HTTPMethod>
-
-    /// Creates an instance using the values provided.
-    ///
-    /// - Parameters:
-    ///   - dataPreprocessor:    `DataPreprocessor` used to prepare the received `Data` for serialization.
-    ///   - decoder:             The `DataDecoder`. `JSONDecoder()` by default.
-    ///   - emptyResponseCodes:  The HTTP response codes for which empty responses are allowed. `[204, 205]` by default.
-    ///   - emptyRequestMethods: The HTTP request methods for which empty responses are allowed. `[.head]` by default.
-    public init(dataPreprocessor: DataPreprocessor = DecodableResponseSerializer.defaultDataPreprocessor,
-                decoder: DataDecoder = JSONDecoder(),
-                emptyResponseCodes: Set<Int> = DecodableResponseSerializer.defaultEmptyResponseCodes,
-                emptyRequestMethods: Set<HTTPMethod> = DecodableResponseSerializer.defaultEmptyRequestMethods) {
-        self.dataPreprocessor = dataPreprocessor
-        self.decoder = decoder
-        self.emptyResponseCodes = emptyResponseCodes
-        self.emptyRequestMethods = emptyRequestMethods
-    }
-
-    public func serialize(request: URLRequest?, response: HTTPURLResponse?, data: Data?, error: Error?) throws -> T {
-        guard error == nil else { throw error! }
-
-        guard var data = data, !data.isEmpty else {
-            guard emptyResponseAllowed(forRequest: request, response: response) else {
-                throw AFError.responseSerializationFailed(reason: .inputDataNilOrZeroLength)
-            }
-
-            guard let emptyResponseType = T.self as? EmptyResponse.Type, let emptyValue = emptyResponseType.emptyValue() as? T else {
-                throw AFError.responseSerializationFailed(reason: .invalidEmptyResponse(type: "\(T.self)"))
-            }
-
-            return emptyValue
-        }
-
-        data = try dataPreprocessor.preprocess(data)
-
-        do {
-            return try decoder.decode(T.self, from: data)
-        } catch {
-            throw AFError.responseSerializationFailed(reason: .decodingFailed(error: error))
-        }
-    }
-}
-
-extension DataRequest {
-    /// Adds a handler using a `DecodableResponseSerializer` to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - type:                `Decodable` type to decode from response data.
-    ///   - queue:               The queue on which the completion handler is dispatched. `.main` by default.
-    ///   - dataPreprocessor:    `DataPreprocessor` which processes the received `Data` before calling the
-    ///                          `completionHandler`. `PassthroughPreprocessor()` by default.
-    ///   - decoder:             `DataDecoder` to use to decode the response. `JSONDecoder()` by default.
-    ///   - encoding:            The string encoding. Defaults to `nil`, in which case the encoding will be determined
-    ///                          from the server response, falling back to the default HTTP character set, `ISO-8859-1`.
-    ///   - emptyResponseCodes:  HTTP status codes for which empty responses are always valid. `[204, 205]` by default.
-    ///   - emptyRequestMethods: `HTTPMethod`s for which empty responses are always valid. `[.head]` by default.
-    ///   - options:             `JSONSerialization.ReadingOptions` used when parsing the response. `.allowFragments`
-    ///                          by default.
-    ///   - completionHandler:   A closure to be executed once the request has finished.
-    ///
-    /// - Returns:               The request.
-    @discardableResult
-    public func responseDecodable<T: Decodable>(of type: T.Type = T.self,
-                                                queue: DispatchQueue = .main,
-                                                dataPreprocessor: DataPreprocessor = DecodableResponseSerializer<T>.defaultDataPreprocessor,
-                                                decoder: DataDecoder = JSONDecoder(),
-                                                emptyResponseCodes: Set<Int> = DecodableResponseSerializer<T>.defaultEmptyResponseCodes,
-                                                emptyRequestMethods: Set<HTTPMethod> = DecodableResponseSerializer<T>.defaultEmptyRequestMethods,
-                                                completionHandler: @escaping (AFDataResponse<T>) -> Void) -> Self {
-        response(queue: queue,
-                 responseSerializer: DecodableResponseSerializer(dataPreprocessor: dataPreprocessor,
-                                                                 decoder: decoder,
-                                                                 emptyResponseCodes: emptyResponseCodes,
-                                                                 emptyRequestMethods: emptyRequestMethods),
-                 completionHandler: completionHandler)
-    }
-}
-
-extension DownloadRequest {
-    /// Adds a handler using a `DecodableResponseSerializer` to be called once the request has finished.
-    ///
-    /// - Parameters:
-    ///   - type:                `Decodable` type to decode from response data.
-    ///   - queue:               The queue on which the completion handler is dispatched. `.main` by default.
-    ///   - dataPreprocessor:    `DataPreprocessor` which processes the received `Data` before calling the
-    ///                          `completionHandler`. `PassthroughPreprocessor()` by default.
-    ///   - decoder:             `DataDecoder` to use to decode the response. `JSONDecoder()` by default.
-    ///   - encoding:            The string encoding. Defaults to `nil`, in which case the encoding will be determined
-    ///                          from the server response, falling back to the default HTTP character set, `ISO-8859-1`.
-    ///   - emptyResponseCodes:  HTTP status codes for which empty responses are always valid. `[204, 205]` by default.
-    ///   - emptyRequestMethods: `HTTPMethod`s for which empty responses are always valid. `[.head]` by default.
-    ///   - options:             `JSONSerialization.ReadingOptions` used when parsing the response. `.allowFragments`
-    ///                          by default.
-    ///   - completionHandler:   A closure to be executed once the request has finished.
-    ///
-    /// - Returns:               The request.
-    @discardableResult
-    public func responseDecodable<T: Decodable>(of type: T.Type = T.self,
-                                                queue: DispatchQueue = .main,
-                                                dataPreprocessor: DataPreprocessor = DecodableResponseSerializer<T>.defaultDataPreprocessor,
-                                                decoder: DataDecoder = JSONDecoder(),
-                                                emptyResponseCodes: Set<Int> = DecodableResponseSerializer<T>.defaultEmptyResponseCodes,
-                                                emptyRequestMethods: Set<HTTPMethod> = DecodableResponseSerializer<T>.defaultEmptyRequestMethods,
-                                                completionHandler: @escaping (AFDownloadResponse<T>) -> Void) -> Self {
-        response(queue: queue,
-                 responseSerializer: DecodableResponseSerializer(dataPreprocessor: dataPreprocessor,
-                                                                 decoder: decoder,
-                                                                 emptyResponseCodes: emptyResponseCodes,
-                                                                 emptyRequestMethods: emptyRequestMethods),
-                 completionHandler: completionHandler)
-    }
-}
-
-// MARK: - DataStreamRequest
-
-/// A type which can serialize incoming `Data`.
-public protocol DataStreamSerializer {
-    /// Type produced from the serialized `Data`.
-    associatedtype SerializedObject
-
-    /// Serializes incoming `Data` into a `SerializedObject` value.
-    ///
-    /// - Parameter data: `Data` to be serialized.
-    ///
-    /// - Throws: Any error produced during serialization.
-    func serialize(_ data: Data) throws -> SerializedObject
-}
-
-/// `DataStreamSerializer` which uses the provided `DataPreprocessor` and `DataDecoder` to serialize the incoming `Data`.
-public struct DecodableStreamSerializer<T: Decodable>: DataStreamSerializer {
-    /// `DataDecoder` used to decode incoming `Data`.
-    public let decoder: DataDecoder
-    /// `DataPreprocessor` incoming `Data` is passed through before being passed to the `DataDecoder`.
-    public let dataPreprocessor: DataPreprocessor
-
-    /// Creates an instance with the provided `DataDecoder` and `DataPreprocessor`.
-    /// - Parameters:
-    ///   - decoder: `        DataDecoder` used to decode incoming `Data`.
-    ///   - dataPreprocessor: `DataPreprocessor` used to process incoming `Data` before it's passed through the `decoder`.
-    public init(decoder: DataDecoder = JSONDecoder(), dataPreprocessor: DataPreprocessor = PassthroughPreprocessor()) {
-        self.decoder = decoder
-        self.dataPreprocessor = dataPreprocessor
-    }
-
-    public func serialize(_ data: Data) throws -> T {
-        let processedData = try dataPreprocessor.preprocess(data)
-        do {
-            return try decoder.decode(T.self, from: processedData)
-        } catch {
-            throw AFError.responseSerializationFailed(reason: .decodingFailed(error: error))
-        }
-    }
-}
-
-/// `DataStreamSerializer` which performs no serialization on incoming `Data`.
-public struct PassthroughStreamSerializer: DataStreamSerializer {
-    public func serialize(_ data: Data) throws -> Data { data }
-}
-
-/// `DataStreamSerializer` which serializes incoming stream `Data` into `UTF8`-decoded `String` values.
-public struct StringStreamSerializer: DataStreamSerializer {
-    public func serialize(_ data: Data) throws -> String {
-        String(decoding: data, as: UTF8.self)
-    }
-}
-
-extension DataStreamRequest {
-    /// Adds a `StreamHandler` which performs no parsing on incoming `Data`.
-    ///
-    /// - Parameters:
-    ///   - queue:  `DispatchQueue` on which to perform `StreamHandler` closure.
-    ///   - stream: `StreamHandler` closure called as `Data` is received. May be called multiple times.
-    ///
-    /// - Returns:  The `DataStreamRequest`.
-    @discardableResult
-    public func responseStream(on queue: DispatchQueue = .main, stream: @escaping Handler<Data, Never>) -> Self {
-        let parser = { [unowned self] (data: Data) in
-            queue.async {
-                self.capturingError {
-                    try stream(.init(event: .stream(.success(data)), token: .init(self)))
-                }
-
-                self.updateAndCompleteIfPossible()
-            }
-        }
-
-        $streamMutableState.write { $0.streams.append(parser) }
-        appendStreamCompletion(on: queue, stream: stream)
-
-        return self
-    }
-
-    /// Adds a `StreamHandler` which uses the provided `DataStreamSerializer` to process incoming `Data`.
-    ///
-    /// - Parameters:
-    ///   - serializer: `DataStreamSerializer` used to process incoming `Data`. Its work is done on the `serializationQueue`.
-    ///   - queue:      `DispatchQueue` on which to perform `StreamHandler` closure.
-    ///   - stream:     `StreamHandler` closure called as `Data` is received. May be called multiple times.
-    ///
-    /// - Returns:      The `DataStreamRequest`.
-    @discardableResult
-    public func responseStream<Serializer: DataStreamSerializer>(using serializer: Serializer,
-                                                                 on queue: DispatchQueue = .main,
-                                                                 stream: @escaping Handler<Serializer.SerializedObject, AFError>) -> Self {
-        let parser = { [unowned self] (data: Data) in
-            self.serializationQueue.async {
-                // Start work on serialization queue.
-                let result = Result { try serializer.serialize(data) }
-                    .mapError { $0.asAFError(or: .responseSerializationFailed(reason: .customSerializationFailed(error: $0))) }
-                // End work on serialization queue.
-                self.underlyingQueue.async {
-                    self.eventMonitor?.request(self, didParseStream: result)
-
-                    if result.isFailure, self.automaticallyCancelOnStreamError {
-                        self.cancel()
-                    }
-
-                    queue.async {
-                        self.capturingError {
-                            try stream(.init(event: .stream(result), token: .init(self)))
-                        }
-
-                        self.updateAndCompleteIfPossible()
-                    }
-                }
-            }
-        }
-
-        $streamMutableState.write { $0.streams.append(parser) }
-        appendStreamCompletion(on: queue, stream: stream)
-
-        return self
-    }
-
-    /// Adds a `StreamHandler` which parses incoming `Data` as a UTF8 `String`.
-    ///
-    /// - Parameters:
-    ///   - queue:      `DispatchQueue` on which to perform `StreamHandler` closure.
-    ///   - stream:     `StreamHandler` closure called as `Data` is received. May be called multiple times.
-    ///
-    /// - Returns:  The `DataStreamRequest`.
-    @discardableResult
-    public func responseStreamString(on queue: DispatchQueue = .main,
-                                     stream: @escaping Handler<String, Never>) -> Self {
-        let parser = { [unowned self] (data: Data) in
-            self.serializationQueue.async {
-                // Start work on serialization queue.
-                let string = String(decoding: data, as: UTF8.self)
-                // End work on serialization queue.
-                self.underlyingQueue.async {
-                    self.eventMonitor?.request(self, didParseStream: .success(string))
-
-                    queue.async {
-                        self.capturingError {
-                            try stream(.init(event: .stream(.success(string)), token: .init(self)))
-                        }
-
-                        self.updateAndCompleteIfPossible()
-                    }
-                }
-            }
-        }
-
-        $streamMutableState.write { $0.streams.append(parser) }
-        appendStreamCompletion(on: queue, stream: stream)
-
-        return self
-    }
-
-    private func updateAndCompleteIfPossible() {
-        $streamMutableState.write { state in
-            state.numberOfExecutingStreams -= 1
-
-            guard state.numberOfExecutingStreams == 0, !state.enqueuedCompletionEvents.isEmpty else { return }
-
-            let completionEvents = state.enqueuedCompletionEvents
-            self.underlyingQueue.async { completionEvents.forEach { $0() } }
-            state.enqueuedCompletionEvents.removeAll()
-        }
-    }
-
-    /// Adds a `StreamHandler` which parses incoming `Data` using the provided `DataDecoder`.
-    ///
-    /// - Parameters:
-    ///   - type:         `Decodable` type to parse incoming `Data` into.
-    ///   - queue:        `DispatchQueue` on which to perform `StreamHandler` closure.
-    ///   - decoder:      `DataDecoder` used to decode the incoming `Data`.
-    ///   - preprocessor: `DataPreprocessor` used to process the incoming `Data` before it's passed to the `decoder`.
-    ///   - stream:       `StreamHandler` closure called as `Data` is received. May be called multiple times.
-    ///
-    /// - Returns: The `DataStreamRequest`.
-    @discardableResult
-    public func responseStreamDecodable<T: Decodable>(of type: T.Type = T.self,
-                                                      on queue: DispatchQueue = .main,
-                                                      using decoder: DataDecoder = JSONDecoder(),
-                                                      preprocessor: DataPreprocessor = PassthroughPreprocessor(),
-                                                      stream: @escaping Handler<T, AFError>) -> Self {
-        responseStream(using: DecodableStreamSerializer<T>(decoder: decoder, dataPreprocessor: preprocessor),
-                       stream: stream)
-    }
-}
diff --git a/Pods/Alamofire/Source/Result+Alamofire.swift b/Pods/Alamofire/Source/Result+Alamofire.swift
deleted file mode 100644
index 39ac28607..000000000
--- a/Pods/Alamofire/Source/Result+Alamofire.swift
+++ /dev/null
@@ -1,120 +0,0 @@
-//
-//  Result+Alamofire.swift
-//
-//  Copyright (c) 2019 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// Default type of `Result` returned by Alamofire, with an `AFError` `Failure` type.
-public typealias AFResult<Success> = Result<Success, AFError>
-
-// MARK: - Internal APIs
-
-extension Result {
-    /// Returns whether the instance is `.success`.
-    var isSuccess: Bool {
-        guard case .success = self else { return false }
-        return true
-    }
-
-    /// Returns whether the instance is `.failure`.
-    var isFailure: Bool {
-        !isSuccess
-    }
-
-    /// Returns the associated value if the result is a success, `nil` otherwise.
-    var success: Success? {
-        guard case let .success(value) = self else { return nil }
-        return value
-    }
-
-    /// Returns the associated error value if the result is a failure, `nil` otherwise.
-    var failure: Failure? {
-        guard case let .failure(error) = self else { return nil }
-        return error
-    }
-
-    /// Initializes a `Result` from value or error. Returns `.failure` if the error is non-nil, `.success` otherwise.
-    ///
-    /// - Parameters:
-    ///   - value: A value.
-    ///   - error: An `Error`.
-    init(value: Success, error: Failure?) {
-        if let error = error {
-            self = .failure(error)
-        } else {
-            self = .success(value)
-        }
-    }
-
-    /// Evaluates the specified closure when the `Result` is a success, passing the unwrapped value as a parameter.
-    ///
-    /// Use the `tryMap` method with a closure that may throw an error. For example:
-    ///
-    ///     let possibleData: Result<Data, Error> = .success(Data(...))
-    ///     let possibleObject = possibleData.tryMap {
-    ///         try JSONSerialization.jsonObject(with: $0)
-    ///     }
-    ///
-    /// - parameter transform: A closure that takes the success value of the instance.
-    ///
-    /// - returns: A `Result` containing the result of the given closure. If this instance is a failure, returns the
-    ///            same failure.
-    func tryMap<NewSuccess>(_ transform: (Success) throws -> NewSuccess) -> Result<NewSuccess, Error> {
-        switch self {
-        case let .success(value):
-            do {
-                return try .success(transform(value))
-            } catch {
-                return .failure(error)
-            }
-        case let .failure(error):
-            return .failure(error)
-        }
-    }
-
-    /// Evaluates the specified closure when the `Result` is a failure, passing the unwrapped error as a parameter.
-    ///
-    /// Use the `tryMapError` function with a closure that may throw an error. For example:
-    ///
-    ///     let possibleData: Result<Data, Error> = .success(Data(...))
-    ///     let possibleObject = possibleData.tryMapError {
-    ///         try someFailableFunction(taking: $0)
-    ///     }
-    ///
-    /// - Parameter transform: A throwing closure that takes the error of the instance.
-    ///
-    /// - Returns: A `Result` instance containing the result of the transform. If this instance is a success, returns
-    ///            the same success.
-    func tryMapError<NewFailure: Error>(_ transform: (Failure) throws -> NewFailure) -> Result<Success, Error> {
-        switch self {
-        case let .failure(error):
-            do {
-                return try .failure(transform(error))
-            } catch {
-                return .failure(error)
-            }
-        case let .success(value):
-            return .success(value)
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/RetryPolicy.swift b/Pods/Alamofire/Source/RetryPolicy.swift
deleted file mode 100644
index e9cbcaf45..000000000
--- a/Pods/Alamofire/Source/RetryPolicy.swift
+++ /dev/null
@@ -1,370 +0,0 @@
-//
-//  RetryPolicy.swift
-//
-//  Copyright (c) 2019-2020 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// A retry policy that retries requests using an exponential backoff for allowed HTTP methods and HTTP status codes
-/// as well as certain types of networking errors.
-open class RetryPolicy: RequestInterceptor {
-    /// The default retry limit for retry policies.
-    public static let defaultRetryLimit: UInt = 2
-
-    /// The default exponential backoff base for retry policies (must be a minimum of 2).
-    public static let defaultExponentialBackoffBase: UInt = 2
-
-    /// The default exponential backoff scale for retry policies.
-    public static let defaultExponentialBackoffScale: Double = 0.5
-
-    /// The default HTTP methods to retry.
-    /// See [RFC 2616 - Section 9.1.2](https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html) for more information.
-    public static let defaultRetryableHTTPMethods: Set<HTTPMethod> = [.delete, // [Delete](https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.7) - not always idempotent
-                                                                      .get, // [GET](https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.3) - generally idempotent
-                                                                      .head, // [HEAD](https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.4) - generally idempotent
-                                                                      .options, // [OPTIONS](https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.2) - inherently idempotent
-                                                                      .put, // [PUT](https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.6) - not always idempotent
-                                                                      .trace // [TRACE](https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.8) - inherently idempotent
-    ]
-
-    /// The default HTTP status codes to retry.
-    /// See [RFC 2616 - Section 10](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10) for more information.
-    public static let defaultRetryableHTTPStatusCodes: Set<Int> = [408, // [Request Timeout](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.9)
-                                                                   500, // [Internal Server Error](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.5.1)
-                                                                   502, // [Bad Gateway](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.5.3)
-                                                                   503, // [Service Unavailable](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.5.4)
-                                                                   504 // [Gateway Timeout](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.5.5)
-    ]
-
-    /// The default URL error codes to retry.
-    public static let defaultRetryableURLErrorCodes: Set<URLError.Code> = [// [Security] App Transport Security disallowed a connection because there is no secure network connection.
-        //   - [Disabled] ATS settings do not change at runtime.
-        // .appTransportSecurityRequiresSecureConnection,
-
-        // [System] An app or app extension attempted to connect to a background session that is already connected to a
-        // process.
-        //   - [Enabled] The other process could release the background session.
-        .backgroundSessionInUseByAnotherProcess,
-
-        // [System] The shared container identifier of the URL session configuration is needed but has not been set.
-        //   - [Disabled] Cannot change at runtime.
-        // .backgroundSessionRequiresSharedContainer,
-
-        // [System] The app is suspended or exits while a background data task is processing.
-        //   - [Enabled] App can be foregrounded or launched to recover.
-        .backgroundSessionWasDisconnected,
-
-        // [Network] The URL Loading system received bad data from the server.
-        //   - [Enabled] Server could return valid data when retrying.
-        .badServerResponse,
-
-        // [Resource] A malformed URL prevented a URL request from being initiated.
-        //   - [Disabled] URL was most likely constructed incorrectly.
-        // .badURL,
-
-        // [System] A connection was attempted while a phone call is active on a network that does not support
-        // simultaneous phone and data communication (EDGE or GPRS).
-        //   - [Enabled] Phone call could be ended to allow request to recover.
-        .callIsActive,
-
-        // [Client] An asynchronous load has been canceled.
-        //   - [Disabled] Request was cancelled by the client.
-        // .cancelled,
-
-        // [File System] A download task couldn’t close the downloaded file on disk.
-        //   - [Disabled] File system error is unlikely to recover with retry.
-        // .cannotCloseFile,
-
-        // [Network] An attempt to connect to a host failed.
-        //   - [Enabled] Server or DNS lookup could recover during retry.
-        .cannotConnectToHost,
-
-        // [File System] A download task couldn’t create the downloaded file on disk because of an I/O failure.
-        //   - [Disabled] File system error is unlikely to recover with retry.
-        // .cannotCreateFile,
-
-        // [Data] Content data received during a connection request had an unknown content encoding.
-        //   - [Disabled] Server is unlikely to modify the content encoding during a retry.
-        // .cannotDecodeContentData,
-
-        // [Data] Content data received during a connection request could not be decoded for a known content encoding.
-        //   - [Disabled] Server is unlikely to modify the content encoding during a retry.
-        // .cannotDecodeRawData,
-
-        // [Network] The host name for a URL could not be resolved.
-        //   - [Enabled] Server or DNS lookup could recover during retry.
-        .cannotFindHost,
-
-        // [Network] A request to load an item only from the cache could not be satisfied.
-        //   - [Enabled] Cache could be populated during a retry.
-        .cannotLoadFromNetwork,
-
-        // [File System] A download task was unable to move a downloaded file on disk.
-        //   - [Disabled] File system error is unlikely to recover with retry.
-        // .cannotMoveFile,
-
-        // [File System] A download task was unable to open the downloaded file on disk.
-        //   - [Disabled] File system error is unlikely to recover with retry.
-        // .cannotOpenFile,
-
-        // [Data] A task could not parse a response.
-        //   - [Disabled] Invalid response is unlikely to recover with retry.
-        // .cannotParseResponse,
-
-        // [File System] A download task was unable to remove a downloaded file from disk.
-        //   - [Disabled] File system error is unlikely to recover with retry.
-        // .cannotRemoveFile,
-
-        // [File System] A download task was unable to write to the downloaded file on disk.
-        //   - [Disabled] File system error is unlikely to recover with retry.
-        // .cannotWriteToFile,
-
-        // [Security] A client certificate was rejected.
-        //   - [Disabled] Client certificate is unlikely to change with retry.
-        // .clientCertificateRejected,
-
-        // [Security] A client certificate was required to authenticate an SSL connection during a request.
-        //   - [Disabled] Client certificate is unlikely to be provided with retry.
-        // .clientCertificateRequired,
-
-        // [Data] The length of the resource data exceeds the maximum allowed.
-        //   - [Disabled] Resource will likely still exceed the length maximum on retry.
-        // .dataLengthExceedsMaximum,
-
-        // [System] The cellular network disallowed a connection.
-        //   - [Enabled] WiFi connection could be established during retry.
-        .dataNotAllowed,
-
-        // [Network] The host address could not be found via DNS lookup.
-        //   - [Enabled] DNS lookup could succeed during retry.
-        .dnsLookupFailed,
-
-        // [Data] A download task failed to decode an encoded file during the download.
-        //   - [Enabled] Server could correct the decoding issue with retry.
-        .downloadDecodingFailedMidStream,
-
-        // [Data] A download task failed to decode an encoded file after downloading.
-        //   - [Enabled] Server could correct the decoding issue with retry.
-        .downloadDecodingFailedToComplete,
-
-        // [File System] A file does not exist.
-        //   - [Disabled] File system error is unlikely to recover with retry.
-        // .fileDoesNotExist,
-
-        // [File System] A request for an FTP file resulted in the server responding that the file is not a plain file,
-        // but a directory.
-        //   - [Disabled] FTP directory is not likely to change to a file during a retry.
-        // .fileIsDirectory,
-
-        // [Network] A redirect loop has been detected or the threshold for number of allowable redirects has been
-        // exceeded (currently 16).
-        //   - [Disabled] The redirect loop is unlikely to be resolved within the retry window.
-        // .httpTooManyRedirects,
-
-        // [System] The attempted connection required activating a data context while roaming, but international roaming
-        // is disabled.
-        //   - [Enabled] WiFi connection could be established during retry.
-        .internationalRoamingOff,
-
-        // [Connectivity] A client or server connection was severed in the middle of an in-progress load.
-        //   - [Enabled] A network connection could be established during retry.
-        .networkConnectionLost,
-
-        // [File System] A resource couldn’t be read because of insufficient permissions.
-        //   - [Disabled] Permissions are unlikely to be granted during retry.
-        // .noPermissionsToReadFile,
-
-        // [Connectivity] A network resource was requested, but an internet connection has not been established and
-        // cannot be established automatically.
-        //   - [Enabled] A network connection could be established during retry.
-        .notConnectedToInternet,
-
-        // [Resource] A redirect was specified by way of server response code, but the server did not accompany this
-        // code with a redirect URL.
-        //   - [Disabled] The redirect URL is unlikely to be supplied during a retry.
-        // .redirectToNonExistentLocation,
-
-        // [Client] A body stream is needed but the client did not provide one.
-        //   - [Disabled] The client will be unlikely to supply a body stream during retry.
-        // .requestBodyStreamExhausted,
-
-        // [Resource] A requested resource couldn’t be retrieved.
-        //   - [Disabled] The resource is unlikely to become available during the retry window.
-        // .resourceUnavailable,
-
-        // [Security] An attempt to establish a secure connection failed for reasons that can’t be expressed more
-        // specifically.
-        //   - [Enabled] The secure connection could be established during a retry given the lack of specificity
-        //     provided by the error.
-        .secureConnectionFailed,
-
-        // [Security] A server certificate had a date which indicates it has expired, or is not yet valid.
-        //   - [Enabled] The server certificate could become valid within the retry window.
-        .serverCertificateHasBadDate,
-
-        // [Security] A server certificate was not signed by any root server.
-        //   - [Disabled] The server certificate is unlikely to change during the retry window.
-        // .serverCertificateHasUnknownRoot,
-
-        // [Security] A server certificate is not yet valid.
-        //   - [Enabled] The server certificate could become valid within the retry window.
-        .serverCertificateNotYetValid,
-
-        // [Security] A server certificate was signed by a root server that isn’t trusted.
-        //   - [Disabled] The server certificate is unlikely to become trusted within the retry window.
-        // .serverCertificateUntrusted,
-
-        // [Network] An asynchronous operation timed out.
-        //   - [Enabled] The request timed out for an unknown reason and should be retried.
-        .timedOut
-
-        // [System] The URL Loading System encountered an error that it can’t interpret.
-        //   - [Disabled] The error could not be interpreted and is unlikely to be recovered from during a retry.
-        // .unknown,
-
-        // [Resource] A properly formed URL couldn’t be handled by the framework.
-        //   - [Disabled] The URL is unlikely to change during a retry.
-        // .unsupportedURL,
-
-        // [Client] Authentication is required to access a resource.
-        //   - [Disabled] The user authentication is unlikely to be provided by retrying.
-        // .userAuthenticationRequired,
-
-        // [Client] An asynchronous request for authentication has been canceled by the user.
-        //   - [Disabled] The user cancelled authentication and explicitly took action to not retry.
-        // .userCancelledAuthentication,
-
-        // [Resource] A server reported that a URL has a non-zero content length, but terminated the network connection
-        // gracefully without sending any data.
-        //   - [Disabled] The server is unlikely to provide data during the retry window.
-        // .zeroByteResource,
-    ]
-
-    /// The total number of times the request is allowed to be retried.
-    public let retryLimit: UInt
-
-    /// The base of the exponential backoff policy (should always be greater than or equal to 2).
-    public let exponentialBackoffBase: UInt
-
-    /// The scale of the exponential backoff.
-    public let exponentialBackoffScale: Double
-
-    /// The HTTP methods that are allowed to be retried.
-    public let retryableHTTPMethods: Set<HTTPMethod>
-
-    /// The HTTP status codes that are automatically retried by the policy.
-    public let retryableHTTPStatusCodes: Set<Int>
-
-    /// The URL error codes that are automatically retried by the policy.
-    public let retryableURLErrorCodes: Set<URLError.Code>
-
-    /// Creates an `ExponentialBackoffRetryPolicy` from the specified parameters.
-    ///
-    /// - Parameters:
-    ///   - retryLimit:               The total number of times the request is allowed to be retried. `2` by default.
-    ///   - exponentialBackoffBase:   The base of the exponential backoff policy. `2` by default.
-    ///   - exponentialBackoffScale:  The scale of the exponential backoff. `0.5` by default.
-    ///   - retryableHTTPMethods:     The HTTP methods that are allowed to be retried.
-    ///                               `RetryPolicy.defaultRetryableHTTPMethods` by default.
-    ///   - retryableHTTPStatusCodes: The HTTP status codes that are automatically retried by the policy.
-    ///                               `RetryPolicy.defaultRetryableHTTPStatusCodes` by default.
-    ///   - retryableURLErrorCodes:   The URL error codes that are automatically retried by the policy.
-    ///                               `RetryPolicy.defaultRetryableURLErrorCodes` by default.
-    public init(retryLimit: UInt = RetryPolicy.defaultRetryLimit,
-                exponentialBackoffBase: UInt = RetryPolicy.defaultExponentialBackoffBase,
-                exponentialBackoffScale: Double = RetryPolicy.defaultExponentialBackoffScale,
-                retryableHTTPMethods: Set<HTTPMethod> = RetryPolicy.defaultRetryableHTTPMethods,
-                retryableHTTPStatusCodes: Set<Int> = RetryPolicy.defaultRetryableHTTPStatusCodes,
-                retryableURLErrorCodes: Set<URLError.Code> = RetryPolicy.defaultRetryableURLErrorCodes) {
-        precondition(exponentialBackoffBase >= 2, "The `exponentialBackoffBase` must be a minimum of 2.")
-
-        self.retryLimit = retryLimit
-        self.exponentialBackoffBase = exponentialBackoffBase
-        self.exponentialBackoffScale = exponentialBackoffScale
-        self.retryableHTTPMethods = retryableHTTPMethods
-        self.retryableHTTPStatusCodes = retryableHTTPStatusCodes
-        self.retryableURLErrorCodes = retryableURLErrorCodes
-    }
-
-    open func retry(_ request: Request,
-                    for session: Session,
-                    dueTo error: Error,
-                    completion: @escaping (RetryResult) -> Void) {
-        if request.retryCount < retryLimit, shouldRetry(request: request, dueTo: error) {
-            completion(.retryWithDelay(pow(Double(exponentialBackoffBase), Double(request.retryCount)) * exponentialBackoffScale))
-        } else {
-            completion(.doNotRetry)
-        }
-    }
-
-    /// Determines whether or not to retry the provided `Request`.
-    ///
-    /// - Parameters:
-    ///     - request: `Request` that failed due to the provided `Error`.
-    ///     - error:   `Error` encountered while executing the `Request`.
-    ///
-    /// - Returns:     `Bool` determining whether or not to retry the `Request`.
-    open func shouldRetry(request: Request, dueTo error: Error) -> Bool {
-        guard let httpMethod = request.request?.method, retryableHTTPMethods.contains(httpMethod) else { return false }
-
-        if let statusCode = request.response?.statusCode, retryableHTTPStatusCodes.contains(statusCode) {
-            return true
-        } else {
-            let errorCode = (error as? URLError)?.code
-            let afErrorCode = (error.asAFError?.underlyingError as? URLError)?.code
-
-            guard let code = errorCode ?? afErrorCode else { return false }
-
-            return retryableURLErrorCodes.contains(code)
-        }
-    }
-}
-
-// MARK: -
-
-/// A retry policy that automatically retries idempotent requests for network connection lost errors. For more
-/// information about retrying network connection lost errors, please refer to Apple's
-/// [technical document](https://developer.apple.com/library/content/qa/qa1941/_index.html).
-open class ConnectionLostRetryPolicy: RetryPolicy {
-    /// Creates a `ConnectionLostRetryPolicy` instance from the specified parameters.
-    ///
-    /// - Parameters:
-    ///   - retryLimit:              The total number of times the request is allowed to be retried.
-    ///                              `RetryPolicy.defaultRetryLimit` by default.
-    ///   - exponentialBackoffBase:  The base of the exponential backoff policy.
-    ///                              `RetryPolicy.defaultExponentialBackoffBase` by default.
-    ///   - exponentialBackoffScale: The scale of the exponential backoff.
-    ///                              `RetryPolicy.defaultExponentialBackoffScale` by default.
-    ///   - retryableHTTPMethods:    The idempotent http methods to retry.
-    ///                              `RetryPolicy.defaultRetryableHTTPMethods` by default.
-    public init(retryLimit: UInt = RetryPolicy.defaultRetryLimit,
-                exponentialBackoffBase: UInt = RetryPolicy.defaultExponentialBackoffBase,
-                exponentialBackoffScale: Double = RetryPolicy.defaultExponentialBackoffScale,
-                retryableHTTPMethods: Set<HTTPMethod> = RetryPolicy.defaultRetryableHTTPMethods) {
-        super.init(retryLimit: retryLimit,
-                   exponentialBackoffBase: exponentialBackoffBase,
-                   exponentialBackoffScale: exponentialBackoffScale,
-                   retryableHTTPMethods: retryableHTTPMethods,
-                   retryableHTTPStatusCodes: [],
-                   retryableURLErrorCodes: [.networkConnectionLost])
-    }
-}
diff --git a/Pods/Alamofire/Source/ServerTrustEvaluation.swift b/Pods/Alamofire/Source/ServerTrustEvaluation.swift
deleted file mode 100644
index 9ca94f161..000000000
--- a/Pods/Alamofire/Source/ServerTrustEvaluation.swift
+++ /dev/null
@@ -1,619 +0,0 @@
-//
-//  ServerTrustPolicy.swift
-//
-//  Copyright (c) 2014-2016 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// Responsible for managing the mapping of `ServerTrustEvaluating` values to given hosts.
-open class ServerTrustManager {
-    /// Determines whether all hosts for this `ServerTrustManager` must be evaluated. `true` by default.
-    public let allHostsMustBeEvaluated: Bool
-
-    /// The dictionary of policies mapped to a particular host.
-    public let evaluators: [String: ServerTrustEvaluating]
-
-    /// Initializes the `ServerTrustManager` instance with the given evaluators.
-    ///
-    /// Since different servers and web services can have different leaf certificates, intermediate and even root
-    /// certificates, it is important to have the flexibility to specify evaluation policies on a per host basis. This
-    /// allows for scenarios such as using default evaluation for host1, certificate pinning for host2, public key
-    /// pinning for host3 and disabling evaluation for host4.
-    ///
-    /// - Parameters:
-    ///   - allHostsMustBeEvaluated: The value determining whether all hosts for this instance must be evaluated. `true`
-    ///                              by default.
-    ///   - evaluators:              A dictionary of evaluators mapped to hosts.
-    public init(allHostsMustBeEvaluated: Bool = true, evaluators: [String: ServerTrustEvaluating]) {
-        self.allHostsMustBeEvaluated = allHostsMustBeEvaluated
-        self.evaluators = evaluators
-    }
-
-    /// Returns the `ServerTrustEvaluating` value for the given host, if one is set.
-    ///
-    /// By default, this method will return the policy that perfectly matches the given host. Subclasses could override
-    /// this method and implement more complex mapping implementations such as wildcards.
-    ///
-    /// - Parameter host: The host to use when searching for a matching policy.
-    ///
-    /// - Returns:        The `ServerTrustEvaluating` value for the given host if found, `nil` otherwise.
-    /// - Throws:         `AFError.serverTrustEvaluationFailed` if `allHostsMustBeEvaluated` is `true` and no matching
-    ///                   evaluators are found.
-    open func serverTrustEvaluator(forHost host: String) throws -> ServerTrustEvaluating? {
-        guard let evaluator = evaluators[host] else {
-            if allHostsMustBeEvaluated {
-                throw AFError.serverTrustEvaluationFailed(reason: .noRequiredEvaluator(host: host))
-            }
-
-            return nil
-        }
-
-        return evaluator
-    }
-}
-
-/// A protocol describing the API used to evaluate server trusts.
-public protocol ServerTrustEvaluating {
-    #if os(Linux)
-    // Implement this once Linux has API for evaluating server trusts.
-    #else
-    /// Evaluates the given `SecTrust` value for the given `host`.
-    ///
-    /// - Parameters:
-    ///   - trust: The `SecTrust` value to evaluate.
-    ///   - host:  The host for which to evaluate the `SecTrust` value.
-    ///
-    /// - Returns: A `Bool` indicating whether the evaluator considers the `SecTrust` value valid for `host`.
-    func evaluate(_ trust: SecTrust, forHost host: String) throws
-    #endif
-}
-
-// MARK: - Server Trust Evaluators
-
-/// An evaluator which uses the default server trust evaluation while allowing you to control whether to validate the
-/// host provided by the challenge. Applications are encouraged to always validate the host in production environments
-/// to guarantee the validity of the server's certificate chain.
-public final class DefaultTrustEvaluator: ServerTrustEvaluating {
-    private let validateHost: Bool
-
-    /// Creates a `DefaultTrustEvaluator`.
-    ///
-    /// - Parameter validateHost: Determines whether or not the evaluator should validate the host. `true` by default.
-    public init(validateHost: Bool = true) {
-        self.validateHost = validateHost
-    }
-
-    public func evaluate(_ trust: SecTrust, forHost host: String) throws {
-        if validateHost {
-            try trust.af.performValidation(forHost: host)
-        }
-
-        try trust.af.performDefaultValidation(forHost: host)
-    }
-}
-
-/// An evaluator which Uses the default and revoked server trust evaluations allowing you to control whether to validate
-/// the host provided by the challenge as well as specify the revocation flags for testing for revoked certificates.
-/// Apple platforms did not start testing for revoked certificates automatically until iOS 10.1, macOS 10.12 and tvOS
-/// 10.1 which is demonstrated in our TLS tests. Applications are encouraged to always validate the host in production
-/// environments to guarantee the validity of the server's certificate chain.
-public final class RevocationTrustEvaluator: ServerTrustEvaluating {
-    /// Represents the options to be use when evaluating the status of a certificate.
-    /// Only Revocation Policy Constants are valid, and can be found in [Apple's documentation](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/policies/1563600-revocation_policy_constants).
-    public struct Options: OptionSet {
-        /// Perform revocation checking using the CRL (Certification Revocation List) method.
-        public static let crl = Options(rawValue: kSecRevocationCRLMethod)
-        /// Consult only locally cached replies; do not use network access.
-        public static let networkAccessDisabled = Options(rawValue: kSecRevocationNetworkAccessDisabled)
-        /// Perform revocation checking using OCSP (Online Certificate Status Protocol).
-        public static let ocsp = Options(rawValue: kSecRevocationOCSPMethod)
-        /// Prefer CRL revocation checking over OCSP; by default, OCSP is preferred.
-        public static let preferCRL = Options(rawValue: kSecRevocationPreferCRL)
-        /// Require a positive response to pass the policy. If the flag is not set, revocation checking is done on a
-        /// "best attempt" basis, where failure to reach the server is not considered fatal.
-        public static let requirePositiveResponse = Options(rawValue: kSecRevocationRequirePositiveResponse)
-        /// Perform either OCSP or CRL checking. The checking is performed according to the method(s) specified in the
-        /// certificate and the value of `preferCRL`.
-        public static let any = Options(rawValue: kSecRevocationUseAnyAvailableMethod)
-
-        /// The raw value of the option.
-        public let rawValue: CFOptionFlags
-
-        /// Creates an `Options` value with the given `CFOptionFlags`.
-        ///
-        /// - Parameter rawValue: The `CFOptionFlags` value to initialize with.
-        public init(rawValue: CFOptionFlags) {
-            self.rawValue = rawValue
-        }
-    }
-
-    private let performDefaultValidation: Bool
-    private let validateHost: Bool
-    private let options: Options
-
-    /// Creates a `RevocationTrustEvaluator`.
-    ///
-    /// - Note: Default and host validation will fail when using this evaluator with self-signed certificates. Use
-    ///         `PinnedCertificatesTrustEvaluator` if you need to use self-signed certificates.
-    ///
-    /// - Parameters:
-    ///   - performDefaultValidation:     Determines whether default validation should be performed in addition to
-    ///                                   evaluating the pinned certificates. `true` by default.
-    ///   - validateHost:                 Determines whether or not the evaluator should validate the host, in addition
-    ///                                   to performing the default evaluation, even if `performDefaultValidation` is
-    ///                                   `false`. `true` by default.
-    ///   - options:                      The `Options` to use to check the revocation status of the certificate. `.any`
-    ///                                   by default.
-    public init(performDefaultValidation: Bool = true, validateHost: Bool = true, options: Options = .any) {
-        self.performDefaultValidation = performDefaultValidation
-        self.validateHost = validateHost
-        self.options = options
-    }
-
-    public func evaluate(_ trust: SecTrust, forHost host: String) throws {
-        if performDefaultValidation {
-            try trust.af.performDefaultValidation(forHost: host)
-        }
-
-        if validateHost {
-            try trust.af.performValidation(forHost: host)
-        }
-
-        if #available(iOS 12, macOS 10.14, tvOS 12, watchOS 5, *) {
-            try trust.af.evaluate(afterApplying: SecPolicy.af.revocation(options: options))
-        } else {
-            try trust.af.validate(policy: SecPolicy.af.revocation(options: options)) { status, result in
-                AFError.serverTrustEvaluationFailed(reason: .revocationCheckFailed(output: .init(host, trust, status, result), options: options))
-            }
-        }
-    }
-}
-
-/// Uses the pinned certificates to validate the server trust. The server trust is considered valid if one of the pinned
-/// certificates match one of the server certificates. By validating both the certificate chain and host, certificate
-/// pinning provides a very secure form of server trust validation mitigating most, if not all, MITM attacks.
-/// Applications are encouraged to always validate the host and require a valid certificate chain in production
-/// environments.
-public final class PinnedCertificatesTrustEvaluator: ServerTrustEvaluating {
-    private let certificates: [SecCertificate]
-    private let acceptSelfSignedCertificates: Bool
-    private let performDefaultValidation: Bool
-    private let validateHost: Bool
-
-    /// Creates a `PinnedCertificatesTrustEvaluator`.
-    ///
-    /// - Parameters:
-    ///   - certificates:                 The certificates to use to evaluate the trust. All `cer`, `crt`, and `der`
-    ///                                   certificates in `Bundle.main` by default.
-    ///   - acceptSelfSignedCertificates: Adds the provided certificates as anchors for the trust evaluation, allowing
-    ///                                   self-signed certificates to pass. `false` by default. THIS SETTING SHOULD BE
-    ///                                   FALSE IN PRODUCTION!
-    ///   - performDefaultValidation:     Determines whether default validation should be performed in addition to
-    ///                                   evaluating the pinned certificates. `true` by default.
-    ///   - validateHost:                 Determines whether or not the evaluator should validate the host, in addition
-    ///                                   to performing the default evaluation, even if `performDefaultValidation` is
-    ///                                   `false`. `true` by default.
-    public init(certificates: [SecCertificate] = Bundle.main.af.certificates,
-                acceptSelfSignedCertificates: Bool = false,
-                performDefaultValidation: Bool = true,
-                validateHost: Bool = true) {
-        self.certificates = certificates
-        self.acceptSelfSignedCertificates = acceptSelfSignedCertificates
-        self.performDefaultValidation = performDefaultValidation
-        self.validateHost = validateHost
-    }
-
-    public func evaluate(_ trust: SecTrust, forHost host: String) throws {
-        guard !certificates.isEmpty else {
-            throw AFError.serverTrustEvaluationFailed(reason: .noCertificatesFound)
-        }
-
-        if acceptSelfSignedCertificates {
-            try trust.af.setAnchorCertificates(certificates)
-        }
-
-        if performDefaultValidation {
-            try trust.af.performDefaultValidation(forHost: host)
-        }
-
-        if validateHost {
-            try trust.af.performValidation(forHost: host)
-        }
-
-        let serverCertificatesData = Set(trust.af.certificateData)
-        let pinnedCertificatesData = Set(certificates.af.data)
-        let pinnedCertificatesInServerData = !serverCertificatesData.isDisjoint(with: pinnedCertificatesData)
-        if !pinnedCertificatesInServerData {
-            throw AFError.serverTrustEvaluationFailed(reason: .certificatePinningFailed(host: host,
-                                                                                        trust: trust,
-                                                                                        pinnedCertificates: certificates,
-                                                                                        serverCertificates: trust.af.certificates))
-        }
-    }
-}
-
-/// Uses the pinned public keys to validate the server trust. The server trust is considered valid if one of the pinned
-/// public keys match one of the server certificate public keys. By validating both the certificate chain and host,
-/// public key pinning provides a very secure form of server trust validation mitigating most, if not all, MITM attacks.
-/// Applications are encouraged to always validate the host and require a valid certificate chain in production
-/// environments.
-public final class PublicKeysTrustEvaluator: ServerTrustEvaluating {
-    private let keys: [SecKey]
-    private let performDefaultValidation: Bool
-    private let validateHost: Bool
-
-    /// Creates a `PublicKeysTrustEvaluator`.
-    ///
-    /// - Note: Default and host validation will fail when using this evaluator with self-signed certificates. Use
-    ///         `PinnedCertificatesTrustEvaluator` if you need to use self-signed certificates.
-    ///
-    /// - Parameters:
-    ///   - keys:                     The `SecKey`s to use to validate public keys. Defaults to the public keys of all
-    ///                               certificates included in the main bundle.
-    ///   - performDefaultValidation: Determines whether default validation should be performed in addition to
-    ///                               evaluating the pinned certificates. `true` by default.
-    ///   - validateHost:             Determines whether or not the evaluator should validate the host, in addition to
-    ///                               performing the default evaluation, even if `performDefaultValidation` is `false`.
-    ///                               `true` by default.
-    public init(keys: [SecKey] = Bundle.main.af.publicKeys,
-                performDefaultValidation: Bool = true,
-                validateHost: Bool = true) {
-        self.keys = keys
-        self.performDefaultValidation = performDefaultValidation
-        self.validateHost = validateHost
-    }
-
-    public func evaluate(_ trust: SecTrust, forHost host: String) throws {
-        guard !keys.isEmpty else {
-            throw AFError.serverTrustEvaluationFailed(reason: .noPublicKeysFound)
-        }
-
-        if performDefaultValidation {
-            try trust.af.performDefaultValidation(forHost: host)
-        }
-
-        if validateHost {
-            try trust.af.performValidation(forHost: host)
-        }
-
-        let pinnedKeysInServerKeys: Bool = {
-            for serverPublicKey in trust.af.publicKeys {
-                for pinnedPublicKey in keys {
-                    if serverPublicKey == pinnedPublicKey {
-                        return true
-                    }
-                }
-            }
-            return false
-        }()
-
-        if !pinnedKeysInServerKeys {
-            throw AFError.serverTrustEvaluationFailed(reason: .publicKeyPinningFailed(host: host,
-                                                                                      trust: trust,
-                                                                                      pinnedKeys: keys,
-                                                                                      serverKeys: trust.af.publicKeys))
-        }
-    }
-}
-
-/// Uses the provided evaluators to validate the server trust. The trust is only considered valid if all of the
-/// evaluators consider it valid.
-public final class CompositeTrustEvaluator: ServerTrustEvaluating {
-    private let evaluators: [ServerTrustEvaluating]
-
-    /// Creates a `CompositeTrustEvaluator`.
-    ///
-    /// - Parameter evaluators: The `ServerTrustEvaluating` values used to evaluate the server trust.
-    public init(evaluators: [ServerTrustEvaluating]) {
-        self.evaluators = evaluators
-    }
-
-    public func evaluate(_ trust: SecTrust, forHost host: String) throws {
-        try evaluators.evaluate(trust, forHost: host)
-    }
-}
-
-/// Disables all evaluation which in turn will always consider any server trust as valid.
-///
-/// - Note: Instead of disabling server trust evaluation, it's a better idea to configure systems to properly trust test
-///         certificates, as outlined in [this Apple tech note](https://developer.apple.com/library/archive/qa/qa1948/_index.html).
-///
-/// **THIS EVALUATOR SHOULD NEVER BE USED IN PRODUCTION!**
-@available(*, deprecated, renamed: "DisabledTrustEvaluator", message: "DisabledEvaluator has been renamed DisabledTrustEvaluator.")
-public typealias DisabledEvaluator = DisabledTrustEvaluator
-
-/// Disables all evaluation which in turn will always consider any server trust as valid.
-///
-///
-/// - Note: Instead of disabling server trust evaluation, it's a better idea to configure systems to properly trust test
-///         certificates, as outlined in [this Apple tech note](https://developer.apple.com/library/archive/qa/qa1948/_index.html).
-///
-/// **THIS EVALUATOR SHOULD NEVER BE USED IN PRODUCTION!**
-public final class DisabledTrustEvaluator: ServerTrustEvaluating {
-    /// Creates an instance.
-    public init() {}
-
-    public func evaluate(_ trust: SecTrust, forHost host: String) throws {}
-}
-
-// MARK: - Extensions
-
-extension Array where Element == ServerTrustEvaluating {
-    #if os(Linux)
-    // Add this same convenience method for Linux.
-    #else
-    /// Evaluates the given `SecTrust` value for the given `host`.
-    ///
-    /// - Parameters:
-    ///   - trust: The `SecTrust` value to evaluate.
-    ///   - host:  The host for which to evaluate the `SecTrust` value.
-    ///
-    /// - Returns: Whether or not the evaluator considers the `SecTrust` value valid for `host`.
-    public func evaluate(_ trust: SecTrust, forHost host: String) throws {
-        for evaluator in self {
-            try evaluator.evaluate(trust, forHost: host)
-        }
-    }
-    #endif
-}
-
-extension Bundle: AlamofireExtended {}
-extension AlamofireExtension where ExtendedType: Bundle {
-    /// Returns all valid `cer`, `crt`, and `der` certificates in the bundle.
-    public var certificates: [SecCertificate] {
-        paths(forResourcesOfTypes: [".cer", ".CER", ".crt", ".CRT", ".der", ".DER"]).compactMap { path in
-            guard
-                let certificateData = try? Data(contentsOf: URL(fileURLWithPath: path)) as CFData,
-                let certificate = SecCertificateCreateWithData(nil, certificateData) else { return nil }
-
-            return certificate
-        }
-    }
-
-    /// Returns all public keys for the valid certificates in the bundle.
-    public var publicKeys: [SecKey] {
-        certificates.af.publicKeys
-    }
-
-    /// Returns all pathnames for the resources identified by the provided file extensions.
-    ///
-    /// - Parameter types: The filename extensions locate.
-    ///
-    /// - Returns:         All pathnames for the given filename extensions.
-    public func paths(forResourcesOfTypes types: [String]) -> [String] {
-        Array(Set(types.flatMap { type.paths(forResourcesOfType: $0, inDirectory: nil) }))
-    }
-}
-
-extension SecTrust: AlamofireExtended {}
-extension AlamofireExtension where ExtendedType == SecTrust {
-    /// Evaluates `self` after applying the `SecPolicy` value provided.
-    ///
-    /// - Parameter policy: The `SecPolicy` to apply to `self` before evaluation.
-    ///
-    /// - Throws:           Any `Error` from applying the `SecPolicy` or from evaluation.
-    @available(iOS 12, macOS 10.14, tvOS 12, watchOS 5, *)
-    public func evaluate(afterApplying policy: SecPolicy) throws {
-        try apply(policy: policy).af.evaluate()
-    }
-
-    /// Attempts to validate `self` using the `SecPolicy` provided and transforming any error produced using the closure passed.
-    ///
-    /// - Parameters:
-    ///   - policy:        The `SecPolicy` used to evaluate `self`.
-    ///   - errorProducer: The closure used transform the failed `OSStatus` and `SecTrustResultType`.
-    /// - Throws:          Any `Error` from applying the `policy`, or the result of `errorProducer` if validation fails.
-    @available(iOS, introduced: 10, deprecated: 12, renamed: "evaluate(afterApplying:)")
-    @available(macOS, introduced: 10.12, deprecated: 10.14, renamed: "evaluate(afterApplying:)")
-    @available(tvOS, introduced: 10, deprecated: 12, renamed: "evaluate(afterApplying:)")
-    @available(watchOS, introduced: 3, deprecated: 5, renamed: "evaluate(afterApplying:)")
-    public func validate(policy: SecPolicy, errorProducer: (_ status: OSStatus, _ result: SecTrustResultType) -> Error) throws {
-        try apply(policy: policy).af.validate(errorProducer: errorProducer)
-    }
-
-    /// Applies a `SecPolicy` to `self`, throwing if it fails.
-    ///
-    /// - Parameter policy: The `SecPolicy`.
-    ///
-    /// - Returns: `self`, with the policy applied.
-    /// - Throws: An `AFError.serverTrustEvaluationFailed` instance with a `.policyApplicationFailed` reason.
-    public func apply(policy: SecPolicy) throws -> SecTrust {
-        let status = SecTrustSetPolicies(type, policy)
-
-        guard status.af.isSuccess else {
-            throw AFError.serverTrustEvaluationFailed(reason: .policyApplicationFailed(trust: type,
-                                                                                       policy: policy,
-                                                                                       status: status))
-        }
-
-        return type
-    }
-
-    /// Evaluate `self`, throwing an `Error` if evaluation fails.
-    ///
-    /// - Throws: `AFError.serverTrustEvaluationFailed` with reason `.trustValidationFailed` and associated error from
-    ///           the underlying evaluation.
-    @available(iOS 12, macOS 10.14, tvOS 12, watchOS 5, *)
-    public func evaluate() throws {
-        var error: CFError?
-        let evaluationSucceeded = SecTrustEvaluateWithError(type, &error)
-
-        if !evaluationSucceeded {
-            throw AFError.serverTrustEvaluationFailed(reason: .trustEvaluationFailed(error: error))
-        }
-    }
-
-    /// Validate `self`, passing any failure values through `errorProducer`.
-    ///
-    /// - Parameter errorProducer: The closure used to transform the failed `OSStatus` and `SecTrustResultType` into an
-    ///                            `Error`.
-    /// - Throws:                  The `Error` produced by the `errorProducer` closure.
-    @available(iOS, introduced: 10, deprecated: 12, renamed: "evaluate()")
-    @available(macOS, introduced: 10.12, deprecated: 10.14, renamed: "evaluate()")
-    @available(tvOS, introduced: 10, deprecated: 12, renamed: "evaluate()")
-    @available(watchOS, introduced: 3, deprecated: 5, renamed: "evaluate()")
-    public func validate(errorProducer: (_ status: OSStatus, _ result: SecTrustResultType) -> Error) throws {
-        var result = SecTrustResultType.invalid
-        let status = SecTrustEvaluate(type, &result)
-
-        guard status.af.isSuccess && result.af.isSuccess else {
-            throw errorProducer(status, result)
-        }
-    }
-
-    /// Sets a custom certificate chain on `self`, allowing full validation of a self-signed certificate and its chain.
-    ///
-    /// - Parameter certificates: The `SecCertificate`s to add to the chain.
-    /// - Throws:                 Any error produced when applying the new certificate chain.
-    public func setAnchorCertificates(_ certificates: [SecCertificate]) throws {
-        // Add additional anchor certificates.
-        let status = SecTrustSetAnchorCertificates(type, certificates as CFArray)
-        guard status.af.isSuccess else {
-            throw AFError.serverTrustEvaluationFailed(reason: .settingAnchorCertificatesFailed(status: status,
-                                                                                               certificates: certificates))
-        }
-
-        // Trust only the set anchor certs.
-        let onlyStatus = SecTrustSetAnchorCertificatesOnly(type, true)
-        guard onlyStatus.af.isSuccess else {
-            throw AFError.serverTrustEvaluationFailed(reason: .settingAnchorCertificatesFailed(status: onlyStatus,
-                                                                                               certificates: certificates))
-        }
-    }
-
-    /// The public keys contained in `self`.
-    public var publicKeys: [SecKey] {
-        certificates.af.publicKeys
-    }
-
-    /// The `SecCertificate`s contained i `self`.
-    public var certificates: [SecCertificate] {
-        (0..<SecTrustGetCertificateCount(type)).compactMap { index in
-            SecTrustGetCertificateAtIndex(type, index)
-        }
-    }
-
-    /// The `Data` values for all certificates contained in `self`.
-    public var certificateData: [Data] {
-        certificates.af.data
-    }
-
-    /// Validates `self` after applying `SecPolicy.af.default`. This evaluation does not validate the hostname.
-    ///
-    /// - Parameter host: The hostname, used only in the error output if validation fails.
-    /// - Throws: An `AFError.serverTrustEvaluationFailed` instance with a `.defaultEvaluationFailed` reason.
-    public func performDefaultValidation(forHost host: String) throws {
-        if #available(iOS 12, macOS 10.14, tvOS 12, watchOS 5, *) {
-            try evaluate(afterApplying: SecPolicy.af.default)
-        } else {
-            try validate(policy: SecPolicy.af.default) { status, result in
-                AFError.serverTrustEvaluationFailed(reason: .defaultEvaluationFailed(output: .init(host, type, status, result)))
-            }
-        }
-    }
-
-    /// Validates `self` after applying `SecPolicy.af.hostname(host)`, which performs the default validation as well as
-    /// hostname validation.
-    ///
-    /// - Parameter host: The hostname to use in the validation.
-    /// - Throws:         An `AFError.serverTrustEvaluationFailed` instance with a `.defaultEvaluationFailed` reason.
-    public func performValidation(forHost host: String) throws {
-        if #available(iOS 12, macOS 10.14, tvOS 12, watchOS 5, *) {
-            try evaluate(afterApplying: SecPolicy.af.hostname(host))
-        } else {
-            try validate(policy: SecPolicy.af.hostname(host)) { status, result in
-                AFError.serverTrustEvaluationFailed(reason: .hostValidationFailed(output: .init(host, type, status, result)))
-            }
-        }
-    }
-}
-
-extension SecPolicy: AlamofireExtended {}
-extension AlamofireExtension where ExtendedType == SecPolicy {
-    /// Creates a `SecPolicy` instance which will validate server certificates but not require a host name match.
-    public static let `default` = SecPolicyCreateSSL(true, nil)
-
-    /// Creates a `SecPolicy` instance which will validate server certificates and much match the provided hostname.
-    ///
-    /// - Parameter hostname: The hostname to validate against.
-    ///
-    /// - Returns:            The `SecPolicy`.
-    public static func hostname(_ hostname: String) -> SecPolicy {
-        SecPolicyCreateSSL(true, hostname as CFString)
-    }
-
-    /// Creates a `SecPolicy` which checks the revocation of certificates.
-    ///
-    /// - Parameter options: The `RevocationTrustEvaluator.Options` for evaluation.
-    ///
-    /// - Returns:           The `SecPolicy`.
-    /// - Throws:            An `AFError.serverTrustEvaluationFailed` error with reason `.revocationPolicyCreationFailed`
-    ///                      if the policy cannot be created.
-    public static func revocation(options: RevocationTrustEvaluator.Options) throws -> SecPolicy {
-        guard let policy = SecPolicyCreateRevocation(options.rawValue) else {
-            throw AFError.serverTrustEvaluationFailed(reason: .revocationPolicyCreationFailed)
-        }
-
-        return policy
-    }
-}
-
-extension Array: AlamofireExtended {}
-extension AlamofireExtension where ExtendedType == [SecCertificate] {
-    /// All `Data` values for the contained `SecCertificate`s.
-    public var data: [Data] {
-        type.map { SecCertificateCopyData($0) as Data }
-    }
-
-    /// All public `SecKey` values for the contained `SecCertificate`s.
-    public var publicKeys: [SecKey] {
-        type.compactMap { $0.af.publicKey }
-    }
-}
-
-extension SecCertificate: AlamofireExtended {}
-extension AlamofireExtension where ExtendedType == SecCertificate {
-    /// The public key for `self`, if it can be extracted.
-    public var publicKey: SecKey? {
-        let policy = SecPolicyCreateBasicX509()
-        var trust: SecTrust?
-        let trustCreationStatus = SecTrustCreateWithCertificates(type, policy, &trust)
-
-        guard let createdTrust = trust, trustCreationStatus == errSecSuccess else { return nil }
-
-        return SecTrustCopyPublicKey(createdTrust)
-    }
-}
-
-extension OSStatus: AlamofireExtended {}
-extension AlamofireExtension where ExtendedType == OSStatus {
-    /// Returns whether `self` is `errSecSuccess`.
-    public var isSuccess: Bool { type == errSecSuccess }
-}
-
-extension SecTrustResultType: AlamofireExtended {}
-extension AlamofireExtension where ExtendedType == SecTrustResultType {
-    /// Returns whether `self is `.unspecified` or `.proceed`.
-    public var isSuccess: Bool {
-        type == .unspecified || type == .proceed
-    }
-}
diff --git a/Pods/Alamofire/Source/Session.swift b/Pods/Alamofire/Source/Session.swift
deleted file mode 100644
index ac0ab2295..000000000
--- a/Pods/Alamofire/Source/Session.swift
+++ /dev/null
@@ -1,1258 +0,0 @@
-//
-//  Session.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// `Session` creates and manages Alamofire's `Request` types during their lifetimes. It also provides common
-/// functionality for all `Request`s, including queuing, interception, trust management, redirect handling, and response
-/// cache handling.
-open class Session {
-    /// Shared singleton instance used by all `AF.request` APIs. Cannot be modified.
-    public static let `default` = Session()
-
-    /// Underlying `URLSession` used to create `URLSessionTasks` for this instance, and for which this instance's
-    /// `delegate` handles `URLSessionDelegate` callbacks.
-    ///
-    /// - Note: This instance should **NOT** be used to interact with the underlying `URLSessionTask`s. Doing so will
-    ///         break internal Alamofire logic that tracks those tasks.
-    ///
-    public let session: URLSession
-    /// Instance's `SessionDelegate`, which handles the `URLSessionDelegate` methods and `Request` interaction.
-    public let delegate: SessionDelegate
-    /// Root `DispatchQueue` for all internal callbacks and state update. **MUST** be a serial queue.
-    public let rootQueue: DispatchQueue
-    /// Value determining whether this instance automatically calls `resume()` on all created `Request`s.
-    public let startRequestsImmediately: Bool
-    /// `DispatchQueue` on which `URLRequest`s are created asynchronously. By default this queue uses `rootQueue` as its
-    /// `target`, but a separate queue can be used if request creation is determined to be a bottleneck. Always profile
-    /// and test before introducing an additional queue.
-    public let requestQueue: DispatchQueue
-    /// `DispatchQueue` passed to all `Request`s on which they perform their response serialization. By default this
-    /// queue uses `rootQueue` as its `target` but a separate queue can be used if response serialization is determined
-    /// to be a bottleneck. Always profile and test before introducing an additional queue.
-    public let serializationQueue: DispatchQueue
-    /// `RequestInterceptor` used for all `Request` created by the instance. `RequestInterceptor`s can also be set on a
-    /// per-`Request` basis, in which case the `Request`'s interceptor takes precedence over this value.
-    public let interceptor: RequestInterceptor?
-    /// `ServerTrustManager` instance used to evaluate all trust challenges and provide certificate and key pinning.
-    public let serverTrustManager: ServerTrustManager?
-    /// `RedirectHandler` instance used to provide customization for request redirection.
-    public let redirectHandler: RedirectHandler?
-    /// `CachedResponseHandler` instance used to provide customization of cached response handling.
-    public let cachedResponseHandler: CachedResponseHandler?
-    /// `CompositeEventMonitor` used to compose Alamofire's `defaultEventMonitors` and any passed `EventMonitor`s.
-    public let eventMonitor: CompositeEventMonitor
-    /// `EventMonitor`s included in all instances. `[AlamofireNotifications()]` by default.
-    public let defaultEventMonitors: [EventMonitor] = [AlamofireNotifications()]
-
-    /// Internal map between `Request`s and any `URLSessionTasks` that may be in flight for them.
-    var requestTaskMap = RequestTaskMap()
-    /// `Set` of currently active `Request`s.
-    var activeRequests: Set<Request> = []
-    /// Completion events awaiting `URLSessionTaskMetrics`.
-    var waitingCompletions: [URLSessionTask: () -> Void] = [:]
-
-    /// Creates a `Session` from a `URLSession` and other parameters.
-    ///
-    /// - Note: When passing a `URLSession`, you must create the `URLSession` with a specific `delegateQueue` value and
-    ///         pass the `delegateQueue`'s `underlyingQueue` as the `rootQueue` parameter of this initializer.
-    ///
-    /// - Parameters:
-    ///   - session:                  Underlying `URLSession` for this instance.
-    ///   - delegate:                 `SessionDelegate` that handles `session`'s delegate callbacks as well as `Request`
-    ///                               interaction.
-    ///   - rootQueue:                Root `DispatchQueue` for all internal callbacks and state updates. **MUST** be a
-    ///                               serial queue.
-    ///   - startRequestsImmediately: Determines whether this instance will automatically start all `Request`s. `true`
-    ///                               by default. If set to `false`, all `Request`s created must have `.resume()` called.
-    ///                               on them for them to start.
-    ///   - requestQueue:             `DispatchQueue` on which to perform `URLRequest` creation. By default this queue
-    ///                               will use the `rootQueue` as its `target`. A separate queue can be used if it's
-    ///                               determined request creation is a bottleneck, but that should only be done after
-    ///                               careful testing and profiling. `nil` by default.
-    ///   - serializationQueue:       `DispatchQueue` on which to perform all response serialization. By default this
-    ///                               queue will use the `rootQueue` as its `target`. A separate queue can be used if
-    ///                               it's determined response serialization is a bottleneck, but that should only be
-    ///                               done after careful testing and profiling. `nil` by default.
-    ///   - interceptor:              `RequestInterceptor` to be used for all `Request`s created by this instance. `nil`
-    ///                               by default.
-    ///   - serverTrustManager:       `ServerTrustManager` to be used for all trust evaluations by this instance. `nil`
-    ///                               by default.
-    ///   - redirectHandler:          `RedirectHandler` to be used by all `Request`s created by this instance. `nil` by
-    ///                               default.
-    ///   - cachedResponseHandler:    `CachedResponseHandler` to be used by all `Request`s created by this instance.
-    ///                               `nil` by default.
-    ///   - eventMonitors:            Additional `EventMonitor`s used by the instance. Alamofire always adds a
-    ///                               `AlamofireNotifications` `EventMonitor` to the array passed here. `[]` by default.
-    public init(session: URLSession,
-                delegate: SessionDelegate,
-                rootQueue: DispatchQueue,
-                startRequestsImmediately: Bool = true,
-                requestQueue: DispatchQueue? = nil,
-                serializationQueue: DispatchQueue? = nil,
-                interceptor: RequestInterceptor? = nil,
-                serverTrustManager: ServerTrustManager? = nil,
-                redirectHandler: RedirectHandler? = nil,
-                cachedResponseHandler: CachedResponseHandler? = nil,
-                eventMonitors: [EventMonitor] = []) {
-        precondition(session.configuration.identifier == nil,
-                     "Alamofire does not support background URLSessionConfigurations.")
-        precondition(session.delegateQueue.underlyingQueue === rootQueue,
-                     "Session(session:) initializer must be passed the DispatchQueue used as the delegateQueue's underlyingQueue as rootQueue.")
-
-        self.session = session
-        self.delegate = delegate
-        self.rootQueue = rootQueue
-        self.startRequestsImmediately = startRequestsImmediately
-        self.requestQueue = requestQueue ?? DispatchQueue(label: "\(rootQueue.label).requestQueue", target: rootQueue)
-        self.serializationQueue = serializationQueue ?? DispatchQueue(label: "\(rootQueue.label).serializationQueue", target: rootQueue)
-        self.interceptor = interceptor
-        self.serverTrustManager = serverTrustManager
-        self.redirectHandler = redirectHandler
-        self.cachedResponseHandler = cachedResponseHandler
-        eventMonitor = CompositeEventMonitor(monitors: defaultEventMonitors + eventMonitors)
-        delegate.eventMonitor = eventMonitor
-        delegate.stateProvider = self
-    }
-
-    /// Creates a `Session` from a `URLSessionConfiguration`.
-    ///
-    /// - Note: This initializer lets Alamofire handle the creation of the underlying `URLSession` and its
-    ///         `delegateQueue`, and is the recommended initializer for most uses.
-    ///
-    /// - Parameters:
-    ///   - configuration:            `URLSessionConfiguration` to be used to create the underlying `URLSession`. Changes
-    ///                               to this value after being passed to this initializer will have no effect.
-    ///                               `URLSessionConfiguration.af.default` by default.
-    ///   - delegate:                 `SessionDelegate` that handles `session`'s delegate callbacks as well as `Request`
-    ///                               interaction. `SessionDelegate()` by default.
-    ///   - rootQueue:                Root `DispatchQueue` for all internal callbacks and state updates. **MUST** be a
-    ///                               serial queue. `DispatchQueue(label: "org.alamofire.session.rootQueue")` by default.
-    ///   - startRequestsImmediately: Determines whether this instance will automatically start all `Request`s. `true`
-    ///                               by default. If set to `false`, all `Request`s created must have `.resume()` called.
-    ///                               on them for them to start.
-    ///   - requestQueue:             `DispatchQueue` on which to perform `URLRequest` creation. By default this queue
-    ///                               will use the `rootQueue` as its `target`. A separate queue can be used if it's
-    ///                               determined request creation is a bottleneck, but that should only be done after
-    ///                               careful testing and profiling. `nil` by default.
-    ///   - serializationQueue:       `DispatchQueue` on which to perform all response serialization. By default this
-    ///                               queue will use the `rootQueue` as its `target`. A separate queue can be used if
-    ///                               it's determined response serialization is a bottleneck, but that should only be
-    ///                               done after careful testing and profiling. `nil` by default.
-    ///   - interceptor:              `RequestInterceptor` to be used for all `Request`s created by this instance. `nil`
-    ///                               by default.
-    ///   - serverTrustManager:       `ServerTrustManager` to be used for all trust evaluations by this instance. `nil`
-    ///                               by default.
-    ///   - redirectHandler:          `RedirectHandler` to be used by all `Request`s created by this instance. `nil` by
-    ///                               default.
-    ///   - cachedResponseHandler:    `CachedResponseHandler` to be used by all `Request`s created by this instance.
-    ///                               `nil` by default.
-    ///   - eventMonitors:            Additional `EventMonitor`s used by the instance. Alamofire always adds a
-    ///                               `AlamofireNotifications` `EventMonitor` to the array passed here. `[]` by default.
-    public convenience init(configuration: URLSessionConfiguration = URLSessionConfiguration.af.default,
-                            delegate: SessionDelegate = SessionDelegate(),
-                            rootQueue: DispatchQueue = DispatchQueue(label: "org.alamofire.session.rootQueue"),
-                            startRequestsImmediately: Bool = true,
-                            requestQueue: DispatchQueue? = nil,
-                            serializationQueue: DispatchQueue? = nil,
-                            interceptor: RequestInterceptor? = nil,
-                            serverTrustManager: ServerTrustManager? = nil,
-                            redirectHandler: RedirectHandler? = nil,
-                            cachedResponseHandler: CachedResponseHandler? = nil,
-                            eventMonitors: [EventMonitor] = []) {
-        precondition(configuration.identifier == nil, "Alamofire does not support background URLSessionConfigurations.")
-
-        let delegateQueue = OperationQueue(maxConcurrentOperationCount: 1, underlyingQueue: rootQueue, name: "org.alamofire.session.sessionDelegateQueue")
-        let session = URLSession(configuration: configuration, delegate: delegate, delegateQueue: delegateQueue)
-
-        self.init(session: session,
-                  delegate: delegate,
-                  rootQueue: rootQueue,
-                  startRequestsImmediately: startRequestsImmediately,
-                  requestQueue: requestQueue,
-                  serializationQueue: serializationQueue,
-                  interceptor: interceptor,
-                  serverTrustManager: serverTrustManager,
-                  redirectHandler: redirectHandler,
-                  cachedResponseHandler: cachedResponseHandler,
-                  eventMonitors: eventMonitors)
-    }
-
-    deinit {
-        finishRequestsForDeinit()
-        session.invalidateAndCancel()
-    }
-
-    // MARK: - All Requests API
-
-    /// Perform an action on all active `Request`s.
-    ///
-    /// - Note: The provided `action` closure is performed asynchronously, meaning that some `Request`s may complete and
-    ///         be unavailable by time it runs. Additionally, this action is performed on the instances's `rootQueue`,
-    ///         so care should be taken that actions are fast. Once the work on the `Request`s is complete, any
-    ///         additional work should be performed on another queue.
-    ///
-    /// - Parameters:
-    ///   - action:     Closure to perform with all `Request`s.
-    public func withAllRequests(perform action: @escaping (Set<Request>) -> Void) {
-        rootQueue.async {
-            action(self.activeRequests)
-        }
-    }
-
-    /// Cancel all active `Request`s, optionally calling a completion handler when complete.
-    ///
-    /// - Note: This is an asynchronous operation and does not block the creation of future `Request`s. Cancelled
-    ///         `Request`s may not cancel immediately due internal work, and may not cancel at all if they are close to
-    ///         completion when cancelled.
-    ///
-    /// - Parameters:
-    ///   - queue:      `DispatchQueue` on which the completion handler is run. `.main` by default.
-    ///   - completion: Closure to be called when all `Request`s have been cancelled.
-    public func cancelAllRequests(completingOnQueue queue: DispatchQueue = .main, completion: (() -> Void)? = nil) {
-        withAllRequests { requests in
-            requests.forEach { $0.cancel() }
-            queue.async {
-                completion?()
-            }
-        }
-    }
-
-    // MARK: - DataRequest
-
-    /// Closure which provides a `URLRequest` for mutation.
-    public typealias RequestModifier = (inout URLRequest) throws -> Void
-
-    struct RequestConvertible: URLRequestConvertible {
-        let url: URLConvertible
-        let method: HTTPMethod
-        let parameters: Parameters?
-        let encoding: ParameterEncoding
-        let headers: HTTPHeaders?
-        let requestModifier: RequestModifier?
-
-        func asURLRequest() throws -> URLRequest {
-            var request = try URLRequest(url: url, method: method, headers: headers)
-            try requestModifier?(&request)
-
-            return try encoding.encode(request, with: parameters)
-        }
-    }
-
-    /// Creates a `DataRequest` from a `URLRequest` created using the passed components and a `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - convertible:     `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - method:          `HTTPMethod` for the `URLRequest`. `.get` by default.
-    ///   - parameters:      `Parameters` (a.k.a. `[String: Any]`) value to be encoded into the `URLRequest`. `nil` by
-    ///                      default.
-    ///   - encoding:        `ParameterEncoding` to be used to encode the `parameters` value into the `URLRequest`.
-    ///                      `URLEncoding.default` by default.
-    ///   - headers:         `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - interceptor:     `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - requestModifier: `RequestModifier` which will be applied to the `URLRequest` created from the provided
-    ///                      parameters. `nil` by default.
-    ///
-    /// - Returns:       The created `DataRequest`.
-    open func request(_ convertible: URLConvertible,
-                      method: HTTPMethod = .get,
-                      parameters: Parameters? = nil,
-                      encoding: ParameterEncoding = URLEncoding.default,
-                      headers: HTTPHeaders? = nil,
-                      interceptor: RequestInterceptor? = nil,
-                      requestModifier: RequestModifier? = nil) -> DataRequest {
-        let convertible = RequestConvertible(url: convertible,
-                                             method: method,
-                                             parameters: parameters,
-                                             encoding: encoding,
-                                             headers: headers,
-                                             requestModifier: requestModifier)
-
-        return request(convertible, interceptor: interceptor)
-    }
-
-    struct RequestEncodableConvertible<Parameters: Encodable>: URLRequestConvertible {
-        let url: URLConvertible
-        let method: HTTPMethod
-        let parameters: Parameters?
-        let encoder: ParameterEncoder
-        let headers: HTTPHeaders?
-        let requestModifier: RequestModifier?
-
-        func asURLRequest() throws -> URLRequest {
-            var request = try URLRequest(url: url, method: method, headers: headers)
-            try requestModifier?(&request)
-
-            return try parameters.map { try encoder.encode($0, into: request) } ?? request
-        }
-    }
-
-    /// Creates a `DataRequest` from a `URLRequest` created using the passed components, `Encodable` parameters, and a
-    /// `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - convertible: `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - method:      `HTTPMethod` for the `URLRequest`. `.get` by default.
-    ///   - parameters:  `Encodable` value to be encoded into the `URLRequest`. `nil` by default.
-    ///   - encoder:     `ParameterEncoder` to be used to encode the `parameters` value into the `URLRequest`.
-    ///                  `URLEncodedFormParameterEncoder.default` by default.
-    ///   - headers:     `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - interceptor: `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///
-    /// - Returns:       The created `DataRequest`.
-    open func request<Parameters: Encodable>(_ convertible: URLConvertible,
-                                             method: HTTPMethod = .get,
-                                             parameters: Parameters? = nil,
-                                             encoder: ParameterEncoder = URLEncodedFormParameterEncoder.default,
-                                             headers: HTTPHeaders? = nil,
-                                             interceptor: RequestInterceptor? = nil,
-                                             requestModifier: RequestModifier? = nil) -> DataRequest {
-        let convertible = RequestEncodableConvertible(url: convertible,
-                                                      method: method,
-                                                      parameters: parameters,
-                                                      encoder: encoder,
-                                                      headers: headers,
-                                                      requestModifier: requestModifier)
-
-        return request(convertible, interceptor: interceptor)
-    }
-
-    /// Creates a `DataRequest` from a `URLRequestConvertible` value and a `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - convertible: `URLRequestConvertible` value to be used to create the `URLRequest`.
-    ///   - interceptor: `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///
-    /// - Returns:       The created `DataRequest`.
-    open func request(_ convertible: URLRequestConvertible, interceptor: RequestInterceptor? = nil) -> DataRequest {
-        let request = DataRequest(convertible: convertible,
-                                  underlyingQueue: rootQueue,
-                                  serializationQueue: serializationQueue,
-                                  eventMonitor: eventMonitor,
-                                  interceptor: interceptor,
-                                  delegate: self)
-
-        perform(request)
-
-        return request
-    }
-
-    // MARK: - DataStreamRequest
-
-    /// Creates a `DataStreamRequest` from the passed components, `Encodable` parameters, and `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - convertible:                      `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - method:                           `HTTPMethod` for the `URLRequest`. `.get` by default.
-    ///   - parameters:                       `Encodable` value to be encoded into the `URLRequest`. `nil` by default.
-    ///   - encoder:                          `ParameterEncoder` to be used to encode the `parameters` value into the
-    ///                                       `URLRequest`.
-    ///                                       `URLEncodedFormParameterEncoder.default` by default.
-    ///   - headers:                          `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - automaticallyCancelOnStreamError: `Bool` indicating whether the instance should be canceled when an `Error`
-    ///                                       is thrown while serializing stream `Data`. `false` by default.
-    ///   - interceptor:                      `RequestInterceptor` value to be used by the returned `DataRequest`. `nil`
-    ///                                       by default.
-    ///   - requestModifier:                  `RequestModifier` which will be applied to the `URLRequest` created from
-    ///                                       the provided parameters. `nil` by default.
-    ///
-    /// - Returns:       The created `DataStream` request.
-    open func streamRequest<Parameters: Encodable>(_ convertible: URLConvertible,
-                                                   method: HTTPMethod = .get,
-                                                   parameters: Parameters? = nil,
-                                                   encoder: ParameterEncoder = URLEncodedFormParameterEncoder.default,
-                                                   headers: HTTPHeaders? = nil,
-                                                   automaticallyCancelOnStreamError: Bool = false,
-                                                   interceptor: RequestInterceptor? = nil,
-                                                   requestModifier: RequestModifier? = nil) -> DataStreamRequest {
-        let convertible = RequestEncodableConvertible(url: convertible,
-                                                      method: method,
-                                                      parameters: parameters,
-                                                      encoder: encoder,
-                                                      headers: headers,
-                                                      requestModifier: requestModifier)
-
-        return streamRequest(convertible,
-                             automaticallyCancelOnStreamError: automaticallyCancelOnStreamError,
-                             interceptor: interceptor)
-    }
-
-    /// Creates a `DataStreamRequest` from the passed components and `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - convertible:                      `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - method:                           `HTTPMethod` for the `URLRequest`. `.get` by default.
-    ///   - headers:                          `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - automaticallyCancelOnStreamError: `Bool` indicating whether the instance should be canceled when an `Error`
-    ///                                       is thrown while serializing stream `Data`. `false` by default.
-    ///   - interceptor:                      `RequestInterceptor` value to be used by the returned `DataRequest`. `nil`
-    ///                                       by default.
-    ///   - requestModifier:                  `RequestModifier` which will be applied to the `URLRequest` created from
-    ///                                       the provided parameters. `nil` by default.
-    ///
-    /// - Returns:       The created `DataStream` request.
-    open func streamRequest(_ convertible: URLConvertible,
-                            method: HTTPMethod = .get,
-                            headers: HTTPHeaders? = nil,
-                            automaticallyCancelOnStreamError: Bool = false,
-                            interceptor: RequestInterceptor? = nil,
-                            requestModifier: RequestModifier? = nil) -> DataStreamRequest {
-        let convertible = RequestEncodableConvertible(url: convertible,
-                                                      method: method,
-                                                      parameters: Empty?.none,
-                                                      encoder: URLEncodedFormParameterEncoder.default,
-                                                      headers: headers,
-                                                      requestModifier: requestModifier)
-
-        return streamRequest(convertible,
-                             automaticallyCancelOnStreamError: automaticallyCancelOnStreamError,
-                             interceptor: interceptor)
-    }
-
-    /// Creates a `DataStreamRequest` from the passed `URLRequestConvertible` value and `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - convertible:                      `URLRequestConvertible` value to be used to create the `URLRequest`.
-    ///   - automaticallyCancelOnStreamError: `Bool` indicating whether the instance should be canceled when an `Error`
-    ///                                       is thrown while serializing stream `Data`. `false` by default.
-    ///   - interceptor:                      `RequestInterceptor` value to be used by the returned `DataRequest`. `nil`
-    ///                                        by default.
-    ///
-    /// - Returns:       The created `DataStreamRequest`.
-    open func streamRequest(_ convertible: URLRequestConvertible,
-                            automaticallyCancelOnStreamError: Bool = false,
-                            interceptor: RequestInterceptor? = nil) -> DataStreamRequest {
-        let request = DataStreamRequest(convertible: convertible,
-                                        automaticallyCancelOnStreamError: automaticallyCancelOnStreamError,
-                                        underlyingQueue: rootQueue,
-                                        serializationQueue: serializationQueue,
-                                        eventMonitor: eventMonitor,
-                                        interceptor: interceptor,
-                                        delegate: self)
-
-        perform(request)
-
-        return request
-    }
-
-    // MARK: - DownloadRequest
-
-    /// Creates a `DownloadRequest` using a `URLRequest` created using the passed components, `RequestInterceptor`, and
-    /// `Destination`.
-    ///
-    /// - Parameters:
-    ///   - convertible:     `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - method:          `HTTPMethod` for the `URLRequest`. `.get` by default.
-    ///   - parameters:      `Parameters` (a.k.a. `[String: Any]`) value to be encoded into the `URLRequest`. `nil` by
-    ///                      default.
-    ///   - encoding:        `ParameterEncoding` to be used to encode the `parameters` value into the `URLRequest`.
-    ///                      Defaults to `URLEncoding.default`.
-    ///   - headers:         `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - interceptor:     `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - requestModifier: `RequestModifier` which will be applied to the `URLRequest` created from the provided
-    ///                      parameters. `nil` by default.
-    ///   - destination:     `DownloadRequest.Destination` closure used to determine how and where the downloaded file
-    ///                      should be moved. `nil` by default.
-    ///
-    /// - Returns:           The created `DownloadRequest`.
-    open func download(_ convertible: URLConvertible,
-                       method: HTTPMethod = .get,
-                       parameters: Parameters? = nil,
-                       encoding: ParameterEncoding = URLEncoding.default,
-                       headers: HTTPHeaders? = nil,
-                       interceptor: RequestInterceptor? = nil,
-                       requestModifier: RequestModifier? = nil,
-                       to destination: DownloadRequest.Destination? = nil) -> DownloadRequest {
-        let convertible = RequestConvertible(url: convertible,
-                                             method: method,
-                                             parameters: parameters,
-                                             encoding: encoding,
-                                             headers: headers,
-                                             requestModifier: requestModifier)
-
-        return download(convertible, interceptor: interceptor, to: destination)
-    }
-
-    /// Creates a `DownloadRequest` from a `URLRequest` created using the passed components, `Encodable` parameters, and
-    /// a `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - convertible:     `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - method:          `HTTPMethod` for the `URLRequest`. `.get` by default.
-    ///   - parameters:      Value conforming to `Encodable` to be encoded into the `URLRequest`. `nil` by default.
-    ///   - encoder:         `ParameterEncoder` to be used to encode the `parameters` value into the `URLRequest`.
-    ///                      Defaults to `URLEncodedFormParameterEncoder.default`.
-    ///   - headers:         `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - interceptor:     `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - requestModifier: `RequestModifier` which will be applied to the `URLRequest` created from the provided
-    ///                      parameters. `nil` by default.
-    ///   - destination:     `DownloadRequest.Destination` closure used to determine how and where the downloaded file
-    ///                      should be moved. `nil` by default.
-    ///
-    /// - Returns:           The created `DownloadRequest`.
-    open func download<Parameters: Encodable>(_ convertible: URLConvertible,
-                                              method: HTTPMethod = .get,
-                                              parameters: Parameters? = nil,
-                                              encoder: ParameterEncoder = URLEncodedFormParameterEncoder.default,
-                                              headers: HTTPHeaders? = nil,
-                                              interceptor: RequestInterceptor? = nil,
-                                              requestModifier: RequestModifier? = nil,
-                                              to destination: DownloadRequest.Destination? = nil) -> DownloadRequest {
-        let convertible = RequestEncodableConvertible(url: convertible,
-                                                      method: method,
-                                                      parameters: parameters,
-                                                      encoder: encoder,
-                                                      headers: headers,
-                                                      requestModifier: requestModifier)
-
-        return download(convertible, interceptor: interceptor, to: destination)
-    }
-
-    /// Creates a `DownloadRequest` from a `URLRequestConvertible` value, a `RequestInterceptor`, and a `Destination`.
-    ///
-    /// - Parameters:
-    ///   - convertible: `URLRequestConvertible` value to be used to create the `URLRequest`.
-    ///   - interceptor: `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - destination: `DownloadRequest.Destination` closure used to determine how and where the downloaded file
-    ///                  should be moved. `nil` by default.
-    ///
-    /// - Returns:       The created `DownloadRequest`.
-    open func download(_ convertible: URLRequestConvertible,
-                       interceptor: RequestInterceptor? = nil,
-                       to destination: DownloadRequest.Destination? = nil) -> DownloadRequest {
-        let request = DownloadRequest(downloadable: .request(convertible),
-                                      underlyingQueue: rootQueue,
-                                      serializationQueue: serializationQueue,
-                                      eventMonitor: eventMonitor,
-                                      interceptor: interceptor,
-                                      delegate: self,
-                                      destination: destination ?? DownloadRequest.defaultDestination)
-
-        perform(request)
-
-        return request
-    }
-
-    /// Creates a `DownloadRequest` from the `resumeData` produced from a previously cancelled `DownloadRequest`, as
-    /// well as a `RequestInterceptor`, and a `Destination`.
-    ///
-    /// - Note: If `destination` is not specified, the download will be moved to a temporary location determined by
-    ///         Alamofire. The file will not be deleted until the system purges the temporary files.
-    ///
-    /// - Note: On some versions of all Apple platforms (iOS 10 - 10.2, macOS 10.12 - 10.12.2, tvOS 10 - 10.1, watchOS 3 - 3.1.1),
-    /// `resumeData` is broken on background URL session configurations. There's an underlying bug in the `resumeData`
-    /// generation logic where the data is written incorrectly and will always fail to resume the download. For more
-    /// information about the bug and possible workarounds, please refer to the [this Stack Overflow post](http://stackoverflow.com/a/39347461/1342462).
-    ///
-    /// - Parameters:
-    ///   - data:        The resume data from a previously cancelled `DownloadRequest` or `URLSessionDownloadTask`.
-    ///   - interceptor: `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - destination: `DownloadRequest.Destination` closure used to determine how and where the downloaded file
-    ///                  should be moved. `nil` by default.
-    ///
-    /// - Returns:       The created `DownloadRequest`.
-    open func download(resumingWith data: Data,
-                       interceptor: RequestInterceptor? = nil,
-                       to destination: DownloadRequest.Destination? = nil) -> DownloadRequest {
-        let request = DownloadRequest(downloadable: .resumeData(data),
-                                      underlyingQueue: rootQueue,
-                                      serializationQueue: serializationQueue,
-                                      eventMonitor: eventMonitor,
-                                      interceptor: interceptor,
-                                      delegate: self,
-                                      destination: destination ?? DownloadRequest.defaultDestination)
-
-        perform(request)
-
-        return request
-    }
-
-    // MARK: - UploadRequest
-
-    struct ParameterlessRequestConvertible: URLRequestConvertible {
-        let url: URLConvertible
-        let method: HTTPMethod
-        let headers: HTTPHeaders?
-        let requestModifier: RequestModifier?
-
-        func asURLRequest() throws -> URLRequest {
-            var request = try URLRequest(url: url, method: method, headers: headers)
-            try requestModifier?(&request)
-
-            return request
-        }
-    }
-
-    struct Upload: UploadConvertible {
-        let request: URLRequestConvertible
-        let uploadable: UploadableConvertible
-
-        func createUploadable() throws -> UploadRequest.Uploadable {
-            try uploadable.createUploadable()
-        }
-
-        func asURLRequest() throws -> URLRequest {
-            try request.asURLRequest()
-        }
-    }
-
-    // MARK: Data
-
-    /// Creates an `UploadRequest` for the given `Data`, `URLRequest` components, and `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - data:            The `Data` to upload.
-    ///   - convertible:     `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - method:          `HTTPMethod` for the `URLRequest`. `.post` by default.
-    ///   - headers:         `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - interceptor:     `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - fileManager:     `FileManager` instance to be used by the returned `UploadRequest`. `.default` instance by
-    ///                      default.
-    ///   - requestModifier: `RequestModifier` which will be applied to the `URLRequest` created from the provided
-    ///                      parameters. `nil` by default.
-    ///
-    /// - Returns:           The created `UploadRequest`.
-    open func upload(_ data: Data,
-                     to convertible: URLConvertible,
-                     method: HTTPMethod = .post,
-                     headers: HTTPHeaders? = nil,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default,
-                     requestModifier: RequestModifier? = nil) -> UploadRequest {
-        let convertible = ParameterlessRequestConvertible(url: convertible,
-                                                          method: method,
-                                                          headers: headers,
-                                                          requestModifier: requestModifier)
-
-        return upload(data, with: convertible, interceptor: interceptor, fileManager: fileManager)
-    }
-
-    /// Creates an `UploadRequest` for the given `Data` using the `URLRequestConvertible` value and `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - data:        The `Data` to upload.
-    ///   - convertible: `URLRequestConvertible` value to be used to create the `URLRequest`.
-    ///   - interceptor: `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - fileManager: `FileManager` instance to be used by the returned `UploadRequest`. `.default` instance by
-    ///                  default.
-    ///
-    /// - Returns:       The created `UploadRequest`.
-    open func upload(_ data: Data,
-                     with convertible: URLRequestConvertible,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default) -> UploadRequest {
-        upload(.data(data), with: convertible, interceptor: interceptor, fileManager: fileManager)
-    }
-
-    // MARK: File
-
-    /// Creates an `UploadRequest` for the file at the given file `URL`, using a `URLRequest` from the provided
-    /// components and `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - fileURL:         The `URL` of the file to upload.
-    ///   - convertible:     `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - method:          `HTTPMethod` for the `URLRequest`. `.post` by default.
-    ///   - headers:         `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - interceptor:     `RequestInterceptor` value to be used by the returned `UploadRequest`. `nil` by default.
-    ///   - fileManager:     `FileManager` instance to be used by the returned `UploadRequest`. `.default` instance by
-    ///                      default.
-    ///   - requestModifier: `RequestModifier` which will be applied to the `URLRequest` created from the provided
-    ///                      parameters. `nil` by default.
-    ///
-    /// - Returns:           The created `UploadRequest`.
-    open func upload(_ fileURL: URL,
-                     to convertible: URLConvertible,
-                     method: HTTPMethod = .post,
-                     headers: HTTPHeaders? = nil,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default,
-                     requestModifier: RequestModifier? = nil) -> UploadRequest {
-        let convertible = ParameterlessRequestConvertible(url: convertible,
-                                                          method: method,
-                                                          headers: headers,
-                                                          requestModifier: requestModifier)
-
-        return upload(fileURL, with: convertible, interceptor: interceptor, fileManager: fileManager)
-    }
-
-    /// Creates an `UploadRequest` for the file at the given file `URL` using the `URLRequestConvertible` value and
-    /// `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - fileURL:     The `URL` of the file to upload.
-    ///   - convertible: `URLRequestConvertible` value to be used to create the `URLRequest`.
-    ///   - interceptor: `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - fileManager: `FileManager` instance to be used by the returned `UploadRequest`. `.default` instance by
-    ///                  default.
-    ///
-    /// - Returns:       The created `UploadRequest`.
-    open func upload(_ fileURL: URL,
-                     with convertible: URLRequestConvertible,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default) -> UploadRequest {
-        upload(.file(fileURL, shouldRemove: false), with: convertible, interceptor: interceptor, fileManager: fileManager)
-    }
-
-    // MARK: InputStream
-
-    /// Creates an `UploadRequest` from the `InputStream` provided using a `URLRequest` from the provided components and
-    /// `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - stream:          The `InputStream` that provides the data to upload.
-    ///   - convertible:     `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - method:          `HTTPMethod` for the `URLRequest`. `.post` by default.
-    ///   - headers:         `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - interceptor:     `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - fileManager:     `FileManager` instance to be used by the returned `UploadRequest`. `.default` instance by
-    ///                      default.
-    ///   - requestModifier: `RequestModifier` which will be applied to the `URLRequest` created from the provided
-    ///                      parameters. `nil` by default.
-    ///
-    /// - Returns:           The created `UploadRequest`.
-    open func upload(_ stream: InputStream,
-                     to convertible: URLConvertible,
-                     method: HTTPMethod = .post,
-                     headers: HTTPHeaders? = nil,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default,
-                     requestModifier: RequestModifier? = nil) -> UploadRequest {
-        let convertible = ParameterlessRequestConvertible(url: convertible,
-                                                          method: method,
-                                                          headers: headers,
-                                                          requestModifier: requestModifier)
-
-        return upload(stream, with: convertible, interceptor: interceptor, fileManager: fileManager)
-    }
-
-    /// Creates an `UploadRequest` from the provided `InputStream` using the `URLRequestConvertible` value and
-    /// `RequestInterceptor`.
-    ///
-    /// - Parameters:
-    ///   - stream:      The `InputStream` that provides the data to upload.
-    ///   - convertible: `URLRequestConvertible` value to be used to create the `URLRequest`.
-    ///   - interceptor: `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - fileManager: `FileManager` instance to be used by the returned `UploadRequest`. `.default` instance by
-    ///                  default.
-    ///
-    /// - Returns:       The created `UploadRequest`.
-    open func upload(_ stream: InputStream,
-                     with convertible: URLRequestConvertible,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default) -> UploadRequest {
-        upload(.stream(stream), with: convertible, interceptor: interceptor, fileManager: fileManager)
-    }
-
-    // MARK: MultipartFormData
-
-    /// Creates an `UploadRequest` for the multipart form data built using a closure and sent using the provided
-    /// `URLRequest` components and `RequestInterceptor`.
-    ///
-    /// It is important to understand the memory implications of uploading `MultipartFormData`. If the cumulative
-    /// payload is small, encoding the data in-memory and directly uploading to a server is the by far the most
-    /// efficient approach. However, if the payload is too large, encoding the data in-memory could cause your app to
-    /// be terminated. Larger payloads must first be written to disk using input and output streams to keep the memory
-    /// footprint low, then the data can be uploaded as a stream from the resulting file. Streaming from disk MUST be
-    /// used for larger payloads such as video content.
-    ///
-    /// The `encodingMemoryThreshold` parameter allows Alamofire to automatically determine whether to encode in-memory
-    /// or stream from disk. If the content length of the `MultipartFormData` is below the `encodingMemoryThreshold`,
-    /// encoding takes place in-memory. If the content length exceeds the threshold, the data is streamed to disk
-    /// during the encoding process. Then the result is uploaded as data or as a stream depending on which encoding
-    /// technique was used.
-    ///
-    /// - Parameters:
-    ///   - multipartFormData:       `MultipartFormData` building closure.
-    ///   - convertible:             `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - encodingMemoryThreshold: Byte threshold used to determine whether the form data is encoded into memory or
-    ///                              onto disk before being uploaded. `MultipartFormData.encodingMemoryThreshold` by
-    ///                              default.
-    ///   - method:                  `HTTPMethod` for the `URLRequest`. `.post` by default.
-    ///   - headers:                 `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - interceptor:             `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - fileManager:             `FileManager` to be used if the form data exceeds the memory threshold and is
-    ///                              written to disk before being uploaded. `.default` instance by default.
-    ///   - requestModifier:         `RequestModifier` which will be applied to the `URLRequest` created from the
-    ///                              provided parameters. `nil` by default.
-    ///
-    /// - Returns:                   The created `UploadRequest`.
-    open func upload(multipartFormData: @escaping (MultipartFormData) -> Void,
-                     to url: URLConvertible,
-                     usingThreshold encodingMemoryThreshold: UInt64 = MultipartFormData.encodingMemoryThreshold,
-                     method: HTTPMethod = .post,
-                     headers: HTTPHeaders? = nil,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default,
-                     requestModifier: RequestModifier? = nil) -> UploadRequest {
-        let convertible = ParameterlessRequestConvertible(url: url,
-                                                          method: method,
-                                                          headers: headers,
-                                                          requestModifier: requestModifier)
-
-        let formData = MultipartFormData(fileManager: fileManager)
-        multipartFormData(formData)
-
-        return upload(multipartFormData: formData,
-                      with: convertible,
-                      usingThreshold: encodingMemoryThreshold,
-                      interceptor: interceptor,
-                      fileManager: fileManager)
-    }
-
-    /// Creates an `UploadRequest` using a `MultipartFormData` building closure, the provided `URLRequestConvertible`
-    /// value, and a `RequestInterceptor`.
-    ///
-    /// It is important to understand the memory implications of uploading `MultipartFormData`. If the cumulative
-    /// payload is small, encoding the data in-memory and directly uploading to a server is the by far the most
-    /// efficient approach. However, if the payload is too large, encoding the data in-memory could cause your app to
-    /// be terminated. Larger payloads must first be written to disk using input and output streams to keep the memory
-    /// footprint low, then the data can be uploaded as a stream from the resulting file. Streaming from disk MUST be
-    /// used for larger payloads such as video content.
-    ///
-    /// The `encodingMemoryThreshold` parameter allows Alamofire to automatically determine whether to encode in-memory
-    /// or stream from disk. If the content length of the `MultipartFormData` is below the `encodingMemoryThreshold`,
-    /// encoding takes place in-memory. If the content length exceeds the threshold, the data is streamed to disk
-    /// during the encoding process. Then the result is uploaded as data or as a stream depending on which encoding
-    /// technique was used.
-    ///
-    /// - Parameters:
-    ///   - multipartFormData:       `MultipartFormData` building closure.
-    ///   - request:                 `URLRequestConvertible` value to be used to create the `URLRequest`.
-    ///   - encodingMemoryThreshold: Byte threshold used to determine whether the form data is encoded into memory or
-    ///                              onto disk before being uploaded. `MultipartFormData.encodingMemoryThreshold` by
-    ///                              default.
-    ///   - interceptor:             `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - fileManager:             `FileManager` to be used if the form data exceeds the memory threshold and is
-    ///                              written to disk before being uploaded. `.default` instance by default.
-    ///
-    /// - Returns:                   The created `UploadRequest`.
-    open func upload(multipartFormData: @escaping (MultipartFormData) -> Void,
-                     with request: URLRequestConvertible,
-                     usingThreshold encodingMemoryThreshold: UInt64 = MultipartFormData.encodingMemoryThreshold,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default) -> UploadRequest {
-        let formData = MultipartFormData(fileManager: fileManager)
-        multipartFormData(formData)
-
-        return upload(multipartFormData: formData,
-                      with: request,
-                      usingThreshold: encodingMemoryThreshold,
-                      interceptor: interceptor,
-                      fileManager: fileManager)
-    }
-
-    /// Creates an `UploadRequest` for the prebuilt `MultipartFormData` value using the provided `URLRequest` components
-    /// and `RequestInterceptor`.
-    ///
-    /// It is important to understand the memory implications of uploading `MultipartFormData`. If the cumulative
-    /// payload is small, encoding the data in-memory and directly uploading to a server is the by far the most
-    /// efficient approach. However, if the payload is too large, encoding the data in-memory could cause your app to
-    /// be terminated. Larger payloads must first be written to disk using input and output streams to keep the memory
-    /// footprint low, then the data can be uploaded as a stream from the resulting file. Streaming from disk MUST be
-    /// used for larger payloads such as video content.
-    ///
-    /// The `encodingMemoryThreshold` parameter allows Alamofire to automatically determine whether to encode in-memory
-    /// or stream from disk. If the content length of the `MultipartFormData` is below the `encodingMemoryThreshold`,
-    /// encoding takes place in-memory. If the content length exceeds the threshold, the data is streamed to disk
-    /// during the encoding process. Then the result is uploaded as data or as a stream depending on which encoding
-    /// technique was used.
-    ///
-    /// - Parameters:
-    ///   - multipartFormData:       `MultipartFormData` instance to upload.
-    ///   - url:                     `URLConvertible` value to be used as the `URLRequest`'s `URL`.
-    ///   - encodingMemoryThreshold: Byte threshold used to determine whether the form data is encoded into memory or
-    ///                              onto disk before being uploaded. `MultipartFormData.encodingMemoryThreshold` by
-    ///                              default.
-    ///   - method:                  `HTTPMethod` for the `URLRequest`. `.post` by default.
-    ///   - headers:                 `HTTPHeaders` value to be added to the `URLRequest`. `nil` by default.
-    ///   - interceptor:             `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - fileManager:             `FileManager` to be used if the form data exceeds the memory threshold and is
-    ///                              written to disk before being uploaded. `.default` instance by default.
-    ///   - requestModifier:         `RequestModifier` which will be applied to the `URLRequest` created from the
-    ///                              provided parameters. `nil` by default.
-    ///
-    /// - Returns:                   The created `UploadRequest`.
-    open func upload(multipartFormData: MultipartFormData,
-                     to url: URLConvertible,
-                     usingThreshold encodingMemoryThreshold: UInt64 = MultipartFormData.encodingMemoryThreshold,
-                     method: HTTPMethod = .post,
-                     headers: HTTPHeaders? = nil,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default,
-                     requestModifier: RequestModifier? = nil) -> UploadRequest {
-        let convertible = ParameterlessRequestConvertible(url: url,
-                                                          method: method,
-                                                          headers: headers,
-                                                          requestModifier: requestModifier)
-
-        let multipartUpload = MultipartUpload(encodingMemoryThreshold: encodingMemoryThreshold,
-                                              request: convertible,
-                                              multipartFormData: multipartFormData)
-
-        return upload(multipartUpload, interceptor: interceptor, fileManager: fileManager)
-    }
-
-    /// Creates an `UploadRequest` for the prebuilt `MultipartFormData` value using the providing `URLRequestConvertible`
-    /// value and `RequestInterceptor`.
-    ///
-    /// It is important to understand the memory implications of uploading `MultipartFormData`. If the cumulative
-    /// payload is small, encoding the data in-memory and directly uploading to a server is the by far the most
-    /// efficient approach. However, if the payload is too large, encoding the data in-memory could cause your app to
-    /// be terminated. Larger payloads must first be written to disk using input and output streams to keep the memory
-    /// footprint low, then the data can be uploaded as a stream from the resulting file. Streaming from disk MUST be
-    /// used for larger payloads such as video content.
-    ///
-    /// The `encodingMemoryThreshold` parameter allows Alamofire to automatically determine whether to encode in-memory
-    /// or stream from disk. If the content length of the `MultipartFormData` is below the `encodingMemoryThreshold`,
-    /// encoding takes place in-memory. If the content length exceeds the threshold, the data is streamed to disk
-    /// during the encoding process. Then the result is uploaded as data or as a stream depending on which encoding
-    /// technique was used.
-    ///
-    /// - Parameters:
-    ///   - multipartFormData:       `MultipartFormData` instance to upload.
-    ///   - request:                 `URLRequestConvertible` value to be used to create the `URLRequest`.
-    ///   - encodingMemoryThreshold: Byte threshold used to determine whether the form data is encoded into memory or
-    ///                              onto disk before being uploaded. `MultipartFormData.encodingMemoryThreshold` by
-    ///                              default.
-    ///   - interceptor:             `RequestInterceptor` value to be used by the returned `DataRequest`. `nil` by default.
-    ///   - fileManager:             `FileManager` instance to be used by the returned `UploadRequest`. `.default` instance by
-    ///                              default.
-    ///
-    /// - Returns:                   The created `UploadRequest`.
-    open func upload(multipartFormData: MultipartFormData,
-                     with request: URLRequestConvertible,
-                     usingThreshold encodingMemoryThreshold: UInt64 = MultipartFormData.encodingMemoryThreshold,
-                     interceptor: RequestInterceptor? = nil,
-                     fileManager: FileManager = .default) -> UploadRequest {
-        let multipartUpload = MultipartUpload(encodingMemoryThreshold: encodingMemoryThreshold,
-                                              request: request,
-                                              multipartFormData: multipartFormData)
-
-        return upload(multipartUpload, interceptor: interceptor, fileManager: fileManager)
-    }
-
-    // MARK: - Internal API
-
-    // MARK: Uploadable
-
-    func upload(_ uploadable: UploadRequest.Uploadable,
-                with convertible: URLRequestConvertible,
-                interceptor: RequestInterceptor?,
-                fileManager: FileManager) -> UploadRequest {
-        let uploadable = Upload(request: convertible, uploadable: uploadable)
-
-        return upload(uploadable, interceptor: interceptor, fileManager: fileManager)
-    }
-
-    func upload(_ upload: UploadConvertible, interceptor: RequestInterceptor?, fileManager: FileManager) -> UploadRequest {
-        let request = UploadRequest(convertible: upload,
-                                    underlyingQueue: rootQueue,
-                                    serializationQueue: serializationQueue,
-                                    eventMonitor: eventMonitor,
-                                    interceptor: interceptor,
-                                    fileManager: fileManager,
-                                    delegate: self)
-
-        perform(request)
-
-        return request
-    }
-
-    // MARK: Perform
-
-    /// Starts performing the provided `Request`.
-    ///
-    /// - Parameter request: The `Request` to perform.
-    func perform(_ request: Request) {
-        rootQueue.async {
-            guard !request.isCancelled else { return }
-
-            self.activeRequests.insert(request)
-
-            self.requestQueue.async {
-                // Leaf types must come first, otherwise they will cast as their superclass.
-                switch request {
-                case let r as UploadRequest: self.performUploadRequest(r) // UploadRequest must come before DataRequest due to subtype relationship.
-                case let r as DataRequest: self.performDataRequest(r)
-                case let r as DownloadRequest: self.performDownloadRequest(r)
-                case let r as DataStreamRequest: self.performDataStreamRequest(r)
-                default: fatalError("Attempted to perform unsupported Request subclass: \(type(of: request))")
-                }
-            }
-        }
-    }
-
-    func performDataRequest(_ request: DataRequest) {
-        dispatchPrecondition(condition: .onQueue(requestQueue))
-
-        performSetupOperations(for: request, convertible: request.convertible)
-    }
-
-    func performDataStreamRequest(_ request: DataStreamRequest) {
-        dispatchPrecondition(condition: .onQueue(requestQueue))
-
-        performSetupOperations(for: request, convertible: request.convertible)
-    }
-
-    func performUploadRequest(_ request: UploadRequest) {
-        dispatchPrecondition(condition: .onQueue(requestQueue))
-
-        performSetupOperations(for: request, convertible: request.convertible) {
-            do {
-                let uploadable = try request.upload.createUploadable()
-                self.rootQueue.async { request.didCreateUploadable(uploadable) }
-                return true
-            } catch {
-                self.rootQueue.async { request.didFailToCreateUploadable(with: error.asAFError(or: .createUploadableFailed(error: error))) }
-                return false
-            }
-        }
-    }
-
-    func performDownloadRequest(_ request: DownloadRequest) {
-        dispatchPrecondition(condition: .onQueue(requestQueue))
-
-        switch request.downloadable {
-        case let .request(convertible):
-            performSetupOperations(for: request, convertible: convertible)
-        case let .resumeData(resumeData):
-            rootQueue.async { self.didReceiveResumeData(resumeData, for: request) }
-        }
-    }
-
-    func performSetupOperations(for request: Request,
-                                convertible: URLRequestConvertible,
-                                shouldCreateTask: @escaping () -> Bool = { true })
-    {
-        dispatchPrecondition(condition: .onQueue(requestQueue))
-
-        let initialRequest: URLRequest
-
-        do {
-            initialRequest = try convertible.asURLRequest()
-            try initialRequest.validate()
-        } catch {
-            rootQueue.async { request.didFailToCreateURLRequest(with: error.asAFError(or: .createURLRequestFailed(error: error))) }
-            return
-        }
-
-        rootQueue.async { request.didCreateInitialURLRequest(initialRequest) }
-
-        guard !request.isCancelled else { return }
-
-        guard let adapter = adapter(for: request) else {
-            guard shouldCreateTask() else { return }
-            rootQueue.async { self.didCreateURLRequest(initialRequest, for: request) }
-            return
-        }
-
-        adapter.adapt(initialRequest, for: self) { result in
-            do {
-                let adaptedRequest = try result.get()
-                try adaptedRequest.validate()
-
-                self.rootQueue.async { request.didAdaptInitialRequest(initialRequest, to: adaptedRequest) }
-
-                guard shouldCreateTask() else { return }
-
-                self.rootQueue.async { self.didCreateURLRequest(adaptedRequest, for: request) }
-            } catch {
-                self.rootQueue.async { request.didFailToAdaptURLRequest(initialRequest, withError: .requestAdaptationFailed(error: error)) }
-            }
-        }
-    }
-
-    // MARK: - Task Handling
-
-    func didCreateURLRequest(_ urlRequest: URLRequest, for request: Request) {
-        dispatchPrecondition(condition: .onQueue(rootQueue))
-
-        request.didCreateURLRequest(urlRequest)
-
-        guard !request.isCancelled else { return }
-
-        let task = request.task(for: urlRequest, using: session)
-        requestTaskMap[request] = task
-        request.didCreateTask(task)
-
-        updateStatesForTask(task, request: request)
-    }
-
-    func didReceiveResumeData(_ data: Data, for request: DownloadRequest) {
-        dispatchPrecondition(condition: .onQueue(rootQueue))
-
-        guard !request.isCancelled else { return }
-
-        let task = request.task(forResumeData: data, using: session)
-        requestTaskMap[request] = task
-        request.didCreateTask(task)
-
-        updateStatesForTask(task, request: request)
-    }
-
-    func updateStatesForTask(_ task: URLSessionTask, request: Request) {
-        dispatchPrecondition(condition: .onQueue(rootQueue))
-
-        request.withState { state in
-            switch state {
-            case .initialized, .finished:
-                // Do nothing.
-                break
-            case .resumed:
-                task.resume()
-                rootQueue.async { request.didResumeTask(task) }
-            case .suspended:
-                task.suspend()
-                rootQueue.async { request.didSuspendTask(task) }
-            case .cancelled:
-                // Resume to ensure metrics are gathered.
-                task.resume()
-                task.cancel()
-                rootQueue.async { request.didCancelTask(task) }
-            }
-        }
-    }
-
-    // MARK: - Adapters and Retriers
-
-    func adapter(for request: Request) -> RequestAdapter? {
-        if let requestInterceptor = request.interceptor, let sessionInterceptor = interceptor {
-            return Interceptor(adapters: [requestInterceptor, sessionInterceptor])
-        } else {
-            return request.interceptor ?? interceptor
-        }
-    }
-
-    func retrier(for request: Request) -> RequestRetrier? {
-        if let requestInterceptor = request.interceptor, let sessionInterceptor = interceptor {
-            return Interceptor(retriers: [requestInterceptor, sessionInterceptor])
-        } else {
-            return request.interceptor ?? interceptor
-        }
-    }
-
-    // MARK: - Invalidation
-
-    func finishRequestsForDeinit() {
-        requestTaskMap.requests.forEach { request in
-            rootQueue.async {
-                request.finish(error: AFError.sessionDeinitialized)
-            }
-        }
-    }
-}
-
-// MARK: - RequestDelegate
-
-extension Session: RequestDelegate {
-    public var sessionConfiguration: URLSessionConfiguration {
-        session.configuration
-    }
-
-    public var startImmediately: Bool { startRequestsImmediately }
-
-    public func cleanup(after request: Request) {
-        activeRequests.remove(request)
-    }
-
-    public func retryResult(for request: Request, dueTo error: AFError, completion: @escaping (RetryResult) -> Void) {
-        guard let retrier = retrier(for: request) else {
-            rootQueue.async { completion(.doNotRetry) }
-            return
-        }
-
-        retrier.retry(request, for: self, dueTo: error) { retryResult in
-            self.rootQueue.async {
-                guard let retryResultError = retryResult.error else { completion(retryResult); return }
-
-                let retryError = AFError.requestRetryFailed(retryError: retryResultError, originalError: error)
-                completion(.doNotRetryWithError(retryError))
-            }
-        }
-    }
-
-    public func retryRequest(_ request: Request, withDelay timeDelay: TimeInterval?) {
-        rootQueue.async {
-            let retry: () -> Void = {
-                guard !request.isCancelled else { return }
-
-                request.prepareForRetry()
-                self.perform(request)
-            }
-
-            if let retryDelay = timeDelay {
-                self.rootQueue.after(retryDelay) { retry() }
-            } else {
-                retry()
-            }
-        }
-    }
-}
-
-// MARK: - SessionStateProvider
-
-extension Session: SessionStateProvider {
-    func request(for task: URLSessionTask) -> Request? {
-        dispatchPrecondition(condition: .onQueue(rootQueue))
-
-        return requestTaskMap[task]
-    }
-
-    func didGatherMetricsForTask(_ task: URLSessionTask) {
-        dispatchPrecondition(condition: .onQueue(rootQueue))
-
-        let didDisassociate = requestTaskMap.disassociateIfNecessaryAfterGatheringMetricsForTask(task)
-
-        if didDisassociate {
-            waitingCompletions[task]?()
-            waitingCompletions[task] = nil
-        }
-    }
-
-    func didCompleteTask(_ task: URLSessionTask, completion: @escaping () -> Void) {
-        dispatchPrecondition(condition: .onQueue(rootQueue))
-
-        let didDisassociate = requestTaskMap.disassociateIfNecessaryAfterCompletingTask(task)
-
-        if didDisassociate {
-            completion()
-        } else {
-            waitingCompletions[task] = completion
-        }
-    }
-
-    func credential(for task: URLSessionTask, in protectionSpace: URLProtectionSpace) -> URLCredential? {
-        dispatchPrecondition(condition: .onQueue(rootQueue))
-
-        return requestTaskMap[task]?.credential ??
-            session.configuration.urlCredentialStorage?.defaultCredential(for: protectionSpace)
-    }
-
-    func cancelRequestsForSessionInvalidation(with error: Error?) {
-        dispatchPrecondition(condition: .onQueue(rootQueue))
-
-        requestTaskMap.requests.forEach { $0.finish(error: AFError.sessionInvalidated(error: error)) }
-    }
-}
diff --git a/Pods/Alamofire/Source/SessionDelegate.swift b/Pods/Alamofire/Source/SessionDelegate.swift
deleted file mode 100644
index befc80eab..000000000
--- a/Pods/Alamofire/Source/SessionDelegate.swift
+++ /dev/null
@@ -1,330 +0,0 @@
-//
-//  SessionDelegate.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// Class which implements the various `URLSessionDelegate` methods to connect various Alamofire features.
-open class SessionDelegate: NSObject {
-    private let fileManager: FileManager
-
-    weak var stateProvider: SessionStateProvider?
-    var eventMonitor: EventMonitor?
-
-    /// Creates an instance from the given `FileManager`.
-    ///
-    /// - Parameter fileManager: `FileManager` to use for underlying file management, such as moving downloaded files.
-    ///                          `.default` by default.
-    public init(fileManager: FileManager = .default) {
-        self.fileManager = fileManager
-    }
-
-    /// Internal method to find and cast requests while maintaining some integrity checking.
-    ///
-    /// - Parameters:
-    ///   - task: The `URLSessionTask` for which to find the associated `Request`.
-    ///   - type: The `Request` subclass type to cast any `Request` associate with `task`.
-    func request<R: Request>(for task: URLSessionTask, as type: R.Type) -> R? {
-        guard let provider = stateProvider else {
-            assertionFailure("StateProvider is nil.")
-            return nil
-        }
-
-        return provider.request(for: task) as? R
-    }
-}
-
-/// Type which provides various `Session` state values.
-protocol SessionStateProvider: AnyObject {
-    var serverTrustManager: ServerTrustManager? { get }
-    var redirectHandler: RedirectHandler? { get }
-    var cachedResponseHandler: CachedResponseHandler? { get }
-
-    func request(for task: URLSessionTask) -> Request?
-    func didGatherMetricsForTask(_ task: URLSessionTask)
-    func didCompleteTask(_ task: URLSessionTask, completion: @escaping () -> Void)
-    func credential(for task: URLSessionTask, in protectionSpace: URLProtectionSpace) -> URLCredential?
-    func cancelRequestsForSessionInvalidation(with error: Error?)
-}
-
-// MARK: URLSessionDelegate
-
-extension SessionDelegate: URLSessionDelegate {
-    open func urlSession(_ session: URLSession, didBecomeInvalidWithError error: Error?) {
-        eventMonitor?.urlSession(session, didBecomeInvalidWithError: error)
-
-        stateProvider?.cancelRequestsForSessionInvalidation(with: error)
-    }
-}
-
-// MARK: URLSessionTaskDelegate
-
-extension SessionDelegate: URLSessionTaskDelegate {
-    /// Result of a `URLAuthenticationChallenge` evaluation.
-    typealias ChallengeEvaluation = (disposition: URLSession.AuthChallengeDisposition, credential: URLCredential?, error: AFError?)
-
-    open func urlSession(_ session: URLSession,
-                         task: URLSessionTask,
-                         didReceive challenge: URLAuthenticationChallenge,
-                         completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
-        eventMonitor?.urlSession(session, task: task, didReceive: challenge)
-
-        let evaluation: ChallengeEvaluation
-        switch challenge.protectionSpace.authenticationMethod {
-        case NSURLAuthenticationMethodServerTrust:
-            evaluation = attemptServerTrustAuthentication(with: challenge)
-        case NSURLAuthenticationMethodHTTPBasic, NSURLAuthenticationMethodHTTPDigest, NSURLAuthenticationMethodNTLM,
-             NSURLAuthenticationMethodNegotiate, NSURLAuthenticationMethodClientCertificate:
-            evaluation = attemptCredentialAuthentication(for: challenge, belongingTo: task)
-        default:
-            evaluation = (.performDefaultHandling, nil, nil)
-        }
-
-        if let error = evaluation.error {
-            stateProvider?.request(for: task)?.didFailTask(task, earlyWithError: error)
-        }
-
-        completionHandler(evaluation.disposition, evaluation.credential)
-    }
-
-    /// Evaluates the server trust `URLAuthenticationChallenge` received.
-    ///
-    /// - Parameter challenge: The `URLAuthenticationChallenge`.
-    ///
-    /// - Returns:             The `ChallengeEvaluation`.
-    func attemptServerTrustAuthentication(with challenge: URLAuthenticationChallenge) -> ChallengeEvaluation {
-        let host = challenge.protectionSpace.host
-
-        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
-              let trust = challenge.protectionSpace.serverTrust
-        else {
-            return (.performDefaultHandling, nil, nil)
-        }
-
-        do {
-            guard let evaluator = try stateProvider?.serverTrustManager?.serverTrustEvaluator(forHost: host) else {
-                return (.performDefaultHandling, nil, nil)
-            }
-
-            try evaluator.evaluate(trust, forHost: host)
-
-            return (.useCredential, URLCredential(trust: trust), nil)
-        } catch {
-            return (.cancelAuthenticationChallenge, nil, error.asAFError(or: .serverTrustEvaluationFailed(reason: .customEvaluationFailed(error: error))))
-        }
-    }
-
-    /// Evaluates the credential-based authentication `URLAuthenticationChallenge` received for `task`.
-    ///
-    /// - Parameters:
-    ///   - challenge: The `URLAuthenticationChallenge`.
-    ///   - task:      The `URLSessionTask` which received the challenge.
-    ///
-    /// - Returns:     The `ChallengeEvaluation`.
-    func attemptCredentialAuthentication(for challenge: URLAuthenticationChallenge,
-                                         belongingTo task: URLSessionTask) -> ChallengeEvaluation {
-        guard challenge.previousFailureCount == 0 else {
-            return (.rejectProtectionSpace, nil, nil)
-        }
-
-        guard let credential = stateProvider?.credential(for: task, in: challenge.protectionSpace) else {
-            return (.performDefaultHandling, nil, nil)
-        }
-
-        return (.useCredential, credential, nil)
-    }
-
-    open func urlSession(_ session: URLSession,
-                         task: URLSessionTask,
-                         didSendBodyData bytesSent: Int64,
-                         totalBytesSent: Int64,
-                         totalBytesExpectedToSend: Int64) {
-        eventMonitor?.urlSession(session,
-                                 task: task,
-                                 didSendBodyData: bytesSent,
-                                 totalBytesSent: totalBytesSent,
-                                 totalBytesExpectedToSend: totalBytesExpectedToSend)
-
-        stateProvider?.request(for: task)?.updateUploadProgress(totalBytesSent: totalBytesSent,
-                                                                totalBytesExpectedToSend: totalBytesExpectedToSend)
-    }
-
-    open func urlSession(_ session: URLSession,
-                         task: URLSessionTask,
-                         needNewBodyStream completionHandler: @escaping (InputStream?) -> Void) {
-        eventMonitor?.urlSession(session, taskNeedsNewBodyStream: task)
-
-        guard let request = request(for: task, as: UploadRequest.self) else {
-            assertionFailure("needNewBodyStream did not find UploadRequest.")
-            completionHandler(nil)
-            return
-        }
-
-        completionHandler(request.inputStream())
-    }
-
-    open func urlSession(_ session: URLSession,
-                         task: URLSessionTask,
-                         willPerformHTTPRedirection response: HTTPURLResponse,
-                         newRequest request: URLRequest,
-                         completionHandler: @escaping (URLRequest?) -> Void) {
-        eventMonitor?.urlSession(session, task: task, willPerformHTTPRedirection: response, newRequest: request)
-
-        if let redirectHandler = stateProvider?.request(for: task)?.redirectHandler ?? stateProvider?.redirectHandler {
-            redirectHandler.task(task, willBeRedirectedTo: request, for: response, completion: completionHandler)
-        } else {
-            completionHandler(request)
-        }
-    }
-
-    open func urlSession(_ session: URLSession, task: URLSessionTask, didFinishCollecting metrics: URLSessionTaskMetrics) {
-        eventMonitor?.urlSession(session, task: task, didFinishCollecting: metrics)
-
-        stateProvider?.request(for: task)?.didGatherMetrics(metrics)
-
-        stateProvider?.didGatherMetricsForTask(task)
-    }
-
-    open func urlSession(_ session: URLSession, task: URLSessionTask, didCompleteWithError error: Error?) {
-        eventMonitor?.urlSession(session, task: task, didCompleteWithError: error)
-
-        let request = stateProvider?.request(for: task)
-
-        stateProvider?.didCompleteTask(task) {
-            request?.didCompleteTask(task, with: error.map { $0.asAFError(or: .sessionTaskFailed(error: $0)) })
-        }
-    }
-
-    @available(macOS 10.13, iOS 11.0, tvOS 11.0, watchOS 4.0, *)
-    open func urlSession(_ session: URLSession, taskIsWaitingForConnectivity task: URLSessionTask) {
-        eventMonitor?.urlSession(session, taskIsWaitingForConnectivity: task)
-    }
-}
-
-// MARK: URLSessionDataDelegate
-
-extension SessionDelegate: URLSessionDataDelegate {
-    open func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive data: Data) {
-        eventMonitor?.urlSession(session, dataTask: dataTask, didReceive: data)
-
-        if let request = request(for: dataTask, as: DataRequest.self) {
-            request.didReceive(data: data)
-        } else if let request = request(for: dataTask, as: DataStreamRequest.self) {
-            request.didReceive(data: data)
-        } else {
-            assertionFailure("dataTask did not find DataRequest or DataStreamRequest in didReceive")
-            return
-        }
-    }
-
-    open func urlSession(_ session: URLSession,
-                         dataTask: URLSessionDataTask,
-                         willCacheResponse proposedResponse: CachedURLResponse,
-                         completionHandler: @escaping (CachedURLResponse?) -> Void) {
-        eventMonitor?.urlSession(session, dataTask: dataTask, willCacheResponse: proposedResponse)
-
-        if let handler = stateProvider?.request(for: dataTask)?.cachedResponseHandler ?? stateProvider?.cachedResponseHandler {
-            handler.dataTask(dataTask, willCacheResponse: proposedResponse, completion: completionHandler)
-        } else {
-            completionHandler(proposedResponse)
-        }
-    }
-}
-
-// MARK: URLSessionDownloadDelegate
-
-extension SessionDelegate: URLSessionDownloadDelegate {
-    open func urlSession(_ session: URLSession,
-                         downloadTask: URLSessionDownloadTask,
-                         didResumeAtOffset fileOffset: Int64,
-                         expectedTotalBytes: Int64) {
-        eventMonitor?.urlSession(session,
-                                 downloadTask: downloadTask,
-                                 didResumeAtOffset: fileOffset,
-                                 expectedTotalBytes: expectedTotalBytes)
-        guard let downloadRequest = request(for: downloadTask, as: DownloadRequest.self) else {
-            assertionFailure("downloadTask did not find DownloadRequest.")
-            return
-        }
-
-        downloadRequest.updateDownloadProgress(bytesWritten: fileOffset,
-                                               totalBytesExpectedToWrite: expectedTotalBytes)
-    }
-
-    open func urlSession(_ session: URLSession,
-                         downloadTask: URLSessionDownloadTask,
-                         didWriteData bytesWritten: Int64,
-                         totalBytesWritten: Int64,
-                         totalBytesExpectedToWrite: Int64) {
-        eventMonitor?.urlSession(session,
-                                 downloadTask: downloadTask,
-                                 didWriteData: bytesWritten,
-                                 totalBytesWritten: totalBytesWritten,
-                                 totalBytesExpectedToWrite: totalBytesExpectedToWrite)
-        guard let downloadRequest = request(for: downloadTask, as: DownloadRequest.self) else {
-            assertionFailure("downloadTask did not find DownloadRequest.")
-            return
-        }
-
-        downloadRequest.updateDownloadProgress(bytesWritten: bytesWritten,
-                                               totalBytesExpectedToWrite: totalBytesExpectedToWrite)
-    }
-
-    open func urlSession(_ session: URLSession, downloadTask: URLSessionDownloadTask, didFinishDownloadingTo location: URL) {
-        eventMonitor?.urlSession(session, downloadTask: downloadTask, didFinishDownloadingTo: location)
-
-        guard let request = request(for: downloadTask, as: DownloadRequest.self) else {
-            assertionFailure("downloadTask did not find DownloadRequest.")
-            return
-        }
-
-        let (destination, options): (URL, DownloadRequest.Options)
-        if let response = request.response {
-            (destination, options) = request.destination(location, response)
-        } else {
-            // If there's no response this is likely a local file download, so generate the temporary URL directly.
-            (destination, options) = (DownloadRequest.defaultDestinationURL(location), [])
-        }
-
-        eventMonitor?.request(request, didCreateDestinationURL: destination)
-
-        do {
-            if options.contains(.removePreviousFile), fileManager.fileExists(atPath: destination.path) {
-                try fileManager.removeItem(at: destination)
-            }
-
-            if options.contains(.createIntermediateDirectories) {
-                let directory = destination.deletingLastPathComponent()
-                try fileManager.createDirectory(at: directory, withIntermediateDirectories: true)
-            }
-
-            try fileManager.moveItem(at: location, to: destination)
-
-            request.didFinishDownloading(using: downloadTask, with: .success(destination))
-        } catch {
-            request.didFinishDownloading(using: downloadTask, with: .failure(.downloadedFileMoveFailed(error: error,
-                                                                                                       source: location,
-                                                                                                       destination: destination)))
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/StringEncoding+Alamofire.swift b/Pods/Alamofire/Source/StringEncoding+Alamofire.swift
deleted file mode 100644
index 8fa613336..000000000
--- a/Pods/Alamofire/Source/StringEncoding+Alamofire.swift
+++ /dev/null
@@ -1,55 +0,0 @@
-//
-//  StringEncoding+Alamofire.swift
-//
-//  Copyright (c) 2020 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-extension String.Encoding {
-    /// Creates an encoding from the IANA charset name.
-    ///
-    /// - Notes: These mappings match those [provided by CoreFoundation](https://opensource.apple.com/source/CF/CF-476.18/CFStringUtilities.c.auto.html)
-    ///
-    /// - Parameter name: IANA charset name.
-    init?(ianaCharsetName name: String) {
-        switch name.lowercased() {
-        case "utf-8":
-            self = .utf8
-        case "iso-8859-1":
-            self = .isoLatin1
-        case "unicode-1-1", "iso-10646-ucs-2", "utf-16":
-            self = .utf16
-        case "utf-16be":
-            self = .utf16BigEndian
-        case "utf-16le":
-            self = .utf16LittleEndian
-        case "utf-32":
-            self = .utf32
-        case "utf-32be":
-            self = .utf32BigEndian
-        case "utf-32le":
-            self = .utf32LittleEndian
-        default:
-            return nil
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/URLConvertible+URLRequestConvertible.swift b/Pods/Alamofire/Source/URLConvertible+URLRequestConvertible.swift
deleted file mode 100644
index 455c4bcbb..000000000
--- a/Pods/Alamofire/Source/URLConvertible+URLRequestConvertible.swift
+++ /dev/null
@@ -1,105 +0,0 @@
-//
-//  URLConvertible+URLRequestConvertible.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// Types adopting the `URLConvertible` protocol can be used to construct `URL`s, which can then be used to construct
-/// `URLRequests`.
-public protocol URLConvertible {
-    /// Returns a `URL` from the conforming instance or throws.
-    ///
-    /// - Returns: The `URL` created from the instance.
-    /// - Throws:  Any error thrown while creating the `URL`.
-    func asURL() throws -> URL
-}
-
-extension String: URLConvertible {
-    /// Returns a `URL` if `self` can be used to initialize a `URL` instance, otherwise throws.
-    ///
-    /// - Returns: The `URL` initialized with `self`.
-    /// - Throws:  An `AFError.invalidURL` instance.
-    public func asURL() throws -> URL {
-        guard let url = URL(string: self) else { throw AFError.invalidURL(url: self) }
-
-        return url
-    }
-}
-
-extension URL: URLConvertible {
-    /// Returns `self`.
-    public func asURL() throws -> URL { self }
-}
-
-extension URLComponents: URLConvertible {
-    /// Returns a `URL` if the `self`'s `url` is not nil, otherwise throws.
-    ///
-    /// - Returns: The `URL` from the `url` property.
-    /// - Throws:  An `AFError.invalidURL` instance.
-    public func asURL() throws -> URL {
-        guard let url = url else { throw AFError.invalidURL(url: self) }
-
-        return url
-    }
-}
-
-// MARK: -
-
-/// Types adopting the `URLRequestConvertible` protocol can be used to safely construct `URLRequest`s.
-public protocol URLRequestConvertible {
-    /// Returns a `URLRequest` or throws if an `Error` was encountered.
-    ///
-    /// - Returns: A `URLRequest`.
-    /// - Throws:  Any error thrown while constructing the `URLRequest`.
-    func asURLRequest() throws -> URLRequest
-}
-
-extension URLRequestConvertible {
-    /// The `URLRequest` returned by discarding any `Error` encountered.
-    public var urlRequest: URLRequest? { try? asURLRequest() }
-}
-
-extension URLRequest: URLRequestConvertible {
-    /// Returns `self`.
-    public func asURLRequest() throws -> URLRequest { self }
-}
-
-// MARK: -
-
-extension URLRequest {
-    /// Creates an instance with the specified `url`, `method`, and `headers`.
-    ///
-    /// - Parameters:
-    ///   - url:     The `URLConvertible` value.
-    ///   - method:  The `HTTPMethod`.
-    ///   - headers: The `HTTPHeaders`, `nil` by default.
-    /// - Throws:    Any error thrown while converting the `URLConvertible` to a `URL`.
-    public init(url: URLConvertible, method: HTTPMethod, headers: HTTPHeaders? = nil) throws {
-        let url = try url.asURL()
-
-        self.init(url: url)
-
-        httpMethod = method.rawValue
-        allHTTPHeaderFields = headers?.dictionary
-    }
-}
diff --git a/Pods/Alamofire/Source/URLEncodedFormEncoder.swift b/Pods/Alamofire/Source/URLEncodedFormEncoder.swift
deleted file mode 100644
index e5cc0c50f..000000000
--- a/Pods/Alamofire/Source/URLEncodedFormEncoder.swift
+++ /dev/null
@@ -1,976 +0,0 @@
-//
-//  URLEncodedFormEncoder.swift
-//
-//  Copyright (c) 2019 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-/// An object that encodes instances into URL-encoded query strings.
-///
-/// There is no published specification for how to encode collection types. By default, the convention of appending
-/// `[]` to the key for array values (`foo[]=1&foo[]=2`), and appending the key surrounded by square brackets for
-/// nested dictionary values (`foo[bar]=baz`) is used. Optionally, `ArrayEncoding` can be used to omit the
-/// square brackets appended to array keys.
-///
-/// `BoolEncoding` can be used to configure how `Bool` values are encoded. The default behavior is to encode
-/// `true` as 1 and `false` as 0.
-///
-/// `DateEncoding` can be used to configure how `Date` values are encoded. By default, the `.deferredToDate`
-/// strategy is used, which formats dates from their structure.
-///
-/// `SpaceEncoding` can be used to configure how spaces are encoded. Modern encodings use percent replacement (`%20`),
-/// while older encodings may expect spaces to be replaced with `+`.
-///
-/// This type is largely based on Vapor's [`url-encoded-form`](https://github.com/vapor/url-encoded-form) project.
-public final class URLEncodedFormEncoder {
-    /// Encoding to use for `Array` values.
-    public enum ArrayEncoding {
-        /// An empty set of square brackets ("[]") are appended to the key for every value. This is the default encoding.
-        case brackets
-        /// No brackets are appended to the key and the key is encoded as is.
-        case noBrackets
-
-        /// Encodes the key according to the encoding.
-        ///
-        /// - Parameter key: The `key` to encode.
-        /// - Returns:       The encoded key.
-        func encode(_ key: String) -> String {
-            switch self {
-            case .brackets: return "\(key)[]"
-            case .noBrackets: return key
-            }
-        }
-    }
-
-    /// Encoding to use for `Bool` values.
-    public enum BoolEncoding {
-        /// Encodes `true` as `1`, `false` as `0`.
-        case numeric
-        /// Encodes `true` as "true", `false` as "false". This is the default encoding.
-        case literal
-
-        /// Encodes the given `Bool` as a `String`.
-        ///
-        /// - Parameter value: The `Bool` to encode.
-        ///
-        /// - Returns:         The encoded `String`.
-        func encode(_ value: Bool) -> String {
-            switch self {
-            case .numeric: return value ? "1" : "0"
-            case .literal: return value ? "true" : "false"
-            }
-        }
-    }
-
-    /// Encoding to use for `Data` values.
-    public enum DataEncoding {
-        /// Defers encoding to the `Data` type.
-        case deferredToData
-        /// Encodes `Data` as a Base64-encoded string. This is the default encoding.
-        case base64
-        /// Encode the `Data` as a custom value encoded by the given closure.
-        case custom((Data) throws -> String)
-
-        /// Encodes `Data` according to the encoding.
-        ///
-        /// - Parameter data: The `Data` to encode.
-        ///
-        /// - Returns:        The encoded `String`, or `nil` if the `Data` should be encoded according to its
-        ///                   `Encodable` implementation.
-        func encode(_ data: Data) throws -> String? {
-            switch self {
-            case .deferredToData: return nil
-            case .base64: return data.base64EncodedString()
-            case let .custom(encoding): return try encoding(data)
-            }
-        }
-    }
-
-    /// Encoding to use for `Date` values.
-    public enum DateEncoding {
-        /// ISO8601 and RFC3339 formatter.
-        private static let iso8601Formatter: ISO8601DateFormatter = {
-            let formatter = ISO8601DateFormatter()
-            formatter.formatOptions = .withInternetDateTime
-            return formatter
-        }()
-
-        /// Defers encoding to the `Date` type. This is the default encoding.
-        case deferredToDate
-        /// Encodes `Date`s as seconds since midnight UTC on January 1, 1970.
-        case secondsSince1970
-        /// Encodes `Date`s as milliseconds since midnight UTC on January 1, 1970.
-        case millisecondsSince1970
-        /// Encodes `Date`s according to the ISO8601 and RFC3339 standards.
-        case iso8601
-        /// Encodes `Date`s using the given `DateFormatter`.
-        case formatted(DateFormatter)
-        /// Encodes `Date`s using the given closure.
-        case custom((Date) throws -> String)
-
-        /// Encodes the date according to the encoding.
-        ///
-        /// - Parameter date: The `Date` to encode.
-        ///
-        /// - Returns:        The encoded `String`, or `nil` if the `Date` should be encoded according to its
-        ///                   `Encodable` implementation.
-        func encode(_ date: Date) throws -> String? {
-            switch self {
-            case .deferredToDate:
-                return nil
-            case .secondsSince1970:
-                return String(date.timeIntervalSince1970)
-            case .millisecondsSince1970:
-                return String(date.timeIntervalSince1970 * 1000.0)
-            case .iso8601:
-                return DateEncoding.iso8601Formatter.string(from: date)
-            case let .formatted(formatter):
-                return formatter.string(from: date)
-            case let .custom(closure):
-                return try closure(date)
-            }
-        }
-    }
-
-    /// Encoding to use for keys.
-    ///
-    /// This type is derived from [`JSONEncoder`'s `KeyEncodingStrategy`](https://github.com/apple/swift/blob/6aa313b8dd5f05135f7f878eccc1db6f9fbe34ff/stdlib/public/Darwin/Foundation/JSONEncoder.swift#L128)
-    /// and [`XMLEncoder`s `KeyEncodingStrategy`](https://github.com/MaxDesiatov/XMLCoder/blob/master/Sources/XMLCoder/Encoder/XMLEncoder.swift#L102).
-    public enum KeyEncoding {
-        /// Use the keys specified by each type. This is the default encoding.
-        case useDefaultKeys
-        /// Convert from "camelCaseKeys" to "snake_case_keys" before writing a key.
-        ///
-        /// Capital characters are determined by testing membership in
-        /// `CharacterSet.uppercaseLetters` and `CharacterSet.lowercaseLetters`
-        /// (Unicode General Categories Lu and Lt).
-        /// The conversion to lower case uses `Locale.system`, also known as
-        /// the ICU "root" locale. This means the result is consistent
-        /// regardless of the current user's locale and language preferences.
-        ///
-        /// Converting from camel case to snake case:
-        /// 1. Splits words at the boundary of lower-case to upper-case
-        /// 2. Inserts `_` between words
-        /// 3. Lowercases the entire string
-        /// 4. Preserves starting and ending `_`.
-        ///
-        /// For example, `oneTwoThree` becomes `one_two_three`. `_oneTwoThree_` becomes `_one_two_three_`.
-        ///
-        /// - Note: Using a key encoding strategy has a nominal performance cost, as each string key has to be converted.
-        case convertToSnakeCase
-        /// Same as convertToSnakeCase, but using `-` instead of `_`.
-        /// For example `oneTwoThree` becomes `one-two-three`.
-        case convertToKebabCase
-        /// Capitalize the first letter only.
-        /// For example `oneTwoThree` becomes  `OneTwoThree`.
-        case capitalized
-        /// Uppercase all letters.
-        /// For example `oneTwoThree` becomes  `ONETWOTHREE`.
-        case uppercased
-        /// Lowercase all letters.
-        /// For example `oneTwoThree` becomes  `onetwothree`.
-        case lowercased
-        /// A custom encoding using the provided closure.
-        case custom((String) -> String)
-
-        func encode(_ key: String) -> String {
-            switch self {
-            case .useDefaultKeys: return key
-            case .convertToSnakeCase: return convertToSnakeCase(key)
-            case .convertToKebabCase: return convertToKebabCase(key)
-            case .capitalized: return String(key.prefix(1).uppercased() + key.dropFirst())
-            case .uppercased: return key.uppercased()
-            case .lowercased: return key.lowercased()
-            case let .custom(encoding): return encoding(key)
-            }
-        }
-
-        private func convertToSnakeCase(_ key: String) -> String {
-            convert(key, usingSeparator: "_")
-        }
-
-        private func convertToKebabCase(_ key: String) -> String {
-            convert(key, usingSeparator: "-")
-        }
-
-        private func convert(_ key: String, usingSeparator separator: String) -> String {
-            guard !key.isEmpty else { return key }
-
-            var words: [Range<String.Index>] = []
-            // The general idea of this algorithm is to split words on
-            // transition from lower to upper case, then on transition of >1
-            // upper case characters to lowercase
-            //
-            // myProperty -> my_property
-            // myURLProperty -> my_url_property
-            //
-            // It is assumed, per Swift naming conventions, that the first character of the key is lowercase.
-            var wordStart = key.startIndex
-            var searchRange = key.index(after: wordStart)..<key.endIndex
-
-            // Find next uppercase character
-            while let upperCaseRange = key.rangeOfCharacter(from: CharacterSet.uppercaseLetters, options: [], range: searchRange) {
-                let untilUpperCase = wordStart..<upperCaseRange.lowerBound
-                words.append(untilUpperCase)
-
-                // Find next lowercase character
-                searchRange = upperCaseRange.lowerBound..<searchRange.upperBound
-                guard let lowerCaseRange = key.rangeOfCharacter(from: CharacterSet.lowercaseLetters, options: [], range: searchRange) else {
-                    // There are no more lower case letters. Just end here.
-                    wordStart = searchRange.lowerBound
-                    break
-                }
-
-                // Is the next lowercase letter more than 1 after the uppercase?
-                // If so, we encountered a group of uppercase letters that we
-                // should treat as its own word
-                let nextCharacterAfterCapital = key.index(after: upperCaseRange.lowerBound)
-                if lowerCaseRange.lowerBound == nextCharacterAfterCapital {
-                    // The next character after capital is a lower case character and therefore not a word boundary.
-                    // Continue searching for the next upper case for the boundary.
-                    wordStart = upperCaseRange.lowerBound
-                } else {
-                    // There was a range of >1 capital letters. Turn those into a word, stopping at the capital before the lower case character.
-                    let beforeLowerIndex = key.index(before: lowerCaseRange.lowerBound)
-                    words.append(upperCaseRange.lowerBound..<beforeLowerIndex)
-
-                    // Next word starts at the capital before the lowercase we just found
-                    wordStart = beforeLowerIndex
-                }
-                searchRange = lowerCaseRange.upperBound..<searchRange.upperBound
-            }
-            words.append(wordStart..<searchRange.upperBound)
-            let result = words.map { range in
-                key[range].lowercased()
-            }.joined(separator: separator)
-
-            return result
-        }
-    }
-
-    /// Encoding to use for spaces.
-    public enum SpaceEncoding {
-        /// Encodes spaces according to normal percent escaping rules (%20).
-        case percentEscaped
-        /// Encodes spaces as `+`,
-        case plusReplaced
-
-        /// Encodes the string according to the encoding.
-        ///
-        /// - Parameter string: The `String` to encode.
-        ///
-        /// - Returns:          The encoded `String`.
-        func encode(_ string: String) -> String {
-            switch self {
-            case .percentEscaped: return string.replacingOccurrences(of: " ", with: "%20")
-            case .plusReplaced: return string.replacingOccurrences(of: " ", with: "+")
-            }
-        }
-    }
-
-    /// `URLEncodedFormEncoder` error.
-    public enum Error: Swift.Error {
-        /// An invalid root object was created by the encoder. Only keyed values are valid.
-        case invalidRootObject(String)
-
-        var localizedDescription: String {
-            switch self {
-            case let .invalidRootObject(object):
-                return "URLEncodedFormEncoder requires keyed root object. Received \(object) instead."
-            }
-        }
-    }
-
-    /// Whether or not to sort the encoded key value pairs.
-    ///
-    /// - Note: This setting ensures a consistent ordering for all encodings of the same parameters. When set to `false`,
-    ///         encoded `Dictionary` values may have a different encoded order each time they're encoded due to
-    ///       ` Dictionary`'s random storage order, but `Encodable` types will maintain their encoded order.
-    public let alphabetizeKeyValuePairs: Bool
-    /// The `ArrayEncoding` to use.
-    public let arrayEncoding: ArrayEncoding
-    /// The `BoolEncoding` to use.
-    public let boolEncoding: BoolEncoding
-    /// THe `DataEncoding` to use.
-    public let dataEncoding: DataEncoding
-    /// The `DateEncoding` to use.
-    public let dateEncoding: DateEncoding
-    /// The `KeyEncoding` to use.
-    public let keyEncoding: KeyEncoding
-    /// The `SpaceEncoding` to use.
-    public let spaceEncoding: SpaceEncoding
-    /// The `CharacterSet` of allowed (non-escaped) characters.
-    public var allowedCharacters: CharacterSet
-
-    /// Creates an instance from the supplied parameters.
-    ///
-    /// - Parameters:
-    ///   - alphabetizeKeyValuePairs: Whether or not to sort the encoded key value pairs. `true` by default.
-    ///   - arrayEncoding:            The `ArrayEncoding` to use. `.brackets` by default.
-    ///   - boolEncoding:             The `BoolEncoding` to use. `.numeric` by default.
-    ///   - dataEncoding:             The `DataEncoding` to use. `.base64` by default.
-    ///   - dateEncoding:             The `DateEncoding` to use. `.deferredToDate` by default.
-    ///   - keyEncoding:              The `KeyEncoding` to use. `.useDefaultKeys` by default.
-    ///   - spaceEncoding:            The `SpaceEncoding` to use. `.percentEscaped` by default.
-    ///   - allowedCharacters:        The `CharacterSet` of allowed (non-escaped) characters. `.afURLQueryAllowed` by
-    ///                               default.
-    public init(alphabetizeKeyValuePairs: Bool = true,
-                arrayEncoding: ArrayEncoding = .brackets,
-                boolEncoding: BoolEncoding = .numeric,
-                dataEncoding: DataEncoding = .base64,
-                dateEncoding: DateEncoding = .deferredToDate,
-                keyEncoding: KeyEncoding = .useDefaultKeys,
-                spaceEncoding: SpaceEncoding = .percentEscaped,
-                allowedCharacters: CharacterSet = .afURLQueryAllowed) {
-        self.alphabetizeKeyValuePairs = alphabetizeKeyValuePairs
-        self.arrayEncoding = arrayEncoding
-        self.boolEncoding = boolEncoding
-        self.dataEncoding = dataEncoding
-        self.dateEncoding = dateEncoding
-        self.keyEncoding = keyEncoding
-        self.spaceEncoding = spaceEncoding
-        self.allowedCharacters = allowedCharacters
-    }
-
-    func encode(_ value: Encodable) throws -> URLEncodedFormComponent {
-        let context = URLEncodedFormContext(.object([]))
-        let encoder = _URLEncodedFormEncoder(context: context,
-                                             boolEncoding: boolEncoding,
-                                             dataEncoding: dataEncoding,
-                                             dateEncoding: dateEncoding)
-        try value.encode(to: encoder)
-
-        return context.component
-    }
-
-    /// Encodes the `value` as a URL form encoded `String`.
-    ///
-    /// - Parameter value: The `Encodable` value.`
-    ///
-    /// - Returns:         The encoded `String`.
-    /// - Throws:          An `Error` or `EncodingError` instance if encoding fails.
-    public func encode(_ value: Encodable) throws -> String {
-        let component: URLEncodedFormComponent = try encode(value)
-
-        guard case let .object(object) = component else {
-            throw Error.invalidRootObject("\(component)")
-        }
-
-        let serializer = URLEncodedFormSerializer(alphabetizeKeyValuePairs: alphabetizeKeyValuePairs,
-                                                  arrayEncoding: arrayEncoding,
-                                                  keyEncoding: keyEncoding,
-                                                  spaceEncoding: spaceEncoding,
-                                                  allowedCharacters: allowedCharacters)
-        let query = serializer.serialize(object)
-
-        return query
-    }
-
-    /// Encodes the value as `Data`. This is performed by first creating an encoded `String` and then returning the
-    /// `.utf8` data.
-    ///
-    /// - Parameter value: The `Encodable` value.
-    ///
-    /// - Returns:         The encoded `Data`.
-    ///
-    /// - Throws:          An `Error` or `EncodingError` instance if encoding fails.
-    public func encode(_ value: Encodable) throws -> Data {
-        let string: String = try encode(value)
-
-        return Data(string.utf8)
-    }
-}
-
-final class _URLEncodedFormEncoder {
-    var codingPath: [CodingKey]
-    // Returns an empty dictionary, as this encoder doesn't support userInfo.
-    var userInfo: [CodingUserInfoKey: Any] { [:] }
-
-    let context: URLEncodedFormContext
-
-    private let boolEncoding: URLEncodedFormEncoder.BoolEncoding
-    private let dataEncoding: URLEncodedFormEncoder.DataEncoding
-    private let dateEncoding: URLEncodedFormEncoder.DateEncoding
-
-    init(context: URLEncodedFormContext,
-         codingPath: [CodingKey] = [],
-         boolEncoding: URLEncodedFormEncoder.BoolEncoding,
-         dataEncoding: URLEncodedFormEncoder.DataEncoding,
-         dateEncoding: URLEncodedFormEncoder.DateEncoding) {
-        self.context = context
-        self.codingPath = codingPath
-        self.boolEncoding = boolEncoding
-        self.dataEncoding = dataEncoding
-        self.dateEncoding = dateEncoding
-    }
-}
-
-extension _URLEncodedFormEncoder: Encoder {
-    func container<Key>(keyedBy type: Key.Type) -> KeyedEncodingContainer<Key> where Key: CodingKey {
-        let container = _URLEncodedFormEncoder.KeyedContainer<Key>(context: context,
-                                                                   codingPath: codingPath,
-                                                                   boolEncoding: boolEncoding,
-                                                                   dataEncoding: dataEncoding,
-                                                                   dateEncoding: dateEncoding)
-        return KeyedEncodingContainer(container)
-    }
-
-    func unkeyedContainer() -> UnkeyedEncodingContainer {
-        _URLEncodedFormEncoder.UnkeyedContainer(context: context,
-                                                codingPath: codingPath,
-                                                boolEncoding: boolEncoding,
-                                                dataEncoding: dataEncoding,
-                                                dateEncoding: dateEncoding)
-    }
-
-    func singleValueContainer() -> SingleValueEncodingContainer {
-        _URLEncodedFormEncoder.SingleValueContainer(context: context,
-                                                    codingPath: codingPath,
-                                                    boolEncoding: boolEncoding,
-                                                    dataEncoding: dataEncoding,
-                                                    dateEncoding: dateEncoding)
-    }
-}
-
-final class URLEncodedFormContext {
-    var component: URLEncodedFormComponent
-
-    init(_ component: URLEncodedFormComponent) {
-        self.component = component
-    }
-}
-
-enum URLEncodedFormComponent {
-    typealias Object = [(key: String, value: URLEncodedFormComponent)]
-
-    case string(String)
-    case array([URLEncodedFormComponent])
-    case object(Object)
-
-    /// Converts self to an `[URLEncodedFormData]` or returns `nil` if not convertible.
-    var array: [URLEncodedFormComponent]? {
-        switch self {
-        case let .array(array): return array
-        default: return nil
-        }
-    }
-
-    /// Converts self to an `Object` or returns `nil` if not convertible.
-    var object: Object? {
-        switch self {
-        case let .object(object): return object
-        default: return nil
-        }
-    }
-
-    /// Sets self to the supplied value at a given path.
-    ///
-    ///     data.set(to: "hello", at: ["path", "to", "value"])
-    ///
-    /// - parameters:
-    ///     - value: Value of `Self` to set at the supplied path.
-    ///     - path: `CodingKey` path to update with the supplied value.
-    public mutating func set(to value: URLEncodedFormComponent, at path: [CodingKey]) {
-        set(&self, to: value, at: path)
-    }
-
-    /// Recursive backing method to `set(to:at:)`.
-    private func set(_ context: inout URLEncodedFormComponent, to value: URLEncodedFormComponent, at path: [CodingKey]) {
-        guard path.count >= 1 else {
-            context = value
-            return
-        }
-
-        let end = path[0]
-        var child: URLEncodedFormComponent
-        switch path.count {
-        case 1:
-            child = value
-        case 2...:
-            if let index = end.intValue {
-                let array = context.array ?? []
-                if array.count > index {
-                    child = array[index]
-                } else {
-                    child = .array([])
-                }
-                set(&child, to: value, at: Array(path[1...]))
-            } else {
-                child = context.object?.first { $0.key == end.stringValue }?.value ?? .object(.init())
-                set(&child, to: value, at: Array(path[1...]))
-            }
-        default: fatalError("Unreachable")
-        }
-
-        if let index = end.intValue {
-            if var array = context.array {
-                if array.count > index {
-                    array[index] = child
-                } else {
-                    array.append(child)
-                }
-                context = .array(array)
-            } else {
-                context = .array([child])
-            }
-        } else {
-            if var object = context.object {
-                if let index = object.firstIndex(where: { $0.key == end.stringValue }) {
-                    object[index] = (key: end.stringValue, value: child)
-                } else {
-                    object.append((key: end.stringValue, value: child))
-                }
-                context = .object(object)
-            } else {
-                context = .object([(key: end.stringValue, value: child)])
-            }
-        }
-    }
-}
-
-struct AnyCodingKey: CodingKey, Hashable {
-    let stringValue: String
-    let intValue: Int?
-
-    init?(stringValue: String) {
-        self.stringValue = stringValue
-        intValue = nil
-    }
-
-    init?(intValue: Int) {
-        stringValue = "\(intValue)"
-        self.intValue = intValue
-    }
-
-    init<Key>(_ base: Key) where Key: CodingKey {
-        if let intValue = base.intValue {
-            self.init(intValue: intValue)!
-        } else {
-            self.init(stringValue: base.stringValue)!
-        }
-    }
-}
-
-extension _URLEncodedFormEncoder {
-    final class KeyedContainer<Key> where Key: CodingKey {
-        var codingPath: [CodingKey]
-
-        private let context: URLEncodedFormContext
-        private let boolEncoding: URLEncodedFormEncoder.BoolEncoding
-        private let dataEncoding: URLEncodedFormEncoder.DataEncoding
-        private let dateEncoding: URLEncodedFormEncoder.DateEncoding
-
-        init(context: URLEncodedFormContext,
-             codingPath: [CodingKey],
-             boolEncoding: URLEncodedFormEncoder.BoolEncoding,
-             dataEncoding: URLEncodedFormEncoder.DataEncoding,
-             dateEncoding: URLEncodedFormEncoder.DateEncoding) {
-            self.context = context
-            self.codingPath = codingPath
-            self.boolEncoding = boolEncoding
-            self.dataEncoding = dataEncoding
-            self.dateEncoding = dateEncoding
-        }
-
-        private func nestedCodingPath(for key: CodingKey) -> [CodingKey] {
-            codingPath + [key]
-        }
-    }
-}
-
-extension _URLEncodedFormEncoder.KeyedContainer: KeyedEncodingContainerProtocol {
-    func encodeNil(forKey key: Key) throws {
-        let context = EncodingError.Context(codingPath: codingPath,
-                                            debugDescription: "URLEncodedFormEncoder cannot encode nil values.")
-        throw EncodingError.invalidValue("\(key): nil", context)
-    }
-
-    func encode<T>(_ value: T, forKey key: Key) throws where T: Encodable {
-        var container = nestedSingleValueEncoder(for: key)
-        try container.encode(value)
-    }
-
-    func nestedSingleValueEncoder(for key: Key) -> SingleValueEncodingContainer {
-        let container = _URLEncodedFormEncoder.SingleValueContainer(context: context,
-                                                                    codingPath: nestedCodingPath(for: key),
-                                                                    boolEncoding: boolEncoding,
-                                                                    dataEncoding: dataEncoding,
-                                                                    dateEncoding: dateEncoding)
-
-        return container
-    }
-
-    func nestedUnkeyedContainer(forKey key: Key) -> UnkeyedEncodingContainer {
-        let container = _URLEncodedFormEncoder.UnkeyedContainer(context: context,
-                                                                codingPath: nestedCodingPath(for: key),
-                                                                boolEncoding: boolEncoding,
-                                                                dataEncoding: dataEncoding,
-                                                                dateEncoding: dateEncoding)
-
-        return container
-    }
-
-    func nestedContainer<NestedKey>(keyedBy keyType: NestedKey.Type, forKey key: Key) -> KeyedEncodingContainer<NestedKey> where NestedKey: CodingKey {
-        let container = _URLEncodedFormEncoder.KeyedContainer<NestedKey>(context: context,
-                                                                         codingPath: nestedCodingPath(for: key),
-                                                                         boolEncoding: boolEncoding,
-                                                                         dataEncoding: dataEncoding,
-                                                                         dateEncoding: dateEncoding)
-
-        return KeyedEncodingContainer(container)
-    }
-
-    func superEncoder() -> Encoder {
-        _URLEncodedFormEncoder(context: context,
-                               codingPath: codingPath,
-                               boolEncoding: boolEncoding,
-                               dataEncoding: dataEncoding,
-                               dateEncoding: dateEncoding)
-    }
-
-    func superEncoder(forKey key: Key) -> Encoder {
-        _URLEncodedFormEncoder(context: context,
-                               codingPath: nestedCodingPath(for: key),
-                               boolEncoding: boolEncoding,
-                               dataEncoding: dataEncoding,
-                               dateEncoding: dateEncoding)
-    }
-}
-
-extension _URLEncodedFormEncoder {
-    final class SingleValueContainer {
-        var codingPath: [CodingKey]
-
-        private var canEncodeNewValue = true
-
-        private let context: URLEncodedFormContext
-        private let boolEncoding: URLEncodedFormEncoder.BoolEncoding
-        private let dataEncoding: URLEncodedFormEncoder.DataEncoding
-        private let dateEncoding: URLEncodedFormEncoder.DateEncoding
-
-        init(context: URLEncodedFormContext,
-             codingPath: [CodingKey],
-             boolEncoding: URLEncodedFormEncoder.BoolEncoding,
-             dataEncoding: URLEncodedFormEncoder.DataEncoding,
-             dateEncoding: URLEncodedFormEncoder.DateEncoding) {
-            self.context = context
-            self.codingPath = codingPath
-            self.boolEncoding = boolEncoding
-            self.dataEncoding = dataEncoding
-            self.dateEncoding = dateEncoding
-        }
-
-        private func checkCanEncode(value: Any?) throws {
-            guard canEncodeNewValue else {
-                let context = EncodingError.Context(codingPath: codingPath,
-                                                    debugDescription: "Attempt to encode value through single value container when previously value already encoded.")
-                throw EncodingError.invalidValue(value as Any, context)
-            }
-        }
-    }
-}
-
-extension _URLEncodedFormEncoder.SingleValueContainer: SingleValueEncodingContainer {
-    func encodeNil() throws {
-        try checkCanEncode(value: nil)
-        defer { canEncodeNewValue = false }
-
-        let context = EncodingError.Context(codingPath: codingPath,
-                                            debugDescription: "URLEncodedFormEncoder cannot encode nil values.")
-        throw EncodingError.invalidValue("nil", context)
-    }
-
-    func encode(_ value: Bool) throws {
-        try encode(value, as: String(boolEncoding.encode(value)))
-    }
-
-    func encode(_ value: String) throws {
-        try encode(value, as: value)
-    }
-
-    func encode(_ value: Double) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: Float) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: Int) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: Int8) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: Int16) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: Int32) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: Int64) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: UInt) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: UInt8) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: UInt16) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: UInt32) throws {
-        try encode(value, as: String(value))
-    }
-
-    func encode(_ value: UInt64) throws {
-        try encode(value, as: String(value))
-    }
-
-    private func encode<T>(_ value: T, as string: String) throws where T: Encodable {
-        try checkCanEncode(value: value)
-        defer { canEncodeNewValue = false }
-
-        context.component.set(to: .string(string), at: codingPath)
-    }
-
-    func encode<T>(_ value: T) throws where T: Encodable {
-        switch value {
-        case let date as Date:
-            guard let string = try dateEncoding.encode(date) else {
-                try attemptToEncode(value)
-                return
-            }
-
-            try encode(value, as: string)
-        case let data as Data:
-            guard let string = try dataEncoding.encode(data) else {
-                try attemptToEncode(value)
-                return
-            }
-
-            try encode(value, as: string)
-        case let decimal as Decimal:
-            // Decimal's `Encodable` implementation returns an object, not a single value, so override it.
-            try encode(value, as: String(describing: decimal))
-        default:
-            try attemptToEncode(value)
-        }
-    }
-
-    private func attemptToEncode<T>(_ value: T) throws where T: Encodable {
-        try checkCanEncode(value: value)
-        defer { canEncodeNewValue = false }
-
-        let encoder = _URLEncodedFormEncoder(context: context,
-                                             codingPath: codingPath,
-                                             boolEncoding: boolEncoding,
-                                             dataEncoding: dataEncoding,
-                                             dateEncoding: dateEncoding)
-        try value.encode(to: encoder)
-    }
-}
-
-extension _URLEncodedFormEncoder {
-    final class UnkeyedContainer {
-        var codingPath: [CodingKey]
-
-        var count = 0
-        var nestedCodingPath: [CodingKey] {
-            codingPath + [AnyCodingKey(intValue: count)!]
-        }
-
-        private let context: URLEncodedFormContext
-        private let boolEncoding: URLEncodedFormEncoder.BoolEncoding
-        private let dataEncoding: URLEncodedFormEncoder.DataEncoding
-        private let dateEncoding: URLEncodedFormEncoder.DateEncoding
-
-        init(context: URLEncodedFormContext,
-             codingPath: [CodingKey],
-             boolEncoding: URLEncodedFormEncoder.BoolEncoding,
-             dataEncoding: URLEncodedFormEncoder.DataEncoding,
-             dateEncoding: URLEncodedFormEncoder.DateEncoding) {
-            self.context = context
-            self.codingPath = codingPath
-            self.boolEncoding = boolEncoding
-            self.dataEncoding = dataEncoding
-            self.dateEncoding = dateEncoding
-        }
-    }
-}
-
-extension _URLEncodedFormEncoder.UnkeyedContainer: UnkeyedEncodingContainer {
-    func encodeNil() throws {
-        let context = EncodingError.Context(codingPath: codingPath,
-                                            debugDescription: "URLEncodedFormEncoder cannot encode nil values.")
-        throw EncodingError.invalidValue("nil", context)
-    }
-
-    func encode<T>(_ value: T) throws where T: Encodable {
-        var container = nestedSingleValueContainer()
-        try container.encode(value)
-    }
-
-    func nestedSingleValueContainer() -> SingleValueEncodingContainer {
-        defer { count += 1 }
-
-        return _URLEncodedFormEncoder.SingleValueContainer(context: context,
-                                                           codingPath: nestedCodingPath,
-                                                           boolEncoding: boolEncoding,
-                                                           dataEncoding: dataEncoding,
-                                                           dateEncoding: dateEncoding)
-    }
-
-    func nestedContainer<NestedKey>(keyedBy keyType: NestedKey.Type) -> KeyedEncodingContainer<NestedKey> where NestedKey: CodingKey {
-        defer { count += 1 }
-        let container = _URLEncodedFormEncoder.KeyedContainer<NestedKey>(context: context,
-                                                                         codingPath: nestedCodingPath,
-                                                                         boolEncoding: boolEncoding,
-                                                                         dataEncoding: dataEncoding,
-                                                                         dateEncoding: dateEncoding)
-
-        return KeyedEncodingContainer(container)
-    }
-
-    func nestedUnkeyedContainer() -> UnkeyedEncodingContainer {
-        defer { count += 1 }
-
-        return _URLEncodedFormEncoder.UnkeyedContainer(context: context,
-                                                       codingPath: nestedCodingPath,
-                                                       boolEncoding: boolEncoding,
-                                                       dataEncoding: dataEncoding,
-                                                       dateEncoding: dateEncoding)
-    }
-
-    func superEncoder() -> Encoder {
-        defer { count += 1 }
-
-        return _URLEncodedFormEncoder(context: context,
-                                      codingPath: codingPath,
-                                      boolEncoding: boolEncoding,
-                                      dataEncoding: dataEncoding,
-                                      dateEncoding: dateEncoding)
-    }
-}
-
-final class URLEncodedFormSerializer {
-    private let alphabetizeKeyValuePairs: Bool
-    private let arrayEncoding: URLEncodedFormEncoder.ArrayEncoding
-    private let keyEncoding: URLEncodedFormEncoder.KeyEncoding
-    private let spaceEncoding: URLEncodedFormEncoder.SpaceEncoding
-    private let allowedCharacters: CharacterSet
-
-    init(alphabetizeKeyValuePairs: Bool,
-         arrayEncoding: URLEncodedFormEncoder.ArrayEncoding,
-         keyEncoding: URLEncodedFormEncoder.KeyEncoding,
-         spaceEncoding: URLEncodedFormEncoder.SpaceEncoding,
-         allowedCharacters: CharacterSet) {
-        self.alphabetizeKeyValuePairs = alphabetizeKeyValuePairs
-        self.arrayEncoding = arrayEncoding
-        self.keyEncoding = keyEncoding
-        self.spaceEncoding = spaceEncoding
-        self.allowedCharacters = allowedCharacters
-    }
-
-    func serialize(_ object: URLEncodedFormComponent.Object) -> String {
-        var output: [String] = []
-        for (key, component) in object {
-            let value = serialize(component, forKey: key)
-            output.append(value)
-        }
-        output = alphabetizeKeyValuePairs ? output.sorted() : output
-
-        return output.joinedWithAmpersands()
-    }
-
-    func serialize(_ component: URLEncodedFormComponent, forKey key: String) -> String {
-        switch component {
-        case let .string(string): return "\(escape(keyEncoding.encode(key)))=\(escape(string))"
-        case let .array(array): return serialize(array, forKey: key)
-        case let .object(object): return serialize(object, forKey: key)
-        }
-    }
-
-    func serialize(_ object: URLEncodedFormComponent.Object, forKey key: String) -> String {
-        var segments: [String] = object.map { subKey, value in
-            let keyPath = "[\(subKey)]"
-            return serialize(value, forKey: key + keyPath)
-        }
-        segments = alphabetizeKeyValuePairs ? segments.sorted() : segments
-
-        return segments.joinedWithAmpersands()
-    }
-
-    func serialize(_ array: [URLEncodedFormComponent], forKey key: String) -> String {
-        var segments: [String] = array.map { component in
-            let keyPath = arrayEncoding.encode(key)
-            return serialize(component, forKey: keyPath)
-        }
-        segments = alphabetizeKeyValuePairs ? segments.sorted() : segments
-
-        return segments.joinedWithAmpersands()
-    }
-
-    func escape(_ query: String) -> String {
-        var allowedCharactersWithSpace = allowedCharacters
-        allowedCharactersWithSpace.insert(charactersIn: " ")
-        let escapedQuery = query.addingPercentEncoding(withAllowedCharacters: allowedCharactersWithSpace) ?? query
-        let spaceEncodedQuery = spaceEncoding.encode(escapedQuery)
-
-        return spaceEncodedQuery
-    }
-}
-
-extension Array where Element == String {
-    func joinedWithAmpersands() -> String {
-        joined(separator: "&")
-    }
-}
-
-extension CharacterSet {
-    /// Creates a CharacterSet from RFC 3986 allowed characters.
-    ///
-    /// RFC 3986 states that the following characters are "reserved" characters.
-    ///
-    /// - General Delimiters: ":", "#", "[", "]", "@", "?", "/"
-    /// - Sub-Delimiters: "!", "$", "&", "'", "(", ")", "*", "+", ",", ";", "="
-    ///
-    /// In RFC 3986 - Section 3.4, it states that the "?" and "/" characters should not be escaped to allow
-    /// query strings to include a URL. Therefore, all "reserved" characters with the exception of "?" and "/"
-    /// should be percent-escaped in the query string.
-    public static let afURLQueryAllowed: CharacterSet = {
-        let generalDelimitersToEncode = ":#[]@" // does not include "?" or "/" due to RFC 3986 - Section 3.4
-        let subDelimitersToEncode = "!$&'()*+,;="
-        let encodableDelimiters = CharacterSet(charactersIn: "\(generalDelimitersToEncode)\(subDelimitersToEncode)")
-
-        return CharacterSet.urlQueryAllowed.subtracting(encodableDelimiters)
-    }()
-}
diff --git a/Pods/Alamofire/Source/URLRequest+Alamofire.swift b/Pods/Alamofire/Source/URLRequest+Alamofire.swift
deleted file mode 100644
index be27c8ed0..000000000
--- a/Pods/Alamofire/Source/URLRequest+Alamofire.swift
+++ /dev/null
@@ -1,39 +0,0 @@
-//
-//  URLRequest+Alamofire.swift
-//
-//  Copyright (c) 2019 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-extension URLRequest {
-    /// Returns the `httpMethod` as Alamofire's `HTTPMethod` type.
-    public var method: HTTPMethod? {
-        get { httpMethod.flatMap(HTTPMethod.init) }
-        set { httpMethod = newValue?.rawValue }
-    }
-
-    public func validate() throws {
-        if method == .get, let bodyData = httpBody {
-            throw AFError.urlRequestValidationFailed(reason: .bodyDataInGETRequest(bodyData))
-        }
-    }
-}
diff --git a/Pods/Alamofire/Source/URLSessionConfiguration+Alamofire.swift b/Pods/Alamofire/Source/URLSessionConfiguration+Alamofire.swift
deleted file mode 100644
index de3e290a3..000000000
--- a/Pods/Alamofire/Source/URLSessionConfiguration+Alamofire.swift
+++ /dev/null
@@ -1,37 +0,0 @@
-//
-//  URLSessionConfiguration+Alamofire.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-extension URLSessionConfiguration: AlamofireExtended {}
-extension AlamofireExtension where ExtendedType: URLSessionConfiguration {
-    /// Alamofire's default configuration. Same as `URLSessionConfiguration.default` but adds Alamofire default
-    /// `Accept-Language`, `Accept-Encoding`, and `User-Agent` headers.
-    public static var `default`: URLSessionConfiguration {
-        let configuration = URLSessionConfiguration.default
-        configuration.headers = .default
-
-        return configuration
-    }
-}
diff --git a/Pods/Alamofire/Source/Validation.swift b/Pods/Alamofire/Source/Validation.swift
deleted file mode 100644
index bd2a27953..000000000
--- a/Pods/Alamofire/Source/Validation.swift
+++ /dev/null
@@ -1,302 +0,0 @@
-//
-//  Validation.swift
-//
-//  Copyright (c) 2014-2018 Alamofire Software Foundation (http://alamofire.org/)
-//
-//  Permission is hereby granted, free of charge, to any person obtaining a copy
-//  of this software and associated documentation files (the "Software"), to deal
-//  in the Software without restriction, including without limitation the rights
-//  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-//  copies of the Software, and to permit persons to whom the Software is
-//  furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be included in
-//  all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-//  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-//  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-//  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-//  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-//  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-//  THE SOFTWARE.
-//
-
-import Foundation
-
-extension Request {
-    // MARK: Helper Types
-
-    fileprivate typealias ErrorReason = AFError.ResponseValidationFailureReason
-
-    /// Used to represent whether a validation succeeded or failed.
-    public typealias ValidationResult = Result<Void, Error>
-
-    fileprivate struct MIMEType {
-        let type: String
-        let subtype: String
-
-        var isWildcard: Bool { type == "*" && subtype == "*" }
-
-        init?(_ string: String) {
-            let components: [String] = {
-                let stripped = string.trimmingCharacters(in: .whitespacesAndNewlines)
-                let split = stripped[..<(stripped.range(of: ";")?.lowerBound ?? stripped.endIndex)]
-
-                return split.components(separatedBy: "/")
-            }()
-
-            if let type = components.first, let subtype = components.last {
-                self.type = type
-                self.subtype = subtype
-            } else {
-                return nil
-            }
-        }
-
-        func matches(_ mime: MIMEType) -> Bool {
-            switch (type, subtype) {
-            case (mime.type, mime.subtype), (mime.type, "*"), ("*", mime.subtype), ("*", "*"):
-                return true
-            default:
-                return false
-            }
-        }
-    }
-
-    // MARK: Properties
-
-    fileprivate var acceptableStatusCodes: Range<Int> { 200..<300 }
-
-    fileprivate var acceptableContentTypes: [String] {
-        if let accept = request?.value(forHTTPHeaderField: "Accept") {
-            return accept.components(separatedBy: ",")
-        }
-
-        return ["*/*"]
-    }
-
-    // MARK: Status Code
-
-    fileprivate func validate<S: Sequence>(statusCode acceptableStatusCodes: S,
-                                           response: HTTPURLResponse)
-        -> ValidationResult
-        where S.Iterator.Element == Int {
-        if acceptableStatusCodes.contains(response.statusCode) {
-            return .success(())
-        } else {
-            let reason: ErrorReason = .unacceptableStatusCode(code: response.statusCode)
-            return .failure(AFError.responseValidationFailed(reason: reason))
-        }
-    }
-
-    // MARK: Content Type
-
-    fileprivate func validate<S: Sequence>(contentType acceptableContentTypes: S,
-                                           response: HTTPURLResponse,
-                                           data: Data?)
-        -> ValidationResult
-        where S.Iterator.Element == String {
-        guard let data = data, !data.isEmpty else { return .success(()) }
-
-        return validate(contentType: acceptableContentTypes, response: response)
-    }
-
-    fileprivate func validate<S: Sequence>(contentType acceptableContentTypes: S,
-                                           response: HTTPURLResponse)
-        -> ValidationResult
-        where S.Iterator.Element == String {
-        guard
-            let responseContentType = response.mimeType,
-            let responseMIMEType = MIMEType(responseContentType)
-        else {
-            for contentType in acceptableContentTypes {
-                if let mimeType = MIMEType(contentType), mimeType.isWildcard {
-                    return .success(())
-                }
-            }
-
-            let error: AFError = {
-                let reason: ErrorReason = .missingContentType(acceptableContentTypes: Array(acceptableContentTypes))
-                return AFError.responseValidationFailed(reason: reason)
-            }()
-
-            return .failure(error)
-        }
-
-        for contentType in acceptableContentTypes {
-            if let acceptableMIMEType = MIMEType(contentType), acceptableMIMEType.matches(responseMIMEType) {
-                return .success(())
-            }
-        }
-
-        let error: AFError = {
-            let reason: ErrorReason = .unacceptableContentType(acceptableContentTypes: Array(acceptableContentTypes),
-                                                               responseContentType: responseContentType)
-
-            return AFError.responseValidationFailed(reason: reason)
-        }()
-
-        return .failure(error)
-    }
-}
-
-// MARK: -
-
-extension DataRequest {
-    /// A closure used to validate a request that takes a URL request, a URL response and data, and returns whether the
-    /// request was valid.
-    public typealias Validation = (URLRequest?, HTTPURLResponse, Data?) -> ValidationResult
-
-    /// Validates that the response has a status code in the specified sequence.
-    ///
-    /// If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - Parameter statusCode: `Sequence` of acceptable response status codes.
-    ///
-    /// - Returns:              The instance.
-    @discardableResult
-    public func validate<S: Sequence>(statusCode acceptableStatusCodes: S) -> Self where S.Iterator.Element == Int {
-        validate { [unowned self] _, response, _ in
-            self.validate(statusCode: acceptableStatusCodes, response: response)
-        }
-    }
-
-    /// Validates that the response has a content type in the specified sequence.
-    ///
-    /// If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - parameter contentType: The acceptable content types, which may specify wildcard types and/or subtypes.
-    ///
-    /// - returns: The request.
-    @discardableResult
-    public func validate<S: Sequence>(contentType acceptableContentTypes: @escaping @autoclosure () -> S) -> Self where S.Iterator.Element == String {
-        validate { [unowned self] _, response, data in
-            self.validate(contentType: acceptableContentTypes(), response: response, data: data)
-        }
-    }
-
-    /// Validates that the response has a status code in the default acceptable range of 200...299, and that the content
-    /// type matches any specified in the Accept HTTP header field.
-    ///
-    /// If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - returns: The request.
-    @discardableResult
-    public func validate() -> Self {
-        let contentTypes: () -> [String] = { [unowned self] in
-            self.acceptableContentTypes
-        }
-        return validate(statusCode: acceptableStatusCodes).validate(contentType: contentTypes())
-    }
-}
-
-extension DataStreamRequest {
-    /// A closure used to validate a request that takes a `URLRequest` and `HTTPURLResponse` and returns whether the
-    /// request was valid.
-    public typealias Validation = (_ request: URLRequest?, _ response: HTTPURLResponse) -> ValidationResult
-
-    /// Validates that the response has a status code in the specified sequence.
-    ///
-    /// If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - Parameter statusCode: `Sequence` of acceptable response status codes.
-    ///
-    /// - Returns:              The instance.
-    @discardableResult
-    public func validate<S: Sequence>(statusCode acceptableStatusCodes: S) -> Self where S.Iterator.Element == Int {
-        validate { [unowned self] _, response in
-            self.validate(statusCode: acceptableStatusCodes, response: response)
-        }
-    }
-
-    /// Validates that the response has a content type in the specified sequence.
-    ///
-    /// If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - parameter contentType: The acceptable content types, which may specify wildcard types and/or subtypes.
-    ///
-    /// - returns: The request.
-    @discardableResult
-    public func validate<S: Sequence>(contentType acceptableContentTypes: @escaping @autoclosure () -> S) -> Self where S.Iterator.Element == String {
-        validate { [unowned self] _, response in
-            self.validate(contentType: acceptableContentTypes(), response: response)
-        }
-    }
-
-    /// Validates that the response has a status code in the default acceptable range of 200...299, and that the content
-    /// type matches any specified in the Accept HTTP header field.
-    ///
-    /// If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - Returns: The instance.
-    @discardableResult
-    public func validate() -> Self {
-        let contentTypes: () -> [String] = { [unowned self] in
-            self.acceptableContentTypes
-        }
-        return validate(statusCode: acceptableStatusCodes).validate(contentType: contentTypes())
-    }
-}
-
-// MARK: -
-
-extension DownloadRequest {
-    /// A closure used to validate a request that takes a URL request, a URL response, a temporary URL and a
-    /// destination URL, and returns whether the request was valid.
-    public typealias Validation = (_ request: URLRequest?,
-                                   _ response: HTTPURLResponse,
-                                   _ fileURL: URL?)
-        -> ValidationResult
-
-    /// Validates that the response has a status code in the specified sequence.
-    ///
-    /// If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - Parameter statusCode: `Sequence` of acceptable response status codes.
-    ///
-    /// - Returns:              The instance.
-    @discardableResult
-    public func validate<S: Sequence>(statusCode acceptableStatusCodes: S) -> Self where S.Iterator.Element == Int {
-        validate { [unowned self] _, response, _ in
-            self.validate(statusCode: acceptableStatusCodes, response: response)
-        }
-    }
-
-    /// Validates that the response has a content type in the specified sequence.
-    ///
-    /// If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - parameter contentType: The acceptable content types, which may specify wildcard types and/or subtypes.
-    ///
-    /// - returns: The request.
-    @discardableResult
-    public func validate<S: Sequence>(contentType acceptableContentTypes: @escaping @autoclosure () -> S) -> Self where S.Iterator.Element == String {
-        validate { [unowned self] _, response, fileURL in
-            guard let validFileURL = fileURL else {
-                return .failure(AFError.responseValidationFailed(reason: .dataFileNil))
-            }
-
-            do {
-                let data = try Data(contentsOf: validFileURL)
-                return self.validate(contentType: acceptableContentTypes(), response: response, data: data)
-            } catch {
-                return .failure(AFError.responseValidationFailed(reason: .dataFileReadFailed(at: validFileURL)))
-            }
-        }
-    }
-
-    /// Validates that the response has a status code in the default acceptable range of 200...299, and that the content
-    /// type matches any specified in the Accept HTTP header field.
-    ///
-    /// If validation fails, subsequent calls to response handlers will have an associated error.
-    ///
-    /// - returns: The request.
-    @discardableResult
-    public func validate() -> Self {
-        let contentTypes = { [unowned self] in
-            self.acceptableContentTypes
-        }
-        return validate(statusCode: acceptableStatusCodes).validate(contentType: contentTypes())
-    }
-}
diff --git a/Pods/BRLOptionParser/BRLOptionParser/BRLOptionParser.h b/Pods/BRLOptionParser/BRLOptionParser/BRLOptionParser.h
deleted file mode 100644
index 3dbfdbad7..000000000
--- a/Pods/BRLOptionParser/BRLOptionParser/BRLOptionParser.h
+++ /dev/null
@@ -1,62 +0,0 @@
-// BRLOptionParser.h
-//
-// Copyright © 2013–2015 Stephen Celis (<stephen@stephencelis.com>)
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in
-// all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-// THE SOFTWARE.
-
-
-@import Foundation;
-
-
-typedef void (^BRLOptionParserOptionBlock)();
-typedef void (^BRLOptionParserOptionBlockWithArgument)(NSString *value);
-
-
-static NSString *const BRLOptionParserErrorDomain = @"BRLOptionParserErrorDomain";
-
-
-typedef NS_ENUM(NSUInteger, BRLOptionParserErrorCode) {
-    BRLOptionParserErrorCodeUnrecognized = 1,
-    BRLOptionParserErrorCodeRequired
-};
-
-
-@interface BRLOptionParser : NSObject
-
-+ (instancetype)parser;
-+ (instancetype)longOnlyParser;
-
-@property (nonatomic, getter = isLongOnly) BOOL longOnly;
-
-@property (nonatomic, copy) NSString *banner;
-
-- (void)setBanner:(NSString *)banner, ...;
-
-- (void)addOption:(char *)option flag:(unichar)flag description:(NSString *)description block:(BRLOptionParserOptionBlock)block;
-- (void)addOption:(char *)option flag:(unichar)flag description:(NSString *)description blockWithArgument:(BRLOptionParserOptionBlockWithArgument)blockWithArgument;
-
-- (void)addOption:(char *)option flag:(unichar)flag description:(NSString *)description value:(BOOL *)value;
-- (void)addOption:(char *)option flag:(unichar)flag description:(NSString *)description argument:(NSString *__strong *)argument;
-
-- (void)addSeparator;
-- (void)addSeparator:(NSString *)separator;
-
-- (BOOL)parseArgc:(int)argc argv:(const char **)argv error:(NSError **)error;
-
-@end
diff --git a/Pods/BRLOptionParser/BRLOptionParser/BRLOptionParser.m b/Pods/BRLOptionParser/BRLOptionParser/BRLOptionParser.m
deleted file mode 100644
index 066cdf5e8..000000000
--- a/Pods/BRLOptionParser/BRLOptionParser/BRLOptionParser.m
+++ /dev/null
@@ -1,306 +0,0 @@
-// BRLOptionParser.m
-//
-// Copyright © 2013–2015 Stephen Celis (<stephen@stephencelis.com>)
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in
-// all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-// THE SOFTWARE.
-
-
-#import "BRLOptionParser.h"
-#import <getopt.h>
-
-
-typedef NS_ENUM(NSUInteger, BRLOptionArgument) {
-    BRLOptionArgumentNone = no_argument,
-    BRLOptionArgumentRequired = required_argument
-};
-
-
-@interface BRLOption : NSObject
-
-@property (assign) BRLOptionArgument argument;
-@property (assign) char * name;
-@property (assign) unichar flag;
-@property (strong) NSString *description;
-@property (copy) id block;
-
-+ (instancetype)optionWithName:(char *)name flag:(unichar)flag description:(NSString *)description block:(BRLOptionParserOptionBlock)block;
-+ (instancetype)optionWithName:(char *)name flag:(unichar)flag description:(NSString *)description blockWithArgument:(BRLOptionParserOptionBlockWithArgument)blockWithArgument;
-
-@end
-
-
-@implementation BRLOption
-
-@synthesize description = _description;
-
-+ (instancetype)optionWithName:(char *)name flag:(unichar)flag description:(NSString *)description block:(BRLOptionParserOptionBlock)block
-{
-    BRLOption *option = [[self alloc] initWithName:name flag:flag description:description argument:BRLOptionArgumentNone block:block];
-    return option;
-}
-
-+ (instancetype)optionWithName:(char *)name flag:(unichar)flag description:(NSString *)description blockWithArgument:(BRLOptionParserOptionBlockWithArgument)blockWithArgument
-{
-    BRLOption *option = [[self alloc] initWithName:name flag:flag description:description argument:BRLOptionArgumentRequired block:blockWithArgument];
-    return option;
-}
-
-- (instancetype)initWithName:(char *)name flag:(unichar)flag description:(NSString *)description argument:(BRLOptionArgument)argument block:(id)block
-{
-    if (self = [super init]) {
-        _argument = argument;
-        _name = name;
-        _flag = flag;
-        _block = block;
-        _description = description;
-    }
-    return self;
-}
-
-@end
-
-
-@interface BRLOptionParser ()
-
-@property NSMutableArray *options;
-
-@end
-
-
-@implementation BRLOptionParser
-
-+ (instancetype)parser
-{
-    return [self new];
-}
-
-+ (instancetype)longOnlyParser
-{
-    BRLOptionParser *parser = [self parser];
-    if (parser) {
-        parser.longOnly = YES;
-    }
-    return parser;
-}
-
-- (id)init
-{
-    if (self = [super init]) {
-        [self setBanner:@"usage: %@ [options]", [NSProcessInfo processInfo].processName];
-        _options = [NSMutableArray new];
-    }
-    return self;
-}
-
-- (void)setBanner:(NSString *)banner, ...
-{
-    va_list args;
-    va_start(args, banner);
-    _banner = [[NSString alloc] initWithFormat:banner arguments:args];
-    va_end(args);
-    return;
-}
-
-- (void)addOption:(char *)option flag:(unichar)flag description:(NSString *)description block:(BRLOptionParserOptionBlock)block
-{
-    [self.options addObject:[BRLOption optionWithName:option flag:flag description:description block:block]];
-}
-
-- (void)addOption:(char *)option flag:(unichar)flag description:(NSString *)description blockWithArgument:(BRLOptionParserOptionBlockWithArgument)blockWithArgument
-{
-    [self.options addObject:[BRLOption optionWithName:option flag:flag description:description blockWithArgument:blockWithArgument]];
-}
-
-- (void)addOption:(char *)option flag:(unichar)flag description:(NSString *)description value:(BOOL *)value
-{
-    [self addOption:option flag:flag description:description block:^{
-        *value = YES;
-    }];
-}
-
-- (void)addOption:(char *)option flag:(unichar)flag description:(NSString *)description argument:(NSString *__strong *)argument
-{
-    [self addOption:option flag:flag description:description blockWithArgument:^(NSString *value) {
-        *argument = value;
-    }];
-}
-
-- (void)addSeparator
-{
-    [self addSeparator:nil];
-}
-
-- (void)addSeparator:(NSString *)separator
-{
-    if (separator == nil) {
-        separator = @"";
-    }
-    [self.options addObject:separator];
-}
-
-- (BOOL)parseArgc:(int)argc argv:(const char **)argv error:(NSError *__autoreleasing *)error
-{
-    NSMapTable *mapTable = NSCreateMapTable(NSIntegerMapKeyCallBacks, NSNonRetainedObjectMapValueCallBacks, self.options.count);
-
-    NSUInteger i = 0;
-    NSUInteger c = 0;
-
-    struct option * long_options = malloc((self.options.count + 1) * sizeof(struct option));
-    char * short_options = malloc(((self.options.count * 2) + 1) * sizeof(char));
-
-    for (id each in self.options) {
-        if (![each isKindOfClass:[BRLOption class]]) {
-            continue;
-        }
-        BRLOption *option = each;
-        if (option.name) {
-            NSMapInsert(mapTable, (const void *)option.name, (__bridge void *)option);
-            long_options[i++] = (struct option){option.name, option.argument, NULL, option.flag};
-        }
-        if (option.flag) {
-            NSMapInsert(mapTable, (const void *)(NSUInteger)option.flag, (__bridge void *)option);
-            short_options[c++] = option.flag;
-            if (option.argument == BRLOptionArgumentRequired) {
-                short_options[c++] = ':';
-            };
-        }
-    }
-    long_options[i] = (struct option){0, 0, 0, 0};
-    short_options[c] = '\0';
-
-    int ch = 0;
-    int long_options_index = 0;
-
-    opterr = 0;
-
-    int (* getopt_long_method)(int, char * const *, const char *, const struct option *, int *);
-    getopt_long_method = self.isLongOnly ? &getopt_long_only : &getopt_long;
-
-    int cached_optind = optind;
-    while ((ch = getopt_long_method(argc, (char **)argv, short_options, long_options, &long_options_index)) != -1) {
-        @try {
-            BRLOption *option = nil;
-
-            switch (ch) {
-                case '?': {
-                    if (error) {
-                        // I wish this could be done more cleanly, but getopt doesn't appear to expose the current failing option as originally input.
-                        NSString *arg = [NSString stringWithUTF8String:argv[cached_optind]];
-                        if ([arg hasPrefix:[self longPrefix]]) {
-                            arg = [arg componentsSeparatedByString:@"="].firstObject;
-                        } else if (optopt) {
-                            arg = [NSString stringWithFormat:@"-%c", optopt];
-                        }
-
-                        if (optopt) {
-                            option = (__bridge BRLOption *)NSMapGet(mapTable, (const void *)(NSUInteger)optopt);
-                        } else {
-                            NSString *longOption = [NSString stringWithFormat:@"%@%s", [self longPrefix], long_options[long_options_index].name];
-                            if ([arg isEqualToString:longOption]) {
-                                option = (__bridge BRLOption *)NSMapGet(mapTable, (const void *)long_options[long_options_index].name);
-                            }
-                        }
-
-                        if (option && option.argument == BRLOptionArgumentRequired) {
-                            *error = [NSError errorWithDomain:BRLOptionParserErrorDomain code:BRLOptionParserErrorCodeRequired userInfo:@{NSLocalizedDescriptionKey: [NSString stringWithFormat:@"option `%@' requires an argument", arg]}];
-                        } else {
-                            *error = [NSError errorWithDomain:BRLOptionParserErrorDomain code:BRLOptionParserErrorCodeUnrecognized userInfo:@{NSLocalizedDescriptionKey: [NSString stringWithFormat:@"unrecognized option `%@'", arg]}];
-                        }
-                    }
-                    return NO;
-                    break;
-                }
-                case ':':
-
-                    break;
-                case 0:
-                    option = (__bridge BRLOption *)NSMapGet(mapTable, (const void *)long_options[long_options_index].name);
-                    break;
-                default: {
-                    option = (__bridge BRLOption *)NSMapGet(mapTable, (const void *)(NSUInteger)ch);
-                    break;
-                }
-            }
-
-            if (option.argument == BRLOptionArgumentRequired) {
-                BRLOptionParserOptionBlockWithArgument block = option.block;
-                block([NSString stringWithUTF8String:optarg]);
-            } else {
-                BRLOptionParserOptionBlock block = option.block;
-                block();
-            }
-        } @finally {
-            cached_optind = optind;
-        }
-    }
-
-    return YES;
-}
-
-- (NSString *)description
-{
-    NSMutableString *(^trimLine)(NSMutableString *) = ^NSMutableString *(NSMutableString *line) {
-        NSRange range = [line rangeOfCharacterFromSet:[[NSCharacterSet whitespaceCharacterSet] invertedSet] options:NSBackwardsSearch];
-        if (range.location != NSNotFound) {
-            line = [[line substringToIndex:range.location + 1] mutableCopy];
-        }
-        return line;
-    };
-
-    NSMutableArray *description = [NSMutableArray arrayWithObject:self.banner];
-    for (id each in self.options) {
-        NSMutableString *line = [NSMutableString new];
-        if ([each isKindOfClass:[BRLOption class]]) {
-            BRLOption *option = each;
-            [line appendString:@"    "];
-            if (option.flag) {
-                [line appendFormat:@"-%c", option.flag];
-                [line appendString:option.name ? @", " : @"  "];
-            } else {
-                [line appendString:@"    "];
-            }
-            if (option.name) {
-                [line appendFormat:@"%@%-24s   ", [self longPrefix], option.name];
-            } else {
-                [line appendString:@"                             "];
-            }
-            if (line.length > 37) {
-                line = trimLine(line);
-                [line appendString:@"\n                                     "];
-            }
-            if (option.description) {
-                [line appendString:option.description];
-            }
-            line = trimLine(line);
-        } else {
-            [line appendFormat:@"%@", each];
-        }
-        [description addObject:line];
-    }
-    return [[description componentsJoinedByString:@"\n"] stringByAppendingString:@"\n"];
-}
-
-#pragma mark -
-
-- (NSString *)longPrefix
-{
-    return self.isLongOnly ? @"-" : @"--";
-}
-
-@end
diff --git a/Pods/BRLOptionParser/LICENSE b/Pods/BRLOptionParser/LICENSE
deleted file mode 100644
index f3de6b535..000000000
--- a/Pods/BRLOptionParser/LICENSE
+++ /dev/null
@@ -1,22 +0,0 @@
-(The MIT License)
-
-Copyright © 2013-2015 Stephen Celis (<stephen@stephencelis.com>)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
diff --git a/Pods/BRLOptionParser/README.markdown b/Pods/BRLOptionParser/README.markdown
deleted file mode 100644
index 3e2284c75..000000000
--- a/Pods/BRLOptionParser/README.markdown
+++ /dev/null
@@ -1,88 +0,0 @@
-# BRLOptionParser [![Build Status][1]][2]
-
-A short wrapper for [getopt_long(3)][3] (and getopt_long_only(3)).
-
-[1]: https://img.shields.io/travis/stephencelis/BRLOptionParser.svg?style=flat
-[2]: https://travis-ci.org/stephencelis/BRLOptionParser
-[3]: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man3/getopt_long.3.html
-
-## Install
-
-With [CocoaPods][4]:
-
-``` rb
-# Podfile
-pod 'BRLOptionParser', '~> 0.3.1'
-```
-
-[4]: http://cocoapods.org
-
-## Example
-
-``` objc
-// main.m
-#import <BRLOptionParser/BRLOptionParser.h>
-
-int main(int argc, const char * argv[])
-{
-    @autoreleasepool {
-        NSString *name = @"world";
-        BOOL verbose = NO;
-
-        BRLOptionParser *options = [BRLOptionParser new];
-
-        [options setBanner:@"usage: %s [-n <name>] [-vh]", argv[0]];
-        [options addOption:"name" flag:'n' description:@"Your name" argument:&name];
-        [options addSeparator];
-        [options addOption:"verbose" flag:'v' description:nil value:&verbose];
-        __weak typeof(options) weakOptions = options;
-        [options addOption:"help" flag:'h' description:@"Show this message" block:^{
-            printf("%s", [[weakOptions description] UTF8String]);
-            exit(EXIT_SUCCESS);
-        }];
-
-        NSError *error = nil;
-        if (![options parseArgc:argc argv:argv error:&error]) {
-            const char * message = error.localizedDescription.UTF8String;
-            fprintf(stderr, "%s: %s\n", argv[0], message);
-            exit(EXIT_FAILURE);
-        }
-
-        if (verbose) {
-            fprintf(stderr, "(Preparing to say hello...)\n");
-        }
-
-        printf("Hello, %s!\n", name.UTF8String);
-    }
-
-    return EXIT_SUCCESS;
-}
-```
-
-In practice:
-
-```
-$ hello
-Hello, world!
-$ hello -h
-usage: hello [-n <name>] [-vh]
-    -n, --name                       Your name
-
-    -v, --verbose
-    -h, --help                       Show this message
-$ hello -n
-hello: option `-n' requires an argument
-$ hello --name Stephen
-Hello, Stephen!
-$ hello -vngoodbye
-(Preparing to say hello...)
-Hello, goodbye!
-$ hello --goodbye
-hello: unrecognized option `--goodbye'
-```
-
-## License
-
-BRLOptionParser is available under the MIT license. See the LICENSE file
-for more information.
-
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServer.h b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServer.h
deleted file mode 100644
index 70cb70c60..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServer.h
+++ /dev/null
@@ -1,637 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import <TargetConditionals.h>
-
-#import "GCDWebServerRequest.h"
-#import "GCDWebServerResponse.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerMatchBlock is called for every handler added to the
- *  GCDWebServer whenever a new HTTP request has started (i.e. HTTP headers have
- *  been received). The block is passed the basic info for the request (HTTP method,
- *  URL, headers...) and must decide if it wants to handle it or not.
- *
- *  If the handler can handle the request, the block must return a new
- *  GCDWebServerRequest instance created with the same basic info.
- *  Otherwise, it simply returns nil.
- */
-typedef GCDWebServerRequest* _Nullable (^GCDWebServerMatchBlock)(NSString* requestMethod, NSURL* requestURL, NSDictionary<NSString*, NSString*>* requestHeaders, NSString* urlPath, NSDictionary<NSString*, NSString*>* urlQuery);
-
-/**
- *  The GCDWebServerProcessBlock is called after the HTTP request has been fully
- *  received (i.e. the entire HTTP body has been read). The block is passed the
- *  GCDWebServerRequest created at the previous step by the GCDWebServerMatchBlock.
- *
- *  The block must return a GCDWebServerResponse or nil on error, which will
- *  result in a 500 HTTP status code returned to the client. It's however
- *  recommended to return a GCDWebServerErrorResponse on error so more useful
- *  information can be returned to the client.
- */
-typedef GCDWebServerResponse* _Nullable (^GCDWebServerProcessBlock)(__kindof GCDWebServerRequest* request);
-
-/**
- *  The GCDWebServerAsynchronousProcessBlock works like the GCDWebServerProcessBlock
- *  except the GCDWebServerResponse can be returned to the server at a later time
- *  allowing for asynchronous generation of the response.
- *
- *  The block must eventually call "completionBlock" passing a GCDWebServerResponse
- *  or nil on error, which will result in a 500 HTTP status code returned to the client.
- *  It's however recommended to return a GCDWebServerErrorResponse on error so more
- *  useful information can be returned to the client.
- */
-typedef void (^GCDWebServerCompletionBlock)(GCDWebServerResponse* _Nullable response);
-typedef void (^GCDWebServerAsyncProcessBlock)(__kindof GCDWebServerRequest* request, GCDWebServerCompletionBlock completionBlock);
-
-/**
- *  The GCDWebServerBuiltInLoggerBlock is used to override the built-in logger at runtime.
- *  The block will be passed the log level and the log message, see setLogLevel for
- *  documentation of the log levels for the built-in logger.
- */
-typedef void (^GCDWebServerBuiltInLoggerBlock)(int level, NSString* _Nonnull message);
-
-/**
- *  The port used by the GCDWebServer (NSNumber / NSUInteger).
- *
- *  The default value is 0 i.e. let the OS pick a random port.
- */
-extern NSString* const GCDWebServerOption_Port;
-
-/**
- *  The Bonjour name used by the GCDWebServer (NSString). If set to an empty string,
- *  the name will automatically take the value of the GCDWebServerOption_ServerName
- *  option. If this option is set to nil, Bonjour will be disabled.
- *
- *  The default value is nil.
- */
-extern NSString* const GCDWebServerOption_BonjourName;
-
-/**
- *  The Bonjour service type used by the GCDWebServer (NSString).
- *
- *  The default value is "_http._tcp", the service type for HTTP web servers.
- */
-extern NSString* const GCDWebServerOption_BonjourType;
-
-/**
- *  Request a port mapping in the NAT gateway (NSNumber / BOOL).
- *
- *  This uses the DNSService API under the hood which supports IPv4 mappings only.
- *
- *  The default value is NO.
- *
- *  @warning The external port set up by the NAT gateway may be different than
- *  the one used by the GCDWebServer.
- */
-extern NSString* const GCDWebServerOption_RequestNATPortMapping;
-
-/**
- *  Only accept HTTP requests coming from localhost i.e. not from the outside
- *  network (NSNumber / BOOL).
- *
- *  The default value is NO.
- *
- *  @warning Bonjour and NAT port mapping should be disabled if using this option
- *  since the server will not be reachable from the outside network anyway.
- */
-extern NSString* const GCDWebServerOption_BindToLocalhost;
-
-/**
- *  The maximum number of incoming HTTP requests that can be queued waiting to
- *  be handled before new ones are dropped (NSNumber / NSUInteger).
- *
- *  The default value is 16.
- */
-extern NSString* const GCDWebServerOption_MaxPendingConnections;
-
-/**
- *  The value for "Server" HTTP header used by the GCDWebServer (NSString).
- *
- *  The default value is the GCDWebServer class name.
- */
-extern NSString* const GCDWebServerOption_ServerName;
-
-/**
- *  The authentication method used by the GCDWebServer
- *  (one of "GCDWebServerAuthenticationMethod_...").
- *
- *  The default value is nil i.e. authentication is disabled.
- */
-extern NSString* const GCDWebServerOption_AuthenticationMethod;
-
-/**
- *  The authentication realm used by the GCDWebServer (NSString).
- *
- *  The default value is the same as the GCDWebServerOption_ServerName option.
- */
-extern NSString* const GCDWebServerOption_AuthenticationRealm;
-
-/**
- *  The authentication accounts used by the GCDWebServer
- *  (NSDictionary of username / password pairs).
- *
- *  The default value is nil i.e. no accounts.
- */
-extern NSString* const GCDWebServerOption_AuthenticationAccounts;
-
-/**
- *  The class used by the GCDWebServer when instantiating GCDWebServerConnection
- *  (subclass of GCDWebServerConnection).
- *
- *  The default value is the GCDWebServerConnection class.
- */
-extern NSString* const GCDWebServerOption_ConnectionClass;
-
-/**
- *  Allow the GCDWebServer to pretend "HEAD" requests are actually "GET" ones
- *  and automatically discard the HTTP body of the response (NSNumber / BOOL).
- *
- *  The default value is YES.
- */
-extern NSString* const GCDWebServerOption_AutomaticallyMapHEADToGET;
-
-/**
- *  The interval expressed in seconds used by the GCDWebServer to decide how to
- *  coalesce calls to -webServerDidConnect: and -webServerDidDisconnect:
- *  (NSNumber / double). Coalescing will be disabled if the interval is <= 0.0.
- *
- *  The default value is 1.0 second.
- */
-extern NSString* const GCDWebServerOption_ConnectedStateCoalescingInterval;
-
-/**
- *  Set the dispatch queue priority on which server connection will be 
- *  run (NSNumber / long).
- *
- *
- *  The default value is DISPATCH_QUEUE_PRIORITY_DEFAULT.
- */
-extern NSString* const GCDWebServerOption_DispatchQueuePriority;
-
-#if TARGET_OS_IPHONE
-
-/**
- *  Enables the GCDWebServer to automatically suspend itself (as if -stop was
- *  called) when the iOS app goes into the background and the last
- *  GCDWebServerConnection is closed, then resume itself (as if -start was called)
- *  when the iOS app comes back to the foreground (NSNumber / BOOL).
- *
- *  See the README.md file for more information about this option.
- *
- *  The default value is YES.
- *
- *  @warning The running property will be NO while the GCDWebServer is suspended.
- */
-extern NSString* const GCDWebServerOption_AutomaticallySuspendInBackground;
-
-#endif
-
-/**
- *  HTTP Basic Authentication scheme (see https://tools.ietf.org/html/rfc2617).
- *
- *  @warning Use of this authentication scheme is not recommended as the
- *  passwords are sent in clear.
- */
-extern NSString* const GCDWebServerAuthenticationMethod_Basic;
-
-/**
- *  HTTP Digest Access Authentication scheme (see https://tools.ietf.org/html/rfc2617).
- */
-extern NSString* const GCDWebServerAuthenticationMethod_DigestAccess;
-
-@class GCDWebServer;
-
-/**
- *  Delegate methods for GCDWebServer.
- *
- *  @warning These methods are always called on the main thread in a serialized way.
- */
-@protocol GCDWebServerDelegate <NSObject>
-@optional
-
-/**
- *  This method is called after the server has successfully started.
- */
-- (void)webServerDidStart:(GCDWebServer*)server;
-
-/**
- *  This method is called after the Bonjour registration for the server has
- *  successfully completed.
- *
- *  Use the "bonjourServerURL" property to retrieve the Bonjour address of the
- *  server.
- */
-- (void)webServerDidCompleteBonjourRegistration:(GCDWebServer*)server;
-
-/**
- *  This method is called after the NAT port mapping for the server has been
- *  updated.
- *
- *  Use the "publicServerURL" property to retrieve the public address of the
- *  server.
- */
-- (void)webServerDidUpdateNATPortMapping:(GCDWebServer*)server;
-
-/**
- *  This method is called when the first GCDWebServerConnection is opened by the
- *  server to serve a series of HTTP requests.
- *
- *  A series of HTTP requests is considered ongoing as long as new HTTP requests
- *  keep coming (and new GCDWebServerConnection instances keep being opened),
- *  until before the last HTTP request has been responded to (and the
- *  corresponding last GCDWebServerConnection closed).
- */
-- (void)webServerDidConnect:(GCDWebServer*)server;
-
-/**
- *  This method is called when the last GCDWebServerConnection is closed after
- *  the server has served a series of HTTP requests.
- *
- *  The GCDWebServerOption_ConnectedStateCoalescingInterval option can be used
- *  to have the server wait some extra delay before considering that the series
- *  of HTTP requests has ended (in case there some latency between consecutive
- *  requests). This effectively coalesces the calls to -webServerDidConnect:
- *  and -webServerDidDisconnect:.
- */
-- (void)webServerDidDisconnect:(GCDWebServer*)server;
-
-/**
- *  This method is called after the server has stopped.
- */
-- (void)webServerDidStop:(GCDWebServer*)server;
-
-@end
-
-/**
- *  The GCDWebServer class listens for incoming HTTP requests on a given port,
- *  then passes each one to a "handler" capable of generating an HTTP response
- *  for it, which is then sent back to the client.
- *
- *  GCDWebServer instances can be created and used from any thread but it's
- *  recommended to have the main thread's runloop be running so internal callbacks
- *  can be handled e.g. for Bonjour registration.
- *
- *  See the README.md file for more information about the architecture of GCDWebServer.
- */
-@interface GCDWebServer : NSObject
-
-/**
- *  Sets the delegate for the server.
- */
-@property(nonatomic, weak, nullable) id<GCDWebServerDelegate> delegate;
-
-/**
- *  Returns YES if the server is currently running.
- */
-@property(nonatomic, readonly, getter=isRunning) BOOL running;
-
-/**
- *  Returns the port used by the server.
- *
- *  @warning This property is only valid if the server is running.
- */
-@property(nonatomic, readonly) NSUInteger port;
-
-/**
- *  Returns the Bonjour name used by the server.
- *
- *  @warning This property is only valid if the server is running and Bonjour
- *  registration has successfully completed, which can take up to a few seconds.
- */
-@property(nonatomic, readonly, nullable) NSString* bonjourName;
-
-/**
- *  Returns the Bonjour service type used by the server.
- *
- *  @warning This property is only valid if the server is running and Bonjour
- *  registration has successfully completed, which can take up to a few seconds.
- */
-@property(nonatomic, readonly, nullable) NSString* bonjourType;
-
-/**
- *  This method is the designated initializer for the class.
- */
-- (instancetype)init;
-
-/**
- *  Adds to the server a handler that generates responses synchronously when handling incoming HTTP requests.
- *
- *  Handlers are called in a LIFO queue, so if multiple handlers can potentially
- *  respond to a given request, the latest added one wins.
- *
- *  @warning Addling handlers while the server is running is not allowed.
- */
-- (void)addHandlerWithMatchBlock:(GCDWebServerMatchBlock)matchBlock processBlock:(GCDWebServerProcessBlock)processBlock;
-
-/**
- *  Adds to the server a handler that generates responses asynchronously when handling incoming HTTP requests.
- *
- *  Handlers are called in a LIFO queue, so if multiple handlers can potentially
- *  respond to a given request, the latest added one wins.
- *
- *  @warning Addling handlers while the server is running is not allowed.
- */
-- (void)addHandlerWithMatchBlock:(GCDWebServerMatchBlock)matchBlock asyncProcessBlock:(GCDWebServerAsyncProcessBlock)processBlock;
-
-/**
- *  Removes all handlers previously added to the server.
- *
- *  @warning Removing handlers while the server is running is not allowed.
- */
-- (void)removeAllHandlers;
-
-/**
- *  Starts the server with explicit options. This method is the designated way
- *  to start the server.
- *
- *  Returns NO if the server failed to start and sets "error" argument if not NULL.
- */
-- (BOOL)startWithOptions:(nullable NSDictionary<NSString*, id>*)options error:(NSError** _Nullable)error;
-
-/**
- *  Stops the server and prevents it to accepts new HTTP requests.
- *
- *  @warning Stopping the server does not abort GCDWebServerConnection instances
- *  currently handling already received HTTP requests. These connections will
- *  continue to execute normally until completion.
- */
-- (void)stop;
-
-@end
-
-@interface GCDWebServer (Extensions)
-
-/**
- *  Returns the server's URL.
- *
- *  @warning This property is only valid if the server is running.
- */
-@property(nonatomic, readonly, nullable) NSURL* serverURL;
-
-/**
- *  Returns the server's Bonjour URL.
- *
- *  @warning This property is only valid if the server is running and Bonjour
- *  registration has successfully completed, which can take up to a few seconds.
- *  Also be aware this property will not automatically update if the Bonjour hostname
- *  has been dynamically changed after the server started running (this should be rare).
- */
-@property(nonatomic, readonly, nullable) NSURL* bonjourServerURL;
-
-/**
- *  Returns the server's public URL.
- *
- *  @warning This property is only valid if the server is running and NAT port
- *  mapping is active.
- */
-@property(nonatomic, readonly, nullable) NSURL* publicServerURL;
-
-/**
- *  Starts the server on port 8080 (OS X & iOS Simulator) or port 80 (iOS)
- *  using the default Bonjour name.
- *
- *  Returns NO if the server failed to start.
- */
-- (BOOL)start;
-
-/**
- *  Starts the server on a given port and with a specific Bonjour name.
- *  Pass a nil Bonjour name to disable Bonjour entirely or an empty string to
- *  use the default name.
- *
- *  Returns NO if the server failed to start.
- */
-- (BOOL)startWithPort:(NSUInteger)port bonjourName:(nullable NSString*)name;
-
-#if !TARGET_OS_IPHONE
-
-/**
- *  Runs the server synchronously using -startWithPort:bonjourName: until a
- *  SIGINT signal is received i.e. Ctrl-C. This method is intended to be used
- *  by command line tools.
- *
- *  Returns NO if the server failed to start.
- *
- *  @warning This method must be used from the main thread only.
- */
-- (BOOL)runWithPort:(NSUInteger)port bonjourName:(nullable NSString*)name;
-
-/**
- *  Runs the server synchronously using -startWithOptions: until a SIGTERM or
- *  SIGINT signal is received i.e. Ctrl-C in Terminal. This method is intended to
- *  be used by command line tools.
- *
- *  Returns NO if the server failed to start and sets "error" argument if not NULL.
- *
- *  @warning This method must be used from the main thread only.
- */
-- (BOOL)runWithOptions:(nullable NSDictionary<NSString*, id>*)options error:(NSError** _Nullable)error;
-
-#endif
-
-@end
-
-@interface GCDWebServer (Handlers)
-
-/**
- *  Adds a default handler to the server to handle all incoming HTTP requests
- *  with a given HTTP method and generate responses synchronously.
- */
-- (void)addDefaultHandlerForMethod:(NSString*)method requestClass:(Class)aClass processBlock:(GCDWebServerProcessBlock)block;
-
-/**
- *  Adds a default handler to the server to handle all incoming HTTP requests
- *  with a given HTTP method and generate responses asynchronously.
- */
-- (void)addDefaultHandlerForMethod:(NSString*)method requestClass:(Class)aClass asyncProcessBlock:(GCDWebServerAsyncProcessBlock)block;
-
-/**
- *  Adds a handler to the server to handle incoming HTTP requests with a given
- *  HTTP method and a specific case-insensitive path  and generate responses
- *  synchronously.
- */
-- (void)addHandlerForMethod:(NSString*)method path:(NSString*)path requestClass:(Class)aClass processBlock:(GCDWebServerProcessBlock)block;
-
-/**
- *  Adds a handler to the server to handle incoming HTTP requests with a given
- *  HTTP method and a specific case-insensitive path and generate responses
- *  asynchronously.
- */
-- (void)addHandlerForMethod:(NSString*)method path:(NSString*)path requestClass:(Class)aClass asyncProcessBlock:(GCDWebServerAsyncProcessBlock)block;
-
-/**
- *  Adds a handler to the server to handle incoming HTTP requests with a given
- *  HTTP method and a path matching a case-insensitive regular expression and
- *  generate responses synchronously.
- */
-- (void)addHandlerForMethod:(NSString*)method pathRegex:(NSString*)regex requestClass:(Class)aClass processBlock:(GCDWebServerProcessBlock)block;
-
-/**
- *  Adds a handler to the server to handle incoming HTTP requests with a given
- *  HTTP method and a path matching a case-insensitive regular expression and
- *  generate responses asynchronously.
- */
-- (void)addHandlerForMethod:(NSString*)method pathRegex:(NSString*)regex requestClass:(Class)aClass asyncProcessBlock:(GCDWebServerAsyncProcessBlock)block;
-
-@end
-
-@interface GCDWebServer (GETHandlers)
-
-/**
- *  Adds a handler to the server to respond to incoming "GET" HTTP requests
- *  with a specific case-insensitive path with in-memory data.
- */
-- (void)addGETHandlerForPath:(NSString*)path staticData:(NSData*)staticData contentType:(nullable NSString*)contentType cacheAge:(NSUInteger)cacheAge;
-
-/**
- *  Adds a handler to the server to respond to incoming "GET" HTTP requests
- *  with a specific case-insensitive path with a file.
- */
-- (void)addGETHandlerForPath:(NSString*)path filePath:(NSString*)filePath isAttachment:(BOOL)isAttachment cacheAge:(NSUInteger)cacheAge allowRangeRequests:(BOOL)allowRangeRequests;
-
-/**
- *  Adds a handler to the server to respond to incoming "GET" HTTP requests
- *  with a case-insensitive path inside a base path with the corresponding file
- *  inside a local directory. If no local file matches the request path, a 401
- *  HTTP status code is returned to the client.
- *
- *  The "indexFilename" argument allows to specify an "index" file name to use
- *  when the request path corresponds to a directory.
- */
-- (void)addGETHandlerForBasePath:(NSString*)basePath directoryPath:(NSString*)directoryPath indexFilename:(nullable NSString*)indexFilename cacheAge:(NSUInteger)cacheAge allowRangeRequests:(BOOL)allowRangeRequests;
-
-@end
-
-/**
- *  GCDWebServer provides its own built-in logging facility which is used by
- *  default. It simply sends log messages to stderr assuming it is connected
- *  to a terminal type device.
- *
- *  GCDWebServer is also compatible with a limited set of third-party logging
- *  facilities. If one of them is available at compile time, GCDWebServer will
- *  automatically use it in place of the built-in one.
- *
- *  Currently supported third-party logging facilities are:
- *  - XLFacility (by the same author as GCDWebServer): https://github.com/swisspol/XLFacility
- *
- *  For the built-in logging facility, the default logging level is INFO
- *  (or DEBUG if the preprocessor constant "DEBUG" evaluates to non-zero at
- *  compile time).
- *
- *  It's possible to have GCDWebServer use a custom logging facility by defining
- *  the "__GCDWEBSERVER_LOGGING_HEADER__" preprocessor constant in Xcode build
- *  settings to the name of a custom header file (escaped like \"MyLogging.h\").
- *  This header file must define the following set of macros:
- *
- *    GWS_LOG_DEBUG(...)
- *    GWS_LOG_VERBOSE(...)
- *    GWS_LOG_INFO(...)
- *    GWS_LOG_WARNING(...)
- *    GWS_LOG_ERROR(...)
- *
- *  IMPORTANT: These macros must behave like NSLog(). Furthermore the GWS_LOG_DEBUG()
- *  macro should not do anything unless the preprocessor constant "DEBUG" evaluates
- *  to non-zero.
- *
- *  The logging methods below send log messages to the same logging facility
- *  used by GCDWebServer. They can be used for consistency wherever you interact
- *  with GCDWebServer in your code (e.g. in the implementation of handlers).
- */
-@interface GCDWebServer (Logging)
-
-/**
- *  Sets the log level of the logging facility below which log messages are discarded.
- *
- *  @warning The interpretation of the "level" argument depends on the logging
- *  facility used at compile time.
- *
- *  If using the built-in logging facility, the log levels are as follow:
- *  DEBUG = 0
- *  VERBOSE = 1
- *  INFO = 2
- *  WARNING = 3
- *  ERROR = 4
- */
-+ (void)setLogLevel:(int)level;
-
-/**
- *  Set a logger to be used instead of the built-in logger which logs to stderr.
- *
- *  IMPORTANT: In order for this override to work, you should not be specifying
- *  a custom logger at compile time with "__GCDWEBSERVER_LOGGING_HEADER__".
- */
-+ (void)setBuiltInLogger:(GCDWebServerBuiltInLoggerBlock)block;
-
-/**
- *  Logs a message to the logging facility at the VERBOSE level.
- */
-- (void)logVerbose:(NSString*)format, ... NS_FORMAT_FUNCTION(1, 2);
-
-/**
- *  Logs a message to the logging facility at the INFO level.
- */
-- (void)logInfo:(NSString*)format, ... NS_FORMAT_FUNCTION(1, 2);
-
-/**
- *  Logs a message to the logging facility at the WARNING level.
- */
-- (void)logWarning:(NSString*)format, ... NS_FORMAT_FUNCTION(1, 2);
-
-/**
- *  Logs a message to the logging facility at the ERROR level.
- */
-- (void)logError:(NSString*)format, ... NS_FORMAT_FUNCTION(1, 2);
-
-@end
-
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-
-@interface GCDWebServer (Testing)
-
-/**
- *  Activates recording of HTTP requests and responses which create files in the
- *  current directory containing the raw data for all requests and responses.
- *
- *  @warning The current directory must not contain any prior recording files.
- */
-@property(nonatomic, getter=isRecordingEnabled) BOOL recordingEnabled;
-
-/**
- *  Runs tests by playing back pre-recorded HTTP requests in the given directory
- *  and comparing the generated responses with the pre-recorded ones.
- *
- *  Returns the number of failed tests or -1 if server failed to start.
- */
-- (NSInteger)runTestsWithOptions:(nullable NSDictionary<NSString*, id>*)options inDirectory:(NSString*)path;
-
-@end
-
-#endif
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServer.m b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServer.m
deleted file mode 100644
index 655b2bda7..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServer.m
+++ /dev/null
@@ -1,1310 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import <TargetConditionals.h>
-#if TARGET_OS_IPHONE
-#import <UIKit/UIKit.h>
-#else
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-#import <AppKit/AppKit.h>
-#endif
-#endif
-#import <netinet/in.h>
-#import <dns_sd.h>
-
-#import "GCDWebServerPrivate.h"
-
-#if TARGET_OS_IPHONE && !TARGET_IPHONE_SIMULATOR
-#define kDefaultPort 80
-#else
-#define kDefaultPort 8080
-#endif
-
-#define kBonjourResolutionTimeout 5.0
-
-NSString* const GCDWebServerOption_Port = @"Port";
-NSString* const GCDWebServerOption_BonjourName = @"BonjourName";
-NSString* const GCDWebServerOption_BonjourType = @"BonjourType";
-NSString* const GCDWebServerOption_RequestNATPortMapping = @"RequestNATPortMapping";
-NSString* const GCDWebServerOption_BindToLocalhost = @"BindToLocalhost";
-NSString* const GCDWebServerOption_MaxPendingConnections = @"MaxPendingConnections";
-NSString* const GCDWebServerOption_ServerName = @"ServerName";
-NSString* const GCDWebServerOption_AuthenticationMethod = @"AuthenticationMethod";
-NSString* const GCDWebServerOption_AuthenticationRealm = @"AuthenticationRealm";
-NSString* const GCDWebServerOption_AuthenticationAccounts = @"AuthenticationAccounts";
-NSString* const GCDWebServerOption_ConnectionClass = @"ConnectionClass";
-NSString* const GCDWebServerOption_AutomaticallyMapHEADToGET = @"AutomaticallyMapHEADToGET";
-NSString* const GCDWebServerOption_ConnectedStateCoalescingInterval = @"ConnectedStateCoalescingInterval";
-NSString* const GCDWebServerOption_DispatchQueuePriority = @"DispatchQueuePriority";
-#if TARGET_OS_IPHONE
-NSString* const GCDWebServerOption_AutomaticallySuspendInBackground = @"AutomaticallySuspendInBackground";
-#endif
-
-NSString* const GCDWebServerAuthenticationMethod_Basic = @"Basic";
-NSString* const GCDWebServerAuthenticationMethod_DigestAccess = @"DigestAccess";
-
-#if defined(__GCDWEBSERVER_LOGGING_FACILITY_BUILTIN__)
-#if DEBUG
-GCDWebServerLoggingLevel GCDWebServerLogLevel = kGCDWebServerLoggingLevel_Debug;
-#else
-GCDWebServerLoggingLevel GCDWebServerLogLevel = kGCDWebServerLoggingLevel_Info;
-#endif
-#endif
-
-#if !TARGET_OS_IPHONE
-static BOOL _run;
-#endif
-
-#ifdef __GCDWEBSERVER_LOGGING_FACILITY_BUILTIN__
-
-static GCDWebServerBuiltInLoggerBlock _builtInLoggerBlock;
-
-void GCDWebServerLogMessage(GCDWebServerLoggingLevel level, NSString* format, ...) {
-  static const char* levelNames[] = {"DEBUG", "VERBOSE", "INFO", "WARNING", "ERROR"};
-  static int enableLogging = -1;
-  if (enableLogging < 0) {
-    enableLogging = (isatty(STDERR_FILENO) ? 1 : 0);
-  }
-  if (_builtInLoggerBlock || enableLogging) {
-    va_list arguments;
-    va_start(arguments, format);
-    NSString* message = [[NSString alloc] initWithFormat:format arguments:arguments];
-    va_end(arguments);
-    if (_builtInLoggerBlock) {
-      _builtInLoggerBlock(level, message);
-    } else {
-      fprintf(stderr, "[%s] %s\n", levelNames[level], [message UTF8String]);
-    }
-  }
-}
-
-#endif
-
-#if !TARGET_OS_IPHONE
-
-static void _SignalHandler(int signal) {
-  _run = NO;
-  printf("\n");
-}
-
-#endif
-
-#if !TARGET_OS_IPHONE || defined(__GCDWEBSERVER_ENABLE_TESTING__)
-
-// This utility function is used to ensure scheduled callbacks on the main thread are called when running the server synchronously
-// https://developer.apple.com/library/mac/documentation/General/Conceptual/ConcurrencyProgrammingGuide/OperationQueues/OperationQueues.html
-// The main queue works with the application’s run loop to interleave the execution of queued tasks with the execution of other event sources attached to the run loop
-// TODO: Ensure all scheduled blocks on the main queue are also executed
-static void _ExecuteMainThreadRunLoopSources() {
-  SInt32 result;
-  do {
-    result = CFRunLoopRunInMode(kCFRunLoopDefaultMode, 0.0, true);
-  } while (result == kCFRunLoopRunHandledSource);
-}
-
-#endif
-
-@implementation GCDWebServerHandler
-
-- (instancetype)initWithMatchBlock:(GCDWebServerMatchBlock _Nonnull)matchBlock asyncProcessBlock:(GCDWebServerAsyncProcessBlock _Nonnull)processBlock {
-  if ((self = [super init])) {
-    _matchBlock = [matchBlock copy];
-    _asyncProcessBlock = [processBlock copy];
-  }
-  return self;
-}
-
-@end
-
-@implementation GCDWebServer {
-  dispatch_queue_t _syncQueue;
-  dispatch_group_t _sourceGroup;
-  NSMutableArray<GCDWebServerHandler*>* _handlers;
-  NSInteger _activeConnections;  // Accessed through _syncQueue only
-  BOOL _connected;  // Accessed on main thread only
-  CFRunLoopTimerRef _disconnectTimer;  // Accessed on main thread only
-
-  NSDictionary<NSString*, id>* _options;
-  NSMutableDictionary<NSString*, NSString*>* _authenticationBasicAccounts;
-  NSMutableDictionary<NSString*, NSString*>* _authenticationDigestAccounts;
-  Class _connectionClass;
-  CFTimeInterval _disconnectDelay;
-  dispatch_source_t _source4;
-  dispatch_source_t _source6;
-  CFNetServiceRef _registrationService;
-  CFNetServiceRef _resolutionService;
-  DNSServiceRef _dnsService;
-  CFSocketRef _dnsSocket;
-  CFRunLoopSourceRef _dnsSource;
-  NSString* _dnsAddress;
-  NSUInteger _dnsPort;
-  BOOL _bindToLocalhost;
-#if TARGET_OS_IPHONE
-  BOOL _suspendInBackground;
-  UIBackgroundTaskIdentifier _backgroundTask;
-#endif
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-  BOOL _recording;
-#endif
-}
-
-+ (void)initialize {
-  GCDWebServerInitializeFunctions();
-}
-
-- (instancetype)init {
-  if ((self = [super init])) {
-    _syncQueue = dispatch_queue_create([NSStringFromClass([self class]) UTF8String], DISPATCH_QUEUE_SERIAL);
-    _sourceGroup = dispatch_group_create();
-    _handlers = [[NSMutableArray alloc] init];
-#if TARGET_OS_IPHONE
-    _backgroundTask = UIBackgroundTaskInvalid;
-#endif
-  }
-  return self;
-}
-
-- (void)dealloc {
-  GWS_DCHECK(_connected == NO);
-  GWS_DCHECK(_activeConnections == 0);
-  GWS_DCHECK(_options == nil);  // The server can never be dealloc'ed while running because of the retain-cycle with the dispatch source
-  GWS_DCHECK(_disconnectTimer == NULL);  // The server can never be dealloc'ed while the disconnect timer is pending because of the retain-cycle
-
-#if !OS_OBJECT_USE_OBJC_RETAIN_RELEASE
-  dispatch_release(_sourceGroup);
-  dispatch_release(_syncQueue);
-#endif
-}
-
-#if TARGET_OS_IPHONE
-
-// Always called on main thread
-- (void)_startBackgroundTask {
-  GWS_DCHECK([NSThread isMainThread]);
-  if (_backgroundTask == UIBackgroundTaskInvalid) {
-    GWS_LOG_DEBUG(@"Did start background task");
-    _backgroundTask = [[UIApplication sharedApplication] beginBackgroundTaskWithExpirationHandler:^{
-      GWS_LOG_WARNING(@"Application is being suspended while %@ is still connected", [self class]);
-      [self _endBackgroundTask];
-    }];
-  } else {
-    GWS_DNOT_REACHED();
-  }
-}
-
-#endif
-
-// Always called on main thread
-- (void)_didConnect {
-  GWS_DCHECK([NSThread isMainThread]);
-  GWS_DCHECK(_connected == NO);
-  _connected = YES;
-  GWS_LOG_DEBUG(@"Did connect");
-
-#if TARGET_OS_IPHONE
-  if ([[UIApplication sharedApplication] applicationState] != UIApplicationStateBackground) {
-    [self _startBackgroundTask];
-  }
-#endif
-
-  if ([_delegate respondsToSelector:@selector(webServerDidConnect:)]) {
-    [_delegate webServerDidConnect:self];
-  }
-}
-
-- (void)willStartConnection:(GCDWebServerConnection*)connection {
-  dispatch_sync(_syncQueue, ^{
-    GWS_DCHECK(self->_activeConnections >= 0);
-    if (self->_activeConnections == 0) {
-      dispatch_async(dispatch_get_main_queue(), ^{
-        if (self->_disconnectTimer) {
-          CFRunLoopTimerInvalidate(self->_disconnectTimer);
-          CFRelease(self->_disconnectTimer);
-          self->_disconnectTimer = NULL;
-        }
-        if (self->_connected == NO) {
-          [self _didConnect];
-        }
-      });
-    }
-    self->_activeConnections += 1;
-  });
-}
-
-#if TARGET_OS_IPHONE
-
-// Always called on main thread
-- (void)_endBackgroundTask {
-  GWS_DCHECK([NSThread isMainThread]);
-  if (_backgroundTask != UIBackgroundTaskInvalid) {
-    if (_suspendInBackground && ([[UIApplication sharedApplication] applicationState] == UIApplicationStateBackground) && _source4) {
-      [self _stop];
-    }
-    [[UIApplication sharedApplication] endBackgroundTask:_backgroundTask];
-    _backgroundTask = UIBackgroundTaskInvalid;
-    GWS_LOG_DEBUG(@"Did end background task");
-  }
-}
-
-#endif
-
-// Always called on main thread
-- (void)_didDisconnect {
-  GWS_DCHECK([NSThread isMainThread]);
-  GWS_DCHECK(_connected == YES);
-  _connected = NO;
-  GWS_LOG_DEBUG(@"Did disconnect");
-
-#if TARGET_OS_IPHONE
-  [self _endBackgroundTask];
-#endif
-
-  if ([_delegate respondsToSelector:@selector(webServerDidDisconnect:)]) {
-    [_delegate webServerDidDisconnect:self];
-  }
-}
-
-- (void)didEndConnection:(GCDWebServerConnection*)connection {
-  dispatch_sync(_syncQueue, ^{
-    GWS_DCHECK(self->_activeConnections > 0);
-    self->_activeConnections -= 1;
-    if (self->_activeConnections == 0) {
-      dispatch_async(dispatch_get_main_queue(), ^{
-        if ((self->_disconnectDelay > 0.0) && (self->_source4 != NULL)) {
-          if (self->_disconnectTimer) {
-            CFRunLoopTimerInvalidate(self->_disconnectTimer);
-            CFRelease(self->_disconnectTimer);
-          }
-          self->_disconnectTimer = CFRunLoopTimerCreateWithHandler(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent() + self->_disconnectDelay, 0.0, 0, 0, ^(CFRunLoopTimerRef timer) {
-            GWS_DCHECK([NSThread isMainThread]);
-            [self _didDisconnect];
-            CFRelease(self->_disconnectTimer);
-            self->_disconnectTimer = NULL;
-          });
-          CFRunLoopAddTimer(CFRunLoopGetMain(), self->_disconnectTimer, kCFRunLoopCommonModes);
-        } else {
-          [self _didDisconnect];
-        }
-      });
-    }
-  });
-}
-
-- (NSString*)bonjourName {
-  CFStringRef name = _resolutionService ? CFNetServiceGetName(_resolutionService) : NULL;
-  return name && CFStringGetLength(name) ? CFBridgingRelease(CFStringCreateCopy(kCFAllocatorDefault, name)) : nil;
-}
-
-- (NSString*)bonjourType {
-  CFStringRef type = _resolutionService ? CFNetServiceGetType(_resolutionService) : NULL;
-  return type && CFStringGetLength(type) ? CFBridgingRelease(CFStringCreateCopy(kCFAllocatorDefault, type)) : nil;
-}
-
-- (void)addHandlerWithMatchBlock:(GCDWebServerMatchBlock)matchBlock processBlock:(GCDWebServerProcessBlock)processBlock {
-  [self addHandlerWithMatchBlock:matchBlock
-               asyncProcessBlock:^(GCDWebServerRequest* request, GCDWebServerCompletionBlock completionBlock) {
-                 completionBlock(processBlock(request));
-               }];
-}
-
-- (void)addHandlerWithMatchBlock:(GCDWebServerMatchBlock)matchBlock asyncProcessBlock:(GCDWebServerAsyncProcessBlock)processBlock {
-  GWS_DCHECK(_options == nil);
-  GCDWebServerHandler* handler = [[GCDWebServerHandler alloc] initWithMatchBlock:matchBlock asyncProcessBlock:processBlock];
-  [_handlers insertObject:handler atIndex:0];
-}
-
-- (void)removeAllHandlers {
-  GWS_DCHECK(_options == nil);
-  [_handlers removeAllObjects];
-}
-
-static void _NetServiceRegisterCallBack(CFNetServiceRef service, CFStreamError* error, void* info) {
-  GWS_DCHECK([NSThread isMainThread]);
-  @autoreleasepool {
-    if (error->error) {
-      GWS_LOG_ERROR(@"Bonjour registration error %i (domain %i)", (int)error->error, (int)error->domain);
-    } else {
-      GCDWebServer* server = (__bridge GCDWebServer*)info;
-      GWS_LOG_VERBOSE(@"Bonjour registration complete for %@", [server class]);
-      if (!CFNetServiceResolveWithTimeout(server->_resolutionService, kBonjourResolutionTimeout, NULL)) {
-        GWS_LOG_ERROR(@"Failed starting Bonjour resolution");
-        GWS_DNOT_REACHED();
-      }
-    }
-  }
-}
-
-static void _NetServiceResolveCallBack(CFNetServiceRef service, CFStreamError* error, void* info) {
-  GWS_DCHECK([NSThread isMainThread]);
-  @autoreleasepool {
-    if (error->error) {
-      if ((error->domain != kCFStreamErrorDomainNetServices) && (error->error != kCFNetServicesErrorTimeout)) {
-        GWS_LOG_ERROR(@"Bonjour resolution error %i (domain %i)", (int)error->error, (int)error->domain);
-      }
-    } else {
-      GCDWebServer* server = (__bridge GCDWebServer*)info;
-      GWS_LOG_INFO(@"%@ now locally reachable at %@", [server class], server.bonjourServerURL);
-      if ([server.delegate respondsToSelector:@selector(webServerDidCompleteBonjourRegistration:)]) {
-        [server.delegate webServerDidCompleteBonjourRegistration:server];
-      }
-    }
-  }
-}
-
-static void _DNSServiceCallBack(DNSServiceRef sdRef, DNSServiceFlags flags, uint32_t interfaceIndex, DNSServiceErrorType errorCode, uint32_t externalAddress, DNSServiceProtocol protocol, uint16_t internalPort, uint16_t externalPort, uint32_t ttl, void* context) {
-  GWS_DCHECK([NSThread isMainThread]);
-  @autoreleasepool {
-    GCDWebServer* server = (__bridge GCDWebServer*)context;
-    if ((errorCode == kDNSServiceErr_NoError) || (errorCode == kDNSServiceErr_DoubleNAT)) {
-      struct sockaddr_in addr4;
-      bzero(&addr4, sizeof(addr4));
-      addr4.sin_len = sizeof(addr4);
-      addr4.sin_family = AF_INET;
-      addr4.sin_addr.s_addr = externalAddress;  // Already in network byte order
-      server->_dnsAddress = GCDWebServerStringFromSockAddr((const struct sockaddr*)&addr4, NO);
-      server->_dnsPort = ntohs(externalPort);
-      GWS_LOG_INFO(@"%@ now publicly reachable at %@", [server class], server.publicServerURL);
-    } else {
-      GWS_LOG_ERROR(@"DNS service error %i", errorCode);
-      server->_dnsAddress = nil;
-      server->_dnsPort = 0;
-    }
-    if ([server.delegate respondsToSelector:@selector(webServerDidUpdateNATPortMapping:)]) {
-      [server.delegate webServerDidUpdateNATPortMapping:server];
-    }
-  }
-}
-
-static void _SocketCallBack(CFSocketRef s, CFSocketCallBackType type, CFDataRef address, const void* data, void* info) {
-  GWS_DCHECK([NSThread isMainThread]);
-  @autoreleasepool {
-    GCDWebServer* server = (__bridge GCDWebServer*)info;
-    DNSServiceErrorType status = DNSServiceProcessResult(server->_dnsService);
-    if (status != kDNSServiceErr_NoError) {
-      GWS_LOG_ERROR(@"DNS service error %i", status);
-    }
-  }
-}
-
-static inline id _GetOption(NSDictionary<NSString*, id>* options, NSString* key, id defaultValue) {
-  id value = [options objectForKey:key];
-  return value ? value : defaultValue;
-}
-
-static inline NSString* _EncodeBase64(NSString* string) {
-  NSData* data = [string dataUsingEncoding:NSUTF8StringEncoding];
-#if TARGET_OS_IPHONE || (__MAC_OS_X_VERSION_MIN_REQUIRED >= __MAC_10_9)
-  return [[NSString alloc] initWithData:[data base64EncodedDataWithOptions:0] encoding:NSASCIIStringEncoding];
-#else
-  if (@available(macOS 10.9, *)) {
-    return [[NSString alloc] initWithData:[data base64EncodedDataWithOptions:0] encoding:NSASCIIStringEncoding];
-  }
-  return [data base64Encoding];
-#endif
-}
-
-- (int)_createListeningSocket:(BOOL)useIPv6
-                 localAddress:(const void*)address
-                       length:(socklen_t)length
-        maxPendingConnections:(NSUInteger)maxPendingConnections
-                        error:(NSError**)error {
-  int listeningSocket = socket(useIPv6 ? PF_INET6 : PF_INET, SOCK_STREAM, IPPROTO_TCP);
-  if (listeningSocket > 0) {
-    int yes = 1;
-    setsockopt(listeningSocket, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes));
-
-    if (bind(listeningSocket, address, length) == 0) {
-      if (listen(listeningSocket, (int)maxPendingConnections) == 0) {
-        GWS_LOG_DEBUG(@"Did open %s listening socket %i", useIPv6 ? "IPv6" : "IPv4", listeningSocket);
-        return listeningSocket;
-      } else {
-        if (error) {
-          *error = GCDWebServerMakePosixError(errno);
-        }
-        GWS_LOG_ERROR(@"Failed starting %s listening socket: %s (%i)", useIPv6 ? "IPv6" : "IPv4", strerror(errno), errno);
-        close(listeningSocket);
-      }
-    } else {
-      if (error) {
-        *error = GCDWebServerMakePosixError(errno);
-      }
-      GWS_LOG_ERROR(@"Failed binding %s listening socket: %s (%i)", useIPv6 ? "IPv6" : "IPv4", strerror(errno), errno);
-      close(listeningSocket);
-    }
-
-  } else {
-    if (error) {
-      *error = GCDWebServerMakePosixError(errno);
-    }
-    GWS_LOG_ERROR(@"Failed creating %s listening socket: %s (%i)", useIPv6 ? "IPv6" : "IPv4", strerror(errno), errno);
-  }
-  return -1;
-}
-
-- (dispatch_source_t)_createDispatchSourceWithListeningSocket:(int)listeningSocket isIPv6:(BOOL)isIPv6 {
-  dispatch_group_enter(_sourceGroup);
-  dispatch_source_t source = dispatch_source_create(DISPATCH_SOURCE_TYPE_READ, listeningSocket, 0, dispatch_get_global_queue(_dispatchQueuePriority, 0));
-  dispatch_source_set_cancel_handler(source, ^{
-    @autoreleasepool {
-      int result = close(listeningSocket);
-      if (result != 0) {
-        GWS_LOG_ERROR(@"Failed closing %s listening socket: %s (%i)", isIPv6 ? "IPv6" : "IPv4", strerror(errno), errno);
-      } else {
-        GWS_LOG_DEBUG(@"Did close %s listening socket %i", isIPv6 ? "IPv6" : "IPv4", listeningSocket);
-      }
-    }
-    dispatch_group_leave(self->_sourceGroup);
-  });
-  dispatch_source_set_event_handler(source, ^{
-    @autoreleasepool {
-      struct sockaddr_storage remoteSockAddr;
-      socklen_t remoteAddrLen = sizeof(remoteSockAddr);
-      int socket = accept(listeningSocket, (struct sockaddr*)&remoteSockAddr, &remoteAddrLen);
-      if (socket > 0) {
-        NSData* remoteAddress = [NSData dataWithBytes:&remoteSockAddr length:remoteAddrLen];
-
-        struct sockaddr_storage localSockAddr;
-        socklen_t localAddrLen = sizeof(localSockAddr);
-        NSData* localAddress = nil;
-        if (getsockname(socket, (struct sockaddr*)&localSockAddr, &localAddrLen) == 0) {
-          localAddress = [NSData dataWithBytes:&localSockAddr length:localAddrLen];
-          GWS_DCHECK((!isIPv6 && localSockAddr.ss_family == AF_INET) || (isIPv6 && localSockAddr.ss_family == AF_INET6));
-        } else {
-          GWS_DNOT_REACHED();
-        }
-
-        int noSigPipe = 1;
-        setsockopt(socket, SOL_SOCKET, SO_NOSIGPIPE, &noSigPipe, sizeof(noSigPipe));  // Make sure this socket cannot generate SIG_PIPE
-
-        GCDWebServerConnection* connection = [(GCDWebServerConnection*)[self->_connectionClass alloc] initWithServer:self localAddress:localAddress remoteAddress:remoteAddress socket:socket];  // Connection will automatically retain itself while opened
-        [connection self];  // Prevent compiler from complaining about unused variable / useless statement
-      } else {
-        GWS_LOG_ERROR(@"Failed accepting %s socket: %s (%i)", isIPv6 ? "IPv6" : "IPv4", strerror(errno), errno);
-      }
-    }
-  });
-  return source;
-}
-
-- (BOOL)_start:(NSError**)error {
-  GWS_DCHECK(_source4 == NULL);
-
-  NSUInteger port = [(NSNumber*)_GetOption(_options, GCDWebServerOption_Port, @0) unsignedIntegerValue];
-  BOOL bindToLocalhost = [(NSNumber*)_GetOption(_options, GCDWebServerOption_BindToLocalhost, @NO) boolValue];
-  NSUInteger maxPendingConnections = [(NSNumber*)_GetOption(_options, GCDWebServerOption_MaxPendingConnections, @16) unsignedIntegerValue];
-
-  struct sockaddr_in addr4;
-  bzero(&addr4, sizeof(addr4));
-  addr4.sin_len = sizeof(addr4);
-  addr4.sin_family = AF_INET;
-  addr4.sin_port = htons(port);
-  addr4.sin_addr.s_addr = bindToLocalhost ? htonl(INADDR_LOOPBACK) : htonl(INADDR_ANY);
-  int listeningSocket4 = [self _createListeningSocket:NO localAddress:&addr4 length:sizeof(addr4) maxPendingConnections:maxPendingConnections error:error];
-  if (listeningSocket4 <= 0) {
-    return NO;
-  }
-  if (port == 0) {
-    struct sockaddr_in addr;
-    socklen_t addrlen = sizeof(addr);
-    if (getsockname(listeningSocket4, (struct sockaddr*)&addr, &addrlen) == 0) {
-      port = ntohs(addr.sin_port);
-    } else {
-      GWS_LOG_ERROR(@"Failed retrieving socket address: %s (%i)", strerror(errno), errno);
-    }
-  }
-
-  struct sockaddr_in6 addr6;
-  bzero(&addr6, sizeof(addr6));
-  addr6.sin6_len = sizeof(addr6);
-  addr6.sin6_family = AF_INET6;
-  addr6.sin6_port = htons(port);
-  addr6.sin6_addr = bindToLocalhost ? in6addr_loopback : in6addr_any;
-  int listeningSocket6 = [self _createListeningSocket:YES localAddress:&addr6 length:sizeof(addr6) maxPendingConnections:maxPendingConnections error:error];
-  if (listeningSocket6 <= 0) {
-    close(listeningSocket4);
-    return NO;
-  }
-
-  _serverName = [(NSString*)_GetOption(_options, GCDWebServerOption_ServerName, NSStringFromClass([self class])) copy];
-  NSString* authenticationMethod = _GetOption(_options, GCDWebServerOption_AuthenticationMethod, nil);
-  if ([authenticationMethod isEqualToString:GCDWebServerAuthenticationMethod_Basic]) {
-    _authenticationRealm = [(NSString*)_GetOption(_options, GCDWebServerOption_AuthenticationRealm, _serverName) copy];
-    _authenticationBasicAccounts = [[NSMutableDictionary alloc] init];
-    NSDictionary* accounts = _GetOption(_options, GCDWebServerOption_AuthenticationAccounts, @{});
-    [accounts enumerateKeysAndObjectsUsingBlock:^(NSString* username, NSString* password, BOOL* stop) {
-      [self->_authenticationBasicAccounts setObject:_EncodeBase64([NSString stringWithFormat:@"%@:%@", username, password]) forKey:username];
-    }];
-  } else if ([authenticationMethod isEqualToString:GCDWebServerAuthenticationMethod_DigestAccess]) {
-    _authenticationRealm = [(NSString*)_GetOption(_options, GCDWebServerOption_AuthenticationRealm, _serverName) copy];
-    _authenticationDigestAccounts = [[NSMutableDictionary alloc] init];
-    NSDictionary* accounts = _GetOption(_options, GCDWebServerOption_AuthenticationAccounts, @{});
-    [accounts enumerateKeysAndObjectsUsingBlock:^(NSString* username, NSString* password, BOOL* stop) {
-      [self->_authenticationDigestAccounts setObject:GCDWebServerComputeMD5Digest(@"%@:%@:%@", username, self->_authenticationRealm, password) forKey:username];
-    }];
-  }
-  _connectionClass = _GetOption(_options, GCDWebServerOption_ConnectionClass, [GCDWebServerConnection class]);
-  _shouldAutomaticallyMapHEADToGET = [(NSNumber*)_GetOption(_options, GCDWebServerOption_AutomaticallyMapHEADToGET, @YES) boolValue];
-  _disconnectDelay = [(NSNumber*)_GetOption(_options, GCDWebServerOption_ConnectedStateCoalescingInterval, @1.0) doubleValue];
-  _dispatchQueuePriority = [(NSNumber*)_GetOption(_options, GCDWebServerOption_DispatchQueuePriority, @(DISPATCH_QUEUE_PRIORITY_DEFAULT)) longValue];
-
-  _source4 = [self _createDispatchSourceWithListeningSocket:listeningSocket4 isIPv6:NO];
-  _source6 = [self _createDispatchSourceWithListeningSocket:listeningSocket6 isIPv6:YES];
-  _port = port;
-  _bindToLocalhost = bindToLocalhost;
-
-  NSString* bonjourName = _GetOption(_options, GCDWebServerOption_BonjourName, nil);
-  NSString* bonjourType = _GetOption(_options, GCDWebServerOption_BonjourType, @"_http._tcp");
-  if (bonjourName) {
-    _registrationService = CFNetServiceCreate(kCFAllocatorDefault, CFSTR("local."), (__bridge CFStringRef)bonjourType, (__bridge CFStringRef)(bonjourName.length ? bonjourName : _serverName), (SInt32)_port);
-    if (_registrationService) {
-      CFNetServiceClientContext context = {0, (__bridge void*)self, NULL, NULL, NULL};
-
-      CFNetServiceSetClient(_registrationService, _NetServiceRegisterCallBack, &context);
-      CFNetServiceScheduleWithRunLoop(_registrationService, CFRunLoopGetMain(), kCFRunLoopCommonModes);
-      CFStreamError streamError = {0};
-      CFNetServiceRegisterWithOptions(_registrationService, 0, &streamError);
-
-      _resolutionService = CFNetServiceCreateCopy(kCFAllocatorDefault, _registrationService);
-      if (_resolutionService) {
-        CFNetServiceSetClient(_resolutionService, _NetServiceResolveCallBack, &context);
-        CFNetServiceScheduleWithRunLoop(_resolutionService, CFRunLoopGetMain(), kCFRunLoopCommonModes);
-      } else {
-        GWS_LOG_ERROR(@"Failed creating CFNetService for resolution");
-      }
-    } else {
-      GWS_LOG_ERROR(@"Failed creating CFNetService for registration");
-    }
-  }
-
-  if ([(NSNumber*)_GetOption(_options, GCDWebServerOption_RequestNATPortMapping, @NO) boolValue]) {
-    DNSServiceErrorType status = DNSServiceNATPortMappingCreate(&_dnsService, 0, 0, kDNSServiceProtocol_TCP, htons(port), htons(port), 0, _DNSServiceCallBack, (__bridge void*)self);
-    if (status == kDNSServiceErr_NoError) {
-      CFSocketContext context = {0, (__bridge void*)self, NULL, NULL, NULL};
-      _dnsSocket = CFSocketCreateWithNative(kCFAllocatorDefault, DNSServiceRefSockFD(_dnsService), kCFSocketReadCallBack, _SocketCallBack, &context);
-      if (_dnsSocket) {
-        CFSocketSetSocketFlags(_dnsSocket, CFSocketGetSocketFlags(_dnsSocket) & ~kCFSocketCloseOnInvalidate);
-        _dnsSource = CFSocketCreateRunLoopSource(kCFAllocatorDefault, _dnsSocket, 0);
-        if (_dnsSource) {
-          CFRunLoopAddSource(CFRunLoopGetMain(), _dnsSource, kCFRunLoopCommonModes);
-        } else {
-          GWS_LOG_ERROR(@"Failed creating CFRunLoopSource");
-          GWS_DNOT_REACHED();
-        }
-      } else {
-        GWS_LOG_ERROR(@"Failed creating CFSocket");
-        GWS_DNOT_REACHED();
-      }
-    } else {
-      GWS_LOG_ERROR(@"Failed creating NAT port mapping (%i)", status);
-    }
-  }
-
-  dispatch_resume(_source4);
-  dispatch_resume(_source6);
-  GWS_LOG_INFO(@"%@ started on port %i and reachable at %@", [self class], (int)_port, self.serverURL);
-  if ([_delegate respondsToSelector:@selector(webServerDidStart:)]) {
-    dispatch_async(dispatch_get_main_queue(), ^{
-      [self->_delegate webServerDidStart:self];
-    });
-  }
-
-  return YES;
-}
-
-- (void)_stop {
-  GWS_DCHECK(_source4 != NULL);
-
-  if (_dnsService) {
-    _dnsAddress = nil;
-    _dnsPort = 0;
-    if (_dnsSource) {
-      CFRunLoopSourceInvalidate(_dnsSource);
-      CFRelease(_dnsSource);
-      _dnsSource = NULL;
-    }
-    if (_dnsSocket) {
-      CFRelease(_dnsSocket);
-      _dnsSocket = NULL;
-    }
-    DNSServiceRefDeallocate(_dnsService);
-    _dnsService = NULL;
-  }
-
-  if (_registrationService) {
-    if (_resolutionService) {
-      CFNetServiceUnscheduleFromRunLoop(_resolutionService, CFRunLoopGetMain(), kCFRunLoopCommonModes);
-      CFNetServiceSetClient(_resolutionService, NULL, NULL);
-      CFNetServiceCancel(_resolutionService);
-      CFRelease(_resolutionService);
-      _resolutionService = NULL;
-    }
-    CFNetServiceUnscheduleFromRunLoop(_registrationService, CFRunLoopGetMain(), kCFRunLoopCommonModes);
-    CFNetServiceSetClient(_registrationService, NULL, NULL);
-    CFNetServiceCancel(_registrationService);
-    CFRelease(_registrationService);
-    _registrationService = NULL;
-  }
-
-  dispatch_source_cancel(_source6);
-  dispatch_source_cancel(_source4);
-  dispatch_group_wait(_sourceGroup, DISPATCH_TIME_FOREVER);  // Wait until the cancellation handlers have been called which guarantees the listening sockets are closed
-#if !OS_OBJECT_USE_OBJC_RETAIN_RELEASE
-  dispatch_release(_source6);
-#endif
-  _source6 = NULL;
-#if !OS_OBJECT_USE_OBJC_RETAIN_RELEASE
-  dispatch_release(_source4);
-#endif
-  _source4 = NULL;
-  _port = 0;
-  _bindToLocalhost = NO;
-
-  _serverName = nil;
-  _authenticationRealm = nil;
-  _authenticationBasicAccounts = nil;
-  _authenticationDigestAccounts = nil;
-
-  dispatch_async(dispatch_get_main_queue(), ^{
-    if (self->_disconnectTimer) {
-      CFRunLoopTimerInvalidate(self->_disconnectTimer);
-      CFRelease(self->_disconnectTimer);
-      self->_disconnectTimer = NULL;
-      [self _didDisconnect];
-    }
-  });
-
-  GWS_LOG_INFO(@"%@ stopped", [self class]);
-  if ([_delegate respondsToSelector:@selector(webServerDidStop:)]) {
-    dispatch_async(dispatch_get_main_queue(), ^{
-      [self->_delegate webServerDidStop:self];
-    });
-  }
-}
-
-#if TARGET_OS_IPHONE
-
-- (void)_didEnterBackground:(NSNotification*)notification {
-  GWS_DCHECK([NSThread isMainThread]);
-  GWS_LOG_DEBUG(@"Did enter background");
-  if ((_backgroundTask == UIBackgroundTaskInvalid) && _source4) {
-    [self _stop];
-  }
-}
-
-- (void)_willEnterForeground:(NSNotification*)notification {
-  GWS_DCHECK([NSThread isMainThread]);
-  GWS_LOG_DEBUG(@"Will enter foreground");
-  if (!_source4) {
-    [self _start:NULL];  // TODO: There's probably nothing we can do on failure
-  }
-}
-
-#endif
-
-- (BOOL)startWithOptions:(NSDictionary<NSString*, id>*)options error:(NSError**)error {
-  if (_options == nil) {
-    _options = options ? [options copy] : @{};
-#if TARGET_OS_IPHONE
-    _suspendInBackground = [(NSNumber*)_GetOption(_options, GCDWebServerOption_AutomaticallySuspendInBackground, @YES) boolValue];
-    if (((_suspendInBackground == NO) || ([[UIApplication sharedApplication] applicationState] != UIApplicationStateBackground)) && ![self _start:error])
-#else
-    if (![self _start:error])
-#endif
-    {
-      _options = nil;
-      return NO;
-    }
-#if TARGET_OS_IPHONE
-    if (_suspendInBackground) {
-      [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_didEnterBackground:) name:UIApplicationDidEnterBackgroundNotification object:nil];
-      [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_willEnterForeground:) name:UIApplicationWillEnterForegroundNotification object:nil];
-    }
-#endif
-    return YES;
-  } else {
-    GWS_DNOT_REACHED();
-  }
-  return NO;
-}
-
-- (BOOL)isRunning {
-  return (_options ? YES : NO);
-}
-
-- (void)stop {
-  if (_options) {
-#if TARGET_OS_IPHONE
-    if (_suspendInBackground) {
-      [[NSNotificationCenter defaultCenter] removeObserver:self name:UIApplicationDidEnterBackgroundNotification object:nil];
-      [[NSNotificationCenter defaultCenter] removeObserver:self name:UIApplicationWillEnterForegroundNotification object:nil];
-    }
-#endif
-    if (_source4) {
-      [self _stop];
-    }
-    _options = nil;
-  } else {
-    GWS_DNOT_REACHED();
-  }
-}
-
-@end
-
-@implementation GCDWebServer (Extensions)
-
-- (NSURL*)serverURL {
-  if (_source4) {
-    NSString* ipAddress = _bindToLocalhost ? @"localhost" : GCDWebServerGetPrimaryIPAddress(NO);  // We can't really use IPv6 anyway as it doesn't work great with HTTP URLs in practice
-    if (ipAddress) {
-      if (_port != 80) {
-        return [NSURL URLWithString:[NSString stringWithFormat:@"http://%@:%i/", ipAddress, (int)_port]];
-      } else {
-        return [NSURL URLWithString:[NSString stringWithFormat:@"http://%@/", ipAddress]];
-      }
-    }
-  }
-  return nil;
-}
-
-- (NSURL*)bonjourServerURL {
-  if (_source4 && _resolutionService) {
-    NSString* name = (__bridge NSString*)CFNetServiceGetTargetHost(_resolutionService);
-    if (name.length) {
-      name = [name substringToIndex:(name.length - 1)];  // Strip trailing period at end of domain
-      if (_port != 80) {
-        return [NSURL URLWithString:[NSString stringWithFormat:@"http://%@:%i/", name, (int)_port]];
-      } else {
-        return [NSURL URLWithString:[NSString stringWithFormat:@"http://%@/", name]];
-      }
-    }
-  }
-  return nil;
-}
-
-- (NSURL*)publicServerURL {
-  if (_source4 && _dnsService && _dnsAddress && _dnsPort) {
-    if (_dnsPort != 80) {
-      return [NSURL URLWithString:[NSString stringWithFormat:@"http://%@:%i/", _dnsAddress, (int)_dnsPort]];
-    } else {
-      return [NSURL URLWithString:[NSString stringWithFormat:@"http://%@/", _dnsAddress]];
-    }
-  }
-  return nil;
-}
-
-- (BOOL)start {
-  return [self startWithPort:kDefaultPort bonjourName:@""];
-}
-
-- (BOOL)startWithPort:(NSUInteger)port bonjourName:(NSString*)name {
-  NSMutableDictionary* options = [NSMutableDictionary dictionary];
-  [options setObject:[NSNumber numberWithInteger:port] forKey:GCDWebServerOption_Port];
-  [options setValue:name forKey:GCDWebServerOption_BonjourName];
-  return [self startWithOptions:options error:NULL];
-}
-
-#if !TARGET_OS_IPHONE
-
-- (BOOL)runWithPort:(NSUInteger)port bonjourName:(NSString*)name {
-  NSMutableDictionary* options = [NSMutableDictionary dictionary];
-  [options setObject:[NSNumber numberWithInteger:port] forKey:GCDWebServerOption_Port];
-  [options setValue:name forKey:GCDWebServerOption_BonjourName];
-  return [self runWithOptions:options error:NULL];
-}
-
-- (BOOL)runWithOptions:(NSDictionary<NSString*, id>*)options error:(NSError**)error {
-  GWS_DCHECK([NSThread isMainThread]);
-  BOOL success = NO;
-  _run = YES;
-  void (*termHandler)(int) = signal(SIGTERM, _SignalHandler);
-  void (*intHandler)(int) = signal(SIGINT, _SignalHandler);
-  if ((termHandler != SIG_ERR) && (intHandler != SIG_ERR)) {
-    if ([self startWithOptions:options error:error]) {
-      while (_run) {
-        CFRunLoopRunInMode(kCFRunLoopDefaultMode, 1.0, true);
-      }
-      [self stop];
-      success = YES;
-    }
-    _ExecuteMainThreadRunLoopSources();
-    signal(SIGINT, intHandler);
-    signal(SIGTERM, termHandler);
-  }
-  return success;
-}
-
-#endif
-
-@end
-
-@implementation GCDWebServer (Handlers)
-
-- (void)addDefaultHandlerForMethod:(NSString*)method requestClass:(Class)aClass processBlock:(GCDWebServerProcessBlock)block {
-  [self addDefaultHandlerForMethod:method
-                      requestClass:aClass
-                 asyncProcessBlock:^(GCDWebServerRequest* request, GCDWebServerCompletionBlock completionBlock) {
-                   completionBlock(block(request));
-                 }];
-}
-
-- (void)addDefaultHandlerForMethod:(NSString*)method requestClass:(Class)aClass asyncProcessBlock:(GCDWebServerAsyncProcessBlock)block {
-  [self
-      addHandlerWithMatchBlock:^GCDWebServerRequest*(NSString* requestMethod, NSURL* requestURL, NSDictionary<NSString*, NSString*>* requestHeaders, NSString* urlPath, NSDictionary<NSString*, NSString*>* urlQuery) {
-        if (![requestMethod isEqualToString:method]) {
-          return nil;
-        }
-        return [(GCDWebServerRequest*)[aClass alloc] initWithMethod:requestMethod url:requestURL headers:requestHeaders path:urlPath query:urlQuery];
-      }
-             asyncProcessBlock:block];
-}
-
-- (void)addHandlerForMethod:(NSString*)method path:(NSString*)path requestClass:(Class)aClass processBlock:(GCDWebServerProcessBlock)block {
-  [self addHandlerForMethod:method
-                       path:path
-               requestClass:aClass
-          asyncProcessBlock:^(GCDWebServerRequest* request, GCDWebServerCompletionBlock completionBlock) {
-            completionBlock(block(request));
-          }];
-}
-
-- (void)addHandlerForMethod:(NSString*)method path:(NSString*)path requestClass:(Class)aClass asyncProcessBlock:(GCDWebServerAsyncProcessBlock)block {
-  if ([path hasPrefix:@"/"] && [aClass isSubclassOfClass:[GCDWebServerRequest class]]) {
-    [self
-        addHandlerWithMatchBlock:^GCDWebServerRequest*(NSString* requestMethod, NSURL* requestURL, NSDictionary<NSString*, NSString*>* requestHeaders, NSString* urlPath, NSDictionary<NSString*, NSString*>* urlQuery) {
-          if (![requestMethod isEqualToString:method]) {
-            return nil;
-          }
-          if ([urlPath caseInsensitiveCompare:path] != NSOrderedSame) {
-            return nil;
-          }
-          return [(GCDWebServerRequest*)[aClass alloc] initWithMethod:requestMethod url:requestURL headers:requestHeaders path:urlPath query:urlQuery];
-        }
-               asyncProcessBlock:block];
-  } else {
-    GWS_DNOT_REACHED();
-  }
-}
-
-- (void)addHandlerForMethod:(NSString*)method pathRegex:(NSString*)regex requestClass:(Class)aClass processBlock:(GCDWebServerProcessBlock)block {
-  [self addHandlerForMethod:method
-                  pathRegex:regex
-               requestClass:aClass
-          asyncProcessBlock:^(GCDWebServerRequest* request, GCDWebServerCompletionBlock completionBlock) {
-            completionBlock(block(request));
-          }];
-}
-
-- (void)addHandlerForMethod:(NSString*)method pathRegex:(NSString*)regex requestClass:(Class)aClass asyncProcessBlock:(GCDWebServerAsyncProcessBlock)block {
-  NSRegularExpression* expression = [NSRegularExpression regularExpressionWithPattern:regex options:NSRegularExpressionCaseInsensitive error:NULL];
-  if (expression && [aClass isSubclassOfClass:[GCDWebServerRequest class]]) {
-    [self
-        addHandlerWithMatchBlock:^GCDWebServerRequest*(NSString* requestMethod, NSURL* requestURL, NSDictionary<NSString*, NSString*>* requestHeaders, NSString* urlPath, NSDictionary<NSString*, NSString*>* urlQuery) {
-          if (![requestMethod isEqualToString:method]) {
-            return nil;
-          }
-
-          NSArray* matches = [expression matchesInString:urlPath options:0 range:NSMakeRange(0, urlPath.length)];
-          if (matches.count == 0) {
-            return nil;
-          }
-
-          NSMutableArray* captures = [NSMutableArray array];
-          for (NSTextCheckingResult* result in matches) {
-            // Start at 1; index 0 is the whole string
-            for (NSUInteger i = 1; i < result.numberOfRanges; i++) {
-              NSRange range = [result rangeAtIndex:i];
-              // range is {NSNotFound, 0} "if one of the capture groups did not participate in this particular match"
-              // see discussion in -[NSRegularExpression firstMatchInString:options:range:]
-              if (range.location != NSNotFound) {
-                [captures addObject:[urlPath substringWithRange:range]];
-              }
-            }
-          }
-
-          GCDWebServerRequest* request = [(GCDWebServerRequest*)[aClass alloc] initWithMethod:requestMethod url:requestURL headers:requestHeaders path:urlPath query:urlQuery];
-          [request setAttribute:captures forKey:GCDWebServerRequestAttribute_RegexCaptures];
-          return request;
-        }
-               asyncProcessBlock:block];
-  } else {
-    GWS_DNOT_REACHED();
-  }
-}
-
-@end
-
-@implementation GCDWebServer (GETHandlers)
-
-- (void)addGETHandlerForPath:(NSString*)path staticData:(NSData*)staticData contentType:(NSString*)contentType cacheAge:(NSUInteger)cacheAge {
-  [self addHandlerForMethod:@"GET"
-                       path:path
-               requestClass:[GCDWebServerRequest class]
-               processBlock:^GCDWebServerResponse*(GCDWebServerRequest* request) {
-                 GCDWebServerResponse* response = [GCDWebServerDataResponse responseWithData:staticData contentType:contentType];
-                 response.cacheControlMaxAge = cacheAge;
-                 return response;
-               }];
-}
-
-- (void)addGETHandlerForPath:(NSString*)path filePath:(NSString*)filePath isAttachment:(BOOL)isAttachment cacheAge:(NSUInteger)cacheAge allowRangeRequests:(BOOL)allowRangeRequests {
-  [self addHandlerForMethod:@"GET"
-                       path:path
-               requestClass:[GCDWebServerRequest class]
-               processBlock:^GCDWebServerResponse*(GCDWebServerRequest* request) {
-                 GCDWebServerResponse* response = nil;
-                 if (allowRangeRequests) {
-                   response = [GCDWebServerFileResponse responseWithFile:filePath byteRange:request.byteRange isAttachment:isAttachment];
-                   [response setValue:@"bytes" forAdditionalHeader:@"Accept-Ranges"];
-                 } else {
-                   response = [GCDWebServerFileResponse responseWithFile:filePath isAttachment:isAttachment];
-                 }
-                 response.cacheControlMaxAge = cacheAge;
-                 return response;
-               }];
-}
-
-- (GCDWebServerResponse*)_responseWithContentsOfDirectory:(NSString*)path {
-  NSArray* contents = [[[NSFileManager defaultManager] contentsOfDirectoryAtPath:path error:NULL] sortedArrayUsingSelector:@selector(localizedStandardCompare:)];
-  if (contents == nil) {
-    return nil;
-  }
-  NSMutableString* html = [NSMutableString string];
-  [html appendString:@"<!DOCTYPE html>\n"];
-  [html appendString:@"<html><head><meta charset=\"utf-8\"></head><body>\n"];
-  [html appendString:@"<ul>\n"];
-  for (NSString* entry in contents) {
-    if (![entry hasPrefix:@"."]) {
-      NSString* type = [[[NSFileManager defaultManager] attributesOfItemAtPath:[path stringByAppendingPathComponent:entry] error:NULL] objectForKey:NSFileType];
-      GWS_DCHECK(type);
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-      NSString* escapedFile = [entry stringByAddingPercentEscapesUsingEncoding:NSUTF8StringEncoding];
-#pragma clang diagnostic pop
-      GWS_DCHECK(escapedFile);
-      if ([type isEqualToString:NSFileTypeRegular]) {
-        [html appendFormat:@"<li><a href=\"%@\">%@</a></li>\n", escapedFile, entry];
-      } else if ([type isEqualToString:NSFileTypeDirectory]) {
-        [html appendFormat:@"<li><a href=\"%@/\">%@/</a></li>\n", escapedFile, entry];
-      }
-    }
-  }
-  [html appendString:@"</ul>\n"];
-  [html appendString:@"</body></html>\n"];
-  return [GCDWebServerDataResponse responseWithHTML:html];
-}
-
-- (void)addGETHandlerForBasePath:(NSString*)basePath directoryPath:(NSString*)directoryPath indexFilename:(NSString*)indexFilename cacheAge:(NSUInteger)cacheAge allowRangeRequests:(BOOL)allowRangeRequests {
-  if ([basePath hasPrefix:@"/"] && [basePath hasSuffix:@"/"]) {
-    GCDWebServer* __unsafe_unretained server = self;
-    [self
-        addHandlerWithMatchBlock:^GCDWebServerRequest*(NSString* requestMethod, NSURL* requestURL, NSDictionary<NSString*, NSString*>* requestHeaders, NSString* urlPath, NSDictionary<NSString*, NSString*>* urlQuery) {
-          if (![requestMethod isEqualToString:@"GET"]) {
-            return nil;
-          }
-          if (![urlPath hasPrefix:basePath]) {
-            return nil;
-          }
-          return [[GCDWebServerRequest alloc] initWithMethod:requestMethod url:requestURL headers:requestHeaders path:urlPath query:urlQuery];
-        }
-        processBlock:^GCDWebServerResponse*(GCDWebServerRequest* request) {
-          GCDWebServerResponse* response = nil;
-          NSString* filePath = [directoryPath stringByAppendingPathComponent:GCDWebServerNormalizePath([request.path substringFromIndex:basePath.length])];
-          NSString* fileType = [[[NSFileManager defaultManager] attributesOfItemAtPath:filePath error:NULL] fileType];
-          if (fileType) {
-            if ([fileType isEqualToString:NSFileTypeDirectory]) {
-              if (indexFilename) {
-                NSString* indexPath = [filePath stringByAppendingPathComponent:indexFilename];
-                NSString* indexType = [[[NSFileManager defaultManager] attributesOfItemAtPath:indexPath error:NULL] fileType];
-                if ([indexType isEqualToString:NSFileTypeRegular]) {
-                  return [GCDWebServerFileResponse responseWithFile:indexPath];
-                }
-              }
-              response = [server _responseWithContentsOfDirectory:filePath];
-            } else if ([fileType isEqualToString:NSFileTypeRegular]) {
-              if (allowRangeRequests) {
-                response = [GCDWebServerFileResponse responseWithFile:filePath byteRange:request.byteRange];
-                [response setValue:@"bytes" forAdditionalHeader:@"Accept-Ranges"];
-              } else {
-                response = [GCDWebServerFileResponse responseWithFile:filePath];
-              }
-            }
-          }
-          if (response) {
-            response.cacheControlMaxAge = cacheAge;
-          } else {
-            response = [GCDWebServerResponse responseWithStatusCode:kGCDWebServerHTTPStatusCode_NotFound];
-          }
-          return response;
-        }];
-  } else {
-    GWS_DNOT_REACHED();
-  }
-}
-
-@end
-
-@implementation GCDWebServer (Logging)
-
-+ (void)setLogLevel:(int)level {
-#if defined(__GCDWEBSERVER_LOGGING_FACILITY_XLFACILITY__)
-  [XLSharedFacility setMinLogLevel:level];
-#elif defined(__GCDWEBSERVER_LOGGING_FACILITY_BUILTIN__)
-  GCDWebServerLogLevel = level;
-#endif
-}
-
-+ (void)setBuiltInLogger:(GCDWebServerBuiltInLoggerBlock)block {
-#if defined(__GCDWEBSERVER_LOGGING_FACILITY_BUILTIN__)
-  _builtInLoggerBlock = block;
-#else
-  GWS_DNOT_REACHED();  // Built-in logger must be enabled in order to override
-#endif
-}
-
-- (void)logVerbose:(NSString*)format, ... {
-  va_list arguments;
-  va_start(arguments, format);
-  GWS_LOG_VERBOSE(@"%@", [[NSString alloc] initWithFormat:format arguments:arguments]);
-  va_end(arguments);
-}
-
-- (void)logInfo:(NSString*)format, ... {
-  va_list arguments;
-  va_start(arguments, format);
-  GWS_LOG_INFO(@"%@", [[NSString alloc] initWithFormat:format arguments:arguments]);
-  va_end(arguments);
-}
-
-- (void)logWarning:(NSString*)format, ... {
-  va_list arguments;
-  va_start(arguments, format);
-  GWS_LOG_WARNING(@"%@", [[NSString alloc] initWithFormat:format arguments:arguments]);
-  va_end(arguments);
-}
-
-- (void)logError:(NSString*)format, ... {
-  va_list arguments;
-  va_start(arguments, format);
-  GWS_LOG_ERROR(@"%@", [[NSString alloc] initWithFormat:format arguments:arguments]);
-  va_end(arguments);
-}
-
-@end
-
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-
-@implementation GCDWebServer (Testing)
-
-- (void)setRecordingEnabled:(BOOL)flag {
-  _recording = flag;
-}
-
-- (BOOL)isRecordingEnabled {
-  return _recording;
-}
-
-static CFHTTPMessageRef _CreateHTTPMessageFromData(NSData* data, BOOL isRequest) {
-  CFHTTPMessageRef message = CFHTTPMessageCreateEmpty(kCFAllocatorDefault, isRequest);
-  if (CFHTTPMessageAppendBytes(message, data.bytes, data.length)) {
-    return message;
-  }
-  CFRelease(message);
-  return NULL;
-}
-
-static CFHTTPMessageRef _CreateHTTPMessageFromPerformingRequest(NSData* inData, NSUInteger port) {
-  CFHTTPMessageRef response = NULL;
-  int httpSocket = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
-  if (httpSocket > 0) {
-    struct sockaddr_in addr4;
-    bzero(&addr4, sizeof(addr4));
-    addr4.sin_len = sizeof(addr4);
-    addr4.sin_family = AF_INET;
-    addr4.sin_port = htons(port);
-    addr4.sin_addr.s_addr = htonl(INADDR_ANY);
-    if (connect(httpSocket, (void*)&addr4, sizeof(addr4)) == 0) {
-      if (write(httpSocket, inData.bytes, inData.length) == (ssize_t)inData.length) {
-        NSMutableData* outData = [[NSMutableData alloc] initWithLength:(256 * 1024)];
-        NSUInteger length = 0;
-        while (1) {
-          ssize_t result = read(httpSocket, (char*)outData.mutableBytes + length, outData.length - length);
-          if (result < 0) {
-            length = NSUIntegerMax;
-            break;
-          } else if (result == 0) {
-            break;
-          }
-          length += result;
-          if (length >= outData.length) {
-            outData.length = 2 * outData.length;
-          }
-        }
-        if (length != NSUIntegerMax) {
-          outData.length = length;
-          response = _CreateHTTPMessageFromData(outData, NO);
-        } else {
-          GWS_DNOT_REACHED();
-        }
-      }
-    }
-    close(httpSocket);
-  }
-  return response;
-}
-
-static void _LogResult(NSString* format, ...) {
-  va_list arguments;
-  va_start(arguments, format);
-  NSString* message = [[NSString alloc] initWithFormat:format arguments:arguments];
-  va_end(arguments);
-  fprintf(stdout, "%s\n", [message UTF8String]);
-}
-
-- (NSInteger)runTestsWithOptions:(NSDictionary<NSString*, id>*)options inDirectory:(NSString*)path {
-  GWS_DCHECK([NSThread isMainThread]);
-  NSArray* ignoredHeaders = @[ @"Date", @"Etag" ];  // Dates are always different by definition and ETags depend on file system node IDs
-  NSInteger result = -1;
-  if ([self startWithOptions:options error:NULL]) {
-    _ExecuteMainThreadRunLoopSources();
-
-    result = 0;
-    NSArray* files = [[[NSFileManager defaultManager] contentsOfDirectoryAtPath:path error:NULL] sortedArrayUsingSelector:@selector(localizedStandardCompare:)];
-    for (NSString* requestFile in files) {
-      if (![requestFile hasSuffix:@".request"]) {
-        continue;
-      }
-      @autoreleasepool {
-        NSString* index = [[requestFile componentsSeparatedByString:@"-"] firstObject];
-        BOOL success = NO;
-        NSData* requestData = [NSData dataWithContentsOfFile:[path stringByAppendingPathComponent:requestFile]];
-        if (requestData) {
-          CFHTTPMessageRef request = _CreateHTTPMessageFromData(requestData, YES);
-          if (request) {
-            NSString* requestMethod = CFBridgingRelease(CFHTTPMessageCopyRequestMethod(request));
-            NSURL* requestURL = CFBridgingRelease(CFHTTPMessageCopyRequestURL(request));
-            _LogResult(@"[%i] %@ %@", (int)[index integerValue], requestMethod, requestURL.path);
-            NSString* prefix = [index stringByAppendingString:@"-"];
-            for (NSString* responseFile in files) {
-              if ([responseFile hasPrefix:prefix] && [responseFile hasSuffix:@".response"]) {
-                NSData* responseData = [NSData dataWithContentsOfFile:[path stringByAppendingPathComponent:responseFile]];
-                if (responseData) {
-                  CFHTTPMessageRef expectedResponse = _CreateHTTPMessageFromData(responseData, NO);
-                  if (expectedResponse) {
-                    CFHTTPMessageRef actualResponse = _CreateHTTPMessageFromPerformingRequest(requestData, self.port);
-                    if (actualResponse) {
-                      success = YES;
-
-                      CFIndex expectedStatusCode = CFHTTPMessageGetResponseStatusCode(expectedResponse);
-                      CFIndex actualStatusCode = CFHTTPMessageGetResponseStatusCode(actualResponse);
-                      if (actualStatusCode != expectedStatusCode) {
-                        _LogResult(@"  Status code not matching:\n    Expected: %i\n      Actual: %i", (int)expectedStatusCode, (int)actualStatusCode);
-                        success = NO;
-                      }
-
-                      NSDictionary* expectedHeaders = CFBridgingRelease(CFHTTPMessageCopyAllHeaderFields(expectedResponse));
-                      NSDictionary* actualHeaders = CFBridgingRelease(CFHTTPMessageCopyAllHeaderFields(actualResponse));
-                      for (NSString* expectedHeader in expectedHeaders) {
-                        if ([ignoredHeaders containsObject:expectedHeader]) {
-                          continue;
-                        }
-                        NSString* expectedValue = [expectedHeaders objectForKey:expectedHeader];
-                        NSString* actualValue = [actualHeaders objectForKey:expectedHeader];
-                        if (![actualValue isEqualToString:expectedValue]) {
-                          _LogResult(@"  Header '%@' not matching:\n    Expected: \"%@\"\n      Actual: \"%@\"", expectedHeader, expectedValue, actualValue);
-                          success = NO;
-                        }
-                      }
-                      for (NSString* actualHeader in actualHeaders) {
-                        if (![expectedHeaders objectForKey:actualHeader]) {
-                          _LogResult(@"  Header '%@' not matching:\n    Expected: \"%@\"\n      Actual: \"%@\"", actualHeader, nil, [actualHeaders objectForKey:actualHeader]);
-                          success = NO;
-                        }
-                      }
-
-                      NSString* expectedContentLength = CFBridgingRelease(CFHTTPMessageCopyHeaderFieldValue(expectedResponse, CFSTR("Content-Length")));
-                      NSData* expectedBody = CFBridgingRelease(CFHTTPMessageCopyBody(expectedResponse));
-                      NSString* actualContentLength = CFBridgingRelease(CFHTTPMessageCopyHeaderFieldValue(actualResponse, CFSTR("Content-Length")));
-                      NSData* actualBody = CFBridgingRelease(CFHTTPMessageCopyBody(actualResponse));
-                      if ([actualContentLength isEqualToString:expectedContentLength] && (actualBody.length > expectedBody.length)) {  // Handle web browser closing connection before retrieving entire body (e.g. when playing a video file)
-                        actualBody = [actualBody subdataWithRange:NSMakeRange(0, expectedBody.length)];
-                      }
-                      if ((actualBody && expectedBody && ![actualBody isEqualToData:expectedBody]) || (actualBody && !expectedBody) || (!actualBody && expectedBody)) {
-                        _LogResult(@"  Bodies not matching:\n    Expected: %lu bytes\n      Actual: %lu bytes", (unsigned long)expectedBody.length, (unsigned long)actualBody.length);
-                        success = NO;
-#if !TARGET_OS_IPHONE
-#if DEBUG
-                        if (GCDWebServerIsTextContentType((NSString*)[expectedHeaders objectForKey:@"Content-Type"])) {
-                          NSString* expectedPath = [NSTemporaryDirectory() stringByAppendingPathComponent:(NSString*)[[[NSProcessInfo processInfo] globallyUniqueString] stringByAppendingPathExtension:@"txt"]];
-                          NSString* actualPath = [NSTemporaryDirectory() stringByAppendingPathComponent:(NSString*)[[[NSProcessInfo processInfo] globallyUniqueString] stringByAppendingPathExtension:@"txt"]];
-                          if ([expectedBody writeToFile:expectedPath atomically:YES] && [actualBody writeToFile:actualPath atomically:YES]) {
-                            NSTask* task = [[NSTask alloc] init];
-                            [task setLaunchPath:@"/usr/bin/opendiff"];
-                            [task setArguments:@[ expectedPath, actualPath ]];
-                            [task launch];
-                          }
-                        }
-#endif
-#endif
-                      }
-
-                      CFRelease(actualResponse);
-                    }
-                    CFRelease(expectedResponse);
-                  }
-                } else {
-                  GWS_DNOT_REACHED();
-                }
-                break;
-              }
-            }
-            CFRelease(request);
-          }
-        } else {
-          GWS_DNOT_REACHED();
-        }
-        _LogResult(@"");
-        if (!success) {
-          ++result;
-        }
-      }
-      _ExecuteMainThreadRunLoopSources();
-    }
-
-    [self stop];
-
-    _ExecuteMainThreadRunLoopSources();
-  }
-  return result;
-}
-
-@end
-
-#endif
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerConnection.h b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerConnection.h
deleted file mode 100644
index 4d59b9f1f..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerConnection.h
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "GCDWebServer.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-@class GCDWebServerHandler;
-
-/**
- *  The GCDWebServerConnection class is instantiated by GCDWebServer to handle
- *  each new HTTP connection. Each instance stays alive until the connection is
- *  closed.
- *
- *  You cannot use this class directly, but it is made public so you can
- *  subclass it to override some hooks. Use the GCDWebServerOption_ConnectionClass
- *  option for GCDWebServer to install your custom subclass.
- *
- *  @warning The GCDWebServerConnection retains the GCDWebServer until the
- *  connection is closed.
- */
-@interface GCDWebServerConnection : NSObject
-
-/**
- *  Returns the GCDWebServer that owns the connection.
- */
-@property(nonatomic, readonly) GCDWebServer* server;
-
-/**
- *  Returns YES if the connection is using IPv6.
- */
-@property(nonatomic, readonly, getter=isUsingIPv6) BOOL usingIPv6;
-
-/**
- *  Returns the address of the local peer (i.e. server) of the connection
- *  as a raw "struct sockaddr".
- */
-@property(nonatomic, readonly) NSData* localAddressData;
-
-/**
- *  Returns the address of the local peer (i.e. server) of the connection
- *  as a string.
- */
-@property(nonatomic, readonly) NSString* localAddressString;
-
-/**
- *  Returns the address of the remote peer (i.e. client) of the connection
- *  as a raw "struct sockaddr".
- */
-@property(nonatomic, readonly) NSData* remoteAddressData;
-
-/**
- *  Returns the address of the remote peer (i.e. client) of the connection
- *  as a string.
- */
-@property(nonatomic, readonly) NSString* remoteAddressString;
-
-/**
- *  Returns the total number of bytes received from the remote peer (i.e. client)
- *  so far.
- */
-@property(nonatomic, readonly) NSUInteger totalBytesRead;
-
-/**
- *  Returns the total number of bytes sent to the remote peer (i.e. client) so far.
- */
-@property(nonatomic, readonly) NSUInteger totalBytesWritten;
-
-@end
-
-/**
- *  Hooks to customize the behavior of GCDWebServer HTTP connections.
- *
- *  @warning These methods can be called on any GCD thread.
- *  Be sure to also call "super" when overriding them.
- */
-@interface GCDWebServerConnection (Subclassing)
-
-/**
- *  This method is called when the connection is opened.
- *
- *  Return NO to reject the connection e.g. after validating the local
- *  or remote address.
- */
-- (BOOL)open;
-
-/**
- *  This method is called whenever data has been received
- *  from the remote peer (i.e. client).
- *
- *  @warning Do not attempt to modify this data.
- */
-- (void)didReadBytes:(const void*)bytes length:(NSUInteger)length;
-
-/**
- *  This method is called whenever data has been sent
- *  to the remote peer (i.e. client).
- *
- *  @warning Do not attempt to modify this data.
- */
-- (void)didWriteBytes:(const void*)bytes length:(NSUInteger)length;
-
-/**
- *  This method is called after the HTTP headers have been received to
- *  allow replacing the request URL by another one.
- *
- *  The default implementation returns the original URL.
- */
-- (NSURL*)rewriteRequestURL:(NSURL*)url withMethod:(NSString*)method headers:(NSDictionary<NSString*, NSString*>*)headers;
-
-/**
- *  Assuming a valid HTTP request was received, this method is called before
- *  the request is processed.
- *
- *  Return a non-nil GCDWebServerResponse to bypass the request processing entirely.
- *
- *  The default implementation checks for HTTP authentication if applicable
- *  and returns a barebone 401 status code response if authentication failed.
- */
-- (nullable GCDWebServerResponse*)preflightRequest:(GCDWebServerRequest*)request;
-
-/**
- *  Assuming a valid HTTP request was received and -preflightRequest: returned nil,
- *  this method is called to process the request by executing the handler's
- *  process block.
- */
-- (void)processRequest:(GCDWebServerRequest*)request completion:(GCDWebServerCompletionBlock)completion;
-
-/**
- *  Assuming a valid HTTP request was received and either -preflightRequest:
- *  or -processRequest:completion: returned a non-nil GCDWebServerResponse,
- *  this method is called to override the response.
- *
- *  You can either modify the current response and return it, or return a
- *  completely new one.
- *
- *  The default implementation replaces any response matching the "ETag" or
- *  "Last-Modified-Date" header of the request by a barebone "Not-Modified" (304)
- *  one.
- */
-- (GCDWebServerResponse*)overrideResponse:(GCDWebServerResponse*)response forRequest:(GCDWebServerRequest*)request;
-
-/**
- *  This method is called if any error happens while validing or processing
- *  the request or if no GCDWebServerResponse was generated during processing.
- *
- *  @warning If the request was invalid (e.g. the HTTP headers were malformed),
- *  the "request" argument will be nil.
- */
-- (void)abortRequest:(nullable GCDWebServerRequest*)request withStatusCode:(NSInteger)statusCode;
-
-/**
- *  Called when the connection is closed.
- */
-- (void)close;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerConnection.m b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerConnection.m
deleted file mode 100644
index 574079459..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerConnection.m
+++ /dev/null
@@ -1,843 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import <TargetConditionals.h>
-#import <netdb.h>
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-#import <libkern/OSAtomic.h>
-#endif
-
-#import "GCDWebServerPrivate.h"
-
-#define kHeadersReadCapacity (1 * 1024)
-#define kBodyReadCapacity (256 * 1024)
-
-typedef void (^ReadDataCompletionBlock)(BOOL success);
-typedef void (^ReadHeadersCompletionBlock)(NSData* extraData);
-typedef void (^ReadBodyCompletionBlock)(BOOL success);
-
-typedef void (^WriteDataCompletionBlock)(BOOL success);
-typedef void (^WriteHeadersCompletionBlock)(BOOL success);
-typedef void (^WriteBodyCompletionBlock)(BOOL success);
-
-static NSData* _CRLFData = nil;
-static NSData* _CRLFCRLFData = nil;
-static NSData* _continueData = nil;
-static NSData* _lastChunkData = nil;
-static NSString* _digestAuthenticationNonce = nil;
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-static int32_t _connectionCounter = 0;
-#endif
-
-NS_ASSUME_NONNULL_BEGIN
-
-@interface GCDWebServerConnection (Read)
-- (void)readData:(NSMutableData*)data withLength:(NSUInteger)length completionBlock:(ReadDataCompletionBlock)block;
-- (void)readHeaders:(NSMutableData*)headersData withCompletionBlock:(ReadHeadersCompletionBlock)block;
-- (void)readBodyWithRemainingLength:(NSUInteger)length completionBlock:(ReadBodyCompletionBlock)block;
-- (void)readNextBodyChunk:(NSMutableData*)chunkData completionBlock:(ReadBodyCompletionBlock)block;
-@end
-
-@interface GCDWebServerConnection (Write)
-- (void)writeData:(NSData*)data withCompletionBlock:(WriteDataCompletionBlock)block;
-- (void)writeHeadersWithCompletionBlock:(WriteHeadersCompletionBlock)block;
-- (void)writeBodyWithCompletionBlock:(WriteBodyCompletionBlock)block;
-@end
-
-NS_ASSUME_NONNULL_END
-
-@implementation GCDWebServerConnection {
-  CFSocketNativeHandle _socket;
-  BOOL _virtualHEAD;
-
-  CFHTTPMessageRef _requestMessage;
-  GCDWebServerRequest* _request;
-  GCDWebServerHandler* _handler;
-  CFHTTPMessageRef _responseMessage;
-  GCDWebServerResponse* _response;
-  NSInteger _statusCode;
-
-  BOOL _opened;
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-  NSUInteger _connectionIndex;
-  NSString* _requestPath;
-  int _requestFD;
-  NSString* _responsePath;
-  int _responseFD;
-#endif
-}
-
-+ (void)initialize {
-  if (_CRLFData == nil) {
-    _CRLFData = [[NSData alloc] initWithBytes:"\r\n" length:2];
-    GWS_DCHECK(_CRLFData);
-  }
-  if (_CRLFCRLFData == nil) {
-    _CRLFCRLFData = [[NSData alloc] initWithBytes:"\r\n\r\n" length:4];
-    GWS_DCHECK(_CRLFCRLFData);
-  }
-  if (_continueData == nil) {
-    CFHTTPMessageRef message = CFHTTPMessageCreateResponse(kCFAllocatorDefault, 100, NULL, kCFHTTPVersion1_1);
-    _continueData = CFBridgingRelease(CFHTTPMessageCopySerializedMessage(message));
-    CFRelease(message);
-    GWS_DCHECK(_continueData);
-  }
-  if (_lastChunkData == nil) {
-    _lastChunkData = [[NSData alloc] initWithBytes:"0\r\n\r\n" length:5];
-  }
-  if (_digestAuthenticationNonce == nil) {
-    CFUUIDRef uuid = CFUUIDCreate(kCFAllocatorDefault);
-    _digestAuthenticationNonce = GCDWebServerComputeMD5Digest(@"%@", CFBridgingRelease(CFUUIDCreateString(kCFAllocatorDefault, uuid)));
-    CFRelease(uuid);
-  }
-}
-
-- (BOOL)isUsingIPv6 {
-  const struct sockaddr* localSockAddr = _localAddressData.bytes;
-  return (localSockAddr->sa_family == AF_INET6);
-}
-
-- (void)_initializeResponseHeadersWithStatusCode:(NSInteger)statusCode {
-  _statusCode = statusCode;
-  _responseMessage = CFHTTPMessageCreateResponse(kCFAllocatorDefault, statusCode, NULL, kCFHTTPVersion1_1);
-  CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("Connection"), CFSTR("Close"));
-  CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("Server"), (__bridge CFStringRef)_server.serverName);
-  CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("Date"), (__bridge CFStringRef)GCDWebServerFormatRFC822([NSDate date]));
-}
-
-- (void)_startProcessingRequest {
-  GWS_DCHECK(_responseMessage == NULL);
-
-  GCDWebServerResponse* preflightResponse = [self preflightRequest:_request];
-  if (preflightResponse) {
-    [self _finishProcessingRequest:preflightResponse];
-  } else {
-    [self processRequest:_request
-              completion:^(GCDWebServerResponse* processResponse) {
-                [self _finishProcessingRequest:processResponse];
-              }];
-  }
-}
-
-// http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
-- (void)_finishProcessingRequest:(GCDWebServerResponse*)response {
-  GWS_DCHECK(_responseMessage == NULL);
-  BOOL hasBody = NO;
-
-  if (response) {
-    response = [self overrideResponse:response forRequest:_request];
-  }
-  if (response) {
-    if ([response hasBody]) {
-      [response prepareForReading];
-      hasBody = !_virtualHEAD;
-    }
-    NSError* error = nil;
-    if (hasBody && ![response performOpen:&error]) {
-      GWS_LOG_ERROR(@"Failed opening response body for socket %i: %@", _socket, error);
-    } else {
-      _response = response;
-    }
-  }
-
-  if (_response) {
-    [self _initializeResponseHeadersWithStatusCode:_response.statusCode];
-    if (_response.lastModifiedDate) {
-      CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("Last-Modified"), (__bridge CFStringRef)GCDWebServerFormatRFC822((NSDate*)_response.lastModifiedDate));
-    }
-    if (_response.eTag) {
-      CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("ETag"), (__bridge CFStringRef)_response.eTag);
-    }
-    if ((_response.statusCode >= 200) && (_response.statusCode < 300)) {
-      if (_response.cacheControlMaxAge > 0) {
-        CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("Cache-Control"), (__bridge CFStringRef)[NSString stringWithFormat:@"max-age=%i, public", (int)_response.cacheControlMaxAge]);
-      } else {
-        CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("Cache-Control"), CFSTR("no-cache"));
-      }
-    }
-    if (_response.contentType != nil) {
-      CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("Content-Type"), (__bridge CFStringRef)GCDWebServerNormalizeHeaderValue(_response.contentType));
-    }
-    if (_response.contentLength != NSUIntegerMax) {
-      CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("Content-Length"), (__bridge CFStringRef)[NSString stringWithFormat:@"%lu", (unsigned long)_response.contentLength]);
-    }
-    if (_response.usesChunkedTransferEncoding) {
-      CFHTTPMessageSetHeaderFieldValue(_responseMessage, CFSTR("Transfer-Encoding"), CFSTR("chunked"));
-    }
-    [_response.additionalHeaders enumerateKeysAndObjectsUsingBlock:^(id key, id obj, BOOL* stop) {
-      CFHTTPMessageSetHeaderFieldValue(self->_responseMessage, (__bridge CFStringRef)key, (__bridge CFStringRef)obj);
-    }];
-    [self writeHeadersWithCompletionBlock:^(BOOL success) {
-      if (success) {
-        if (hasBody) {
-          [self writeBodyWithCompletionBlock:^(BOOL successInner) {
-            [self->_response performClose];  // TODO: There's nothing we can do on failure as headers have already been sent
-          }];
-        }
-      } else if (hasBody) {
-        [self->_response performClose];
-      }
-    }];
-  } else {
-    [self abortRequest:_request withStatusCode:kGCDWebServerHTTPStatusCode_InternalServerError];
-  }
-}
-
-- (void)_readBodyWithLength:(NSUInteger)length initialData:(NSData*)initialData {
-  NSError* error = nil;
-  if (![_request performOpen:&error]) {
-    GWS_LOG_ERROR(@"Failed opening request body for socket %i: %@", _socket, error);
-    [self abortRequest:_request withStatusCode:kGCDWebServerHTTPStatusCode_InternalServerError];
-    return;
-  }
-
-  if (initialData.length) {
-    if (![_request performWriteData:initialData error:&error]) {
-      GWS_LOG_ERROR(@"Failed writing request body on socket %i: %@", _socket, error);
-      if (![_request performClose:&error]) {
-        GWS_LOG_ERROR(@"Failed closing request body for socket %i: %@", _socket, error);
-      }
-      [self abortRequest:_request withStatusCode:kGCDWebServerHTTPStatusCode_InternalServerError];
-      return;
-    }
-    length -= initialData.length;
-  }
-
-  if (length) {
-    [self readBodyWithRemainingLength:length
-                      completionBlock:^(BOOL success) {
-                        NSError* localError = nil;
-                        if ([self->_request performClose:&localError]) {
-                          [self _startProcessingRequest];
-                        } else {
-                          GWS_LOG_ERROR(@"Failed closing request body for socket %i: %@", self->_socket, error);
-                          [self abortRequest:self->_request withStatusCode:kGCDWebServerHTTPStatusCode_InternalServerError];
-                        }
-                      }];
-  } else {
-    if ([_request performClose:&error]) {
-      [self _startProcessingRequest];
-    } else {
-      GWS_LOG_ERROR(@"Failed closing request body for socket %i: %@", _socket, error);
-      [self abortRequest:_request withStatusCode:kGCDWebServerHTTPStatusCode_InternalServerError];
-    }
-  }
-}
-
-- (void)_readChunkedBodyWithInitialData:(NSData*)initialData {
-  NSError* error = nil;
-  if (![_request performOpen:&error]) {
-    GWS_LOG_ERROR(@"Failed opening request body for socket %i: %@", _socket, error);
-    [self abortRequest:_request withStatusCode:kGCDWebServerHTTPStatusCode_InternalServerError];
-    return;
-  }
-
-  NSMutableData* chunkData = [[NSMutableData alloc] initWithData:initialData];
-  [self readNextBodyChunk:chunkData
-          completionBlock:^(BOOL success) {
-            NSError* localError = nil;
-            if ([self->_request performClose:&localError]) {
-              [self _startProcessingRequest];
-            } else {
-              GWS_LOG_ERROR(@"Failed closing request body for socket %i: %@", self->_socket, error);
-              [self abortRequest:self->_request withStatusCode:kGCDWebServerHTTPStatusCode_InternalServerError];
-            }
-          }];
-}
-
-- (void)_readRequestHeaders {
-  _requestMessage = CFHTTPMessageCreateEmpty(kCFAllocatorDefault, true);
-  NSMutableData* headersData = [[NSMutableData alloc] initWithCapacity:kHeadersReadCapacity];
-  [self readHeaders:headersData
-      withCompletionBlock:^(NSData* extraData) {
-        if (extraData) {
-          NSString* requestMethod = CFBridgingRelease(CFHTTPMessageCopyRequestMethod(self->_requestMessage));  // Method verbs are case-sensitive and uppercase
-          if (self->_server.shouldAutomaticallyMapHEADToGET && [requestMethod isEqualToString:@"HEAD"]) {
-            requestMethod = @"GET";
-            self->_virtualHEAD = YES;
-          }
-          NSDictionary* requestHeaders = CFBridgingRelease(CFHTTPMessageCopyAllHeaderFields(self->_requestMessage));  // Header names are case-insensitive but CFHTTPMessageCopyAllHeaderFields() will standardize the common ones
-          NSURL* requestURL = CFBridgingRelease(CFHTTPMessageCopyRequestURL(self->_requestMessage));
-          if (requestURL) {
-            requestURL = [self rewriteRequestURL:requestURL withMethod:requestMethod headers:requestHeaders];
-            GWS_DCHECK(requestURL);
-          }
-          NSString* urlPath = requestURL ? CFBridgingRelease(CFURLCopyPath((CFURLRef)requestURL)) : nil;  // Don't use -[NSURL path] which strips the ending slash
-          if (urlPath == nil) {
-            urlPath = @"/";  // CFURLCopyPath() returns NULL for a relative URL with path "//" contrary to -[NSURL path] which returns "/"
-          }
-          NSString* requestPath = urlPath ? GCDWebServerUnescapeURLString(urlPath) : nil;
-          NSString* queryString = requestURL ? CFBridgingRelease(CFURLCopyQueryString((CFURLRef)requestURL, NULL)) : nil;  // Don't use -[NSURL query] to make sure query is not unescaped;
-          NSDictionary* requestQuery = queryString ? GCDWebServerParseURLEncodedForm(queryString) : @{};
-          if (requestMethod && requestURL && requestHeaders && requestPath && requestQuery) {
-            for (self->_handler in self->_server.handlers) {
-              self->_request = self->_handler.matchBlock(requestMethod, requestURL, requestHeaders, requestPath, requestQuery);
-              if (self->_request) {
-                break;
-              }
-            }
-            if (self->_request) {
-              self->_request.localAddressData = self.localAddressData;
-              self->_request.remoteAddressData = self.remoteAddressData;
-              if ([self->_request hasBody]) {
-                [self->_request prepareForWriting];
-                if (self->_request.usesChunkedTransferEncoding || (extraData.length <= self->_request.contentLength)) {
-                  NSString* expectHeader = [requestHeaders objectForKey:@"Expect"];
-                  if (expectHeader) {
-                    if ([expectHeader caseInsensitiveCompare:@"100-continue"] == NSOrderedSame) {  // TODO: Actually validate request before continuing
-                      [self writeData:_continueData
-                          withCompletionBlock:^(BOOL success) {
-                            if (success) {
-                              if (self->_request.usesChunkedTransferEncoding) {
-                                [self _readChunkedBodyWithInitialData:extraData];
-                              } else {
-                                [self _readBodyWithLength:self->_request.contentLength initialData:extraData];
-                              }
-                            }
-                          }];
-                    } else {
-                      GWS_LOG_ERROR(@"Unsupported 'Expect' / 'Content-Length' header combination on socket %i", self->_socket);
-                      [self abortRequest:self->_request withStatusCode:kGCDWebServerHTTPStatusCode_ExpectationFailed];
-                    }
-                  } else {
-                    if (self->_request.usesChunkedTransferEncoding) {
-                      [self _readChunkedBodyWithInitialData:extraData];
-                    } else {
-                      [self _readBodyWithLength:self->_request.contentLength initialData:extraData];
-                    }
-                  }
-                } else {
-                  GWS_LOG_ERROR(@"Unexpected 'Content-Length' header value on socket %i", self->_socket);
-                  [self abortRequest:self->_request withStatusCode:kGCDWebServerHTTPStatusCode_BadRequest];
-                }
-              } else {
-                [self _startProcessingRequest];
-              }
-            } else {
-              self->_request = [[GCDWebServerRequest alloc] initWithMethod:requestMethod url:requestURL headers:requestHeaders path:requestPath query:requestQuery];
-              GWS_DCHECK(self->_request);
-              [self abortRequest:self->_request withStatusCode:kGCDWebServerHTTPStatusCode_NotImplemented];
-            }
-          } else {
-            [self abortRequest:nil withStatusCode:kGCDWebServerHTTPStatusCode_InternalServerError];
-            GWS_DNOT_REACHED();
-          }
-        } else {
-          [self abortRequest:nil withStatusCode:kGCDWebServerHTTPStatusCode_InternalServerError];
-        }
-      }];
-}
-
-- (instancetype)initWithServer:(GCDWebServer*)server localAddress:(NSData*)localAddress remoteAddress:(NSData*)remoteAddress socket:(CFSocketNativeHandle)socket {
-  if ((self = [super init])) {
-    _server = server;
-    _localAddressData = localAddress;
-    _remoteAddressData = remoteAddress;
-    _socket = socket;
-    GWS_LOG_DEBUG(@"Did open connection on socket %i", _socket);
-
-    [_server willStartConnection:self];
-
-    if (![self open]) {
-      close(_socket);
-      return nil;
-    }
-    _opened = YES;
-
-    [self _readRequestHeaders];
-  }
-  return self;
-}
-
-- (NSString*)localAddressString {
-  return GCDWebServerStringFromSockAddr(_localAddressData.bytes, YES);
-}
-
-- (NSString*)remoteAddressString {
-  return GCDWebServerStringFromSockAddr(_remoteAddressData.bytes, YES);
-}
-
-- (void)dealloc {
-  int result = close(_socket);
-  if (result != 0) {
-    GWS_LOG_ERROR(@"Failed closing socket %i for connection: %s (%i)", _socket, strerror(errno), errno);
-  } else {
-    GWS_LOG_DEBUG(@"Did close connection on socket %i", _socket);
-  }
-
-  if (_opened) {
-    [self close];
-  }
-
-  [_server didEndConnection:self];
-
-  if (_requestMessage) {
-    CFRelease(_requestMessage);
-  }
-
-  if (_responseMessage) {
-    CFRelease(_responseMessage);
-  }
-}
-
-@end
-
-@implementation GCDWebServerConnection (Read)
-
-- (void)readData:(NSMutableData*)data withLength:(NSUInteger)length completionBlock:(ReadDataCompletionBlock)block {
-  dispatch_read(_socket, length, dispatch_get_global_queue(_server.dispatchQueuePriority, 0), ^(dispatch_data_t buffer, int error) {
-    @autoreleasepool {
-      if (error == 0) {
-        size_t size = dispatch_data_get_size(buffer);
-        if (size > 0) {
-          NSUInteger originalLength = data.length;
-          dispatch_data_apply(buffer, ^bool(dispatch_data_t region, size_t chunkOffset, const void* chunkBytes, size_t chunkSize) {
-            [data appendBytes:chunkBytes length:chunkSize];
-            return true;
-          });
-          [self didReadBytes:((char*)data.bytes + originalLength) length:(data.length - originalLength)];
-          block(YES);
-        } else {
-          if (self->_totalBytesRead > 0) {
-            GWS_LOG_ERROR(@"No more data available on socket %i", self->_socket);
-          } else {
-            GWS_LOG_WARNING(@"No data received from socket %i", self->_socket);
-          }
-          block(NO);
-        }
-      } else {
-        GWS_LOG_ERROR(@"Error while reading from socket %i: %s (%i)", self->_socket, strerror(error), error);
-        block(NO);
-      }
-    }
-  });
-}
-
-- (void)readHeaders:(NSMutableData*)headersData withCompletionBlock:(ReadHeadersCompletionBlock)block {
-  GWS_DCHECK(_requestMessage);
-  [self readData:headersData
-           withLength:NSUIntegerMax
-      completionBlock:^(BOOL success) {
-        if (success) {
-          NSRange range = [headersData rangeOfData:_CRLFCRLFData options:0 range:NSMakeRange(0, headersData.length)];
-          if (range.location == NSNotFound) {
-            [self readHeaders:headersData withCompletionBlock:block];
-          } else {
-            NSUInteger length = range.location + range.length;
-            if (CFHTTPMessageAppendBytes(self->_requestMessage, headersData.bytes, length)) {
-              if (CFHTTPMessageIsHeaderComplete(self->_requestMessage)) {
-                block([headersData subdataWithRange:NSMakeRange(length, headersData.length - length)]);
-              } else {
-                GWS_LOG_ERROR(@"Failed parsing request headers from socket %i", self->_socket);
-                block(nil);
-              }
-            } else {
-              GWS_LOG_ERROR(@"Failed appending request headers data from socket %i", self->_socket);
-              block(nil);
-            }
-          }
-        } else {
-          block(nil);
-        }
-      }];
-}
-
-- (void)readBodyWithRemainingLength:(NSUInteger)length completionBlock:(ReadBodyCompletionBlock)block {
-  GWS_DCHECK([_request hasBody] && ![_request usesChunkedTransferEncoding]);
-  NSMutableData* bodyData = [[NSMutableData alloc] initWithCapacity:kBodyReadCapacity];
-  [self readData:bodyData
-           withLength:length
-      completionBlock:^(BOOL success) {
-        if (success) {
-          if (bodyData.length <= length) {
-            NSError* error = nil;
-            if ([self->_request performWriteData:bodyData error:&error]) {
-              NSUInteger remainingLength = length - bodyData.length;
-              if (remainingLength) {
-                [self readBodyWithRemainingLength:remainingLength completionBlock:block];
-              } else {
-                block(YES);
-              }
-            } else {
-              GWS_LOG_ERROR(@"Failed writing request body on socket %i: %@", self->_socket, error);
-              block(NO);
-            }
-          } else {
-            GWS_LOG_ERROR(@"Unexpected extra content reading request body on socket %i", self->_socket);
-            block(NO);
-            GWS_DNOT_REACHED();
-          }
-        } else {
-          block(NO);
-        }
-      }];
-}
-
-static inline NSUInteger _ScanHexNumber(const void* bytes, NSUInteger size) {
-  char buffer[size + 1];
-  bcopy(bytes, buffer, size);
-  buffer[size] = 0;
-  char* end = NULL;
-  long result = strtol(buffer, &end, 16);
-  return ((end != NULL) && (*end == 0) && (result >= 0) ? result : NSNotFound);
-}
-
-- (void)readNextBodyChunk:(NSMutableData*)chunkData completionBlock:(ReadBodyCompletionBlock)block {
-  GWS_DCHECK([_request hasBody] && [_request usesChunkedTransferEncoding]);
-
-  while (1) {
-    NSRange range = [chunkData rangeOfData:_CRLFData options:0 range:NSMakeRange(0, chunkData.length)];
-    if (range.location == NSNotFound) {
-      break;
-    }
-    NSRange extensionRange = [chunkData rangeOfData:[NSData dataWithBytes:";" length:1] options:0 range:NSMakeRange(0, range.location)];  // Ignore chunk extensions
-    NSUInteger length = _ScanHexNumber((char*)chunkData.bytes, extensionRange.location != NSNotFound ? extensionRange.location : range.location);
-    if (length != NSNotFound) {
-      if (length) {
-        if (chunkData.length < range.location + range.length + length + 2) {
-          break;
-        }
-        const char* ptr = (char*)chunkData.bytes + range.location + range.length + length;
-        if ((*ptr == '\r') && (*(ptr + 1) == '\n')) {
-          NSError* error = nil;
-          if ([_request performWriteData:[chunkData subdataWithRange:NSMakeRange(range.location + range.length, length)] error:&error]) {
-            [chunkData replaceBytesInRange:NSMakeRange(0, range.location + range.length + length + 2) withBytes:NULL length:0];
-          } else {
-            GWS_LOG_ERROR(@"Failed writing request body on socket %i: %@", _socket, error);
-            block(NO);
-            return;
-          }
-        } else {
-          GWS_LOG_ERROR(@"Missing terminating CRLF sequence for chunk reading request body on socket %i", _socket);
-          block(NO);
-          return;
-        }
-      } else {
-        NSRange trailerRange = [chunkData rangeOfData:_CRLFCRLFData options:0 range:NSMakeRange(range.location, chunkData.length - range.location)];  // Ignore trailers
-        if (trailerRange.location != NSNotFound) {
-          block(YES);
-          return;
-        }
-      }
-    } else {
-      GWS_LOG_ERROR(@"Invalid chunk length reading request body on socket %i", _socket);
-      block(NO);
-      return;
-    }
-  }
-
-  [self readData:chunkData
-           withLength:NSUIntegerMax
-      completionBlock:^(BOOL success) {
-        if (success) {
-          [self readNextBodyChunk:chunkData completionBlock:block];
-        } else {
-          block(NO);
-        }
-      }];
-}
-
-@end
-
-@implementation GCDWebServerConnection (Write)
-
-- (void)writeData:(NSData*)data withCompletionBlock:(WriteDataCompletionBlock)block {
-  dispatch_data_t buffer = dispatch_data_create(data.bytes, data.length, dispatch_get_global_queue(_server.dispatchQueuePriority, 0), ^{
-    [data self];  // Keeps ARC from releasing data too early
-  });
-  dispatch_write(_socket, buffer, dispatch_get_global_queue(_server.dispatchQueuePriority, 0), ^(dispatch_data_t remainingData, int error) {
-    @autoreleasepool {
-      if (error == 0) {
-        GWS_DCHECK(remainingData == NULL);
-        [self didWriteBytes:data.bytes length:data.length];
-        block(YES);
-      } else {
-        GWS_LOG_ERROR(@"Error while writing to socket %i: %s (%i)", self->_socket, strerror(error), error);
-        block(NO);
-      }
-    }
-  });
-#if !OS_OBJECT_USE_OBJC_RETAIN_RELEASE
-  dispatch_release(buffer);
-#endif
-}
-
-- (void)writeHeadersWithCompletionBlock:(WriteHeadersCompletionBlock)block {
-  GWS_DCHECK(_responseMessage);
-  CFDataRef data = CFHTTPMessageCopySerializedMessage(_responseMessage);
-  [self writeData:(__bridge NSData*)data withCompletionBlock:block];
-  CFRelease(data);
-}
-
-- (void)writeBodyWithCompletionBlock:(WriteBodyCompletionBlock)block {
-  GWS_DCHECK([_response hasBody]);
-  [_response performReadDataWithCompletion:^(NSData* data, NSError* error) {
-    if (data) {
-      if (data.length) {
-        if (self->_response.usesChunkedTransferEncoding) {
-          const char* hexString = [[NSString stringWithFormat:@"%lx", (unsigned long)data.length] UTF8String];
-          size_t hexLength = strlen(hexString);
-          NSData* chunk = [NSMutableData dataWithLength:(hexLength + 2 + data.length + 2)];
-          if (chunk == nil) {
-            GWS_LOG_ERROR(@"Failed allocating memory for response body chunk for socket %i: %@", self->_socket, error);
-            block(NO);
-            return;
-          }
-          char* ptr = (char*)[(NSMutableData*)chunk mutableBytes];
-          bcopy(hexString, ptr, hexLength);
-          ptr += hexLength;
-          *ptr++ = '\r';
-          *ptr++ = '\n';
-          bcopy(data.bytes, ptr, data.length);
-          ptr += data.length;
-          *ptr++ = '\r';
-          *ptr = '\n';
-          data = chunk;
-        }
-        [self writeData:data
-            withCompletionBlock:^(BOOL success) {
-              if (success) {
-                [self writeBodyWithCompletionBlock:block];
-              } else {
-                block(NO);
-              }
-            }];
-      } else {
-        if (self->_response.usesChunkedTransferEncoding) {
-          [self writeData:_lastChunkData
-              withCompletionBlock:^(BOOL success) {
-                block(success);
-              }];
-        } else {
-          block(YES);
-        }
-      }
-    } else {
-      GWS_LOG_ERROR(@"Failed reading response body for socket %i: %@", self->_socket, error);
-      block(NO);
-    }
-  }];
-}
-
-@end
-
-@implementation GCDWebServerConnection (Subclassing)
-
-- (BOOL)open {
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-  if (_server.recordingEnabled) {
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-    _connectionIndex = OSAtomicIncrement32(&_connectionCounter);
-#pragma clang diagnostic pop
-
-    _requestPath = [NSTemporaryDirectory() stringByAppendingPathComponent:[[NSProcessInfo processInfo] globallyUniqueString]];
-    _requestFD = open([_requestPath fileSystemRepresentation], O_CREAT | O_TRUNC | O_WRONLY, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-    GWS_DCHECK(_requestFD > 0);
-
-    _responsePath = [NSTemporaryDirectory() stringByAppendingPathComponent:[[NSProcessInfo processInfo] globallyUniqueString]];
-    _responseFD = open([_responsePath fileSystemRepresentation], O_CREAT | O_TRUNC | O_WRONLY, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-    GWS_DCHECK(_responseFD > 0);
-  }
-#endif
-
-  return YES;
-}
-
-- (void)didReadBytes:(const void*)bytes length:(NSUInteger)length {
-  GWS_LOG_DEBUG(@"Connection received %lu bytes on socket %i", (unsigned long)length, _socket);
-  _totalBytesRead += length;
-
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-  if ((_requestFD > 0) && (write(_requestFD, bytes, length) != (ssize_t)length)) {
-    GWS_LOG_ERROR(@"Failed recording request data: %s (%i)", strerror(errno), errno);
-    close(_requestFD);
-    _requestFD = 0;
-  }
-#endif
-}
-
-- (void)didWriteBytes:(const void*)bytes length:(NSUInteger)length {
-  GWS_LOG_DEBUG(@"Connection sent %lu bytes on socket %i", (unsigned long)length, _socket);
-  _totalBytesWritten += length;
-
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-  if ((_responseFD > 0) && (write(_responseFD, bytes, length) != (ssize_t)length)) {
-    GWS_LOG_ERROR(@"Failed recording response data: %s (%i)", strerror(errno), errno);
-    close(_responseFD);
-    _responseFD = 0;
-  }
-#endif
-}
-
-- (NSURL*)rewriteRequestURL:(NSURL*)url withMethod:(NSString*)method headers:(NSDictionary<NSString*, NSString*>*)headers {
-  return url;
-}
-
-// https://tools.ietf.org/html/rfc2617
-- (GCDWebServerResponse*)preflightRequest:(GCDWebServerRequest*)request {
-  GWS_LOG_DEBUG(@"Connection on socket %i preflighting request \"%@ %@\" with %lu bytes body", _socket, _virtualHEAD ? @"HEAD" : _request.method, _request.path, (unsigned long)_totalBytesRead);
-  GCDWebServerResponse* response = nil;
-  if (_server.authenticationBasicAccounts) {
-    __block BOOL authenticated = NO;
-    NSString* authorizationHeader = [request.headers objectForKey:@"Authorization"];
-    if ([authorizationHeader hasPrefix:@"Basic "]) {
-      NSString* basicAccount = [authorizationHeader substringFromIndex:6];
-      [_server.authenticationBasicAccounts enumerateKeysAndObjectsUsingBlock:^(NSString* username, NSString* digest, BOOL* stop) {
-        if ([basicAccount isEqualToString:digest]) {
-          authenticated = YES;
-          *stop = YES;
-        }
-      }];
-    }
-    if (!authenticated) {
-      response = [GCDWebServerResponse responseWithStatusCode:kGCDWebServerHTTPStatusCode_Unauthorized];
-      [response setValue:[NSString stringWithFormat:@"Basic realm=\"%@\"", _server.authenticationRealm] forAdditionalHeader:@"WWW-Authenticate"];
-    }
-  } else if (_server.authenticationDigestAccounts) {
-    BOOL authenticated = NO;
-    BOOL isStaled = NO;
-    NSString* authorizationHeader = [request.headers objectForKey:@"Authorization"];
-    if ([authorizationHeader hasPrefix:@"Digest "]) {
-      NSString* realm = GCDWebServerExtractHeaderValueParameter(authorizationHeader, @"realm");
-      if (realm && [_server.authenticationRealm isEqualToString:realm]) {
-        NSString* nonce = GCDWebServerExtractHeaderValueParameter(authorizationHeader, @"nonce");
-        if ([nonce isEqualToString:_digestAuthenticationNonce]) {
-          NSString* username = GCDWebServerExtractHeaderValueParameter(authorizationHeader, @"username");
-          NSString* uri = GCDWebServerExtractHeaderValueParameter(authorizationHeader, @"uri");
-          NSString* actualResponse = GCDWebServerExtractHeaderValueParameter(authorizationHeader, @"response");
-          NSString* ha1 = [_server.authenticationDigestAccounts objectForKey:username];
-          NSString* ha2 = GCDWebServerComputeMD5Digest(@"%@:%@", request.method, uri);  // We cannot use "request.path" as the query string is required
-          NSString* expectedResponse = GCDWebServerComputeMD5Digest(@"%@:%@:%@", ha1, _digestAuthenticationNonce, ha2);
-          if ([actualResponse isEqualToString:expectedResponse]) {
-            authenticated = YES;
-          }
-        } else if (nonce.length) {
-          isStaled = YES;
-        }
-      }
-    }
-    if (!authenticated) {
-      response = [GCDWebServerResponse responseWithStatusCode:kGCDWebServerHTTPStatusCode_Unauthorized];
-      [response setValue:[NSString stringWithFormat:@"Digest realm=\"%@\", nonce=\"%@\"%@", _server.authenticationRealm, _digestAuthenticationNonce, isStaled ? @", stale=TRUE" : @""] forAdditionalHeader:@"WWW-Authenticate"];  // TODO: Support Quality of Protection ("qop")
-    }
-  }
-  return response;
-}
-
-- (void)processRequest:(GCDWebServerRequest*)request completion:(GCDWebServerCompletionBlock)completion {
-  GWS_LOG_DEBUG(@"Connection on socket %i processing request \"%@ %@\" with %lu bytes body", _socket, _virtualHEAD ? @"HEAD" : _request.method, _request.path, (unsigned long)_totalBytesRead);
-  _handler.asyncProcessBlock(request, [completion copy]);
-}
-
-// http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.25
-// http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.26
-static inline BOOL _CompareResources(NSString* responseETag, NSString* requestETag, NSDate* responseLastModified, NSDate* requestLastModified) {
-  if (requestLastModified && responseLastModified) {
-    if ([responseLastModified compare:requestLastModified] != NSOrderedDescending) {
-      return YES;
-    }
-  }
-  if (requestETag && responseETag) {  // Per the specs "If-None-Match" must be checked after "If-Modified-Since"
-    if ([requestETag isEqualToString:@"*"]) {
-      return YES;
-    }
-    if ([responseETag isEqualToString:requestETag]) {
-      return YES;
-    }
-  }
-  return NO;
-}
-
-- (GCDWebServerResponse*)overrideResponse:(GCDWebServerResponse*)response forRequest:(GCDWebServerRequest*)request {
-  if ((response.statusCode >= 200) && (response.statusCode < 300) && _CompareResources(response.eTag, request.ifNoneMatch, response.lastModifiedDate, request.ifModifiedSince)) {
-    NSInteger code = [request.method isEqualToString:@"HEAD"] || [request.method isEqualToString:@"GET"] ? kGCDWebServerHTTPStatusCode_NotModified : kGCDWebServerHTTPStatusCode_PreconditionFailed;
-    GCDWebServerResponse* newResponse = [GCDWebServerResponse responseWithStatusCode:code];
-    newResponse.cacheControlMaxAge = response.cacheControlMaxAge;
-    newResponse.lastModifiedDate = response.lastModifiedDate;
-    newResponse.eTag = response.eTag;
-    GWS_DCHECK(newResponse);
-    return newResponse;
-  }
-  return response;
-}
-
-- (void)abortRequest:(GCDWebServerRequest*)request withStatusCode:(NSInteger)statusCode {
-  GWS_DCHECK(_responseMessage == NULL);
-  GWS_DCHECK((statusCode >= 400) && (statusCode < 600));
-  [self _initializeResponseHeadersWithStatusCode:statusCode];
-  [self writeHeadersWithCompletionBlock:^(BOOL success){
-      // Nothing more to do
-  }];
-  GWS_LOG_DEBUG(@"Connection aborted with status code %i on socket %i", (int)statusCode, _socket);
-}
-
-- (void)close {
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-  if (_requestPath) {
-    BOOL success = NO;
-    NSError* error = nil;
-    if (_requestFD > 0) {
-      close(_requestFD);
-      NSString* name = [NSString stringWithFormat:@"%03lu-%@.request", (unsigned long)_connectionIndex, _virtualHEAD ? @"HEAD" : _request.method];
-      success = [[NSFileManager defaultManager] moveItemAtPath:_requestPath toPath:[[[NSFileManager defaultManager] currentDirectoryPath] stringByAppendingPathComponent:name] error:&error];
-    }
-    if (!success) {
-      GWS_LOG_ERROR(@"Failed saving recorded request: %@", error);
-      GWS_DNOT_REACHED();
-    }
-    unlink([_requestPath fileSystemRepresentation]);
-  }
-
-  if (_responsePath) {
-    BOOL success = NO;
-    NSError* error = nil;
-    if (_responseFD > 0) {
-      close(_responseFD);
-      NSString* name = [NSString stringWithFormat:@"%03lu-%i.response", (unsigned long)_connectionIndex, (int)_statusCode];
-      success = [[NSFileManager defaultManager] moveItemAtPath:_responsePath toPath:[[[NSFileManager defaultManager] currentDirectoryPath] stringByAppendingPathComponent:name] error:&error];
-    }
-    if (!success) {
-      GWS_LOG_ERROR(@"Failed saving recorded response: %@", error);
-      GWS_DNOT_REACHED();
-    }
-    unlink([_responsePath fileSystemRepresentation]);
-  }
-#endif
-
-  if (_request) {
-    GWS_LOG_VERBOSE(@"[%@] %@ %i \"%@ %@\" (%lu | %lu)", self.localAddressString, self.remoteAddressString, (int)_statusCode, _virtualHEAD ? @"HEAD" : _request.method, _request.path, (unsigned long)_totalBytesRead, (unsigned long)_totalBytesWritten);
-  } else {
-    GWS_LOG_VERBOSE(@"[%@] %@ %i \"(invalid request)\" (%lu | %lu)", self.localAddressString, self.remoteAddressString, (int)_statusCode, (unsigned long)_totalBytesRead, (unsigned long)_totalBytesWritten);
-  }
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerFunctions.h b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerFunctions.h
deleted file mode 100644
index 217fb1431..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerFunctions.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import <Foundation/Foundation.h>
-
-NS_ASSUME_NONNULL_BEGIN
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/**
- *  Converts a file extension to the corresponding MIME type.
- *  If there is no match, "application/octet-stream" is returned.
- *
- *  Overrides allow to customize the built-in mapping from extensions to MIME
- *  types. Keys of the dictionary must be lowercased file extensions without
- *  the period, and the values must be the corresponding MIME types.
- */
-NSString* GCDWebServerGetMimeTypeForExtension(NSString* extension, NSDictionary<NSString*, NSString*>* _Nullable overrides);
-
-/**
- *  Add percent-escapes to a string so it can be used in a URL.
- *  The legal characters ":@/?&=+" are also escaped to ensure compatibility
- *  with URL encoded forms and URL queries.
- */
-NSString* _Nullable GCDWebServerEscapeURLString(NSString* string);
-
-/**
- *  Unescapes a URL percent-encoded string.
- */
-NSString* _Nullable GCDWebServerUnescapeURLString(NSString* string);
-
-/**
- *  Extracts the unescaped names and values from an
- *  "application/x-www-form-urlencoded" form.
- *  http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.1
- */
-NSDictionary<NSString*, NSString*>* GCDWebServerParseURLEncodedForm(NSString* form);
-
-/**
- *  On OS X, returns the IPv4 or IPv6 address as a string of the primary
- *  connected service or nil if not available.
- *  
- *  On iOS, returns the IPv4 or IPv6 address as a string of the WiFi
- *  interface if connected or nil otherwise.
- */
-NSString* _Nullable GCDWebServerGetPrimaryIPAddress(BOOL useIPv6);
-
-/**
- *  Converts a date into a string using RFC822 formatting.
- *  https://tools.ietf.org/html/rfc822#section-5
- *  https://tools.ietf.org/html/rfc1123#section-5.2.14
- */
-NSString* GCDWebServerFormatRFC822(NSDate* date);
-
-/**
- *  Converts a RFC822 formatted string into a date.
- *  https://tools.ietf.org/html/rfc822#section-5
- *  https://tools.ietf.org/html/rfc1123#section-5.2.14
- *
- *  @warning Timezones other than GMT are not supported by this function.
- */
-NSDate* _Nullable GCDWebServerParseRFC822(NSString* string);
-
-/**
- *  Converts a date into a string using IOS 8601 formatting.
- *  http://tools.ietf.org/html/rfc3339#section-5.6
- */
-NSString* GCDWebServerFormatISO8601(NSDate* date);
-
-/**
- *  Converts a ISO 8601 formatted string into a date.
- *  http://tools.ietf.org/html/rfc3339#section-5.6
- *
- *  @warning Only "calendar" variant is supported at this time and timezones
- *  other than GMT are not supported either.
- */
-NSDate* _Nullable GCDWebServerParseISO8601(NSString* string);
-
-/**
- *  Removes "//", "/./" and "/../" components from path as well as any trailing slash.
- */
-NSString* GCDWebServerNormalizePath(NSString* path);
-
-#ifdef __cplusplus
-}
-#endif
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerFunctions.m b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerFunctions.m
deleted file mode 100644
index c855556ca..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerFunctions.m
+++ /dev/null
@@ -1,334 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import <TargetConditionals.h>
-#if TARGET_OS_IPHONE
-#import <MobileCoreServices/MobileCoreServices.h>
-#else
-#import <SystemConfiguration/SystemConfiguration.h>
-#endif
-#import <CommonCrypto/CommonDigest.h>
-
-#import <ifaddrs.h>
-#import <net/if.h>
-#import <netdb.h>
-
-#import "GCDWebServerPrivate.h"
-
-static NSDateFormatter* _dateFormatterRFC822 = nil;
-static NSDateFormatter* _dateFormatterISO8601 = nil;
-static dispatch_queue_t _dateFormatterQueue = NULL;
-
-// TODO: Handle RFC 850 and ANSI C's asctime() format
-void GCDWebServerInitializeFunctions() {
-  GWS_DCHECK([NSThread isMainThread]);  // NSDateFormatter should be initialized on main thread
-  if (_dateFormatterRFC822 == nil) {
-    _dateFormatterRFC822 = [[NSDateFormatter alloc] init];
-    _dateFormatterRFC822.timeZone = [NSTimeZone timeZoneWithAbbreviation:@"GMT"];
-    _dateFormatterRFC822.dateFormat = @"EEE',' dd MMM yyyy HH':'mm':'ss 'GMT'";
-    _dateFormatterRFC822.locale = [[NSLocale alloc] initWithLocaleIdentifier:@"en_US"];
-    GWS_DCHECK(_dateFormatterRFC822);
-  }
-  if (_dateFormatterISO8601 == nil) {
-    _dateFormatterISO8601 = [[NSDateFormatter alloc] init];
-    _dateFormatterISO8601.timeZone = [NSTimeZone timeZoneWithAbbreviation:@"GMT"];
-    _dateFormatterISO8601.dateFormat = @"yyyy-MM-dd'T'HH:mm:ss'+00:00'";
-    _dateFormatterISO8601.locale = [[NSLocale alloc] initWithLocaleIdentifier:@"en_US"];
-    GWS_DCHECK(_dateFormatterISO8601);
-  }
-  if (_dateFormatterQueue == NULL) {
-    _dateFormatterQueue = dispatch_queue_create(NULL, DISPATCH_QUEUE_SERIAL);
-    GWS_DCHECK(_dateFormatterQueue);
-  }
-}
-
-NSString* GCDWebServerNormalizeHeaderValue(NSString* value) {
-  if (value) {
-    NSRange range = [value rangeOfString:@";"];  // Assume part before ";" separator is case-insensitive
-    if (range.location != NSNotFound) {
-      value = [[[value substringToIndex:range.location] lowercaseString] stringByAppendingString:[value substringFromIndex:range.location]];
-    } else {
-      value = [value lowercaseString];
-    }
-  }
-  return value;
-}
-
-NSString* GCDWebServerTruncateHeaderValue(NSString* value) {
-  if (value) {
-    NSRange range = [value rangeOfString:@";"];
-    if (range.location != NSNotFound) {
-      return [value substringToIndex:range.location];
-    }
-  }
-  return value;
-}
-
-NSString* GCDWebServerExtractHeaderValueParameter(NSString* value, NSString* name) {
-  NSString* parameter = nil;
-  if (value) {
-    NSScanner* scanner = [[NSScanner alloc] initWithString:value];
-    [scanner setCaseSensitive:NO];  // Assume parameter names are case-insensitive
-    NSString* string = [NSString stringWithFormat:@"%@=", name];
-    if ([scanner scanUpToString:string intoString:NULL]) {
-      [scanner scanString:string intoString:NULL];
-      if ([scanner scanString:@"\"" intoString:NULL]) {
-        [scanner scanUpToString:@"\"" intoString:&parameter];
-      } else {
-        [scanner scanUpToCharactersFromSet:[NSCharacterSet whitespaceCharacterSet] intoString:&parameter];
-      }
-    }
-  }
-  return parameter;
-}
-
-// http://www.w3schools.com/tags/ref_charactersets.asp
-NSStringEncoding GCDWebServerStringEncodingFromCharset(NSString* charset) {
-  NSStringEncoding encoding = kCFStringEncodingInvalidId;
-  if (charset) {
-    encoding = CFStringConvertEncodingToNSStringEncoding(CFStringConvertIANACharSetNameToEncoding((CFStringRef)charset));
-  }
-  return (encoding != kCFStringEncodingInvalidId ? encoding : NSUTF8StringEncoding);
-}
-
-NSString* GCDWebServerFormatRFC822(NSDate* date) {
-  __block NSString* string;
-  dispatch_sync(_dateFormatterQueue, ^{
-    string = [_dateFormatterRFC822 stringFromDate:date];
-  });
-  return string;
-}
-
-NSDate* GCDWebServerParseRFC822(NSString* string) {
-  __block NSDate* date;
-  dispatch_sync(_dateFormatterQueue, ^{
-    date = [_dateFormatterRFC822 dateFromString:string];
-  });
-  return date;
-}
-
-NSString* GCDWebServerFormatISO8601(NSDate* date) {
-  __block NSString* string;
-  dispatch_sync(_dateFormatterQueue, ^{
-    string = [_dateFormatterISO8601 stringFromDate:date];
-  });
-  return string;
-}
-
-NSDate* GCDWebServerParseISO8601(NSString* string) {
-  __block NSDate* date;
-  dispatch_sync(_dateFormatterQueue, ^{
-    date = [_dateFormatterISO8601 dateFromString:string];
-  });
-  return date;
-}
-
-BOOL GCDWebServerIsTextContentType(NSString* type) {
-  return ([type hasPrefix:@"text/"] || [type hasPrefix:@"application/json"] || [type hasPrefix:@"application/xml"]);
-}
-
-NSString* GCDWebServerDescribeData(NSData* data, NSString* type) {
-  if (GCDWebServerIsTextContentType(type)) {
-    NSString* charset = GCDWebServerExtractHeaderValueParameter(type, @"charset");
-    NSString* string = [[NSString alloc] initWithData:data encoding:GCDWebServerStringEncodingFromCharset(charset)];
-    if (string) {
-      return string;
-    }
-  }
-  return [NSString stringWithFormat:@"<%lu bytes>", (unsigned long)data.length];
-}
-
-NSString* GCDWebServerGetMimeTypeForExtension(NSString* extension, NSDictionary<NSString*, NSString*>* overrides) {
-  NSDictionary* builtInOverrides = @{@"css" : @"text/css"};
-  NSString* mimeType = nil;
-  extension = [extension lowercaseString];
-  if (extension.length) {
-    mimeType = [overrides objectForKey:extension];
-    if (mimeType == nil) {
-      mimeType = [builtInOverrides objectForKey:extension];
-    }
-    if (mimeType == nil) {
-      CFStringRef uti = UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, (__bridge CFStringRef)extension, NULL);
-      if (uti) {
-        mimeType = CFBridgingRelease(UTTypeCopyPreferredTagWithClass(uti, kUTTagClassMIMEType));
-        CFRelease(uti);
-      }
-    }
-  }
-  return mimeType ? mimeType : kGCDWebServerDefaultMimeType;
-}
-
-NSString* GCDWebServerEscapeURLString(NSString* string) {
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-  return CFBridgingRelease(CFURLCreateStringByAddingPercentEscapes(kCFAllocatorDefault, (CFStringRef)string, NULL, CFSTR(":@/?&=+"), kCFStringEncodingUTF8));
-#pragma clang diagnostic pop
-}
-
-NSString* GCDWebServerUnescapeURLString(NSString* string) {
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-  return CFBridgingRelease(CFURLCreateStringByReplacingPercentEscapesUsingEncoding(kCFAllocatorDefault, (CFStringRef)string, CFSTR(""), kCFStringEncodingUTF8));
-#pragma clang diagnostic pop
-}
-
-NSDictionary<NSString*, NSString*>* GCDWebServerParseURLEncodedForm(NSString* form) {
-  NSMutableDictionary* parameters = [NSMutableDictionary dictionary];
-  NSScanner* scanner = [[NSScanner alloc] initWithString:form];
-  [scanner setCharactersToBeSkipped:nil];
-  while (1) {
-    NSString* key = nil;
-    if (![scanner scanUpToString:@"=" intoString:&key] || [scanner isAtEnd]) {
-      break;
-    }
-    [scanner setScanLocation:([scanner scanLocation] + 1)];
-
-    NSString* value = nil;
-    [scanner scanUpToString:@"&" intoString:&value];
-    if (value == nil) {
-      value = @"";
-    }
-
-    key = [key stringByReplacingOccurrencesOfString:@"+" withString:@" "];
-    NSString* unescapedKey = key ? GCDWebServerUnescapeURLString(key) : nil;
-    value = [value stringByReplacingOccurrencesOfString:@"+" withString:@" "];
-    NSString* unescapedValue = value ? GCDWebServerUnescapeURLString(value) : nil;
-    if (unescapedKey && unescapedValue) {
-      [parameters setObject:unescapedValue forKey:unescapedKey];
-    } else {
-      GWS_LOG_WARNING(@"Failed parsing URL encoded form for key \"%@\" and value \"%@\"", key, value);
-      GWS_DNOT_REACHED();
-    }
-
-    if ([scanner isAtEnd]) {
-      break;
-    }
-    [scanner setScanLocation:([scanner scanLocation] + 1)];
-  }
-  return parameters;
-}
-
-NSString* GCDWebServerStringFromSockAddr(const struct sockaddr* addr, BOOL includeService) {
-  char hostBuffer[NI_MAXHOST];
-  char serviceBuffer[NI_MAXSERV];
-  if (getnameinfo(addr, addr->sa_len, hostBuffer, sizeof(hostBuffer), serviceBuffer, sizeof(serviceBuffer), NI_NUMERICHOST | NI_NUMERICSERV | NI_NOFQDN) != 0) {
-#if DEBUG
-    GWS_DNOT_REACHED();
-#else
-    return @"";
-#endif
-  }
-  return includeService ? [NSString stringWithFormat:@"%s:%s", hostBuffer, serviceBuffer] : (NSString*)[NSString stringWithUTF8String:hostBuffer];
-}
-
-NSString* GCDWebServerGetPrimaryIPAddress(BOOL useIPv6) {
-  NSString* address = nil;
-#if TARGET_OS_IPHONE
-#if !TARGET_IPHONE_SIMULATOR && !TARGET_OS_TV
-  const char* primaryInterface = "en0";  // WiFi interface on iOS
-#endif
-#else
-  const char* primaryInterface = NULL;
-  SCDynamicStoreRef store = SCDynamicStoreCreate(kCFAllocatorDefault, CFSTR("GCDWebServer"), NULL, NULL);
-  if (store) {
-    CFPropertyListRef info = SCDynamicStoreCopyValue(store, CFSTR("State:/Network/Global/IPv4"));  // There is no equivalent for IPv6 but the primary interface should be the same
-    if (info) {
-      NSString* interface = [(__bridge NSDictionary*)info objectForKey:@"PrimaryInterface"];
-      if (interface) {
-        primaryInterface = [[NSString stringWithString:interface] UTF8String];  // Copy string to auto-release pool
-      }
-      CFRelease(info);
-    }
-    CFRelease(store);
-  }
-  if (primaryInterface == NULL) {
-    primaryInterface = "lo0";
-  }
-#endif
-  struct ifaddrs* list;
-  if (getifaddrs(&list) >= 0) {
-    for (struct ifaddrs* ifap = list; ifap; ifap = ifap->ifa_next) {
-#if TARGET_IPHONE_SIMULATOR || TARGET_OS_TV
-      // Assume en0 is Ethernet and en1 is WiFi since there is no way to use SystemConfiguration framework in iOS Simulator
-      // Assumption holds for Apple TV running tvOS
-      if (strcmp(ifap->ifa_name, "en0") && strcmp(ifap->ifa_name, "en1"))
-#else
-      if (strcmp(ifap->ifa_name, primaryInterface))
-#endif
-      {
-        continue;
-      }
-      if ((ifap->ifa_flags & IFF_UP) && ((!useIPv6 && (ifap->ifa_addr->sa_family == AF_INET)) || (useIPv6 && (ifap->ifa_addr->sa_family == AF_INET6)))) {
-        address = GCDWebServerStringFromSockAddr(ifap->ifa_addr, NO);
-        break;
-      }
-    }
-    freeifaddrs(list);
-  }
-  return address;
-}
-
-NSString* GCDWebServerComputeMD5Digest(NSString* format, ...) {
-  va_list arguments;
-  va_start(arguments, format);
-  const char* string = [[[NSString alloc] initWithFormat:format arguments:arguments] UTF8String];
-  va_end(arguments);
-  unsigned char md5[CC_MD5_DIGEST_LENGTH];
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-  CC_MD5(string, (CC_LONG)strlen(string), md5);
-#pragma clang diagnostic pop
-  char buffer[2 * CC_MD5_DIGEST_LENGTH + 1];
-  for (int i = 0; i < CC_MD5_DIGEST_LENGTH; ++i) {
-    unsigned char byte = md5[i];
-    unsigned char byteHi = (byte & 0xF0) >> 4;
-    buffer[2 * i + 0] = byteHi >= 10 ? 'a' + byteHi - 10 : '0' + byteHi;
-    unsigned char byteLo = byte & 0x0F;
-    buffer[2 * i + 1] = byteLo >= 10 ? 'a' + byteLo - 10 : '0' + byteLo;
-  }
-  buffer[2 * CC_MD5_DIGEST_LENGTH] = 0;
-  return (NSString*)[NSString stringWithUTF8String:buffer];
-}
-
-NSString* GCDWebServerNormalizePath(NSString* path) {
-  NSMutableArray* components = [[NSMutableArray alloc] init];
-  for (NSString* component in [path componentsSeparatedByString:@"/"]) {
-    if ([component isEqualToString:@".."]) {
-      [components removeLastObject];
-    } else if (component.length && ![component isEqualToString:@"."]) {
-      [components addObject:component];
-    }
-  }
-  if (path.length && ([path characterAtIndex:0] == '/')) {
-    return [@"/" stringByAppendingString:[components componentsJoinedByString:@"/"]];  // Preserve initial slash
-  }
-  return [components componentsJoinedByString:@"/"];
-}
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerHTTPStatusCodes.h b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerHTTPStatusCodes.h
deleted file mode 100644
index 12b697e37..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerHTTPStatusCodes.h
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-// http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
-// http://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml
-
-#import <Foundation/Foundation.h>
-
-/**
- *  Convenience constants for "informational" HTTP status codes.
- */
-typedef NS_ENUM(NSInteger, GCDWebServerInformationalHTTPStatusCode) {
-  kGCDWebServerHTTPStatusCode_Continue = 100,
-  kGCDWebServerHTTPStatusCode_SwitchingProtocols = 101,
-  kGCDWebServerHTTPStatusCode_Processing = 102
-};
-
-/**
- *  Convenience constants for "successful" HTTP status codes.
- */
-typedef NS_ENUM(NSInteger, GCDWebServerSuccessfulHTTPStatusCode) {
-  kGCDWebServerHTTPStatusCode_OK = 200,
-  kGCDWebServerHTTPStatusCode_Created = 201,
-  kGCDWebServerHTTPStatusCode_Accepted = 202,
-  kGCDWebServerHTTPStatusCode_NonAuthoritativeInformation = 203,
-  kGCDWebServerHTTPStatusCode_NoContent = 204,
-  kGCDWebServerHTTPStatusCode_ResetContent = 205,
-  kGCDWebServerHTTPStatusCode_PartialContent = 206,
-  kGCDWebServerHTTPStatusCode_MultiStatus = 207,
-  kGCDWebServerHTTPStatusCode_AlreadyReported = 208
-};
-
-/**
- *  Convenience constants for "redirection" HTTP status codes.
- */
-typedef NS_ENUM(NSInteger, GCDWebServerRedirectionHTTPStatusCode) {
-  kGCDWebServerHTTPStatusCode_MultipleChoices = 300,
-  kGCDWebServerHTTPStatusCode_MovedPermanently = 301,
-  kGCDWebServerHTTPStatusCode_Found = 302,
-  kGCDWebServerHTTPStatusCode_SeeOther = 303,
-  kGCDWebServerHTTPStatusCode_NotModified = 304,
-  kGCDWebServerHTTPStatusCode_UseProxy = 305,
-  kGCDWebServerHTTPStatusCode_TemporaryRedirect = 307,
-  kGCDWebServerHTTPStatusCode_PermanentRedirect = 308
-};
-
-/**
- *  Convenience constants for "client error" HTTP status codes.
- */
-typedef NS_ENUM(NSInteger, GCDWebServerClientErrorHTTPStatusCode) {
-  kGCDWebServerHTTPStatusCode_BadRequest = 400,
-  kGCDWebServerHTTPStatusCode_Unauthorized = 401,
-  kGCDWebServerHTTPStatusCode_PaymentRequired = 402,
-  kGCDWebServerHTTPStatusCode_Forbidden = 403,
-  kGCDWebServerHTTPStatusCode_NotFound = 404,
-  kGCDWebServerHTTPStatusCode_MethodNotAllowed = 405,
-  kGCDWebServerHTTPStatusCode_NotAcceptable = 406,
-  kGCDWebServerHTTPStatusCode_ProxyAuthenticationRequired = 407,
-  kGCDWebServerHTTPStatusCode_RequestTimeout = 408,
-  kGCDWebServerHTTPStatusCode_Conflict = 409,
-  kGCDWebServerHTTPStatusCode_Gone = 410,
-  kGCDWebServerHTTPStatusCode_LengthRequired = 411,
-  kGCDWebServerHTTPStatusCode_PreconditionFailed = 412,
-  kGCDWebServerHTTPStatusCode_RequestEntityTooLarge = 413,
-  kGCDWebServerHTTPStatusCode_RequestURITooLong = 414,
-  kGCDWebServerHTTPStatusCode_UnsupportedMediaType = 415,
-  kGCDWebServerHTTPStatusCode_RequestedRangeNotSatisfiable = 416,
-  kGCDWebServerHTTPStatusCode_ExpectationFailed = 417,
-  kGCDWebServerHTTPStatusCode_UnprocessableEntity = 422,
-  kGCDWebServerHTTPStatusCode_Locked = 423,
-  kGCDWebServerHTTPStatusCode_FailedDependency = 424,
-  kGCDWebServerHTTPStatusCode_UpgradeRequired = 426,
-  kGCDWebServerHTTPStatusCode_PreconditionRequired = 428,
-  kGCDWebServerHTTPStatusCode_TooManyRequests = 429,
-  kGCDWebServerHTTPStatusCode_RequestHeaderFieldsTooLarge = 431
-};
-
-/**
- *  Convenience constants for "server error" HTTP status codes.
- */
-typedef NS_ENUM(NSInteger, GCDWebServerServerErrorHTTPStatusCode) {
-  kGCDWebServerHTTPStatusCode_InternalServerError = 500,
-  kGCDWebServerHTTPStatusCode_NotImplemented = 501,
-  kGCDWebServerHTTPStatusCode_BadGateway = 502,
-  kGCDWebServerHTTPStatusCode_ServiceUnavailable = 503,
-  kGCDWebServerHTTPStatusCode_GatewayTimeout = 504,
-  kGCDWebServerHTTPStatusCode_HTTPVersionNotSupported = 505,
-  kGCDWebServerHTTPStatusCode_InsufficientStorage = 507,
-  kGCDWebServerHTTPStatusCode_LoopDetected = 508,
-  kGCDWebServerHTTPStatusCode_NotExtended = 510,
-  kGCDWebServerHTTPStatusCode_NetworkAuthenticationRequired = 511
-};
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerPrivate.h b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerPrivate.h
deleted file mode 100644
index 4668a9787..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerPrivate.h
+++ /dev/null
@@ -1,224 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import <os/object.h>
-#import <sys/socket.h>
-
-/**
- *  All GCDWebServer headers.
- */
-
-#import "GCDWebServerHTTPStatusCodes.h"
-#import "GCDWebServerFunctions.h"
-
-#import "GCDWebServer.h"
-#import "GCDWebServerConnection.h"
-
-#import "GCDWebServerDataRequest.h"
-#import "GCDWebServerFileRequest.h"
-#import "GCDWebServerMultiPartFormRequest.h"
-#import "GCDWebServerURLEncodedFormRequest.h"
-
-#import "GCDWebServerDataResponse.h"
-#import "GCDWebServerErrorResponse.h"
-#import "GCDWebServerFileResponse.h"
-#import "GCDWebServerStreamedResponse.h"
-
-/**
- *  Check if a custom logging facility should be used instead.
- */
-
-#if defined(__GCDWEBSERVER_LOGGING_HEADER__)
-
-#define __GCDWEBSERVER_LOGGING_FACILITY_CUSTOM__
-
-#import __GCDWEBSERVER_LOGGING_HEADER__
-
-/**
- *  Automatically detect if XLFacility is available and if so use it as a
- *  logging facility.
- */
-
-#elif defined(__has_include) && __has_include("XLFacilityMacros.h")
-
-#define __GCDWEBSERVER_LOGGING_FACILITY_XLFACILITY__
-
-#undef XLOG_TAG
-#define XLOG_TAG @"gcdwebserver.internal"
-
-#import "XLFacilityMacros.h"
-
-#define GWS_LOG_DEBUG(...) XLOG_DEBUG(__VA_ARGS__)
-#define GWS_LOG_VERBOSE(...) XLOG_VERBOSE(__VA_ARGS__)
-#define GWS_LOG_INFO(...) XLOG_INFO(__VA_ARGS__)
-#define GWS_LOG_WARNING(...) XLOG_WARNING(__VA_ARGS__)
-#define GWS_LOG_ERROR(...) XLOG_ERROR(__VA_ARGS__)
-
-#define GWS_DCHECK(__CONDITION__) XLOG_DEBUG_CHECK(__CONDITION__)
-#define GWS_DNOT_REACHED() XLOG_DEBUG_UNREACHABLE()
-
-/**
- *  If all of the above fail, then use GCDWebServer built-in
- *  logging facility.
- */
-
-#else
-
-#define __GCDWEBSERVER_LOGGING_FACILITY_BUILTIN__
-
-typedef NS_ENUM(int, GCDWebServerLoggingLevel) {
-  kGCDWebServerLoggingLevel_Debug = 0,
-  kGCDWebServerLoggingLevel_Verbose,
-  kGCDWebServerLoggingLevel_Info,
-  kGCDWebServerLoggingLevel_Warning,
-  kGCDWebServerLoggingLevel_Error
-};
-
-extern GCDWebServerLoggingLevel GCDWebServerLogLevel;
-extern void GCDWebServerLogMessage(GCDWebServerLoggingLevel level, NSString* _Nonnull format, ...) NS_FORMAT_FUNCTION(2, 3);
-
-#if DEBUG
-#define GWS_LOG_DEBUG(...)                                                                                                             \
-  do {                                                                                                                                 \
-    if (GCDWebServerLogLevel <= kGCDWebServerLoggingLevel_Debug) GCDWebServerLogMessage(kGCDWebServerLoggingLevel_Debug, __VA_ARGS__); \
-  } while (0)
-#else
-#define GWS_LOG_DEBUG(...)
-#endif
-#define GWS_LOG_VERBOSE(...)                                                                                                               \
-  do {                                                                                                                                     \
-    if (GCDWebServerLogLevel <= kGCDWebServerLoggingLevel_Verbose) GCDWebServerLogMessage(kGCDWebServerLoggingLevel_Verbose, __VA_ARGS__); \
-  } while (0)
-#define GWS_LOG_INFO(...)                                                                                                            \
-  do {                                                                                                                               \
-    if (GCDWebServerLogLevel <= kGCDWebServerLoggingLevel_Info) GCDWebServerLogMessage(kGCDWebServerLoggingLevel_Info, __VA_ARGS__); \
-  } while (0)
-#define GWS_LOG_WARNING(...)                                                                                                               \
-  do {                                                                                                                                     \
-    if (GCDWebServerLogLevel <= kGCDWebServerLoggingLevel_Warning) GCDWebServerLogMessage(kGCDWebServerLoggingLevel_Warning, __VA_ARGS__); \
-  } while (0)
-#define GWS_LOG_ERROR(...)                                                                                                             \
-  do {                                                                                                                                 \
-    if (GCDWebServerLogLevel <= kGCDWebServerLoggingLevel_Error) GCDWebServerLogMessage(kGCDWebServerLoggingLevel_Error, __VA_ARGS__); \
-  } while (0)
-
-#endif
-
-/**
- *  Consistency check macros used when building Debug only.
- */
-
-#if !defined(GWS_DCHECK) || !defined(GWS_DNOT_REACHED)
-
-#if DEBUG
-
-#define GWS_DCHECK(__CONDITION__) \
-  do {                            \
-    if (!(__CONDITION__)) {       \
-      abort();                    \
-    }                             \
-  } while (0)
-#define GWS_DNOT_REACHED() abort()
-
-#else
-
-#define GWS_DCHECK(__CONDITION__)
-#define GWS_DNOT_REACHED()
-
-#endif
-
-#endif
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  GCDWebServer internal constants and APIs.
- */
-
-#define kGCDWebServerDefaultMimeType @"application/octet-stream"
-#define kGCDWebServerErrorDomain @"GCDWebServerErrorDomain"
-
-static inline BOOL GCDWebServerIsValidByteRange(NSRange range) {
-  return ((range.location != NSUIntegerMax) || (range.length > 0));
-}
-
-static inline NSError* GCDWebServerMakePosixError(int code) {
-  return [NSError errorWithDomain:NSPOSIXErrorDomain code:code userInfo:@{NSLocalizedDescriptionKey : (NSString*)[NSString stringWithUTF8String:strerror(code)]}];
-}
-
-extern void GCDWebServerInitializeFunctions(void);
-extern NSString* _Nullable GCDWebServerNormalizeHeaderValue(NSString* _Nullable value);
-extern NSString* _Nullable GCDWebServerTruncateHeaderValue(NSString* _Nullable value);
-extern NSString* _Nullable GCDWebServerExtractHeaderValueParameter(NSString* _Nullable value, NSString* attribute);
-extern NSStringEncoding GCDWebServerStringEncodingFromCharset(NSString* charset);
-extern BOOL GCDWebServerIsTextContentType(NSString* type);
-extern NSString* GCDWebServerDescribeData(NSData* data, NSString* contentType);
-extern NSString* GCDWebServerComputeMD5Digest(NSString* format, ...) NS_FORMAT_FUNCTION(1, 2);
-extern NSString* GCDWebServerStringFromSockAddr(const struct sockaddr* addr, BOOL includeService);
-
-@interface GCDWebServerConnection ()
-- (instancetype)initWithServer:(GCDWebServer*)server localAddress:(NSData*)localAddress remoteAddress:(NSData*)remoteAddress socket:(CFSocketNativeHandle)socket;
-@end
-
-@interface GCDWebServer ()
-@property(nonatomic, readonly) NSMutableArray<GCDWebServerHandler*>* handlers;
-@property(nonatomic, readonly, nullable) NSString* serverName;
-@property(nonatomic, readonly, nullable) NSString* authenticationRealm;
-@property(nonatomic, readonly, nullable) NSMutableDictionary<NSString*, NSString*>* authenticationBasicAccounts;
-@property(nonatomic, readonly, nullable) NSMutableDictionary<NSString*, NSString*>* authenticationDigestAccounts;
-@property(nonatomic, readonly) BOOL shouldAutomaticallyMapHEADToGET;
-@property(nonatomic, readonly) dispatch_queue_priority_t dispatchQueuePriority;
-- (void)willStartConnection:(GCDWebServerConnection*)connection;
-- (void)didEndConnection:(GCDWebServerConnection*)connection;
-@end
-
-@interface GCDWebServerHandler : NSObject
-@property(nonatomic, readonly) GCDWebServerMatchBlock matchBlock;
-@property(nonatomic, readonly) GCDWebServerAsyncProcessBlock asyncProcessBlock;
-@end
-
-@interface GCDWebServerRequest ()
-@property(nonatomic, readonly) BOOL usesChunkedTransferEncoding;
-@property(nonatomic) NSData* localAddressData;
-@property(nonatomic) NSData* remoteAddressData;
-- (void)prepareForWriting;
-- (BOOL)performOpen:(NSError**)error;
-- (BOOL)performWriteData:(NSData*)data error:(NSError**)error;
-- (BOOL)performClose:(NSError**)error;
-- (void)setAttribute:(nullable id)attribute forKey:(NSString*)key;
-@end
-
-@interface GCDWebServerResponse ()
-@property(nonatomic, readonly) NSDictionary<NSString*, NSString*>* additionalHeaders;
-@property(nonatomic, readonly) BOOL usesChunkedTransferEncoding;
-- (void)prepareForReading;
-- (BOOL)performOpen:(NSError**)error;
-- (void)performReadDataWithCompletion:(GCDWebServerBodyReaderCompletionBlock)block;
-- (void)performClose;
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerRequest.h b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerRequest.h
deleted file mode 100644
index 79b446a5d..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerRequest.h
+++ /dev/null
@@ -1,210 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import <Foundation/Foundation.h>
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  Attribute key to retrieve an NSArray containing NSStrings from a GCDWebServerRequest
- *  with the contents of any regular expression captures done on the request path.
- *
- *  @warning This attribute will only be set on the request if adding a handler using 
- *  -addHandlerForMethod:pathRegex:requestClass:processBlock:.
- */
-extern NSString* const GCDWebServerRequestAttribute_RegexCaptures;
-
-/**
- *  This protocol is used by the GCDWebServerConnection to communicate with
- *  the GCDWebServerRequest and write the received HTTP body data.
- *
- *  Note that multiple GCDWebServerBodyWriter objects can be chained together
- *  internally e.g. to automatically decode gzip encoded content before
- *  passing it on to the GCDWebServerRequest.
- *
- *  @warning These methods can be called on any GCD thread.
- */
-@protocol GCDWebServerBodyWriter <NSObject>
-
-/**
- *  This method is called before any body data is received.
- *
- *  It should return YES on success or NO on failure and set the "error" argument
- *  which is guaranteed to be non-NULL.
- */
-- (BOOL)open:(NSError**)error;
-
-/**
- *  This method is called whenever body data has been received.
- *
- *  It should return YES on success or NO on failure and set the "error" argument
- *  which is guaranteed to be non-NULL.
- */
-- (BOOL)writeData:(NSData*)data error:(NSError**)error;
-
-/**
- *  This method is called after all body data has been received.
- *
- *  It should return YES on success or NO on failure and set the "error" argument
- *  which is guaranteed to be non-NULL.
- */
-- (BOOL)close:(NSError**)error;
-
-@end
-
-/**
- *  The GCDWebServerRequest class is instantiated by the GCDWebServerConnection
- *  after the HTTP headers have been received. Each instance wraps a single HTTP
- *  request. If a body is present, the methods from the GCDWebServerBodyWriter
- *  protocol will be called by the GCDWebServerConnection to receive it.
- *
- *  The default implementation of the GCDWebServerBodyWriter protocol on the class
- *  simply ignores the body data.
- *
- *  @warning GCDWebServerRequest instances can be created and used on any GCD thread.
- */
-@interface GCDWebServerRequest : NSObject <GCDWebServerBodyWriter>
-
-/**
- *  Returns the HTTP method for the request.
- */
-@property(nonatomic, readonly) NSString* method;
-
-/**
- *  Returns the URL for the request.
- */
-@property(nonatomic, readonly) NSURL* URL;
-
-/**
- *  Returns the HTTP headers for the request.
- */
-@property(nonatomic, readonly) NSDictionary<NSString*, NSString*>* headers;
-
-/**
- *  Returns the path component of the URL for the request.
- */
-@property(nonatomic, readonly) NSString* path;
-
-/**
- *  Returns the parsed and unescaped query component of the URL for the request.
- *
- *  @warning This property will be nil if there is no query in the URL.
- */
-@property(nonatomic, readonly, nullable) NSDictionary<NSString*, NSString*>* query;
-
-/**
- *  Returns the content type for the body of the request parsed from the
- *  "Content-Type" header.
- *
- *  This property will be nil if the request has no body or set to
- *  "application/octet-stream" if a body is present but there was no
- *  "Content-Type" header.
- */
-@property(nonatomic, readonly, nullable) NSString* contentType;
-
-/**
- *  Returns the content length for the body of the request parsed from the
- *  "Content-Length" header.
- *
- *  This property will be set to "NSUIntegerMax" if the request has no body or
- *  if there is a body but no "Content-Length" header, typically because
- *  chunked transfer encoding is used.
- */
-@property(nonatomic, readonly) NSUInteger contentLength;
-
-/**
- *  Returns the parsed "If-Modified-Since" header or nil if absent or malformed.
- */
-@property(nonatomic, readonly, nullable) NSDate* ifModifiedSince;
-
-/**
- *  Returns the parsed "If-None-Match" header or nil if absent or malformed.
- */
-@property(nonatomic, readonly, nullable) NSString* ifNoneMatch;
-
-/**
- *  Returns the parsed "Range" header or (NSUIntegerMax, 0) if absent or malformed.
- *  The range will be set to (offset, length) if expressed from the beginning
- *  of the entity body, or (NSUIntegerMax, length) if expressed from its end.
- */
-@property(nonatomic, readonly) NSRange byteRange;
-
-/**
- *  Returns YES if the client supports gzip content encoding according to the
- *  "Accept-Encoding" header.
- */
-@property(nonatomic, readonly) BOOL acceptsGzipContentEncoding;
-
-/**
- *  Returns the address of the local peer (i.e. server) for the request
- *  as a raw "struct sockaddr".
- */
-@property(nonatomic, readonly) NSData* localAddressData;
-
-/**
- *  Returns the address of the local peer (i.e. server) for the request
- *  as a string.
- */
-@property(nonatomic, readonly) NSString* localAddressString;
-
-/**
- *  Returns the address of the remote peer (i.e. client) for the request
- *  as a raw "struct sockaddr".
- */
-@property(nonatomic, readonly) NSData* remoteAddressData;
-
-/**
- *  Returns the address of the remote peer (i.e. client) for the request
- *  as a string.
- */
-@property(nonatomic, readonly) NSString* remoteAddressString;
-
-/**
- *  This method is the designated initializer for the class.
- */
-- (instancetype)initWithMethod:(NSString*)method url:(NSURL*)url headers:(NSDictionary<NSString*, NSString*>*)headers path:(NSString*)path query:(nullable NSDictionary<NSString*, NSString*>*)query;
-
-/**
- *  Convenience method that checks if the contentType property is defined.
- */
-- (BOOL)hasBody;
-
-/**
- *  Convenience method that checks if the byteRange property is defined.
- */
-- (BOOL)hasByteRange;
-
-/**
- *  Retrieves an attribute associated with this request using the given key.
- *
- *  @return The attribute value for the key.
- */
-- (nullable id)attributeForKey:(NSString*)key;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerRequest.m b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerRequest.m
deleted file mode 100644
index 5648eff7a..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerRequest.m
+++ /dev/null
@@ -1,303 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import <zlib.h>
-
-#import "GCDWebServerPrivate.h"
-
-NSString* const GCDWebServerRequestAttribute_RegexCaptures = @"GCDWebServerRequestAttribute_RegexCaptures";
-
-#define kZlibErrorDomain @"ZlibErrorDomain"
-#define kGZipInitialBufferSize (256 * 1024)
-
-@interface GCDWebServerBodyDecoder : NSObject <GCDWebServerBodyWriter>
-@end
-
-@interface GCDWebServerGZipDecoder : GCDWebServerBodyDecoder
-@end
-
-@implementation GCDWebServerBodyDecoder {
-  GCDWebServerRequest* __unsafe_unretained _request;
-  id<GCDWebServerBodyWriter> __unsafe_unretained _writer;
-}
-
-- (instancetype)initWithRequest:(GCDWebServerRequest* _Nonnull)request writer:(id<GCDWebServerBodyWriter> _Nonnull)writer {
-  if ((self = [super init])) {
-    _request = request;
-    _writer = writer;
-  }
-  return self;
-}
-
-- (BOOL)open:(NSError**)error {
-  return [_writer open:error];
-}
-
-- (BOOL)writeData:(NSData*)data error:(NSError**)error {
-  return [_writer writeData:data error:error];
-}
-
-- (BOOL)close:(NSError**)error {
-  return [_writer close:error];
-}
-
-@end
-
-@implementation GCDWebServerGZipDecoder {
-  z_stream _stream;
-  BOOL _finished;
-}
-
-- (BOOL)open:(NSError**)error {
-  int result = inflateInit2(&_stream, 15 + 16);
-  if (result != Z_OK) {
-    if (error) {
-      *error = [NSError errorWithDomain:kZlibErrorDomain code:result userInfo:nil];
-    }
-    return NO;
-  }
-  if (![super open:error]) {
-    inflateEnd(&_stream);
-    return NO;
-  }
-  return YES;
-}
-
-- (BOOL)writeData:(NSData*)data error:(NSError**)error {
-  GWS_DCHECK(!_finished);
-  _stream.next_in = (Bytef*)data.bytes;
-  _stream.avail_in = (uInt)data.length;
-  NSMutableData* decodedData = [[NSMutableData alloc] initWithLength:kGZipInitialBufferSize];
-  if (decodedData == nil) {
-    GWS_DNOT_REACHED();
-    return NO;
-  }
-  NSUInteger length = 0;
-  while (1) {
-    NSUInteger maxLength = decodedData.length - length;
-    _stream.next_out = (Bytef*)((char*)decodedData.mutableBytes + length);
-    _stream.avail_out = (uInt)maxLength;
-    int result = inflate(&_stream, Z_NO_FLUSH);
-    if ((result != Z_OK) && (result != Z_STREAM_END)) {
-      if (error) {
-        *error = [NSError errorWithDomain:kZlibErrorDomain code:result userInfo:nil];
-      }
-      return NO;
-    }
-    length += maxLength - _stream.avail_out;
-    if (_stream.avail_out > 0) {
-      if (result == Z_STREAM_END) {
-        _finished = YES;
-      }
-      break;
-    }
-    decodedData.length = 2 * decodedData.length;  // zlib has used all the output buffer so resize it and try again in case more data is available
-  }
-  decodedData.length = length;
-  BOOL success = length ? [super writeData:decodedData error:error] : YES;  // No need to call writer if we have no data yet
-  return success;
-}
-
-- (BOOL)close:(NSError**)error {
-  GWS_DCHECK(_finished);
-  inflateEnd(&_stream);
-  return [super close:error];
-}
-
-@end
-
-@implementation GCDWebServerRequest {
-  BOOL _opened;
-  NSMutableArray<GCDWebServerBodyDecoder*>* _decoders;
-  id<GCDWebServerBodyWriter> __unsafe_unretained _writer;
-  NSMutableDictionary<NSString*, id>* _attributes;
-}
-
-- (instancetype)initWithMethod:(NSString*)method url:(NSURL*)url headers:(NSDictionary<NSString*, NSString*>*)headers path:(NSString*)path query:(NSDictionary<NSString*, NSString*>*)query {
-  if ((self = [super init])) {
-    _method = [method copy];
-    _URL = url;
-    _headers = headers;
-    _path = [path copy];
-    _query = query;
-
-    _contentType = GCDWebServerNormalizeHeaderValue([_headers objectForKey:@"Content-Type"]);
-    _usesChunkedTransferEncoding = [GCDWebServerNormalizeHeaderValue([_headers objectForKey:@"Transfer-Encoding"]) isEqualToString:@"chunked"];
-    NSString* lengthHeader = [_headers objectForKey:@"Content-Length"];
-    if (lengthHeader) {
-      NSInteger length = [lengthHeader integerValue];
-      if (_usesChunkedTransferEncoding || (length < 0)) {
-        GWS_LOG_WARNING(@"Invalid 'Content-Length' header '%@' for '%@' request on \"%@\"", lengthHeader, _method, _URL);
-        GWS_DNOT_REACHED();
-        return nil;
-      }
-      _contentLength = length;
-      if (_contentType == nil) {
-        _contentType = kGCDWebServerDefaultMimeType;
-      }
-    } else if (_usesChunkedTransferEncoding) {
-      if (_contentType == nil) {
-        _contentType = kGCDWebServerDefaultMimeType;
-      }
-      _contentLength = NSUIntegerMax;
-    } else {
-      if (_contentType) {
-        GWS_LOG_WARNING(@"Ignoring 'Content-Type' header for '%@' request on \"%@\"", _method, _URL);
-        _contentType = nil;  // Content-Type without Content-Length or chunked-encoding doesn't make sense
-      }
-      _contentLength = NSUIntegerMax;
-    }
-
-    NSString* modifiedHeader = [_headers objectForKey:@"If-Modified-Since"];
-    if (modifiedHeader) {
-      _ifModifiedSince = [GCDWebServerParseRFC822(modifiedHeader) copy];
-    }
-    _ifNoneMatch = [_headers objectForKey:@"If-None-Match"];
-
-    _byteRange = NSMakeRange(NSUIntegerMax, 0);
-    NSString* rangeHeader = GCDWebServerNormalizeHeaderValue([_headers objectForKey:@"Range"]);
-    if (rangeHeader) {
-      if ([rangeHeader hasPrefix:@"bytes="]) {
-        NSArray* components = [[rangeHeader substringFromIndex:6] componentsSeparatedByString:@","];
-        if (components.count == 1) {
-          components = [(NSString*)[components firstObject] componentsSeparatedByString:@"-"];
-          if (components.count == 2) {
-            NSString* startString = [components objectAtIndex:0];
-            NSInteger startValue = [startString integerValue];
-            NSString* endString = [components objectAtIndex:1];
-            NSInteger endValue = [endString integerValue];
-            if (startString.length && (startValue >= 0) && endString.length && (endValue >= startValue)) {  // The second 500 bytes: "500-999"
-              _byteRange.location = startValue;
-              _byteRange.length = endValue - startValue + 1;
-            } else if (startString.length && (startValue >= 0)) {  // The bytes after 9500 bytes: "9500-"
-              _byteRange.location = startValue;
-              _byteRange.length = NSUIntegerMax;
-            } else if (endString.length && (endValue > 0)) {  // The final 500 bytes: "-500"
-              _byteRange.location = NSUIntegerMax;
-              _byteRange.length = endValue;
-            }
-          }
-        }
-      }
-      if ((_byteRange.location == NSUIntegerMax) && (_byteRange.length == 0)) {  // Ignore "Range" header if syntactically invalid
-        GWS_LOG_WARNING(@"Failed to parse 'Range' header \"%@\" for url: %@", rangeHeader, url);
-      }
-    }
-
-    if ([[_headers objectForKey:@"Accept-Encoding"] rangeOfString:@"gzip"].location != NSNotFound) {
-      _acceptsGzipContentEncoding = YES;
-    }
-
-    _decoders = [[NSMutableArray alloc] init];
-    _attributes = [[NSMutableDictionary alloc] init];
-  }
-  return self;
-}
-
-- (BOOL)hasBody {
-  return _contentType ? YES : NO;
-}
-
-- (BOOL)hasByteRange {
-  return GCDWebServerIsValidByteRange(_byteRange);
-}
-
-- (id)attributeForKey:(NSString*)key {
-  return [_attributes objectForKey:key];
-}
-
-- (BOOL)open:(NSError**)error {
-  return YES;
-}
-
-- (BOOL)writeData:(NSData*)data error:(NSError**)error {
-  return YES;
-}
-
-- (BOOL)close:(NSError**)error {
-  return YES;
-}
-
-- (void)prepareForWriting {
-  _writer = self;
-  if ([GCDWebServerNormalizeHeaderValue([self.headers objectForKey:@"Content-Encoding"]) isEqualToString:@"gzip"]) {
-    GCDWebServerGZipDecoder* decoder = [[GCDWebServerGZipDecoder alloc] initWithRequest:self writer:_writer];
-    [_decoders addObject:decoder];
-    _writer = decoder;
-  }
-}
-
-- (BOOL)performOpen:(NSError**)error {
-  GWS_DCHECK(_contentType);
-  GWS_DCHECK(_writer);
-  if (_opened) {
-    GWS_DNOT_REACHED();
-    return NO;
-  }
-  _opened = YES;
-  return [_writer open:error];
-}
-
-- (BOOL)performWriteData:(NSData*)data error:(NSError**)error {
-  GWS_DCHECK(_opened);
-  return [_writer writeData:data error:error];
-}
-
-- (BOOL)performClose:(NSError**)error {
-  GWS_DCHECK(_opened);
-  return [_writer close:error];
-}
-
-- (void)setAttribute:(id)attribute forKey:(NSString*)key {
-  [_attributes setValue:attribute forKey:key];
-}
-
-- (NSString*)localAddressString {
-  return GCDWebServerStringFromSockAddr(_localAddressData.bytes, YES);
-}
-
-- (NSString*)remoteAddressString {
-  return GCDWebServerStringFromSockAddr(_remoteAddressData.bytes, YES);
-}
-
-- (NSString*)description {
-  NSMutableString* description = [NSMutableString stringWithFormat:@"%@ %@", _method, _path];
-  for (NSString* argument in [[_query allKeys] sortedArrayUsingSelector:@selector(compare:)]) {
-    [description appendFormat:@"\n  %@ = %@", argument, [_query objectForKey:argument]];
-  }
-  [description appendString:@"\n"];
-  for (NSString* header in [[_headers allKeys] sortedArrayUsingSelector:@selector(compare:)]) {
-    [description appendFormat:@"\n%@: %@", header, [_headers objectForKey:header]];
-  }
-  return description;
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerResponse.h b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerResponse.h
deleted file mode 100644
index 2e1365bfb..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerResponse.h
+++ /dev/null
@@ -1,212 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import <Foundation/Foundation.h>
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerBodyReaderCompletionBlock is passed by GCDWebServer to the
- *  GCDWebServerBodyReader object when reading data from it asynchronously.
- */
-typedef void (^GCDWebServerBodyReaderCompletionBlock)(NSData* _Nullable data, NSError* _Nullable error);
-
-/**
- *  This protocol is used by the GCDWebServerConnection to communicate with
- *  the GCDWebServerResponse and read the HTTP body data to send.
- *
- *  Note that multiple GCDWebServerBodyReader objects can be chained together
- *  internally e.g. to automatically apply gzip encoding to the content before
- *  passing it on to the GCDWebServerResponse.
- *
- *  @warning These methods can be called on any GCD thread.
- */
-@protocol GCDWebServerBodyReader <NSObject>
-
-@required
-
-/**
- *  This method is called before any body data is sent.
- *
- *  It should return YES on success or NO on failure and set the "error" argument
- *  which is guaranteed to be non-NULL.
- */
-- (BOOL)open:(NSError**)error;
-
-/**
- *  This method is called whenever body data is sent.
- *
- *  It should return a non-empty NSData if there is body data available,
- *  or an empty NSData there is no more body data, or nil on error and set
- *  the "error" argument which is guaranteed to be non-NULL.
- */
-- (nullable NSData*)readData:(NSError**)error;
-
-/**
- *  This method is called after all body data has been sent.
- */
-- (void)close;
-
-@optional
-
-/**
- *  If this method is implemented, it will be preferred over -readData:.
- *
- *  It must call the passed block when data is available, passing a non-empty
- *  NSData if there is body data available, or an empty NSData there is no more
- *  body data, or nil on error and pass an NSError along.
- */
-- (void)asyncReadDataWithCompletion:(GCDWebServerBodyReaderCompletionBlock)block;
-
-@end
-
-/**
- *  The GCDWebServerResponse class is used to wrap a single HTTP response.
- *  It is instantiated by the handler of the GCDWebServer that handled the request.
- *  If a body is present, the methods from the GCDWebServerBodyReader protocol
- *  will be called by the GCDWebServerConnection to send it.
- *
- *  The default implementation of the GCDWebServerBodyReader protocol
- *  on the class simply returns an empty body.
- *
- *  @warning GCDWebServerResponse instances can be created and used on any GCD thread.
- */
-@interface GCDWebServerResponse : NSObject <GCDWebServerBodyReader>
-
-/**
- *  Sets the content type for the body of the response.
- *
- *  The default value is nil i.e. the response has no body.
- *
- *  @warning This property must be set if a body is present.
- */
-@property(nonatomic, copy, nullable) NSString* contentType;
-
-/**
- *  Sets the content length for the body of the response. If a body is present
- *  but this property is set to "NSUIntegerMax", this means the length of the body
- *  cannot be known ahead of time. Chunked transfer encoding will be
- *  automatically enabled by the GCDWebServerConnection to comply with HTTP/1.1
- *  specifications.
- *
- *  The default value is "NSUIntegerMax" i.e. the response has no body or its length
- *  is undefined.
- */
-@property(nonatomic) NSUInteger contentLength;
-
-/**
- *  Sets the HTTP status code for the response.
- *
- *  The default value is 200 i.e. "OK".
- */
-@property(nonatomic) NSInteger statusCode;
-
-/**
- *  Sets the caching hint for the response using the "Cache-Control" header.
- *  This value is expressed in seconds.
- *
- *  The default value is 0 i.e. "no-cache".
- */
-@property(nonatomic) NSUInteger cacheControlMaxAge;
-
-/**
- *  Sets the last modified date for the response using the "Last-Modified" header.
- *
- *  The default value is nil.
- */
-@property(nonatomic, nullable) NSDate* lastModifiedDate;
-
-/**
- *  Sets the ETag for the response using the "ETag" header.
- *
- *  The default value is nil.
- */
-@property(nonatomic, copy, nullable) NSString* eTag;
-
-/**
- *  Enables gzip encoding for the response body.
- *
- *  The default value is NO.
- *
- *  @warning Enabling gzip encoding will remove any "Content-Length" header
- *  since the length of the body is not known anymore. The client will still
- *  be able to determine the body length when connection is closed per
- *  HTTP/1.1 specifications.
- */
-@property(nonatomic, getter=isGZipContentEncodingEnabled) BOOL gzipContentEncodingEnabled;
-
-/**
- *  Creates an empty response.
- */
-+ (instancetype)response;
-
-/**
- *  This method is the designated initializer for the class.
- */
-- (instancetype)init;
-
-/**
- *  Sets an additional HTTP header on the response.
- *  Pass a nil value to remove an additional header.
- *
- *  @warning Do not attempt to override the primary headers used
- *  by GCDWebServerResponse like "Content-Type", "ETag", etc...
- */
-- (void)setValue:(nullable NSString*)value forAdditionalHeader:(NSString*)header;
-
-/**
- *  Convenience method that checks if the contentType property is defined.
- */
-- (BOOL)hasBody;
-
-@end
-
-@interface GCDWebServerResponse (Extensions)
-
-/**
- *  Creates a empty response with a specific HTTP status code.
- */
-+ (instancetype)responseWithStatusCode:(NSInteger)statusCode;
-
-/**
- *  Creates an HTTP redirect response to a new URL.
- */
-+ (instancetype)responseWithRedirect:(NSURL*)location permanent:(BOOL)permanent;
-
-/**
- *  Initializes an empty response with a specific HTTP status code.
- */
-- (instancetype)initWithStatusCode:(NSInteger)statusCode;
-
-/**
- *  Initializes an HTTP redirect response to a new URL.
- */
-- (instancetype)initWithRedirect:(NSURL*)location permanent:(BOOL)permanent;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerResponse.m b/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerResponse.m
deleted file mode 100644
index 46042b21b..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Core/GCDWebServerResponse.m
+++ /dev/null
@@ -1,284 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import <zlib.h>
-
-#import "GCDWebServerPrivate.h"
-
-#define kZlibErrorDomain @"ZlibErrorDomain"
-#define kGZipInitialBufferSize (256 * 1024)
-
-@interface GCDWebServerBodyEncoder : NSObject <GCDWebServerBodyReader>
-@end
-
-@interface GCDWebServerGZipEncoder : GCDWebServerBodyEncoder
-@end
-
-@implementation GCDWebServerBodyEncoder {
-  GCDWebServerResponse* __unsafe_unretained _response;
-  id<GCDWebServerBodyReader> __unsafe_unretained _reader;
-}
-
-- (instancetype)initWithResponse:(GCDWebServerResponse* _Nonnull)response reader:(id<GCDWebServerBodyReader> _Nonnull)reader {
-  if ((self = [super init])) {
-    _response = response;
-    _reader = reader;
-  }
-  return self;
-}
-
-- (BOOL)open:(NSError**)error {
-  return [_reader open:error];
-}
-
-- (NSData*)readData:(NSError**)error {
-  return [_reader readData:error];
-}
-
-- (void)close {
-  [_reader close];
-}
-
-@end
-
-@implementation GCDWebServerGZipEncoder {
-  z_stream _stream;
-  BOOL _finished;
-}
-
-- (instancetype)initWithResponse:(GCDWebServerResponse* _Nonnull)response reader:(id<GCDWebServerBodyReader> _Nonnull)reader {
-  if ((self = [super initWithResponse:response reader:reader])) {
-    response.contentLength = NSUIntegerMax;  // Make sure "Content-Length" header is not set since we don't know it
-    [response setValue:@"gzip" forAdditionalHeader:@"Content-Encoding"];
-  }
-  return self;
-}
-
-- (BOOL)open:(NSError**)error {
-  int result = deflateInit2(&_stream, Z_DEFAULT_COMPRESSION, Z_DEFLATED, 15 + 16, 8, Z_DEFAULT_STRATEGY);
-  if (result != Z_OK) {
-    if (error) {
-      *error = [NSError errorWithDomain:kZlibErrorDomain code:result userInfo:nil];
-    }
-    return NO;
-  }
-  if (![super open:error]) {
-    deflateEnd(&_stream);
-    return NO;
-  }
-  return YES;
-}
-
-- (NSData*)readData:(NSError**)error {
-  NSMutableData* encodedData;
-  if (_finished) {
-    encodedData = [[NSMutableData alloc] init];
-  } else {
-    encodedData = [[NSMutableData alloc] initWithLength:kGZipInitialBufferSize];
-    if (encodedData == nil) {
-      GWS_DNOT_REACHED();
-      return nil;
-    }
-    NSUInteger length = 0;
-    do {
-      NSData* data = [super readData:error];
-      if (data == nil) {
-        return nil;
-      }
-      _stream.next_in = (Bytef*)data.bytes;
-      _stream.avail_in = (uInt)data.length;
-      while (1) {
-        NSUInteger maxLength = encodedData.length - length;
-        _stream.next_out = (Bytef*)((char*)encodedData.mutableBytes + length);
-        _stream.avail_out = (uInt)maxLength;
-        int result = deflate(&_stream, data.length ? Z_NO_FLUSH : Z_FINISH);
-        if (result == Z_STREAM_END) {
-          _finished = YES;
-        } else if (result != Z_OK) {
-          if (error) {
-            *error = [NSError errorWithDomain:kZlibErrorDomain code:result userInfo:nil];
-          }
-          return nil;
-        }
-        length += maxLength - _stream.avail_out;
-        if (_stream.avail_out > 0) {
-          break;
-        }
-        encodedData.length = 2 * encodedData.length;  // zlib has used all the output buffer so resize it and try again in case more data is available
-      }
-      GWS_DCHECK(_stream.avail_in == 0);
-    } while (length == 0);  // Make sure we don't return an empty NSData if not in finished state
-    encodedData.length = length;
-  }
-  return encodedData;
-}
-
-- (void)close {
-  deflateEnd(&_stream);
-  [super close];
-}
-
-@end
-
-@implementation GCDWebServerResponse {
-  BOOL _opened;
-  NSMutableArray<GCDWebServerBodyEncoder*>* _encoders;
-  id<GCDWebServerBodyReader> __unsafe_unretained _reader;
-}
-
-+ (instancetype)response {
-  return [(GCDWebServerResponse*)[[self class] alloc] init];
-}
-
-- (instancetype)init {
-  if ((self = [super init])) {
-    _contentType = nil;
-    _contentLength = NSUIntegerMax;
-    _statusCode = kGCDWebServerHTTPStatusCode_OK;
-    _cacheControlMaxAge = 0;
-    _additionalHeaders = [[NSMutableDictionary alloc] init];
-    _encoders = [[NSMutableArray alloc] init];
-  }
-  return self;
-}
-
-- (void)setValue:(NSString*)value forAdditionalHeader:(NSString*)header {
-  [_additionalHeaders setValue:value forKey:header];
-}
-
-- (BOOL)hasBody {
-  return _contentType ? YES : NO;
-}
-
-- (BOOL)usesChunkedTransferEncoding {
-  return (_contentType != nil) && (_contentLength == NSUIntegerMax);
-}
-
-- (BOOL)open:(NSError**)error {
-  return YES;
-}
-
-- (NSData*)readData:(NSError**)error {
-  return [NSData data];
-}
-
-- (void)close {
-  ;
-}
-
-- (void)prepareForReading {
-  _reader = self;
-  if (_gzipContentEncodingEnabled) {
-    GCDWebServerGZipEncoder* encoder = [[GCDWebServerGZipEncoder alloc] initWithResponse:self reader:_reader];
-    [_encoders addObject:encoder];
-    _reader = encoder;
-  }
-}
-
-- (BOOL)performOpen:(NSError**)error {
-  GWS_DCHECK(_contentType);
-  GWS_DCHECK(_reader);
-  if (_opened) {
-    GWS_DNOT_REACHED();
-    return NO;
-  }
-  _opened = YES;
-  return [_reader open:error];
-}
-
-- (void)performReadDataWithCompletion:(GCDWebServerBodyReaderCompletionBlock)block {
-  GWS_DCHECK(_opened);
-  if ([_reader respondsToSelector:@selector(asyncReadDataWithCompletion:)]) {
-    [_reader asyncReadDataWithCompletion:[block copy]];
-  } else {
-    NSError* error = nil;
-    NSData* data = [_reader readData:&error];
-    block(data, error);
-  }
-}
-
-- (void)performClose {
-  GWS_DCHECK(_opened);
-  [_reader close];
-}
-
-- (NSString*)description {
-  NSMutableString* description = [NSMutableString stringWithFormat:@"Status Code = %i", (int)_statusCode];
-  if (_contentType) {
-    [description appendFormat:@"\nContent Type = %@", _contentType];
-  }
-  if (_contentLength != NSUIntegerMax) {
-    [description appendFormat:@"\nContent Length = %lu", (unsigned long)_contentLength];
-  }
-  [description appendFormat:@"\nCache Control Max Age = %lu", (unsigned long)_cacheControlMaxAge];
-  if (_lastModifiedDate) {
-    [description appendFormat:@"\nLast Modified Date = %@", _lastModifiedDate];
-  }
-  if (_eTag) {
-    [description appendFormat:@"\nETag = %@", _eTag];
-  }
-  if (_additionalHeaders.count) {
-    [description appendString:@"\n"];
-    for (NSString* header in [[_additionalHeaders allKeys] sortedArrayUsingSelector:@selector(compare:)]) {
-      [description appendFormat:@"\n%@: %@", header, [_additionalHeaders objectForKey:header]];
-    }
-  }
-  return description;
-}
-
-@end
-
-@implementation GCDWebServerResponse (Extensions)
-
-+ (instancetype)responseWithStatusCode:(NSInteger)statusCode {
-  return [(GCDWebServerResponse*)[self alloc] initWithStatusCode:statusCode];
-}
-
-+ (instancetype)responseWithRedirect:(NSURL*)location permanent:(BOOL)permanent {
-  return [(GCDWebServerResponse*)[self alloc] initWithRedirect:location permanent:permanent];
-}
-
-- (instancetype)initWithStatusCode:(NSInteger)statusCode {
-  if ((self = [self init])) {
-    self.statusCode = statusCode;
-  }
-  return self;
-}
-
-- (instancetype)initWithRedirect:(NSURL*)location permanent:(BOOL)permanent {
-  if ((self = [self init])) {
-    self.statusCode = permanent ? kGCDWebServerHTTPStatusCode_MovedPermanently : kGCDWebServerHTTPStatusCode_TemporaryRedirect;
-    [self setValue:[location absoluteString] forAdditionalHeader:@"Location"];
-  }
-  return self;
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerDataRequest.h b/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerDataRequest.h
deleted file mode 100644
index b105ce766..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerDataRequest.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "GCDWebServerRequest.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerDataRequest subclass of GCDWebServerRequest stores the body
- *  of the HTTP request in memory.
- */
-@interface GCDWebServerDataRequest : GCDWebServerRequest
-
-/**
- *  Returns the data for the request body.
- */
-@property(nonatomic, readonly) NSData* data;
-
-@end
-
-@interface GCDWebServerDataRequest (Extensions)
-
-/**
- *  Returns the data for the request body interpreted as text. If the content
- *  type of the body is not a text one, or if an error occurs, nil is returned.
- *
- *  The text encoding used to interpret the data is extracted from the
- *  "Content-Type" header or defaults to UTF-8.
- */
-@property(nonatomic, readonly, nullable) NSString* text;
-
-/**
- *  Returns the data for the request body interpreted as a JSON object. If the
- *  content type of the body is not JSON, or if an error occurs, nil is returned.
- */
-@property(nonatomic, readonly, nullable) id jsonObject;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerDataRequest.m b/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerDataRequest.m
deleted file mode 100644
index fcb293211..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerDataRequest.m
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import "GCDWebServerPrivate.h"
-
-@interface GCDWebServerDataRequest ()
-@property(nonatomic) NSMutableData* data;
-@end
-
-@implementation GCDWebServerDataRequest {
-  NSString* _text;
-  id _jsonObject;
-}
-
-- (BOOL)open:(NSError**)error {
-  if (self.contentLength != NSUIntegerMax) {
-    _data = [[NSMutableData alloc] initWithCapacity:self.contentLength];
-  } else {
-    _data = [[NSMutableData alloc] init];
-  }
-  if (_data == nil) {
-    if (error) {
-      *error = [NSError errorWithDomain:kGCDWebServerErrorDomain code:-1 userInfo:@{NSLocalizedDescriptionKey : @"Failed allocating memory"}];
-    }
-    return NO;
-  }
-  return YES;
-}
-
-- (BOOL)writeData:(NSData*)data error:(NSError**)error {
-  [_data appendData:data];
-  return YES;
-}
-
-- (BOOL)close:(NSError**)error {
-  return YES;
-}
-
-- (NSString*)description {
-  NSMutableString* description = [NSMutableString stringWithString:[super description]];
-  if (_data) {
-    [description appendString:@"\n\n"];
-    [description appendString:GCDWebServerDescribeData(_data, (NSString*)self.contentType)];
-  }
-  return description;
-}
-
-@end
-
-@implementation GCDWebServerDataRequest (Extensions)
-
-- (NSString*)text {
-  if (_text == nil) {
-    if ([self.contentType hasPrefix:@"text/"]) {
-      NSString* charset = GCDWebServerExtractHeaderValueParameter(self.contentType, @"charset");
-      _text = [[NSString alloc] initWithData:self.data encoding:GCDWebServerStringEncodingFromCharset(charset)];
-    } else {
-      GWS_DNOT_REACHED();
-    }
-  }
-  return _text;
-}
-
-- (id)jsonObject {
-  if (_jsonObject == nil) {
-    NSString* mimeType = GCDWebServerTruncateHeaderValue(self.contentType);
-    if ([mimeType isEqualToString:@"application/json"] || [mimeType isEqualToString:@"text/json"] || [mimeType isEqualToString:@"text/javascript"]) {
-      _jsonObject = [NSJSONSerialization JSONObjectWithData:_data options:0 error:NULL];
-    } else {
-      GWS_DNOT_REACHED();
-    }
-  }
-  return _jsonObject;
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerFileRequest.h b/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerFileRequest.h
deleted file mode 100644
index 3c6a6d249..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerFileRequest.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "GCDWebServerRequest.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerFileRequest subclass of GCDWebServerRequest stores the body
- *  of the HTTP request to a file on disk.
- */
-@interface GCDWebServerFileRequest : GCDWebServerRequest
-
-/**
- *  Returns the path to the temporary file containing the request body.
- *
- *  @warning This temporary file will be automatically deleted when the
- *  GCDWebServerFileRequest is deallocated. If you want to preserve this file,
- *  you must move it to a different location beforehand.
- */
-@property(nonatomic, readonly) NSString* temporaryPath;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerFileRequest.m b/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerFileRequest.m
deleted file mode 100644
index 0845d5e96..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerFileRequest.m
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import "GCDWebServerPrivate.h"
-
-@implementation GCDWebServerFileRequest {
-  int _file;
-}
-
-- (instancetype)initWithMethod:(NSString*)method url:(NSURL*)url headers:(NSDictionary<NSString*, NSString*>*)headers path:(NSString*)path query:(NSDictionary<NSString*, NSString*>*)query {
-  if ((self = [super initWithMethod:method url:url headers:headers path:path query:query])) {
-    _temporaryPath = [NSTemporaryDirectory() stringByAppendingPathComponent:[[NSProcessInfo processInfo] globallyUniqueString]];
-  }
-  return self;
-}
-
-- (void)dealloc {
-  unlink([_temporaryPath fileSystemRepresentation]);
-}
-
-- (BOOL)open:(NSError**)error {
-  _file = open([_temporaryPath fileSystemRepresentation], O_CREAT | O_TRUNC | O_WRONLY, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-  if (_file <= 0) {
-    if (error) {
-      *error = GCDWebServerMakePosixError(errno);
-    }
-    return NO;
-  }
-  return YES;
-}
-
-- (BOOL)writeData:(NSData*)data error:(NSError**)error {
-  if (write(_file, data.bytes, data.length) != (ssize_t)data.length) {
-    if (error) {
-      *error = GCDWebServerMakePosixError(errno);
-    }
-    return NO;
-  }
-  return YES;
-}
-
-- (BOOL)close:(NSError**)error {
-  if (close(_file) < 0) {
-    if (error) {
-      *error = GCDWebServerMakePosixError(errno);
-    }
-    return NO;
-  }
-#ifdef __GCDWEBSERVER_ENABLE_TESTING__
-  NSString* creationDateHeader = [self.headers objectForKey:@"X-GCDWebServer-CreationDate"];
-  if (creationDateHeader) {
-    NSDate* date = GCDWebServerParseISO8601(creationDateHeader);
-    if (!date || ![[NSFileManager defaultManager] setAttributes:@{NSFileCreationDate : date} ofItemAtPath:_temporaryPath error:error]) {
-      return NO;
-    }
-  }
-  NSString* modifiedDateHeader = [self.headers objectForKey:@"X-GCDWebServer-ModifiedDate"];
-  if (modifiedDateHeader) {
-    NSDate* date = GCDWebServerParseRFC822(modifiedDateHeader);
-    if (!date || ![[NSFileManager defaultManager] setAttributes:@{NSFileModificationDate : date} ofItemAtPath:_temporaryPath error:error]) {
-      return NO;
-    }
-  }
-#endif
-  return YES;
-}
-
-- (NSString*)description {
-  NSMutableString* description = [NSMutableString stringWithString:[super description]];
-  [description appendFormat:@"\n\n{%@}", _temporaryPath];
-  return description;
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerMultiPartFormRequest.h b/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerMultiPartFormRequest.h
deleted file mode 100644
index cbe838eaa..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerMultiPartFormRequest.h
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "GCDWebServerRequest.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerMultiPart class is an abstract class that wraps the content
- *  of a part.
- */
-@interface GCDWebServerMultiPart : NSObject
-
-/**
- *  Returns the control name retrieved from the part headers.
- */
-@property(nonatomic, readonly) NSString* controlName;
-
-/**
- *  Returns the content type retrieved from the part headers or "text/plain"
- *  if not available (per HTTP specifications).
- */
-@property(nonatomic, readonly) NSString* contentType;
-
-/**
- *  Returns the MIME type component of the content type for the part.
- */
-@property(nonatomic, readonly) NSString* mimeType;
-
-@end
-
-/**
- *  The GCDWebServerMultiPartArgument subclass of GCDWebServerMultiPart wraps
- *  the content of a part as data in memory.
- */
-@interface GCDWebServerMultiPartArgument : GCDWebServerMultiPart
-
-/**
- *  Returns the data for the part.
- */
-@property(nonatomic, readonly) NSData* data;
-
-/**
- *  Returns the data for the part interpreted as text. If the content
- *  type of the part is not a text one, or if an error occurs, nil is returned.
- *
- *  The text encoding used to interpret the data is extracted from the
- *  "Content-Type" header or defaults to UTF-8.
- */
-@property(nonatomic, readonly, nullable) NSString* string;
-
-@end
-
-/**
- *  The GCDWebServerMultiPartFile subclass of GCDWebServerMultiPart wraps
- *  the content of a part as a file on disk.
- */
-@interface GCDWebServerMultiPartFile : GCDWebServerMultiPart
-
-/**
- *  Returns the file name retrieved from the part headers.
- */
-@property(nonatomic, readonly) NSString* fileName;
-
-/**
- *  Returns the path to the temporary file containing the part data.
- *
- *  @warning This temporary file will be automatically deleted when the
- *  GCDWebServerMultiPartFile is deallocated. If you want to preserve this file,
- *  you must move it to a different location beforehand.
- */
-@property(nonatomic, readonly) NSString* temporaryPath;
-
-@end
-
-/**
- *  The GCDWebServerMultiPartFormRequest subclass of GCDWebServerRequest
- *  parses the body of the HTTP request as a multipart encoded form.
- */
-@interface GCDWebServerMultiPartFormRequest : GCDWebServerRequest
-
-/**
- *  Returns the argument parts from the multipart encoded form as
- *  name / GCDWebServerMultiPartArgument pairs.
- */
-@property(nonatomic, readonly) NSArray<GCDWebServerMultiPartArgument*>* arguments;
-
-/**
- *  Returns the files parts from the multipart encoded form as
- *  name / GCDWebServerMultiPartFile pairs.
- */
-@property(nonatomic, readonly) NSArray<GCDWebServerMultiPartFile*>* files;
-
-/**
- *  Returns the MIME type for multipart encoded forms
- *  i.e. "multipart/form-data".
- */
-+ (NSString*)mimeType;
-
-/**
- *  Returns the first argument for a given control name or nil if not found.
- */
-- (nullable GCDWebServerMultiPartArgument*)firstArgumentForControlName:(NSString*)name;
-
-/**
- *  Returns the first file for a given control name or nil if not found.
- */
-- (nullable GCDWebServerMultiPartFile*)firstFileForControlName:(NSString*)name;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerMultiPartFormRequest.m b/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerMultiPartFormRequest.m
deleted file mode 100644
index 7550a021f..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerMultiPartFormRequest.m
+++ /dev/null
@@ -1,405 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import "GCDWebServerPrivate.h"
-
-#define kMultiPartBufferSize (256 * 1024)
-
-typedef enum {
-  kParserState_Undefined = 0,
-  kParserState_Start,
-  kParserState_Headers,
-  kParserState_Content,
-  kParserState_End
-} ParserState;
-
-@interface GCDWebServerMIMEStreamParser : NSObject
-@end
-
-static NSData* _newlineData = nil;
-static NSData* _newlinesData = nil;
-static NSData* _dashNewlineData = nil;
-
-@implementation GCDWebServerMultiPart
-
-- (instancetype)initWithControlName:(NSString* _Nonnull)name contentType:(NSString* _Nonnull)type {
-  if ((self = [super init])) {
-    _controlName = [name copy];
-    _contentType = [type copy];
-    _mimeType = (NSString*)GCDWebServerTruncateHeaderValue(_contentType);
-  }
-  return self;
-}
-
-@end
-
-@implementation GCDWebServerMultiPartArgument
-
-- (instancetype)initWithControlName:(NSString* _Nonnull)name contentType:(NSString* _Nonnull)type data:(NSData* _Nonnull)data {
-  if ((self = [super initWithControlName:name contentType:type])) {
-    _data = data;
-
-    if ([self.contentType hasPrefix:@"text/"]) {
-      NSString* charset = GCDWebServerExtractHeaderValueParameter(self.contentType, @"charset");
-      _string = [[NSString alloc] initWithData:_data encoding:GCDWebServerStringEncodingFromCharset(charset)];
-    }
-  }
-  return self;
-}
-
-- (NSString*)description {
-  return [NSString stringWithFormat:@"<%@ | '%@' | %lu bytes>", [self class], self.mimeType, (unsigned long)_data.length];
-}
-
-@end
-
-@implementation GCDWebServerMultiPartFile
-
-- (instancetype)initWithControlName:(NSString* _Nonnull)name contentType:(NSString* _Nonnull)type fileName:(NSString* _Nonnull)fileName temporaryPath:(NSString* _Nonnull)temporaryPath {
-  if ((self = [super initWithControlName:name contentType:type])) {
-    _fileName = [fileName copy];
-    _temporaryPath = [temporaryPath copy];
-  }
-  return self;
-}
-
-- (void)dealloc {
-  unlink([_temporaryPath fileSystemRepresentation]);
-}
-
-- (NSString*)description {
-  return [NSString stringWithFormat:@"<%@ | '%@' | '%@>'", [self class], self.mimeType, _fileName];
-}
-
-@end
-
-@implementation GCDWebServerMIMEStreamParser {
-  NSData* _boundary;
-  NSString* _defaultcontrolName;
-  ParserState _state;
-  NSMutableData* _data;
-  NSMutableArray<GCDWebServerMultiPartArgument*>* _arguments;
-  NSMutableArray<GCDWebServerMultiPartFile*>* _files;
-
-  NSString* _controlName;
-  NSString* _fileName;
-  NSString* _contentType;
-  NSString* _tmpPath;
-  int _tmpFile;
-  GCDWebServerMIMEStreamParser* _subParser;
-}
-
-+ (void)initialize {
-  if (_newlineData == nil) {
-    _newlineData = [[NSData alloc] initWithBytes:"\r\n" length:2];
-    GWS_DCHECK(_newlineData);
-  }
-  if (_newlinesData == nil) {
-    _newlinesData = [[NSData alloc] initWithBytes:"\r\n\r\n" length:4];
-    GWS_DCHECK(_newlinesData);
-  }
-  if (_dashNewlineData == nil) {
-    _dashNewlineData = [[NSData alloc] initWithBytes:"--\r\n" length:4];
-    GWS_DCHECK(_dashNewlineData);
-  }
-}
-
-- (instancetype)initWithBoundary:(NSString* _Nonnull)boundary defaultControlName:(NSString* _Nullable)name arguments:(NSMutableArray<GCDWebServerMultiPartArgument*>* _Nonnull)arguments files:(NSMutableArray<GCDWebServerMultiPartFile*>* _Nonnull)files {
-  NSData* data = boundary.length ? [[NSString stringWithFormat:@"--%@", boundary] dataUsingEncoding:NSASCIIStringEncoding] : nil;
-  if (data == nil) {
-    GWS_DNOT_REACHED();
-    return nil;
-  }
-  if ((self = [super init])) {
-    _boundary = data;
-    _defaultcontrolName = name;
-    _arguments = arguments;
-    _files = files;
-    _data = [[NSMutableData alloc] initWithCapacity:kMultiPartBufferSize];
-    _state = kParserState_Start;
-  }
-  return self;
-}
-
-- (void)dealloc {
-  if (_tmpFile > 0) {
-    close(_tmpFile);
-    unlink([_tmpPath fileSystemRepresentation]);
-  }
-}
-
-// http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.2
-- (BOOL)_parseData {
-  BOOL success = YES;
-
-  if (_state == kParserState_Headers) {
-    NSRange range = [_data rangeOfData:_newlinesData options:0 range:NSMakeRange(0, _data.length)];
-    if (range.location != NSNotFound) {
-      _controlName = nil;
-      _fileName = nil;
-      _contentType = nil;
-      _tmpPath = nil;
-      _subParser = nil;
-      NSString* headers = [[NSString alloc] initWithData:[_data subdataWithRange:NSMakeRange(0, range.location)] encoding:NSUTF8StringEncoding];
-      if (headers) {
-        for (NSString* header in [headers componentsSeparatedByString:@"\r\n"]) {
-          NSRange subRange = [header rangeOfString:@":"];
-          if (subRange.location != NSNotFound) {
-            NSString* name = [header substringToIndex:subRange.location];
-            NSString* value = [[header substringFromIndex:(subRange.location + subRange.length)] stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceCharacterSet]];
-            if ([name caseInsensitiveCompare:@"Content-Type"] == NSOrderedSame) {
-              _contentType = GCDWebServerNormalizeHeaderValue(value);
-            } else if ([name caseInsensitiveCompare:@"Content-Disposition"] == NSOrderedSame) {
-              NSString* contentDisposition = GCDWebServerNormalizeHeaderValue(value);
-              if ([GCDWebServerTruncateHeaderValue(contentDisposition) isEqualToString:@"form-data"]) {
-                _controlName = GCDWebServerExtractHeaderValueParameter(contentDisposition, @"name");
-                _fileName = GCDWebServerExtractHeaderValueParameter(contentDisposition, @"filename");
-              } else if ([GCDWebServerTruncateHeaderValue(contentDisposition) isEqualToString:@"file"]) {
-                _controlName = _defaultcontrolName;
-                _fileName = GCDWebServerExtractHeaderValueParameter(contentDisposition, @"filename");
-              }
-            }
-          } else {
-            GWS_DNOT_REACHED();
-          }
-        }
-        if (_contentType == nil) {
-          _contentType = @"text/plain";
-        }
-      } else {
-        GWS_LOG_ERROR(@"Failed decoding headers in part of 'multipart/form-data'");
-        GWS_DNOT_REACHED();
-      }
-      if (_controlName) {
-        if ([GCDWebServerTruncateHeaderValue(_contentType) isEqualToString:@"multipart/mixed"]) {
-          NSString* boundary = GCDWebServerExtractHeaderValueParameter(_contentType, @"boundary");
-          _subParser = [[GCDWebServerMIMEStreamParser alloc] initWithBoundary:boundary defaultControlName:_controlName arguments:_arguments files:_files];
-          if (_subParser == nil) {
-            GWS_DNOT_REACHED();
-            success = NO;
-          }
-        } else if (_fileName) {
-          NSString* path = [NSTemporaryDirectory() stringByAppendingPathComponent:[[NSProcessInfo processInfo] globallyUniqueString]];
-          _tmpFile = open([path fileSystemRepresentation], O_CREAT | O_TRUNC | O_WRONLY, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-          if (_tmpFile > 0) {
-            _tmpPath = [path copy];
-          } else {
-            GWS_DNOT_REACHED();
-            success = NO;
-          }
-        }
-      } else {
-        GWS_DNOT_REACHED();
-        success = NO;
-      }
-
-      [_data replaceBytesInRange:NSMakeRange(0, range.location + range.length) withBytes:NULL length:0];
-      _state = kParserState_Content;
-    }
-  }
-
-  if ((_state == kParserState_Start) || (_state == kParserState_Content)) {
-    NSRange range = [_data rangeOfData:_boundary options:0 range:NSMakeRange(0, _data.length)];
-    if (range.location != NSNotFound) {
-      NSRange subRange = NSMakeRange(range.location + range.length, _data.length - range.location - range.length);
-      NSRange subRange1 = [_data rangeOfData:_newlineData options:NSDataSearchAnchored range:subRange];
-      NSRange subRange2 = [_data rangeOfData:_dashNewlineData options:NSDataSearchAnchored range:subRange];
-      if ((subRange1.location != NSNotFound) || (subRange2.location != NSNotFound)) {
-        if (_state == kParserState_Content) {
-          const void* dataBytes = _data.bytes;
-          NSUInteger dataLength = range.location - 2;
-          if (_subParser) {
-            if (![_subParser appendBytes:dataBytes length:(dataLength + 2)] || ![_subParser isAtEnd]) {
-              GWS_DNOT_REACHED();
-              success = NO;
-            }
-            _subParser = nil;
-          } else if (_tmpPath) {
-            ssize_t result = write(_tmpFile, dataBytes, dataLength);
-            if (result == (ssize_t)dataLength) {
-              if (close(_tmpFile) == 0) {
-                _tmpFile = 0;
-                GCDWebServerMultiPartFile* file = [[GCDWebServerMultiPartFile alloc] initWithControlName:_controlName contentType:_contentType fileName:_fileName temporaryPath:_tmpPath];
-                [_files addObject:file];
-              } else {
-                GWS_DNOT_REACHED();
-                success = NO;
-              }
-            } else {
-              GWS_DNOT_REACHED();
-              success = NO;
-            }
-            _tmpPath = nil;
-          } else {
-            NSData* data = [[NSData alloc] initWithBytes:(void*)dataBytes length:dataLength];
-            GCDWebServerMultiPartArgument* argument = [[GCDWebServerMultiPartArgument alloc] initWithControlName:_controlName contentType:_contentType data:data];
-            [_arguments addObject:argument];
-          }
-        }
-
-        if (subRange1.location != NSNotFound) {
-          [_data replaceBytesInRange:NSMakeRange(0, subRange1.location + subRange1.length) withBytes:NULL length:0];
-          _state = kParserState_Headers;
-          success = [self _parseData];
-        } else {
-          _state = kParserState_End;
-        }
-      }
-    } else {
-      NSUInteger margin = 2 * _boundary.length;
-      if (_data.length > margin) {
-        NSUInteger length = _data.length - margin;
-        if (_subParser) {
-          if ([_subParser appendBytes:_data.bytes length:length]) {
-            [_data replaceBytesInRange:NSMakeRange(0, length) withBytes:NULL length:0];
-          } else {
-            GWS_DNOT_REACHED();
-            success = NO;
-          }
-        } else if (_tmpPath) {
-          ssize_t result = write(_tmpFile, _data.bytes, length);
-          if (result == (ssize_t)length) {
-            [_data replaceBytesInRange:NSMakeRange(0, length) withBytes:NULL length:0];
-          } else {
-            GWS_DNOT_REACHED();
-            success = NO;
-          }
-        }
-      }
-    }
-  }
-
-  return success;
-}
-
-- (BOOL)appendBytes:(const void*)bytes length:(NSUInteger)length {
-  [_data appendBytes:bytes length:length];
-  return [self _parseData];
-}
-
-- (BOOL)isAtEnd {
-  return (_state == kParserState_End);
-}
-
-@end
-
-@interface GCDWebServerMultiPartFormRequest ()
-@property(nonatomic) NSMutableArray<GCDWebServerMultiPartArgument*>* arguments;
-@property(nonatomic) NSMutableArray<GCDWebServerMultiPartFile*>* files;
-@end
-
-@implementation GCDWebServerMultiPartFormRequest {
-  GCDWebServerMIMEStreamParser* _parser;
-}
-
-+ (NSString*)mimeType {
-  return @"multipart/form-data";
-}
-
-- (instancetype)initWithMethod:(NSString*)method url:(NSURL*)url headers:(NSDictionary<NSString*, NSString*>*)headers path:(NSString*)path query:(NSDictionary<NSString*, NSString*>*)query {
-  if ((self = [super initWithMethod:method url:url headers:headers path:path query:query])) {
-    _arguments = [[NSMutableArray alloc] init];
-    _files = [[NSMutableArray alloc] init];
-  }
-  return self;
-}
-
-- (BOOL)open:(NSError**)error {
-  NSString* boundary = GCDWebServerExtractHeaderValueParameter(self.contentType, @"boundary");
-  _parser = [[GCDWebServerMIMEStreamParser alloc] initWithBoundary:boundary defaultControlName:nil arguments:_arguments files:_files];
-  if (_parser == nil) {
-    if (error) {
-      *error = [NSError errorWithDomain:kGCDWebServerErrorDomain code:-1 userInfo:@{NSLocalizedDescriptionKey : @"Failed starting to parse multipart form data"}];
-    }
-    return NO;
-  }
-  return YES;
-}
-
-- (BOOL)writeData:(NSData*)data error:(NSError**)error {
-  if (![_parser appendBytes:data.bytes length:data.length]) {
-    if (error) {
-      *error = [NSError errorWithDomain:kGCDWebServerErrorDomain code:-1 userInfo:@{NSLocalizedDescriptionKey : @"Failed continuing to parse multipart form data"}];
-    }
-    return NO;
-  }
-  return YES;
-}
-
-- (BOOL)close:(NSError**)error {
-  BOOL atEnd = [_parser isAtEnd];
-  _parser = nil;
-  if (!atEnd) {
-    if (error) {
-      *error = [NSError errorWithDomain:kGCDWebServerErrorDomain code:-1 userInfo:@{NSLocalizedDescriptionKey : @"Failed finishing to parse multipart form data"}];
-    }
-    return NO;
-  }
-  return YES;
-}
-
-- (GCDWebServerMultiPartArgument*)firstArgumentForControlName:(NSString*)name {
-  for (GCDWebServerMultiPartArgument* argument in _arguments) {
-    if ([argument.controlName isEqualToString:name]) {
-      return argument;
-    }
-  }
-  return nil;
-}
-
-- (GCDWebServerMultiPartFile*)firstFileForControlName:(NSString*)name {
-  for (GCDWebServerMultiPartFile* file in _files) {
-    if ([file.controlName isEqualToString:name]) {
-      return file;
-    }
-  }
-  return nil;
-}
-
-- (NSString*)description {
-  NSMutableString* description = [NSMutableString stringWithString:[super description]];
-  if (_arguments.count) {
-    [description appendString:@"\n"];
-    for (GCDWebServerMultiPartArgument* argument in _arguments) {
-      [description appendFormat:@"\n%@ (%@)\n", argument.controlName, argument.contentType];
-      [description appendString:GCDWebServerDescribeData(argument.data, argument.contentType)];
-    }
-  }
-  if (_files.count) {
-    [description appendString:@"\n"];
-    for (GCDWebServerMultiPartFile* file in _files) {
-      [description appendFormat:@"\n%@ (%@): %@\n{%@}", file.controlName, file.contentType, file.fileName, file.temporaryPath];
-    }
-  }
-  return description;
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerURLEncodedFormRequest.h b/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerURLEncodedFormRequest.h
deleted file mode 100644
index c0168b761..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerURLEncodedFormRequest.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "GCDWebServerDataRequest.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerURLEncodedFormRequest subclass of GCDWebServerRequest
- *  parses the body of the HTTP request as a URL encoded form using
- *  GCDWebServerParseURLEncodedForm().
- */
-@interface GCDWebServerURLEncodedFormRequest : GCDWebServerDataRequest
-
-/**
- *  Returns the unescaped control names and values for the URL encoded form.
- *
- *  The text encoding used to interpret the data is extracted from the
- *  "Content-Type" header or defaults to UTF-8.
- */
-@property(nonatomic, readonly) NSDictionary<NSString*, NSString*>* arguments;
-
-/**
- *  Returns the MIME type for URL encoded forms
- *  i.e. "application/x-www-form-urlencoded".
- */
-+ (NSString*)mimeType;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerURLEncodedFormRequest.m b/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerURLEncodedFormRequest.m
deleted file mode 100644
index d4d89e43e..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Requests/GCDWebServerURLEncodedFormRequest.m
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import "GCDWebServerPrivate.h"
-
-@implementation GCDWebServerURLEncodedFormRequest
-
-+ (NSString*)mimeType {
-  return @"application/x-www-form-urlencoded";
-}
-
-- (BOOL)close:(NSError**)error {
-  if (![super close:error]) {
-    return NO;
-  }
-
-  NSString* charset = GCDWebServerExtractHeaderValueParameter(self.contentType, @"charset");
-  NSString* string = [[NSString alloc] initWithData:self.data encoding:GCDWebServerStringEncodingFromCharset(charset)];
-  _arguments = GCDWebServerParseURLEncodedForm(string);
-  return YES;
-}
-
-- (NSString*)description {
-  NSMutableString* description = [NSMutableString stringWithString:[super description]];
-  [description appendString:@"\n"];
-  for (NSString* argument in [[_arguments allKeys] sortedArrayUsingSelector:@selector(compare:)]) {
-    [description appendFormat:@"\n%@ = %@", argument, [_arguments objectForKey:argument]];
-  }
-  return description;
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerDataResponse.h b/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerDataResponse.h
deleted file mode 100644
index e5121c336..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerDataResponse.h
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "GCDWebServerResponse.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerDataResponse subclass of GCDWebServerResponse reads the body
- *  of the HTTP response from memory.
- */
-@interface GCDWebServerDataResponse : GCDWebServerResponse
-@property(nonatomic, copy) NSString* contentType;  // Redeclare as non-null
-
-/**
- *  Creates a response with data in memory and a given content type.
- */
-+ (instancetype)responseWithData:(NSData*)data contentType:(NSString*)type;
-
-/**
- *  This method is the designated initializer for the class.
- */
-- (instancetype)initWithData:(NSData*)data contentType:(NSString*)type;
-
-@end
-
-@interface GCDWebServerDataResponse (Extensions)
-
-/**
- *  Creates a data response from text encoded using UTF-8.
- */
-+ (nullable instancetype)responseWithText:(NSString*)text;
-
-/**
- *  Creates a data response from HTML encoded using UTF-8.
- */
-+ (nullable instancetype)responseWithHTML:(NSString*)html;
-
-/**
- *  Creates a data response from an HTML template encoded using UTF-8.
- *  See -initWithHTMLTemplate:variables: for details.
- */
-+ (nullable instancetype)responseWithHTMLTemplate:(NSString*)path variables:(NSDictionary<NSString*, NSString*>*)variables;
-
-/**
- *  Creates a data response from a serialized JSON object and the default
- *  "application/json" content type.
- */
-+ (nullable instancetype)responseWithJSONObject:(id)object;
-
-/**
- *  Creates a data response from a serialized JSON object and a custom
- *  content type.
- */
-+ (nullable instancetype)responseWithJSONObject:(id)object contentType:(NSString*)type;
-
-/**
- *  Initializes a data response from text encoded using UTF-8.
- */
-- (nullable instancetype)initWithText:(NSString*)text;
-
-/**
- *  Initializes a data response from HTML encoded using UTF-8.
- */
-- (nullable instancetype)initWithHTML:(NSString*)html;
-
-/**
- *  Initializes a data response from an HTML template encoded using UTF-8.
- *
- *  All occurences of "%variable%" within the HTML template are replaced with
- *  their corresponding values.
- */
-- (nullable instancetype)initWithHTMLTemplate:(NSString*)path variables:(NSDictionary<NSString*, NSString*>*)variables;
-
-/**
- *  Initializes a data response from a serialized JSON object and the default
- *  "application/json" content type.
- */
-- (nullable instancetype)initWithJSONObject:(id)object;
-
-/**
- *  Initializes a data response from a serialized JSON object and a custom
- *  content type.
- */
-- (nullable instancetype)initWithJSONObject:(id)object contentType:(NSString*)type;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerDataResponse.m b/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerDataResponse.m
deleted file mode 100644
index 2ea2ce904..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerDataResponse.m
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import "GCDWebServerPrivate.h"
-
-@implementation GCDWebServerDataResponse {
-  NSData* _data;
-  BOOL _done;
-}
-
-@dynamic contentType;
-
-+ (instancetype)responseWithData:(NSData*)data contentType:(NSString*)type {
-  return [(GCDWebServerDataResponse*)[[self class] alloc] initWithData:data contentType:type];
-}
-
-- (instancetype)initWithData:(NSData*)data contentType:(NSString*)type {
-  if ((self = [super init])) {
-    _data = data;
-
-    self.contentType = type;
-    self.contentLength = data.length;
-  }
-  return self;
-}
-
-- (NSData*)readData:(NSError**)error {
-  NSData* data;
-  if (_done) {
-    data = [NSData data];
-  } else {
-    data = _data;
-    _done = YES;
-  }
-  return data;
-}
-
-- (NSString*)description {
-  NSMutableString* description = [NSMutableString stringWithString:[super description]];
-  [description appendString:@"\n\n"];
-  [description appendString:GCDWebServerDescribeData(_data, self.contentType)];
-  return description;
-}
-
-@end
-
-@implementation GCDWebServerDataResponse (Extensions)
-
-+ (instancetype)responseWithText:(NSString*)text {
-  return [(GCDWebServerDataResponse*)[self alloc] initWithText:text];
-}
-
-+ (instancetype)responseWithHTML:(NSString*)html {
-  return [(GCDWebServerDataResponse*)[self alloc] initWithHTML:html];
-}
-
-+ (instancetype)responseWithHTMLTemplate:(NSString*)path variables:(NSDictionary<NSString*, NSString*>*)variables {
-  return [(GCDWebServerDataResponse*)[self alloc] initWithHTMLTemplate:path variables:variables];
-}
-
-+ (instancetype)responseWithJSONObject:(id)object {
-  return [(GCDWebServerDataResponse*)[self alloc] initWithJSONObject:object];
-}
-
-+ (instancetype)responseWithJSONObject:(id)object contentType:(NSString*)type {
-  return [(GCDWebServerDataResponse*)[self alloc] initWithJSONObject:object contentType:type];
-}
-
-- (instancetype)initWithText:(NSString*)text {
-  NSData* data = [text dataUsingEncoding:NSUTF8StringEncoding];
-  if (data == nil) {
-    GWS_DNOT_REACHED();
-    return nil;
-  }
-  return [self initWithData:data contentType:@"text/plain; charset=utf-8"];
-}
-
-- (instancetype)initWithHTML:(NSString*)html {
-  NSData* data = [html dataUsingEncoding:NSUTF8StringEncoding];
-  if (data == nil) {
-    GWS_DNOT_REACHED();
-    return nil;
-  }
-  return [self initWithData:data contentType:@"text/html; charset=utf-8"];
-}
-
-- (instancetype)initWithHTMLTemplate:(NSString*)path variables:(NSDictionary<NSString*, NSString*>*)variables {
-  NSMutableString* html = [[NSMutableString alloc] initWithContentsOfFile:path encoding:NSUTF8StringEncoding error:NULL];
-  [variables enumerateKeysAndObjectsUsingBlock:^(NSString* key, NSString* value, BOOL* stop) {
-    [html replaceOccurrencesOfString:[NSString stringWithFormat:@"%%%@%%", key] withString:value options:0 range:NSMakeRange(0, html.length)];
-  }];
-  return [self initWithHTML:html];
-}
-
-- (instancetype)initWithJSONObject:(id)object {
-  return [self initWithJSONObject:object contentType:@"application/json"];
-}
-
-- (instancetype)initWithJSONObject:(id)object contentType:(NSString*)type {
-  NSData* data = [NSJSONSerialization dataWithJSONObject:object options:0 error:NULL];
-  if (data == nil) {
-    GWS_DNOT_REACHED();
-    return nil;
-  }
-  return [self initWithData:data contentType:type];
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerErrorResponse.h b/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerErrorResponse.h
deleted file mode 100644
index 7e10d5bfe..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerErrorResponse.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "GCDWebServerDataResponse.h"
-#import "GCDWebServerHTTPStatusCodes.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerDataResponse subclass of GCDWebServerDataResponse generates
- *  an HTML body from an HTTP status code and an error message.
- */
-@interface GCDWebServerErrorResponse : GCDWebServerDataResponse
-
-/**
- *  Creates a client error response with the corresponding HTTP status code.
- */
-+ (instancetype)responseWithClientError:(GCDWebServerClientErrorHTTPStatusCode)errorCode message:(NSString*)format, ... NS_FORMAT_FUNCTION(2, 3);
-
-/**
- *  Creates a server error response with the corresponding HTTP status code.
- */
-+ (instancetype)responseWithServerError:(GCDWebServerServerErrorHTTPStatusCode)errorCode message:(NSString*)format, ... NS_FORMAT_FUNCTION(2, 3);
-
-/**
- *  Creates a client error response with the corresponding HTTP status code
- *  and an underlying NSError.
- */
-+ (instancetype)responseWithClientError:(GCDWebServerClientErrorHTTPStatusCode)errorCode underlyingError:(nullable NSError*)underlyingError message:(NSString*)format, ... NS_FORMAT_FUNCTION(3, 4);
-
-/**
- *  Creates a server error response with the corresponding HTTP status code
- *  and an underlying NSError.
- */
-+ (instancetype)responseWithServerError:(GCDWebServerServerErrorHTTPStatusCode)errorCode underlyingError:(nullable NSError*)underlyingError message:(NSString*)format, ... NS_FORMAT_FUNCTION(3, 4);
-
-/**
- *  Initializes a client error response with the corresponding HTTP status code.
- */
-- (instancetype)initWithClientError:(GCDWebServerClientErrorHTTPStatusCode)errorCode message:(NSString*)format, ... NS_FORMAT_FUNCTION(2, 3);
-
-/**
- *  Initializes a server error response with the corresponding HTTP status code.
- */
-- (instancetype)initWithServerError:(GCDWebServerServerErrorHTTPStatusCode)errorCode message:(NSString*)format, ... NS_FORMAT_FUNCTION(2, 3);
-
-/**
- *  Initializes a client error response with the corresponding HTTP status code
- *  and an underlying NSError.
- */
-- (instancetype)initWithClientError:(GCDWebServerClientErrorHTTPStatusCode)errorCode underlyingError:(nullable NSError*)underlyingError message:(NSString*)format, ... NS_FORMAT_FUNCTION(3, 4);
-
-/**
- *  Initializes a server error response with the corresponding HTTP status code
- *  and an underlying NSError.
- */
-- (instancetype)initWithServerError:(GCDWebServerServerErrorHTTPStatusCode)errorCode underlyingError:(nullable NSError*)underlyingError message:(NSString*)format, ... NS_FORMAT_FUNCTION(3, 4);
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerErrorResponse.m b/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerErrorResponse.m
deleted file mode 100644
index ab3788f6b..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerErrorResponse.m
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import "GCDWebServerPrivate.h"
-
-@implementation GCDWebServerErrorResponse
-
-+ (instancetype)responseWithClientError:(GCDWebServerClientErrorHTTPStatusCode)errorCode message:(NSString*)format, ... {
-  GWS_DCHECK(((NSInteger)errorCode >= 400) && ((NSInteger)errorCode < 500));
-  va_list arguments;
-  va_start(arguments, format);
-  GCDWebServerErrorResponse* response = [(GCDWebServerErrorResponse*)[self alloc] initWithStatusCode:errorCode underlyingError:nil messageFormat:format arguments:arguments];
-  va_end(arguments);
-  return response;
-}
-
-+ (instancetype)responseWithServerError:(GCDWebServerServerErrorHTTPStatusCode)errorCode message:(NSString*)format, ... {
-  GWS_DCHECK(((NSInteger)errorCode >= 500) && ((NSInteger)errorCode < 600));
-  va_list arguments;
-  va_start(arguments, format);
-  GCDWebServerErrorResponse* response = [(GCDWebServerErrorResponse*)[self alloc] initWithStatusCode:errorCode underlyingError:nil messageFormat:format arguments:arguments];
-  va_end(arguments);
-  return response;
-}
-
-+ (instancetype)responseWithClientError:(GCDWebServerClientErrorHTTPStatusCode)errorCode underlyingError:(NSError*)underlyingError message:(NSString*)format, ... {
-  GWS_DCHECK(((NSInteger)errorCode >= 400) && ((NSInteger)errorCode < 500));
-  va_list arguments;
-  va_start(arguments, format);
-  GCDWebServerErrorResponse* response = [(GCDWebServerErrorResponse*)[self alloc] initWithStatusCode:errorCode underlyingError:underlyingError messageFormat:format arguments:arguments];
-  va_end(arguments);
-  return response;
-}
-
-+ (instancetype)responseWithServerError:(GCDWebServerServerErrorHTTPStatusCode)errorCode underlyingError:(NSError*)underlyingError message:(NSString*)format, ... {
-  GWS_DCHECK(((NSInteger)errorCode >= 500) && ((NSInteger)errorCode < 600));
-  va_list arguments;
-  va_start(arguments, format);
-  GCDWebServerErrorResponse* response = [(GCDWebServerErrorResponse*)[self alloc] initWithStatusCode:errorCode underlyingError:underlyingError messageFormat:format arguments:arguments];
-  va_end(arguments);
-  return response;
-}
-
-static inline NSString* _EscapeHTMLString(NSString* string) {
-  return [string stringByReplacingOccurrencesOfString:@"\"" withString:@"&quot;"];
-}
-
-- (instancetype)initWithStatusCode:(NSInteger)statusCode underlyingError:(NSError*)underlyingError messageFormat:(NSString*)format arguments:(va_list)arguments {
-  NSString* message = [[NSString alloc] initWithFormat:format arguments:arguments];
-  NSString* title = [NSString stringWithFormat:@"HTTP Error %i", (int)statusCode];
-  NSString* error = underlyingError ? [NSString stringWithFormat:@"[%@] %@ (%li)", underlyingError.domain, _EscapeHTMLString(underlyingError.localizedDescription), (long)underlyingError.code] : @"";
-  NSString* html = [NSString stringWithFormat:@"<!DOCTYPE html><html lang=\"en\"><head><meta charset=\"utf-8\"><title>%@</title></head><body><h1>%@: %@</h1><h3>%@</h3></body></html>",
-                                              title, title, _EscapeHTMLString(message), error];
-  if ((self = [self initWithHTML:html])) {
-    self.statusCode = statusCode;
-  }
-  return self;
-}
-
-- (instancetype)initWithClientError:(GCDWebServerClientErrorHTTPStatusCode)errorCode message:(NSString*)format, ... {
-  GWS_DCHECK(((NSInteger)errorCode >= 400) && ((NSInteger)errorCode < 500));
-  va_list arguments;
-  va_start(arguments, format);
-  self = [self initWithStatusCode:errorCode underlyingError:nil messageFormat:format arguments:arguments];
-  va_end(arguments);
-  return self;
-}
-
-- (instancetype)initWithServerError:(GCDWebServerServerErrorHTTPStatusCode)errorCode message:(NSString*)format, ... {
-  GWS_DCHECK(((NSInteger)errorCode >= 500) && ((NSInteger)errorCode < 600));
-  va_list arguments;
-  va_start(arguments, format);
-  self = [self initWithStatusCode:errorCode underlyingError:nil messageFormat:format arguments:arguments];
-  va_end(arguments);
-  return self;
-}
-
-- (instancetype)initWithClientError:(GCDWebServerClientErrorHTTPStatusCode)errorCode underlyingError:(NSError*)underlyingError message:(NSString*)format, ... {
-  GWS_DCHECK(((NSInteger)errorCode >= 400) && ((NSInteger)errorCode < 500));
-  va_list arguments;
-  va_start(arguments, format);
-  self = [self initWithStatusCode:errorCode underlyingError:underlyingError messageFormat:format arguments:arguments];
-  va_end(arguments);
-  return self;
-}
-
-- (instancetype)initWithServerError:(GCDWebServerServerErrorHTTPStatusCode)errorCode underlyingError:(NSError*)underlyingError message:(NSString*)format, ... {
-  GWS_DCHECK(((NSInteger)errorCode >= 500) && ((NSInteger)errorCode < 600));
-  va_list arguments;
-  va_start(arguments, format);
-  self = [self initWithStatusCode:errorCode underlyingError:underlyingError messageFormat:format arguments:arguments];
-  va_end(arguments);
-  return self;
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerFileResponse.h b/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerFileResponse.h
deleted file mode 100644
index 78931bc61..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerFileResponse.h
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "GCDWebServerResponse.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerFileResponse subclass of GCDWebServerResponse reads the body
- *  of the HTTP response from a file on disk.
- *
- *  It will automatically set the contentType, lastModifiedDate and eTag
- *  properties of the GCDWebServerResponse according to the file extension and
- *  metadata.
- */
-@interface GCDWebServerFileResponse : GCDWebServerResponse
-@property(nonatomic, copy) NSString* contentType;  // Redeclare as non-null
-@property(nonatomic) NSDate* lastModifiedDate;  // Redeclare as non-null
-@property(nonatomic, copy) NSString* eTag;  // Redeclare as non-null
-
-/**
- *  Creates a response with the contents of a file.
- */
-+ (nullable instancetype)responseWithFile:(NSString*)path;
-
-/**
- *  Creates a response like +responseWithFile: and sets the "Content-Disposition"
- *  HTTP header for a download if the "attachment" argument is YES.
- */
-+ (nullable instancetype)responseWithFile:(NSString*)path isAttachment:(BOOL)attachment;
-
-/**
- *  Creates a response like +responseWithFile: but restricts the file contents
- *  to a specific byte range.
- *
- *  See -initWithFile:byteRange: for details.
- */
-+ (nullable instancetype)responseWithFile:(NSString*)path byteRange:(NSRange)range;
-
-/**
- *  Creates a response like +responseWithFile:byteRange: and sets the
- *  "Content-Disposition" HTTP header for a download if the "attachment"
- *  argument is YES.
- */
-+ (nullable instancetype)responseWithFile:(NSString*)path byteRange:(NSRange)range isAttachment:(BOOL)attachment;
-
-/**
- *  Initializes a response with the contents of a file.
- */
-- (nullable instancetype)initWithFile:(NSString*)path;
-
-/**
- *  Initializes a response like +responseWithFile: and sets the
- *  "Content-Disposition" HTTP header for a download if the "attachment"
- *  argument is YES.
- */
-- (nullable instancetype)initWithFile:(NSString*)path isAttachment:(BOOL)attachment;
-
-/**
- *  Initializes a response like -initWithFile: but restricts the file contents
- *  to a specific byte range. This range should be set to (NSUIntegerMax, 0) for
- *  the full file, (offset, length) if expressed from the beginning of the file,
- *  or (NSUIntegerMax, length) if expressed from the end of the file. The "offset"
- *  and "length" values will be automatically adjusted to be compatible with the
- *  actual size of the file.
- *
- *  This argument would typically be set to the value of the byteRange property
- *  of the current GCDWebServerRequest.
- */
-- (nullable instancetype)initWithFile:(NSString*)path byteRange:(NSRange)range;
-
-/**
- *  This method is the designated initializer for the class.
- *
- *  If MIME type overrides are specified, they allow to customize the built-in
- *  mapping from extensions to MIME types. Keys of the dictionary must be lowercased
- *  file extensions without the period, and the values must be the corresponding
- *  MIME types.
- */
-- (nullable instancetype)initWithFile:(NSString*)path byteRange:(NSRange)range isAttachment:(BOOL)attachment mimeTypeOverrides:(nullable NSDictionary<NSString*, NSString*>*)overrides;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerFileResponse.m b/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerFileResponse.m
deleted file mode 100644
index 78233063e..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerFileResponse.m
+++ /dev/null
@@ -1,185 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import <sys/stat.h>
-
-#import "GCDWebServerPrivate.h"
-
-#define kFileReadBufferSize (32 * 1024)
-
-@implementation GCDWebServerFileResponse {
-  NSString* _path;
-  NSUInteger _offset;
-  NSUInteger _size;
-  int _file;
-}
-
-@dynamic contentType, lastModifiedDate, eTag;
-
-+ (instancetype)responseWithFile:(NSString*)path {
-  return [(GCDWebServerFileResponse*)[[self class] alloc] initWithFile:path];
-}
-
-+ (instancetype)responseWithFile:(NSString*)path isAttachment:(BOOL)attachment {
-  return [(GCDWebServerFileResponse*)[[self class] alloc] initWithFile:path isAttachment:attachment];
-}
-
-+ (instancetype)responseWithFile:(NSString*)path byteRange:(NSRange)range {
-  return [(GCDWebServerFileResponse*)[[self class] alloc] initWithFile:path byteRange:range];
-}
-
-+ (instancetype)responseWithFile:(NSString*)path byteRange:(NSRange)range isAttachment:(BOOL)attachment {
-  return [(GCDWebServerFileResponse*)[[self class] alloc] initWithFile:path byteRange:range isAttachment:attachment mimeTypeOverrides:nil];
-}
-
-- (instancetype)initWithFile:(NSString*)path {
-  return [self initWithFile:path byteRange:NSMakeRange(NSUIntegerMax, 0) isAttachment:NO mimeTypeOverrides:nil];
-}
-
-- (instancetype)initWithFile:(NSString*)path isAttachment:(BOOL)attachment {
-  return [self initWithFile:path byteRange:NSMakeRange(NSUIntegerMax, 0) isAttachment:attachment mimeTypeOverrides:nil];
-}
-
-- (instancetype)initWithFile:(NSString*)path byteRange:(NSRange)range {
-  return [self initWithFile:path byteRange:range isAttachment:NO mimeTypeOverrides:nil];
-}
-
-static inline NSDate* _NSDateFromTimeSpec(const struct timespec* t) {
-  return [NSDate dateWithTimeIntervalSince1970:((NSTimeInterval)t->tv_sec + (NSTimeInterval)t->tv_nsec / 1000000000.0)];
-}
-
-- (instancetype)initWithFile:(NSString*)path byteRange:(NSRange)range isAttachment:(BOOL)attachment mimeTypeOverrides:(NSDictionary<NSString*, NSString*>*)overrides {
-  struct stat info;
-  if (lstat([path fileSystemRepresentation], &info) || !(info.st_mode & S_IFREG)) {
-    GWS_DNOT_REACHED();
-    return nil;
-  }
-#ifndef __LP64__
-  if (info.st_size >= (off_t)4294967295) {  // In 32 bit mode, we can't handle files greater than 4 GiBs (don't use "NSUIntegerMax" here to avoid potential unsigned to signed conversion issues)
-    GWS_DNOT_REACHED();
-    return nil;
-  }
-#endif
-  NSUInteger fileSize = (NSUInteger)info.st_size;
-
-  BOOL hasByteRange = GCDWebServerIsValidByteRange(range);
-  if (hasByteRange) {
-    if (range.location != NSUIntegerMax) {
-      range.location = MIN(range.location, fileSize);
-      range.length = MIN(range.length, fileSize - range.location);
-    } else {
-      range.length = MIN(range.length, fileSize);
-      range.location = fileSize - range.length;
-    }
-    if (range.length == 0) {
-      return nil;  // TODO: Return 416 status code and "Content-Range: bytes */{file length}" header
-    }
-  } else {
-    range.location = 0;
-    range.length = fileSize;
-  }
-
-  if ((self = [super init])) {
-    _path = [path copy];
-    _offset = range.location;
-    _size = range.length;
-    if (hasByteRange) {
-      [self setStatusCode:kGCDWebServerHTTPStatusCode_PartialContent];
-      [self setValue:[NSString stringWithFormat:@"bytes %lu-%lu/%lu", (unsigned long)_offset, (unsigned long)(_offset + _size - 1), (unsigned long)fileSize] forAdditionalHeader:@"Content-Range"];
-      GWS_LOG_DEBUG(@"Using content bytes range [%lu-%lu] for file \"%@\"", (unsigned long)_offset, (unsigned long)(_offset + _size - 1), path);
-    }
-
-    if (attachment) {
-      NSString* fileName = [path lastPathComponent];
-      NSData* data = [[fileName stringByReplacingOccurrencesOfString:@"\"" withString:@""] dataUsingEncoding:NSISOLatin1StringEncoding allowLossyConversion:YES];
-      NSString* lossyFileName = data ? [[NSString alloc] initWithData:data encoding:NSISOLatin1StringEncoding] : nil;
-      if (lossyFileName) {
-        NSString* value = [NSString stringWithFormat:@"attachment; filename=\"%@\"; filename*=UTF-8''%@", lossyFileName, GCDWebServerEscapeURLString(fileName)];
-        [self setValue:value forAdditionalHeader:@"Content-Disposition"];
-      } else {
-        GWS_DNOT_REACHED();
-      }
-    }
-
-    self.contentType = GCDWebServerGetMimeTypeForExtension([_path pathExtension], overrides);
-    self.contentLength = _size;
-    self.lastModifiedDate = _NSDateFromTimeSpec(&info.st_mtimespec);
-    self.eTag = [NSString stringWithFormat:@"%llu/%li/%li", info.st_ino, info.st_mtimespec.tv_sec, info.st_mtimespec.tv_nsec];
-  }
-  return self;
-}
-
-- (BOOL)open:(NSError**)error {
-  _file = open([_path fileSystemRepresentation], O_NOFOLLOW | O_RDONLY);
-  if (_file <= 0) {
-    if (error) {
-      *error = GCDWebServerMakePosixError(errno);
-    }
-    return NO;
-  }
-  if (lseek(_file, _offset, SEEK_SET) != (off_t)_offset) {
-    if (error) {
-      *error = GCDWebServerMakePosixError(errno);
-    }
-    close(_file);
-    return NO;
-  }
-  return YES;
-}
-
-- (NSData*)readData:(NSError**)error {
-  size_t length = MIN((NSUInteger)kFileReadBufferSize, _size);
-  NSMutableData* data = [[NSMutableData alloc] initWithLength:length];
-  ssize_t result = read(_file, data.mutableBytes, length);
-  if (result < 0) {
-    if (error) {
-      *error = GCDWebServerMakePosixError(errno);
-    }
-    return nil;
-  }
-  if (result > 0) {
-    [data setLength:result];
-    _size -= result;
-  }
-  return data;
-}
-
-- (void)close {
-  close(_file);
-}
-
-- (NSString*)description {
-  NSMutableString* description = [NSMutableString stringWithString:[super description]];
-  [description appendFormat:@"\n\n{%@}", _path];
-  return description;
-}
-
-@end
diff --git a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerStreamedResponse.h b/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerStreamedResponse.h
deleted file mode 100644
index 211f63038..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerStreamedResponse.h
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "GCDWebServerResponse.h"
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- *  The GCDWebServerStreamBlock is called to stream the data for the HTTP body.
- *  The block must return either a chunk of data, an empty NSData when done, or
- *  nil on error and set the "error" argument which is guaranteed to be non-NULL.
- */
-typedef NSData* _Nullable (^GCDWebServerStreamBlock)(NSError** error);
-
-/**
- *  The GCDWebServerAsyncStreamBlock works like the GCDWebServerStreamBlock
- *  except the streamed data can be returned at a later time allowing for
- *  truly asynchronous generation of the data.
- *
- *  The block must call "completionBlock" passing the new chunk of data when ready,
- *  an empty NSData when done, or nil on error and pass a NSError.
- *
- *  The block cannot call "completionBlock" more than once per invocation.
- */
-typedef void (^GCDWebServerAsyncStreamBlock)(GCDWebServerBodyReaderCompletionBlock completionBlock);
-
-/**
- *  The GCDWebServerStreamedResponse subclass of GCDWebServerResponse streams
- *  the body of the HTTP response using a GCD block.
- */
-@interface GCDWebServerStreamedResponse : GCDWebServerResponse
-@property(nonatomic, copy) NSString* contentType;  // Redeclare as non-null
-
-/**
- *  Creates a response with streamed data and a given content type.
- */
-+ (instancetype)responseWithContentType:(NSString*)type streamBlock:(GCDWebServerStreamBlock)block;
-
-/**
- *  Creates a response with async streamed data and a given content type.
- */
-+ (instancetype)responseWithContentType:(NSString*)type asyncStreamBlock:(GCDWebServerAsyncStreamBlock)block;
-
-/**
- *  Initializes a response with streamed data and a given content type.
- */
-- (instancetype)initWithContentType:(NSString*)type streamBlock:(GCDWebServerStreamBlock)block;
-
-/**
- *  This method is the designated initializer for the class.
- */
-- (instancetype)initWithContentType:(NSString*)type asyncStreamBlock:(GCDWebServerAsyncStreamBlock)block;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerStreamedResponse.m b/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerStreamedResponse.m
deleted file mode 100644
index c05e91b44..000000000
--- a/Pods/GCDWebServer/GCDWebServer/Responses/GCDWebServerStreamedResponse.m
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- Copyright (c) 2012-2019, Pierre-Olivier Latour
- All rights reserved.
- 
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- * The name of Pierre-Olivier Latour may not be used to endorse
- or promote products derived from this software without specific
- prior written permission.
- 
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
- DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if !__has_feature(objc_arc)
-#error GCDWebServer requires ARC
-#endif
-
-#import "GCDWebServerPrivate.h"
-
-@implementation GCDWebServerStreamedResponse {
-  GCDWebServerAsyncStreamBlock _block;
-}
-
-@dynamic contentType;
-
-+ (instancetype)responseWithContentType:(NSString*)type streamBlock:(GCDWebServerStreamBlock)block {
-  return [(GCDWebServerStreamedResponse*)[[self class] alloc] initWithContentType:type streamBlock:block];
-}
-
-+ (instancetype)responseWithContentType:(NSString*)type asyncStreamBlock:(GCDWebServerAsyncStreamBlock)block {
-  return [(GCDWebServerStreamedResponse*)[[self class] alloc] initWithContentType:type asyncStreamBlock:block];
-}
-
-- (instancetype)initWithContentType:(NSString*)type streamBlock:(GCDWebServerStreamBlock)block {
-  return [self initWithContentType:type
-                  asyncStreamBlock:^(GCDWebServerBodyReaderCompletionBlock completionBlock) {
-                    NSError* error = nil;
-                    NSData* data = block(&error);
-                    completionBlock(data, error);
-                  }];
-}
-
-- (instancetype)initWithContentType:(NSString*)type asyncStreamBlock:(GCDWebServerAsyncStreamBlock)block {
-  if ((self = [super init])) {
-    _block = [block copy];
-
-    self.contentType = type;
-  }
-  return self;
-}
-
-- (void)asyncReadDataWithCompletion:(GCDWebServerBodyReaderCompletionBlock)block {
-  _block(block);
-}
-
-- (NSString*)description {
-  NSMutableString* description = [NSMutableString stringWithString:[super description]];
-  [description appendString:@"\n\n<STREAM>"];
-  return description;
-}
-
-@end
diff --git a/Pods/GCDWebServer/LICENSE b/Pods/GCDWebServer/LICENSE
deleted file mode 100644
index 12335de49..000000000
--- a/Pods/GCDWebServer/LICENSE
+++ /dev/null
@@ -1,24 +0,0 @@
-Copyright (c) 2012-2014, Pierre-Olivier Latour
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-    * The name of Pierre-Olivier Latour may not be used to endorse
-      or promote products derived from this software without specific
-      prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
-DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/Pods/GCDWebServer/README.md b/Pods/GCDWebServer/README.md
deleted file mode 100644
index 7d6aa578b..000000000
--- a/Pods/GCDWebServer/README.md
+++ /dev/null
@@ -1,469 +0,0 @@
-Overview
-========
-
-[![Build Status](https://travis-ci.org/swisspol/GCDWebServer.svg?branch=master)](https://travis-ci.org/swisspol/GCDWebServer)
-[![Version](http://cocoapod-badges.herokuapp.com/v/GCDWebServer/badge.png)](https://cocoapods.org/pods/GCDWebServer)
-[![Platform](http://cocoapod-badges.herokuapp.com/p/GCDWebServer/badge.png)](https://github.com/swisspol/GCDWebServer)
-[![License](http://img.shields.io/cocoapods/l/GCDWebServer.svg)](LICENSE)
-
-GCDWebServer is a modern and lightweight GCD based HTTP 1.1 server designed to be embedded in iOS, macOS & tvOS apps. It was written from scratch with the following goals in mind:
-* Elegant and easy to use architecture with only 4 core classes: server, connection, request and response (see "Understanding GCDWebServer's Architecture" below)
-* Well designed API with fully documented headers for easy integration and customization
-* Entirely built with an event-driven design using [Grand Central Dispatch](http://en.wikipedia.org/wiki/Grand_Central_Dispatch) for best performance and concurrency
-* No dependencies on third-party source code
-* Available under a friendly [New BSD License](LICENSE)
-
-Extra built-in features:
-* Allow implementation of fully asynchronous handlers of incoming HTTP requests
-* Minimize memory usage with disk streaming of large HTTP request or response bodies
-* Parser for [web forms](http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4) submitted using "application/x-www-form-urlencoded" or "multipart/form-data" encodings (including file uploads)
-* [JSON](http://www.json.org/) parsing and serialization for request and response HTTP bodies
-* [Chunked transfer encoding](https://en.wikipedia.org/wiki/Chunked_transfer_encoding) for request and response HTTP bodies
-* [HTTP compression](https://en.wikipedia.org/wiki/HTTP_compression) with gzip for request and response HTTP bodies
-* [HTTP range](https://en.wikipedia.org/wiki/Byte_serving) support for requests of local files
-* [Basic](https://en.wikipedia.org/wiki/Basic_access_authentication) and [Digest Access](https://en.wikipedia.org/wiki/Digest_access_authentication) authentications for password protection
-* Automatically handle transitions between foreground, background and suspended modes in iOS apps
-* Full support for both IPv4 and IPv6
-* NAT port mapping (IPv4 only)
-
-Included extensions:
-* [GCDWebUploader](GCDWebUploader/GCDWebUploader.h): subclass of ```GCDWebServer``` that implements an interface for uploading and downloading files using a web browser
-* [GCDWebDAVServer](GCDWebDAVServer/GCDWebDAVServer.h): subclass of ```GCDWebServer``` that implements a class 1 [WebDAV](https://en.wikipedia.org/wiki/WebDAV) server (with partial class 2 support for macOS Finder)
-
-What's not supported (but not really required from an embedded HTTP server):
-* Keep-alive connections
-* HTTPS
-
-Requirements:
-* macOS 10.7 or later (x86_64)
-* iOS 8.0 or later (armv7, armv7s or arm64)
-* tvOS 9.0 or later (arm64)
-* ARC memory management only (if you need MRC support use GCDWebServer 3.1 or earlier)
-
-Getting Started
-===============
-
-Download or check out the [latest release](https://github.com/swisspol/GCDWebServer/releases) of GCDWebServer then add the entire "GCDWebServer" subfolder to your Xcode project. If you intend to use one of the extensions like GCDWebDAVServer or GCDWebUploader, add these subfolders as well. Finally link to `libz` (via Target > Build Phases > Link Binary With Libraries) and add `$(SDKROOT)/usr/include/libxml2` to your header search paths (via Target > Build Settings > HEADER_SEARCH_PATHS).
-
-Alternatively, you can install GCDWebServer using [CocoaPods](http://cocoapods.org/) by simply adding this line to your Podfile:
-```
-pod "GCDWebServer", "~> 3.0"
-```
-If you want to use GCDWebUploader, use this line instead:
-```
-pod "GCDWebServer/WebUploader", "~> 3.0"
-```
-Or this line for GCDWebDAVServer:
-```
-pod "GCDWebServer/WebDAV", "~> 3.0"
-```
-
-And finally run `$ pod install`.
-
-You can also use [Carthage](https://github.com/Carthage/Carthage) by adding this line to your Cartfile (3.2.5 is the first release with Carthage support):
-```
-github "swisspol/GCDWebServer" ~> 3.2.5
-```
-
-Then run `$ carthage update` and add the generated frameworks to your Xcode projects (see [Carthage instructions](https://github.com/Carthage/Carthage#adding-frameworks-to-an-application)).
-
-Help & Support
-==============
-
-For help with using GCDWebServer, it's best to ask your question on Stack Overflow with the [`gcdwebserver`](http://stackoverflow.com/questions/tagged/gcdwebserver) tag. For bug reports and enhancement requests you can use [issues](https://github.com/swisspol/GCDWebServer/issues) in this project.
-
-Be sure to read this entire README first though!
-
-Hello World
-===========
-
-These code snippets show how to implement a custom HTTP server that runs on port 8080 and returns a "Hello World" HTML page to any request. Since GCDWebServer uses GCD blocks to handle requests, no subclassing or delegates are needed, which results in very clean code.
-
-**IMPORTANT:** If not using CocoaPods, be sure to add the `libz` shared system library to the Xcode target for your app.
-
-**macOS version (command line tool):**
-```objectivec
-#import "GCDWebServer.h"
-#import "GCDWebServerDataResponse.h"
-
-int main(int argc, const char* argv[]) {
-  @autoreleasepool {
-    
-    // Create server
-    GCDWebServer* webServer = [[GCDWebServer alloc] init];
-    
-    // Add a handler to respond to GET requests on any URL
-    [webServer addDefaultHandlerForMethod:@"GET"
-                             requestClass:[GCDWebServerRequest class]
-                             processBlock:^GCDWebServerResponse *(GCDWebServerRequest* request) {
-      
-      return [GCDWebServerDataResponse responseWithHTML:@"<html><body><p>Hello World</p></body></html>"];
-      
-    }];
-    
-    // Use convenience method that runs server on port 8080
-    // until SIGINT (Ctrl-C in Terminal) or SIGTERM is received
-    [webServer runWithPort:8080 bonjourName:nil];
-    NSLog(@"Visit %@ in your web browser", webServer.serverURL);
-    
-  }
-  return 0;
-}
-```
-
-**iOS version:**
-```objectivec
-#import "GCDWebServer.h"
-#import "GCDWebServerDataResponse.h"
-
-@interface AppDelegate : NSObject <UIApplicationDelegate> {
-  GCDWebServer* _webServer;
-}
-@end
-
-@implementation AppDelegate
-
-- (BOOL)application:(UIApplication*)application didFinishLaunchingWithOptions:(NSDictionary*)launchOptions {
-  
-  // Create server
-  _webServer = [[GCDWebServer alloc] init];
-  
-  // Add a handler to respond to GET requests on any URL
-  [_webServer addDefaultHandlerForMethod:@"GET"
-                            requestClass:[GCDWebServerRequest class]
-                            processBlock:^GCDWebServerResponse *(GCDWebServerRequest* request) {
-    
-    return [GCDWebServerDataResponse responseWithHTML:@"<html><body><p>Hello World</p></body></html>"];
-    
-  }];
-  
-  // Start server on port 8080
-  [_webServer startWithPort:8080 bonjourName:nil];
-  NSLog(@"Visit %@ in your web browser", _webServer.serverURL);
-  
-  return YES;
-}
-
-@end
-```
-
-**macOS Swift version (command line tool):**
-
-***webServer.swift***
-```swift
-import Foundation
-import GCDWebServer
-
-func initWebServer() {
-
-    let webServer = GCDWebServer()
-
-    webServer.addDefaultHandler(forMethod: "GET", request: GCDWebServerRequest.self, processBlock: {request in
-            return GCDWebServerDataResponse(html:"<html><body><p>Hello World</p></body></html>")
-            
-        })
-        
-    webServer.start(withPort: 8080, bonjourName: "GCD Web Server")
-    
-    print("Visit \(webServer.serverURL) in your web browser")
-}
-```
-
-***WebServer-Bridging-Header.h***
-```objectivec
-#import <GCDWebServer/GCDWebServer.h>
-#import <GCDWebServer/GCDWebServerDataResponse.h>
-```
-
-Web Based Uploads in iOS Apps
-=============================
-
-GCDWebUploader is a subclass of ```GCDWebServer``` that provides a ready-to-use HTML 5 file uploader & downloader. This lets users upload, download, delete files and create directories from a directory inside your iOS app's sandbox using a clean user interface in their web browser.
-
-Simply instantiate and run a ```GCDWebUploader``` instance then visit ```http://{YOUR-IOS-DEVICE-IP-ADDRESS}/``` from your web browser:
-
-```objectivec
-#import "GCDWebUploader.h"
-
-@interface AppDelegate : NSObject <UIApplicationDelegate> {
-  GCDWebUploader* _webUploader;
-}
-@end
-
-@implementation AppDelegate
-
-- (BOOL)application:(UIApplication*)application didFinishLaunchingWithOptions:(NSDictionary*)launchOptions {
-  NSString* documentsPath = [NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES) firstObject];
-  _webUploader = [[GCDWebUploader alloc] initWithUploadDirectory:documentsPath];
-  [_webUploader start];
-  NSLog(@"Visit %@ in your web browser", _webUploader.serverURL);
-  return YES;
-}
-
-@end
-```
-
-WebDAV Server in iOS Apps
-=========================
-
-GCDWebDAVServer is a subclass of ```GCDWebServer``` that provides a class 1 compliant [WebDAV](https://en.wikipedia.org/wiki/WebDAV) server. This lets users upload, download, delete files and create directories from a directory inside your iOS app's sandbox using any WebDAV client like [Transmit](https://panic.com/transmit/) (Mac), [ForkLift](http://binarynights.com/forklift/) (Mac) or [CyberDuck](http://cyberduck.io/) (Mac / Windows).
-
-GCDWebDAVServer should also work with the [macOS Finder](http://support.apple.com/kb/PH13859) as it is partially class 2 compliant (but only when the client is the macOS WebDAV implementation).
-
-Simply instantiate and run a ```GCDWebDAVServer``` instance then connect to ```http://{YOUR-IOS-DEVICE-IP-ADDRESS}/``` using a WebDAV client:
-
-```objectivec
-#import "GCDWebDAVServer.h"
-
-@interface AppDelegate : NSObject <UIApplicationDelegate> {
-  GCDWebDAVServer* _davServer;
-}
-@end
-
-@implementation AppDelegate
-
-- (BOOL)application:(UIApplication*)application didFinishLaunchingWithOptions:(NSDictionary*)launchOptions {
-  NSString* documentsPath = [NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES) firstObject];
-  _davServer = [[GCDWebDAVServer alloc] initWithUploadDirectory:documentsPath];
-  [_davServer start];
-  NSLog(@"Visit %@ in your WebDAV client", _davServer.serverURL);
-  return YES;
-}
-
-@end
-```
-
-Serving a Static Website
-========================
-
-GCDWebServer includes a built-in handler that can recursively serve a directory (it also lets you control how the ["Cache-Control"](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9) header should be set):
-
-**macOS version (command line tool):**
-```objectivec
-#import "GCDWebServer.h"
-
-int main(int argc, const char* argv[]) {
-  @autoreleasepool {
-    
-    GCDWebServer* webServer = [[GCDWebServer alloc] init];
-    [webServer addGETHandlerForBasePath:@"/" directoryPath:NSHomeDirectory() indexFilename:nil cacheAge:3600 allowRangeRequests:YES];
-    [webServer runWithPort:8080];
-    
-  }
-  return 0;
-}
-```
-
-Using GCDWebServer
-==================
-
-You start by creating an instance of the ```GCDWebServer``` class. Note that you can have multiple web servers running in the same app as long as they listen on different ports.
-
-Then you add one or more "handlers" to the server: each handler gets a chance to handle an incoming web request and provide a response. Handlers are called in a LIFO queue, so the latest added handler overrides any previously added ones.
-
-Finally you start the server on a given port.
-
-Understanding GCDWebServer's Architecture
-=========================================
-
-GCDWebServer's architecture consists of only 4 core classes:
-* [GCDWebServer](GCDWebServer/Core/GCDWebServer.h) manages the socket that listens for new HTTP connections and the list of handlers used by the server.
-* [GCDWebServerConnection](GCDWebServer/Core/GCDWebServerConnection.h) is instantiated by ```GCDWebServer``` to handle each new HTTP connection. Each instance stays alive until the connection is closed. You cannot use this class directly, but it is exposed so you can subclass it to override some hooks.
-* [GCDWebServerRequest](GCDWebServer/Core/GCDWebServerRequest.h) is created by the ```GCDWebServerConnection``` instance after HTTP headers have been received. It wraps the request and handles the HTTP body if any. GCDWebServer comes with [several subclasses](GCDWebServer/Requests) of ```GCDWebServerRequest``` to handle common cases like storing the body in memory or stream it to a file on disk.
-* [GCDWebServerResponse](GCDWebServer/Core/GCDWebServerResponse.h) is created by the request handler and wraps the response HTTP headers and optional body. GCDWebServer comes with [several subclasses](GCDWebServer/Responses) of ```GCDWebServerResponse``` to handle common cases like HTML text in memory or streaming a file from disk.
-
-Implementing Handlers
-=====================
-
-GCDWebServer relies on "handlers" to process incoming web requests and generating responses. Handlers are implemented with GCD blocks which makes it very easy to provide your own. However, they are executed on arbitrary threads within GCD so __special attention must be paid to thread-safety and re-entrancy__.
-
-Handlers require 2 GCD blocks:
-* The ```GCDWebServerMatchBlock``` is called on every handler added to the ```GCDWebServer``` instance whenever a web request has started (i.e. HTTP headers have been received). It is passed the basic info for the web request (HTTP method, URL, headers...) and must decide if it wants to handle it or not. If yes, it must return a new ```GCDWebServerRequest``` instance (see above) created with this info. Otherwise, it simply returns nil.
-* The ```GCDWebServerProcessBlock``` or ```GCDWebServerAsyncProcessBlock``` is called after the web request has been fully received and is passed the ```GCDWebServerRequest``` instance created at the previous step. It must return synchronously (if using ```GCDWebServerProcessBlock```) or asynchronously (if using ```GCDWebServerAsyncProcessBlock```) a ```GCDWebServerResponse``` instance (see above) or nil on error, which will result in a 500 HTTP status code returned to the client. It's however recommended to return an instance of [GCDWebServerErrorResponse](GCDWebServer/Responses/GCDWebServerErrorResponse.h) on error so more useful information can be returned to the client.
-
-Note that most methods on ```GCDWebServer``` to add handlers only require the ```GCDWebServerProcessBlock``` or ```GCDWebServerAsyncProcessBlock``` as they already provide a built-in ```GCDWebServerMatchBlock``` e.g. to match a URL path with a Regex.
-
-Asynchronous HTTP Responses
-===========================
-
-New in GCDWebServer 3.0 is the ability to process HTTP requests asynchronously i.e. add handlers to the server which generate their ```GCDWebServerResponse``` asynchronously. This is achieved by adding handlers that use a ```GCDWebServerAsyncProcessBlock``` instead of a ```GCDWebServerProcessBlock```. Here's an example:
-
-**(Synchronous version)** The handler blocks while generating the HTTP response:
-```objectivec
-[webServer addDefaultHandlerForMethod:@"GET"
-                         requestClass:[GCDWebServerRequest class]
-                         processBlock:^GCDWebServerResponse *(GCDWebServerRequest* request) {
-  
-  GCDWebServerDataResponse* response = [GCDWebServerDataResponse responseWithHTML:@"<html><body><p>Hello World</p></body></html>"];
-  return response;
-  
-}];
-```
-
-**(Asynchronous version)** The handler returns immediately and calls back GCDWebServer later with the generated HTTP response:
-```objectivec
-[webServer addDefaultHandlerForMethod:@"GET"
-                         requestClass:[GCDWebServerRequest class]
-                    asyncProcessBlock:^(GCDWebServerRequest* request, GCDWebServerCompletionBlock completionBlock) {
-  
-  // Do some async operation like network access or file I/O (simulated here using dispatch_after())
-  dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(3 * NSEC_PER_SEC)), dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
-    GCDWebServerDataResponse* response = [GCDWebServerDataResponse responseWithHTML:@"<html><body><p>Hello World</p></body></html>"];
-    completionBlock(response);
-  });
-
-}];
-```
-
-**(Advanced asynchronous version)** The handler returns immediately a streamed HTTP response which itself generates its contents asynchronously:
-```objectivec
-[webServer addDefaultHandlerForMethod:@"GET"
-                         requestClass:[GCDWebServerRequest class]
-                         processBlock:^GCDWebServerResponse *(GCDWebServerRequest* request) {
-  
-  NSMutableArray* contents = [NSMutableArray arrayWithObjects:@"<html><body><p>\n", @"Hello World!\n", @"</p></body></html>\n", nil];  // Fake data source we are reading from
-  GCDWebServerStreamedResponse* response = [GCDWebServerStreamedResponse responseWithContentType:@"text/html" asyncStreamBlock:^(GCDWebServerBodyReaderCompletionBlock completionBlock) {
-    
-    // Simulate a delay reading from the fake data source
-    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(1 * NSEC_PER_SEC)), dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
-      NSString* string = contents.firstObject;
-      if (string) {
-        [contents removeObjectAtIndex:0];
-        completionBlock([string dataUsingEncoding:NSUTF8StringEncoding], nil);  // Generate the 2nd part of the stream data
-      } else {
-        completionBlock([NSData data], nil);  // Must pass an empty NSData to signal the end of the stream
-      }
-    });
-    
-  }];
-  return response;
-  
-}];
-```
-
-*Note that you can even combine both the asynchronous and advanced asynchronous versions to return asynchronously an asynchronous HTTP response!*
-
-GCDWebServer & Background Mode for iOS Apps
-===========================================
-
-When doing networking operations in iOS apps, you must handle carefully [what happens when iOS puts the app in the background](https://developer.apple.com/library/ios/technotes/tn2277/_index.html). Typically you must stop any network servers while the app is in the background and restart them when the app comes back to the foreground. This can become quite complex considering servers might have ongoing connections when they need to be stopped.
-
-Fortunately, GCDWebServer does all of this automatically for you:
-- GCDWebServer begins a [background task](https://developer.apple.com/library/archive/documentation/iPhone/Conceptual/iPhoneOSProgrammingGuide/BackgroundExecution/BackgroundExecution.html) whenever the first HTTP connection is opened and ends it only when the last one is closed. This prevents iOS from suspending the app after it goes in the background, which would immediately kill HTTP connections to the client.
- - While the app is in the background, as long as new HTTP connections keep being initiated, the background task will continue to exist and iOS will not suspend the app **for up to 10 minutes** (unless under sudden and unexpected memory pressure).
- - If the app is still in the background when the last HTTP connection is closed, GCDWebServer will suspend itself and stop accepting new connections as if you had called ```-stop``` (this behavior can be disabled with the ```GCDWebServerOption_AutomaticallySuspendInBackground``` option).
-- If the app goes in the background while no HTTP connections are opened, GCDWebServer will immediately suspend itself and stop accepting new connections as if you had called ```-stop``` (this behavior can be disabled with the ```GCDWebServerOption_AutomaticallySuspendInBackground``` option).
-- If the app comes back to the foreground and GCDWebServer had been suspended, it will automatically resume itself and start accepting again new HTTP connections as if you had called ```-start```.
-
-HTTP connections are often initiated in batches (or bursts), for instance when loading a web page with multiple resources. This makes it difficult to accurately detect when the *very last* HTTP connection has been closed: it's possible 2 consecutive HTTP connections part of the same batch would be separated by a small delay instead of overlapping. It would be bad for the client if GCDWebServer suspended itself right in between. The ```GCDWebServerOption_ConnectedStateCoalescingInterval``` option solves this problem elegantly by forcing GCDWebServer to wait some extra delay before performing any action after the last HTTP connection has been closed, just in case a new HTTP connection is initiated within this delay.
-
-Logging in GCDWebServer
-=======================
-
-Both for debugging and informational purpose, GCDWebServer logs messages extensively whenever something happens. Furthermore, when building GCDWebServer in "Debug" mode versus "Release" mode, it logs even more information but also performs a number of internal consistency checks. To enable this behavior, define the preprocessor constant ```DEBUG=1``` when compiling GCDWebServer. In Xcode target settings, this can be done by adding ```DEBUG=1``` to the build setting ```GCC_PREPROCESSOR_DEFINITIONS``` when building in "Debug" configuration. Finally, you can also control the logging verbosity at run time by calling ```+[GCDWebServer setLogLevel:]```.
-
-By default, all messages logged by GCDWebServer are sent to its built-in logging facility, which simply outputs to ```stderr``` (assuming a terminal type device is connected). In order to better integrate with the rest of your app or because of the amount of information logged, you might want to use another logging facility.
-
-GCDWebServer has automatic support for [XLFacility](https://github.com/swisspol/XLFacility) (by the same author as GCDWebServer and also open-source): if it is in the same Xcode project, GCDWebServer should use it automatically instead of the built-in logging facility (see [GCDWebServerPrivate.h](GCDWebServer/Core/GCDWebServerPrivate.h) for the implementation details).
-
-It's also possible to use a custom logging facility - see [GCDWebServer.h](GCDWebServer/Core/GCDWebServer.h) for more information.
-
-Advanced Example 1: Implementing HTTP Redirects
-===============================================
-
-Here's an example handler that redirects "/" to "/index.html" using the convenience method on ```GCDWebServerResponse``` (it sets the HTTP status code and "Location" header automatically):
-
-```objectivec
-[self addHandlerForMethod:@"GET"
-                     path:@"/"
-             requestClass:[GCDWebServerRequest class]
-             processBlock:^GCDWebServerResponse *(GCDWebServerRequest* request) {
-    
-  return [GCDWebServerResponse responseWithRedirect:[NSURL URLWithString:@"index.html" relativeToURL:request.URL]
-                                          permanent:NO];
-    
-}];
-```
-
-Advanced Example 2: Implementing Forms
-======================================
-
-To implement an HTTP form, you need a pair of handlers:
-* The GET handler does not expect any body in the HTTP request and therefore uses the ```GCDWebServerRequest``` class. The handler generates a response containing a simple HTML form.
-* The POST handler expects the form values to be in the body of the HTTP request and percent-encoded. Fortunately, GCDWebServer provides the request class ```GCDWebServerURLEncodedFormRequest``` which can automatically parse such bodies. The handler simply echoes back the value from the user submitted form.
-
-```objectivec
-[webServer addHandlerForMethod:@"GET"
-                          path:@"/"
-                  requestClass:[GCDWebServerRequest class]
-                  processBlock:^GCDWebServerResponse *(GCDWebServerRequest* request) {
-  
-  NSString* html = @" \
-    <html><body> \
-      <form name=\"input\" action=\"/\" method=\"post\" enctype=\"application/x-www-form-urlencoded\"> \
-      Value: <input type=\"text\" name=\"value\"> \
-      <input type=\"submit\" value=\"Submit\"> \
-      </form> \
-    </body></html> \
-  ";
-  return [GCDWebServerDataResponse responseWithHTML:html];
-  
-}];
-
-[webServer addHandlerForMethod:@"POST"
-                          path:@"/"
-                  requestClass:[GCDWebServerURLEncodedFormRequest class]
-                  processBlock:^GCDWebServerResponse *(GCDWebServerRequest* request) {
-  
-  NSString* value = [[(GCDWebServerURLEncodedFormRequest*)request arguments] objectForKey:@"value"];
-  NSString* html = [NSString stringWithFormat:@"<html><body><p>%@</p></body></html>", value];
-  return [GCDWebServerDataResponse responseWithHTML:html];
-  
-}];
-```
-
-Advanced Example 3: Serving a Dynamic Website
-=============================================
-
-GCDWebServer provides an extension to the ```GCDWebServerDataResponse``` class that can return HTML content generated from a template and a set of variables (using the format ```%variable%```). It is a very basic template system and is really intended as a starting point to building more advanced template systems by subclassing ```GCDWebServerResponse```.
-
-Assuming you have a website directory in your app containing HTML template files along with the corresponding CSS, scripts and images, it's pretty easy to turn it into a dynamic website:
-
-```objectivec
-// Get the path to the website directory
-NSString* websitePath = [[NSBundle mainBundle] pathForResource:@"Website" ofType:nil];
-
-// Add a default handler to serve static files (i.e. anything other than HTML files)
-[self addGETHandlerForBasePath:@"/" directoryPath:websitePath indexFilename:nil cacheAge:3600 allowRangeRequests:YES];
-
-// Add an override handler for all requests to "*.html" URLs to do the special HTML templatization
-[self addHandlerForMethod:@"GET"
-                pathRegex:@"/.*\.html"
-             requestClass:[GCDWebServerRequest class]
-             processBlock:^GCDWebServerResponse *(GCDWebServerRequest* request) {
-    
-    NSDictionary* variables = [NSDictionary dictionaryWithObjectsAndKeys:@"value", @"variable", nil];
-    return [GCDWebServerDataResponse responseWithHTMLTemplate:[websitePath stringByAppendingPathComponent:request.path]
-                                                    variables:variables];
-    
-}];
-
-// Add an override handler to redirect "/" URL to "/index.html"
-[self addHandlerForMethod:@"GET"
-                     path:@"/"
-             requestClass:[GCDWebServerRequest class]
-             processBlock:^GCDWebServerResponse *(GCDWebServerRequest* request) {
-    
-    return [GCDWebServerResponse responseWithRedirect:[NSURL URLWithString:@"index.html" relativeToURL:request.URL]
-                                            permanent:NO];
-    
-];
-
-```
-
-Final Example: File Downloads and Uploads From iOS App
-======================================================
-
-GCDWebServer was originally written for the [ComicFlow](http://itunes.apple.com/us/app/comicflow/id409290355?mt=8) comic reader app for iPad. It allow users to connect to their iPad with their web browser over WiFi and then upload, download and organize comic files inside the app.
-
-ComicFlow is [entirely open-source](https://github.com/swisspol/ComicFlow) and you can see how it uses GCDWebServer in the [WebServer.h](https://github.com/swisspol/ComicFlow/blob/master/Classes/WebServer.h) and [WebServer.m](https://github.com/swisspol/ComicFlow/blob/master/Classes/WebServer.m) files.
diff --git a/Pods/Headers/Private/BRLOptionParser/BRLOptionParser.h b/Pods/Headers/Private/BRLOptionParser/BRLOptionParser.h
deleted file mode 120000
index 155812821..000000000
--- a/Pods/Headers/Private/BRLOptionParser/BRLOptionParser.h
+++ /dev/null
@@ -1 +0,0 @@
-../../../BRLOptionParser/BRLOptionParser/BRLOptionParser.h
\ No newline at end of file
diff --git a/Pods/Headers/Public/BRLOptionParser/BRLOptionParser.h b/Pods/Headers/Public/BRLOptionParser/BRLOptionParser.h
deleted file mode 120000
index 155812821..000000000
--- a/Pods/Headers/Public/BRLOptionParser/BRLOptionParser.h
+++ /dev/null
@@ -1 +0,0 @@
-../../../BRLOptionParser/BRLOptionParser/BRLOptionParser.h
\ No newline at end of file
diff --git a/Pods/MASShortcut/Framework/Model/MASKeyCodes.h b/Pods/MASShortcut/Framework/Model/MASKeyCodes.h
deleted file mode 100644
index 4c000b172..000000000
--- a/Pods/MASShortcut/Framework/Model/MASKeyCodes.h
+++ /dev/null
@@ -1,44 +0,0 @@
-#import <Carbon/Carbon.h>
-#import <AppKit/AppKit.h>
-#import "MASKeyMasks.h"
-
-// These glyphs are missed in Carbon.h
-typedef NS_ENUM(unsigned short, kMASShortcutGlyph) {
-    kMASShortcutGlyphEject = 0x23CF,
-    kMASShortcutGlyphClear = 0x2715,
-    kMASShortcutGlyphDeleteLeft = 0x232B,
-    kMASShortcutGlyphDeleteRight = 0x2326,
-    kMASShortcutGlyphLeftArrow = 0x2190,
-    kMASShortcutGlyphRightArrow = 0x2192,
-    kMASShortcutGlyphUpArrow = 0x2191,
-    kMASShortcutGlyphDownArrow = 0x2193,
-    kMASShortcutGlyphEscape = 0x238B,
-    kMASShortcutGlyphHelp = 0x003F,
-    kMASShortcutGlyphPageDown = 0x21DF,
-    kMASShortcutGlyphPageUp = 0x21DE,
-    kMASShortcutGlyphTabRight = 0x21E5,
-    kMASShortcutGlyphReturn = 0x2305,
-    kMASShortcutGlyphReturnR2L = 0x21A9,
-    kMASShortcutGlyphPadClear = 0x2327,
-    kMASShortcutGlyphNorthwestArrow = 0x2196,
-    kMASShortcutGlyphSoutheastArrow = 0x2198,
-};
-
-NS_INLINE NSString* NSStringFromMASKeyCode(unsigned short ch)
-{
-    return [NSString stringWithFormat:@"%C", ch];
-}
-
-NS_INLINE NSUInteger MASPickCocoaModifiers(NSUInteger flags)
-{
-    return (flags & (NSEventModifierFlagControl | NSEventModifierFlagShift | NSEventModifierFlagOption | NSEventModifierFlagCommand));
-}
-
-NS_INLINE UInt32 MASCarbonModifiersFromCocoaModifiers(NSUInteger cocoaFlags)
-{
-    return
-          (cocoaFlags & NSEventModifierFlagCommand ? cmdKey : 0)
-        | (cocoaFlags & NSEventModifierFlagOption ? optionKey : 0)
-        | (cocoaFlags & NSEventModifierFlagControl ? controlKey : 0)
-        | (cocoaFlags & NSEventModifierFlagShift ? shiftKey : 0);
-}
diff --git a/Pods/MASShortcut/Framework/Model/MASKeyMasks.h b/Pods/MASShortcut/Framework/Model/MASKeyMasks.h
deleted file mode 100644
index 5813c1df5..000000000
--- a/Pods/MASShortcut/Framework/Model/MASKeyMasks.h
+++ /dev/null
@@ -1,18 +0,0 @@
-#import <Availability.h>
-
-// https://github.com/shpakovski/MASShortcut/issues/99
-//
-// Long story short: NSControlKeyMask and friends were replaced with NSEventModifierFlagControl
-// and similar in macOS Sierra. The project builds fine & clean, but including MASShortcut in
-// a project with deployment target set to 10.12 results in several deprecation warnings because
-// of the control masks. Simply replacing the old symbols with the new ones isn’t an option,
-// since it breaks the build on older SDKs – in Travis, for example.
-//
-// It should be safe to remove this whole thing once the 10.12 SDK is ubiquitous.
-
-#if __MAC_OS_X_VERSION_MAX_ALLOWED < 101200
-#define NSEventModifierFlagCommand  NSCommandKeyMask
-#define NSEventModifierFlagControl  NSControlKeyMask
-#define NSEventModifierFlagOption   NSAlternateKeyMask
-#define NSEventModifierFlagShift    NSShiftKeyMask
-#endif
diff --git a/Pods/MASShortcut/Framework/Model/MASShortcut.h b/Pods/MASShortcut/Framework/Model/MASShortcut.h
deleted file mode 100644
index 1b7d76bed..000000000
--- a/Pods/MASShortcut/Framework/Model/MASShortcut.h
+++ /dev/null
@@ -1,81 +0,0 @@
-#import "MASKeyCodes.h"
-
-/**
- A model class to hold a key combination.
-
- This class just represents a combination of keys. It does not care if
- the combination is valid or can be used as a hotkey, it doesn’t watch
- the input system for the shortcut appearance, nor it does access user
- defaults.
-*/
-@interface MASShortcut : NSObject <NSSecureCoding, NSCopying>
-
-/**
- The virtual key code for the keyboard key.
-
- Hardware independent, same as in `NSEvent`. See `Events.h` in the HIToolbox
- framework for a complete list, or Command-click this symbol: `kVK_ANSI_A`.
-*/
-@property (nonatomic, readonly) NSInteger keyCode;
-
-/**
- Cocoa keyboard modifier flags.
-
- Same as in `NSEvent`: `NSCommandKeyMask`, `NSAlternateKeyMask`, etc.
-*/
-@property (nonatomic, readonly) NSEventModifierFlags modifierFlags;
-
-/**
- Same as `keyCode`, just a different type.
-*/
-@property (nonatomic, readonly) UInt32 carbonKeyCode;
-
-/**
- Carbon modifier flags.
-
- A bit sum of `cmdKey`, `optionKey`, etc.
-*/
-@property (nonatomic, readonly) UInt32 carbonFlags;
-
-/**
- A string representing the “key” part of a shortcut, like the `5` in `⌘5`.
-
- @warning The value may change depending on the active keyboard layout.
- For example for the `^2` keyboard shortcut (`kVK_ANSI_2+NSControlKeyMask`
- to be precise) the `keyCodeString` is `2` on the US keyboard, but `ě` when
- the Czech keyboard layout is active. See the spec for details.
-*/
-@property (nonatomic, readonly) NSString *keyCodeString;
-
-/**
- A key-code string used in key equivalent matching.
-
- For precise meaning of “key equivalents” see the `keyEquivalent`
- property of `NSMenuItem`. Here the string is used to support shortcut
- validation (“is the shortcut already taken in this menu?”) and
- for display in `NSMenu`.
-
- The value of this property may differ from `keyCodeString`. For example
- the Russian keyboard has a `Г` (Ge) Cyrillic character in place of the
- latin `U` key. This means you can create a `^Г` shortcut, but in menus
- that’s always displayed as `^U`. So the `keyCodeString` returns `Г`
- and `keyCodeStringForKeyEquivalent` returns `U`.
-*/
-@property (nonatomic, readonly) NSString *keyCodeStringForKeyEquivalent;
-
-/**
- A string representing the shortcut modifiers, like the `⌘` in `⌘5`.
-*/
-@property (nonatomic, readonly) NSString *modifierFlagsString;
-
-- (instancetype)initWithKeyCode:(NSInteger)code modifierFlags:(NSEventModifierFlags)flags;
-+ (instancetype)shortcutWithKeyCode:(NSInteger)code modifierFlags:(NSEventModifierFlags)flags;
-
-/**
- Creates a new shortcut from an `NSEvent` object.
-
- This is just a convenience initializer that reads the key code and modifiers from an `NSEvent`.
-*/
-+ (instancetype)shortcutWithEvent:(NSEvent *)anEvent;
-
-@end
diff --git a/Pods/MASShortcut/Framework/Model/MASShortcut.m b/Pods/MASShortcut/Framework/Model/MASShortcut.m
deleted file mode 100644
index 1a029a90b..000000000
--- a/Pods/MASShortcut/Framework/Model/MASShortcut.m
+++ /dev/null
@@ -1,243 +0,0 @@
-#import "MASShortcut.h"
-#import "MASLocalization.h"
-
-static NSString *const MASShortcutKeyCode = @"KeyCode";
-static NSString *const MASShortcutModifierFlags = @"ModifierFlags";
-
-@implementation MASShortcut
-
-#pragma mark Initialization
-
-- (instancetype)initWithKeyCode:(NSInteger)code modifierFlags:(NSEventModifierFlags)flags
-{
-    self = [super init];
-    if (self) {
-        _keyCode = code;
-        _modifierFlags = MASPickCocoaModifiers(flags);
-    }
-    return self;
-}
-
-+ (instancetype)shortcutWithKeyCode:(NSInteger)code modifierFlags:(NSEventModifierFlags)flags
-{
-    return [[self alloc] initWithKeyCode:code modifierFlags:flags];
-}
-
-+ (instancetype)shortcutWithEvent:(NSEvent *)event
-{
-    return [[self alloc] initWithKeyCode:event.keyCode modifierFlags:event.modifierFlags];
-}
-
-#pragma mark Shortcut Accessors
-
-- (UInt32)carbonKeyCode
-{
-    return (self.keyCode == NSNotFound ? 0 : (UInt32)self.keyCode);
-}
-
-- (UInt32)carbonFlags
-{
-    return MASCarbonModifiersFromCocoaModifiers(self.modifierFlags);
-}
-
-- (NSString *)description
-{
-    return [NSString stringWithFormat:@"%@%@", self.modifierFlagsString, self.keyCodeString];
-}
-
-- (NSString *)keyCodeStringForKeyEquivalent
-{
-    NSString *keyCodeString = self.keyCodeString;
-
-    if (keyCodeString.length <= 1) {
-        return keyCodeString.lowercaseString;
-    }
-
-    switch (self.keyCode) {
-        case kVK_F1: return NSStringFromMASKeyCode(NSF1FunctionKey);
-        case kVK_F2: return NSStringFromMASKeyCode(NSF2FunctionKey);
-        case kVK_F3: return NSStringFromMASKeyCode(NSF3FunctionKey);
-        case kVK_F4: return NSStringFromMASKeyCode(NSF4FunctionKey);
-        case kVK_F5: return NSStringFromMASKeyCode(NSF5FunctionKey);
-        case kVK_F6: return NSStringFromMASKeyCode(NSF6FunctionKey);
-        case kVK_F7: return NSStringFromMASKeyCode(NSF7FunctionKey);
-        case kVK_F8: return NSStringFromMASKeyCode(NSF8FunctionKey);
-        case kVK_F9: return NSStringFromMASKeyCode(NSF9FunctionKey);
-        case kVK_F10: return NSStringFromMASKeyCode(NSF10FunctionKey);
-        case kVK_F11: return NSStringFromMASKeyCode(NSF11FunctionKey);
-        case kVK_F12: return NSStringFromMASKeyCode(NSF12FunctionKey);
-        case kVK_F13: return NSStringFromMASKeyCode(NSF13FunctionKey);
-        case kVK_F14: return NSStringFromMASKeyCode(NSF14FunctionKey);
-        case kVK_F15: return NSStringFromMASKeyCode(NSF15FunctionKey);
-        case kVK_F16: return NSStringFromMASKeyCode(NSF16FunctionKey);
-        case kVK_F17: return NSStringFromMASKeyCode(NSF17FunctionKey);
-        case kVK_F18: return NSStringFromMASKeyCode(NSF18FunctionKey);
-        case kVK_F19: return NSStringFromMASKeyCode(NSF19FunctionKey);
-        case kVK_Space: return NSStringFromMASKeyCode(0x20);
-        default: return @"";
-    }
-}
-
-- (NSString *)keyCodeString
-{
-    // Some key codes don't have an equivalent
-    switch (self.keyCode) {
-        case NSNotFound: return @"";
-        case kVK_F1: return @"F1";
-        case kVK_F2: return @"F2";
-        case kVK_F3: return @"F3";
-        case kVK_F4: return @"F4";
-        case kVK_F5: return @"F5";
-        case kVK_F6: return @"F6";
-        case kVK_F7: return @"F7";
-        case kVK_F8: return @"F8";
-        case kVK_F9: return @"F9";
-        case kVK_F10: return @"F10";
-        case kVK_F11: return @"F11";
-        case kVK_F12: return @"F12";
-        case kVK_F13: return @"F13";
-        case kVK_F14: return @"F14";
-        case kVK_F15: return @"F15";
-        case kVK_F16: return @"F16";
-        case kVK_F17: return @"F17";
-        case kVK_F18: return @"F18";
-        case kVK_F19: return @"F19";
-        case kVK_Space: return MASLocalizedString(@"Space", @"Shortcut glyph name for SPACE key");
-        case kVK_Escape: return NSStringFromMASKeyCode(kMASShortcutGlyphEscape);
-        case kVK_Delete: return NSStringFromMASKeyCode(kMASShortcutGlyphDeleteLeft);
-        case kVK_ForwardDelete: return NSStringFromMASKeyCode(kMASShortcutGlyphDeleteRight);
-        case kVK_LeftArrow: return NSStringFromMASKeyCode(kMASShortcutGlyphLeftArrow);
-        case kVK_RightArrow: return NSStringFromMASKeyCode(kMASShortcutGlyphRightArrow);
-        case kVK_UpArrow: return NSStringFromMASKeyCode(kMASShortcutGlyphUpArrow);
-        case kVK_DownArrow: return NSStringFromMASKeyCode(kMASShortcutGlyphDownArrow);
-        case kVK_Help: return NSStringFromMASKeyCode(kMASShortcutGlyphHelp);
-        case kVK_PageUp: return NSStringFromMASKeyCode(kMASShortcutGlyphPageUp);
-        case kVK_PageDown: return NSStringFromMASKeyCode(kMASShortcutGlyphPageDown);
-        case kVK_Tab: return NSStringFromMASKeyCode(kMASShortcutGlyphTabRight);
-        case kVK_Return: return NSStringFromMASKeyCode(kMASShortcutGlyphReturnR2L);
-            
-        // Keypad
-        case kVK_ANSI_Keypad0: return @"0";
-        case kVK_ANSI_Keypad1: return @"1";
-        case kVK_ANSI_Keypad2: return @"2";
-        case kVK_ANSI_Keypad3: return @"3";
-        case kVK_ANSI_Keypad4: return @"4";
-        case kVK_ANSI_Keypad5: return @"5";
-        case kVK_ANSI_Keypad6: return @"6";
-        case kVK_ANSI_Keypad7: return @"7";
-        case kVK_ANSI_Keypad8: return @"8";
-        case kVK_ANSI_Keypad9: return @"9";
-        case kVK_ANSI_KeypadDecimal: return @".";
-        case kVK_ANSI_KeypadMultiply: return @"*";
-        case kVK_ANSI_KeypadPlus: return @"+";
-        case kVK_ANSI_KeypadClear: return NSStringFromMASKeyCode(kMASShortcutGlyphPadClear);
-        case kVK_ANSI_KeypadDivide: return @"/";
-        case kVK_ANSI_KeypadEnter: return NSStringFromMASKeyCode(kMASShortcutGlyphReturn);
-        case kVK_ANSI_KeypadMinus: return @"-";
-        case kVK_ANSI_KeypadEquals: return @"=";
-            
-        // Hardcode
-        case 119: return NSStringFromMASKeyCode(kMASShortcutGlyphSoutheastArrow);
-        case 115: return NSStringFromMASKeyCode(kMASShortcutGlyphNorthwestArrow);
-    }
-    
-    // Everything else should be printable so look it up in the current ASCII capable keyboard layout
-    OSStatus error = noErr;
-    NSString *keystroke = nil;
-    TISInputSourceRef inputSource = TISCopyCurrentASCIICapableKeyboardLayoutInputSource();
-    if (inputSource) {
-        CFDataRef layoutDataRef = TISGetInputSourceProperty(inputSource, kTISPropertyUnicodeKeyLayoutData);
-        if (layoutDataRef) {
-            UCKeyboardLayout *layoutData = (UCKeyboardLayout *)CFDataGetBytePtr(layoutDataRef);
-            UniCharCount length = 0;
-            UniChar  chars[256] = { 0 };
-            UInt32 deadKeyState = 0;
-            error = UCKeyTranslate(layoutData, (UInt16)self.keyCode, kUCKeyActionDisplay, 0, // No modifiers
-                                   LMGetKbdType(), kUCKeyTranslateNoDeadKeysMask, &deadKeyState,
-                                   sizeof(chars) / sizeof(UniChar), &length, chars);
-            keystroke = ((error == noErr) && length ? [NSString stringWithCharacters:chars length:length] : @"");
-        }
-        CFRelease(inputSource);
-    }
-    
-    // Validate keystroke
-    if (keystroke.length) {
-        static NSMutableCharacterSet *validChars = nil;
-        if (validChars == nil) {
-            validChars = [[NSMutableCharacterSet alloc] init];
-            [validChars formUnionWithCharacterSet:[NSCharacterSet alphanumericCharacterSet]];
-            [validChars formUnionWithCharacterSet:[NSCharacterSet punctuationCharacterSet]];
-            [validChars formUnionWithCharacterSet:[NSCharacterSet symbolCharacterSet]];
-        }
-        for (NSUInteger i = 0, length = keystroke.length; i < length; i++) {
-            if (![validChars characterIsMember:[keystroke characterAtIndex:i]]) {
-                keystroke = @"";
-                break;
-            }
-        }
-    }
-    
-    // Finally, we've got a shortcut!
-    return keystroke.uppercaseString;
-}
-
-- (NSString *)modifierFlagsString
-{
-    unichar chars[4];
-    NSUInteger count = 0;
-    // These are in the same order as the menu manager shows them
-    if (self.modifierFlags & NSControlKeyMask) chars[count++] = kControlUnicode;
-    if (self.modifierFlags & NSAlternateKeyMask) chars[count++] = kOptionUnicode;
-    if (self.modifierFlags & NSShiftKeyMask) chars[count++] = kShiftUnicode;
-    if (self.modifierFlags & NSCommandKeyMask) chars[count++] = kCommandUnicode;
-    return (count ? [NSString stringWithCharacters:chars length:count] : @"");
-}
-
-#pragma mark NSObject
-
-- (BOOL) isEqual: (MASShortcut*) object
-{
-    return [object isKindOfClass:[self class]]
-        && (object.keyCode == self.keyCode)
-        && (object.modifierFlags == self.modifierFlags);
-}
-
-- (NSUInteger) hash
-{
-    return self.keyCode + self.modifierFlags;
-}
-
-#pragma mark NSCoding
-
-- (void)encodeWithCoder:(NSCoder *)coder
-{
-    [coder encodeInteger:(self.keyCode != NSNotFound ? self.keyCode : - 1) forKey:MASShortcutKeyCode];
-    [coder encodeInteger:(NSInteger)self.modifierFlags forKey:MASShortcutModifierFlags];
-}
-
-- (instancetype)initWithCoder:(NSCoder *)decoder
-{
-    self = [super init];
-    if (self) {
-        NSInteger code = [decoder decodeIntegerForKey:MASShortcutKeyCode];
-        _keyCode = (code < 0) ? NSNotFound : code;
-        _modifierFlags = [decoder decodeIntegerForKey:MASShortcutModifierFlags];
-    }
-    return self;
-}
-
-#pragma mark NSSecureCoding
-
-+ (BOOL)supportsSecureCoding
-{
-    return YES;
-}
-
-#pragma mark NSCopying
-
-- (instancetype) copyWithZone:(NSZone *)zone
-{
-    return [[self class] shortcutWithKeyCode:_keyCode modifierFlags:_modifierFlags];
-}
-
-@end
diff --git a/Pods/MASShortcut/Framework/Model/MASShortcutValidator.h b/Pods/MASShortcut/Framework/Model/MASShortcutValidator.h
deleted file mode 100644
index 95fe8282b..000000000
--- a/Pods/MASShortcut/Framework/Model/MASShortcutValidator.h
+++ /dev/null
@@ -1,29 +0,0 @@
-#import "MASShortcut.h"
-
-/**
- This class is used by the recording control to tell which shortcuts are acceptable.
-
- There are two kinds of shortcuts that are not considered acceptable: shortcuts that
- are too simple (like single letter keys) and shortcuts that are already used by the
- operating system.
-*/
-@interface MASShortcutValidator : NSObject
-
-/**
- Set to `YES` if you want to accept Option-something shortcuts.
-
- `NO` by default, since Option-something shortcuts are often used by system,
- for example Option-G will type the © sign. This also applies to Option-Shift
- shortcuts – in other words, shortcut recorder will not accept shortcuts like
- Option-Shift-K by default. (Again, since Option-Shift-K inserts the Apple
- logo sign by default.)
-*/
-@property(assign) BOOL allowAnyShortcutWithOptionModifier;
-
-+ (instancetype) sharedValidator;
-
-- (BOOL) isShortcutValid: (MASShortcut*) shortcut;
-- (BOOL) isShortcut: (MASShortcut*) shortcut alreadyTakenInMenu: (NSMenu*) menu explanation: (NSString**) explanation;
-- (BOOL) isShortcutAlreadyTakenBySystem: (MASShortcut*) shortcut explanation: (NSString**) explanation;
-
-@end
diff --git a/Pods/MASShortcut/Framework/Model/MASShortcutValidator.m b/Pods/MASShortcut/Framework/Model/MASShortcutValidator.m
deleted file mode 100644
index 01f21b737..000000000
--- a/Pods/MASShortcut/Framework/Model/MASShortcutValidator.m
+++ /dev/null
@@ -1,112 +0,0 @@
-#import "MASShortcutValidator.h"
-#import "MASLocalization.h"
-
-@implementation MASShortcutValidator
-
-+ (instancetype) sharedValidator
-{
-    static dispatch_once_t once;
-    static MASShortcutValidator *sharedInstance;
-    dispatch_once(&once, ^{
-        sharedInstance = [[self alloc] init];
-    });
-    return sharedInstance;
-}
-
-- (BOOL) isShortcutValid: (MASShortcut*) shortcut
-{
-    NSInteger keyCode = [shortcut keyCode];
-    NSEventModifierFlags modifiers = [shortcut modifierFlags];
-
-    // Allow any function key with any combination of modifiers
-    BOOL includesFunctionKey = ((keyCode == kVK_F1) || (keyCode == kVK_F2) || (keyCode == kVK_F3) || (keyCode == kVK_F4) ||
-                                (keyCode == kVK_F5) || (keyCode == kVK_F6) || (keyCode == kVK_F7) || (keyCode == kVK_F8) ||
-                                (keyCode == kVK_F9) || (keyCode == kVK_F10) || (keyCode == kVK_F11) || (keyCode == kVK_F12) ||
-                                (keyCode == kVK_F13) || (keyCode == kVK_F14) || (keyCode == kVK_F15) || (keyCode == kVK_F16) ||
-                                (keyCode == kVK_F17) || (keyCode == kVK_F18) || (keyCode == kVK_F19) || (keyCode == kVK_F20));
-    if (includesFunctionKey) return YES;
-
-    // Do not allow any other key without modifiers
-    BOOL hasModifierFlags = (modifiers > 0);
-    if (!hasModifierFlags) return NO;
-
-    // Allow any hotkey containing Control or Command modifier
-    BOOL includesCommand = ((modifiers & NSCommandKeyMask) > 0);
-    BOOL includesControl = ((modifiers & NSControlKeyMask) > 0);
-    if (includesCommand || includesControl) return YES;
-
-    // Allow Option key only in selected cases
-    BOOL includesOption = ((modifiers & NSAlternateKeyMask) > 0);
-    if (includesOption) {
-
-        // Always allow Option-Space and Option-Escape because they do not have any bind system commands
-        if ((keyCode == kVK_Space) || (keyCode == kVK_Escape)) return YES;
-
-        // Allow Option modifier with any key even if it will break the system binding
-        if (_allowAnyShortcutWithOptionModifier) return YES;
-    }
-
-    // The hotkey does not have any modifiers or violates system bindings
-    return NO;
-}
-
-- (BOOL) isShortcut: (MASShortcut*) shortcut alreadyTakenInMenu: (NSMenu*) menu explanation: (NSString**) explanation
-{
-    NSString *keyEquivalent = [shortcut keyCodeStringForKeyEquivalent];
-    NSEventModifierFlags flags = [shortcut modifierFlags];
-
-    for (NSMenuItem *menuItem in menu.itemArray) {
-        if (menuItem.hasSubmenu && [self isShortcut:shortcut alreadyTakenInMenu:[menuItem submenu] explanation:explanation]) return YES;
-        
-        BOOL equalFlags = (MASPickCocoaModifiers(menuItem.keyEquivalentModifierMask) == flags);
-        BOOL equalHotkeyLowercase = [menuItem.keyEquivalent.lowercaseString isEqualToString:keyEquivalent];
-        
-        // Check if the cases are different, we know ours is lower and that shift is included in our modifiers
-        // If theirs is capitol, we need to add shift to their modifiers
-        if (equalHotkeyLowercase && ![menuItem.keyEquivalent isEqualToString:keyEquivalent]) {
-            equalFlags = (MASPickCocoaModifiers(menuItem.keyEquivalentModifierMask | NSShiftKeyMask) == flags);
-        }
-        
-        if (equalFlags && equalHotkeyLowercase) {
-            if (explanation) {
-                *explanation = MASLocalizedString(@"This shortcut cannot be used because it is already used by the menu item ‘%@’.",
-                                                     @"Message for alert when shortcut is already used");
-                *explanation = [NSString stringWithFormat:*explanation, menuItem.title];
-            }
-            return YES;
-        }
-    }
-    return NO;
-}
-
-- (BOOL) isShortcutAlreadyTakenBySystem: (MASShortcut*) shortcut explanation: (NSString**) explanation
-{
-    CFArrayRef globalHotKeys;
-    if (CopySymbolicHotKeys(&globalHotKeys) == noErr) {
-
-        // Enumerate all global hotkeys and check if any of them matches current shortcut
-        for (CFIndex i = 0, count = CFArrayGetCount(globalHotKeys); i < count; i++) {
-            CFDictionaryRef hotKeyInfo = CFArrayGetValueAtIndex(globalHotKeys, i);
-            CFNumberRef code = CFDictionaryGetValue(hotKeyInfo, kHISymbolicHotKeyCode);
-            CFNumberRef flags = CFDictionaryGetValue(hotKeyInfo, kHISymbolicHotKeyModifiers);
-            CFNumberRef enabled = CFDictionaryGetValue(hotKeyInfo, kHISymbolicHotKeyEnabled);
-
-            if (([(__bridge NSNumber *)code integerValue] == [shortcut keyCode]) &&
-                ([(__bridge NSNumber *)flags unsignedIntegerValue] == [shortcut carbonFlags]) &&
-                ([(__bridge NSNumber *)enabled boolValue])) {
-
-                if (explanation) {
-                    *explanation = MASLocalizedString(@"This combination cannot be used because it is already used by a system-wide "
-                                                     @"keyboard shortcut.\nIf you really want to use this key combination, most shortcuts "
-                                                     @"can be changed in the Keyboard & Mouse panel in System Preferences.",
-                                                     @"Message for alert when shortcut is already used by the system");
-                }
-                return YES;
-            }
-        }
-        CFRelease(globalHotKeys);
-    }
-    return [self isShortcut:shortcut alreadyTakenInMenu:[NSApp mainMenu] explanation:explanation];
-}
-
-@end
diff --git a/Pods/MASShortcut/Framework/Monitoring/MASHotKey.h b/Pods/MASShortcut/Framework/Monitoring/MASHotKey.h
deleted file mode 100644
index 1d267e423..000000000
--- a/Pods/MASShortcut/Framework/Monitoring/MASHotKey.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#import "MASShortcut.h"
-
-extern FourCharCode const MASHotKeySignature;
-
-@interface MASHotKey : NSObject
-
-@property(readonly) UInt32 carbonID;
-@property(copy) dispatch_block_t action;
-
-+ (instancetype) registeredHotKeyWithShortcut: (MASShortcut*) shortcut;
-
-@end
diff --git a/Pods/MASShortcut/Framework/Monitoring/MASHotKey.m b/Pods/MASShortcut/Framework/Monitoring/MASHotKey.m
deleted file mode 100644
index c5ab74445..000000000
--- a/Pods/MASShortcut/Framework/Monitoring/MASHotKey.m
+++ /dev/null
@@ -1,44 +0,0 @@
-#import "MASHotKey.h"
-
-FourCharCode const MASHotKeySignature = 'MASS';
-
-@interface MASHotKey ()
-@property(assign) EventHotKeyRef hotKeyRef;
-@property(assign) UInt32 carbonID;
-@end
-
-@implementation MASHotKey
-
-- (instancetype) initWithShortcut: (MASShortcut*) shortcut
-{
-    self = [super init];
-
-    static UInt32 CarbonHotKeyID = 0;
-
-    _carbonID = ++CarbonHotKeyID;
-    EventHotKeyID hotKeyID = { .signature = MASHotKeySignature, .id = _carbonID };
-
-    OSStatus status = RegisterEventHotKey([shortcut carbonKeyCode], [shortcut carbonFlags],
-        hotKeyID, GetEventDispatcherTarget(), 0, &_hotKeyRef);
-
-    if (status != noErr) {
-        return nil;
-    }
-
-    return self;
-}
-
-+ (instancetype) registeredHotKeyWithShortcut: (MASShortcut*) shortcut
-{
-    return [[self alloc] initWithShortcut:shortcut];
-}
-
-- (void) dealloc
-{
-    if (_hotKeyRef) {
-        UnregisterEventHotKey(_hotKeyRef);
-        _hotKeyRef = NULL;
-    }
-}
-
-@end
diff --git a/Pods/MASShortcut/Framework/Monitoring/MASShortcutMonitor.h b/Pods/MASShortcut/Framework/Monitoring/MASShortcutMonitor.h
deleted file mode 100644
index dc3d458fb..000000000
--- a/Pods/MASShortcut/Framework/Monitoring/MASShortcutMonitor.h
+++ /dev/null
@@ -1,27 +0,0 @@
-#import "MASShortcut.h"
-
-/**
- Executes action when a shortcut is pressed.
-
- There can only be one instance of this class, otherwise things
- will probably not work. (There’s a Carbon event handler inside
- and there can only be one Carbon event handler of a given type.)
-*/
-@interface MASShortcutMonitor : NSObject
-
-- (instancetype) init __unavailable;
-+ (instancetype) sharedMonitor;
-
-/**
- Register a shortcut along with an action.
-
- Attempting to insert an already registered shortcut probably won’t work.
- It may burn your house or cut your fingers. You have been warned.
-*/
-- (BOOL) registerShortcut: (MASShortcut*) shortcut withAction: (dispatch_block_t) action;
-- (BOOL) isShortcutRegistered: (MASShortcut*) shortcut;
-
-- (void) unregisterShortcut: (MASShortcut*) shortcut;
-- (void) unregisterAllShortcuts;
-
-@end
diff --git a/Pods/MASShortcut/Framework/Monitoring/MASShortcutMonitor.m b/Pods/MASShortcut/Framework/Monitoring/MASShortcutMonitor.m
deleted file mode 100644
index fce802265..000000000
--- a/Pods/MASShortcut/Framework/Monitoring/MASShortcutMonitor.m
+++ /dev/null
@@ -1,108 +0,0 @@
-#import "MASShortcutMonitor.h"
-#import "MASHotKey.h"
-
-@interface MASShortcutMonitor ()
-@property(assign) EventHandlerRef eventHandlerRef;
-@property(strong) NSMutableDictionary *hotKeys;
-@end
-
-static OSStatus MASCarbonEventCallback(EventHandlerCallRef, EventRef, void*);
-
-@implementation MASShortcutMonitor
-
-#pragma mark Initialization
-
-- (instancetype) init
-{
-    self = [super init];
-    [self setHotKeys:[NSMutableDictionary dictionary]];
-    EventTypeSpec hotKeyPressedSpec = { .eventClass = kEventClassKeyboard, .eventKind = kEventHotKeyPressed };
-    OSStatus status = InstallEventHandler(GetEventDispatcherTarget(), MASCarbonEventCallback,
-        1, &hotKeyPressedSpec, (__bridge void*)self, &_eventHandlerRef);
-    if (status != noErr) {
-        return nil;
-    }
-    return self;
-}
-
-- (void) dealloc
-{
-    if (_eventHandlerRef) {
-        RemoveEventHandler(_eventHandlerRef);
-        _eventHandlerRef = NULL;
-    }
-}
-
-+ (instancetype) sharedMonitor
-{
-    static dispatch_once_t once;
-    static MASShortcutMonitor *sharedInstance;
-    dispatch_once(&once, ^{
-        sharedInstance = [[self alloc] init];
-    });
-    return sharedInstance;
-}
-
-#pragma mark Registration
-
-- (BOOL) registerShortcut: (MASShortcut*) shortcut withAction: (dispatch_block_t) action
-{
-    MASHotKey *hotKey = [MASHotKey registeredHotKeyWithShortcut:shortcut];
-    if (hotKey) {
-        [hotKey setAction:action];
-        [_hotKeys setObject:hotKey forKey:shortcut];
-        return YES;
-    } else {
-        return NO;
-    }
-}
-
-- (void) unregisterShortcut: (MASShortcut*) shortcut
-{
-    if (shortcut) {
-        [_hotKeys removeObjectForKey:shortcut];
-    }
-}
-
-- (void) unregisterAllShortcuts
-{
-    [_hotKeys removeAllObjects];
-}
-
-- (BOOL) isShortcutRegistered: (MASShortcut*) shortcut
-{
-    return !![_hotKeys objectForKey:shortcut];
-}
-
-#pragma mark Event Handling
-
-- (void) handleEvent: (EventRef) event
-{
-    if (GetEventClass(event) != kEventClassKeyboard) {
-        return;
-    }
-
-    EventHotKeyID hotKeyID;
-    OSStatus status = GetEventParameter(event, kEventParamDirectObject, typeEventHotKeyID, NULL, sizeof(hotKeyID), NULL, &hotKeyID);
-    if (status != noErr || hotKeyID.signature != MASHotKeySignature) {
-        return;
-    }
-
-    [_hotKeys enumerateKeysAndObjectsUsingBlock:^(MASShortcut *shortcut, MASHotKey *hotKey, BOOL *stop) {
-        if (hotKeyID.id == [hotKey carbonID]) {
-            if ([hotKey action]) {
-                dispatch_async(dispatch_get_main_queue(), [hotKey action]);
-            }
-            *stop = YES;
-        }
-    }];
-}
-
-@end
-
-static OSStatus MASCarbonEventCallback(EventHandlerCallRef _, EventRef event, void *context)
-{
-    MASShortcutMonitor *dispatcher = (__bridge id)context;
-    [dispatcher handleEvent:event];
-    return noErr;
-}
diff --git a/Pods/MASShortcut/Framework/Shortcut.h b/Pods/MASShortcut/Framework/Shortcut.h
deleted file mode 100644
index 5a8de8e3a..000000000
--- a/Pods/MASShortcut/Framework/Shortcut.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#import "MASKeyMasks.h"
-#import "MASShortcut.h"
-#import "MASShortcutValidator.h"
-#import "MASShortcutMonitor.h"
-#import "MASShortcutBinder.h"
-#import "MASDictionaryTransformer.h"
-#import "MASShortcutView.h"
-#import "MASShortcutView+Bindings.h"
diff --git a/Pods/MASShortcut/Framework/UI/MASLocalization.h b/Pods/MASShortcut/Framework/UI/MASLocalization.h
deleted file mode 100644
index 466a9694e..000000000
--- a/Pods/MASShortcut/Framework/UI/MASLocalization.h
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- Reads a localized string from the framework’s bundle.
-
- Normally you would use NSLocalizedString to read the localized
- strings, but that’s just a shortcut for loading the strings from
- the main bundle. And once the framework ends up in an app, the
- main bundle will be the app’s bundle and won’t contain our strings.
- So we introduced this helper function that makes sure to load the
- strings from the framework’s bundle. Please avoid using
- NSLocalizedString throughout the framework, it wouldn’t work
- properly.
-*/
-NSString *MASLocalizedString(NSString *key, NSString *comment);
\ No newline at end of file
diff --git a/Pods/MASShortcut/Framework/UI/MASLocalization.m b/Pods/MASShortcut/Framework/UI/MASLocalization.m
deleted file mode 100644
index 5e119a71c..000000000
--- a/Pods/MASShortcut/Framework/UI/MASLocalization.m
+++ /dev/null
@@ -1,34 +0,0 @@
-#import "MASLocalization.h"
-#import "MASShortcut.h"
-
-static NSString *const MASLocalizationTableName = @"Localizable";
-static NSString *const MASPlaceholderLocalizationString = @"XXX";
-
-// The CocoaPods trickery here is needed because when the code
-// is built as a part of CocoaPods, it won’t make a separate framework
-// and the Localized.strings file won’t be bundled correctly.
-// See https://github.com/shpakovski/MASShortcut/issues/74
-NSString *MASLocalizedString(NSString *key, NSString *comment) {
-    static NSBundle *localizationBundle = nil;
-    static dispatch_once_t onceToken;
-    dispatch_once(&onceToken, ^{
-        NSBundle *frameworkBundle = [NSBundle bundleForClass:[MASShortcut class]];
-        // first we'll check if resources bundle was copied to MASShortcut framework bundle when !use_frameworks option is active
-        NSURL *cocoaPodsBundleURL = [frameworkBundle URLForResource:@"MASShortcut" withExtension:@"bundle"];
-        if (cocoaPodsBundleURL) {
-            localizationBundle = [NSBundle bundleWithURL: cocoaPodsBundleURL];
-        } else {
-            // trying to fetch cocoapods bundle from main bundle
-            cocoaPodsBundleURL = [[NSBundle mainBundle] URLForResource: @"MASShortcut" withExtension:@"bundle"];
-            if (cocoaPodsBundleURL) {
-                localizationBundle = [NSBundle bundleWithURL: cocoaPodsBundleURL];
-            } else {
-                // fallback to framework bundle
-                localizationBundle = frameworkBundle;
-            }
-        }
-    });
-    return [localizationBundle localizedStringForKey:key
-        value:MASPlaceholderLocalizationString
-        table:MASLocalizationTableName];
-}
diff --git a/Pods/MASShortcut/Framework/UI/MASShortcutView+Bindings.h b/Pods/MASShortcut/Framework/UI/MASShortcutView+Bindings.h
deleted file mode 100644
index 01b224686..000000000
--- a/Pods/MASShortcut/Framework/UI/MASShortcutView+Bindings.h
+++ /dev/null
@@ -1,25 +0,0 @@
-#import "MASShortcutView.h"
-
-/**
- A simplified interface to bind the recorder value to user defaults.
-
- You can bind the `shortcutValue` to user defaults using the standard
- `bind:toObject:withKeyPath:options:` call, but since that’s a lot to type
- and read, here’s a simpler option.
-
- Setting the `associatedUserDefaultsKey` binds the view’s shortcut value
- to the given user defaults key. You can supply a value transformer to convert
- values between user defaults and `MASShortcut`. If you don’t supply
- a transformer, the `NSUnarchiveFromDataTransformerName` will be used
- automatically.
-
- Set `associatedUserDefaultsKey` to `nil` to disconnect the binding.
-*/
-@interface MASShortcutView (Bindings)
-
-@property(copy) NSString *associatedUserDefaultsKey;
-
-- (void) setAssociatedUserDefaultsKey: (NSString*) newKey withTransformer: (NSValueTransformer*) transformer;
-- (void) setAssociatedUserDefaultsKey: (NSString*) newKey withTransformerName: (NSString*) transformerName;
-
-@end
diff --git a/Pods/MASShortcut/Framework/UI/MASShortcutView+Bindings.m b/Pods/MASShortcut/Framework/UI/MASShortcutView+Bindings.m
deleted file mode 100644
index 54c511154..000000000
--- a/Pods/MASShortcut/Framework/UI/MASShortcutView+Bindings.m
+++ /dev/null
@@ -1,50 +0,0 @@
-#import "MASShortcutView+Bindings.h"
-
-@implementation MASShortcutView (Bindings)
-
-- (NSString*) associatedUserDefaultsKey
-{
-    NSDictionary* bindingInfo = [self infoForBinding:MASShortcutBinding];
-    if (bindingInfo != nil) {
-        NSString *keyPath = [bindingInfo objectForKey:NSObservedKeyPathKey];
-        NSString *key = [keyPath stringByReplacingOccurrencesOfString:@"values." withString:@""];
-        return key;
-    } else {
-        return nil;
-    }
-}
-
-- (void) setAssociatedUserDefaultsKey: (NSString*) newKey withTransformer: (NSValueTransformer*) transformer
-{
-    // Break previous binding if any
-    NSString *currentKey = [self associatedUserDefaultsKey];
-    if (currentKey != nil) {
-        [self unbind:currentKey];
-    }
-
-    // Stop if the new binding is nil
-    if (newKey == nil) {
-        return;
-    }
-
-    NSDictionary *options = transformer ?
-        @{NSValueTransformerBindingOption:transformer} :
-        nil;
-
-    [self bind:MASShortcutBinding
-        toObject:[NSUserDefaultsController sharedUserDefaultsController]
-        withKeyPath:[@"values." stringByAppendingString:newKey]
-        options:options];
-}
-
-- (void) setAssociatedUserDefaultsKey: (NSString*) newKey withTransformerName: (NSString*) transformerName
-{
-    [self setAssociatedUserDefaultsKey:newKey withTransformer:[NSValueTransformer valueTransformerForName:transformerName]];
-}
-
-- (void) setAssociatedUserDefaultsKey: (NSString*) newKey
-{
-    [self setAssociatedUserDefaultsKey:newKey withTransformerName:NSKeyedUnarchiveFromDataTransformerName];
-}
-
-@end
diff --git a/Pods/MASShortcut/Framework/UI/MASShortcutView.h b/Pods/MASShortcut/Framework/UI/MASShortcutView.h
deleted file mode 100644
index 75d4eb333..000000000
--- a/Pods/MASShortcut/Framework/UI/MASShortcutView.h
+++ /dev/null
@@ -1,26 +0,0 @@
-@class MASShortcut, MASShortcutValidator;
-
-extern NSString *const MASShortcutBinding;
-
-typedef NS_ENUM(NSInteger, MASShortcutViewStyle) {
-    MASShortcutViewStyleDefault = 0,  // Height = 19 px
-    MASShortcutViewStyleTexturedRect, // Height = 25 px
-    MASShortcutViewStyleRounded,      // Height = 43 px
-    MASShortcutViewStyleFlat
-};
-
-@interface MASShortcutView : NSView
-
-@property (nonatomic, strong) MASShortcut *shortcutValue;
-@property (nonatomic, strong) MASShortcutValidator *shortcutValidator;
-@property (nonatomic, getter = isRecording) BOOL recording;
-@property (nonatomic, getter = isEnabled) BOOL enabled;
-@property (nonatomic, copy) void (^shortcutValueChange)(MASShortcutView *sender);
-@property (nonatomic, assign) MASShortcutViewStyle style;
-
-/// Returns custom class for drawing control.
-+ (Class)shortcutCellClass;
-
-- (void)setAcceptsFirstResponder:(BOOL)value;
-
-@end
diff --git a/Pods/MASShortcut/Framework/UI/MASShortcutView.m b/Pods/MASShortcut/Framework/UI/MASShortcutView.m
deleted file mode 100644
index 3a44df42e..000000000
--- a/Pods/MASShortcut/Framework/UI/MASShortcutView.m
+++ /dev/null
@@ -1,646 +0,0 @@
-#import "MASShortcutView.h"
-#import "MASShortcutValidator.h"
-#import "MASLocalization.h"
-
-NSString *const MASShortcutBinding = @"shortcutValue";
-
-static const CGFloat MASHintButtonWidth = 23;
-static const CGFloat MASButtonFontSize = 11;
-
-#pragma mark -
-
-@interface MASShortcutView () // Private accessors
-
-@property (nonatomic, getter = isHinting) BOOL hinting;
-@property (nonatomic, copy) NSString *shortcutPlaceholder;
-@property (nonatomic, assign) BOOL showsDeleteButton;
-
-@end
-
-#pragma mark -
-
-@implementation MASShortcutView {
-    NSButtonCell *_shortcutCell;
-    NSInteger _shortcutToolTipTag;
-    NSInteger _hintToolTipTag;
-    NSTrackingArea *_hintArea;
-    BOOL _acceptsFirstResponder;
-}
-
-#pragma mark -
-
-+ (Class)shortcutCellClass
-{
-    return [NSButtonCell class];
-}
-
-- (id)initWithFrame:(CGRect)frameRect
-{
-    self = [super initWithFrame:frameRect];
-    if (self) {
-        [self commonInit];
-    }
-    return self;
-}
-
-- (id)initWithCoder:(NSCoder *)coder
-{
-    self = [super initWithCoder:coder];
-    if (self) {
-        [self commonInit];
-    }
-    return self;
-}
-
-- (void)commonInit
-{
-    _shortcutCell = [[[self.class shortcutCellClass] alloc] init];
-    _shortcutCell.buttonType = NSPushOnPushOffButton;
-    _shortcutCell.font = [[NSFontManager sharedFontManager] convertFont:_shortcutCell.font toSize:MASButtonFontSize];
-    _shortcutValidator = [MASShortcutValidator sharedValidator];
-    _enabled = YES;
-    _showsDeleteButton = YES;
-    _acceptsFirstResponder = NO;
-    [self resetShortcutCellStyle];
-}
-
-- (void)dealloc
-{
-    [self activateEventMonitoring:NO];
-    [self activateResignObserver:NO];
-}
-
-#pragma mark - Public accessors
-
-- (void)setEnabled:(BOOL)flag
-{
-    if (_enabled != flag) {
-        _enabled = flag;
-        [self updateTrackingAreas];
-        self.recording = NO;
-        [self invalidateIntrinsicContentSize];
-        [self setNeedsDisplay:YES];
-    }
-}
-
-- (void)setStyle:(MASShortcutViewStyle)newStyle
-{
-    if (_style != newStyle) {
-        _style = newStyle;
-        [self resetShortcutCellStyle];
-        [self invalidateIntrinsicContentSize];
-        [self setNeedsDisplay:YES];
-    }
-}
-
-- (void)resetShortcutCellStyle
-{
-    switch (_style) {
-        case MASShortcutViewStyleDefault: {
-            _shortcutCell.bezelStyle = NSRoundRectBezelStyle;
-            break;
-        }
-        case MASShortcutViewStyleTexturedRect: {
-            _shortcutCell.bezelStyle = NSTexturedRoundedBezelStyle;
-            break;
-        }
-        case MASShortcutViewStyleRounded: {
-            _shortcutCell.bezelStyle = NSRoundedBezelStyle;
-            break;
-        }
-        case MASShortcutViewStyleFlat: {
-            self.wantsLayer = YES;
-            _shortcutCell.backgroundColor = [NSColor clearColor];
-            _shortcutCell.bordered = NO;
-            break;
-        }
-    }
-}
-
-- (void)setRecording:(BOOL)flag
-{
-    // Only one recorder can be active at the moment
-    static MASShortcutView *currentRecorder = nil;
-    if (flag && (currentRecorder != self)) {
-        currentRecorder.recording = NO;
-        currentRecorder = flag ? self : nil;
-    }
-    
-    // Only enabled view supports recording
-    if (flag && !self.enabled) return;
-
-    // Only care about changes in state
-    if (flag == _recording) return;
-
-    _recording = flag;
-    self.shortcutPlaceholder = nil;
-    [self resetToolTips];
-    [self activateEventMonitoring:_recording];
-    [self activateResignObserver:_recording];
-    [self invalidateIntrinsicContentSize];
-    [self setNeedsDisplay:YES];
-
-    // Give VoiceOver users feedback on the result. Requires at least 10.9 to run.
-    // We’re silencing the “tautological compare” warning here so that if someone
-    // takes the naked source files and compiles them with -Wall, the following
-    // NSAccessibilityPriorityKey comparison doesn’t cause a warning. See:
-    // https://github.com/shpakovski/MASShortcut/issues/76
-    #pragma clang diagnostic push
-    #pragma clang diagnostic ignored "-Wtautological-compare"
-    if (_recording == NO && (&NSAccessibilityPriorityKey != NULL)) {
-        NSString* msg = _shortcutValue ?
-                         MASLocalizedString(@"Shortcut set", @"VoiceOver: Shortcut set") :
-                         MASLocalizedString(@"Shortcut cleared", @"VoiceOver: Shortcut cleared");
-        NSDictionary *announcementInfo = @{
-            NSAccessibilityAnnouncementKey : msg,
-            NSAccessibilityPriorityKey : @(NSAccessibilityPriorityHigh),
-        };
-        NSAccessibilityPostNotificationWithUserInfo(self, NSAccessibilityAnnouncementRequestedNotification, announcementInfo);
-    }
-    #pragma clang diagnostic pop
-}
-
-- (void)setShortcutValue:(MASShortcut *)shortcutValue
-{
-    _shortcutValue = shortcutValue;
-    [self resetToolTips];
-    [self invalidateIntrinsicContentSize];
-    [self setNeedsDisplay:YES];
-    [self propagateValue:shortcutValue forBinding:MASShortcutBinding];
-
-    if (self.shortcutValueChange) {
-        self.shortcutValueChange(self);
-    }
-}
-
-- (void)setShortcutPlaceholder:(NSString *)shortcutPlaceholder
-{
-    _shortcutPlaceholder = shortcutPlaceholder.copy;
-    [self invalidateIntrinsicContentSize];
-    [self setNeedsDisplay:YES];
-}
-
-#pragma mark - Appearance
-
-- (BOOL)allowsVibrancy
-{
-    return YES;
-}
-
-#pragma mark - Drawing
-
-- (BOOL)isFlipped
-{
-    return YES;
-}
-
-- (void)drawInRect:(CGRect)frame withTitle:(NSString *)title alignment:(NSTextAlignment)alignment state:(NSInteger)state
-{
-    _shortcutCell.title = title;
-    _shortcutCell.alignment = alignment;
-    _shortcutCell.state = state;
-    _shortcutCell.enabled = self.enabled;
-
-    switch (_style) {
-        case MASShortcutViewStyleDefault: {
-            [_shortcutCell drawWithFrame:frame inView:self];
-            break;
-        }
-        case MASShortcutViewStyleTexturedRect: {
-            [_shortcutCell drawWithFrame:CGRectOffset(frame, 0.0, 1.0) inView:self];
-            break;
-        }
-        case MASShortcutViewStyleRounded: {
-            [_shortcutCell drawWithFrame:CGRectOffset(frame, 0.0, 1.0) inView:self];
-            break;
-        }
-        case MASShortcutViewStyleFlat: {
-            [_shortcutCell drawWithFrame:frame inView:self];
-            break;
-        }
-    }
-}
-
-- (void)drawRect:(CGRect)dirtyRect
-{
-    if (self.shortcutValue) {
-        NSString *buttonTitle;
-        if (self.recording) {
-            buttonTitle = NSStringFromMASKeyCode(kMASShortcutGlyphEscape);
-        } else if (self.showsDeleteButton) {
-            buttonTitle = NSStringFromMASKeyCode(kMASShortcutGlyphClear);
-        }
-        if (buttonTitle != nil) {
-            [self drawInRect:self.bounds withTitle:buttonTitle alignment:NSRightTextAlignment state:NSOffState];
-        }
-        CGRect shortcutRect;
-        [self getShortcutRect:&shortcutRect hintRect:NULL];
-        NSString *title = (self.recording
-                           ? (_hinting
-                              ? MASLocalizedString(@"Use Old Shortcut", @"Cancel action button for non-empty shortcut in recording state")
-                              : (self.shortcutPlaceholder.length > 0
-                                 ? self.shortcutPlaceholder
-                                 : MASLocalizedString(@"Type New Shortcut", @"Non-empty shortcut button in recording state")))
-                           : _shortcutValue ? _shortcutValue.description : @"");
-        [self drawInRect:shortcutRect withTitle:title alignment:NSCenterTextAlignment state:self.isRecording ? NSOnState : NSOffState];
-    }
-    else {
-        if (self.recording)
-        {
-            [self drawInRect:self.bounds withTitle:NSStringFromMASKeyCode(kMASShortcutGlyphEscape) alignment:NSRightTextAlignment state:NSOffState];
-            
-            CGRect shortcutRect;
-            [self getShortcutRect:&shortcutRect hintRect:NULL];
-            NSString *title = (_hinting
-                               ? MASLocalizedString(@"Cancel", @"Cancel action button in recording state")
-                               : (self.shortcutPlaceholder.length > 0
-                                  ? self.shortcutPlaceholder
-                                  : MASLocalizedString(@"Type Shortcut", @"Empty shortcut button in recording state")));
-            [self drawInRect:shortcutRect withTitle:title alignment:NSCenterTextAlignment state:NSOnState];
-        }
-        else
-        {
-            [self drawInRect:self.bounds withTitle:MASLocalizedString(@"Record Shortcut", @"Empty shortcut button in normal state")
-                   alignment:NSCenterTextAlignment state:NSOffState];
-        }
-    }
-}
-
-
-- (NSSize)intrinsicContentSize
-{
-    NSSize cellSize = _shortcutCell.cellSize;
-
-    // Use a "fake" value for width.  Since determining the actual width requires information
-    // that is not determined until drawRect: is called, it doesn't seem feasible to properly
-    // calculate the intrinsic size without refactoring the code.  That would give better results,
-    // however.
-
-    // 120 is an arbitray number that seems to be wide enough for English localization.  This
-    // may need to be adjusted for other locales/languages.
-
-    // NOTE:  Simply returning cellSize results in a display that is sometimes correct
-    // and sometimes not, and changes based on whether the mouse is hovering or not.
-    return NSMakeSize(120, cellSize.height);
-}
-
-
-#pragma mark - Mouse handling
-
-- (void)getShortcutRect:(CGRect *)shortcutRectRef hintRect:(CGRect *)hintRectRef
-{
-    CGRect shortcutRect, hintRect;
-    CGFloat hintButtonWidth = MASHintButtonWidth;
-    switch (self.style) {
-        case MASShortcutViewStyleTexturedRect: hintButtonWidth += 2.0; break;
-        case MASShortcutViewStyleRounded: hintButtonWidth += 3.0; break;
-        case MASShortcutViewStyleFlat: hintButtonWidth -= 8.0 - (_shortcutCell.font.pointSize - MASButtonFontSize); break;
-        default: break;
-    }
-    CGRectDivide(self.bounds, &hintRect, &shortcutRect, hintButtonWidth, CGRectMaxXEdge);
-    if (shortcutRectRef)  *shortcutRectRef = shortcutRect;
-    if (hintRectRef) *hintRectRef = hintRect;
-}
-
-- (BOOL)locationInShortcutRect:(CGPoint)location
-{
-    CGRect shortcutRect;
-    [self getShortcutRect:&shortcutRect hintRect:NULL];
-    return CGRectContainsPoint(shortcutRect, [self convertPoint:location fromView:nil]);
-}
-
-- (BOOL)locationInHintRect:(CGPoint)location
-{
-    CGRect hintRect;
-    [self getShortcutRect:NULL hintRect:&hintRect];
-    return CGRectContainsPoint(hintRect, [self convertPoint:location fromView:nil]);
-}
-
-- (void)mouseDown:(NSEvent *)event
-{
-    if (self.enabled) {
-        if (self.shortcutValue) {
-            if (self.recording) {
-                if ([self locationInHintRect:event.locationInWindow]) {
-                    self.recording = NO;
-                }
-            }
-            else {
-                if ([self locationInShortcutRect:event.locationInWindow]) {
-                    self.recording = YES;
-                }
-                else {
-                    self.shortcutValue = nil;
-                }
-            }
-        }
-        else {
-            if (self.recording) {
-                if ([self locationInHintRect:event.locationInWindow]) {
-                    self.recording = NO;
-                }
-            }
-            else {
-                self.recording = YES;
-            }
-        }
-    }
-    else {
-        [super mouseDown:event];
-    }
-}
-
-#pragma mark - Handling mouse over
-
-- (void)updateTrackingAreas
-{
-    [super updateTrackingAreas];
-    
-    if (_hintArea) {
-        [self removeTrackingArea:_hintArea];
-        _hintArea = nil;
-    }
-    
-    // Forbid hinting if view is disabled
-    if (!self.enabled) return;
-    
-    CGRect hintRect;
-    [self getShortcutRect:NULL hintRect:&hintRect];
-    NSTrackingAreaOptions options = (NSTrackingMouseEnteredAndExited | NSTrackingActiveAlways | NSTrackingAssumeInside);
-    _hintArea = [[NSTrackingArea alloc] initWithRect:hintRect options:options owner:self userInfo:nil];
-    [self addTrackingArea:_hintArea];
-}
-
-- (void)setHinting:(BOOL)flag
-{
-    if (_hinting != flag) {
-        _hinting = flag;
-        [self invalidateIntrinsicContentSize];
-        [self setNeedsDisplay:YES];
-    }
-}
-
-- (void)mouseEntered:(NSEvent *)event
-{
-    self.hinting = YES;
-}
-
-- (void)mouseExited:(NSEvent *)event
-{
-    self.hinting = NO;
-}
-
-void *kUserDataShortcut = &kUserDataShortcut;
-void *kUserDataHint = &kUserDataHint;
-
-- (void)resetToolTips
-{
-    if (_shortcutToolTipTag) {
-        [self removeToolTip:_shortcutToolTipTag];
-        _shortcutToolTipTag = 0;
-    }
-    if (_hintToolTipTag) {
-        [self removeToolTip:_hintToolTipTag];
-        _hintToolTipTag = 0;
-    }
-    
-    if ((self.shortcutValue == nil) || self.recording || !self.enabled) return;
-
-    CGRect shortcutRect, hintRect;
-    [self getShortcutRect:&shortcutRect hintRect:&hintRect];
-    _shortcutToolTipTag = [self addToolTipRect:shortcutRect owner:self userData:kUserDataShortcut];
-    _hintToolTipTag = [self addToolTipRect:hintRect owner:self userData:kUserDataHint];
-}
-
-- (NSString *)view:(NSView *)view stringForToolTip:(NSToolTipTag)tag point:(CGPoint)point userData:(void *)data
-{
-    if (data == kUserDataShortcut) {
-        return MASLocalizedString(@"Click to record new shortcut", @"Tooltip for non-empty shortcut button");
-    }
-    else if (data == kUserDataHint) {
-        return MASLocalizedString(@"Delete shortcut", @"Tooltip for hint button near the non-empty shortcut");
-    }
-    return @"";
-}
-
-#pragma mark - Event monitoring
-
-- (void)activateEventMonitoring:(BOOL)shouldActivate
-{
-    static BOOL isActive = NO;
-    if (isActive == shouldActivate) return;
-    isActive = shouldActivate;
-    
-    static id eventMonitor = nil;
-    if (shouldActivate) {
-        __unsafe_unretained MASShortcutView *weakSelf = self;
-        NSEventMask eventMask = (NSKeyDownMask | NSFlagsChangedMask);
-        eventMonitor = [NSEvent addLocalMonitorForEventsMatchingMask:eventMask handler:^(NSEvent *event) {
-
-            // Create a shortcut from the event
-            MASShortcut *shortcut = [MASShortcut shortcutWithEvent:event];
-
-            // Tab key must pass through.
-            if (shortcut.keyCode == kVK_Tab){
-                return event;
-            }
-
-            // If the shortcut is a plain Delete or Backspace, clear the current shortcut and cancel recording
-            if (!shortcut.modifierFlags && ((shortcut.keyCode == kVK_Delete) || (shortcut.keyCode == kVK_ForwardDelete))) {
-                weakSelf.shortcutValue = nil;
-                weakSelf.recording = NO;
-                event = nil;
-            }
-
-            // If the shortcut is a plain Esc, cancel recording
-            else if (!shortcut.modifierFlags && shortcut.keyCode == kVK_Escape) {
-                weakSelf.recording = NO;
-                event = nil;
-            }
-
-            // If the shortcut is Cmd-W or Cmd-Q, cancel recording and pass the event through
-            else if ((shortcut.modifierFlags == NSCommandKeyMask) && (shortcut.keyCode == kVK_ANSI_W || shortcut.keyCode == kVK_ANSI_Q)) {
-                weakSelf.recording = NO;
-            }
-
-            else {
-                // Verify possible shortcut
-                if (shortcut.keyCodeString.length > 0) {
-                    if (!weakSelf.shortcutValidator || [weakSelf.shortcutValidator isShortcutValid:shortcut]) {
-                        // Verify that shortcut is not used
-                        NSString *explanation = nil;
-                        if ([weakSelf.shortcutValidator isShortcutAlreadyTakenBySystem:shortcut explanation:&explanation]) {
-                            // Prevent cancel of recording when Alert window is key
-                            [weakSelf activateResignObserver:NO];
-                            [weakSelf activateEventMonitoring:NO];
-                            NSString *format = MASLocalizedString(@"The key combination %@ cannot be used",
-                                                                 @"Title for alert when shortcut is already used");
-                            NSAlert* alert = [[NSAlert alloc]init];
-                            alert.alertStyle = NSCriticalAlertStyle;
-                            alert.informativeText = explanation;
-                            alert.messageText = [NSString stringWithFormat:format, shortcut];
-                            [alert addButtonWithTitle:MASLocalizedString(@"OK", @"Alert button when shortcut is already used")];
-
-                            [alert runModal];
-                            weakSelf.shortcutPlaceholder = nil;
-                            [weakSelf activateResignObserver:YES];
-                            [weakSelf activateEventMonitoring:YES];
-                        }
-                        else {
-                            weakSelf.shortcutValue = shortcut;
-                            weakSelf.recording = NO;
-                        }
-                    }
-                    else {
-                        // Key press with or without SHIFT is not valid input
-                        NSBeep();
-                    }
-                }
-                else {
-                    // User is playing with modifier keys
-                    weakSelf.shortcutPlaceholder = shortcut.modifierFlagsString;
-                }
-                event = nil;
-            }
-            return event;
-        }];
-    }
-    else {
-        [NSEvent removeMonitor:eventMonitor];
-    }
-}
-
-- (void)activateResignObserver:(BOOL)shouldActivate
-{
-    static BOOL isActive = NO;
-    if (isActive == shouldActivate) return;
-    isActive = shouldActivate;
-    
-    static id observer = nil;
-    NSNotificationCenter *notificationCenter = [NSNotificationCenter defaultCenter];
-    if (shouldActivate) {
-        __unsafe_unretained MASShortcutView *weakSelf = self;
-        observer = [notificationCenter addObserverForName:NSWindowDidResignKeyNotification object:self.window
-                                                queue:[NSOperationQueue mainQueue] usingBlock:^(NSNotification *notification) {
-                                                    weakSelf.recording = NO;
-                                                }];
-    }
-    else {
-        [notificationCenter removeObserver:observer];
-    }
-}
-
-#pragma mark Bindings
-
-// http://tomdalling.com/blog/cocoa/implementing-your-own-cocoa-bindings/
--(void) propagateValue:(id)value forBinding:(NSString*)binding
-{
-    NSParameterAssert(binding != nil);
-
-    //WARNING: bindingInfo contains NSNull, so it must be accounted for
-    NSDictionary* bindingInfo = [self infoForBinding:binding];
-    if(!bindingInfo)
-        return; //there is no binding
-
-    //apply the value transformer, if one has been set
-    NSDictionary* bindingOptions = [bindingInfo objectForKey:NSOptionsKey];
-    if(bindingOptions){
-        NSValueTransformer* transformer = [bindingOptions valueForKey:NSValueTransformerBindingOption];
-        if(!transformer || (id)transformer == [NSNull null]){
-            NSString* transformerName = [bindingOptions valueForKey:NSValueTransformerNameBindingOption];
-            if(transformerName && (id)transformerName != [NSNull null]){
-                transformer = [NSValueTransformer valueTransformerForName:transformerName];
-            }
-        }
-
-        if(transformer && (id)transformer != [NSNull null]){
-            if([[transformer class] allowsReverseTransformation]){
-                value = [transformer reverseTransformedValue:value];
-            } else {
-                NSLog(@"WARNING: binding \"%@\" has value transformer, but it doesn't allow reverse transformations in %s", binding, __PRETTY_FUNCTION__);
-            }
-        }
-    }
-
-    id boundObject = [bindingInfo objectForKey:NSObservedObjectKey];
-    if(!boundObject || boundObject == [NSNull null]){
-        NSLog(@"ERROR: NSObservedObjectKey was nil for binding \"%@\" in %s", binding, __PRETTY_FUNCTION__);
-        return;
-    }
-
-    NSString* boundKeyPath = [bindingInfo objectForKey:NSObservedKeyPathKey];
-    if(!boundKeyPath || (id)boundKeyPath == [NSNull null]){
-        NSLog(@"ERROR: NSObservedKeyPathKey was nil for binding \"%@\" in %s", binding, __PRETTY_FUNCTION__);
-        return;
-    }
-
-    [boundObject setValue:value forKeyPath:boundKeyPath];
-}
-
-#pragma mark - Accessibility
-
-- (NSString *)accessibilityHelp
-{
-    return MASLocalizedString(@"To record a new shortcut, click this button, and then type the"
-                             @" new shortcut, or press delete to clear an existing shortcut.",
-                             @"VoiceOver shortcut help");
-}
-
-- (NSString *)accessibilityLabel
-{
-    NSString* title = _shortcutValue.description ?: @"Empty";
-    title = [title stringByAppendingFormat:@" %@", MASLocalizedString(@"keyboard shortcut", @"VoiceOver title")];
-    return title;
-}
-
-- (BOOL)accessibilityPerformPress
-{
-    if (self.isRecording == NO) {
-        self.recording = YES;
-        return YES;
-    }
-    else {
-        return NO;
-    }
-}
-
-- (NSString *)accessibilityRole
-{
-    return NSAccessibilityButtonRole;
-}
-
-- (BOOL)acceptsFirstResponder
-{
-    return _acceptsFirstResponder;
-}
-
-- (void)setAcceptsFirstResponder:(BOOL)value
-{
-    _acceptsFirstResponder = value;
-}
-
-- (BOOL)becomeFirstResponder
-{
-    [self invalidateIntrinsicContentSize];
-    [self setNeedsDisplay:YES];
-    return [super becomeFirstResponder];
-}
-
-- (BOOL)resignFirstResponder
-{
-    [self invalidateIntrinsicContentSize];
-    [self setNeedsDisplay:YES];
-    return [super resignFirstResponder];
-}
-
-- (void)drawFocusRingMask
-{
-    [_shortcutCell drawFocusRingMaskWithFrame:[self bounds] inView:self];
-}
-
-- (NSRect)focusRingMaskBounds
-{
-    return [self bounds];
-}
-
-@end
diff --git a/Pods/MASShortcut/Framework/User Defaults Storage/MASDictionaryTransformer.h b/Pods/MASShortcut/Framework/User Defaults Storage/MASDictionaryTransformer.h
deleted file mode 100644
index 6e53fd8b0..000000000
--- a/Pods/MASShortcut/Framework/User Defaults Storage/MASDictionaryTransformer.h	
+++ /dev/null
@@ -1,19 +0,0 @@
-extern NSString *const MASDictionaryTransformerName;
-
-/**
- Converts shortcuts for storage in user defaults.
-
- User defaults can’t stored custom types directly, they have to
- be serialized to `NSData` or some other supported type like an
- `NSDictionary`. In Cocoa Bindings, the conversion can be done
- using value transformers like this one.
-
- There’s a built-in transformer (`NSKeyedUnarchiveFromDataTransformerName`)
- that converts any `NSCoding` types to `NSData`, but with shortcuts
- it makes sense to use a dictionary instead – the defaults look better
- when inspected with the `defaults` command-line utility and the
- format is compatible with an older sortcut library called Shortcut
- Recorder.
-*/
-@interface MASDictionaryTransformer : NSValueTransformer
-@end
diff --git a/Pods/MASShortcut/Framework/User Defaults Storage/MASDictionaryTransformer.m b/Pods/MASShortcut/Framework/User Defaults Storage/MASDictionaryTransformer.m
deleted file mode 100644
index 9e4c82b4b..000000000
--- a/Pods/MASShortcut/Framework/User Defaults Storage/MASDictionaryTransformer.m	
+++ /dev/null
@@ -1,51 +0,0 @@
-#import "MASDictionaryTransformer.h"
-#import "MASShortcut.h"
-
-NSString *const MASDictionaryTransformerName = @"MASDictionaryTransformer";
-
-static NSString *const MASKeyCodeKey = @"keyCode";
-static NSString *const MASModifierFlagsKey = @"modifierFlags";
-
-@implementation MASDictionaryTransformer
-
-+ (BOOL) allowsReverseTransformation
-{
-    return YES;
-}
-
-// Storing nil values as an empty dictionary lets us differ between
-// “not available, use default value” and “explicitly set to none”.
-// See http://stackoverflow.com/questions/5540760 for details.
-- (NSDictionary*) reverseTransformedValue: (MASShortcut*) shortcut
-{
-    if (shortcut == nil) {
-        return [NSDictionary dictionary];
-    } else {
-        return @{
-            MASKeyCodeKey: @([shortcut keyCode]),
-            MASModifierFlagsKey: @([shortcut modifierFlags])
-        };
-    }
-}
-
-- (MASShortcut*) transformedValue: (NSDictionary*) dictionary
-{
-    // We have to be defensive here as the value may come from user defaults.
-    if (![dictionary isKindOfClass:[NSDictionary class]]) {
-        return nil;
-    }
-
-    id keyCodeBox = [dictionary objectForKey:MASKeyCodeKey];
-    id modifierFlagsBox = [dictionary objectForKey:MASModifierFlagsKey];
-
-    SEL integerValue = @selector(integerValue);
-    if (![keyCodeBox respondsToSelector:integerValue] || ![modifierFlagsBox respondsToSelector:integerValue]) {
-        return nil;
-    }
-
-    return [MASShortcut
-        shortcutWithKeyCode:[keyCodeBox integerValue]
-        modifierFlags:[modifierFlagsBox integerValue]];
-}
-
-@end
diff --git a/Pods/MASShortcut/Framework/User Defaults Storage/MASShortcutBinder.h b/Pods/MASShortcut/Framework/User Defaults Storage/MASShortcutBinder.h
deleted file mode 100644
index e7406dee2..000000000
--- a/Pods/MASShortcut/Framework/User Defaults Storage/MASShortcutBinder.h	
+++ /dev/null
@@ -1,67 +0,0 @@
-#import "MASShortcutMonitor.h"
-
-/**
- Binds actions to user defaults keys.
-
- If you store shortcuts in user defaults (for example by binding
- a `MASShortcutView` to user defaults), you can use this class to
- connect an action directly to a user defaults key. If the shortcut
- stored under the key changes, the action will get automatically
- updated to the new one.
-
- This class is mostly a wrapper around a `MASShortcutMonitor`. It
- watches the changes in user defaults and updates the shortcut monitor
- accordingly with the new shortcuts.
-*/
-@interface MASShortcutBinder : NSObject
-
-/**
- A convenience shared instance.
-
- You may use it so that you don’t have to manage an instance by hand,
- but it’s perfectly fine to allocate and use a separate instance instead.
-*/
-+ (instancetype) sharedBinder;
-
-/**
- The underlying shortcut monitor.
-*/
-@property(strong) MASShortcutMonitor *shortcutMonitor;
-
-/**
- Binding options customizing the access to user defaults.
-
- As an example, you can use `NSValueTransformerNameBindingOption` to customize
- the storage format used for the shortcuts. By default the shortcuts are converted
- from `NSData` (`NSKeyedUnarchiveFromDataTransformerName`). Note that if the
- binder is to work with `MASShortcutView`, both object have to use the same storage
- format.
-*/
-@property(copy) NSDictionary *bindingOptions;
-
-/**
- Binds given action to a shortcut stored under the given defaults key.
-
- In other words, no matter what shortcut you store under the given key,
- pressing it will always trigger the given action.
-*/
-- (void) bindShortcutWithDefaultsKey: (NSString*) defaultsKeyName toAction: (dispatch_block_t) action;
-
-/**
- Disconnect the binding between user defaults and action.
-
- In other words, the shortcut stored under the given key will no longer trigger an action.
-*/
-- (void) breakBindingWithDefaultsKey: (NSString*) defaultsKeyName;
-
-/**
- Register default shortcuts in user defaults.
-
- This is a convenience frontent to `[NSUserDefaults registerDefaults]`.
- The dictionary should contain a map of user defaults’ keys to appropriate
- keyboard shortcuts. The shortcuts will be transformed according to
- `bindingOptions` and registered using `registerDefaults`.
-*/
-- (void) registerDefaultShortcuts: (NSDictionary*) defaultShortcuts;
-
-@end
diff --git a/Pods/MASShortcut/Framework/User Defaults Storage/MASShortcutBinder.m b/Pods/MASShortcut/Framework/User Defaults Storage/MASShortcutBinder.m
deleted file mode 100644
index 4c0d7f9ae..000000000
--- a/Pods/MASShortcut/Framework/User Defaults Storage/MASShortcutBinder.m	
+++ /dev/null
@@ -1,121 +0,0 @@
-#import "MASShortcutBinder.h"
-#import "MASShortcut.h"
-
-@interface MASShortcutBinder ()
-@property(strong) NSMutableDictionary *actions;
-@property(strong) NSMutableDictionary *shortcuts;
-@end
-
-@implementation MASShortcutBinder
-
-#pragma mark Initialization
-
-- (id) init
-{
-    self = [super init];
-    [self setActions:[NSMutableDictionary dictionary]];
-    [self setShortcuts:[NSMutableDictionary dictionary]];
-    [self setShortcutMonitor:[MASShortcutMonitor sharedMonitor]];
-    [self setBindingOptions:@{NSValueTransformerNameBindingOption: NSKeyedUnarchiveFromDataTransformerName}];
-    return self;
-}
-
-- (void) dealloc
-{
-    for (NSString *bindingName in [_actions allKeys]) {
-        [self unbind:bindingName];
-    }
-}
-
-+ (instancetype) sharedBinder
-{
-    static dispatch_once_t once;
-    static MASShortcutBinder *sharedInstance;
-    dispatch_once(&once, ^{
-        sharedInstance = [[self alloc] init];
-    });
-    return sharedInstance;
-}
-
-#pragma mark Registration
-
-- (void) bindShortcutWithDefaultsKey: (NSString*) defaultsKeyName toAction: (dispatch_block_t) action
-{
-    NSAssert([defaultsKeyName rangeOfString:@"."].location == NSNotFound,
-        @"Illegal character in binding name (“.”), please see http://git.io/x5YS.");
-    NSAssert([defaultsKeyName rangeOfString:@" "].location == NSNotFound,
-        @"Illegal character in binding name (“ ”), please see http://git.io/x5YS.");
-    [_actions setObject:[action copy] forKey:defaultsKeyName];
-    [self bind:defaultsKeyName
-        toObject:[NSUserDefaultsController sharedUserDefaultsController]
-        withKeyPath:[@"values." stringByAppendingString:defaultsKeyName]
-        options:_bindingOptions];
-}
-
-- (void) breakBindingWithDefaultsKey: (NSString*) defaultsKeyName
-{
-    [_shortcutMonitor unregisterShortcut:[_shortcuts objectForKey:defaultsKeyName]];
-    [_shortcuts removeObjectForKey:defaultsKeyName];
-    [_actions removeObjectForKey:defaultsKeyName];
-    [self unbind:defaultsKeyName];
-}
-
-- (void) registerDefaultShortcuts: (NSDictionary*) defaultShortcuts
-{
-    NSValueTransformer *transformer = [_bindingOptions valueForKey:NSValueTransformerBindingOption];
-    if (transformer == nil) {
-        NSString *transformerName = [_bindingOptions valueForKey:NSValueTransformerNameBindingOption];
-        if (transformerName) {
-            transformer = [NSValueTransformer valueTransformerForName:transformerName];
-        }
-    }
-
-    NSAssert(transformer != nil, @"Can’t register default shortcuts without a transformer.");
-
-    [defaultShortcuts enumerateKeysAndObjectsUsingBlock:^(NSString *defaultsKey, MASShortcut *shortcut, BOOL *stop) {
-        id value = [transformer reverseTransformedValue:shortcut];
-        [[NSUserDefaults standardUserDefaults] registerDefaults:@{defaultsKey:value}];
-    }];
-}
-
-#pragma mark Bindings
-
-- (BOOL) isRegisteredAction: (NSString*) name
-{
-    return !![_actions objectForKey:name];
-}
-
-- (id) valueForUndefinedKey: (NSString*) key
-{
-    return [self isRegisteredAction:key] ?
-        [_shortcuts objectForKey:key] :
-        [super valueForUndefinedKey:key];
-}
-
-- (void) setValue: (id) value forUndefinedKey: (NSString*) key
-{
-    if (![self isRegisteredAction:key]) {
-        [super setValue:value forUndefinedKey:key];
-        return;
-    }
-
-    MASShortcut *newShortcut = value;
-    MASShortcut *currentShortcut = [_shortcuts objectForKey:key];
-
-    // Unbind previous shortcut if any
-    if (currentShortcut != nil) {
-        [_shortcutMonitor unregisterShortcut:currentShortcut];
-    }
-
-    // Just deleting the old shortcut
-    if (newShortcut == nil) {
-        [_shortcuts removeObjectForKey:key];
-        return;
-    }
-
-    // Bind new shortcut
-    [_shortcuts setObject:newShortcut forKey:key];
-    [_shortcutMonitor registerShortcut:newShortcut withAction:[_actions objectForKey:key]];
-}
-
-@end
diff --git a/Pods/MASShortcut/LICENSE b/Pods/MASShortcut/LICENSE
deleted file mode 100644
index e7686315f..000000000
--- a/Pods/MASShortcut/LICENSE
+++ /dev/null
@@ -1,22 +0,0 @@
-Copyright (c) 2012-2013, Vadim Shpakovski
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/Pods/MASShortcut/README.md b/Pods/MASShortcut/README.md
deleted file mode 100644
index d10ba1abe..000000000
--- a/Pods/MASShortcut/README.md
+++ /dev/null
@@ -1,136 +0,0 @@
-[![Build Status](https://travis-ci.org/shpakovski/MASShortcut.svg?branch=master)](https://travis-ci.org/shpakovski/MASShortcut)
-[![Carthage compatible](https://img.shields.io/badge/Carthage-compatible-4BC51D.svg?style=flat)](https://github.com/Carthage/Carthage)
-
-# Intro
-
-Some time ago Cocoa developers used a brilliant framework [ShortcutRecorder](http://wafflesoftware.net/shortcut/) for managing keyboard shortcuts in application preferences. However, it became incompatible with the new plugin architecture of Xcode 4.
-
-The MASShortcut project introduces a modern API and user interface for recording, storing and using system-wide keyboard shortcuts.
-
-![Screenshot of the demo project](https://raw.githubusercontent.com/shpakovski/MASShortcut/master/Demo/screenshot.png "This is how the demo looks like")
-
-Features:
-
-* Record and display keyboard shortcuts
-* Watch for shortcuts and execute actions, system-wide
-* A nice, [documented API](http://cocoadocs.org/docsets/MASShortcut/)
-* Can be configured to be compatible with Shortcut Recorder
-* Can be installed both through CocoaPods and as a Git submodule
-* Mac App Store friendly
-* Works on OS X 10.10 and up
-* Hacking-friendly codebase covered with tests
-
-Partially done:
-
-* Accessibility support. There’s some basic accessibility code, testers and feedback welcome.
-* Localisation. The English and Czech localization should be complete, there’s basic support for German, French, Spanish, Italian, and Japanese. If you’re a native speaker in one of the mentioned languages, please test the localization and report issues or add missing strings.
-
-Pull requests welcome :)
-
-# Installation
-
-You can use [CocoaPods](http://cocoapods.org/), adding the following line to your Podfile:
-
-    pod 'MASShortcut'
-
-If you want to stick to the 1.x branch, you can use the version smart match operator:
-
-    pod 'MASShortcut', '~> 1'
-
-You can also install via [Carthage](https://github.com/Carthage/Carthage), or you can use Git submodules and link against the MASShortcut framework manually.
-
-To build from the command line, type 'make release'. The framework will be created in a temporary directory and revealed in Finder when the build is complete.
-
-# Usage
-
-I hope, it is really easy:
-
-```objective-c
-#import <MASShortcut/Shortcut.h>
-
-// Drop a custom view into XIB, set its class to MASShortcutView
-// and its height to 19. If you select another appearance style,
-// look up the correct height values in MASShortcutView.h.
-@property (nonatomic, weak) IBOutlet MASShortcutView *shortcutView;
-
-// Pick a preference key to store the shortcut between launches
-static NSString *const kPreferenceGlobalShortcut = @"GlobalShortcut";
-
-// Associate the shortcut view with user defaults
-self.shortcutView.associatedUserDefaultsKey = kPreferenceGlobalShortcut;
-
-// Associate the preference key with an action
-[[MASShortcutBinder sharedBinder]
-    bindShortcutWithDefaultsKey:kPreferenceGlobalShortcut
-    toAction:^{
-    // Let me know if you find a better or a more convenient API.
-}];
-```
-
-You can see a real usage example in the Demo target. Enjoy!
-
-# Shortcut Recorder Compatibility
-
-By default, MASShortcut uses a different User Defaults storage format incompatible with Shortcut Recorder. But it’s easily possible to change that, so that you can replace Shortcut Recorder with MASShortcut without having to migrate the shortcuts previously stored by your apps. There are two parts of the story:
-
-If you bind the recorder control (`MASShortcutView`) to User defaults, set the Value Transformer field in the Interface Builder to `MASDictionaryTransformer`. This makes sure the shortcuts are written in the Shortcut Recorder format.
-
-If you use `MASShortcutBinder` to automatically load shortcuts from User Defaults, set the `bindingOptions` accordingly:
-
-```objective-c
-[[MASShortcutBinder sharedBinder] setBindingOptions:@{NSValueTransformerNameBindingOption:MASDictionaryTransformerName}];
-```
-
-This makes sure that the shortcuts in the Shortcut Recorder format are loaded correctly.
-
-# Notifications
-
-By registering for KVO notifications from `NSUserDefaultsController`, you can get a callback whenever a user changes the shortcut, allowing you to perform any UI updates, or other code handling tasks.
-
-This is just as easy to implement:
-    
-```objective-c
-// Declare an ivar for key path in the user defaults controller
-NSString *_observableKeyPath;
-    
-// Make a global context reference
-void *kGlobalShortcutContext = &kGlobalShortcutContext;
-    
-// Implement when loading view
-_observableKeyPath = [@"values." stringByAppendingString:kPreferenceGlobalShortcut];
-[[NSUserDefaultsController sharedUserDefaultsController] addObserver:self forKeyPath:_observableKeyPath
-                                                             options:NSKeyValueObservingOptionInitial
-                                                             context:kGlobalShortcutContext];
-
-// Capture the KVO change and do something
-- (void)observeValueForKeyPath:(NSString *)keyPath ofObject:(id)obj
-                        change:(NSDictionary *)change context:(void *)ctx
-{
-    if (ctx == kGlobalShortcutContext) {
-        NSLog(@"Shortcut has changed");
-    }
-    else {
-        [super observeValueForKeyPath:keyPath ofObject:obj change:change context:ctx];
-    }
-}
-
-// Do not forget to remove the observer
-[[NSUserDefaultsController sharedUserDefaultsController] removeObserver:self
-                                                             forKeyPath:_observableKeyPath
-                                                                context:kGlobalShortcutContext];
-```
-
-# Using in Swift projects
-
-  1. Install as a Pod using the latest CocoaPods with Swift support.
-  2. Create a bridging header file [using the instructions here](http://swiftalicio.us/2014/11/using-cocoapods-from-swift/)
-  3. Your bridging header file should contain the following [two](https://github.com/shpakovski/MASShortcut/issues/36) imports:
-
-```objective-c
-#import <Cocoa/Cocoa.h>
-#import <MASShortcut/Shortcut.h>
-```
-
-# Copyright
-
-MASShortcut is licensed under the 2-clause BSD license.
diff --git a/Pods/MASShortcut/Resources/cs.lproj/Localizable.strings b/Pods/MASShortcut/Resources/cs.lproj/Localizable.strings
deleted file mode 100644
index afefe2bb0..000000000
--- a/Pods/MASShortcut/Resources/cs.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Zrušit";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Kliknutím nahrajete novou zkratku";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Smazat zkratku";
-
-/* VoiceOver title */
-"keyboard shortcut" = "klávesová zkratka";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Nahrát zkratku";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "zkratka smazána";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "zkratka nastavena";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Mezerník";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "Kombinace %@ se nedá použít";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Tato zkratka se nedá použít, protože už ji obsadil systém.\nKdybyste na ní trvali, většina systémových zkratek se dá přenastavit v Předvolbách systému.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Tato zkratka se nedá použít, protože už je použita pro menu (%@).";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "Pokud chcete nahrát novou zkratku, stiskněte toto tlačítko a následně vybranou zkratku. Stisknutím Delete vymažete stávající zkratku.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Stiskněte zkratku";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Stiskněte zkratku";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Vrátit se k původní";
diff --git a/Pods/MASShortcut/Resources/de.lproj/Localizable.strings b/Pods/MASShortcut/Resources/de.lproj/Localizable.strings
deleted file mode 100644
index 986cdba51..000000000
--- a/Pods/MASShortcut/Resources/de.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Abbrechen";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Klicken um neuen Kurzbefehl aufzunehmen";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Kurzbefehl Löschen";
-
-/* VoiceOver title */
-"keyboard shortcut" = "Kurzbefehl";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Kurzbefehl aufnehmen";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Kurzbefehl gelöscht";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Kurzbefehl gesetzt";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Leertaste";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "Die Tastenkombination %@ kann nicht genutzt werden";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Diese Kombination kann nicht genutzt werden, weil sie bereits als systemweiter Kurzbefehl genutzt wird.\nFalls du diese Tastenkombination wirklich benutzen willst, können die meisten Kurzbefehle in den Tastatur Systemeinstellungen geändert werden.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Dieser Kurzbefehl kann nicht genutzt werden, weil er bereits vom Menüpunkt „%@“ genutzt wird.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "Drücke diesen Button, um einen neuen Kurzbefehl aufzunehmen. Tippe dann den neuen Kurzbefehl oder drücke Löschen, um den aktuellen Kurzbefehl zu löschen.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Neuen eingeben";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Kurzbefehl eingeben";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Alten nutzen";
diff --git a/Pods/MASShortcut/Resources/en.lproj/Localizable.strings b/Pods/MASShortcut/Resources/en.lproj/Localizable.strings
deleted file mode 100644
index bfa60a96f..000000000
--- a/Pods/MASShortcut/Resources/en.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Cancel";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Click to record new shortcut";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Delete shortcut";
-
-/* VoiceOver title */
-"keyboard shortcut" = "keyboard shortcut";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Record Shortcut";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Shortcut cleared";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Shortcut set";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Space";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "The key combination %@ cannot be used";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "This shortcut cannot be used because it is already used by the menu item ‘%@’.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Type New Shortcut";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Type Shortcut";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Use Old Shortcut";
diff --git a/Pods/MASShortcut/Resources/es.lproj/Localizable.strings b/Pods/MASShortcut/Resources/es.lproj/Localizable.strings
deleted file mode 100644
index 55362cfec..000000000
--- a/Pods/MASShortcut/Resources/es.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Cancelar";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Haga clic para grabar nuevo atajo";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Borrar atajo";
-
-/* VoiceOver title */
-"keyboard shortcut" = "atajo de teklado";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Grabar atajo";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Atajo borrado";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Atajo creado";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Espacio";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "La combinación de claves %@ no se puede utilizada";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Esta combinación no se puede utilizar debido a que ya es en us como atajo del sistema.\nSi realmente desea utilizar esta combinación de teclas, la mayoría de los atajos se puede cambiar en el panel de Teclado y Ratón de Preferencias del Sistema.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Este atajo no se puede utilizar debido a que ya es utilizado por el elemento de menú '%@'.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "Para grabar un nuevo atajo, haga clic en este botón, a continuar, escriba el nuevo atajo, o pulse borrar para qutar un atajo existente.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Escribir atajo";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Escribir atajo";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Usa atajo anterior";
\ No newline at end of file
diff --git a/Pods/MASShortcut/Resources/fr.lproj/Localizable.strings b/Pods/MASShortcut/Resources/fr.lproj/Localizable.strings
deleted file mode 100644
index 003dbacf2..000000000
--- a/Pods/MASShortcut/Resources/fr.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Annuler";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Cliquez pour enregistrer le raccourci";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Supprimer le raccourci";
-
-/* VoiceOver title */
-"keyboard shortcut" = "raccourci clavier";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Enregistrer le raccourci";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Raccourci supprimé";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Raccourci configuré";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Espace";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "La combinaison %@ ne peut être utilisée";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Cette combinaison de touches ne peut être utilisée parce qu’elle est réservée pour un raccourci du système.\nSi vous désirez l’utiliser, la plupart des raccourcis peuvent être modifiés dans l’onglet Clavier, dans Préférences Système.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Ce raccourci ne peut être utilisé parce qu’il est déjà utilisé par le point de menu «%@».";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "Pour enregistrer un nouveau raccourci, cliquez sur ce bouton et tapez le nouveau raccourci, ou bien, tapez sur «Supprimer» pour supprimer le raccourci configuré.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Saisir un raccourci";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Saisir un raccourci";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Revenir au raccourci précédent";
diff --git a/Pods/MASShortcut/Resources/it.lproj/Localizable.strings b/Pods/MASShortcut/Resources/it.lproj/Localizable.strings
deleted file mode 100644
index 53ec56087..000000000
--- a/Pods/MASShortcut/Resources/it.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Annulla";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Cliccare per registrare una nuova combinazione";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Cancella scorciatoia";
-
-/* VoiceOver title */
-"keyboard shortcut" = "Scorciatoia da tastiera";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Registra scorciatoia";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Scorciatoia rimossa";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Scorciatoia impostata";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Spazio";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "Questa combinazione %@ di tasti non può essere usata";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Questa combinazione di tasti non può essere usata perchè è già usata da una scorciatoia da tastiera a livello di Sistema.\nSe volete davvero usare questa combinazione di tasti, la maggior parte delle scorciatoie possono essere cambiate nel pannello Tastiera e Mouse delle Preferenze di Sistema.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Questa combinazione di tasti non può essere usata perchè è già usata dalla voce di menù ‘%@’.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "Per registrare una nuova scorciatoia, cliccare su questo pulsante e poi inserire la muova scorciatoia o premere cancella per resettare una scorciatoia esistente.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Digita nuova";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Digita scorciatoia";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Usare vecchia";
diff --git a/Pods/MASShortcut/Resources/ja.lproj/Localizable.strings b/Pods/MASShortcut/Resources/ja.lproj/Localizable.strings
deleted file mode 100644
index dec08eb38..000000000
--- a/Pods/MASShortcut/Resources/ja.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "キャンセルする";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "クリックしてショートカットを入力";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "ショートカットを削除";
-
-/* VoiceOver title */
-"keyboard shortcut" = "キーボードショートカット";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "ショートカットを入力";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "ショートカットが削除されました";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "ショートカットが設定されました";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "スペース";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "%@ はショートカットに設定できません";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "このショートカットは、システム全体で使用されているショートカットのため、設定することができません。\nもしこのショートカットを使用したい場合、「システム環境設定」の「キーボード」、「マウス」のパネルから既に設定されているショートカットを変更してください。";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "このショートカットは、メニュー操作の「%@」で使われているため、設定できません。";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "このボタンをクリックし、ショートカットを入力すると、新しいショートカットが設定されます。また、削除ボタンをおすと、ショートカットが削除されます。";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "ショートカットを入力";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "ショートカットを入力";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "古いショートカットを使用";
diff --git a/Pods/MASShortcut/Resources/ko.lproj/Localizable.strings b/Pods/MASShortcut/Resources/ko.lproj/Localizable.strings
deleted file mode 100644
index 41c079648..000000000
--- a/Pods/MASShortcut/Resources/ko.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "취소";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "클릭해 단축 키를 입력";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "단축키 삭제";
-
-/* VoiceOver title */
-"keyboard shortcut" = "키보드 단축키";
-
-/* Alert button when shortcut is already used */
-"OK" = "좋아";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "단축키 입력";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "단축키　삭제됨";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "단축키　설정됨";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "스페이스 바";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "%@ 단축키로 설정할 수 없습니다";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "이 결합은 시스템 전체에서 사용 때문에 단축키로 설정 할 수 없습니다.\n단축키를 사용하고 싶으면 시스템 환경 설정의 키보드, 마우스 패널에서 이미 설정되어있는 단축키를 변경하십시오.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "이 단축키는 ‘%@’ 메뉴 아이템에 사용되고 있기 때문에 설정할 수 없습니다.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "이 버튼을 클릭하고 단축키를 입력하면 새로운 단축키가 설정됩니다. 또한 삭제 버튼을 누르면  단축키가 삭제됩니다.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "새 단축키 입력";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "단축키 입력";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "오래된 단축키를 사용";
diff --git a/Pods/MASShortcut/Resources/nl.lproj/Localizable.strings b/Pods/MASShortcut/Resources/nl.lproj/Localizable.strings
deleted file mode 100644
index 06f78176c..000000000
--- a/Pods/MASShortcut/Resources/nl.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Verbreken";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Druk om een nieuwe sneltoets in te voeren";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Verwijder sneltoets";
-
-/* VoiceOver title */
-"keyboard shortcut" = "sneltoets";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Sneltoets opnemen";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Sneltoets verwijderd";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Sneltoets zetten";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Spatie";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "De sneltoetsencombinatie kan niet worden gebruikt";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Deze combinatie kan niet worden gebruikt want hij wordt al gebruikt door een systeembreed sneltoets.\nAls je deze combinatie echt wilt gebruiken, kun je de meeste sneltoetsen binnen Toetsenbordinstellingen veranderen.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Deze sneltoets kan niet worden gebruikt want hij wordt al gebruikt door het menu item ‘%@’.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "Om nieuwe sneltoets op te nemen, druk op deze knop, en voer een nieuwe sneltoets in, of druk op verwijder om bestaande sneltoets te verwijderen.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Voer Nieuwe Sneltoets in";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Voer Sneltoets in";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Gebruik Oude Sneltoets";
\ No newline at end of file
diff --git a/Pods/MASShortcut/Resources/pl.lproj/Localizable.strings b/Pods/MASShortcut/Resources/pl.lproj/Localizable.strings
deleted file mode 100644
index fffe334cf..000000000
--- a/Pods/MASShortcut/Resources/pl.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Anuluj";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Kliknij, by ustawić nowy skrót";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Usuń skrót";
-
-/* VoiceOver title */
-"keyboard shortcut" = "skrót klawiszowy";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Utwórz skrót";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Skrót usunięty";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Skrót ustawiony";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Spacja";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "Nie można użyć kombinacji klawiszy %@";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Nie można użyć tej kombinacji, ponieważ jest już zajęta przez skrót systemowy.\nMożesz to zmienić w panelu Klawiatura w Preferencjach systemowych.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Ten skrót nie może być użyty, ponieważ w menu ma już przypisaną funkcję ‘%@’.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "Aby ustawić nowy skrót, użyj tego przycisku, a następnie wpisz nowy skrót albo naciśnij klawisz delete, by usunąć istniejący skrót";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Wpisz nowy skrót";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Wpisz skrót";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Użyj starego skrótu";
\ No newline at end of file
diff --git a/Pods/MASShortcut/Resources/pt.lproj/Localizable.strings b/Pods/MASShortcut/Resources/pt.lproj/Localizable.strings
deleted file mode 100644
index 0d4dfde19..000000000
--- a/Pods/MASShortcut/Resources/pt.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Cancelar";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" ="Clique para gravar o atalho";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Apagar atalho";
-
-/* VoiceOver title */
-"keyboard shortcut" = "atalho de teclado";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Gravar Atalho";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Atalho limpo";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Atalho definido";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Espaço";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "A combinação de teclas “%@” não pode ser usada";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Esta combinação não pode ser usada porque ela já é usada por um atalho global do sistema.\nA maioria dos atalhos pode ser alterada no painel Teclado das Preferências do Sistema, caso realmente deseje usar esta combinação.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Este atalho não pode ser usado porque ele já é usado pelo item de menu “%@”.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "Para gravar um atalho novo, clique neste botão e digite o novo atalho ou pressione apagar para limpar um atalho existente.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Digite o atalho";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Digite o atalho";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Usar atalho antigo";
diff --git a/Pods/MASShortcut/Resources/ru.lproj/Localizable.strings b/Pods/MASShortcut/Resources/ru.lproj/Localizable.strings
deleted file mode 100644
index 36c52080c..000000000
--- a/Pods/MASShortcut/Resources/ru.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Отмена";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Нажмите для записи сочетания клавиш";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Удалить горячую клавишу";
-
-/* VoiceOver title */
-"keyboard shortcut" = "сочетание клавиш";
-
-/* Alert button when shortcut is already used */
-"OK" = "ОК";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Ввести сочетание";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Сочетание клавиш удалено";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Сочетание клавиш назначено";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Пробел";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "Нельзя использовать сочетание клавиш %@";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Нельзя использовать это сочетание клавиш, потому что оно уже используется в системе.\n Если вы хотите использовать это сочетание, измените существующее системное сочетание клавиш через панель Клавиатура в Cистемных настройках.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Нельзя использовать это сочетание, потому что оно уже связано с элементом ‘%@’.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "Чтобы назначить новое сочетание клавиш, нажмите эту кнопку и введите новое сочетание, или нажмите \"Удалить\", чтобы удалить действующее сочетание клавиш.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Введите сочетание";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Введите сочетание";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Вернуть старое";
\ No newline at end of file
diff --git a/Pods/MASShortcut/Resources/sv.lproj/Localizable.strings b/Pods/MASShortcut/Resources/sv.lproj/Localizable.strings
deleted file mode 100644
index e8bb31da5..000000000
--- a/Pods/MASShortcut/Resources/sv.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "Avbryt";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "Klicka för att registrera ny kortkommando";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "Ta bort en kortkommando";
-
-/* VoiceOver title */
-"keyboard shortcut" = "Tangentbordskortkommando";
-
-/* Alert button when shortcut is already used */
-"OK" = "OK";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "Registrera kortkommando";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "Kortkommando rensas";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "Kortkommando uppsättning";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "Utrymme";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "Tangentkombinationen %@ kan inte användas";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "Den här kombinationen kan inte användas eftersom den redan används som en tangentbordskortkommando. Om du verkligen vill använda den här tangentkombinationen kan de flesta genvägar ändras under Tangentbord & Mus i Systeminställningar.";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "Denna kortkommando kan inte användas eftersom det redan används av ett menyalternativ ‘%@’.";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "För att registrera en ny kortkommando, klicka på den här knappen och skriv sedan in den nya kortkommando, eller tryck på radera för att rensa en befintlig kortkommando.";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "Skriv Ny Kortkommando";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "Skriv Kortkommando";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "Använd Gammal Kortkommando";
diff --git a/Pods/MASShortcut/Resources/zh-Hans.lproj/Localizable.strings b/Pods/MASShortcut/Resources/zh-Hans.lproj/Localizable.strings
deleted file mode 100644
index d383cc96c..000000000
--- a/Pods/MASShortcut/Resources/zh-Hans.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "取消";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "点击以记录新快捷键";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "删除快捷键";
-
-/* VoiceOver title */
-"keyboard shortcut" = "键盘快捷键";
-
-/* Alert button when shortcut is already used */
-"OK" = "好";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "记录快捷键";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "快捷键已清除";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "快捷键已设置";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "空格键";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "按键组合“%@”无法使用";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "当前按键组合无法使用，因为它已经用作其他系统全局快捷键。\n如果您真的想使用这个按键组合，大部分系统全局快捷键能在“系统偏好设置”里的“键盘”和“鼠标”面板中重设。";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "当前快捷键无法使用，因为它已用作菜单项“%@”的快捷键。";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "若要记录新的快捷键，单击此按钮，然后键入新的快捷键，或者按“delete键”删除已经存在的快捷键。";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "键入新快捷键";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "键入快捷键";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "还原快捷键";
diff --git a/Pods/MASShortcut/Resources/zh-Hant.lproj/Localizable.strings b/Pods/MASShortcut/Resources/zh-Hant.lproj/Localizable.strings
deleted file mode 100644
index 28a765cb0..000000000
--- a/Pods/MASShortcut/Resources/zh-Hant.lproj/Localizable.strings
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Cancel action button in recording state */
-"Cancel" = "取消";
-
-/* Tooltip for non-empty shortcut button */
-"Click to record new shortcut" = "點選以記錄新快捷鍵";
-
-/* Tooltip for hint button near the non-empty shortcut */
-"Delete shortcut" = "刪除快捷鍵";
-
-/* VoiceOver title */
-"keyboard shortcut" = "鍵盤快捷鍵";
-
-/* Alert button when shortcut is already used */
-"OK" = "好";
-
-/* Empty shortcut button in normal state */
-"Record Shortcut" = "記錄快捷鍵";
-
-/* VoiceOver: Shortcut cleared */
-"Shortcut cleared" = "快捷鍵已清除";
-
-/* VoiceOver: Shortcut set */
-"Shortcut set" = "快捷鍵已設定";
-
-/* Shortcut glyph name for SPACE key */
-"Space" = "空格鍵";
-
-/* Title for alert when shortcut is already used */
-"The key combination %@ cannot be used" = "按鍵組合“%@”無法使用";
-
-/* Message for alert when shortcut is already used by the system */
-"This combination cannot be used because it is already used by a system-wide keyboard shortcut.\nIf you really want to use this key combination, most shortcuts can be changed in the Keyboard & Mouse panel in System Preferences." = "當前按鍵組合無法使用，因為它已經用作其他系統全局快捷鍵。\n如果您真的想使用這個按鍵組合，大部分系統全局快捷鍵能在“系統偏好設定”裡的“鍵盤”和“滑鼠”面板中重設。";
-
-/* Message for alert when shortcut is already used */
-"This shortcut cannot be used because it is already used by the menu item ‘%@’." = "當前快捷鍵無法使用，因為它已用作選單項“%@”的快捷鍵。";
-
-/* VoiceOver shortcut help */
-"To record a new shortcut, click this button, and then type the new shortcut, or press delete to clear an existing shortcut." = "若要記錄新的快捷鍵，單擊此按鈕，然後鍵入新的快捷鍵，或者按“delete鍵”刪除已經存在的快捷鍵。";
-
-/* Non-empty shortcut button in recording state */
-"Type New Shortcut" = "鍵入新快捷鍵";
-
-/* Empty shortcut button in recording state */
-"Type Shortcut" = "鍵入快捷鍵";
-
-/* Cancel action button for non-empty shortcut in recording state */
-"Use Old Shortcut" = "還原快捷鍵";
diff --git a/Pods/Manifest.lock b/Pods/Manifest.lock
deleted file mode 100644
index ba9ec4fe5..000000000
--- a/Pods/Manifest.lock
+++ /dev/null
@@ -1,44 +0,0 @@
-PODS:
-  - Alamofire (5.4.3)
-  - BRLOptionParser (0.3.1)
-  - GCDWebServer (3.5.4):
-    - GCDWebServer/Core (= 3.5.4)
-  - GCDWebServer/Core (3.5.4)
-  - MASShortcut (2.4.0)
-  - RxCocoa (6.2.0):
-    - RxRelay (= 6.2.0)
-    - RxSwift (= 6.2.0)
-  - RxRelay (6.2.0):
-    - RxSwift (= 6.2.0)
-  - RxSwift (6.2.0)
-
-DEPENDENCIES:
-  - Alamofire (~> 5.4.3)
-  - BRLOptionParser (~> 0.3.1)
-  - GCDWebServer (~> 3.0)
-  - MASShortcut (~> 2)
-  - RxCocoa (~> 6.2.0)
-  - RxSwift (~> 6.2.0)
-
-SPEC REPOS:
-  trunk:
-    - Alamofire
-    - BRLOptionParser
-    - GCDWebServer
-    - MASShortcut
-    - RxCocoa
-    - RxRelay
-    - RxSwift
-
-SPEC CHECKSUMS:
-  Alamofire: e447a2774a40c996748296fa2c55112fdbbc42f9
-  BRLOptionParser: a03256a8ff003ca1f5376c55f55f210e085a3958
-  GCDWebServer: 2c156a56c8226e2d5c0c3f208a3621ccffbe3ce4
-  MASShortcut: d9e4909e878661cc42877cc9d6efbe638273ab57
-  RxCocoa: 4baf94bb35f2c0ab31bc0cb9f1900155f646ba42
-  RxRelay: e72dbfd157807478401ef1982e1c61c945c94b2f
-  RxSwift: d356ab7bee873611322f134c5f9ef379fa183d8f
-
-PODFILE CHECKSUM: 5e6ee339e4466d456309238c104e8625cd1e3e41
-
-COCOAPODS: 1.10.1
diff --git a/Pods/Pods.xcodeproj/project.pbxproj b/Pods/Pods.xcodeproj/project.pbxproj
deleted file mode 100644
index f49790919..000000000
--- a/Pods/Pods.xcodeproj/project.pbxproj
+++ /dev/null
@@ -1,3522 +0,0 @@
-// !$*UTF8*$!
-{
-	archiveVersion = 1;
-	classes = {
-	};
-	objectVersion = 46;
-	objects = {
-
-/* Begin PBXBuildFile section */
-		013BAC24F7AC722E59517CB110A9E685 /* HTTPMethod.swift in Sources */ = {isa = PBXBuildFile; fileRef = 403ABCCF5634DCD99A376EAA601F828E /* HTTPMethod.swift */; };
-		017170EB9F2450569816AB0FF2E6D541 /* CombineLatest.swift in Sources */ = {isa = PBXBuildFile; fileRef = FF5FCDE3BD3C3E02C0A0B3D529BF6982 /* CombineLatest.swift */; };
-		022F83EC88B467A88CBB491D7C98FA7E /* UITabBar+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21F927D22EA76A49C54C44827DD1CE5A /* UITabBar+Rx.swift */; };
-		02AEF100BA92B652E6E48EF58B479533 /* en.lproj in Resources */ = {isa = PBXBuildFile; fileRef = 4A797B2A249C56CB61DB60A3FEA31FD2 /* en.lproj */; };
-		037CEEDED76C75AB19A6A015D66C1322 /* RxCollectionViewDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = B9215F3DCBD2FE1BDADCEF5D05219A48 /* RxCollectionViewDelegateProxy.swift */; };
-		06185F389644D5BD1C84259027C533D5 /* UICollectionView+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = D49EC557FA27872611535147AB5D700C /* UICollectionView+Rx.swift */; };
-		0722A6B0D2DE0B9620F5C9659CB679D8 /* Debounce.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8A2C23CF743A94075196D7A4F419F5A4 /* Debounce.swift */; };
-		07326CA68F757A1C82495BB52A92BD5C /* CompositeDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3BE91EC45C71C190D532DC351F5E724D /* CompositeDisposable.swift */; };
-		080F0457EB8E6A9F2841FB0D77AEEF42 /* RxCollectionViewDataSourcePrefetchingProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 78275DA82CA025902C1D6FAF39BC9403 /* RxCollectionViewDataSourcePrefetchingProxy.swift */; };
-		08FE05B1BA0A6D9CE971027E0480350A /* AnonymousDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1EB8536183BE6472CDCC5817172688EF /* AnonymousDisposable.swift */; };
-		091B8980E4EFE8B81548A8B0369DF1F7 /* UIPickerView+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 608BE9EFB078FCC2348EF2782C265D92 /* UIPickerView+Rx.swift */; };
-		0A1849775CF90D514963187D3A771CF8 /* Combine.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9F78589C2F1DDF07DF58CD22F6835B19 /* Combine.swift */; };
-		0A20A09C199A4692A8EA72497B3D504A /* Catch.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1CD2535A24AA927A5965AF73264678A3 /* Catch.swift */; };
-		0A4DF5D6FC29A34C999E1ECBB53C696B /* RxMutableBox.swift in Sources */ = {isa = PBXBuildFile; fileRef = 530CEAEC9F4BC5F2EC9C9534779927A3 /* RxMutableBox.swift */; };
-		0A8A30C3BF493120607DD0157A560065 /* ObserveOn.swift in Sources */ = {isa = PBXBuildFile; fileRef = FD39BD9C1B852EC7AC7CD7D77D1E606F /* ObserveOn.swift */; };
-		0A900DF17E3B64F08AF673E9A0DDD697 /* OperationQueue+Alamofire.swift in Sources */ = {isa = PBXBuildFile; fileRef = 26DA8062B81F764A6EEA6168DF6337AB /* OperationQueue+Alamofire.swift */; };
-		0CA982442C8027B672202D753260BAC9 /* RxSwift-umbrella.h in Headers */ = {isa = PBXBuildFile; fileRef = 77B5C856C653A9586105526C4341767A /* RxSwift-umbrella.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		0D8B936D823A959DDE9005A1C1D89487 /* Disposables.swift in Sources */ = {isa = PBXBuildFile; fileRef = CECC6752E3DD709B29A4ED0461B7BF82 /* Disposables.swift */; };
-		0E7C902AB09DA1CA05D07D36BD55C73E /* Enumerated.swift in Sources */ = {isa = PBXBuildFile; fileRef = 31234D4C5E912BD05D37874E7E89A233 /* Enumerated.swift */; };
-		0EEDE530AD4098CC0660A78E2852DA6A /* MASKeyMasks.h in Headers */ = {isa = PBXBuildFile; fileRef = 867FD5BBBCAC1E98FE144867305F8FEF /* MASKeyMasks.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		0FB5F248B62BC1F0113E53461E807AE5 /* SubjectType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 44D9E4509154BFFEBEA9AEA0C935EC9E /* SubjectType.swift */; };
-		0FE468D23725DEF3BB913C80A61F9B1B /* RxPickerViewDataSourceType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 961D7CAE484B6E4929A7BE5B048D29B5 /* RxPickerViewDataSourceType.swift */; };
-		10993D369AADB3E2BCA4E966DE514C09 /* SchedulerServices+Emulation.swift in Sources */ = {isa = PBXBuildFile; fileRef = A0791E5EB9ADBB88CEE0BCD83DA9502C /* SchedulerServices+Emulation.swift */; };
-		109ADA4349083858A198CA863E457E37 /* DisposeBag.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0F2EB184269284B56190B6EE5A7E5CC3 /* DisposeBag.swift */; };
-		11B06B47E4CB24A05B1299D730643803 /* ObservableType+PrimitiveSequence.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1AA3BEB86C50C2AAE9CCEDB0171CFC56 /* ObservableType+PrimitiveSequence.swift */; };
-		1208E81DA8B532D0646D627B50290EB6 /* AFError.swift in Sources */ = {isa = PBXBuildFile; fileRef = 6D8A09F0F8EDB0B1A568AA29A33D62EA /* AFError.swift */; };
-		128376A37733CDCD9870A39DE261904E /* UISearchController+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8ED0DC48A18FD32A95BE8B28D715172C /* UISearchController+Rx.swift */; };
-		12DF0C4E73CEC6118673050B236C7799 /* MASKeyCodes.h in Headers */ = {isa = PBXBuildFile; fileRef = 73327356D8055C270C5AFBAEE0D202DD /* MASKeyCodes.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		12E8D9F9C1A9B4FC7669C18954BC4798 /* ControlEvent+Driver.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4C0E4BDE3E30AF8C9062AFAD9C3AEA28 /* ControlEvent+Driver.swift */; };
-		14403B39AC36562E41D4768CCF3540B1 /* CombineLatest+arity.swift in Sources */ = {isa = PBXBuildFile; fileRef = BC41D63AA5F0A525ACB78573334AB97C /* CombineLatest+arity.swift */; };
-		14C185529F30494F6B6F0DFA9AEDDC05 /* TakeLast.swift in Sources */ = {isa = PBXBuildFile; fileRef = 73118DDBDD8A625213B479BD40C4B9CE /* TakeLast.swift */; };
-		14E31D647AFA8F0FBE3793EF61872247 /* ScheduledItemType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 19FF8B675AE7A3F0AB7CDE7C48E8082A /* ScheduledItemType.swift */; };
-		16C263170733039596369C8D4F89077A /* InfiniteSequence.swift in Sources */ = {isa = PBXBuildFile; fileRef = EC8F5BC5CABB65CCD832B9821F532DBD /* InfiniteSequence.swift */; };
-		19D605A3233499828FB6B790869F3E9C /* NetworkReachabilityManager.swift in Sources */ = {isa = PBXBuildFile; fileRef = F5102E62600D264D29633030E490AAE6 /* NetworkReachabilityManager.swift */; };
-		1A630AD9EFDB068A1544BD51CA5E99B7 /* Dematerialize.swift in Sources */ = {isa = PBXBuildFile; fileRef = 080201197B517655700BD33F44B1A602 /* Dematerialize.swift */; };
-		1AECEBA213A2C9E6EC56C2C1358849E4 /* MASShortcut.m in Sources */ = {isa = PBXBuildFile; fileRef = 7A4A724DBFF9C1C260A76A4B104F3B1E /* MASShortcut.m */; };
-		1B341070BA8EB97021BE7C152639CBF5 /* VirtualTimeScheduler.swift in Sources */ = {isa = PBXBuildFile; fileRef = 6A2828DE92C9CEECE9FB19F2EE763305 /* VirtualTimeScheduler.swift */; };
-		1C0A940E6D4FD420BEC04B9F16914D71 /* RecursiveLock.swift in Sources */ = {isa = PBXBuildFile; fileRef = 11DD125BCF1FDD4E34715800EC2F295F /* RecursiveLock.swift */; };
-		1C11628696BD0C889E0A4FC6CA4B6922 /* GCDWebServer-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = 09A0680C8640FDF225CF2A27A4204628 /* GCDWebServer-dummy.m */; };
-		1D5606C6BD48C543FA0DB2C82B8791B7 /* GCDWebServer-umbrella.h in Headers */ = {isa = PBXBuildFile; fileRef = B400BB6631F1C9F8534BE1CEF160097E /* GCDWebServer-umbrella.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		1DF080CB9D37CB063C6FEC09BBF8F238 /* Timer.swift in Sources */ = {isa = PBXBuildFile; fileRef = F893DD80BE166F23DB8567A0940B0FEE /* Timer.swift */; };
-		1EC23A9ACE471AAE845CE9ACD4588932 /* Infallible+Zip+arity.swift in Sources */ = {isa = PBXBuildFile; fileRef = A2FFFF24B3AC3570742D7F2CCF2FE3C5 /* Infallible+Zip+arity.swift */; };
-		1ECDFBCA376564682426B5D8AC70393C /* RxTableViewDataSourceProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = ADC06A8D8266504D3FD0F38F5F1A87AD /* RxTableViewDataSourceProxy.swift */; };
-		1FAEB66513E2610FE37D99FDD8F9E46D /* GCDWebServerStreamedResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = AE4742C0047EC328BE64C1DF6D868CEF /* GCDWebServerStreamedResponse.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		1FDEA9EB6CAF8FB09C98CEBE607DCFB6 /* SectionedViewDataSourceType.swift in Sources */ = {isa = PBXBuildFile; fileRef = A4177B545582D09C0D653414E6353741 /* SectionedViewDataSourceType.swift */; };
-		212EDC48B68107BEA9247F3464CE696E /* StringEncoding+Alamofire.swift in Sources */ = {isa = PBXBuildFile; fileRef = C8305C9D0B89A4CE30258C61DDD5A342 /* StringEncoding+Alamofire.swift */; };
-		218C14EAE5AA31C30314AE0289B732A0 /* Protected.swift in Sources */ = {isa = PBXBuildFile; fileRef = 43D1B54DDFE366EA8E657D1CFA2A5349 /* Protected.swift */; };
-		221F057199246D7709DD91C950746B7B /* GCDWebServerMultiPartFormRequest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0C1C25377D5ADEBBE1E5B44FD42F2BF8 /* GCDWebServerMultiPartFormRequest.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		2375AD3B88ECB4A1C01F9F70DCFB05E7 /* Errors.swift in Sources */ = {isa = PBXBuildFile; fileRef = 718741562429DAE6AA6DC455ED6883D4 /* Errors.swift */; };
-		239AC2D5500F4E4FB04BC341A1335DF7 /* SerialDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 6DAFFC9484B606CC3A8583B2085B7957 /* SerialDisposable.swift */; };
-		23CF55A9FA514BDCA0B46320D4ED5DEC /* RxCocoa.swift in Sources */ = {isa = PBXBuildFile; fileRef = B1816E3DFE7F11350A74B0C1F878F7FC /* RxCocoa.swift */; };
-		2453CFD81C667B99753FF8354AA82C60 /* HistoricalScheduler.swift in Sources */ = {isa = PBXBuildFile; fileRef = 6DA5F27AAEF9B366933CB017942EFAA8 /* HistoricalScheduler.swift */; };
-		262C2E49711CEA356F7C2031AE074C8A /* RecursiveScheduler.swift in Sources */ = {isa = PBXBuildFile; fileRef = 40FC23633FFFBBD0FA165FB284958F8C /* RecursiveScheduler.swift */; };
-		262EBFD1844224838811BD9E1726CD73 /* AppKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EA187A944BB7C96464B1E79E6D12F90F /* AppKit.framework */; };
-		26900F59621365F9EF08DB37C7E07C06 /* RxScrollViewDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7B58732AA1AF7EA39B29A8BE85721F26 /* RxScrollViewDelegateProxy.swift */; };
-		27C5636F69D717D7745A0235D715E4FB /* Platform.Linux.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4FF704B43D944C2399606B76A430F1A6 /* Platform.Linux.swift */; };
-		27E59A11A2743B0595CDE3A08675EAE1 /* DispatchQueue+Alamofire.swift in Sources */ = {isa = PBXBuildFile; fileRef = 41ADA85A38ECDBBD122B707DA599E641 /* DispatchQueue+Alamofire.swift */; };
-		2862DA4097D964B745862F00BB45759D /* KVORepresentable+Swift.swift in Sources */ = {isa = PBXBuildFile; fileRef = 6EB5DBBABE4FD6FFF0223AC1BC4674DB /* KVORepresentable+Swift.swift */; };
-		2B540E502B0EE71D93636BA94B9F0817 /* Zip+arity.swift in Sources */ = {isa = PBXBuildFile; fileRef = ABD89974F6EA342767735D559995D3FA /* Zip+arity.swift */; };
-		2BD53F1C421E9938A099F3F45C84FBAD /* Platform.Linux.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2586C5A6499D4E9A6B62C1CF5804DE66 /* Platform.Linux.swift */; };
-		2C8A055494092F137EDB2E3BDCA74DFC /* Maybe.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5219820998BC7D8238F0F05F90A3D96F /* Maybe.swift */; };
-		2CD9AC66F1727C363449C4072DA57F89 /* ObservableType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4338C646A92E1539E9BED963FC618602 /* ObservableType.swift */; };
-		2D890B63806F7465912098B60052B092 /* SerialDispatchQueueScheduler.swift in Sources */ = {isa = PBXBuildFile; fileRef = 408AEB2CFB972D5D82E41BB027E6686C /* SerialDispatchQueueScheduler.swift */; };
-		2E0722133679D5C422D0EC5ACB8B23A1 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */; };
-		2F835E1CFB72A43AC17728C6105B9635 /* SharedSequence.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4F401550E51DCC5F5746B99EC564065B /* SharedSequence.swift */; };
-		2FD49578803778A2F094C0B21FEE332C /* Cancelable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8565AD8EBB9A4E532AF93D887B586876 /* Cancelable.swift */; };
-		30536C64EAA45BE64894B48D74144B1E /* DispatchQueue+Extensions.swift in Sources */ = {isa = PBXBuildFile; fileRef = 29E3014CE53E3127CCD38149E2060C76 /* DispatchQueue+Extensions.swift */; };
-		313170D278E51360492948E6BB704EA7 /* ru.lproj in Resources */ = {isa = PBXBuildFile; fileRef = 9A3F0ED147035005ABA4D679F9E36A7B /* ru.lproj */; };
-		3212BC4884F26AE9244A7548691A0CE0 /* Delay.swift in Sources */ = {isa = PBXBuildFile; fileRef = D570E112B81800B30A1165D0BC68DB8A /* Delay.swift */; };
-		325A6428E460396F0B0CB9B6FE10EEC4 /* it.lproj in Resources */ = {isa = PBXBuildFile; fileRef = 321FC2ED515952B66BACDB8CAC130EB4 /* it.lproj */; };
-		332D9AE4473773687AA9155EF16A80D8 /* MASHotKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 8937D9E4BB1CD1D979DFF21019B4D814 /* MASHotKey.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		34C033CDDD8217EE4221E9BDFFC23086 /* MainScheduler.swift in Sources */ = {isa = PBXBuildFile; fileRef = 98B151536C20EA366FDBE99C5A8BB7A5 /* MainScheduler.swift */; };
-		3596F8FDA81BECFE1B05B50500447638 /* KVORepresentable+CoreGraphics.swift in Sources */ = {isa = PBXBuildFile; fileRef = C70C13D2EC9B57E48D64BD7ABC49F9D6 /* KVORepresentable+CoreGraphics.swift */; };
-		35A428176550E4AA2BB98CDDEE2AFF99 /* Signal.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8E4505859B317DCDCC426973F6C7153D /* Signal.swift */; };
-		3685E20BBC5AFEA3BC80FE12732AB269 /* GCDWebServerResponse.m in Sources */ = {isa = PBXBuildFile; fileRef = C40D7DCF882E3A5609EDE1602335E721 /* GCDWebServerResponse.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		36DED9F6B7737F022FB0B01ECE2BB88E /* GCDWebServerFunctions.m in Sources */ = {isa = PBXBuildFile; fileRef = 0555618E1BBA944D30E358F0700CDD8B /* GCDWebServerFunctions.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		381FF05F8B4F611EE9C2FDBE4457BB89 /* SessionDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = B7045A3758C33721435A4135DBC6A8AA /* SessionDelegate.swift */; };
-		38A45D6FD7DCA41AC0C9CD58EDBB57CB /* UITextView+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = A4BB8686A6F85698D8AC03A77D188340 /* UITextView+Rx.swift */; };
-		39988540E9F936FE5085117BB8F32FAC /* PriorityQueue.swift in Sources */ = {isa = PBXBuildFile; fileRef = A3A89F3DBB03CFC012C901EB6D452A3B /* PriorityQueue.swift */; };
-		3AB06F4DB0A01BA8F6662D0EDC495981 /* InvocableScheduledItem.swift in Sources */ = {isa = PBXBuildFile; fileRef = F97D53A26324CAC07AB16E21B963CF9A /* InvocableScheduledItem.swift */; };
-		3BAE1C06A091DFA7A91F93BD40BD41B9 /* Throttle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 127B3965CEBAEBFB395F0D10B7C255FB /* Throttle.swift */; };
-		3BBEC4A24B60E2276CBC26E555F64F41 /* GCDWebServerDataResponse.m in Sources */ = {isa = PBXBuildFile; fileRef = AB7765E1848A0449B3E3267F17DDE12E /* GCDWebServerDataResponse.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		3D8428BE717C8E76FA50C1D8B93561EE /* DisposeBase.swift in Sources */ = {isa = PBXBuildFile; fileRef = 04A3FEA575D65278CDB553AA231A0CF6 /* DisposeBase.swift */; };
-		3E2FF4CBA1E2C3A36060CB61A25F80F7 /* BRLOptionParser-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = 1389D4639C0D9038BA081FA8DC1CD646 /* BRLOptionParser-dummy.m */; };
-		3E6A74677BA3612A449B323631B44559 /* ObservableType+Extensions.swift in Sources */ = {isa = PBXBuildFile; fileRef = C713517A8C0251C9EEB925D43C63A544 /* ObservableType+Extensions.swift */; };
-		42DBD7750A47DE5273041BDEE8850195 /* Multicast.swift in Sources */ = {isa = PBXBuildFile; fileRef = CD90405BE5311F3F3A8CFCFABCCF3560 /* Multicast.swift */; };
-		4319C0B97542219FCA256B790FE90C1C /* es.lproj in Resources */ = {isa = PBXBuildFile; fileRef = 4504CA755CE81F89F9F165BF93126D21 /* es.lproj */; };
-		432B3CB444984CCCFB4EF37E2D762F05 /* Observable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 636937DE6DA6CE01D7E94282A16BC9D9 /* Observable.swift */; };
-		43BC914A79B9230DA50C9D476DE5114D /* WKWebView+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = FDCA53BCCEFF4720A955F8202537A982 /* WKWebView+Rx.swift */; };
-		4407E13BF761D53607A7B419BE64458B /* TextInput.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1DBE368EA1C6F7EBE80E08054C9BC6AE /* TextInput.swift */; };
-		440BDCF5820801BC8A6D740C48EEAB8E /* Queue.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B23D7AFD516825208E6CE9B362989DB /* Queue.swift */; };
-		447B98FAB75F9B738B72DA92A3C581D6 /* RxPickerViewDataSourceProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = EC44E7C397DF9B77CEF6F5C86EFCE92A /* RxPickerViewDataSourceProxy.swift */; };
-		44C45DEC66DB1FBBA5F850E79057DC13 /* TakeWithPredicate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 6327835932D3C270A640C0C76A860EB8 /* TakeWithPredicate.swift */; };
-		44D30DA4840EF46F1C4BCEA6179AAE60 /* ElementAt.swift in Sources */ = {isa = PBXBuildFile; fileRef = DA23B9C3D142FEFFA05E4F37B1A976AE /* ElementAt.swift */; };
-		45B8CC1C61E7A0BB28CFA8CE7C12FEBC /* MultipartFormData.swift in Sources */ = {isa = PBXBuildFile; fileRef = D7453403FEE25F56521DBB8A39EA0204 /* MultipartFormData.swift */; };
-		4673A5004D211FA68BB8506B9A323034 /* Sink.swift in Sources */ = {isa = PBXBuildFile; fileRef = B304846A96173EC0E0631D07751C0893 /* Sink.swift */; };
-		4728113A1BA4AE948E1B2FB610A473B4 /* Repeat.swift in Sources */ = {isa = PBXBuildFile; fileRef = 45BF55923F2D3657D9D5420E606B641F /* Repeat.swift */; };
-		47E487EF80C53073DBFE5F5FD6BCFF0E /* AsyncSubject.swift in Sources */ = {isa = PBXBuildFile; fileRef = FD07F15ADFC693A5C730840EA2B42015 /* AsyncSubject.swift */; };
-		47FDBBBD2704901588C3A7C56BBC502D /* ServerTrustEvaluation.swift in Sources */ = {isa = PBXBuildFile; fileRef = 90E9219489B97BDFE17BA3231CC465FC /* ServerTrustEvaluation.swift */; };
-		4892C3EBD345FAE187A5E15D7FA19CBE /* GCDWebServerFileRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 962EFFE0B39AFE334DBCAF81B4DBFE56 /* GCDWebServerFileRequest.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		4940AB8BC3936DEBDC02BF49FE5E97A1 /* GCDWebServerFileRequest.m in Sources */ = {isa = PBXBuildFile; fileRef = 392538EA12C4E3008D6EF1ABB226B3BF /* GCDWebServerFileRequest.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		4953376F75EEA98570C65CFC41E0A154 /* RxSearchControllerDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 474547C10494F37402A98A0BFC7E6288 /* RxSearchControllerDelegateProxy.swift */; };
-		4A33F1A7BD2AD1F318E081E17B0AA80F /* InvocableType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 200825C8579BF340304A9767D679EC35 /* InvocableType.swift */; };
-		4AEC050FA7D5ED52FDA9DF50EA3560DF /* ParameterEncoder.swift in Sources */ = {isa = PBXBuildFile; fileRef = D7ED9E80778846168B6F3F867C04F6AA /* ParameterEncoder.swift */; };
-		4B9CC90686F274845EBBB82F230C11EE /* Infallible+Operators.swift in Sources */ = {isa = PBXBuildFile; fileRef = EF4A8984BD7018149BDA495C7EA5FE28 /* Infallible+Operators.swift */; };
-		4BEC411F5B170048C65D315C87832600 /* AsyncLock.swift in Sources */ = {isa = PBXBuildFile; fileRef = 52626495FA7375A2A4753E3EC16FB26C /* AsyncLock.swift */; };
-		4BF6073DF04E6CD2C3BD8D2C552D7E65 /* UISlider+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 466B399C2E7FFAA61B709F2AB447ECDF /* UISlider+Rx.swift */; };
-		4C3A9F4F5A688009D660C0FA5E5D81BB /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */; };
-		4C6CC049B53AF49050AD6428C5B50AB0 /* NopDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = E6B674A528A68BF8E6AB4A5F747B05B8 /* NopDisposable.swift */; };
-		4C88ED296D3687C973B0472D047CE3E8 /* SchedulerType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 111E9F3F4997D0ACA2E0BCDAF269904C /* SchedulerType.swift */; };
-		4D15DB973A043E9B4A47B724738A2A5F /* MASShortcut.h in Headers */ = {isa = PBXBuildFile; fileRef = A2B9727C5385989526550D8E1AC4649A /* MASShortcut.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		4D6504A580F9D6278452D19FD3DD35BC /* PublishRelay.swift in Sources */ = {isa = PBXBuildFile; fileRef = CA7211C3393B6E1ED0E57C4CCF5F5005 /* PublishRelay.swift */; };
-		4E095DE808150F9350BB9CB3C99A37B2 /* _RXObjCRuntime.m in Sources */ = {isa = PBXBuildFile; fileRef = 638797412ABBF2F7725016AF4B056309 /* _RXObjCRuntime.m */; };
-		4EC10410410410FF3A33C6015FD5927D /* ShareReplayScope.swift in Sources */ = {isa = PBXBuildFile; fileRef = 72D91E08E6C75E1F0DBACD4FF3CA2F55 /* ShareReplayScope.swift */; };
-		516E4177ED65653EA9DAADBA3CF3FBED /* OperationQueueScheduler.swift in Sources */ = {isa = PBXBuildFile; fileRef = AC4C66DE7DB1A4B525929AEF699AC3CE /* OperationQueueScheduler.swift */; };
-		519260344D4291AA4C1CEAD7711B1489 /* Deferred.swift in Sources */ = {isa = PBXBuildFile; fileRef = 33BBD4B03778E41A59C1A3F64AAB876C /* Deferred.swift */; };
-		51B830516D57359FAB42031193E47CB1 /* RxCollectionViewDataSourceType.swift in Sources */ = {isa = PBXBuildFile; fileRef = C0D1BF03B3F26978B85F2E44EBE18FC1 /* RxCollectionViewDataSourceType.swift */; };
-		5263ED302CD55D6C365476F9B20AD5D1 /* MASShortcutMonitor.h in Headers */ = {isa = PBXBuildFile; fileRef = 24121C8FA3C10947BE50901868F9198A /* MASShortcutMonitor.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		52CB53A7C3EF4BD88F73996450B73AA7 /* Filter.swift in Sources */ = {isa = PBXBuildFile; fileRef = 44775F4816D20EB134F1DBAB43BE0B3A /* Filter.swift */; };
-		535519D2B25D1784AA6D6A9BDE60C759 /* Switch.swift in Sources */ = {isa = PBXBuildFile; fileRef = F4786526A5AD085C95AC191C7253C591 /* Switch.swift */; };
-		543010884F5B7C1F2920A0DF33A3A9D1 /* SynchronizedUnsubscribeType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1FA62A0165A7A8D001536C62FD5E2392 /* SynchronizedUnsubscribeType.swift */; };
-		54FFBD61CC8FA5DD12646A7FFAAFE425 /* RxRelay-umbrella.h in Headers */ = {isa = PBXBuildFile; fileRef = 2DDC82F5641636881356BF49166C8DF3 /* RxRelay-umbrella.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		563C41694A1B06EF34752E894297D3FA /* MASShortcut-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = 6B668707F7C66384A3BB8BC4FE3F41E6 /* MASShortcut-dummy.m */; };
-		58D3BBBF801B54CC74FAAC0374F1948D /* NSTextStorage+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = E35662841C2AAA3188CD9ADFDC38880F /* NSTextStorage+Rx.swift */; };
-		5989329B01C0737EFDB490C5A771FDC2 /* GCDWebServerURLEncodedFormRequest.m in Sources */ = {isa = PBXBuildFile; fileRef = DC40BD5F1E0BFED23CB5A6AE57FA4443 /* GCDWebServerURLEncodedFormRequest.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		5BF5F916582D2EE625A9F0F32ECE709A /* MASShortcut-umbrella.h in Headers */ = {isa = PBXBuildFile; fileRef = 930EB20F00FF48CAF9B19505BC219504 /* MASShortcut-umbrella.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		5CDF229542C4FC347E9D1DFDBAC8B230 /* Scan.swift in Sources */ = {isa = PBXBuildFile; fileRef = 32777B9FE68F64D911474F7B7595C94C /* Scan.swift */; };
-		5E3681E1F77D4A9B58F332348935EE8C /* Range.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2096522151041770121528F182B6F42D /* Range.swift */; };
-		5F7CE7907DC769D3E61980B80D20A275 /* Concat.swift in Sources */ = {isa = PBXBuildFile; fileRef = 66C7F789300668AEDFA53AEA1392C48B /* Concat.swift */; };
-		601A69113478A1336ADA98C7658D2355 /* Take.swift in Sources */ = {isa = PBXBuildFile; fileRef = 273C90965AA81CCFE4CDA40530425746 /* Take.swift */; };
-		60FBA126D0D250DE50F4DD26041E4A9C /* RxTableViewDataSourceType.swift in Sources */ = {isa = PBXBuildFile; fileRef = D418B4DEE726BA9D5A912D8F1FBF0888 /* RxTableViewDataSourceType.swift */; };
-		611ACC0E723AF0E572160BC75133A9E6 /* UIGestureRecognizer+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = D87FAE60EB40AC65B2E5000C6B82DFEB /* UIGestureRecognizer+Rx.swift */; };
-		62DF258CA1EA9A41A99B93052A72DAB0 /* _RXDelegateProxy.m in Sources */ = {isa = PBXBuildFile; fileRef = 6AD4414199F479D544CBF1FFF3FB45E4 /* _RXDelegateProxy.m */; };
-		63257249A72693C87BF365F343DA1D36 /* ko.lproj in Resources */ = {isa = PBXBuildFile; fileRef = A254689F2908346AD7387F063C24B41A /* ko.lproj */; };
-		63CE2D43072C461D8DE926F0B9EC2E97 /* RxPickerViewDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 22D41ECF1E34CC3D83A32F7896831100 /* RxPickerViewDelegateProxy.swift */; };
-		64F43894B4404E7BDE27A5C8BE96E0AE /* Completable+AndThen.swift in Sources */ = {isa = PBXBuildFile; fileRef = A111C3B36368413B50627674BB48E859 /* Completable+AndThen.swift */; };
-		652118C36365C28E76826357E309EADE /* Infallible.swift in Sources */ = {isa = PBXBuildFile; fileRef = 370A313E34AF66CB8D7437ABDC3FB7F8 /* Infallible.swift */; };
-		6546D728B69398F93B506845141EBD61 /* EventMonitor.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4E0CDE6403F2AF9E108FF190F90FA9FF /* EventMonitor.swift */; };
-		65EA84D8C4EA09B4455BC6C221D2A940 /* Pods-ShadowsocksX-NGTests-umbrella.h in Headers */ = {isa = PBXBuildFile; fileRef = 72A57876EDEB24ADDFE06DD482CE250C /* Pods-ShadowsocksX-NGTests-umbrella.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		66207468882614FB8CE9896DC4250F13 /* Infallible+Create.swift in Sources */ = {isa = PBXBuildFile; fileRef = 161437331F54761E08F028DD14CDC21E /* Infallible+Create.swift */; };
-		665FBE569EDC9AF24C721F6B9C7241EC /* MASShortcutBinder.h in Headers */ = {isa = PBXBuildFile; fileRef = A18A7F7794D2CC58900E95F6644D63E8 /* MASShortcutBinder.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		666EC5C8356E6D4448A2FE7BEE77AD88 /* RedirectHandler.swift in Sources */ = {isa = PBXBuildFile; fileRef = A32434EC299FDE302FFF9F31EB8735D0 /* RedirectHandler.swift */; };
-		66B26C6CAE737EC21F4BA1F1851B69C5 /* Result+Alamofire.swift in Sources */ = {isa = PBXBuildFile; fileRef = CD2C25316E1BF4F3230E3412417481E6 /* Result+Alamofire.swift */; };
-		6809229B402FC6C91774DA8664AD4F2F /* GCDWebServerRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = A4395BE2A0C53A82170A01602870453A /* GCDWebServerRequest.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		695A83FEFDFE24858DDC37BD64DBBA33 /* Binder.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4412635C50524157DDF38FA0CB197F4A /* Binder.swift */; };
-		69D750E3DAB2F11E37761A204A145883 /* Timeout.swift in Sources */ = {isa = PBXBuildFile; fileRef = 661DD8158386E15481E17DE6E2FA1882 /* Timeout.swift */; };
-		6A2F2216A64E4B4E0FD6215A2F5E692D /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */; };
-		6A3972E7F1ACA4CEE36E0AA3B2BA34FB /* Reactive.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0C0FB7A81FC88101C56EABF826BD78F5 /* Reactive.swift */; };
-		6A5300346FF40392C6A4B5908AA9C027 /* RxCocoaObjCRuntimeError+Extensions.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9F666DF6A38D74980DF6F191509F4971 /* RxCocoaObjCRuntimeError+Extensions.swift */; };
-		6AE407A4FB6C3D6ADD862CC6E3067A17 /* Session.swift in Sources */ = {isa = PBXBuildFile; fileRef = 996DFC2DB5C2F37F0E623EB885F5DEB5 /* Session.swift */; };
-		6B105A67121436E162ADE05A682BEA71 /* Amb.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0CB05B6D60934D955FE0D75C2339A114 /* Amb.swift */; };
-		6BDF6DD0C73F197EC93643F477997B40 /* UISearchBar+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2888FA81FD2BE4D3B068BCE4AFDC9A93 /* UISearchBar+Rx.swift */; };
-		6C08F6A77889651626583100F560153D /* RequestTaskMap.swift in Sources */ = {isa = PBXBuildFile; fileRef = EF8D2E7C64775F0DD477127B5EC2E0AB /* RequestTaskMap.swift */; };
-		6C1064F34CFE15C3DB0E923D9D170E0C /* UIBarButtonItem+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = CB340F626B32E3AF98F1E13658FB46E2 /* UIBarButtonItem+Rx.swift */; };
-		6CA2AE8DA8D630D83FAED6FC2F081967 /* HistoricalSchedulerTimeConverter.swift in Sources */ = {isa = PBXBuildFile; fileRef = 38A0B431980745BE7A67D566D79E240A /* HistoricalSchedulerTimeConverter.swift */; };
-		6CD3A3F8ABC5FCE23D15CE6823840010 /* RxTabBarControllerDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 39D9FF9E1CBB62DA6FC1910AA45EB039 /* RxTabBarControllerDelegateProxy.swift */; };
-		6CDC5000511AB1CF616FEBB8A856AE58 /* Bag+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = CCCC3232579F890A62A86540F6600BE6 /* Bag+Rx.swift */; };
-		6D5BDAE5D8D991B874AD4D7FF2EA7C8C /* Lock.swift in Sources */ = {isa = PBXBuildFile; fileRef = CA0A6C3DB39AD5C25FF5B1A9F554E228 /* Lock.swift */; };
-		6E54F64E8DA73F4B0B46C216F9F93F63 /* RequestInterceptor.swift in Sources */ = {isa = PBXBuildFile; fileRef = 80B5C55F7279E38D15E19E9DEDDEDE7B /* RequestInterceptor.swift */; };
-		6E75ECF4BDC7AF83E3151274539DFF93 /* DispatchQueue+Extensions.swift in Sources */ = {isa = PBXBuildFile; fileRef = C96F1CEB77C6CB8A9D2A7682406E7AE9 /* DispatchQueue+Extensions.swift */; };
-		6FD62C6E23DE07DF1291500FEFC19354 /* BehaviorRelay.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8D796FDCC7398C88D7B835BD89700D56 /* BehaviorRelay.swift */; };
-		70359E1C7BAA76860EA35A607CCC4309 /* DelegateProxyType.swift in Sources */ = {isa = PBXBuildFile; fileRef = DBB7AE66363DEA0FFF31BA0AD1EB9340 /* DelegateProxyType.swift */; };
-		7094648D68C944D337CE86C10F8EEB04 /* zh-Hans.lproj in Resources */ = {isa = PBXBuildFile; fileRef = B2BCE49AE180E28B89BBBE037DF32A2F /* zh-Hans.lproj */; };
-		72E6FED1FBFB7D269B435A3802528AA1 /* MASShortcutValidator.h in Headers */ = {isa = PBXBuildFile; fileRef = 8E796A67AE756E845646324A31731334 /* MASShortcutValidator.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		72EC2712926E6D28B52360D9AC41668F /* AlamofireExtended.swift in Sources */ = {isa = PBXBuildFile; fileRef = 19AA7CC35C97B4BDF08E2E5CE20955E0 /* AlamofireExtended.swift */; };
-		73E48515343BD4E57358BAD9F3B2F590 /* Platform.Darwin.swift in Sources */ = {isa = PBXBuildFile; fileRef = FAABDBC186233AEF9876B5A4F009C8B8 /* Platform.Darwin.swift */; };
-		741E51A8D9DE26331ABB938B3BD5751A /* AddRef.swift in Sources */ = {isa = PBXBuildFile; fileRef = 494FD3BF9675BD2ADCE4731FED65B5FF /* AddRef.swift */; };
-		75917BCA0645283EC7D9CC3ADEE6DB4F /* BehaviorRelay+Driver.swift in Sources */ = {isa = PBXBuildFile; fileRef = 98EF0EFA057CC202BD041F55B091661A /* BehaviorRelay+Driver.swift */; };
-		77093BBAB8F2F51540322CB14BD2C178 /* BehaviorSubject.swift in Sources */ = {isa = PBXBuildFile; fileRef = BB1177638C48D2FB13DDFB46A70CD35D /* BehaviorSubject.swift */; };
-		77260113D5ADF7B45DAE46C549580AFD /* UIRefreshControl+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 506B13C445D67D7231C25641361EE5A1 /* UIRefreshControl+Rx.swift */; };
-		774C726DE2716860799DAEAD0B801A94 /* Reduce.swift in Sources */ = {isa = PBXBuildFile; fileRef = D894FDA92A29CEECD7D1E50C263F1777 /* Reduce.swift */; };
-		7813074001D6CD69B3A1EBAF59379E58 /* Observable+Bind.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0A18EEA4857408358F9A8E6ED8AF8829 /* Observable+Bind.swift */; };
-		786C836C43BD6428332A4001EE13816F /* RecursiveLock.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5554F4E6979C7DDD1E00F81CB94D474D /* RecursiveLock.swift */; };
-		7885432DE1DDE9F2A4607033B2808E5B /* GroupBy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 47EB7F9271D4EAE5B4A31D5D0194BECC /* GroupBy.swift */; };
-		7B0FB5B7BF42B15FDF1FCE073D8C4C21 /* AsSingle.swift in Sources */ = {isa = PBXBuildFile; fileRef = B8D247C19100F15D54BFF5D93804C65E /* AsSingle.swift */; };
-		7B99EC9A5D3CF7B6DE0330773143F15F /* ObserverType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7B00E954AA2FCFDF5ACDEC8CD8C6941E /* ObserverType.swift */; };
-		7BD242803D2ADF6E50A27C3542C8695D /* NSSlider+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5874107EF4581DA493B60BBCFE422D1C /* NSSlider+Rx.swift */; };
-		7BFBC9F9818BC849C72D672D6B6E4B75 /* RxNavigationControllerDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 52DFCC55A239674DEF17871D293D227C /* RxNavigationControllerDelegateProxy.swift */; };
-		7CF0187F571D299FE14788318D720152 /* StartWith.swift in Sources */ = {isa = PBXBuildFile; fileRef = 864BF009AFF7BFF4D8B68869FC885957 /* StartWith.swift */; };
-		7D3DD4A8BB36733BA15868F7FB8C56CE /* Alamofire-umbrella.h in Headers */ = {isa = PBXBuildFile; fileRef = 10E99E50E2994DB7AD9AEBDEF1A2F72B /* Alamofire-umbrella.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		7D5AE7E56AC7636F1D00076095F57745 /* GCDWebServerConnection.h in Headers */ = {isa = PBXBuildFile; fileRef = 6D0B40D5A184825074ECC549693CAF02 /* GCDWebServerConnection.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		7E8BC075464E9C355B763973CA6C08D2 /* UINavigationController+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 6D742A8B753D54115AD3C6D293B64276 /* UINavigationController+Rx.swift */; };
-		805003984E8CFD3375B935DC772A7BF3 /* MASShortcutView.m in Sources */ = {isa = PBXBuildFile; fileRef = 7C73921B2C710D3814A33EF328D04D20 /* MASShortcutView.m */; };
-		809C371060C874FBEF8FECDF197D74E3 /* sv.lproj in Resources */ = {isa = PBXBuildFile; fileRef = FDF7D102C3DA0493A530D68E569DA7CF /* sv.lproj */; };
-		80C7348602C99C09226B1241C02D4754 /* MASShortcutView.h in Headers */ = {isa = PBXBuildFile; fileRef = A2EEB1D58595D58C5DC8978116BE0648 /* MASShortcutView.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		815908B08BEA64FC0E5641D046D43CB6 /* RxCocoa.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EB9FE74C8220E21EC9A5A77098E9152 /* RxCocoa.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		82764E2E2DA3FD699FC5B659ED35D9AE /* pt.lproj in Resources */ = {isa = PBXBuildFile; fileRef = FAB6166D07AACCBF2B4A5FFC66F22602 /* pt.lproj */; };
-		830F06C3D23016D62112E4BA1C22A766 /* LockOwnerType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 683395CCE980D15405934DC5E2BCD682 /* LockOwnerType.swift */; };
-		8314F89A5274810933307BC20E85D3B0 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */; };
-		83470A9EFB9948DED806CC1D1233D21C /* Skip.swift in Sources */ = {isa = PBXBuildFile; fileRef = 07B4CEF97C27B2FE6205EE1D720BFB39 /* Skip.swift */; };
-		844134211AB7B26FACFFF74B58B81C02 /* UIButton+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 17F9F190DDBE93E38A56D8405CBFA664 /* UIButton+Rx.swift */; };
-		8450D728709DB935952A5A59650DB926 /* MASDictionaryTransformer.h in Headers */ = {isa = PBXBuildFile; fileRef = 353B178196A1B3A383089B3D1006F66A /* MASDictionaryTransformer.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		84E576015933A4F6F431759174C62956 /* Error.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4764F518EAB30C5EA82C03A5607ED7AF /* Error.swift */; };
-		85CD565FB8198B084806FE075B268AB5 /* NSObject+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = C119A4F639217703B4B382419AF9D4EF /* NSObject+Rx.swift */; };
-		872E07F59296D07A405BAB9C36936AC8 /* DelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = BB63C0EAF763E45BC31AAB9802F87995 /* DelegateProxy.swift */; };
-		8819CBF35F9919DFC3C17016DF3ACE46 /* UIApplication+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = C78EDD95C0B56A70BE237D148A1726CA /* UIApplication+Rx.swift */; };
-		88665F16CDF39BC2A50C6619169E6EDF /* Carbon.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 62F5D09616527A0713F24DF416BEC64F /* Carbon.framework */; };
-		88F5FF298C4C3D2CDCA5EB7B0BE2B52C /* GCDWebServerResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 89066EEDE0D03A9B328DADDC9344CC13 /* GCDWebServerResponse.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		896AD4C4865ECEA0A8344B54BBA3B9E1 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */; };
-		8AA937910F87915DE700CAB6C868689E /* Notifications.swift in Sources */ = {isa = PBXBuildFile; fileRef = BEEC0450A3B1A48A304AE8BF1DC03429 /* Notifications.swift */; };
-		8B67845A8F56DF49F8B22B1BB63C5E10 /* VirtualTimeConverterType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4673D1BC54F57F490E2D3352F6BA1B73 /* VirtualTimeConverterType.swift */; };
-		8B7EEE0E899778DA279E64E26E38FB30 /* RxTextViewDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 531091EE9FF408558B83A1E053360F67 /* RxTextViewDelegateProxy.swift */; };
-		8BEDC2C0D907FBB47A65EE0E01DE2A59 /* GCDWebServerDataRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 36E9C273C636D7A0C559787BD1FABA68 /* GCDWebServerDataRequest.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		8CE605907DC8FA1F2E4751F939A4E604 /* UIControl+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9C1FFDE936B5B805CB094F77E95A88FC /* UIControl+Rx.swift */; };
-		8EB4272CE33A59083F0DC9746C0F71D0 /* RxSwift-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = F0007682E9947D6BFA4DA24D30F6CBF2 /* RxSwift-dummy.m */; };
-		8EEA6795ED2806C80FBE6A00B615CB76 /* PriorityQueue.swift in Sources */ = {isa = PBXBuildFile; fileRef = D96D37A7C37C05D7DEEAE9B3944CC4DD /* PriorityQueue.swift */; };
-		8F66042610AE99F62D17E50EF0C83B0D /* Never.swift in Sources */ = {isa = PBXBuildFile; fileRef = F961756C2E9DE7614DBA1271483EB245 /* Never.swift */; };
-		901D8E9CC22C5E7FDB218557EBBB3559 /* GCDWebServerDataResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = C21721CAB3BC76F0D7582BD636DB821D /* GCDWebServerDataResponse.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		90429156F020B4490158F6686EEFCB02 /* Date+Dispatch.swift in Sources */ = {isa = PBXBuildFile; fileRef = F11E6B29B9CB879F29AFEBD980D3AFBF /* Date+Dispatch.swift */; };
-		90B5B048AE70F82175F8A3DB72EF601E /* Buffer.swift in Sources */ = {isa = PBXBuildFile; fileRef = BE717EAC81EE595FC7AE3C1A3C6D06A6 /* Buffer.swift */; };
-		911448B2EDA2FF880108F77642797A88 /* ResponseSerialization.swift in Sources */ = {isa = PBXBuildFile; fileRef = 48CB9D3553F121F84DBB750A8FBE0F3D /* ResponseSerialization.swift */; };
-		9131DD9E2CB7420C156461E56835AE6E /* RxSwift.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BFD92A4EF88D0A6B34E86A6A7CE2436D /* RxSwift.framework */; };
-		9141315B460BE4CD3030B62BE7692B73 /* Queue.swift in Sources */ = {isa = PBXBuildFile; fileRef = 960C49C6C3C5E2554CA3CD8EB86B61AC /* Queue.swift */; };
-		91B837CE0DCD8EDB300FCDFFA1279162 /* HTTPHeaders.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3425B3045259FEA3A238D183DEEE520B /* HTTPHeaders.swift */; };
-		91C85BAD47B39F365F260E74AB24693D /* zh-Hant.lproj in Resources */ = {isa = PBXBuildFile; fileRef = B5D8A52DE9A6385138A6D20CB5527DDB /* zh-Hant.lproj */; };
-		9281E701873CD72C35440865226A1A8B /* Pods-ShadowsocksX-NGTests-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = 1C10AA3C311345DB3616BCE827B69C55 /* Pods-ShadowsocksX-NGTests-dummy.m */; };
-		934592C980EE09EEE5F4B5074C6A56D8 /* PublishRelay+Signal.swift in Sources */ = {isa = PBXBuildFile; fileRef = 758B67811993E4C5163D7637EDBB6CFD /* PublishRelay+Signal.swift */; };
-		9360BB098EFD18F90BA16149E8EF8A34 /* Merge.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5CA0D236EFCE9E4E77F9A2B2A0AF3FC4 /* Merge.swift */; };
-		9389C4BF3F440F2503FFEB8BBC8975C8 /* ja.lproj in Resources */ = {isa = PBXBuildFile; fileRef = B1F34EB08D07E2AF230CDA30F361889D /* ja.lproj */; };
-		953EC9012B7246D01EA866100FAEA023 /* RxPickerViewAdapter.swift in Sources */ = {isa = PBXBuildFile; fileRef = F979292485788BE53E5871123C74EB10 /* RxPickerViewAdapter.swift */; };
-		96E6F7A2D012051B29BC9147340E5117 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */; };
-		9806F1246774ADD50F50D3F1624EB0EB /* UITabBarController+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9D4701E49CFDE5F411CDFD316EDD3C70 /* UITabBarController+Rx.swift */; };
-		99210D61FFF596695086F3E51D893204 /* ControlProperty+Driver.swift in Sources */ = {isa = PBXBuildFile; fileRef = 97D6BD38BB9E0F241C3C82A118E7F253 /* ControlProperty+Driver.swift */; };
-		999CAB83E4F6D824DF56B2B755C0B588 /* _RXKVOObserver.m in Sources */ = {isa = PBXBuildFile; fileRef = A14B9E97BE00B01372727FA8DA9B10A3 /* _RXKVOObserver.m */; };
-		99ABB4C207FE146C78313E8A9A581FD6 /* GCDWebServerFileResponse.m in Sources */ = {isa = PBXBuildFile; fileRef = 5BC543740C092C697A08396093A0F7BD /* GCDWebServerFileResponse.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		99E2AEBB5C39DB1661C5C03DDAA451EC /* Infallible+CombineLatest+arity.swift in Sources */ = {isa = PBXBuildFile; fileRef = 40573DCBFB24CA15F7D6C33B5C73162F /* Infallible+CombineLatest+arity.swift */; };
-		9A1CDAE2E9AFFFDBC654855D4A8C6D36 /* CFNetwork.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 817D9055D7659CAC86800D119F65E0F4 /* CFNetwork.framework */; };
-		9AA31D499392F8C3E63FE70C8DE816ED /* RxCocoaRuntime.h in Headers */ = {isa = PBXBuildFile; fileRef = 95F05E167015F6A202D2BEB9437AE766 /* RxCocoaRuntime.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		9AC6705C60E05CAB6115BA7603BDC0F6 /* Bag.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0B98DA4C08DC1A12B2789714C6CDEFFA /* Bag.swift */; };
-		9B1D8A7798D8A6F518FC9AF9725431D0 /* URLConvertible+URLRequestConvertible.swift in Sources */ = {isa = PBXBuildFile; fileRef = AE6768B8A7BED83ED5C93BB3439EFFEF /* URLConvertible+URLRequestConvertible.swift */; };
-		9C3D3F75523B1B1BB4B3051C01F8F6FE /* Zip+Collection.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3677CB82C594C5820F17431AA45C5C87 /* Zip+Collection.swift */; };
-		9D05E77AB8415BB11EC5C5FB6FD62276 /* UITextField+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 877FA6BB936631CD8F2CA0DFFF6EFC9C /* UITextField+Rx.swift */; };
-		9D5CD154B7C49DA0BCBFF996CA9A6E62 /* RetryWhen.swift in Sources */ = {isa = PBXBuildFile; fileRef = AADC2D51259367D2BB2C73816E5A35CD /* RetryWhen.swift */; };
-		9E9A7DA26421695F48AA96DA35B813B4 /* RxTableViewDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = B5B1AE9FCFABDD97172220DFDFE618E5 /* RxTableViewDelegateProxy.swift */; };
-		9F77A1FFC61AF7C54E88B7436893C91B /* DistinctUntilChanged.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3949A4BE0C4C31915E5A812146DB23B9 /* DistinctUntilChanged.swift */; };
-		9F794FB773B632DAC0416008A8EC3F45 /* ScheduledDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = F0D4493458E5817BA46B4318626487F6 /* ScheduledDisposable.swift */; };
-		9FC8EA2F7B3939D69D1469F9046B166A /* Window.swift in Sources */ = {isa = PBXBuildFile; fileRef = 855607DC318E2CF3120B3C70565140A0 /* Window.swift */; };
-		9FED70D1E1FBFB80E974E999EF732258 /* RetryPolicy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3B85D80911EDFC7DD402EBEB3A05169A /* RetryPolicy.swift */; };
-		A0F9BB688F14F5B350A388BA60C184A0 /* ObservableConvertibleType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4618A8C418D70264404BBAF10EE3A1F4 /* ObservableConvertibleType.swift */; };
-		A1CB4107AB9FDEC58E3A7C0C14B4AB79 /* UIDatePicker+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 46A83A815027A06FB7A8AB2CEDF56368 /* UIDatePicker+Rx.swift */; };
-		A24E8834A85F99EF471C495AD4EFACAB /* RxRelay.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = FBD8075FDD277652161C8676E945DE6A /* RxRelay.framework */; };
-		A2526FE80C9370555D66A0A33EA22E44 /* NotificationCenter+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = DE18F7CA6E337EA48867C7D92143B6F9 /* NotificationCenter+Rx.swift */; };
-		A2F246B7FCDC421BE6098866AA1509C9 /* MASShortcutView+Bindings.m in Sources */ = {isa = PBXBuildFile; fileRef = 7C471325C18D493A8244DEB1563B18B6 /* MASShortcutView+Bindings.m */; };
-		A34F81BE4A40B0C6EF378FBB8F240C66 /* _RXObjCRuntime.h in Headers */ = {isa = PBXBuildFile; fileRef = 6985BD62945B0A86382437BC1758C282 /* _RXObjCRuntime.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		A3D78B5A2E0E6B987B021DA58CA55BEB /* PublishSubject.swift in Sources */ = {isa = PBXBuildFile; fileRef = FE18557905075BFBE5AFBE3A0D9287F4 /* PublishSubject.swift */; };
-		A4CE525F7E6904D7D244727C90DBDBE2 /* Sample.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBC071EBDAC90F82FF4D25D024A5AACF /* Sample.swift */; };
-		A525A6AE79BA19A9BDEA467D31477916 /* NSTextField+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2C81F8C45A4C248E266304541A86B5A8 /* NSTextField+Rx.swift */; };
-		A5BE980B95C08EDFEBEC17E0433A4A2E /* RxTarget.swift in Sources */ = {isa = PBXBuildFile; fileRef = 6B37E46EBF28CB6542B58754F09D8AAA /* RxTarget.swift */; };
-		A5DC2335899B03F0130A9C739319C92A /* SwitchIfEmpty.swift in Sources */ = {isa = PBXBuildFile; fileRef = A20673B8CBA1827BCAE8A9CDEAF0CDC5 /* SwitchIfEmpty.swift */; };
-		A6652D3942752A05ED133DB77C955216 /* DelaySubscription.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8AE4AAE5FF0F7FEDE2C8D5FB08A1AE4F /* DelaySubscription.swift */; };
-		A7A81BFC5D65FDB665AC19E78D4F21B6 /* ToArray.swift in Sources */ = {isa = PBXBuildFile; fileRef = 314A2DB247EA6781CE45C5C146496327 /* ToArray.swift */; };
-		A8DBBA1BD18472113BBE931A3F949659 /* Infallible+Bind.swift in Sources */ = {isa = PBXBuildFile; fileRef = 36C45F96BE0AE01F3BB2C90370A73616 /* Infallible+Bind.swift */; };
-		A8EEAAF6FACD8832BE7E4A6331ED57E4 /* ControlEvent+Signal.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9C3A35E7DD83A1437478608A9F2EF44C /* ControlEvent+Signal.swift */; };
-		A9AFA432B293A80CF9B1ABD1285A4705 /* AtomicInt.swift in Sources */ = {isa = PBXBuildFile; fileRef = A269EEED1FC8BFDA5FCB004DC335F5C8 /* AtomicInt.swift */; };
-		A9DD82DFCFA49DC81169D82415DE7B94 /* Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = D54CB24891D5C94C81CAED6F6D1D4FAB /* Rx.swift */; };
-		A9DFF7177D374AF79EEAD9F34B66569A /* NSButton+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 6DFC3F4E49698472F1AA8DE21B1BD0F2 /* NSButton+Rx.swift */; };
-		A9E6EFE85136C81C4AD5BF1CC1B990FD /* BinaryDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2FEFD09344E88FFE590FC0A7146C0D32 /* BinaryDisposable.swift */; };
-		AA5CBA43C0BF98751988A758EB180BA6 /* ScheduledItem.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8663196F6A9678BFC77A8E46F8666C75 /* ScheduledItem.swift */; };
-		AB83592C5AA99079DA59151D2ACDFBE2 /* ObservableConvertibleType+Driver.swift in Sources */ = {isa = PBXBuildFile; fileRef = E14C791F6C2C8320DE732C78C55306A1 /* ObservableConvertibleType+Driver.swift */; };
-		ABA85887A41495358C83CE3F3030EDEA /* CachedResponseHandler.swift in Sources */ = {isa = PBXBuildFile; fileRef = 32EC506B43DB4AE47634A8AEE18D9E8C /* CachedResponseHandler.swift */; };
-		ABDF69C30364D8B9BDFDA8D82A797396 /* ConcurrentDispatchQueueScheduler.swift in Sources */ = {isa = PBXBuildFile; fileRef = DB051CDFBF3B30AA181F5BF12F48FD3A /* ConcurrentDispatchQueueScheduler.swift */; };
-		AC9540D461C3407AB049AEDB94B82375 /* _RXDelegateProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 30E50B8D09D21C042020DA82FA315C59 /* _RXDelegateProxy.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		ADF86969180231C97A14929F02866A1E /* DefaultIfEmpty.swift in Sources */ = {isa = PBXBuildFile; fileRef = C798C591985DFD0B008AAEEBF78EF979 /* DefaultIfEmpty.swift */; };
-		AE143D6485273A676FF9FBF637EE32B3 /* Create.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3ED0602BE820AA0F7B2D99CBFED4C1F0 /* Create.swift */; };
-		AEA40BB1875D2E7B7DCB5E63E672033B /* UITableView+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 51E7C258B34B55C44CAA679574F0B5E1 /* UITableView+Rx.swift */; };
-		AECCE1EAA0757255BC4D722A53202DB0 /* GCDWebServer.h in Headers */ = {isa = PBXBuildFile; fileRef = C771BA2A255CC372CD2AB83291BD3E1C /* GCDWebServer.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		AED84FBEE9189CFC8A946DDC2BFCB2BE /* _RX.m in Sources */ = {isa = PBXBuildFile; fileRef = 74E6FB11E3F38127740B54FF3C72D1EF /* _RX.m */; };
-		B1501E5B044C314A7E3E08D5172CE6C4 /* MASLocalization.m in Sources */ = {isa = PBXBuildFile; fileRef = 46DA81F6288F2733B7F27CCDE97EA2C4 /* MASLocalization.m */; };
-		B21C782362344F1FBCA4C5792EC1DED4 /* PrimitiveSequence+Zip+arity.swift in Sources */ = {isa = PBXBuildFile; fileRef = A8C417EB740CAC7F2602C6D8880E7737 /* PrimitiveSequence+Zip+arity.swift */; };
-		B2246BF06902F6B9264919F779968CCB /* RxTableViewDataSourcePrefetchingProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = C15539256AFFEE061C9DE9660B995B25 /* RxTableViewDataSourcePrefetchingProxy.swift */; };
-		B261ED81ABD31C88EAC460E27E453FAE /* NSTextView+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5800B274C19C06FB1CA12AC039704852 /* NSTextView+Rx.swift */; };
-		B28F09A584B9F1BBF2EFD17B072A5CE1 /* UIStepper+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1B2134E06DD0F0E19694ADD2E46E9EF0 /* UIStepper+Rx.swift */; };
-		B3C0F4C71E972214529455424C69E544 /* GroupedObservable.swift in Sources */ = {isa = PBXBuildFile; fileRef = EFD30F9BBDEB87F6ADD6C3AAF8DE6E30 /* GroupedObservable.swift */; };
-		B3E529B0C5581EFBE667B478A97681F6 /* Pods-ShadowsocksX-NG-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = D60357581333E7EC56952E31B2991366 /* Pods-ShadowsocksX-NG-dummy.m */; };
-		B47372436C56EE24B909DE97D5005A64 /* GCDWebServerFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = DD31B6D267ADAB9B30F51F821C60554A /* GCDWebServerFunctions.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		B4E0DA5CB21C859040F39077A2731701 /* ImmediateSchedulerType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7DF9FA6B1D40855A99145762147C1690 /* ImmediateSchedulerType.swift */; };
-		B59F717CE3CD531818EAFE88FBB454AA /* InfiniteSequence.swift in Sources */ = {isa = PBXBuildFile; fileRef = EB62C29E42A50AB4AA5C6DED19DA376D /* InfiniteSequence.swift */; };
-		B6634C3C7216D0A7B063174C16BA1922 /* PrimitiveSequence.swift in Sources */ = {isa = PBXBuildFile; fileRef = 280A80C3BD890370005C094FC4C3DC12 /* PrimitiveSequence.swift */; };
-		B7B31CEFFD225FE0DE33DA0CAAFB46BB /* AnonymousObserver.swift in Sources */ = {isa = PBXBuildFile; fileRef = 636D1EE61F0E0E367F486461F8E0DF54 /* AnonymousObserver.swift */; };
-		B82E2164A69C0D6D3A21B76EFF96F083 /* SharedSequence+Operators.swift in Sources */ = {isa = PBXBuildFile; fileRef = D18636DE7B757847E9D7B9E45CA10DE2 /* SharedSequence+Operators.swift */; };
-		B8B7E2AC4972978F6894F9C22936CA42 /* Driver.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5E698A2854CB4D9E919B55523EB57D1A /* Driver.swift */; };
-		B90A504C57627AFCC56F0608D321FB31 /* nl.lproj in Resources */ = {isa = PBXBuildFile; fileRef = A94A0417121D2C31F7167E4A79EC5313 /* nl.lproj */; };
-		B936FB1A1779B971BCE58D1CFB84036B /* SingleAssignmentDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = FCF992D22D15D6CF73AF4D310FEE871C /* SingleAssignmentDisposable.swift */; };
-		B9C2804D9E9FD66CF22595DBFED0DC79 /* SubscribeOn.swift in Sources */ = {isa = PBXBuildFile; fileRef = 17A8B6DADE1F343EA5319D5964E84B71 /* SubscribeOn.swift */; };
-		BAB6CF7AB28DA0D4BCBC2CF5F53D51AE /* UIScrollView+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 441E899D371A5638D8CBD0A21A8CCA61 /* UIScrollView+Rx.swift */; };
-		BAC5C3D7F895C6A95B5EA70D1C4BB998 /* DispatchQueueConfiguration.swift in Sources */ = {isa = PBXBuildFile; fileRef = 222E861679233A0833D6C2F8079146E7 /* DispatchQueueConfiguration.swift */; };
-		BACB203DEE570915EDEC3E701158A173 /* AsMaybe.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7D680C4252D37F732EE2D1BB9AB911DA /* AsMaybe.swift */; };
-		BB15F798287F7447B78B4D49522030C4 /* SwiftSupport.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0BC06E9EC97DF3F5E3AB732D978BD66B /* SwiftSupport.swift */; };
-		BB322452A0B606428489BA2B2F6D3715 /* NSControl+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = AAFFAAB92EFEC042FEE2F851EF9C6CC0 /* NSControl+Rx.swift */; };
-		BC03F491551F314E102DEB2F96110609 /* ObservableConvertibleType+Signal.swift in Sources */ = {isa = PBXBuildFile; fileRef = C3DCF3854C69F5239CE7E89C1FCFAA51 /* ObservableConvertibleType+Signal.swift */; };
-		BC184A6D6502B7B4B308496F5172E4FE /* SynchronizedOnType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 95A61E2BD71E9AE873207EFE8994362B /* SynchronizedOnType.swift */; };
-		BD379AB5D6DF4FF97EF15732D9635186 /* GCDWebServerURLEncodedFormRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 97319F4B64360DC3D794BD7B57BC9936 /* GCDWebServerURLEncodedFormRequest.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		BD386D2A7F6652D62B9E75803D3AAD3B /* Bag.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2BDFA1D8F5CB80DCE3773C11691B223D /* Bag.swift */; };
-		BEF81EB8E8A3FB2B8519CDF1C6DEDA1E /* CombineLatest+Collection.swift in Sources */ = {isa = PBXBuildFile; fileRef = 68D133622632E3F0C62D1F74D188EA7E /* CombineLatest+Collection.swift */; };
-		BF1EB892BE3CF9CDFA0DAC7F9392435C /* GCDWebServerRequest.m in Sources */ = {isa = PBXBuildFile; fileRef = D4E3DADB00C8898A4A01F4DF1034F96C /* GCDWebServerRequest.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		C09F690FF2734763D8D2838B0BA14B0F /* RxCocoa-umbrella.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C0551E43C5CE2E6F3BD09C18890BFD /* RxCocoa-umbrella.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		C0ACE318CA3576826A53026F9C253E0B /* RefCountDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = B97E5FCD7744551B43A8C353FD79E774 /* RefCountDisposable.swift */; };
-		C0E1B20534F498B9891E956388D79209 /* NSView+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = C4028B836251B6DD18772CF35047686A /* NSView+Rx.swift */; };
-		C0EA3A392A5229080E52F9FDF969FDC8 /* Completable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2AE63CBE5D3B0C2D25184C45E1B8C885 /* Completable.swift */; };
-		C1C5B050B55C15103ABC81769551A283 /* Response.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0D09EFC8E8E0DD0BACEB39FA20E08331 /* Response.swift */; };
-		C1F1DB6A9CBDE584D09BA1613AAD4F9D /* Alamofire.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2E656BCAB89EA23EC58A161ACF0DAE68 /* Alamofire.swift */; };
-		C33311F020C5777D0CB7E0F61E4FED8D /* Shortcut.h in Headers */ = {isa = PBXBuildFile; fileRef = 6B9491CF676F85A85C4F0987D38F9051 /* Shortcut.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		C341FC8944C28CCA39FB9AC4B0F23763 /* GCDWebServerHTTPStatusCodes.h in Headers */ = {isa = PBXBuildFile; fileRef = 57BEC3094A7FB642608645E131DA83D4 /* GCDWebServerHTTPStatusCodes.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		C3D17F4F92CD46A4285A92D1FD6AA4B1 /* fr.lproj in Resources */ = {isa = PBXBuildFile; fileRef = B68B5F9FDDB0D41979766C1D549A8780 /* fr.lproj */; };
-		C4CD2007BF8F2B0B5125A85B1C43AD24 /* ReplayRelay.swift in Sources */ = {isa = PBXBuildFile; fileRef = 485A8E801F2DA21AB5D16808AE1B4887 /* ReplayRelay.swift */; };
-		C60C9B7447C5D9555611004E27093043 /* SharedSequence+Operators+arity.swift in Sources */ = {isa = PBXBuildFile; fileRef = 87A94DCCD78781BAE448DEA818B26DE4 /* SharedSequence+Operators+arity.swift */; };
-		C6D5A4B4028B2C43380C9FA58BD5C8CA /* Alamofire-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = 06A09DBC68AE0A93F94442D71EBF343F /* Alamofire-dummy.m */; };
-		C7A325790D6CB1C3545FE9E688545C56 /* BooleanDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = EA0C023ECBE853C3AFE12E6702B6D1CD /* BooleanDisposable.swift */; };
-		C81FF014587AC7E1A51D4F3F2C6F72EA /* ReplaySubject.swift in Sources */ = {isa = PBXBuildFile; fileRef = 96D93775EA307729314581C5C539C487 /* ReplaySubject.swift */; };
-		C83DA2E174587856EBBAAA1763F6D483 /* _RXKVOObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = A8A33670952794CBD825EC26F1A98DBF /* _RXKVOObserver.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		C8422B20017685DE0D693EC679FF8BF6 /* KVORepresentable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 54F202B17AB2C7DC4FEC3F1CF2B5FD57 /* KVORepresentable.swift */; };
-		CA391E5CE794FA6D964DC2DFC8B8E109 /* NSObject+Rx+KVORepresentable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7B00813C768C553C089DAF0C1900799B /* NSObject+Rx+KVORepresentable.swift */; };
-		CC9F7F2B397CCCC5397750D0B139E373 /* Utils.swift in Sources */ = {isa = PBXBuildFile; fileRef = 29BFF21F894144F23E9F778185A1EBC4 /* Utils.swift */; };
-		CCE2D9FB50D6084FD48013ED3474F992 /* Optional.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5158C591583049B150EC9F57DC2FA656 /* Optional.swift */; };
-		CD782D1189ADBAA42D087B87D53838A0 /* GCDWebServerDataRequest.m in Sources */ = {isa = PBXBuildFile; fileRef = 7DFEE31FDCAA3B9A85119C45EE5BF376 /* GCDWebServerDataRequest.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		CE622A228B2F310835326CCF0B83F031 /* SynchronizedDisposeType.swift in Sources */ = {isa = PBXBuildFile; fileRef = F3623071AC720B9C13DD1043F7052A73 /* SynchronizedDisposeType.swift */; };
-		CEA50BEC377AEE2AAA9DB5B71DEA418C /* BRLOptionParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 31F9576864749334961DE762B01B777C /* BRLOptionParser.h */; settings = {ATTRIBUTES = (Project, ); }; };
-		D03F1F02DE8606E6057D57866611BEBF /* MultipartUpload.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9CF5ADA01C91A2DF993314D6CC9C63D3 /* MultipartUpload.swift */; };
-		D0B9EA4DC98653D58DEAE9629A2F0285 /* SkipUntil.swift in Sources */ = {isa = PBXBuildFile; fileRef = A1D0AF20D0BF5465039BB88836A959B6 /* SkipUntil.swift */; };
-		D0C4275AF3346D1C08B187D04D9606F2 /* Platform.Darwin.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8E801F2049749D5BA709EAE3A2028661 /* Platform.Darwin.swift */; };
-		D13BDCB5C86CD4018E19F1DA207BA61A /* CurrentThreadScheduler.swift in Sources */ = {isa = PBXBuildFile; fileRef = C793DFE7002D416E900642C76CEEBD75 /* CurrentThreadScheduler.swift */; };
-		D14066FAE94E304798E43651E5886D13 /* ParameterEncoding.swift in Sources */ = {isa = PBXBuildFile; fileRef = ECF8CD0A416163A50B72AAF4B0C4A124 /* ParameterEncoding.swift */; };
-		D21D80287E6B1C56E0BE86B1E3F08249 /* Decode.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5D99DA86D8CBFFCB2E7FD40BC42568F3 /* Decode.swift */; };
-		D251A0235B97F9217D50C5A1C7C5F311 /* URLSession+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = EAB5B580FE6B602D602E607C7BC7C470 /* URLSession+Rx.swift */; };
-		D260B45339932BAA56D7024048E2D155 /* GCDWebServerConnection.m in Sources */ = {isa = PBXBuildFile; fileRef = 1410700BFA8AF785CCF9919941F9930C /* GCDWebServerConnection.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		D31FC7FDD450C4CDD633ECBAD27C6221 /* URLEncodedFormEncoder.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5D0A2A589A608DD00CA24C86BCD46E62 /* URLEncodedFormEncoder.swift */; };
-		D33C1AD2E019F48235F734A00CE7C24C /* GCDWebServerFileResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 77E73C4E3CAF9AD8FAE2EA9130D6A37E /* GCDWebServerFileResponse.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		D37A995029438A503B62B1D2ACFE9247 /* MASShortcut.bundle in Resources */ = {isa = PBXBuildFile; fileRef = 230F8208BE63C052A548A7D41A1158B2 /* MASShortcut.bundle */; };
-		D557532ED179C1F26074DCD602EF357D /* cs.lproj in Resources */ = {isa = PBXBuildFile; fileRef = 18B45BFB16E63DDF1AFB6C167D70D1C2 /* cs.lproj */; };
-		D574A95C82CDFCC40442A4C5A20645D9 /* Single.swift in Sources */ = {isa = PBXBuildFile; fileRef = A3E96B8BC40FDC92B51E51B50F126573 /* Single.swift */; };
-		D57542063237724C1CA2962EAC1764C7 /* Sequence.swift in Sources */ = {isa = PBXBuildFile; fileRef = 172B845C32EEB48FD9EF1A11CC432D51 /* Sequence.swift */; };
-		D597C1B3CBDE4896A022E9422A4F4874 /* Debug.swift in Sources */ = {isa = PBXBuildFile; fileRef = 555231B7293881D7D76CA80C82AABA2B /* Debug.swift */; };
-		D5E020763D69E9336EB398ACD48FEBB0 /* GCDWebServerErrorResponse.m in Sources */ = {isa = PBXBuildFile; fileRef = 199E49652A8B30754D25980910F956E1 /* GCDWebServerErrorResponse.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		D5EAAFB6FAD77A8F0699345149BA3CBB /* URLRequest+Alamofire.swift in Sources */ = {isa = PBXBuildFile; fileRef = 47291D90953698297410B0C37E619402 /* URLRequest+Alamofire.swift */; };
-		D6389E438CF72863B7F4832592B60428 /* Empty.swift in Sources */ = {isa = PBXBuildFile; fileRef = 65D8FEBF2028BCC7758A666F2A35989A /* Empty.swift */; };
-		D661EA5F16B11BEE347BAE35961A3AD2 /* TailRecursiveSink.swift in Sources */ = {isa = PBXBuildFile; fileRef = 558A95B0EAE7FAFDFCC334A1E9277C19 /* TailRecursiveSink.swift */; };
-		D9884F11DD4FAA059A45CBBBC68E090F /* RxCollectionViewReactiveArrayDataSource.swift in Sources */ = {isa = PBXBuildFile; fileRef = B25AD05D537735CCA21E1986D98F830E /* RxCollectionViewReactiveArrayDataSource.swift */; };
-		DAB6B67BBE65A9ECA898A563CACF442A /* RxWKNavigationDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3AC418FEB3CC60F42D6A18E6151C871A /* RxWKNavigationDelegateProxy.swift */; };
-		DADE159BB4CF9E438FC5DEF80822A710 /* MASHotKey.m in Sources */ = {isa = PBXBuildFile; fileRef = 7BE4993AB90D97D332E61EB54E0C3C9A /* MASHotKey.m */; };
-		DBFA45EBB79E16D7B6780CDA789B0D08 /* SkipWhile.swift in Sources */ = {isa = PBXBuildFile; fileRef = 904A920F44C4C4A18874A6A62A3ED759 /* SkipWhile.swift */; };
-		DC627AFC5B585686898B014184AFCABD /* AuthenticationInterceptor.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2E101994FDA2210D6CD7972A656C511F /* AuthenticationInterceptor.swift */; };
-		DC708FA8C70373D522CB885D4451F3D0 /* RxTabBarDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 66D1DACD1512DCFE82BC525C443DA8A5 /* RxTabBarDelegateProxy.swift */; };
-		DCC8DE3CDC74A5E38864303C8C2404EF /* ObserverBase.swift in Sources */ = {isa = PBXBuildFile; fileRef = CE8BA32B7F7B571C37D44747CBB93955 /* ObserverBase.swift */; };
-		DD24A504D1BB91B71B67B4A93A92F1DA /* ConcurrentMainScheduler.swift in Sources */ = {isa = PBXBuildFile; fileRef = A126CA25C01C17FEF1E4B62108855349 /* ConcurrentMainScheduler.swift */; };
-		DD7EC76A4EB8C3A1741CD5B77B57E0A4 /* UISwitch+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3622945DEBFCB14514027A236BDFC74C /* UISwitch+Rx.swift */; };
-		DDA573352B48255CA674E8BB62C306C6 /* Using.swift in Sources */ = {isa = PBXBuildFile; fileRef = FE3AAA7586F734974B628C45E2310229 /* Using.swift */; };
-		DE76073247081964D8DA688F13021B62 /* UISegmentedControl+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = E39E7221D0BA332CC5AC5DD0A7C16C92 /* UISegmentedControl+Rx.swift */; };
-		DF3FD63D6A37C12FDB09B8CA5AE80AC3 /* GCDWebServerPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 10F2E7253B70490BD80C987E65C522AC /* GCDWebServerPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		E03556E8EC8DA4FF0DE3ED6F86BD7C51 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */; };
-		E06F7DEDC12A706F1AA7067CA7D58BD8 /* Disposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8369906FA14B85B8271089FAAA1E4694 /* Disposable.swift */; };
-		E0AF255AB2AFA980F44645355BB7828C /* _RX.h in Headers */ = {isa = PBXBuildFile; fileRef = 3BAD385D5CDC39C1AE6584A123D2DFC4 /* _RX.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		E1AD1FE46FE8F693F913FEC190210A59 /* RxCocoa-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = 4752AFB18B745CA95D95FB7457EAA1C4 /* RxCocoa-dummy.m */; };
-		E26E725D6366FA3AE20B95802F54C4B6 /* WithUnretained.swift in Sources */ = {isa = PBXBuildFile; fileRef = 897003218412D0C779A54DAAD7D2A4EE /* WithUnretained.swift */; };
-		E3EE570AEF6808660B0542591285D354 /* RxRelay-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = 1718F5B8FAF3CE57AE64B5F53589493F /* RxRelay-dummy.m */; };
-		E46EB73E26A44700E41C3CD2F1E847FD /* Event.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5CE7CD3C7A16D2E9341BBBAB18D5D8DC /* Event.swift */; };
-		E52E9DB2E0EB574ED157EB478E60D13D /* Pods-proxy_conf_helper-dummy.m in Sources */ = {isa = PBXBuildFile; fileRef = 8752D17209EE8AAD7681107D6444113F /* Pods-proxy_conf_helper-dummy.m */; };
-		E5A162C30F57D3A21BD9D74BC97E782E /* First.swift in Sources */ = {isa = PBXBuildFile; fileRef = 543DFE92FBC6235F6826EF38928A7C08 /* First.swift */; };
-		E5F1157CAB86D8C0C166874A6E826739 /* Materialize.swift in Sources */ = {isa = PBXBuildFile; fileRef = E4618B5826B29CA49F53BD36B1570602 /* Materialize.swift */; };
-		E5F3CF900C793B92F327E2F4BDF8A8AB /* MASLocalization.h in Headers */ = {isa = PBXBuildFile; fileRef = 82A2597C8D9860F95F40565C0631A47D /* MASLocalization.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		E8064C59B797763270D65097B4CD075B /* ObservableConvertibleType+SharedSequence.swift in Sources */ = {isa = PBXBuildFile; fileRef = DFAC6355D5B0FD94083A74B4602AF9D2 /* ObservableConvertibleType+SharedSequence.swift */; };
-		E816A86AE437A96B389D73C115778CFA /* NSObject+Rx+RawRepresentable.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4C9EBFDB861299F7DC1241C7FCFF00DD /* NSObject+Rx+RawRepresentable.swift */; };
-		E83CDC839BC5CA753A57BE04CB66F85D /* ConnectableObservableType.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2505B197F74151D018080608E6576C6C /* ConnectableObservableType.swift */; };
-		E84DB9453D7F43DCEC20FDFB5F1CDFD6 /* RxSearchBarDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 345AE1A0C847584A14AD381D5E476AB9 /* RxSearchBarDelegateProxy.swift */; };
-		E9B95D42F4510C79E2D8A8CFA251CD49 /* GCDWebServer.m in Sources */ = {isa = PBXBuildFile; fileRef = 55F5FEB17D952CAA64A6B7DE90D7E47D /* GCDWebServer.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		E9C69CBF2B72EC9A5031BA6FF30BC251 /* Generate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 886072F083033D493924A8BE652713ED /* Generate.swift */; };
-		E9FD5789C7C4946FC504E7C679BDD156 /* ControlProperty.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5878F666B9410A53C5BBE1778D1B2CCE /* ControlProperty.swift */; };
-		EA82A6A287EA96119DF03722AB2F25B8 /* Just.swift in Sources */ = {isa = PBXBuildFile; fileRef = FA1467E6A8A0A5B978108FDFC868000E /* Just.swift */; };
-		EB8C4B9D8DFF39ECFE8538B73F5717F7 /* CompactMap.swift in Sources */ = {isa = PBXBuildFile; fileRef = A6415209F9685A39C6C1018082155EA5 /* CompactMap.swift */; };
-		EC388029B45DC677A2412CF1617E4DF1 /* SystemConfiguration.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EF91750DCDE73B687E4BA164856BE224 /* SystemConfiguration.framework */; };
-		ED82861E104428E8C3FA8D1B2618C875 /* Producer.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4FDB60114950AF3BF06EF9DA0AF9E5AC /* Producer.swift */; };
-		EDC93BD7B9262119AE145E4C7A9D0212 /* Request.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9029CBEE1EB8EBFDFCC3F55CEC98E088 /* Request.swift */; };
-		EDD85DAC7DC88B01D5A2C20969416C9B /* BRLOptionParser.m in Sources */ = {isa = PBXBuildFile; fileRef = 68C9C3CF6142E1B32695BC562ECAC427 /* BRLOptionParser.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		F01A39BF2122BF11990A88015EF45A48 /* Pods-ShadowsocksX-NG-umbrella.h in Headers */ = {isa = PBXBuildFile; fileRef = CD95085BFAA31431686824B236DB9319 /* Pods-ShadowsocksX-NG-umbrella.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		F07EC9B60B1FB76D9F64FE2BC62A87DF /* MASShortcutView+Bindings.h in Headers */ = {isa = PBXBuildFile; fileRef = B5AEEDAA3124911175E2336A08227588 /* MASShortcutView+Bindings.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		F0F3224FF592F9BA2A044A2FC2BD4CCD /* Validation.swift in Sources */ = {isa = PBXBuildFile; fileRef = 151A22449BAFE60147DA302082A00FA1 /* Validation.swift */; };
-		F186B25E38062738E07F219D0289CBFA /* ItemEvents.swift in Sources */ = {isa = PBXBuildFile; fileRef = 684F8C697CD894D0F5680EE542AC32E9 /* ItemEvents.swift */; };
-		F1A73AB066B6EC8C012F4044B542568D /* Map.swift in Sources */ = {isa = PBXBuildFile; fileRef = 494A67061DAFFD52534BC4699A8DF637 /* Map.swift */; };
-		F1F7AF19C5D50FB5BCD1D357FB9A5946 /* Do.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0E5F518C62FDAA5A762312C37D1CB101 /* Do.swift */; };
-		F2AB55CF962B7EBDE26DD970C282CEDE /* RxTableViewReactiveArrayDataSource.swift in Sources */ = {isa = PBXBuildFile; fileRef = B265FABD755D21851D1C166921BB4A24 /* RxTableViewReactiveArrayDataSource.swift */; };
-		F44EF6685A8C029EAC293DE9FADC3794 /* ControlTarget.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5DA6A1DA8589C7192C8BFDBC3F4A9913 /* ControlTarget.swift */; };
-		F45717BF2118BB61C328A1F67CFE9238 /* Driver+Subscription.swift in Sources */ = {isa = PBXBuildFile; fileRef = D7F46244A2FF95EF2B228E2F76529358 /* Driver+Subscription.swift */; };
-		F4C5E42370FEF310E72D2A8DAD2993FB /* pl.lproj in Resources */ = {isa = PBXBuildFile; fileRef = EE873D31D9227598B067D9426D366009 /* pl.lproj */; };
-		F515F0E56CBF807E49797455E495074C /* MASShortcutMonitor.m in Sources */ = {isa = PBXBuildFile; fileRef = 605C26B2F1FFA16F0E85E33F5CC526EC /* MASShortcutMonitor.m */; };
-		F5C3C227785D45C44F1FA8157EF99C71 /* GCDWebServerErrorResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 9EE8B6717B73CE07A9FAC17FFCB1BA91 /* GCDWebServerErrorResponse.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		F5E8D9EC4166B35C084791CAEFF2404C /* WithLatestFrom.swift in Sources */ = {isa = PBXBuildFile; fileRef = A49E3489F755F888C3405824694827BF /* WithLatestFrom.swift */; };
-		F621486B5084C21DA2498C0FC6A85E02 /* AnyObserver.swift in Sources */ = {isa = PBXBuildFile; fileRef = 840A431555445FF451B4B74E7A8DDCF4 /* AnyObserver.swift */; };
-		F654788A27A296CD2C1F104B4C897EF0 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */; };
-		F6F5712CC3ED7DD4D51BA12747FCDE6E /* MASDictionaryTransformer.m in Sources */ = {isa = PBXBuildFile; fileRef = F6460C30C5328ED85A1103897C8CB63C /* MASDictionaryTransformer.m */; };
-		F70EF854395CDE981A8336E4FF0310FE /* URLSessionConfiguration+Alamofire.swift in Sources */ = {isa = PBXBuildFile; fileRef = 83FE5C08C0F9F63C9A7D2B71EF9F0864 /* URLSessionConfiguration+Alamofire.swift */; };
-		F71DB74D923AB8F40A88103BDC5ABFA6 /* RxTextStorageDelegateProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = 95B33DD3F11E0587A32ECE709173E4EF /* RxTextStorageDelegateProxy.swift */; };
-		F7DAD2EF3F86BC40F7D4F2EE49362418 /* GCDWebServerStreamedResponse.m in Sources */ = {isa = PBXBuildFile; fileRef = DAE48A7C993FBD43A674E228A900457B /* GCDWebServerStreamedResponse.m */; settings = {COMPILER_FLAGS = "-DOS_OBJECT_USE_OBJC=0"; }; };
-		F89A75BE493264635F9977B0A9233617 /* ObservableConvertibleType+Infallible.swift in Sources */ = {isa = PBXBuildFile; fileRef = 834EB5666F2D27EDBD25C600C80DF7CE /* ObservableConvertibleType+Infallible.swift */; };
-		F8C1D484E959F9ADD96E9CD2F3B045B0 /* Observable+Bind.swift in Sources */ = {isa = PBXBuildFile; fileRef = E8976DA3C1E5870E7B74F26E219A9885 /* Observable+Bind.swift */; };
-		F8EC0962127455A9E5ABEA1B2D0C91D7 /* UIActivityIndicatorView+Rx.swift in Sources */ = {isa = PBXBuildFile; fileRef = 89A41E2A66DF6A8547AFAB72FE74B6A2 /* UIActivityIndicatorView+Rx.swift */; };
-		F9872C7244CA7C80D5E402B3922DB009 /* SchedulerType+SharedSequence.swift in Sources */ = {isa = PBXBuildFile; fileRef = 53EB3CB0FCC5ABA4F18B576E6BA4EB1F /* SchedulerType+SharedSequence.swift */; };
-		F9C743AF2433172C84F9365D8DE8CBF3 /* MASShortcutValidator.m in Sources */ = {isa = PBXBuildFile; fileRef = 726DEA3A84065F8E12FDE5617447B366 /* MASShortcutValidator.m */; };
-		FA547DB169BA1CB0759702BA51F1C52E /* SubscriptionDisposable.swift in Sources */ = {isa = PBXBuildFile; fileRef = DAFB048690381EFB0893639F33D3C764 /* SubscriptionDisposable.swift */; };
-		FAEF22DB65A2C18EAF044623FF4ECA43 /* SingleAsync.swift in Sources */ = {isa = PBXBuildFile; fileRef = A2B10B3F59B2394712B672A72C5827F0 /* SingleAsync.swift */; };
-		FB3AD79C536DC201CED66150778FA691 /* RxSwift.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BFD92A4EF88D0A6B34E86A6A7CE2436D /* RxSwift.framework */; };
-		FB425C8625656D7AE2AFD1F8A78713B0 /* MASShortcutBinder.m in Sources */ = {isa = PBXBuildFile; fileRef = 46002374E8C8C6F2127C7C9A6DFEF743 /* MASShortcutBinder.m */; };
-		FC22B1E68007E6AC40CC8DF2DF5E0AB6 /* Zip.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9FA0DBB3C5358A6E4EF0C16145BB0F7E /* Zip.swift */; };
-		FCBF7F9DA53A194F0653EE7E00B57BC8 /* GCDWebServerMultiPartFormRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = D157799A728D6FFED669C62E86BABD73 /* GCDWebServerMultiPartFormRequest.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		FD397CD62192F67DF9C2088CC5EBE409 /* ControlEvent.swift in Sources */ = {isa = PBXBuildFile; fileRef = 38724BD70D1712C03FA9B7A4C417144D /* ControlEvent.swift */; };
-		FDEBCA25E0674ADFB66FA6256FF6486F /* RxCollectionViewDataSourceProxy.swift in Sources */ = {isa = PBXBuildFile; fileRef = C5BD2C8DB205D16490D3804A6CAB6C50 /* RxCollectionViewDataSourceProxy.swift */; };
-		FF36522388E5964B78AD72A59721AADC /* de.lproj in Resources */ = {isa = PBXBuildFile; fileRef = 8F90CD66F125C28F8983AFCFA7DF6607 /* de.lproj */; };
-		FFF63A18CD673B6821ED19EB164316C9 /* Signal+Subscription.swift in Sources */ = {isa = PBXBuildFile; fileRef = 12318B6E6BA8040BCC422023A5ABEF27 /* Signal+Subscription.swift */; };
-/* End PBXBuildFile section */
-
-/* Begin PBXContainerItemProxy section */
-		1CA90026A2A030CD980CB1E78050B63A /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 4622BFEF3DC16E8BD15EEFC30D4D0084;
-			remoteInfo = RxRelay;
-		};
-		290D7A27821274F88F50BA4027E877B0 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 00F92A6698B766C4479D7B608F28D680;
-			remoteInfo = BRLOptionParser;
-		};
-		3A3C6F9E9E958812D1FF93C9737FE5B1 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = EA9EA43B3B503823EE36C60D9C8A865F;
-			remoteInfo = RxSwift;
-		};
-		3DE69038DEBF7AC72F345377CCA1A457 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 73C37A16ECCEAD845651DCDEE95675BE;
-			remoteInfo = "MASShortcut-MASShortcut";
-		};
-		6C21C08D1A9E4A42298C1E83946EFBF6 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = EAAA1AD3A8A1B59AB91319EE40752C6D;
-			remoteInfo = Alamofire;
-		};
-		7569E9B350638EBD714C781E38F158A8 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = E9FDECF69808DB0491D4B4C08CF920DC;
-			remoteInfo = "Pods-ShadowsocksX-NG";
-		};
-		809667767BFFB7D46B762AD5F006A069 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = EA9EA43B3B503823EE36C60D9C8A865F;
-			remoteInfo = RxSwift;
-		};
-		93C581FCCE9BCA693063DEB0CB18943C /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 4622BFEF3DC16E8BD15EEFC30D4D0084;
-			remoteInfo = RxRelay;
-		};
-		95ED7E1E76F66FF2AFA473A3D49F574E /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = EA9EA43B3B503823EE36C60D9C8A865F;
-			remoteInfo = RxSwift;
-		};
-		A5DE8E8EE1A9A5D27FEA05AD1FF38C1E /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 7AD0C6DCDC9CEC8A3C7C10C7FEE07BE6;
-			remoteInfo = RxCocoa;
-		};
-		B0B5FA86CABF29A7785405416D374CDA /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 2B2B481A164695722839BD581D442457;
-			remoteInfo = MASShortcut;
-		};
-		E627335D42AC0ADFBA7B40BFD314B204 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = AD904F32069787EFB2DFFE05EB82F5BD;
-			remoteInfo = GCDWebServer;
-		};
-/* End PBXContainerItemProxy section */
-
-/* Begin PBXFileReference section */
-		04A3FEA575D65278CDB553AA231A0CF6 /* DisposeBase.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = DisposeBase.swift; path = RxSwift/Disposables/DisposeBase.swift; sourceTree = "<group>"; };
-		0555618E1BBA944D30E358F0700CDD8B /* GCDWebServerFunctions.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerFunctions.m; path = GCDWebServer/Core/GCDWebServerFunctions.m; sourceTree = "<group>"; };
-		06A09DBC68AE0A93F94442D71EBF343F /* Alamofire-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "Alamofire-dummy.m"; sourceTree = "<group>"; };
-		07B4CEF97C27B2FE6205EE1D720BFB39 /* Skip.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Skip.swift; path = RxSwift/Observables/Skip.swift; sourceTree = "<group>"; };
-		080201197B517655700BD33F44B1A602 /* Dematerialize.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Dematerialize.swift; path = RxSwift/Observables/Dematerialize.swift; sourceTree = "<group>"; };
-		09A0680C8640FDF225CF2A27A4204628 /* GCDWebServer-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "GCDWebServer-dummy.m"; sourceTree = "<group>"; };
-		0A18EEA4857408358F9A8E6ED8AF8829 /* Observable+Bind.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Observable+Bind.swift"; path = "RxRelay/Observable+Bind.swift"; sourceTree = "<group>"; };
-		0B98DA4C08DC1A12B2789714C6CDEFFA /* Bag.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Bag.swift; path = Platform/DataStructures/Bag.swift; sourceTree = "<group>"; };
-		0BC06E9EC97DF3F5E3AB732D978BD66B /* SwiftSupport.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SwiftSupport.swift; path = RxSwift/SwiftSupport/SwiftSupport.swift; sourceTree = "<group>"; };
-		0C0FB7A81FC88101C56EABF826BD78F5 /* Reactive.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Reactive.swift; path = RxSwift/Reactive.swift; sourceTree = "<group>"; };
-		0C1C25377D5ADEBBE1E5B44FD42F2BF8 /* GCDWebServerMultiPartFormRequest.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerMultiPartFormRequest.m; path = GCDWebServer/Requests/GCDWebServerMultiPartFormRequest.m; sourceTree = "<group>"; };
-		0CB05B6D60934D955FE0D75C2339A114 /* Amb.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Amb.swift; path = RxSwift/Observables/Amb.swift; sourceTree = "<group>"; };
-		0D09EFC8E8E0DD0BACEB39FA20E08331 /* Response.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Response.swift; path = Source/Response.swift; sourceTree = "<group>"; };
-		0E5F518C62FDAA5A762312C37D1CB101 /* Do.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Do.swift; path = RxSwift/Observables/Do.swift; sourceTree = "<group>"; };
-		0F2EB184269284B56190B6EE5A7E5CC3 /* DisposeBag.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = DisposeBag.swift; path = RxSwift/Disposables/DisposeBag.swift; sourceTree = "<group>"; };
-		10E99E50E2994DB7AD9AEBDEF1A2F72B /* Alamofire-umbrella.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "Alamofire-umbrella.h"; sourceTree = "<group>"; };
-		10F2E7253B70490BD80C987E65C522AC /* GCDWebServerPrivate.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerPrivate.h; path = GCDWebServer/Core/GCDWebServerPrivate.h; sourceTree = "<group>"; };
-		111E9F3F4997D0ACA2E0BCDAF269904C /* SchedulerType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SchedulerType.swift; path = RxSwift/SchedulerType.swift; sourceTree = "<group>"; };
-		11DD125BCF1FDD4E34715800EC2F295F /* RecursiveLock.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RecursiveLock.swift; path = Platform/RecursiveLock.swift; sourceTree = "<group>"; };
-		11F97CBA2FD3653262BC227DD1340D90 /* Pods-proxy_conf_helper-acknowledgements.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "Pods-proxy_conf_helper-acknowledgements.plist"; sourceTree = "<group>"; };
-		12318B6E6BA8040BCC422023A5ABEF27 /* Signal+Subscription.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Signal+Subscription.swift"; path = "RxCocoa/Traits/Signal/Signal+Subscription.swift"; sourceTree = "<group>"; };
-		127B3965CEBAEBFB395F0D10B7C255FB /* Throttle.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Throttle.swift; path = RxSwift/Observables/Throttle.swift; sourceTree = "<group>"; };
-		1389D4639C0D9038BA081FA8DC1CD646 /* BRLOptionParser-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "BRLOptionParser-dummy.m"; sourceTree = "<group>"; };
-		1410700BFA8AF785CCF9919941F9930C /* GCDWebServerConnection.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerConnection.m; path = GCDWebServer/Core/GCDWebServerConnection.m; sourceTree = "<group>"; };
-		151A22449BAFE60147DA302082A00FA1 /* Validation.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Validation.swift; path = Source/Validation.swift; sourceTree = "<group>"; };
-		161437331F54761E08F028DD14CDC21E /* Infallible+Create.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Infallible+Create.swift"; path = "RxSwift/Traits/Infallible/Infallible+Create.swift"; sourceTree = "<group>"; };
-		1718F5B8FAF3CE57AE64B5F53589493F /* RxRelay-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "RxRelay-dummy.m"; sourceTree = "<group>"; };
-		172B845C32EEB48FD9EF1A11CC432D51 /* Sequence.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Sequence.swift; path = RxSwift/Observables/Sequence.swift; sourceTree = "<group>"; };
-		17A8B6DADE1F343EA5319D5964E84B71 /* SubscribeOn.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SubscribeOn.swift; path = RxSwift/Observables/SubscribeOn.swift; sourceTree = "<group>"; };
-		17F9F190DDBE93E38A56D8405CBFA664 /* UIButton+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIButton+Rx.swift"; path = "RxCocoa/iOS/UIButton+Rx.swift"; sourceTree = "<group>"; };
-		18B45BFB16E63DDF1AFB6C167D70D1C2 /* cs.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = cs.lproj; path = Resources/cs.lproj; sourceTree = "<group>"; };
-		196DA983244F60766BA272090829A16E /* Pods-ShadowsocksX-NGTests.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = "Pods-ShadowsocksX-NGTests.debug.xcconfig"; sourceTree = "<group>"; };
-		199E49652A8B30754D25980910F956E1 /* GCDWebServerErrorResponse.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerErrorResponse.m; path = GCDWebServer/Responses/GCDWebServerErrorResponse.m; sourceTree = "<group>"; };
-		19AA7CC35C97B4BDF08E2E5CE20955E0 /* AlamofireExtended.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AlamofireExtended.swift; path = Source/AlamofireExtended.swift; sourceTree = "<group>"; };
-		19FF8B675AE7A3F0AB7CDE7C48E8082A /* ScheduledItemType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ScheduledItemType.swift; path = RxSwift/Schedulers/Internal/ScheduledItemType.swift; sourceTree = "<group>"; };
-		1A2C716EE769E98BF094D14B243A42C2 /* Alamofire-prefix.pch */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "Alamofire-prefix.pch"; sourceTree = "<group>"; };
-		1AA3BEB86C50C2AAE9CCEDB0171CFC56 /* ObservableType+PrimitiveSequence.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "ObservableType+PrimitiveSequence.swift"; path = "RxSwift/Traits/PrimitiveSequence/ObservableType+PrimitiveSequence.swift"; sourceTree = "<group>"; };
-		1B2134E06DD0F0E19694ADD2E46E9EF0 /* UIStepper+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIStepper+Rx.swift"; path = "RxCocoa/iOS/UIStepper+Rx.swift"; sourceTree = "<group>"; };
-		1C10AA3C311345DB3616BCE827B69C55 /* Pods-ShadowsocksX-NGTests-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "Pods-ShadowsocksX-NGTests-dummy.m"; sourceTree = "<group>"; };
-		1CD2535A24AA927A5965AF73264678A3 /* Catch.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Catch.swift; path = RxSwift/Observables/Catch.swift; sourceTree = "<group>"; };
-		1DBE368EA1C6F7EBE80E08054C9BC6AE /* TextInput.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = TextInput.swift; path = RxCocoa/Common/TextInput.swift; sourceTree = "<group>"; };
-		1EA29F7E0E65B6A9619DB77448844EC1 /* Pods-ShadowsocksX-NG.modulemap */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.module; path = "Pods-ShadowsocksX-NG.modulemap"; sourceTree = "<group>"; };
-		1EB8536183BE6472CDCC5817172688EF /* AnonymousDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AnonymousDisposable.swift; path = RxSwift/Disposables/AnonymousDisposable.swift; sourceTree = "<group>"; };
-		1FA62A0165A7A8D001536C62FD5E2392 /* SynchronizedUnsubscribeType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SynchronizedUnsubscribeType.swift; path = RxSwift/Concurrency/SynchronizedUnsubscribeType.swift; sourceTree = "<group>"; };
-		200825C8579BF340304A9767D679EC35 /* InvocableType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = InvocableType.swift; path = RxSwift/Schedulers/Internal/InvocableType.swift; sourceTree = "<group>"; };
-		2094BFBE78A2839B3C673A3E450C77FC /* GCDWebServer.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = GCDWebServer.release.xcconfig; sourceTree = "<group>"; };
-		2096522151041770121528F182B6F42D /* Range.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Range.swift; path = RxSwift/Observables/Range.swift; sourceTree = "<group>"; };
-		21F927D22EA76A49C54C44827DD1CE5A /* UITabBar+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UITabBar+Rx.swift"; path = "RxCocoa/iOS/UITabBar+Rx.swift"; sourceTree = "<group>"; };
-		222E861679233A0833D6C2F8079146E7 /* DispatchQueueConfiguration.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = DispatchQueueConfiguration.swift; path = RxSwift/Schedulers/Internal/DispatchQueueConfiguration.swift; sourceTree = "<group>"; };
-		22ADD736785A6DE33628551E25AC889A /* Pods-ShadowsocksX-NGTests-acknowledgements.markdown */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text; path = "Pods-ShadowsocksX-NGTests-acknowledgements.markdown"; sourceTree = "<group>"; };
-		22D41ECF1E34CC3D83A32F7896831100 /* RxPickerViewDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxPickerViewDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxPickerViewDelegateProxy.swift; sourceTree = "<group>"; };
-		230F8208BE63C052A548A7D41A1158B2 /* MASShortcut.bundle */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = MASShortcut.bundle; sourceTree = BUILT_PRODUCTS_DIR; };
-		24121C8FA3C10947BE50901868F9198A /* MASShortcutMonitor.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASShortcutMonitor.h; path = Framework/Monitoring/MASShortcutMonitor.h; sourceTree = "<group>"; };
-		2505B197F74151D018080608E6576C6C /* ConnectableObservableType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ConnectableObservableType.swift; path = RxSwift/ConnectableObservableType.swift; sourceTree = "<group>"; };
-		2586C5A6499D4E9A6B62C1CF5804DE66 /* Platform.Linux.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Platform.Linux.swift; path = Platform/Platform.Linux.swift; sourceTree = "<group>"; };
-		26A8810424438A12E7ADBFB3E068C658 /* MASShortcut.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = MASShortcut.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		26DA8062B81F764A6EEA6168DF6337AB /* OperationQueue+Alamofire.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "OperationQueue+Alamofire.swift"; path = "Source/OperationQueue+Alamofire.swift"; sourceTree = "<group>"; };
-		273C90965AA81CCFE4CDA40530425746 /* Take.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Take.swift; path = RxSwift/Observables/Take.swift; sourceTree = "<group>"; };
-		280A80C3BD890370005C094FC4C3DC12 /* PrimitiveSequence.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = PrimitiveSequence.swift; path = RxSwift/Traits/PrimitiveSequence/PrimitiveSequence.swift; sourceTree = "<group>"; };
-		2888FA81FD2BE4D3B068BCE4AFDC9A93 /* UISearchBar+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UISearchBar+Rx.swift"; path = "RxCocoa/iOS/UISearchBar+Rx.swift"; sourceTree = "<group>"; };
-		28F6CED61832E1CE6BA74AA90F7E45EE /* RxSwift.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = RxSwift.release.xcconfig; sourceTree = "<group>"; };
-		29BFF21F894144F23E9F778185A1EBC4 /* Utils.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Utils.swift; path = RxRelay/Utils.swift; sourceTree = "<group>"; };
-		29E3014CE53E3127CCD38149E2060C76 /* DispatchQueue+Extensions.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "DispatchQueue+Extensions.swift"; path = "Platform/DispatchQueue+Extensions.swift"; sourceTree = "<group>"; };
-		2A11F032AFA3310A3EEE63E67481B01E /* Pods-ShadowsocksX-NG-frameworks.sh */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.script.sh; path = "Pods-ShadowsocksX-NG-frameworks.sh"; sourceTree = "<group>"; };
-		2AE63CBE5D3B0C2D25184C45E1B8C885 /* Completable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Completable.swift; path = RxSwift/Traits/PrimitiveSequence/Completable.swift; sourceTree = "<group>"; };
-		2BDFA1D8F5CB80DCE3773C11691B223D /* Bag.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Bag.swift; path = Platform/DataStructures/Bag.swift; sourceTree = "<group>"; };
-		2C81F8C45A4C248E266304541A86B5A8 /* NSTextField+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSTextField+Rx.swift"; path = "RxCocoa/macOS/NSTextField+Rx.swift"; sourceTree = "<group>"; };
-		2CFE9D0E45288EBBAF865D7685C2B983 /* Pods-ShadowsocksX-NGTests-acknowledgements.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "Pods-ShadowsocksX-NGTests-acknowledgements.plist"; sourceTree = "<group>"; };
-		2DDC82F5641636881356BF49166C8DF3 /* RxRelay-umbrella.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "RxRelay-umbrella.h"; sourceTree = "<group>"; };
-		2E101994FDA2210D6CD7972A656C511F /* AuthenticationInterceptor.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AuthenticationInterceptor.swift; path = Source/AuthenticationInterceptor.swift; sourceTree = "<group>"; };
-		2E656BCAB89EA23EC58A161ACF0DAE68 /* Alamofire.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Alamofire.swift; path = Source/Alamofire.swift; sourceTree = "<group>"; };
-		2F138B6C28378A801D2186B22E1E6224 /* RxCocoa.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = RxCocoa.debug.xcconfig; sourceTree = "<group>"; };
-		2FEFD09344E88FFE590FC0A7146C0D32 /* BinaryDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = BinaryDisposable.swift; path = RxSwift/Disposables/BinaryDisposable.swift; sourceTree = "<group>"; };
-		30E50B8D09D21C042020DA82FA315C59 /* _RXDelegateProxy.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = _RXDelegateProxy.h; path = RxCocoa/Runtime/include/_RXDelegateProxy.h; sourceTree = "<group>"; };
-		31234D4C5E912BD05D37874E7E89A233 /* Enumerated.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Enumerated.swift; path = RxSwift/Observables/Enumerated.swift; sourceTree = "<group>"; };
-		314A2DB247EA6781CE45C5C146496327 /* ToArray.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ToArray.swift; path = RxSwift/Observables/ToArray.swift; sourceTree = "<group>"; };
-		31F9576864749334961DE762B01B777C /* BRLOptionParser.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = BRLOptionParser.h; path = BRLOptionParser/BRLOptionParser.h; sourceTree = "<group>"; };
-		321FC2ED515952B66BACDB8CAC130EB4 /* it.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = it.lproj; path = Resources/it.lproj; sourceTree = "<group>"; };
-		32777B9FE68F64D911474F7B7595C94C /* Scan.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Scan.swift; path = RxSwift/Observables/Scan.swift; sourceTree = "<group>"; };
-		32EC506B43DB4AE47634A8AEE18D9E8C /* CachedResponseHandler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = CachedResponseHandler.swift; path = Source/CachedResponseHandler.swift; sourceTree = "<group>"; };
-		336A70440B171C2C6AEE66F83620273A /* Alamofire.modulemap */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.module; path = Alamofire.modulemap; sourceTree = "<group>"; };
-		33BBD4B03778E41A59C1A3F64AAB876C /* Deferred.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Deferred.swift; path = RxSwift/Observables/Deferred.swift; sourceTree = "<group>"; };
-		3425B3045259FEA3A238D183DEEE520B /* HTTPHeaders.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = HTTPHeaders.swift; path = Source/HTTPHeaders.swift; sourceTree = "<group>"; };
-		345AE1A0C847584A14AD381D5E476AB9 /* RxSearchBarDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxSearchBarDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxSearchBarDelegateProxy.swift; sourceTree = "<group>"; };
-		353B178196A1B3A383089B3D1006F66A /* MASDictionaryTransformer.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASDictionaryTransformer.h; path = "Framework/User Defaults Storage/MASDictionaryTransformer.h"; sourceTree = "<group>"; };
-		3622945DEBFCB14514027A236BDFC74C /* UISwitch+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UISwitch+Rx.swift"; path = "RxCocoa/iOS/UISwitch+Rx.swift"; sourceTree = "<group>"; };
-		3677CB82C594C5820F17431AA45C5C87 /* Zip+Collection.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Zip+Collection.swift"; path = "RxSwift/Observables/Zip+Collection.swift"; sourceTree = "<group>"; };
-		3685B6DE4DF41097400DA11AA41A500B /* RxSwift-prefix.pch */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "RxSwift-prefix.pch"; sourceTree = "<group>"; };
-		36C45F96BE0AE01F3BB2C90370A73616 /* Infallible+Bind.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Infallible+Bind.swift"; path = "RxCocoa/Common/Infallible+Bind.swift"; sourceTree = "<group>"; };
-		36E9C273C636D7A0C559787BD1FABA68 /* GCDWebServerDataRequest.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerDataRequest.h; path = GCDWebServer/Requests/GCDWebServerDataRequest.h; sourceTree = "<group>"; };
-		370A313E34AF66CB8D7437ABDC3FB7F8 /* Infallible.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Infallible.swift; path = RxSwift/Traits/Infallible/Infallible.swift; sourceTree = "<group>"; };
-		38724BD70D1712C03FA9B7A4C417144D /* ControlEvent.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ControlEvent.swift; path = RxCocoa/Traits/ControlEvent.swift; sourceTree = "<group>"; };
-		38A0B431980745BE7A67D566D79E240A /* HistoricalSchedulerTimeConverter.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = HistoricalSchedulerTimeConverter.swift; path = RxSwift/Schedulers/HistoricalSchedulerTimeConverter.swift; sourceTree = "<group>"; };
-		38A6B331CD11EA3ADC9BE7CFD5DE99DA /* RxRelay.modulemap */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.module; path = RxRelay.modulemap; sourceTree = "<group>"; };
-		392538EA12C4E3008D6EF1ABB226B3BF /* GCDWebServerFileRequest.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerFileRequest.m; path = GCDWebServer/Requests/GCDWebServerFileRequest.m; sourceTree = "<group>"; };
-		3949A4BE0C4C31915E5A812146DB23B9 /* DistinctUntilChanged.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = DistinctUntilChanged.swift; path = RxSwift/Observables/DistinctUntilChanged.swift; sourceTree = "<group>"; };
-		39D9FF9E1CBB62DA6FC1910AA45EB039 /* RxTabBarControllerDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTabBarControllerDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxTabBarControllerDelegateProxy.swift; sourceTree = "<group>"; };
-		3AC418FEB3CC60F42D6A18E6151C871A /* RxWKNavigationDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxWKNavigationDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxWKNavigationDelegateProxy.swift; sourceTree = "<group>"; };
-		3B85D80911EDFC7DD402EBEB3A05169A /* RetryPolicy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RetryPolicy.swift; path = Source/RetryPolicy.swift; sourceTree = "<group>"; };
-		3BAD385D5CDC39C1AE6584A123D2DFC4 /* _RX.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = _RX.h; path = RxCocoa/Runtime/include/_RX.h; sourceTree = "<group>"; };
-		3BE91EC45C71C190D532DC351F5E724D /* CompositeDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = CompositeDisposable.swift; path = RxSwift/Disposables/CompositeDisposable.swift; sourceTree = "<group>"; };
-		3ED0602BE820AA0F7B2D99CBFED4C1F0 /* Create.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Create.swift; path = RxSwift/Observables/Create.swift; sourceTree = "<group>"; };
-		403ABCCF5634DCD99A376EAA601F828E /* HTTPMethod.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = HTTPMethod.swift; path = Source/HTTPMethod.swift; sourceTree = "<group>"; };
-		40573DCBFB24CA15F7D6C33B5C73162F /* Infallible+CombineLatest+arity.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Infallible+CombineLatest+arity.swift"; path = "RxSwift/Traits/Infallible/Infallible+CombineLatest+arity.swift"; sourceTree = "<group>"; };
-		408AEB2CFB972D5D82E41BB027E6686C /* SerialDispatchQueueScheduler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SerialDispatchQueueScheduler.swift; path = RxSwift/Schedulers/SerialDispatchQueueScheduler.swift; sourceTree = "<group>"; };
-		40FC23633FFFBBD0FA165FB284958F8C /* RecursiveScheduler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RecursiveScheduler.swift; path = RxSwift/Schedulers/RecursiveScheduler.swift; sourceTree = "<group>"; };
-		41ADA85A38ECDBBD122B707DA599E641 /* DispatchQueue+Alamofire.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "DispatchQueue+Alamofire.swift"; path = "Source/DispatchQueue+Alamofire.swift"; sourceTree = "<group>"; };
-		4338C646A92E1539E9BED963FC618602 /* ObservableType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ObservableType.swift; path = RxSwift/ObservableType.swift; sourceTree = "<group>"; };
-		43D1B54DDFE366EA8E657D1CFA2A5349 /* Protected.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Protected.swift; path = Source/Protected.swift; sourceTree = "<group>"; };
-		4412635C50524157DDF38FA0CB197F4A /* Binder.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Binder.swift; path = RxSwift/Binder.swift; sourceTree = "<group>"; };
-		441E899D371A5638D8CBD0A21A8CCA61 /* UIScrollView+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIScrollView+Rx.swift"; path = "RxCocoa/iOS/UIScrollView+Rx.swift"; sourceTree = "<group>"; };
-		44775F4816D20EB134F1DBAB43BE0B3A /* Filter.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Filter.swift; path = RxSwift/Observables/Filter.swift; sourceTree = "<group>"; };
-		44D9E4509154BFFEBEA9AEA0C935EC9E /* SubjectType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SubjectType.swift; path = RxSwift/Subjects/SubjectType.swift; sourceTree = "<group>"; };
-		4504CA755CE81F89F9F165BF93126D21 /* es.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = es.lproj; path = Resources/es.lproj; sourceTree = "<group>"; };
-		45BF55923F2D3657D9D5420E606B641F /* Repeat.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Repeat.swift; path = RxSwift/Observables/Repeat.swift; sourceTree = "<group>"; };
-		46002374E8C8C6F2127C7C9A6DFEF743 /* MASShortcutBinder.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = MASShortcutBinder.m; path = "Framework/User Defaults Storage/MASShortcutBinder.m"; sourceTree = "<group>"; };
-		4618A8C418D70264404BBAF10EE3A1F4 /* ObservableConvertibleType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ObservableConvertibleType.swift; path = RxSwift/ObservableConvertibleType.swift; sourceTree = "<group>"; };
-		466B399C2E7FFAA61B709F2AB447ECDF /* UISlider+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UISlider+Rx.swift"; path = "RxCocoa/iOS/UISlider+Rx.swift"; sourceTree = "<group>"; };
-		4673D1BC54F57F490E2D3352F6BA1B73 /* VirtualTimeConverterType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = VirtualTimeConverterType.swift; path = RxSwift/Schedulers/VirtualTimeConverterType.swift; sourceTree = "<group>"; };
-		46A83A815027A06FB7A8AB2CEDF56368 /* UIDatePicker+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIDatePicker+Rx.swift"; path = "RxCocoa/iOS/UIDatePicker+Rx.swift"; sourceTree = "<group>"; };
-		46DA81F6288F2733B7F27CCDE97EA2C4 /* MASLocalization.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = MASLocalization.m; path = Framework/UI/MASLocalization.m; sourceTree = "<group>"; };
-		47291D90953698297410B0C37E619402 /* URLRequest+Alamofire.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "URLRequest+Alamofire.swift"; path = "Source/URLRequest+Alamofire.swift"; sourceTree = "<group>"; };
-		474547C10494F37402A98A0BFC7E6288 /* RxSearchControllerDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxSearchControllerDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxSearchControllerDelegateProxy.swift; sourceTree = "<group>"; };
-		4752AFB18B745CA95D95FB7457EAA1C4 /* RxCocoa-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "RxCocoa-dummy.m"; sourceTree = "<group>"; };
-		4764F518EAB30C5EA82C03A5607ED7AF /* Error.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Error.swift; path = RxSwift/Observables/Error.swift; sourceTree = "<group>"; };
-		47EB7F9271D4EAE5B4A31D5D0194BECC /* GroupBy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = GroupBy.swift; path = RxSwift/Observables/GroupBy.swift; sourceTree = "<group>"; };
-		485A8E801F2DA21AB5D16808AE1B4887 /* ReplayRelay.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ReplayRelay.swift; path = RxRelay/ReplayRelay.swift; sourceTree = "<group>"; };
-		48CB9D3553F121F84DBB750A8FBE0F3D /* ResponseSerialization.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ResponseSerialization.swift; path = Source/ResponseSerialization.swift; sourceTree = "<group>"; };
-		4946CBDE2CD13F181402416264EBF61D /* RxSwift-Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "RxSwift-Info.plist"; sourceTree = "<group>"; };
-		494A67061DAFFD52534BC4699A8DF637 /* Map.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Map.swift; path = RxSwift/Observables/Map.swift; sourceTree = "<group>"; };
-		494FD3BF9675BD2ADCE4731FED65B5FF /* AddRef.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AddRef.swift; path = RxSwift/Observables/AddRef.swift; sourceTree = "<group>"; };
-		4A70BE8C07BCE9C6D6F47AC73225C959 /* Pods-proxy_conf_helper.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = "Pods-proxy_conf_helper.release.xcconfig"; sourceTree = "<group>"; };
-		4A797B2A249C56CB61DB60A3FEA31FD2 /* en.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = en.lproj; path = Resources/en.lproj; sourceTree = "<group>"; };
-		4C0E4BDE3E30AF8C9062AFAD9C3AEA28 /* ControlEvent+Driver.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "ControlEvent+Driver.swift"; path = "RxCocoa/Traits/Driver/ControlEvent+Driver.swift"; sourceTree = "<group>"; };
-		4C9EBFDB861299F7DC1241C7FCFF00DD /* NSObject+Rx+RawRepresentable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSObject+Rx+RawRepresentable.swift"; path = "RxCocoa/Foundation/NSObject+Rx+RawRepresentable.swift"; sourceTree = "<group>"; };
-		4E0CDE6403F2AF9E108FF190F90FA9FF /* EventMonitor.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = EventMonitor.swift; path = Source/EventMonitor.swift; sourceTree = "<group>"; };
-		4F401550E51DCC5F5746B99EC564065B /* SharedSequence.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SharedSequence.swift; path = RxCocoa/Traits/SharedSequence/SharedSequence.swift; sourceTree = "<group>"; };
-		4FDB60114950AF3BF06EF9DA0AF9E5AC /* Producer.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Producer.swift; path = RxSwift/Observables/Producer.swift; sourceTree = "<group>"; };
-		4FF704B43D944C2399606B76A430F1A6 /* Platform.Linux.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Platform.Linux.swift; path = Platform/Platform.Linux.swift; sourceTree = "<group>"; };
-		506B13C445D67D7231C25641361EE5A1 /* UIRefreshControl+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIRefreshControl+Rx.swift"; path = "RxCocoa/iOS/UIRefreshControl+Rx.swift"; sourceTree = "<group>"; };
-		5158C591583049B150EC9F57DC2FA656 /* Optional.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Optional.swift; path = RxSwift/Observables/Optional.swift; sourceTree = "<group>"; };
-		51E7C258B34B55C44CAA679574F0B5E1 /* UITableView+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UITableView+Rx.swift"; path = "RxCocoa/iOS/UITableView+Rx.swift"; sourceTree = "<group>"; };
-		5219820998BC7D8238F0F05F90A3D96F /* Maybe.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Maybe.swift; path = RxSwift/Traits/PrimitiveSequence/Maybe.swift; sourceTree = "<group>"; };
-		52626495FA7375A2A4753E3EC16FB26C /* AsyncLock.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AsyncLock.swift; path = RxSwift/Concurrency/AsyncLock.swift; sourceTree = "<group>"; };
-		52786C2AA26607ED32FA242D407DEC3D /* RxRelay-Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "RxRelay-Info.plist"; sourceTree = "<group>"; };
-		52DFCC55A239674DEF17871D293D227C /* RxNavigationControllerDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxNavigationControllerDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxNavigationControllerDelegateProxy.swift; sourceTree = "<group>"; };
-		530CEAEC9F4BC5F2EC9C9534779927A3 /* RxMutableBox.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxMutableBox.swift; path = RxSwift/RxMutableBox.swift; sourceTree = "<group>"; };
-		531091EE9FF408558B83A1E053360F67 /* RxTextViewDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTextViewDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxTextViewDelegateProxy.swift; sourceTree = "<group>"; };
-		53EB3CB0FCC5ABA4F18B576E6BA4EB1F /* SchedulerType+SharedSequence.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "SchedulerType+SharedSequence.swift"; path = "RxCocoa/Traits/SharedSequence/SchedulerType+SharedSequence.swift"; sourceTree = "<group>"; };
-		543DFE92FBC6235F6826EF38928A7C08 /* First.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = First.swift; path = RxSwift/Observables/First.swift; sourceTree = "<group>"; };
-		54F202B17AB2C7DC4FEC3F1CF2B5FD57 /* KVORepresentable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = KVORepresentable.swift; path = RxCocoa/Foundation/KVORepresentable.swift; sourceTree = "<group>"; };
-		555231B7293881D7D76CA80C82AABA2B /* Debug.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Debug.swift; path = RxSwift/Observables/Debug.swift; sourceTree = "<group>"; };
-		5554F4E6979C7DDD1E00F81CB94D474D /* RecursiveLock.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RecursiveLock.swift; path = Platform/RecursiveLock.swift; sourceTree = "<group>"; };
-		558A95B0EAE7FAFDFCC334A1E9277C19 /* TailRecursiveSink.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = TailRecursiveSink.swift; path = RxSwift/Observers/TailRecursiveSink.swift; sourceTree = "<group>"; };
-		55F5FEB17D952CAA64A6B7DE90D7E47D /* GCDWebServer.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServer.m; path = GCDWebServer/Core/GCDWebServer.m; sourceTree = "<group>"; };
-		57BEC3094A7FB642608645E131DA83D4 /* GCDWebServerHTTPStatusCodes.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerHTTPStatusCodes.h; path = GCDWebServer/Core/GCDWebServerHTTPStatusCodes.h; sourceTree = "<group>"; };
-		5800B274C19C06FB1CA12AC039704852 /* NSTextView+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSTextView+Rx.swift"; path = "RxCocoa/macOS/NSTextView+Rx.swift"; sourceTree = "<group>"; };
-		5874107EF4581DA493B60BBCFE422D1C /* NSSlider+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSSlider+Rx.swift"; path = "RxCocoa/macOS/NSSlider+Rx.swift"; sourceTree = "<group>"; };
-		5878F666B9410A53C5BBE1778D1B2CCE /* ControlProperty.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ControlProperty.swift; path = RxCocoa/Traits/ControlProperty.swift; sourceTree = "<group>"; };
-		5BC543740C092C697A08396093A0F7BD /* GCDWebServerFileResponse.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerFileResponse.m; path = GCDWebServer/Responses/GCDWebServerFileResponse.m; sourceTree = "<group>"; };
-		5C0C485AB4EA81F3E9128F65E9AC66CA /* Pods-ShadowsocksX-NGTests.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = "Pods-ShadowsocksX-NGTests.release.xcconfig"; sourceTree = "<group>"; };
-		5CA0D236EFCE9E4E77F9A2B2A0AF3FC4 /* Merge.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Merge.swift; path = RxSwift/Observables/Merge.swift; sourceTree = "<group>"; };
-		5CE7CD3C7A16D2E9341BBBAB18D5D8DC /* Event.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Event.swift; path = RxSwift/Event.swift; sourceTree = "<group>"; };
-		5D0A2A589A608DD00CA24C86BCD46E62 /* URLEncodedFormEncoder.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = URLEncodedFormEncoder.swift; path = Source/URLEncodedFormEncoder.swift; sourceTree = "<group>"; };
-		5D797E9A5C5782CE845840781FA1CC81 /* Alamofire.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Alamofire.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		5D99DA86D8CBFFCB2E7FD40BC42568F3 /* Decode.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Decode.swift; path = RxSwift/Observables/Decode.swift; sourceTree = "<group>"; };
-		5DA6A1DA8589C7192C8BFDBC3F4A9913 /* ControlTarget.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ControlTarget.swift; path = RxCocoa/Common/ControlTarget.swift; sourceTree = "<group>"; };
-		5E698A2854CB4D9E919B55523EB57D1A /* Driver.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Driver.swift; path = RxCocoa/Traits/Driver/Driver.swift; sourceTree = "<group>"; };
-		5EE446AD8C625612BFF0E37E4419E0FD /* BRLOptionParser.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = BRLOptionParser.debug.xcconfig; sourceTree = "<group>"; };
-		605C26B2F1FFA16F0E85E33F5CC526EC /* MASShortcutMonitor.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = MASShortcutMonitor.m; path = Framework/Monitoring/MASShortcutMonitor.m; sourceTree = "<group>"; };
-		608BE9EFB078FCC2348EF2782C265D92 /* UIPickerView+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIPickerView+Rx.swift"; path = "RxCocoa/iOS/UIPickerView+Rx.swift"; sourceTree = "<group>"; };
-		61C23DB60A84900CD4BDA2F5EE2A0865 /* libPods-proxy_conf_helper.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-proxy_conf_helper.a"; sourceTree = BUILT_PRODUCTS_DIR; };
-		62F5D09616527A0713F24DF416BEC64F /* Carbon.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Carbon.framework; path = Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk/System/Library/Frameworks/Carbon.framework; sourceTree = DEVELOPER_DIR; };
-		6327835932D3C270A640C0C76A860EB8 /* TakeWithPredicate.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = TakeWithPredicate.swift; path = RxSwift/Observables/TakeWithPredicate.swift; sourceTree = "<group>"; };
-		636937DE6DA6CE01D7E94282A16BC9D9 /* Observable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Observable.swift; path = RxSwift/Observable.swift; sourceTree = "<group>"; };
-		636D1EE61F0E0E367F486461F8E0DF54 /* AnonymousObserver.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AnonymousObserver.swift; path = RxSwift/Observers/AnonymousObserver.swift; sourceTree = "<group>"; };
-		638797412ABBF2F7725016AF4B056309 /* _RXObjCRuntime.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = _RXObjCRuntime.m; path = RxCocoa/Runtime/_RXObjCRuntime.m; sourceTree = "<group>"; };
-		65D8FEBF2028BCC7758A666F2A35989A /* Empty.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Empty.swift; path = RxSwift/Observables/Empty.swift; sourceTree = "<group>"; };
-		661DD8158386E15481E17DE6E2FA1882 /* Timeout.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Timeout.swift; path = RxSwift/Observables/Timeout.swift; sourceTree = "<group>"; };
-		66C7F789300668AEDFA53AEA1392C48B /* Concat.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Concat.swift; path = RxSwift/Observables/Concat.swift; sourceTree = "<group>"; };
-		66D1DACD1512DCFE82BC525C443DA8A5 /* RxTabBarDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTabBarDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxTabBarDelegateProxy.swift; sourceTree = "<group>"; };
-		683395CCE980D15405934DC5E2BCD682 /* LockOwnerType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = LockOwnerType.swift; path = RxSwift/Concurrency/LockOwnerType.swift; sourceTree = "<group>"; };
-		684F8C697CD894D0F5680EE542AC32E9 /* ItemEvents.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ItemEvents.swift; path = RxCocoa/iOS/Events/ItemEvents.swift; sourceTree = "<group>"; };
-		68C9C3CF6142E1B32695BC562ECAC427 /* BRLOptionParser.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = BRLOptionParser.m; path = BRLOptionParser/BRLOptionParser.m; sourceTree = "<group>"; };
-		68D133622632E3F0C62D1F74D188EA7E /* CombineLatest+Collection.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "CombineLatest+Collection.swift"; path = "RxSwift/Observables/CombineLatest+Collection.swift"; sourceTree = "<group>"; };
-		6985BD62945B0A86382437BC1758C282 /* _RXObjCRuntime.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = _RXObjCRuntime.h; path = RxCocoa/Runtime/include/_RXObjCRuntime.h; sourceTree = "<group>"; };
-		6A2828DE92C9CEECE9FB19F2EE763305 /* VirtualTimeScheduler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = VirtualTimeScheduler.swift; path = RxSwift/Schedulers/VirtualTimeScheduler.swift; sourceTree = "<group>"; };
-		6AD4414199F479D544CBF1FFF3FB45E4 /* _RXDelegateProxy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = _RXDelegateProxy.m; path = RxCocoa/Runtime/_RXDelegateProxy.m; sourceTree = "<group>"; };
-		6B37E46EBF28CB6542B58754F09D8AAA /* RxTarget.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTarget.swift; path = RxCocoa/Common/RxTarget.swift; sourceTree = "<group>"; };
-		6B668707F7C66384A3BB8BC4FE3F41E6 /* MASShortcut-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "MASShortcut-dummy.m"; sourceTree = "<group>"; };
-		6B9491CF676F85A85C4F0987D38F9051 /* Shortcut.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = Shortcut.h; path = Framework/Shortcut.h; sourceTree = "<group>"; };
-		6D0B40D5A184825074ECC549693CAF02 /* GCDWebServerConnection.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerConnection.h; path = GCDWebServer/Core/GCDWebServerConnection.h; sourceTree = "<group>"; };
-		6D742A8B753D54115AD3C6D293B64276 /* UINavigationController+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UINavigationController+Rx.swift"; path = "RxCocoa/iOS/UINavigationController+Rx.swift"; sourceTree = "<group>"; };
-		6D8A09F0F8EDB0B1A568AA29A33D62EA /* AFError.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AFError.swift; path = Source/AFError.swift; sourceTree = "<group>"; };
-		6DA5F27AAEF9B366933CB017942EFAA8 /* HistoricalScheduler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = HistoricalScheduler.swift; path = RxSwift/Schedulers/HistoricalScheduler.swift; sourceTree = "<group>"; };
-		6DAFFC9484B606CC3A8583B2085B7957 /* SerialDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SerialDisposable.swift; path = RxSwift/Disposables/SerialDisposable.swift; sourceTree = "<group>"; };
-		6DFC3F4E49698472F1AA8DE21B1BD0F2 /* NSButton+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSButton+Rx.swift"; path = "RxCocoa/macOS/NSButton+Rx.swift"; sourceTree = "<group>"; };
-		6EB5DBBABE4FD6FFF0223AC1BC4674DB /* KVORepresentable+Swift.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "KVORepresentable+Swift.swift"; path = "RxCocoa/Foundation/KVORepresentable+Swift.swift"; sourceTree = "<group>"; };
-		70C291AA3C3CEE619534F472C4F04882 /* MASShortcut.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = MASShortcut.debug.xcconfig; sourceTree = "<group>"; };
-		718741562429DAE6AA6DC455ED6883D4 /* Errors.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Errors.swift; path = RxSwift/Errors.swift; sourceTree = "<group>"; };
-		726DEA3A84065F8E12FDE5617447B366 /* MASShortcutValidator.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = MASShortcutValidator.m; path = Framework/Model/MASShortcutValidator.m; sourceTree = "<group>"; };
-		72A57876EDEB24ADDFE06DD482CE250C /* Pods-ShadowsocksX-NGTests-umbrella.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "Pods-ShadowsocksX-NGTests-umbrella.h"; sourceTree = "<group>"; };
-		72D91E08E6C75E1F0DBACD4FF3CA2F55 /* ShareReplayScope.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ShareReplayScope.swift; path = RxSwift/Observables/ShareReplayScope.swift; sourceTree = "<group>"; };
-		73118DDBDD8A625213B479BD40C4B9CE /* TakeLast.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = TakeLast.swift; path = RxSwift/Observables/TakeLast.swift; sourceTree = "<group>"; };
-		73327356D8055C270C5AFBAEE0D202DD /* MASKeyCodes.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASKeyCodes.h; path = Framework/Model/MASKeyCodes.h; sourceTree = "<group>"; };
-		74656C1BF53AED56A45CDA8600A787D1 /* Pods-proxy_conf_helper-acknowledgements.markdown */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text; path = "Pods-proxy_conf_helper-acknowledgements.markdown"; sourceTree = "<group>"; };
-		74E6FB11E3F38127740B54FF3C72D1EF /* _RX.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = _RX.m; path = RxCocoa/Runtime/_RX.m; sourceTree = "<group>"; };
-		758B67811993E4C5163D7637EDBB6CFD /* PublishRelay+Signal.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "PublishRelay+Signal.swift"; path = "RxCocoa/Traits/Signal/PublishRelay+Signal.swift"; sourceTree = "<group>"; };
-		75EA425CE2A4DBDDEB580C7303DD2454 /* Alamofire.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = Alamofire.debug.xcconfig; sourceTree = "<group>"; };
-		7720FEFA630547FDE17C156840E36CC6 /* MASShortcut-prefix.pch */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "MASShortcut-prefix.pch"; sourceTree = "<group>"; };
-		77B5C856C653A9586105526C4341767A /* RxSwift-umbrella.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "RxSwift-umbrella.h"; sourceTree = "<group>"; };
-		77E73C4E3CAF9AD8FAE2EA9130D6A37E /* GCDWebServerFileResponse.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerFileResponse.h; path = GCDWebServer/Responses/GCDWebServerFileResponse.h; sourceTree = "<group>"; };
-		78275DA82CA025902C1D6FAF39BC9403 /* RxCollectionViewDataSourcePrefetchingProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxCollectionViewDataSourcePrefetchingProxy.swift; path = RxCocoa/iOS/Proxies/RxCollectionViewDataSourcePrefetchingProxy.swift; sourceTree = "<group>"; };
-		7A4A724DBFF9C1C260A76A4B104F3B1E /* MASShortcut.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = MASShortcut.m; path = Framework/Model/MASShortcut.m; sourceTree = "<group>"; };
-		7B00813C768C553C089DAF0C1900799B /* NSObject+Rx+KVORepresentable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSObject+Rx+KVORepresentable.swift"; path = "RxCocoa/Foundation/NSObject+Rx+KVORepresentable.swift"; sourceTree = "<group>"; };
-		7B00E954AA2FCFDF5ACDEC8CD8C6941E /* ObserverType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ObserverType.swift; path = RxSwift/ObserverType.swift; sourceTree = "<group>"; };
-		7B58732AA1AF7EA39B29A8BE85721F26 /* RxScrollViewDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxScrollViewDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxScrollViewDelegateProxy.swift; sourceTree = "<group>"; };
-		7BE4993AB90D97D332E61EB54E0C3C9A /* MASHotKey.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = MASHotKey.m; path = Framework/Monitoring/MASHotKey.m; sourceTree = "<group>"; };
-		7C471325C18D493A8244DEB1563B18B6 /* MASShortcutView+Bindings.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = "MASShortcutView+Bindings.m"; path = "Framework/UI/MASShortcutView+Bindings.m"; sourceTree = "<group>"; };
-		7C73921B2C710D3814A33EF328D04D20 /* MASShortcutView.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = MASShortcutView.m; path = Framework/UI/MASShortcutView.m; sourceTree = "<group>"; };
-		7D680C4252D37F732EE2D1BB9AB911DA /* AsMaybe.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AsMaybe.swift; path = RxSwift/Observables/AsMaybe.swift; sourceTree = "<group>"; };
-		7DF9FA6B1D40855A99145762147C1690 /* ImmediateSchedulerType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ImmediateSchedulerType.swift; path = RxSwift/ImmediateSchedulerType.swift; sourceTree = "<group>"; };
-		7DFEE31FDCAA3B9A85119C45EE5BF376 /* GCDWebServerDataRequest.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerDataRequest.m; path = GCDWebServer/Requests/GCDWebServerDataRequest.m; sourceTree = "<group>"; };
-		7EB9FE74C8220E21EC9A5A77098E9152 /* RxCocoa.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = RxCocoa.h; path = RxCocoa/RxCocoa.h; sourceTree = "<group>"; };
-		809C5FAB588354C9BA37DC3EAB8CB45C /* RxSwift.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = RxSwift.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		80B5C55F7279E38D15E19E9DEDDEDE7B /* RequestInterceptor.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RequestInterceptor.swift; path = Source/RequestInterceptor.swift; sourceTree = "<group>"; };
-		817D9055D7659CAC86800D119F65E0F4 /* CFNetwork.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CFNetwork.framework; path = Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk/System/Library/Frameworks/CFNetwork.framework; sourceTree = DEVELOPER_DIR; };
-		82A2597C8D9860F95F40565C0631A47D /* MASLocalization.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASLocalization.h; path = Framework/UI/MASLocalization.h; sourceTree = "<group>"; };
-		834EB5666F2D27EDBD25C600C80DF7CE /* ObservableConvertibleType+Infallible.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "ObservableConvertibleType+Infallible.swift"; path = "RxSwift/Traits/Infallible/ObservableConvertibleType+Infallible.swift"; sourceTree = "<group>"; };
-		8369906FA14B85B8271089FAAA1E4694 /* Disposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Disposable.swift; path = RxSwift/Disposable.swift; sourceTree = "<group>"; };
-		83899FE1EDE6090C8B2F4703A7895330 /* Pods-ShadowsocksX-NGTests.modulemap */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.module; path = "Pods-ShadowsocksX-NGTests.modulemap"; sourceTree = "<group>"; };
-		83FE5C08C0F9F63C9A7D2B71EF9F0864 /* URLSessionConfiguration+Alamofire.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "URLSessionConfiguration+Alamofire.swift"; path = "Source/URLSessionConfiguration+Alamofire.swift"; sourceTree = "<group>"; };
-		840A431555445FF451B4B74E7A8DDCF4 /* AnyObserver.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AnyObserver.swift; path = RxSwift/AnyObserver.swift; sourceTree = "<group>"; };
-		848DD5BA5CA758D1F00A7F6F947019EB /* Alamofire.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = Alamofire.release.xcconfig; sourceTree = "<group>"; };
-		855607DC318E2CF3120B3C70565140A0 /* Window.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Window.swift; path = RxSwift/Observables/Window.swift; sourceTree = "<group>"; };
-		8565AD8EBB9A4E532AF93D887B586876 /* Cancelable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Cancelable.swift; path = RxSwift/Cancelable.swift; sourceTree = "<group>"; };
-		864BF009AFF7BFF4D8B68869FC885957 /* StartWith.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = StartWith.swift; path = RxSwift/Observables/StartWith.swift; sourceTree = "<group>"; };
-		8663196F6A9678BFC77A8E46F8666C75 /* ScheduledItem.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ScheduledItem.swift; path = RxSwift/Schedulers/Internal/ScheduledItem.swift; sourceTree = "<group>"; };
-		866C21955F27EBD7A49148F5E63A6E7E /* libBRLOptionParser.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libBRLOptionParser.a; sourceTree = BUILT_PRODUCTS_DIR; };
-		867FD5BBBCAC1E98FE144867305F8FEF /* MASKeyMasks.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASKeyMasks.h; path = Framework/Model/MASKeyMasks.h; sourceTree = "<group>"; };
-		8752D17209EE8AAD7681107D6444113F /* Pods-proxy_conf_helper-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "Pods-proxy_conf_helper-dummy.m"; sourceTree = "<group>"; };
-		877FA6BB936631CD8F2CA0DFFF6EFC9C /* UITextField+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UITextField+Rx.swift"; path = "RxCocoa/iOS/UITextField+Rx.swift"; sourceTree = "<group>"; };
-		87A94DCCD78781BAE448DEA818B26DE4 /* SharedSequence+Operators+arity.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "SharedSequence+Operators+arity.swift"; path = "RxCocoa/Traits/SharedSequence/SharedSequence+Operators+arity.swift"; sourceTree = "<group>"; };
-		886072F083033D493924A8BE652713ED /* Generate.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Generate.swift; path = RxSwift/Observables/Generate.swift; sourceTree = "<group>"; };
-		89066EEDE0D03A9B328DADDC9344CC13 /* GCDWebServerResponse.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerResponse.h; path = GCDWebServer/Core/GCDWebServerResponse.h; sourceTree = "<group>"; };
-		8937D9E4BB1CD1D979DFF21019B4D814 /* MASHotKey.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASHotKey.h; path = Framework/Monitoring/MASHotKey.h; sourceTree = "<group>"; };
-		897003218412D0C779A54DAAD7D2A4EE /* WithUnretained.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = WithUnretained.swift; path = RxSwift/Observables/WithUnretained.swift; sourceTree = "<group>"; };
-		89A41E2A66DF6A8547AFAB72FE74B6A2 /* UIActivityIndicatorView+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIActivityIndicatorView+Rx.swift"; path = "RxCocoa/iOS/UIActivityIndicatorView+Rx.swift"; sourceTree = "<group>"; };
-		8A2C23CF743A94075196D7A4F419F5A4 /* Debounce.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Debounce.swift; path = RxSwift/Observables/Debounce.swift; sourceTree = "<group>"; };
-		8AE4AAE5FF0F7FEDE2C8D5FB08A1AE4F /* DelaySubscription.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = DelaySubscription.swift; path = RxSwift/Observables/DelaySubscription.swift; sourceTree = "<group>"; };
-		8C1810C471075F4E78D93E645BD7F63B /* MASShortcut.modulemap */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.module; path = MASShortcut.modulemap; sourceTree = "<group>"; };
-		8D796FDCC7398C88D7B835BD89700D56 /* BehaviorRelay.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = BehaviorRelay.swift; path = RxRelay/BehaviorRelay.swift; sourceTree = "<group>"; };
-		8E4505859B317DCDCC426973F6C7153D /* Signal.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Signal.swift; path = RxCocoa/Traits/Signal/Signal.swift; sourceTree = "<group>"; };
-		8E796A67AE756E845646324A31731334 /* MASShortcutValidator.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASShortcutValidator.h; path = Framework/Model/MASShortcutValidator.h; sourceTree = "<group>"; };
-		8E801F2049749D5BA709EAE3A2028661 /* Platform.Darwin.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Platform.Darwin.swift; path = Platform/Platform.Darwin.swift; sourceTree = "<group>"; };
-		8ED0DC48A18FD32A95BE8B28D715172C /* UISearchController+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UISearchController+Rx.swift"; path = "RxCocoa/iOS/UISearchController+Rx.swift"; sourceTree = "<group>"; };
-		8F90CD66F125C28F8983AFCFA7DF6607 /* de.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = de.lproj; path = Resources/de.lproj; sourceTree = "<group>"; };
-		9029CBEE1EB8EBFDFCC3F55CEC98E088 /* Request.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Request.swift; path = Source/Request.swift; sourceTree = "<group>"; };
-		904A920F44C4C4A18874A6A62A3ED759 /* SkipWhile.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SkipWhile.swift; path = RxSwift/Observables/SkipWhile.swift; sourceTree = "<group>"; };
-		90E9219489B97BDFE17BA3231CC465FC /* ServerTrustEvaluation.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ServerTrustEvaluation.swift; path = Source/ServerTrustEvaluation.swift; sourceTree = "<group>"; };
-		92B4BB091693150E5B1FCC6987683C6F /* Pods-ShadowsocksX-NG.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = "Pods-ShadowsocksX-NG.release.xcconfig"; sourceTree = "<group>"; };
-		930EB20F00FF48CAF9B19505BC219504 /* MASShortcut-umbrella.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "MASShortcut-umbrella.h"; sourceTree = "<group>"; };
-		95A61E2BD71E9AE873207EFE8994362B /* SynchronizedOnType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SynchronizedOnType.swift; path = RxSwift/Concurrency/SynchronizedOnType.swift; sourceTree = "<group>"; };
-		95B33DD3F11E0587A32ECE709173E4EF /* RxTextStorageDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTextStorageDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxTextStorageDelegateProxy.swift; sourceTree = "<group>"; };
-		95F05E167015F6A202D2BEB9437AE766 /* RxCocoaRuntime.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = RxCocoaRuntime.h; path = RxCocoa/Runtime/include/RxCocoaRuntime.h; sourceTree = "<group>"; };
-		960C49C6C3C5E2554CA3CD8EB86B61AC /* Queue.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Queue.swift; path = Platform/DataStructures/Queue.swift; sourceTree = "<group>"; };
-		961D7CAE484B6E4929A7BE5B048D29B5 /* RxPickerViewDataSourceType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxPickerViewDataSourceType.swift; path = RxCocoa/iOS/Protocols/RxPickerViewDataSourceType.swift; sourceTree = "<group>"; };
-		962EFFE0B39AFE334DBCAF81B4DBFE56 /* GCDWebServerFileRequest.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerFileRequest.h; path = GCDWebServer/Requests/GCDWebServerFileRequest.h; sourceTree = "<group>"; };
-		96C80DBAD0A8D59912E005E60636A935 /* Pods-ShadowsocksX-NG-Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "Pods-ShadowsocksX-NG-Info.plist"; sourceTree = "<group>"; };
-		96D93775EA307729314581C5C539C487 /* ReplaySubject.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ReplaySubject.swift; path = RxSwift/Subjects/ReplaySubject.swift; sourceTree = "<group>"; };
-		97319F4B64360DC3D794BD7B57BC9936 /* GCDWebServerURLEncodedFormRequest.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerURLEncodedFormRequest.h; path = GCDWebServer/Requests/GCDWebServerURLEncodedFormRequest.h; sourceTree = "<group>"; };
-		97D6BD38BB9E0F241C3C82A118E7F253 /* ControlProperty+Driver.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "ControlProperty+Driver.swift"; path = "RxCocoa/Traits/Driver/ControlProperty+Driver.swift"; sourceTree = "<group>"; };
-		98B151536C20EA366FDBE99C5A8BB7A5 /* MainScheduler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = MainScheduler.swift; path = RxSwift/Schedulers/MainScheduler.swift; sourceTree = "<group>"; };
-		98EF0EFA057CC202BD041F55B091661A /* BehaviorRelay+Driver.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "BehaviorRelay+Driver.swift"; path = "RxCocoa/Traits/Driver/BehaviorRelay+Driver.swift"; sourceTree = "<group>"; };
-		996DFC2DB5C2F37F0E623EB885F5DEB5 /* Session.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Session.swift; path = Source/Session.swift; sourceTree = "<group>"; };
-		9A3F0ED147035005ABA4D679F9E36A7B /* ru.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = ru.lproj; path = Resources/ru.lproj; sourceTree = "<group>"; };
-		9A71B9958F30759ED2645E0DF9ADF314 /* Pods-ShadowsocksX-NG.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = "Pods-ShadowsocksX-NG.debug.xcconfig"; sourceTree = "<group>"; };
-		9B23D7AFD516825208E6CE9B362989DB /* Queue.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Queue.swift; path = Platform/DataStructures/Queue.swift; sourceTree = "<group>"; };
-		9C1FFDE936B5B805CB094F77E95A88FC /* UIControl+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIControl+Rx.swift"; path = "RxCocoa/iOS/UIControl+Rx.swift"; sourceTree = "<group>"; };
-		9C3A35E7DD83A1437478608A9F2EF44C /* ControlEvent+Signal.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "ControlEvent+Signal.swift"; path = "RxCocoa/Traits/Signal/ControlEvent+Signal.swift"; sourceTree = "<group>"; };
-		9CF5ADA01C91A2DF993314D6CC9C63D3 /* MultipartUpload.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = MultipartUpload.swift; path = Source/MultipartUpload.swift; sourceTree = "<group>"; };
-		9D407239EE1987EFBB2A7EB11F70BFCF /* BRLOptionParser-prefix.pch */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "BRLOptionParser-prefix.pch"; sourceTree = "<group>"; };
-		9D4701E49CFDE5F411CDFD316EDD3C70 /* UITabBarController+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UITabBarController+Rx.swift"; path = "RxCocoa/iOS/UITabBarController+Rx.swift"; sourceTree = "<group>"; };
-		9D940727FF8FB9C785EB98E56350EF41 /* Podfile */ = {isa = PBXFileReference; explicitFileType = text.script.ruby; includeInIndex = 1; indentWidth = 2; name = Podfile; path = ../Podfile; sourceTree = SOURCE_ROOT; tabWidth = 2; xcLanguageSpecificationIdentifier = xcode.lang.ruby; };
-		9EE8B6717B73CE07A9FAC17FFCB1BA91 /* GCDWebServerErrorResponse.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerErrorResponse.h; path = GCDWebServer/Responses/GCDWebServerErrorResponse.h; sourceTree = "<group>"; };
-		9EF2C4A08C5514586AFFBB5AE22A99ED /* ResourceBundle-MASShortcut-MASShortcut-Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "ResourceBundle-MASShortcut-MASShortcut-Info.plist"; sourceTree = "<group>"; };
-		9F666DF6A38D74980DF6F191509F4971 /* RxCocoaObjCRuntimeError+Extensions.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "RxCocoaObjCRuntimeError+Extensions.swift"; path = "RxCocoa/Common/RxCocoaObjCRuntimeError+Extensions.swift"; sourceTree = "<group>"; };
-		9F78589C2F1DDF07DF58CD22F6835B19 /* Combine.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Combine.swift; path = Source/Combine.swift; sourceTree = "<group>"; };
-		9FA0DBB3C5358A6E4EF0C16145BB0F7E /* Zip.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Zip.swift; path = RxSwift/Observables/Zip.swift; sourceTree = "<group>"; };
-		A01C872DE26A61BFEF081FC71E72A0D0 /* RxRelay-prefix.pch */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "RxRelay-prefix.pch"; sourceTree = "<group>"; };
-		A0791E5EB9ADBB88CEE0BCD83DA9502C /* SchedulerServices+Emulation.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "SchedulerServices+Emulation.swift"; path = "RxSwift/Schedulers/SchedulerServices+Emulation.swift"; sourceTree = "<group>"; };
-		A111C3B36368413B50627674BB48E859 /* Completable+AndThen.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Completable+AndThen.swift"; path = "RxSwift/Traits/PrimitiveSequence/Completable+AndThen.swift"; sourceTree = "<group>"; };
-		A126CA25C01C17FEF1E4B62108855349 /* ConcurrentMainScheduler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ConcurrentMainScheduler.swift; path = RxSwift/Schedulers/ConcurrentMainScheduler.swift; sourceTree = "<group>"; };
-		A14B9E97BE00B01372727FA8DA9B10A3 /* _RXKVOObserver.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = _RXKVOObserver.m; path = RxCocoa/Runtime/_RXKVOObserver.m; sourceTree = "<group>"; };
-		A18A7F7794D2CC58900E95F6644D63E8 /* MASShortcutBinder.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASShortcutBinder.h; path = "Framework/User Defaults Storage/MASShortcutBinder.h"; sourceTree = "<group>"; };
-		A1D0AF20D0BF5465039BB88836A959B6 /* SkipUntil.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SkipUntil.swift; path = RxSwift/Observables/SkipUntil.swift; sourceTree = "<group>"; };
-		A20673B8CBA1827BCAE8A9CDEAF0CDC5 /* SwitchIfEmpty.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SwitchIfEmpty.swift; path = RxSwift/Observables/SwitchIfEmpty.swift; sourceTree = "<group>"; };
-		A254689F2908346AD7387F063C24B41A /* ko.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = ko.lproj; path = Resources/ko.lproj; sourceTree = "<group>"; };
-		A269EEED1FC8BFDA5FCB004DC335F5C8 /* AtomicInt.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AtomicInt.swift; path = Platform/AtomicInt.swift; sourceTree = "<group>"; };
-		A2738BBB0867C27512A99A3C9DBB2F1E /* GCDWebServer-Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "GCDWebServer-Info.plist"; sourceTree = "<group>"; };
-		A2B10B3F59B2394712B672A72C5827F0 /* SingleAsync.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SingleAsync.swift; path = RxSwift/Observables/SingleAsync.swift; sourceTree = "<group>"; };
-		A2B9727C5385989526550D8E1AC4649A /* MASShortcut.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASShortcut.h; path = Framework/Model/MASShortcut.h; sourceTree = "<group>"; };
-		A2EEB1D58595D58C5DC8978116BE0648 /* MASShortcutView.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = MASShortcutView.h; path = Framework/UI/MASShortcutView.h; sourceTree = "<group>"; };
-		A2FFFF24B3AC3570742D7F2CCF2FE3C5 /* Infallible+Zip+arity.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Infallible+Zip+arity.swift"; path = "RxSwift/Traits/Infallible/Infallible+Zip+arity.swift"; sourceTree = "<group>"; };
-		A32434EC299FDE302FFF9F31EB8735D0 /* RedirectHandler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RedirectHandler.swift; path = Source/RedirectHandler.swift; sourceTree = "<group>"; };
-		A3A89F3DBB03CFC012C901EB6D452A3B /* PriorityQueue.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = PriorityQueue.swift; path = Platform/DataStructures/PriorityQueue.swift; sourceTree = "<group>"; };
-		A3E96B8BC40FDC92B51E51B50F126573 /* Single.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Single.swift; path = RxSwift/Traits/PrimitiveSequence/Single.swift; sourceTree = "<group>"; };
-		A4177B545582D09C0D653414E6353741 /* SectionedViewDataSourceType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SectionedViewDataSourceType.swift; path = RxCocoa/Common/SectionedViewDataSourceType.swift; sourceTree = "<group>"; };
-		A4395BE2A0C53A82170A01602870453A /* GCDWebServerRequest.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerRequest.h; path = GCDWebServer/Core/GCDWebServerRequest.h; sourceTree = "<group>"; };
-		A49E3489F755F888C3405824694827BF /* WithLatestFrom.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = WithLatestFrom.swift; path = RxSwift/Observables/WithLatestFrom.swift; sourceTree = "<group>"; };
-		A4BB8686A6F85698D8AC03A77D188340 /* UITextView+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UITextView+Rx.swift"; path = "RxCocoa/iOS/UITextView+Rx.swift"; sourceTree = "<group>"; };
-		A6415209F9685A39C6C1018082155EA5 /* CompactMap.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = CompactMap.swift; path = RxSwift/Observables/CompactMap.swift; sourceTree = "<group>"; };
-		A8A33670952794CBD825EC26F1A98DBF /* _RXKVOObserver.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = _RXKVOObserver.h; path = RxCocoa/Runtime/include/_RXKVOObserver.h; sourceTree = "<group>"; };
-		A8C417EB740CAC7F2602C6D8880E7737 /* PrimitiveSequence+Zip+arity.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "PrimitiveSequence+Zip+arity.swift"; path = "RxSwift/Traits/PrimitiveSequence/PrimitiveSequence+Zip+arity.swift"; sourceTree = "<group>"; };
-		A907FA326D15CD08847B63032F80EB64 /* Pods-ShadowsocksX-NG-acknowledgements.markdown */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text; path = "Pods-ShadowsocksX-NG-acknowledgements.markdown"; sourceTree = "<group>"; };
-		A94A0417121D2C31F7167E4A79EC5313 /* nl.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = nl.lproj; path = Resources/nl.lproj; sourceTree = "<group>"; };
-		AADC2D51259367D2BB2C73816E5A35CD /* RetryWhen.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RetryWhen.swift; path = RxSwift/Observables/RetryWhen.swift; sourceTree = "<group>"; };
-		AAFFAAB92EFEC042FEE2F851EF9C6CC0 /* NSControl+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSControl+Rx.swift"; path = "RxCocoa/macOS/NSControl+Rx.swift"; sourceTree = "<group>"; };
-		AB7765E1848A0449B3E3267F17DDE12E /* GCDWebServerDataResponse.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerDataResponse.m; path = GCDWebServer/Responses/GCDWebServerDataResponse.m; sourceTree = "<group>"; };
-		ABD89974F6EA342767735D559995D3FA /* Zip+arity.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Zip+arity.swift"; path = "RxSwift/Observables/Zip+arity.swift"; sourceTree = "<group>"; };
-		AC4C66DE7DB1A4B525929AEF699AC3CE /* OperationQueueScheduler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = OperationQueueScheduler.swift; path = RxSwift/Schedulers/OperationQueueScheduler.swift; sourceTree = "<group>"; };
-		ADC06A8D8266504D3FD0F38F5F1A87AD /* RxTableViewDataSourceProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTableViewDataSourceProxy.swift; path = RxCocoa/iOS/Proxies/RxTableViewDataSourceProxy.swift; sourceTree = "<group>"; };
-		AE4742C0047EC328BE64C1DF6D868CEF /* GCDWebServerStreamedResponse.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerStreamedResponse.h; path = GCDWebServer/Responses/GCDWebServerStreamedResponse.h; sourceTree = "<group>"; };
-		AE6768B8A7BED83ED5C93BB3439EFFEF /* URLConvertible+URLRequestConvertible.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "URLConvertible+URLRequestConvertible.swift"; path = "Source/URLConvertible+URLRequestConvertible.swift"; sourceTree = "<group>"; };
-		AF22EDE51D4C2AF18359CE03247D06F1 /* RxCocoa.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = RxCocoa.release.xcconfig; sourceTree = "<group>"; };
-		B1816E3DFE7F11350A74B0C1F878F7FC /* RxCocoa.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxCocoa.swift; path = RxCocoa/RxCocoa.swift; sourceTree = "<group>"; };
-		B1F34EB08D07E2AF230CDA30F361889D /* ja.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = ja.lproj; path = Resources/ja.lproj; sourceTree = "<group>"; };
-		B25AD05D537735CCA21E1986D98F830E /* RxCollectionViewReactiveArrayDataSource.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxCollectionViewReactiveArrayDataSource.swift; path = RxCocoa/iOS/DataSources/RxCollectionViewReactiveArrayDataSource.swift; sourceTree = "<group>"; };
-		B265FABD755D21851D1C166921BB4A24 /* RxTableViewReactiveArrayDataSource.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTableViewReactiveArrayDataSource.swift; path = RxCocoa/iOS/DataSources/RxTableViewReactiveArrayDataSource.swift; sourceTree = "<group>"; };
-		B2BCE49AE180E28B89BBBE037DF32A2F /* zh-Hans.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = "zh-Hans.lproj"; path = "Resources/zh-Hans.lproj"; sourceTree = "<group>"; };
-		B304846A96173EC0E0631D07751C0893 /* Sink.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Sink.swift; path = RxSwift/Observables/Sink.swift; sourceTree = "<group>"; };
-		B400BB6631F1C9F8534BE1CEF160097E /* GCDWebServer-umbrella.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "GCDWebServer-umbrella.h"; sourceTree = "<group>"; };
-		B5AEEDAA3124911175E2336A08227588 /* MASShortcutView+Bindings.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = "MASShortcutView+Bindings.h"; path = "Framework/UI/MASShortcutView+Bindings.h"; sourceTree = "<group>"; };
-		B5B1AE9FCFABDD97172220DFDFE618E5 /* RxTableViewDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTableViewDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxTableViewDelegateProxy.swift; sourceTree = "<group>"; };
-		B5D8A52DE9A6385138A6D20CB5527DDB /* zh-Hant.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = "zh-Hant.lproj"; path = "Resources/zh-Hant.lproj"; sourceTree = "<group>"; };
-		B68B5F9FDDB0D41979766C1D549A8780 /* fr.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = fr.lproj; path = Resources/fr.lproj; sourceTree = "<group>"; };
-		B68C1052A3B51DBCF7D960F898AAFA95 /* GCDWebServer.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = GCDWebServer.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		B7045A3758C33721435A4135DBC6A8AA /* SessionDelegate.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SessionDelegate.swift; path = Source/SessionDelegate.swift; sourceTree = "<group>"; };
-		B797965188D07FBBF91BA7F69EC21D39 /* Pods-ShadowsocksX-NGTests-Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "Pods-ShadowsocksX-NGTests-Info.plist"; sourceTree = "<group>"; };
-		B81749D1C6130BC14B2386B76041124F /* GCDWebServer.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = GCDWebServer.debug.xcconfig; sourceTree = "<group>"; };
-		B8D247C19100F15D54BFF5D93804C65E /* AsSingle.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AsSingle.swift; path = RxSwift/Observables/AsSingle.swift; sourceTree = "<group>"; };
-		B9215F3DCBD2FE1BDADCEF5D05219A48 /* RxCollectionViewDelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxCollectionViewDelegateProxy.swift; path = RxCocoa/iOS/Proxies/RxCollectionViewDelegateProxy.swift; sourceTree = "<group>"; };
-		B97E5FCD7744551B43A8C353FD79E774 /* RefCountDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RefCountDisposable.swift; path = RxSwift/Disposables/RefCountDisposable.swift; sourceTree = "<group>"; };
-		BB1177638C48D2FB13DDFB46A70CD35D /* BehaviorSubject.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = BehaviorSubject.swift; path = RxSwift/Subjects/BehaviorSubject.swift; sourceTree = "<group>"; };
-		BB63C0EAF763E45BC31AAB9802F87995 /* DelegateProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = DelegateProxy.swift; path = RxCocoa/Common/DelegateProxy.swift; sourceTree = "<group>"; };
-		BC41D63AA5F0A525ACB78573334AB97C /* CombineLatest+arity.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "CombineLatest+arity.swift"; path = "RxSwift/Observables/CombineLatest+arity.swift"; sourceTree = "<group>"; };
-		BC432FD48A5932251F1CAFBC4BF74894 /* RxCocoa.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = RxCocoa.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		BE717EAC81EE595FC7AE3C1A3C6D06A6 /* Buffer.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Buffer.swift; path = RxSwift/Observables/Buffer.swift; sourceTree = "<group>"; };
-		BEEC0450A3B1A48A304AE8BF1DC03429 /* Notifications.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Notifications.swift; path = Source/Notifications.swift; sourceTree = "<group>"; };
-		BF07A24C96313F878506258234883CC8 /* GCDWebServer-prefix.pch */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "GCDWebServer-prefix.pch"; sourceTree = "<group>"; };
-		BF25DE5F0433D7BA7D6F91A5F113542A /* RxRelay.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = RxRelay.debug.xcconfig; sourceTree = "<group>"; };
-		BFD92A4EF88D0A6B34E86A6A7CE2436D /* RxSwift.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = RxSwift.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		C0D1BF03B3F26978B85F2E44EBE18FC1 /* RxCollectionViewDataSourceType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxCollectionViewDataSourceType.swift; path = RxCocoa/iOS/Protocols/RxCollectionViewDataSourceType.swift; sourceTree = "<group>"; };
-		C119A4F639217703B4B382419AF9D4EF /* NSObject+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSObject+Rx.swift"; path = "RxCocoa/Foundation/NSObject+Rx.swift"; sourceTree = "<group>"; };
-		C15539256AFFEE061C9DE9660B995B25 /* RxTableViewDataSourcePrefetchingProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTableViewDataSourcePrefetchingProxy.swift; path = RxCocoa/iOS/Proxies/RxTableViewDataSourcePrefetchingProxy.swift; sourceTree = "<group>"; };
-		C21721CAB3BC76F0D7582BD636DB821D /* GCDWebServerDataResponse.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerDataResponse.h; path = GCDWebServer/Responses/GCDWebServerDataResponse.h; sourceTree = "<group>"; };
-		C3B6C103B3C3936D11BF01C71C0EE380 /* BRLOptionParser.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = BRLOptionParser.release.xcconfig; sourceTree = "<group>"; };
-		C3DCF3854C69F5239CE7E89C1FCFAA51 /* ObservableConvertibleType+Signal.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "ObservableConvertibleType+Signal.swift"; path = "RxCocoa/Traits/Signal/ObservableConvertibleType+Signal.swift"; sourceTree = "<group>"; };
-		C4028B836251B6DD18772CF35047686A /* NSView+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSView+Rx.swift"; path = "RxCocoa/macOS/NSView+Rx.swift"; sourceTree = "<group>"; };
-		C40D7DCF882E3A5609EDE1602335E721 /* GCDWebServerResponse.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerResponse.m; path = GCDWebServer/Core/GCDWebServerResponse.m; sourceTree = "<group>"; };
-		C535813B1010A4B0BEBADE15AD42DC2E /* MASShortcut-Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "MASShortcut-Info.plist"; sourceTree = "<group>"; };
-		C5BD2C8DB205D16490D3804A6CAB6C50 /* RxCollectionViewDataSourceProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxCollectionViewDataSourceProxy.swift; path = RxCocoa/iOS/Proxies/RxCollectionViewDataSourceProxy.swift; sourceTree = "<group>"; };
-		C70C13D2EC9B57E48D64BD7ABC49F9D6 /* KVORepresentable+CoreGraphics.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "KVORepresentable+CoreGraphics.swift"; path = "RxCocoa/Foundation/KVORepresentable+CoreGraphics.swift"; sourceTree = "<group>"; };
-		C713517A8C0251C9EEB925D43C63A544 /* ObservableType+Extensions.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "ObservableType+Extensions.swift"; path = "RxSwift/ObservableType+Extensions.swift"; sourceTree = "<group>"; };
-		C771BA2A255CC372CD2AB83291BD3E1C /* GCDWebServer.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServer.h; path = GCDWebServer/Core/GCDWebServer.h; sourceTree = "<group>"; };
-		C78EDD95C0B56A70BE237D148A1726CA /* UIApplication+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIApplication+Rx.swift"; path = "RxCocoa/iOS/UIApplication+Rx.swift"; sourceTree = "<group>"; };
-		C793DFE7002D416E900642C76CEEBD75 /* CurrentThreadScheduler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = CurrentThreadScheduler.swift; path = RxSwift/Schedulers/CurrentThreadScheduler.swift; sourceTree = "<group>"; };
-		C798C591985DFD0B008AAEEBF78EF979 /* DefaultIfEmpty.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = DefaultIfEmpty.swift; path = RxSwift/Observables/DefaultIfEmpty.swift; sourceTree = "<group>"; };
-		C8305C9D0B89A4CE30258C61DDD5A342 /* StringEncoding+Alamofire.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "StringEncoding+Alamofire.swift"; path = "Source/StringEncoding+Alamofire.swift"; sourceTree = "<group>"; };
-		C96F1CEB77C6CB8A9D2A7682406E7AE9 /* DispatchQueue+Extensions.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "DispatchQueue+Extensions.swift"; path = "Platform/DispatchQueue+Extensions.swift"; sourceTree = "<group>"; };
-		CA0A6C3DB39AD5C25FF5B1A9F554E228 /* Lock.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Lock.swift; path = RxSwift/Concurrency/Lock.swift; sourceTree = "<group>"; };
-		CA7211C3393B6E1ED0E57C4CCF5F5005 /* PublishRelay.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = PublishRelay.swift; path = RxRelay/PublishRelay.swift; sourceTree = "<group>"; };
-		CB340F626B32E3AF98F1E13658FB46E2 /* UIBarButtonItem+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIBarButtonItem+Rx.swift"; path = "RxCocoa/iOS/UIBarButtonItem+Rx.swift"; sourceTree = "<group>"; };
-		CCCC3232579F890A62A86540F6600BE6 /* Bag+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Bag+Rx.swift"; path = "RxSwift/Extensions/Bag+Rx.swift"; sourceTree = "<group>"; };
-		CD2C25316E1BF4F3230E3412417481E6 /* Result+Alamofire.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Result+Alamofire.swift"; path = "Source/Result+Alamofire.swift"; sourceTree = "<group>"; };
-		CD90405BE5311F3F3A8CFCFABCCF3560 /* Multicast.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Multicast.swift; path = RxSwift/Observables/Multicast.swift; sourceTree = "<group>"; };
-		CD95085BFAA31431686824B236DB9319 /* Pods-ShadowsocksX-NG-umbrella.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "Pods-ShadowsocksX-NG-umbrella.h"; sourceTree = "<group>"; };
-		CE8BA32B7F7B571C37D44747CBB93955 /* ObserverBase.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ObserverBase.swift; path = RxSwift/Observers/ObserverBase.swift; sourceTree = "<group>"; };
-		CECC6752E3DD709B29A4ED0461B7BF82 /* Disposables.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Disposables.swift; path = RxSwift/Disposables/Disposables.swift; sourceTree = "<group>"; };
-		D157799A728D6FFED669C62E86BABD73 /* GCDWebServerMultiPartFormRequest.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerMultiPartFormRequest.h; path = GCDWebServer/Requests/GCDWebServerMultiPartFormRequest.h; sourceTree = "<group>"; };
-		D18636DE7B757847E9D7B9E45CA10DE2 /* SharedSequence+Operators.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "SharedSequence+Operators.swift"; path = "RxCocoa/Traits/SharedSequence/SharedSequence+Operators.swift"; sourceTree = "<group>"; };
-		D231BAD0830AAA293F76CB7428ADA704 /* MASShortcut.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = MASShortcut.release.xcconfig; sourceTree = "<group>"; };
-		D418B4DEE726BA9D5A912D8F1FBF0888 /* RxTableViewDataSourceType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxTableViewDataSourceType.swift; path = RxCocoa/iOS/Protocols/RxTableViewDataSourceType.swift; sourceTree = "<group>"; };
-		D48183AD5F98D081078429EF56451DFF /* Pods_ShadowsocksX_NGTests.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_ShadowsocksX_NGTests.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		D49EC557FA27872611535147AB5D700C /* UICollectionView+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UICollectionView+Rx.swift"; path = "RxCocoa/iOS/UICollectionView+Rx.swift"; sourceTree = "<group>"; };
-		D4E3DADB00C8898A4A01F4DF1034F96C /* GCDWebServerRequest.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerRequest.m; path = GCDWebServer/Core/GCDWebServerRequest.m; sourceTree = "<group>"; };
-		D54CB24891D5C94C81CAED6F6D1D4FAB /* Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Rx.swift; path = RxSwift/Rx.swift; sourceTree = "<group>"; };
-		D570E112B81800B30A1165D0BC68DB8A /* Delay.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Delay.swift; path = RxSwift/Observables/Delay.swift; sourceTree = "<group>"; };
-		D60357581333E7EC56952E31B2991366 /* Pods-ShadowsocksX-NG-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "Pods-ShadowsocksX-NG-dummy.m"; sourceTree = "<group>"; };
-		D64C89D84E4BDDCF85E57BDA0153F0B1 /* RxSwift.modulemap */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.module; path = RxSwift.modulemap; sourceTree = "<group>"; };
-		D70A973E907BDE134197952FF14301CE /* RxRelay.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = RxRelay.release.xcconfig; sourceTree = "<group>"; };
-		D7453403FEE25F56521DBB8A39EA0204 /* MultipartFormData.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = MultipartFormData.swift; path = Source/MultipartFormData.swift; sourceTree = "<group>"; };
-		D7ED9E80778846168B6F3F867C04F6AA /* ParameterEncoder.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ParameterEncoder.swift; path = Source/ParameterEncoder.swift; sourceTree = "<group>"; };
-		D7F46244A2FF95EF2B228E2F76529358 /* Driver+Subscription.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Driver+Subscription.swift"; path = "RxCocoa/Traits/Driver/Driver+Subscription.swift"; sourceTree = "<group>"; };
-		D87FAE60EB40AC65B2E5000C6B82DFEB /* UIGestureRecognizer+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UIGestureRecognizer+Rx.swift"; path = "RxCocoa/iOS/UIGestureRecognizer+Rx.swift"; sourceTree = "<group>"; };
-		D894FDA92A29CEECD7D1E50C263F1777 /* Reduce.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Reduce.swift; path = RxSwift/Observables/Reduce.swift; sourceTree = "<group>"; };
-		D896F6A68919914B3302027C15449A1D /* Pods_ShadowsocksX_NG.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_ShadowsocksX_NG.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		D8C88B0B7BFE785BC9B00D1C53FDC003 /* Pods-proxy_conf_helper.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = "Pods-proxy_conf_helper.debug.xcconfig"; sourceTree = "<group>"; };
-		D96D37A7C37C05D7DEEAE9B3944CC4DD /* PriorityQueue.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = PriorityQueue.swift; path = Platform/DataStructures/PriorityQueue.swift; sourceTree = "<group>"; };
-		DA23B9C3D142FEFFA05E4F37B1A976AE /* ElementAt.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ElementAt.swift; path = RxSwift/Observables/ElementAt.swift; sourceTree = "<group>"; };
-		DAE48A7C993FBD43A674E228A900457B /* GCDWebServerStreamedResponse.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerStreamedResponse.m; path = GCDWebServer/Responses/GCDWebServerStreamedResponse.m; sourceTree = "<group>"; };
-		DAFB048690381EFB0893639F33D3C764 /* SubscriptionDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SubscriptionDisposable.swift; path = RxSwift/Disposables/SubscriptionDisposable.swift; sourceTree = "<group>"; };
-		DB051CDFBF3B30AA181F5BF12F48FD3A /* ConcurrentDispatchQueueScheduler.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ConcurrentDispatchQueueScheduler.swift; path = RxSwift/Schedulers/ConcurrentDispatchQueueScheduler.swift; sourceTree = "<group>"; };
-		DBB7AE66363DEA0FFF31BA0AD1EB9340 /* DelegateProxyType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = DelegateProxyType.swift; path = RxCocoa/Common/DelegateProxyType.swift; sourceTree = "<group>"; };
-		DC40BD5F1E0BFED23CB5A6AE57FA4443 /* GCDWebServerURLEncodedFormRequest.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = GCDWebServerURLEncodedFormRequest.m; path = GCDWebServer/Requests/GCDWebServerURLEncodedFormRequest.m; sourceTree = "<group>"; };
-		DD31B6D267ADAB9B30F51F821C60554A /* GCDWebServerFunctions.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; name = GCDWebServerFunctions.h; path = GCDWebServer/Core/GCDWebServerFunctions.h; sourceTree = "<group>"; };
-		DE18F7CA6E337EA48867C7D92143B6F9 /* NotificationCenter+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NotificationCenter+Rx.swift"; path = "RxCocoa/Foundation/NotificationCenter+Rx.swift"; sourceTree = "<group>"; };
-		DE719264DC0248D1CA1E5F7821C8381D /* RxCocoa-prefix.pch */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "RxCocoa-prefix.pch"; sourceTree = "<group>"; };
-		DFA75B434E18E0DA5F6DEB758B437261 /* GCDWebServer.modulemap */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.module; path = GCDWebServer.modulemap; sourceTree = "<group>"; };
-		DFAC6355D5B0FD94083A74B4602AF9D2 /* ObservableConvertibleType+SharedSequence.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "ObservableConvertibleType+SharedSequence.swift"; path = "RxCocoa/Traits/SharedSequence/ObservableConvertibleType+SharedSequence.swift"; sourceTree = "<group>"; };
-		E14C791F6C2C8320DE732C78C55306A1 /* ObservableConvertibleType+Driver.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "ObservableConvertibleType+Driver.swift"; path = "RxCocoa/Traits/Driver/ObservableConvertibleType+Driver.swift"; sourceTree = "<group>"; };
-		E35662841C2AAA3188CD9ADFDC38880F /* NSTextStorage+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "NSTextStorage+Rx.swift"; path = "RxCocoa/iOS/NSTextStorage+Rx.swift"; sourceTree = "<group>"; };
-		E39E7221D0BA332CC5AC5DD0A7C16C92 /* UISegmentedControl+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "UISegmentedControl+Rx.swift"; path = "RxCocoa/iOS/UISegmentedControl+Rx.swift"; sourceTree = "<group>"; };
-		E4618B5826B29CA49F53BD36B1570602 /* Materialize.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Materialize.swift; path = RxSwift/Observables/Materialize.swift; sourceTree = "<group>"; };
-		E4C0551E43C5CE2E6F3BD09C18890BFD /* RxCocoa-umbrella.h */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.h; path = "RxCocoa-umbrella.h"; sourceTree = "<group>"; };
-		E5635498728E3B4005A42A385330D7CC /* RxCocoa-Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "RxCocoa-Info.plist"; sourceTree = "<group>"; };
-		E6B674A528A68BF8E6AB4A5F747B05B8 /* NopDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = NopDisposable.swift; path = RxSwift/Disposables/NopDisposable.swift; sourceTree = "<group>"; };
-		E8976DA3C1E5870E7B74F26E219A9885 /* Observable+Bind.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Observable+Bind.swift"; path = "RxCocoa/Common/Observable+Bind.swift"; sourceTree = "<group>"; };
-		EA0C023ECBE853C3AFE12E6702B6D1CD /* BooleanDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = BooleanDisposable.swift; path = RxSwift/Disposables/BooleanDisposable.swift; sourceTree = "<group>"; };
-		EA187A944BB7C96464B1E79E6D12F90F /* AppKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = AppKit.framework; path = Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk/System/Library/Frameworks/AppKit.framework; sourceTree = DEVELOPER_DIR; };
-		EAB5B580FE6B602D602E607C7BC7C470 /* URLSession+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "URLSession+Rx.swift"; path = "RxCocoa/Foundation/URLSession+Rx.swift"; sourceTree = "<group>"; };
-		EB62C29E42A50AB4AA5C6DED19DA376D /* InfiniteSequence.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = InfiniteSequence.swift; path = Platform/DataStructures/InfiniteSequence.swift; sourceTree = "<group>"; };
-		EBC071EBDAC90F82FF4D25D024A5AACF /* Sample.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Sample.swift; path = RxSwift/Observables/Sample.swift; sourceTree = "<group>"; };
-		EC44E7C397DF9B77CEF6F5C86EFCE92A /* RxPickerViewDataSourceProxy.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxPickerViewDataSourceProxy.swift; path = RxCocoa/iOS/Proxies/RxPickerViewDataSourceProxy.swift; sourceTree = "<group>"; };
-		EC8F5BC5CABB65CCD832B9821F532DBD /* InfiniteSequence.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = InfiniteSequence.swift; path = Platform/DataStructures/InfiniteSequence.swift; sourceTree = "<group>"; };
-		ECF8CD0A416163A50B72AAF4B0C4A124 /* ParameterEncoding.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ParameterEncoding.swift; path = Source/ParameterEncoding.swift; sourceTree = "<group>"; };
-		EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk/System/Library/Frameworks/Cocoa.framework; sourceTree = DEVELOPER_DIR; };
-		EE873D31D9227598B067D9426D366009 /* pl.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = pl.lproj; path = Resources/pl.lproj; sourceTree = "<group>"; };
-		EF4A8984BD7018149BDA495C7EA5FE28 /* Infallible+Operators.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Infallible+Operators.swift"; path = "RxSwift/Traits/Infallible/Infallible+Operators.swift"; sourceTree = "<group>"; };
-		EF8D2E7C64775F0DD477127B5EC2E0AB /* RequestTaskMap.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RequestTaskMap.swift; path = Source/RequestTaskMap.swift; sourceTree = "<group>"; };
-		EF91750DCDE73B687E4BA164856BE224 /* SystemConfiguration.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = SystemConfiguration.framework; path = Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk/System/Library/Frameworks/SystemConfiguration.framework; sourceTree = DEVELOPER_DIR; };
-		EFD30F9BBDEB87F6ADD6C3AAF8DE6E30 /* GroupedObservable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = GroupedObservable.swift; path = RxSwift/GroupedObservable.swift; sourceTree = "<group>"; };
-		F0007682E9947D6BFA4DA24D30F6CBF2 /* RxSwift-dummy.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; path = "RxSwift-dummy.m"; sourceTree = "<group>"; };
-		F0D4493458E5817BA46B4318626487F6 /* ScheduledDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ScheduledDisposable.swift; path = RxSwift/Disposables/ScheduledDisposable.swift; sourceTree = "<group>"; };
-		F11E6B29B9CB879F29AFEBD980D3AFBF /* Date+Dispatch.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "Date+Dispatch.swift"; path = "RxSwift/Date+Dispatch.swift"; sourceTree = "<group>"; };
-		F17C7E34E699CD1435A12B207C1A125D /* RxCocoa.modulemap */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.module; path = RxCocoa.modulemap; sourceTree = "<group>"; };
-		F3623071AC720B9C13DD1043F7052A73 /* SynchronizedDisposeType.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SynchronizedDisposeType.swift; path = RxSwift/Concurrency/SynchronizedDisposeType.swift; sourceTree = "<group>"; };
-		F4786526A5AD085C95AC191C7253C591 /* Switch.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Switch.swift; path = RxSwift/Observables/Switch.swift; sourceTree = "<group>"; };
-		F5102E62600D264D29633030E490AAE6 /* NetworkReachabilityManager.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = NetworkReachabilityManager.swift; path = Source/NetworkReachabilityManager.swift; sourceTree = "<group>"; };
-		F57A5448A0A790BED406AB47ED75D7B1 /* Alamofire-Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "Alamofire-Info.plist"; sourceTree = "<group>"; };
-		F6460C30C5328ED85A1103897C8CB63C /* MASDictionaryTransformer.m */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.c.objc; name = MASDictionaryTransformer.m; path = "Framework/User Defaults Storage/MASDictionaryTransformer.m"; sourceTree = "<group>"; };
-		F893DD80BE166F23DB8567A0940B0FEE /* Timer.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Timer.swift; path = RxSwift/Observables/Timer.swift; sourceTree = "<group>"; };
-		F961756C2E9DE7614DBA1271483EB245 /* Never.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Never.swift; path = RxSwift/Observables/Never.swift; sourceTree = "<group>"; };
-		F979292485788BE53E5871123C74EB10 /* RxPickerViewAdapter.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = RxPickerViewAdapter.swift; path = RxCocoa/iOS/DataSources/RxPickerViewAdapter.swift; sourceTree = "<group>"; };
-		F97D53A26324CAC07AB16E21B963CF9A /* InvocableScheduledItem.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = InvocableScheduledItem.swift; path = RxSwift/Schedulers/Internal/InvocableScheduledItem.swift; sourceTree = "<group>"; };
-		FA1467E6A8A0A5B978108FDFC868000E /* Just.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Just.swift; path = RxSwift/Observables/Just.swift; sourceTree = "<group>"; };
-		FAABDBC186233AEF9876B5A4F009C8B8 /* Platform.Darwin.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Platform.Darwin.swift; path = Platform/Platform.Darwin.swift; sourceTree = "<group>"; };
-		FAB6166D07AACCBF2B4A5FFC66F22602 /* pt.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = pt.lproj; path = Resources/pt.lproj; sourceTree = "<group>"; };
-		FB50A95F3BC6DC12244F2B76ABEBB9BD /* Pods-ShadowsocksX-NG-acknowledgements.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; path = "Pods-ShadowsocksX-NG-acknowledgements.plist"; sourceTree = "<group>"; };
-		FBD8075FDD277652161C8676E945DE6A /* RxRelay.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = RxRelay.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		FCF992D22D15D6CF73AF4D310FEE871C /* SingleAssignmentDisposable.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = SingleAssignmentDisposable.swift; path = RxSwift/Disposables/SingleAssignmentDisposable.swift; sourceTree = "<group>"; };
-		FD07F15ADFC693A5C730840EA2B42015 /* AsyncSubject.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = AsyncSubject.swift; path = RxSwift/Subjects/AsyncSubject.swift; sourceTree = "<group>"; };
-		FD39BD9C1B852EC7AC7CD7D77D1E606F /* ObserveOn.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ObserveOn.swift; path = RxSwift/Observables/ObserveOn.swift; sourceTree = "<group>"; };
-		FDCA53BCCEFF4720A955F8202537A982 /* WKWebView+Rx.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = "WKWebView+Rx.swift"; path = "RxCocoa/iOS/WKWebView+Rx.swift"; sourceTree = "<group>"; };
-		FDF7D102C3DA0493A530D68E569DA7CF /* sv.lproj */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = folder; name = sv.lproj; path = Resources/sv.lproj; sourceTree = "<group>"; };
-		FE18557905075BFBE5AFBE3A0D9287F4 /* PublishSubject.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = PublishSubject.swift; path = RxSwift/Subjects/PublishSubject.swift; sourceTree = "<group>"; };
-		FE3AAA7586F734974B628C45E2310229 /* Using.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = Using.swift; path = RxSwift/Observables/Using.swift; sourceTree = "<group>"; };
-		FE6138E84780096ADB31F55549931FC6 /* RxSwift.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; path = RxSwift.debug.xcconfig; sourceTree = "<group>"; };
-		FF5FCDE3BD3C3E02C0A0B3D529BF6982 /* CombineLatest.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = CombineLatest.swift; path = RxSwift/Observables/CombineLatest.swift; sourceTree = "<group>"; };
-		FF8B264DFE802855D5D67E7CDDABFC3C /* RxRelay.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = RxRelay.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-/* End PBXFileReference section */
-
-/* Begin PBXFrameworksBuildPhase section */
-		1514A9A36FD5740CCE236AFAF1DAC5C6 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		44ABA0E4566A87964594C3AB0F7D2048 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		6E9985F3EEB339730D49B3D0181E6029 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				2E0722133679D5C422D0EC5ACB8B23A1 /* Cocoa.framework in Frameworks */,
-				A24E8834A85F99EF471C495AD4EFACAB /* RxRelay.framework in Frameworks */,
-				9131DD9E2CB7420C156461E56835AE6E /* RxSwift.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		7B690F32F695B6718D43BA3D3544C78C /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				8314F89A5274810933307BC20E85D3B0 /* Cocoa.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		B3C5909F9901CF3F5237F1832E214556 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				6A2F2216A64E4B4E0FD6215A2F5E692D /* Cocoa.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		BA30161BB5D2E74710CBABFCC20E409F /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				F654788A27A296CD2C1F104B4C897EF0 /* Cocoa.framework in Frameworks */,
-				FB3AD79C536DC201CED66150778FA691 /* RxSwift.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		C2D4774AB2F0BFB25B60914F66C457AC /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				E03556E8EC8DA4FF0DE3ED6F86BD7C51 /* Cocoa.framework in Frameworks */,
-				EC388029B45DC677A2412CF1617E4DF1 /* SystemConfiguration.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		DA3A32D96D94A82A8FFE804468C37DB4 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				262EBFD1844224838811BD9E1726CD73 /* AppKit.framework in Frameworks */,
-				88665F16CDF39BC2A50C6619169E6EDF /* Carbon.framework in Frameworks */,
-				96E6F7A2D012051B29BC9147340E5117 /* Cocoa.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		E4B8CC1E36A98FF4D8BDAC84442F0DCE /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9A1CDAE2E9AFFFDBC654855D4A8C6D36 /* CFNetwork.framework in Frameworks */,
-				4C3A9F4F5A688009D660C0FA5E5D81BB /* Cocoa.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		EE0D52842751CED2CD0BD2633A30FEA4 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		F4AB20C615B7CE4E912D4031FF0A52C8 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				896AD4C4865ECEA0A8344B54BBA3B9E1 /* Cocoa.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXFrameworksBuildPhase section */
-
-/* Begin PBXGroup section */
-		016ECA8DBDA1E03C02AE6CE07B9C7B28 /* Pods-ShadowsocksX-NGTests */ = {
-			isa = PBXGroup;
-			children = (
-				83899FE1EDE6090C8B2F4703A7895330 /* Pods-ShadowsocksX-NGTests.modulemap */,
-				22ADD736785A6DE33628551E25AC889A /* Pods-ShadowsocksX-NGTests-acknowledgements.markdown */,
-				2CFE9D0E45288EBBAF865D7685C2B983 /* Pods-ShadowsocksX-NGTests-acknowledgements.plist */,
-				1C10AA3C311345DB3616BCE827B69C55 /* Pods-ShadowsocksX-NGTests-dummy.m */,
-				B797965188D07FBBF91BA7F69EC21D39 /* Pods-ShadowsocksX-NGTests-Info.plist */,
-				72A57876EDEB24ADDFE06DD482CE250C /* Pods-ShadowsocksX-NGTests-umbrella.h */,
-				196DA983244F60766BA272090829A16E /* Pods-ShadowsocksX-NGTests.debug.xcconfig */,
-				5C0C485AB4EA81F3E9128F65E9AC66CA /* Pods-ShadowsocksX-NGTests.release.xcconfig */,
-			);
-			name = "Pods-ShadowsocksX-NGTests";
-			path = "Target Support Files/Pods-ShadowsocksX-NGTests";
-			sourceTree = "<group>";
-		};
-		0AE53B8F7176B22FFD63627F9D926CAF /* Support Files */ = {
-			isa = PBXGroup;
-			children = (
-				336A70440B171C2C6AEE66F83620273A /* Alamofire.modulemap */,
-				06A09DBC68AE0A93F94442D71EBF343F /* Alamofire-dummy.m */,
-				F57A5448A0A790BED406AB47ED75D7B1 /* Alamofire-Info.plist */,
-				1A2C716EE769E98BF094D14B243A42C2 /* Alamofire-prefix.pch */,
-				10E99E50E2994DB7AD9AEBDEF1A2F72B /* Alamofire-umbrella.h */,
-				75EA425CE2A4DBDDEB580C7303DD2454 /* Alamofire.debug.xcconfig */,
-				848DD5BA5CA758D1F00A7F6F947019EB /* Alamofire.release.xcconfig */,
-			);
-			name = "Support Files";
-			path = "../Target Support Files/Alamofire";
-			sourceTree = "<group>";
-		};
-		14F38608C29A913E1DD0D624DE663510 /* Pods */ = {
-			isa = PBXGroup;
-			children = (
-				2FBE37D8419906C6110EC34FC53F14BE /* Alamofire */,
-				D20BAD07D23FBA7AA269B9FA80FE8BF3 /* BRLOptionParser */,
-				25954B3ABFDB5497C48E76FDE256C24A /* GCDWebServer */,
-				D71126DFC6989B0EEE224402B0C7852C /* MASShortcut */,
-				AF01C03E9E6BF3B668D35EEF202AD7A0 /* RxCocoa */,
-				6B3DE0B21DFC168E060A8E9C9EC74C3A /* RxRelay */,
-				62066982AA2FE77C183DF3046C898E34 /* RxSwift */,
-			);
-			name = Pods;
-			sourceTree = "<group>";
-		};
-		165807E7BFFB1F57C0BA71AD827D588F /* Support Files */ = {
-			isa = PBXGroup;
-			children = (
-				1389D4639C0D9038BA081FA8DC1CD646 /* BRLOptionParser-dummy.m */,
-				9D407239EE1987EFBB2A7EB11F70BFCF /* BRLOptionParser-prefix.pch */,
-				5EE446AD8C625612BFF0E37E4419E0FD /* BRLOptionParser.debug.xcconfig */,
-				C3B6C103B3C3936D11BF01C71C0EE380 /* BRLOptionParser.release.xcconfig */,
-			);
-			name = "Support Files";
-			path = "../Target Support Files/BRLOptionParser";
-			sourceTree = "<group>";
-		};
-		25954B3ABFDB5497C48E76FDE256C24A /* GCDWebServer */ = {
-			isa = PBXGroup;
-			children = (
-				7D5BF41D87EA0E33C1D9986ADA4BDA51 /* Core */,
-				F7E043D77B41FA3B6662AD3E792046E8 /* Support Files */,
-			);
-			path = GCDWebServer;
-			sourceTree = "<group>";
-		};
-		2FBE37D8419906C6110EC34FC53F14BE /* Alamofire */ = {
-			isa = PBXGroup;
-			children = (
-				6D8A09F0F8EDB0B1A568AA29A33D62EA /* AFError.swift */,
-				2E656BCAB89EA23EC58A161ACF0DAE68 /* Alamofire.swift */,
-				19AA7CC35C97B4BDF08E2E5CE20955E0 /* AlamofireExtended.swift */,
-				2E101994FDA2210D6CD7972A656C511F /* AuthenticationInterceptor.swift */,
-				32EC506B43DB4AE47634A8AEE18D9E8C /* CachedResponseHandler.swift */,
-				9F78589C2F1DDF07DF58CD22F6835B19 /* Combine.swift */,
-				41ADA85A38ECDBBD122B707DA599E641 /* DispatchQueue+Alamofire.swift */,
-				4E0CDE6403F2AF9E108FF190F90FA9FF /* EventMonitor.swift */,
-				3425B3045259FEA3A238D183DEEE520B /* HTTPHeaders.swift */,
-				403ABCCF5634DCD99A376EAA601F828E /* HTTPMethod.swift */,
-				D7453403FEE25F56521DBB8A39EA0204 /* MultipartFormData.swift */,
-				9CF5ADA01C91A2DF993314D6CC9C63D3 /* MultipartUpload.swift */,
-				F5102E62600D264D29633030E490AAE6 /* NetworkReachabilityManager.swift */,
-				BEEC0450A3B1A48A304AE8BF1DC03429 /* Notifications.swift */,
-				26DA8062B81F764A6EEA6168DF6337AB /* OperationQueue+Alamofire.swift */,
-				D7ED9E80778846168B6F3F867C04F6AA /* ParameterEncoder.swift */,
-				ECF8CD0A416163A50B72AAF4B0C4A124 /* ParameterEncoding.swift */,
-				43D1B54DDFE366EA8E657D1CFA2A5349 /* Protected.swift */,
-				A32434EC299FDE302FFF9F31EB8735D0 /* RedirectHandler.swift */,
-				9029CBEE1EB8EBFDFCC3F55CEC98E088 /* Request.swift */,
-				80B5C55F7279E38D15E19E9DEDDEDE7B /* RequestInterceptor.swift */,
-				EF8D2E7C64775F0DD477127B5EC2E0AB /* RequestTaskMap.swift */,
-				0D09EFC8E8E0DD0BACEB39FA20E08331 /* Response.swift */,
-				48CB9D3553F121F84DBB750A8FBE0F3D /* ResponseSerialization.swift */,
-				CD2C25316E1BF4F3230E3412417481E6 /* Result+Alamofire.swift */,
-				3B85D80911EDFC7DD402EBEB3A05169A /* RetryPolicy.swift */,
-				90E9219489B97BDFE17BA3231CC465FC /* ServerTrustEvaluation.swift */,
-				996DFC2DB5C2F37F0E623EB885F5DEB5 /* Session.swift */,
-				B7045A3758C33721435A4135DBC6A8AA /* SessionDelegate.swift */,
-				C8305C9D0B89A4CE30258C61DDD5A342 /* StringEncoding+Alamofire.swift */,
-				AE6768B8A7BED83ED5C93BB3439EFFEF /* URLConvertible+URLRequestConvertible.swift */,
-				5D0A2A589A608DD00CA24C86BCD46E62 /* URLEncodedFormEncoder.swift */,
-				47291D90953698297410B0C37E619402 /* URLRequest+Alamofire.swift */,
-				83FE5C08C0F9F63C9A7D2B71EF9F0864 /* URLSessionConfiguration+Alamofire.swift */,
-				151A22449BAFE60147DA302082A00FA1 /* Validation.swift */,
-				0AE53B8F7176B22FFD63627F9D926CAF /* Support Files */,
-			);
-			path = Alamofire;
-			sourceTree = "<group>";
-		};
-		493933EC245DE8B9BF6A90C4A901306A /* Targets Support Files */ = {
-			isa = PBXGroup;
-			children = (
-				A1DDAA49ED6DA408AC4F6220754154E6 /* Pods-proxy_conf_helper */,
-				B364CCC64531E6C6BC03A50131504939 /* Pods-ShadowsocksX-NG */,
-				016ECA8DBDA1E03C02AE6CE07B9C7B28 /* Pods-ShadowsocksX-NGTests */,
-			);
-			name = "Targets Support Files";
-			sourceTree = "<group>";
-		};
-		4AE2520FB25EC7AF2FA83B8E69D00ED0 /* Support Files */ = {
-			isa = PBXGroup;
-			children = (
-				8C1810C471075F4E78D93E645BD7F63B /* MASShortcut.modulemap */,
-				6B668707F7C66384A3BB8BC4FE3F41E6 /* MASShortcut-dummy.m */,
-				C535813B1010A4B0BEBADE15AD42DC2E /* MASShortcut-Info.plist */,
-				7720FEFA630547FDE17C156840E36CC6 /* MASShortcut-prefix.pch */,
-				930EB20F00FF48CAF9B19505BC219504 /* MASShortcut-umbrella.h */,
-				70C291AA3C3CEE619534F472C4F04882 /* MASShortcut.debug.xcconfig */,
-				D231BAD0830AAA293F76CB7428ADA704 /* MASShortcut.release.xcconfig */,
-				9EF2C4A08C5514586AFFBB5AE22A99ED /* ResourceBundle-MASShortcut-MASShortcut-Info.plist */,
-			);
-			name = "Support Files";
-			path = "../Target Support Files/MASShortcut";
-			sourceTree = "<group>";
-		};
-		4C712514E3CDE5A583F0DA94CB23FB65 /* Frameworks */ = {
-			isa = PBXGroup;
-			children = (
-				FBD8075FDD277652161C8676E945DE6A /* RxRelay.framework */,
-				BFD92A4EF88D0A6B34E86A6A7CE2436D /* RxSwift.framework */,
-				EE196A86A60DA3C09134F038D0679871 /* OS X */,
-			);
-			name = Frameworks;
-			sourceTree = "<group>";
-		};
-		5E0AA8A2AD4F95EB8CD37C35E2FC5D26 /* Support Files */ = {
-			isa = PBXGroup;
-			children = (
-				D64C89D84E4BDDCF85E57BDA0153F0B1 /* RxSwift.modulemap */,
-				F0007682E9947D6BFA4DA24D30F6CBF2 /* RxSwift-dummy.m */,
-				4946CBDE2CD13F181402416264EBF61D /* RxSwift-Info.plist */,
-				3685B6DE4DF41097400DA11AA41A500B /* RxSwift-prefix.pch */,
-				77B5C856C653A9586105526C4341767A /* RxSwift-umbrella.h */,
-				FE6138E84780096ADB31F55549931FC6 /* RxSwift.debug.xcconfig */,
-				28F6CED61832E1CE6BA74AA90F7E45EE /* RxSwift.release.xcconfig */,
-			);
-			name = "Support Files";
-			path = "../Target Support Files/RxSwift";
-			sourceTree = "<group>";
-		};
-		5E93897366D3A44BA737EB9FE037DDB1 /* Support Files */ = {
-			isa = PBXGroup;
-			children = (
-				F17C7E34E699CD1435A12B207C1A125D /* RxCocoa.modulemap */,
-				4752AFB18B745CA95D95FB7457EAA1C4 /* RxCocoa-dummy.m */,
-				E5635498728E3B4005A42A385330D7CC /* RxCocoa-Info.plist */,
-				DE719264DC0248D1CA1E5F7821C8381D /* RxCocoa-prefix.pch */,
-				E4C0551E43C5CE2E6F3BD09C18890BFD /* RxCocoa-umbrella.h */,
-				2F138B6C28378A801D2186B22E1E6224 /* RxCocoa.debug.xcconfig */,
-				AF22EDE51D4C2AF18359CE03247D06F1 /* RxCocoa.release.xcconfig */,
-			);
-			name = "Support Files";
-			path = "../Target Support Files/RxCocoa";
-			sourceTree = "<group>";
-		};
-		62066982AA2FE77C183DF3046C898E34 /* RxSwift */ = {
-			isa = PBXGroup;
-			children = (
-				494FD3BF9675BD2ADCE4731FED65B5FF /* AddRef.swift */,
-				0CB05B6D60934D955FE0D75C2339A114 /* Amb.swift */,
-				1EB8536183BE6472CDCC5817172688EF /* AnonymousDisposable.swift */,
-				636D1EE61F0E0E367F486461F8E0DF54 /* AnonymousObserver.swift */,
-				840A431555445FF451B4B74E7A8DDCF4 /* AnyObserver.swift */,
-				7D680C4252D37F732EE2D1BB9AB911DA /* AsMaybe.swift */,
-				B8D247C19100F15D54BFF5D93804C65E /* AsSingle.swift */,
-				52626495FA7375A2A4753E3EC16FB26C /* AsyncLock.swift */,
-				FD07F15ADFC693A5C730840EA2B42015 /* AsyncSubject.swift */,
-				A269EEED1FC8BFDA5FCB004DC335F5C8 /* AtomicInt.swift */,
-				0B98DA4C08DC1A12B2789714C6CDEFFA /* Bag.swift */,
-				CCCC3232579F890A62A86540F6600BE6 /* Bag+Rx.swift */,
-				BB1177638C48D2FB13DDFB46A70CD35D /* BehaviorSubject.swift */,
-				2FEFD09344E88FFE590FC0A7146C0D32 /* BinaryDisposable.swift */,
-				4412635C50524157DDF38FA0CB197F4A /* Binder.swift */,
-				EA0C023ECBE853C3AFE12E6702B6D1CD /* BooleanDisposable.swift */,
-				BE717EAC81EE595FC7AE3C1A3C6D06A6 /* Buffer.swift */,
-				8565AD8EBB9A4E532AF93D887B586876 /* Cancelable.swift */,
-				1CD2535A24AA927A5965AF73264678A3 /* Catch.swift */,
-				FF5FCDE3BD3C3E02C0A0B3D529BF6982 /* CombineLatest.swift */,
-				BC41D63AA5F0A525ACB78573334AB97C /* CombineLatest+arity.swift */,
-				68D133622632E3F0C62D1F74D188EA7E /* CombineLatest+Collection.swift */,
-				A6415209F9685A39C6C1018082155EA5 /* CompactMap.swift */,
-				2AE63CBE5D3B0C2D25184C45E1B8C885 /* Completable.swift */,
-				A111C3B36368413B50627674BB48E859 /* Completable+AndThen.swift */,
-				3BE91EC45C71C190D532DC351F5E724D /* CompositeDisposable.swift */,
-				66C7F789300668AEDFA53AEA1392C48B /* Concat.swift */,
-				DB051CDFBF3B30AA181F5BF12F48FD3A /* ConcurrentDispatchQueueScheduler.swift */,
-				A126CA25C01C17FEF1E4B62108855349 /* ConcurrentMainScheduler.swift */,
-				2505B197F74151D018080608E6576C6C /* ConnectableObservableType.swift */,
-				3ED0602BE820AA0F7B2D99CBFED4C1F0 /* Create.swift */,
-				C793DFE7002D416E900642C76CEEBD75 /* CurrentThreadScheduler.swift */,
-				F11E6B29B9CB879F29AFEBD980D3AFBF /* Date+Dispatch.swift */,
-				8A2C23CF743A94075196D7A4F419F5A4 /* Debounce.swift */,
-				555231B7293881D7D76CA80C82AABA2B /* Debug.swift */,
-				5D99DA86D8CBFFCB2E7FD40BC42568F3 /* Decode.swift */,
-				C798C591985DFD0B008AAEEBF78EF979 /* DefaultIfEmpty.swift */,
-				33BBD4B03778E41A59C1A3F64AAB876C /* Deferred.swift */,
-				D570E112B81800B30A1165D0BC68DB8A /* Delay.swift */,
-				8AE4AAE5FF0F7FEDE2C8D5FB08A1AE4F /* DelaySubscription.swift */,
-				080201197B517655700BD33F44B1A602 /* Dematerialize.swift */,
-				C96F1CEB77C6CB8A9D2A7682406E7AE9 /* DispatchQueue+Extensions.swift */,
-				222E861679233A0833D6C2F8079146E7 /* DispatchQueueConfiguration.swift */,
-				8369906FA14B85B8271089FAAA1E4694 /* Disposable.swift */,
-				CECC6752E3DD709B29A4ED0461B7BF82 /* Disposables.swift */,
-				0F2EB184269284B56190B6EE5A7E5CC3 /* DisposeBag.swift */,
-				04A3FEA575D65278CDB553AA231A0CF6 /* DisposeBase.swift */,
-				3949A4BE0C4C31915E5A812146DB23B9 /* DistinctUntilChanged.swift */,
-				0E5F518C62FDAA5A762312C37D1CB101 /* Do.swift */,
-				DA23B9C3D142FEFFA05E4F37B1A976AE /* ElementAt.swift */,
-				65D8FEBF2028BCC7758A666F2A35989A /* Empty.swift */,
-				31234D4C5E912BD05D37874E7E89A233 /* Enumerated.swift */,
-				4764F518EAB30C5EA82C03A5607ED7AF /* Error.swift */,
-				718741562429DAE6AA6DC455ED6883D4 /* Errors.swift */,
-				5CE7CD3C7A16D2E9341BBBAB18D5D8DC /* Event.swift */,
-				44775F4816D20EB134F1DBAB43BE0B3A /* Filter.swift */,
-				543DFE92FBC6235F6826EF38928A7C08 /* First.swift */,
-				886072F083033D493924A8BE652713ED /* Generate.swift */,
-				47EB7F9271D4EAE5B4A31D5D0194BECC /* GroupBy.swift */,
-				EFD30F9BBDEB87F6ADD6C3AAF8DE6E30 /* GroupedObservable.swift */,
-				6DA5F27AAEF9B366933CB017942EFAA8 /* HistoricalScheduler.swift */,
-				38A0B431980745BE7A67D566D79E240A /* HistoricalSchedulerTimeConverter.swift */,
-				7DF9FA6B1D40855A99145762147C1690 /* ImmediateSchedulerType.swift */,
-				370A313E34AF66CB8D7437ABDC3FB7F8 /* Infallible.swift */,
-				40573DCBFB24CA15F7D6C33B5C73162F /* Infallible+CombineLatest+arity.swift */,
-				161437331F54761E08F028DD14CDC21E /* Infallible+Create.swift */,
-				EF4A8984BD7018149BDA495C7EA5FE28 /* Infallible+Operators.swift */,
-				A2FFFF24B3AC3570742D7F2CCF2FE3C5 /* Infallible+Zip+arity.swift */,
-				EB62C29E42A50AB4AA5C6DED19DA376D /* InfiniteSequence.swift */,
-				F97D53A26324CAC07AB16E21B963CF9A /* InvocableScheduledItem.swift */,
-				200825C8579BF340304A9767D679EC35 /* InvocableType.swift */,
-				FA1467E6A8A0A5B978108FDFC868000E /* Just.swift */,
-				CA0A6C3DB39AD5C25FF5B1A9F554E228 /* Lock.swift */,
-				683395CCE980D15405934DC5E2BCD682 /* LockOwnerType.swift */,
-				98B151536C20EA366FDBE99C5A8BB7A5 /* MainScheduler.swift */,
-				494A67061DAFFD52534BC4699A8DF637 /* Map.swift */,
-				E4618B5826B29CA49F53BD36B1570602 /* Materialize.swift */,
-				5219820998BC7D8238F0F05F90A3D96F /* Maybe.swift */,
-				5CA0D236EFCE9E4E77F9A2B2A0AF3FC4 /* Merge.swift */,
-				CD90405BE5311F3F3A8CFCFABCCF3560 /* Multicast.swift */,
-				F961756C2E9DE7614DBA1271483EB245 /* Never.swift */,
-				E6B674A528A68BF8E6AB4A5F747B05B8 /* NopDisposable.swift */,
-				636937DE6DA6CE01D7E94282A16BC9D9 /* Observable.swift */,
-				4618A8C418D70264404BBAF10EE3A1F4 /* ObservableConvertibleType.swift */,
-				834EB5666F2D27EDBD25C600C80DF7CE /* ObservableConvertibleType+Infallible.swift */,
-				4338C646A92E1539E9BED963FC618602 /* ObservableType.swift */,
-				C713517A8C0251C9EEB925D43C63A544 /* ObservableType+Extensions.swift */,
-				1AA3BEB86C50C2AAE9CCEDB0171CFC56 /* ObservableType+PrimitiveSequence.swift */,
-				FD39BD9C1B852EC7AC7CD7D77D1E606F /* ObserveOn.swift */,
-				CE8BA32B7F7B571C37D44747CBB93955 /* ObserverBase.swift */,
-				7B00E954AA2FCFDF5ACDEC8CD8C6941E /* ObserverType.swift */,
-				AC4C66DE7DB1A4B525929AEF699AC3CE /* OperationQueueScheduler.swift */,
-				5158C591583049B150EC9F57DC2FA656 /* Optional.swift */,
-				FAABDBC186233AEF9876B5A4F009C8B8 /* Platform.Darwin.swift */,
-				4FF704B43D944C2399606B76A430F1A6 /* Platform.Linux.swift */,
-				280A80C3BD890370005C094FC4C3DC12 /* PrimitiveSequence.swift */,
-				A8C417EB740CAC7F2602C6D8880E7737 /* PrimitiveSequence+Zip+arity.swift */,
-				D96D37A7C37C05D7DEEAE9B3944CC4DD /* PriorityQueue.swift */,
-				4FDB60114950AF3BF06EF9DA0AF9E5AC /* Producer.swift */,
-				FE18557905075BFBE5AFBE3A0D9287F4 /* PublishSubject.swift */,
-				960C49C6C3C5E2554CA3CD8EB86B61AC /* Queue.swift */,
-				2096522151041770121528F182B6F42D /* Range.swift */,
-				0C0FB7A81FC88101C56EABF826BD78F5 /* Reactive.swift */,
-				11DD125BCF1FDD4E34715800EC2F295F /* RecursiveLock.swift */,
-				40FC23633FFFBBD0FA165FB284958F8C /* RecursiveScheduler.swift */,
-				D894FDA92A29CEECD7D1E50C263F1777 /* Reduce.swift */,
-				B97E5FCD7744551B43A8C353FD79E774 /* RefCountDisposable.swift */,
-				45BF55923F2D3657D9D5420E606B641F /* Repeat.swift */,
-				96D93775EA307729314581C5C539C487 /* ReplaySubject.swift */,
-				AADC2D51259367D2BB2C73816E5A35CD /* RetryWhen.swift */,
-				D54CB24891D5C94C81CAED6F6D1D4FAB /* Rx.swift */,
-				530CEAEC9F4BC5F2EC9C9534779927A3 /* RxMutableBox.swift */,
-				EBC071EBDAC90F82FF4D25D024A5AACF /* Sample.swift */,
-				32777B9FE68F64D911474F7B7595C94C /* Scan.swift */,
-				F0D4493458E5817BA46B4318626487F6 /* ScheduledDisposable.swift */,
-				8663196F6A9678BFC77A8E46F8666C75 /* ScheduledItem.swift */,
-				19FF8B675AE7A3F0AB7CDE7C48E8082A /* ScheduledItemType.swift */,
-				A0791E5EB9ADBB88CEE0BCD83DA9502C /* SchedulerServices+Emulation.swift */,
-				111E9F3F4997D0ACA2E0BCDAF269904C /* SchedulerType.swift */,
-				172B845C32EEB48FD9EF1A11CC432D51 /* Sequence.swift */,
-				408AEB2CFB972D5D82E41BB027E6686C /* SerialDispatchQueueScheduler.swift */,
-				6DAFFC9484B606CC3A8583B2085B7957 /* SerialDisposable.swift */,
-				72D91E08E6C75E1F0DBACD4FF3CA2F55 /* ShareReplayScope.swift */,
-				A3E96B8BC40FDC92B51E51B50F126573 /* Single.swift */,
-				FCF992D22D15D6CF73AF4D310FEE871C /* SingleAssignmentDisposable.swift */,
-				A2B10B3F59B2394712B672A72C5827F0 /* SingleAsync.swift */,
-				B304846A96173EC0E0631D07751C0893 /* Sink.swift */,
-				07B4CEF97C27B2FE6205EE1D720BFB39 /* Skip.swift */,
-				A1D0AF20D0BF5465039BB88836A959B6 /* SkipUntil.swift */,
-				904A920F44C4C4A18874A6A62A3ED759 /* SkipWhile.swift */,
-				864BF009AFF7BFF4D8B68869FC885957 /* StartWith.swift */,
-				44D9E4509154BFFEBEA9AEA0C935EC9E /* SubjectType.swift */,
-				17A8B6DADE1F343EA5319D5964E84B71 /* SubscribeOn.swift */,
-				DAFB048690381EFB0893639F33D3C764 /* SubscriptionDisposable.swift */,
-				0BC06E9EC97DF3F5E3AB732D978BD66B /* SwiftSupport.swift */,
-				F4786526A5AD085C95AC191C7253C591 /* Switch.swift */,
-				A20673B8CBA1827BCAE8A9CDEAF0CDC5 /* SwitchIfEmpty.swift */,
-				F3623071AC720B9C13DD1043F7052A73 /* SynchronizedDisposeType.swift */,
-				95A61E2BD71E9AE873207EFE8994362B /* SynchronizedOnType.swift */,
-				1FA62A0165A7A8D001536C62FD5E2392 /* SynchronizedUnsubscribeType.swift */,
-				558A95B0EAE7FAFDFCC334A1E9277C19 /* TailRecursiveSink.swift */,
-				273C90965AA81CCFE4CDA40530425746 /* Take.swift */,
-				73118DDBDD8A625213B479BD40C4B9CE /* TakeLast.swift */,
-				6327835932D3C270A640C0C76A860EB8 /* TakeWithPredicate.swift */,
-				127B3965CEBAEBFB395F0D10B7C255FB /* Throttle.swift */,
-				661DD8158386E15481E17DE6E2FA1882 /* Timeout.swift */,
-				F893DD80BE166F23DB8567A0940B0FEE /* Timer.swift */,
-				314A2DB247EA6781CE45C5C146496327 /* ToArray.swift */,
-				FE3AAA7586F734974B628C45E2310229 /* Using.swift */,
-				4673D1BC54F57F490E2D3352F6BA1B73 /* VirtualTimeConverterType.swift */,
-				6A2828DE92C9CEECE9FB19F2EE763305 /* VirtualTimeScheduler.swift */,
-				855607DC318E2CF3120B3C70565140A0 /* Window.swift */,
-				A49E3489F755F888C3405824694827BF /* WithLatestFrom.swift */,
-				897003218412D0C779A54DAAD7D2A4EE /* WithUnretained.swift */,
-				9FA0DBB3C5358A6E4EF0C16145BB0F7E /* Zip.swift */,
-				ABD89974F6EA342767735D559995D3FA /* Zip+arity.swift */,
-				3677CB82C594C5820F17431AA45C5C87 /* Zip+Collection.swift */,
-				5E0AA8A2AD4F95EB8CD37C35E2FC5D26 /* Support Files */,
-			);
-			path = RxSwift;
-			sourceTree = "<group>";
-		};
-		6B3DE0B21DFC168E060A8E9C9EC74C3A /* RxRelay */ = {
-			isa = PBXGroup;
-			children = (
-				8D796FDCC7398C88D7B835BD89700D56 /* BehaviorRelay.swift */,
-				0A18EEA4857408358F9A8E6ED8AF8829 /* Observable+Bind.swift */,
-				CA7211C3393B6E1ED0E57C4CCF5F5005 /* PublishRelay.swift */,
-				485A8E801F2DA21AB5D16808AE1B4887 /* ReplayRelay.swift */,
-				29BFF21F894144F23E9F778185A1EBC4 /* Utils.swift */,
-				E9E177E10E9704C8136B4410D7F621DB /* Support Files */,
-			);
-			path = RxRelay;
-			sourceTree = "<group>";
-		};
-		7D5BF41D87EA0E33C1D9986ADA4BDA51 /* Core */ = {
-			isa = PBXGroup;
-			children = (
-				C771BA2A255CC372CD2AB83291BD3E1C /* GCDWebServer.h */,
-				55F5FEB17D952CAA64A6B7DE90D7E47D /* GCDWebServer.m */,
-				6D0B40D5A184825074ECC549693CAF02 /* GCDWebServerConnection.h */,
-				1410700BFA8AF785CCF9919941F9930C /* GCDWebServerConnection.m */,
-				36E9C273C636D7A0C559787BD1FABA68 /* GCDWebServerDataRequest.h */,
-				7DFEE31FDCAA3B9A85119C45EE5BF376 /* GCDWebServerDataRequest.m */,
-				C21721CAB3BC76F0D7582BD636DB821D /* GCDWebServerDataResponse.h */,
-				AB7765E1848A0449B3E3267F17DDE12E /* GCDWebServerDataResponse.m */,
-				9EE8B6717B73CE07A9FAC17FFCB1BA91 /* GCDWebServerErrorResponse.h */,
-				199E49652A8B30754D25980910F956E1 /* GCDWebServerErrorResponse.m */,
-				962EFFE0B39AFE334DBCAF81B4DBFE56 /* GCDWebServerFileRequest.h */,
-				392538EA12C4E3008D6EF1ABB226B3BF /* GCDWebServerFileRequest.m */,
-				77E73C4E3CAF9AD8FAE2EA9130D6A37E /* GCDWebServerFileResponse.h */,
-				5BC543740C092C697A08396093A0F7BD /* GCDWebServerFileResponse.m */,
-				DD31B6D267ADAB9B30F51F821C60554A /* GCDWebServerFunctions.h */,
-				0555618E1BBA944D30E358F0700CDD8B /* GCDWebServerFunctions.m */,
-				57BEC3094A7FB642608645E131DA83D4 /* GCDWebServerHTTPStatusCodes.h */,
-				D157799A728D6FFED669C62E86BABD73 /* GCDWebServerMultiPartFormRequest.h */,
-				0C1C25377D5ADEBBE1E5B44FD42F2BF8 /* GCDWebServerMultiPartFormRequest.m */,
-				10F2E7253B70490BD80C987E65C522AC /* GCDWebServerPrivate.h */,
-				A4395BE2A0C53A82170A01602870453A /* GCDWebServerRequest.h */,
-				D4E3DADB00C8898A4A01F4DF1034F96C /* GCDWebServerRequest.m */,
-				89066EEDE0D03A9B328DADDC9344CC13 /* GCDWebServerResponse.h */,
-				C40D7DCF882E3A5609EDE1602335E721 /* GCDWebServerResponse.m */,
-				AE4742C0047EC328BE64C1DF6D868CEF /* GCDWebServerStreamedResponse.h */,
-				DAE48A7C993FBD43A674E228A900457B /* GCDWebServerStreamedResponse.m */,
-				97319F4B64360DC3D794BD7B57BC9936 /* GCDWebServerURLEncodedFormRequest.h */,
-				DC40BD5F1E0BFED23CB5A6AE57FA4443 /* GCDWebServerURLEncodedFormRequest.m */,
-			);
-			name = Core;
-			sourceTree = "<group>";
-		};
-		9D9694B208E8690D485FD95D4A4C8CAA /* Resources */ = {
-			isa = PBXGroup;
-			children = (
-				18B45BFB16E63DDF1AFB6C167D70D1C2 /* cs.lproj */,
-				8F90CD66F125C28F8983AFCFA7DF6607 /* de.lproj */,
-				4A797B2A249C56CB61DB60A3FEA31FD2 /* en.lproj */,
-				4504CA755CE81F89F9F165BF93126D21 /* es.lproj */,
-				B68B5F9FDDB0D41979766C1D549A8780 /* fr.lproj */,
-				321FC2ED515952B66BACDB8CAC130EB4 /* it.lproj */,
-				B1F34EB08D07E2AF230CDA30F361889D /* ja.lproj */,
-				A254689F2908346AD7387F063C24B41A /* ko.lproj */,
-				A94A0417121D2C31F7167E4A79EC5313 /* nl.lproj */,
-				EE873D31D9227598B067D9426D366009 /* pl.lproj */,
-				FAB6166D07AACCBF2B4A5FFC66F22602 /* pt.lproj */,
-				9A3F0ED147035005ABA4D679F9E36A7B /* ru.lproj */,
-				FDF7D102C3DA0493A530D68E569DA7CF /* sv.lproj */,
-				B2BCE49AE180E28B89BBBE037DF32A2F /* zh-Hans.lproj */,
-				B5D8A52DE9A6385138A6D20CB5527DDB /* zh-Hant.lproj */,
-			);
-			name = Resources;
-			sourceTree = "<group>";
-		};
-		A1DDAA49ED6DA408AC4F6220754154E6 /* Pods-proxy_conf_helper */ = {
-			isa = PBXGroup;
-			children = (
-				74656C1BF53AED56A45CDA8600A787D1 /* Pods-proxy_conf_helper-acknowledgements.markdown */,
-				11F97CBA2FD3653262BC227DD1340D90 /* Pods-proxy_conf_helper-acknowledgements.plist */,
-				8752D17209EE8AAD7681107D6444113F /* Pods-proxy_conf_helper-dummy.m */,
-				D8C88B0B7BFE785BC9B00D1C53FDC003 /* Pods-proxy_conf_helper.debug.xcconfig */,
-				4A70BE8C07BCE9C6D6F47AC73225C959 /* Pods-proxy_conf_helper.release.xcconfig */,
-			);
-			name = "Pods-proxy_conf_helper";
-			path = "Target Support Files/Pods-proxy_conf_helper";
-			sourceTree = "<group>";
-		};
-		AF01C03E9E6BF3B668D35EEF202AD7A0 /* RxCocoa */ = {
-			isa = PBXGroup;
-			children = (
-				3BAD385D5CDC39C1AE6584A123D2DFC4 /* _RX.h */,
-				74E6FB11E3F38127740B54FF3C72D1EF /* _RX.m */,
-				30E50B8D09D21C042020DA82FA315C59 /* _RXDelegateProxy.h */,
-				6AD4414199F479D544CBF1FFF3FB45E4 /* _RXDelegateProxy.m */,
-				A8A33670952794CBD825EC26F1A98DBF /* _RXKVOObserver.h */,
-				A14B9E97BE00B01372727FA8DA9B10A3 /* _RXKVOObserver.m */,
-				6985BD62945B0A86382437BC1758C282 /* _RXObjCRuntime.h */,
-				638797412ABBF2F7725016AF4B056309 /* _RXObjCRuntime.m */,
-				2BDFA1D8F5CB80DCE3773C11691B223D /* Bag.swift */,
-				98EF0EFA057CC202BD041F55B091661A /* BehaviorRelay+Driver.swift */,
-				38724BD70D1712C03FA9B7A4C417144D /* ControlEvent.swift */,
-				4C0E4BDE3E30AF8C9062AFAD9C3AEA28 /* ControlEvent+Driver.swift */,
-				9C3A35E7DD83A1437478608A9F2EF44C /* ControlEvent+Signal.swift */,
-				5878F666B9410A53C5BBE1778D1B2CCE /* ControlProperty.swift */,
-				97D6BD38BB9E0F241C3C82A118E7F253 /* ControlProperty+Driver.swift */,
-				5DA6A1DA8589C7192C8BFDBC3F4A9913 /* ControlTarget.swift */,
-				BB63C0EAF763E45BC31AAB9802F87995 /* DelegateProxy.swift */,
-				DBB7AE66363DEA0FFF31BA0AD1EB9340 /* DelegateProxyType.swift */,
-				29E3014CE53E3127CCD38149E2060C76 /* DispatchQueue+Extensions.swift */,
-				5E698A2854CB4D9E919B55523EB57D1A /* Driver.swift */,
-				D7F46244A2FF95EF2B228E2F76529358 /* Driver+Subscription.swift */,
-				36C45F96BE0AE01F3BB2C90370A73616 /* Infallible+Bind.swift */,
-				EC8F5BC5CABB65CCD832B9821F532DBD /* InfiniteSequence.swift */,
-				684F8C697CD894D0F5680EE542AC32E9 /* ItemEvents.swift */,
-				54F202B17AB2C7DC4FEC3F1CF2B5FD57 /* KVORepresentable.swift */,
-				C70C13D2EC9B57E48D64BD7ABC49F9D6 /* KVORepresentable+CoreGraphics.swift */,
-				6EB5DBBABE4FD6FFF0223AC1BC4674DB /* KVORepresentable+Swift.swift */,
-				DE18F7CA6E337EA48867C7D92143B6F9 /* NotificationCenter+Rx.swift */,
-				6DFC3F4E49698472F1AA8DE21B1BD0F2 /* NSButton+Rx.swift */,
-				AAFFAAB92EFEC042FEE2F851EF9C6CC0 /* NSControl+Rx.swift */,
-				C119A4F639217703B4B382419AF9D4EF /* NSObject+Rx.swift */,
-				7B00813C768C553C089DAF0C1900799B /* NSObject+Rx+KVORepresentable.swift */,
-				4C9EBFDB861299F7DC1241C7FCFF00DD /* NSObject+Rx+RawRepresentable.swift */,
-				5874107EF4581DA493B60BBCFE422D1C /* NSSlider+Rx.swift */,
-				2C81F8C45A4C248E266304541A86B5A8 /* NSTextField+Rx.swift */,
-				E35662841C2AAA3188CD9ADFDC38880F /* NSTextStorage+Rx.swift */,
-				5800B274C19C06FB1CA12AC039704852 /* NSTextView+Rx.swift */,
-				C4028B836251B6DD18772CF35047686A /* NSView+Rx.swift */,
-				E8976DA3C1E5870E7B74F26E219A9885 /* Observable+Bind.swift */,
-				E14C791F6C2C8320DE732C78C55306A1 /* ObservableConvertibleType+Driver.swift */,
-				DFAC6355D5B0FD94083A74B4602AF9D2 /* ObservableConvertibleType+SharedSequence.swift */,
-				C3DCF3854C69F5239CE7E89C1FCFAA51 /* ObservableConvertibleType+Signal.swift */,
-				8E801F2049749D5BA709EAE3A2028661 /* Platform.Darwin.swift */,
-				2586C5A6499D4E9A6B62C1CF5804DE66 /* Platform.Linux.swift */,
-				A3A89F3DBB03CFC012C901EB6D452A3B /* PriorityQueue.swift */,
-				758B67811993E4C5163D7637EDBB6CFD /* PublishRelay+Signal.swift */,
-				9B23D7AFD516825208E6CE9B362989DB /* Queue.swift */,
-				5554F4E6979C7DDD1E00F81CB94D474D /* RecursiveLock.swift */,
-				7EB9FE74C8220E21EC9A5A77098E9152 /* RxCocoa.h */,
-				B1816E3DFE7F11350A74B0C1F878F7FC /* RxCocoa.swift */,
-				9F666DF6A38D74980DF6F191509F4971 /* RxCocoaObjCRuntimeError+Extensions.swift */,
-				95F05E167015F6A202D2BEB9437AE766 /* RxCocoaRuntime.h */,
-				78275DA82CA025902C1D6FAF39BC9403 /* RxCollectionViewDataSourcePrefetchingProxy.swift */,
-				C5BD2C8DB205D16490D3804A6CAB6C50 /* RxCollectionViewDataSourceProxy.swift */,
-				C0D1BF03B3F26978B85F2E44EBE18FC1 /* RxCollectionViewDataSourceType.swift */,
-				B9215F3DCBD2FE1BDADCEF5D05219A48 /* RxCollectionViewDelegateProxy.swift */,
-				B25AD05D537735CCA21E1986D98F830E /* RxCollectionViewReactiveArrayDataSource.swift */,
-				52DFCC55A239674DEF17871D293D227C /* RxNavigationControllerDelegateProxy.swift */,
-				F979292485788BE53E5871123C74EB10 /* RxPickerViewAdapter.swift */,
-				EC44E7C397DF9B77CEF6F5C86EFCE92A /* RxPickerViewDataSourceProxy.swift */,
-				961D7CAE484B6E4929A7BE5B048D29B5 /* RxPickerViewDataSourceType.swift */,
-				22D41ECF1E34CC3D83A32F7896831100 /* RxPickerViewDelegateProxy.swift */,
-				7B58732AA1AF7EA39B29A8BE85721F26 /* RxScrollViewDelegateProxy.swift */,
-				345AE1A0C847584A14AD381D5E476AB9 /* RxSearchBarDelegateProxy.swift */,
-				474547C10494F37402A98A0BFC7E6288 /* RxSearchControllerDelegateProxy.swift */,
-				39D9FF9E1CBB62DA6FC1910AA45EB039 /* RxTabBarControllerDelegateProxy.swift */,
-				66D1DACD1512DCFE82BC525C443DA8A5 /* RxTabBarDelegateProxy.swift */,
-				C15539256AFFEE061C9DE9660B995B25 /* RxTableViewDataSourcePrefetchingProxy.swift */,
-				ADC06A8D8266504D3FD0F38F5F1A87AD /* RxTableViewDataSourceProxy.swift */,
-				D418B4DEE726BA9D5A912D8F1FBF0888 /* RxTableViewDataSourceType.swift */,
-				B5B1AE9FCFABDD97172220DFDFE618E5 /* RxTableViewDelegateProxy.swift */,
-				B265FABD755D21851D1C166921BB4A24 /* RxTableViewReactiveArrayDataSource.swift */,
-				6B37E46EBF28CB6542B58754F09D8AAA /* RxTarget.swift */,
-				95B33DD3F11E0587A32ECE709173E4EF /* RxTextStorageDelegateProxy.swift */,
-				531091EE9FF408558B83A1E053360F67 /* RxTextViewDelegateProxy.swift */,
-				3AC418FEB3CC60F42D6A18E6151C871A /* RxWKNavigationDelegateProxy.swift */,
-				53EB3CB0FCC5ABA4F18B576E6BA4EB1F /* SchedulerType+SharedSequence.swift */,
-				A4177B545582D09C0D653414E6353741 /* SectionedViewDataSourceType.swift */,
-				4F401550E51DCC5F5746B99EC564065B /* SharedSequence.swift */,
-				D18636DE7B757847E9D7B9E45CA10DE2 /* SharedSequence+Operators.swift */,
-				87A94DCCD78781BAE448DEA818B26DE4 /* SharedSequence+Operators+arity.swift */,
-				8E4505859B317DCDCC426973F6C7153D /* Signal.swift */,
-				12318B6E6BA8040BCC422023A5ABEF27 /* Signal+Subscription.swift */,
-				1DBE368EA1C6F7EBE80E08054C9BC6AE /* TextInput.swift */,
-				89A41E2A66DF6A8547AFAB72FE74B6A2 /* UIActivityIndicatorView+Rx.swift */,
-				C78EDD95C0B56A70BE237D148A1726CA /* UIApplication+Rx.swift */,
-				CB340F626B32E3AF98F1E13658FB46E2 /* UIBarButtonItem+Rx.swift */,
-				17F9F190DDBE93E38A56D8405CBFA664 /* UIButton+Rx.swift */,
-				D49EC557FA27872611535147AB5D700C /* UICollectionView+Rx.swift */,
-				9C1FFDE936B5B805CB094F77E95A88FC /* UIControl+Rx.swift */,
-				46A83A815027A06FB7A8AB2CEDF56368 /* UIDatePicker+Rx.swift */,
-				D87FAE60EB40AC65B2E5000C6B82DFEB /* UIGestureRecognizer+Rx.swift */,
-				6D742A8B753D54115AD3C6D293B64276 /* UINavigationController+Rx.swift */,
-				608BE9EFB078FCC2348EF2782C265D92 /* UIPickerView+Rx.swift */,
-				506B13C445D67D7231C25641361EE5A1 /* UIRefreshControl+Rx.swift */,
-				441E899D371A5638D8CBD0A21A8CCA61 /* UIScrollView+Rx.swift */,
-				2888FA81FD2BE4D3B068BCE4AFDC9A93 /* UISearchBar+Rx.swift */,
-				8ED0DC48A18FD32A95BE8B28D715172C /* UISearchController+Rx.swift */,
-				E39E7221D0BA332CC5AC5DD0A7C16C92 /* UISegmentedControl+Rx.swift */,
-				466B399C2E7FFAA61B709F2AB447ECDF /* UISlider+Rx.swift */,
-				1B2134E06DD0F0E19694ADD2E46E9EF0 /* UIStepper+Rx.swift */,
-				3622945DEBFCB14514027A236BDFC74C /* UISwitch+Rx.swift */,
-				21F927D22EA76A49C54C44827DD1CE5A /* UITabBar+Rx.swift */,
-				9D4701E49CFDE5F411CDFD316EDD3C70 /* UITabBarController+Rx.swift */,
-				51E7C258B34B55C44CAA679574F0B5E1 /* UITableView+Rx.swift */,
-				877FA6BB936631CD8F2CA0DFFF6EFC9C /* UITextField+Rx.swift */,
-				A4BB8686A6F85698D8AC03A77D188340 /* UITextView+Rx.swift */,
-				EAB5B580FE6B602D602E607C7BC7C470 /* URLSession+Rx.swift */,
-				FDCA53BCCEFF4720A955F8202537A982 /* WKWebView+Rx.swift */,
-				5E93897366D3A44BA737EB9FE037DDB1 /* Support Files */,
-			);
-			path = RxCocoa;
-			sourceTree = "<group>";
-		};
-		B364CCC64531E6C6BC03A50131504939 /* Pods-ShadowsocksX-NG */ = {
-			isa = PBXGroup;
-			children = (
-				1EA29F7E0E65B6A9619DB77448844EC1 /* Pods-ShadowsocksX-NG.modulemap */,
-				A907FA326D15CD08847B63032F80EB64 /* Pods-ShadowsocksX-NG-acknowledgements.markdown */,
-				FB50A95F3BC6DC12244F2B76ABEBB9BD /* Pods-ShadowsocksX-NG-acknowledgements.plist */,
-				D60357581333E7EC56952E31B2991366 /* Pods-ShadowsocksX-NG-dummy.m */,
-				2A11F032AFA3310A3EEE63E67481B01E /* Pods-ShadowsocksX-NG-frameworks.sh */,
-				96C80DBAD0A8D59912E005E60636A935 /* Pods-ShadowsocksX-NG-Info.plist */,
-				CD95085BFAA31431686824B236DB9319 /* Pods-ShadowsocksX-NG-umbrella.h */,
-				9A71B9958F30759ED2645E0DF9ADF314 /* Pods-ShadowsocksX-NG.debug.xcconfig */,
-				92B4BB091693150E5B1FCC6987683C6F /* Pods-ShadowsocksX-NG.release.xcconfig */,
-			);
-			name = "Pods-ShadowsocksX-NG";
-			path = "Target Support Files/Pods-ShadowsocksX-NG";
-			sourceTree = "<group>";
-		};
-		CF1408CF629C7361332E53B88F7BD30C = {
-			isa = PBXGroup;
-			children = (
-				9D940727FF8FB9C785EB98E56350EF41 /* Podfile */,
-				4C712514E3CDE5A583F0DA94CB23FB65 /* Frameworks */,
-				14F38608C29A913E1DD0D624DE663510 /* Pods */,
-				E786B58AC38A5957ED28E1C47257C01E /* Products */,
-				493933EC245DE8B9BF6A90C4A901306A /* Targets Support Files */,
-			);
-			sourceTree = "<group>";
-		};
-		D20BAD07D23FBA7AA269B9FA80FE8BF3 /* BRLOptionParser */ = {
-			isa = PBXGroup;
-			children = (
-				31F9576864749334961DE762B01B777C /* BRLOptionParser.h */,
-				68C9C3CF6142E1B32695BC562ECAC427 /* BRLOptionParser.m */,
-				165807E7BFFB1F57C0BA71AD827D588F /* Support Files */,
-			);
-			path = BRLOptionParser;
-			sourceTree = "<group>";
-		};
-		D71126DFC6989B0EEE224402B0C7852C /* MASShortcut */ = {
-			isa = PBXGroup;
-			children = (
-				353B178196A1B3A383089B3D1006F66A /* MASDictionaryTransformer.h */,
-				F6460C30C5328ED85A1103897C8CB63C /* MASDictionaryTransformer.m */,
-				8937D9E4BB1CD1D979DFF21019B4D814 /* MASHotKey.h */,
-				7BE4993AB90D97D332E61EB54E0C3C9A /* MASHotKey.m */,
-				73327356D8055C270C5AFBAEE0D202DD /* MASKeyCodes.h */,
-				867FD5BBBCAC1E98FE144867305F8FEF /* MASKeyMasks.h */,
-				82A2597C8D9860F95F40565C0631A47D /* MASLocalization.h */,
-				46DA81F6288F2733B7F27CCDE97EA2C4 /* MASLocalization.m */,
-				A2B9727C5385989526550D8E1AC4649A /* MASShortcut.h */,
-				7A4A724DBFF9C1C260A76A4B104F3B1E /* MASShortcut.m */,
-				A18A7F7794D2CC58900E95F6644D63E8 /* MASShortcutBinder.h */,
-				46002374E8C8C6F2127C7C9A6DFEF743 /* MASShortcutBinder.m */,
-				24121C8FA3C10947BE50901868F9198A /* MASShortcutMonitor.h */,
-				605C26B2F1FFA16F0E85E33F5CC526EC /* MASShortcutMonitor.m */,
-				8E796A67AE756E845646324A31731334 /* MASShortcutValidator.h */,
-				726DEA3A84065F8E12FDE5617447B366 /* MASShortcutValidator.m */,
-				A2EEB1D58595D58C5DC8978116BE0648 /* MASShortcutView.h */,
-				7C73921B2C710D3814A33EF328D04D20 /* MASShortcutView.m */,
-				B5AEEDAA3124911175E2336A08227588 /* MASShortcutView+Bindings.h */,
-				7C471325C18D493A8244DEB1563B18B6 /* MASShortcutView+Bindings.m */,
-				6B9491CF676F85A85C4F0987D38F9051 /* Shortcut.h */,
-				9D9694B208E8690D485FD95D4A4C8CAA /* Resources */,
-				4AE2520FB25EC7AF2FA83B8E69D00ED0 /* Support Files */,
-			);
-			path = MASShortcut;
-			sourceTree = "<group>";
-		};
-		E786B58AC38A5957ED28E1C47257C01E /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				5D797E9A5C5782CE845840781FA1CC81 /* Alamofire.framework */,
-				B68C1052A3B51DBCF7D960F898AAFA95 /* GCDWebServer.framework */,
-				866C21955F27EBD7A49148F5E63A6E7E /* libBRLOptionParser.a */,
-				61C23DB60A84900CD4BDA2F5EE2A0865 /* libPods-proxy_conf_helper.a */,
-				230F8208BE63C052A548A7D41A1158B2 /* MASShortcut.bundle */,
-				26A8810424438A12E7ADBFB3E068C658 /* MASShortcut.framework */,
-				D896F6A68919914B3302027C15449A1D /* Pods_ShadowsocksX_NG.framework */,
-				D48183AD5F98D081078429EF56451DFF /* Pods_ShadowsocksX_NGTests.framework */,
-				BC432FD48A5932251F1CAFBC4BF74894 /* RxCocoa.framework */,
-				FF8B264DFE802855D5D67E7CDDABFC3C /* RxRelay.framework */,
-				809C5FAB588354C9BA37DC3EAB8CB45C /* RxSwift.framework */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-		E9E177E10E9704C8136B4410D7F621DB /* Support Files */ = {
-			isa = PBXGroup;
-			children = (
-				38A6B331CD11EA3ADC9BE7CFD5DE99DA /* RxRelay.modulemap */,
-				1718F5B8FAF3CE57AE64B5F53589493F /* RxRelay-dummy.m */,
-				52786C2AA26607ED32FA242D407DEC3D /* RxRelay-Info.plist */,
-				A01C872DE26A61BFEF081FC71E72A0D0 /* RxRelay-prefix.pch */,
-				2DDC82F5641636881356BF49166C8DF3 /* RxRelay-umbrella.h */,
-				BF25DE5F0433D7BA7D6F91A5F113542A /* RxRelay.debug.xcconfig */,
-				D70A973E907BDE134197952FF14301CE /* RxRelay.release.xcconfig */,
-			);
-			name = "Support Files";
-			path = "../Target Support Files/RxRelay";
-			sourceTree = "<group>";
-		};
-		EE196A86A60DA3C09134F038D0679871 /* OS X */ = {
-			isa = PBXGroup;
-			children = (
-				EA187A944BB7C96464B1E79E6D12F90F /* AppKit.framework */,
-				62F5D09616527A0713F24DF416BEC64F /* Carbon.framework */,
-				817D9055D7659CAC86800D119F65E0F4 /* CFNetwork.framework */,
-				EE6672D913C4CDAB5BAC161BDC483A67 /* Cocoa.framework */,
-				EF91750DCDE73B687E4BA164856BE224 /* SystemConfiguration.framework */,
-			);
-			name = "OS X";
-			sourceTree = "<group>";
-		};
-		F7E043D77B41FA3B6662AD3E792046E8 /* Support Files */ = {
-			isa = PBXGroup;
-			children = (
-				DFA75B434E18E0DA5F6DEB758B437261 /* GCDWebServer.modulemap */,
-				09A0680C8640FDF225CF2A27A4204628 /* GCDWebServer-dummy.m */,
-				A2738BBB0867C27512A99A3C9DBB2F1E /* GCDWebServer-Info.plist */,
-				BF07A24C96313F878506258234883CC8 /* GCDWebServer-prefix.pch */,
-				B400BB6631F1C9F8534BE1CEF160097E /* GCDWebServer-umbrella.h */,
-				B81749D1C6130BC14B2386B76041124F /* GCDWebServer.debug.xcconfig */,
-				2094BFBE78A2839B3C673A3E450C77FC /* GCDWebServer.release.xcconfig */,
-			);
-			name = "Support Files";
-			path = "../Target Support Files/GCDWebServer";
-			sourceTree = "<group>";
-		};
-/* End PBXGroup section */
-
-/* Begin PBXHeadersBuildPhase section */
-		00CE41EA22C241610DE8C8369C5F8DCC /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				65EA84D8C4EA09B4455BC6C221D2A940 /* Pods-ShadowsocksX-NGTests-umbrella.h in Headers */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		4066ADE1EACF598A77B29ECDD1BC4736 /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				0CA982442C8027B672202D753260BAC9 /* RxSwift-umbrella.h in Headers */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		578CC080DFCED687B046D6BDE4585CCB /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				54FFBD61CC8FA5DD12646A7FFAAFE425 /* RxRelay-umbrella.h in Headers */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		5C92B9BF5BDADA4C1E469E82F4E59CC5 /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				8450D728709DB935952A5A59650DB926 /* MASDictionaryTransformer.h in Headers */,
-				332D9AE4473773687AA9155EF16A80D8 /* MASHotKey.h in Headers */,
-				12DF0C4E73CEC6118673050B236C7799 /* MASKeyCodes.h in Headers */,
-				0EEDE530AD4098CC0660A78E2852DA6A /* MASKeyMasks.h in Headers */,
-				E5F3CF900C793B92F327E2F4BDF8A8AB /* MASLocalization.h in Headers */,
-				5BF5F916582D2EE625A9F0F32ECE709A /* MASShortcut-umbrella.h in Headers */,
-				4D15DB973A043E9B4A47B724738A2A5F /* MASShortcut.h in Headers */,
-				665FBE569EDC9AF24C721F6B9C7241EC /* MASShortcutBinder.h in Headers */,
-				5263ED302CD55D6C365476F9B20AD5D1 /* MASShortcutMonitor.h in Headers */,
-				72E6FED1FBFB7D269B435A3802528AA1 /* MASShortcutValidator.h in Headers */,
-				F07EC9B60B1FB76D9F64FE2BC62A87DF /* MASShortcutView+Bindings.h in Headers */,
-				80C7348602C99C09226B1241C02D4754 /* MASShortcutView.h in Headers */,
-				C33311F020C5777D0CB7E0F61E4FED8D /* Shortcut.h in Headers */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		6584631C190AE58FF259F0472DDC1232 /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		6D5EE38D1C1016BBF38E27BDF0AE819C /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				CEA50BEC377AEE2AAA9DB5B71DEA418C /* BRLOptionParser.h in Headers */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		6E03461CB76B22AB26BB407943C2763E /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				E0AF255AB2AFA980F44645355BB7828C /* _RX.h in Headers */,
-				AC9540D461C3407AB049AEDB94B82375 /* _RXDelegateProxy.h in Headers */,
-				C83DA2E174587856EBBAAA1763F6D483 /* _RXKVOObserver.h in Headers */,
-				A34F81BE4A40B0C6EF378FBB8F240C66 /* _RXObjCRuntime.h in Headers */,
-				C09F690FF2734763D8D2838B0BA14B0F /* RxCocoa-umbrella.h in Headers */,
-				815908B08BEA64FC0E5641D046D43CB6 /* RxCocoa.h in Headers */,
-				9AA31D499392F8C3E63FE70C8DE816ED /* RxCocoaRuntime.h in Headers */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		8070B01910C64B9AFD0DB550EDE38D6B /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				7D3DD4A8BB36733BA15868F7FB8C56CE /* Alamofire-umbrella.h in Headers */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		8AC5AA6FFC615596F505AD8BD785D837 /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				1D5606C6BD48C543FA0DB2C82B8791B7 /* GCDWebServer-umbrella.h in Headers */,
-				AECCE1EAA0757255BC4D722A53202DB0 /* GCDWebServer.h in Headers */,
-				7D5AE7E56AC7636F1D00076095F57745 /* GCDWebServerConnection.h in Headers */,
-				8BEDC2C0D907FBB47A65EE0E01DE2A59 /* GCDWebServerDataRequest.h in Headers */,
-				901D8E9CC22C5E7FDB218557EBBB3559 /* GCDWebServerDataResponse.h in Headers */,
-				F5C3C227785D45C44F1FA8157EF99C71 /* GCDWebServerErrorResponse.h in Headers */,
-				4892C3EBD345FAE187A5E15D7FA19CBE /* GCDWebServerFileRequest.h in Headers */,
-				D33C1AD2E019F48235F734A00CE7C24C /* GCDWebServerFileResponse.h in Headers */,
-				B47372436C56EE24B909DE97D5005A64 /* GCDWebServerFunctions.h in Headers */,
-				C341FC8944C28CCA39FB9AC4B0F23763 /* GCDWebServerHTTPStatusCodes.h in Headers */,
-				FCBF7F9DA53A194F0653EE7E00B57BC8 /* GCDWebServerMultiPartFormRequest.h in Headers */,
-				DF3FD63D6A37C12FDB09B8CA5AE80AC3 /* GCDWebServerPrivate.h in Headers */,
-				6809229B402FC6C91774DA8664AD4F2F /* GCDWebServerRequest.h in Headers */,
-				88F5FF298C4C3D2CDCA5EB7B0BE2B52C /* GCDWebServerResponse.h in Headers */,
-				1FAEB66513E2610FE37D99FDD8F9E46D /* GCDWebServerStreamedResponse.h in Headers */,
-				BD379AB5D6DF4FF97EF15732D9635186 /* GCDWebServerURLEncodedFormRequest.h in Headers */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		E23D293CACB5C453B56EBB9A0CC37588 /* Headers */ = {
-			isa = PBXHeadersBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				F01A39BF2122BF11990A88015EF45A48 /* Pods-ShadowsocksX-NG-umbrella.h in Headers */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXHeadersBuildPhase section */
-
-/* Begin PBXNativeTarget section */
-		00F92A6698B766C4479D7B608F28D680 /* BRLOptionParser */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 6D442598AC59E49374231C4242255CA3 /* Build configuration list for PBXNativeTarget "BRLOptionParser" */;
-			buildPhases = (
-				6D5EE38D1C1016BBF38E27BDF0AE819C /* Headers */,
-				DFF2B5F26ABB5074146BB93EA5DBE095 /* Sources */,
-				EE0D52842751CED2CD0BD2633A30FEA4 /* Frameworks */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = BRLOptionParser;
-			productName = BRLOptionParser;
-			productReference = 866C21955F27EBD7A49148F5E63A6E7E /* libBRLOptionParser.a */;
-			productType = "com.apple.product-type.library.static";
-		};
-		2B2B481A164695722839BD581D442457 /* MASShortcut */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = E888D466E966B416D89BA302F582A3F5 /* Build configuration list for PBXNativeTarget "MASShortcut" */;
-			buildPhases = (
-				5C92B9BF5BDADA4C1E469E82F4E59CC5 /* Headers */,
-				7A815F2E1A9D4EFD8C4C4BD6D7DC1BCA /* Sources */,
-				DA3A32D96D94A82A8FFE804468C37DB4 /* Frameworks */,
-				E8A034F83F762D640CA494BF8161ED87 /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				53637CA92B734D4013B9F99E7AAA9808 /* PBXTargetDependency */,
-			);
-			name = MASShortcut;
-			productName = MASShortcut;
-			productReference = 26A8810424438A12E7ADBFB3E068C658 /* MASShortcut.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-		2E91F9FD8B0C7DA58DD330CBF2096926 /* Pods-ShadowsocksX-NGTests */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 84B5ECA69733DA3FEDC652649E6E42C5 /* Build configuration list for PBXNativeTarget "Pods-ShadowsocksX-NGTests" */;
-			buildPhases = (
-				00CE41EA22C241610DE8C8369C5F8DCC /* Headers */,
-				F0A91985F4DA9728630FB9ABC81A8CC1 /* Sources */,
-				F4AB20C615B7CE4E912D4031FF0A52C8 /* Frameworks */,
-				8FA2F274BF94CAE07E4B856B3E2F5D77 /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				FF103DE3A0523E2D55DE3D845DD9F0E2 /* PBXTargetDependency */,
-			);
-			name = "Pods-ShadowsocksX-NGTests";
-			productName = "Pods-ShadowsocksX-NGTests";
-			productReference = D48183AD5F98D081078429EF56451DFF /* Pods_ShadowsocksX_NGTests.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-		4622BFEF3DC16E8BD15EEFC30D4D0084 /* RxRelay */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 3797157A80385C2407F752CEE1BFEB21 /* Build configuration list for PBXNativeTarget "RxRelay" */;
-			buildPhases = (
-				578CC080DFCED687B046D6BDE4585CCB /* Headers */,
-				FEE82C527A384A55B52EF357FAA16C22 /* Sources */,
-				BA30161BB5D2E74710CBABFCC20E409F /* Frameworks */,
-				A151D550DD2C543F68445FDB753EF8EF /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				232E22686FEEB70180F984222B39F949 /* PBXTargetDependency */,
-			);
-			name = RxRelay;
-			productName = RxRelay;
-			productReference = FF8B264DFE802855D5D67E7CDDABFC3C /* RxRelay.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-		73C37A16ECCEAD845651DCDEE95675BE /* MASShortcut-MASShortcut */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 1C26E77821938498151B66E4B3FAFDB5 /* Build configuration list for PBXNativeTarget "MASShortcut-MASShortcut" */;
-			buildPhases = (
-				3DC69F9E1AADA4EC8478D34D6CE9F516 /* Sources */,
-				1514A9A36FD5740CCE236AFAF1DAC5C6 /* Frameworks */,
-				B729EA1E27F34F10BAEB7F33DC42599A /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = "MASShortcut-MASShortcut";
-			productName = "MASShortcut-MASShortcut";
-			productReference = 230F8208BE63C052A548A7D41A1158B2 /* MASShortcut.bundle */;
-			productType = "com.apple.product-type.bundle";
-		};
-		7AD0C6DCDC9CEC8A3C7C10C7FEE07BE6 /* RxCocoa */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = ABE56D8D3781109924A96BB7837ED223 /* Build configuration list for PBXNativeTarget "RxCocoa" */;
-			buildPhases = (
-				6E03461CB76B22AB26BB407943C2763E /* Headers */,
-				CCF785ECCCE66AF314E3E51FEE3B8E42 /* Sources */,
-				6E9985F3EEB339730D49B3D0181E6029 /* Frameworks */,
-				EE0DFE66B52C1DA23E421D65B412E5CC /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				16E7E2DB71489A3B3A809EE95AF55896 /* PBXTargetDependency */,
-				F1208697A3C80B8117E54FA1B0E859B1 /* PBXTargetDependency */,
-			);
-			name = RxCocoa;
-			productName = RxCocoa;
-			productReference = BC432FD48A5932251F1CAFBC4BF74894 /* RxCocoa.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-		9155E0B9A1C6F689BA4B61F3B690FDA1 /* Pods-proxy_conf_helper */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 0D501A92E69AF80E7786DD9C0D172BEC /* Build configuration list for PBXNativeTarget "Pods-proxy_conf_helper" */;
-			buildPhases = (
-				6584631C190AE58FF259F0472DDC1232 /* Headers */,
-				19D1B24F4E402839324A4B4FE36492FB /* Sources */,
-				44ABA0E4566A87964594C3AB0F7D2048 /* Frameworks */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				79DC5AF6E7C88EC75AD6D91A9FF3E011 /* PBXTargetDependency */,
-			);
-			name = "Pods-proxy_conf_helper";
-			productName = "Pods-proxy_conf_helper";
-			productReference = 61C23DB60A84900CD4BDA2F5EE2A0865 /* libPods-proxy_conf_helper.a */;
-			productType = "com.apple.product-type.library.static";
-		};
-		AD904F32069787EFB2DFFE05EB82F5BD /* GCDWebServer */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 690C9430B03B92419AFA4555712EC873 /* Build configuration list for PBXNativeTarget "GCDWebServer" */;
-			buildPhases = (
-				8AC5AA6FFC615596F505AD8BD785D837 /* Headers */,
-				A169CD366B0A64342FFF6E09CEC61622 /* Sources */,
-				C2D4774AB2F0BFB25B60914F66C457AC /* Frameworks */,
-				AE499806FA299FC184E575472A14EE39 /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = GCDWebServer;
-			productName = GCDWebServer;
-			productReference = B68C1052A3B51DBCF7D960F898AAFA95 /* GCDWebServer.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-		E9FDECF69808DB0491D4B4C08CF920DC /* Pods-ShadowsocksX-NG */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 975822F53DB5EF99EE2C5EA67BC503C9 /* Build configuration list for PBXNativeTarget "Pods-ShadowsocksX-NG" */;
-			buildPhases = (
-				E23D293CACB5C453B56EBB9A0CC37588 /* Headers */,
-				53C1A57011F61182535EA4555B7EE67A /* Sources */,
-				7B690F32F695B6718D43BA3D3544C78C /* Frameworks */,
-				E61A0FC1D432BA45188126B9155D697E /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				18247C9B740C16AA1A1F647B7676E673 /* PBXTargetDependency */,
-				D38F26CBE0B158CB00FD29413295EBDB /* PBXTargetDependency */,
-				B2D17789138C47D21E16F60C47053226 /* PBXTargetDependency */,
-				41031387B219D54FF7673356F1696E11 /* PBXTargetDependency */,
-				7DABF5696F48F5C2D50C0A3DE25289EE /* PBXTargetDependency */,
-				0403456DEA90C0614E5AFBAE92D06199 /* PBXTargetDependency */,
-			);
-			name = "Pods-ShadowsocksX-NG";
-			productName = "Pods-ShadowsocksX-NG";
-			productReference = D896F6A68919914B3302027C15449A1D /* Pods_ShadowsocksX_NG.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-		EA9EA43B3B503823EE36C60D9C8A865F /* RxSwift */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 6331D6AD3A4489B8CBA44A44D38FD80A /* Build configuration list for PBXNativeTarget "RxSwift" */;
-			buildPhases = (
-				4066ADE1EACF598A77B29ECDD1BC4736 /* Headers */,
-				17A2675A401E7A47A2A85F5E0DE8CFFB /* Sources */,
-				B3C5909F9901CF3F5237F1832E214556 /* Frameworks */,
-				046A991884442073662E8396D30686EE /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = RxSwift;
-			productName = RxSwift;
-			productReference = 809C5FAB588354C9BA37DC3EAB8CB45C /* RxSwift.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-		EAAA1AD3A8A1B59AB91319EE40752C6D /* Alamofire */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 78E219AC01CD5AFED663C9AB28280801 /* Build configuration list for PBXNativeTarget "Alamofire" */;
-			buildPhases = (
-				8070B01910C64B9AFD0DB550EDE38D6B /* Headers */,
-				2C8326877F6A9617C2FBE9BD15D95B59 /* Sources */,
-				E4B8CC1E36A98FF4D8BDAC84442F0DCE /* Frameworks */,
-				9BCA7D105D531AE5DAF34FB86A2E623A /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = Alamofire;
-			productName = Alamofire;
-			productReference = 5D797E9A5C5782CE845840781FA1CC81 /* Alamofire.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-/* End PBXNativeTarget section */
-
-/* Begin PBXProject section */
-		BFDFE7DC352907FC980B868725387E98 /* Project object */ = {
-			isa = PBXProject;
-			attributes = {
-				LastSwiftUpdateCheck = 1100;
-				LastUpgradeCheck = 1250;
-			};
-			buildConfigurationList = 4821239608C13582E20E6DA73FD5F1F9 /* Build configuration list for PBXProject "Pods" */;
-			compatibilityVersion = "Xcode 3.2";
-			developmentRegion = en;
-			hasScannedForEncodings = 0;
-			knownRegions = (
-				en,
-				Base,
-			);
-			mainGroup = CF1408CF629C7361332E53B88F7BD30C;
-			productRefGroup = E786B58AC38A5957ED28E1C47257C01E /* Products */;
-			projectDirPath = "";
-			projectRoot = "";
-			targets = (
-				EAAA1AD3A8A1B59AB91319EE40752C6D /* Alamofire */,
-				00F92A6698B766C4479D7B608F28D680 /* BRLOptionParser */,
-				AD904F32069787EFB2DFFE05EB82F5BD /* GCDWebServer */,
-				2B2B481A164695722839BD581D442457 /* MASShortcut */,
-				73C37A16ECCEAD845651DCDEE95675BE /* MASShortcut-MASShortcut */,
-				9155E0B9A1C6F689BA4B61F3B690FDA1 /* Pods-proxy_conf_helper */,
-				E9FDECF69808DB0491D4B4C08CF920DC /* Pods-ShadowsocksX-NG */,
-				2E91F9FD8B0C7DA58DD330CBF2096926 /* Pods-ShadowsocksX-NGTests */,
-				7AD0C6DCDC9CEC8A3C7C10C7FEE07BE6 /* RxCocoa */,
-				4622BFEF3DC16E8BD15EEFC30D4D0084 /* RxRelay */,
-				EA9EA43B3B503823EE36C60D9C8A865F /* RxSwift */,
-			);
-		};
-/* End PBXProject section */
-
-/* Begin PBXResourcesBuildPhase section */
-		046A991884442073662E8396D30686EE /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		8FA2F274BF94CAE07E4B856B3E2F5D77 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		9BCA7D105D531AE5DAF34FB86A2E623A /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		A151D550DD2C543F68445FDB753EF8EF /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		AE499806FA299FC184E575472A14EE39 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		B729EA1E27F34F10BAEB7F33DC42599A /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				D557532ED179C1F26074DCD602EF357D /* cs.lproj in Resources */,
-				FF36522388E5964B78AD72A59721AADC /* de.lproj in Resources */,
-				02AEF100BA92B652E6E48EF58B479533 /* en.lproj in Resources */,
-				4319C0B97542219FCA256B790FE90C1C /* es.lproj in Resources */,
-				C3D17F4F92CD46A4285A92D1FD6AA4B1 /* fr.lproj in Resources */,
-				325A6428E460396F0B0CB9B6FE10EEC4 /* it.lproj in Resources */,
-				9389C4BF3F440F2503FFEB8BBC8975C8 /* ja.lproj in Resources */,
-				63257249A72693C87BF365F343DA1D36 /* ko.lproj in Resources */,
-				B90A504C57627AFCC56F0608D321FB31 /* nl.lproj in Resources */,
-				F4C5E42370FEF310E72D2A8DAD2993FB /* pl.lproj in Resources */,
-				82764E2E2DA3FD699FC5B659ED35D9AE /* pt.lproj in Resources */,
-				313170D278E51360492948E6BB704EA7 /* ru.lproj in Resources */,
-				809C371060C874FBEF8FECDF197D74E3 /* sv.lproj in Resources */,
-				7094648D68C944D337CE86C10F8EEB04 /* zh-Hans.lproj in Resources */,
-				91C85BAD47B39F365F260E74AB24693D /* zh-Hant.lproj in Resources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		E61A0FC1D432BA45188126B9155D697E /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		E8A034F83F762D640CA494BF8161ED87 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				D37A995029438A503B62B1D2ACFE9247 /* MASShortcut.bundle in Resources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		EE0DFE66B52C1DA23E421D65B412E5CC /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXResourcesBuildPhase section */
-
-/* Begin PBXSourcesBuildPhase section */
-		17A2675A401E7A47A2A85F5E0DE8CFFB /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				741E51A8D9DE26331ABB938B3BD5751A /* AddRef.swift in Sources */,
-				6B105A67121436E162ADE05A682BEA71 /* Amb.swift in Sources */,
-				08FE05B1BA0A6D9CE971027E0480350A /* AnonymousDisposable.swift in Sources */,
-				B7B31CEFFD225FE0DE33DA0CAAFB46BB /* AnonymousObserver.swift in Sources */,
-				F621486B5084C21DA2498C0FC6A85E02 /* AnyObserver.swift in Sources */,
-				BACB203DEE570915EDEC3E701158A173 /* AsMaybe.swift in Sources */,
-				7B0FB5B7BF42B15FDF1FCE073D8C4C21 /* AsSingle.swift in Sources */,
-				4BEC411F5B170048C65D315C87832600 /* AsyncLock.swift in Sources */,
-				47E487EF80C53073DBFE5F5FD6BCFF0E /* AsyncSubject.swift in Sources */,
-				A9AFA432B293A80CF9B1ABD1285A4705 /* AtomicInt.swift in Sources */,
-				6CDC5000511AB1CF616FEBB8A856AE58 /* Bag+Rx.swift in Sources */,
-				9AC6705C60E05CAB6115BA7603BDC0F6 /* Bag.swift in Sources */,
-				77093BBAB8F2F51540322CB14BD2C178 /* BehaviorSubject.swift in Sources */,
-				A9E6EFE85136C81C4AD5BF1CC1B990FD /* BinaryDisposable.swift in Sources */,
-				695A83FEFDFE24858DDC37BD64DBBA33 /* Binder.swift in Sources */,
-				C7A325790D6CB1C3545FE9E688545C56 /* BooleanDisposable.swift in Sources */,
-				90B5B048AE70F82175F8A3DB72EF601E /* Buffer.swift in Sources */,
-				2FD49578803778A2F094C0B21FEE332C /* Cancelable.swift in Sources */,
-				0A20A09C199A4692A8EA72497B3D504A /* Catch.swift in Sources */,
-				14403B39AC36562E41D4768CCF3540B1 /* CombineLatest+arity.swift in Sources */,
-				BEF81EB8E8A3FB2B8519CDF1C6DEDA1E /* CombineLatest+Collection.swift in Sources */,
-				017170EB9F2450569816AB0FF2E6D541 /* CombineLatest.swift in Sources */,
-				EB8C4B9D8DFF39ECFE8538B73F5717F7 /* CompactMap.swift in Sources */,
-				64F43894B4404E7BDE27A5C8BE96E0AE /* Completable+AndThen.swift in Sources */,
-				C0EA3A392A5229080E52F9FDF969FDC8 /* Completable.swift in Sources */,
-				07326CA68F757A1C82495BB52A92BD5C /* CompositeDisposable.swift in Sources */,
-				5F7CE7907DC769D3E61980B80D20A275 /* Concat.swift in Sources */,
-				ABDF69C30364D8B9BDFDA8D82A797396 /* ConcurrentDispatchQueueScheduler.swift in Sources */,
-				DD24A504D1BB91B71B67B4A93A92F1DA /* ConcurrentMainScheduler.swift in Sources */,
-				E83CDC839BC5CA753A57BE04CB66F85D /* ConnectableObservableType.swift in Sources */,
-				AE143D6485273A676FF9FBF637EE32B3 /* Create.swift in Sources */,
-				D13BDCB5C86CD4018E19F1DA207BA61A /* CurrentThreadScheduler.swift in Sources */,
-				90429156F020B4490158F6686EEFCB02 /* Date+Dispatch.swift in Sources */,
-				0722A6B0D2DE0B9620F5C9659CB679D8 /* Debounce.swift in Sources */,
-				D597C1B3CBDE4896A022E9422A4F4874 /* Debug.swift in Sources */,
-				D21D80287E6B1C56E0BE86B1E3F08249 /* Decode.swift in Sources */,
-				ADF86969180231C97A14929F02866A1E /* DefaultIfEmpty.swift in Sources */,
-				519260344D4291AA4C1CEAD7711B1489 /* Deferred.swift in Sources */,
-				3212BC4884F26AE9244A7548691A0CE0 /* Delay.swift in Sources */,
-				A6652D3942752A05ED133DB77C955216 /* DelaySubscription.swift in Sources */,
-				1A630AD9EFDB068A1544BD51CA5E99B7 /* Dematerialize.swift in Sources */,
-				6E75ECF4BDC7AF83E3151274539DFF93 /* DispatchQueue+Extensions.swift in Sources */,
-				BAC5C3D7F895C6A95B5EA70D1C4BB998 /* DispatchQueueConfiguration.swift in Sources */,
-				E06F7DEDC12A706F1AA7067CA7D58BD8 /* Disposable.swift in Sources */,
-				0D8B936D823A959DDE9005A1C1D89487 /* Disposables.swift in Sources */,
-				109ADA4349083858A198CA863E457E37 /* DisposeBag.swift in Sources */,
-				3D8428BE717C8E76FA50C1D8B93561EE /* DisposeBase.swift in Sources */,
-				9F77A1FFC61AF7C54E88B7436893C91B /* DistinctUntilChanged.swift in Sources */,
-				F1F7AF19C5D50FB5BCD1D357FB9A5946 /* Do.swift in Sources */,
-				44D30DA4840EF46F1C4BCEA6179AAE60 /* ElementAt.swift in Sources */,
-				D6389E438CF72863B7F4832592B60428 /* Empty.swift in Sources */,
-				0E7C902AB09DA1CA05D07D36BD55C73E /* Enumerated.swift in Sources */,
-				84E576015933A4F6F431759174C62956 /* Error.swift in Sources */,
-				2375AD3B88ECB4A1C01F9F70DCFB05E7 /* Errors.swift in Sources */,
-				E46EB73E26A44700E41C3CD2F1E847FD /* Event.swift in Sources */,
-				52CB53A7C3EF4BD88F73996450B73AA7 /* Filter.swift in Sources */,
-				E5A162C30F57D3A21BD9D74BC97E782E /* First.swift in Sources */,
-				E9C69CBF2B72EC9A5031BA6FF30BC251 /* Generate.swift in Sources */,
-				7885432DE1DDE9F2A4607033B2808E5B /* GroupBy.swift in Sources */,
-				B3C0F4C71E972214529455424C69E544 /* GroupedObservable.swift in Sources */,
-				2453CFD81C667B99753FF8354AA82C60 /* HistoricalScheduler.swift in Sources */,
-				6CA2AE8DA8D630D83FAED6FC2F081967 /* HistoricalSchedulerTimeConverter.swift in Sources */,
-				B4E0DA5CB21C859040F39077A2731701 /* ImmediateSchedulerType.swift in Sources */,
-				99E2AEBB5C39DB1661C5C03DDAA451EC /* Infallible+CombineLatest+arity.swift in Sources */,
-				66207468882614FB8CE9896DC4250F13 /* Infallible+Create.swift in Sources */,
-				4B9CC90686F274845EBBB82F230C11EE /* Infallible+Operators.swift in Sources */,
-				1EC23A9ACE471AAE845CE9ACD4588932 /* Infallible+Zip+arity.swift in Sources */,
-				652118C36365C28E76826357E309EADE /* Infallible.swift in Sources */,
-				B59F717CE3CD531818EAFE88FBB454AA /* InfiniteSequence.swift in Sources */,
-				3AB06F4DB0A01BA8F6662D0EDC495981 /* InvocableScheduledItem.swift in Sources */,
-				4A33F1A7BD2AD1F318E081E17B0AA80F /* InvocableType.swift in Sources */,
-				EA82A6A287EA96119DF03722AB2F25B8 /* Just.swift in Sources */,
-				6D5BDAE5D8D991B874AD4D7FF2EA7C8C /* Lock.swift in Sources */,
-				830F06C3D23016D62112E4BA1C22A766 /* LockOwnerType.swift in Sources */,
-				34C033CDDD8217EE4221E9BDFFC23086 /* MainScheduler.swift in Sources */,
-				F1A73AB066B6EC8C012F4044B542568D /* Map.swift in Sources */,
-				E5F1157CAB86D8C0C166874A6E826739 /* Materialize.swift in Sources */,
-				2C8A055494092F137EDB2E3BDCA74DFC /* Maybe.swift in Sources */,
-				9360BB098EFD18F90BA16149E8EF8A34 /* Merge.swift in Sources */,
-				42DBD7750A47DE5273041BDEE8850195 /* Multicast.swift in Sources */,
-				8F66042610AE99F62D17E50EF0C83B0D /* Never.swift in Sources */,
-				4C6CC049B53AF49050AD6428C5B50AB0 /* NopDisposable.swift in Sources */,
-				432B3CB444984CCCFB4EF37E2D762F05 /* Observable.swift in Sources */,
-				F89A75BE493264635F9977B0A9233617 /* ObservableConvertibleType+Infallible.swift in Sources */,
-				A0F9BB688F14F5B350A388BA60C184A0 /* ObservableConvertibleType.swift in Sources */,
-				3E6A74677BA3612A449B323631B44559 /* ObservableType+Extensions.swift in Sources */,
-				11B06B47E4CB24A05B1299D730643803 /* ObservableType+PrimitiveSequence.swift in Sources */,
-				2CD9AC66F1727C363449C4072DA57F89 /* ObservableType.swift in Sources */,
-				0A8A30C3BF493120607DD0157A560065 /* ObserveOn.swift in Sources */,
-				DCC8DE3CDC74A5E38864303C8C2404EF /* ObserverBase.swift in Sources */,
-				7B99EC9A5D3CF7B6DE0330773143F15F /* ObserverType.swift in Sources */,
-				516E4177ED65653EA9DAADBA3CF3FBED /* OperationQueueScheduler.swift in Sources */,
-				CCE2D9FB50D6084FD48013ED3474F992 /* Optional.swift in Sources */,
-				73E48515343BD4E57358BAD9F3B2F590 /* Platform.Darwin.swift in Sources */,
-				27C5636F69D717D7745A0235D715E4FB /* Platform.Linux.swift in Sources */,
-				B21C782362344F1FBCA4C5792EC1DED4 /* PrimitiveSequence+Zip+arity.swift in Sources */,
-				B6634C3C7216D0A7B063174C16BA1922 /* PrimitiveSequence.swift in Sources */,
-				8EEA6795ED2806C80FBE6A00B615CB76 /* PriorityQueue.swift in Sources */,
-				ED82861E104428E8C3FA8D1B2618C875 /* Producer.swift in Sources */,
-				A3D78B5A2E0E6B987B021DA58CA55BEB /* PublishSubject.swift in Sources */,
-				9141315B460BE4CD3030B62BE7692B73 /* Queue.swift in Sources */,
-				5E3681E1F77D4A9B58F332348935EE8C /* Range.swift in Sources */,
-				6A3972E7F1ACA4CEE36E0AA3B2BA34FB /* Reactive.swift in Sources */,
-				1C0A940E6D4FD420BEC04B9F16914D71 /* RecursiveLock.swift in Sources */,
-				262C2E49711CEA356F7C2031AE074C8A /* RecursiveScheduler.swift in Sources */,
-				774C726DE2716860799DAEAD0B801A94 /* Reduce.swift in Sources */,
-				C0ACE318CA3576826A53026F9C253E0B /* RefCountDisposable.swift in Sources */,
-				4728113A1BA4AE948E1B2FB610A473B4 /* Repeat.swift in Sources */,
-				C81FF014587AC7E1A51D4F3F2C6F72EA /* ReplaySubject.swift in Sources */,
-				9D5CD154B7C49DA0BCBFF996CA9A6E62 /* RetryWhen.swift in Sources */,
-				A9DD82DFCFA49DC81169D82415DE7B94 /* Rx.swift in Sources */,
-				0A4DF5D6FC29A34C999E1ECBB53C696B /* RxMutableBox.swift in Sources */,
-				8EB4272CE33A59083F0DC9746C0F71D0 /* RxSwift-dummy.m in Sources */,
-				A4CE525F7E6904D7D244727C90DBDBE2 /* Sample.swift in Sources */,
-				5CDF229542C4FC347E9D1DFDBAC8B230 /* Scan.swift in Sources */,
-				9F794FB773B632DAC0416008A8EC3F45 /* ScheduledDisposable.swift in Sources */,
-				AA5CBA43C0BF98751988A758EB180BA6 /* ScheduledItem.swift in Sources */,
-				14E31D647AFA8F0FBE3793EF61872247 /* ScheduledItemType.swift in Sources */,
-				10993D369AADB3E2BCA4E966DE514C09 /* SchedulerServices+Emulation.swift in Sources */,
-				4C88ED296D3687C973B0472D047CE3E8 /* SchedulerType.swift in Sources */,
-				D57542063237724C1CA2962EAC1764C7 /* Sequence.swift in Sources */,
-				2D890B63806F7465912098B60052B092 /* SerialDispatchQueueScheduler.swift in Sources */,
-				239AC2D5500F4E4FB04BC341A1335DF7 /* SerialDisposable.swift in Sources */,
-				4EC10410410410FF3A33C6015FD5927D /* ShareReplayScope.swift in Sources */,
-				D574A95C82CDFCC40442A4C5A20645D9 /* Single.swift in Sources */,
-				B936FB1A1779B971BCE58D1CFB84036B /* SingleAssignmentDisposable.swift in Sources */,
-				FAEF22DB65A2C18EAF044623FF4ECA43 /* SingleAsync.swift in Sources */,
-				4673A5004D211FA68BB8506B9A323034 /* Sink.swift in Sources */,
-				83470A9EFB9948DED806CC1D1233D21C /* Skip.swift in Sources */,
-				D0B9EA4DC98653D58DEAE9629A2F0285 /* SkipUntil.swift in Sources */,
-				DBFA45EBB79E16D7B6780CDA789B0D08 /* SkipWhile.swift in Sources */,
-				7CF0187F571D299FE14788318D720152 /* StartWith.swift in Sources */,
-				0FB5F248B62BC1F0113E53461E807AE5 /* SubjectType.swift in Sources */,
-				B9C2804D9E9FD66CF22595DBFED0DC79 /* SubscribeOn.swift in Sources */,
-				FA547DB169BA1CB0759702BA51F1C52E /* SubscriptionDisposable.swift in Sources */,
-				BB15F798287F7447B78B4D49522030C4 /* SwiftSupport.swift in Sources */,
-				535519D2B25D1784AA6D6A9BDE60C759 /* Switch.swift in Sources */,
-				A5DC2335899B03F0130A9C739319C92A /* SwitchIfEmpty.swift in Sources */,
-				CE622A228B2F310835326CCF0B83F031 /* SynchronizedDisposeType.swift in Sources */,
-				BC184A6D6502B7B4B308496F5172E4FE /* SynchronizedOnType.swift in Sources */,
-				543010884F5B7C1F2920A0DF33A3A9D1 /* SynchronizedUnsubscribeType.swift in Sources */,
-				D661EA5F16B11BEE347BAE35961A3AD2 /* TailRecursiveSink.swift in Sources */,
-				601A69113478A1336ADA98C7658D2355 /* Take.swift in Sources */,
-				14C185529F30494F6B6F0DFA9AEDDC05 /* TakeLast.swift in Sources */,
-				44C45DEC66DB1FBBA5F850E79057DC13 /* TakeWithPredicate.swift in Sources */,
-				3BAE1C06A091DFA7A91F93BD40BD41B9 /* Throttle.swift in Sources */,
-				69D750E3DAB2F11E37761A204A145883 /* Timeout.swift in Sources */,
-				1DF080CB9D37CB063C6FEC09BBF8F238 /* Timer.swift in Sources */,
-				A7A81BFC5D65FDB665AC19E78D4F21B6 /* ToArray.swift in Sources */,
-				DDA573352B48255CA674E8BB62C306C6 /* Using.swift in Sources */,
-				8B67845A8F56DF49F8B22B1BB63C5E10 /* VirtualTimeConverterType.swift in Sources */,
-				1B341070BA8EB97021BE7C152639CBF5 /* VirtualTimeScheduler.swift in Sources */,
-				9FC8EA2F7B3939D69D1469F9046B166A /* Window.swift in Sources */,
-				F5E8D9EC4166B35C084791CAEFF2404C /* WithLatestFrom.swift in Sources */,
-				E26E725D6366FA3AE20B95802F54C4B6 /* WithUnretained.swift in Sources */,
-				2B540E502B0EE71D93636BA94B9F0817 /* Zip+arity.swift in Sources */,
-				9C3D3F75523B1B1BB4B3051C01F8F6FE /* Zip+Collection.swift in Sources */,
-				FC22B1E68007E6AC40CC8DF2DF5E0AB6 /* Zip.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		19D1B24F4E402839324A4B4FE36492FB /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				E52E9DB2E0EB574ED157EB478E60D13D /* Pods-proxy_conf_helper-dummy.m in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		2C8326877F6A9617C2FBE9BD15D95B59 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				1208E81DA8B532D0646D627B50290EB6 /* AFError.swift in Sources */,
-				C6D5A4B4028B2C43380C9FA58BD5C8CA /* Alamofire-dummy.m in Sources */,
-				C1F1DB6A9CBDE584D09BA1613AAD4F9D /* Alamofire.swift in Sources */,
-				72EC2712926E6D28B52360D9AC41668F /* AlamofireExtended.swift in Sources */,
-				DC627AFC5B585686898B014184AFCABD /* AuthenticationInterceptor.swift in Sources */,
-				ABA85887A41495358C83CE3F3030EDEA /* CachedResponseHandler.swift in Sources */,
-				0A1849775CF90D514963187D3A771CF8 /* Combine.swift in Sources */,
-				27E59A11A2743B0595CDE3A08675EAE1 /* DispatchQueue+Alamofire.swift in Sources */,
-				6546D728B69398F93B506845141EBD61 /* EventMonitor.swift in Sources */,
-				91B837CE0DCD8EDB300FCDFFA1279162 /* HTTPHeaders.swift in Sources */,
-				013BAC24F7AC722E59517CB110A9E685 /* HTTPMethod.swift in Sources */,
-				45B8CC1C61E7A0BB28CFA8CE7C12FEBC /* MultipartFormData.swift in Sources */,
-				D03F1F02DE8606E6057D57866611BEBF /* MultipartUpload.swift in Sources */,
-				19D605A3233499828FB6B790869F3E9C /* NetworkReachabilityManager.swift in Sources */,
-				8AA937910F87915DE700CAB6C868689E /* Notifications.swift in Sources */,
-				0A900DF17E3B64F08AF673E9A0DDD697 /* OperationQueue+Alamofire.swift in Sources */,
-				4AEC050FA7D5ED52FDA9DF50EA3560DF /* ParameterEncoder.swift in Sources */,
-				D14066FAE94E304798E43651E5886D13 /* ParameterEncoding.swift in Sources */,
-				218C14EAE5AA31C30314AE0289B732A0 /* Protected.swift in Sources */,
-				666EC5C8356E6D4448A2FE7BEE77AD88 /* RedirectHandler.swift in Sources */,
-				EDC93BD7B9262119AE145E4C7A9D0212 /* Request.swift in Sources */,
-				6E54F64E8DA73F4B0B46C216F9F93F63 /* RequestInterceptor.swift in Sources */,
-				6C08F6A77889651626583100F560153D /* RequestTaskMap.swift in Sources */,
-				C1C5B050B55C15103ABC81769551A283 /* Response.swift in Sources */,
-				911448B2EDA2FF880108F77642797A88 /* ResponseSerialization.swift in Sources */,
-				66B26C6CAE737EC21F4BA1F1851B69C5 /* Result+Alamofire.swift in Sources */,
-				9FED70D1E1FBFB80E974E999EF732258 /* RetryPolicy.swift in Sources */,
-				47FDBBBD2704901588C3A7C56BBC502D /* ServerTrustEvaluation.swift in Sources */,
-				6AE407A4FB6C3D6ADD862CC6E3067A17 /* Session.swift in Sources */,
-				381FF05F8B4F611EE9C2FDBE4457BB89 /* SessionDelegate.swift in Sources */,
-				212EDC48B68107BEA9247F3464CE696E /* StringEncoding+Alamofire.swift in Sources */,
-				9B1D8A7798D8A6F518FC9AF9725431D0 /* URLConvertible+URLRequestConvertible.swift in Sources */,
-				D31FC7FDD450C4CDD633ECBAD27C6221 /* URLEncodedFormEncoder.swift in Sources */,
-				D5EAAFB6FAD77A8F0699345149BA3CBB /* URLRequest+Alamofire.swift in Sources */,
-				F70EF854395CDE981A8336E4FF0310FE /* URLSessionConfiguration+Alamofire.swift in Sources */,
-				F0F3224FF592F9BA2A044A2FC2BD4CCD /* Validation.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		3DC69F9E1AADA4EC8478D34D6CE9F516 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		53C1A57011F61182535EA4555B7EE67A /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				B3E529B0C5581EFBE667B478A97681F6 /* Pods-ShadowsocksX-NG-dummy.m in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		7A815F2E1A9D4EFD8C4C4BD6D7DC1BCA /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				F6F5712CC3ED7DD4D51BA12747FCDE6E /* MASDictionaryTransformer.m in Sources */,
-				DADE159BB4CF9E438FC5DEF80822A710 /* MASHotKey.m in Sources */,
-				B1501E5B044C314A7E3E08D5172CE6C4 /* MASLocalization.m in Sources */,
-				563C41694A1B06EF34752E894297D3FA /* MASShortcut-dummy.m in Sources */,
-				1AECEBA213A2C9E6EC56C2C1358849E4 /* MASShortcut.m in Sources */,
-				FB425C8625656D7AE2AFD1F8A78713B0 /* MASShortcutBinder.m in Sources */,
-				F515F0E56CBF807E49797455E495074C /* MASShortcutMonitor.m in Sources */,
-				F9C743AF2433172C84F9365D8DE8CBF3 /* MASShortcutValidator.m in Sources */,
-				A2F246B7FCDC421BE6098866AA1509C9 /* MASShortcutView+Bindings.m in Sources */,
-				805003984E8CFD3375B935DC772A7BF3 /* MASShortcutView.m in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		A169CD366B0A64342FFF6E09CEC61622 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				1C11628696BD0C889E0A4FC6CA4B6922 /* GCDWebServer-dummy.m in Sources */,
-				E9B95D42F4510C79E2D8A8CFA251CD49 /* GCDWebServer.m in Sources */,
-				D260B45339932BAA56D7024048E2D155 /* GCDWebServerConnection.m in Sources */,
-				CD782D1189ADBAA42D087B87D53838A0 /* GCDWebServerDataRequest.m in Sources */,
-				3BBEC4A24B60E2276CBC26E555F64F41 /* GCDWebServerDataResponse.m in Sources */,
-				D5E020763D69E9336EB398ACD48FEBB0 /* GCDWebServerErrorResponse.m in Sources */,
-				4940AB8BC3936DEBDC02BF49FE5E97A1 /* GCDWebServerFileRequest.m in Sources */,
-				99ABB4C207FE146C78313E8A9A581FD6 /* GCDWebServerFileResponse.m in Sources */,
-				36DED9F6B7737F022FB0B01ECE2BB88E /* GCDWebServerFunctions.m in Sources */,
-				221F057199246D7709DD91C950746B7B /* GCDWebServerMultiPartFormRequest.m in Sources */,
-				BF1EB892BE3CF9CDFA0DAC7F9392435C /* GCDWebServerRequest.m in Sources */,
-				3685E20BBC5AFEA3BC80FE12732AB269 /* GCDWebServerResponse.m in Sources */,
-				F7DAD2EF3F86BC40F7D4F2EE49362418 /* GCDWebServerStreamedResponse.m in Sources */,
-				5989329B01C0737EFDB490C5A771FDC2 /* GCDWebServerURLEncodedFormRequest.m in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		CCF785ECCCE66AF314E3E51FEE3B8E42 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				AED84FBEE9189CFC8A946DDC2BFCB2BE /* _RX.m in Sources */,
-				62DF258CA1EA9A41A99B93052A72DAB0 /* _RXDelegateProxy.m in Sources */,
-				999CAB83E4F6D824DF56B2B755C0B588 /* _RXKVOObserver.m in Sources */,
-				4E095DE808150F9350BB9CB3C99A37B2 /* _RXObjCRuntime.m in Sources */,
-				BD386D2A7F6652D62B9E75803D3AAD3B /* Bag.swift in Sources */,
-				75917BCA0645283EC7D9CC3ADEE6DB4F /* BehaviorRelay+Driver.swift in Sources */,
-				12E8D9F9C1A9B4FC7669C18954BC4798 /* ControlEvent+Driver.swift in Sources */,
-				A8EEAAF6FACD8832BE7E4A6331ED57E4 /* ControlEvent+Signal.swift in Sources */,
-				FD397CD62192F67DF9C2088CC5EBE409 /* ControlEvent.swift in Sources */,
-				99210D61FFF596695086F3E51D893204 /* ControlProperty+Driver.swift in Sources */,
-				E9FD5789C7C4946FC504E7C679BDD156 /* ControlProperty.swift in Sources */,
-				F44EF6685A8C029EAC293DE9FADC3794 /* ControlTarget.swift in Sources */,
-				872E07F59296D07A405BAB9C36936AC8 /* DelegateProxy.swift in Sources */,
-				70359E1C7BAA76860EA35A607CCC4309 /* DelegateProxyType.swift in Sources */,
-				30536C64EAA45BE64894B48D74144B1E /* DispatchQueue+Extensions.swift in Sources */,
-				F45717BF2118BB61C328A1F67CFE9238 /* Driver+Subscription.swift in Sources */,
-				B8B7E2AC4972978F6894F9C22936CA42 /* Driver.swift in Sources */,
-				A8DBBA1BD18472113BBE931A3F949659 /* Infallible+Bind.swift in Sources */,
-				16C263170733039596369C8D4F89077A /* InfiniteSequence.swift in Sources */,
-				F186B25E38062738E07F219D0289CBFA /* ItemEvents.swift in Sources */,
-				3596F8FDA81BECFE1B05B50500447638 /* KVORepresentable+CoreGraphics.swift in Sources */,
-				2862DA4097D964B745862F00BB45759D /* KVORepresentable+Swift.swift in Sources */,
-				C8422B20017685DE0D693EC679FF8BF6 /* KVORepresentable.swift in Sources */,
-				A2526FE80C9370555D66A0A33EA22E44 /* NotificationCenter+Rx.swift in Sources */,
-				A9DFF7177D374AF79EEAD9F34B66569A /* NSButton+Rx.swift in Sources */,
-				BB322452A0B606428489BA2B2F6D3715 /* NSControl+Rx.swift in Sources */,
-				CA391E5CE794FA6D964DC2DFC8B8E109 /* NSObject+Rx+KVORepresentable.swift in Sources */,
-				E816A86AE437A96B389D73C115778CFA /* NSObject+Rx+RawRepresentable.swift in Sources */,
-				85CD565FB8198B084806FE075B268AB5 /* NSObject+Rx.swift in Sources */,
-				7BD242803D2ADF6E50A27C3542C8695D /* NSSlider+Rx.swift in Sources */,
-				A525A6AE79BA19A9BDEA467D31477916 /* NSTextField+Rx.swift in Sources */,
-				58D3BBBF801B54CC74FAAC0374F1948D /* NSTextStorage+Rx.swift in Sources */,
-				B261ED81ABD31C88EAC460E27E453FAE /* NSTextView+Rx.swift in Sources */,
-				C0E1B20534F498B9891E956388D79209 /* NSView+Rx.swift in Sources */,
-				F8C1D484E959F9ADD96E9CD2F3B045B0 /* Observable+Bind.swift in Sources */,
-				AB83592C5AA99079DA59151D2ACDFBE2 /* ObservableConvertibleType+Driver.swift in Sources */,
-				E8064C59B797763270D65097B4CD075B /* ObservableConvertibleType+SharedSequence.swift in Sources */,
-				BC03F491551F314E102DEB2F96110609 /* ObservableConvertibleType+Signal.swift in Sources */,
-				D0C4275AF3346D1C08B187D04D9606F2 /* Platform.Darwin.swift in Sources */,
-				2BD53F1C421E9938A099F3F45C84FBAD /* Platform.Linux.swift in Sources */,
-				39988540E9F936FE5085117BB8F32FAC /* PriorityQueue.swift in Sources */,
-				934592C980EE09EEE5F4B5074C6A56D8 /* PublishRelay+Signal.swift in Sources */,
-				440BDCF5820801BC8A6D740C48EEAB8E /* Queue.swift in Sources */,
-				786C836C43BD6428332A4001EE13816F /* RecursiveLock.swift in Sources */,
-				E1AD1FE46FE8F693F913FEC190210A59 /* RxCocoa-dummy.m in Sources */,
-				23CF55A9FA514BDCA0B46320D4ED5DEC /* RxCocoa.swift in Sources */,
-				6A5300346FF40392C6A4B5908AA9C027 /* RxCocoaObjCRuntimeError+Extensions.swift in Sources */,
-				080F0457EB8E6A9F2841FB0D77AEEF42 /* RxCollectionViewDataSourcePrefetchingProxy.swift in Sources */,
-				FDEBCA25E0674ADFB66FA6256FF6486F /* RxCollectionViewDataSourceProxy.swift in Sources */,
-				51B830516D57359FAB42031193E47CB1 /* RxCollectionViewDataSourceType.swift in Sources */,
-				037CEEDED76C75AB19A6A015D66C1322 /* RxCollectionViewDelegateProxy.swift in Sources */,
-				D9884F11DD4FAA059A45CBBBC68E090F /* RxCollectionViewReactiveArrayDataSource.swift in Sources */,
-				7BFBC9F9818BC849C72D672D6B6E4B75 /* RxNavigationControllerDelegateProxy.swift in Sources */,
-				953EC9012B7246D01EA866100FAEA023 /* RxPickerViewAdapter.swift in Sources */,
-				447B98FAB75F9B738B72DA92A3C581D6 /* RxPickerViewDataSourceProxy.swift in Sources */,
-				0FE468D23725DEF3BB913C80A61F9B1B /* RxPickerViewDataSourceType.swift in Sources */,
-				63CE2D43072C461D8DE926F0B9EC2E97 /* RxPickerViewDelegateProxy.swift in Sources */,
-				26900F59621365F9EF08DB37C7E07C06 /* RxScrollViewDelegateProxy.swift in Sources */,
-				E84DB9453D7F43DCEC20FDFB5F1CDFD6 /* RxSearchBarDelegateProxy.swift in Sources */,
-				4953376F75EEA98570C65CFC41E0A154 /* RxSearchControllerDelegateProxy.swift in Sources */,
-				6CD3A3F8ABC5FCE23D15CE6823840010 /* RxTabBarControllerDelegateProxy.swift in Sources */,
-				DC708FA8C70373D522CB885D4451F3D0 /* RxTabBarDelegateProxy.swift in Sources */,
-				B2246BF06902F6B9264919F779968CCB /* RxTableViewDataSourcePrefetchingProxy.swift in Sources */,
-				1ECDFBCA376564682426B5D8AC70393C /* RxTableViewDataSourceProxy.swift in Sources */,
-				60FBA126D0D250DE50F4DD26041E4A9C /* RxTableViewDataSourceType.swift in Sources */,
-				9E9A7DA26421695F48AA96DA35B813B4 /* RxTableViewDelegateProxy.swift in Sources */,
-				F2AB55CF962B7EBDE26DD970C282CEDE /* RxTableViewReactiveArrayDataSource.swift in Sources */,
-				A5BE980B95C08EDFEBEC17E0433A4A2E /* RxTarget.swift in Sources */,
-				F71DB74D923AB8F40A88103BDC5ABFA6 /* RxTextStorageDelegateProxy.swift in Sources */,
-				8B7EEE0E899778DA279E64E26E38FB30 /* RxTextViewDelegateProxy.swift in Sources */,
-				DAB6B67BBE65A9ECA898A563CACF442A /* RxWKNavigationDelegateProxy.swift in Sources */,
-				F9872C7244CA7C80D5E402B3922DB009 /* SchedulerType+SharedSequence.swift in Sources */,
-				1FDEA9EB6CAF8FB09C98CEBE607DCFB6 /* SectionedViewDataSourceType.swift in Sources */,
-				C60C9B7447C5D9555611004E27093043 /* SharedSequence+Operators+arity.swift in Sources */,
-				B82E2164A69C0D6D3A21B76EFF96F083 /* SharedSequence+Operators.swift in Sources */,
-				2F835E1CFB72A43AC17728C6105B9635 /* SharedSequence.swift in Sources */,
-				FFF63A18CD673B6821ED19EB164316C9 /* Signal+Subscription.swift in Sources */,
-				35A428176550E4AA2BB98CDDEE2AFF99 /* Signal.swift in Sources */,
-				4407E13BF761D53607A7B419BE64458B /* TextInput.swift in Sources */,
-				F8EC0962127455A9E5ABEA1B2D0C91D7 /* UIActivityIndicatorView+Rx.swift in Sources */,
-				8819CBF35F9919DFC3C17016DF3ACE46 /* UIApplication+Rx.swift in Sources */,
-				6C1064F34CFE15C3DB0E923D9D170E0C /* UIBarButtonItem+Rx.swift in Sources */,
-				844134211AB7B26FACFFF74B58B81C02 /* UIButton+Rx.swift in Sources */,
-				06185F389644D5BD1C84259027C533D5 /* UICollectionView+Rx.swift in Sources */,
-				8CE605907DC8FA1F2E4751F939A4E604 /* UIControl+Rx.swift in Sources */,
-				A1CB4107AB9FDEC58E3A7C0C14B4AB79 /* UIDatePicker+Rx.swift in Sources */,
-				611ACC0E723AF0E572160BC75133A9E6 /* UIGestureRecognizer+Rx.swift in Sources */,
-				7E8BC075464E9C355B763973CA6C08D2 /* UINavigationController+Rx.swift in Sources */,
-				091B8980E4EFE8B81548A8B0369DF1F7 /* UIPickerView+Rx.swift in Sources */,
-				77260113D5ADF7B45DAE46C549580AFD /* UIRefreshControl+Rx.swift in Sources */,
-				BAB6CF7AB28DA0D4BCBC2CF5F53D51AE /* UIScrollView+Rx.swift in Sources */,
-				6BDF6DD0C73F197EC93643F477997B40 /* UISearchBar+Rx.swift in Sources */,
-				128376A37733CDCD9870A39DE261904E /* UISearchController+Rx.swift in Sources */,
-				DE76073247081964D8DA688F13021B62 /* UISegmentedControl+Rx.swift in Sources */,
-				4BF6073DF04E6CD2C3BD8D2C552D7E65 /* UISlider+Rx.swift in Sources */,
-				B28F09A584B9F1BBF2EFD17B072A5CE1 /* UIStepper+Rx.swift in Sources */,
-				DD7EC76A4EB8C3A1741CD5B77B57E0A4 /* UISwitch+Rx.swift in Sources */,
-				022F83EC88B467A88CBB491D7C98FA7E /* UITabBar+Rx.swift in Sources */,
-				9806F1246774ADD50F50D3F1624EB0EB /* UITabBarController+Rx.swift in Sources */,
-				AEA40BB1875D2E7B7DCB5E63E672033B /* UITableView+Rx.swift in Sources */,
-				9D05E77AB8415BB11EC5C5FB6FD62276 /* UITextField+Rx.swift in Sources */,
-				38A45D6FD7DCA41AC0C9CD58EDBB57CB /* UITextView+Rx.swift in Sources */,
-				D251A0235B97F9217D50C5A1C7C5F311 /* URLSession+Rx.swift in Sources */,
-				43BC914A79B9230DA50C9D476DE5114D /* WKWebView+Rx.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		DFF2B5F26ABB5074146BB93EA5DBE095 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				3E2FF4CBA1E2C3A36060CB61A25F80F7 /* BRLOptionParser-dummy.m in Sources */,
-				EDD85DAC7DC88B01D5A2C20969416C9B /* BRLOptionParser.m in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		F0A91985F4DA9728630FB9ABC81A8CC1 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9281E701873CD72C35440865226A1A8B /* Pods-ShadowsocksX-NGTests-dummy.m in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		FEE82C527A384A55B52EF357FAA16C22 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				6FD62C6E23DE07DF1291500FEFC19354 /* BehaviorRelay.swift in Sources */,
-				7813074001D6CD69B3A1EBAF59379E58 /* Observable+Bind.swift in Sources */,
-				4D6504A580F9D6278452D19FD3DD35BC /* PublishRelay.swift in Sources */,
-				C4CD2007BF8F2B0B5125A85B1C43AD24 /* ReplayRelay.swift in Sources */,
-				E3EE570AEF6808660B0542591285D354 /* RxRelay-dummy.m in Sources */,
-				CC9F7F2B397CCCC5397750D0B139E373 /* Utils.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXSourcesBuildPhase section */
-
-/* Begin PBXTargetDependency section */
-		0403456DEA90C0614E5AFBAE92D06199 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = RxSwift;
-			target = EA9EA43B3B503823EE36C60D9C8A865F /* RxSwift */;
-			targetProxy = 3A3C6F9E9E958812D1FF93C9737FE5B1 /* PBXContainerItemProxy */;
-		};
-		16E7E2DB71489A3B3A809EE95AF55896 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = RxRelay;
-			target = 4622BFEF3DC16E8BD15EEFC30D4D0084 /* RxRelay */;
-			targetProxy = 93C581FCCE9BCA693063DEB0CB18943C /* PBXContainerItemProxy */;
-		};
-		18247C9B740C16AA1A1F647B7676E673 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = Alamofire;
-			target = EAAA1AD3A8A1B59AB91319EE40752C6D /* Alamofire */;
-			targetProxy = 6C21C08D1A9E4A42298C1E83946EFBF6 /* PBXContainerItemProxy */;
-		};
-		232E22686FEEB70180F984222B39F949 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = RxSwift;
-			target = EA9EA43B3B503823EE36C60D9C8A865F /* RxSwift */;
-			targetProxy = 95ED7E1E76F66FF2AFA473A3D49F574E /* PBXContainerItemProxy */;
-		};
-		41031387B219D54FF7673356F1696E11 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = RxCocoa;
-			target = 7AD0C6DCDC9CEC8A3C7C10C7FEE07BE6 /* RxCocoa */;
-			targetProxy = A5DE8E8EE1A9A5D27FEA05AD1FF38C1E /* PBXContainerItemProxy */;
-		};
-		53637CA92B734D4013B9F99E7AAA9808 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = "MASShortcut-MASShortcut";
-			target = 73C37A16ECCEAD845651DCDEE95675BE /* MASShortcut-MASShortcut */;
-			targetProxy = 3DE69038DEBF7AC72F345377CCA1A457 /* PBXContainerItemProxy */;
-		};
-		79DC5AF6E7C88EC75AD6D91A9FF3E011 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = BRLOptionParser;
-			target = 00F92A6698B766C4479D7B608F28D680 /* BRLOptionParser */;
-			targetProxy = 290D7A27821274F88F50BA4027E877B0 /* PBXContainerItemProxy */;
-		};
-		7DABF5696F48F5C2D50C0A3DE25289EE /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = RxRelay;
-			target = 4622BFEF3DC16E8BD15EEFC30D4D0084 /* RxRelay */;
-			targetProxy = 1CA90026A2A030CD980CB1E78050B63A /* PBXContainerItemProxy */;
-		};
-		B2D17789138C47D21E16F60C47053226 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = MASShortcut;
-			target = 2B2B481A164695722839BD581D442457 /* MASShortcut */;
-			targetProxy = B0B5FA86CABF29A7785405416D374CDA /* PBXContainerItemProxy */;
-		};
-		D38F26CBE0B158CB00FD29413295EBDB /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = GCDWebServer;
-			target = AD904F32069787EFB2DFFE05EB82F5BD /* GCDWebServer */;
-			targetProxy = E627335D42AC0ADFBA7B40BFD314B204 /* PBXContainerItemProxy */;
-		};
-		F1208697A3C80B8117E54FA1B0E859B1 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = RxSwift;
-			target = EA9EA43B3B503823EE36C60D9C8A865F /* RxSwift */;
-			targetProxy = 809667767BFFB7D46B762AD5F006A069 /* PBXContainerItemProxy */;
-		};
-		FF103DE3A0523E2D55DE3D845DD9F0E2 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			name = "Pods-ShadowsocksX-NG";
-			target = E9FDECF69808DB0491D4B4C08CF920DC /* Pods-ShadowsocksX-NG */;
-			targetProxy = 7569E9B350638EBD714C781E38F158A8 /* PBXContainerItemProxy */;
-		};
-/* End PBXTargetDependency section */
-
-/* Begin XCBuildConfiguration section */
-		12B0FE32A40DD86F2B679BA026ED60EB /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 4A70BE8C07BCE9C6D6F47AC73225C959 /* Pods-proxy_conf_helper.release.xcconfig */;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = NO;
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				EXECUTABLE_PREFIX = lib;
-				MACH_O_TYPE = staticlib;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				OTHER_LDFLAGS = "";
-				OTHER_LIBTOOLFLAGS = "";
-				PODS_ROOT = "$(SRCROOT)";
-				PRODUCT_BUNDLE_IDENTIFIER = "org.cocoapods.${PRODUCT_NAME:rfc1034identifier}";
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-			};
-			name = Release;
-		};
-		1B9B12FB7A187E6EA55EABA8BB6F0938 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = FE6138E84780096ADB31F55549931FC6 /* RxSwift.debug.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/RxSwift/RxSwift-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/RxSwift/RxSwift-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/RxSwift/RxSwift.modulemap";
-				PRODUCT_MODULE_NAME = RxSwift;
-				PRODUCT_NAME = RxSwift;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 5.1;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Debug;
-		};
-		2539F7AA518E214ED06639F251D62C91 /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 2094BFBE78A2839B3C673A3E450C77FC /* GCDWebServer.release.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/GCDWebServer/GCDWebServer-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/GCDWebServer/GCDWebServer-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/GCDWebServer/GCDWebServer.modulemap";
-				PRODUCT_MODULE_NAME = GCDWebServer;
-				PRODUCT_NAME = GCDWebServer;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 4.0;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Release;
-		};
-		2B85D48D53650AE64148B523322A5F29 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 2F138B6C28378A801D2186B22E1E6224 /* RxCocoa.debug.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/RxCocoa/RxCocoa-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/RxCocoa/RxCocoa-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/RxCocoa/RxCocoa.modulemap";
-				PRODUCT_MODULE_NAME = RxCocoa;
-				PRODUCT_NAME = RxCocoa;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 5.1;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Debug;
-		};
-		3AFB1C88E05301BC48B8F2B048ED1025 /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = AF22EDE51D4C2AF18359CE03247D06F1 /* RxCocoa.release.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/RxCocoa/RxCocoa-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/RxCocoa/RxCocoa-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/RxCocoa/RxCocoa.modulemap";
-				PRODUCT_MODULE_NAME = RxCocoa;
-				PRODUCT_NAME = RxCocoa;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 5.1;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Release;
-		};
-		3C142CA6AB0CA7F833124C32A76D5882 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 9A71B9958F30759ED2645E0DF9ADF314 /* Pods-ShadowsocksX-NG.debug.xcconfig */;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = NO;
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				INFOPLIST_FILE = "Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACH_O_TYPE = staticlib;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.modulemap";
-				OTHER_LDFLAGS = "";
-				OTHER_LIBTOOLFLAGS = "";
-				PODS_ROOT = "$(SRCROOT)";
-				PRODUCT_BUNDLE_IDENTIFIER = "org.cocoapods.${PRODUCT_NAME:rfc1034identifier}";
-				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Debug;
-		};
-		435521A8C1A030B456A3602B835F915D /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 70C291AA3C3CEE619534F472C4F04882 /* MASShortcut.debug.xcconfig */;
-			buildSettings = {
-				COMBINE_HIDPI_IMAGES = YES;
-				CONFIGURATION_BUILD_DIR = "$(BUILD_DIR)/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)/MASShortcut";
-				IBSC_MODULE = MASShortcut;
-				INFOPLIST_FILE = "Target Support Files/MASShortcut/ResourceBundle-MASShortcut-MASShortcut-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Bundles";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				PRODUCT_NAME = MASShortcut;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				WRAPPER_EXTENSION = bundle;
-			};
-			name = Debug;
-		};
-		464AFC3D045DAC93B8A74739B86B31AE /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5EE446AD8C625612BFF0E37E4419E0FD /* BRLOptionParser.debug.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				EXECUTABLE_PREFIX = lib;
-				GCC_PREFIX_HEADER = "Target Support Files/BRLOptionParser/BRLOptionParser-prefix.pch";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				OTHER_LDFLAGS = "";
-				OTHER_LIBTOOLFLAGS = "";
-				PRIVATE_HEADERS_FOLDER_PATH = "";
-				PRODUCT_MODULE_NAME = BRLOptionParser;
-				PRODUCT_NAME = BRLOptionParser;
-				PUBLIC_HEADERS_FOLDER_PATH = "";
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-			};
-			name = Debug;
-		};
-		5E5046922B2BADEB6AE175DCA2A5C450 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"POD_CONFIGURATION_DEBUG=1",
-					"DEBUG=1",
-					"$(inherited)",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				STRIP_INSTALLED_PRODUCT = NO;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 5.0;
-				SYMROOT = "${SRCROOT}/../build";
-			};
-			name = Debug;
-		};
-		8492155DEB6029C10D570132B7564FA2 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = B81749D1C6130BC14B2386B76041124F /* GCDWebServer.debug.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/GCDWebServer/GCDWebServer-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/GCDWebServer/GCDWebServer-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/GCDWebServer/GCDWebServer.modulemap";
-				PRODUCT_MODULE_NAME = GCDWebServer;
-				PRODUCT_NAME = GCDWebServer;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 4.0;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Debug;
-		};
-		8D11F123E993591D305166C07349A576 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 196DA983244F60766BA272090829A16E /* Pods-ShadowsocksX-NGTests.debug.xcconfig */;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = NO;
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				INFOPLIST_FILE = "Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACH_O_TYPE = staticlib;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.modulemap";
-				OTHER_LDFLAGS = "";
-				OTHER_LIBTOOLFLAGS = "";
-				PODS_ROOT = "$(SRCROOT)";
-				PRODUCT_BUNDLE_IDENTIFIER = "org.cocoapods.${PRODUCT_NAME:rfc1034identifier}";
-				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Debug;
-		};
-		8F694BB186184267497C5B29EBD5F103 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 75EA425CE2A4DBDDEB580C7303DD2454 /* Alamofire.debug.xcconfig */;
-			buildSettings = {
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/Alamofire/Alamofire-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/Alamofire/Alamofire-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/Alamofire/Alamofire.modulemap";
-				PRODUCT_MODULE_NAME = Alamofire;
-				PRODUCT_NAME = Alamofire;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 5.3;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Debug;
-		};
-		90EDC1405B8CA8EDAD433A863FDD47C4 /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D70A973E907BDE134197952FF14301CE /* RxRelay.release.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/RxRelay/RxRelay-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/RxRelay/RxRelay-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/RxRelay/RxRelay.modulemap";
-				PRODUCT_MODULE_NAME = RxRelay;
-				PRODUCT_NAME = RxRelay;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 5.1;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Release;
-		};
-		9570335934A831709D5FDB644D8144D9 /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5C0C485AB4EA81F3E9128F65E9AC66CA /* Pods-ShadowsocksX-NGTests.release.xcconfig */;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = NO;
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				INFOPLIST_FILE = "Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACH_O_TYPE = staticlib;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.modulemap";
-				OTHER_LDFLAGS = "";
-				OTHER_LIBTOOLFLAGS = "";
-				PODS_ROOT = "$(SRCROOT)";
-				PRODUCT_BUNDLE_IDENTIFIER = "org.cocoapods.${PRODUCT_NAME:rfc1034identifier}";
-				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Release;
-		};
-		992C0F3AEB140A12268A0B7AB779808B /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 92B4BB091693150E5B1FCC6987683C6F /* Pods-ShadowsocksX-NG.release.xcconfig */;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = NO;
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				INFOPLIST_FILE = "Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACH_O_TYPE = staticlib;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.modulemap";
-				OTHER_LDFLAGS = "";
-				OTHER_LIBTOOLFLAGS = "";
-				PODS_ROOT = "$(SRCROOT)";
-				PRODUCT_BUNDLE_IDENTIFIER = "org.cocoapods.${PRODUCT_NAME:rfc1034identifier}";
-				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Release;
-		};
-		9A282D83C54CDCBE99AC3D556E781819 /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D231BAD0830AAA293F76CB7428ADA704 /* MASShortcut.release.xcconfig */;
-			buildSettings = {
-				COMBINE_HIDPI_IMAGES = YES;
-				CONFIGURATION_BUILD_DIR = "$(BUILD_DIR)/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)/MASShortcut";
-				IBSC_MODULE = MASShortcut;
-				INFOPLIST_FILE = "Target Support Files/MASShortcut/ResourceBundle-MASShortcut-MASShortcut-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Bundles";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				PRODUCT_NAME = MASShortcut;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				WRAPPER_EXTENSION = bundle;
-			};
-			name = Release;
-		};
-		A977C7C72501F07BFFC97CA3F19F344F /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = C3B6C103B3C3936D11BF01C71C0EE380 /* BRLOptionParser.release.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				EXECUTABLE_PREFIX = lib;
-				GCC_PREFIX_HEADER = "Target Support Files/BRLOptionParser/BRLOptionParser-prefix.pch";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				OTHER_LDFLAGS = "";
-				OTHER_LIBTOOLFLAGS = "";
-				PRIVATE_HEADERS_FOLDER_PATH = "";
-				PRODUCT_MODULE_NAME = BRLOptionParser;
-				PRODUCT_NAME = BRLOptionParser;
-				PUBLIC_HEADERS_FOLDER_PATH = "";
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-			};
-			name = Release;
-		};
-		AE5F5BC820C835E9310C556B3D39E167 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 70C291AA3C3CEE619534F472C4F04882 /* MASShortcut.debug.xcconfig */;
-			buildSettings = {
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/MASShortcut/MASShortcut-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/MASShortcut/MASShortcut-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/MASShortcut/MASShortcut.modulemap";
-				PRODUCT_MODULE_NAME = MASShortcut;
-				PRODUCT_NAME = MASShortcut;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 4.0;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Debug;
-		};
-		D256BAA9A69C64A728E66C27D53FDD4B /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"POD_CONFIGURATION_RELEASE=1",
-					"$(inherited)",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MTL_ENABLE_DEBUG_INFO = NO;
-				MTL_FAST_MATH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				STRIP_INSTALLED_PRODUCT = NO;
-				SWIFT_OPTIMIZATION_LEVEL = "-Owholemodule";
-				SWIFT_VERSION = 5.0;
-				SYMROOT = "${SRCROOT}/../build";
-			};
-			name = Release;
-		};
-		DDA9EC41D966236C68CB4AB50CCF2287 /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 848DD5BA5CA758D1F00A7F6F947019EB /* Alamofire.release.xcconfig */;
-			buildSettings = {
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/Alamofire/Alamofire-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/Alamofire/Alamofire-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/Alamofire/Alamofire.modulemap";
-				PRODUCT_MODULE_NAME = Alamofire;
-				PRODUCT_NAME = Alamofire;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 5.3;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Release;
-		};
-		DF12A32B61F9AC9FC15D4FEE49C27C64 /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D231BAD0830AAA293F76CB7428ADA704 /* MASShortcut.release.xcconfig */;
-			buildSettings = {
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/MASShortcut/MASShortcut-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/MASShortcut/MASShortcut-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/MASShortcut/MASShortcut.modulemap";
-				PRODUCT_MODULE_NAME = MASShortcut;
-				PRODUCT_NAME = MASShortcut;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 4.0;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Release;
-		};
-		E50DD4E0C6E58142D33757B5C9E7B75C /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = BF25DE5F0433D7BA7D6F91A5F113542A /* RxRelay.debug.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/RxRelay/RxRelay-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/RxRelay/RxRelay-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/RxRelay/RxRelay.modulemap";
-				PRODUCT_MODULE_NAME = RxRelay;
-				PRODUCT_NAME = RxRelay;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 5.1;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Debug;
-		};
-		F2D56CB7664FC6CD92EB5B8E9298A5E7 /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 28F6CED61832E1CE6BA74AA90F7E45EE /* RxSwift.release.xcconfig */;
-			buildSettings = {
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				DEFINES_MODULE = YES;
-				DYLIB_COMPATIBILITY_VERSION = 1;
-				DYLIB_CURRENT_VERSION = 1;
-				DYLIB_INSTALL_NAME_BASE = "@rpath";
-				GCC_PREFIX_HEADER = "Target Support Files/RxSwift/RxSwift-prefix.pch";
-				INFOPLIST_FILE = "Target Support Files/RxSwift/RxSwift-Info.plist";
-				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MODULEMAP_FILE = "Target Support Files/RxSwift/RxSwift.modulemap";
-				PRODUCT_MODULE_NAME = RxSwift;
-				PRODUCT_NAME = RxSwift;
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "$(inherited) ";
-				SWIFT_VERSION = 5.1;
-				VERSIONING_SYSTEM = "apple-generic";
-				VERSION_INFO_PREFIX = "";
-			};
-			name = Release;
-		};
-		F6B84B253DE1626F094BD37FC42474DF /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D8C88B0B7BFE785BC9B00D1C53FDC003 /* Pods-proxy_conf_helper.debug.xcconfig */;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = NO;
-				CLANG_ENABLE_OBJC_WEAK = NO;
-				"CODE_SIGN_IDENTITY[sdk=appletvos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "";
-				"CODE_SIGN_IDENTITY[sdk=watchos*]" = "";
-				EXECUTABLE_PREFIX = lib;
-				MACH_O_TYPE = staticlib;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				OTHER_LDFLAGS = "";
-				OTHER_LIBTOOLFLAGS = "";
-				PODS_ROOT = "$(SRCROOT)";
-				PRODUCT_BUNDLE_IDENTIFIER = "org.cocoapods.${PRODUCT_NAME:rfc1034identifier}";
-				SDKROOT = macosx;
-				SKIP_INSTALL = YES;
-			};
-			name = Debug;
-		};
-/* End XCBuildConfiguration section */
-
-/* Begin XCConfigurationList section */
-		0D501A92E69AF80E7786DD9C0D172BEC /* Build configuration list for PBXNativeTarget "Pods-proxy_conf_helper" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				F6B84B253DE1626F094BD37FC42474DF /* Debug */,
-				12B0FE32A40DD86F2B679BA026ED60EB /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		1C26E77821938498151B66E4B3FAFDB5 /* Build configuration list for PBXNativeTarget "MASShortcut-MASShortcut" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				435521A8C1A030B456A3602B835F915D /* Debug */,
-				9A282D83C54CDCBE99AC3D556E781819 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		3797157A80385C2407F752CEE1BFEB21 /* Build configuration list for PBXNativeTarget "RxRelay" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				E50DD4E0C6E58142D33757B5C9E7B75C /* Debug */,
-				90EDC1405B8CA8EDAD433A863FDD47C4 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		4821239608C13582E20E6DA73FD5F1F9 /* Build configuration list for PBXProject "Pods" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				5E5046922B2BADEB6AE175DCA2A5C450 /* Debug */,
-				D256BAA9A69C64A728E66C27D53FDD4B /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		6331D6AD3A4489B8CBA44A44D38FD80A /* Build configuration list for PBXNativeTarget "RxSwift" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				1B9B12FB7A187E6EA55EABA8BB6F0938 /* Debug */,
-				F2D56CB7664FC6CD92EB5B8E9298A5E7 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		690C9430B03B92419AFA4555712EC873 /* Build configuration list for PBXNativeTarget "GCDWebServer" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				8492155DEB6029C10D570132B7564FA2 /* Debug */,
-				2539F7AA518E214ED06639F251D62C91 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		6D442598AC59E49374231C4242255CA3 /* Build configuration list for PBXNativeTarget "BRLOptionParser" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				464AFC3D045DAC93B8A74739B86B31AE /* Debug */,
-				A977C7C72501F07BFFC97CA3F19F344F /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		78E219AC01CD5AFED663C9AB28280801 /* Build configuration list for PBXNativeTarget "Alamofire" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				8F694BB186184267497C5B29EBD5F103 /* Debug */,
-				DDA9EC41D966236C68CB4AB50CCF2287 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		84B5ECA69733DA3FEDC652649E6E42C5 /* Build configuration list for PBXNativeTarget "Pods-ShadowsocksX-NGTests" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				8D11F123E993591D305166C07349A576 /* Debug */,
-				9570335934A831709D5FDB644D8144D9 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		975822F53DB5EF99EE2C5EA67BC503C9 /* Build configuration list for PBXNativeTarget "Pods-ShadowsocksX-NG" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				3C142CA6AB0CA7F833124C32A76D5882 /* Debug */,
-				992C0F3AEB140A12268A0B7AB779808B /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		ABE56D8D3781109924A96BB7837ED223 /* Build configuration list for PBXNativeTarget "RxCocoa" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				2B85D48D53650AE64148B523322A5F29 /* Debug */,
-				3AFB1C88E05301BC48B8F2B048ED1025 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		E888D466E966B416D89BA302F582A3F5 /* Build configuration list for PBXNativeTarget "MASShortcut" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				AE5F5BC820C835E9310C556B3D39E167 /* Debug */,
-				DF12A32B61F9AC9FC15D4FEE49C27C64 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-/* End XCConfigurationList section */
-	};
-	rootObject = BFDFE7DC352907FC980B868725387E98 /* Project object */;
-}
diff --git a/Pods/RxCocoa/LICENSE.md b/Pods/RxCocoa/LICENSE.md
deleted file mode 100644
index e32511b38..000000000
--- a/Pods/RxCocoa/LICENSE.md
+++ /dev/null
@@ -1,9 +0,0 @@
-**The MIT License**
-**Copyright © 2015 Krunoslav Zaher, Shai Mishali**
-**All rights reserved.**
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/Pods/RxCocoa/Platform/DataStructures/Bag.swift b/Pods/RxCocoa/Platform/DataStructures/Bag.swift
deleted file mode 100644
index 5720a3b44..000000000
--- a/Pods/RxCocoa/Platform/DataStructures/Bag.swift
+++ /dev/null
@@ -1,181 +0,0 @@
-//
-//  Bag.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 2/28/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Swift
-
-let arrayDictionaryMaxSize = 30
-
-struct BagKey {
-    /**
-    Unique identifier for object added to `Bag`.
-     
-    It's underlying type is UInt64. If we assume there in an idealized CPU that works at 4GHz,
-     it would take ~150 years of continuous running time for it to overflow.
-    */
-    fileprivate let rawValue: UInt64
-}
-
-/**
-Data structure that represents a bag of elements typed `T`.
-
-Single element can be stored multiple times.
-
-Time and space complexity of insertion and deletion is O(n). 
-
-It is suitable for storing small number of elements.
-*/
-struct Bag<T> : CustomDebugStringConvertible {
-    /// Type of identifier for inserted elements.
-    typealias KeyType = BagKey
-    
-    typealias Entry = (key: BagKey, value: T)
- 
-    private var _nextKey: BagKey = BagKey(rawValue: 0)
-
-    // data
-
-    // first fill inline variables
-    var _key0: BagKey?
-    var _value0: T?
-
-    // then fill "array dictionary"
-    var _pairs = ContiguousArray<Entry>()
-
-    // last is sparse dictionary
-    var _dictionary: [BagKey: T]?
-
-    var _onlyFastPath = true
-
-    /// Creates new empty `Bag`.
-    init() {
-    }
-    
-    /**
-    Inserts `value` into bag.
-    
-    - parameter element: Element to insert.
-    - returns: Key that can be used to remove element from bag.
-    */
-    mutating func insert(_ element: T) -> BagKey {
-        let key = _nextKey
-
-        _nextKey = BagKey(rawValue: _nextKey.rawValue &+ 1)
-
-        if _key0 == nil {
-            _key0 = key
-            _value0 = element
-            return key
-        }
-
-        _onlyFastPath = false
-
-        if _dictionary != nil {
-            _dictionary![key] = element
-            return key
-        }
-
-        if _pairs.count < arrayDictionaryMaxSize {
-            _pairs.append((key: key, value: element))
-            return key
-        }
-        
-        _dictionary = [key: element]
-        
-        return key
-    }
-    
-    /// - returns: Number of elements in bag.
-    var count: Int {
-        let dictionaryCount: Int = _dictionary?.count ?? 0
-        return (_value0 != nil ? 1 : 0) + _pairs.count + dictionaryCount
-    }
-    
-    /// Removes all elements from bag and clears capacity.
-    mutating func removeAll() {
-        _key0 = nil
-        _value0 = nil
-
-        _pairs.removeAll(keepingCapacity: false)
-        _dictionary?.removeAll(keepingCapacity: false)
-    }
-    
-    /**
-    Removes element with a specific `key` from bag.
-    
-    - parameter key: Key that identifies element to remove from bag.
-    - returns: Element that bag contained, or nil in case element was already removed.
-    */
-    mutating func removeKey(_ key: BagKey) -> T? {
-        if _key0 == key {
-            _key0 = nil
-            let value = _value0!
-            _value0 = nil
-            return value
-        }
-
-        if let existingObject = _dictionary?.removeValue(forKey: key) {
-            return existingObject
-        }
-
-        for i in 0 ..< _pairs.count where _pairs[i].key == key {
-            let value = _pairs[i].value
-            _pairs.remove(at: i)
-            return value
-        }
-
-        return nil
-    }
-}
-
-extension Bag {
-    /// A textual representation of `self`, suitable for debugging.
-    var debugDescription : String {
-        "\(self.count) elements in Bag"
-    }
-}
-
-extension Bag {
-    /// Enumerates elements inside the bag.
-    ///
-    /// - parameter action: Enumeration closure.
-    func forEach(_ action: (T) -> Void) {
-        if _onlyFastPath {
-            if let value0 = _value0 {
-                action(value0)
-            }
-            return
-        }
-
-        let value0 = _value0
-        let dictionary = _dictionary
-
-        if let value0 = value0 {
-            action(value0)
-        }
-
-        for i in 0 ..< _pairs.count {
-            action(_pairs[i].value)
-        }
-
-        if dictionary?.count ?? 0 > 0 {
-            for element in dictionary!.values {
-                action(element)
-            }
-        }
-    }
-}
-
-extension BagKey: Hashable {
-    func hash(into hasher: inout Hasher) {
-        hasher.combine(rawValue)
-    }
-}
-
-func ==(lhs: BagKey, rhs: BagKey) -> Bool {
-    lhs.rawValue == rhs.rawValue
-}
diff --git a/Pods/RxCocoa/Platform/DataStructures/InfiniteSequence.swift b/Pods/RxCocoa/Platform/DataStructures/InfiniteSequence.swift
deleted file mode 100644
index 75d7bea7f..000000000
--- a/Pods/RxCocoa/Platform/DataStructures/InfiniteSequence.swift
+++ /dev/null
@@ -1,23 +0,0 @@
-//
-//  InfiniteSequence.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 6/13/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Sequence that repeats `repeatedValue` infinite number of times.
-struct InfiniteSequence<Element> : Sequence {
-    typealias Iterator = AnyIterator<Element>
-    
-    private let repeatedValue: Element
-    
-    init(repeatedValue: Element) {
-        self.repeatedValue = repeatedValue
-    }
-    
-    func makeIterator() -> Iterator {
-        let repeatedValue = self.repeatedValue
-        return AnyIterator { repeatedValue }
-    }
-}
diff --git a/Pods/RxCocoa/Platform/DataStructures/PriorityQueue.swift b/Pods/RxCocoa/Platform/DataStructures/PriorityQueue.swift
deleted file mode 100644
index 9ed856b91..000000000
--- a/Pods/RxCocoa/Platform/DataStructures/PriorityQueue.swift
+++ /dev/null
@@ -1,111 +0,0 @@
-//
-//  PriorityQueue.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 12/27/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-struct PriorityQueue<Element> {
-    private let hasHigherPriority: (Element, Element) -> Bool
-    private let isEqual: (Element, Element) -> Bool
-
-    private var elements = [Element]()
-
-    init(hasHigherPriority: @escaping (Element, Element) -> Bool, isEqual: @escaping (Element, Element) -> Bool) {
-        self.hasHigherPriority = hasHigherPriority
-        self.isEqual = isEqual
-    }
-
-    mutating func enqueue(_ element: Element) {
-        elements.append(element)
-        bubbleToHigherPriority(elements.count - 1)
-    }
-
-    func peek() -> Element? {
-        elements.first
-    }
-
-    var isEmpty: Bool {
-        elements.count == 0
-    }
-
-    mutating func dequeue() -> Element? {
-        guard let front = peek() else {
-            return nil
-        }
-
-        removeAt(0)
-
-        return front
-    }
-
-    mutating func remove(_ element: Element) {
-        for i in 0 ..< elements.count {
-            if self.isEqual(elements[i], element) {
-                removeAt(i)
-                return
-            }
-        }
-    }
-
-    private mutating func removeAt(_ index: Int) {
-        let removingLast = index == elements.count - 1
-        if !removingLast {
-            elements.swapAt(index, elements.count - 1)
-        }
-
-        _ = elements.popLast()
-
-        if !removingLast {
-            bubbleToHigherPriority(index)
-            bubbleToLowerPriority(index)
-        }
-    }
-
-    private mutating func bubbleToHigherPriority(_ initialUnbalancedIndex: Int) {
-        precondition(initialUnbalancedIndex >= 0)
-        precondition(initialUnbalancedIndex < elements.count)
-
-        var unbalancedIndex = initialUnbalancedIndex
-
-        while unbalancedIndex > 0 {
-            let parentIndex = (unbalancedIndex - 1) / 2
-            guard self.hasHigherPriority(elements[unbalancedIndex], elements[parentIndex]) else { break }
-            elements.swapAt(unbalancedIndex, parentIndex)
-            unbalancedIndex = parentIndex
-        }
-    }
-
-    private mutating func bubbleToLowerPriority(_ initialUnbalancedIndex: Int) {
-        precondition(initialUnbalancedIndex >= 0)
-        precondition(initialUnbalancedIndex < elements.count)
-
-        var unbalancedIndex = initialUnbalancedIndex
-        while true {
-            let leftChildIndex = unbalancedIndex * 2 + 1
-            let rightChildIndex = unbalancedIndex * 2 + 2
-
-            var highestPriorityIndex = unbalancedIndex
-
-            if leftChildIndex < elements.count && self.hasHigherPriority(elements[leftChildIndex], elements[highestPriorityIndex]) {
-                highestPriorityIndex = leftChildIndex
-            }
-
-            if rightChildIndex < elements.count && self.hasHigherPriority(elements[rightChildIndex], elements[highestPriorityIndex]) {
-                highestPriorityIndex = rightChildIndex
-            }
-
-            guard highestPriorityIndex != unbalancedIndex else { break }
-            elements.swapAt(highestPriorityIndex, unbalancedIndex)
-
-            unbalancedIndex = highestPriorityIndex
-        }
-    }
-}
-
-extension PriorityQueue : CustomDebugStringConvertible {
-    var debugDescription: String {
-        elements.debugDescription
-    }
-}
diff --git a/Pods/RxCocoa/Platform/DataStructures/Queue.swift b/Pods/RxCocoa/Platform/DataStructures/Queue.swift
deleted file mode 100644
index 625d4733e..000000000
--- a/Pods/RxCocoa/Platform/DataStructures/Queue.swift
+++ /dev/null
@@ -1,148 +0,0 @@
-//
-//  Queue.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 3/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/**
-Data structure that represents queue.
-
-Complexity of `enqueue`, `dequeue` is O(1) when number of operations is
-averaged over N operations.
-
-Complexity of `peek` is O(1).
-*/
-struct Queue<T>: Sequence {
-    /// Type of generator.
-    typealias Generator = AnyIterator<T>
-
-    private let resizeFactor = 2
-    
-    private var storage: ContiguousArray<T?>
-    private var innerCount = 0
-    private var pushNextIndex = 0
-    private let initialCapacity: Int
-
-    /**
-    Creates new queue.
-    
-    - parameter capacity: Capacity of newly created queue.
-    */
-    init(capacity: Int) {
-        initialCapacity = capacity
-
-        storage = ContiguousArray<T?>(repeating: nil, count: capacity)
-    }
-    
-    private var dequeueIndex: Int {
-        let index = pushNextIndex - count
-        return index < 0 ? index + storage.count : index
-    }
-    
-    /// - returns: Is queue empty.
-    var isEmpty: Bool { count == 0 }
-    
-    /// - returns: Number of elements inside queue.
-    var count: Int { innerCount }
-    
-    /// - returns: Element in front of a list of elements to `dequeue`.
-    func peek() -> T {
-        precondition(count > 0)
-        
-        return storage[dequeueIndex]!
-    }
-    
-    mutating private func resizeTo(_ size: Int) {
-        var newStorage = ContiguousArray<T?>(repeating: nil, count: size)
-        
-        let count = self.count
-        
-        let dequeueIndex = self.dequeueIndex
-        let spaceToEndOfQueue = storage.count - dequeueIndex
-        
-        // first batch is from dequeue index to end of array
-        let countElementsInFirstBatch = Swift.min(count, spaceToEndOfQueue)
-        // second batch is wrapped from start of array to end of queue
-        let numberOfElementsInSecondBatch = count - countElementsInFirstBatch
-        
-        newStorage[0 ..< countElementsInFirstBatch] = storage[dequeueIndex ..< (dequeueIndex + countElementsInFirstBatch)]
-        newStorage[countElementsInFirstBatch ..< (countElementsInFirstBatch + numberOfElementsInSecondBatch)] = storage[0 ..< numberOfElementsInSecondBatch]
-        
-        self.innerCount = count
-        pushNextIndex = count
-        storage = newStorage
-    }
-    
-    /// Enqueues `element`.
-    ///
-    /// - parameter element: Element to enqueue.
-    mutating func enqueue(_ element: T) {
-        if count == storage.count {
-            resizeTo(Swift.max(storage.count, 1) * resizeFactor)
-        }
-        
-        storage[pushNextIndex] = element
-        pushNextIndex += 1
-        innerCount += 1
-        
-        if pushNextIndex >= storage.count {
-            pushNextIndex -= storage.count
-        }
-    }
-    
-    private mutating func dequeueElementOnly() -> T {
-        precondition(count > 0)
-        
-        let index = dequeueIndex
-
-        defer {
-            storage[index] = nil
-            innerCount -= 1
-        }
-
-        return storage[index]!
-    }
-
-    /// Dequeues element or throws an exception in case queue is empty.
-    ///
-    /// - returns: Dequeued element.
-    mutating func dequeue() -> T? {
-        if self.count == 0 {
-            return nil
-        }
-
-        defer {
-            let downsizeLimit = storage.count / (resizeFactor * resizeFactor)
-            if count < downsizeLimit && downsizeLimit >= initialCapacity {
-                resizeTo(storage.count / resizeFactor)
-            }
-        }
-
-        return dequeueElementOnly()
-    }
-    
-    /// - returns: Generator of contained elements.
-    func makeIterator() -> AnyIterator<T> {
-        var i = dequeueIndex
-        var innerCount = count
-
-        return AnyIterator {
-            if innerCount == 0 {
-                return nil
-            }
-
-            defer {
-                innerCount -= 1
-                i += 1
-            }
-
-            if i >= self.storage.count {
-                i -= self.storage.count
-            }
-
-            return self.storage[i]
-        }
-    }
-}
diff --git a/Pods/RxCocoa/Platform/DispatchQueue+Extensions.swift b/Pods/RxCocoa/Platform/DispatchQueue+Extensions.swift
deleted file mode 100644
index aaf24cae6..000000000
--- a/Pods/RxCocoa/Platform/DispatchQueue+Extensions.swift
+++ /dev/null
@@ -1,21 +0,0 @@
-//
-//  DispatchQueue+Extensions.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 10/22/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-
-extension DispatchQueue {
-    private static var token: DispatchSpecificKey<()> = {
-        let key = DispatchSpecificKey<()>()
-        DispatchQueue.main.setSpecific(key: key, value: ())
-        return key
-    }()
-
-    static var isMain: Bool {
-        DispatchQueue.getSpecific(key: token) != nil
-    }
-}
diff --git a/Pods/RxCocoa/Platform/Platform.Darwin.swift b/Pods/RxCocoa/Platform/Platform.Darwin.swift
deleted file mode 100644
index eacc19431..000000000
--- a/Pods/RxCocoa/Platform/Platform.Darwin.swift
+++ /dev/null
@@ -1,35 +0,0 @@
-//
-//  Platform.Darwin.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 12/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(macOS) || os(iOS) || os(tvOS) || os(watchOS)
-
-    import Darwin
-    import Foundation
-
-    extension Thread {
-        static func setThreadLocalStorageValue<T: AnyObject>(_ value: T?, forKey key: NSCopying) {
-            let currentThread = Thread.current
-            let threadDictionary = currentThread.threadDictionary
-
-            if let newValue = value {
-                threadDictionary[key] = newValue
-            }
-            else {
-                threadDictionary[key] = nil
-            }
-        }
-
-        static func getThreadLocalStorageValueForKey<T>(_ key: NSCopying) -> T? {
-            let currentThread = Thread.current
-            let threadDictionary = currentThread.threadDictionary
-            
-            return threadDictionary[key] as? T
-        }
-    }
-
-#endif
diff --git a/Pods/RxCocoa/Platform/Platform.Linux.swift b/Pods/RxCocoa/Platform/Platform.Linux.swift
deleted file mode 100644
index 52a3e3af8..000000000
--- a/Pods/RxCocoa/Platform/Platform.Linux.swift
+++ /dev/null
@@ -1,32 +0,0 @@
-//
-//  Platform.Linux.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 12/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(Linux)
-
-    import Foundation
-
-    extension Thread {
-
-        static func setThreadLocalStorageValue<T: AnyObject>(_ value: T?, forKey key: String) {
-            if let newValue = value {
-                Thread.current.threadDictionary[key] = newValue
-            }
-            else {
-                Thread.current.threadDictionary[key] = nil
-            }
-        }
-
-        static func getThreadLocalStorageValueForKey<T: AnyObject>(_ key: String) -> T? {
-            let currentThread = Thread.current
-            let threadDictionary = currentThread.threadDictionary
-
-            return threadDictionary[key] as? T
-        }
-    }
-
-#endif
diff --git a/Pods/RxCocoa/Platform/RecursiveLock.swift b/Pods/RxCocoa/Platform/RecursiveLock.swift
deleted file mode 100644
index 10b9bbb0b..000000000
--- a/Pods/RxCocoa/Platform/RecursiveLock.swift
+++ /dev/null
@@ -1,34 +0,0 @@
-//
-//  RecursiveLock.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 12/18/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-#if TRACE_RESOURCES
-    class RecursiveLock: NSRecursiveLock {
-        override init() {
-            _ = Resources.incrementTotal()
-            super.init()
-        }
-
-        override func lock() {
-            super.lock()
-            _ = Resources.incrementTotal()
-        }
-
-        override func unlock() {
-            super.unlock()
-            _ = Resources.decrementTotal()
-        }
-
-        deinit {
-            _ = Resources.decrementTotal()
-        }
-    }
-#else
-    typealias RecursiveLock = NSRecursiveLock
-#endif
diff --git a/Pods/RxCocoa/README.md b/Pods/RxCocoa/README.md
deleted file mode 100644
index 20330166b..000000000
--- a/Pods/RxCocoa/README.md
+++ /dev/null
@@ -1,254 +0,0 @@
-<p align="center">
-<img src="assets/RxSwift_Logo.png" width="35%" alt="RxSwift Logo" />
-<br />
-<a href="https://actions-badge.atrox.dev/ReactiveX/RxSwift/goto" target="_blank"><img src="https://github.com/ReactiveX/RxSwift/workflows/RxSwift/badge.svg?branch=main" alt="Build Status" /></a>
-<img src="https://img.shields.io/badge/platforms-iOS%20%7C%20macOS%20%7C%20tvOS%20%7C%20watchOS%20%7C%20Linux-333333.svg" alt="Supported Platforms: iOS, macOS, tvOS, watchOS & Linux" />
-<br />
-<a href="https://cocoapods.org/pods/RxSwift" alt="RxSwift on CocoaPods" title="RxSwift on CocoaPods"><img src="https://img.shields.io/cocoapods/v/RxSwift.svg" /></a>
-<a href="https://github.com/Carthage/Carthage" alt="RxSwift on Carthage" title="RxSwift on Carthage"><img src="https://img.shields.io/badge/Carthage-compatible-4BC51D.svg?style=flat" /></a>
-<a href="https://github.com/apple/swift-package-manager" alt="RxSwift on Swift Package Manager" title="RxSwift on Swift Package Manager"><img src="https://img.shields.io/badge/Swift%20Package%20Manager-compatible-brightgreen.svg" /></a>
-</p>
-
-Rx is a [generic abstraction of computation](https://youtu.be/looJcaeboBY) expressed through `Observable<Element>` interface, which lets you broadcast and subscribe to values and other events from an `Observable` stream.  
-
-RxSwift is the Swift-specific implementation of the [Reactive Extensions](http://reactivex.io) standard.
-
-<p align="center"><img src="assets/example.png" width="55%" alt="RxSwift Observable Example of a price constantly changing and updating the app's UI" /></p>
-
-While this version aims to stay true to the original spirit and naming conventions of Rx, this projects also aims to provide a true Swift-first API for Rx APIs.
-
-Cross platform documentation can be found on [ReactiveX.io](http://reactivex.io/).
-
-Like other Rx implementation, RxSwift's intention is to enable easy composition of asynchronous operations and streams of data in the form of `Observable` objects and a suite of methods to transform and compose these pieces of asynchronous work.
-
-KVO observation, async operations, UI Events and other streams of data are all unified under [abstraction of sequence](Documentation/GettingStarted.md#observables-aka-sequences). This is the reason why Rx is so simple, elegant and powerful.
-
-## I came here because I want to ...
-
-###### ... understand
-
-* [why use rx?](Documentation/Why.md)
-* [the basics, getting started with RxSwift](Documentation/GettingStarted.md)
-* [traits](Documentation/Traits.md) - what are `Single`, `Completable`, `Maybe`, `Driver`, and `ControlProperty` ... and why do they exist?
-* [testing](Documentation/UnitTests.md)
-* [tips and common errors](Documentation/Tips.md)
-* [debugging](Documentation/GettingStarted.md#debugging)
-* [the math behind Rx](Documentation/MathBehindRx.md)
-* [what are hot and cold observable sequences?](Documentation/HotAndColdObservables.md)
-
-###### ... install
-
-* Integrate RxSwift/RxCocoa with my app. [Installation Guide](#installation)
-
-###### ... hack around
-
-* with the example app. [Running Example App](Documentation/ExampleApp.md)
-* with operators in playgrounds. [Playgrounds](Documentation/Playgrounds.md)
-
-###### ... interact
-
-* All of this is great, but it would be nice to talk with other people using RxSwift and exchange experiences. <br />[Join Slack Channel](http://slack.rxswift.org)
-* Report a problem using the library. [Open an Issue With Bug Template](.github/ISSUE_TEMPLATE.md)
-* Request a new feature. [Open an Issue With Feature Request Template](Documentation/NewFeatureRequestTemplate.md)
-* Help out [Check out contribution guide](CONTRIBUTING.md)
-
-###### ... compare
-
-* [with Combine and ReactiveSwift](Documentation/ComparisonWithOtherLibraries.md).
-
-###### ... understand the structure
-
-RxSwift is as compositional as the asynchronous work it drives. The core unit is RxSwift itself, while other dependencies can be added for UI Work, testing, and more.
-
-It comprises five separate components depending on each other in the following way:
-
-```none
-┌──────────────┐    ┌──────────────┐
-│   RxCocoa    ├────▶   RxRelay    │
-└───────┬──────┘    └──────┬───────┘
-        │                  │        
-┌───────▼──────────────────▼───────┐
-│             RxSwift              │
-└───────▲──────────────────▲───────┘
-        │                  │        
-┌───────┴──────┐    ┌──────┴───────┐
-│    RxTest    │    │  RxBlocking  │
-└──────────────┘    └──────────────┘
-```
-
-* **RxSwift**: The core of RxSwift, providing the Rx standard as (mostly) defined by [ReactiveX](https://reactivex.io). It has no other dependencies.
-* **RxCocoa**: Provides Cocoa-specific capabilities for general iOS/macOS/watchOS & tvOS app development, such as Shared Sequences, Traits, and much more. It depends on both `RxSwift` and `RxRelay`.
-* **RxRelay**: Provides `PublishRelay`, `BehaviorRelay` and `ReplayRelay`, three [simple wrappers around Subjects](https://github.com/ReactiveX/RxSwift/blob/main/Documentation/Subjects.md#relays). It depends on `RxSwift`. 
-* **RxTest** and **RxBlocking**: Provides testing capabilities for Rx-based systems. It depends on `RxSwift`.
-
-## Usage
-
-<table>
-  <tr>
-    <th width="30%">Here's an example</th>
-    <th width="30%">In Action</th>
-  </tr>
-  <tr>
-    <td>Define search for GitHub repositories ...</td>
-    <th rowspan="9"><img src="https://raw.githubusercontent.com/kzaher/rxswiftcontent/master/GithubSearch.gif"></th>
-  </tr>
-  <tr>
-    <td><div class="highlight highlight-source-swift"><pre>
-let searchResults = searchBar.rx.text.orEmpty
-    .throttle(.milliseconds(300), scheduler: MainScheduler.instance)
-    .distinctUntilChanged()
-    .flatMapLatest { query -> Observable&lt;[Repository]&gt; in
-        if query.isEmpty {
-            return .just([])
-        }
-        return searchGitHub(query)
-            .catchAndReturn([])
-    }
-    .observe(on: MainScheduler.instance)</pre></div></td>
-  </tr>
-  <tr>
-    <td>... then bind the results to your tableview</td>
-  </tr>
-  <tr>
-    <td width="30%"><div class="highlight highlight-source-swift"><pre>
-searchResults
-    .bind(to: tableView.rx.items(cellIdentifier: "Cell")) {
-        (index, repository: Repository, cell) in
-        cell.textLabel?.text = repository.name
-        cell.detailTextLabel?.text = repository.url
-    }
-    .disposed(by: disposeBag)</pre></div></td>
-  </tr>
-</table>
-
-
-## Requirements
-
-* Xcode 12.x
-* Swift 5.x
-
-For Xcode 11 and below, [use RxSwift 5.x](https://github.com/ReactiveX/RxSwift/releases/tag/5.1.1).
-
-## Installation
-
-RxSwift doesn't contain any external dependencies.
-
-These are currently the supported installation options:
-
-### Manual
-
-Open Rx.xcworkspace, choose `RxExample` and hit run. This method will build everything and run the sample app
-
-### [CocoaPods](https://guides.cocoapods.org/using/using-cocoapods.html)
-
-```ruby
-# Podfile
-use_frameworks!
-
-target 'YOUR_TARGET_NAME' do
-    pod 'RxSwift', '6.2.0'
-    pod 'RxCocoa', '6.2.0'
-end
-
-# RxTest and RxBlocking make the most sense in the context of unit/integration tests
-target 'YOUR_TESTING_TARGET' do
-    pod 'RxBlocking', '6.2.0'
-    pod 'RxTest', '6.2.0'
-end
-```
-
-Replace `YOUR_TARGET_NAME` and then, in the `Podfile` directory, type:
-
-```bash
-$ pod install
-```
-
-### XCFrameworks
-
-Each release starting with RxSwift 6 includes `*.xcframework` framework binaries.
-
-Simply drag the needed framework binaries to your **Frameworks, Libraries, and Embedded Content** section under your target's **General** tab.
-
-> **Note**: If you're using `RxCocoa`, be sure to also drag **RxCocoaRuntime.xcframework** before importing `RxCocoa`.
-
-<img src="https://raw.githubusercontent.com/ReactiveX/RxSwift/main/assets/xcframeworks.png" alt="XCFrameworks instructions" width="65%">
-
-### [Carthage](https://github.com/Carthage/Carthage)
-
-Add this to `Cartfile`
-
-```
-github "ReactiveX/RxSwift" "6.2.0"
-```
-
-```bash
-$ carthage update
-```
-
-#### Carthage as a Static Library
-
-Carthage defaults to building RxSwift as a Dynamic Library. 
-
-If you wish to build RxSwift as a Static Library using Carthage you may use the script below to manually modify the framework type before building with Carthage:
-
-```bash
-carthage update RxSwift --platform iOS --no-build
-sed -i -e 's/MACH_O_TYPE = mh_dylib/MACH_O_TYPE = staticlib/g' Carthage/Checkouts/RxSwift/Rx.xcodeproj/project.pbxproj
-carthage build RxSwift --platform iOS
-```
-
-### [Swift Package Manager](https://github.com/apple/swift-package-manager)
-
-> **Note**: There is a critical cross-dependency bug affecting many projects including RxSwift in Swift Package Manager. We've [filed a bug (SR-12303)](https://bugs.swift.org/browse/SR-12303) in early 2020 but have no answer yet. Your mileage may vary. A partial workaround can be found [here](https://github.com/ReactiveX/RxSwift/issues/2127#issuecomment-717830502).
-
-Create a `Package.swift` file.
-
-```swift
-// swift-tools-version:5.0
-
-import PackageDescription
-
-let package = Package(
-  name: "RxTestProject",
-  dependencies: [
-    .package(url: "https://github.com/ReactiveX/RxSwift.git", .exact("6.2.0"))
-  ],
-  targets: [
-    .target(name: "RxTestProject", dependencies: ["RxSwift", "RxCocoa"])
-  ]
-)
-```
-
-```bash
-$ swift build
-```
-
-To build or test a module with RxTest dependency, set `TEST=1`.
-
-```bash
-$ TEST=1 swift test
-```
-
-### Manually using git submodules
-
-* Add RxSwift as a submodule
-
-```bash
-$ git submodule add git@github.com:ReactiveX/RxSwift.git
-```
-
-* Drag `Rx.xcodeproj` into Project Navigator
-* Go to `Project > Targets > Build Phases > Link Binary With Libraries`, click `+` and select `RxSwift`, `RxCocoa` and `RxRelay` targets
-
-## References
-
-* [http://reactivex.io/](http://reactivex.io/)
-* [Reactive Extensions GitHub (GitHub)](https://github.com/Reactive-Extensions)
-* [RxSwift RayWenderlich.com Book](https://store.raywenderlich.com/products/rxswift-reactive-programming-with-swift)
-* [RxSwift: Debunking the myth of hard (YouTube)](https://www.youtube.com/watch?v=GdvLP0ZAhhc)
-* [Boxue.io RxSwift Online Course](https://boxueio.com/series/rxswift-101) (Chinese 🇨🇳)
-* [Expert to Expert: Brian Beckman and Erik Meijer - Inside the .NET Reactive Framework (Rx) (video)](https://youtu.be/looJcaeboBY)
-* [Reactive Programming Overview (Jafar Husain from Netflix)](https://youtu.be/-8Y1-lE6NSA)
-* [Subject/Observer is Dual to Iterator (paper)](http://csl.stanford.edu/~christos/pldi2010.fit/meijer.duality.pdf)
-* [Rx standard sequence operators visualized (visualization tool)](http://rxmarbles.com/)
-* [Haskell](https://www.haskell.org/)
diff --git a/Pods/RxCocoa/RxCocoa/Common/ControlTarget.swift b/Pods/RxCocoa/RxCocoa/Common/ControlTarget.swift
deleted file mode 100644
index 231c3fe5d..000000000
--- a/Pods/RxCocoa/RxCocoa/Common/ControlTarget.swift
+++ /dev/null
@@ -1,88 +0,0 @@
-//
-//  ControlTarget.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 2/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS) || os(macOS)
-
-import RxSwift
-
-#if os(iOS) || os(tvOS)
-    import UIKit
-
-    typealias Control = UIKit.UIControl
-#elseif os(macOS)
-    import Cocoa
-
-    typealias Control = Cocoa.NSControl
-#endif
-
-// This should be only used from `MainScheduler`
-final class ControlTarget: RxTarget {
-    typealias Callback = (Control) -> Void
-
-    let selector: Selector = #selector(ControlTarget.eventHandler(_:))
-
-    weak var control: Control?
-#if os(iOS) || os(tvOS)
-    let controlEvents: UIControl.Event
-#endif
-    var callback: Callback?
-    #if os(iOS) || os(tvOS)
-    init(control: Control, controlEvents: UIControl.Event, callback: @escaping Callback) {
-        MainScheduler.ensureRunningOnMainThread()
-
-        self.control = control
-        self.controlEvents = controlEvents
-        self.callback = callback
-
-        super.init()
-
-        control.addTarget(self, action: selector, for: controlEvents)
-
-        let method = self.method(for: selector)
-        if method == nil {
-            rxFatalError("Can't find method")
-        }
-    }
-#elseif os(macOS)
-    init(control: Control, callback: @escaping Callback) {
-        MainScheduler.ensureRunningOnMainThread()
-
-        self.control = control
-        self.callback = callback
-
-        super.init()
-
-        control.target = self
-        control.action = self.selector
-
-        let method = self.method(for: self.selector)
-        if method == nil {
-            rxFatalError("Can't find method")
-        }
-    }
-#endif
-
-    @objc func eventHandler(_ sender: Control!) {
-        if let callback = self.callback, let control = self.control {
-            callback(control)
-        }
-    }
-
-    override func dispose() {
-        super.dispose()
-#if os(iOS) || os(tvOS)
-        self.control?.removeTarget(self, action: self.selector, for: self.controlEvents)
-#elseif os(macOS)
-        self.control?.target = nil
-        self.control?.action = nil
-#endif
-        self.callback = nil
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/Common/DelegateProxy.swift b/Pods/RxCocoa/RxCocoa/Common/DelegateProxy.swift
deleted file mode 100644
index 4ef8de73b..000000000
--- a/Pods/RxCocoa/RxCocoa/Common/DelegateProxy.swift
+++ /dev/null
@@ -1,293 +0,0 @@
-//
-//  DelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if !os(Linux)
-
-    import RxSwift
-    #if SWIFT_PACKAGE && !os(Linux)
-        import RxCocoaRuntime
-    #endif
-
-    /// Base class for `DelegateProxyType` protocol.
-    ///
-    /// This implementation is not thread safe and can be used only from one thread (Main thread).
-    open class DelegateProxy<P: AnyObject, D>: _RXDelegateProxy {
-        public typealias ParentObject = P
-        public typealias Delegate = D
-
-        private var _sentMessageForSelector = [Selector: MessageDispatcher]()
-        private var _methodInvokedForSelector = [Selector: MessageDispatcher]()
-
-        /// Parent object associated with delegate proxy.
-        private weak var _parentObject: ParentObject?
-
-        private let _currentDelegateFor: (ParentObject) -> AnyObject?
-        private let _setCurrentDelegateTo: (AnyObject?, ParentObject) -> Void
-
-        /// Initializes new instance.
-        ///
-        /// - parameter parentObject: Optional parent object that owns `DelegateProxy` as associated object.
-        public init<Proxy: DelegateProxyType>(parentObject: ParentObject, delegateProxy: Proxy.Type)
-            where Proxy: DelegateProxy<ParentObject, Delegate>, Proxy.ParentObject == ParentObject, Proxy.Delegate == Delegate {
-            self._parentObject = parentObject
-            self._currentDelegateFor = delegateProxy._currentDelegate
-            self._setCurrentDelegateTo = delegateProxy._setCurrentDelegate
-
-            MainScheduler.ensureRunningOnMainThread()
-            #if TRACE_RESOURCES
-                _ = Resources.incrementTotal()
-            #endif
-            super.init()
-        }
-
-        /**
-         Returns observable sequence of invocations of delegate methods. Elements are sent *before method is invoked*.
-
-         Only methods that have `void` return value can be observed using this method because
-         those methods are used as a notification mechanism. It doesn't matter if they are optional
-         or not. Observing is performed by installing a hidden associated `PublishSubject` that is
-         used to dispatch messages to observers.
-
-         Delegate methods that have non `void` return value can't be observed directly using this method
-         because:
-         * those methods are not intended to be used as a notification mechanism, but as a behavior customization mechanism
-         * there is no sensible automatic way to determine a default return value
-
-         In case observing of delegate methods that have return type is required, it can be done by
-         manually installing a `PublishSubject` or `BehaviorSubject` and implementing delegate method.
-
-         e.g.
-
-             // delegate proxy part (RxScrollViewDelegateProxy)
-
-             let internalSubject = PublishSubject<CGPoint>
-
-             public func requiredDelegateMethod(scrollView: UIScrollView, arg1: CGPoint) -> Bool {
-                 internalSubject.on(.next(arg1))
-                 return self._forwardToDelegate?.requiredDelegateMethod?(scrollView, arg1: arg1) ?? defaultReturnValue
-             }
-
-         ....
-
-             // reactive property implementation in a real class (`UIScrollView`)
-             public var property: Observable<CGPoint> {
-                 let proxy = RxScrollViewDelegateProxy.proxy(for: base)
-                 return proxy.internalSubject.asObservable()
-             }
-
-         **In case calling this method prints "Delegate proxy is already implementing `\(selector)`,
-         a more performant way of registering might exist.", that means that manual observing method
-         is required analog to the example above because delegate method has already been implemented.**
-
-         - parameter selector: Selector used to filter observed invocations of delegate methods.
-         - returns: Observable sequence of arguments passed to `selector` method.
-         */
-        open func sentMessage(_ selector: Selector) -> Observable<[Any]> {
-            MainScheduler.ensureRunningOnMainThread()
-
-            let subject = self._sentMessageForSelector[selector]
-
-            if let subject = subject {
-                return subject.asObservable()
-            }
-            else {
-                let subject = MessageDispatcher(selector: selector, delegateProxy: self)
-                self._sentMessageForSelector[selector] = subject
-                return subject.asObservable()
-            }
-        }
-
-        /**
-         Returns observable sequence of invoked delegate methods. Elements are sent *after method is invoked*.
-
-         Only methods that have `void` return value can be observed using this method because
-         those methods are used as a notification mechanism. It doesn't matter if they are optional
-         or not. Observing is performed by installing a hidden associated `PublishSubject` that is
-         used to dispatch messages to observers.
-
-         Delegate methods that have non `void` return value can't be observed directly using this method
-         because:
-         * those methods are not intended to be used as a notification mechanism, but as a behavior customization mechanism
-         * there is no sensible automatic way to determine a default return value
-
-         In case observing of delegate methods that have return type is required, it can be done by
-         manually installing a `PublishSubject` or `BehaviorSubject` and implementing delegate method.
-
-         e.g.
-
-             // delegate proxy part (RxScrollViewDelegateProxy)
-
-             let internalSubject = PublishSubject<CGPoint>
-
-             public func requiredDelegateMethod(scrollView: UIScrollView, arg1: CGPoint) -> Bool {
-                 internalSubject.on(.next(arg1))
-                 return self._forwardToDelegate?.requiredDelegateMethod?(scrollView, arg1: arg1) ?? defaultReturnValue
-             }
-
-         ....
-
-             // reactive property implementation in a real class (`UIScrollView`)
-             public var property: Observable<CGPoint> {
-                 let proxy = RxScrollViewDelegateProxy.proxy(for: base)
-                 return proxy.internalSubject.asObservable()
-             }
-
-         **In case calling this method prints "Delegate proxy is already implementing `\(selector)`,
-         a more performant way of registering might exist.", that means that manual observing method
-         is required analog to the example above because delegate method has already been implemented.**
-
-         - parameter selector: Selector used to filter observed invocations of delegate methods.
-         - returns: Observable sequence of arguments passed to `selector` method.
-         */
-        open func methodInvoked(_ selector: Selector) -> Observable<[Any]> {
-            MainScheduler.ensureRunningOnMainThread()
-
-            let subject = self._methodInvokedForSelector[selector]
-
-            if let subject = subject {
-                return subject.asObservable()
-            }
-            else {
-                let subject = MessageDispatcher(selector: selector, delegateProxy: self)
-                self._methodInvokedForSelector[selector] = subject
-                return subject.asObservable()
-            }
-        }
-
-        fileprivate func checkSelectorIsObservable(_ selector: Selector) {
-            MainScheduler.ensureRunningOnMainThread()
-
-            if self.hasWiredImplementation(for: selector) {
-                print("⚠️ Delegate proxy is already implementing `\(selector)`, a more performant way of registering might exist.")
-                return
-            }
-
-            if self.voidDelegateMethodsContain(selector) {
-                return
-            }
-
-            // In case `_forwardToDelegate` is `nil`, it is assumed the check is being done prematurely.
-            if !(self._forwardToDelegate?.responds(to: selector) ?? true) {
-                print("⚠️ Using delegate proxy dynamic interception method but the target delegate object doesn't respond to the requested selector. " +
-                    "In case pure Swift delegate proxy is being used please use manual observing method by using`PublishSubject`s. " +
-                    " (selector: `\(selector)`, forwardToDelegate: `\(self._forwardToDelegate ?? self)`)")
-            }
-        }
-
-        // proxy
-
-        open override func _sentMessage(_ selector: Selector, withArguments arguments: [Any]) {
-            self._sentMessageForSelector[selector]?.on(.next(arguments))
-        }
-
-        open override func _methodInvoked(_ selector: Selector, withArguments arguments: [Any]) {
-            self._methodInvokedForSelector[selector]?.on(.next(arguments))
-        }
-
-        /// Returns reference of normal delegate that receives all forwarded messages
-        /// through `self`.
-        ///
-        /// - returns: Value of reference if set or nil.
-        open func forwardToDelegate() -> Delegate? {
-            return castOptionalOrFatalError(self._forwardToDelegate)
-        }
-
-        /// Sets reference of normal delegate that receives all forwarded messages
-        /// through `self`.
-        ///
-        /// - parameter forwardToDelegate: Reference of delegate that receives all messages through `self`.
-        /// - parameter retainDelegate: Should `self` retain `forwardToDelegate`.
-        open func setForwardToDelegate(_ delegate: Delegate?, retainDelegate: Bool) {
-            #if DEBUG // 4.0 all configurations
-                MainScheduler.ensureRunningOnMainThread()
-            #endif
-            self._setForwardToDelegate(delegate, retainDelegate: retainDelegate)
-
-            let sentSelectors: [Selector] = self._sentMessageForSelector.values.filter { $0.hasObservers }.map { $0.selector }
-            let invokedSelectors: [Selector] = self._methodInvokedForSelector.values.filter { $0.hasObservers }.map { $0.selector }
-            let allUsedSelectors = sentSelectors + invokedSelectors
-
-            for selector in Set(allUsedSelectors) {
-                self.checkSelectorIsObservable(selector)
-            }
-
-            self.reset()
-        }
-
-        private func hasObservers(selector: Selector) -> Bool {
-            return (self._sentMessageForSelector[selector]?.hasObservers ?? false)
-                || (self._methodInvokedForSelector[selector]?.hasObservers ?? false)
-        }
-
-        override open func responds(to aSelector: Selector!) -> Bool {
-            return super.responds(to: aSelector)
-                || (self._forwardToDelegate?.responds(to: aSelector) ?? false)
-                || (self.voidDelegateMethodsContain(aSelector) && self.hasObservers(selector: aSelector))
-        }
-
-        fileprivate func reset() {
-            guard let parentObject = self._parentObject else { return }
-
-            let maybeCurrentDelegate = self._currentDelegateFor(parentObject)
-
-            if maybeCurrentDelegate === self {
-                self._setCurrentDelegateTo(nil, parentObject)
-                self._setCurrentDelegateTo(castOrFatalError(self), parentObject)
-            }
-        }
-
-        deinit {
-            for v in self._sentMessageForSelector.values {
-                v.on(.completed)
-            }
-            for v in self._methodInvokedForSelector.values {
-                v.on(.completed)
-            }
-            #if TRACE_RESOURCES
-                _ = Resources.decrementTotal()
-            #endif
-        }
-    
-
-    }
-
-    private let mainScheduler = MainScheduler()
-
-    private final class MessageDispatcher {
-        private let dispatcher: PublishSubject<[Any]>
-        private let result: Observable<[Any]>
-
-        fileprivate let selector: Selector
-
-        init<P, D>(selector: Selector, delegateProxy _delegateProxy: DelegateProxy<P, D>) {
-            weak var weakDelegateProxy = _delegateProxy
-
-            let dispatcher = PublishSubject<[Any]>()
-            self.dispatcher = dispatcher
-            self.selector = selector
-
-            self.result = dispatcher
-                .do(onSubscribed: { weakDelegateProxy?.checkSelectorIsObservable(selector); weakDelegateProxy?.reset() }, onDispose: { weakDelegateProxy?.reset() })
-                .share()
-                .subscribe(on: mainScheduler)
-        }
-
-        var on: (Event<[Any]>) -> Void {
-            return self.dispatcher.on
-        }
-
-        var hasObservers: Bool {
-            return self.dispatcher.hasObservers
-        }
-
-        func asObservable() -> Observable<[Any]> {
-            return self.result
-        }
-    }
-    
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/Common/DelegateProxyType.swift b/Pods/RxCocoa/RxCocoa/Common/DelegateProxyType.swift
deleted file mode 100644
index 42fa50dc2..000000000
--- a/Pods/RxCocoa/RxCocoa/Common/DelegateProxyType.swift
+++ /dev/null
@@ -1,435 +0,0 @@
-//
-//  DelegateProxyType.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if !os(Linux)
-
-    import Foundation
-    import RxSwift
-
-/**
-`DelegateProxyType` protocol enables using both normal delegates and Rx observable sequences with
-views that can have only one delegate/datasource registered.
-
-`Proxies` store information about observers, subscriptions and delegates
-for specific views.
-
-Type implementing `DelegateProxyType` should never be initialized directly.
-
-To fetch initialized instance of type implementing `DelegateProxyType`, `proxy` method
-should be used.
-
-This is more or less how it works.
-
-
-
-      +-------------------------------------------+
-      |                                           |                           
-      | UIView subclass (UIScrollView)            |                           
-      |                                           |
-      +-----------+-------------------------------+                           
-                  |                                                           
-                  | Delegate                                                  
-                  |                                                           
-                  |                                                           
-      +-----------v-------------------------------+                           
-      |                                           |                           
-      | Delegate proxy : DelegateProxyType        +-----+---->  Observable<T1>
-      |                , UIScrollViewDelegate     |     |
-      +-----------+-------------------------------+     +---->  Observable<T2>
-                  |                                     |                     
-                  |                                     +---->  Observable<T3>
-                  |                                     |                     
-                  | forwards events                     |
-                  | to custom delegate                  |
-                  |                                     v                     
-      +-----------v-------------------------------+                           
-      |                                           |                           
-      | Custom delegate (UIScrollViewDelegate)    |                           
-      |                                           |
-      +-------------------------------------------+                           
-
-
-Since RxCocoa needs to automagically create those Proxys and because views that have delegates can be hierarchical
-
-     UITableView : UIScrollView : UIView
-
-.. and corresponding delegates are also hierarchical
-
-     UITableViewDelegate : UIScrollViewDelegate : NSObject
-
-... this mechanism can be extended by using the following snippet in `registerKnownImplementations` or in some other
-     part of your app that executes before using `rx.*` (e.g. appDidFinishLaunching).
-
-    RxScrollViewDelegateProxy.register { RxTableViewDelegateProxy(parentObject: $0) }
-
-*/
-public protocol DelegateProxyType: AnyObject {
-    associatedtype ParentObject: AnyObject
-    associatedtype Delegate
-    
-    /// It is require that enumerate call `register` of the extended DelegateProxy subclasses here.
-    static func registerKnownImplementations()
-
-    /// Unique identifier for delegate
-    static var identifier: UnsafeRawPointer { get }
-
-    /// Returns designated delegate property for object.
-    ///
-    /// Objects can have multiple delegate properties.
-    ///
-    /// Each delegate property needs to have it's own type implementing `DelegateProxyType`.
-    ///
-    /// It's abstract method.
-    ///
-    /// - parameter object: Object that has delegate property.
-    /// - returns: Value of delegate property.
-    static func currentDelegate(for object: ParentObject) -> Delegate?
-
-    /// Sets designated delegate property for object.
-    ///
-    /// Objects can have multiple delegate properties.
-    ///
-    /// Each delegate property needs to have it's own type implementing `DelegateProxyType`.
-    ///
-    /// It's abstract method.
-    ///
-    /// - parameter toObject: Object that has delegate property.
-    /// - parameter delegate: Delegate value.
-    static func setCurrentDelegate(_ delegate: Delegate?, to object: ParentObject)
-
-    /// Returns reference of normal delegate that receives all forwarded messages
-    /// through `self`.
-    ///
-    /// - returns: Value of reference if set or nil.
-    func forwardToDelegate() -> Delegate?
-
-    /// Sets reference of normal delegate that receives all forwarded messages
-    /// through `self`.
-    ///
-    /// - parameter forwardToDelegate: Reference of delegate that receives all messages through `self`.
-    /// - parameter retainDelegate: Should `self` retain `forwardToDelegate`.
-    func setForwardToDelegate(_ forwardToDelegate: Delegate?, retainDelegate: Bool)
-}
-
-// default implementations
-extension DelegateProxyType {
-    /// Unique identifier for delegate
-    public static var identifier: UnsafeRawPointer {
-        let delegateIdentifier = ObjectIdentifier(Delegate.self)
-        let integerIdentifier = Int(bitPattern: delegateIdentifier)
-        return UnsafeRawPointer(bitPattern: integerIdentifier)!
-    }
-}
-
-// workaround of Delegate: class
-extension DelegateProxyType {
-    static func _currentDelegate(for object: ParentObject) -> AnyObject? {
-        currentDelegate(for: object).map { $0 as AnyObject }
-    }
-    
-    static func _setCurrentDelegate(_ delegate: AnyObject?, to object: ParentObject) {
-        setCurrentDelegate(castOptionalOrFatalError(delegate), to: object)
-    }
-    
-    func _forwardToDelegate() -> AnyObject? {
-        self.forwardToDelegate().map { $0 as AnyObject }
-    }
-    
-    func _setForwardToDelegate(_ forwardToDelegate: AnyObject?, retainDelegate: Bool) {
-        self.setForwardToDelegate(castOptionalOrFatalError(forwardToDelegate), retainDelegate: retainDelegate)
-    }
-}
-
-extension DelegateProxyType {
-
-    /// Store DelegateProxy subclass to factory.
-    /// When make 'Rx*DelegateProxy' subclass, call 'Rx*DelegateProxySubclass.register(for:_)' 1 time, or use it in DelegateProxyFactory
-    /// 'Rx*DelegateProxy' can have one subclass implementation per concrete ParentObject type.
-    /// Should call it from concrete DelegateProxy type, not generic.
-    public static func register<Parent>(make: @escaping (Parent) -> Self) {
-        self.factory.extend(make: make)
-    }
-
-    /// Creates new proxy for target object.
-    /// Should not call this function directory, use 'DelegateProxy.proxy(for:)'
-    public static func createProxy(for object: AnyObject) -> Self {
-        castOrFatalError(factory.createProxy(for: object))
-    }
-
-    /// Returns existing proxy for object or installs new instance of delegate proxy.
-    ///
-    /// - parameter object: Target object on which to install delegate proxy.
-    /// - returns: Installed instance of delegate proxy.
-    ///
-    ///
-    ///     extension Reactive where Base: UISearchBar {
-    ///
-    ///         public var delegate: DelegateProxy<UISearchBar, UISearchBarDelegate> {
-    ///            return RxSearchBarDelegateProxy.proxy(for: base)
-    ///         }
-    ///
-    ///         public var text: ControlProperty<String> {
-    ///             let source: Observable<String> = self.delegate.observe(#selector(UISearchBarDelegate.searchBar(_:textDidChange:)))
-    ///             ...
-    ///         }
-    ///     }
-    public static func proxy(for object: ParentObject) -> Self {
-        MainScheduler.ensureRunningOnMainThread()
-
-        let maybeProxy = self.assignedProxy(for: object)
-
-        let proxy: AnyObject
-        if let existingProxy = maybeProxy {
-            proxy = existingProxy
-        }
-        else {
-            proxy = castOrFatalError(self.createProxy(for: object))
-            self.assignProxy(proxy, toObject: object)
-            assert(self.assignedProxy(for: object) === proxy)
-        }
-        let currentDelegate = self._currentDelegate(for: object)
-        let delegateProxy: Self = castOrFatalError(proxy)
-
-        if currentDelegate !== delegateProxy {
-            delegateProxy._setForwardToDelegate(currentDelegate, retainDelegate: false)
-            assert(delegateProxy._forwardToDelegate() === currentDelegate)
-            self._setCurrentDelegate(proxy, to: object)
-            assert(self._currentDelegate(for: object) === proxy)
-            assert(delegateProxy._forwardToDelegate() === currentDelegate)
-        }
-
-        return delegateProxy
-    }
-
-    /// Sets forward delegate for `DelegateProxyType` associated with a specific object and return disposable that can be used to unset the forward to delegate.
-    /// Using this method will also make sure that potential original object cached selectors are cleared and will report any accidental forward delegate mutations.
-    ///
-    /// - parameter forwardDelegate: Delegate object to set.
-    /// - parameter retainDelegate: Retain `forwardDelegate` while it's being set.
-    /// - parameter onProxyForObject: Object that has `delegate` property.
-    /// - returns: Disposable object that can be used to clear forward delegate.
-    public static func installForwardDelegate(_ forwardDelegate: Delegate, retainDelegate: Bool, onProxyForObject object: ParentObject) -> Disposable {
-        weak var weakForwardDelegate: AnyObject? = forwardDelegate as AnyObject
-        let proxy = self.proxy(for: object)
-
-        assert(proxy._forwardToDelegate() === nil, "This is a feature to warn you that there is already a delegate (or data source) set somewhere previously. The action you are trying to perform will clear that delegate (data source) and that means that some of your features that depend on that delegate (data source) being set will likely stop working.\n" +
-            "If you are ok with this, try to set delegate (data source) to `nil` in front of this operation.\n" +
-            " This is the source object value: \(object)\n" +
-            " This is the original delegate (data source) value: \(proxy.forwardToDelegate()!)\n" +
-            "Hint: Maybe delegate was already set in xib or storyboard and now it's being overwritten in code.\n")
-
-        proxy.setForwardToDelegate(forwardDelegate, retainDelegate: retainDelegate)
-
-        return Disposables.create {
-            MainScheduler.ensureRunningOnMainThread()
-
-            let delegate: AnyObject? = weakForwardDelegate
-
-            assert(delegate == nil || proxy._forwardToDelegate() === delegate, "Delegate was changed from time it was first set. Current \(String(describing: proxy.forwardToDelegate())), and it should have been \(proxy)")
-
-            proxy.setForwardToDelegate(nil, retainDelegate: retainDelegate)
-        }
-    }
-}
-
-
-// private extensions
-extension DelegateProxyType {
-    private static var factory: DelegateProxyFactory {
-        DelegateProxyFactory.sharedFactory(for: self)
-    }
-
-    private static func assignedProxy(for object: ParentObject) -> AnyObject? {
-        let maybeDelegate = objc_getAssociatedObject(object, self.identifier)
-        return castOptionalOrFatalError(maybeDelegate)
-    }
-
-    private static func assignProxy(_ proxy: AnyObject, toObject object: ParentObject) {
-        objc_setAssociatedObject(object, self.identifier, proxy, .OBJC_ASSOCIATION_RETAIN)
-    }
-}
-
-/// Describes an object that has a delegate.
-public protocol HasDelegate: AnyObject {
-    /// Delegate type
-    associatedtype Delegate
-
-    /// Delegate
-    var delegate: Delegate? { get set }
-}
-
-extension DelegateProxyType where ParentObject: HasDelegate, Self.Delegate == ParentObject.Delegate {
-    public static func currentDelegate(for object: ParentObject) -> Delegate? {
-        object.delegate
-    }
-
-    public static func setCurrentDelegate(_ delegate: Delegate?, to object: ParentObject) {
-        object.delegate = delegate
-    }
-}
-
-/// Describes an object that has a data source.
-public protocol HasDataSource: AnyObject {
-    /// Data source type
-    associatedtype DataSource
-
-    /// Data source
-    var dataSource: DataSource? { get set }
-}
-
-extension DelegateProxyType where ParentObject: HasDataSource, Self.Delegate == ParentObject.DataSource {
-    public static func currentDelegate(for object: ParentObject) -> Delegate? {
-        object.dataSource
-    }
-
-    public static func setCurrentDelegate(_ delegate: Delegate?, to object: ParentObject) {
-        object.dataSource = delegate
-    }
-}
-
-/// Describes an object that has a prefetch data source.
-@available(iOS 10.0, tvOS 10.0, *)
-public protocol HasPrefetchDataSource: AnyObject {
-    /// Prefetch data source type
-    associatedtype PrefetchDataSource
-
-    /// Prefetch data source
-    var prefetchDataSource: PrefetchDataSource? { get set }
-}
-
-@available(iOS 10.0, tvOS 10.0, *)
-extension DelegateProxyType where ParentObject: HasPrefetchDataSource, Self.Delegate == ParentObject.PrefetchDataSource {
-    public static func currentDelegate(for object: ParentObject) -> Delegate? {
-        object.prefetchDataSource
-    }
-
-    public static func setCurrentDelegate(_ delegate: Delegate?, to object: ParentObject) {
-        object.prefetchDataSource = delegate
-    }
-}
-
-    #if os(iOS) || os(tvOS)
-        import UIKit
-
-        extension ObservableType {
-            func subscribeProxyDataSource<DelegateProxy: DelegateProxyType>(ofObject object: DelegateProxy.ParentObject, dataSource: DelegateProxy.Delegate, retainDataSource: Bool, binding: @escaping (DelegateProxy, Event<Element>) -> Void)
-                -> Disposable
-                where DelegateProxy.ParentObject: UIView
-                , DelegateProxy.Delegate: AnyObject {
-                let proxy = DelegateProxy.proxy(for: object)
-                let unregisterDelegate = DelegateProxy.installForwardDelegate(dataSource, retainDelegate: retainDataSource, onProxyForObject: object)
-
-                // Do not perform layoutIfNeeded if the object is still not in the view heirarchy
-                if object.window != nil {
-                    // this is needed to flush any delayed old state (https://github.com/RxSwiftCommunity/RxDataSources/pull/75)
-                    object.layoutIfNeeded()
-                }
-
-                let subscription = self.asObservable()
-                    .observe(on:MainScheduler())
-                    .catch { error in
-                        bindingError(error)
-                        return Observable.empty()
-                    }
-                    // source can never end, otherwise it would release the subscriber, and deallocate the data source
-                    .concat(Observable.never())
-                    .take(until: object.rx.deallocated)
-                    .subscribe { [weak object] (event: Event<Element>) in
-
-                        if let object = object {
-                            assert(proxy === DelegateProxy.currentDelegate(for: object), "Proxy changed from the time it was first set.\nOriginal: \(proxy)\nExisting: \(String(describing: DelegateProxy.currentDelegate(for: object)))")
-                        }
-                        
-                        binding(proxy, event)
-                        
-                        switch event {
-                        case .error(let error):
-                            bindingError(error)
-                            unregisterDelegate.dispose()
-                        case .completed:
-                            unregisterDelegate.dispose()
-                        default:
-                            break
-                        }
-                    }
-                    
-                return Disposables.create { [weak object] in
-                    subscription.dispose()
-
-                    if object?.window != nil {
-                        object?.layoutIfNeeded()
-                    }
-
-                    unregisterDelegate.dispose()
-                }
-            }
-        }
-
-    #endif
-
-    /**
-
-     To add delegate proxy subclasses call `DelegateProxySubclass.register()` in `registerKnownImplementations` or in some other
-     part of your app that executes before using `rx.*` (e.g. appDidFinishLaunching).
-
-         class RxScrollViewDelegateProxy: DelegateProxy {
-             public static func registerKnownImplementations() {
-                 self.register { RxTableViewDelegateProxy(parentObject: $0) }
-         }
-         ...
-
-
-     */
-    private class DelegateProxyFactory {
-        private static var _sharedFactories: [UnsafeRawPointer: DelegateProxyFactory] = [:]
-
-        fileprivate static func sharedFactory<DelegateProxy: DelegateProxyType>(for proxyType: DelegateProxy.Type) -> DelegateProxyFactory {
-            MainScheduler.ensureRunningOnMainThread()
-            let identifier = DelegateProxy.identifier
-            if let factory = _sharedFactories[identifier] {
-                return factory
-            }
-            let factory = DelegateProxyFactory(for: proxyType)
-            _sharedFactories[identifier] = factory
-            DelegateProxy.registerKnownImplementations()
-            return factory
-        }
-
-        private var _factories: [ObjectIdentifier: ((AnyObject) -> AnyObject)]
-        private var _delegateProxyType: Any.Type
-        private var _identifier: UnsafeRawPointer
-
-        private init<DelegateProxy: DelegateProxyType>(for proxyType: DelegateProxy.Type) {
-            self._factories = [:]
-            self._delegateProxyType = proxyType
-            self._identifier = proxyType.identifier
-        }
-
-        fileprivate func extend<DelegateProxy: DelegateProxyType, ParentObject>(make: @escaping (ParentObject) -> DelegateProxy) {
-                MainScheduler.ensureRunningOnMainThread()
-                precondition(self._identifier == DelegateProxy.identifier, "Delegate proxy has inconsistent identifier")
-                guard self._factories[ObjectIdentifier(ParentObject.self)] == nil else {
-                    rxFatalError("The factory of \(ParentObject.self) is duplicated. DelegateProxy is not allowed of duplicated base object type.")
-                }
-                self._factories[ObjectIdentifier(ParentObject.self)] = { make(castOrFatalError($0)) }
-        }
-
-        fileprivate func createProxy(for object: AnyObject) -> AnyObject {
-            MainScheduler.ensureRunningOnMainThread()
-            var maybeMirror: Mirror? = Mirror(reflecting: object)
-            while let mirror = maybeMirror {
-                if let factory = self._factories[ObjectIdentifier(mirror.subjectType)] {
-                    return factory(object)
-                }
-                maybeMirror = mirror.superclassMirror
-            }
-            rxFatalError("DelegateProxy has no factory of \(object). Implement DelegateProxy subclass for \(object) first.")
-        }
-    }
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/Common/Infallible+Bind.swift b/Pods/RxCocoa/RxCocoa/Common/Infallible+Bind.swift
deleted file mode 100644
index 82c2922d6..000000000
--- a/Pods/RxCocoa/RxCocoa/Common/Infallible+Bind.swift
+++ /dev/null
@@ -1,148 +0,0 @@
-//
-//  Infallible+Bind.swift
-//  RxCocoa
-//
-//  Created by Shai Mishali on 27/08/2020.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-extension InfallibleType {
-    /**
-     Creates new subscription and sends elements to observer(s).
-     In this form, it's equivalent to the `subscribe` method, but it better conveys intent, and enables
-     writing more consistent binding code.
-     - parameter to: Observers to receives events.
-     - returns: Disposable object that can be used to unsubscribe the observers.
-     */
-    public func bind<Observer: ObserverType>(to observers: Observer...) -> Disposable where Observer.Element == Element {
-        self.subscribe { event in
-            observers.forEach { $0.on(event) }
-        }
-    }
-
-    /**
-     Creates new subscription and sends elements to observer(s).
-     In this form, it's equivalent to the `subscribe` method, but it better conveys intent, and enables
-     writing more consistent binding code.
-     - parameter to: Observers to receives events.
-     - returns: Disposable object that can be used to unsubscribe the observers.
-     */
-    public func bind<Observer: ObserverType>(to observers: Observer...) -> Disposable where Observer.Element == Element? {
-        self.map { $0 as Element? }
-            .subscribe { event in
-                observers.forEach { $0.on(event) }
-            }
-    }
-
-    /**
-    Subscribes to observable sequence using custom binder function.
-
-    - parameter to: Function used to bind elements from `self`.
-    - returns: Object representing subscription.
-    */
-    public func bind<Result>(to binder: (Self) -> Result) -> Result {
-        binder(self)
-    }
-
-    /**
-    Subscribes to observable sequence using custom binder function and final parameter passed to binder function
-    after `self` is passed.
-
-        public func bind<R1, R2>(to binder: Self -> R1 -> R2, curriedArgument: R1) -> R2 {
-            return binder(self)(curriedArgument)
-        }
-
-    - parameter to: Function used to bind elements from `self`.
-    - parameter curriedArgument: Final argument passed to `binder` to finish binding process.
-    - returns: Object representing subscription.
-    */
-    public func bind<R1, R2>(to binder: (Self) -> (R1) -> R2, curriedArgument: R1) -> R2 {
-        binder(self)(curriedArgument)
-    }
-
-    /**
-    Subscribes an element handler to an observable sequence.
-    In case error occurs in debug mode, `fatalError` will be raised.
-    In case error occurs in release mode, `error` will be logged.
-
-    - parameter onNext: Action to invoke for each element in the observable sequence.
-    - returns: Subscription object used to unsubscribe from the observable sequence.
-    */
-    public func bind(onNext: @escaping (Element) -> Void) -> Disposable {
-        self.subscribe(onNext: onNext)
-    }
-
-    /**
-    Creates new subscription and sends elements to `BehaviorRelay`.
-
-    - parameter relay: Target relay for sequence elements.
-    - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-    */
-    public func bind(to relays: BehaviorRelay<Element>...) -> Disposable {
-        return self.subscribe(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-     Creates new subscription and sends elements to `BehaviorRelay`.
-
-     - parameter relay: Target relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func bind(to relays: BehaviorRelay<Element?>...) -> Disposable {
-        return self.subscribe(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-    Creates new subscription and sends elements to `PublishRelay`.
-
-    - parameter relay: Target relay for sequence elements.
-    - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-    */
-    public func bind(to relays: PublishRelay<Element>...) -> Disposable {
-        return self.subscribe(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-     Creates new subscription and sends elements to `PublishRelay`.
-
-     - parameter relay: Target relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func bind(to relays: PublishRelay<Element?>...) -> Disposable {
-        return self.subscribe(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-    Creates new subscription and sends elements to `ReplayRelay`.
-
-    - parameter relay: Target relay for sequence elements.
-    - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-    */
-    public func bind(to relays: ReplayRelay<Element>...) -> Disposable {
-        return self.subscribe(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-     Creates new subscription and sends elements to `ReplayRelay`.
-
-     - parameter relay: Target relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func bind(to relays: ReplayRelay<Element?>...) -> Disposable {
-        return self.subscribe(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Common/Observable+Bind.swift b/Pods/RxCocoa/RxCocoa/Common/Observable+Bind.swift
deleted file mode 100644
index edded6b87..000000000
--- a/Pods/RxCocoa/RxCocoa/Common/Observable+Bind.swift
+++ /dev/null
@@ -1,103 +0,0 @@
-//
-//  Observable+Bind.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 8/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-extension ObservableType {
-    /**
-     Creates new subscription and sends elements to observer(s).
-     In this form, it's equivalent to the `subscribe` method, but it better conveys intent, and enables
-     writing more consistent binding code.
-     - parameter to: Observers to receives events.
-     - returns: Disposable object that can be used to unsubscribe the observers.
-     */
-    public func bind<Observer: ObserverType>(to observers: Observer...) -> Disposable where Observer.Element == Element {
-        self.subscribe { event in
-            observers.forEach { $0.on(event) }
-        }
-    }
-
-    /**
-     Creates new subscription and sends elements to observer(s).
-     In this form, it's equivalent to the `subscribe` method, but it better conveys intent, and enables
-     writing more consistent binding code.
-     - parameter to: Observers to receives events.
-     - returns: Disposable object that can be used to unsubscribe the observers.
-     */
-    public func bind<Observer: ObserverType>(to observers: Observer...) -> Disposable where Observer.Element == Element? {
-        self.map { $0 as Element? }
-            .subscribe { event in
-                observers.forEach { $0.on(event) }
-            }
-    }
-
-    /**
-    Subscribes to observable sequence using custom binder function.
-
-    - parameter to: Function used to bind elements from `self`.
-    - returns: Object representing subscription.
-    */
-    public func bind<Result>(to binder: (Self) -> Result) -> Result {
-        binder(self)
-    }
-
-    /**
-    Subscribes to observable sequence using custom binder function and final parameter passed to binder function
-    after `self` is passed.
-
-        public func bind<R1, R2>(to binder: Self -> R1 -> R2, curriedArgument: R1) -> R2 {
-            return binder(self)(curriedArgument)
-        }
-
-    - parameter to: Function used to bind elements from `self`.
-    - parameter curriedArgument: Final argument passed to `binder` to finish binding process.
-    - returns: Object representing subscription.
-    */
-    public func bind<R1, R2>(to binder: (Self) -> (R1) -> R2, curriedArgument: R1) -> R2 {
-        binder(self)(curriedArgument)
-    }
-    
-    /**
-    Subscribes an element handler to an observable sequence.
-    In case error occurs in debug mode, `fatalError` will be raised.
-    In case error occurs in release mode, `error` will be logged.
-
-     - Note: If `object` can't be retained, none of the other closures will be invoked.
-     
-    - parameter object: The object to provide an unretained reference on.
-    - parameter onNext: Action to invoke for each element in the observable sequence.
-    - returns: Subscription object used to unsubscribe from the observable sequence.
-    */
-    public func bind<Object: AnyObject>(
-        with object: Object,
-        onNext: @escaping (Object, Element) -> Void
-    ) -> Disposable {
-        self.subscribe(onNext: { [weak object] in
-            guard let object = object else { return }
-            onNext(object, $0)
-        },
-        onError: { error in
-            rxFatalErrorInDebug("Binding error: \(error)")
-        })
-    }
-    
-    /**
-    Subscribes an element handler to an observable sequence.
-    In case error occurs in debug mode, `fatalError` will be raised.
-    In case error occurs in release mode, `error` will be logged.
-
-    - parameter onNext: Action to invoke for each element in the observable sequence.
-    - returns: Subscription object used to unsubscribe from the observable sequence.
-    */
-    public func bind(onNext: @escaping (Element) -> Void) -> Disposable {
-        self.subscribe(onNext: onNext,
-                       onError: { error in
-                        rxFatalErrorInDebug("Binding error: \(error)")
-                       })
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Common/RxCocoaObjCRuntimeError+Extensions.swift b/Pods/RxCocoa/RxCocoa/Common/RxCocoaObjCRuntimeError+Extensions.swift
deleted file mode 100644
index 4abf8808c..000000000
--- a/Pods/RxCocoa/RxCocoa/Common/RxCocoaObjCRuntimeError+Extensions.swift
+++ /dev/null
@@ -1,161 +0,0 @@
-//
-//  RxCocoaObjCRuntimeError+Extensions.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 10/9/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if SWIFT_PACKAGE && !DISABLE_SWIZZLING && !os(Linux)
-    import RxCocoaRuntime
-#endif
-
-#if !DISABLE_SWIZZLING && !os(Linux)
-    /// RxCocoa ObjC runtime interception mechanism.
-    public enum RxCocoaInterceptionMechanism {
-        /// Unknown message interception mechanism.
-        case unknown
-        /// Key value observing interception mechanism.
-        case kvo
-    }
-
-    /// RxCocoa ObjC runtime modification errors.
-    public enum RxCocoaObjCRuntimeError
-        : Swift.Error
-        , CustomDebugStringConvertible {
-        /// Unknown error has occurred.
-        case unknown(target: AnyObject)
-
-        /**
-        If the object is reporting a different class then it's real class, that means that there is probably
-        already some interception mechanism in place or something weird is happening.
-
-        The most common case when this would happen is when using a combination of KVO (`observe`) and `sentMessage`.
-
-        This error is easily resolved by just using `sentMessage` observing before `observe`.
-
-        The reason why the other way around could create issues is because KVO will unregister it's interceptor
-        class and restore original class. Unfortunately that will happen no matter was there another interceptor
-        subclass registered in hierarchy or not.
-
-        Failure scenario:
-        * KVO sets class to be `__KVO__OriginalClass` (subclass of `OriginalClass`)
-        * `sentMessage` sets object class to be `_RX_namespace___KVO__OriginalClass` (subclass of `__KVO__OriginalClass`)
-        * then unobserving with KVO will restore class to be `OriginalClass` -> failure point (possibly a bug in KVO)
-
-        The reason why changing order of observing works is because any interception method on unregistration 
-        should return object's original real class (if that doesn't happen then it's really easy to argue that's a bug
-        in that interception mechanism).
-
-        This library won't remove registered interceptor even if there aren't any observers left because
-        it's highly unlikely it would have any benefit in real world use cases, and it's even more
-        dangerous.
-        */
-        case objectMessagesAlreadyBeingIntercepted(target: AnyObject, interceptionMechanism: RxCocoaInterceptionMechanism)
-
-        /// Trying to observe messages for selector that isn't implemented.
-        case selectorNotImplemented(target: AnyObject)
-
-        /// Core Foundation classes are usually toll free bridged. Those classes crash the program in case
-        /// `object_setClass` is performed on them.
-        ///
-        /// There is a possibility to just swizzle methods on original object, but since those won't be usual use
-        /// cases for this library, then an error will just be reported for now.
-        case cantInterceptCoreFoundationTollFreeBridgedObjects(target: AnyObject)
-
-        /// Two libraries have simultaneously tried to modify ObjC runtime and that was detected. This can only
-        /// happen in scenarios where multiple interception libraries are used.
-        ///
-        /// To synchronize other libraries intercepting messages for an object, use `synchronized` on target object and
-        /// it's meta-class.
-        case threadingCollisionWithOtherInterceptionMechanism(target: AnyObject)
-
-        /// For some reason saving original method implementation under RX namespace failed.
-        case savingOriginalForwardingMethodFailed(target: AnyObject)
-
-        /// Intercepting a sent message by replacing a method implementation with `_objc_msgForward` failed for some reason.
-        case replacingMethodWithForwardingImplementation(target: AnyObject)
-
-        /// Attempt to intercept one of the performance sensitive methods:
-        ///    * class
-        ///    * respondsToSelector:
-        ///    * methodSignatureForSelector:
-        ///    * forwardingTargetForSelector:
-        case observingPerformanceSensitiveMessages(target: AnyObject)
-
-        /// Message implementation has unsupported return type (for example large struct). The reason why this is a error
-        /// is because in some cases intercepting sent messages requires replacing implementation with `_objc_msgForward_stret`
-        /// instead of `_objc_msgForward`.
-        ///
-        /// The unsupported cases should be fairly uncommon.
-        case observingMessagesWithUnsupportedReturnType(target: AnyObject)
-    }
-
-    extension RxCocoaObjCRuntimeError {
-        /// A textual representation of `self`, suitable for debugging.
-        public var debugDescription: String {
-            switch self {
-            case let .unknown(target):
-                return "Unknown error occurred.\nTarget: `\(target)`"
-            case let .objectMessagesAlreadyBeingIntercepted(target, interceptionMechanism):
-                let interceptionMechanismDescription = interceptionMechanism == .kvo ? "KVO" : "other interception mechanism"
-                return "Collision between RxCocoa interception mechanism and \(interceptionMechanismDescription)."
-                    + " To resolve this conflict please use this interception mechanism first.\nTarget: \(target)"
-            case let .selectorNotImplemented(target):
-                return "Trying to observe messages for selector that isn't implemented.\nTarget: \(target)"
-            case let .cantInterceptCoreFoundationTollFreeBridgedObjects(target):
-                return "Interception of messages sent to Core Foundation isn't supported.\nTarget: \(target)"
-            case let .threadingCollisionWithOtherInterceptionMechanism(target):
-                return "Detected a conflict while modifying ObjC runtime.\nTarget: \(target)"
-            case let .savingOriginalForwardingMethodFailed(target):
-                return "Saving original method implementation failed.\nTarget: \(target)"
-            case let .replacingMethodWithForwardingImplementation(target):
-                return "Intercepting a sent message by replacing a method implementation with `_objc_msgForward` failed for some reason.\nTarget: \(target)"
-            case let .observingPerformanceSensitiveMessages(target):
-                return "Attempt to intercept one of the performance sensitive methods. \nTarget: \(target)"
-            case let .observingMessagesWithUnsupportedReturnType(target):
-                return "Attempt to intercept a method with unsupported return type. \nTarget: \(target)"
-            }
-        }
-    }
-    
-    // MARK: Conversions `NSError` > `RxCocoaObjCRuntimeError`
-
-    extension Error {
-        func rxCocoaErrorForTarget(_ target: AnyObject) -> RxCocoaObjCRuntimeError {
-            let error = self as NSError
-            
-            if error.domain == RXObjCRuntimeErrorDomain {
-                let errorCode = RXObjCRuntimeError(rawValue: error.code) ?? .unknown
-                
-                switch errorCode {
-                case .unknown:
-                    return .unknown(target: target)
-                case .objectMessagesAlreadyBeingIntercepted:
-                    let isKVO = (error.userInfo[RXObjCRuntimeErrorIsKVOKey] as? NSNumber)?.boolValue ?? false
-                    return .objectMessagesAlreadyBeingIntercepted(target: target, interceptionMechanism: isKVO ? .kvo : .unknown)
-                case .selectorNotImplemented:
-                    return .selectorNotImplemented(target: target)
-                case .cantInterceptCoreFoundationTollFreeBridgedObjects:
-                    return .cantInterceptCoreFoundationTollFreeBridgedObjects(target: target)
-                case .threadingCollisionWithOtherInterceptionMechanism:
-                    return .threadingCollisionWithOtherInterceptionMechanism(target: target)
-                case .savingOriginalForwardingMethodFailed:
-                    return .savingOriginalForwardingMethodFailed(target: target)
-                case .replacingMethodWithForwardingImplementation:
-                    return .replacingMethodWithForwardingImplementation(target: target)
-                case .observingPerformanceSensitiveMessages:
-                    return .observingPerformanceSensitiveMessages(target: target)
-                case .observingMessagesWithUnsupportedReturnType:
-                    return .observingMessagesWithUnsupportedReturnType(target: target)
-                @unknown default:
-                    fatalError("Unhandled Objective C Runtime Error")
-                }
-            }
-            
-            return RxCocoaObjCRuntimeError.unknown(target: target)
-        }
-    }
-
-#endif
-
diff --git a/Pods/RxCocoa/RxCocoa/Common/RxTarget.swift b/Pods/RxCocoa/RxCocoa/Common/RxTarget.swift
deleted file mode 100644
index 5a2c464b0..000000000
--- a/Pods/RxCocoa/RxCocoa/Common/RxTarget.swift
+++ /dev/null
@@ -1,43 +0,0 @@
-//
-//  RxTarget.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-import RxSwift
-
-class RxTarget : NSObject
-               , Disposable {
-    
-    private var retainSelf: RxTarget?
-    
-    override init() {
-        super.init()
-        self.retainSelf = self
-
-#if TRACE_RESOURCES
-        _ = Resources.incrementTotal()
-#endif
-
-#if DEBUG
-        MainScheduler.ensureRunningOnMainThread()
-#endif
-    }
-    
-    func dispose() {
-#if DEBUG
-        MainScheduler.ensureRunningOnMainThread()
-#endif
-        self.retainSelf = nil
-    }
-
-#if TRACE_RESOURCES
-    deinit {
-        _ = Resources.decrementTotal()
-    }
-#endif
-}
diff --git a/Pods/RxCocoa/RxCocoa/Common/SectionedViewDataSourceType.swift b/Pods/RxCocoa/RxCocoa/Common/SectionedViewDataSourceType.swift
deleted file mode 100644
index 5c3cf3ca4..000000000
--- a/Pods/RxCocoa/RxCocoa/Common/SectionedViewDataSourceType.swift
+++ /dev/null
@@ -1,20 +0,0 @@
-//
-//  SectionedViewDataSourceType.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 1/10/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-/// Data source with access to underlying sectioned model.
-public protocol SectionedViewDataSourceType {
-    /// Returns model at index path.
-    ///
-    /// In case data source doesn't contain any sections when this method is being called, `RxCocoaError.ItemsNotYetBound(object: self)` is thrown.
-
-    /// - parameter indexPath: Model index path
-    /// - returns: Model at index path.
-    func model(at indexPath: IndexPath) throws -> Any
-}
diff --git a/Pods/RxCocoa/RxCocoa/Common/TextInput.swift b/Pods/RxCocoa/RxCocoa/Common/TextInput.swift
deleted file mode 100644
index 2268882fa..000000000
--- a/Pods/RxCocoa/RxCocoa/Common/TextInput.swift
+++ /dev/null
@@ -1,78 +0,0 @@
-//
-//  TextInput.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 5/12/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-#if os(iOS) || os(tvOS)
-    import UIKit
-
-    /// Represents text input with reactive extensions.
-    public struct TextInput<Base: UITextInput> {
-        /// Base text input to extend.
-        public let base: Base
-
-        /// Reactive wrapper for `text` property.
-        public let text: ControlProperty<String?>
-
-        /// Initializes new text input.
-        ///
-        /// - parameter base: Base object.
-        /// - parameter text: Textual control property.
-        public init(base: Base, text: ControlProperty<String?>) {
-            self.base = base
-            self.text = text
-        }
-    }
-
-    extension Reactive where Base: UITextField {
-        /// Reactive text input.
-        public var textInput: TextInput<Base> {
-            return TextInput(base: base, text: self.text)
-        }
-    }
-
-    extension Reactive where Base: UITextView {
-        /// Reactive text input.
-        public var textInput: TextInput<Base> {
-            return TextInput(base: base, text: self.text)
-        }
-    }
-
-#endif
-
-#if os(macOS)
-    import Cocoa
-
-    /// Represents text input with reactive extensions.
-    public struct TextInput<Base: NSTextInputClient> {
-        /// Base text input to extend.
-        public let base: Base
-
-        /// Reactive wrapper for `text` property.
-        public let text: ControlProperty<String?>
-
-        /// Initializes new text input.
-        ///
-        /// - parameter base: Base object.
-        /// - parameter text: Textual control property.
-        public init(base: Base, text: ControlProperty<String?>) {
-            self.base = base
-            self.text = text
-        }
-    }
-
-    extension Reactive where Base: NSTextField, Base: NSTextInputClient {
-        /// Reactive text input.
-        public var textInput: TextInput<Base> {
-            return TextInput(base: self.base, text: self.text)
-        }
-    }
-
-#endif
-
-
diff --git a/Pods/RxCocoa/RxCocoa/Foundation/KVORepresentable+CoreGraphics.swift b/Pods/RxCocoa/RxCocoa/Foundation/KVORepresentable+CoreGraphics.swift
deleted file mode 100644
index 30026bf99..000000000
--- a/Pods/RxCocoa/RxCocoa/Foundation/KVORepresentable+CoreGraphics.swift
+++ /dev/null
@@ -1,68 +0,0 @@
-//
-//  KVORepresentable+CoreGraphics.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 11/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if !os(Linux)
-
-import RxSwift
-import CoreGraphics
-
-import Foundation
-
-#if arch(x86_64) || arch(arm64)
-	let CGRectType = "{CGRect={CGPoint=dd}{CGSize=dd}}"
-    let CGSizeType = "{CGSize=dd}"
-    let CGPointType = "{CGPoint=dd}"
-#elseif arch(i386) || arch(arm) || os(watchOS)
-    let CGRectType = "{CGRect={CGPoint=ff}{CGSize=ff}}"
-    let CGSizeType = "{CGSize=ff}"
-    let CGPointType = "{CGPoint=ff}"
-#endif
-
-extension CGRect : KVORepresentable {
-    public typealias KVOType = NSValue
-
-    /// Constructs self from `NSValue`.
-    public init?(KVOValue: KVOType) {
-        if strcmp(KVOValue.objCType, CGRectType) != 0 {
-            return nil
-        }
-        var typedValue = CGRect(x: 0, y: 0, width: 0, height: 0)
-        KVOValue.getValue(&typedValue)
-        self = typedValue
-    }
-}
-
-extension CGPoint : KVORepresentable {
-    public typealias KVOType = NSValue
-
-    /// Constructs self from `NSValue`.
-    public init?(KVOValue: KVOType) {
-        if strcmp(KVOValue.objCType, CGPointType) != 0 {
-            return nil
-        }
-        var typedValue = CGPoint(x: 0, y: 0)
-        KVOValue.getValue(&typedValue)
-        self = typedValue
-    }
-}
-
-extension CGSize : KVORepresentable {
-    public typealias KVOType = NSValue
-
-    /// Constructs self from `NSValue`.
-    public init?(KVOValue: KVOType) {
-        if strcmp(KVOValue.objCType, CGSizeType) != 0 {
-            return nil
-        }
-        var typedValue = CGSize(width: 0, height: 0)
-        KVOValue.getValue(&typedValue)
-        self = typedValue
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/Foundation/KVORepresentable+Swift.swift b/Pods/RxCocoa/RxCocoa/Foundation/KVORepresentable+Swift.swift
deleted file mode 100644
index 00d53dd09..000000000
--- a/Pods/RxCocoa/RxCocoa/Foundation/KVORepresentable+Swift.swift
+++ /dev/null
@@ -1,88 +0,0 @@
-//
-//  KVORepresentable+Swift.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 11/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-extension Int : KVORepresentable {
-    public typealias KVOType = NSNumber
-
-    /// Constructs `Self` using KVO value.
-    public init?(KVOValue: KVOType) {
-        self.init(KVOValue.int32Value)
-    }
-}
-
-extension Int32 : KVORepresentable {
-    public typealias KVOType = NSNumber
-
-    /// Constructs `Self` using KVO value.
-    public init?(KVOValue: KVOType) {
-        self.init(KVOValue.int32Value)
-    }
-}
-
-extension Int64 : KVORepresentable {
-    public typealias KVOType = NSNumber
-
-    /// Constructs `Self` using KVO value.
-    public init?(KVOValue: KVOType) {
-        self.init(KVOValue.int64Value)
-    }
-}
-
-extension UInt : KVORepresentable {
-    public typealias KVOType = NSNumber
-
-    /// Constructs `Self` using KVO value.
-    public init?(KVOValue: KVOType) {
-        self.init(KVOValue.uintValue)
-    }
-}
-
-extension UInt32 : KVORepresentable {
-    public typealias KVOType = NSNumber
-
-    /// Constructs `Self` using KVO value.
-    public init?(KVOValue: KVOType) {
-        self.init(KVOValue.uint32Value)
-    }
-}
-
-extension UInt64 : KVORepresentable {
-    public typealias KVOType = NSNumber
-
-    /// Constructs `Self` using KVO value.
-    public init?(KVOValue: KVOType) {
-        self.init(KVOValue.uint64Value)
-    }
-}
-
-extension Bool : KVORepresentable {
-    public typealias KVOType = NSNumber
-
-    /// Constructs `Self` using KVO value.
-    public init?(KVOValue: KVOType) {
-        self.init(KVOValue.boolValue)
-    }
-}
-
-
-extension RawRepresentable where RawValue: KVORepresentable {
-    /// Constructs `Self` using optional KVO value.
-    init?(KVOValue: RawValue.KVOType?) {
-        guard let KVOValue = KVOValue else {
-            return nil
-        }
-
-        guard let rawValue = RawValue(KVOValue: KVOValue) else {
-            return nil
-        }
-
-        self.init(rawValue: rawValue)
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Foundation/KVORepresentable.swift b/Pods/RxCocoa/RxCocoa/Foundation/KVORepresentable.swift
deleted file mode 100644
index be12b332f..000000000
--- a/Pods/RxCocoa/RxCocoa/Foundation/KVORepresentable.swift
+++ /dev/null
@@ -1,28 +0,0 @@
-//
-//  KVORepresentable.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 11/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Type that is KVO representable (KVO mechanism can be used to observe it).
-public protocol KVORepresentable {
-    /// Associated KVO type.
-    associatedtype KVOType
-
-    /// Constructs `Self` using KVO value.
-    init?(KVOValue: KVOType)
-}
-
-extension KVORepresentable {
-    /// Initializes `KVORepresentable` with optional value.
-    init?(KVOValue: KVOType?) {
-        guard let KVOValue = KVOValue else {
-            return nil
-        }
-
-        self.init(KVOValue: KVOValue)
-    }
-}
-
diff --git a/Pods/RxCocoa/RxCocoa/Foundation/NSObject+Rx+KVORepresentable.swift b/Pods/RxCocoa/RxCocoa/Foundation/NSObject+Rx+KVORepresentable.swift
deleted file mode 100644
index 1be5a212d..000000000
--- a/Pods/RxCocoa/RxCocoa/Foundation/NSObject+Rx+KVORepresentable.swift
+++ /dev/null
@@ -1,60 +0,0 @@
-//
-//  NSObject+Rx+KVORepresentable.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 11/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if !os(Linux)
-
-import Foundation
-import RxSwift
-
-/// Key value observing options
-public struct KeyValueObservingOptions: OptionSet {
-    /// Raw value
-    public let rawValue: UInt
-
-    public init(rawValue: UInt) {
-        self.rawValue = rawValue
-    }
-
-    /// Whether a sequence element should be sent to the observer immediately, before the subscribe method even returns.
-    public static let initial = KeyValueObservingOptions(rawValue: 1 << 0)
-    /// Whether to send updated values.
-    public static let new = KeyValueObservingOptions(rawValue: 1 << 1)
-}
-
-extension Reactive where Base: NSObject {
-
-    /**
-     Specialization of generic `observe` method.
-
-     This is a special overload because to observe values of some type (for example `Int`), first values of KVO type
-     need to be observed (`NSNumber`), and then converted to result type.
-
-     For more information take a look at `observe` method.
-     */
-    public func observe<Element: KVORepresentable>(_ type: Element.Type, _ keyPath: String, options: KeyValueObservingOptions = [.new, .initial], retainSelf: Bool = true) -> Observable<Element?> {
-        return self.observe(Element.KVOType.self, keyPath, options: options, retainSelf: retainSelf)
-            .map(Element.init)
-    }
-}
-
-#if !DISABLE_SWIZZLING && !os(Linux)
-    // KVO
-    extension Reactive where Base: NSObject {
-        /**
-        Specialization of generic `observeWeakly` method.
-
-        For more information take a look at `observeWeakly` method.
-        */
-        public func observeWeakly<Element: KVORepresentable>(_ type: Element.Type, _ keyPath: String, options: KeyValueObservingOptions = [.new, .initial]) -> Observable<Element?> {
-            return self.observeWeakly(Element.KVOType.self, keyPath, options: options)
-                .map(Element.init)
-        }
-    }
-#endif
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/Foundation/NSObject+Rx+RawRepresentable.swift b/Pods/RxCocoa/RxCocoa/Foundation/NSObject+Rx+RawRepresentable.swift
deleted file mode 100644
index 6e47cb243..000000000
--- a/Pods/RxCocoa/RxCocoa/Foundation/NSObject+Rx+RawRepresentable.swift
+++ /dev/null
@@ -1,52 +0,0 @@
-//
-//  NSObject+Rx+RawRepresentable.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 11/9/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if !os(Linux)
-
-import RxSwift
-
-import Foundation
-
-extension Reactive where Base: NSObject {
-    /**
-     Specialization of generic `observe` method.
-
-     This specialization first observes `KVORepresentable` value and then converts it to `RawRepresentable` value.
-     
-     It is useful for observing bridged ObjC enum values.
-
-     For more information take a look at `observe` method.
-     */
-    public func observe<Element: RawRepresentable>(_ type: Element.Type, _ keyPath: String, options: KeyValueObservingOptions = [.new, .initial], retainSelf: Bool = true) -> Observable<Element?> where Element.RawValue: KVORepresentable {
-        return self.observe(Element.RawValue.KVOType.self, keyPath, options: options, retainSelf: retainSelf)
-            .map(Element.init)
-    }
-}
-
-#if !DISABLE_SWIZZLING
-
-    // observeWeakly + RawRepresentable
-    extension Reactive where Base: NSObject {
-
-        /**
-         Specialization of generic `observeWeakly` method.
-
-         This specialization first observes `KVORepresentable` value and then converts it to `RawRepresentable` value.
-     
-         It is useful for observing bridged ObjC enum values.
-
-         For more information take a look at `observeWeakly` method.
-         */
-        public func observeWeakly<Element: RawRepresentable>(_ type: Element.Type, _ keyPath: String, options: KeyValueObservingOptions = [.new, .initial]) -> Observable<Element?> where Element.RawValue: KVORepresentable {
-            return self.observeWeakly(Element.RawValue.KVOType.self, keyPath, options: options)
-                .map(Element.init)
-        }
-    }
-#endif
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/Foundation/NSObject+Rx.swift b/Pods/RxCocoa/RxCocoa/Foundation/NSObject+Rx.swift
deleted file mode 100644
index 68affa722..000000000
--- a/Pods/RxCocoa/RxCocoa/Foundation/NSObject+Rx.swift
+++ /dev/null
@@ -1,569 +0,0 @@
-//
-//  NSObject+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 2/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if !os(Linux)
-
-import Foundation
-import RxSwift
-#if SWIFT_PACKAGE && !DISABLE_SWIZZLING && !os(Linux)
-    import RxCocoaRuntime
-#endif
-
-#if !DISABLE_SWIZZLING && !os(Linux)
-private var deallocatingSubjectTriggerContext: UInt8 = 0
-private var deallocatingSubjectContext: UInt8 = 0
-#endif
-private var deallocatedSubjectTriggerContext: UInt8 = 0
-private var deallocatedSubjectContext: UInt8 = 0
-
-#if !os(Linux)
-
-/**
-KVO is a tricky mechanism.
-
-When observing child in a ownership hierarchy, usually retaining observing target is wanted behavior.
-When observing parent in a ownership hierarchy, usually retaining target isn't wanter behavior.
-
-KVO with weak references is especially tricky. For it to work, some kind of swizzling is required.
-That can be done by
-    * replacing object class dynamically (like KVO does)
-    * by swizzling `dealloc` method on all instances for a class.
-    * some third method ...
-
-Both approaches can fail in certain scenarios:
-    * problems arise when swizzlers return original object class (like KVO does when nobody is observing)
-    * Problems can arise because replacing dealloc method isn't atomic operation (get implementation,
-    set implementation).
-
-Second approach is chosen. It can fail in case there are multiple libraries dynamically trying
-to replace dealloc method. In case that isn't the case, it should be ok.
-*/
-extension Reactive where Base: NSObject {
-
-
-    /**
-     Observes values on `keyPath` starting from `self` with `options` and retains `self` if `retainSelf` is set.
-
-     `observe` is just a simple and performant wrapper around KVO mechanism.
-
-     * it can be used to observe paths starting from `self` or from ancestors in ownership graph (`retainSelf = false`)
-     * it can be used to observe paths starting from descendants in ownership graph (`retainSelf = true`)
-     * the paths have to consist only of `strong` properties, otherwise you are risking crashing the system by not unregistering KVO observer before dealloc.
-
-     If support for weak properties is needed or observing arbitrary or unknown relationships in the
-     ownership tree, `observeWeakly` is the preferred option.
-
-     - parameter keyPath: Key path of property names to observe.
-     - parameter options: KVO mechanism notification options.
-     - parameter retainSelf: Retains self during observation if set `true`.
-     - returns: Observable sequence of objects on `keyPath`.
-     */
-    public func observe<Element>(_ type: Element.Type,
-                                 _ keyPath: String,
-                                 options: KeyValueObservingOptions = [.new, .initial],
-                                 retainSelf: Bool = true) -> Observable<Element?> {
-        KVOObservable(object: self.base, keyPath: keyPath, options: options, retainTarget: retainSelf).asObservable()
-    }
-
-    /**
-    Observes values at the provided key path using the provided options.
-
-     - parameter keyPath: A key path between the object and one of its properties.
-     - parameter options: Key-value observation options, defaults to `.new` and `.initial`.
-
-     - note: When the object is deallocated, a completion event is emitted.
-
-     - returns: An observable emitting value changes at the provided key path.
-    */
-    public func observe<Element>(_ keyPath: KeyPath<Base, Element>,
-                                 options: NSKeyValueObservingOptions = [.new, .initial]) -> Observable<Element> {
-        Observable<Element>.create { [weak base] observer in
-            let observation = base?.observe(keyPath, options: options) { obj, _ in
-                observer.on(.next(obj[keyPath: keyPath]))
-            }
-
-            return Disposables.create { observation?.invalidate() }
-        }
-        .take(until: base.rx.deallocated)
-    }
-}
-
-#endif
-
-#if !DISABLE_SWIZZLING && !os(Linux)
-// KVO
-extension Reactive where Base: NSObject {
-    /**
-     Observes values on `keyPath` starting from `self` with `options` and doesn't retain `self`.
-
-     It can be used in all cases where `observe` can be used and additionally
-
-     * because it won't retain observed target, it can be used to observe arbitrary object graph whose ownership relation is unknown
-     * it can be used to observe `weak` properties
-
-     **Since it needs to intercept object deallocation process it needs to perform swizzling of `dealloc` method on observed object.**
-
-     - parameter keyPath: Key path of property names to observe.
-     - parameter options: KVO mechanism notification options.
-     - returns: Observable sequence of objects on `keyPath`.
-     */
-    public func observeWeakly<Element>(_ type: Element.Type, _ keyPath: String, options: KeyValueObservingOptions = [.new, .initial]) -> Observable<Element?> {
-        return observeWeaklyKeyPathFor(self.base, keyPath: keyPath, options: options)
-            .map { n in
-                return n as? Element
-            }
-    }
-}
-#endif
-
-// Dealloc
-extension Reactive where Base: AnyObject {
-    
-    /**
-    Observable sequence of object deallocated events.
-    
-    After object is deallocated one `()` element will be produced and sequence will immediately complete.
-    
-    - returns: Observable sequence of object deallocated events.
-    */
-    public var deallocated: Observable<Void> {
-        return self.synchronized {
-            if let deallocObservable = objc_getAssociatedObject(self.base, &deallocatedSubjectContext) as? DeallocObservable {
-                return deallocObservable.subject
-            }
-
-            let deallocObservable = DeallocObservable()
-
-            objc_setAssociatedObject(self.base, &deallocatedSubjectContext, deallocObservable, .OBJC_ASSOCIATION_RETAIN_NONATOMIC)
-            return deallocObservable.subject
-        }
-    }
-
-#if !DISABLE_SWIZZLING && !os(Linux)
-
-    /**
-     Observable sequence of message arguments that completes when object is deallocated.
-     
-     Each element is produced before message is invoked on target object. `methodInvoked`
-     exists in case observing of invoked messages is needed.
-
-     In case an error occurs sequence will fail with `RxCocoaObjCRuntimeError`.
-     
-     In case some argument is `nil`, instance of `NSNull()` will be sent.
-
-     - returns: Observable sequence of arguments passed to `selector` method.
-     */
-    public func sentMessage(_ selector: Selector) -> Observable<[Any]> {
-        return self.synchronized {
-            // in case of dealloc selector replay subject behavior needs to be used
-            if selector == deallocSelector {
-                return self.deallocating.map { _ in [] }
-            }
-
-            do {
-                let proxy: MessageSentProxy = try self.registerMessageInterceptor(selector)
-                return proxy.messageSent.asObservable()
-            }
-            catch let e {
-                return Observable.error(e)
-            }
-        }
-    }
-
-    /**
-     Observable sequence of message arguments that completes when object is deallocated.
-
-     Each element is produced after message is invoked on target object. `sentMessage`
-     exists in case interception of sent messages before they were invoked is needed.
-
-     In case an error occurs sequence will fail with `RxCocoaObjCRuntimeError`.
-
-     In case some argument is `nil`, instance of `NSNull()` will be sent.
-
-     - returns: Observable sequence of arguments passed to `selector` method.
-     */
-    public func methodInvoked(_ selector: Selector) -> Observable<[Any]> {
-        return self.synchronized {
-            // in case of dealloc selector replay subject behavior needs to be used
-            if selector == deallocSelector {
-                return self.deallocated.map { _ in [] }
-            }
-
-
-            do {
-                let proxy: MessageSentProxy = try self.registerMessageInterceptor(selector)
-                return proxy.methodInvoked.asObservable()
-            }
-            catch let e {
-                return Observable.error(e)
-            }
-        }
-    }
-
-    /**
-    Observable sequence of object deallocating events.
-    
-    When `dealloc` message is sent to `self` one `()` element will be produced and after object is deallocated sequence
-    will immediately complete.
-     
-    In case an error occurs sequence will fail with `RxCocoaObjCRuntimeError`.
-    
-    - returns: Observable sequence of object deallocating events.
-    */
-    public var deallocating: Observable<()> {
-        return self.synchronized {
-            do {
-                let proxy: DeallocatingProxy = try self.registerMessageInterceptor(deallocSelector)
-                return proxy.messageSent.asObservable()
-            }
-            catch let e {
-                return Observable.error(e)
-            }
-        }
-    }
-
-    private func registerMessageInterceptor<T: MessageInterceptorSubject>(_ selector: Selector) throws -> T {
-        let rxSelector = RX_selector(selector)
-        let selectorReference = RX_reference_from_selector(rxSelector)
-
-        let subject: T
-        if let existingSubject = objc_getAssociatedObject(self.base, selectorReference) as? T {
-            subject = existingSubject
-        }
-        else {
-            subject = T()
-            objc_setAssociatedObject(
-                self.base,
-                selectorReference,
-                subject,
-                .OBJC_ASSOCIATION_RETAIN_NONATOMIC
-            )
-        }
-
-        if subject.isActive {
-            return subject
-        }
-
-        var error: NSError?
-        let targetImplementation = RX_ensure_observing(self.base, selector, &error)
-        if targetImplementation == nil {
-            throw error?.rxCocoaErrorForTarget(self.base) ?? RxCocoaError.unknown
-        }
-
-        subject.targetImplementation = targetImplementation!
-
-        return subject
-    }
-#endif
-}
-
-// MARK: Message interceptors
-
-#if !DISABLE_SWIZZLING && !os(Linux)
-
-    private protocol MessageInterceptorSubject: AnyObject {
-        init()
-
-        var isActive: Bool {
-            get
-        }
-
-        var targetImplementation: IMP { get set }
-    }
-
-    private final class DeallocatingProxy
-        : MessageInterceptorSubject
-        , RXDeallocatingObserver {
-        typealias Element = ()
-
-        let messageSent = ReplaySubject<()>.create(bufferSize: 1)
-
-        @objc var targetImplementation: IMP = RX_default_target_implementation()
-
-        var isActive: Bool {
-            return self.targetImplementation != RX_default_target_implementation()
-        }
-
-        init() {
-        }
-
-        @objc func deallocating() {
-            self.messageSent.on(.next(()))
-        }
-
-        deinit {
-            self.messageSent.on(.completed)
-        }
-    }
-
-    private final class MessageSentProxy
-        : MessageInterceptorSubject
-        , RXMessageSentObserver {
-        typealias Element = [AnyObject]
-
-        let messageSent = PublishSubject<[Any]>()
-        let methodInvoked = PublishSubject<[Any]>()
-
-        @objc var targetImplementation: IMP = RX_default_target_implementation()
-
-        var isActive: Bool {
-            return self.targetImplementation != RX_default_target_implementation()
-        }
-
-        init() {
-        }
-
-        @objc func messageSent(withArguments arguments: [Any]) {
-            self.messageSent.on(.next(arguments))
-        }
-
-        @objc func methodInvoked(withArguments arguments: [Any]) {
-            self.methodInvoked.on(.next(arguments))
-        }
-
-        deinit {
-            self.messageSent.on(.completed)
-            self.methodInvoked.on(.completed)
-        }
-    }
-
-#endif
-
-
-private final class DeallocObservable {
-    let subject = ReplaySubject<Void>.create(bufferSize:1)
-
-    init() {
-    }
-
-    deinit {
-        self.subject.on(.next(()))
-        self.subject.on(.completed)
-    }
-}
-
-// MARK: KVO
-
-#if !os(Linux)
-
-private protocol KVOObservableProtocol {
-    var target: AnyObject { get }
-    var keyPath: String { get }
-    var retainTarget: Bool { get }
-    var options: KeyValueObservingOptions { get }
-}
-
-private final class KVOObserver
-    : _RXKVOObserver
-    , Disposable {
-    typealias Callback = (Any?) -> Void
-
-    var retainSelf: KVOObserver?
-
-    init(parent: KVOObservableProtocol, callback: @escaping Callback) {
-        #if TRACE_RESOURCES
-            _ = Resources.incrementTotal()
-        #endif
-
-        super.init(target: parent.target, retainTarget: parent.retainTarget, keyPath: parent.keyPath, options: parent.options.nsOptions, callback: callback)
-        self.retainSelf = self
-    }
-
-    override func dispose() {
-        super.dispose()
-        self.retainSelf = nil
-    }
-
-    deinit {
-        #if TRACE_RESOURCES
-            _ = Resources.decrementTotal()
-        #endif
-    }
-}
-
-private final class KVOObservable<Element>
-    : ObservableType
-    , KVOObservableProtocol {
-    typealias Element = Element?
-
-    unowned var target: AnyObject
-    var strongTarget: AnyObject?
-
-    var keyPath: String
-    var options: KeyValueObservingOptions
-    var retainTarget: Bool
-
-    init(object: AnyObject, keyPath: String, options: KeyValueObservingOptions, retainTarget: Bool) {
-        self.target = object
-        self.keyPath = keyPath
-        self.options = options
-        self.retainTarget = retainTarget
-        if retainTarget {
-            self.strongTarget = object
-        }
-    }
-
-    func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element? {
-        let observer = KVOObserver(parent: self) { value in
-            if value as? NSNull != nil {
-                observer.on(.next(nil))
-                return
-            }
-            observer.on(.next(value as? Element))
-        }
-
-        return Disposables.create(with: observer.dispose)
-    }
-
-}
-
-private extension KeyValueObservingOptions {
-    var nsOptions: NSKeyValueObservingOptions {
-        var result: UInt = 0
-        if self.contains(.new) {
-            result |= NSKeyValueObservingOptions.new.rawValue
-        }
-        if self.contains(.initial) {
-            result |= NSKeyValueObservingOptions.initial.rawValue
-        }
-        
-        return NSKeyValueObservingOptions(rawValue: result)
-    }
-}
-
-#endif
-
-#if !DISABLE_SWIZZLING && !os(Linux)
-
-    private func observeWeaklyKeyPathFor(_ target: NSObject, keyPath: String, options: KeyValueObservingOptions) -> Observable<AnyObject?> {
-        let components = keyPath.components(separatedBy: ".").filter { $0 != "self" }
-
-        let observable = observeWeaklyKeyPathFor(target, keyPathSections: components, options: options)
-            .finishWithNilWhenDealloc(target)
-
-        if !options.isDisjoint(with: .initial) {
-            return observable
-        }
-        else {
-            return observable
-                .skip(1)
-        }
-    }
-
-    // This should work correctly
-    // Identifiers can't contain `,`, so the only place where `,` can appear
-    // is as a delimiter.
-    // This means there is `W` as element in an array of property attributes.
-    private func isWeakProperty(_ properyRuntimeInfo: String) -> Bool {
-        properyRuntimeInfo.range(of: ",W,") != nil
-    }
-
-    private extension ObservableType where Element == AnyObject? {
-        func finishWithNilWhenDealloc(_ target: NSObject)
-            -> Observable<AnyObject?> {
-                let deallocating = target.rx.deallocating
-
-                return deallocating
-                    .map { _ in
-                        return Observable.just(nil)
-                    }
-                    .startWith(self.asObservable())
-                    .switchLatest()
-        }
-    }
-
-    private func observeWeaklyKeyPathFor(
-        _ target: NSObject,
-        keyPathSections: [String],
-        options: KeyValueObservingOptions
-        ) -> Observable<AnyObject?> {
-
-        weak var weakTarget: AnyObject? = target
-
-        let propertyName = keyPathSections[0]
-        let remainingPaths = Array(keyPathSections[1..<keyPathSections.count])
-
-        let property = class_getProperty(object_getClass(target), propertyName)
-        if property == nil {
-            return Observable.error(RxCocoaError.invalidPropertyName(object: target, propertyName: propertyName))
-        }
-        let propertyAttributes = property_getAttributes(property!)
-
-        // should dealloc hook be in place if week property, or just create strong reference because it doesn't matter
-        let isWeak = isWeakProperty(propertyAttributes.map(String.init) ?? "")
-        let propertyObservable = KVOObservable(object: target, keyPath: propertyName, options: options.union(.initial), retainTarget: false) as KVOObservable<AnyObject>
-
-        // KVO recursion for value changes
-        return propertyObservable
-            .flatMapLatest { (nextTarget: AnyObject?) -> Observable<AnyObject?> in
-                if nextTarget == nil {
-                    return Observable.just(nil)
-                }
-                let nextObject = nextTarget! as? NSObject
-
-                let strongTarget: AnyObject? = weakTarget
-
-                if nextObject == nil {
-                    return Observable.error(RxCocoaError.invalidObjectOnKeyPath(object: nextTarget!, sourceObject: strongTarget ?? NSNull(), propertyName: propertyName))
-                }
-
-                // if target is alive, then send change
-                // if it's deallocated, don't send anything
-                if strongTarget == nil {
-                    return Observable.empty()
-                }
-
-                let nextElementsObservable = keyPathSections.count == 1
-                    ? Observable.just(nextTarget)
-                    : observeWeaklyKeyPathFor(nextObject!, keyPathSections: remainingPaths, options: options)
-                
-                if isWeak {
-                    return nextElementsObservable
-                        .finishWithNilWhenDealloc(nextObject!)
-                }
-                else {
-                    return nextElementsObservable
-                }
-        }
-    }
-#endif
-
-// MARK: Constants
-
-private let deallocSelector = NSSelectorFromString("dealloc")
-
-// MARK: AnyObject + Reactive
-
-extension Reactive where Base: AnyObject {
-    func synchronized<T>( _ action: () -> T) -> T {
-        objc_sync_enter(self.base)
-        let result = action()
-        objc_sync_exit(self.base)
-        return result
-    }
-}
-
-extension Reactive where Base: AnyObject {
-    /**
-     Helper to make sure that `Observable` returned from `createCachedObservable` is only created once.
-     This is important because there is only one `target` and `action` properties on `NSControl` or `UIBarButtonItem`.
-     */
-    func lazyInstanceObservable<T: AnyObject>(_ key: UnsafeRawPointer, createCachedObservable: () -> T) -> T {
-        if let value = objc_getAssociatedObject(self.base, key) {
-            return value as! T
-        }
-        
-        let observable = createCachedObservable()
-        
-        objc_setAssociatedObject(self.base, key, observable, .OBJC_ASSOCIATION_RETAIN_NONATOMIC)
-        
-        return observable
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/Foundation/NotificationCenter+Rx.swift b/Pods/RxCocoa/RxCocoa/Foundation/NotificationCenter+Rx.swift
deleted file mode 100644
index 30ffa2bfd..000000000
--- a/Pods/RxCocoa/RxCocoa/Foundation/NotificationCenter+Rx.swift
+++ /dev/null
@@ -1,31 +0,0 @@
-//
-//  NotificationCenter+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 5/2/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-import RxSwift
-
-extension Reactive where Base: NotificationCenter {
-    /**
-    Transforms notifications posted to notification center to observable sequence of notifications.
-    
-    - parameter name: Optional name used to filter notifications.
-    - parameter object: Optional object used to filter notifications.
-    - returns: Observable sequence of posted notifications.
-    */
-    public func notification(_ name: Notification.Name?, object: AnyObject? = nil) -> Observable<Notification> {
-        return Observable.create { [weak object] observer in
-            let nsObserver = self.base.addObserver(forName: name, object: object, queue: nil) { notification in
-                observer.on(.next(notification))
-            }
-            
-            return Disposables.create {
-                self.base.removeObserver(nsObserver)
-            }
-        }
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Foundation/URLSession+Rx.swift b/Pods/RxCocoa/RxCocoa/Foundation/URLSession+Rx.swift
deleted file mode 100644
index 93e65ccf8..000000000
--- a/Pods/RxCocoa/RxCocoa/Foundation/URLSession+Rx.swift
+++ /dev/null
@@ -1,240 +0,0 @@
-//
-//  URLSession+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 3/23/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-import RxSwift
-
-#if canImport(FoundationNetworking)
-import FoundationNetworking
-#endif
-
-/// RxCocoa URL errors.
-public enum RxCocoaURLError
-    : Swift.Error {
-    /// Unknown error occurred.
-    case unknown
-    /// Response is not NSHTTPURLResponse
-    case nonHTTPResponse(response: URLResponse)
-    /// Response is not successful. (not in `200 ..< 300` range)
-    case httpRequestFailed(response: HTTPURLResponse, data: Data?)
-    /// Deserialization error.
-    case deserializationError(error: Swift.Error)
-}
-
-extension RxCocoaURLError
-    : CustomDebugStringConvertible {
-    /// A textual representation of `self`, suitable for debugging.
-    public var debugDescription: String {
-        switch self {
-        case .unknown:
-            return "Unknown error has occurred."
-        case let .nonHTTPResponse(response):
-            return "Response is not NSHTTPURLResponse `\(response)`."
-        case let .httpRequestFailed(response, _):
-            return "HTTP request failed with `\(response.statusCode)`."
-        case let .deserializationError(error):
-            return "Error during deserialization of the response: \(error)"
-        }
-    }
-}
-
-private func escapeTerminalString(_ value: String) -> String {
-    return value.replacingOccurrences(of: "\"", with: "\\\"", options:[], range: nil)
-}
-
-private func convertURLRequestToCurlCommand(_ request: URLRequest) -> String {
-    let method = request.httpMethod ?? "GET"
-    var returnValue = "curl -X \(method) "
-
-    if let httpBody = request.httpBody {
-        let maybeBody = String(data: httpBody, encoding: String.Encoding.utf8)
-        if let body = maybeBody {
-            returnValue += "-d \"\(escapeTerminalString(body))\" "
-        }
-    }
-
-    for (key, value) in request.allHTTPHeaderFields ?? [:] {
-        let escapedKey = escapeTerminalString(key as String)
-        let escapedValue = escapeTerminalString(value as String)
-        returnValue += "\n    -H \"\(escapedKey): \(escapedValue)\" "
-    }
-
-    let URLString = request.url?.absoluteString ?? "<unknown url>"
-
-    returnValue += "\n\"\(escapeTerminalString(URLString))\""
-
-    returnValue += " -i -v"
-
-    return returnValue
-}
-
-private func convertResponseToString(_ response: URLResponse?, _ error: NSError?, _ interval: TimeInterval) -> String {
-    let ms = Int(interval * 1000)
-
-    if let response = response as? HTTPURLResponse {
-        if 200 ..< 300 ~= response.statusCode {
-            return "Success (\(ms)ms): Status \(response.statusCode)"
-        }
-        else {
-            return "Failure (\(ms)ms): Status \(response.statusCode)"
-        }
-    }
-
-    if let error = error {
-        if error.domain == NSURLErrorDomain && error.code == NSURLErrorCancelled {
-            return "Canceled (\(ms)ms)"
-        }
-        return "Failure (\(ms)ms): NSError > \(error)"
-    }
-
-    return "<Unhandled response from server>"
-}
-
-extension Reactive where Base: URLSession {
-    /**
-    Observable sequence of responses for URL request.
-    
-    Performing of request starts after observer is subscribed and not after invoking this method.
-    
-    **URL requests will be performed per subscribed observer.**
-    
-    Any error during fetching of the response will cause observed sequence to terminate with error.
-    
-    - parameter request: URL request.
-    - returns: Observable sequence of URL responses.
-    */
-    public func response(request: URLRequest) -> Observable<(response: HTTPURLResponse, data: Data)> {
-        return Observable.create { observer in
-
-            // smart compiler should be able to optimize this out
-            let d: Date?
-
-            if URLSession.rx.shouldLogRequest(request) {
-                d = Date()
-            }
-            else {
-               d = nil
-            }
-
-            let task = self.base.dataTask(with: request) { data, response, error in
-
-                if URLSession.rx.shouldLogRequest(request) {
-                    let interval = Date().timeIntervalSince(d ?? Date())
-                    print(convertURLRequestToCurlCommand(request))
-                    #if os(Linux)
-                        print(convertResponseToString(response, error.flatMap { $0 as NSError }, interval))
-                    #else
-                        print(convertResponseToString(response, error.map { $0 as NSError }, interval))
-                    #endif
-                }
-                
-                guard let response = response, let data = data else {
-                    observer.on(.error(error ?? RxCocoaURLError.unknown))
-                    return
-                }
-
-                guard let httpResponse = response as? HTTPURLResponse else {
-                    observer.on(.error(RxCocoaURLError.nonHTTPResponse(response: response)))
-                    return
-                }
-
-                observer.on(.next((httpResponse, data)))
-                observer.on(.completed)
-            }
-
-            task.resume()
-
-            return Disposables.create(with: task.cancel)
-        }
-    }
-
-    /**
-    Observable sequence of response data for URL request.
-    
-    Performing of request starts after observer is subscribed and not after invoking this method.
-    
-    **URL requests will be performed per subscribed observer.**
-    
-    Any error during fetching of the response will cause observed sequence to terminate with error.
-    
-    If response is not HTTP response with status code in the range of `200 ..< 300`, sequence
-    will terminate with `(RxCocoaErrorDomain, RxCocoaError.NetworkError)`.
-    
-    - parameter request: URL request.
-    - returns: Observable sequence of response data.
-    */
-    public func data(request: URLRequest) -> Observable<Data> {
-        return self.response(request: request).map { pair -> Data in
-            if 200 ..< 300 ~= pair.0.statusCode {
-                return pair.1
-            }
-            else {
-                throw RxCocoaURLError.httpRequestFailed(response: pair.0, data: pair.1)
-            }
-        }
-    }
-
-    /**
-    Observable sequence of response JSON for URL request.
-    
-    Performing of request starts after observer is subscribed and not after invoking this method.
-    
-    **URL requests will be performed per subscribed observer.**
-    
-    Any error during fetching of the response will cause observed sequence to terminate with error.
-    
-    If response is not HTTP response with status code in the range of `200 ..< 300`, sequence
-    will terminate with `(RxCocoaErrorDomain, RxCocoaError.NetworkError)`.
-    
-    If there is an error during JSON deserialization observable sequence will fail with that error.
-    
-    - parameter request: URL request.
-    - returns: Observable sequence of response JSON.
-    */
-    public func json(request: URLRequest, options: JSONSerialization.ReadingOptions = []) -> Observable<Any> {
-        return self.data(request: request).map { data -> Any in
-            do {
-                return try JSONSerialization.jsonObject(with: data, options: options)
-            } catch let error {
-                throw RxCocoaURLError.deserializationError(error: error)
-            }
-        }
-    }
-
-    /**
-    Observable sequence of response JSON for GET request with `URL`.
-     
-    Performing of request starts after observer is subscribed and not after invoking this method.
-    
-    **URL requests will be performed per subscribed observer.**
-    
-    Any error during fetching of the response will cause observed sequence to terminate with error.
-    
-    If response is not HTTP response with status code in the range of `200 ..< 300`, sequence
-    will terminate with `(RxCocoaErrorDomain, RxCocoaError.NetworkError)`.
-    
-    If there is an error during JSON deserialization observable sequence will fail with that error.
-    
-    - parameter url: URL of `NSURLRequest` request.
-    - returns: Observable sequence of response JSON.
-    */
-    public func json(url: Foundation.URL) -> Observable<Any> {
-        self.json(request: URLRequest(url: url))
-    }
-}
-
-extension Reactive where Base == URLSession {
-    /// Log URL requests to standard output in curl format.
-    public static var shouldLogRequest: (URLRequest) -> Bool = { _ in
-        #if DEBUG
-            return true
-        #else
-            return false
-        #endif
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Runtime/_RX.m b/Pods/RxCocoa/RxCocoa/Runtime/_RX.m
deleted file mode 100644
index cffbfbcce..000000000
--- a/Pods/RxCocoa/RxCocoa/Runtime/_RX.m
+++ /dev/null
@@ -1,10 +0,0 @@
-//
-//  _RX.m
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import "include/_RX.h"
-
diff --git a/Pods/RxCocoa/RxCocoa/Runtime/_RXDelegateProxy.m b/Pods/RxCocoa/RxCocoa/Runtime/_RXDelegateProxy.m
deleted file mode 100644
index 36338a575..000000000
--- a/Pods/RxCocoa/RxCocoa/Runtime/_RXDelegateProxy.m
+++ /dev/null
@@ -1,147 +0,0 @@
-//
-//  _RXDelegateProxy.m
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/4/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import "include/_RXDelegateProxy.h"
-#import "include/_RX.h"
-#import "include/_RXObjCRuntime.h"
-
-@interface _RXDelegateProxy () {
-    id __weak __forwardToDelegate;
-}
-
-@property (nonatomic, strong) id strongForwardDelegate;
-
-@end
-
-static NSMutableDictionary *voidSelectorsPerClass = nil;
-
-@implementation _RXDelegateProxy
-
-+(NSSet*)collectVoidSelectorsForProtocol:(Protocol *)protocol {
-    NSMutableSet *selectors = [NSMutableSet set];
-
-    unsigned int protocolMethodCount = 0;
-    struct objc_method_description *pMethods = protocol_copyMethodDescriptionList(protocol, NO, YES, &protocolMethodCount);
-
-    for (unsigned int i = 0; i < protocolMethodCount; ++i) {
-        struct objc_method_description method = pMethods[i];
-        if (RX_is_method_with_description_void(method)) {
-            [selectors addObject:SEL_VALUE(method.name)];
-        }
-    }
-            
-    free(pMethods);
-
-    unsigned int numberOfBaseProtocols = 0;
-    Protocol * __unsafe_unretained * pSubprotocols = protocol_copyProtocolList(protocol, &numberOfBaseProtocols);
-
-    for (unsigned int i = 0; i < numberOfBaseProtocols; ++i) {
-        [selectors unionSet:[self collectVoidSelectorsForProtocol:pSubprotocols[i]]];
-    }
-    
-    free(pSubprotocols);
-
-    return selectors;
-}
-
-+(void)initialize {
-    @synchronized (_RXDelegateProxy.class) {
-        if (voidSelectorsPerClass == nil) {
-            voidSelectorsPerClass = [[NSMutableDictionary alloc] init];
-        }
-
-        NSMutableSet *voidSelectors = [NSMutableSet set];
-
-#define CLASS_HIERARCHY_MAX_DEPTH 100
-
-        NSInteger  classHierarchyDepth = 0;
-        Class      targetClass         = NULL;
-
-        for (classHierarchyDepth = 0, targetClass = self;
-             classHierarchyDepth < CLASS_HIERARCHY_MAX_DEPTH && targetClass != nil;
-             ++classHierarchyDepth, targetClass = class_getSuperclass(targetClass)
-        ) {
-            unsigned int count;
-            Protocol *__unsafe_unretained *pProtocols = class_copyProtocolList(targetClass, &count);
-            
-            for (unsigned int i = 0; i < count; i++) {
-                NSSet *selectorsForProtocol = [self collectVoidSelectorsForProtocol:pProtocols[i]];
-                [voidSelectors unionSet:selectorsForProtocol];
-            }
-            
-            free(pProtocols);
-        }
-
-        if (classHierarchyDepth == CLASS_HIERARCHY_MAX_DEPTH) {
-            NSLog(@"Detected weird class hierarchy with depth over %d. Starting with this class -> %@", CLASS_HIERARCHY_MAX_DEPTH, self);
-#if DEBUG
-            abort();
-#endif
-        }
-        
-        voidSelectorsPerClass[CLASS_VALUE(self)] = voidSelectors;
-    }
-}
-
--(id)_forwardToDelegate {
-    return __forwardToDelegate;
-}
-
--(void)_setForwardToDelegate:(id __nullable)forwardToDelegate retainDelegate:(BOOL)retainDelegate {
-    __forwardToDelegate = forwardToDelegate;
-    if (retainDelegate) {
-        self.strongForwardDelegate = forwardToDelegate;
-    }
-    else {
-        self.strongForwardDelegate = nil;
-    }
-}
-
--(BOOL)hasWiredImplementationForSelector:(SEL)selector {
-    return [super respondsToSelector:selector];
-}
-
--(BOOL)voidDelegateMethodsContain:(SEL)selector {
-    @synchronized(_RXDelegateProxy.class) {
-        NSSet *voidSelectors = voidSelectorsPerClass[CLASS_VALUE(self.class)];
-        NSAssert(voidSelectors != nil, @"Set of allowed methods not initialized");
-        return [voidSelectors containsObject:SEL_VALUE(selector)];
-    }
-}
-
--(void)forwardInvocation:(NSInvocation *)anInvocation {
-    BOOL isVoid = RX_is_method_signature_void(anInvocation.methodSignature);
-    NSArray *arguments = nil;
-    if (isVoid) {
-        arguments = RX_extract_arguments(anInvocation);
-        [self _sentMessage:anInvocation.selector withArguments:arguments];
-    }
-    
-    if (self._forwardToDelegate && [self._forwardToDelegate respondsToSelector:anInvocation.selector]) {
-        [anInvocation invokeWithTarget:self._forwardToDelegate];
-    }
-
-    if (isVoid) {
-        [self _methodInvoked:anInvocation.selector withArguments:arguments];
-    }
-}
-
-// abstract method
--(void)_sentMessage:(SEL)selector withArguments:(NSArray *)arguments {
-
-}
-
-// abstract method
--(void)_methodInvoked:(SEL)selector withArguments:(NSArray *)arguments {
-
-}
-
--(void)dealloc {
-}
-
-@end
diff --git a/Pods/RxCocoa/RxCocoa/Runtime/_RXKVOObserver.m b/Pods/RxCocoa/RxCocoa/Runtime/_RXKVOObserver.m
deleted file mode 100644
index fc8fb75c1..000000000
--- a/Pods/RxCocoa/RxCocoa/Runtime/_RXKVOObserver.m
+++ /dev/null
@@ -1,54 +0,0 @@
-//
-//  _RXKVOObserver.m
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/11/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import "include/_RXKVOObserver.h"
-
-@interface _RXKVOObserver ()
-
-@property (nonatomic, unsafe_unretained) id            target;
-@property (nonatomic, strong           ) id            retainedTarget;
-@property (nonatomic, copy             ) NSString     *keyPath;
-@property (nonatomic, copy             ) void (^callback)(id);
-
-@end
-
-@implementation _RXKVOObserver
-
--(instancetype)initWithTarget:(id)target
-                 retainTarget:(BOOL)retainTarget
-                      keyPath:(NSString*)keyPath
-                      options:(NSKeyValueObservingOptions)options
-                     callback:(void (^)(id))callback {
-    self = [super init];
-    if (!self) return nil;
-    
-    self.target = target;
-    if (retainTarget) {
-        self.retainedTarget = target;
-    }
-    self.keyPath = keyPath;
-    self.callback = callback;
-    
-    [self.target addObserver:self forKeyPath:self.keyPath options:options context:nil];
-    
-    return self;
-}
-
--(void)observeValueForKeyPath:(NSString *)keyPath ofObject:(id)object change:(NSDictionary *)change context:(void *)context {
-    @synchronized(self) {
-        self.callback(change[NSKeyValueChangeNewKey]);
-    }
-}
-
--(void)dispose {
-    [self.target removeObserver:self forKeyPath:self.keyPath context:nil];
-    self.target = nil;
-    self.retainedTarget = nil;
-}
-
-@end
diff --git a/Pods/RxCocoa/RxCocoa/Runtime/_RXObjCRuntime.m b/Pods/RxCocoa/RxCocoa/Runtime/_RXObjCRuntime.m
deleted file mode 100644
index 2e685aaa7..000000000
--- a/Pods/RxCocoa/RxCocoa/Runtime/_RXObjCRuntime.m
+++ /dev/null
@@ -1,1062 +0,0 @@
-//
-//  _RXObjCRuntime.m
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/11/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import <pthread.h>
-#import <Foundation/Foundation.h>
-#import <objc/runtime.h>
-#import <objc/message.h>
-#import <libkern/OSAtomic.h>
-#import <stdatomic.h>
-
-#import "include/_RX.h"
-#import "include/_RXObjCRuntime.h"
-
-// self + cmd
-#define HIDDEN_ARGUMENT_COUNT   2
-
-#if !DISABLE_SWIZZLING
-
-#define NSErrorParam NSError *__autoreleasing __nullable * __nullable
-
-@class RXObjCRuntime;
-
-BOOL RXAbortOnThreadingHazard = NO;
-
-typedef NSInvocation       *NSInvocationRef;
-typedef NSMethodSignature  *NSMethodSignatureRef;
-typedef unsigned char       rx_uchar;
-typedef unsigned short      rx_ushort;
-typedef unsigned int        rx_uint;
-typedef unsigned long       rx_ulong;
-typedef id (^rx_block)(id);
-typedef BOOL (^RXInterceptWithOptimizedObserver)(RXObjCRuntime * __nonnull self, Class __nonnull class, SEL __nonnull selector, NSErrorParam error);
-
-static CFTypeID  defaultTypeID;
-static SEL       deallocSelector;
-
-static int RxSwizzlingTargetClassKey = 0;
-
-#if TRACE_RESOURCES
-_Atomic static int32_t numberOInterceptedMethods = 0;
-_Atomic static int32_t numberOfForwardedMethods = 0;
-#endif
-
-#define THREADING_HAZARD(class) \
-    NSLog(@"There was a problem swizzling on `%@`.\nYou have probably two libraries performing swizzling in runtime.\nWe didn't want to crash your program, but this is not good ...\nYou an solve this problem by either not using swizzling in this library, removing one of those other libraries, or making sure that swizzling parts are synchronized (only perform them on main thread).\nAnd yes, this message will self destruct when you clear the console, and since it's non deterministic, the problem could still exist and it will be hard for you to reproduce it.", NSStringFromClass(class)); ABORT_IN_DEBUG if (RXAbortOnThreadingHazard) { abort(); }
-
-#define ALWAYS(condition, message) if (!(condition)) { [NSException raise:@"RX Invalid Operator" format:@"%@", message]; }
-#define ALWAYS_WITH_INFO(condition, message) NSAssert((condition), @"%@ [%@] > %@", NSStringFromClass(class), NSStringFromSelector(selector), (message))
-#define C_ALWAYS(condition, message) NSCAssert((condition), @"%@ [%@] > %@", NSStringFromClass(class), NSStringFromSelector(selector), (message))
-
-#define RX_PREFIX @"_RX_namespace_"
-
-#define RX_ARG_id(value)           ((value) ?: [NSNull null])
-#define RX_ARG_char(value)         [NSNumber numberWithChar:value]
-#define RX_ARG_short(value)        [NSNumber numberWithShort:value]
-#define RX_ARG_int(value)          [NSNumber numberWithInt:value]
-#define RX_ARG_long(value)         [NSNumber numberWithLong:value]
-#define RX_ARG_BOOL(value)         [NSNumber numberWithBool:value]
-#define RX_ARG_SEL(value)          [NSNumber valueWithPointer:value]
-#define RX_ARG_rx_uchar(value)     [NSNumber numberWithUnsignedInt:value]
-#define RX_ARG_rx_ushort(value)    [NSNumber numberWithUnsignedInt:value]
-#define RX_ARG_rx_uint(value)      [NSNumber numberWithUnsignedInt:value]
-#define RX_ARG_rx_ulong(value)     [NSNumber numberWithUnsignedLong:value]
-#define RX_ARG_rx_block(value)     ((id)(value) ?: [NSNull null])
-#define RX_ARG_float(value)        [NSNumber numberWithFloat:value]
-#define RX_ARG_double(value)       [NSNumber numberWithDouble:value]
-
-typedef struct supported_type {
-    const char *encoding;
-} supported_type_t;
-
-static supported_type_t supported_types[] = {
-    { .encoding = @encode(void)},
-    { .encoding = @encode(id)},
-    { .encoding = @encode(Class)},
-    { .encoding = @encode(void (^)(void))},
-    { .encoding = @encode(char)},
-    { .encoding = @encode(short)},
-    { .encoding = @encode(int)},
-    { .encoding = @encode(long)},
-    { .encoding = @encode(long long)},
-    { .encoding = @encode(unsigned char)},
-    { .encoding = @encode(unsigned short)},
-    { .encoding = @encode(unsigned int)},
-    { .encoding = @encode(unsigned long)},
-    { .encoding = @encode(unsigned long long)},
-    { .encoding = @encode(float)},
-    { .encoding = @encode(double)},
-    { .encoding = @encode(BOOL)},
-    { .encoding = @encode(const char*)},
-};
-
-NSString * __nonnull const RXObjCRuntimeErrorDomain   = @"RXObjCRuntimeErrorDomain";
-NSString * __nonnull const RXObjCRuntimeErrorIsKVOKey = @"RXObjCRuntimeErrorIsKVOKey";
-
-BOOL RX_return_type_is_supported(const char *type) {
-    if (type == nil) {
-        return NO;
-    }
-
-    for (int i = 0; i < sizeof(supported_types) / sizeof(supported_type_t); ++i) {
-        if (supported_types[i].encoding[0] != type[0]) {
-            continue;
-        }
-        if (strcmp(supported_types[i].encoding, type) == 0) {
-            return YES;
-        }
-    }
-
-    return NO;
-}
-
-static BOOL RX_method_has_supported_return_type(Method method) {
-    const char *rawEncoding = method_getTypeEncoding(method);
-    ALWAYS(rawEncoding != nil, @"Example encoding method is nil.");
-
-    NSMethodSignature *methodSignature = [NSMethodSignature signatureWithObjCTypes:rawEncoding];
-    ALWAYS(methodSignature != nil, @"Method signature method is nil.");
-
-    return RX_return_type_is_supported(methodSignature.methodReturnType);
-}
-
-SEL __nonnull RX_selector(SEL __nonnull selector) {
-    NSString *selectorString = NSStringFromSelector(selector);
-    return NSSelectorFromString([RX_PREFIX stringByAppendingString:selectorString]);
-}
-
-#endif
-
-BOOL RX_is_method_signature_void(NSMethodSignature * __nonnull methodSignature) {
-    const char *methodReturnType = methodSignature.methodReturnType;
-    return strcmp(methodReturnType, @encode(void)) == 0;
-}
-
-BOOL RX_is_method_with_description_void(struct objc_method_description method) {
-    return strncmp(method.types, @encode(void), 1) == 0;
-}
-
-id __nonnull RX_extract_argument_at_index(NSInvocation * __nonnull invocation, NSUInteger index) {
-    const char *argumentType = [invocation.methodSignature getArgumentTypeAtIndex:index];
-    
-#define RETURN_VALUE(type) \
-    else if (strcmp(argumentType, @encode(type)) == 0) {\
-        type val = 0; \
-        [invocation getArgument:&val atIndex:index]; \
-        return @(val); \
-    }
-
-    // Skip const type qualifier.
-    if (argumentType[0] == 'r') {
-        argumentType++;
-    }
-    
-    if (strcmp(argumentType, @encode(id)) == 0
-        || strcmp(argumentType, @encode(Class)) == 0
-        || strcmp(argumentType, @encode(void (^)(void))) == 0
-    ) {
-        __unsafe_unretained id argument = nil;
-        [invocation getArgument:&argument atIndex:index];
-        return argument;
-    }
-    RETURN_VALUE(char)
-    RETURN_VALUE(short)
-    RETURN_VALUE(int)
-    RETURN_VALUE(long)
-    RETURN_VALUE(long long)
-    RETURN_VALUE(unsigned char)
-    RETURN_VALUE(unsigned short)
-    RETURN_VALUE(unsigned int)
-    RETURN_VALUE(unsigned long)
-    RETURN_VALUE(unsigned long long)
-    RETURN_VALUE(float)
-    RETURN_VALUE(double)
-    RETURN_VALUE(BOOL)
-    RETURN_VALUE(const char *)
-    else {
-        NSUInteger size = 0;
-        NSGetSizeAndAlignment(argumentType, &size, NULL);
-        NSCParameterAssert(size > 0);
-        uint8_t data[size];
-        [invocation getArgument:&data atIndex:index];
-        
-        return [NSValue valueWithBytes:&data objCType:argumentType];
-    }
-}
-
-NSArray *RX_extract_arguments(NSInvocation *invocation) {
-    NSUInteger numberOfArguments = invocation.methodSignature.numberOfArguments;
-    NSUInteger numberOfVisibleArguments = numberOfArguments - HIDDEN_ARGUMENT_COUNT;
-    
-    NSCParameterAssert(numberOfVisibleArguments >= 0);
-    
-    NSMutableArray *arguments = [NSMutableArray arrayWithCapacity:numberOfVisibleArguments];
-    
-    for (NSUInteger index = HIDDEN_ARGUMENT_COUNT; index < numberOfArguments; ++index) {
-        [arguments addObject:RX_extract_argument_at_index(invocation, index) ?: [NSNull null]];
-    }
-    
-    return arguments;
-}
-
-IMP __nonnull RX_default_target_implementation(void) {
-    return _objc_msgForward;
-}
-
-#if !DISABLE_SWIZZLING
-
-void * __nonnull RX_reference_from_selector(SEL __nonnull selector) {
-    return selector;
-}
-
-static BOOL RX_forward_invocation(id __nonnull __unsafe_unretained self, NSInvocation *invocation) {
-    SEL originalSelector = RX_selector(invocation.selector);
-
-    id<RXMessageSentObserver> messageSentObserver = objc_getAssociatedObject(self, originalSelector);
-
-    if (messageSentObserver != nil) {
-        NSArray *arguments = RX_extract_arguments(invocation);
-        [messageSentObserver messageSentWithArguments:arguments];
-    }
-
-    if ([self respondsToSelector:originalSelector]) {
-        invocation.selector = originalSelector;
-        [invocation invokeWithTarget:self];
-
-        if (messageSentObserver != nil) {
-            NSArray *arguments = RX_extract_arguments(invocation);
-            [messageSentObserver methodInvokedWithArguments:arguments];
-        }
-
-        return YES;
-    }
-
-    return NO;
-}
-
-static BOOL RX_responds_to_selector(id __nonnull __unsafe_unretained self, SEL selector) {
-    Class class = object_getClass(self);
-    if (class == nil) { return NO; }
-
-    Method m = class_getInstanceMethod(class, selector);
-    return m != nil;
-
-}
-
-static NSMethodSignatureRef RX_method_signature(id __nonnull __unsafe_unretained self, SEL selector) {
-    Class class = object_getClass(self);
-    if (class == nil) { return nil; }
-
-    Method method = class_getInstanceMethod(class, selector);
-    if (method == nil) { return nil; }
-
-    const char *encoding = method_getTypeEncoding(method);
-    if (encoding == nil) { return nil; }
-
-    return [NSMethodSignature signatureWithObjCTypes:encoding];
-}
-
-static NSString * __nonnull RX_method_encoding(Method __nonnull method) {
-    const char *typeEncoding = method_getTypeEncoding(method);
-    ALWAYS(typeEncoding != nil, @"Method encoding is nil.");
-
-    NSString *encoding = [NSString stringWithCString:typeEncoding encoding:NSASCIIStringEncoding];
-    ALWAYS(encoding != nil, @"Can't convert encoding to NSString.");
-    return encoding;
-}
-
-@interface RXObjCRuntime: NSObject
-
-@property (nonatomic, assign) pthread_mutex_t lock;
-
-@property (nonatomic, strong) NSMutableSet<NSValue *> *classesThatSupportObservingByForwarding;
-@property (nonatomic, strong) NSMutableDictionary<NSValue *, NSMutableSet<NSValue*> *> *forwardedSelectorsByClass;
-
-@property (nonatomic, strong) NSMutableDictionary<NSValue *, Class> *dynamicSubclassByRealClass;
-@property (nonatomic, strong) NSMutableDictionary<NSValue *, NSMutableDictionary<NSValue*, NSValue *>*> *interceptorIMPbySelectorsByClass;
-
-+(RXObjCRuntime*)instance;
-
--(void)performLocked:(void (^)(RXObjCRuntime* __nonnull))action;
--(IMP __nullable)ensurePrepared:(id __nonnull)target forObserving:(SEL __nonnull)selector error:(NSErrorParam)error;
--(BOOL)ensureSwizzledSelector:(SEL __nonnull)selector
-                      ofClass:(Class __nonnull)class
-   newImplementationGenerator:(IMP(^)(void))newImplementationGenerator
-replacementImplementationGenerator:(IMP (^)(IMP originalImplementation))replacementImplementationGenerator
-                        error:(NSErrorParam)error;
-
-
-+(void)registerOptimizedObserver:(RXInterceptWithOptimizedObserver)registration encodedAs:(SEL)selector;
-
-@end
-
-/**
- All API methods perform work on locked instance of `RXObjCRuntime`. In that way it's easy to prove
- that every action is properly locked.
- */
-IMP __nullable RX_ensure_observing(id __nonnull target, SEL __nonnull selector, NSErrorParam error) {
-    __block IMP targetImplementation = nil;
-    // Target is the second object that needs to be synchronized to TRY to make sure other swizzling framework
-    // won't do something in parallel.
-    // Even though this is too fine grained locking and more coarse grained locks should exist, this is just in case
-    // someone calls this method directly without any external lock.
-    @synchronized(target) {
-        // The only other resource that all other swizzling libraries have in common without introducing external
-        // dependencies is class object.
-        //
-        // It is polite to try to synchronize it in hope other unknown entities will also attempt to do so.
-        // It's like trying to figure out how to communicate with aliens without actually communicating,
-        // save for the fact that aliens are people, programmers, authors of swizzling libraries.
-        @synchronized([target class]) {
-            [[RXObjCRuntime instance] performLocked:^(RXObjCRuntime * __nonnull self) {
-                targetImplementation = [self ensurePrepared:target
-                                               forObserving:selector
-                                                      error:error];
-            }];
-        }
-    }
-
-    return targetImplementation;
-}
-
-// bodies
-
-#define FORWARD_BODY(invocation)                        if (RX_forward_invocation(self, NAME_CAT(_, 0, invocation))) { return; }
-
-#define RESPONDS_TO_SELECTOR_BODY(selector)             if (RX_responds_to_selector(self, NAME_CAT(_, 0, selector))) return YES;
-
-#define CLASS_BODY(...)                                 return actAsClass;
-
-#define METHOD_SIGNATURE_FOR_SELECTOR_BODY(selector)                                            \
-    NSMethodSignatureRef methodSignature = RX_method_signature(self, NAME_CAT(_, 0, selector)); \
-    if (methodSignature != nil) {                                                               \
-        return methodSignature;                                                                 \
-    }
-
-#define DEALLOCATING_BODY(...)                                                        \
-    id<RXDeallocatingObserver> observer = objc_getAssociatedObject(self, rxSelector); \
-    if (observer != nil && observer.targetImplementation == thisIMP) {                \
-        [observer deallocating];                                                      \
-    }
-
-#define OBSERVE_BODY(...)                                                              \
-    id<RXMessageSentObserver> observer = objc_getAssociatedObject(self, rxSelector);   \
-                                                                                       \
-    if (observer != nil && observer.targetImplementation == thisIMP) {                 \
-        [observer messageSentWithArguments:@[COMMA_DELIMITED_ARGUMENTS(__VA_ARGS__)]]; \
-    }                                                                                  \
-
-
-#define OBSERVE_INVOKED_BODY(...)                                                        \
-    if (observer != nil && observer.targetImplementation == thisIMP) {                   \
-        [observer methodInvokedWithArguments:@[COMMA_DELIMITED_ARGUMENTS(__VA_ARGS__)]]; \
-    }                                                                                    \
-
-
-#define BUILD_ARG_WRAPPER(type)                   RX_ARG_ ## type                                                     //RX_ARG_ ## type
-
-#define CAT(_1, _2, head, tail)                   RX_CAT2(head, tail)
-#define SEPARATE_BY_COMMA(_1, _2, head, tail)     head, tail
-#define SEPARATE_BY_SPACE(_1, _2, head, tail)     head tail
-#define SEPARATE_BY_UNDERSCORE(head, tail)        RX_CAT2(RX_CAT2(head, _), tail)
-
-#define UNDERSCORE_TYPE_CAT(_1, index, type)      RX_CAT2(_, type)                                                    // generates -> _type
-#define NAME_CAT(_1, index, type)                 SEPARATE_BY_UNDERSCORE(type, index)                                 // generates -> type_0
-#define TYPE_AND_NAME_CAT(_1, index, type)        type SEPARATE_BY_UNDERSCORE(type, index)                            // generates -> type type_0
-#define NOT_NULL_ARGUMENT_CAT(_1, index, type)    BUILD_ARG_WRAPPER(type)(NAME_CAT(_1, index, type))                  // generates -> ((id)(type_0) ?: [NSNull null])
-#define EXAMPLE_PARAMETER(_1, index, type)        RX_CAT2(_, type):(type)SEPARATE_BY_UNDERSCORE(type, index)          // generates -> _type:(type)type_0
-#define SELECTOR_PART(_1, index, type)            RX_CAT2(_, type:)                                                   // generates -> _type:
-
-#define COMMA_DELIMITED_ARGUMENTS(...)            RX_FOREACH(_, SEPARATE_BY_COMMA, NOT_NULL_ARGUMENT_CAT, ## __VA_ARGS__)
-#define ARGUMENTS(...)                            RX_FOREACH_COMMA(_, NAME_CAT, ## __VA_ARGS__)
-#define DECLARE_ARGUMENTS(...)                    RX_FOREACH_COMMA(_, TYPE_AND_NAME_CAT, ## __VA_ARGS__)
-
-// optimized observe methods
-
-#define GENERATE_SELECTOR_IDENTIFIER(...)         RX_CAT2(exampleSelector, RX_FOREACH(_, CAT, UNDERSCORE_TYPE_CAT, ## __VA_ARGS__))
-
-#define GENERATE_METHOD_IDENTIFIER(...)           RX_CAT2(swizzle, RX_FOREACH(_, CAT, UNDERSCORE_TYPE_CAT, ## __VA_ARGS__))
-
-#define GENERATE_OBSERVE_METHOD_DECLARATION(...)                                 \
-    -(BOOL)GENERATE_METHOD_IDENTIFIER(__VA_ARGS__):(Class __nonnull)class        \
-                                          selector:(SEL)selector                 \
-                                             error:(NSErrorParam)error {         \
-
-
-#define BUILD_EXAMPLE_METHOD(return_value, ...) \
-    +(return_value)RX_CAT2(RX_CAT2(example_, return_value), RX_FOREACH(_, SEPARATE_BY_SPACE, EXAMPLE_PARAMETER, ## __VA_ARGS__)) {}
-
-#define BUILD_EXAMPLE_METHOD_SELECTOR(return_value, ...) \
-    RX_CAT2(RX_CAT2(example_, return_value), RX_FOREACH(_, SEPARATE_BY_SPACE, SELECTOR_PART, ## __VA_ARGS__))
-
-#define SWIZZLE_OBSERVE_METHOD_DEFINITIONS(return_value, ...) \
-    BUILD_EXAMPLE_METHOD(return_value, ## __VA_ARGS__)                                                                                                  \
-    SWIZZLE_METHOD(return_value, GENERATE_OBSERVE_METHOD_DECLARATION(return_value, ## __VA_ARGS__), OBSERVE_BODY, OBSERVE_INVOKED_BODY, ## __VA_ARGS__) \
-
-#define SWIZZLE_OBSERVE_METHOD_BODY(return_value, ...)                                                                                                       \
-       __unused SEL GENERATE_SELECTOR_IDENTIFIER(return_value, ## __VA_ARGS__) = @selector(BUILD_EXAMPLE_METHOD_SELECTOR(return_value, ## __VA_ARGS__));                                           \
-       [self registerOptimizedObserver:^BOOL(RXObjCRuntime * __nonnull self, Class __nonnull class,                                                     \
-            SEL __nonnull selector, NSErrorParam error) {                                                                                               \
-            return [self GENERATE_METHOD_IDENTIFIER(return_value, ## __VA_ARGS__):class selector:selector error:error];                                 \
-       } encodedAs:GENERATE_SELECTOR_IDENTIFIER(return_value, ## __VA_ARGS__)];                                                                                                                    \
-
-// infrastructure method
-
-#define NO_BODY(...)
-
-#define SWIZZLE_INFRASTRUCTURE_METHOD(return_value, method_name, parameters, method_selector, body, ...)               \
-    SWIZZLE_METHOD(return_value, -(BOOL)method_name:(Class __nonnull)class parameters error:(NSErrorParam)error        \
-        {                                                                                                              \
-            SEL selector = method_selector; , body, NO_BODY, __VA_ARGS__)                                              \
-
-
-// common base
-
-#define SWIZZLE_METHOD(return_value, method_prototype, body, invoked_body, ...)                                          \
-method_prototype                                                                                                         \
-    __unused SEL rxSelector = RX_selector(selector);                                                                     \
-    IMP (^newImplementationGenerator)(void) = ^() {                                                                      \
-        __block IMP thisIMP = nil;                                                                                       \
-        id newImplementation = ^return_value(__unsafe_unretained id self DECLARE_ARGUMENTS(__VA_ARGS__)) {               \
-            body(__VA_ARGS__)                                                                                            \
-                                                                                                                         \
-            struct objc_super superInfo = {                                                                              \
-                .receiver = self,                                                                                        \
-                .super_class = class_getSuperclass(class)                                                                \
-            };                                                                                                           \
-                                                                                                                         \
-            return_value (*msgSend)(struct objc_super *, SEL DECLARE_ARGUMENTS(__VA_ARGS__))                             \
-                = (__typeof__(msgSend))objc_msgSendSuper;                                                                \
-            @try {                                                                                                       \
-              return msgSend(&superInfo, selector ARGUMENTS(__VA_ARGS__));                                               \
-            }                                                                                                            \
-            @finally { invoked_body(__VA_ARGS__) }                                                                       \
-        };                                                                                                               \
-                                                                                                                         \
-        thisIMP = imp_implementationWithBlock(newImplementation);                                                        \
-        return thisIMP;                                                                                                  \
-    };                                                                                                                   \
-                                                                                                                         \
-    IMP (^replacementImplementationGenerator)(IMP) = ^(IMP originalImplementation) {                                     \
-        __block return_value (*originalImplementationTyped)(__unsafe_unretained id, SEL DECLARE_ARGUMENTS(__VA_ARGS__) ) \
-            = (__typeof__(originalImplementationTyped))(originalImplementation);                                         \
-                                                                                                                         \
-        __block IMP thisIMP = nil;                                                                                       \
-        id implementationReplacement = ^return_value(__unsafe_unretained id self DECLARE_ARGUMENTS(__VA_ARGS__) ) {      \
-            body(__VA_ARGS__)                                                                                            \
-            @try {                                                                                                       \
-                return originalImplementationTyped(self, selector ARGUMENTS(__VA_ARGS__));                               \
-            }                                                                                                            \
-            @finally { invoked_body(__VA_ARGS__) }                                                                       \
-        };                                                                                                               \
-                                                                                                                         \
-        thisIMP = imp_implementationWithBlock(implementationReplacement);                                                \
-        return thisIMP;                                                                                                  \
-    };                                                                                                                   \
-                                                                                                                         \
-    return [self ensureSwizzledSelector:selector                                                                         \
-                                ofClass:class                                                                            \
-             newImplementationGenerator:newImplementationGenerator                                                       \
-     replacementImplementationGenerator:replacementImplementationGenerator                                               \
-                                  error:error];                                                                          \
- }                                                                                                                       \
-
-
-@interface RXObjCRuntime (InfrastructureMethods)
-@end
-
-// MARK: Infrastructure Methods
-
-@implementation RXObjCRuntime (InfrastructureMethods)
-
-SWIZZLE_INFRASTRUCTURE_METHOD(
-    void,
-    swizzleForwardInvocation,
-    ,
-    @selector(forwardInvocation:),
-    FORWARD_BODY,
-    NSInvocationRef
-)
-SWIZZLE_INFRASTRUCTURE_METHOD(
-    BOOL,
-    swizzleRespondsToSelector,
-    ,
-    @selector(respondsToSelector:),
-    RESPONDS_TO_SELECTOR_BODY,
-    SEL
-)
-SWIZZLE_INFRASTRUCTURE_METHOD(
-    Class __nonnull,
-    swizzleClass,
-    toActAs:(Class)actAsClass,
-    @selector(class),
-    CLASS_BODY
-)
-SWIZZLE_INFRASTRUCTURE_METHOD(
-    NSMethodSignatureRef,
-    swizzleMethodSignatureForSelector,
-    ,
-    @selector(methodSignatureForSelector:),
-    METHOD_SIGNATURE_FOR_SELECTOR_BODY,
-    SEL
-)
-SWIZZLE_INFRASTRUCTURE_METHOD(
-    void,
-    swizzleDeallocating,
-    ,
-    deallocSelector,
-    DEALLOCATING_BODY
-)
-
-@end
-
-// MARK: Optimized intercepting methods for specific combination of parameter types
-
-@interface RXObjCRuntime (swizzle)
-
-@end
-
-@implementation RXObjCRuntime(swizzle)
-
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void)
-
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, char)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, short)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, int)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, long)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, rx_uchar)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, rx_ushort)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, rx_uint)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, rx_ulong)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, rx_block)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, float)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, double)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, SEL)
-
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, id)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, char)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, short)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, int)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, long)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, rx_uchar)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, rx_ushort)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, rx_uint)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, rx_ulong)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, rx_block)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, float)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, double)
-SWIZZLE_OBSERVE_METHOD_DEFINITIONS(void, id, SEL)
-
-+(void)load {
-    SWIZZLE_OBSERVE_METHOD_BODY(void)
-
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, char)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, short)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, int)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, long)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, rx_uchar)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, rx_ushort)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, rx_uint)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, rx_ulong)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, rx_block)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, float)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, double)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, SEL)
-
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, id)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, char)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, short)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, int)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, long)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, rx_uchar)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, rx_ushort)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, rx_uint)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, rx_ulong)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, rx_block)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, float)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, double)
-    SWIZZLE_OBSERVE_METHOD_BODY(void, id, SEL)
-}
-
-@end
-
-// MARK: RXObjCRuntime
-
-@implementation RXObjCRuntime
-
-static RXObjCRuntime *_instance = nil;
-static NSMutableDictionary<NSString *, RXInterceptWithOptimizedObserver> *optimizedObserversByMethodEncoding = nil;
-
-+(RXObjCRuntime*)instance {
-    return _instance;
-}
-
-+(void)initialize {
-    _instance = [[RXObjCRuntime alloc] init];
-    defaultTypeID = CFGetTypeID((CFTypeRef)RXObjCRuntime.class); // just need a reference of some object not from CF
-    deallocSelector = NSSelectorFromString(@"dealloc");
-    NSAssert(_instance != nil, @"Failed to initialize swizzling");
-}
-
--(instancetype)init {
-    self = [super init];
-    if (!self) return nil;
-
-    self.classesThatSupportObservingByForwarding = [NSMutableSet set];
-    self.forwardedSelectorsByClass = [NSMutableDictionary dictionary];
-
-    self.dynamicSubclassByRealClass = [NSMutableDictionary dictionary];
-    self.interceptorIMPbySelectorsByClass = [NSMutableDictionary dictionary];
-
-    pthread_mutexattr_t lock_attr;
-    pthread_mutexattr_init(&lock_attr);
-    pthread_mutexattr_settype(&lock_attr, PTHREAD_MUTEX_RECURSIVE);
-    pthread_mutex_init(&_lock, &lock_attr);
-    pthread_mutexattr_destroy(&lock_attr);
-    
-    return self;
-}
-
--(void)performLocked:(void (^)(RXObjCRuntime* __nonnull))action {
-    pthread_mutex_lock(&_lock);
-    action(self);
-    pthread_mutex_unlock(&_lock);
-}
-
-+(void)registerOptimizedObserver:(RXInterceptWithOptimizedObserver)registration encodedAs:(SEL)selector {
-    Method exampleEncodingMethod = class_getClassMethod(self, selector);
-    ALWAYS(exampleEncodingMethod != nil, @"Example encoding method is nil.");
-
-    NSString *methodEncoding = RX_method_encoding(exampleEncodingMethod);
-
-    if (optimizedObserversByMethodEncoding == nil) {
-        optimizedObserversByMethodEncoding = [NSMutableDictionary dictionary];
-    }
-
-    DLOG(@"Added optimized method: %@ (%@)", methodEncoding, NSStringFromSelector(selector));
-    ALWAYS(optimizedObserversByMethodEncoding[methodEncoding] == nil, @"Optimized observer already registered")
-    optimizedObserversByMethodEncoding[methodEncoding] = registration;
-}
-
-/**
- This is the main entry point for observing messages sent to arbitrary objects.
- */
--(IMP __nullable)ensurePrepared:(id __nonnull)target forObserving:(SEL __nonnull)selector error:(NSErrorParam)error {
-    Method instanceMethod = class_getInstanceMethod([target class], selector);
-    if (instanceMethod == nil) {
-        RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                           code:RXObjCRuntimeErrorSelectorNotImplemented
-                                       userInfo:nil], nil);
-    }
-
-    if (selector == @selector(class)
-    ||  selector == @selector(forwardingTargetForSelector:)
-    ||  selector == @selector(methodSignatureForSelector:)
-    ||  selector == @selector(respondsToSelector:)) {
-        RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                           code:RXObjCRuntimeErrorObservingPerformanceSensitiveMessages
-                                       userInfo:nil], nil);
-    }
-
-    // For `dealloc` message, original implementation will be swizzled.
-    // This is a special case because observing `dealloc` message is performed when `observeWeakly` is used.
-    //
-    // Some toll free bridged classes don't handle `object_setClass` well and cause crashes.
-    //
-    // To make `deallocating` as robust as possible, original implementation will be replaced.
-    if (selector == deallocSelector) {
-        Class __nonnull deallocSwizzingTarget = [target class];
-        IMP interceptorIMPForSelector = [self interceptorImplementationForSelector:selector forClass:deallocSwizzingTarget];
-        if (interceptorIMPForSelector != nil) {
-            return interceptorIMPForSelector;
-        }
-
-        if (![self swizzleDeallocating:deallocSwizzingTarget error:error]) {
-            return nil;
-        }
-
-        interceptorIMPForSelector = [self interceptorImplementationForSelector:selector forClass:deallocSwizzingTarget];
-        if (interceptorIMPForSelector != nil) {
-            return interceptorIMPForSelector;
-        }
-    }
-    else {
-        Class __nullable swizzlingImplementorClass = [self prepareTargetClassForObserving:target error:error];
-        if (swizzlingImplementorClass == nil) {
-            return nil;
-        }
-
-        NSString *methodEncoding = RX_method_encoding(instanceMethod);
-        RXInterceptWithOptimizedObserver optimizedIntercept = optimizedObserversByMethodEncoding[methodEncoding];
-
-        if (!RX_method_has_supported_return_type(instanceMethod)) {
-            RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                               code:RXObjCRuntimeErrorObservingMessagesWithUnsupportedReturnType
-                                           userInfo:nil], nil);
-        }
-
-        // optimized interception method
-        if (optimizedIntercept != nil) {
-            IMP interceptorIMPForSelector = [self interceptorImplementationForSelector:selector forClass:swizzlingImplementorClass];
-            if (interceptorIMPForSelector != nil) {
-                return interceptorIMPForSelector;
-            }
-
-            if (!optimizedIntercept(self, swizzlingImplementorClass, selector, error)) {
-                return nil;
-            }
-
-            interceptorIMPForSelector = [self interceptorImplementationForSelector:selector forClass:swizzlingImplementorClass];
-            if (interceptorIMPForSelector != nil) {
-                return interceptorIMPForSelector;
-            }
-        }
-        // default fallback to observing by forwarding messages
-        else {
-            if ([self forwardingSelector:selector forClass:swizzlingImplementorClass]) {
-                return RX_default_target_implementation();
-            }
-
-            if (![self observeByForwardingMessages:swizzlingImplementorClass
-                                          selector:selector
-                                            target:target
-                                             error:error]) {
-                return nil;
-            }
-
-            if ([self forwardingSelector:selector forClass:swizzlingImplementorClass]) {
-                return RX_default_target_implementation();
-            }
-        }
-    }
-
-    RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                       code:RXObjCRuntimeErrorUnknown
-                                   userInfo:nil], nil);
-}
-
--(Class __nullable)prepareTargetClassForObserving:(id __nonnull)target error:(NSErrorParam)error {
-    Class swizzlingClass = objc_getAssociatedObject(target, &RxSwizzlingTargetClassKey);
-    if (swizzlingClass != nil) {
-        return swizzlingClass;
-    }
-
-    Class __nonnull wannaBeClass = [target class];
-    /**
-     Core Foundation classes are usually toll free bridged. Those classes crash the program in case
-     `object_setClass` is performed on them.
-
-     There is a possibility to just swizzle methods on original object, but since those won't be usual use
-     cases for this library, then an error will just be reported for now.
-     */
-    BOOL isThisTollFreeFoundationClass = CFGetTypeID((CFTypeRef)target) != defaultTypeID;
-
-    if (isThisTollFreeFoundationClass) {
-        RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                           code:RXObjCRuntimeErrorCantInterceptCoreFoundationTollFreeBridgedObjects
-                                       userInfo:nil], nil);
-    }
-
-    /**
-     If the object is reporting a different class then what it's real class, that means that there is probably
-     already some interception mechanism in place or something weird is happening.
-     
-     Most common case when this would happen is when using KVO (`observe`) and `sentMessage`.
-
-     This error is easily resolved by just using `sentMessage` observing before `observe`.
-     
-     The reason why other way around could create issues is because KVO will unregister it's interceptor 
-     class and restore original class. Unfortunately that will happen no matter was there another interceptor
-     subclass registered in hierarchy or not.
-     
-     Failure scenario:
-     * KVO sets class to be `__KVO__OriginalClass` (subclass of `OriginalClass`)
-     * `sentMessage` sets object class to be `_RX_namespace___KVO__OriginalClass` (subclass of `__KVO__OriginalClass`)
-     * then unobserving with KVO will restore class to be `OriginalClass` -> failure point
-
-     The reason why changing order of observing works is because any interception method should return
-     object's original real class (if that doesn't happen then it's really easy to argue that's a bug
-     in that other library).
-     
-     This library won't remove registered interceptor even if there aren't any observers left because
-     it's highly unlikely it would have any benefit in real world use cases, and it's even more
-     dangerous.
-     */
-    if ([target class] != object_getClass(target)) {
-        BOOL isKVO = [target respondsToSelector:NSSelectorFromString(@"_isKVOA")];
-
-        RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                           code:RXObjCRuntimeErrorObjectMessagesAlreadyBeingIntercepted
-                                       userInfo:@{
-                                                  RXObjCRuntimeErrorIsKVOKey : @(isKVO)
-                                                  }], nil);
-    }
-
-    Class __nullable dynamicFakeSubclass = [self ensureHasDynamicFakeSubclass:wannaBeClass error:error];
-
-    if (dynamicFakeSubclass == nil) {
-        return nil;
-    }
-
-    Class previousClass = object_setClass(target, dynamicFakeSubclass);
-    if (previousClass != wannaBeClass) {
-        THREADING_HAZARD(wannaBeClass);
-        RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                           code:RXObjCRuntimeErrorThreadingCollisionWithOtherInterceptionMechanism
-                                       userInfo:nil], nil);
-    }
-
-    objc_setAssociatedObject(target, &RxSwizzlingTargetClassKey, dynamicFakeSubclass, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
-    return dynamicFakeSubclass;
-}
-
-
--(BOOL)forwardingSelector:(SEL)selector forClass:(Class __nonnull)class {
-    return [self.forwardedSelectorsByClass[CLASS_VALUE(class)] containsObject:SEL_VALUE(selector)];
-}
-
--(void)registerForwardedSelector:(SEL)selector forClass:(Class __nonnull)class {
-    NSValue *classValue = CLASS_VALUE(class);
-
-    NSMutableSet<NSValue *> *forwardedSelectors = self.forwardedSelectorsByClass[classValue];
-
-    if (forwardedSelectors == nil) {
-        forwardedSelectors = [NSMutableSet set];
-        self.forwardedSelectorsByClass[classValue] = forwardedSelectors;
-    }
-
-    [forwardedSelectors addObject:SEL_VALUE(selector)];
-}
-
--(BOOL)observeByForwardingMessages:(Class __nonnull)swizzlingImplementorClass
-                          selector:(SEL)selector
-                            target:(id __nonnull)target
-                             error:(NSErrorParam)error {
-    if (![self ensureForwardingMethodsAreSwizzled:swizzlingImplementorClass error:error]) {
-        return NO;
-    }
-
-    ALWAYS(![self forwardingSelector:selector forClass:swizzlingImplementorClass], @"Already observing selector for class");
-
-#if TRACE_RESOURCES
-    atomic_fetch_add(&numberOfForwardedMethods, 1);
-#endif
-    SEL rxSelector = RX_selector(selector);
-
-    Method instanceMethod = class_getInstanceMethod(swizzlingImplementorClass, selector);
-    ALWAYS(instanceMethod != nil, @"Instance method is nil");
-
-    const char* methodEncoding = method_getTypeEncoding(instanceMethod);
-    ALWAYS(methodEncoding != nil, @"Method encoding is nil.");
-    NSMethodSignature *methodSignature = [NSMethodSignature signatureWithObjCTypes:methodEncoding];
-    ALWAYS(methodSignature != nil, @"Method signature is invalid.");
-
-    IMP implementation = method_getImplementation(instanceMethod);
-
-    if (implementation == nil) {
-        RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                           code:RXObjCRuntimeErrorSelectorNotImplemented
-                                       userInfo:nil], NO);
-    }
-
-    if (!class_addMethod(swizzlingImplementorClass, rxSelector, implementation, methodEncoding)) {
-        RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                           code:RXObjCRuntimeErrorSavingOriginalForwardingMethodFailed
-                                       userInfo:nil], NO);
-    }
-
-    if (!class_addMethod(swizzlingImplementorClass, selector, _objc_msgForward, methodEncoding)) {
-        if (implementation != method_setImplementation(instanceMethod, _objc_msgForward)) {
-            THREADING_HAZARD(swizzlingImplementorClass);
-            RX_THROW_ERROR([NSError errorWithDomain:RXObjCRuntimeErrorDomain
-                                               code:RXObjCRuntimeErrorReplacingMethodWithForwardingImplementation
-                                           userInfo:nil], NO);
-        }
-    }
-
-    DLOG(@"Rx uses forwarding to observe `%@` for `%@`.", NSStringFromSelector(selector), swizzlingImplementorClass);
-    [self registerForwardedSelector:selector forClass:swizzlingImplementorClass];
-
-    return YES;
-}
-
-/**
- If object don't have some weird behavior, claims it's the same class that runtime shows,
- then dynamic subclass is created (only this instance will have performance hit).
- 
- In case something weird is detected, then original base class is being swizzled and all instances
- will have somewhat reduced performance.
- 
- This is especially handy optimization for weak KVO. Nobody will swizzle for example `NSString`,
- but to know when instance of a `NSString` was deallocated, performance hit will be only felt on a 
- single instance of `NSString`, not all instances of `NSString`s.
- */
--(Class __nullable)ensureHasDynamicFakeSubclass:(Class __nonnull)class error:(NSErrorParam)error {
-    Class dynamicFakeSubclass = self.dynamicSubclassByRealClass[CLASS_VALUE(class)];
-    if (dynamicFakeSubclass != nil) {
-        return dynamicFakeSubclass;
-    }
-
-    NSString *dynamicFakeSubclassName = [RX_PREFIX stringByAppendingString:NSStringFromClass(class)];
-    const char *dynamicFakeSubclassNameRaw = dynamicFakeSubclassName.UTF8String;
-    dynamicFakeSubclass = objc_allocateClassPair(class, dynamicFakeSubclassNameRaw, 0);
-    ALWAYS(dynamicFakeSubclass != nil, @"Class not generated");
-
-    if (![self swizzleClass:dynamicFakeSubclass toActAs:class error:error]) {
-        return nil;
-    }
-
-    objc_registerClassPair(dynamicFakeSubclass);
-
-    [self.dynamicSubclassByRealClass setObject:dynamicFakeSubclass forKey:CLASS_VALUE(class)];
-    ALWAYS(self.dynamicSubclassByRealClass[CLASS_VALUE(class)] != nil, @"Class not registered");
-
-    return dynamicFakeSubclass;
-}
-
--(BOOL)ensureForwardingMethodsAreSwizzled:(Class __nonnull)class error:(NSErrorParam)error {
-    NSValue *classValue = CLASS_VALUE(class);
-    if ([self.classesThatSupportObservingByForwarding containsObject:classValue]) {
-        return YES;
-    }
-
-    if (![self swizzleForwardInvocation:class error:error]) { return NO; }
-    if (![self swizzleMethodSignatureForSelector:class error:error]) { return NO; }
-    if (![self swizzleRespondsToSelector:class error:error]) { return NO; }
-
-    [self.classesThatSupportObservingByForwarding addObject:classValue];
-
-    return YES;
-}
-
--(void)registerInterceptedSelector:(SEL)selector implementation:(IMP)implementation forClass:(Class)class {
-    NSValue * __nonnull classValue = CLASS_VALUE(class);
-    NSValue * __nonnull selectorValue = SEL_VALUE(selector);
-
-    NSMutableDictionary *swizzledIMPBySelectorsForClass = self.interceptorIMPbySelectorsByClass[classValue];
-
-    if (swizzledIMPBySelectorsForClass == nil) {
-        swizzledIMPBySelectorsForClass = [NSMutableDictionary dictionary];
-        self.interceptorIMPbySelectorsByClass[classValue] = swizzledIMPBySelectorsForClass;
-    }
-
-    swizzledIMPBySelectorsForClass[selectorValue] = IMP_VALUE(implementation);
-
-    ALWAYS([self interceptorImplementationForSelector:selector forClass:class] != nil, @"Class should have been swizzled");
-}
-
--(IMP)interceptorImplementationForSelector:(SEL)selector forClass:(Class)class {
-    NSValue * __nonnull classValue = CLASS_VALUE(class);
-    NSValue * __nonnull selectorValue = SEL_VALUE(selector);
-
-    NSMutableDictionary *swizzledIMPBySelectorForClass = self.interceptorIMPbySelectorsByClass[classValue];
-
-    NSValue *impValue = swizzledIMPBySelectorForClass[selectorValue];
-    return impValue.pointerValue;
-}
-
--(BOOL)ensureSwizzledSelector:(SEL __nonnull)selector
-                      ofClass:(Class __nonnull)class
-   newImplementationGenerator:(IMP(^)(void))newImplementationGenerator
-replacementImplementationGenerator:(IMP (^)(IMP originalImplementation))replacementImplementationGenerator
-                        error:(NSErrorParam)error {
-    if ([self interceptorImplementationForSelector:selector forClass:class] != nil) {
-        DLOG(@"Trying to register same intercept at least once, this sounds like a possible bug");
-        return YES;
-    }
-
-#if TRACE_RESOURCES
-    atomic_fetch_add(&numberOInterceptedMethods, 1);
-#endif
-    
-    DLOG(@"Rx is swizzling `%@` for `%@`", NSStringFromSelector(selector), class);
-
-    Method existingMethod = class_getInstanceMethod(class, selector);
-    ALWAYS(existingMethod != nil, @"Method doesn't exist");
-
-    const char *encoding = method_getTypeEncoding(existingMethod);
-    ALWAYS(encoding != nil, @"Encoding is nil");
-
-    IMP newImplementation = newImplementationGenerator();
-
-    if (class_addMethod(class, selector, newImplementation, encoding)) {
-        // new method added, job done
-        [self registerInterceptedSelector:selector implementation:newImplementation forClass:class];
-
-        return YES;
-    }
-
-    imp_removeBlock(newImplementation);
-
-    // if add fails, that means that method already exists on targetClass
-    Method existingMethodOnTargetClass = existingMethod;
-
-    IMP originalImplementation = method_getImplementation(existingMethodOnTargetClass);
-    ALWAYS(originalImplementation != nil, @"Method must exist.");
-    IMP implementationReplacementIMP = replacementImplementationGenerator(originalImplementation);
-    ALWAYS(implementationReplacementIMP != nil, @"Method must exist.");
-    IMP originalImplementationAfterChange = method_setImplementation(existingMethodOnTargetClass, implementationReplacementIMP);
-    ALWAYS(originalImplementation != nil, @"Method must exist.");
-
-    // If method replacing failed, who knows what happened, better not trying again, otherwise program can get
-    // corrupted.
-    [self registerInterceptedSelector:selector implementation:implementationReplacementIMP forClass:class];
-
-    // ¯\_(ツ)_/¯
-    if (originalImplementationAfterChange != originalImplementation) {
-        THREADING_HAZARD(class);
-        return NO;
-    }
-
-    return YES;
-}
-
-@end
-
-#if TRACE_RESOURCES
-
-NSInteger RX_number_of_dynamic_subclasses(void) {
-    __block NSInteger count = 0;
-    [[RXObjCRuntime instance] performLocked:^(RXObjCRuntime * __nonnull self) {
-        count = self.dynamicSubclassByRealClass.count;
-    }];
-
-    return count;
-}
-
-NSInteger RX_number_of_forwarding_enabled_classes(void) {
-    __block NSInteger count = 0;
-    [[RXObjCRuntime instance] performLocked:^(RXObjCRuntime * __nonnull self) {
-        count = self.classesThatSupportObservingByForwarding.count;
-    }];
-
-    return count;
-}
-
-NSInteger RX_number_of_intercepting_classes(void) {
-    __block NSInteger count = 0;
-    [[RXObjCRuntime instance] performLocked:^(RXObjCRuntime * __nonnull self) {
-        count = self.interceptorIMPbySelectorsByClass.count;
-    }];
-
-    return count;
-}
-
-NSInteger RX_number_of_forwarded_methods(void) {
-    return numberOfForwardedMethods;
-}
-
-NSInteger RX_number_of_swizzled_methods(void) {
-    return numberOInterceptedMethods;
-}
-
-#endif
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/Runtime/include/RxCocoaRuntime.h b/Pods/RxCocoa/RxCocoa/Runtime/include/RxCocoaRuntime.h
deleted file mode 100644
index 8cf762ec8..000000000
--- a/Pods/RxCocoa/RxCocoa/Runtime/include/RxCocoaRuntime.h
+++ /dev/null
@@ -1,19 +0,0 @@
-//
-//  RxCocoaRuntime.h
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 2/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-#import "_RX.h"
-#import "_RXDelegateProxy.h"
-#import "_RXKVOObserver.h"
-#import "_RXObjCRuntime.h"
-
-//! Project version number for RxCocoa.
-FOUNDATION_EXPORT double RxCocoaVersionNumber;
-
-//! Project version string for RxCocoa.
-FOUNDATION_EXPORT const unsigned char RxCocoaVersionString[];
diff --git a/Pods/RxCocoa/RxCocoa/Runtime/include/_RX.h b/Pods/RxCocoa/RxCocoa/Runtime/include/_RX.h
deleted file mode 100644
index b868ac97e..000000000
--- a/Pods/RxCocoa/RxCocoa/Runtime/include/_RX.h
+++ /dev/null
@@ -1,93 +0,0 @@
-//
-//  _RX.h
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-#import <objc/runtime.h>
-
-/**
- ################################################################################
- This file is part of RX private API
- ################################################################################
- */
-
-#if        TRACE_RESOURCES >= 2
-#   define DLOG(...)         NSLog(__VA_ARGS__)
-#else
-#   define DLOG(...)
-#endif
-
-#if        DEBUG
-#   define ABORT_IN_DEBUG    abort();
-#else
-#   define ABORT_IN_DEBUG
-#endif
-
-
-#define SEL_VALUE(x)      [NSValue valueWithPointer:(x)]
-#define CLASS_VALUE(x)    [NSValue valueWithNonretainedObject:(x)]
-#define IMP_VALUE(x)      [NSValue valueWithPointer:(x)]
-
-/**
- Checks that the local `error` instance exists before assigning it's value by reference.
- This macro exists to work around static analysis warnings — `NSError` is always assumed to be `nullable`, even though we explicitly define the method parameter as `nonnull`. See http://www.openradar.me/21766176 for more details.
- */
-#define RX_THROW_ERROR(errorValue, returnValue) if (error != nil) { *error = (errorValue); } return (returnValue);
-
-#define RX_CAT2(_1, _2) _RX_CAT2(_1, _2)
-#define _RX_CAT2(_1, _2) _1 ## _2
-
-#define RX_ELEMENT_AT(n, ...) RX_CAT2(_RX_ELEMENT_AT_, n)(__VA_ARGS__)
-#define _RX_ELEMENT_AT_0(x, ...) x
-#define _RX_ELEMENT_AT_1(_0, x, ...) x
-#define _RX_ELEMENT_AT_2(_0, _1, x, ...) x
-#define _RX_ELEMENT_AT_3(_0, _1, _2, x, ...) x
-#define _RX_ELEMENT_AT_4(_0, _1, _2, _3, x, ...) x
-#define _RX_ELEMENT_AT_5(_0, _1, _2, _3, _4, x, ...) x
-#define _RX_ELEMENT_AT_6(_0, _1, _2, _3, _4, _5, x, ...) x
-
-#define RX_COUNT(...) RX_ELEMENT_AT(6, ## __VA_ARGS__, 6, 5, 4, 3, 2, 1, 0)
-#define RX_EMPTY(...) RX_ELEMENT_AT(6, ## __VA_ARGS__, 0, 0, 0, 0, 0, 0, 1)
-
-/**
- #define SUM(context, index, head, tail) head + tail
- #define MAP(context, index, element) (context)[index] * (element)
-
- RX_FOR(numbers, SUM, MAP, b0, b1, b2);
-
- (numbers)[0] * (b0) + (numbers)[1] * (b1) + (numbers[2]) * (b2)
- */
-
-#define RX_FOREACH(context, concat, map, ...) RX_FOR_MAX(RX_COUNT(__VA_ARGS__), _RX_FOREACH_CONCAT, _RX_FOREACH_MAP, context, concat, map, __VA_ARGS__)
-#define _RX_FOREACH_CONCAT(index, head, tail, context, concat, map, ...) concat(context, index, head, tail)
-#define _RX_FOREACH_MAP(index, context, concat, map, ...) map(context, index, RX_ELEMENT_AT(index, __VA_ARGS__))
-
-/**
- #define MAP(context, index, item) (context)[index] * (item)
-
- RX_FOR_COMMA(numbers, MAP, b0, b1);
-
- ,(numbers)[0] * b0, (numbers)[1] * b1
- */
-#define RX_FOREACH_COMMA(context, map, ...) RX_CAT2(_RX_FOREACH_COMMA_EMPTY_, RX_EMPTY(__VA_ARGS__))(context, map, ## __VA_ARGS__)
-#define _RX_FOREACH_COMMA_EMPTY_1(context, map, ...)
-#define _RX_FOREACH_COMMA_EMPTY_0(context, map, ...) , RX_FOR_MAX(RX_COUNT(__VA_ARGS__), _RX_FOREACH_COMMA_CONCAT, _RX_FOREACH_COMMA_MAP, context, map, __VA_ARGS__)
-#define _RX_FOREACH_COMMA_CONCAT(index, head, tail, context, map, ...) head, tail
-#define _RX_FOREACH_COMMA_MAP(index, context, map, ...) map(context, index, RX_ELEMENT_AT(index, __VA_ARGS__))
-
-// rx for
-
-#define RX_FOR_MAX(max, concat, map, ...) RX_CAT2(RX_FOR_, max)(concat, map, ## __VA_ARGS__)
-
-#define RX_FOR_0(concat, map, ...)
-#define RX_FOR_1(concat, map, ...) map(0, __VA_ARGS__)
-#define RX_FOR_2(concat, map, ...) concat(1, RX_FOR_1(concat, map, ## __VA_ARGS__), map(1, __VA_ARGS__), __VA_ARGS__)
-#define RX_FOR_3(concat, map, ...) concat(2, RX_FOR_2(concat, map, ## __VA_ARGS__), map(2, __VA_ARGS__), __VA_ARGS__)
-#define RX_FOR_4(concat, map, ...) concat(3, RX_FOR_3(concat, map, ## __VA_ARGS__), map(3, __VA_ARGS__), __VA_ARGS__)
-#define RX_FOR_5(concat, map, ...) concat(4, RX_FOR_4(concat, map, ## __VA_ARGS__), map(4, __VA_ARGS__), __VA_ARGS__)
-#define RX_FOR_6(concat, map, ...) concat(5, RX_FOR_5(concat, map, ## __VA_ARGS__), map(5, __VA_ARGS__), __VA_ARGS__)
-
diff --git a/Pods/RxCocoa/RxCocoa/Runtime/include/_RXDelegateProxy.h b/Pods/RxCocoa/RxCocoa/Runtime/include/_RXDelegateProxy.h
deleted file mode 100644
index e1cc207d1..000000000
--- a/Pods/RxCocoa/RxCocoa/Runtime/include/_RXDelegateProxy.h
+++ /dev/null
@@ -1,27 +0,0 @@
-//
-//  _RXDelegateProxy.h
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/4/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-
-NS_ASSUME_NONNULL_BEGIN
-
-@interface _RXDelegateProxy : NSObject
-
-@property (nonatomic, weak, readonly) id _forwardToDelegate;
-
--(void)_setForwardToDelegate:(id __nullable)forwardToDelegate retainDelegate:(BOOL)retainDelegate NS_SWIFT_NAME(_setForwardToDelegate(_:retainDelegate:)) ;
-
--(BOOL)hasWiredImplementationForSelector:(SEL)selector;
--(BOOL)voidDelegateMethodsContain:(SEL)selector;
-
--(void)_sentMessage:(SEL)selector withArguments:(NSArray*)arguments;
--(void)_methodInvoked:(SEL)selector withArguments:(NSArray*)arguments;
-
-@end
-
-NS_ASSUME_NONNULL_END
diff --git a/Pods/RxCocoa/RxCocoa/Runtime/include/_RXKVOObserver.h b/Pods/RxCocoa/RxCocoa/Runtime/include/_RXKVOObserver.h
deleted file mode 100644
index adcfd0a3b..000000000
--- a/Pods/RxCocoa/RxCocoa/Runtime/include/_RXKVOObserver.h
+++ /dev/null
@@ -1,28 +0,0 @@
-//
-//  _RXKVOObserver.h
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/11/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-
-/**
- ################################################################################
- This file is part of RX private API
- ################################################################################
- */
-
-// Exists because if written in Swift, reading unowned is disabled during dealloc process
-@interface _RXKVOObserver : NSObject
-
--(instancetype)initWithTarget:(id)target
-                 retainTarget:(BOOL)retainTarget
-                      keyPath:(NSString*)keyPath
-                      options:(NSKeyValueObservingOptions)options
-                     callback:(void (^)(id))callback;
-
--(void)dispose;
-
-@end
diff --git a/Pods/RxCocoa/RxCocoa/Runtime/include/_RXObjCRuntime.h b/Pods/RxCocoa/RxCocoa/Runtime/include/_RXObjCRuntime.h
deleted file mode 100644
index bc6a76af7..000000000
--- a/Pods/RxCocoa/RxCocoa/Runtime/include/_RXObjCRuntime.h
+++ /dev/null
@@ -1,102 +0,0 @@
-//
-//  _RXObjCRuntime.h
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/11/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-
-#if !DISABLE_SWIZZLING
-
-/**
- ################################################################################
- This file is part of RX private API
- ################################################################################
- */
-
-/**
- This flag controls `RELEASE` configuration behavior in case race was detecting while modifying
- ObjC runtime.
-
- In case this value is set to `YES`, after runtime race is detected, `abort()` will be called.
- Otherwise, only error will be reported using normal error reporting mechanism.
-
- In `DEBUG` mode `abort` will be always called in case race is detected.
- 
- Races can't happen in case this is the only library modifying ObjC runtime, but in case there are multiple libraries
- changing ObjC runtime, race conditions can occur because there is no way to synchronize multiple libraries unaware of
- each other.
-
- To help remedy this situation this library will use `synchronized` on target object and it's meta-class, but
- there aren't any guarantees of how other libraries will behave.
-
- Default value is `NO`.
-
- */
-extern BOOL RXAbortOnThreadingHazard;
-
-/// Error domain for RXObjCRuntime.
-extern NSString * __nonnull const RXObjCRuntimeErrorDomain;
-
-/// `userInfo` key with additional information is interceptor probably KVO.
-extern NSString * __nonnull const RXObjCRuntimeErrorIsKVOKey;
-
-typedef NS_ENUM(NSInteger, RXObjCRuntimeError) {
-    RXObjCRuntimeErrorUnknown                                           = 1,
-    RXObjCRuntimeErrorObjectMessagesAlreadyBeingIntercepted             = 2,
-    RXObjCRuntimeErrorSelectorNotImplemented                            = 3,
-    RXObjCRuntimeErrorCantInterceptCoreFoundationTollFreeBridgedObjects = 4,
-    RXObjCRuntimeErrorThreadingCollisionWithOtherInterceptionMechanism  = 5,
-    RXObjCRuntimeErrorSavingOriginalForwardingMethodFailed              = 6,
-    RXObjCRuntimeErrorReplacingMethodWithForwardingImplementation       = 7,
-    RXObjCRuntimeErrorObservingPerformanceSensitiveMessages             = 8,
-    RXObjCRuntimeErrorObservingMessagesWithUnsupportedReturnType        = 9,
-};
-
-/// Transforms normal selector into a selector with RX prefix.
-SEL _Nonnull RX_selector(SEL _Nonnull selector);
-
-/// Transforms selector into a unique pointer (because of Swift conversion rules)
-void * __nonnull RX_reference_from_selector(SEL __nonnull selector);
-
-/// Protocol that interception observers must implement.
-@protocol RXMessageSentObserver
-
-/// In case the same selector is being intercepted for a pair of base/sub classes,
-/// this property will differentiate between interceptors that need to fire.
-@property (nonatomic, assign, readonly) IMP __nonnull targetImplementation;
-
--(void)messageSentWithArguments:(NSArray* __nonnull)arguments;
--(void)methodInvokedWithArguments:(NSArray* __nonnull)arguments;
-
-@end
-
-/// Protocol that deallocating observer must implement.
-@protocol RXDeallocatingObserver
-
-/// In case the same selector is being intercepted for a pair of base/sub classes,
-/// this property will differentiate between interceptors that need to fire.
-@property (nonatomic, assign, readonly) IMP __nonnull targetImplementation;
-
--(void)deallocating;
-
-@end
-
-/// Ensures interceptor is installed on target object.
-IMP __nullable RX_ensure_observing(id __nonnull target, SEL __nonnull selector, NSError *__autoreleasing __nullable * __nullable error);
-
-#endif
-
-/// Extracts arguments for `invocation`.
-NSArray * __nonnull RX_extract_arguments(NSInvocation * __nonnull invocation);
-
-/// Returns `YES` in case method has `void` return type.
-BOOL RX_is_method_with_description_void(struct objc_method_description method);
-
-/// Returns `YES` in case methodSignature has `void` return type.
-BOOL RX_is_method_signature_void(NSMethodSignature * __nonnull methodSignature);
-
-/// Default value for `RXInterceptionObserver.targetImplementation`.
-IMP __nonnull RX_default_target_implementation(void);
diff --git a/Pods/RxCocoa/RxCocoa/RxCocoa.h b/Pods/RxCocoa/RxCocoa/RxCocoa.h
deleted file mode 100644
index 0bca1bc75..000000000
--- a/Pods/RxCocoa/RxCocoa/RxCocoa.h
+++ /dev/null
@@ -1,19 +0,0 @@
-//
-//  RxCocoa.h
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 2/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-#import <RxCocoa/_RX.h>
-#import <RxCocoa/_RXDelegateProxy.h>
-#import <RxCocoa/_RXKVOObserver.h>
-#import <RxCocoa/_RXObjCRuntime.h>
-
-//! Project version number for RxCocoa.
-FOUNDATION_EXPORT double RxCocoaVersionNumber;
-
-//! Project version string for RxCocoa.
-FOUNDATION_EXPORT const unsigned char RxCocoaVersionString[];
diff --git a/Pods/RxCocoa/RxCocoa/RxCocoa.swift b/Pods/RxCocoa/RxCocoa/RxCocoa.swift
deleted file mode 100644
index 5e569fc2b..000000000
--- a/Pods/RxCocoa/RxCocoa/RxCocoa.swift
+++ /dev/null
@@ -1,155 +0,0 @@
-//
-//  RxCocoa.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 2/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-// Importing RxCocoa also imports RxRelay
-@_exported import RxRelay
-
-import RxSwift
-#if os(iOS)
-    import UIKit
-#endif
-
-/// RxCocoa errors.
-public enum RxCocoaError
-    : Swift.Error
-    , CustomDebugStringConvertible {
-    /// Unknown error has occurred.
-    case unknown
-    /// Invalid operation was attempted.
-    case invalidOperation(object: Any)
-    /// Items are not yet bound to user interface but have been requested.
-    case itemsNotYetBound(object: Any)
-    /// Invalid KVO Path.
-    case invalidPropertyName(object: Any, propertyName: String)
-    /// Invalid object on key path.
-    case invalidObjectOnKeyPath(object: Any, sourceObject: AnyObject, propertyName: String)
-    /// Error during swizzling.
-    case errorDuringSwizzling
-    /// Casting error.
-    case castingError(object: Any, targetType: Any.Type)
-}
-
-
-// MARK: Debug descriptions
-
-extension RxCocoaError {
-    /// A textual representation of `self`, suitable for debugging.
-    public var debugDescription: String {
-        switch self {
-        case .unknown:
-            return "Unknown error occurred."
-        case let .invalidOperation(object):
-            return "Invalid operation was attempted on `\(object)`."
-        case let .itemsNotYetBound(object):
-            return "Data source is set, but items are not yet bound to user interface for `\(object)`."
-        case let .invalidPropertyName(object, propertyName):
-            return "Object `\(object)` doesn't have a property named `\(propertyName)`."
-        case let .invalidObjectOnKeyPath(object, sourceObject, propertyName):
-            return "Unobservable object `\(object)` was observed as `\(propertyName)` of `\(sourceObject)`."
-        case .errorDuringSwizzling:
-            return "Error during swizzling."
-        case let .castingError(object, targetType):
-            return "Error casting `\(object)` to `\(targetType)`"
-        }
-    }
-}
-
-
-
-// MARK: Error binding policies
-
-func bindingError(_ error: Swift.Error) {
-    let error = "Binding error: \(error)"
-#if DEBUG
-    rxFatalError(error)
-#else
-    print(error)
-#endif
-}
-
-/// Swift does not implement abstract methods. This method is used as a runtime check to ensure that methods which intended to be abstract (i.e., they should be implemented in subclasses) are not called directly on the superclass.
-func rxAbstractMethod(message: String = "Abstract method", file: StaticString = #file, line: UInt = #line) -> Swift.Never {
-    rxFatalError(message, file: file, line: line)
-}
-
-func rxFatalError(_ lastMessage: @autoclosure () -> String, file: StaticString = #file, line: UInt = #line) -> Swift.Never  {
-    // The temptation to comment this line is great, but please don't, it's for your own good. The choice is yours.
-    fatalError(lastMessage(), file: file, line: line)
-}
-
-func rxFatalErrorInDebug(_ lastMessage: @autoclosure () -> String, file: StaticString = #file, line: UInt = #line) {
-    #if DEBUG
-        fatalError(lastMessage(), file: file, line: line)
-    #else
-        print("\(file):\(line): \(lastMessage())")
-    #endif
-}
-
-// MARK: casts or fatal error
-
-// workaround for Swift compiler bug, cheers compiler team :)
-func castOptionalOrFatalError<T>(_ value: Any?) -> T? {
-    if value == nil {
-        return nil
-    }
-    let v: T = castOrFatalError(value)
-    return v
-}
-
-func castOrThrow<T>(_ resultType: T.Type, _ object: Any) throws -> T {
-    guard let returnValue = object as? T else {
-        throw RxCocoaError.castingError(object: object, targetType: resultType)
-    }
-
-    return returnValue
-}
-
-func castOptionalOrThrow<T>(_ resultType: T.Type, _ object: AnyObject) throws -> T? {
-    if NSNull().isEqual(object) {
-        return nil
-    }
-
-    guard let returnValue = object as? T else {
-        throw RxCocoaError.castingError(object: object, targetType: resultType)
-    }
-
-    return returnValue
-}
-
-func castOrFatalError<T>(_ value: AnyObject!, message: String) -> T {
-    let maybeResult: T? = value as? T
-    guard let result = maybeResult else {
-        rxFatalError(message)
-    }
-    
-    return result
-}
-
-func castOrFatalError<T>(_ value: Any!) -> T {
-    let maybeResult: T? = value as? T
-    guard let result = maybeResult else {
-        rxFatalError("Failure converting from \(String(describing: value)) to \(T.self)")
-    }
-    
-    return result
-}
-
-// MARK: Error messages
-
-let dataSourceNotSet = "DataSource not set"
-let delegateNotSet = "Delegate not set"
-
-// MARK: Shared with RxSwift
-
-func rxFatalError(_ lastMessage: String) -> Never  {
-    // The temptation to comment this line is great, but please don't, it's for your own good. The choice is yours.
-    fatalError(lastMessage)
-}
-
diff --git a/Pods/RxCocoa/RxCocoa/Traits/ControlEvent.swift b/Pods/RxCocoa/RxCocoa/Traits/ControlEvent.swift
deleted file mode 100644
index bea1d83d9..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/ControlEvent.swift
+++ /dev/null
@@ -1,68 +0,0 @@
-//
-//  ControlEvent.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 8/28/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-/// A protocol that extends `ControlEvent`.
-public protocol ControlEventType : ObservableType {
-
-    /// - returns: `ControlEvent` interface
-    func asControlEvent() -> ControlEvent<Element>
-}
-
-/**
-    A trait for `Observable`/`ObservableType` that represents an event on a UI element.
-
-    Properties:
-
-    - it doesn’t send any initial value on subscription,
-    - it `Complete`s the sequence when the control deallocates,
-    - it never errors out
-    - it delivers events on `MainScheduler.instance`.
-
-    **The implementation of `ControlEvent` will ensure that sequence of events is being subscribed on main scheduler
-     (`subscribe(on: ConcurrentMainScheduler.instance)` behavior).**
-
-    **It is the implementor’s responsibility to make sure that all other properties enumerated above are satisfied.**
-
-    **If they aren’t, using this trait will communicate wrong properties, and could potentially break someone’s code.**
-
-    **If the `events` observable sequence passed into the initializer doesn’t satisfy all enumerated
-     properties, don’t use this trait.**
-*/
-public struct ControlEvent<PropertyType> : ControlEventType {
-    public typealias Element = PropertyType
-
-    let events: Observable<PropertyType>
-
-    /// Initializes control event with a observable sequence that represents events.
-    ///
-    /// - parameter events: Observable sequence that represents events.
-    /// - returns: Control event created with a observable sequence of events.
-    public init<Ev: ObservableType>(events: Ev) where Ev.Element == Element {
-        self.events = events.subscribe(on: ConcurrentMainScheduler.instance)
-    }
-
-    /// Subscribes an observer to control events.
-    ///
-    /// - parameter observer: Observer to subscribe to events.
-    /// - returns: Disposable object that can be used to unsubscribe the observer from receiving control events.
-    public func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.events.subscribe(observer)
-    }
-
-    /// - returns: `Observable` interface.
-    public func asObservable() -> Observable<Element> {
-        self.events
-    }
-
-    /// - returns: `ControlEvent` interface.
-    public func asControlEvent() -> ControlEvent<Element> {
-        self
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/ControlProperty.swift b/Pods/RxCocoa/RxCocoa/Traits/ControlProperty.swift
deleted file mode 100644
index 3068afbf2..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/ControlProperty.swift
+++ /dev/null
@@ -1,118 +0,0 @@
-//
-//  ControlProperty.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 8/28/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-/// Protocol that enables extension of `ControlProperty`.
-public protocol ControlPropertyType : ObservableType, ObserverType {
-
-    /// - returns: `ControlProperty` interface
-    func asControlProperty() -> ControlProperty<Element>
-}
-
-/**
-    Trait for `Observable`/`ObservableType` that represents property of UI element.
- 
-    Sequence of values only represents initial control value and user initiated value changes.
-    Programmatic value changes won't be reported.
-
-    It's properties are:
-
-    - `shareReplay(1)` behavior
-        - it's stateful, upon subscription (calling subscribe) last element is immediately replayed if it was produced
-    - it will `Complete` sequence on control being deallocated
-    - it never errors out
-    - it delivers events on `MainScheduler.instance`
-
-    **The implementation of `ControlProperty` will ensure that sequence of values is being subscribed on main scheduler
-    (`subscribe(on: ConcurrentMainScheduler.instance)` behavior).**
-
-    **It is implementor's responsibility to make sure that that all other properties enumerated above are satisfied.**
-
-    **If they aren't, then using this trait communicates wrong properties and could potentially break someone's code.**
-
-    **In case `values` observable sequence that is being passed into initializer doesn't satisfy all enumerated
-    properties, please don't use this trait.**
-*/
-public struct ControlProperty<PropertyType> : ControlPropertyType {
-    public typealias Element = PropertyType
-
-    let values: Observable<PropertyType>
-    let valueSink: AnyObserver<PropertyType>
-
-    /// Initializes control property with a observable sequence that represents property values and observer that enables
-    /// binding values to property.
-    ///
-    /// - parameter values: Observable sequence that represents property values.
-    /// - parameter valueSink: Observer that enables binding values to control property.
-    /// - returns: Control property created with a observable sequence of values and an observer that enables binding values
-    /// to property.
-    public init<Values: ObservableType, Sink: ObserverType>(values: Values, valueSink: Sink) where Element == Values.Element, Element == Sink.Element {
-        self.values = values.subscribe(on: ConcurrentMainScheduler.instance)
-        self.valueSink = valueSink.asObserver()
-    }
-
-    /// Subscribes an observer to control property values.
-    ///
-    /// - parameter observer: Observer to subscribe to property values.
-    /// - returns: Disposable object that can be used to unsubscribe the observer from receiving control property values.
-    public func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.values.subscribe(observer)
-    }
-
-    /// `ControlEvent` of user initiated value changes. Every time user updates control value change event
-    /// will be emitted from `changed` event.
-    ///
-    /// Programmatic changes to control value won't be reported.
-    ///
-    /// It contains all control property values except for first one.
-    ///
-    /// The name only implies that sequence element will be generated once user changes a value and not that
-    /// adjacent sequence values need to be different (e.g. because of interaction between programmatic and user updates,
-    /// or for any other reason).
-    public var changed: ControlEvent<PropertyType> {
-        ControlEvent(events: self.values.skip(1))
-    }
-
-    /// - returns: `Observable` interface.
-    public func asObservable() -> Observable<Element> {
-        self.values
-    }
-
-    /// - returns: `ControlProperty` interface.
-    public func asControlProperty() -> ControlProperty<Element> {
-        self
-    }
-
-    /// Binds event to user interface.
-    ///
-    /// - In case next element is received, it is being set to control value.
-    /// - In case error is received, DEBUG buids raise fatal error, RELEASE builds log event to standard output.
-    /// - In case sequence completes, nothing happens.
-    public func on(_ event: Event<Element>) {
-        switch event {
-        case .error(let error):
-            bindingError(error)
-        case .next:
-            self.valueSink.on(event)
-        case .completed:
-            self.valueSink.on(event)
-        }
-    }
-}
-
-extension ControlPropertyType where Element == String? {
-    /// Transforms control property of type `String?` into control property of type `String`.
-    public var orEmpty: ControlProperty<String> {
-        let original: ControlProperty<String?> = self.asControlProperty()
-
-        let values: Observable<String> = original.values.map { $0 ?? "" }
-        let valueSink: AnyObserver<String> = original.valueSink.mapObserver { $0 }
-        return ControlProperty<String>(values: values, valueSink: valueSink)
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Driver/BehaviorRelay+Driver.swift b/Pods/RxCocoa/RxCocoa/Traits/Driver/BehaviorRelay+Driver.swift
deleted file mode 100644
index 76d960f0c..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Driver/BehaviorRelay+Driver.swift
+++ /dev/null
@@ -1,21 +0,0 @@
-//
-//  BehaviorRelay+Driver.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 10/7/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-import RxRelay
-
-extension BehaviorRelay {
-    /// Converts `BehaviorRelay` to `Driver`.
-    ///
-    /// - returns: Observable sequence.
-    public func asDriver() -> Driver<Element> {
-        let source = self.asObservable()
-            .observe(on:DriverSharingStrategy.scheduler)
-        return SharedSequence(source)
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Driver/ControlEvent+Driver.swift b/Pods/RxCocoa/RxCocoa/Traits/Driver/ControlEvent+Driver.swift
deleted file mode 100644
index b59c7533e..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Driver/ControlEvent+Driver.swift
+++ /dev/null
@@ -1,24 +0,0 @@
-//
-//  ControlEvent+Driver.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 9/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-    
-extension ControlEvent {
-    /// Converts `ControlEvent` to `Driver` trait.
-    ///
-    /// `ControlEvent` already can't fail, so no special case needs to be handled.
-    public func asDriver() -> Driver<Element> {
-        return self.asDriver { _ -> Driver<Element> in
-            #if DEBUG
-                rxFatalError("Somehow driver received error from a source that shouldn't fail.")
-            #else
-                return Driver.empty()
-            #endif
-        }
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Driver/ControlProperty+Driver.swift b/Pods/RxCocoa/RxCocoa/Traits/Driver/ControlProperty+Driver.swift
deleted file mode 100644
index 790452970..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Driver/ControlProperty+Driver.swift
+++ /dev/null
@@ -1,24 +0,0 @@
-//
-//  ControlProperty+Driver.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 9/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-extension ControlProperty {
-    /// Converts `ControlProperty` to `Driver` trait.
-    ///
-    /// `ControlProperty` already can't fail, so no special case needs to be handled.
-    public func asDriver() -> Driver<Element> {
-        return self.asDriver { _ -> Driver<Element> in
-            #if DEBUG
-                rxFatalError("Somehow driver received error from a source that shouldn't fail.")
-            #else
-                return Driver.empty()
-            #endif
-        }
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Driver/Driver+Subscription.swift b/Pods/RxCocoa/RxCocoa/Traits/Driver/Driver+Subscription.swift
deleted file mode 100644
index da9659c49..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Driver/Driver+Subscription.swift
+++ /dev/null
@@ -1,203 +0,0 @@
-//
-//  Driver+Subscription.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 9/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-import RxRelay
-
-private let errorMessage = "`drive*` family of methods can be only called from `MainThread`.\n" +
-"This is required to ensure that the last replayed `Driver` element is delivered on `MainThread`.\n"
-
-extension SharedSequenceConvertibleType where SharingStrategy == DriverSharingStrategy {
-    /**
-    Creates new subscription and sends elements to observer.
-    This method can be only called from `MainThread`.
-
-    In this form it's equivalent to `subscribe` method, but it communicates intent better.
-
-    - parameter observers: Observers that receives events.
-    - returns: Disposable object that can be used to unsubscribe the observer from the subject.
-    */
-    public func drive<Observer: ObserverType>(_ observers: Observer...) -> Disposable where Observer.Element == Element {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return self.asSharedSequence()
-                   .asObservable()
-                   .subscribe { e in
-                    observers.forEach { $0.on(e) }
-                   }
-    }
-
-    /**
-     Creates new subscription and sends elements to observer.
-     This method can be only called from `MainThread`.
-
-     In this form it's equivalent to `subscribe` method, but it communicates intent better.
-
-     - parameter observers: Observers that receives events.
-     - returns: Disposable object that can be used to unsubscribe the observer from the subject.
-     */
-    public func drive<Observer: ObserverType>(_ observers: Observer...) -> Disposable where Observer.Element == Element? {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return self.asSharedSequence()
-                   .asObservable()
-                   .map { $0 as Element? }
-                   .subscribe { e in
-                    observers.forEach { $0.on(e) }
-                   }
-    }
-
-    /**
-    Creates new subscription and sends elements to `BehaviorRelay`.
-    This method can be only called from `MainThread`.
-
-    - parameter relays: Target relays for sequence elements.
-    - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-    */
-    public func drive(_ relays: BehaviorRelay<Element>...) -> Disposable {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return self.drive(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-     Creates new subscription and sends elements to `BehaviorRelay`.
-     This method can be only called from `MainThread`.
-
-     - parameter relays: Target relays for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func drive(_ relays: BehaviorRelay<Element?>...) -> Disposable {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return self.drive(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-    Creates new subscription and sends elements to `ReplayRelay`.
-    This method can be only called from `MainThread`.
-
-    - parameter relays: Target relays for sequence elements.
-    - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-    */
-    public func drive(_ relays: ReplayRelay<Element>...) -> Disposable {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return self.drive(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-     Creates new subscription and sends elements to `ReplayRelay`.
-     This method can be only called from `MainThread`.
-
-     - parameter relays: Target relays for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func drive(_ relays: ReplayRelay<Element?>...) -> Disposable {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return self.drive(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-    Subscribes to observable sequence using custom binder function.
-    This method can be only called from `MainThread`.
-
-    - parameter with: Function used to bind elements from `self`.
-    - returns: Object representing subscription.
-    */
-    public func drive<Result>(_ transformation: (Observable<Element>) -> Result) -> Result {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return transformation(self.asObservable())
-    }
-
-    /**
-    Subscribes to observable sequence using custom binder function and final parameter passed to binder function
-    after `self` is passed.
-
-        public func drive<R1, R2>(with: Self -> R1 -> R2, curriedArgument: R1) -> R2 {
-            return with(self)(curriedArgument)
-        }
-
-    This method can be only called from `MainThread`.
-
-    - parameter with: Function used to bind elements from `self`.
-    - parameter curriedArgument: Final argument passed to `binder` to finish binding process.
-    - returns: Object representing subscription.
-    */
-    public func drive<R1, R2>(_ with: (Observable<Element>) -> (R1) -> R2, curriedArgument: R1) -> R2 {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return with(self.asObservable())(curriedArgument)
-    }
-    
-    /**
-    Subscribes an element handler, a completion handler and disposed handler to an observable sequence.
-    This method can be only called from `MainThread`.
-     
-    Also, take in an object and provide an unretained, safe to use (i.e. not implicitly unwrapped), reference to it along with the events emitted by the sequence.
-    
-    Error callback is not exposed because `Driver` can't error out.
-     
-     - Note: If `object` can't be retained, none of the other closures will be invoked.
-     
-    - parameter object: The object to provide an unretained reference on.
-    - parameter onNext: Action to invoke for each element in the observable sequence.
-    - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-    gracefully completed, errored, or if the generation is canceled by disposing subscription)
-    - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-    gracefully completed, errored, or if the generation is canceled by disposing subscription)
-    - returns: Subscription object used to unsubscribe from the observable sequence.
-    */
-    public func drive<Object: AnyObject>(
-        with object: Object,
-        onNext: ((Object, Element) -> Void)? = nil,
-        onCompleted: ((Object) -> Void)? = nil,
-        onDisposed: ((Object) -> Void)? = nil
-    ) -> Disposable {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return self.asObservable().subscribe(with: object, onNext: onNext, onCompleted: onCompleted, onDisposed: onDisposed)
-    }
-    
-    /**
-    Subscribes an element handler, a completion handler and disposed handler to an observable sequence.
-    This method can be only called from `MainThread`.
-    
-    Error callback is not exposed because `Driver` can't error out.
-    
-    - parameter onNext: Action to invoke for each element in the observable sequence.
-    - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-    gracefully completed, errored, or if the generation is canceled by disposing subscription)
-    - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-    gracefully completed, errored, or if the generation is canceled by disposing subscription)
-    - returns: Subscription object used to unsubscribe from the observable sequence.
-    */
-    public func drive(
-        onNext: ((Element) -> Void)? = nil,
-        onCompleted: (() -> Void)? = nil,
-        onDisposed: (() -> Void)? = nil
-    ) -> Disposable {
-        MainScheduler.ensureRunningOnMainThread(errorMessage: errorMessage)
-        return self.asObservable().subscribe(onNext: onNext, onCompleted: onCompleted, onDisposed: onDisposed)
-    }
-
-    /**
-    Subscribes to this `Driver` with a no-op.
-    This method can be only called from `MainThread`.
-
-    - note: This is an alias of `drive(onNext: nil, onCompleted: nil, onDisposed: nil)` used to fix an ambiguity bug in Swift: https://bugs.swift.org/browse/SR-13657
-
-    - returns: Subscription object used to unsubscribe from the observable sequence.
-    */
-    public func drive() -> Disposable {
-        drive(onNext: nil, onCompleted: nil, onDisposed: nil)
-    }
-}
-
-
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Driver/Driver.swift b/Pods/RxCocoa/RxCocoa/Traits/Driver/Driver.swift
deleted file mode 100644
index 5de8b3a56..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Driver/Driver.swift
+++ /dev/null
@@ -1,53 +0,0 @@
-//
-//  Driver.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 9/26/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-/**
- Trait that represents observable sequence with following properties:
-
- - it never fails
- - it delivers events on `MainScheduler.instance`
- - `share(replay: 1, scope: .whileConnected)` sharing strategy
- 
- Additional explanation:
- - all observers share sequence computation resources
- - it's stateful, upon subscription (calling subscribe) last element is immediately replayed if it was produced
- - computation of elements is reference counted with respect to the number of observers
- - if there are no subscribers, it will release sequence computation resources
-
- In case trait that models event bus is required, please check `Signal`.
-
- `Driver<Element>` can be considered a builder pattern for observable sequences that drive the application.
-
- If observable sequence has produced at least one element, after new subscription is made last produced element will be
- immediately replayed on the same thread on which the subscription was made.
-
- When using `drive*`, `subscribe*` and `bind*` family of methods, they should always be called from main thread.
-
- If `drive*`, `subscribe*` and `bind*` are called from background thread, it is possible that initial replay
- will happen on background thread, and subsequent events will arrive on main thread.
-
- To find out more about traits and how to use them, please visit `Documentation/Traits.md`.
- */
-public typealias Driver<Element> = SharedSequence<DriverSharingStrategy, Element>
-
-public struct DriverSharingStrategy: SharingStrategyProtocol {
-    public static var scheduler: SchedulerType { SharingScheduler.make() }
-    public static func share<Element>(_ source: Observable<Element>) -> Observable<Element> {
-        source.share(replay: 1, scope: .whileConnected)
-    }
-}
-
-extension SharedSequenceConvertibleType where SharingStrategy == DriverSharingStrategy {
-    /// Adds `asDriver` to `SharingSequence` with `DriverSharingStrategy`.
-    public func asDriver() -> Driver<Element> {
-        self.asSharedSequence()
-    }
-}
-
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Driver/ObservableConvertibleType+Driver.swift b/Pods/RxCocoa/RxCocoa/Traits/Driver/ObservableConvertibleType+Driver.swift
deleted file mode 100644
index bcac66b66..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Driver/ObservableConvertibleType+Driver.swift
+++ /dev/null
@@ -1,57 +0,0 @@
-//
-//  ObservableConvertibleType+Driver.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 9/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-extension ObservableConvertibleType {
-    /**
-    Converts observable sequence to `Driver` trait.
-    
-    - parameter onErrorJustReturn: Element to return in case of error and after that complete the sequence.
-    - returns: Driver trait.
-    */
-    public func asDriver(onErrorJustReturn: Element) -> Driver<Element> {
-        let source = self
-            .asObservable()
-            .observe(on:DriverSharingStrategy.scheduler)
-            .catchAndReturn(onErrorJustReturn)
-        return Driver(source)
-    }
-    
-    /**
-    Converts observable sequence to `Driver` trait.
-    
-    - parameter onErrorDriveWith: Driver that continues to drive the sequence in case of error.
-    - returns: Driver trait.
-    */
-    public func asDriver(onErrorDriveWith: Driver<Element>) -> Driver<Element> {
-        let source = self
-            .asObservable()
-            .observe(on:DriverSharingStrategy.scheduler)
-            .catch { _ in
-                onErrorDriveWith.asObservable()
-            }
-        return Driver(source)
-    }
-
-    /**
-    Converts observable sequence to `Driver` trait.
-    
-    - parameter onErrorRecover: Calculates driver that continues to drive the sequence in case of error.
-    - returns: Driver trait.
-    */
-    public func asDriver(onErrorRecover: @escaping (_ error: Swift.Error) -> Driver<Element>) -> Driver<Element> {
-        let source = self
-            .asObservable()
-            .observe(on:DriverSharingStrategy.scheduler)
-            .catch { error in
-                onErrorRecover(error).asObservable()
-            }
-        return Driver(source)
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/ObservableConvertibleType+SharedSequence.swift b/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/ObservableConvertibleType+SharedSequence.swift
deleted file mode 100644
index 20ddf868f..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/ObservableConvertibleType+SharedSequence.swift
+++ /dev/null
@@ -1,57 +0,0 @@
-//
-//  ObservableConvertibleType+SharedSequence.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 11/1/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-extension ObservableConvertibleType {
-    /**
-     Converts anything convertible to `Observable` to `SharedSequence` unit.
-
-     - parameter onErrorJustReturn: Element to return in case of error and after that complete the sequence.
-     - returns: Driving observable sequence.
-     */
-    public func asSharedSequence<S>(sharingStrategy: S.Type = S.self, onErrorJustReturn: Element) -> SharedSequence<S, Element> {
-        let source = self
-            .asObservable()
-            .observe(on:S.scheduler)
-            .catchAndReturn(onErrorJustReturn)
-        return SharedSequence(source)
-    }
-
-    /**
-     Converts anything convertible to `Observable` to `SharedSequence` unit.
-
-     - parameter onErrorDriveWith: SharedSequence that provides elements of the sequence in case of error.
-     - returns: Driving observable sequence.
-     */
-    public func asSharedSequence<S>(sharingStrategy: S.Type = S.self, onErrorDriveWith: SharedSequence<S, Element>) -> SharedSequence<S, Element> {
-        let source = self
-            .asObservable()
-            .observe(on:S.scheduler)
-            .catch { _ in
-                onErrorDriveWith.asObservable()
-            }
-        return SharedSequence(source)
-    }
-
-    /**
-     Converts anything convertible to `Observable` to `SharedSequence` unit.
-
-     - parameter onErrorRecover: Calculates driver that continues to drive the sequence in case of error.
-     - returns: Driving observable sequence.
-     */
-    public func asSharedSequence<S>(sharingStrategy: S.Type = S.self, onErrorRecover: @escaping (_ error: Swift.Error) -> SharedSequence<S, Element>) -> SharedSequence<S, Element> {
-        let source = self
-            .asObservable()
-            .observe(on:S.scheduler)
-            .catch { error in
-                onErrorRecover(error).asObservable()
-            }
-        return SharedSequence(source)
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SchedulerType+SharedSequence.swift b/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SchedulerType+SharedSequence.swift
deleted file mode 100644
index 5111e06d8..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SchedulerType+SharedSequence.swift
+++ /dev/null
@@ -1,62 +0,0 @@
-//
-//  SchedulerType+SharedSequence.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 8/27/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-public enum SharingScheduler {
-    /// Default scheduler used in SharedSequence based traits.
-    public private(set) static var make: () -> SchedulerType = { MainScheduler() }
-
-    /**
-     This method can be used in unit tests to ensure that built in shared sequences are using mock schedulers instead
-     of main schedulers.
-
-     **This shouldn't be used in normal release builds.**
-    */
-    static public func mock(scheduler: SchedulerType, action: () throws -> Void) rethrows {
-        return try mock(makeScheduler: { scheduler }, action: action)
-    }
-
-    /**
-     This method can be used in unit tests to ensure that built in shared sequences are using mock schedulers instead
-     of main schedulers.
-
-     **This shouldn't be used in normal release builds.**
-     */
-    static public func mock(makeScheduler: @escaping () -> SchedulerType, action: () throws -> Void) rethrows {
-        let originalMake = make
-        make = makeScheduler
-        defer {
-            make = originalMake
-        }
-
-        try action()
-
-        // If you remove this line , compiler buggy optimizations will change behavior of this code
-        _forceCompilerToStopDoingInsaneOptimizationsThatBreakCode(makeScheduler)
-        // Scary, I know
-    }
-}
-
-#if os(Linux)
-    import Glibc
-#else
-    import Foundation
-#endif
-
-func _forceCompilerToStopDoingInsaneOptimizationsThatBreakCode(_ scheduler: () -> SchedulerType) {
-    let a: Int32 = 1
-#if os(Linux)
-    let b = 314 + Int32(Glibc.random() & 1)
-#else
-    let b = 314 + Int32(arc4random() & 1)
-#endif
-    if a == b {
-        print(scheduler())
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SharedSequence+Operators+arity.swift b/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SharedSequence+Operators+arity.swift
deleted file mode 100644
index 4cc967cfb..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SharedSequence+Operators+arity.swift
+++ /dev/null
@@ -1,656 +0,0 @@
-// This file is autogenerated. Take a look at `Preprocessor` target in RxSwift project 
-//
-//  SharedSequence+Operators+arity.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 10/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-
-
-// 2
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, resultSelector: @escaping (O1.Element, O2.Element) throws -> Element)
-        -> SharedSequence<O1.SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(),
-            resultSelector: resultSelector
-        )
-
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2)
-        -> SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable()
-        )
-
-        return SharedSequence<SharingStrategy, (O1.Element, O2.Element)>(source)
-    }
-}
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, resultSelector: @escaping (O1.Element, O2.Element) throws -> Element)
-        -> SharedSequence<SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(),
-                resultSelector: resultSelector
-            )
-
-        return SharedSequence<O1.SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever any of the observable sequences produces an element.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2)
-        -> SharedSequence<SharingStrategy, (O1.Element, O2.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable()
-            )
-
-        return SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element)>(source)
-    }
-}
-
-
-
-// 3
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, resultSelector: @escaping (O1.Element, O2.Element, O3.Element) throws -> Element)
-        -> SharedSequence<O1.SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(),
-            resultSelector: resultSelector
-        )
-
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3)
-        -> SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable()
-        )
-
-        return SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element)>(source)
-    }
-}
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, resultSelector: @escaping (O1.Element, O2.Element, O3.Element) throws -> Element)
-        -> SharedSequence<SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(),
-                resultSelector: resultSelector
-            )
-
-        return SharedSequence<O1.SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever any of the observable sequences produces an element.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3)
-        -> SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable()
-            )
-
-        return SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element)>(source)
-    }
-}
-
-
-
-// 4
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element) throws -> Element)
-        -> SharedSequence<O1.SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(),
-            resultSelector: resultSelector
-        )
-
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4)
-        -> SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable()
-        )
-
-        return SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element)>(source)
-    }
-}
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element) throws -> Element)
-        -> SharedSequence<SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(),
-                resultSelector: resultSelector
-            )
-
-        return SharedSequence<O1.SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever any of the observable sequences produces an element.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4)
-        -> SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable()
-            )
-
-        return SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element)>(source)
-    }
-}
-
-
-
-// 5
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element) throws -> Element)
-        -> SharedSequence<O1.SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(),
-            resultSelector: resultSelector
-        )
-
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5)
-        -> SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable()
-        )
-
-        return SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element)>(source)
-    }
-}
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element) throws -> Element)
-        -> SharedSequence<SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(),
-                resultSelector: resultSelector
-            )
-
-        return SharedSequence<O1.SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever any of the observable sequences produces an element.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5)
-        -> SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable()
-            )
-
-        return SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element)>(source)
-    }
-}
-
-
-
-// 6
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element) throws -> Element)
-        -> SharedSequence<O1.SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(),
-            resultSelector: resultSelector
-        )
-
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6)
-        -> SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable()
-        )
-
-        return SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element)>(source)
-    }
-}
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element) throws -> Element)
-        -> SharedSequence<SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(),
-                resultSelector: resultSelector
-            )
-
-        return SharedSequence<O1.SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever any of the observable sequences produces an element.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6)
-        -> SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable()
-            )
-
-        return SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element)>(source)
-    }
-}
-
-
-
-// 7
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType, O7: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element) throws -> Element)
-        -> SharedSequence<O1.SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy,
-            SharingStrategy == O7.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(), source7.asSharedSequence().asObservable(),
-            resultSelector: resultSelector
-        )
-
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType, O7: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7)
-        -> SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy,
-            SharingStrategy == O7.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(), source7.asSharedSequence().asObservable()
-        )
-
-        return SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element)>(source)
-    }
-}
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType, O7: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element) throws -> Element)
-        -> SharedSequence<SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy,
-            SharingStrategy == O7.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(), source7.asSharedSequence().asObservable(),
-                resultSelector: resultSelector
-            )
-
-        return SharedSequence<O1.SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever any of the observable sequences produces an element.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType, O7: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7)
-        -> SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy,
-            SharingStrategy == O7.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(), source7.asSharedSequence().asObservable()
-            )
-
-        return SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element)>(source)
-    }
-}
-
-
-
-// 8
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType, O7: SharedSequenceConvertibleType, O8: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, _ source8: O8, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element) throws -> Element)
-        -> SharedSequence<O1.SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy,
-            SharingStrategy == O7.SharingStrategy,
-            SharingStrategy == O8.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(), source7.asSharedSequence().asObservable(), source8.asSharedSequence().asObservable(),
-            resultSelector: resultSelector
-        )
-
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType, O7: SharedSequenceConvertibleType, O8: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, _ source8: O8)
-        -> SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy,
-            SharingStrategy == O7.SharingStrategy,
-            SharingStrategy == O8.SharingStrategy {
-        let source = Observable.zip(
-            source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(), source7.asSharedSequence().asObservable(), source8.asSharedSequence().asObservable()
-        )
-
-        return SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element)>(source)
-    }
-}
-
-extension SharedSequence {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType, O7: SharedSequenceConvertibleType, O8: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, _ source8: O8, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element) throws -> Element)
-        -> SharedSequence<SharingStrategy, Element> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy,
-            SharingStrategy == O7.SharingStrategy,
-            SharingStrategy == O8.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(), source7.asSharedSequence().asObservable(), source8.asSharedSequence().asObservable(),
-                resultSelector: resultSelector
-            )
-
-        return SharedSequence<O1.SharingStrategy, Element>(source)
-    }
-}
-
-extension SharedSequenceConvertibleType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of element tuples whenever any of the observable sequences produces an element.
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: SharedSequenceConvertibleType, O2: SharedSequenceConvertibleType, O3: SharedSequenceConvertibleType, O4: SharedSequenceConvertibleType, O5: SharedSequenceConvertibleType, O6: SharedSequenceConvertibleType, O7: SharedSequenceConvertibleType, O8: SharedSequenceConvertibleType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, _ source8: O8)
-        -> SharedSequence<SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element)> where SharingStrategy == O1.SharingStrategy,
-            SharingStrategy == O2.SharingStrategy,
-            SharingStrategy == O3.SharingStrategy,
-            SharingStrategy == O4.SharingStrategy,
-            SharingStrategy == O5.SharingStrategy,
-            SharingStrategy == O6.SharingStrategy,
-            SharingStrategy == O7.SharingStrategy,
-            SharingStrategy == O8.SharingStrategy {
-        let source = Observable.combineLatest(
-                source1.asSharedSequence().asObservable(), source2.asSharedSequence().asObservable(), source3.asSharedSequence().asObservable(), source4.asSharedSequence().asObservable(), source5.asSharedSequence().asObservable(), source6.asSharedSequence().asObservable(), source7.asSharedSequence().asObservable(), source8.asSharedSequence().asObservable()
-            )
-
-        return SharedSequence<O1.SharingStrategy, (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element)>(source)
-    }
-}
-
-
diff --git a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SharedSequence+Operators.swift b/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SharedSequence+Operators.swift
deleted file mode 100644
index 45383ef05..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SharedSequence+Operators.swift
+++ /dev/null
@@ -1,585 +0,0 @@
-//
-//  SharedSequence+Operators.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 9/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-// MARK: map
-extension SharedSequenceConvertibleType {
-    
-    /**
-    Projects each element of an observable sequence into a new form.
-    
-    - parameter selector: A transform function to apply to each source element.
-    - returns: An observable sequence whose elements are the result of invoking the transform function on each element of source.
-    */
-    public func map<Result>(_ selector: @escaping (Element) -> Result) -> SharedSequence<SharingStrategy, Result> {
-        let source = self
-            .asObservable()
-            .map(selector)
-        return SharedSequence<SharingStrategy, Result>(source)
-    }
-}
-
-// MARK: compactMap
-extension SharedSequenceConvertibleType {
-    
-    /**
-     Projects each element of an observable sequence into an optional form and filters all optional results.
-     
-     - parameter transform: A transform function to apply to each source element and which returns an element or nil.
-     - returns: An observable sequence whose elements are the result of filtering the transform function for each element of the source.
-     
-     */
-    public func compactMap<Result>(_ selector: @escaping (Element) -> Result?) -> SharedSequence<SharingStrategy, Result> {
-        let source = self
-            .asObservable()
-            .compactMap(selector)
-        return SharedSequence<SharingStrategy, Result>(source)
-    }
-}
-
-// MARK: filter
-extension SharedSequenceConvertibleType {
-    /**
-    Filters the elements of an observable sequence based on a predicate.
-    
-    - parameter predicate: A function to test each source element for a condition.
-    - returns: An observable sequence that contains elements from the input sequence that satisfy the condition.
-    */
-    public func filter(_ predicate: @escaping (Element) -> Bool) -> SharedSequence<SharingStrategy, Element> {
-        let source = self
-            .asObservable()
-            .filter(predicate)
-        return SharedSequence(source)
-    }
-}
-
-// MARK: switchLatest
-extension SharedSequenceConvertibleType where Element: SharedSequenceConvertibleType {
-    
-    /**
-    Transforms an observable sequence of observable sequences into an observable sequence
-    producing values only from the most recent observable sequence.
-    
-    Each time a new inner observable sequence is received, unsubscribe from the
-    previous inner observable sequence.
-    
-    - returns: The observable sequence that at any point in time produces the elements of the most recent inner observable sequence that has been received.
-    */
-    public func switchLatest() -> SharedSequence<Element.SharingStrategy, Element.Element> {
-        let source: Observable<Element.Element> = self
-            .asObservable()
-            .map { $0.asSharedSequence() }
-            .switchLatest()
-        return SharedSequence<Element.SharingStrategy, Element.Element>(source)
-    }
-}
-
-// MARK: flatMapLatest
-extension SharedSequenceConvertibleType {
-    /**
-     Projects each element of an observable sequence into a new sequence of observable sequences and then
-     transforms an observable sequence of observable sequences into an observable sequence producing values only from the most recent observable sequence.
-
-     It is a combination of `map` + `switchLatest` operator
-
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the transform function on each element of source producing an
-     Observable of Observable sequences and that at any point in time produces the elements of the most recent inner observable sequence that has been received.
-     */
-    public func flatMapLatest<Sharing, Result>(_ selector: @escaping (Element) -> SharedSequence<Sharing, Result>)
-        -> SharedSequence<Sharing, Result> {
-        let source: Observable<Result> = self
-            .asObservable()
-            .flatMapLatest(selector)
-        return SharedSequence<Sharing, Result>(source)
-    }
-}
-
-// MARK: flatMapFirst
-extension SharedSequenceConvertibleType {
-
-    /**
-     Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-     If element is received while there is some projected observable sequence being merged it will simply be ignored.
-
-     - parameter selector: A transform function to apply to element that was observed while no observable is executing in parallel.
-     - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence that was received while no other sequence was being calculated.
-     */
-    public func flatMapFirst<Sharing, Result>(_ selector: @escaping (Element) -> SharedSequence<Sharing, Result>)
-        -> SharedSequence<Sharing, Result> {
-        let source: Observable<Result> = self
-            .asObservable()
-            .flatMapFirst(selector)
-        return SharedSequence<Sharing, Result>(source)
-    }
-}
-
-// MARK: do
-extension SharedSequenceConvertibleType {
-    /**
-     Invokes an action for each event in the observable sequence, and propagates all observer messages through the result sequence.
-
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter afterNext: Action to invoke for each element after the observable has passed an onNext event along to its downstream.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter afterCompleted: Action to invoke after graceful termination of the observable sequence.
-     - parameter onSubscribe: Action to invoke before subscribing to source observable sequence.
-     - parameter onSubscribed: Action to invoke after subscribing to source observable sequence.
-     - parameter onDispose: Action to invoke after subscription to source observable has been disposed for any reason. It can be either because sequence terminates for some reason or observer subscription being disposed.
-     - returns: The source sequence with the side-effecting behavior applied.
-     */
-    public func `do`(onNext: ((Element) -> Void)? = nil, afterNext: ((Element) -> Void)? = nil, onCompleted: (() -> Void)? = nil, afterCompleted: (() -> Void)? = nil, onSubscribe: (() -> Void)? = nil, onSubscribed: (() -> Void)? = nil, onDispose: (() -> Void)? = nil)
-        -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .do(onNext: onNext, afterNext: afterNext, onCompleted: onCompleted, afterCompleted: afterCompleted, onSubscribe: onSubscribe, onSubscribed: onSubscribed, onDispose: onDispose)
-
-        return SharedSequence(source)
-    }
-}
-
-// MARK: debug
-extension SharedSequenceConvertibleType {
-    
-    /**
-    Prints received events for all observers on standard output.
-    
-    - parameter identifier: Identifier that is printed together with event description to standard output.
-    - returns: An observable sequence whose events are printed to standard output.
-    */
-    public func debug(_ identifier: String? = nil, trimOutput: Bool = false, file: String = #file, line: UInt = #line, function: String = #function) -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .debug(identifier, trimOutput: trimOutput, file: file, line: line, function: function)
-        return SharedSequence(source)
-    }
-}
-
-// MARK: distinctUntilChanged
-extension SharedSequenceConvertibleType where Element: Equatable {
-    
-    /**
-    Returns an observable sequence that contains only distinct contiguous elements according to equality operator.
-    
-    - returns: An observable sequence only containing the distinct contiguous elements, based on equality operator, from the source sequence.
-    */
-    public func distinctUntilChanged()
-        -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .distinctUntilChanged({ $0 }, comparer: { ($0 == $1) })
-            
-        return SharedSequence(source)
-    }
-}
-
-extension SharedSequenceConvertibleType {
-    
-    /**
-    Returns an observable sequence that contains only distinct contiguous elements according to the `keySelector`.
-    
-    - parameter keySelector: A function to compute the comparison key for each element.
-    - returns: An observable sequence only containing the distinct contiguous elements, based on a computed key value, from the source sequence.
-    */
-    public func distinctUntilChanged<Key: Equatable>(_ keySelector: @escaping (Element) -> Key) -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .distinctUntilChanged(keySelector, comparer: { $0 == $1 })
-        return SharedSequence(source)
-    }
-   
-    /**
-    Returns an observable sequence that contains only distinct contiguous elements according to the `comparer`.
-    
-    - parameter comparer: Equality comparer for computed key values.
-    - returns: An observable sequence only containing the distinct contiguous elements, based on `comparer`, from the source sequence.
-    */
-    public func distinctUntilChanged(_ comparer: @escaping (Element, Element) -> Bool) -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .distinctUntilChanged({ $0 }, comparer: comparer)
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-    
-    /**
-    Returns an observable sequence that contains only distinct contiguous elements according to the keySelector and the comparer.
-    
-    - parameter keySelector: A function to compute the comparison key for each element.
-    - parameter comparer: Equality comparer for computed key values.
-    - returns: An observable sequence only containing the distinct contiguous elements, based on a computed key value and the comparer, from the source sequence.
-    */
-    public func distinctUntilChanged<K>(_ keySelector: @escaping (Element) -> K, comparer: @escaping (K, K) -> Bool) -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .distinctUntilChanged(keySelector, comparer: comparer)
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-}
-
-
-// MARK: flatMap
-extension SharedSequenceConvertibleType {
-    
-    /**
-    Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-    
-    - parameter selector: A transform function to apply to each element.
-    - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence.
-    */
-    public func flatMap<Sharing, Result>(_ selector: @escaping (Element) -> SharedSequence<Sharing, Result>) -> SharedSequence<Sharing, Result> {
-        let source = self.asObservable()
-            .flatMap(selector)
-        
-        return SharedSequence(source)
-    }
-}
-
-// MARK: merge
-extension SharedSequenceConvertibleType {
-    /**
-     Merges elements from all observable sequences from collection into a single observable sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter sources: Collection of observable sequences to merge.
-     - returns: The observable sequence that merges the elements of the observable sequences.
-     */
-    public static func merge<Collection: Swift.Collection>(_ sources: Collection) -> SharedSequence<SharingStrategy, Element>
-        where Collection.Element == SharedSequence<SharingStrategy, Element> {
-        let source = Observable.merge(sources.map { $0.asObservable() })
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-
-    /**
-     Merges elements from all observable sequences from array into a single observable sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter sources: Array of observable sequences to merge.
-     - returns: The observable sequence that merges the elements of the observable sequences.
-     */
-    public static func merge(_ sources: [SharedSequence<SharingStrategy, Element>]) -> SharedSequence<SharingStrategy, Element> {
-        let source = Observable.merge(sources.map { $0.asObservable() })
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-
-    /**
-     Merges elements from all observable sequences into a single observable sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter sources: Collection of observable sequences to merge.
-     - returns: The observable sequence that merges the elements of the observable sequences.
-     */
-    public static func merge(_ sources: SharedSequence<SharingStrategy, Element>...) -> SharedSequence<SharingStrategy, Element> {
-        let source = Observable.merge(sources.map { $0.asObservable() })
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-    
-}
-
-// MARK: merge
-extension SharedSequenceConvertibleType where Element: SharedSequenceConvertibleType {
-    /**
-    Merges elements from all observable sequences in the given enumerable sequence into a single observable sequence.
-    
-    - returns: The observable sequence that merges the elements of the observable sequences.
-    */
-    public func merge() -> SharedSequence<Element.SharingStrategy, Element.Element> {
-        let source = self.asObservable()
-            .map { $0.asSharedSequence() }
-            .merge()
-        return SharedSequence<Element.SharingStrategy, Element.Element>(source)
-    }
-    
-    /**
-    Merges elements from all inner observable sequences into a single observable sequence, limiting the number of concurrent subscriptions to inner sequences.
-    
-    - parameter maxConcurrent: Maximum number of inner observable sequences being subscribed to concurrently.
-    - returns: The observable sequence that merges the elements of the inner sequences.
-    */
-    public func merge(maxConcurrent: Int)
-        -> SharedSequence<Element.SharingStrategy, Element.Element> {
-        let source = self.asObservable()
-            .map { $0.asSharedSequence() }
-            .merge(maxConcurrent: maxConcurrent)
-        return SharedSequence<Element.SharingStrategy, Element.Element>(source)
-    }
-}
-
-// MARK: throttle
-extension SharedSequenceConvertibleType {
-    
-    /**
-     Returns an Observable that emits the first and the latest item emitted by the source Observable during sequential time windows of a specified duration.
-
-     This operator makes sure that no two elements are emitted in less then dueTime.
-
-     - seealso: [debounce operator on reactivex.io](http://reactivex.io/documentation/operators/debounce.html)
-
-     - parameter dueTime: Throttling duration for each element.
-     - parameter latest: Should latest element received in a dueTime wide time window since last element emission be emitted.
-     - returns: The throttled sequence.
-    */
-    public func throttle(_ dueTime: RxTimeInterval, latest: Bool = true)
-        -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .throttle(dueTime, latest: latest, scheduler: SharingStrategy.scheduler)
-
-        return SharedSequence(source)
-    }
-
-    /**
-    Ignores elements from an observable sequence which are followed by another element within a specified relative time duration, using the specified scheduler to run throttling timers.
-    
-    - parameter dueTime: Throttling duration for each element.
-    - returns: The throttled sequence.
-    */
-    public func debounce(_ dueTime: RxTimeInterval)
-        -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .debounce(dueTime, scheduler: SharingStrategy.scheduler)
-
-        return SharedSequence(source)
-    }
-}
-
-// MARK: scan
-extension SharedSequenceConvertibleType {
-    /**
-    Applies an accumulator function over an observable sequence and returns each intermediate result. The specified seed value is used as the initial accumulator value.
-    
-    For aggregation behavior with no intermediate results, see `reduce`.
-    
-    - parameter seed: The initial accumulator value.
-    - parameter accumulator: An accumulator function to be invoked on each element.
-    - returns: An observable sequence containing the accumulated values.
-    */
-    public func scan<A>(_ seed: A, accumulator: @escaping (A, Element) -> A)
-        -> SharedSequence<SharingStrategy, A> {
-        let source = self.asObservable()
-            .scan(seed, accumulator: accumulator)
-        return SharedSequence<SharingStrategy, A>(source)
-    }
-}
-
-// MARK: concat
-
-extension SharedSequence {
-    /**
-     Concatenates all observable sequences in the given sequence, as long as the previous observable sequence terminated successfully.
-
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat<Sequence: Swift.Sequence>(_ sequence: Sequence) -> SharedSequence<SharingStrategy, Element>
-        where Sequence.Element == SharedSequence<SharingStrategy, Element> {
-            let source = Observable.concat(sequence.lazy.map { $0.asObservable() })
-            return SharedSequence<SharingStrategy, Element>(source)
-    }
-
-    /**
-     Concatenates all observable sequences in the given sequence, as long as the previous observable sequence terminated successfully.
-
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat<Collection: Swift.Collection>(_ collection: Collection) -> SharedSequence<SharingStrategy, Element>
-        where Collection.Element == SharedSequence<SharingStrategy, Element> {
-        let source = Observable.concat(collection.map { $0.asObservable() })
-        return SharedSequence<SharingStrategy, Element>(source)
-    }
-}
-
-// MARK: zip
-
-extension SharedSequence {
-    /**
-     Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-     - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-     - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-     */
-    public static func zip<Collection: Swift.Collection, Result>(_ collection: Collection, resultSelector: @escaping ([Element]) throws -> Result) -> SharedSequence<SharingStrategy, Result>
-        where Collection.Element == SharedSequence<SharingStrategy, Element> {
-        let source = Observable.zip(collection.map { $0.asSharedSequence().asObservable() }, resultSelector: resultSelector)
-        return SharedSequence<SharingStrategy, Result>(source)
-    }
-
-    /**
-     Merges the specified observable sequences into one observable sequence all of the observable sequences have produced an element at a corresponding index.
-
-     - returns: An observable sequence containing the result of combining elements of the sources.
-     */
-    public static func zip<Collection: Swift.Collection>(_ collection: Collection) -> SharedSequence<SharingStrategy, [Element]>
-        where Collection.Element == SharedSequence<SharingStrategy, Element> {
-            let source = Observable.zip(collection.map { $0.asSharedSequence().asObservable() })
-            return SharedSequence<SharingStrategy, [Element]>(source)
-    }
-}
-
-// MARK: combineLatest
-
-extension SharedSequence {
-    /**
-     Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-     - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-     - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-     */
-    public static func combineLatest<Collection: Swift.Collection, Result>(_ collection: Collection, resultSelector: @escaping ([Element]) throws -> Result) -> SharedSequence<SharingStrategy, Result>
-        where Collection.Element == SharedSequence<SharingStrategy, Element> {
-        let source = Observable.combineLatest(collection.map { $0.asObservable() }, resultSelector: resultSelector)
-        return SharedSequence<SharingStrategy, Result>(source)
-    }
-
-    /**
-     Merges the specified observable sequences into one observable sequence whenever any of the observable sequences produces an element.
-
-     - returns: An observable sequence containing the result of combining elements of the sources.
-     */
-    public static func combineLatest<Collection: Swift.Collection>(_ collection: Collection) -> SharedSequence<SharingStrategy, [Element]>
-        where Collection.Element == SharedSequence<SharingStrategy, Element> {
-        let source = Observable.combineLatest(collection.map { $0.asObservable() })
-        return SharedSequence<SharingStrategy, [Element]>(source)
-    }
-}
-
-// MARK: - withUnretained
-extension SharedSequenceConvertibleType where SharingStrategy == SignalSharingStrategy {
-    /**
-     Provides an unretained, safe to use (i.e. not implicitly unwrapped), reference to an object along with the events emitted by the sequence.
-     
-     In the case the provided object cannot be retained successfully, the seqeunce will complete.
-     
-     - note: Be careful when using this operator in a sequence that has a buffer or replay, for example `share(replay: 1)`, as the sharing buffer will also include the provided object, which could potentially cause a retain cycle.
-     
-     - parameter obj: The object to provide an unretained reference on.
-     - parameter resultSelector: A function to combine the unretained referenced on `obj` and the value of the observable sequence.
-     - returns: An observable sequence that contains the result of `resultSelector` being called with an unretained reference on `obj` and the values of the original sequence.
-     */
-    public func withUnretained<Object: AnyObject, Out>(
-        _ obj: Object,
-        resultSelector: @escaping (Object, Element) -> Out
-    ) -> SharedSequence<SharingStrategy, Out> {
-        SharedSequence(self.asObservable().withUnretained(obj, resultSelector: resultSelector))
-    }
-
-    /**
-     Provides an unretained, safe to use (i.e. not implicitly unwrapped), reference to an object along with the events emitted by the sequence.
-     
-     In the case the provided object cannot be retained successfully, the seqeunce will complete.
-     
-     - note: Be careful when using this operator in a sequence that has a buffer or replay, for example `share(replay: 1)`, as the sharing buffer will also include the provided object, which could potentially cause a retain cycle.
-     
-     - parameter obj: The object to provide an unretained reference on.
-     - returns: An observable sequence of tuples that contains both an unretained reference on `obj` and the values of the original sequence.
-     */
-    public func withUnretained<Object: AnyObject>(_ obj: Object) -> SharedSequence<SharingStrategy, (Object, Element)> {
-        withUnretained(obj) { ($0, $1) }
-    }
-}
-
-extension SharedSequenceConvertibleType where SharingStrategy == DriverSharingStrategy {
-    @available(*, message: "withUnretained has been deprecated for Driver. Consider using `drive(with:onNext:onCompleted:onDisposed:)`, instead", unavailable)
-    public func withUnretained<Object: AnyObject, Out>(
-        _ obj: Object,
-        resultSelector: @escaping (Object, Element) -> Out
-    ) -> SharedSequence<SharingStrategy, Out> {
-        SharedSequence(self.asObservable().withUnretained(obj, resultSelector: resultSelector))
-    }
-    
-    @available(*, message: "withUnretained has been deprecated for Driver. Consider using `drive(with:onNext:onCompleted:onDisposed:)`, instead", unavailable)
-    public func withUnretained<Object: AnyObject>(_ obj: Object) -> SharedSequence<SharingStrategy, (Object, Element)> {
-        SharedSequence(self.asObservable().withUnretained(obj) { ($0, $1) })
-    }
-}
-
-// MARK: withLatestFrom
-extension SharedSequenceConvertibleType {
-
-    /**
-    Merges two observable sequences into one observable sequence by combining each element from self with the latest element from the second source, if any.
-
-    - parameter second: Second observable source.
-    - parameter resultSelector: Function to invoke for each element from the self combined with the latest element from the second source, if any.
-    - returns: An observable sequence containing the result of combining each element of the self  with the latest element from the second source, if any, using the specified result selector function.
-    */
-    public func withLatestFrom<SecondO: SharedSequenceConvertibleType, ResultType>(_ second: SecondO, resultSelector: @escaping (Element, SecondO.Element) -> ResultType) -> SharedSequence<SharingStrategy, ResultType> where SecondO.SharingStrategy == SharingStrategy {
-        let source = self.asObservable()
-            .withLatestFrom(second.asSharedSequence(), resultSelector: resultSelector)
-
-        return SharedSequence<SharingStrategy, ResultType>(source)
-    }
-
-    /**
-    Merges two observable sequences into one observable sequence by using latest element from the second sequence every time when `self` emits an element.
-
-    - parameter second: Second observable source.
-    - returns: An observable sequence containing the result of combining each element of the self  with the latest element from the second source, if any, using the specified result selector function.
-    */
-    public func withLatestFrom<SecondO: SharedSequenceConvertibleType>(_ second: SecondO) -> SharedSequence<SharingStrategy, SecondO.Element> {
-        let source = self.asObservable()
-            .withLatestFrom(second.asSharedSequence())
-
-        return SharedSequence<SharingStrategy, SecondO.Element>(source)
-    }
-}
-
-// MARK: skip
-extension SharedSequenceConvertibleType {
-
-    /**
-     Bypasses a specified number of elements in an observable sequence and then returns the remaining elements.
-
-     - seealso: [skip operator on reactivex.io](http://reactivex.io/documentation/operators/skip.html)
-
-     - parameter count: The number of elements to skip before returning the remaining elements.
-     - returns: An observable sequence that contains the elements that occur after the specified index in the input sequence.
-     */
-    public func skip(_ count: Int)
-        -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .skip(count)
-        return SharedSequence(source)
-    }
-}
-
-// MARK: startWith
-extension SharedSequenceConvertibleType {
-    
-    /**
-    Prepends a value to an observable sequence.
-
-    - seealso: [startWith operator on reactivex.io](http://reactivex.io/documentation/operators/startwith.html)
-    
-    - parameter element: Element to prepend to the specified sequence.
-    - returns: The source sequence prepended with the specified values.
-    */
-    public func startWith(_ element: Element)
-        -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-                .startWith(element)
-
-        return SharedSequence(source)
-    }
-}
-
-// MARK: delay
-extension SharedSequenceConvertibleType {
-
-    /**
-     Returns an observable sequence by the source observable sequence shifted forward in time by a specified delay. Error events from the source observable sequence are not delayed.
-
-     - seealso: [delay operator on reactivex.io](http://reactivex.io/documentation/operators/delay.html)
-
-     - parameter dueTime: Relative time shift of the source by.
-     - parameter scheduler: Scheduler to run the subscription delay timer on.
-     - returns: the source Observable shifted in time by the specified delay.
-     */
-    public func delay(_ dueTime: RxTimeInterval)
-        -> SharedSequence<SharingStrategy, Element> {
-        let source = self.asObservable()
-            .delay(dueTime, scheduler: SharingStrategy.scheduler)
-
-        return SharedSequence(source)
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SharedSequence.swift b/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SharedSequence.swift
deleted file mode 100644
index 4db2ee49b..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/SharedSequence/SharedSequence.swift
+++ /dev/null
@@ -1,226 +0,0 @@
-//
-//  SharedSequence.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 8/27/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-/**
-    Trait that represents observable sequence that shares computation resources with following properties:
-
-    - it never fails
-    - it delivers events on `SharingStrategy.scheduler`
-    - sharing strategy is customizable using `SharingStrategy.share` behavior
-
-    `SharedSequence<Element>` can be considered a builder pattern for observable sequences that share computation resources.
-
-    To find out more about units and how to use them, please visit `Documentation/Traits.md`.
-*/
-public struct SharedSequence<SharingStrategy: SharingStrategyProtocol, Element> : SharedSequenceConvertibleType, ObservableConvertibleType {
-    let source: Observable<Element>
-
-    init(_ source: Observable<Element>) {
-        self.source = SharingStrategy.share(source)
-    }
-
-    init(raw: Observable<Element>) {
-        self.source = raw
-    }
-
-    #if EXPANDABLE_SHARED_SEQUENCE
-    /**
-     This method is extension hook in case this unit needs to extended from outside the library.
-     
-     By defining `EXPANDABLE_SHARED_SEQUENCE` one agrees that it's up to them to ensure shared sequence
-     properties are preserved after extension.
-    */
-    public static func createUnsafe<Source: ObservableType>(source: Source) -> SharedSequence<SharingStrategy, Source.Element> {
-        SharedSequence<SharingStrategy, Source.Element>(raw: source.asObservable())
-    }
-    #endif
-
-    /**
-    - returns: Built observable sequence.
-    */
-    public func asObservable() -> Observable<Element> {
-        self.source
-    }
-
-    /**
-    - returns: `self`
-    */
-    public func asSharedSequence() -> SharedSequence<SharingStrategy, Element> {
-        self
-    }
-}
-
-/**
- Different `SharedSequence` sharing strategies must conform to this protocol.
- */
-public protocol SharingStrategyProtocol {
-    /**
-     Scheduled on which all sequence events will be delivered.
-    */
-    static var scheduler: SchedulerType { get }
-
-    /**
-     Computation resources sharing strategy for multiple sequence observers.
-     
-     E.g. One can choose `share(replay:scope:)`
-     as sequence event sharing strategies, but also do something more exotic, like
-     implementing promises or lazy loading chains.
-    */
-    static func share<Element>(_ source: Observable<Element>) -> Observable<Element>
-}
-
-/**
-A type that can be converted to `SharedSequence`.
-*/
-public protocol SharedSequenceConvertibleType : ObservableConvertibleType {
-    associatedtype SharingStrategy: SharingStrategyProtocol
-
-    /**
-    Converts self to `SharedSequence`.
-    */
-    func asSharedSequence() -> SharedSequence<SharingStrategy, Element>
-}
-
-extension SharedSequenceConvertibleType {
-    public func asObservable() -> Observable<Element> {
-        self.asSharedSequence().asObservable()
-    }
-}
-
-
-extension SharedSequence {
-
-    /**
-    Returns an empty observable sequence, using the specified scheduler to send out the single `Completed` message.
-
-    - returns: An observable sequence with no elements.
-    */
-    public static func empty() -> SharedSequence<SharingStrategy, Element> {
-        SharedSequence(raw: Observable.empty().subscribe(on: SharingStrategy.scheduler))
-    }
-
-    /**
-    Returns a non-terminating observable sequence, which can be used to denote an infinite duration.
-
-    - returns: An observable sequence whose observers will never get called.
-    */
-    public static func never() -> SharedSequence<SharingStrategy, Element> {
-        SharedSequence(raw: Observable.never())
-    }
-
-    /**
-    Returns an observable sequence that contains a single element.
-
-    - parameter element: Single element in the resulting observable sequence.
-    - returns: An observable sequence containing the single specified element.
-    */
-    public static func just(_ element: Element) -> SharedSequence<SharingStrategy, Element> {
-        SharedSequence(raw: Observable.just(element).subscribe(on: SharingStrategy.scheduler))
-    }
-
-    /**
-     Returns an observable sequence that invokes the specified factory function whenever a new observer subscribes.
-
-     - parameter observableFactory: Observable factory function to invoke for each observer that subscribes to the resulting sequence.
-     - returns: An observable sequence whose observers trigger an invocation of the given observable factory function.
-     */
-    public static func deferred(_ observableFactory: @escaping () -> SharedSequence<SharingStrategy, Element>)
-        -> SharedSequence<SharingStrategy, Element> {
-        SharedSequence(Observable.deferred { observableFactory().asObservable() })
-    }
-
-    /**
-    This method creates a new Observable instance with a variable number of elements.
-
-    - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-
-    - parameter elements: Elements to generate.
-    - returns: The observable sequence whose elements are pulled from the given arguments.
-    */
-    public static func of(_ elements: Element ...) -> SharedSequence<SharingStrategy, Element> {
-        let source = Observable.from(elements, scheduler: SharingStrategy.scheduler)
-        return SharedSequence(raw: source)
-    }
-}
-
-extension SharedSequence {
-    
-    /**
-    This method converts an array to an observable sequence.
-     
-    - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-     
-    - returns: The observable sequence whose elements are pulled from the given enumerable sequence.
-     */
-    public static func from(_ array: [Element]) -> SharedSequence<SharingStrategy, Element> {
-        let source = Observable.from(array, scheduler: SharingStrategy.scheduler)
-        return SharedSequence(raw: source)
-    }
-    
-    /**
-     This method converts a sequence to an observable sequence.
-     
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-     
-     - returns: The observable sequence whose elements are pulled from the given enumerable sequence.
-    */
-    public static func from<Sequence: Swift.Sequence>(_ sequence: Sequence) -> SharedSequence<SharingStrategy, Element> where Sequence.Element == Element {
-        let source = Observable.from(sequence, scheduler: SharingStrategy.scheduler)
-        return SharedSequence(raw: source)
-    }
-    
-    /**
-     This method converts a optional to an observable sequence.
-     
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-     
-     - parameter optional: Optional element in the resulting observable sequence.
-     
-     - returns: An observable sequence containing the wrapped value or not from given optional.
-     */
-    public static func from(optional: Element?) -> SharedSequence<SharingStrategy, Element> {
-        let source = Observable.from(optional: optional, scheduler: SharingStrategy.scheduler)
-        return SharedSequence(raw: source)
-    }
-}
-
-extension SharedSequence where Element: RxAbstractInteger {
-    /**
-     Returns an observable sequence that produces a value after each period, using the specified scheduler to run timers and to send out observer messages.
-
-     - seealso: [interval operator on reactivex.io](http://reactivex.io/documentation/operators/interval.html)
-
-     - parameter period: Period for producing the values in the resulting sequence.
-     - returns: An observable sequence that produces a value after each period.
-     */
-    public static func interval(_ period: RxTimeInterval)
-        -> SharedSequence<SharingStrategy, Element> {
-        SharedSequence(Observable.interval(period, scheduler: SharingStrategy.scheduler))
-    }
-}
-
-// MARK: timer
-
-extension SharedSequence where Element: RxAbstractInteger {
-    /**
-     Returns an observable sequence that periodically produces a value after the specified initial relative due time has elapsed, using the specified scheduler to run timers.
-
-     - seealso: [timer operator on reactivex.io](http://reactivex.io/documentation/operators/timer.html)
-
-     - parameter dueTime: Relative time at which to produce the first value.
-     - parameter period: Period to produce subsequent values.
-     - returns: An observable sequence that produces a value after due time has elapsed and then each period.
-     */
-    public static func timer(_ dueTime: RxTimeInterval, period: RxTimeInterval)
-        -> SharedSequence<SharingStrategy, Element> {
-        SharedSequence(Observable.timer(dueTime, period: period, scheduler: SharingStrategy.scheduler))
-    }
-}
-
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Signal/ControlEvent+Signal.swift b/Pods/RxCocoa/RxCocoa/Traits/Signal/ControlEvent+Signal.swift
deleted file mode 100644
index bec4723d4..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Signal/ControlEvent+Signal.swift
+++ /dev/null
@@ -1,25 +0,0 @@
-//
-//  ControlEvent+Signal.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 11/1/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-extension ControlEvent {
-    /// Converts `ControlEvent` to `Signal` trait.
-    ///
-    /// `ControlEvent` already can't fail, so no special case needs to be handled.
-    public func asSignal() -> Signal<Element> {
-        return self.asSignal { _ -> Signal<Element> in
-            #if DEBUG
-                rxFatalError("Somehow signal received error from a source that shouldn't fail.")
-            #else
-                return Signal.empty()
-            #endif
-        }
-    }
-}
-
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Signal/ObservableConvertibleType+Signal.swift b/Pods/RxCocoa/RxCocoa/Traits/Signal/ObservableConvertibleType+Signal.swift
deleted file mode 100644
index b962d4ed0..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Signal/ObservableConvertibleType+Signal.swift
+++ /dev/null
@@ -1,57 +0,0 @@
-//
-//  ObservableConvertibleType+Signal.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 9/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-extension ObservableConvertibleType {
-    /**
-     Converts observable sequence to `Signal` trait.
-
-     - parameter onErrorJustReturn: Element to return in case of error and after that complete the sequence.
-     - returns: Signal trait.
-     */
-    public func asSignal(onErrorJustReturn: Element) -> Signal<Element> {
-        let source = self
-            .asObservable()
-            .observe(on: SignalSharingStrategy.scheduler)
-            .catchAndReturn(onErrorJustReturn)
-        return Signal(source)
-    }
-
-    /**
-     Converts observable sequence to `Signal` trait.
-
-     - parameter onErrorSignalWith: Signal that continues to emit the sequence in case of error.
-     - returns: Signal trait.
-     */
-    public func asSignal(onErrorSignalWith: Signal<Element>) -> Signal<Element> {
-        let source = self
-            .asObservable()
-            .observe(on: SignalSharingStrategy.scheduler)
-            .catch { _ in
-                onErrorSignalWith.asObservable()
-            }
-        return Signal(source)
-    }
-
-    /**
-     Converts observable sequence to `Signal` trait.
-
-     - parameter onErrorRecover: Calculates signal that continues to emit the sequence in case of error.
-     - returns: Signal trait.
-     */
-    public func asSignal(onErrorRecover: @escaping (_ error: Swift.Error) -> Signal<Element>) -> Signal<Element> {
-        let source = self
-            .asObservable()
-            .observe(on: SignalSharingStrategy.scheduler)
-            .catch { error in
-                onErrorRecover(error).asObservable()
-            }
-        return Signal(source)
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Signal/PublishRelay+Signal.swift b/Pods/RxCocoa/RxCocoa/Traits/Signal/PublishRelay+Signal.swift
deleted file mode 100644
index 79b975dbe..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Signal/PublishRelay+Signal.swift
+++ /dev/null
@@ -1,21 +0,0 @@
-//
-//  PublishRelay+Signal.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 12/28/15.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-import RxRelay
-
-extension PublishRelay {
-    /// Converts `PublishRelay` to `Signal`.
-    ///
-    /// - returns: Observable sequence.
-    public func asSignal() -> Signal<Element> {
-        let source = self.asObservable()
-            .observe(on:SignalSharingStrategy.scheduler)
-        return SharedSequence(source)
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Signal/Signal+Subscription.swift b/Pods/RxCocoa/RxCocoa/Traits/Signal/Signal+Subscription.swift
deleted file mode 100644
index ce3f94bd7..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Signal/Signal+Subscription.swift
+++ /dev/null
@@ -1,178 +0,0 @@
-//
-//  Signal+Subscription.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 9/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-import RxRelay
-
-extension SharedSequenceConvertibleType where SharingStrategy == SignalSharingStrategy {
-    /**
-     Creates new subscription and sends elements to observer.
-
-     In this form it's equivalent to `subscribe` method, but it communicates intent better.
-
-     - parameter to: Observers that receives events.
-     - returns: Disposable object that can be used to unsubscribe the observer from the subject.
-     */
-    public func emit<Observer: ObserverType>(to observers: Observer...) -> Disposable where Observer.Element == Element {
-        return self.asSharedSequence()
-                   .asObservable()
-                   .subscribe { event in
-                    observers.forEach { $0.on(event) }
-                   }
-    }
-
-    /**
-     Creates new subscription and sends elements to observer.
-
-     In this form it's equivalent to `subscribe` method, but it communicates intent better.
-
-     - parameter to: Observers that receives events.
-     - returns: Disposable object that can be used to unsubscribe the observer from the subject.
-     */
-    public func emit<Observer: ObserverType>(to observers: Observer...) -> Disposable where Observer.Element == Element? {
-        return self.asSharedSequence()
-                   .asObservable()
-                   .map { $0 as Element? }
-                   .subscribe { event in
-                       observers.forEach { $0.on(event) }
-                   }
-    }
-
-    /**
-     Creates new subscription and sends elements to `BehaviorRelay`.
-     - parameter to: Target relays for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func emit(to relays: BehaviorRelay<Element>...) -> Disposable {
-        return self.emit(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-    
-    /**
-     Creates new subscription and sends elements to `BehaviorRelay`.
-     - parameter to: Target relays for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func emit(to relays: BehaviorRelay<Element?>...) -> Disposable {
-        return self.emit(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-    
-    /**
-     Creates new subscription and sends elements to `PublishRelay`.
-
-     - parameter to: Target relays for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func emit(to relays: PublishRelay<Element>...) -> Disposable {
-        return self.emit(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-     Creates new subscription and sends elements to `PublishRelay`.
-
-     - parameter to: Target relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func emit(to relays: PublishRelay<Element?>...) -> Disposable {
-        return self.emit(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-     Creates new subscription and sends elements to `ReplayRelay`.
-
-     - parameter to: Target relays for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func emit(to relays: ReplayRelay<Element>...) -> Disposable {
-        return self.emit(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-
-    /**
-     Creates new subscription and sends elements to `ReplayRelay`.
-
-     - parameter to: Target relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer from the relay.
-     */
-    public func emit(to relays: ReplayRelay<Element?>...) -> Disposable {
-        return self.emit(onNext: { e in
-            relays.forEach { $0.accept(e) }
-        })
-    }
-    
-    /**
-     Subscribes an element handler, a completion handler and disposed handler to an observable sequence.
-
-     Also, take in an object and provide an unretained, safe to use (i.e. not implicitly unwrapped), reference to it along with the events emitted by the sequence.
-
-     Error callback is not exposed because `Signal` can't error out.
-
-     - Note: If `object` can't be retained, none of the other closures will be invoked.
-     
-     - parameter object: The object to provide an unretained reference on.
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     gracefully completed, errored, or if the generation is canceled by disposing subscription)
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription)
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func emit<Object: AnyObject>(
-        with object: Object,
-        onNext: ((Object, Element) -> Void)? = nil,
-        onCompleted: ((Object) -> Void)? = nil,
-        onDisposed: ((Object) -> Void)? = nil
-    ) -> Disposable {
-        self.asObservable().subscribe(
-            with: object,
-            onNext: onNext,
-            onCompleted: onCompleted,
-            onDisposed: onDisposed
-        )
-    }
-
-    /**
-     Subscribes an element handler, a completion handler and disposed handler to an observable sequence.
-
-     Error callback is not exposed because `Signal` can't error out.
-     
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     gracefully completed, errored, or if the generation is canceled by disposing subscription)
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription)
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func emit(
-        onNext: ((Element) -> Void)? = nil,
-        onCompleted: (() -> Void)? = nil,
-        onDisposed: (() -> Void)? = nil
-    ) -> Disposable {
-        self.asObservable().subscribe(onNext: onNext, onCompleted: onCompleted, onDisposed: onDisposed)
-    }
-
-    /**
-    Subscribes to this `Signal` with a no-op.
-    This method can be only called from `MainThread`.
-
-    - note: This is an alias of `emit(onNext: nil, onCompleted: nil, onDisposed: nil)` used to fix an ambiguity bug in Swift: https://bugs.swift.org/browse/SR-13657
-
-    - returns: Subscription object used to unsubscribe from the observable sequence.
-    */
-    public func emit() -> Disposable {
-        emit(onNext: nil, onCompleted: nil, onDisposed: nil)
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/Traits/Signal/Signal.swift b/Pods/RxCocoa/RxCocoa/Traits/Signal/Signal.swift
deleted file mode 100644
index e066b7ec2..000000000
--- a/Pods/RxCocoa/RxCocoa/Traits/Signal/Signal.swift
+++ /dev/null
@@ -1,45 +0,0 @@
-//
-//  Signal.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 9/26/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-/**
- Trait that represents observable sequence with following properties:
- 
- - it never fails
- - it delivers events on `MainScheduler.instance`
- - `share(scope: .whileConnected)` sharing strategy
-
- Additional explanation:
- - all observers share sequence computation resources
- - there is no replaying of sequence elements on new observer subscription
- - computation of elements is reference counted with respect to the number of observers
- - if there are no subscribers, it will release sequence computation resources
-
- In case trait that models state propagation is required, please check `Driver`.
-
- `Signal<Element>` can be considered a builder pattern for observable sequences that model imperative events part of the application.
- 
- To find out more about units and how to use them, please visit `Documentation/Traits.md`.
- */
-public typealias Signal<Element> = SharedSequence<SignalSharingStrategy, Element>
-
-public struct SignalSharingStrategy: SharingStrategyProtocol {
-    public static var scheduler: SchedulerType { SharingScheduler.make() }
-    
-    public static func share<Element>(_ source: Observable<Element>) -> Observable<Element> {
-        source.share(scope: .whileConnected)
-    }
-}
-
-extension SharedSequenceConvertibleType where SharingStrategy == SignalSharingStrategy {
-    /// Adds `asPublisher` to `SharingSequence` with `PublishSharingStrategy`.
-    public func asSignal() -> Signal<Element> {
-        self.asSharedSequence()
-    }
-}
diff --git a/Pods/RxCocoa/RxCocoa/iOS/DataSources/RxCollectionViewReactiveArrayDataSource.swift b/Pods/RxCocoa/RxCocoa/iOS/DataSources/RxCollectionViewReactiveArrayDataSource.swift
deleted file mode 100644
index 1acc998ae..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/DataSources/RxCollectionViewReactiveArrayDataSource.swift
+++ /dev/null
@@ -1,108 +0,0 @@
-//
-//  RxCollectionViewReactiveArrayDataSource.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-// objc monkey business
-class _RxCollectionViewReactiveArrayDataSource
-    : NSObject
-    , UICollectionViewDataSource {
-    
-    @objc(numberOfSectionsInCollectionView:)
-    func numberOfSections(in: UICollectionView) -> Int {
-        1
-    }
-
-    func _collectionView(_ collectionView: UICollectionView, numberOfItemsInSection section: Int) -> Int {
-        0
-    }
-    
-    func collectionView(_ collectionView: UICollectionView, numberOfItemsInSection section: Int) -> Int {
-        _collectionView(collectionView, numberOfItemsInSection: section)
-    }
-
-    fileprivate func _collectionView(_ collectionView: UICollectionView, cellForItemAt indexPath: IndexPath) -> UICollectionViewCell {
-        rxAbstractMethod()
-    }
-
-    func collectionView(_ collectionView: UICollectionView, cellForItemAt indexPath: IndexPath) -> UICollectionViewCell {
-        _collectionView(collectionView, cellForItemAt: indexPath)
-    }
-}
-
-class RxCollectionViewReactiveArrayDataSourceSequenceWrapper<Sequence: Swift.Sequence>
-    : RxCollectionViewReactiveArrayDataSource<Sequence.Element>
-    , RxCollectionViewDataSourceType {
-    typealias Element = Sequence
-
-    override init(cellFactory: @escaping CellFactory) {
-        super.init(cellFactory: cellFactory)
-    }
-    
-    func collectionView(_ collectionView: UICollectionView, observedEvent: Event<Sequence>) {
-        Binder(self) { collectionViewDataSource, sectionModels in
-            let sections = Array(sectionModels)
-            collectionViewDataSource.collectionView(collectionView, observedElements: sections)
-        }.on(observedEvent)
-    }
-}
-
-
-// Please take a look at `DelegateProxyType.swift`
-class RxCollectionViewReactiveArrayDataSource<Element>
-    : _RxCollectionViewReactiveArrayDataSource
-    , SectionedViewDataSourceType {
-    
-    typealias CellFactory = (UICollectionView, Int, Element) -> UICollectionViewCell
-    
-    var itemModels: [Element]?
-    
-    func modelAtIndex(_ index: Int) -> Element? {
-        itemModels?[index]
-    }
-
-    func model(at indexPath: IndexPath) throws -> Any {
-        precondition(indexPath.section == 0)
-        guard let item = itemModels?[indexPath.item] else {
-            throw RxCocoaError.itemsNotYetBound(object: self)
-        }
-        return item
-    }
-    
-    var cellFactory: CellFactory
-    
-    init(cellFactory: @escaping CellFactory) {
-        self.cellFactory = cellFactory
-    }
-    
-    // data source
-    
-    override func _collectionView(_ collectionView: UICollectionView, numberOfItemsInSection section: Int) -> Int {
-        itemModels?.count ?? 0
-    }
-    
-    override func _collectionView(_ collectionView: UICollectionView, cellForItemAt indexPath: IndexPath) -> UICollectionViewCell {
-        cellFactory(collectionView, indexPath.item, itemModels![indexPath.item])
-    }
-    
-    // reactive
-    
-    func collectionView(_ collectionView: UICollectionView, observedElements: [Element]) {
-        self.itemModels = observedElements
-        
-        collectionView.reloadData()
-
-        // workaround for http://stackoverflow.com/questions/39867325/ios-10-bug-uicollectionview-received-layout-attributes-for-a-cell-with-an-index
-        collectionView.collectionViewLayout.invalidateLayout()
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/DataSources/RxPickerViewAdapter.swift b/Pods/RxCocoa/RxCocoa/iOS/DataSources/RxPickerViewAdapter.swift
deleted file mode 100644
index 53b847549..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/DataSources/RxPickerViewAdapter.swift
+++ /dev/null
@@ -1,92 +0,0 @@
-//
-//  RxPickerViewAdapter.swift
-//  RxCocoa
-//
-//  Created by Sergey Shulga on 12/07/2017.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import UIKit
-import RxSwift
-
-class RxPickerViewArrayDataSource<T>: NSObject, UIPickerViewDataSource, SectionedViewDataSourceType {
-    fileprivate var items: [T] = []
-    
-    func model(at indexPath: IndexPath) throws -> Any {
-        guard items.indices ~= indexPath.row else {
-            throw RxCocoaError.itemsNotYetBound(object: self)
-        }
-        return items[indexPath.row]
-    }
-
-    func numberOfComponents(in pickerView: UIPickerView) -> Int {
-        1
-    }
-    
-    func pickerView(_ pickerView: UIPickerView, numberOfRowsInComponent component: Int) -> Int {
-        items.count
-    }
-}
-
-class RxPickerViewSequenceDataSource<Sequence: Swift.Sequence>
-    : RxPickerViewArrayDataSource<Sequence.Element>
-    , RxPickerViewDataSourceType {
-    typealias Element = Sequence
-
-    func pickerView(_ pickerView: UIPickerView, observedEvent: Event<Sequence>) {
-        Binder(self) { dataSource, items in
-            dataSource.items = items
-            pickerView.reloadAllComponents()
-        }
-        .on(observedEvent.map(Array.init))
-    }
-}
-
-final class RxStringPickerViewAdapter<Sequence: Swift.Sequence>
-    : RxPickerViewSequenceDataSource<Sequence>
-    , UIPickerViewDelegate {
-    
-    typealias TitleForRow = (Int, Sequence.Element) -> String?
-    private let titleForRow: TitleForRow
-    
-    init(titleForRow: @escaping TitleForRow) {
-        self.titleForRow = titleForRow
-        super.init()
-    }
-    
-    func pickerView(_ pickerView: UIPickerView, titleForRow row: Int, forComponent component: Int) -> String? {
-        titleForRow(row, items[row])
-    }
-}
-
-final class RxAttributedStringPickerViewAdapter<Sequence: Swift.Sequence>: RxPickerViewSequenceDataSource<Sequence>, UIPickerViewDelegate {
-    typealias AttributedTitleForRow = (Int, Sequence.Element) -> NSAttributedString?
-    private let attributedTitleForRow: AttributedTitleForRow
-    
-    init(attributedTitleForRow: @escaping AttributedTitleForRow) {
-        self.attributedTitleForRow = attributedTitleForRow
-        super.init()
-    }
-    
-    func pickerView(_ pickerView: UIPickerView, attributedTitleForRow row: Int, forComponent component: Int) -> NSAttributedString? {
-        attributedTitleForRow(row, items[row])
-    }
-}
-
-final class RxPickerViewAdapter<Sequence: Swift.Sequence>: RxPickerViewSequenceDataSource<Sequence>, UIPickerViewDelegate {
-    typealias ViewForRow = (Int, Sequence.Element, UIView?) -> UIView
-    private let viewForRow: ViewForRow
-    
-    init(viewForRow: @escaping ViewForRow) {
-        self.viewForRow = viewForRow
-        super.init()
-    }
-    
-    func pickerView(_ pickerView: UIPickerView, viewForRow row: Int, forComponent component: Int, reusing view: UIView?) -> UIView {
-        viewForRow(row, items[row], view)
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/DataSources/RxTableViewReactiveArrayDataSource.swift b/Pods/RxCocoa/RxCocoa/iOS/DataSources/RxTableViewReactiveArrayDataSource.swift
deleted file mode 100644
index 6d612f327..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/DataSources/RxTableViewReactiveArrayDataSource.swift
+++ /dev/null
@@ -1,101 +0,0 @@
-//
-//  RxTableViewReactiveArrayDataSource.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/26/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-// objc monkey business
-class _RxTableViewReactiveArrayDataSource
-    : NSObject
-    , UITableViewDataSource {
-    
-    func numberOfSections(in tableView: UITableView) -> Int {
-        1
-    }
-   
-    func _tableView(_ tableView: UITableView, numberOfRowsInSection section: Int) -> Int {
-        0
-    }
-    
-    func tableView(_ tableView: UITableView, numberOfRowsInSection section: Int) -> Int {
-        _tableView(tableView, numberOfRowsInSection: section)
-    }
-
-    fileprivate func _tableView(_ tableView: UITableView, cellForRowAt indexPath: IndexPath) -> UITableViewCell {
-        rxAbstractMethod()
-    }
-
-    func tableView(_ tableView: UITableView, cellForRowAt indexPath: IndexPath) -> UITableViewCell {
-        _tableView(tableView, cellForRowAt: indexPath)
-    }
-}
-
-
-class RxTableViewReactiveArrayDataSourceSequenceWrapper<Sequence: Swift.Sequence>
-    : RxTableViewReactiveArrayDataSource<Sequence.Element>
-    , RxTableViewDataSourceType {
-    typealias Element = Sequence
-
-    override init(cellFactory: @escaping CellFactory) {
-        super.init(cellFactory: cellFactory)
-    }
-
-    func tableView(_ tableView: UITableView, observedEvent: Event<Sequence>) {
-        Binder(self) { tableViewDataSource, sectionModels in
-            let sections = Array(sectionModels)
-            tableViewDataSource.tableView(tableView, observedElements: sections)
-        }.on(observedEvent)
-    }
-}
-
-// Please take a look at `DelegateProxyType.swift`
-class RxTableViewReactiveArrayDataSource<Element>
-    : _RxTableViewReactiveArrayDataSource
-    , SectionedViewDataSourceType {
-    typealias CellFactory = (UITableView, Int, Element) -> UITableViewCell
-    
-    var itemModels: [Element]?
-    
-    func modelAtIndex(_ index: Int) -> Element? {
-        itemModels?[index]
-    }
-
-    func model(at indexPath: IndexPath) throws -> Any {
-        precondition(indexPath.section == 0)
-        guard let item = itemModels?[indexPath.item] else {
-            throw RxCocoaError.itemsNotYetBound(object: self)
-        }
-        return item
-    }
-
-    let cellFactory: CellFactory
-    
-    init(cellFactory: @escaping CellFactory) {
-        self.cellFactory = cellFactory
-    }
-    
-    override func _tableView(_ tableView: UITableView, numberOfRowsInSection section: Int) -> Int {
-        itemModels?.count ?? 0
-    }
-    
-    override func _tableView(_ tableView: UITableView, cellForRowAt indexPath: IndexPath) -> UITableViewCell {
-        cellFactory(tableView, indexPath.item, itemModels![indexPath.row])
-    }
-    
-    // reactive
-    
-    func tableView(_ tableView: UITableView, observedElements: [Element]) {
-        self.itemModels = observedElements
-        
-        tableView.reloadData()
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Events/ItemEvents.swift b/Pods/RxCocoa/RxCocoa/iOS/Events/ItemEvents.swift
deleted file mode 100644
index aadf74980..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Events/ItemEvents.swift
+++ /dev/null
@@ -1,15 +0,0 @@
-//
-//  ItemEvents.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/20/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-import UIKit
-
-public typealias ItemMovedEvent = (sourceIndex: IndexPath, destinationIndex: IndexPath)
-public typealias WillDisplayCellEvent = (cell: UITableViewCell, indexPath: IndexPath)
-public typealias DidEndDisplayingCellEvent = (cell: UITableViewCell, indexPath: IndexPath)
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/NSTextStorage+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/NSTextStorage+Rx.swift
deleted file mode 100644
index ba3054761..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/NSTextStorage+Rx.swift
+++ /dev/null
@@ -1,35 +0,0 @@
-//
-//  NSTextStorage+Rx.swift
-//  RxCocoa
-//
-//  Created by Segii Shulga on 12/30/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-    import RxSwift
-    import UIKit
-    
-    extension Reactive where Base: NSTextStorage {
-
-        /// Reactive wrapper for `delegate`.
-        ///
-        /// For more information take a look at `DelegateProxyType` protocol documentation.
-        public var delegate: DelegateProxy<NSTextStorage, NSTextStorageDelegate> {
-            return RxTextStorageDelegateProxy.proxy(for: base)
-        }
-
-        /// Reactive wrapper for `delegate` message.
-        public var didProcessEditingRangeChangeInLength: Observable<(editedMask: NSTextStorage.EditActions, editedRange: NSRange, delta: Int)> {
-            return delegate
-                .methodInvoked(#selector(NSTextStorageDelegate.textStorage(_:didProcessEditing:range:changeInLength:)))
-                .map { a in
-                    let editedMask = NSTextStorage.EditActions(rawValue: try castOrThrow(UInt.self, a[1]) )
-                    let editedRange = try castOrThrow(NSValue.self, a[2]).rangeValue
-                    let delta = try castOrThrow(Int.self, a[3])
-                    
-                    return (editedMask, editedRange, delta)
-                }
-        }
-    }
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Protocols/RxCollectionViewDataSourceType.swift b/Pods/RxCocoa/RxCocoa/iOS/Protocols/RxCollectionViewDataSourceType.swift
deleted file mode 100644
index b098a9eda..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Protocols/RxCollectionViewDataSourceType.swift
+++ /dev/null
@@ -1,27 +0,0 @@
-//
-//  RxCollectionViewDataSourceType.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-/// Marks data source as `UICollectionView` reactive data source enabling it to be used with one of the `bindTo` methods.
-public protocol RxCollectionViewDataSourceType /*: UICollectionViewDataSource*/ {
-    
-    /// Type of elements that can be bound to collection view.
-    associatedtype Element
-    
-    /// New observable sequence event observed.
-    ///
-    /// - parameter collectionView: Bound collection view.
-    /// - parameter observedEvent: Event
-    func collectionView(_ collectionView: UICollectionView, observedEvent: Event<Element>)
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Protocols/RxPickerViewDataSourceType.swift b/Pods/RxCocoa/RxCocoa/iOS/Protocols/RxPickerViewDataSourceType.swift
deleted file mode 100644
index 1f390bff1..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Protocols/RxPickerViewDataSourceType.swift
+++ /dev/null
@@ -1,26 +0,0 @@
-//
-//  RxPickerViewDataSourceType.swift
-//  RxCocoa
-//
-//  Created by Sergey Shulga on 05/07/2017.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-    
-import UIKit
-import RxSwift
-
-/// Marks data source as `UIPickerView` reactive data source enabling it to be used with one of the `bindTo` methods.
-public protocol RxPickerViewDataSourceType {
-    /// Type of elements that can be bound to picker view.
-    associatedtype Element
-    
-    /// New observable sequence event observed.
-    ///
-    /// - parameter pickerView: Bound picker view.
-    /// - parameter observedEvent: Event
-    func pickerView(_ pickerView: UIPickerView, observedEvent: Event<Element>)
-}
-    
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Protocols/RxTableViewDataSourceType.swift b/Pods/RxCocoa/RxCocoa/iOS/Protocols/RxTableViewDataSourceType.swift
deleted file mode 100644
index d59af9e40..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Protocols/RxTableViewDataSourceType.swift
+++ /dev/null
@@ -1,27 +0,0 @@
-//
-//  RxTableViewDataSourceType.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/26/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-/// Marks data source as `UITableView` reactive data source enabling it to be used with one of the `bindTo` methods.
-public protocol RxTableViewDataSourceType /*: UITableViewDataSource*/ {
-    
-    /// Type of elements that can be bound to table view.
-    associatedtype Element
-    
-    /// New observable sequence event observed.
-    ///
-    /// - parameter tableView: Bound table view.
-    /// - parameter observedEvent: Event
-    func tableView(_ tableView: UITableView, observedEvent: Event<Element>)
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxCollectionViewDataSourcePrefetchingProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxCollectionViewDataSourcePrefetchingProxy.swift
deleted file mode 100644
index efb7554c7..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxCollectionViewDataSourcePrefetchingProxy.swift
+++ /dev/null
@@ -1,92 +0,0 @@
-//
-//  RxCollectionViewDataSourcePrefetchingProxy.swift
-//  RxCocoa
-//
-//  Created by Rowan Livingstone on 2/15/18.
-//  Copyright © 2018 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-@available(iOS 10.0, tvOS 10.0, *)
-extension UICollectionView: HasPrefetchDataSource {
-    public typealias PrefetchDataSource = UICollectionViewDataSourcePrefetching
-}
-
-@available(iOS 10.0, tvOS 10.0, *)
-private let collectionViewPrefetchDataSourceNotSet = CollectionViewPrefetchDataSourceNotSet()
-
-@available(iOS 10.0, tvOS 10.0, *)
-private final class CollectionViewPrefetchDataSourceNotSet
-    : NSObject
-    , UICollectionViewDataSourcePrefetching {
-
-    func collectionView(_ collectionView: UICollectionView, prefetchItemsAt indexPaths: [IndexPath]) {}
-
-}
-
-@available(iOS 10.0, tvOS 10.0, *)
-open class RxCollectionViewDataSourcePrefetchingProxy
-    : DelegateProxy<UICollectionView, UICollectionViewDataSourcePrefetching>
-    , DelegateProxyType
-    , UICollectionViewDataSourcePrefetching {
-
-    /// Typed parent object.
-    public weak private(set) var collectionView: UICollectionView?
-
-    /// - parameter collectionView: Parent object for delegate proxy.
-    public init(collectionView: ParentObject) {
-        self.collectionView = collectionView
-        super.init(parentObject: collectionView, delegateProxy: RxCollectionViewDataSourcePrefetchingProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxCollectionViewDataSourcePrefetchingProxy(collectionView: $0) }
-    }
-
-    private var _prefetchItemsPublishSubject: PublishSubject<[IndexPath]>?
-
-    /// Optimized version used for observing prefetch items callbacks.
-    internal var prefetchItemsPublishSubject: PublishSubject<[IndexPath]> {
-        if let subject = _prefetchItemsPublishSubject {
-            return subject
-        }
-
-        let subject = PublishSubject<[IndexPath]>()
-        _prefetchItemsPublishSubject = subject
-
-        return subject
-    }
-
-    private weak var _requiredMethodsPrefetchDataSource: UICollectionViewDataSourcePrefetching? = collectionViewPrefetchDataSourceNotSet
-
-    // MARK: delegate
-
-    /// Required delegate method implementation.
-    public func collectionView(_ collectionView: UICollectionView, prefetchItemsAt indexPaths: [IndexPath]) {
-        if let subject = _prefetchItemsPublishSubject {
-            subject.on(.next(indexPaths))
-        }
-
-        (_requiredMethodsPrefetchDataSource ?? collectionViewPrefetchDataSourceNotSet).collectionView(collectionView, prefetchItemsAt: indexPaths)
-    }
-
-    /// For more information take a look at `DelegateProxyType`.
-    open override func setForwardToDelegate(_ forwardToDelegate: UICollectionViewDataSourcePrefetching?, retainDelegate: Bool) {
-        _requiredMethodsPrefetchDataSource = forwardToDelegate ?? collectionViewPrefetchDataSourceNotSet
-        super.setForwardToDelegate(forwardToDelegate, retainDelegate: retainDelegate)
-    }
-
-    deinit {
-        if let subject = _prefetchItemsPublishSubject {
-            subject.on(.completed)
-        }
-    }
-
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxCollectionViewDataSourceProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxCollectionViewDataSourceProxy.swift
deleted file mode 100644
index 793e54485..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxCollectionViewDataSourceProxy.swift
+++ /dev/null
@@ -1,76 +0,0 @@
-//
-//  RxCollectionViewDataSourceProxy.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-extension UICollectionView: HasDataSource {
-    public typealias DataSource = UICollectionViewDataSource
-}
-
-private let collectionViewDataSourceNotSet = CollectionViewDataSourceNotSet()
-
-private final class CollectionViewDataSourceNotSet
-    : NSObject
-    , UICollectionViewDataSource {
-
-    func collectionView(_ collectionView: UICollectionView, numberOfItemsInSection section: Int) -> Int {
-        0
-    }
-    
-    // The cell that is returned must be retrieved from a call to -dequeueReusableCellWithReuseIdentifier:forIndexPath:
-    func collectionView(_ collectionView: UICollectionView, cellForItemAt indexPath: IndexPath) -> UICollectionViewCell {
-        rxAbstractMethod(message: dataSourceNotSet)
-    }
-    
-}
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxCollectionViewDataSourceProxy
-    : DelegateProxy<UICollectionView, UICollectionViewDataSource>
-    , DelegateProxyType 
-    , UICollectionViewDataSource {
-
-    /// Typed parent object.
-    public weak private(set) var collectionView: UICollectionView?
-
-    /// - parameter collectionView: Parent object for delegate proxy.
-    public init(collectionView: ParentObject) {
-        self.collectionView = collectionView
-        super.init(parentObject: collectionView, delegateProxy: RxCollectionViewDataSourceProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxCollectionViewDataSourceProxy(collectionView: $0) }
-    }
-
-    private weak var _requiredMethodsDataSource: UICollectionViewDataSource? = collectionViewDataSourceNotSet
-
-    // MARK: delegate
-
-    /// Required delegate method implementation.
-    public func collectionView(_ collectionView: UICollectionView, numberOfItemsInSection section: Int) -> Int {
-        (_requiredMethodsDataSource ?? collectionViewDataSourceNotSet).collectionView(collectionView, numberOfItemsInSection: section)
-    }
-    
-    /// Required delegate method implementation.
-    public func collectionView(_ collectionView: UICollectionView, cellForItemAt indexPath: IndexPath) -> UICollectionViewCell {
-        (_requiredMethodsDataSource ?? collectionViewDataSourceNotSet).collectionView(collectionView, cellForItemAt: indexPath)
-    }
-
-    /// For more information take a look at `DelegateProxyType`.
-    open override func setForwardToDelegate(_ forwardToDelegate: UICollectionViewDataSource?, retainDelegate: Bool) {
-        _requiredMethodsDataSource = forwardToDelegate ?? collectionViewDataSourceNotSet
-        super.setForwardToDelegate(forwardToDelegate, retainDelegate: retainDelegate)
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxCollectionViewDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxCollectionViewDelegateProxy.swift
deleted file mode 100644
index dd8f4b43b..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxCollectionViewDelegateProxy.swift
+++ /dev/null
@@ -1,32 +0,0 @@
-//
-//  RxCollectionViewDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxCollectionViewDelegateProxy
-    : RxScrollViewDelegateProxy
-    , UICollectionViewDelegate
-    , UICollectionViewDelegateFlowLayout {
-
-    /// Typed parent object.
-    public weak private(set) var collectionView: UICollectionView?
-
-    /// Initializes `RxCollectionViewDelegateProxy`
-    ///
-    /// - parameter collectionView: Parent object for delegate proxy.
-    public init(collectionView: UICollectionView) {
-        self.collectionView = collectionView
-        super.init(scrollView: collectionView)
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxNavigationControllerDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxNavigationControllerDelegateProxy.swift
deleted file mode 100644
index 372bf7959..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxNavigationControllerDelegateProxy.swift
+++ /dev/null
@@ -1,38 +0,0 @@
-//
-//  RxNavigationControllerDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Diogo on 13/04/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-    import UIKit
-    import RxSwift
-
-    extension UINavigationController: HasDelegate {
-        public typealias Delegate = UINavigationControllerDelegate
-    }
-
-    /// For more information take a look at `DelegateProxyType`.
-    open class RxNavigationControllerDelegateProxy
-        : DelegateProxy<UINavigationController, UINavigationControllerDelegate>
-        , DelegateProxyType 
-        , UINavigationControllerDelegate {
-
-        /// Typed parent object.
-        public weak private(set) var navigationController: UINavigationController?
-
-        /// - parameter navigationController: Parent object for delegate proxy.
-        public init(navigationController: ParentObject) {
-            self.navigationController = navigationController
-            super.init(parentObject: navigationController, delegateProxy: RxNavigationControllerDelegateProxy.self)
-        }
-
-        // Register known implementations
-        public static func registerKnownImplementations() {
-            self.register { RxNavigationControllerDelegateProxy(navigationController: $0) }
-        }
-    }
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxPickerViewDataSourceProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxPickerViewDataSourceProxy.swift
deleted file mode 100644
index f9c65d1cd..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxPickerViewDataSourceProxy.swift
+++ /dev/null
@@ -1,71 +0,0 @@
-//
-//  RxPickerViewDataSourceProxy.swift
-//  RxCocoa
-//
-//  Created by Sergey Shulga on 05/07/2017.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import UIKit
-import RxSwift
-
-extension UIPickerView: HasDataSource {
-    public typealias DataSource = UIPickerViewDataSource
-}
-
-private let pickerViewDataSourceNotSet = PickerViewDataSourceNotSet()
-
-final private class PickerViewDataSourceNotSet: NSObject, UIPickerViewDataSource {
-    func numberOfComponents(in pickerView: UIPickerView) -> Int {
-        0
-    }
-    
-    func pickerView(_ pickerView: UIPickerView, numberOfRowsInComponent component: Int) -> Int {
-        0
-    }
-}
-
-/// For more information take a look at `DelegateProxyType`.
-public class RxPickerViewDataSourceProxy
-    : DelegateProxy<UIPickerView, UIPickerViewDataSource>
-    , DelegateProxyType
-    , UIPickerViewDataSource {
-
-    /// Typed parent object.
-    public weak private(set) var pickerView: UIPickerView?
-
-    /// - parameter pickerView: Parent object for delegate proxy.
-    public init(pickerView: ParentObject) {
-        self.pickerView = pickerView
-        super.init(parentObject: pickerView, delegateProxy: RxPickerViewDataSourceProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxPickerViewDataSourceProxy(pickerView: $0) }
-    }
-
-    private weak var _requiredMethodsDataSource: UIPickerViewDataSource? = pickerViewDataSourceNotSet
-
-    // MARK: UIPickerViewDataSource
-
-    /// Required delegate method implementation.
-    public func numberOfComponents(in pickerView: UIPickerView) -> Int {
-        (_requiredMethodsDataSource ?? pickerViewDataSourceNotSet).numberOfComponents(in: pickerView)
-    }
-
-    /// Required delegate method implementation.
-    public func pickerView(_ pickerView: UIPickerView, numberOfRowsInComponent component: Int) -> Int {
-        (_requiredMethodsDataSource ?? pickerViewDataSourceNotSet).pickerView(pickerView, numberOfRowsInComponent: component)
-    }
-    
-    /// For more information take a look at `DelegateProxyType`.
-    public override func setForwardToDelegate(_ forwardToDelegate: UIPickerViewDataSource?, retainDelegate: Bool) {
-        _requiredMethodsDataSource = forwardToDelegate ?? pickerViewDataSourceNotSet
-        super.setForwardToDelegate(forwardToDelegate, retainDelegate: retainDelegate)
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxPickerViewDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxPickerViewDelegateProxy.swift
deleted file mode 100644
index 922126f84..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxPickerViewDelegateProxy.swift
+++ /dev/null
@@ -1,37 +0,0 @@
-//
-//  RxPickerViewDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Segii Shulga on 5/12/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-    import RxSwift
-    import UIKit
-
-    extension UIPickerView: HasDelegate {
-        public typealias Delegate = UIPickerViewDelegate
-    }
-
-    open class RxPickerViewDelegateProxy
-        : DelegateProxy<UIPickerView, UIPickerViewDelegate>
-        , DelegateProxyType 
-        , UIPickerViewDelegate {
-
-        /// Typed parent object.
-        public weak private(set) var pickerView: UIPickerView?
-
-        /// - parameter pickerView: Parent object for delegate proxy.
-        public init(pickerView: ParentObject) {
-            self.pickerView = pickerView
-            super.init(parentObject: pickerView, delegateProxy: RxPickerViewDelegateProxy.self)
-        }
-
-        // Register known implementationss
-        public static func registerKnownImplementations() {
-            self.register { RxPickerViewDelegateProxy(pickerView: $0) }
-        }
-    }
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxScrollViewDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxScrollViewDelegateProxy.swift
deleted file mode 100644
index 59608d3b1..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxScrollViewDelegateProxy.swift
+++ /dev/null
@@ -1,92 +0,0 @@
-//
-//  RxScrollViewDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import RxSwift
-import UIKit
-    
-extension UIScrollView: HasDelegate {
-    public typealias Delegate = UIScrollViewDelegate
-}
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxScrollViewDelegateProxy
-    : DelegateProxy<UIScrollView, UIScrollViewDelegate>
-    , DelegateProxyType 
-    , UIScrollViewDelegate {
-
-    /// Typed parent object.
-    public weak private(set) var scrollView: UIScrollView?
-
-    /// - parameter scrollView: Parent object for delegate proxy.
-    public init(scrollView: ParentObject) {
-        self.scrollView = scrollView
-        super.init(parentObject: scrollView, delegateProxy: RxScrollViewDelegateProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxScrollViewDelegateProxy(scrollView: $0) }
-        self.register { RxTableViewDelegateProxy(tableView: $0) }
-        self.register { RxCollectionViewDelegateProxy(collectionView: $0) }
-        self.register { RxTextViewDelegateProxy(textView: $0) }
-    }
-
-    private var _contentOffsetBehaviorSubject: BehaviorSubject<CGPoint>?
-    private var _contentOffsetPublishSubject: PublishSubject<()>?
-
-    /// Optimized version used for observing content offset changes.
-    internal var contentOffsetBehaviorSubject: BehaviorSubject<CGPoint> {
-        if let subject = _contentOffsetBehaviorSubject {
-            return subject
-        }
-
-        let subject = BehaviorSubject<CGPoint>(value: self.scrollView?.contentOffset ?? CGPoint.zero)
-        _contentOffsetBehaviorSubject = subject
-
-        return subject
-    }
-
-    /// Optimized version used for observing content offset changes.
-    internal var contentOffsetPublishSubject: PublishSubject<()> {
-        if let subject = _contentOffsetPublishSubject {
-            return subject
-        }
-
-        let subject = PublishSubject<()>()
-        _contentOffsetPublishSubject = subject
-
-        return subject
-    }
-    
-    // MARK: delegate methods
-
-    /// For more information take a look at `DelegateProxyType`.
-    public func scrollViewDidScroll(_ scrollView: UIScrollView) {
-        if let subject = _contentOffsetBehaviorSubject {
-            subject.on(.next(scrollView.contentOffset))
-        }
-        if let subject = _contentOffsetPublishSubject {
-            subject.on(.next(()))
-        }
-        self._forwardToDelegate?.scrollViewDidScroll?(scrollView)
-    }
-    
-    deinit {
-        if let subject = _contentOffsetBehaviorSubject {
-            subject.on(.completed)
-        }
-
-        if let subject = _contentOffsetPublishSubject {
-            subject.on(.completed)
-        }
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxSearchBarDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxSearchBarDelegateProxy.swift
deleted file mode 100644
index 532ab6872..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxSearchBarDelegateProxy.swift
+++ /dev/null
@@ -1,39 +0,0 @@
-//
-//  RxSearchBarDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 7/4/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-extension UISearchBar: HasDelegate {
-    public typealias Delegate = UISearchBarDelegate
-}
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxSearchBarDelegateProxy
-    : DelegateProxy<UISearchBar, UISearchBarDelegate>
-    , DelegateProxyType 
-    , UISearchBarDelegate {
-
-    /// Typed parent object.
-    public weak private(set) var searchBar: UISearchBar?
-
-    /// - parameter searchBar: Parent object for delegate proxy.
-    public init(searchBar: ParentObject) {
-        self.searchBar = searchBar
-        super.init(parentObject: searchBar, delegateProxy: RxSearchBarDelegateProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxSearchBarDelegateProxy(searchBar: $0) }
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxSearchControllerDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxSearchControllerDelegateProxy.swift
deleted file mode 100644
index 04e0de096..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxSearchControllerDelegateProxy.swift
+++ /dev/null
@@ -1,39 +0,0 @@
-//
-//  RxSearchControllerDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Segii Shulga on 3/17/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import RxSwift
-import UIKit
-
-extension UISearchController: HasDelegate {
-    public typealias Delegate = UISearchControllerDelegate
-}
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxSearchControllerDelegateProxy
-    : DelegateProxy<UISearchController, UISearchControllerDelegate>
-    , DelegateProxyType 
-    , UISearchControllerDelegate {
-
-    /// Typed parent object.
-    public weak private(set) var searchController: UISearchController?
-
-    /// - parameter searchController: Parent object for delegate proxy.
-    public init(searchController: UISearchController) {
-        self.searchController = searchController
-        super.init(parentObject: searchController, delegateProxy: RxSearchControllerDelegateProxy.self)
-    }
-    
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxSearchControllerDelegateProxy(searchController: $0) }
-    }
-}
-   
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTabBarControllerDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTabBarControllerDelegateProxy.swift
deleted file mode 100644
index 585894ce2..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTabBarControllerDelegateProxy.swift
+++ /dev/null
@@ -1,39 +0,0 @@
-//
-//  RxTabBarControllerDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Yusuke Kita on 2016/12/07.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-extension UITabBarController: HasDelegate {
-    public typealias Delegate = UITabBarControllerDelegate
-}
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxTabBarControllerDelegateProxy
-    : DelegateProxy<UITabBarController, UITabBarControllerDelegate>
-    , DelegateProxyType 
-    , UITabBarControllerDelegate {
-
-    /// Typed parent object.
-    public weak private(set) var tabBar: UITabBarController?
-
-    /// - parameter tabBar: Parent object for delegate proxy.
-    public init(tabBar: ParentObject) {
-        self.tabBar = tabBar
-        super.init(parentObject: tabBar, delegateProxy: RxTabBarControllerDelegateProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxTabBarControllerDelegateProxy(tabBar: $0) }
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTabBarDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTabBarDelegateProxy.swift
deleted file mode 100644
index 620573090..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTabBarDelegateProxy.swift
+++ /dev/null
@@ -1,49 +0,0 @@
-//
-//  RxTabBarDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Jesse Farless on 5/14/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-extension UITabBar: HasDelegate {
-    public typealias Delegate = UITabBarDelegate
-}
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxTabBarDelegateProxy
-    : DelegateProxy<UITabBar, UITabBarDelegate>
-    , DelegateProxyType 
-    , UITabBarDelegate {
-
-    /// Typed parent object.
-    public weak private(set) var tabBar: UITabBar?
-
-    /// - parameter tabBar: Parent object for delegate proxy.
-    public init(tabBar: ParentObject) {
-        self.tabBar = tabBar
-        super.init(parentObject: tabBar, delegateProxy: RxTabBarDelegateProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxTabBarDelegateProxy(tabBar: $0) }
-    }
-
-    /// For more information take a look at `DelegateProxyType`.
-    open class func currentDelegate(for object: ParentObject) -> UITabBarDelegate? {
-        object.delegate
-    }
-
-    /// For more information take a look at `DelegateProxyType`.
-    open class func setCurrentDelegate(_ delegate: UITabBarDelegate?, to object: ParentObject) {
-        object.delegate = delegate
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTableViewDataSourcePrefetchingProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTableViewDataSourcePrefetchingProxy.swift
deleted file mode 100644
index 4345312e4..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTableViewDataSourcePrefetchingProxy.swift
+++ /dev/null
@@ -1,93 +0,0 @@
-//
-//  RxTableViewDataSourcePrefetchingProxy.swift
-//  RxCocoa
-//
-//  Created by Rowan Livingstone on 2/15/18.
-//  Copyright © 2018 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-@available(iOS 10.0, tvOS 10.0, *)
-extension UITableView: HasPrefetchDataSource {
-    public typealias PrefetchDataSource = UITableViewDataSourcePrefetching
-}
-
-@available(iOS 10.0, tvOS 10.0, *)
-private let tableViewPrefetchDataSourceNotSet = TableViewPrefetchDataSourceNotSet()
-
-@available(iOS 10.0, tvOS 10.0, *)
-private final class TableViewPrefetchDataSourceNotSet
-    : NSObject
-    , UITableViewDataSourcePrefetching {
-
-    func tableView(_ tableView: UITableView, prefetchRowsAt indexPaths: [IndexPath]) {}
-
-}
-
-@available(iOS 10.0, tvOS 10.0, *)
-open class RxTableViewDataSourcePrefetchingProxy
-    : DelegateProxy<UITableView, UITableViewDataSourcePrefetching>
-    , DelegateProxyType
-    , UITableViewDataSourcePrefetching {
-
-    /// Typed parent object.
-    public weak private(set) var tableView: UITableView?
-
-    /// - parameter tableView: Parent object for delegate proxy.
-    public init(tableView: ParentObject) {
-        self.tableView = tableView
-        super.init(parentObject: tableView, delegateProxy: RxTableViewDataSourcePrefetchingProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxTableViewDataSourcePrefetchingProxy(tableView: $0) }
-    }
-
-    private var _prefetchRowsPublishSubject: PublishSubject<[IndexPath]>?
-
-    /// Optimized version used for observing prefetch rows callbacks.
-    internal var prefetchRowsPublishSubject: PublishSubject<[IndexPath]> {
-        if let subject = _prefetchRowsPublishSubject {
-            return subject
-        }
-
-        let subject = PublishSubject<[IndexPath]>()
-        _prefetchRowsPublishSubject = subject
-
-        return subject
-    }
-
-    private weak var _requiredMethodsPrefetchDataSource: UITableViewDataSourcePrefetching? = tableViewPrefetchDataSourceNotSet
-
-    // MARK: delegate
-
-    /// Required delegate method implementation.
-    public func tableView(_ tableView: UITableView, prefetchRowsAt indexPaths: [IndexPath]) {
-        if let subject = _prefetchRowsPublishSubject {
-            subject.on(.next(indexPaths))
-        }
-
-        (_requiredMethodsPrefetchDataSource ?? tableViewPrefetchDataSourceNotSet).tableView(tableView, prefetchRowsAt: indexPaths)
-    }
-
-    /// For more information take a look at `DelegateProxyType`.
-    open override func setForwardToDelegate(_ forwardToDelegate: UITableViewDataSourcePrefetching?, retainDelegate: Bool) {
-        _requiredMethodsPrefetchDataSource = forwardToDelegate ?? tableViewPrefetchDataSourceNotSet
-        super.setForwardToDelegate(forwardToDelegate, retainDelegate: retainDelegate)
-    }
-
-    deinit {
-        if let subject = _prefetchRowsPublishSubject {
-            subject.on(.completed)
-        }
-    }
-
-}
-
-#endif
-
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTableViewDataSourceProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTableViewDataSourceProxy.swift
deleted file mode 100644
index 42d9386e5..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTableViewDataSourceProxy.swift
+++ /dev/null
@@ -1,75 +0,0 @@
-//
-//  RxTableViewDataSourceProxy.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-    
-extension UITableView: HasDataSource {
-    public typealias DataSource = UITableViewDataSource
-}
-
-private let tableViewDataSourceNotSet = TableViewDataSourceNotSet()
-
-private final class TableViewDataSourceNotSet
-    : NSObject
-    , UITableViewDataSource {
-
-    func tableView(_ tableView: UITableView, numberOfRowsInSection section: Int) -> Int {
-        0
-    }
-    
-    func tableView(_ tableView: UITableView, cellForRowAt indexPath: IndexPath) -> UITableViewCell {
-        rxAbstractMethod(message: dataSourceNotSet)
-    }
-}
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxTableViewDataSourceProxy
-    : DelegateProxy<UITableView, UITableViewDataSource>
-    , DelegateProxyType 
-    , UITableViewDataSource {
-
-    /// Typed parent object.
-    public weak private(set) var tableView: UITableView?
-
-    /// - parameter tableView: Parent object for delegate proxy.
-    public init(tableView: UITableView) {
-        self.tableView = tableView
-        super.init(parentObject: tableView, delegateProxy: RxTableViewDataSourceProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxTableViewDataSourceProxy(tableView: $0) }
-    }
-
-    private weak var _requiredMethodsDataSource: UITableViewDataSource? = tableViewDataSourceNotSet
-
-    // MARK: delegate
-
-    /// Required delegate method implementation.
-    public func tableView(_ tableView: UITableView, numberOfRowsInSection section: Int) -> Int {
-        (_requiredMethodsDataSource ?? tableViewDataSourceNotSet).tableView(tableView, numberOfRowsInSection: section)
-    }
-
-    /// Required delegate method implementation.
-    public func tableView(_ tableView: UITableView, cellForRowAt indexPath: IndexPath) -> UITableViewCell {
-        (_requiredMethodsDataSource ?? tableViewDataSourceNotSet).tableView(tableView, cellForRowAt: indexPath)
-    }
-
-    /// For more information take a look at `DelegateProxyType`.
-    open override func setForwardToDelegate(_ forwardToDelegate: UITableViewDataSource?, retainDelegate: Bool) {
-        _requiredMethodsDataSource = forwardToDelegate  ?? tableViewDataSourceNotSet
-        super.setForwardToDelegate(forwardToDelegate, retainDelegate: retainDelegate)
-    }
-
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTableViewDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTableViewDelegateProxy.swift
deleted file mode 100644
index 86a875857..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTableViewDelegateProxy.swift
+++ /dev/null
@@ -1,30 +0,0 @@
-//
-//  RxTableViewDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 6/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxTableViewDelegateProxy
-    : RxScrollViewDelegateProxy
-    , UITableViewDelegate {
-
-    /// Typed parent object.
-    public weak private(set) var tableView: UITableView?
-
-    /// - parameter tableView: Parent object for delegate proxy.
-    public init(tableView: UITableView) {
-        self.tableView = tableView
-        super.init(scrollView: tableView)
-    }
-
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTextStorageDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTextStorageDelegateProxy.swift
deleted file mode 100644
index 12669f9ca..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTextStorageDelegateProxy.swift
+++ /dev/null
@@ -1,37 +0,0 @@
-//
-//  RxTextStorageDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Segii Shulga on 12/30/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-    import RxSwift
-    import UIKit
-
-    extension NSTextStorage: HasDelegate {
-        public typealias Delegate = NSTextStorageDelegate
-    }
-
-    open class RxTextStorageDelegateProxy
-        : DelegateProxy<NSTextStorage, NSTextStorageDelegate>
-        , DelegateProxyType 
-        , NSTextStorageDelegate {
-
-        /// Typed parent object.
-        public weak private(set) var textStorage: NSTextStorage?
-
-        /// - parameter textStorage: Parent object for delegate proxy.
-        public init(textStorage: NSTextStorage) {
-            self.textStorage = textStorage
-            super.init(parentObject: textStorage, delegateProxy: RxTextStorageDelegateProxy.self)
-        }
-
-        // Register known implementations
-        public static func registerKnownImplementations() {
-            self.register { RxTextStorageDelegateProxy(textStorage: $0) }
-        }
-    }
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTextViewDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTextViewDelegateProxy.swift
deleted file mode 100644
index c8a1dfd67..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxTextViewDelegateProxy.swift
+++ /dev/null
@@ -1,43 +0,0 @@
-//
-//  RxTextViewDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Yuta ToKoRo on 7/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-/// For more information take a look at `DelegateProxyType`.
-open class RxTextViewDelegateProxy
-    : RxScrollViewDelegateProxy
-    , UITextViewDelegate {
-
-    /// Typed parent object.
-    public weak private(set) var textView: UITextView?
-
-    /// - parameter textview: Parent object for delegate proxy.
-    public init(textView: UITextView) {
-        self.textView = textView
-        super.init(scrollView: textView)
-    }
-
-    // MARK: delegate methods
-
-    /// For more information take a look at `DelegateProxyType`.
-    @objc open func textView(_ textView: UITextView, shouldChangeTextIn range: NSRange, replacementText text: String) -> Bool {
-        /**
-         We've had some issues with observing text changes. This is here just in case we need the same hack in future and that 
-         we wouldn't need to change the public interface.
-        */
-        let forwardToDelegate = self.forwardToDelegate() as? UITextViewDelegate
-        return forwardToDelegate?.textView?(textView,
-            shouldChangeTextIn: range,
-            replacementText: text) ?? true
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxWKNavigationDelegateProxy.swift b/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxWKNavigationDelegateProxy.swift
deleted file mode 100644
index c758c0212..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/Proxies/RxWKNavigationDelegateProxy.swift
+++ /dev/null
@@ -1,43 +0,0 @@
-//
-//  RxWKNavigationDelegateProxy.swift
-//  RxCocoa
-//
-//  Created by Giuseppe Lanza on 14/02/2020.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(macOS)
-
-import RxSwift
-import WebKit
-
-@available(iOS 8.0, OSX 10.10, OSXApplicationExtension 10.10, *)
-open class RxWKNavigationDelegateProxy
-    : DelegateProxy<WKWebView, WKNavigationDelegate>
-    , DelegateProxyType
-, WKNavigationDelegate {
-
-    /// Typed parent object.
-    public weak private(set) var webView: WKWebView?
-
-    /// - parameter webView: Parent object for delegate proxy.
-    public init(webView: ParentObject) {
-        self.webView = webView
-        super.init(parentObject: webView, delegateProxy: RxWKNavigationDelegateProxy.self)
-    }
-
-    // Register known implementations
-    public static func registerKnownImplementations() {
-        self.register { RxWKNavigationDelegateProxy(webView: $0) }
-    }
-    
-    public static func currentDelegate(for object: WKWebView) -> WKNavigationDelegate? {
-        object.navigationDelegate
-    }
-    
-    public static func setCurrentDelegate(_ delegate: WKNavigationDelegate?, to object: WKWebView) {
-        object.navigationDelegate = delegate
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIActivityIndicatorView+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIActivityIndicatorView+Rx.swift
deleted file mode 100644
index ca2d4f1b1..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIActivityIndicatorView+Rx.swift
+++ /dev/null
@@ -1,27 +0,0 @@
-//
-//  UIActivityIndicatorView+Rx.swift
-//  RxCocoa
-//
-//  Created by Ivan Persidskiy on 02/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-extension Reactive where Base: UIActivityIndicatorView {
-    /// Bindable sink for `startAnimating()`, `stopAnimating()` methods.
-    public var isAnimating: Binder<Bool> {
-        Binder(self.base) { activityIndicator, active in
-            if active {
-                activityIndicator.startAnimating()
-            } else {
-                activityIndicator.stopAnimating()
-            }
-        }
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIApplication+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIApplication+Rx.swift
deleted file mode 100644
index d7761058b..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIApplication+Rx.swift
+++ /dev/null
@@ -1,106 +0,0 @@
-//
-//  UIApplication+Rx.swift
-//  RxCocoa
-//
-//  Created by Mads Bøgeskov on 18/01/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import UIKit
-import RxSwift
-
-extension Reactive where Base: UIApplication {
-    /// Bindable sink for `isNetworkActivityIndicatorVisible`.
-    public var isNetworkActivityIndicatorVisible: Binder<Bool> {
-        return Binder(self.base) { application, active in
-            application.isNetworkActivityIndicatorVisible = active
-        }
-    }
-    
-    /// Reactive wrapper for `UIApplication.didEnterBackgroundNotification`
-    public static var didEnterBackground: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.didEnterBackgroundNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.willEnterForegroundNotification`
-    public static var willEnterForeground: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.willEnterForegroundNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.didFinishLaunchingNotification`
-    public static var didFinishLaunching: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.didFinishLaunchingNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.didBecomeActiveNotification`
-    public static var didBecomeActive: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.didBecomeActiveNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.willResignActiveNotification`
-    public static var willResignActive: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.willResignActiveNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.didReceiveMemoryWarningNotification`
-    public static var didReceiveMemoryWarning: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.didReceiveMemoryWarningNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.willTerminateNotification`
-    public static var willTerminate: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.willTerminateNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.significantTimeChangeNotification`
-    public static var significantTimeChange: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.significantTimeChangeNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.backgroundRefreshStatusDidChangeNotification`
-    public static var backgroundRefreshStatusDidChange: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.backgroundRefreshStatusDidChangeNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.protectedDataWillBecomeUnavailableNotification`
-    public static var protectedDataWillBecomeUnavailable: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.protectedDataWillBecomeUnavailableNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.protectedDataDidBecomeAvailableNotification`
-    public static var protectedDataDidBecomeAvailable: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.protectedDataDidBecomeAvailableNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `UIApplication.userDidTakeScreenshotNotification`
-    public static var userDidTakeScreenshot: ControlEvent<Void> {
-        let source = NotificationCenter.default.rx.notification(UIApplication.userDidTakeScreenshotNotification).map { _ in }
-        
-        return ControlEvent(events: source)
-    }
-}
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIBarButtonItem+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIBarButtonItem+Rx.swift
deleted file mode 100644
index 0bcaa9942..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIBarButtonItem+Rx.swift
+++ /dev/null
@@ -1,72 +0,0 @@
-//
-//  UIBarButtonItem+Rx.swift
-//  RxCocoa
-//
-//  Created by Daniel Tartaglia on 5/31/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-private var rx_tap_key: UInt8 = 0
-
-extension Reactive where Base: UIBarButtonItem {
-    /// Reactive wrapper for target action pattern on `self`.
-    public var tap: ControlEvent<()> {
-        let source = lazyInstanceObservable(&rx_tap_key) { () -> Observable<()> in
-            Observable.create { [weak control = self.base] observer in
-                guard let control = control else {
-                    observer.on(.completed)
-                    return Disposables.create()
-                }
-                let target = BarButtonItemTarget(barButtonItem: control) {
-                    observer.on(.next(()))
-                }
-                return target
-            }
-            .take(until: self.deallocated)
-            .share()
-        }
-        
-        return ControlEvent(events: source)
-    }
-}
-
-
-@objc
-final class BarButtonItemTarget: RxTarget {
-    typealias Callback = () -> Void
-    
-    weak var barButtonItem: UIBarButtonItem?
-    var callback: Callback!
-    
-    init(barButtonItem: UIBarButtonItem, callback: @escaping () -> Void) {
-        self.barButtonItem = barButtonItem
-        self.callback = callback
-        super.init()
-        barButtonItem.target = self
-        barButtonItem.action = #selector(BarButtonItemTarget.action(_:))
-    }
-    
-    override func dispose() {
-        super.dispose()
-#if DEBUG
-        MainScheduler.ensureRunningOnMainThread()
-#endif
-        
-        barButtonItem?.target = nil
-        barButtonItem?.action = nil
-        
-        callback = nil
-    }
-    
-    @objc func action(_ sender: AnyObject) {
-        callback()
-    }
-    
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIButton+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIButton+Rx.swift
deleted file mode 100644
index 4d0f4c323..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIButton+Rx.swift
+++ /dev/null
@@ -1,82 +0,0 @@
-//
-//  UIButton+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 3/28/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import RxSwift
-import UIKit
-
-extension Reactive where Base: UIButton {
-    
-    /// Reactive wrapper for `TouchUpInside` control event.
-    public var tap: ControlEvent<Void> {
-        controlEvent(.touchUpInside)
-    }
-}
-
-#endif
-
-#if os(tvOS)
-
-import RxSwift
-import UIKit
-
-extension Reactive where Base: UIButton {
-
-    /// Reactive wrapper for `PrimaryActionTriggered` control event.
-    public var primaryAction: ControlEvent<Void> {
-        controlEvent(.primaryActionTriggered)
-    }
-
-}
-
-#endif
-
-#if os(iOS) || os(tvOS)
-
-import RxSwift
-import UIKit
-
-extension Reactive where Base: UIButton {
-    /// Reactive wrapper for `setTitle(_:for:)`
-    public func title(for controlState: UIControl.State = []) -> Binder<String?> {
-        Binder(self.base) { button, title in
-            button.setTitle(title, for: controlState)
-        }
-    }
-
-    /// Reactive wrapper for `setImage(_:for:)`
-    public func image(for controlState: UIControl.State = []) -> Binder<UIImage?> {
-        Binder(self.base) { button, image in
-            button.setImage(image, for: controlState)
-        }
-    }
-
-    /// Reactive wrapper for `setBackgroundImage(_:for:)`
-    public func backgroundImage(for controlState: UIControl.State = []) -> Binder<UIImage?> {
-        Binder(self.base) { button, image in
-            button.setBackgroundImage(image, for: controlState)
-        }
-    }
-    
-}
-#endif
-
-#if os(iOS) || os(tvOS)
-    import RxSwift
-    import UIKit
-    
-    extension Reactive where Base: UIButton {
-        /// Reactive wrapper for `setAttributedTitle(_:controlState:)`
-        public func attributedTitle(for controlState: UIControl.State = []) -> Binder<NSAttributedString?> {
-            return Binder(self.base) { button, attributedTitle -> Void in
-                button.setAttributedTitle(attributedTitle, for: controlState)
-            }
-        }
-    }
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UICollectionView+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UICollectionView+Rx.swift
deleted file mode 100644
index 7f3de007c..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UICollectionView+Rx.swift
+++ /dev/null
@@ -1,380 +0,0 @@
-//
-//  UICollectionView+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 4/2/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import RxSwift
-import UIKit
-
-// Items
-
-extension Reactive where Base: UICollectionView {
-
-    /**
-    Binds sequences of elements to collection view items.
-    
-    - parameter source: Observable sequence of items.
-    - parameter cellFactory: Transform between sequence elements and view cells.
-    - returns: Disposable object that can be used to unbind.
-     
-     Example
-    
-         let items = Observable.just([
-             1,
-             2,
-             3
-         ])
-
-         items
-         .bind(to: collectionView.rx.items) { (collectionView, row, element) in
-            let indexPath = IndexPath(row: row, section: 0)
-            let cell = collectionView.dequeueReusableCell(withReuseIdentifier: "Cell", for: indexPath) as! NumberCell
-             cell.value?.text = "\(element) @ \(row)"
-             return cell
-         }
-         .disposed(by: disposeBag)
-    */
-    public func items<Sequence: Swift.Sequence, Source: ObservableType>
-        (_ source: Source)
-        -> (_ cellFactory: @escaping (UICollectionView, Int, Sequence.Element) -> UICollectionViewCell)
-        -> Disposable where Source.Element == Sequence {
-        return { cellFactory in
-            let dataSource = RxCollectionViewReactiveArrayDataSourceSequenceWrapper<Sequence>(cellFactory: cellFactory)
-            return self.items(dataSource: dataSource)(source)
-        }
-        
-    }
-    
-    /**
-    Binds sequences of elements to collection view items.
-    
-    - parameter cellIdentifier: Identifier used to dequeue cells.
-    - parameter source: Observable sequence of items.
-    - parameter configureCell: Transform between sequence elements and view cells.
-    - parameter cellType: Type of collection view cell.
-    - returns: Disposable object that can be used to unbind.
-     
-     Example
-
-         let items = Observable.just([
-             1,
-             2,
-             3
-         ])
-
-         items
-             .bind(to: collectionView.rx.items(cellIdentifier: "Cell", cellType: NumberCell.self)) { (row, element, cell) in
-                cell.value?.text = "\(element) @ \(row)"
-             }
-             .disposed(by: disposeBag)
-    */
-    public func items<Sequence: Swift.Sequence, Cell: UICollectionViewCell, Source: ObservableType>
-        (cellIdentifier: String, cellType: Cell.Type = Cell.self)
-        -> (_ source: Source)
-        -> (_ configureCell: @escaping (Int, Sequence.Element, Cell) -> Void)
-        -> Disposable where Source.Element == Sequence {
-        return { source in
-            return { configureCell in
-                let dataSource = RxCollectionViewReactiveArrayDataSourceSequenceWrapper<Sequence> { cv, i, item in
-                    let indexPath = IndexPath(item: i, section: 0)
-                    let cell = cv.dequeueReusableCell(withReuseIdentifier: cellIdentifier, for: indexPath) as! Cell
-                    configureCell(i, item, cell)
-                    return cell
-                }
-                    
-                return self.items(dataSource: dataSource)(source)
-            }
-        }
-    }
-
-    
-    /**
-    Binds sequences of elements to collection view items using a custom reactive data used to perform the transformation.
-    
-    - parameter dataSource: Data source used to transform elements to view cells.
-    - parameter source: Observable sequence of items.
-    - returns: Disposable object that can be used to unbind.
-     
-     Example
-     
-         let dataSource = RxCollectionViewSectionedReloadDataSource<SectionModel<String, Double>>()
-
-         let items = Observable.just([
-             SectionModel(model: "First section", items: [
-                 1.0,
-                 2.0,
-                 3.0
-             ]),
-             SectionModel(model: "Second section", items: [
-                 1.0,
-                 2.0,
-                 3.0
-             ]),
-             SectionModel(model: "Third section", items: [
-                 1.0,
-                 2.0,
-                 3.0
-             ])
-         ])
-
-         dataSource.configureCell = { (dataSource, cv, indexPath, element) in
-             let cell = cv.dequeueReusableCell(withReuseIdentifier: "Cell", for: indexPath) as! NumberCell
-             cell.value?.text = "\(element) @ row \(indexPath.row)"
-             return cell
-         }
-
-         items
-            .bind(to: collectionView.rx.items(dataSource: dataSource))
-            .disposed(by: disposeBag)
-    */
-    public func items<
-            DataSource: RxCollectionViewDataSourceType & UICollectionViewDataSource,
-            Source: ObservableType>
-        (dataSource: DataSource)
-        -> (_ source: Source)
-        -> Disposable where DataSource.Element == Source.Element
-          {
-        return { source in
-            // This is called for sideeffects only, and to make sure delegate proxy is in place when
-            // data source is being bound.
-            // This is needed because theoretically the data source subscription itself might
-            // call `self.rx.delegate`. If that happens, it might cause weird side effects since
-            // setting data source will set delegate, and UICollectionView might get into a weird state.
-            // Therefore it's better to set delegate proxy first, just to be sure.
-            _ = self.delegate
-            // Strong reference is needed because data source is in use until result subscription is disposed
-            return source.subscribeProxyDataSource(ofObject: self.base, dataSource: dataSource, retainDataSource: true) { [weak collectionView = self.base] (_: RxCollectionViewDataSourceProxy, event) -> Void in
-                guard let collectionView = collectionView else {
-                    return
-                }
-                dataSource.collectionView(collectionView, observedEvent: event)
-            }
-        }
-    }
-}
-
-extension Reactive where Base: UICollectionView {
-    public typealias DisplayCollectionViewCellEvent = (cell: UICollectionViewCell, at: IndexPath)
-    public typealias DisplayCollectionViewSupplementaryViewEvent = (supplementaryView: UICollectionReusableView, elementKind: String, at: IndexPath)
-
-    /// Reactive wrapper for `dataSource`.
-    ///
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var dataSource: DelegateProxy<UICollectionView, UICollectionViewDataSource> {
-        RxCollectionViewDataSourceProxy.proxy(for: base)
-    }
-    
-    /// Installs data source as forwarding delegate on `rx.dataSource`.
-    /// Data source won't be retained.
-    ///
-    /// It enables using normal delegate mechanism with reactive delegate mechanism.
-    ///
-    /// - parameter dataSource: Data source object.
-    /// - returns: Disposable object that can be used to unbind the data source.
-    public func setDataSource(_ dataSource: UICollectionViewDataSource)
-        -> Disposable {
-        RxCollectionViewDataSourceProxy.installForwardDelegate(dataSource, retainDelegate: false, onProxyForObject: self.base)
-    }
-   
-    /// Reactive wrapper for `delegate` message `collectionView(_:didSelectItemAtIndexPath:)`.
-    public var itemSelected: ControlEvent<IndexPath> {
-        let source = delegate.methodInvoked(#selector(UICollectionViewDelegate.collectionView(_:didSelectItemAt:)))
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[1])
-            }
-        
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `collectionView(_:didDeselectItemAtIndexPath:)`.
-    public var itemDeselected: ControlEvent<IndexPath> {
-        let source = delegate.methodInvoked(#selector(UICollectionViewDelegate.collectionView(_:didDeselectItemAt:)))
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[1])
-        }
-
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `collectionView(_:didHighlightItemAt:)`.
-    public var itemHighlighted: ControlEvent<IndexPath> {
-        let source = delegate.methodInvoked(#selector(UICollectionViewDelegate.collectionView(_:didHighlightItemAt:)))
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[1])
-            }
-        
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `collectionView(_:didUnhighlightItemAt:)`.
-    public var itemUnhighlighted: ControlEvent<IndexPath> {
-        let source = delegate.methodInvoked(#selector(UICollectionViewDelegate.collectionView(_:didUnhighlightItemAt:)))
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[1])
-            }
-        
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `collectionView:willDisplay:forItemAt:`.
-    public var willDisplayCell: ControlEvent<DisplayCollectionViewCellEvent> {
-        let source: Observable<DisplayCollectionViewCellEvent> = self.delegate.methodInvoked(#selector(UICollectionViewDelegate.collectionView(_:willDisplay:forItemAt:)))
-            .map { a in
-                return (try castOrThrow(UICollectionViewCell.self, a[1]), try castOrThrow(IndexPath.self, a[2]))
-            }
-        
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `collectionView(_:willDisplaySupplementaryView:forElementKind:at:)`.
-    public var willDisplaySupplementaryView: ControlEvent<DisplayCollectionViewSupplementaryViewEvent> {
-        let source: Observable<DisplayCollectionViewSupplementaryViewEvent> = self.delegate.methodInvoked(#selector(UICollectionViewDelegate.collectionView(_:willDisplaySupplementaryView:forElementKind:at:)))
-            .map { a in
-                return (try castOrThrow(UICollectionReusableView.self, a[1]),
-                        try castOrThrow(String.self, a[2]),
-                        try castOrThrow(IndexPath.self, a[3]))
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `collectionView:didEndDisplaying:forItemAt:`.
-    public var didEndDisplayingCell: ControlEvent<DisplayCollectionViewCellEvent> {
-        let source: Observable<DisplayCollectionViewCellEvent> = self.delegate.methodInvoked(#selector(UICollectionViewDelegate.collectionView(_:didEndDisplaying:forItemAt:)))
-            .map { a in
-                return (try castOrThrow(UICollectionViewCell.self, a[1]), try castOrThrow(IndexPath.self, a[2]))
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `collectionView(_:didEndDisplayingSupplementaryView:forElementOfKind:at:)`.
-    public var didEndDisplayingSupplementaryView: ControlEvent<DisplayCollectionViewSupplementaryViewEvent> {
-        let source: Observable<DisplayCollectionViewSupplementaryViewEvent> = self.delegate.methodInvoked(#selector(UICollectionViewDelegate.collectionView(_:didEndDisplayingSupplementaryView:forElementOfKind:at:)))
-            .map { a in
-                return (try castOrThrow(UICollectionReusableView.self, a[1]),
-                        try castOrThrow(String.self, a[2]),
-                        try castOrThrow(IndexPath.self, a[3]))
-            }
-
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `delegate` message `collectionView(_:didSelectItemAtIndexPath:)`.
-    ///
-    /// It can be only used when one of the `rx.itemsWith*` methods is used to bind observable sequence,
-    /// or any other data source conforming to `SectionedViewDataSourceType` protocol.
-    ///
-    /// ```
-    ///     collectionView.rx.modelSelected(MyModel.self)
-    ///        .map { ...
-    /// ```
-    public func modelSelected<T>(_ modelType: T.Type) -> ControlEvent<T> {
-        let source: Observable<T> = itemSelected.flatMap { [weak view = self.base as UICollectionView] indexPath -> Observable<T> in
-            guard let view = view else {
-                return Observable.empty()
-            }
-
-            return Observable.just(try view.rx.model(at: indexPath))
-        }
-        
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `collectionView(_:didSelectItemAtIndexPath:)`.
-    ///
-    /// It can be only used when one of the `rx.itemsWith*` methods is used to bind observable sequence,
-    /// or any other data source conforming to `SectionedViewDataSourceType` protocol.
-    ///
-    /// ```
-    ///     collectionView.rx.modelDeselected(MyModel.self)
-    ///        .map { ...
-    /// ```
-    public func modelDeselected<T>(_ modelType: T.Type) -> ControlEvent<T> {
-        let source: Observable<T> = itemDeselected.flatMap { [weak view = self.base as UICollectionView] indexPath -> Observable<T> in
-            guard let view = view else {
-                return Observable.empty()
-            }
-
-            return Observable.just(try view.rx.model(at: indexPath))
-        }
-
-        return ControlEvent(events: source)
-    }
-    
-    /// Synchronous helper method for retrieving a model at indexPath through a reactive data source
-    public func model<T>(at indexPath: IndexPath) throws -> T {
-        let dataSource: SectionedViewDataSourceType = castOrFatalError(self.dataSource.forwardToDelegate(), message: "This method only works in case one of the `rx.itemsWith*` methods was used.")
-        
-        let element = try dataSource.model(at: indexPath)
-
-        return try castOrThrow(T.self, element)
-    }
-}
-
-@available(iOS 10.0, tvOS 10.0, *)
-extension Reactive where Base: UICollectionView {
-
-    /// Reactive wrapper for `prefetchDataSource`.
-    ///
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var prefetchDataSource: DelegateProxy<UICollectionView, UICollectionViewDataSourcePrefetching> {
-        RxCollectionViewDataSourcePrefetchingProxy.proxy(for: base)
-    }
-
-    /**
-     Installs prefetch data source as forwarding delegate on `rx.prefetchDataSource`.
-     Prefetch data source won't be retained.
-
-     It enables using normal delegate mechanism with reactive delegate mechanism.
-
-     - parameter prefetchDataSource: Prefetch data source object.
-     - returns: Disposable object that can be used to unbind the data source.
-     */
-    public func setPrefetchDataSource(_ prefetchDataSource: UICollectionViewDataSourcePrefetching)
-        -> Disposable {
-            return RxCollectionViewDataSourcePrefetchingProxy.installForwardDelegate(prefetchDataSource, retainDelegate: false, onProxyForObject: self.base)
-    }
-
-    /// Reactive wrapper for `prefetchDataSource` message `collectionView(_:prefetchItemsAt:)`.
-    public var prefetchItems: ControlEvent<[IndexPath]> {
-        let source = RxCollectionViewDataSourcePrefetchingProxy.proxy(for: base).prefetchItemsPublishSubject
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `prefetchDataSource` message `collectionView(_:cancelPrefetchingForItemsAt:)`.
-    public var cancelPrefetchingForItems: ControlEvent<[IndexPath]> {
-        let source = prefetchDataSource.methodInvoked(#selector(UICollectionViewDataSourcePrefetching.collectionView(_:cancelPrefetchingForItemsAt:)))
-            .map { a in
-                return try castOrThrow(Array<IndexPath>.self, a[1])
-        }
-
-        return ControlEvent(events: source)
-    }
-
-}
-#endif
-
-#if os(tvOS)
-
-extension Reactive where Base: UICollectionView {
-    
-    /// Reactive wrapper for `delegate` message `collectionView(_:didUpdateFocusInContext:withAnimationCoordinator:)`.
-    public var didUpdateFocusInContextWithAnimationCoordinator: ControlEvent<(context: UICollectionViewFocusUpdateContext, animationCoordinator: UIFocusAnimationCoordinator)> {
-
-        let source = delegate.methodInvoked(#selector(UICollectionViewDelegate.collectionView(_:didUpdateFocusIn:with:)))
-            .map { a -> (context: UICollectionViewFocusUpdateContext, animationCoordinator: UIFocusAnimationCoordinator) in
-                let context = try castOrThrow(UICollectionViewFocusUpdateContext.self, a[1])
-                let animationCoordinator = try castOrThrow(UIFocusAnimationCoordinator.self, a[2])
-                return (context: context, animationCoordinator: animationCoordinator)
-            }
-
-        return ControlEvent(events: source)
-    }
-}
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIControl+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIControl+Rx.swift
deleted file mode 100644
index 6698cf242..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIControl+Rx.swift
+++ /dev/null
@@ -1,86 +0,0 @@
-//
-//  UIControl+Rx.swift
-//  RxCocoa
-//
-//  Created by Daniel Tartaglia on 5/23/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import RxSwift
-import UIKit
-
-extension Reactive where Base: UIControl {
-    /// Reactive wrapper for target action pattern.
-    ///
-    /// - parameter controlEvents: Filter for observed event types.
-    public func controlEvent(_ controlEvents: UIControl.Event) -> ControlEvent<()> {
-        let source: Observable<Void> = Observable.create { [weak control = self.base] observer in
-                MainScheduler.ensureRunningOnMainThread()
-
-                guard let control = control else {
-                    observer.on(.completed)
-                    return Disposables.create()
-                }
-
-                let controlTarget = ControlTarget(control: control, controlEvents: controlEvents) { _ in
-                    observer.on(.next(()))
-                }
-
-                return Disposables.create(with: controlTarget.dispose)
-            }
-            .take(until: deallocated)
-
-        return ControlEvent(events: source)
-    }
-
-    /// Creates a `ControlProperty` that is triggered by target/action pattern value updates.
-    ///
-    /// - parameter controlEvents: Events that trigger value update sequence elements.
-    /// - parameter getter: Property value getter.
-    /// - parameter setter: Property value setter.
-    public func controlProperty<T>(
-        editingEvents: UIControl.Event,
-        getter: @escaping (Base) -> T,
-        setter: @escaping (Base, T) -> Void
-    ) -> ControlProperty<T> {
-        let source: Observable<T> = Observable.create { [weak weakControl = base] observer in
-                guard let control = weakControl else {
-                    observer.on(.completed)
-                    return Disposables.create()
-                }
-
-                observer.on(.next(getter(control)))
-
-                let controlTarget = ControlTarget(control: control, controlEvents: editingEvents) { _ in
-                    if let control = weakControl {
-                        observer.on(.next(getter(control)))
-                    }
-                }
-                
-                return Disposables.create(with: controlTarget.dispose)
-            }
-            .take(until: deallocated)
-
-        let bindingObserver = Binder(base, binding: setter)
-
-        return ControlProperty<T>(values: source, valueSink: bindingObserver)
-    }
-
-    /// This is a separate method to better communicate to public consumers that
-    /// an `editingEvent` needs to fire for control property to be updated.
-    internal func controlPropertyWithDefaultEvents<T>(
-        editingEvents: UIControl.Event = [.allEditingEvents, .valueChanged],
-        getter: @escaping (Base) -> T,
-        setter: @escaping (Base, T) -> Void
-        ) -> ControlProperty<T> {
-        return controlProperty(
-            editingEvents: editingEvents,
-            getter: getter,
-            setter: setter
-        )
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIDatePicker+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIDatePicker+Rx.swift
deleted file mode 100644
index e10c1ec98..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIDatePicker+Rx.swift
+++ /dev/null
@@ -1,43 +0,0 @@
-//
-//  UIDatePicker+Rx.swift
-//  RxCocoa
-//
-//  Created by Daniel Tartaglia on 5/31/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import RxSwift
-import UIKit
-
-extension Reactive where Base: UIDatePicker {
-    /// Reactive wrapper for `date` property.
-    public var date: ControlProperty<Date> {
-        value
-    }
-
-    /// Reactive wrapper for `date` property.
-    public var value: ControlProperty<Date> {
-        return base.rx.controlPropertyWithDefaultEvents(
-            getter: { datePicker in
-                datePicker.date
-            }, setter: { datePicker, value in
-                datePicker.date = value
-            }
-        )
-    }
-
-    /// Reactive wrapper for `countDownDuration` property.
-    public var countDownDuration: ControlProperty<TimeInterval> {
-        return base.rx.controlPropertyWithDefaultEvents(
-            getter: { datePicker in
-                datePicker.countDownDuration
-            }, setter: { datePicker, value in
-                datePicker.countDownDuration = value
-            }
-        )
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIGestureRecognizer+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIGestureRecognizer+Rx.swift
deleted file mode 100644
index 551290086..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIGestureRecognizer+Rx.swift
+++ /dev/null
@@ -1,75 +0,0 @@
-//
-//  UIGestureRecognizer+Rx.swift
-//  RxCocoa
-//
-//  Created by Carlos García on 10/6/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-// This should be only used from `MainScheduler`
-final class GestureTarget<Recognizer: UIGestureRecognizer>: RxTarget {
-    typealias Callback = (Recognizer) -> Void
-    
-    let selector = #selector(ControlTarget.eventHandler(_:))
-    
-    weak var gestureRecognizer: Recognizer?
-    var callback: Callback?
-    
-    init(_ gestureRecognizer: Recognizer, callback: @escaping Callback) {
-        self.gestureRecognizer = gestureRecognizer
-        self.callback = callback
-        
-        super.init()
-        
-        gestureRecognizer.addTarget(self, action: selector)
-
-        let method = self.method(for: selector)
-        if method == nil {
-            fatalError("Can't find method")
-        }
-    }
-    
-    @objc func eventHandler(_ sender: UIGestureRecognizer) {
-        if let callback = self.callback, let gestureRecognizer = self.gestureRecognizer {
-            callback(gestureRecognizer)
-        }
-    }
-    
-    override func dispose() {
-        super.dispose()
-        
-        self.gestureRecognizer?.removeTarget(self, action: self.selector)
-        self.callback = nil
-    }
-}
-
-extension Reactive where Base: UIGestureRecognizer {
-    
-    /// Reactive wrapper for gesture recognizer events.
-    public var event: ControlEvent<Base> {
-        let source: Observable<Base> = Observable.create { [weak control = self.base] observer in
-            MainScheduler.ensureRunningOnMainThread()
-
-            guard let control = control else {
-                observer.on(.completed)
-                return Disposables.create()
-            }
-            
-            let observer = GestureTarget(control) { control in
-                observer.on(.next(control))
-            }
-            
-            return observer
-        }.take(until: deallocated)
-        
-        return ControlEvent(events: source)
-    }
-    
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UINavigationController+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UINavigationController+Rx.swift
deleted file mode 100644
index 94796b659..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UINavigationController+Rx.swift
+++ /dev/null
@@ -1,49 +0,0 @@
-//
-//  UINavigationController+Rx.swift
-//  RxCocoa
-//
-//  Created by Diogo on 13/04/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import RxSwift
-import UIKit
-
-extension Reactive where Base: UINavigationController {
-    public typealias ShowEvent = (viewController: UIViewController, animated: Bool)
-
-    /// Reactive wrapper for `delegate`.
-    ///
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var delegate: DelegateProxy<UINavigationController, UINavigationControllerDelegate> {
-        RxNavigationControllerDelegateProxy.proxy(for: base)
-    }
-
-    /// Reactive wrapper for delegate method `navigationController(:willShow:animated:)`.
-    public var willShow: ControlEvent<ShowEvent> {
-        let source: Observable<ShowEvent> = delegate
-            .methodInvoked(#selector(UINavigationControllerDelegate.navigationController(_:willShow:animated:)))
-            .map { arg in
-                let viewController = try castOrThrow(UIViewController.self, arg[1])
-                let animated = try castOrThrow(Bool.self, arg[2])
-                return (viewController, animated)
-        }
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for delegate method `navigationController(:didShow:animated:)`.
-    public var didShow: ControlEvent<ShowEvent> {
-        let source: Observable<ShowEvent> = delegate
-            .methodInvoked(#selector(UINavigationControllerDelegate.navigationController(_:didShow:animated:)))
-            .map { arg in
-                let viewController = try castOrThrow(UIViewController.self, arg[1])
-                let animated = try castOrThrow(Bool.self, arg[2])
-                return (viewController, animated)
-        }
-        return ControlEvent(events: source)
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIPickerView+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIPickerView+Rx.swift
deleted file mode 100644
index 317dc13ba..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIPickerView+Rx.swift
+++ /dev/null
@@ -1,224 +0,0 @@
-//
-//  UIPickerView+Rx.swift
-//  RxCocoa
-//
-//  Created by Segii Shulga on 5/12/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-    
-    import RxSwift
-    import UIKit
-
-    extension Reactive where Base: UIPickerView {
-
-        /// Reactive wrapper for `delegate`.
-        /// For more information take a look at `DelegateProxyType` protocol documentation.
-        public var delegate: DelegateProxy<UIPickerView, UIPickerViewDelegate> {
-            return RxPickerViewDelegateProxy.proxy(for: base)
-        }
-        
-        /// Installs delegate as forwarding delegate on `delegate`.
-        /// Delegate won't be retained.
-        ///
-        /// It enables using normal delegate mechanism with reactive delegate mechanism.
-        ///
-        /// - parameter delegate: Delegate object.
-        /// - returns: Disposable object that can be used to unbind the delegate.
-        public func setDelegate(_ delegate: UIPickerViewDelegate)
-            -> Disposable {
-                return RxPickerViewDelegateProxy.installForwardDelegate(delegate, retainDelegate: false, onProxyForObject: self.base)
-        }
-        
-        /**
-         Reactive wrapper for `dataSource`.
-         
-         For more information take a look at `DelegateProxyType` protocol documentation.
-         */
-        public var dataSource: DelegateProxy<UIPickerView, UIPickerViewDataSource> {
-            return RxPickerViewDataSourceProxy.proxy(for: base)
-        }
-        
-        /**
-         Reactive wrapper for `delegate` message `pickerView:didSelectRow:inComponent:`.
-         */
-        public var itemSelected: ControlEvent<(row: Int, component: Int)> {
-            let source = delegate
-                .methodInvoked(#selector(UIPickerViewDelegate.pickerView(_:didSelectRow:inComponent:)))
-                .map {
-                    return (row: try castOrThrow(Int.self, $0[1]), component: try castOrThrow(Int.self, $0[2]))
-                }
-            return ControlEvent(events: source)
-        }
-        
-        /**
-         Reactive wrapper for `delegate` message `pickerView:didSelectRow:inComponent:`.
-         
-         It can be only used when one of the `rx.itemTitles, rx.itemAttributedTitles, items(_ source: O)` methods is used to bind observable sequence,
-         or any other data source conforming to a `ViewDataSourceType` protocol.
-         
-         ```
-         pickerView.rx.modelSelected(MyModel.self)
-         .map { ...
-         ```
-         - parameter modelType: Type of a Model which bound to the dataSource
-         */
-        public func modelSelected<T>(_ modelType: T.Type) -> ControlEvent<[T]> {
-            let source = itemSelected.flatMap { [weak view = self.base as UIPickerView] _, component -> Observable<[T]> in
-                guard let view = view else {
-                    return Observable.empty()
-                }
-
-                let model: [T] = try (0 ..< view.numberOfComponents).map { component in
-                    let row = view.selectedRow(inComponent: component)
-                    return try view.rx.model(at: IndexPath(row: row, section: component))
-                }
-
-                return Observable.just(model)
-            }
-            
-            return ControlEvent(events: source)
-        }
-        
-        /**
-         Binds sequences of elements to picker view rows.
-         
-         - parameter source: Observable sequence of items.
-         - parameter titleForRow: Transform between sequence elements and row titles.
-         - returns: Disposable object that can be used to unbind.
-         
-         Example:
-         
-            let items = Observable.just([
-                    "First Item",
-                    "Second Item",
-                    "Third Item"
-                ])
-         
-            items
-                .bind(to: pickerView.rx.itemTitles) { (row, element) in
-                    return element.title
-                }
-                .disposed(by: disposeBag)
-         
-         */
-        
-        public func itemTitles<Sequence: Swift.Sequence, Source: ObservableType>
-            (_ source: Source)
-            -> (_ titleForRow: @escaping (Int, Sequence.Element) -> String?)
-            -> Disposable where Source.Element == Sequence {
-                return { titleForRow in
-                    let adapter = RxStringPickerViewAdapter<Sequence>(titleForRow: titleForRow)
-                    return self.items(adapter: adapter)(source)
-                }
-        }
-        
-        /**
-         Binds sequences of elements to picker view rows.
-         
-         - parameter source: Observable sequence of items.
-         - parameter attributedTitleForRow: Transform between sequence elements and row attributed titles.
-         - returns: Disposable object that can be used to unbind.
-         
-         Example:
-         
-         let items = Observable.just([
-                "First Item",
-                "Second Item",
-                "Third Item"
-            ])
-         
-         items
-            .bind(to: pickerView.rx.itemAttributedTitles) { (row, element) in
-                return NSAttributedString(string: element.title)
-            }
-            .disposed(by: disposeBag)
-        
-         */
-
-        public func itemAttributedTitles<Sequence: Swift.Sequence, Source: ObservableType>
-            (_ source: Source)
-            -> (_ attributedTitleForRow: @escaping (Int, Sequence.Element) -> NSAttributedString?)
-            -> Disposable where Source.Element == Sequence {
-                return { attributedTitleForRow in
-                    let adapter = RxAttributedStringPickerViewAdapter<Sequence>(attributedTitleForRow: attributedTitleForRow)
-                    return self.items(adapter: adapter)(source)
-                }
-        }
-        
-        /**
-         Binds sequences of elements to picker view rows.
-         
-         - parameter source: Observable sequence of items.
-         - parameter viewForRow: Transform between sequence elements and row views.
-         - returns: Disposable object that can be used to unbind.
-         
-         Example:
-         
-         let items = Observable.just([
-                "First Item",
-                "Second Item",
-                "Third Item"
-            ])
-         
-         items
-            .bind(to: pickerView.rx.items) { (row, element, view) in
-                guard let myView = view as? MyView else {
-                    let view = MyView()
-                    view.configure(with: element)
-                    return view
-                }
-                myView.configure(with: element)
-                return myView
-            }
-            .disposed(by: disposeBag)
-         
-         */
-
-        public func items<Sequence: Swift.Sequence, Source: ObservableType>
-            (_ source: Source)
-            -> (_ viewForRow: @escaping (Int, Sequence.Element, UIView?) -> UIView)
-            -> Disposable where Source.Element == Sequence {
-                return { viewForRow in
-                    let adapter = RxPickerViewAdapter<Sequence>(viewForRow: viewForRow)
-                    return self.items(adapter: adapter)(source)
-                }
-        }
-        
-        /**
-         Binds sequences of elements to picker view rows using a custom reactive adapter used to perform the transformation.
-         This method will retain the adapter for as long as the subscription isn't disposed (result `Disposable`
-         being disposed).
-         In case `source` observable sequence terminates successfully, the adapter will present latest element
-         until the subscription isn't disposed.
-         
-         - parameter adapter: Adapter used to transform elements to picker components.
-         - parameter source: Observable sequence of items.
-         - returns: Disposable object that can be used to unbind.
-         */
-        public func items<Source: ObservableType,
-                          Adapter: RxPickerViewDataSourceType & UIPickerViewDataSource & UIPickerViewDelegate>(adapter: Adapter)
-            -> (_ source: Source)
-            -> Disposable where Source.Element == Adapter.Element {
-                return { source in
-                    let delegateSubscription = self.setDelegate(adapter)
-                    let dataSourceSubscription = source.subscribeProxyDataSource(ofObject: self.base, dataSource: adapter, retainDataSource: true, binding: { [weak pickerView = self.base] (_: RxPickerViewDataSourceProxy, event) in
-                        guard let pickerView = pickerView else { return }
-                        adapter.pickerView(pickerView, observedEvent: event)
-                    })
-                    return Disposables.create(delegateSubscription, dataSourceSubscription)
-                }
-        }
-        
-        /**
-         Synchronous helper method for retrieving a model at indexPath through a reactive data source.
-         */
-        public func model<T>(at indexPath: IndexPath) throws -> T {
-            let dataSource: SectionedViewDataSourceType = castOrFatalError(self.dataSource.forwardToDelegate(), message: "This method only works in case one of the `rx.itemTitles, rx.itemAttributedTitles, items(_ source: O)` methods was used.")
-            
-            return castOrFatalError(try dataSource.model(at: indexPath))
-        }
-    }
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIRefreshControl+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIRefreshControl+Rx.swift
deleted file mode 100644
index cdb10be16..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIRefreshControl+Rx.swift
+++ /dev/null
@@ -1,28 +0,0 @@
-//
-//  UIRefreshControl+Rx.swift
-//  RxCocoa
-//
-//  Created by Yosuke Ishikawa on 1/31/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import UIKit
-import RxSwift
-
-extension Reactive where Base: UIRefreshControl {
-    /// Bindable sink for `beginRefreshing()`, `endRefreshing()` methods.
-    public var isRefreshing: Binder<Bool> {
-        return Binder(self.base) { refreshControl, refresh in
-            if refresh {
-                refreshControl.beginRefreshing()
-            } else {
-                refreshControl.endRefreshing()
-            }
-        }
-    }
-
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIScrollView+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIScrollView+Rx.swift
deleted file mode 100644
index f90e1c26f..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIScrollView+Rx.swift
+++ /dev/null
@@ -1,131 +0,0 @@
-//
-//  UIScrollView+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 4/3/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-    import RxSwift
-    import UIKit
-
-    extension Reactive where Base: UIScrollView {
-        public typealias EndZoomEvent = (view: UIView?, scale: CGFloat)
-        public typealias WillEndDraggingEvent = (velocity: CGPoint, targetContentOffset: UnsafeMutablePointer<CGPoint>)
-
-        /// Reactive wrapper for `delegate`.
-        ///
-        /// For more information take a look at `DelegateProxyType` protocol documentation.
-        public var delegate: DelegateProxy<UIScrollView, UIScrollViewDelegate> {
-            return RxScrollViewDelegateProxy.proxy(for: base)
-        }
-        
-        /// Reactive wrapper for `contentOffset`.
-        public var contentOffset: ControlProperty<CGPoint> {
-            let proxy = RxScrollViewDelegateProxy.proxy(for: base)
-
-            let bindingObserver = Binder(self.base) { scrollView, contentOffset in
-                scrollView.contentOffset = contentOffset
-            }
-
-            return ControlProperty(values: proxy.contentOffsetBehaviorSubject, valueSink: bindingObserver)
-        }
-
-        /// Reactive wrapper for delegate method `scrollViewDidScroll`
-        public var didScroll: ControlEvent<Void> {
-            let source = RxScrollViewDelegateProxy.proxy(for: base).contentOffsetPublishSubject
-            return ControlEvent(events: source)
-        }
-        
-        /// Reactive wrapper for delegate method `scrollViewWillBeginDecelerating`
-        public var willBeginDecelerating: ControlEvent<Void> {
-            let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewWillBeginDecelerating(_:))).map { _ in }
-            return ControlEvent(events: source)
-        }
-    	
-    	/// Reactive wrapper for delegate method `scrollViewDidEndDecelerating`
-    	public var didEndDecelerating: ControlEvent<Void> {
-    		let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewDidEndDecelerating(_:))).map { _ in }
-    		return ControlEvent(events: source)
-    	}
-    	
-        /// Reactive wrapper for delegate method `scrollViewWillBeginDragging`
-        public var willBeginDragging: ControlEvent<Void> {
-            let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewWillBeginDragging(_:))).map { _ in }
-            return ControlEvent(events: source)
-        }
-        
-        /// Reactive wrapper for delegate method `scrollViewWillEndDragging(_:withVelocity:targetContentOffset:)`
-        public var willEndDragging: ControlEvent<WillEndDraggingEvent> {
-            let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewWillEndDragging(_:withVelocity:targetContentOffset:)))
-                .map { value -> WillEndDraggingEvent in
-                    let velocity = try castOrThrow(CGPoint.self, value[1])
-                    let targetContentOffsetValue = try castOrThrow(NSValue.self, value[2])
-
-                    guard let rawPointer = targetContentOffsetValue.pointerValue else { throw RxCocoaError.unknown }
-                    let typedPointer = rawPointer.bindMemory(to: CGPoint.self, capacity: MemoryLayout<CGPoint>.size)
-
-                    return (velocity, typedPointer)
-            }
-            return ControlEvent(events: source)
-        }
-        
-    	/// Reactive wrapper for delegate method `scrollViewDidEndDragging(_:willDecelerate:)`
-        public var didEndDragging: ControlEvent<Bool> {
-    		let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewDidEndDragging(_:willDecelerate:))).map { value -> Bool in
-    			return try castOrThrow(Bool.self, value[1])
-    		}
-    		return ControlEvent(events: source)
-    	}
-
-        /// Reactive wrapper for delegate method `scrollViewDidZoom`
-        public var didZoom: ControlEvent<Void> {
-            let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewDidZoom)).map { _ in }
-            return ControlEvent(events: source)
-        }
-
-
-        /// Reactive wrapper for delegate method `scrollViewDidScrollToTop`
-        public var didScrollToTop: ControlEvent<Void> {
-            let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewDidScrollToTop(_:))).map { _ in }
-            return ControlEvent(events: source)
-        }
-        
-        /// Reactive wrapper for delegate method `scrollViewDidEndScrollingAnimation`
-        public var didEndScrollingAnimation: ControlEvent<Void> {
-            let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewDidEndScrollingAnimation(_:))).map { _ in }
-            return ControlEvent(events: source)
-        }
-        
-        /// Reactive wrapper for delegate method `scrollViewWillBeginZooming(_:with:)`
-        public var willBeginZooming: ControlEvent<UIView?> {
-            let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewWillBeginZooming(_:with:))).map { value -> UIView? in
-                return try castOptionalOrThrow(UIView.self, value[1] as AnyObject)
-            }
-            return ControlEvent(events: source)
-        }
-        
-        /// Reactive wrapper for delegate method `scrollViewDidEndZooming(_:with:atScale:)`
-        public var didEndZooming: ControlEvent<EndZoomEvent> {
-            let source = delegate.methodInvoked(#selector(UIScrollViewDelegate.scrollViewDidEndZooming(_:with:atScale:))).map { value -> EndZoomEvent in
-                return (try castOptionalOrThrow(UIView.self, value[1] as AnyObject), try castOrThrow(CGFloat.self, value[2]))
-            }
-            return ControlEvent(events: source)
-        }
-
-        /// Installs delegate as forwarding delegate on `delegate`.
-        /// Delegate won't be retained.
-        ///
-        /// It enables using normal delegate mechanism with reactive delegate mechanism.
-        ///
-        /// - parameter delegate: Delegate object.
-        /// - returns: Disposable object that can be used to unbind the delegate.
-        public func setDelegate(_ delegate: UIScrollViewDelegate)
-            -> Disposable {
-            return RxScrollViewDelegateProxy.installForwardDelegate(delegate, retainDelegate: false, onProxyForObject: self.base)
-        }
-    }
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UISearchBar+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UISearchBar+Rx.swift
deleted file mode 100644
index 3892b1caf..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UISearchBar+Rx.swift
+++ /dev/null
@@ -1,136 +0,0 @@
-//
-//  UISearchBar+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 3/28/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import RxSwift
-import UIKit
-
-extension Reactive where Base: UISearchBar {
-
-    /// Reactive wrapper for `delegate`.
-    ///
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var delegate: DelegateProxy<UISearchBar, UISearchBarDelegate> {
-        RxSearchBarDelegateProxy.proxy(for: base)
-    }
-
-    /// Reactive wrapper for `text` property.
-    public var text: ControlProperty<String?> {
-        value
-    }
-    
-    /// Reactive wrapper for `text` property.
-    public var value: ControlProperty<String?> {
-        let source: Observable<String?> = Observable.deferred { [weak searchBar = self.base as UISearchBar] () -> Observable<String?> in
-            let text = searchBar?.text
-
-            let textDidChange = (searchBar?.rx.delegate.methodInvoked(#selector(UISearchBarDelegate.searchBar(_:textDidChange:))) ?? Observable.empty())
-            let didEndEditing = (searchBar?.rx.delegate.methodInvoked(#selector(UISearchBarDelegate.searchBarTextDidEndEditing(_:))) ?? Observable.empty())
-            
-            return Observable.merge(textDidChange, didEndEditing)
-                    .map { _ in searchBar?.text ?? "" }
-                    .startWith(text)
-        }
-        
-        let bindingObserver = Binder(self.base) { (searchBar, text: String?) in
-            searchBar.text = text
-        }
-
-        return ControlProperty(values: source, valueSink: bindingObserver)
-    }
-    
-    /// Reactive wrapper for `selectedScopeButtonIndex` property.
-    public var selectedScopeButtonIndex: ControlProperty<Int> {
-        let source: Observable<Int> = Observable.deferred { [weak source = self.base as UISearchBar] () -> Observable<Int> in
-            let index = source?.selectedScopeButtonIndex ?? 0
-            
-            return (source?.rx.delegate.methodInvoked(#selector(UISearchBarDelegate.searchBar(_:selectedScopeButtonIndexDidChange:))) ?? Observable.empty())
-                .map { a in
-                    return try castOrThrow(Int.self, a[1])
-                }
-                .startWith(index)
-        }
-        
-        let bindingObserver = Binder(self.base) { (searchBar, index: Int) in
-            searchBar.selectedScopeButtonIndex = index
-        }
-        
-        return ControlProperty(values: source, valueSink: bindingObserver)
-    }
-    
-#if os(iOS)
-    /// Reactive wrapper for delegate method `searchBarCancelButtonClicked`.
-    public var cancelButtonClicked: ControlEvent<Void> {
-        let source: Observable<Void> = self.delegate.methodInvoked(#selector(UISearchBarDelegate.searchBarCancelButtonClicked(_:)))
-            .map { _ in
-                return ()
-            }
-        return ControlEvent(events: source)
-    }
-
-	/// Reactive wrapper for delegate method `searchBarBookmarkButtonClicked`.
-	public var bookmarkButtonClicked: ControlEvent<Void> {
-		let source: Observable<Void> = self.delegate.methodInvoked(#selector(UISearchBarDelegate.searchBarBookmarkButtonClicked(_:)))
-			.map { _ in
-				return ()
-			}
-		return ControlEvent(events: source)
-	}
-
-	/// Reactive wrapper for delegate method `searchBarResultsListButtonClicked`.
-	public var resultsListButtonClicked: ControlEvent<Void> {
-		let source: Observable<Void> = self.delegate.methodInvoked(#selector(UISearchBarDelegate.searchBarResultsListButtonClicked(_:)))
-			.map { _ in
-				return ()
-		}
-		return ControlEvent(events: source)
-	}
-#endif
-	
-    /// Reactive wrapper for delegate method `searchBarSearchButtonClicked`.
-    public var searchButtonClicked: ControlEvent<Void> {
-        let source: Observable<Void> = self.delegate.methodInvoked(#selector(UISearchBarDelegate.searchBarSearchButtonClicked(_:)))
-            .map { _ in
-                return ()
-        }
-        return ControlEvent(events: source)
-    }
-	
-	/// Reactive wrapper for delegate method `searchBarTextDidBeginEditing`.
-	public var textDidBeginEditing: ControlEvent<Void> {
-		let source: Observable<Void> = self.delegate.methodInvoked(#selector(UISearchBarDelegate.searchBarTextDidBeginEditing(_:)))
-			.map { _ in
-				return ()
-		}
-		return ControlEvent(events: source)
-	}
-	
-	/// Reactive wrapper for delegate method `searchBarTextDidEndEditing`.
-	public var textDidEndEditing: ControlEvent<Void> {
-		let source: Observable<Void> = self.delegate.methodInvoked(#selector(UISearchBarDelegate.searchBarTextDidEndEditing(_:)))
-			.map { _ in
-				return ()
-		}
-		return ControlEvent(events: source)
-	}
-  
-    /// Installs delegate as forwarding delegate on `delegate`.
-    /// Delegate won't be retained.
-    ///
-    /// It enables using normal delegate mechanism with reactive delegate mechanism.
-    ///
-    /// - parameter delegate: Delegate object.
-    /// - returns: Disposable object that can be used to unbind the delegate.
-    public func setDelegate(_ delegate: UISearchBarDelegate)
-        -> Disposable {
-        RxSearchBarDelegateProxy.installForwardDelegate(delegate, retainDelegate: false, onProxyForObject: self.base)
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UISearchController+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UISearchController+Rx.swift
deleted file mode 100644
index 4f524a51a..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UISearchController+Rx.swift
+++ /dev/null
@@ -1,58 +0,0 @@
-//
-//  UISearchController+Rx.swift
-//  RxCocoa
-//
-//  Created by Segii Shulga on 3/17/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-    
-    import RxSwift
-    import UIKit
-    
-    extension Reactive where Base: UISearchController {
-        /// Reactive wrapper for `delegate`.
-        /// For more information take a look at `DelegateProxyType` protocol documentation.
-        public var delegate: DelegateProxy<UISearchController, UISearchControllerDelegate> {
-            return RxSearchControllerDelegateProxy.proxy(for: base)
-        }
-
-        /// Reactive wrapper for `delegate` message.
-        public var didDismiss: Observable<Void> {
-            return delegate
-                .methodInvoked( #selector(UISearchControllerDelegate.didDismissSearchController(_:)))
-                .map { _ in }
-        }
-
-        /// Reactive wrapper for `delegate` message.
-        public var didPresent: Observable<Void> {
-            return delegate
-                .methodInvoked(#selector(UISearchControllerDelegate.didPresentSearchController(_:)))
-                .map { _ in }
-        }
-
-        /// Reactive wrapper for `delegate` message.
-        public var present: Observable<Void> {
-            return delegate
-                .methodInvoked( #selector(UISearchControllerDelegate.presentSearchController(_:)))
-                .map { _ in }
-        }
-
-        /// Reactive wrapper for `delegate` message.
-        public var willDismiss: Observable<Void> {
-            return delegate
-                .methodInvoked(#selector(UISearchControllerDelegate.willDismissSearchController(_:)))
-                .map { _ in }
-        }
-        
-        /// Reactive wrapper for `delegate` message.
-        public var willPresent: Observable<Void> {
-            return delegate
-                .methodInvoked( #selector(UISearchControllerDelegate.willPresentSearchController(_:)))
-                .map { _ in }
-        }
-        
-    }
-    
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UISegmentedControl+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UISegmentedControl+Rx.swift
deleted file mode 100644
index 1a6266261..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UISegmentedControl+Rx.swift
+++ /dev/null
@@ -1,54 +0,0 @@
-//
-//  UISegmentedControl+Rx.swift
-//  RxCocoa
-//
-//  Created by Carlos García on 8/7/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-extension Reactive where Base: UISegmentedControl {
-    /// Reactive wrapper for `selectedSegmentIndex` property.
-    public var selectedSegmentIndex: ControlProperty<Int> {
-        value
-    }
-    
-    /// Reactive wrapper for `selectedSegmentIndex` property.
-    public var value: ControlProperty<Int> {
-        return base.rx.controlPropertyWithDefaultEvents(
-            getter: { segmentedControl in
-                segmentedControl.selectedSegmentIndex
-            }, setter: { segmentedControl, value in
-                segmentedControl.selectedSegmentIndex = value
-            }
-        )
-    }
-    
-    /// Reactive wrapper for `setEnabled(_:forSegmentAt:)`
-    public func enabledForSegment(at index: Int) -> Binder<Bool> {
-        return Binder(self.base) { segmentedControl, segmentEnabled -> Void in
-            segmentedControl.setEnabled(segmentEnabled, forSegmentAt: index)
-        }
-    }
-    
-    /// Reactive wrapper for `setTitle(_:forSegmentAt:)`
-    public func titleForSegment(at index: Int) -> Binder<String?> {
-        return Binder(self.base) { segmentedControl, title -> Void in
-            segmentedControl.setTitle(title, forSegmentAt: index)
-        }
-    }
-    
-    /// Reactive wrapper for `setImage(_:forSegmentAt:)`
-    public func imageForSegment(at index: Int) -> Binder<UIImage?> {
-        return Binder(self.base) { segmentedControl, image -> Void in
-            segmentedControl.setImage(image, forSegmentAt: index)
-        }
-    }
-
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UISlider+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UISlider+Rx.swift
deleted file mode 100644
index 07d4adb5a..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UISlider+Rx.swift
+++ /dev/null
@@ -1,29 +0,0 @@
-//
-//  UISlider+Rx.swift
-//  RxCocoa
-//
-//  Created by Alexander van der Werff on 28/05/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import RxSwift
-import UIKit
-
-extension Reactive where Base: UISlider {
-    
-    /// Reactive wrapper for `value` property.
-    public var value: ControlProperty<Float> {
-        return base.rx.controlPropertyWithDefaultEvents(
-            getter: { slider in
-                slider.value
-            }, setter: { slider, value in
-                slider.value = value
-            }
-        )
-    }
-    
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UIStepper+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UIStepper+Rx.swift
deleted file mode 100644
index 29f638600..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UIStepper+Rx.swift
+++ /dev/null
@@ -1,29 +0,0 @@
-//
-//  UIStepper+Rx.swift
-//  RxCocoa
-//
-//  Created by Yuta ToKoRo on 9/1/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import UIKit
-import RxSwift
-
-extension Reactive where Base: UIStepper {
-    
-    /// Reactive wrapper for `value` property.
-    public var value: ControlProperty<Double> {
-        return base.rx.controlPropertyWithDefaultEvents(
-            getter: { stepper in
-                stepper.value
-            }, setter: { stepper, value in
-                stepper.value = value
-            }
-        )
-    }
-}
-
-#endif
-
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UISwitch+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UISwitch+Rx.swift
deleted file mode 100644
index 6e116b390..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UISwitch+Rx.swift
+++ /dev/null
@@ -1,38 +0,0 @@
-//
-//  UISwitch+Rx.swift
-//  RxCocoa
-//
-//  Created by Carlos García on 8/7/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS)
-
-import UIKit
-import RxSwift
-
-extension Reactive where Base: UISwitch {
-
-    /// Reactive wrapper for `isOn` property.
-    public var isOn: ControlProperty<Bool> {
-        value
-    }
-
-    /// Reactive wrapper for `isOn` property.
-    ///
-    /// ⚠️ Versions prior to iOS 10.2 were leaking `UISwitch`'s, so on those versions
-    /// underlying observable sequence won't complete when nothing holds a strong reference
-    /// to `UISwitch`.
-    public var value: ControlProperty<Bool> {
-        return base.rx.controlPropertyWithDefaultEvents(
-            getter: { uiSwitch in
-                uiSwitch.isOn
-            }, setter: { uiSwitch, value in
-                uiSwitch.isOn = value
-            }
-        )
-    }
-    
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UITabBar+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UITabBar+Rx.swift
deleted file mode 100644
index e98966725..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UITabBar+Rx.swift
+++ /dev/null
@@ -1,92 +0,0 @@
-//
-//  UITabBar+Rx.swift
-//  RxCocoa
-//
-//  Created by Jesse Farless on 5/13/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-/**
- iOS only
- */
-#if os(iOS)
-extension Reactive where Base: UITabBar {
-
-    /// Reactive wrapper for `delegate` message `tabBar(_:willBeginCustomizing:)`.
-    public var willBeginCustomizing: ControlEvent<[UITabBarItem]> {
-        
-        let source = delegate.methodInvoked(#selector(UITabBarDelegate.tabBar(_:willBeginCustomizing:)))
-            .map { a in
-                return try castOrThrow([UITabBarItem].self, a[1])
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `tabBar(_:didBeginCustomizing:)`.
-    public var didBeginCustomizing: ControlEvent<[UITabBarItem]> {
-        let source = delegate.methodInvoked(#selector(UITabBarDelegate.tabBar(_:didBeginCustomizing:)))
-            .map { a in
-                return try castOrThrow([UITabBarItem].self, a[1])
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `tabBar(_:willEndCustomizing:changed:)`.
-    public var willEndCustomizing: ControlEvent<([UITabBarItem], Bool)> {
-        let source = delegate.methodInvoked(#selector(UITabBarDelegate.tabBar(_:willEndCustomizing:changed:)))
-            .map { (a: [Any]) -> (([UITabBarItem], Bool)) in
-                let items = try castOrThrow([UITabBarItem].self, a[1])
-                let changed = try castOrThrow(Bool.self, a[2])
-                return (items, changed)
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `delegate` message `tabBar(_:didEndCustomizing:changed:)`.
-    public var didEndCustomizing: ControlEvent<([UITabBarItem], Bool)> {
-        let source = delegate.methodInvoked(#selector(UITabBarDelegate.tabBar(_:didEndCustomizing:changed:)))
-            .map { (a: [Any]) -> (([UITabBarItem], Bool)) in
-                let items = try castOrThrow([UITabBarItem].self, a[1])
-                let changed = try castOrThrow(Bool.self, a[2])
-                return (items, changed)
-            }
-
-        return ControlEvent(events: source)
-    }
-
-}
-#endif
-
-/**
- iOS and tvOS
- */
-    
-extension Reactive where Base: UITabBar {
-    /// Reactive wrapper for `delegate`.
-    ///
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var delegate: DelegateProxy<UITabBar, UITabBarDelegate> {
-        RxTabBarDelegateProxy.proxy(for: base)
-    }
-
-    /// Reactive wrapper for `delegate` message `tabBar(_:didSelect:)`.
-    public var didSelectItem: ControlEvent<UITabBarItem> {
-        let source = delegate.methodInvoked(#selector(UITabBarDelegate.tabBar(_:didSelect:)))
-            .map { a in
-                return try castOrThrow(UITabBarItem.self, a[1])
-            }
-
-        return ControlEvent(events: source)
-    }
-
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UITabBarController+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UITabBarController+Rx.swift
deleted file mode 100644
index 4b48e8e55..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UITabBarController+Rx.swift
+++ /dev/null
@@ -1,79 +0,0 @@
-//
-//  UITabBarController+Rx.swift
-//  RxCocoa
-//
-//  Created by Yusuke Kita on 2016/12/07.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-    
-/**
- iOS only
- */
-#if os(iOS)
-extension Reactive where Base: UITabBarController {
-    
-    /// Reactive wrapper for `delegate` message `tabBarController:willBeginCustomizing:`.
-    public var willBeginCustomizing: ControlEvent<[UIViewController]> {
-        let source = delegate.methodInvoked(#selector(UITabBarControllerDelegate.tabBarController(_:willBeginCustomizing:)))
-            .map { a in
-                return try castOrThrow([UIViewController].self, a[1])
-        }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `delegate` message `tabBarController:willEndCustomizing:changed:`.
-    public var willEndCustomizing: ControlEvent<(viewControllers: [UIViewController], changed: Bool)> {
-        let source = delegate.methodInvoked(#selector(UITabBarControllerDelegate.tabBarController(_:willEndCustomizing:changed:)))
-            .map { (a: [Any]) -> (viewControllers: [UIViewController], changed: Bool) in
-                let viewControllers = try castOrThrow([UIViewController].self, a[1])
-                let changed = try castOrThrow(Bool.self, a[2])
-                return (viewControllers, changed)
-        }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /// Reactive wrapper for `delegate` message `tabBarController:didEndCustomizing:changed:`.
-    public var didEndCustomizing: ControlEvent<(viewControllers: [UIViewController], changed: Bool)> {
-        let source = delegate.methodInvoked(#selector(UITabBarControllerDelegate.tabBarController(_:didEndCustomizing:changed:)))
-            .map { (a: [Any]) -> (viewControllers: [UIViewController], changed: Bool) in
-                let viewControllers = try castOrThrow([UIViewController].self, a[1])
-                let changed = try castOrThrow(Bool.self, a[2])
-                return (viewControllers, changed)
-        }
-        
-        return ControlEvent(events: source)
-    }
-}
-#endif
-    
-/**
- iOS and tvOS
- */
-
-    extension Reactive where Base: UITabBarController {
-    /// Reactive wrapper for `delegate`.
-    ///
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var delegate: DelegateProxy<UITabBarController, UITabBarControllerDelegate> {
-        RxTabBarControllerDelegateProxy.proxy(for: base)
-    }
-    
-    /// Reactive wrapper for `delegate` message `tabBarController:didSelect:`.
-    public var didSelect: ControlEvent<UIViewController> {
-        let source = delegate.methodInvoked(#selector(UITabBarControllerDelegate.tabBarController(_:didSelect:)))
-            .map { a in
-                return try castOrThrow(UIViewController.self, a[1])
-        }
-        
-        return ControlEvent(events: source)
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UITableView+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UITableView+Rx.swift
deleted file mode 100644
index b21713396..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UITableView+Rx.swift
+++ /dev/null
@@ -1,429 +0,0 @@
-//
-//  UITableView+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 4/2/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import RxSwift
-import UIKit
-
-// Items
-
-extension Reactive where Base: UITableView {
-
-    /**
-    Binds sequences of elements to table view rows.
-    
-    - parameter source: Observable sequence of items.
-    - parameter cellFactory: Transform between sequence elements and view cells.
-    - returns: Disposable object that can be used to unbind.
-     
-     Example:
-    
-         let items = Observable.just([
-             "First Item",
-             "Second Item",
-             "Third Item"
-         ])
-
-         items
-         .bind(to: tableView.rx.items) { (tableView, row, element) in
-             let cell = tableView.dequeueReusableCell(withIdentifier: "Cell")!
-             cell.textLabel?.text = "\(element) @ row \(row)"
-             return cell
-         }
-         .disposed(by: disposeBag)
-
-     */
-    public func items<Sequence: Swift.Sequence, Source: ObservableType>
-        (_ source: Source)
-        -> (_ cellFactory: @escaping (UITableView, Int, Sequence.Element) -> UITableViewCell)
-        -> Disposable
-        where Source.Element == Sequence {
-            return { cellFactory in
-                let dataSource = RxTableViewReactiveArrayDataSourceSequenceWrapper<Sequence>(cellFactory: cellFactory)
-                return self.items(dataSource: dataSource)(source)
-            }
-    }
-
-    /**
-    Binds sequences of elements to table view rows.
-    
-    - parameter cellIdentifier: Identifier used to dequeue cells.
-    - parameter source: Observable sequence of items.
-    - parameter configureCell: Transform between sequence elements and view cells.
-    - parameter cellType: Type of table view cell.
-    - returns: Disposable object that can be used to unbind.
-     
-     Example:
-
-         let items = Observable.just([
-             "First Item",
-             "Second Item",
-             "Third Item"
-         ])
-
-         items
-             .bind(to: tableView.rx.items(cellIdentifier: "Cell", cellType: UITableViewCell.self)) { (row, element, cell) in
-                cell.textLabel?.text = "\(element) @ row \(row)"
-             }
-             .disposed(by: disposeBag)
-    */
-    public func items<Sequence: Swift.Sequence, Cell: UITableViewCell, Source: ObservableType>
-        (cellIdentifier: String, cellType: Cell.Type = Cell.self)
-        -> (_ source: Source)
-        -> (_ configureCell: @escaping (Int, Sequence.Element, Cell) -> Void)
-        -> Disposable
-        where Source.Element == Sequence {
-        return { source in
-            return { configureCell in
-                let dataSource = RxTableViewReactiveArrayDataSourceSequenceWrapper<Sequence> { tv, i, item in
-                    let indexPath = IndexPath(item: i, section: 0)
-                    let cell = tv.dequeueReusableCell(withIdentifier: cellIdentifier, for: indexPath) as! Cell
-                    configureCell(i, item, cell)
-                    return cell
-                }
-                return self.items(dataSource: dataSource)(source)
-            }
-        }
-    }
-
-
-    /**
-    Binds sequences of elements to table view rows using a custom reactive data used to perform the transformation.
-    This method will retain the data source for as long as the subscription isn't disposed (result `Disposable` 
-    being disposed).
-    In case `source` observable sequence terminates successfully, the data source will present latest element
-    until the subscription isn't disposed.
-    
-    - parameter dataSource: Data source used to transform elements to view cells.
-    - parameter source: Observable sequence of items.
-    - returns: Disposable object that can be used to unbind.
-    */
-    public func items<
-            DataSource: RxTableViewDataSourceType & UITableViewDataSource,
-            Source: ObservableType>
-        (dataSource: DataSource)
-        -> (_ source: Source)
-        -> Disposable
-        where DataSource.Element == Source.Element {
-        return { source in
-            // This is called for sideeffects only, and to make sure delegate proxy is in place when
-            // data source is being bound.
-            // This is needed because theoretically the data source subscription itself might
-            // call `self.rx.delegate`. If that happens, it might cause weird side effects since
-            // setting data source will set delegate, and UITableView might get into a weird state.
-            // Therefore it's better to set delegate proxy first, just to be sure.
-            _ = self.delegate
-            // Strong reference is needed because data source is in use until result subscription is disposed
-            return source.subscribeProxyDataSource(ofObject: self.base, dataSource: dataSource as UITableViewDataSource, retainDataSource: true) { [weak tableView = self.base] (_: RxTableViewDataSourceProxy, event) -> Void in
-                guard let tableView = tableView else {
-                    return
-                }
-                dataSource.tableView(tableView, observedEvent: event)
-            }
-        }
-    }
-
-}
-
-extension Reactive where Base: UITableView {
-    /**
-    Reactive wrapper for `dataSource`.
-    
-    For more information take a look at `DelegateProxyType` protocol documentation.
-    */
-    public var dataSource: DelegateProxy<UITableView, UITableViewDataSource> {
-        RxTableViewDataSourceProxy.proxy(for: base)
-    }
-   
-    /**
-    Installs data source as forwarding delegate on `rx.dataSource`.
-    Data source won't be retained.
-    
-    It enables using normal delegate mechanism with reactive delegate mechanism.
-     
-    - parameter dataSource: Data source object.
-    - returns: Disposable object that can be used to unbind the data source.
-    */
-    public func setDataSource(_ dataSource: UITableViewDataSource)
-        -> Disposable {
-        RxTableViewDataSourceProxy.installForwardDelegate(dataSource, retainDelegate: false, onProxyForObject: self.base)
-    }
-    
-    // events
-    
-    /**
-    Reactive wrapper for `delegate` message `tableView:didSelectRowAtIndexPath:`.
-    */
-    public var itemSelected: ControlEvent<IndexPath> {
-        let source = self.delegate.methodInvoked(#selector(UITableViewDelegate.tableView(_:didSelectRowAt:)))
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[1])
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /**
-     Reactive wrapper for `delegate` message `tableView:didDeselectRowAtIndexPath:`.
-     */
-    public var itemDeselected: ControlEvent<IndexPath> {
-        let source = self.delegate.methodInvoked(#selector(UITableViewDelegate.tableView(_:didDeselectRowAt:)))
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[1])
-            }
-
-        return ControlEvent(events: source)
-    }
-    
-    /**
-     Reactive wrapper for `delegate` message `tableView:didHighlightRowAt:`.
-     */
-    public var itemHighlighted: ControlEvent<IndexPath> {
-        let source = self.delegate.methodInvoked(#selector(UITableViewDelegate.tableView(_:didHighlightRowAt:)))
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[1])
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /**
-     Reactive wrapper for `delegate` message `tableView:didUnhighlightRowAt:`.
-     */
-    public var itemUnhighlighted: ControlEvent<IndexPath> {
-        let source = self.delegate.methodInvoked(#selector(UITableViewDelegate.tableView(_:didUnhighlightRowAt:)))
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[1])
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /**
-     Reactive wrapper for `delegate` message `tableView:accessoryButtonTappedForRowWithIndexPath:`.
-     */
-    public var itemAccessoryButtonTapped: ControlEvent<IndexPath> {
-        let source: Observable<IndexPath> = self.delegate.methodInvoked(#selector(UITableViewDelegate.tableView(_:accessoryButtonTappedForRowWith:)))
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[1])
-            }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /**
-    Reactive wrapper for `delegate` message `tableView:commitEditingStyle:forRowAtIndexPath:`.
-    */
-    public var itemInserted: ControlEvent<IndexPath> {
-        let source = self.dataSource.methodInvoked(#selector(UITableViewDataSource.tableView(_:commit:forRowAt:)))
-            .filter { a in
-                return UITableViewCell.EditingStyle(rawValue: (try castOrThrow(NSNumber.self, a[1])).intValue) == .insert
-            }
-            .map { a in
-                return (try castOrThrow(IndexPath.self, a[2]))
-        }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /**
-    Reactive wrapper for `delegate` message `tableView:commitEditingStyle:forRowAtIndexPath:`.
-    */
-    public var itemDeleted: ControlEvent<IndexPath> {
-        let source = self.dataSource.methodInvoked(#selector(UITableViewDataSource.tableView(_:commit:forRowAt:)))
-            .filter { a in
-                return UITableViewCell.EditingStyle(rawValue: (try castOrThrow(NSNumber.self, a[1])).intValue) == .delete
-            }
-            .map { a in
-                return try castOrThrow(IndexPath.self, a[2])
-            }
-        
-        return ControlEvent(events: source)
-    }
-    
-    /**
-    Reactive wrapper for `delegate` message `tableView:moveRowAtIndexPath:toIndexPath:`.
-    */
-    public var itemMoved: ControlEvent<ItemMovedEvent> {
-        let source: Observable<ItemMovedEvent> = self.dataSource.methodInvoked(#selector(UITableViewDataSource.tableView(_:moveRowAt:to:)))
-            .map { a in
-                return (try castOrThrow(IndexPath.self, a[1]), try castOrThrow(IndexPath.self, a[2]))
-            }
-        
-        return ControlEvent(events: source)
-    }
-
-    /**
-    Reactive wrapper for `delegate` message `tableView:willDisplayCell:forRowAtIndexPath:`.
-    */
-    public var willDisplayCell: ControlEvent<WillDisplayCellEvent> {
-        let source: Observable<WillDisplayCellEvent> = self.delegate.methodInvoked(#selector(UITableViewDelegate.tableView(_:willDisplay:forRowAt:)))
-            .map { a in
-                return (try castOrThrow(UITableViewCell.self, a[1]), try castOrThrow(IndexPath.self, a[2]))
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /**
-    Reactive wrapper for `delegate` message `tableView:didEndDisplayingCell:forRowAtIndexPath:`.
-    */
-    public var didEndDisplayingCell: ControlEvent<DidEndDisplayingCellEvent> {
-        let source: Observable<DidEndDisplayingCellEvent> = self.delegate.methodInvoked(#selector(UITableViewDelegate.tableView(_:didEndDisplaying:forRowAt:)))
-            .map { a in
-                return (try castOrThrow(UITableViewCell.self, a[1]), try castOrThrow(IndexPath.self, a[2]))
-            }
-
-        return ControlEvent(events: source)
-    }
-
-    /**
-    Reactive wrapper for `delegate` message `tableView:didSelectRowAtIndexPath:`.
-    
-    It can be only used when one of the `rx.itemsWith*` methods is used to bind observable sequence,
-    or any other data source conforming to `SectionedViewDataSourceType` protocol.
-    
-     ```
-        tableView.rx.modelSelected(MyModel.self)
-            .map { ...
-     ```
-    */
-    public func modelSelected<T>(_ modelType: T.Type) -> ControlEvent<T> {
-        let source: Observable<T> = self.itemSelected.flatMap { [weak view = self.base as UITableView] indexPath -> Observable<T> in
-            guard let view = view else {
-                return Observable.empty()
-            }
-
-            return Observable.just(try view.rx.model(at: indexPath))
-        }
-        
-        return ControlEvent(events: source)
-    }
-
-    /**
-     Reactive wrapper for `delegate` message `tableView:didDeselectRowAtIndexPath:`.
-
-     It can be only used when one of the `rx.itemsWith*` methods is used to bind observable sequence,
-     or any other data source conforming to `SectionedViewDataSourceType` protocol.
-
-     ```
-        tableView.rx.modelDeselected(MyModel.self)
-            .map { ...
-     ```
-     */
-    public func modelDeselected<T>(_ modelType: T.Type) -> ControlEvent<T> {
-         let source: Observable<T> = self.itemDeselected.flatMap { [weak view = self.base as UITableView] indexPath -> Observable<T> in
-             guard let view = view else {
-                 return Observable.empty()
-             }
-
-            return Observable.just(try view.rx.model(at: indexPath))
-        }
-
-        return ControlEvent(events: source)
-    }
-    
-    /**
-     Reactive wrapper for `delegate` message `tableView:commitEditingStyle:forRowAtIndexPath:`.
-     
-     It can be only used when one of the `rx.itemsWith*` methods is used to bind observable sequence,
-     or any other data source conforming to `SectionedViewDataSourceType` protocol.
-     
-     ```
-        tableView.rx.modelDeleted(MyModel.self)
-            .map { ...
-     ```
-     */
-    public func modelDeleted<T>(_ modelType: T.Type) -> ControlEvent<T> {
-        let source: Observable<T> = self.itemDeleted.flatMap { [weak view = self.base as UITableView] indexPath -> Observable<T> in
-            guard let view = view else {
-                return Observable.empty()
-            }
-            
-            return Observable.just(try view.rx.model(at: indexPath))
-        }
-        
-        return ControlEvent(events: source)
-    }
-
-    /**
-     Synchronous helper method for retrieving a model at indexPath through a reactive data source.
-     */
-    public func model<T>(at indexPath: IndexPath) throws -> T {
-        let dataSource: SectionedViewDataSourceType = castOrFatalError(self.dataSource.forwardToDelegate(), message: "This method only works in case one of the `rx.items*` methods was used.")
-        
-        let element = try dataSource.model(at: indexPath)
-
-        return castOrFatalError(element)
-    }
-}
-
-@available(iOS 10.0, tvOS 10.0, *)
-extension Reactive where Base: UITableView {
-
-    /// Reactive wrapper for `prefetchDataSource`.
-    ///
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var prefetchDataSource: DelegateProxy<UITableView, UITableViewDataSourcePrefetching> {
-        RxTableViewDataSourcePrefetchingProxy.proxy(for: base)
-    }
-
-    /**
-     Installs prefetch data source as forwarding delegate on `rx.prefetchDataSource`.
-     Prefetch data source won't be retained.
-
-     It enables using normal delegate mechanism with reactive delegate mechanism.
-
-     - parameter prefetchDataSource: Prefetch data source object.
-     - returns: Disposable object that can be used to unbind the data source.
-     */
-    public func setPrefetchDataSource(_ prefetchDataSource: UITableViewDataSourcePrefetching)
-        -> Disposable {
-            return RxTableViewDataSourcePrefetchingProxy.installForwardDelegate(prefetchDataSource, retainDelegate: false, onProxyForObject: self.base)
-    }
-
-    /// Reactive wrapper for `prefetchDataSource` message `tableView(_:prefetchRowsAt:)`.
-    public var prefetchRows: ControlEvent<[IndexPath]> {
-        let source = RxTableViewDataSourcePrefetchingProxy.proxy(for: base).prefetchRowsPublishSubject
-        return ControlEvent(events: source)
-    }
-
-    /// Reactive wrapper for `prefetchDataSource` message `tableView(_:cancelPrefetchingForRowsAt:)`.
-    public var cancelPrefetchingForRows: ControlEvent<[IndexPath]> {
-        let source = prefetchDataSource.methodInvoked(#selector(UITableViewDataSourcePrefetching.tableView(_:cancelPrefetchingForRowsAt:)))
-            .map { a in
-                return try castOrThrow(Array<IndexPath>.self, a[1])
-        }
-
-        return ControlEvent(events: source)
-    }
-
-}
-#endif
-
-#if os(tvOS)
-    
-    extension Reactive where Base: UITableView {
-        
-        /**
-         Reactive wrapper for `delegate` message `tableView:didUpdateFocusInContext:withAnimationCoordinator:`.
-         */
-        public var didUpdateFocusInContextWithAnimationCoordinator: ControlEvent<(context: UITableViewFocusUpdateContext, animationCoordinator: UIFocusAnimationCoordinator)> {
-            
-            let source = delegate.methodInvoked(#selector(UITableViewDelegate.tableView(_:didUpdateFocusIn:with:)))
-                .map { a -> (context: UITableViewFocusUpdateContext, animationCoordinator: UIFocusAnimationCoordinator) in
-                    let context = try castOrThrow(UITableViewFocusUpdateContext.self, a[1])
-                    let animationCoordinator = try castOrThrow(UIFocusAnimationCoordinator.self, a[2])
-                    return (context: context, animationCoordinator: animationCoordinator)
-            }
-            
-            return ControlEvent(events: source)
-        }
-    }
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UITextField+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UITextField+Rx.swift
deleted file mode 100644
index 614fecc78..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UITextField+Rx.swift
+++ /dev/null
@@ -1,55 +0,0 @@
-//
-//  UITextField+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 2/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import RxSwift
-import UIKit
-
-extension Reactive where Base: UITextField {
-    /// Reactive wrapper for `text` property.
-    public var text: ControlProperty<String?> {
-        value
-    }
-    
-    /// Reactive wrapper for `text` property.
-    public var value: ControlProperty<String?> {
-        return base.rx.controlPropertyWithDefaultEvents(
-            getter: { textField in
-                textField.text
-            },
-            setter: { textField, value in
-                // This check is important because setting text value always clears control state
-                // including marked text selection which is imporant for proper input 
-                // when IME input method is used.
-                if textField.text != value {
-                    textField.text = value
-                }
-            }
-        )
-    }
-    
-    /// Bindable sink for `attributedText` property.
-    public var attributedText: ControlProperty<NSAttributedString?> {
-        return base.rx.controlPropertyWithDefaultEvents(
-            getter: { textField in
-                textField.attributedText
-            },
-            setter: { textField, value in
-                // This check is important because setting text value always clears control state
-                // including marked text selection which is imporant for proper input
-                // when IME input method is used.
-                if textField.attributedText != value {
-                    textField.attributedText = value
-                }
-            }
-        )
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/UITextView+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/UITextView+Rx.swift
deleted file mode 100644
index 497ab66c8..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/UITextView+Rx.swift
+++ /dev/null
@@ -1,125 +0,0 @@
-//
-//  UITextView+Rx.swift
-//  RxCocoa
-//
-//  Created by Yuta ToKoRo on 7/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(tvOS)
-
-import UIKit
-import RxSwift
-
-extension Reactive where Base: UITextView {
-    /// Reactive wrapper for `text` property
-    public var text: ControlProperty<String?> {
-        value
-    }
-    
-    /// Reactive wrapper for `text` property.
-    public var value: ControlProperty<String?> {
-        let source: Observable<String?> = Observable.deferred { [weak textView = self.base] in
-            let text = textView?.text
-            
-            let textChanged = textView?.textStorage
-                // This project uses text storage notifications because
-                // that's the only way to catch autocorrect changes
-                // in all cases. Other suggestions are welcome.
-                .rx.didProcessEditingRangeChangeInLength
-                // This observe on is here because text storage
-                // will emit event while process is not completely done,
-                // so rebinding a value will cause an exception to be thrown.
-                .observe(on:MainScheduler.asyncInstance)
-                .map { _ in
-                    return textView?.textStorage.string
-                }
-                ?? Observable.empty()
-            
-            return textChanged
-                .startWith(text)
-        }
-
-        let bindingObserver = Binder(self.base) { (textView, text: String?) in
-            // This check is important because setting text value always clears control state
-            // including marked text selection which is imporant for proper input 
-            // when IME input method is used.
-            if textView.text != text {
-                textView.text = text
-            }
-        }
-        
-        return ControlProperty(values: source, valueSink: bindingObserver)
-    }
-    
-    
-    /// Reactive wrapper for `attributedText` property.
-    public var attributedText: ControlProperty<NSAttributedString?> {
-        let source: Observable<NSAttributedString?> = Observable.deferred { [weak textView = self.base] in
-            let attributedText = textView?.attributedText
-            
-            let textChanged: Observable<NSAttributedString?> = textView?.textStorage
-                // This project uses text storage notifications because
-                // that's the only way to catch autocorrect changes
-                // in all cases. Other suggestions are welcome.
-                .rx.didProcessEditingRangeChangeInLength
-                // This observe on is here because attributedText storage
-                // will emit event while process is not completely done,
-                // so rebinding a value will cause an exception to be thrown.
-                .observe(on:MainScheduler.asyncInstance)
-                .map { _ in
-                    return textView?.attributedText
-                }
-                ?? Observable.empty()
-            
-            return textChanged
-                .startWith(attributedText)
-        }
-        
-        let bindingObserver = Binder(self.base) { (textView, attributedText: NSAttributedString?) in
-            // This check is important because setting text value always clears control state
-            // including marked text selection which is imporant for proper input
-            // when IME input method is used.
-            if textView.attributedText != attributedText {
-                textView.attributedText = attributedText
-            }
-        }
-        
-        return ControlProperty(values: source, valueSink: bindingObserver)
-    }
-
-    /// Reactive wrapper for `delegate` message.
-    public var didBeginEditing: ControlEvent<()> {
-       return ControlEvent<()>(events: self.delegate.methodInvoked(#selector(UITextViewDelegate.textViewDidBeginEditing(_:)))
-            .map { _ in
-                return ()
-            })
-    }
-
-    /// Reactive wrapper for `delegate` message.
-    public var didEndEditing: ControlEvent<()> {
-        return ControlEvent<()>(events: self.delegate.methodInvoked(#selector(UITextViewDelegate.textViewDidEndEditing(_:)))
-            .map { _ in
-                return ()
-            })
-    }
-
-    /// Reactive wrapper for `delegate` message.
-    public var didChange: ControlEvent<()> {
-        return ControlEvent<()>(events: self.delegate.methodInvoked(#selector(UITextViewDelegate.textViewDidChange(_:)))
-            .map { _ in
-                return ()
-            })
-    }
-
-    /// Reactive wrapper for `delegate` message.
-    public var didChangeSelection: ControlEvent<()> {
-        return ControlEvent<()>(events: self.delegate.methodInvoked(#selector(UITextViewDelegate.textViewDidChangeSelection(_:)))
-            .map { _ in
-                return ()
-            })
-    }
-
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/iOS/WKWebView+Rx.swift b/Pods/RxCocoa/RxCocoa/iOS/WKWebView+Rx.swift
deleted file mode 100644
index b3b4d8479..000000000
--- a/Pods/RxCocoa/RxCocoa/iOS/WKWebView+Rx.swift
+++ /dev/null
@@ -1,57 +0,0 @@
-//
-//  WKWebView+Rx.swift
-//  RxCocoa
-//
-//  Created by Giuseppe Lanza on 14/02/2020.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(iOS) || os(macOS)
-
-import RxSwift
-import WebKit
-
-@available(iOS 8.0, OSX 10.10, OSXApplicationExtension 10.10, *)
-extension Reactive where Base: WKWebView {
-    
-    /// Reactive wrapper for `navigationDelegate`.
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var navigationDelegate: DelegateProxy<WKWebView, WKNavigationDelegate> {
-        RxWKNavigationDelegateProxy.proxy(for: base)
-    }
-    
-    /// Reactive wrapper for `navigationDelegate` message.
-    public var didCommit: Observable<WKNavigation> {
-        navigationDelegate
-            .methodInvoked(#selector(WKNavigationDelegate.webView(_:didCommit:)))
-            .map { a in try castOrThrow(WKNavigation.self, a[1]) }
-    }
-    
-    /// Reactive wrapper for `navigationDelegate` message.
-    public var didStartLoad: Observable<WKNavigation> {
-        navigationDelegate
-            .methodInvoked(#selector(WKNavigationDelegate.webView(_:didStartProvisionalNavigation:)))
-            .map { a in try castOrThrow(WKNavigation.self, a[1]) }
-    }
-
-    /// Reactive wrapper for `navigationDelegate` message.
-    public var didFinishLoad: Observable<WKNavigation> {
-        navigationDelegate
-            .methodInvoked(#selector(WKNavigationDelegate.webView(_:didFinish:)))
-            .map { a in try castOrThrow(WKNavigation.self, a[1]) }
-    }
-
-    /// Reactive wrapper for `navigationDelegate` message.
-    public var didFailLoad: Observable<(WKNavigation, Error)> {
-        navigationDelegate
-            .methodInvoked(#selector(WKNavigationDelegate.webView(_:didFail:withError:)))
-            .map { a in
-                (
-                    try castOrThrow(WKNavigation.self, a[1]),
-                    try castOrThrow(Error.self, a[2])
-                )
-            }
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/macOS/NSButton+Rx.swift b/Pods/RxCocoa/RxCocoa/macOS/NSButton+Rx.swift
deleted file mode 100644
index 7c223618f..000000000
--- a/Pods/RxCocoa/RxCocoa/macOS/NSButton+Rx.swift
+++ /dev/null
@@ -1,33 +0,0 @@
-//
-//  NSButton+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 5/17/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(macOS)
-
-import RxSwift
-import Cocoa
-
-extension Reactive where Base: NSButton {
-    
-    /// Reactive wrapper for control event.
-    public var tap: ControlEvent<Void> {
-        self.controlEvent
-    }
-    
-    /// Reactive wrapper for `state` property`.
-    public var state: ControlProperty<NSControl.StateValue> {
-        return self.base.rx.controlProperty(
-            getter: { control in
-                return control.state
-            }, setter: { (control: NSButton, state: NSControl.StateValue) in
-                control.state = state
-            }
-        )
-    }
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/macOS/NSControl+Rx.swift b/Pods/RxCocoa/RxCocoa/macOS/NSControl+Rx.swift
deleted file mode 100644
index 534f40cab..000000000
--- a/Pods/RxCocoa/RxCocoa/macOS/NSControl+Rx.swift
+++ /dev/null
@@ -1,87 +0,0 @@
-//
-//  NSControl+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 5/31/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(macOS)
-
-import Cocoa
-import RxSwift
-
-private var rx_value_key: UInt8 = 0
-private var rx_control_events_key: UInt8 = 0
-
-extension Reactive where Base: NSControl {
-
-    /// Reactive wrapper for control event.
-    public var controlEvent: ControlEvent<()> {
-        MainScheduler.ensureRunningOnMainThread()
-
-        let source = self.lazyInstanceObservable(&rx_control_events_key) { () -> Observable<Void> in
-            Observable.create { [weak control = self.base] observer in
-                MainScheduler.ensureRunningOnMainThread()
-
-                guard let control = control else {
-                    observer.on(.completed)
-                    return Disposables.create()
-                }
-
-                let observer = ControlTarget(control: control) { _ in
-                    observer.on(.next(()))
-                }
-                
-                return observer
-            }
-            .take(until: self.deallocated)
-			.share()
-        }
-
-        return ControlEvent(events: source)
-    }
-
-    /// Creates a `ControlProperty` that is triggered by target/action pattern value updates.
-    ///
-    /// - parameter getter: Property value getter.
-    /// - parameter setter: Property value setter.
-    public func controlProperty<T>(
-        getter: @escaping (Base) -> T,
-        setter: @escaping (Base, T) -> Void
-    ) -> ControlProperty<T> {
-        MainScheduler.ensureRunningOnMainThread()
-
-        let source = self.base.rx.lazyInstanceObservable(&rx_value_key) { () -> Observable<()> in
-                return Observable.create { [weak weakControl = self.base] (observer: AnyObserver<()>) in
-                    guard let control = weakControl else {
-                        observer.on(.completed)
-                        return Disposables.create()
-                    }
-
-                    observer.on(.next(()))
-
-                    let observer = ControlTarget(control: control) { _ in
-                        if weakControl != nil {
-                            observer.on(.next(()))
-                        }
-                    }
-
-                    return observer
-                }
-                .take(until: self.deallocated)
-                .share(replay: 1, scope: .whileConnected)
-            }
-            .flatMap { [weak base] _ -> Observable<T> in
-                guard let control = base else { return Observable.empty() }
-                return Observable.just(getter(control))
-            }
-
-        let bindingObserver = Binder(self.base, binding: setter)
-
-        return ControlProperty(values: source, valueSink: bindingObserver)
-    }
-}
-
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/macOS/NSSlider+Rx.swift b/Pods/RxCocoa/RxCocoa/macOS/NSSlider+Rx.swift
deleted file mode 100644
index 2e5b19a85..000000000
--- a/Pods/RxCocoa/RxCocoa/macOS/NSSlider+Rx.swift
+++ /dev/null
@@ -1,30 +0,0 @@
-//
-//  NSSlider+Rx.swift
-//  RxCocoa
-//
-//  Created by Junior B. on 24/05/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(macOS)
-
-import RxSwift
-import Cocoa
-
-extension Reactive where Base: NSSlider {
-    
-    /// Reactive wrapper for `value` property.
-    public var value: ControlProperty<Double> {
-        return self.base.rx.controlProperty(
-            getter: { control -> Double in
-                return control.doubleValue
-            },
-            setter: { control, value in
-                control.doubleValue = value
-            }
-        )
-    }
-    
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/macOS/NSTextField+Rx.swift b/Pods/RxCocoa/RxCocoa/macOS/NSTextField+Rx.swift
deleted file mode 100644
index ce69f9e9f..000000000
--- a/Pods/RxCocoa/RxCocoa/macOS/NSTextField+Rx.swift
+++ /dev/null
@@ -1,87 +0,0 @@
-//
-//  NSTextField+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 5/17/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(macOS)
-
-import Cocoa
-import RxSwift
-
-/// Delegate proxy for `NSTextField`.
-///
-/// For more information take a look at `DelegateProxyType`.
-open class RxTextFieldDelegateProxy
-    : DelegateProxy<NSTextField, NSTextFieldDelegate>
-    , DelegateProxyType 
-    , NSTextFieldDelegate {
-
-    /// Typed parent object.
-    public weak private(set) var textField: NSTextField?
-
-    /// Initializes `RxTextFieldDelegateProxy`
-    ///
-    /// - parameter textField: Parent object for delegate proxy.
-    init(textField: NSTextField) {
-        self.textField = textField
-        super.init(parentObject: textField, delegateProxy: RxTextFieldDelegateProxy.self)
-    }
-
-    public static func registerKnownImplementations() {
-        self.register { RxTextFieldDelegateProxy(textField: $0) }
-    }
-
-    fileprivate let textSubject = PublishSubject<String?>()
-
-    // MARK: Delegate methods
-    open func controlTextDidChange(_ notification: Notification) {
-        let textField: NSTextField = castOrFatalError(notification.object)
-        let nextValue = textField.stringValue
-        self.textSubject.on(.next(nextValue))
-        _forwardToDelegate?.controlTextDidChange?(notification)
-    }
-    
-    // MARK: Delegate proxy methods
-
-    /// For more information take a look at `DelegateProxyType`.
-    open class func currentDelegate(for object: ParentObject) -> NSTextFieldDelegate? {
-        object.delegate
-    }
-
-    /// For more information take a look at `DelegateProxyType`.
-    open class func setCurrentDelegate(_ delegate: NSTextFieldDelegate?, to object: ParentObject) {
-        object.delegate = delegate
-    }
-    
-}
-
-extension Reactive where Base: NSTextField {
-
-    /// Reactive wrapper for `delegate`.
-    ///
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var delegate: DelegateProxy<NSTextField, NSTextFieldDelegate> {
-        RxTextFieldDelegateProxy.proxy(for: self.base)
-    }
-    
-    /// Reactive wrapper for `text` property.
-    public var text: ControlProperty<String?> {
-        let delegate = RxTextFieldDelegateProxy.proxy(for: self.base)
-        
-        let source = Observable.deferred { [weak textField = self.base] in
-            delegate.textSubject.startWith(textField?.stringValue)
-        }.take(until: self.deallocated)
-
-        let observer = Binder(self.base) { (control, value: String?) in
-            control.stringValue = value ?? ""
-        }
-
-        return ControlProperty(values: source, valueSink: observer.asObserver())
-    }
-    
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/macOS/NSTextView+Rx.swift b/Pods/RxCocoa/RxCocoa/macOS/NSTextView+Rx.swift
deleted file mode 100644
index c3134e4f5..000000000
--- a/Pods/RxCocoa/RxCocoa/macOS/NSTextView+Rx.swift
+++ /dev/null
@@ -1,94 +0,0 @@
-//
-//  NSTextView+Rx.swift
-//  RxCocoa
-//
-//  Created by Cee on 8/5/18.
-//  Copyright © 2018 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(macOS)
-
-import Cocoa
-import RxSwift
-
-/// Delegate proxy for `NSTextView`.
-///
-/// For more information take a look at `DelegateProxyType`.
-open class RxTextViewDelegateProxy: DelegateProxy<NSTextView, NSTextViewDelegate>, DelegateProxyType, NSTextViewDelegate {
-
-    #if compiler(>=5.2)
-    /// Typed parent object.
-    /// 
-    /// - note: Since Swift 5.2 and Xcode 11.4, Apple have suddenly
-    ///         disallowed using `weak` for NSTextView. For more details
-    ///         see this GitHub Issue: https://git.io/JvSRn
-    public private(set) var textView: NSTextView?
-    #else
-    /// Typed parent object.
-    public weak private(set) var textView: NSTextView?
-    #endif
-
-    /// Initializes `RxTextViewDelegateProxy`
-    ///
-    /// - parameter textView: Parent object for delegate proxy.
-    init(textView: NSTextView) {
-        self.textView = textView
-        super.init(parentObject: textView, delegateProxy: RxTextViewDelegateProxy.self)
-    }
-
-    public static func registerKnownImplementations() {
-        self.register { RxTextViewDelegateProxy(textView: $0) }
-    }
-
-    fileprivate let textSubject = PublishSubject<String>()
-
-    // MARK: Delegate methods
-
-    open func textDidChange(_ notification: Notification) {
-        let textView: NSTextView = castOrFatalError(notification.object)
-        let nextValue = textView.string
-        self.textSubject.on(.next(nextValue))
-        self._forwardToDelegate?.textDidChange?(notification)
-    }
-
-    // MARK: Delegate proxy methods
-
-    /// For more information take a look at `DelegateProxyType`.
-    open class func currentDelegate(for object: ParentObject) -> NSTextViewDelegate? {
-        object.delegate
-    }
-
-    /// For more information take a look at `DelegateProxyType`.
-    open class func setCurrentDelegate(_ delegate: NSTextViewDelegate?, to object: ParentObject) {
-        object.delegate = delegate
-    }
-
-}
-
-extension Reactive where Base: NSTextView {
-
-    /// Reactive wrapper for `delegate`.
-    ///
-    /// For more information take a look at `DelegateProxyType` protocol documentation.
-    public var delegate: DelegateProxy<NSTextView, NSTextViewDelegate> {
-        RxTextViewDelegateProxy.proxy(for: self.base)
-    }
-
-    /// Reactive wrapper for `string` property.
-    public var string: ControlProperty<String> {
-        let delegate = RxTextViewDelegateProxy.proxy(for: self.base)
-
-        let source = Observable.deferred { [weak textView = self.base] in
-            delegate.textSubject.startWith(textView?.string ?? "")
-        }.take(until: self.deallocated)
-
-        let observer = Binder(self.base) { control, value in
-            control.string = value
-        }
-
-        return ControlProperty(values: source, valueSink: observer.asObserver())
-    }
-
-}
-
-#endif
diff --git a/Pods/RxCocoa/RxCocoa/macOS/NSView+Rx.swift b/Pods/RxCocoa/RxCocoa/macOS/NSView+Rx.swift
deleted file mode 100644
index f4256d119..000000000
--- a/Pods/RxCocoa/RxCocoa/macOS/NSView+Rx.swift
+++ /dev/null
@@ -1,21 +0,0 @@
-//
-//  NSView+Rx.swift
-//  RxCocoa
-//
-//  Created by Krunoslav Zaher on 12/6/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(macOS)
-    import Cocoa
-    import RxSwift
-
-    extension Reactive where Base: NSView {
-        /// Bindable sink for `alphaValue` property.
-        public var alpha: Binder<CGFloat> {
-            return Binder(self.base) { view, value in
-                view.alphaValue = value
-            }
-        }
-    }
-#endif
diff --git a/Pods/RxRelay/LICENSE.md b/Pods/RxRelay/LICENSE.md
deleted file mode 100644
index e32511b38..000000000
--- a/Pods/RxRelay/LICENSE.md
+++ /dev/null
@@ -1,9 +0,0 @@
-**The MIT License**
-**Copyright © 2015 Krunoslav Zaher, Shai Mishali**
-**All rights reserved.**
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/Pods/RxRelay/README.md b/Pods/RxRelay/README.md
deleted file mode 100644
index 20330166b..000000000
--- a/Pods/RxRelay/README.md
+++ /dev/null
@@ -1,254 +0,0 @@
-<p align="center">
-<img src="assets/RxSwift_Logo.png" width="35%" alt="RxSwift Logo" />
-<br />
-<a href="https://actions-badge.atrox.dev/ReactiveX/RxSwift/goto" target="_blank"><img src="https://github.com/ReactiveX/RxSwift/workflows/RxSwift/badge.svg?branch=main" alt="Build Status" /></a>
-<img src="https://img.shields.io/badge/platforms-iOS%20%7C%20macOS%20%7C%20tvOS%20%7C%20watchOS%20%7C%20Linux-333333.svg" alt="Supported Platforms: iOS, macOS, tvOS, watchOS & Linux" />
-<br />
-<a href="https://cocoapods.org/pods/RxSwift" alt="RxSwift on CocoaPods" title="RxSwift on CocoaPods"><img src="https://img.shields.io/cocoapods/v/RxSwift.svg" /></a>
-<a href="https://github.com/Carthage/Carthage" alt="RxSwift on Carthage" title="RxSwift on Carthage"><img src="https://img.shields.io/badge/Carthage-compatible-4BC51D.svg?style=flat" /></a>
-<a href="https://github.com/apple/swift-package-manager" alt="RxSwift on Swift Package Manager" title="RxSwift on Swift Package Manager"><img src="https://img.shields.io/badge/Swift%20Package%20Manager-compatible-brightgreen.svg" /></a>
-</p>
-
-Rx is a [generic abstraction of computation](https://youtu.be/looJcaeboBY) expressed through `Observable<Element>` interface, which lets you broadcast and subscribe to values and other events from an `Observable` stream.  
-
-RxSwift is the Swift-specific implementation of the [Reactive Extensions](http://reactivex.io) standard.
-
-<p align="center"><img src="assets/example.png" width="55%" alt="RxSwift Observable Example of a price constantly changing and updating the app's UI" /></p>
-
-While this version aims to stay true to the original spirit and naming conventions of Rx, this projects also aims to provide a true Swift-first API for Rx APIs.
-
-Cross platform documentation can be found on [ReactiveX.io](http://reactivex.io/).
-
-Like other Rx implementation, RxSwift's intention is to enable easy composition of asynchronous operations and streams of data in the form of `Observable` objects and a suite of methods to transform and compose these pieces of asynchronous work.
-
-KVO observation, async operations, UI Events and other streams of data are all unified under [abstraction of sequence](Documentation/GettingStarted.md#observables-aka-sequences). This is the reason why Rx is so simple, elegant and powerful.
-
-## I came here because I want to ...
-
-###### ... understand
-
-* [why use rx?](Documentation/Why.md)
-* [the basics, getting started with RxSwift](Documentation/GettingStarted.md)
-* [traits](Documentation/Traits.md) - what are `Single`, `Completable`, `Maybe`, `Driver`, and `ControlProperty` ... and why do they exist?
-* [testing](Documentation/UnitTests.md)
-* [tips and common errors](Documentation/Tips.md)
-* [debugging](Documentation/GettingStarted.md#debugging)
-* [the math behind Rx](Documentation/MathBehindRx.md)
-* [what are hot and cold observable sequences?](Documentation/HotAndColdObservables.md)
-
-###### ... install
-
-* Integrate RxSwift/RxCocoa with my app. [Installation Guide](#installation)
-
-###### ... hack around
-
-* with the example app. [Running Example App](Documentation/ExampleApp.md)
-* with operators in playgrounds. [Playgrounds](Documentation/Playgrounds.md)
-
-###### ... interact
-
-* All of this is great, but it would be nice to talk with other people using RxSwift and exchange experiences. <br />[Join Slack Channel](http://slack.rxswift.org)
-* Report a problem using the library. [Open an Issue With Bug Template](.github/ISSUE_TEMPLATE.md)
-* Request a new feature. [Open an Issue With Feature Request Template](Documentation/NewFeatureRequestTemplate.md)
-* Help out [Check out contribution guide](CONTRIBUTING.md)
-
-###### ... compare
-
-* [with Combine and ReactiveSwift](Documentation/ComparisonWithOtherLibraries.md).
-
-###### ... understand the structure
-
-RxSwift is as compositional as the asynchronous work it drives. The core unit is RxSwift itself, while other dependencies can be added for UI Work, testing, and more.
-
-It comprises five separate components depending on each other in the following way:
-
-```none
-┌──────────────┐    ┌──────────────┐
-│   RxCocoa    ├────▶   RxRelay    │
-└───────┬──────┘    └──────┬───────┘
-        │                  │        
-┌───────▼──────────────────▼───────┐
-│             RxSwift              │
-└───────▲──────────────────▲───────┘
-        │                  │        
-┌───────┴──────┐    ┌──────┴───────┐
-│    RxTest    │    │  RxBlocking  │
-└──────────────┘    └──────────────┘
-```
-
-* **RxSwift**: The core of RxSwift, providing the Rx standard as (mostly) defined by [ReactiveX](https://reactivex.io). It has no other dependencies.
-* **RxCocoa**: Provides Cocoa-specific capabilities for general iOS/macOS/watchOS & tvOS app development, such as Shared Sequences, Traits, and much more. It depends on both `RxSwift` and `RxRelay`.
-* **RxRelay**: Provides `PublishRelay`, `BehaviorRelay` and `ReplayRelay`, three [simple wrappers around Subjects](https://github.com/ReactiveX/RxSwift/blob/main/Documentation/Subjects.md#relays). It depends on `RxSwift`. 
-* **RxTest** and **RxBlocking**: Provides testing capabilities for Rx-based systems. It depends on `RxSwift`.
-
-## Usage
-
-<table>
-  <tr>
-    <th width="30%">Here's an example</th>
-    <th width="30%">In Action</th>
-  </tr>
-  <tr>
-    <td>Define search for GitHub repositories ...</td>
-    <th rowspan="9"><img src="https://raw.githubusercontent.com/kzaher/rxswiftcontent/master/GithubSearch.gif"></th>
-  </tr>
-  <tr>
-    <td><div class="highlight highlight-source-swift"><pre>
-let searchResults = searchBar.rx.text.orEmpty
-    .throttle(.milliseconds(300), scheduler: MainScheduler.instance)
-    .distinctUntilChanged()
-    .flatMapLatest { query -> Observable&lt;[Repository]&gt; in
-        if query.isEmpty {
-            return .just([])
-        }
-        return searchGitHub(query)
-            .catchAndReturn([])
-    }
-    .observe(on: MainScheduler.instance)</pre></div></td>
-  </tr>
-  <tr>
-    <td>... then bind the results to your tableview</td>
-  </tr>
-  <tr>
-    <td width="30%"><div class="highlight highlight-source-swift"><pre>
-searchResults
-    .bind(to: tableView.rx.items(cellIdentifier: "Cell")) {
-        (index, repository: Repository, cell) in
-        cell.textLabel?.text = repository.name
-        cell.detailTextLabel?.text = repository.url
-    }
-    .disposed(by: disposeBag)</pre></div></td>
-  </tr>
-</table>
-
-
-## Requirements
-
-* Xcode 12.x
-* Swift 5.x
-
-For Xcode 11 and below, [use RxSwift 5.x](https://github.com/ReactiveX/RxSwift/releases/tag/5.1.1).
-
-## Installation
-
-RxSwift doesn't contain any external dependencies.
-
-These are currently the supported installation options:
-
-### Manual
-
-Open Rx.xcworkspace, choose `RxExample` and hit run. This method will build everything and run the sample app
-
-### [CocoaPods](https://guides.cocoapods.org/using/using-cocoapods.html)
-
-```ruby
-# Podfile
-use_frameworks!
-
-target 'YOUR_TARGET_NAME' do
-    pod 'RxSwift', '6.2.0'
-    pod 'RxCocoa', '6.2.0'
-end
-
-# RxTest and RxBlocking make the most sense in the context of unit/integration tests
-target 'YOUR_TESTING_TARGET' do
-    pod 'RxBlocking', '6.2.0'
-    pod 'RxTest', '6.2.0'
-end
-```
-
-Replace `YOUR_TARGET_NAME` and then, in the `Podfile` directory, type:
-
-```bash
-$ pod install
-```
-
-### XCFrameworks
-
-Each release starting with RxSwift 6 includes `*.xcframework` framework binaries.
-
-Simply drag the needed framework binaries to your **Frameworks, Libraries, and Embedded Content** section under your target's **General** tab.
-
-> **Note**: If you're using `RxCocoa`, be sure to also drag **RxCocoaRuntime.xcframework** before importing `RxCocoa`.
-
-<img src="https://raw.githubusercontent.com/ReactiveX/RxSwift/main/assets/xcframeworks.png" alt="XCFrameworks instructions" width="65%">
-
-### [Carthage](https://github.com/Carthage/Carthage)
-
-Add this to `Cartfile`
-
-```
-github "ReactiveX/RxSwift" "6.2.0"
-```
-
-```bash
-$ carthage update
-```
-
-#### Carthage as a Static Library
-
-Carthage defaults to building RxSwift as a Dynamic Library. 
-
-If you wish to build RxSwift as a Static Library using Carthage you may use the script below to manually modify the framework type before building with Carthage:
-
-```bash
-carthage update RxSwift --platform iOS --no-build
-sed -i -e 's/MACH_O_TYPE = mh_dylib/MACH_O_TYPE = staticlib/g' Carthage/Checkouts/RxSwift/Rx.xcodeproj/project.pbxproj
-carthage build RxSwift --platform iOS
-```
-
-### [Swift Package Manager](https://github.com/apple/swift-package-manager)
-
-> **Note**: There is a critical cross-dependency bug affecting many projects including RxSwift in Swift Package Manager. We've [filed a bug (SR-12303)](https://bugs.swift.org/browse/SR-12303) in early 2020 but have no answer yet. Your mileage may vary. A partial workaround can be found [here](https://github.com/ReactiveX/RxSwift/issues/2127#issuecomment-717830502).
-
-Create a `Package.swift` file.
-
-```swift
-// swift-tools-version:5.0
-
-import PackageDescription
-
-let package = Package(
-  name: "RxTestProject",
-  dependencies: [
-    .package(url: "https://github.com/ReactiveX/RxSwift.git", .exact("6.2.0"))
-  ],
-  targets: [
-    .target(name: "RxTestProject", dependencies: ["RxSwift", "RxCocoa"])
-  ]
-)
-```
-
-```bash
-$ swift build
-```
-
-To build or test a module with RxTest dependency, set `TEST=1`.
-
-```bash
-$ TEST=1 swift test
-```
-
-### Manually using git submodules
-
-* Add RxSwift as a submodule
-
-```bash
-$ git submodule add git@github.com:ReactiveX/RxSwift.git
-```
-
-* Drag `Rx.xcodeproj` into Project Navigator
-* Go to `Project > Targets > Build Phases > Link Binary With Libraries`, click `+` and select `RxSwift`, `RxCocoa` and `RxRelay` targets
-
-## References
-
-* [http://reactivex.io/](http://reactivex.io/)
-* [Reactive Extensions GitHub (GitHub)](https://github.com/Reactive-Extensions)
-* [RxSwift RayWenderlich.com Book](https://store.raywenderlich.com/products/rxswift-reactive-programming-with-swift)
-* [RxSwift: Debunking the myth of hard (YouTube)](https://www.youtube.com/watch?v=GdvLP0ZAhhc)
-* [Boxue.io RxSwift Online Course](https://boxueio.com/series/rxswift-101) (Chinese 🇨🇳)
-* [Expert to Expert: Brian Beckman and Erik Meijer - Inside the .NET Reactive Framework (Rx) (video)](https://youtu.be/looJcaeboBY)
-* [Reactive Programming Overview (Jafar Husain from Netflix)](https://youtu.be/-8Y1-lE6NSA)
-* [Subject/Observer is Dual to Iterator (paper)](http://csl.stanford.edu/~christos/pldi2010.fit/meijer.duality.pdf)
-* [Rx standard sequence operators visualized (visualization tool)](http://rxmarbles.com/)
-* [Haskell](https://www.haskell.org/)
diff --git a/Pods/RxRelay/RxRelay/BehaviorRelay.swift b/Pods/RxRelay/RxRelay/BehaviorRelay.swift
deleted file mode 100644
index e02fc8f5c..000000000
--- a/Pods/RxRelay/RxRelay/BehaviorRelay.swift
+++ /dev/null
@@ -1,42 +0,0 @@
-//
-//  BehaviorRelay.swift
-//  RxRelay
-//
-//  Created by Krunoslav Zaher on 10/7/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-/// BehaviorRelay is a wrapper for `BehaviorSubject`.
-///
-/// Unlike `BehaviorSubject` it can't terminate with error or completed.
-public final class BehaviorRelay<Element>: ObservableType {
-    private let subject: BehaviorSubject<Element>
-
-    /// Accepts `event` and emits it to subscribers
-    public func accept(_ event: Element) {
-        self.subject.onNext(event)
-    }
-
-    /// Current value of behavior subject
-    public var value: Element {
-        // this try! is ok because subject can't error out or be disposed
-        return try! self.subject.value()
-    }
-
-    /// Initializes behavior relay with initial value.
-    public init(value: Element) {
-        self.subject = BehaviorSubject(value: value)
-    }
-
-    /// Subscribes observer
-    public func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.subject.subscribe(observer)
-    }
-
-    /// - returns: Canonical interface for push style sequence
-    public func asObservable() -> Observable<Element> {
-        self.subject.asObservable()
-    }
-}
diff --git a/Pods/RxRelay/RxRelay/Observable+Bind.swift b/Pods/RxRelay/RxRelay/Observable+Bind.swift
deleted file mode 100644
index 7a2efc7b0..000000000
--- a/Pods/RxRelay/RxRelay/Observable+Bind.swift
+++ /dev/null
@@ -1,149 +0,0 @@
-//
-//  Observable+Bind.swift
-//  RxRelay
-//
-//  Created by Shai Mishali on 09/04/2019.
-//  Copyright © 2019 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-extension ObservableType {
-    /**
-     Creates new subscription and sends elements to publish relay(s).
-     In case error occurs in debug mode, `fatalError` will be raised.
-     In case error occurs in release mode, `error` will be logged.
-     - parameter to: Target publish relays for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer.
-     */
-    public func bind(to relays: PublishRelay<Element>...) -> Disposable {
-        bind(to: relays)
-    }
-
-    /**
-     Creates new subscription and sends elements to publish relay(s).
-
-     In case error occurs in debug mode, `fatalError` will be raised.
-     In case error occurs in release mode, `error` will be logged.
-
-     - parameter to: Target publish relays for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer.
-     */
-    public func bind(to relays: PublishRelay<Element?>...) -> Disposable {
-        self.map { $0 as Element? }.bind(to: relays)
-    }
-
-    /**
-     Creates new subscription and sends elements to publish relay(s).
-     In case error occurs in debug mode, `fatalError` will be raised.
-     In case error occurs in release mode, `error` will be logged.
-     - parameter to: Target publish relays for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer.
-     */
-    private func bind(to relays: [PublishRelay<Element>]) -> Disposable {
-        subscribe { e in
-            switch e {
-            case let .next(element):
-                relays.forEach {
-                    $0.accept(element)
-                }
-            case let .error(error):
-                rxFatalErrorInDebug("Binding error to publish relay: \(error)")
-            case .completed:
-                break
-            }
-        }
-    }
-
-    /**
-     Creates new subscription and sends elements to behavior relay(s).
-     In case error occurs in debug mode, `fatalError` will be raised.
-     In case error occurs in release mode, `error` will be logged.
-     - parameter to: Target behavior relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer.
-     */
-    public func bind(to relays: BehaviorRelay<Element>...) -> Disposable {
-        self.bind(to: relays)
-    }
-
-    /**
-     Creates new subscription and sends elements to behavior relay(s).
-
-     In case error occurs in debug mode, `fatalError` will be raised.
-     In case error occurs in release mode, `error` will be logged.
-
-     - parameter to: Target behavior relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer.
-     */
-    public func bind(to relays: BehaviorRelay<Element?>...) -> Disposable {
-        self.map { $0 as Element? }.bind(to: relays)
-    }
-
-    /**
-     Creates new subscription and sends elements to behavior relay(s).
-     In case error occurs in debug mode, `fatalError` will be raised.
-     In case error occurs in release mode, `error` will be logged.
-     - parameter to: Target behavior relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer.
-     */
-    private func bind(to relays: [BehaviorRelay<Element>]) -> Disposable {
-        subscribe { e in
-            switch e {
-            case let .next(element):
-                relays.forEach {
-                    $0.accept(element)
-                }
-            case let .error(error):
-                rxFatalErrorInDebug("Binding error to behavior relay: \(error)")
-            case .completed:
-                break
-            }
-        }
-    }
-
-    /**
-     Creates new subscription and sends elements to replay relay(s).
-     In case error occurs in debug mode, `fatalError` will be raised.
-     In case error occurs in release mode, `error` will be logged.
-     - parameter to: Target replay relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer.
-     */
-    public func bind(to relays: ReplayRelay<Element>...) -> Disposable {
-        self.bind(to: relays)
-    }
-
-    /**
-     Creates new subscription and sends elements to replay relay(s).
-
-     In case error occurs in debug mode, `fatalError` will be raised.
-     In case error occurs in release mode, `error` will be logged.
-
-     - parameter to: Target replay relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer.
-     */
-    public func bind(to relays: ReplayRelay<Element?>...) -> Disposable {
-        self.map { $0 as Element? }.bind(to: relays)
-    }
-
-    /**
-     Creates new subscription and sends elements to replay relay(s).
-     In case error occurs in debug mode, `fatalError` will be raised.
-     In case error occurs in release mode, `error` will be logged.
-     - parameter to: Target replay relay for sequence elements.
-     - returns: Disposable object that can be used to unsubscribe the observer.
-     */
-    private func bind(to relays: [ReplayRelay<Element>]) -> Disposable {
-        subscribe { e in
-            switch e {
-            case let .next(element):
-                relays.forEach {
-                    $0.accept(element)
-                }
-            case let .error(error):
-                rxFatalErrorInDebug("Binding error to behavior relay: \(error)")
-            case .completed:
-                break
-            }
-        }
-    }
-}
diff --git a/Pods/RxRelay/RxRelay/PublishRelay.swift b/Pods/RxRelay/RxRelay/PublishRelay.swift
deleted file mode 100644
index a9c8ac428..000000000
--- a/Pods/RxRelay/RxRelay/PublishRelay.swift
+++ /dev/null
@@ -1,36 +0,0 @@
-//
-//  PublishRelay.swift
-//  RxRelay
-//
-//  Created by Krunoslav Zaher on 3/28/15.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-/// PublishRelay is a wrapper for `PublishSubject`.
-///
-/// Unlike `PublishSubject` it can't terminate with error or completed.
-public final class PublishRelay<Element>: ObservableType {
-    private let subject: PublishSubject<Element>
-    
-    // Accepts `event` and emits it to subscribers
-    public func accept(_ event: Element) {
-        self.subject.onNext(event)
-    }
-    
-    /// Initializes with internal empty subject.
-    public init() {
-        self.subject = PublishSubject()
-    }
-
-    /// Subscribes observer
-    public func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.subject.subscribe(observer)
-    }
-    
-    /// - returns: Canonical interface for push style sequence
-    public func asObservable() -> Observable<Element> {
-        self.subject.asObservable()
-    }
-}
diff --git a/Pods/RxRelay/RxRelay/ReplayRelay.swift b/Pods/RxRelay/RxRelay/ReplayRelay.swift
deleted file mode 100644
index 3cc87cd09..000000000
--- a/Pods/RxRelay/RxRelay/ReplayRelay.swift
+++ /dev/null
@@ -1,50 +0,0 @@
-//
-//  ReplayRelay.swift
-//  RxRelay
-//
-//  Created by Zsolt Kovacs on 12/22/19.
-//  Copyright © 2019 Krunoslav Zaher. All rights reserved.
-//
-
-import RxSwift
-
-/// ReplayRelay is a wrapper for `ReplaySubject`.
-///
-/// Unlike `ReplaySubject` it can't terminate with an error or complete.
-public final class ReplayRelay<Element>: ObservableType {
-    private let subject: ReplaySubject<Element>
-
-    // Accepts `event` and emits it to subscribers
-    public func accept(_ event: Element) {
-        self.subject.onNext(event)
-    }
-
-    private init(subject: ReplaySubject<Element>) {
-        self.subject = subject
-    }
-
-    /// Creates new instance of `ReplayRelay` that replays at most `bufferSize` last elements sent to it.
-    ///
-    /// - parameter bufferSize: Maximal number of elements to replay to observers after subscription.
-    /// - returns: New instance of replay relay.
-    public static func create(bufferSize: Int) -> ReplayRelay<Element> {
-        ReplayRelay(subject: ReplaySubject.create(bufferSize: bufferSize))
-    }
-
-    /// Creates a new instance of `ReplayRelay` that buffers all the sent to it.
-    /// To avoid filling up memory, developer needs to make sure that the use case will only ever store a 'reasonable'
-    /// number of elements.
-    public static func createUnbound() -> ReplayRelay<Element> {
-        ReplayRelay(subject: ReplaySubject.createUnbounded())
-    }
-
-    /// Subscribes observer
-    public func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.subject.subscribe(observer)
-    }
-
-    /// - returns: Canonical interface for push style sequence
-    public func asObservable() -> Observable<Element> {
-        self.subject.asObserver()
-    }
-}
diff --git a/Pods/RxRelay/RxRelay/Utils.swift b/Pods/RxRelay/RxRelay/Utils.swift
deleted file mode 100644
index 5954fb980..000000000
--- a/Pods/RxRelay/RxRelay/Utils.swift
+++ /dev/null
@@ -1,17 +0,0 @@
-//
-//  Utils.swift
-//  RxRelay
-//
-//  Created by Shai Mishali on 09/04/2019.
-//  Copyright © 2019 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-func rxFatalErrorInDebug(_ lastMessage: @autoclosure () -> String, file: StaticString = #file, line: UInt = #line) {
-    #if DEBUG
-    fatalError(lastMessage(), file: file, line: line)
-    #else
-    print("\(file):\(line): \(lastMessage())")
-    #endif
-}
diff --git a/Pods/RxSwift/LICENSE.md b/Pods/RxSwift/LICENSE.md
deleted file mode 100644
index e32511b38..000000000
--- a/Pods/RxSwift/LICENSE.md
+++ /dev/null
@@ -1,9 +0,0 @@
-**The MIT License**
-**Copyright © 2015 Krunoslav Zaher, Shai Mishali**
-**All rights reserved.**
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/Pods/RxSwift/Platform/AtomicInt.swift b/Pods/RxSwift/Platform/AtomicInt.swift
deleted file mode 100644
index 98479fd2c..000000000
--- a/Pods/RxSwift/Platform/AtomicInt.swift
+++ /dev/null
@@ -1,71 +0,0 @@
-//
-//  AtomicInt.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 10/28/18.
-//  Copyright © 2018 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-final class AtomicInt: NSLock {
-    fileprivate var value: Int32
-    public init(_ value: Int32 = 0) {
-        self.value = value
-    }
-}
-
-@discardableResult
-@inline(__always)
-func add(_ this: AtomicInt, _ value: Int32) -> Int32 {
-    this.lock()
-    let oldValue = this.value
-    this.value += value
-    this.unlock()
-    return oldValue
-}
-
-@discardableResult
-@inline(__always)
-func sub(_ this: AtomicInt, _ value: Int32) -> Int32 {
-    this.lock()
-    let oldValue = this.value
-    this.value -= value
-    this.unlock()
-    return oldValue
-}
-
-@discardableResult
-@inline(__always)
-func fetchOr(_ this: AtomicInt, _ mask: Int32) -> Int32 {
-    this.lock()
-    let oldValue = this.value
-    this.value |= mask
-    this.unlock()
-    return oldValue
-}
-
-@inline(__always)
-func load(_ this: AtomicInt) -> Int32 {
-    this.lock()
-    let oldValue = this.value
-    this.unlock()
-    return oldValue
-}
-
-@discardableResult
-@inline(__always)
-func increment(_ this: AtomicInt) -> Int32 {
-    add(this, 1)
-}
-
-@discardableResult
-@inline(__always)
-func decrement(_ this: AtomicInt) -> Int32 {
-    sub(this, 1)
-}
-
-@inline(__always)
-func isFlagSet(_ this: AtomicInt, _ mask: Int32) -> Bool {
-    (load(this) & mask) != 0
-}
diff --git a/Pods/RxSwift/Platform/DataStructures/Bag.swift b/Pods/RxSwift/Platform/DataStructures/Bag.swift
deleted file mode 100644
index 5720a3b44..000000000
--- a/Pods/RxSwift/Platform/DataStructures/Bag.swift
+++ /dev/null
@@ -1,181 +0,0 @@
-//
-//  Bag.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 2/28/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Swift
-
-let arrayDictionaryMaxSize = 30
-
-struct BagKey {
-    /**
-    Unique identifier for object added to `Bag`.
-     
-    It's underlying type is UInt64. If we assume there in an idealized CPU that works at 4GHz,
-     it would take ~150 years of continuous running time for it to overflow.
-    */
-    fileprivate let rawValue: UInt64
-}
-
-/**
-Data structure that represents a bag of elements typed `T`.
-
-Single element can be stored multiple times.
-
-Time and space complexity of insertion and deletion is O(n). 
-
-It is suitable for storing small number of elements.
-*/
-struct Bag<T> : CustomDebugStringConvertible {
-    /// Type of identifier for inserted elements.
-    typealias KeyType = BagKey
-    
-    typealias Entry = (key: BagKey, value: T)
- 
-    private var _nextKey: BagKey = BagKey(rawValue: 0)
-
-    // data
-
-    // first fill inline variables
-    var _key0: BagKey?
-    var _value0: T?
-
-    // then fill "array dictionary"
-    var _pairs = ContiguousArray<Entry>()
-
-    // last is sparse dictionary
-    var _dictionary: [BagKey: T]?
-
-    var _onlyFastPath = true
-
-    /// Creates new empty `Bag`.
-    init() {
-    }
-    
-    /**
-    Inserts `value` into bag.
-    
-    - parameter element: Element to insert.
-    - returns: Key that can be used to remove element from bag.
-    */
-    mutating func insert(_ element: T) -> BagKey {
-        let key = _nextKey
-
-        _nextKey = BagKey(rawValue: _nextKey.rawValue &+ 1)
-
-        if _key0 == nil {
-            _key0 = key
-            _value0 = element
-            return key
-        }
-
-        _onlyFastPath = false
-
-        if _dictionary != nil {
-            _dictionary![key] = element
-            return key
-        }
-
-        if _pairs.count < arrayDictionaryMaxSize {
-            _pairs.append((key: key, value: element))
-            return key
-        }
-        
-        _dictionary = [key: element]
-        
-        return key
-    }
-    
-    /// - returns: Number of elements in bag.
-    var count: Int {
-        let dictionaryCount: Int = _dictionary?.count ?? 0
-        return (_value0 != nil ? 1 : 0) + _pairs.count + dictionaryCount
-    }
-    
-    /// Removes all elements from bag and clears capacity.
-    mutating func removeAll() {
-        _key0 = nil
-        _value0 = nil
-
-        _pairs.removeAll(keepingCapacity: false)
-        _dictionary?.removeAll(keepingCapacity: false)
-    }
-    
-    /**
-    Removes element with a specific `key` from bag.
-    
-    - parameter key: Key that identifies element to remove from bag.
-    - returns: Element that bag contained, or nil in case element was already removed.
-    */
-    mutating func removeKey(_ key: BagKey) -> T? {
-        if _key0 == key {
-            _key0 = nil
-            let value = _value0!
-            _value0 = nil
-            return value
-        }
-
-        if let existingObject = _dictionary?.removeValue(forKey: key) {
-            return existingObject
-        }
-
-        for i in 0 ..< _pairs.count where _pairs[i].key == key {
-            let value = _pairs[i].value
-            _pairs.remove(at: i)
-            return value
-        }
-
-        return nil
-    }
-}
-
-extension Bag {
-    /// A textual representation of `self`, suitable for debugging.
-    var debugDescription : String {
-        "\(self.count) elements in Bag"
-    }
-}
-
-extension Bag {
-    /// Enumerates elements inside the bag.
-    ///
-    /// - parameter action: Enumeration closure.
-    func forEach(_ action: (T) -> Void) {
-        if _onlyFastPath {
-            if let value0 = _value0 {
-                action(value0)
-            }
-            return
-        }
-
-        let value0 = _value0
-        let dictionary = _dictionary
-
-        if let value0 = value0 {
-            action(value0)
-        }
-
-        for i in 0 ..< _pairs.count {
-            action(_pairs[i].value)
-        }
-
-        if dictionary?.count ?? 0 > 0 {
-            for element in dictionary!.values {
-                action(element)
-            }
-        }
-    }
-}
-
-extension BagKey: Hashable {
-    func hash(into hasher: inout Hasher) {
-        hasher.combine(rawValue)
-    }
-}
-
-func ==(lhs: BagKey, rhs: BagKey) -> Bool {
-    lhs.rawValue == rhs.rawValue
-}
diff --git a/Pods/RxSwift/Platform/DataStructures/InfiniteSequence.swift b/Pods/RxSwift/Platform/DataStructures/InfiniteSequence.swift
deleted file mode 100644
index 75d7bea7f..000000000
--- a/Pods/RxSwift/Platform/DataStructures/InfiniteSequence.swift
+++ /dev/null
@@ -1,23 +0,0 @@
-//
-//  InfiniteSequence.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 6/13/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Sequence that repeats `repeatedValue` infinite number of times.
-struct InfiniteSequence<Element> : Sequence {
-    typealias Iterator = AnyIterator<Element>
-    
-    private let repeatedValue: Element
-    
-    init(repeatedValue: Element) {
-        self.repeatedValue = repeatedValue
-    }
-    
-    func makeIterator() -> Iterator {
-        let repeatedValue = self.repeatedValue
-        return AnyIterator { repeatedValue }
-    }
-}
diff --git a/Pods/RxSwift/Platform/DataStructures/PriorityQueue.swift b/Pods/RxSwift/Platform/DataStructures/PriorityQueue.swift
deleted file mode 100644
index 9ed856b91..000000000
--- a/Pods/RxSwift/Platform/DataStructures/PriorityQueue.swift
+++ /dev/null
@@ -1,111 +0,0 @@
-//
-//  PriorityQueue.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 12/27/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-struct PriorityQueue<Element> {
-    private let hasHigherPriority: (Element, Element) -> Bool
-    private let isEqual: (Element, Element) -> Bool
-
-    private var elements = [Element]()
-
-    init(hasHigherPriority: @escaping (Element, Element) -> Bool, isEqual: @escaping (Element, Element) -> Bool) {
-        self.hasHigherPriority = hasHigherPriority
-        self.isEqual = isEqual
-    }
-
-    mutating func enqueue(_ element: Element) {
-        elements.append(element)
-        bubbleToHigherPriority(elements.count - 1)
-    }
-
-    func peek() -> Element? {
-        elements.first
-    }
-
-    var isEmpty: Bool {
-        elements.count == 0
-    }
-
-    mutating func dequeue() -> Element? {
-        guard let front = peek() else {
-            return nil
-        }
-
-        removeAt(0)
-
-        return front
-    }
-
-    mutating func remove(_ element: Element) {
-        for i in 0 ..< elements.count {
-            if self.isEqual(elements[i], element) {
-                removeAt(i)
-                return
-            }
-        }
-    }
-
-    private mutating func removeAt(_ index: Int) {
-        let removingLast = index == elements.count - 1
-        if !removingLast {
-            elements.swapAt(index, elements.count - 1)
-        }
-
-        _ = elements.popLast()
-
-        if !removingLast {
-            bubbleToHigherPriority(index)
-            bubbleToLowerPriority(index)
-        }
-    }
-
-    private mutating func bubbleToHigherPriority(_ initialUnbalancedIndex: Int) {
-        precondition(initialUnbalancedIndex >= 0)
-        precondition(initialUnbalancedIndex < elements.count)
-
-        var unbalancedIndex = initialUnbalancedIndex
-
-        while unbalancedIndex > 0 {
-            let parentIndex = (unbalancedIndex - 1) / 2
-            guard self.hasHigherPriority(elements[unbalancedIndex], elements[parentIndex]) else { break }
-            elements.swapAt(unbalancedIndex, parentIndex)
-            unbalancedIndex = parentIndex
-        }
-    }
-
-    private mutating func bubbleToLowerPriority(_ initialUnbalancedIndex: Int) {
-        precondition(initialUnbalancedIndex >= 0)
-        precondition(initialUnbalancedIndex < elements.count)
-
-        var unbalancedIndex = initialUnbalancedIndex
-        while true {
-            let leftChildIndex = unbalancedIndex * 2 + 1
-            let rightChildIndex = unbalancedIndex * 2 + 2
-
-            var highestPriorityIndex = unbalancedIndex
-
-            if leftChildIndex < elements.count && self.hasHigherPriority(elements[leftChildIndex], elements[highestPriorityIndex]) {
-                highestPriorityIndex = leftChildIndex
-            }
-
-            if rightChildIndex < elements.count && self.hasHigherPriority(elements[rightChildIndex], elements[highestPriorityIndex]) {
-                highestPriorityIndex = rightChildIndex
-            }
-
-            guard highestPriorityIndex != unbalancedIndex else { break }
-            elements.swapAt(highestPriorityIndex, unbalancedIndex)
-
-            unbalancedIndex = highestPriorityIndex
-        }
-    }
-}
-
-extension PriorityQueue : CustomDebugStringConvertible {
-    var debugDescription: String {
-        elements.debugDescription
-    }
-}
diff --git a/Pods/RxSwift/Platform/DataStructures/Queue.swift b/Pods/RxSwift/Platform/DataStructures/Queue.swift
deleted file mode 100644
index 625d4733e..000000000
--- a/Pods/RxSwift/Platform/DataStructures/Queue.swift
+++ /dev/null
@@ -1,148 +0,0 @@
-//
-//  Queue.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 3/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/**
-Data structure that represents queue.
-
-Complexity of `enqueue`, `dequeue` is O(1) when number of operations is
-averaged over N operations.
-
-Complexity of `peek` is O(1).
-*/
-struct Queue<T>: Sequence {
-    /// Type of generator.
-    typealias Generator = AnyIterator<T>
-
-    private let resizeFactor = 2
-    
-    private var storage: ContiguousArray<T?>
-    private var innerCount = 0
-    private var pushNextIndex = 0
-    private let initialCapacity: Int
-
-    /**
-    Creates new queue.
-    
-    - parameter capacity: Capacity of newly created queue.
-    */
-    init(capacity: Int) {
-        initialCapacity = capacity
-
-        storage = ContiguousArray<T?>(repeating: nil, count: capacity)
-    }
-    
-    private var dequeueIndex: Int {
-        let index = pushNextIndex - count
-        return index < 0 ? index + storage.count : index
-    }
-    
-    /// - returns: Is queue empty.
-    var isEmpty: Bool { count == 0 }
-    
-    /// - returns: Number of elements inside queue.
-    var count: Int { innerCount }
-    
-    /// - returns: Element in front of a list of elements to `dequeue`.
-    func peek() -> T {
-        precondition(count > 0)
-        
-        return storage[dequeueIndex]!
-    }
-    
-    mutating private func resizeTo(_ size: Int) {
-        var newStorage = ContiguousArray<T?>(repeating: nil, count: size)
-        
-        let count = self.count
-        
-        let dequeueIndex = self.dequeueIndex
-        let spaceToEndOfQueue = storage.count - dequeueIndex
-        
-        // first batch is from dequeue index to end of array
-        let countElementsInFirstBatch = Swift.min(count, spaceToEndOfQueue)
-        // second batch is wrapped from start of array to end of queue
-        let numberOfElementsInSecondBatch = count - countElementsInFirstBatch
-        
-        newStorage[0 ..< countElementsInFirstBatch] = storage[dequeueIndex ..< (dequeueIndex + countElementsInFirstBatch)]
-        newStorage[countElementsInFirstBatch ..< (countElementsInFirstBatch + numberOfElementsInSecondBatch)] = storage[0 ..< numberOfElementsInSecondBatch]
-        
-        self.innerCount = count
-        pushNextIndex = count
-        storage = newStorage
-    }
-    
-    /// Enqueues `element`.
-    ///
-    /// - parameter element: Element to enqueue.
-    mutating func enqueue(_ element: T) {
-        if count == storage.count {
-            resizeTo(Swift.max(storage.count, 1) * resizeFactor)
-        }
-        
-        storage[pushNextIndex] = element
-        pushNextIndex += 1
-        innerCount += 1
-        
-        if pushNextIndex >= storage.count {
-            pushNextIndex -= storage.count
-        }
-    }
-    
-    private mutating func dequeueElementOnly() -> T {
-        precondition(count > 0)
-        
-        let index = dequeueIndex
-
-        defer {
-            storage[index] = nil
-            innerCount -= 1
-        }
-
-        return storage[index]!
-    }
-
-    /// Dequeues element or throws an exception in case queue is empty.
-    ///
-    /// - returns: Dequeued element.
-    mutating func dequeue() -> T? {
-        if self.count == 0 {
-            return nil
-        }
-
-        defer {
-            let downsizeLimit = storage.count / (resizeFactor * resizeFactor)
-            if count < downsizeLimit && downsizeLimit >= initialCapacity {
-                resizeTo(storage.count / resizeFactor)
-            }
-        }
-
-        return dequeueElementOnly()
-    }
-    
-    /// - returns: Generator of contained elements.
-    func makeIterator() -> AnyIterator<T> {
-        var i = dequeueIndex
-        var innerCount = count
-
-        return AnyIterator {
-            if innerCount == 0 {
-                return nil
-            }
-
-            defer {
-                innerCount -= 1
-                i += 1
-            }
-
-            if i >= self.storage.count {
-                i -= self.storage.count
-            }
-
-            return self.storage[i]
-        }
-    }
-}
diff --git a/Pods/RxSwift/Platform/DispatchQueue+Extensions.swift b/Pods/RxSwift/Platform/DispatchQueue+Extensions.swift
deleted file mode 100644
index aaf24cae6..000000000
--- a/Pods/RxSwift/Platform/DispatchQueue+Extensions.swift
+++ /dev/null
@@ -1,21 +0,0 @@
-//
-//  DispatchQueue+Extensions.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 10/22/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-
-extension DispatchQueue {
-    private static var token: DispatchSpecificKey<()> = {
-        let key = DispatchSpecificKey<()>()
-        DispatchQueue.main.setSpecific(key: key, value: ())
-        return key
-    }()
-
-    static var isMain: Bool {
-        DispatchQueue.getSpecific(key: token) != nil
-    }
-}
diff --git a/Pods/RxSwift/Platform/Platform.Darwin.swift b/Pods/RxSwift/Platform/Platform.Darwin.swift
deleted file mode 100644
index eacc19431..000000000
--- a/Pods/RxSwift/Platform/Platform.Darwin.swift
+++ /dev/null
@@ -1,35 +0,0 @@
-//
-//  Platform.Darwin.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 12/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(macOS) || os(iOS) || os(tvOS) || os(watchOS)
-
-    import Darwin
-    import Foundation
-
-    extension Thread {
-        static func setThreadLocalStorageValue<T: AnyObject>(_ value: T?, forKey key: NSCopying) {
-            let currentThread = Thread.current
-            let threadDictionary = currentThread.threadDictionary
-
-            if let newValue = value {
-                threadDictionary[key] = newValue
-            }
-            else {
-                threadDictionary[key] = nil
-            }
-        }
-
-        static func getThreadLocalStorageValueForKey<T>(_ key: NSCopying) -> T? {
-            let currentThread = Thread.current
-            let threadDictionary = currentThread.threadDictionary
-            
-            return threadDictionary[key] as? T
-        }
-    }
-
-#endif
diff --git a/Pods/RxSwift/Platform/Platform.Linux.swift b/Pods/RxSwift/Platform/Platform.Linux.swift
deleted file mode 100644
index 52a3e3af8..000000000
--- a/Pods/RxSwift/Platform/Platform.Linux.swift
+++ /dev/null
@@ -1,32 +0,0 @@
-//
-//  Platform.Linux.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 12/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(Linux)
-
-    import Foundation
-
-    extension Thread {
-
-        static func setThreadLocalStorageValue<T: AnyObject>(_ value: T?, forKey key: String) {
-            if let newValue = value {
-                Thread.current.threadDictionary[key] = newValue
-            }
-            else {
-                Thread.current.threadDictionary[key] = nil
-            }
-        }
-
-        static func getThreadLocalStorageValueForKey<T: AnyObject>(_ key: String) -> T? {
-            let currentThread = Thread.current
-            let threadDictionary = currentThread.threadDictionary
-
-            return threadDictionary[key] as? T
-        }
-    }
-
-#endif
diff --git a/Pods/RxSwift/Platform/RecursiveLock.swift b/Pods/RxSwift/Platform/RecursiveLock.swift
deleted file mode 100644
index 10b9bbb0b..000000000
--- a/Pods/RxSwift/Platform/RecursiveLock.swift
+++ /dev/null
@@ -1,34 +0,0 @@
-//
-//  RecursiveLock.swift
-//  Platform
-//
-//  Created by Krunoslav Zaher on 12/18/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-#if TRACE_RESOURCES
-    class RecursiveLock: NSRecursiveLock {
-        override init() {
-            _ = Resources.incrementTotal()
-            super.init()
-        }
-
-        override func lock() {
-            super.lock()
-            _ = Resources.incrementTotal()
-        }
-
-        override func unlock() {
-            super.unlock()
-            _ = Resources.decrementTotal()
-        }
-
-        deinit {
-            _ = Resources.decrementTotal()
-        }
-    }
-#else
-    typealias RecursiveLock = NSRecursiveLock
-#endif
diff --git a/Pods/RxSwift/README.md b/Pods/RxSwift/README.md
deleted file mode 100644
index 20330166b..000000000
--- a/Pods/RxSwift/README.md
+++ /dev/null
@@ -1,254 +0,0 @@
-<p align="center">
-<img src="assets/RxSwift_Logo.png" width="35%" alt="RxSwift Logo" />
-<br />
-<a href="https://actions-badge.atrox.dev/ReactiveX/RxSwift/goto" target="_blank"><img src="https://github.com/ReactiveX/RxSwift/workflows/RxSwift/badge.svg?branch=main" alt="Build Status" /></a>
-<img src="https://img.shields.io/badge/platforms-iOS%20%7C%20macOS%20%7C%20tvOS%20%7C%20watchOS%20%7C%20Linux-333333.svg" alt="Supported Platforms: iOS, macOS, tvOS, watchOS & Linux" />
-<br />
-<a href="https://cocoapods.org/pods/RxSwift" alt="RxSwift on CocoaPods" title="RxSwift on CocoaPods"><img src="https://img.shields.io/cocoapods/v/RxSwift.svg" /></a>
-<a href="https://github.com/Carthage/Carthage" alt="RxSwift on Carthage" title="RxSwift on Carthage"><img src="https://img.shields.io/badge/Carthage-compatible-4BC51D.svg?style=flat" /></a>
-<a href="https://github.com/apple/swift-package-manager" alt="RxSwift on Swift Package Manager" title="RxSwift on Swift Package Manager"><img src="https://img.shields.io/badge/Swift%20Package%20Manager-compatible-brightgreen.svg" /></a>
-</p>
-
-Rx is a [generic abstraction of computation](https://youtu.be/looJcaeboBY) expressed through `Observable<Element>` interface, which lets you broadcast and subscribe to values and other events from an `Observable` stream.  
-
-RxSwift is the Swift-specific implementation of the [Reactive Extensions](http://reactivex.io) standard.
-
-<p align="center"><img src="assets/example.png" width="55%" alt="RxSwift Observable Example of a price constantly changing and updating the app's UI" /></p>
-
-While this version aims to stay true to the original spirit and naming conventions of Rx, this projects also aims to provide a true Swift-first API for Rx APIs.
-
-Cross platform documentation can be found on [ReactiveX.io](http://reactivex.io/).
-
-Like other Rx implementation, RxSwift's intention is to enable easy composition of asynchronous operations and streams of data in the form of `Observable` objects and a suite of methods to transform and compose these pieces of asynchronous work.
-
-KVO observation, async operations, UI Events and other streams of data are all unified under [abstraction of sequence](Documentation/GettingStarted.md#observables-aka-sequences). This is the reason why Rx is so simple, elegant and powerful.
-
-## I came here because I want to ...
-
-###### ... understand
-
-* [why use rx?](Documentation/Why.md)
-* [the basics, getting started with RxSwift](Documentation/GettingStarted.md)
-* [traits](Documentation/Traits.md) - what are `Single`, `Completable`, `Maybe`, `Driver`, and `ControlProperty` ... and why do they exist?
-* [testing](Documentation/UnitTests.md)
-* [tips and common errors](Documentation/Tips.md)
-* [debugging](Documentation/GettingStarted.md#debugging)
-* [the math behind Rx](Documentation/MathBehindRx.md)
-* [what are hot and cold observable sequences?](Documentation/HotAndColdObservables.md)
-
-###### ... install
-
-* Integrate RxSwift/RxCocoa with my app. [Installation Guide](#installation)
-
-###### ... hack around
-
-* with the example app. [Running Example App](Documentation/ExampleApp.md)
-* with operators in playgrounds. [Playgrounds](Documentation/Playgrounds.md)
-
-###### ... interact
-
-* All of this is great, but it would be nice to talk with other people using RxSwift and exchange experiences. <br />[Join Slack Channel](http://slack.rxswift.org)
-* Report a problem using the library. [Open an Issue With Bug Template](.github/ISSUE_TEMPLATE.md)
-* Request a new feature. [Open an Issue With Feature Request Template](Documentation/NewFeatureRequestTemplate.md)
-* Help out [Check out contribution guide](CONTRIBUTING.md)
-
-###### ... compare
-
-* [with Combine and ReactiveSwift](Documentation/ComparisonWithOtherLibraries.md).
-
-###### ... understand the structure
-
-RxSwift is as compositional as the asynchronous work it drives. The core unit is RxSwift itself, while other dependencies can be added for UI Work, testing, and more.
-
-It comprises five separate components depending on each other in the following way:
-
-```none
-┌──────────────┐    ┌──────────────┐
-│   RxCocoa    ├────▶   RxRelay    │
-└───────┬──────┘    └──────┬───────┘
-        │                  │        
-┌───────▼──────────────────▼───────┐
-│             RxSwift              │
-└───────▲──────────────────▲───────┘
-        │                  │        
-┌───────┴──────┐    ┌──────┴───────┐
-│    RxTest    │    │  RxBlocking  │
-└──────────────┘    └──────────────┘
-```
-
-* **RxSwift**: The core of RxSwift, providing the Rx standard as (mostly) defined by [ReactiveX](https://reactivex.io). It has no other dependencies.
-* **RxCocoa**: Provides Cocoa-specific capabilities for general iOS/macOS/watchOS & tvOS app development, such as Shared Sequences, Traits, and much more. It depends on both `RxSwift` and `RxRelay`.
-* **RxRelay**: Provides `PublishRelay`, `BehaviorRelay` and `ReplayRelay`, three [simple wrappers around Subjects](https://github.com/ReactiveX/RxSwift/blob/main/Documentation/Subjects.md#relays). It depends on `RxSwift`. 
-* **RxTest** and **RxBlocking**: Provides testing capabilities for Rx-based systems. It depends on `RxSwift`.
-
-## Usage
-
-<table>
-  <tr>
-    <th width="30%">Here's an example</th>
-    <th width="30%">In Action</th>
-  </tr>
-  <tr>
-    <td>Define search for GitHub repositories ...</td>
-    <th rowspan="9"><img src="https://raw.githubusercontent.com/kzaher/rxswiftcontent/master/GithubSearch.gif"></th>
-  </tr>
-  <tr>
-    <td><div class="highlight highlight-source-swift"><pre>
-let searchResults = searchBar.rx.text.orEmpty
-    .throttle(.milliseconds(300), scheduler: MainScheduler.instance)
-    .distinctUntilChanged()
-    .flatMapLatest { query -> Observable&lt;[Repository]&gt; in
-        if query.isEmpty {
-            return .just([])
-        }
-        return searchGitHub(query)
-            .catchAndReturn([])
-    }
-    .observe(on: MainScheduler.instance)</pre></div></td>
-  </tr>
-  <tr>
-    <td>... then bind the results to your tableview</td>
-  </tr>
-  <tr>
-    <td width="30%"><div class="highlight highlight-source-swift"><pre>
-searchResults
-    .bind(to: tableView.rx.items(cellIdentifier: "Cell")) {
-        (index, repository: Repository, cell) in
-        cell.textLabel?.text = repository.name
-        cell.detailTextLabel?.text = repository.url
-    }
-    .disposed(by: disposeBag)</pre></div></td>
-  </tr>
-</table>
-
-
-## Requirements
-
-* Xcode 12.x
-* Swift 5.x
-
-For Xcode 11 and below, [use RxSwift 5.x](https://github.com/ReactiveX/RxSwift/releases/tag/5.1.1).
-
-## Installation
-
-RxSwift doesn't contain any external dependencies.
-
-These are currently the supported installation options:
-
-### Manual
-
-Open Rx.xcworkspace, choose `RxExample` and hit run. This method will build everything and run the sample app
-
-### [CocoaPods](https://guides.cocoapods.org/using/using-cocoapods.html)
-
-```ruby
-# Podfile
-use_frameworks!
-
-target 'YOUR_TARGET_NAME' do
-    pod 'RxSwift', '6.2.0'
-    pod 'RxCocoa', '6.2.0'
-end
-
-# RxTest and RxBlocking make the most sense in the context of unit/integration tests
-target 'YOUR_TESTING_TARGET' do
-    pod 'RxBlocking', '6.2.0'
-    pod 'RxTest', '6.2.0'
-end
-```
-
-Replace `YOUR_TARGET_NAME` and then, in the `Podfile` directory, type:
-
-```bash
-$ pod install
-```
-
-### XCFrameworks
-
-Each release starting with RxSwift 6 includes `*.xcframework` framework binaries.
-
-Simply drag the needed framework binaries to your **Frameworks, Libraries, and Embedded Content** section under your target's **General** tab.
-
-> **Note**: If you're using `RxCocoa`, be sure to also drag **RxCocoaRuntime.xcframework** before importing `RxCocoa`.
-
-<img src="https://raw.githubusercontent.com/ReactiveX/RxSwift/main/assets/xcframeworks.png" alt="XCFrameworks instructions" width="65%">
-
-### [Carthage](https://github.com/Carthage/Carthage)
-
-Add this to `Cartfile`
-
-```
-github "ReactiveX/RxSwift" "6.2.0"
-```
-
-```bash
-$ carthage update
-```
-
-#### Carthage as a Static Library
-
-Carthage defaults to building RxSwift as a Dynamic Library. 
-
-If you wish to build RxSwift as a Static Library using Carthage you may use the script below to manually modify the framework type before building with Carthage:
-
-```bash
-carthage update RxSwift --platform iOS --no-build
-sed -i -e 's/MACH_O_TYPE = mh_dylib/MACH_O_TYPE = staticlib/g' Carthage/Checkouts/RxSwift/Rx.xcodeproj/project.pbxproj
-carthage build RxSwift --platform iOS
-```
-
-### [Swift Package Manager](https://github.com/apple/swift-package-manager)
-
-> **Note**: There is a critical cross-dependency bug affecting many projects including RxSwift in Swift Package Manager. We've [filed a bug (SR-12303)](https://bugs.swift.org/browse/SR-12303) in early 2020 but have no answer yet. Your mileage may vary. A partial workaround can be found [here](https://github.com/ReactiveX/RxSwift/issues/2127#issuecomment-717830502).
-
-Create a `Package.swift` file.
-
-```swift
-// swift-tools-version:5.0
-
-import PackageDescription
-
-let package = Package(
-  name: "RxTestProject",
-  dependencies: [
-    .package(url: "https://github.com/ReactiveX/RxSwift.git", .exact("6.2.0"))
-  ],
-  targets: [
-    .target(name: "RxTestProject", dependencies: ["RxSwift", "RxCocoa"])
-  ]
-)
-```
-
-```bash
-$ swift build
-```
-
-To build or test a module with RxTest dependency, set `TEST=1`.
-
-```bash
-$ TEST=1 swift test
-```
-
-### Manually using git submodules
-
-* Add RxSwift as a submodule
-
-```bash
-$ git submodule add git@github.com:ReactiveX/RxSwift.git
-```
-
-* Drag `Rx.xcodeproj` into Project Navigator
-* Go to `Project > Targets > Build Phases > Link Binary With Libraries`, click `+` and select `RxSwift`, `RxCocoa` and `RxRelay` targets
-
-## References
-
-* [http://reactivex.io/](http://reactivex.io/)
-* [Reactive Extensions GitHub (GitHub)](https://github.com/Reactive-Extensions)
-* [RxSwift RayWenderlich.com Book](https://store.raywenderlich.com/products/rxswift-reactive-programming-with-swift)
-* [RxSwift: Debunking the myth of hard (YouTube)](https://www.youtube.com/watch?v=GdvLP0ZAhhc)
-* [Boxue.io RxSwift Online Course](https://boxueio.com/series/rxswift-101) (Chinese 🇨🇳)
-* [Expert to Expert: Brian Beckman and Erik Meijer - Inside the .NET Reactive Framework (Rx) (video)](https://youtu.be/looJcaeboBY)
-* [Reactive Programming Overview (Jafar Husain from Netflix)](https://youtu.be/-8Y1-lE6NSA)
-* [Subject/Observer is Dual to Iterator (paper)](http://csl.stanford.edu/~christos/pldi2010.fit/meijer.duality.pdf)
-* [Rx standard sequence operators visualized (visualization tool)](http://rxmarbles.com/)
-* [Haskell](https://www.haskell.org/)
diff --git a/Pods/RxSwift/RxSwift/AnyObserver.swift b/Pods/RxSwift/RxSwift/AnyObserver.swift
deleted file mode 100644
index e92cc816e..000000000
--- a/Pods/RxSwift/RxSwift/AnyObserver.swift
+++ /dev/null
@@ -1,69 +0,0 @@
-//
-//  AnyObserver.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/28/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// A type-erased `ObserverType`.
-///
-/// Forwards operations to an arbitrary underlying observer with the same `Element` type, hiding the specifics of the underlying observer type.
-public struct AnyObserver<Element> : ObserverType {
-    /// Anonymous event handler type.
-    public typealias EventHandler = (Event<Element>) -> Void
-
-    private let observer: EventHandler
-
-    /// Construct an instance whose `on(event)` calls `eventHandler(event)`
-    ///
-    /// - parameter eventHandler: Event handler that observes sequences events.
-    public init(eventHandler: @escaping EventHandler) {
-        self.observer = eventHandler
-    }
-    
-    /// Construct an instance whose `on(event)` calls `observer.on(event)`
-    ///
-    /// - parameter observer: Observer that receives sequence events.
-    public init<Observer: ObserverType>(_ observer: Observer) where Observer.Element == Element {
-        self.observer = observer.on
-    }
-    
-    /// Send `event` to this observer.
-    ///
-    /// - parameter event: Event instance.
-    public func on(_ event: Event<Element>) {
-        self.observer(event)
-    }
-
-    /// Erases type of observer and returns canonical observer.
-    ///
-    /// - returns: type erased observer.
-    public func asObserver() -> AnyObserver<Element> {
-        self
-    }
-}
-
-extension AnyObserver {
-    /// Collection of `AnyObserver`s
-    typealias s = Bag<(Event<Element>) -> Void>
-}
-
-extension ObserverType {
-    /// Erases type of observer and returns canonical observer.
-    ///
-    /// - returns: type erased observer.
-    public func asObserver() -> AnyObserver<Element> {
-        AnyObserver(self)
-    }
-
-    /// Transforms observer of type R to type E using custom transform method.
-    /// Each event sent to result observer is transformed and sent to `self`.
-    ///
-    /// - returns: observer that transforms events.
-    public func mapObserver<Result>(_ transform: @escaping (Result) throws -> Element) -> AnyObserver<Result> {
-        AnyObserver { e in
-            self.on(e.map(transform))
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Binder.swift b/Pods/RxSwift/RxSwift/Binder.swift
deleted file mode 100644
index 1aae09592..000000000
--- a/Pods/RxSwift/RxSwift/Binder.swift
+++ /dev/null
@@ -1,59 +0,0 @@
-//
-//  Binder.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 9/17/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-/**
- Observer that enforces interface binding rules:
- * can't bind errors (in debug builds binding of errors causes `fatalError` in release builds errors are being logged)
- * ensures binding is performed on a specific scheduler
-
- `Binder` doesn't retain target and in case target is released, element isn't bound.
- 
- By default it binds elements on main scheduler.
- */
-public struct Binder<Value>: ObserverType {
-    public typealias Element = Value
-    
-    private let binding: (Event<Value>) -> Void
-
-    /// Initializes `Binder`
-    ///
-    /// - parameter target: Target object.
-    /// - parameter scheduler: Scheduler used to bind the events.
-    /// - parameter binding: Binding logic.
-    public init<Target: AnyObject>(_ target: Target, scheduler: ImmediateSchedulerType = MainScheduler(), binding: @escaping (Target, Value) -> Void) {
-        weak var weakTarget = target
-
-        self.binding = { event in
-            switch event {
-            case .next(let element):
-                _ = scheduler.schedule(element) { element in
-                    if let target = weakTarget {
-                        binding(target, element)
-                    }
-                    return Disposables.create()
-                }
-            case .error(let error):
-                rxFatalErrorInDebug("Binding error: \(error)")
-            case .completed:
-                break
-            }
-        }
-    }
-
-    /// Binds next element to owner view as described in `binding`.
-    public func on(_ event: Event<Value>) {
-        self.binding(event)
-    }
-
-    /// Erases type of observer.
-    ///
-    /// - returns: type erased observer.
-    public func asObserver() -> AnyObserver<Value> {
-        AnyObserver(eventHandler: self.on)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Cancelable.swift b/Pods/RxSwift/RxSwift/Cancelable.swift
deleted file mode 100644
index 1fa7a6772..000000000
--- a/Pods/RxSwift/RxSwift/Cancelable.swift
+++ /dev/null
@@ -1,13 +0,0 @@
-//
-//  Cancelable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents disposable resource with state tracking.
-public protocol Cancelable : Disposable {
-    /// Was resource disposed.
-    var isDisposed: Bool { get }
-}
diff --git a/Pods/RxSwift/RxSwift/Concurrency/AsyncLock.swift b/Pods/RxSwift/RxSwift/Concurrency/AsyncLock.swift
deleted file mode 100644
index 502597e93..000000000
--- a/Pods/RxSwift/RxSwift/Concurrency/AsyncLock.swift
+++ /dev/null
@@ -1,100 +0,0 @@
-//
-//  AsyncLock.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/**
-In case nobody holds this lock, the work will be queued and executed immediately
-on thread that is requesting lock.
-
-In case there is somebody currently holding that lock, action will be enqueued.
-When owned of the lock finishes with it's processing, it will also execute
-and pending work.
-
-That means that enqueued work could possibly be executed later on a different thread.
-*/
-final class AsyncLock<I: InvocableType>
-    : Disposable
-    , Lock
-    , SynchronizedDisposeType {
-    typealias Action = () -> Void
-    
-    private var _lock = SpinLock()
-    
-    private var queue: Queue<I> = Queue(capacity: 0)
-
-    private var isExecuting: Bool = false
-    private var hasFaulted: Bool = false
-
-    // lock {
-    func lock() {
-        self._lock.lock()
-    }
-
-    func unlock() {
-        self._lock.unlock()
-    }
-    // }
-
-    private func enqueue(_ action: I) -> I? {
-        self.lock(); defer { self.unlock() }
-        if self.hasFaulted {
-            return nil
-        }
-        
-        if self.isExecuting {
-            self.queue.enqueue(action)
-            return nil
-        }
-        
-        self.isExecuting = true
-        
-        return action
-    }
-
-    private func dequeue() -> I? {
-        self.lock(); defer { self.unlock() }
-        if !self.queue.isEmpty {
-            return self.queue.dequeue()
-        }
-        else {
-            self.isExecuting = false
-            return nil
-        }
-    }
-
-    func invoke(_ action: I) {
-        let firstEnqueuedAction = self.enqueue(action)
-        
-        if let firstEnqueuedAction = firstEnqueuedAction {
-            firstEnqueuedAction.invoke()
-        }
-        else {
-            // action is enqueued, it's somebody else's concern now
-            return
-        }
-        
-        while true {
-            let nextAction = self.dequeue()
-
-            if let nextAction = nextAction {
-                nextAction.invoke()
-            }
-            else {
-                return
-            }
-        }
-    }
-    
-    func dispose() {
-        self.synchronizedDispose()
-    }
-
-    func synchronized_dispose() {
-        self.queue = Queue(capacity: 0)
-        self.hasFaulted = true
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Concurrency/Lock.swift b/Pods/RxSwift/RxSwift/Concurrency/Lock.swift
deleted file mode 100644
index 7232f23f5..000000000
--- a/Pods/RxSwift/RxSwift/Concurrency/Lock.swift
+++ /dev/null
@@ -1,23 +0,0 @@
-//
-//  Lock.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/31/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-protocol Lock {
-    func lock()
-    func unlock()
-}
-
-// https://lists.swift.org/pipermail/swift-dev/Week-of-Mon-20151214/000321.html
-typealias SpinLock = RecursiveLock
-
-extension RecursiveLock : Lock {
-    @inline(__always)
-    final func performLocked<T>(_ action: () -> T) -> T {
-        self.lock(); defer { self.unlock() }
-        return action()
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Concurrency/LockOwnerType.swift b/Pods/RxSwift/RxSwift/Concurrency/LockOwnerType.swift
deleted file mode 100644
index 8a98007d1..000000000
--- a/Pods/RxSwift/RxSwift/Concurrency/LockOwnerType.swift
+++ /dev/null
@@ -1,16 +0,0 @@
-//
-//  LockOwnerType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 10/25/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-protocol LockOwnerType: AnyObject, Lock {
-    var lock: RecursiveLock { get }
-}
-
-extension LockOwnerType {
-    func lock() { self.lock.lock() }
-    func unlock() { self.lock.unlock() }
-}
diff --git a/Pods/RxSwift/RxSwift/Concurrency/SynchronizedDisposeType.swift b/Pods/RxSwift/RxSwift/Concurrency/SynchronizedDisposeType.swift
deleted file mode 100644
index 527a2fbe8..000000000
--- a/Pods/RxSwift/RxSwift/Concurrency/SynchronizedDisposeType.swift
+++ /dev/null
@@ -1,18 +0,0 @@
-//
-//  SynchronizedDisposeType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 10/25/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-protocol SynchronizedDisposeType: AnyObject, Disposable, Lock {
-    func synchronized_dispose()
-}
-
-extension SynchronizedDisposeType {
-    func synchronizedDispose() {
-        self.lock(); defer { self.unlock() }
-        self.synchronized_dispose()
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Concurrency/SynchronizedOnType.swift b/Pods/RxSwift/RxSwift/Concurrency/SynchronizedOnType.swift
deleted file mode 100644
index 19168d776..000000000
--- a/Pods/RxSwift/RxSwift/Concurrency/SynchronizedOnType.swift
+++ /dev/null
@@ -1,18 +0,0 @@
-//
-//  SynchronizedOnType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 10/25/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-protocol SynchronizedOnType: AnyObject, ObserverType, Lock {
-    func synchronized_on(_ event: Event<Element>)
-}
-
-extension SynchronizedOnType {
-    func synchronizedOn(_ event: Event<Element>) {
-        self.lock(); defer { self.unlock() }
-        self.synchronized_on(event)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Concurrency/SynchronizedUnsubscribeType.swift b/Pods/RxSwift/RxSwift/Concurrency/SynchronizedUnsubscribeType.swift
deleted file mode 100644
index 988b86f4d..000000000
--- a/Pods/RxSwift/RxSwift/Concurrency/SynchronizedUnsubscribeType.swift
+++ /dev/null
@@ -1,13 +0,0 @@
-//
-//  SynchronizedUnsubscribeType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 10/25/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-protocol SynchronizedUnsubscribeType: AnyObject {
-    associatedtype DisposeKey
-
-    func synchronizedUnsubscribe(_ disposeKey: DisposeKey)
-}
diff --git a/Pods/RxSwift/RxSwift/ConnectableObservableType.swift b/Pods/RxSwift/RxSwift/ConnectableObservableType.swift
deleted file mode 100644
index 52bf93c56..000000000
--- a/Pods/RxSwift/RxSwift/ConnectableObservableType.swift
+++ /dev/null
@@ -1,19 +0,0 @@
-//
-//  ConnectableObservableType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/1/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/**
-Represents an observable sequence wrapper that can be connected and disconnected from its underlying observable sequence.
-*/
-public protocol ConnectableObservableType : ObservableType {
-    /**
-    Connects the observable wrapper to its source. All subscribed observers will receive values from the underlying observable sequence as long as the connection is established.
-    
-    - returns: Disposable used to disconnect the observable wrapper from its source, causing subscribed observer to stop receiving values from the underlying observable sequence.
-    */
-    func connect() -> Disposable
-}
diff --git a/Pods/RxSwift/RxSwift/Date+Dispatch.swift b/Pods/RxSwift/RxSwift/Date+Dispatch.swift
deleted file mode 100644
index 90f70c560..000000000
--- a/Pods/RxSwift/RxSwift/Date+Dispatch.swift
+++ /dev/null
@@ -1,64 +0,0 @@
-//
-//  Date+Dispatch.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 4/14/19.
-//  Copyright © 2019 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-import Foundation
-
-extension DispatchTimeInterval {
-    var convertToSecondsFactor: Double {
-        switch self {
-        case .nanoseconds: return 1_000_000_000.0
-        case .microseconds: return 1_000_000.0
-        case .milliseconds: return 1_000.0
-        case .seconds: return 1.0
-        case .never: fatalError()
-        @unknown default: fatalError()
-        }
-    }
- 
-    func map(_ transform: (Int, Double) -> Int) -> DispatchTimeInterval {
-        switch self {
-        case .nanoseconds(let value): return .nanoseconds(transform(value, 1_000_000_000.0))
-        case .microseconds(let value): return .microseconds(transform(value, 1_000_000.0))
-        case .milliseconds(let value): return .milliseconds(transform(value, 1_000.0))
-        case .seconds(let value): return .seconds(transform(value, 1.0))
-        case .never: return .never
-        @unknown default: fatalError()
-        }
-    }
-    
-    var isNow: Bool {
-        switch self {
-        case .nanoseconds(let value), .microseconds(let value), .milliseconds(let value), .seconds(let value): return value == 0
-        case .never: return false
-        @unknown default: fatalError()
-        }
-    }
-    
-    internal func reduceWithSpanBetween(earlierDate: Date, laterDate: Date) -> DispatchTimeInterval {
-        return self.map { value, factor in
-            let interval = laterDate.timeIntervalSince(earlierDate)
-            let remainder = Double(value) - interval * factor
-            guard remainder > 0 else { return 0 }
-            return Int(remainder.rounded(.toNearestOrAwayFromZero))
-        }
-    }
-}
-
-extension Date {
-
-    internal func addingDispatchInterval(_ dispatchInterval: DispatchTimeInterval) -> Date {
-        switch dispatchInterval {
-        case .nanoseconds(let value), .microseconds(let value), .milliseconds(let value), .seconds(let value):
-            return self.addingTimeInterval(TimeInterval(value) / dispatchInterval.convertToSecondsFactor)
-        case .never: return Date.distantFuture
-        @unknown default: fatalError()
-        }
-    }
-    
-}
diff --git a/Pods/RxSwift/RxSwift/Disposable.swift b/Pods/RxSwift/RxSwift/Disposable.swift
deleted file mode 100644
index b79c77a75..000000000
--- a/Pods/RxSwift/RxSwift/Disposable.swift
+++ /dev/null
@@ -1,13 +0,0 @@
-//
-//  Disposable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents a disposable resource.
-public protocol Disposable {
-    /// Dispose resource.
-    func dispose()
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/AnonymousDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/AnonymousDisposable.swift
deleted file mode 100644
index 591aafa5e..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/AnonymousDisposable.swift
+++ /dev/null
@@ -1,59 +0,0 @@
-//
-//  AnonymousDisposable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents an Action-based disposable.
-///
-/// When dispose method is called, disposal action will be dereferenced.
-private final class AnonymousDisposable : DisposeBase, Cancelable {
-    public typealias DisposeAction = () -> Void
-
-    private let disposed = AtomicInt(0)
-    private var disposeAction: DisposeAction?
-
-    /// - returns: Was resource disposed.
-    public var isDisposed: Bool {
-        isFlagSet(self.disposed, 1)
-    }
-
-    /// Constructs a new disposable with the given action used for disposal.
-    ///
-    /// - parameter disposeAction: Disposal action which will be run upon calling `dispose`.
-    private init(_ disposeAction: @escaping DisposeAction) {
-        self.disposeAction = disposeAction
-        super.init()
-    }
-
-    // Non-deprecated version of the constructor, used by `Disposables.create(with:)`
-    fileprivate init(disposeAction: @escaping DisposeAction) {
-        self.disposeAction = disposeAction
-        super.init()
-    }
-
-    /// Calls the disposal action if and only if the current instance hasn't been disposed yet.
-    ///
-    /// After invoking disposal action, disposal action will be dereferenced.
-    fileprivate func dispose() {
-        if fetchOr(self.disposed, 1) == 0 {
-            if let action = self.disposeAction {
-                self.disposeAction = nil
-                action()
-            }
-        }
-    }
-}
-
-extension Disposables {
-
-    /// Constructs a new disposable with the given action used for disposal.
-    ///
-    /// - parameter dispose: Disposal action which will be run upon calling `dispose`.
-    public static func create(with dispose: @escaping () -> Void) -> Cancelable {
-        AnonymousDisposable(disposeAction: dispose)
-    }
-
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/BinaryDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/BinaryDisposable.swift
deleted file mode 100644
index a3d493708..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/BinaryDisposable.swift
+++ /dev/null
@@ -1,53 +0,0 @@
-//
-//  BinaryDisposable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents two disposable resources that are disposed together.
-private final class BinaryDisposable : DisposeBase, Cancelable {
-
-    private let disposed = AtomicInt(0)
-
-    // state
-    private var disposable1: Disposable?
-    private var disposable2: Disposable?
-
-    /// - returns: Was resource disposed.
-    var isDisposed: Bool {
-        isFlagSet(self.disposed, 1)
-    }
-
-    /// Constructs new binary disposable from two disposables.
-    ///
-    /// - parameter disposable1: First disposable
-    /// - parameter disposable2: Second disposable
-    init(_ disposable1: Disposable, _ disposable2: Disposable) {
-        self.disposable1 = disposable1
-        self.disposable2 = disposable2
-        super.init()
-    }
-
-    /// Calls the disposal action if and only if the current instance hasn't been disposed yet.
-    ///
-    /// After invoking disposal action, disposal action will be dereferenced.
-    func dispose() {
-        if fetchOr(self.disposed, 1) == 0 {
-            self.disposable1?.dispose()
-            self.disposable2?.dispose()
-            self.disposable1 = nil
-            self.disposable2 = nil
-        }
-    }
-}
-
-extension Disposables {
-
-    /// Creates a disposable with the given disposables.
-    public static func create(_ disposable1: Disposable, _ disposable2: Disposable) -> Cancelable {
-        BinaryDisposable(disposable1, disposable2)
-    }
-
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/BooleanDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/BooleanDisposable.swift
deleted file mode 100644
index c7d73e960..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/BooleanDisposable.swift
+++ /dev/null
@@ -1,33 +0,0 @@
-//
-//  BooleanDisposable.swift
-//  RxSwift
-//
-//  Created by Junior B. on 10/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents a disposable resource that can be checked for disposal status.
-public final class BooleanDisposable : Cancelable {
-
-    internal static let BooleanDisposableTrue = BooleanDisposable(isDisposed: true)
-    private var disposed = false
-    
-    /// Initializes a new instance of the `BooleanDisposable` class
-    public init() {
-    }
-    
-    /// Initializes a new instance of the `BooleanDisposable` class with given value
-    public init(isDisposed: Bool) {
-        self.disposed = isDisposed
-    }
-    
-    /// - returns: Was resource disposed.
-    public var isDisposed: Bool {
-        self.disposed
-    }
-    
-    /// Sets the status to disposed, which can be observer through the `isDisposed` property.
-    public func dispose() {
-        self.disposed = true
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/CompositeDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/CompositeDisposable.swift
deleted file mode 100644
index bb4efe6ac..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/CompositeDisposable.swift
+++ /dev/null
@@ -1,147 +0,0 @@
-//
-//  CompositeDisposable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/20/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents a group of disposable resources that are disposed together.
-public final class CompositeDisposable : DisposeBase, Cancelable {
-    /// Key used to remove disposable from composite disposable
-    public struct DisposeKey {
-        fileprivate let key: BagKey
-        fileprivate init(key: BagKey) {
-            self.key = key
-        }
-    }
-
-    private var lock = SpinLock()
-    
-    // state
-    private var disposables: Bag<Disposable>? = Bag()
-
-    public var isDisposed: Bool {
-        self.lock.performLocked { self.disposables == nil }
-    }
-    
-    public override init() {
-    }
-    
-    /// Initializes a new instance of composite disposable with the specified number of disposables.
-    public init(_ disposable1: Disposable, _ disposable2: Disposable) {
-        // This overload is here to make sure we are using optimized version up to 4 arguments.
-        _ = self.disposables!.insert(disposable1)
-        _ = self.disposables!.insert(disposable2)
-    }
-    
-    /// Initializes a new instance of composite disposable with the specified number of disposables.
-    public init(_ disposable1: Disposable, _ disposable2: Disposable, _ disposable3: Disposable) {
-        // This overload is here to make sure we are using optimized version up to 4 arguments.
-        _ = self.disposables!.insert(disposable1)
-        _ = self.disposables!.insert(disposable2)
-        _ = self.disposables!.insert(disposable3)
-    }
-    
-    /// Initializes a new instance of composite disposable with the specified number of disposables.
-    public init(_ disposable1: Disposable, _ disposable2: Disposable, _ disposable3: Disposable, _ disposable4: Disposable, _ disposables: Disposable...) {
-        // This overload is here to make sure we are using optimized version up to 4 arguments.
-        _ = self.disposables!.insert(disposable1)
-        _ = self.disposables!.insert(disposable2)
-        _ = self.disposables!.insert(disposable3)
-        _ = self.disposables!.insert(disposable4)
-        
-        for disposable in disposables {
-            _ = self.disposables!.insert(disposable)
-        }
-    }
-    
-    /// Initializes a new instance of composite disposable with the specified number of disposables.
-    public init(disposables: [Disposable]) {
-        for disposable in disposables {
-            _ = self.disposables!.insert(disposable)
-        }
-    }
-
-    /**
-     Adds a disposable to the CompositeDisposable or disposes the disposable if the CompositeDisposable is disposed.
-     
-     - parameter disposable: Disposable to add.
-     - returns: Key that can be used to remove disposable from composite disposable. In case dispose bag was already
-     disposed `nil` will be returned.
-     */
-    public func insert(_ disposable: Disposable) -> DisposeKey? {
-        let key = self._insert(disposable)
-        
-        if key == nil {
-            disposable.dispose()
-        }
-        
-        return key
-    }
-    
-    private func _insert(_ disposable: Disposable) -> DisposeKey? {
-        self.lock.performLocked {
-            let bagKey = self.disposables?.insert(disposable)
-            return bagKey.map(DisposeKey.init)
-        }
-    }
-    
-    /// - returns: Gets the number of disposables contained in the `CompositeDisposable`.
-    public var count: Int {
-        self.lock.performLocked { self.disposables?.count ?? 0 }
-    }
-    
-    /// Removes and disposes the disposable identified by `disposeKey` from the CompositeDisposable.
-    ///
-    /// - parameter disposeKey: Key used to identify disposable to be removed.
-    public func remove(for disposeKey: DisposeKey) {
-        self._remove(for: disposeKey)?.dispose()
-    }
-    
-    private func _remove(for disposeKey: DisposeKey) -> Disposable? {
-        self.lock.performLocked { self.disposables?.removeKey(disposeKey.key) }
-    }
-    
-    /// Disposes all disposables in the group and removes them from the group.
-    public func dispose() {
-        if let disposables = self._dispose() {
-            disposeAll(in: disposables)
-        }
-    }
-
-    private func _dispose() -> Bag<Disposable>? {
-        self.lock.performLocked {
-            let current = self.disposables
-            self.disposables = nil
-            return current
-        }
-    }
-}
-
-extension Disposables {
-
-    /// Creates a disposable with the given disposables.
-    public static func create(_ disposable1: Disposable, _ disposable2: Disposable, _ disposable3: Disposable) -> Cancelable {
-        CompositeDisposable(disposable1, disposable2, disposable3)
-    }
-    
-    /// Creates a disposable with the given disposables.
-    public static func create(_ disposable1: Disposable, _ disposable2: Disposable, _ disposable3: Disposable, _ disposables: Disposable ...) -> Cancelable {
-        var disposables = disposables
-        disposables.append(disposable1)
-        disposables.append(disposable2)
-        disposables.append(disposable3)
-        return CompositeDisposable(disposables: disposables)
-    }
-    
-    /// Creates a disposable with the given disposables.
-    public static func create(_ disposables: [Disposable]) -> Cancelable {
-        switch disposables.count {
-        case 2:
-            return Disposables.create(disposables[0], disposables[1])
-        default:
-            return CompositeDisposable(disposables: disposables)
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/Disposables.swift b/Pods/RxSwift/RxSwift/Disposables/Disposables.swift
deleted file mode 100644
index 8cd6e28c3..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/Disposables.swift
+++ /dev/null
@@ -1,13 +0,0 @@
-//
-//  Disposables.swift
-//  RxSwift
-//
-//  Created by Mohsen Ramezanpoor on 01/08/2016.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-/// A collection of utility methods for common disposable operations.
-public struct Disposables {
-    private init() {}
-}
-
diff --git a/Pods/RxSwift/RxSwift/Disposables/DisposeBag.swift b/Pods/RxSwift/RxSwift/Disposables/DisposeBag.swift
deleted file mode 100644
index 1a673bcce..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/DisposeBag.swift
+++ /dev/null
@@ -1,144 +0,0 @@
-//
-//  DisposeBag.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/25/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension Disposable {
-    /// Adds `self` to `bag`
-    ///
-    /// - parameter bag: `DisposeBag` to add `self` to.
-    public func disposed(by bag: DisposeBag) {
-        bag.insert(self)
-    }
-}
-
-/**
-Thread safe bag that disposes added disposables on `deinit`.
-
-This returns ARC (RAII) like resource management to `RxSwift`.
-
-In case contained disposables need to be disposed, just put a different dispose bag
-or create a new one in its place.
-
-    self.existingDisposeBag = DisposeBag()
-
-In case explicit disposal is necessary, there is also `CompositeDisposable`.
-*/
-public final class DisposeBag: DisposeBase {
-    
-    private var lock = SpinLock()
-    
-    // state
-    private var disposables = [Disposable]()
-    private var isDisposed = false
-    
-    /// Constructs new empty dispose bag.
-    public override init() {
-        super.init()
-    }
-
-    /// Adds `disposable` to be disposed when dispose bag is being deinited.
-    ///
-    /// - parameter disposable: Disposable to add.
-    public func insert(_ disposable: Disposable) {
-        self._insert(disposable)?.dispose()
-    }
-    
-    private func _insert(_ disposable: Disposable) -> Disposable? {
-        self.lock.performLocked {
-            if self.isDisposed {
-                return disposable
-            }
-
-            self.disposables.append(disposable)
-
-            return nil
-        }
-    }
-
-    /// This is internal on purpose, take a look at `CompositeDisposable` instead.
-    private func dispose() {
-        let oldDisposables = self._dispose()
-
-        for disposable in oldDisposables {
-            disposable.dispose()
-        }
-    }
-
-    private func _dispose() -> [Disposable] {
-        self.lock.performLocked {
-            let disposables = self.disposables
-            
-            self.disposables.removeAll(keepingCapacity: false)
-            self.isDisposed = true
-            
-            return disposables
-        }
-    }
-    
-    deinit {
-        self.dispose()
-    }
-}
-
-extension DisposeBag {
-    /// Convenience init allows a list of disposables to be gathered for disposal.
-    public convenience init(disposing disposables: Disposable...) {
-        self.init()
-        self.disposables += disposables
-    }
-
-    /// Convenience init which utilizes a function builder to let you pass in a list of
-    /// disposables to make a DisposeBag of.
-    public convenience init(@DisposableBuilder builder: () -> [Disposable]) {
-      self.init(disposing: builder())
-    }
-
-    /// Convenience init allows an array of disposables to be gathered for disposal.
-    public convenience init(disposing disposables: [Disposable]) {
-        self.init()
-        self.disposables += disposables
-    }
-
-    /// Convenience function allows a list of disposables to be gathered for disposal.
-    public func insert(_ disposables: Disposable...) {
-        self.insert(disposables)
-    }
-
-    /// Convenience function allows a list of disposables to be gathered for disposal.
-    public func insert(@DisposableBuilder builder: () -> [Disposable]) {
-        self.insert(builder())
-    }
-
-    /// Convenience function allows an array of disposables to be gathered for disposal.
-    public func insert(_ disposables: [Disposable]) {
-        self.lock.performLocked {
-            if self.isDisposed {
-                disposables.forEach { $0.dispose() }
-            } else {
-                self.disposables += disposables
-            }
-        }
-    }
-
-    /// A function builder accepting a list of Disposables and returning them as an array.
-    #if swift(>=5.4)
-    @resultBuilder
-    public struct DisposableBuilder {
-      public static func buildBlock(_ disposables: Disposable...) -> [Disposable] {
-        return disposables
-      }
-    }
-    #else
-    @_functionBuilder
-    public struct DisposableBuilder {
-      public static func buildBlock(_ disposables: Disposable...) -> [Disposable] {
-        return disposables
-      }
-    }
-    #endif
-    
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/DisposeBase.swift b/Pods/RxSwift/RxSwift/Disposables/DisposeBase.swift
deleted file mode 100644
index 0d4b2fb7f..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/DisposeBase.swift
+++ /dev/null
@@ -1,22 +0,0 @@
-//
-//  DisposeBase.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 4/4/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Base class for all disposables.
-public class DisposeBase {
-    init() {
-#if TRACE_RESOURCES
-    _ = Resources.incrementTotal()
-#endif
-    }
-    
-    deinit {
-#if TRACE_RESOURCES
-    _ = Resources.decrementTotal()
-#endif
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/NopDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/NopDisposable.swift
deleted file mode 100644
index dd436ba9c..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/NopDisposable.swift
+++ /dev/null
@@ -1,30 +0,0 @@
-//
-//  NopDisposable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents a disposable that does nothing on disposal.
-///
-/// Nop = No Operation
-private struct NopDisposable : Disposable {
- 
-    fileprivate static let noOp: Disposable = NopDisposable()
-    
-    private init() {
-        
-    }
-    
-    /// Does nothing.
-    public func dispose() {
-    }
-}
-
-extension Disposables {
-    /**
-     Creates a disposable that does nothing on disposal.
-     */
-    static public func create() -> Disposable { NopDisposable.noOp }
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/RefCountDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/RefCountDisposable.swift
deleted file mode 100644
index a59f7789d..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/RefCountDisposable.swift
+++ /dev/null
@@ -1,112 +0,0 @@
-//
-//  RefCountDisposable.swift
-//  RxSwift
-//
-//  Created by Junior B. on 10/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents a disposable resource that only disposes its underlying disposable resource when all dependent disposable objects have been disposed.
-public final class RefCountDisposable : DisposeBase, Cancelable {
-    private var lock = SpinLock()
-    private var disposable = nil as Disposable?
-    private var primaryDisposed = false
-    private var count = 0
-
-    /// - returns: Was resource disposed.
-    public var isDisposed: Bool {
-        self.lock.performLocked { self.disposable == nil }
-    }
-
-    /// Initializes a new instance of the `RefCountDisposable`.
-    public init(disposable: Disposable) {
-        self.disposable = disposable
-        super.init()
-    }
-
-    /**
-     Holds a dependent disposable that when disposed decreases the refcount on the underlying disposable.
-
-     When getter is called, a dependent disposable contributing to the reference count that manages the underlying disposable's lifetime is returned.
-     */
-    public func retain() -> Disposable {
-        self.lock.performLocked {
-            if self.disposable != nil {
-                do {
-                    _ = try incrementChecked(&self.count)
-                } catch {
-                    rxFatalError("RefCountDisposable increment failed")
-                }
-
-                return RefCountInnerDisposable(self)
-            } else {
-                return Disposables.create()
-            }
-        }
-    }
-
-    /// Disposes the underlying disposable only when all dependent disposables have been disposed.
-    public func dispose() {
-        let oldDisposable: Disposable? = self.lock.performLocked {
-            if let oldDisposable = self.disposable, !self.primaryDisposed {
-                self.primaryDisposed = true
-
-                if self.count == 0 {
-                    self.disposable = nil
-                    return oldDisposable
-                }
-            }
-
-            return nil
-        }
-
-        if let disposable = oldDisposable {
-            disposable.dispose()
-        }
-    }
-
-    fileprivate func release() {
-        let oldDisposable: Disposable? = self.lock.performLocked {
-            if let oldDisposable = self.disposable {
-                do {
-                    _ = try decrementChecked(&self.count)
-                } catch {
-                    rxFatalError("RefCountDisposable decrement on release failed")
-                }
-
-                guard self.count >= 0 else {
-                    rxFatalError("RefCountDisposable counter is lower than 0")
-                }
-
-                if self.primaryDisposed && self.count == 0 {
-                    self.disposable = nil
-                    return oldDisposable
-                }
-            }
-
-            return nil
-        }
-
-        if let disposable = oldDisposable {
-            disposable.dispose()
-        }
-    }
-}
-
-internal final class RefCountInnerDisposable: DisposeBase, Disposable
-{
-    private let parent: RefCountDisposable
-    private let isDisposed = AtomicInt(0)
-
-    init(_ parent: RefCountDisposable) {
-        self.parent = parent
-        super.init()
-    }
-
-    internal func dispose()
-    {
-        if fetchOr(self.isDisposed, 1) == 0 {
-            self.parent.release()
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/ScheduledDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/ScheduledDisposable.swift
deleted file mode 100644
index 2cf997bca..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/ScheduledDisposable.swift
+++ /dev/null
@@ -1,50 +0,0 @@
-//
-//  ScheduledDisposable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/13/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-private let disposeScheduledDisposable: (ScheduledDisposable) -> Disposable = { sd in
-    sd.disposeInner()
-    return Disposables.create()
-}
-
-/// Represents a disposable resource whose disposal invocation will be scheduled on the specified scheduler.
-public final class ScheduledDisposable : Cancelable {
-    public let scheduler: ImmediateSchedulerType
-
-    private let disposed = AtomicInt(0)
-
-    // state
-    private var disposable: Disposable?
-
-    /// - returns: Was resource disposed.
-    public var isDisposed: Bool {
-        isFlagSet(self.disposed, 1)
-    }
-
-    /**
-    Initializes a new instance of the `ScheduledDisposable` that uses a `scheduler` on which to dispose the `disposable`.
-
-    - parameter scheduler: Scheduler where the disposable resource will be disposed on.
-    - parameter disposable: Disposable resource to dispose on the given scheduler.
-    */
-    public init(scheduler: ImmediateSchedulerType, disposable: Disposable) {
-        self.scheduler = scheduler
-        self.disposable = disposable
-    }
-
-    /// Disposes the wrapped disposable on the provided scheduler.
-    public func dispose() {
-        _ = self.scheduler.schedule(self, action: disposeScheduledDisposable)
-    }
-
-    func disposeInner() {
-        if fetchOr(self.disposed, 1) == 0 {
-            self.disposable!.dispose()
-            self.disposable = nil
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/SerialDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/SerialDisposable.swift
deleted file mode 100644
index ef4690d32..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/SerialDisposable.swift
+++ /dev/null
@@ -1,73 +0,0 @@
-//
-//  SerialDisposable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents a disposable resource whose underlying disposable resource can be replaced by another disposable resource, causing automatic disposal of the previous underlying disposable resource.
-public final class SerialDisposable : DisposeBase, Cancelable {
-    private var lock = SpinLock()
-    
-    // state
-    private var current = nil as Disposable?
-    private var disposed = false
-    
-    /// - returns: Was resource disposed.
-    public var isDisposed: Bool {
-        self.disposed
-    }
-    
-    /// Initializes a new instance of the `SerialDisposable`.
-    override public init() {
-        super.init()
-    }
-    
-    /**
-    Gets or sets the underlying disposable.
-    
-    Assigning this property disposes the previous disposable object.
-    
-    If the `SerialDisposable` has already been disposed, assignment to this property causes immediate disposal of the given disposable object.
-    */
-    public var disposable: Disposable {
-        get {
-            self.lock.performLocked {
-                self.current ?? Disposables.create()
-            }
-        }
-        set (newDisposable) {
-            let disposable: Disposable? = self.lock.performLocked {
-                if self.isDisposed {
-                    return newDisposable
-                }
-                else {
-                    let toDispose = self.current
-                    self.current = newDisposable
-                    return toDispose
-                }
-            }
-            
-            if let disposable = disposable {
-                disposable.dispose()
-            }
-        }
-    }
-    
-    /// Disposes the underlying disposable as well as all future replacements.
-    public func dispose() {
-        self._dispose()?.dispose()
-    }
-
-    private func _dispose() -> Disposable? {
-        self.lock.performLocked {
-            guard !self.isDisposed else { return nil }
-
-            self.disposed = true
-            let current = self.current
-            self.current = nil
-            return current
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/SingleAssignmentDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/SingleAssignmentDisposable.swift
deleted file mode 100644
index d7307d680..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/SingleAssignmentDisposable.swift
+++ /dev/null
@@ -1,70 +0,0 @@
-//
-//  SingleAssignmentDisposable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/**
-Represents a disposable resource which only allows a single assignment of its underlying disposable resource.
-
-If an underlying disposable resource has already been set, future attempts to set the underlying disposable resource will throw an exception.
-*/
-public final class SingleAssignmentDisposable : DisposeBase, Cancelable {
-
-    private enum DisposeState: Int32 {
-        case disposed = 1
-        case disposableSet = 2
-    }
-
-    // state
-    private let state = AtomicInt(0)
-    private var disposable = nil as Disposable?
-
-    /// - returns: A value that indicates whether the object is disposed.
-    public var isDisposed: Bool {
-        isFlagSet(self.state, DisposeState.disposed.rawValue)
-    }
-
-    /// Initializes a new instance of the `SingleAssignmentDisposable`.
-    public override init() {
-        super.init()
-    }
-
-    /// Gets or sets the underlying disposable. After disposal, the result of getting this property is undefined.
-    ///
-    /// **Throws exception if the `SingleAssignmentDisposable` has already been assigned to.**
-    public func setDisposable(_ disposable: Disposable) {
-        self.disposable = disposable
-
-        let previousState = fetchOr(self.state, DisposeState.disposableSet.rawValue)
-
-        if (previousState & DisposeState.disposableSet.rawValue) != 0 {
-            rxFatalError("oldState.disposable != nil")
-        }
-
-        if (previousState & DisposeState.disposed.rawValue) != 0 {
-            disposable.dispose()
-            self.disposable = nil
-        }
-    }
-
-    /// Disposes the underlying disposable.
-    public func dispose() {
-        let previousState = fetchOr(self.state, DisposeState.disposed.rawValue)
-
-        if (previousState & DisposeState.disposed.rawValue) != 0 {
-            return
-        }
-
-        if (previousState & DisposeState.disposableSet.rawValue) != 0 {
-            guard let disposable = self.disposable else {
-                rxFatalError("Disposable not set")
-            }
-            disposable.dispose()
-            self.disposable = nil
-        }
-    }
-
-}
diff --git a/Pods/RxSwift/RxSwift/Disposables/SubscriptionDisposable.swift b/Pods/RxSwift/RxSwift/Disposables/SubscriptionDisposable.swift
deleted file mode 100644
index a406c84cb..000000000
--- a/Pods/RxSwift/RxSwift/Disposables/SubscriptionDisposable.swift
+++ /dev/null
@@ -1,21 +0,0 @@
-//
-//  SubscriptionDisposable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 10/25/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-struct SubscriptionDisposable<T: SynchronizedUnsubscribeType> : Disposable {
-    private let key: T.DisposeKey
-    private weak var owner: T?
-
-    init(owner: T, key: T.DisposeKey) {
-        self.owner = owner
-        self.key = key
-    }
-
-    func dispose() {
-        self.owner?.synchronizedUnsubscribe(self.key)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Errors.swift b/Pods/RxSwift/RxSwift/Errors.swift
deleted file mode 100644
index d2d2917e7..000000000
--- a/Pods/RxSwift/RxSwift/Errors.swift
+++ /dev/null
@@ -1,52 +0,0 @@
-//
-//  Errors.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/28/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-let RxErrorDomain       = "RxErrorDomain"
-let RxCompositeFailures = "RxCompositeFailures"
-
-/// Generic Rx error codes.
-public enum RxError
-    : Swift.Error
-    , CustomDebugStringConvertible {
-    /// Unknown error occurred.
-    case unknown
-    /// Performing an action on disposed object.
-    case disposed(object: AnyObject)
-    /// Arithmetic overflow error.
-    case overflow
-    /// Argument out of range error.
-    case argumentOutOfRange
-    /// Sequence doesn't contain any elements.
-    case noElements
-    /// Sequence contains more than one element.
-    case moreThanOneElement
-    /// Timeout error.
-    case timeout
-}
-
-extension RxError {
-    /// A textual representation of `self`, suitable for debugging.
-    public var debugDescription: String {
-        switch self {
-        case .unknown:
-            return "Unknown error occurred."
-        case .disposed(let object):
-            return "Object `\(object)` was already disposed."
-        case .overflow:
-            return "Arithmetic overflow occurred."
-        case .argumentOutOfRange:
-            return "Argument out of range."
-        case .noElements:
-            return "Sequence doesn't contain any elements."
-        case .moreThanOneElement:
-            return "Sequence contains more than one element."
-        case .timeout:
-            return "Sequence timeout."
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Event.swift b/Pods/RxSwift/RxSwift/Event.swift
deleted file mode 100644
index 01861a858..000000000
--- a/Pods/RxSwift/RxSwift/Event.swift
+++ /dev/null
@@ -1,104 +0,0 @@
-//
-//  Event.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents a sequence event.
-///
-/// Sequence grammar: 
-/// **next\* (error | completed)**
-@frozen public enum Event<Element> {
-    /// Next element is produced.
-    case next(Element)
-
-    /// Sequence terminated with an error.
-    case error(Swift.Error)
-
-    /// Sequence completed successfully.
-    case completed
-}
-
-extension Event: CustomDebugStringConvertible {
-    /// Description of event.
-    public var debugDescription: String {
-        switch self {
-        case .next(let value):
-            return "next(\(value))"
-        case .error(let error):
-            return "error(\(error))"
-        case .completed:
-            return "completed"
-        }
-    }
-}
-
-extension Event {
-    /// Is `completed` or `error` event.
-    public var isStopEvent: Bool {
-        switch self {
-        case .next: return false
-        case .error, .completed: return true
-        }
-    }
-
-    /// If `next` event, returns element value.
-    public var element: Element? {
-        if case .next(let value) = self {
-            return value
-        }
-        return nil
-    }
-
-    /// If `error` event, returns error.
-    public var error: Swift.Error? {
-        if case .error(let error) = self {
-            return error
-        }
-        return nil
-    }
-
-    /// If `completed` event, returns `true`.
-    public var isCompleted: Bool {
-        if case .completed = self {
-            return true
-        }
-        return false
-    }
-}
-
-extension Event {
-    /// Maps sequence elements using transform. If error happens during the transform, `.error`
-    /// will be returned as value.
-    public func map<Result>(_ transform: (Element) throws -> Result) -> Event<Result> {
-        do {
-            switch self {
-            case let .next(element):
-                return .next(try transform(element))
-            case let .error(error):
-                return .error(error)
-            case .completed:
-                return .completed
-            }
-        }
-        catch let e {
-            return .error(e)
-        }
-    }
-}
-
-/// A type that can be converted to `Event<Element>`.
-public protocol EventConvertible {
-    /// Type of element in event
-    associatedtype Element
-
-    /// Event representation of this instance
-    var event: Event<Element> { get }
-}
-
-extension Event: EventConvertible {
-    /// Event representation of this instance
-    public var event: Event<Element> { self }
-}
diff --git a/Pods/RxSwift/RxSwift/Extensions/Bag+Rx.swift b/Pods/RxSwift/RxSwift/Extensions/Bag+Rx.swift
deleted file mode 100644
index 97946837a..000000000
--- a/Pods/RxSwift/RxSwift/Extensions/Bag+Rx.swift
+++ /dev/null
@@ -1,50 +0,0 @@
-//
-//  Bag+Rx.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 10/19/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-
-// MARK: forEach
-
-@inline(__always)
-func dispatch<Element>(_ bag: Bag<(Event<Element>) -> Void>, _ event: Event<Element>) {
-    bag._value0?(event)
-
-    if bag._onlyFastPath {
-        return
-    }
-
-    let pairs = bag._pairs
-    for i in 0 ..< pairs.count {
-        pairs[i].value(event)
-    }
-
-    if let dictionary = bag._dictionary {
-        for element in dictionary.values {
-            element(event)
-        }
-    }
-}
-
-/// Dispatches `dispose` to all disposables contained inside bag.
-func disposeAll(in bag: Bag<Disposable>) {
-    bag._value0?.dispose()
-
-    if bag._onlyFastPath {
-        return
-    }
-
-    let pairs = bag._pairs
-    for i in 0 ..< pairs.count {
-        pairs[i].value.dispose()
-    }
-
-    if let dictionary = bag._dictionary {
-        for element in dictionary.values {
-            element.dispose()
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/GroupedObservable.swift b/Pods/RxSwift/RxSwift/GroupedObservable.swift
deleted file mode 100644
index 189a8c46a..000000000
--- a/Pods/RxSwift/RxSwift/GroupedObservable.swift
+++ /dev/null
@@ -1,35 +0,0 @@
-//
-//  GroupedObservable.swift
-//  RxSwift
-//
-//  Created by Tomi Koskinen on 01/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents an observable sequence of elements that have a common key.
-public struct GroupedObservable<Key, Element> : ObservableType {
-    /// Gets the common key.
-    public let key: Key
-
-    private let source: Observable<Element>
-
-    /// Initializes grouped observable sequence with key and source observable sequence.
-    ///
-    /// - parameter key: Grouped observable sequence key
-    /// - parameter source: Observable sequence that represents sequence of elements for the key
-    /// - returns: Grouped observable sequence of elements for the specific key
-    public init(key: Key, source: Observable<Element>) {
-        self.key = key
-        self.source = source
-    }
-
-    /// Subscribes `observer` to receive events for this sequence.
-    public func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.source.subscribe(observer)
-    }
-
-    /// Converts `self` to `Observable` sequence. 
-    public func asObservable() -> Observable<Element> {
-        self.source
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/ImmediateSchedulerType.swift b/Pods/RxSwift/RxSwift/ImmediateSchedulerType.swift
deleted file mode 100644
index 954fbf04b..000000000
--- a/Pods/RxSwift/RxSwift/ImmediateSchedulerType.swift
+++ /dev/null
@@ -1,36 +0,0 @@
-//
-//  ImmediateSchedulerType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 5/31/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents an object that immediately schedules units of work.
-public protocol ImmediateSchedulerType {
-    /**
-    Schedules an action to be executed immediately.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    func schedule<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable
-}
-
-extension ImmediateSchedulerType {
-    /**
-    Schedules an action to be executed recursively.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter action: Action to execute recursively. The last parameter passed to the action is used to trigger recursive scheduling of the action, passing in recursive invocation state.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public func scheduleRecursive<State>(_ state: State, action: @escaping (_ state: State, _ recurse: (State) -> Void) -> Void) -> Disposable {
-        let recursiveScheduler = RecursiveImmediateScheduler(action: action, scheduler: self)
-        
-        recursiveScheduler.schedule(state)
-        
-        return Disposables.create(with: recursiveScheduler.dispose)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observable.swift b/Pods/RxSwift/RxSwift/Observable.swift
deleted file mode 100644
index 93a3ed78f..000000000
--- a/Pods/RxSwift/RxSwift/Observable.swift
+++ /dev/null
@@ -1,31 +0,0 @@
-//
-//  Observable.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// A type-erased `ObservableType`. 
-///
-/// It represents a push style sequence.
-public class Observable<Element> : ObservableType {
-    init() {
-#if TRACE_RESOURCES
-        _ = Resources.incrementTotal()
-#endif
-    }
-    
-    public func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        rxAbstractMethod()
-    }
-    
-    public func asObservable() -> Observable<Element> { self }
-    
-    deinit {
-#if TRACE_RESOURCES
-        _ = Resources.decrementTotal()
-#endif
-    }
-}
-
diff --git a/Pods/RxSwift/RxSwift/ObservableConvertibleType.swift b/Pods/RxSwift/RxSwift/ObservableConvertibleType.swift
deleted file mode 100644
index 0f56a8165..000000000
--- a/Pods/RxSwift/RxSwift/ObservableConvertibleType.swift
+++ /dev/null
@@ -1,18 +0,0 @@
-//
-//  ObservableConvertibleType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 9/17/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Type that can be converted to observable sequence (`Observable<Element>`).
-public protocol ObservableConvertibleType {
-    /// Type of elements in sequence.
-    associatedtype Element
-
-    /// Converts `self` to `Observable` sequence.
-    ///
-    /// - returns: Observable sequence that represents `self`.
-    func asObservable() -> Observable<Element>
-}
diff --git a/Pods/RxSwift/RxSwift/ObservableType+Extensions.swift b/Pods/RxSwift/RxSwift/ObservableType+Extensions.swift
deleted file mode 100644
index ac850c3ba..000000000
--- a/Pods/RxSwift/RxSwift/ObservableType+Extensions.swift
+++ /dev/null
@@ -1,174 +0,0 @@
-//
-//  ObservableType+Extensions.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if DEBUG
-    import Foundation
-#endif
-
-extension ObservableType {
-    /**
-     Subscribes an event handler to an observable sequence.
-     
-     - parameter on: Action to invoke for each event in the observable sequence.
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe(_ on: @escaping (Event<Element>) -> Void) -> Disposable {
-        let observer = AnonymousObserver { e in
-            on(e)
-        }
-        return self.asObservable().subscribe(observer)
-    }
-    
-    /**
-     Subscribes an element handler, an error handler, a completion handler and disposed handler to an observable sequence.
-     
-     Also, take in an object and provide an unretained, safe to use (i.e. not implicitly unwrapped), reference to it along with the events emitted by the sequence.
-     
-     - Note: If `object` can't be retained, none of the other closures will be invoked.
-     
-     - parameter object: The object to provide an unretained reference on.
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription).
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe<Object: AnyObject>(
-        with object: Object,
-        onNext: ((Object, Element) -> Void)? = nil,
-        onError: ((Object, Swift.Error) -> Void)? = nil,
-        onCompleted: ((Object) -> Void)? = nil,
-        onDisposed: ((Object) -> Void)? = nil
-    ) -> Disposable {
-        subscribe(
-            onNext: { [weak object] in
-                guard let object = object else { return }
-                onNext?(object, $0)
-            },
-            onError: { [weak object] in
-                guard let object = object else { return }
-                onError?(object, $0)
-            },
-            onCompleted: { [weak object] in
-                guard let object = object else { return }
-                onCompleted?(object)
-            },
-            onDisposed: { [weak object] in
-                guard let object = object else { return }
-                onDisposed?(object)
-            }
-        )
-    }
-    
-    /**
-     Subscribes an element handler, an error handler, a completion handler and disposed handler to an observable sequence.
-     
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription).
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe(
-        onNext: ((Element) -> Void)? = nil,
-        onError: ((Swift.Error) -> Void)? = nil,
-        onCompleted: (() -> Void)? = nil,
-        onDisposed: (() -> Void)? = nil
-    ) -> Disposable {
-            let disposable: Disposable
-            
-            if let disposed = onDisposed {
-                disposable = Disposables.create(with: disposed)
-            }
-            else {
-                disposable = Disposables.create()
-            }
-            
-            #if DEBUG
-                let synchronizationTracker = SynchronizationTracker()
-            #endif
-            
-            let callStack = Hooks.recordCallStackOnError ? Hooks.customCaptureSubscriptionCallstack() : []
-            
-            let observer = AnonymousObserver<Element> { event in
-                
-                #if DEBUG
-                    synchronizationTracker.register(synchronizationErrorMessage: .default)
-                    defer { synchronizationTracker.unregister() }
-                #endif
-                
-                switch event {
-                case .next(let value):
-                    onNext?(value)
-                case .error(let error):
-                    if let onError = onError {
-                        onError(error)
-                    }
-                    else {
-                        Hooks.defaultErrorHandler(callStack, error)
-                    }
-                    disposable.dispose()
-                case .completed:
-                    onCompleted?()
-                    disposable.dispose()
-                }
-            }
-            return Disposables.create(
-                self.asObservable().subscribe(observer),
-                disposable
-            )
-    }
-}
-
-import Foundation
-
-extension Hooks {
-    public typealias DefaultErrorHandler = (_ subscriptionCallStack: [String], _ error: Error) -> Void
-    public typealias CustomCaptureSubscriptionCallstack = () -> [String]
-
-    private static let lock = RecursiveLock()
-    private static var _defaultErrorHandler: DefaultErrorHandler = { subscriptionCallStack, error in
-        #if DEBUG
-            let serializedCallStack = subscriptionCallStack.joined(separator: "\n")
-            print("Unhandled error happened: \(error)")
-            if !serializedCallStack.isEmpty {
-                print("subscription called from:\n\(serializedCallStack)")
-            }
-        #endif
-    }
-    private static var _customCaptureSubscriptionCallstack: CustomCaptureSubscriptionCallstack = {
-        #if DEBUG
-            return Thread.callStackSymbols
-        #else
-            return []
-        #endif
-    }
-
-    /// Error handler called in case onError handler wasn't provided.
-    public static var defaultErrorHandler: DefaultErrorHandler {
-        get {
-            lock.performLocked { _defaultErrorHandler }
-        }
-        set {
-            lock.performLocked { _defaultErrorHandler = newValue }
-        }
-    }
-    
-    /// Subscription callstack block to fetch custom callstack information.
-    public static var customCaptureSubscriptionCallstack: CustomCaptureSubscriptionCallstack {
-        get {
-            lock.performLocked { _customCaptureSubscriptionCallstack }
-        }
-        set {
-            lock.performLocked { _customCaptureSubscriptionCallstack = newValue }
-        }
-    }
-}
-
diff --git a/Pods/RxSwift/RxSwift/ObservableType.swift b/Pods/RxSwift/RxSwift/ObservableType.swift
deleted file mode 100644
index 279bf7f46..000000000
--- a/Pods/RxSwift/RxSwift/ObservableType.swift
+++ /dev/null
@@ -1,45 +0,0 @@
-//
-//  ObservableType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 8/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents a push style sequence.
-public protocol ObservableType: ObservableConvertibleType {
-    /**
-    Subscribes `observer` to receive events for this sequence.
-    
-    ### Grammar
-    
-    **Next\* (Error | Completed)?**
-    
-    * sequences can produce zero or more elements so zero or more `Next` events can be sent to `observer`
-    * once an `Error` or `Completed` event is sent, the sequence terminates and can't produce any other elements
-    
-    It is possible that events are sent from different threads, but no two events can be sent concurrently to
-    `observer`.
-    
-    ### Resource Management
-    
-    When sequence sends `Complete` or `Error` event all internal resources that compute sequence elements
-    will be freed.
-    
-    To cancel production of sequence elements and free resources immediately, call `dispose` on returned
-    subscription.
-    
-    - returns: Subscription for `observer` that can be used to cancel production of sequence elements and free resources.
-    */
-    func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element
-}
-
-extension ObservableType {
-    
-    /// Default implementation of converting `ObservableType` to `Observable`.
-    public func asObservable() -> Observable<Element> {
-        // temporary workaround
-        //return Observable.create(subscribe: self.subscribe)
-        Observable.create { o in self.subscribe(o) }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/AddRef.swift b/Pods/RxSwift/RxSwift/Observables/AddRef.swift
deleted file mode 100644
index a96dfcb03..000000000
--- a/Pods/RxSwift/RxSwift/Observables/AddRef.swift
+++ /dev/null
@@ -1,44 +0,0 @@
-//
-//  AddRef.swift
-//  RxSwift
-//
-//  Created by Junior B. on 30/10/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-final class AddRefSink<Observer: ObserverType> : Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    
-    override init(observer: Observer, cancel: Cancelable) {
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.forwardOn(event)
-        case .completed, .error:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-}
-
-final class AddRef<Element> : Producer<Element> {
-    
-    private let source: Observable<Element>
-    private let refCount: RefCountDisposable
-    
-    init(source: Observable<Element>, refCount: RefCountDisposable) {
-        self.source = source
-        self.refCount = refCount
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let releaseDisposable = self.refCount.retain()
-        let sink = AddRefSink(observer: observer, cancel: cancel)
-        let subscription = Disposables.create(releaseDisposable, self.source.subscribe(sink))
-
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Amb.swift b/Pods/RxSwift/RxSwift/Observables/Amb.swift
deleted file mode 100644
index efc17a8d9..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Amb.swift
+++ /dev/null
@@ -1,157 +0,0 @@
-//
-//  Amb.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Propagates the observable sequence that reacts first.
-
-     - seealso: [amb operator on reactivex.io](http://reactivex.io/documentation/operators/amb.html)
-
-     - returns: An observable sequence that surfaces any of the given sequences, whichever reacted first.
-     */
-    public static func amb<Sequence: Swift.Sequence>(_ sequence: Sequence) -> Observable<Element>
-        where Sequence.Element == Observable<Element> {
-        sequence.reduce(Observable<Sequence.Element.Element>.never()) { a, o in
-            a.amb(o.asObservable())
-        }
-    }
-}
-
-extension ObservableType {
-
-    /**
-     Propagates the observable sequence that reacts first.
-
-     - seealso: [amb operator on reactivex.io](http://reactivex.io/documentation/operators/amb.html)
-
-     - parameter right: Second observable sequence.
-     - returns: An observable sequence that surfaces either of the given sequences, whichever reacted first.
-     */
-    public func amb<O2: ObservableType>
-        (_ right: O2)
-        -> Observable<Element> where O2.Element == Element {
-        Amb(left: self.asObservable(), right: right.asObservable())
-    }
-}
-
-private enum AmbState {
-    case neither
-    case left
-    case right
-}
-
-final private class AmbObserver<Observer: ObserverType>: ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = AmbSink<Observer>
-    typealias This = AmbObserver<Observer>
-    typealias Sink = (This, Event<Element>) -> Void
-    
-    private let parent: Parent
-    fileprivate var sink: Sink
-    fileprivate var cancel: Disposable
-    
-    init(parent: Parent, cancel: Disposable, sink: @escaping Sink) {
-#if TRACE_RESOURCES
-        _ = Resources.incrementTotal()
-#endif
-        
-        self.parent = parent
-        self.sink = sink
-        self.cancel = cancel
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.sink(self, event)
-        if event.isStopEvent {
-            self.cancel.dispose()
-        }
-    }
-    
-    deinit {
-#if TRACE_RESOURCES
-        _ = Resources.decrementTotal()
-#endif
-    }
-}
-
-final private class AmbSink<Observer: ObserverType>: Sink<Observer> {
-    typealias Element = Observer.Element
-    typealias Parent = Amb<Element>
-    typealias AmbObserverType = AmbObserver<Observer>
-
-    private let parent: Parent
-    
-    private let lock = RecursiveLock()
-    // state
-    private var choice = AmbState.neither
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let disposeAll = Disposables.create(subscription1, subscription2)
-        
-        let forwardEvent = { (o: AmbObserverType, event: Event<Element>) -> Void in
-            self.forwardOn(event)
-            if event.isStopEvent {
-                self.dispose()
-            }
-        }
-
-        let decide = { (o: AmbObserverType, event: Event<Element>, me: AmbState, otherSubscription: Disposable) in
-            self.lock.performLocked {
-                if self.choice == .neither {
-                    self.choice = me
-                    o.sink = forwardEvent
-                    o.cancel = disposeAll
-                    otherSubscription.dispose()
-                }
-                
-                if self.choice == me {
-                    self.forwardOn(event)
-                    if event.isStopEvent {
-                        self.dispose()
-                    }
-                }
-            }
-        }
-        
-        let sink1 = AmbObserver(parent: self, cancel: subscription1) { o, e in
-            decide(o, e, .left, subscription2)
-        }
-        
-        let sink2 = AmbObserver(parent: self, cancel: subscription1) { o, e in
-            decide(o, e, .right, subscription1)
-        }
-        
-        subscription1.setDisposable(self.parent.left.subscribe(sink1))
-        subscription2.setDisposable(self.parent.right.subscribe(sink2))
-        
-        return disposeAll
-    }
-}
-
-final private class Amb<Element>: Producer<Element> {
-    fileprivate let left: Observable<Element>
-    fileprivate let right: Observable<Element>
-    
-    init(left: Observable<Element>, right: Observable<Element>) {
-        self.left = left
-        self.right = right
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = AmbSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/AsMaybe.swift b/Pods/RxSwift/RxSwift/Observables/AsMaybe.swift
deleted file mode 100644
index 6fa625784..000000000
--- a/Pods/RxSwift/RxSwift/Observables/AsMaybe.swift
+++ /dev/null
@@ -1,48 +0,0 @@
-//
-//  AsMaybe.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/12/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-private final class AsMaybeSink<Observer: ObserverType> : Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element
-
-    private var element: Event<Element>?
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            if self.element != nil {
-                self.forwardOn(.error(RxError.moreThanOneElement))
-                self.dispose()
-            }
-
-            self.element = event
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            if let element = self.element {
-                self.forwardOn(element)
-            }
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final class AsMaybe<Element>: Producer<Element> {
-    private let source: Observable<Element>
-
-    init(source: Observable<Element>) {
-        self.source = source
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = AsMaybeSink(observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/AsSingle.swift b/Pods/RxSwift/RxSwift/Observables/AsSingle.swift
deleted file mode 100644
index b39932f12..000000000
--- a/Pods/RxSwift/RxSwift/Observables/AsSingle.swift
+++ /dev/null
@@ -1,51 +0,0 @@
-//
-//  AsSingle.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/12/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-private final class AsSingleSink<Observer: ObserverType> : Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element
-
-    private var element: Event<Element>?
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            if self.element != nil {
-                self.forwardOn(.error(RxError.moreThanOneElement))
-                self.dispose()
-            }
-
-            self.element = event
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            if let element = self.element {
-                self.forwardOn(element)
-                self.forwardOn(.completed)
-            }
-            else {
-                self.forwardOn(.error(RxError.noElements))
-            }
-            self.dispose()
-        }
-    }
-}
-
-final class AsSingle<Element>: Producer<Element> {
-    private let source: Observable<Element>
-
-    init(source: Observable<Element>) {
-        self.source = source
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = AsSingleSink(observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Buffer.swift b/Pods/RxSwift/RxSwift/Observables/Buffer.swift
deleted file mode 100644
index 087c4cf57..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Buffer.swift
+++ /dev/null
@@ -1,138 +0,0 @@
-//
-//  Buffer.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 9/13/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Projects each element of an observable sequence into a buffer that's sent out when either it's full or a given amount of time has elapsed, using the specified scheduler to run timers.
-
-     A useful real-world analogy of this overload is the behavior of a ferry leaving the dock when all seats are taken, or at the scheduled time of departure, whichever event occurs first.
-
-     - seealso: [buffer operator on reactivex.io](http://reactivex.io/documentation/operators/buffer.html)
-
-     - parameter timeSpan: Maximum time length of a buffer.
-     - parameter count: Maximum element count of a buffer.
-     - parameter scheduler: Scheduler to run buffering timers on.
-     - returns: An observable sequence of buffers.
-     */
-    public func buffer(timeSpan: RxTimeInterval, count: Int, scheduler: SchedulerType)
-        -> Observable<[Element]> {
-        BufferTimeCount(source: self.asObservable(), timeSpan: timeSpan, count: count, scheduler: scheduler)
-    }
-}
-
-final private class BufferTimeCount<Element>: Producer<[Element]> {
-    
-    fileprivate let timeSpan: RxTimeInterval
-    fileprivate let count: Int
-    fileprivate let scheduler: SchedulerType
-    fileprivate let source: Observable<Element>
-    
-    init(source: Observable<Element>, timeSpan: RxTimeInterval, count: Int, scheduler: SchedulerType) {
-        self.source = source
-        self.timeSpan = timeSpan
-        self.count = count
-        self.scheduler = scheduler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == [Element] {
-        let sink = BufferTimeCountSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class BufferTimeCountSink<Element, Observer: ObserverType>
-    : Sink<Observer>
-    , LockOwnerType
-    , ObserverType
-    , SynchronizedOnType where Observer.Element == [Element] {
-    typealias Parent = BufferTimeCount<Element>
-    
-    private let parent: Parent
-    
-    let lock = RecursiveLock()
-    
-    // state
-    private let timerD = SerialDisposable()
-    private var buffer = [Element]()
-    private var windowID = 0
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
- 
-    func run() -> Disposable {
-        self.createTimer(self.windowID)
-        return Disposables.create(timerD, parent.source.subscribe(self))
-    }
-    
-    func startNewWindowAndSendCurrentOne() {
-        self.windowID = self.windowID &+ 1
-        let windowID = self.windowID
-        
-        let buffer = self.buffer
-        self.buffer = []
-        self.forwardOn(.next(buffer))
-        
-        self.createTimer(windowID)
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next(let element):
-            self.buffer.append(element)
-            
-            if self.buffer.count == self.parent.count {
-                self.startNewWindowAndSendCurrentOne()
-            }
-            
-        case .error(let error):
-            self.buffer = []
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            self.forwardOn(.next(self.buffer))
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-    
-    func createTimer(_ windowID: Int) {
-        if self.timerD.isDisposed {
-            return
-        }
-        
-        if self.windowID != windowID {
-            return
-        }
-
-        let nextTimer = SingleAssignmentDisposable()
-        
-        self.timerD.disposable = nextTimer
-
-        let disposable = self.parent.scheduler.scheduleRelative(windowID, dueTime: self.parent.timeSpan) { previousWindowID in
-            self.lock.performLocked {
-                if previousWindowID != self.windowID {
-                    return
-                }
-             
-                self.startNewWindowAndSendCurrentOne()
-            }
-            
-            return Disposables.create()
-        }
-
-        nextTimer.setDisposable(disposable)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Catch.swift b/Pods/RxSwift/RxSwift/Observables/Catch.swift
deleted file mode 100644
index 2efd66062..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Catch.swift
+++ /dev/null
@@ -1,275 +0,0 @@
-//
-//  Catch.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 4/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Continues an observable sequence that is terminated by an error with the observable sequence produced by the handler.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter handler: Error handler function, producing another observable sequence.
-     - returns: An observable sequence containing the source sequence's elements, followed by the elements produced by the handler's resulting observable sequence in case an error occurred.
-     */
-    public func `catch`(_ handler: @escaping (Swift.Error) throws -> Observable<Element>)
-        -> Observable<Element> {
-        Catch(source: self.asObservable(), handler: handler)
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with the observable sequence produced by the handler.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter handler: Error handler function, producing another observable sequence.
-     - returns: An observable sequence containing the source sequence's elements, followed by the elements produced by the handler's resulting observable sequence in case an error occurred.
-     */
-    @available(*, deprecated, renamed: "catch(_:)")
-    public func catchError(_ handler: @escaping (Swift.Error) throws -> Observable<Element>)
-        -> Observable<Element> {
-        `catch`(handler)
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with a single element.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter element: Last element in an observable sequence in case error occurs.
-     - returns: An observable sequence containing the source sequence's elements, followed by the `element` in case an error occurred.
-     */
-    public func catchAndReturn(_ element: Element)
-        -> Observable<Element> {
-        Catch(source: self.asObservable(), handler: { _ in Observable.just(element) })
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with a single element.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter element: Last element in an observable sequence in case error occurs.
-     - returns: An observable sequence containing the source sequence's elements, followed by the `element` in case an error occurred.
-     */
-    @available(*, deprecated, renamed: "catchAndReturn(_:)")
-    public func catchErrorJustReturn(_ element: Element)
-        -> Observable<Element> {
-        catchAndReturn(element)
-    }
-}
-
-extension ObservableType {
-    /**
-     Continues an observable sequence that is terminated by an error with the next observable sequence.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - returns: An observable sequence containing elements from consecutive source sequences until a source sequence terminates successfully.
-     */
-    @available(*, deprecated, renamed: "catch(onSuccess:onFailure:onDisposed:)")
-    public static func catchError<Sequence: Swift.Sequence>(_ sequence: Sequence) -> Observable<Element>
-        where Sequence.Element == Observable<Element> {
-        `catch`(sequence: sequence)
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with the next observable sequence.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - returns: An observable sequence containing elements from consecutive source sequences until a source sequence terminates successfully.
-     */
-    public static func `catch`<Sequence: Swift.Sequence>(sequence: Sequence) -> Observable<Element>
-        where Sequence.Element == Observable<Element> {
-        CatchSequence(sources: sequence)
-    }
-}
-
-extension ObservableType {
-
-    /**
-     Repeats the source observable sequence until it successfully terminates.
-
-     **This could potentially create an infinite sequence.**
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - returns: Observable sequence to repeat until it successfully terminates.
-     */
-    public func retry() -> Observable<Element> {
-        CatchSequence(sources: InfiniteSequence(repeatedValue: self.asObservable()))
-    }
-
-    /**
-     Repeats the source observable sequence the specified number of times in case of an error or until it successfully terminates.
-
-     If you encounter an error and want it to retry once, then you must use `retry(2)`
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter maxAttemptCount: Maximum number of times to repeat the sequence.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully.
-     */
-    public func retry(_ maxAttemptCount: Int)
-        -> Observable<Element> {
-        CatchSequence(sources: Swift.repeatElement(self.asObservable(), count: maxAttemptCount))
-    }
-}
-
-// catch with callback
-
-final private class CatchSinkProxy<Observer: ObserverType>: ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = CatchSink<Observer>
-    
-    private let parent: Parent
-    
-    init(parent: Parent) {
-        self.parent = parent
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.parent.forwardOn(event)
-        
-        switch event {
-        case .next:
-            break
-        case .error, .completed:
-            self.parent.dispose()
-        }
-    }
-}
-
-final private class CatchSink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = Catch<Element>
-    
-    private let parent: Parent
-    private let subscription = SerialDisposable()
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        let d1 = SingleAssignmentDisposable()
-        self.subscription.disposable = d1
-        d1.setDisposable(self.parent.source.subscribe(self))
-
-        return self.subscription
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.forwardOn(event)
-        case .completed:
-            self.forwardOn(event)
-            self.dispose()
-        case .error(let error):
-            do {
-                let catchSequence = try self.parent.handler(error)
-
-                let observer = CatchSinkProxy(parent: self)
-                
-                self.subscription.disposable = catchSequence.subscribe(observer)
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        }
-    }
-}
-
-final private class Catch<Element>: Producer<Element> {
-    typealias Handler = (Swift.Error) throws -> Observable<Element>
-    
-    fileprivate let source: Observable<Element>
-    fileprivate let handler: Handler
-    
-    init(source: Observable<Element>, handler: @escaping Handler) {
-        self.source = source
-        self.handler = handler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = CatchSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-// catch enumerable
-
-final private class CatchSequenceSink<Sequence: Swift.Sequence, Observer: ObserverType>
-    : TailRecursiveSink<Sequence, Observer>
-    , ObserverType where Sequence.Element: ObservableConvertibleType, Sequence.Element.Element == Observer.Element {
-    typealias Element = Observer.Element
-    typealias Parent = CatchSequence<Sequence>
-
-    private var lastError: Swift.Error?
-    
-    override init(observer: Observer, cancel: Cancelable) {
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.forwardOn(event)
-        case .error(let error):
-            self.lastError = error
-            self.schedule(.moveNext)
-        case .completed:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-
-    override func subscribeToNext(_ source: Observable<Element>) -> Disposable {
-        source.subscribe(self)
-    }
-    
-    override func done() {
-        if let lastError = self.lastError {
-            self.forwardOn(.error(lastError))
-        }
-        else {
-            self.forwardOn(.completed)
-        }
-        
-        self.dispose()
-    }
-    
-    override func extract(_ observable: Observable<Element>) -> SequenceGenerator? {
-        if let onError = observable as? CatchSequence<Sequence> {
-            return (onError.sources.makeIterator(), nil)
-        }
-        else {
-            return nil
-        }
-    }
-}
-
-final private class CatchSequence<Sequence: Swift.Sequence>: Producer<Sequence.Element.Element> where Sequence.Element: ObservableConvertibleType {
-    typealias Element = Sequence.Element.Element
-    
-    let sources: Sequence
-    
-    init(sources: Sequence) {
-        self.sources = sources
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = CatchSequenceSink<Sequence, Observer>(observer: observer, cancel: cancel)
-        let subscription = sink.run((self.sources.makeIterator(), nil))
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/CombineLatest+Collection.swift b/Pods/RxSwift/RxSwift/Observables/CombineLatest+Collection.swift
deleted file mode 100644
index 4350851c2..000000000
--- a/Pods/RxSwift/RxSwift/Observables/CombineLatest+Collection.swift
+++ /dev/null
@@ -1,165 +0,0 @@
-//
-//  CombineLatest+Collection.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 8/29/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-     - seealso: [combinelatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-     - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-     - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-     */
-    public static func combineLatest<Collection: Swift.Collection>(_ collection: Collection, resultSelector: @escaping ([Collection.Element.Element]) throws -> Element) -> Observable<Element>
-        where Collection.Element: ObservableType {
-        CombineLatestCollectionType(sources: collection, resultSelector: resultSelector)
-    }
-
-    /**
-     Merges the specified observable sequences into one observable sequence whenever any of the observable sequences produces an element.
-
-     - seealso: [combinelatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-     - returns: An observable sequence containing the result of combining elements of the sources.
-     */
-    public static func combineLatest<Collection: Swift.Collection>(_ collection: Collection) -> Observable<[Element]>
-        where Collection.Element: ObservableType, Collection.Element.Element == Element {
-        CombineLatestCollectionType(sources: collection, resultSelector: { $0 })
-    }
-}
-
-final private class CombineLatestCollectionTypeSink<Collection: Swift.Collection, Observer: ObserverType>
-    : Sink<Observer> where Collection.Element: ObservableConvertibleType {
-    typealias Result = Observer.Element 
-    typealias Parent = CombineLatestCollectionType<Collection, Result>
-    typealias SourceElement = Collection.Element.Element
-    
-    let parent: Parent
-    
-    let lock = RecursiveLock()
-
-    // state
-    var numberOfValues = 0
-    var values: [SourceElement?]
-    var isDone: [Bool]
-    var numberOfDone = 0
-    var subscriptions: [SingleAssignmentDisposable]
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.values = [SourceElement?](repeating: nil, count: parent.count)
-        self.isDone = [Bool](repeating: false, count: parent.count)
-        self.subscriptions = [SingleAssignmentDisposable]()
-        self.subscriptions.reserveCapacity(parent.count)
-        
-        for _ in 0 ..< parent.count {
-            self.subscriptions.append(SingleAssignmentDisposable())
-        }
-        
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<SourceElement>, atIndex: Int) {
-        self.lock.lock(); defer { self.lock.unlock() }
-        switch event {
-        case .next(let element):
-            if self.values[atIndex] == nil {
-                self.numberOfValues += 1
-            }
-            
-            self.values[atIndex] = element
-            
-            if self.numberOfValues < self.parent.count {
-                let numberOfOthersThatAreDone = self.numberOfDone - (self.isDone[atIndex] ? 1 : 0)
-                if numberOfOthersThatAreDone == self.parent.count - 1 {
-                    self.forwardOn(.completed)
-                    self.dispose()
-                }
-                return
-            }
-            
-            do {
-                let result = try self.parent.resultSelector(self.values.map { $0! })
-                self.forwardOn(.next(result))
-            }
-            catch let error {
-                self.forwardOn(.error(error))
-                self.dispose()
-            }
-            
-        case .error(let error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            if self.isDone[atIndex] {
-                return
-            }
-            
-            self.isDone[atIndex] = true
-            self.numberOfDone += 1
-            
-            if self.numberOfDone == self.parent.count {
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-            else {
-                self.subscriptions[atIndex].dispose()
-            }
-        }
-    }
-    
-    func run() -> Disposable {
-        var j = 0
-        for i in self.parent.sources {
-            let index = j
-            let source = i.asObservable()
-            let disposable = source.subscribe(AnyObserver { event in
-                self.on(event, atIndex: index)
-            })
-
-            self.subscriptions[j].setDisposable(disposable)
-            
-            j += 1
-        }
-
-        if self.parent.sources.isEmpty {
-            do {
-                let result = try self.parent.resultSelector([])
-                self.forwardOn(.next(result))
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-            catch let error {
-                self.forwardOn(.error(error))
-                self.dispose()
-            }
-        }
-        
-        return Disposables.create(subscriptions)
-    }
-}
-
-final private class CombineLatestCollectionType<Collection: Swift.Collection, Result>: Producer<Result> where Collection.Element: ObservableConvertibleType {
-    typealias ResultSelector = ([Collection.Element.Element]) throws -> Result
-    
-    let sources: Collection
-    let resultSelector: ResultSelector
-    let count: Int
-
-    init(sources: Collection, resultSelector: @escaping ResultSelector) {
-        self.sources = sources
-        self.resultSelector = resultSelector
-        self.count = self.sources.count
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = CombineLatestCollectionTypeSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/CombineLatest+arity.swift b/Pods/RxSwift/RxSwift/Observables/CombineLatest+arity.swift
deleted file mode 100644
index e69bbab4a..000000000
--- a/Pods/RxSwift/RxSwift/Observables/CombineLatest+arity.swift
+++ /dev/null
@@ -1,843 +0,0 @@
-// This file is autogenerated. Take a look at `Preprocessor` target in RxSwift project 
-//
-//  CombineLatest+arity.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 4/22/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-
-
-// 2
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType>
-        (_ source1: O1, _ source2: O2, resultSelector: @escaping (O1.Element, O2.Element) throws -> Element)
-            -> Observable<Element> {
-        return CombineLatest2(
-            source1: source1.asObservable(), source2: source2.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType>
-        (_ source1: O1, _ source2: O2)
-            -> Observable<(O1.Element, O2.Element)> {
-        return CombineLatest2(
-            source1: source1.asObservable(), source2: source2.asObservable(),
-            resultSelector: { ($0, $1) }
-        )
-    }
-}
-
-final class CombineLatestSink2_<E1, E2, Observer: ObserverType> : CombineLatestSink<Observer> {
-    typealias Result = Observer.Element
-    typealias Parent = CombineLatest2<E1, E2, Result>
-
-    let parent: Parent
-
-    var latestElement1: E1! = nil
-    var latestElement2: E2! = nil
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 2, observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-
-        let observer1 = CombineLatestObserver(lock: self.lock, parent: self, index: 0, setLatestValue: { (e: E1) -> Void in self.latestElement1 = e }, this: subscription1)
-        let observer2 = CombineLatestObserver(lock: self.lock, parent: self, index: 1, setLatestValue: { (e: E2) -> Void in self.latestElement2 = e }, this: subscription2)
-
-         subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-         subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-
-        return Disposables.create([
-                subscription1,
-                subscription2
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.latestElement1, self.latestElement2)
-    }
-}
-
-final class CombineLatest2<E1, E2, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = CombineLatestSink2_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 3
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, resultSelector: @escaping (O1.Element, O2.Element, O3.Element) throws -> Element)
-            -> Observable<Element> {
-        return CombineLatest3(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3)
-            -> Observable<(O1.Element, O2.Element, O3.Element)> {
-        return CombineLatest3(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(),
-            resultSelector: { ($0, $1, $2) }
-        )
-    }
-}
-
-final class CombineLatestSink3_<E1, E2, E3, Observer: ObserverType> : CombineLatestSink<Observer> {
-    typealias Result = Observer.Element
-    typealias Parent = CombineLatest3<E1, E2, E3, Result>
-
-    let parent: Parent
-
-    var latestElement1: E1! = nil
-    var latestElement2: E2! = nil
-    var latestElement3: E3! = nil
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 3, observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-
-        let observer1 = CombineLatestObserver(lock: self.lock, parent: self, index: 0, setLatestValue: { (e: E1) -> Void in self.latestElement1 = e }, this: subscription1)
-        let observer2 = CombineLatestObserver(lock: self.lock, parent: self, index: 1, setLatestValue: { (e: E2) -> Void in self.latestElement2 = e }, this: subscription2)
-        let observer3 = CombineLatestObserver(lock: self.lock, parent: self, index: 2, setLatestValue: { (e: E3) -> Void in self.latestElement3 = e }, this: subscription3)
-
-         subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-         subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-         subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-
-        return Disposables.create([
-                subscription1,
-                subscription2,
-                subscription3
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.latestElement1, self.latestElement2, self.latestElement3)
-    }
-}
-
-final class CombineLatest3<E1, E2, E3, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = CombineLatestSink3_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 4
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element) throws -> Element)
-            -> Observable<Element> {
-        return CombineLatest4(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4)
-            -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element)> {
-        return CombineLatest4(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(),
-            resultSelector: { ($0, $1, $2, $3) }
-        )
-    }
-}
-
-final class CombineLatestSink4_<E1, E2, E3, E4, Observer: ObserverType> : CombineLatestSink<Observer> {
-    typealias Result = Observer.Element
-    typealias Parent = CombineLatest4<E1, E2, E3, E4, Result>
-
-    let parent: Parent
-
-    var latestElement1: E1! = nil
-    var latestElement2: E2! = nil
-    var latestElement3: E3! = nil
-    var latestElement4: E4! = nil
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 4, observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-
-        let observer1 = CombineLatestObserver(lock: self.lock, parent: self, index: 0, setLatestValue: { (e: E1) -> Void in self.latestElement1 = e }, this: subscription1)
-        let observer2 = CombineLatestObserver(lock: self.lock, parent: self, index: 1, setLatestValue: { (e: E2) -> Void in self.latestElement2 = e }, this: subscription2)
-        let observer3 = CombineLatestObserver(lock: self.lock, parent: self, index: 2, setLatestValue: { (e: E3) -> Void in self.latestElement3 = e }, this: subscription3)
-        let observer4 = CombineLatestObserver(lock: self.lock, parent: self, index: 3, setLatestValue: { (e: E4) -> Void in self.latestElement4 = e }, this: subscription4)
-
-         subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-         subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-         subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-         subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-
-        return Disposables.create([
-                subscription1,
-                subscription2,
-                subscription3,
-                subscription4
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.latestElement1, self.latestElement2, self.latestElement3, self.latestElement4)
-    }
-}
-
-final class CombineLatest4<E1, E2, E3, E4, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = CombineLatestSink4_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 5
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element) throws -> Element)
-            -> Observable<Element> {
-        return CombineLatest5(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5)
-            -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element, O5.Element)> {
-        return CombineLatest5(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(),
-            resultSelector: { ($0, $1, $2, $3, $4) }
-        )
-    }
-}
-
-final class CombineLatestSink5_<E1, E2, E3, E4, E5, Observer: ObserverType> : CombineLatestSink<Observer> {
-    typealias Result = Observer.Element
-    typealias Parent = CombineLatest5<E1, E2, E3, E4, E5, Result>
-
-    let parent: Parent
-
-    var latestElement1: E1! = nil
-    var latestElement2: E2! = nil
-    var latestElement3: E3! = nil
-    var latestElement4: E4! = nil
-    var latestElement5: E5! = nil
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 5, observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-        let subscription5 = SingleAssignmentDisposable()
-
-        let observer1 = CombineLatestObserver(lock: self.lock, parent: self, index: 0, setLatestValue: { (e: E1) -> Void in self.latestElement1 = e }, this: subscription1)
-        let observer2 = CombineLatestObserver(lock: self.lock, parent: self, index: 1, setLatestValue: { (e: E2) -> Void in self.latestElement2 = e }, this: subscription2)
-        let observer3 = CombineLatestObserver(lock: self.lock, parent: self, index: 2, setLatestValue: { (e: E3) -> Void in self.latestElement3 = e }, this: subscription3)
-        let observer4 = CombineLatestObserver(lock: self.lock, parent: self, index: 3, setLatestValue: { (e: E4) -> Void in self.latestElement4 = e }, this: subscription4)
-        let observer5 = CombineLatestObserver(lock: self.lock, parent: self, index: 4, setLatestValue: { (e: E5) -> Void in self.latestElement5 = e }, this: subscription5)
-
-         subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-         subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-         subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-         subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-         subscription5.setDisposable(self.parent.source5.subscribe(observer5))
-
-        return Disposables.create([
-                subscription1,
-                subscription2,
-                subscription3,
-                subscription4,
-                subscription5
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.latestElement1, self.latestElement2, self.latestElement3, self.latestElement4, self.latestElement5)
-    }
-}
-
-final class CombineLatest5<E1, E2, E3, E4, E5, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4, E5) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-    let source5: Observable<E5>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, source5: Observable<E5>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-        self.source5 = source5
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = CombineLatestSink5_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 6
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element) throws -> Element)
-            -> Observable<Element> {
-        return CombineLatest6(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6)
-            -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element)> {
-        return CombineLatest6(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(),
-            resultSelector: { ($0, $1, $2, $3, $4, $5) }
-        )
-    }
-}
-
-final class CombineLatestSink6_<E1, E2, E3, E4, E5, E6, Observer: ObserverType> : CombineLatestSink<Observer> {
-    typealias Result = Observer.Element
-    typealias Parent = CombineLatest6<E1, E2, E3, E4, E5, E6, Result>
-
-    let parent: Parent
-
-    var latestElement1: E1! = nil
-    var latestElement2: E2! = nil
-    var latestElement3: E3! = nil
-    var latestElement4: E4! = nil
-    var latestElement5: E5! = nil
-    var latestElement6: E6! = nil
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 6, observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-        let subscription5 = SingleAssignmentDisposable()
-        let subscription6 = SingleAssignmentDisposable()
-
-        let observer1 = CombineLatestObserver(lock: self.lock, parent: self, index: 0, setLatestValue: { (e: E1) -> Void in self.latestElement1 = e }, this: subscription1)
-        let observer2 = CombineLatestObserver(lock: self.lock, parent: self, index: 1, setLatestValue: { (e: E2) -> Void in self.latestElement2 = e }, this: subscription2)
-        let observer3 = CombineLatestObserver(lock: self.lock, parent: self, index: 2, setLatestValue: { (e: E3) -> Void in self.latestElement3 = e }, this: subscription3)
-        let observer4 = CombineLatestObserver(lock: self.lock, parent: self, index: 3, setLatestValue: { (e: E4) -> Void in self.latestElement4 = e }, this: subscription4)
-        let observer5 = CombineLatestObserver(lock: self.lock, parent: self, index: 4, setLatestValue: { (e: E5) -> Void in self.latestElement5 = e }, this: subscription5)
-        let observer6 = CombineLatestObserver(lock: self.lock, parent: self, index: 5, setLatestValue: { (e: E6) -> Void in self.latestElement6 = e }, this: subscription6)
-
-         subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-         subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-         subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-         subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-         subscription5.setDisposable(self.parent.source5.subscribe(observer5))
-         subscription6.setDisposable(self.parent.source6.subscribe(observer6))
-
-        return Disposables.create([
-                subscription1,
-                subscription2,
-                subscription3,
-                subscription4,
-                subscription5,
-                subscription6
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.latestElement1, self.latestElement2, self.latestElement3, self.latestElement4, self.latestElement5, self.latestElement6)
-    }
-}
-
-final class CombineLatest6<E1, E2, E3, E4, E5, E6, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4, E5, E6) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-    let source5: Observable<E5>
-    let source6: Observable<E6>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, source5: Observable<E5>, source6: Observable<E6>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-        self.source5 = source5
-        self.source6 = source6
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = CombineLatestSink6_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 7
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType, O7: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element) throws -> Element)
-            -> Observable<Element> {
-        return CombineLatest7(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType, O7: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7)
-            -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element)> {
-        return CombineLatest7(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(),
-            resultSelector: { ($0, $1, $2, $3, $4, $5, $6) }
-        )
-    }
-}
-
-final class CombineLatestSink7_<E1, E2, E3, E4, E5, E6, E7, Observer: ObserverType> : CombineLatestSink<Observer> {
-    typealias Result = Observer.Element
-    typealias Parent = CombineLatest7<E1, E2, E3, E4, E5, E6, E7, Result>
-
-    let parent: Parent
-
-    var latestElement1: E1! = nil
-    var latestElement2: E2! = nil
-    var latestElement3: E3! = nil
-    var latestElement4: E4! = nil
-    var latestElement5: E5! = nil
-    var latestElement6: E6! = nil
-    var latestElement7: E7! = nil
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 7, observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-        let subscription5 = SingleAssignmentDisposable()
-        let subscription6 = SingleAssignmentDisposable()
-        let subscription7 = SingleAssignmentDisposable()
-
-        let observer1 = CombineLatestObserver(lock: self.lock, parent: self, index: 0, setLatestValue: { (e: E1) -> Void in self.latestElement1 = e }, this: subscription1)
-        let observer2 = CombineLatestObserver(lock: self.lock, parent: self, index: 1, setLatestValue: { (e: E2) -> Void in self.latestElement2 = e }, this: subscription2)
-        let observer3 = CombineLatestObserver(lock: self.lock, parent: self, index: 2, setLatestValue: { (e: E3) -> Void in self.latestElement3 = e }, this: subscription3)
-        let observer4 = CombineLatestObserver(lock: self.lock, parent: self, index: 3, setLatestValue: { (e: E4) -> Void in self.latestElement4 = e }, this: subscription4)
-        let observer5 = CombineLatestObserver(lock: self.lock, parent: self, index: 4, setLatestValue: { (e: E5) -> Void in self.latestElement5 = e }, this: subscription5)
-        let observer6 = CombineLatestObserver(lock: self.lock, parent: self, index: 5, setLatestValue: { (e: E6) -> Void in self.latestElement6 = e }, this: subscription6)
-        let observer7 = CombineLatestObserver(lock: self.lock, parent: self, index: 6, setLatestValue: { (e: E7) -> Void in self.latestElement7 = e }, this: subscription7)
-
-         subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-         subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-         subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-         subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-         subscription5.setDisposable(self.parent.source5.subscribe(observer5))
-         subscription6.setDisposable(self.parent.source6.subscribe(observer6))
-         subscription7.setDisposable(self.parent.source7.subscribe(observer7))
-
-        return Disposables.create([
-                subscription1,
-                subscription2,
-                subscription3,
-                subscription4,
-                subscription5,
-                subscription6,
-                subscription7
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.latestElement1, self.latestElement2, self.latestElement3, self.latestElement4, self.latestElement5, self.latestElement6, self.latestElement7)
-    }
-}
-
-final class CombineLatest7<E1, E2, E3, E4, E5, E6, E7, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4, E5, E6, E7) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-    let source5: Observable<E5>
-    let source6: Observable<E6>
-    let source7: Observable<E7>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, source5: Observable<E5>, source6: Observable<E6>, source7: Observable<E7>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-        self.source5 = source5
-        self.source6 = source6
-        self.source7 = source7
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = CombineLatestSink7_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 8
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType, O7: ObservableType, O8: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, _ source8: O8, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element) throws -> Element)
-            -> Observable<Element> {
-        return CombineLatest8(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(), source8: source8.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func combineLatest<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType, O7: ObservableType, O8: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, _ source8: O8)
-            -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element)> {
-        return CombineLatest8(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(), source8: source8.asObservable(),
-            resultSelector: { ($0, $1, $2, $3, $4, $5, $6, $7) }
-        )
-    }
-}
-
-final class CombineLatestSink8_<E1, E2, E3, E4, E5, E6, E7, E8, Observer: ObserverType> : CombineLatestSink<Observer> {
-    typealias Result = Observer.Element
-    typealias Parent = CombineLatest8<E1, E2, E3, E4, E5, E6, E7, E8, Result>
-
-    let parent: Parent
-
-    var latestElement1: E1! = nil
-    var latestElement2: E2! = nil
-    var latestElement3: E3! = nil
-    var latestElement4: E4! = nil
-    var latestElement5: E5! = nil
-    var latestElement6: E6! = nil
-    var latestElement7: E7! = nil
-    var latestElement8: E8! = nil
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 8, observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-        let subscription5 = SingleAssignmentDisposable()
-        let subscription6 = SingleAssignmentDisposable()
-        let subscription7 = SingleAssignmentDisposable()
-        let subscription8 = SingleAssignmentDisposable()
-
-        let observer1 = CombineLatestObserver(lock: self.lock, parent: self, index: 0, setLatestValue: { (e: E1) -> Void in self.latestElement1 = e }, this: subscription1)
-        let observer2 = CombineLatestObserver(lock: self.lock, parent: self, index: 1, setLatestValue: { (e: E2) -> Void in self.latestElement2 = e }, this: subscription2)
-        let observer3 = CombineLatestObserver(lock: self.lock, parent: self, index: 2, setLatestValue: { (e: E3) -> Void in self.latestElement3 = e }, this: subscription3)
-        let observer4 = CombineLatestObserver(lock: self.lock, parent: self, index: 3, setLatestValue: { (e: E4) -> Void in self.latestElement4 = e }, this: subscription4)
-        let observer5 = CombineLatestObserver(lock: self.lock, parent: self, index: 4, setLatestValue: { (e: E5) -> Void in self.latestElement5 = e }, this: subscription5)
-        let observer6 = CombineLatestObserver(lock: self.lock, parent: self, index: 5, setLatestValue: { (e: E6) -> Void in self.latestElement6 = e }, this: subscription6)
-        let observer7 = CombineLatestObserver(lock: self.lock, parent: self, index: 6, setLatestValue: { (e: E7) -> Void in self.latestElement7 = e }, this: subscription7)
-        let observer8 = CombineLatestObserver(lock: self.lock, parent: self, index: 7, setLatestValue: { (e: E8) -> Void in self.latestElement8 = e }, this: subscription8)
-
-         subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-         subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-         subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-         subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-         subscription5.setDisposable(self.parent.source5.subscribe(observer5))
-         subscription6.setDisposable(self.parent.source6.subscribe(observer6))
-         subscription7.setDisposable(self.parent.source7.subscribe(observer7))
-         subscription8.setDisposable(self.parent.source8.subscribe(observer8))
-
-        return Disposables.create([
-                subscription1,
-                subscription2,
-                subscription3,
-                subscription4,
-                subscription5,
-                subscription6,
-                subscription7,
-                subscription8
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.latestElement1, self.latestElement2, self.latestElement3, self.latestElement4, self.latestElement5, self.latestElement6, self.latestElement7, self.latestElement8)
-    }
-}
-
-final class CombineLatest8<E1, E2, E3, E4, E5, E6, E7, E8, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4, E5, E6, E7, E8) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-    let source5: Observable<E5>
-    let source6: Observable<E6>
-    let source7: Observable<E7>
-    let source8: Observable<E8>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, source5: Observable<E5>, source6: Observable<E6>, source7: Observable<E7>, source8: Observable<E8>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-        self.source5 = source5
-        self.source6 = source6
-        self.source7 = source7
-        self.source8 = source8
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = CombineLatestSink8_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
diff --git a/Pods/RxSwift/RxSwift/Observables/CombineLatest.swift b/Pods/RxSwift/RxSwift/Observables/CombineLatest.swift
deleted file mode 100644
index caa025640..000000000
--- a/Pods/RxSwift/RxSwift/Observables/CombineLatest.swift
+++ /dev/null
@@ -1,131 +0,0 @@
-//
-//  CombineLatest.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-protocol CombineLatestProtocol: AnyObject {
-    func next(_ index: Int)
-    func fail(_ error: Swift.Error)
-    func done(_ index: Int)
-}
-
-class CombineLatestSink<Observer: ObserverType>
-    : Sink<Observer>
-    , CombineLatestProtocol {
-    typealias Element = Observer.Element 
-   
-    let lock = RecursiveLock()
-
-    private let arity: Int
-    private var numberOfValues = 0
-    private var numberOfDone = 0
-    private var hasValue: [Bool]
-    private var isDone: [Bool]
-   
-    init(arity: Int, observer: Observer, cancel: Cancelable) {
-        self.arity = arity
-        self.hasValue = [Bool](repeating: false, count: arity)
-        self.isDone = [Bool](repeating: false, count: arity)
-        
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func getResult() throws -> Element {
-        rxAbstractMethod()
-    }
-    
-    func next(_ index: Int) {
-        if !self.hasValue[index] {
-            self.hasValue[index] = true
-            self.numberOfValues += 1
-        }
-
-        if self.numberOfValues == self.arity {
-            do {
-                let result = try self.getResult()
-                self.forwardOn(.next(result))
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        }
-        else {
-            var allOthersDone = true
-
-            for i in 0 ..< self.arity {
-                if i != index && !self.isDone[i] {
-                    allOthersDone = false
-                    break
-                }
-            }
-            
-            if allOthersDone {
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-        }
-    }
-    
-    func fail(_ error: Swift.Error) {
-        self.forwardOn(.error(error))
-        self.dispose()
-    }
-    
-    func done(_ index: Int) {
-        if self.isDone[index] {
-            return
-        }
-
-        self.isDone[index] = true
-        self.numberOfDone += 1
-
-        if self.numberOfDone == self.arity {
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final class CombineLatestObserver<Element>
-    : ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias ValueSetter = (Element) -> Void
-    
-    private let parent: CombineLatestProtocol
-    
-    let lock: RecursiveLock
-    private let index: Int
-    private let this: Disposable
-    private let setLatestValue: ValueSetter
-    
-    init(lock: RecursiveLock, parent: CombineLatestProtocol, index: Int, setLatestValue: @escaping ValueSetter, this: Disposable) {
-        self.lock = lock
-        self.parent = parent
-        self.index = index
-        self.this = this
-        self.setLatestValue = setLatestValue
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            self.setLatestValue(value)
-            self.parent.next(self.index)
-        case .error(let error):
-            self.this.dispose()
-            self.parent.fail(error)
-        case .completed:
-            self.this.dispose()
-            self.parent.done(self.index)
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/CompactMap.swift b/Pods/RxSwift/RxSwift/Observables/CompactMap.swift
deleted file mode 100644
index 7dbcdfbe9..000000000
--- a/Pods/RxSwift/RxSwift/Observables/CompactMap.swift
+++ /dev/null
@@ -1,76 +0,0 @@
-//
-//  CompactMap.swift
-//  RxSwift
-//
-//  Created by Michael Long on 04/09/2019.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Projects each element of an observable sequence into an optional form and filters all optional results.
-
-     - parameter transform: A transform function to apply to each source element and which returns an element or nil.
-     - returns: An observable sequence whose elements are the result of filtering the transform function for each element of the source.
-
-     */
-    public func compactMap<Result>(_ transform: @escaping (Element) throws -> Result?)
-        -> Observable<Result> {
-        CompactMap(source: self.asObservable(), transform: transform)
-    }
-}
-
-final private class CompactMapSink<SourceType, Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Transform = (SourceType) throws -> ResultType?
-
-    typealias ResultType = Observer.Element 
-    typealias Element = SourceType
-
-    private let transform: Transform
-
-    init(transform: @escaping Transform, observer: Observer, cancel: Cancelable) {
-        self.transform = transform
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func on(_ event: Event<SourceType>) {
-        switch event {
-        case .next(let element):
-            do {
-                if let mappedElement = try self.transform(element) {
-                    self.forwardOn(.next(mappedElement))
-                }
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        case .error(let error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final private class CompactMap<SourceType, ResultType>: Producer<ResultType> {
-    typealias Transform = (SourceType) throws -> ResultType?
-
-    private let source: Observable<SourceType>
-
-    private let transform: Transform
-
-    init(source: Observable<SourceType>, transform: @escaping Transform) {
-        self.source = source
-        self.transform = transform
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == ResultType {
-        let sink = CompactMapSink(transform: self.transform, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Concat.swift b/Pods/RxSwift/RxSwift/Observables/Concat.swift
deleted file mode 100644
index b2fb1a2e5..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Concat.swift
+++ /dev/null
@@ -1,131 +0,0 @@
-//
-//  Concat.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Concatenates the second observable sequence to `self` upon successful termination of `self`.
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - parameter second: Second observable sequence.
-     - returns: An observable sequence that contains the elements of `self`, followed by those of the second sequence.
-     */
-    public func concat<Source: ObservableConvertibleType>(_ second: Source) -> Observable<Element> where Source.Element == Element {
-        Observable.concat([self.asObservable(), second.asObservable()])
-    }
-}
-
-extension ObservableType {
-    /**
-     Concatenates all observable sequences in the given sequence, as long as the previous observable sequence terminated successfully.
-
-     This operator has tail recursive optimizations that will prevent stack overflow.
-
-     Optimizations will be performed in cases equivalent to following:
-
-     [1, [2, [3, .....].concat()].concat].concat()
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat<Sequence: Swift.Sequence>(_ sequence: Sequence) -> Observable<Element>
-        where Sequence.Element == Observable<Element> {
-            return Concat(sources: sequence, count: nil)
-    }
-
-    /**
-     Concatenates all observable sequences in the given collection, as long as the previous observable sequence terminated successfully.
-
-     This operator has tail recursive optimizations that will prevent stack overflow.
-
-     Optimizations will be performed in cases equivalent to following:
-
-     [1, [2, [3, .....].concat()].concat].concat()
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat<Collection: Swift.Collection>(_ collection: Collection) -> Observable<Element>
-        where Collection.Element == Observable<Element> {
-            return Concat(sources: collection, count: Int64(collection.count))
-    }
-
-    /**
-     Concatenates all observable sequences in the given collection, as long as the previous observable sequence terminated successfully.
-
-     This operator has tail recursive optimizations that will prevent stack overflow.
-
-     Optimizations will be performed in cases equivalent to following:
-
-     [1, [2, [3, .....].concat()].concat].concat()
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat(_ sources: Observable<Element> ...) -> Observable<Element> {
-        Concat(sources: sources, count: Int64(sources.count))
-    }
-}
-
-final private class ConcatSink<Sequence: Swift.Sequence, Observer: ObserverType>
-    : TailRecursiveSink<Sequence, Observer>
-    , ObserverType where Sequence.Element: ObservableConvertibleType, Sequence.Element.Element == Observer.Element {
-    typealias Element = Observer.Element 
-    
-    override init(observer: Observer, cancel: Cancelable) {
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>){
-        switch event {
-        case .next:
-            self.forwardOn(event)
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            self.schedule(.moveNext)
-        }
-    }
-
-    override func subscribeToNext(_ source: Observable<Element>) -> Disposable {
-        source.subscribe(self)
-    }
-    
-    override func extract(_ observable: Observable<Element>) -> SequenceGenerator? {
-        if let source = observable as? Concat<Sequence> {
-            return (source.sources.makeIterator(), source.count)
-        }
-        else {
-            return nil
-        }
-    }
-}
-
-final private class Concat<Sequence: Swift.Sequence>: Producer<Sequence.Element.Element> where Sequence.Element: ObservableConvertibleType {
-    typealias Element = Sequence.Element.Element
-    
-    fileprivate let sources: Sequence
-    fileprivate let count: IntMax?
-
-    init(sources: Sequence, count: IntMax?) {
-        self.sources = sources
-        self.count = count
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = ConcatSink<Sequence, Observer>(observer: observer, cancel: cancel)
-        let subscription = sink.run((self.sources.makeIterator(), self.count))
-        return (sink: sink, subscription: subscription)
-    }
-}
-
diff --git a/Pods/RxSwift/RxSwift/Observables/Create.swift b/Pods/RxSwift/RxSwift/Observables/Create.swift
deleted file mode 100644
index ca81442ce..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Create.swift
+++ /dev/null
@@ -1,78 +0,0 @@
-//
-//  Create.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    // MARK: create
-
-    /**
-     Creates an observable sequence from a specified subscribe method implementation.
-
-     - seealso: [create operator on reactivex.io](http://reactivex.io/documentation/operators/create.html)
-
-     - parameter subscribe: Implementation of the resulting observable sequence's `subscribe` method.
-     - returns: The observable sequence with the specified implementation for the `subscribe` method.
-     */
-    public static func create(_ subscribe: @escaping (AnyObserver<Element>) -> Disposable) -> Observable<Element> {
-        AnonymousObservable(subscribe)
-    }
-}
-
-final private class AnonymousObservableSink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = AnonymousObservable<Element>
-
-    // state
-    private let isStopped = AtomicInt(0)
-
-    #if DEBUG
-        private let synchronizationTracker = SynchronizationTracker()
-    #endif
-
-    override init(observer: Observer, cancel: Cancelable) {
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func on(_ event: Event<Element>) {
-        #if DEBUG
-            self.synchronizationTracker.register(synchronizationErrorMessage: .default)
-            defer { self.synchronizationTracker.unregister() }
-        #endif
-        switch event {
-        case .next:
-            if load(self.isStopped) == 1 {
-                return
-            }
-            self.forwardOn(event)
-        case .error, .completed:
-            if fetchOr(self.isStopped, 1) == 0 {
-                self.forwardOn(event)
-                self.dispose()
-            }
-        }
-    }
-
-    func run(_ parent: Parent) -> Disposable {
-        parent.subscribeHandler(AnyObserver(self))
-    }
-}
-
-final private class AnonymousObservable<Element>: Producer<Element> {
-    typealias SubscribeHandler = (AnyObserver<Element>) -> Disposable
-
-    let subscribeHandler: SubscribeHandler
-
-    init(_ subscribeHandler: @escaping SubscribeHandler) {
-        self.subscribeHandler = subscribeHandler
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = AnonymousObservableSink(observer: observer, cancel: cancel)
-        let subscription = sink.run(self)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Debounce.swift b/Pods/RxSwift/RxSwift/Observables/Debounce.swift
deleted file mode 100644
index dfab00454..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Debounce.swift
+++ /dev/null
@@ -1,119 +0,0 @@
-//
-//  Debounce.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 9/11/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Ignores elements from an observable sequence which are followed by another element within a specified relative time duration, using the specified scheduler to run throttling timers.
-
-     - seealso: [debounce operator on reactivex.io](http://reactivex.io/documentation/operators/debounce.html)
-
-     - parameter dueTime: Throttling duration for each element.
-     - parameter scheduler: Scheduler to run the throttle timers on.
-     - returns: The throttled sequence.
-     */
-    public func debounce(_ dueTime: RxTimeInterval, scheduler: SchedulerType)
-        -> Observable<Element> {
-            return Debounce(source: self.asObservable(), dueTime: dueTime, scheduler: scheduler)
-    }
-}
-
-final private class DebounceSink<Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias Element = Observer.Element 
-    typealias ParentType = Debounce<Element>
-
-    private let parent: ParentType
-
-    let lock = RecursiveLock()
-
-    // state
-    private var id = 0 as UInt64
-    private var value: Element?
-
-    let cancellable = SerialDisposable()
-
-    init(parent: ParentType, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let subscription = self.parent.source.subscribe(self)
-
-        return Disposables.create(subscription, cancellable)
-    }
-
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next(let element):
-            self.id = self.id &+ 1
-            let currentId = self.id
-            self.value = element
-
-
-            let scheduler = self.parent.scheduler
-            let dueTime = self.parent.dueTime
-
-            let d = SingleAssignmentDisposable()
-            self.cancellable.disposable = d
-            d.setDisposable(scheduler.scheduleRelative(currentId, dueTime: dueTime, action: self.propagate))
-        case .error:
-            self.value = nil
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            if let value = self.value {
-                self.value = nil
-                self.forwardOn(.next(value))
-            }
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-
-    func propagate(_ currentId: UInt64) -> Disposable {
-        self.lock.performLocked {
-            let originalValue = self.value
-
-            if let value = originalValue, self.id == currentId {
-                self.value = nil
-                self.forwardOn(.next(value))
-            }
-
-            return Disposables.create()
-        }
-    }
-}
-
-final private class Debounce<Element>: Producer<Element> {
-    fileprivate let source: Observable<Element>
-    fileprivate let dueTime: RxTimeInterval
-    fileprivate let scheduler: SchedulerType
-
-    init(source: Observable<Element>, dueTime: RxTimeInterval, scheduler: SchedulerType) {
-        self.source = source
-        self.dueTime = dueTime
-        self.scheduler = scheduler
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = DebounceSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-    
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Debug.swift b/Pods/RxSwift/RxSwift/Observables/Debug.swift
deleted file mode 100644
index 762e394fc..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Debug.swift
+++ /dev/null
@@ -1,102 +0,0 @@
-//
-//  Debug.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 5/2/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-extension ObservableType {
-
-    /**
-     Prints received events for all observers on standard output.
-
-     - seealso: [do operator on reactivex.io](http://reactivex.io/documentation/operators/do.html)
-
-     - parameter identifier: Identifier that is printed together with event description to standard output.
-     - parameter trimOutput: Should output be trimmed to max 40 characters.
-     - returns: An observable sequence whose events are printed to standard output.
-     */
-    public func debug(_ identifier: String? = nil, trimOutput: Bool = false, file: String = #file, line: UInt = #line, function: String = #function)
-        -> Observable<Element> {
-            return Debug(source: self, identifier: identifier, trimOutput: trimOutput, file: file, line: line, function: function)
-    }
-}
-
-private let dateFormat = "yyyy-MM-dd HH:mm:ss.SSS"
-
-private func logEvent(_ identifier: String, dateFormat: DateFormatter, content: String) {
-    print("\(dateFormat.string(from: Date())): \(identifier) -> \(content)")
-}
-
-final private class DebugSink<Source: ObservableType, Observer: ObserverType>: Sink<Observer>, ObserverType where Observer.Element == Source.Element {
-    typealias Element = Observer.Element 
-    typealias Parent = Debug<Source>
-    
-    private let parent: Parent
-    private let timestampFormatter = DateFormatter()
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.timestampFormatter.dateFormat = dateFormat
-
-        logEvent(self.parent.identifier, dateFormat: self.timestampFormatter, content: "subscribed")
-
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        let maxEventTextLength = 40
-        let eventText = "\(event)"
-
-        let eventNormalized = (eventText.count > maxEventTextLength) && self.parent.trimOutput
-            ? String(eventText.prefix(maxEventTextLength / 2)) + "..." + String(eventText.suffix(maxEventTextLength / 2))
-            : eventText
-
-        logEvent(self.parent.identifier, dateFormat: self.timestampFormatter, content: "Event \(eventNormalized)")
-
-        self.forwardOn(event)
-        if event.isStopEvent {
-            self.dispose()
-        }
-    }
-    
-    override func dispose() {
-        if !self.isDisposed {
-            logEvent(self.parent.identifier, dateFormat: self.timestampFormatter, content: "isDisposed")
-        }
-        super.dispose()
-    }
-}
-
-final private class Debug<Source: ObservableType>: Producer<Source.Element> {
-    fileprivate let identifier: String
-    fileprivate let trimOutput: Bool
-    private let source: Source
-
-    init(source: Source, identifier: String?, trimOutput: Bool, file: String, line: UInt, function: String) {
-        self.trimOutput = trimOutput
-        if let identifier = identifier {
-            self.identifier = identifier
-        }
-        else {
-            let trimmedFile: String
-            if let lastIndex = file.lastIndex(of: "/") {
-                trimmedFile = String(file[file.index(after: lastIndex) ..< file.endIndex])
-            }
-            else {
-                trimmedFile = file
-            }
-            self.identifier = "\(trimmedFile):\(line) (\(function))"
-        }
-        self.source = source
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Source.Element {
-        let sink = DebugSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Decode.swift b/Pods/RxSwift/RxSwift/Observables/Decode.swift
deleted file mode 100644
index 8bc73425d..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Decode.swift
+++ /dev/null
@@ -1,34 +0,0 @@
-//
-//  Decode.swift
-//  RxSwift
-//
-//  Created by Shai Mishali on 24/07/2020.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-public extension ObservableType where Element == Data {
-  /// Attempt to decode the emitted `Data` using a provided decoder.
-  ///
-  /// - parameter type: A `Decodable`-conforming type to attempt to decode to
-  /// - parameter decoder: A capable decoder, e.g. `JSONDecoder` or `PropertyListDecoder`
-  ///
-  /// - note: If using a custom decoder, it must conform to the `DataDecoder` protocol.
-  ///
-  /// - returns: An `Observable` of the decoded type
-  func decode<Item: Decodable,
-              Decoder: DataDecoder>(type: Item.Type,
-                                    decoder: Decoder) -> Observable<Item> {
-    map { try decoder.decode(type, from: $0) }
-  }
-}
-
-/// Represents an entity capable of decoding raw `Data`
-/// into a concrete `Decodable` type
-public protocol DataDecoder {
-  func decode<Item: Decodable>(_ type: Item.Type, from data: Data) throws -> Item
-}
-
-extension JSONDecoder: DataDecoder {}
-extension PropertyListDecoder: DataDecoder {}
diff --git a/Pods/RxSwift/RxSwift/Observables/DefaultIfEmpty.swift b/Pods/RxSwift/RxSwift/Observables/DefaultIfEmpty.swift
deleted file mode 100644
index 8d133d8f8..000000000
--- a/Pods/RxSwift/RxSwift/Observables/DefaultIfEmpty.swift
+++ /dev/null
@@ -1,66 +0,0 @@
-//
-//  DefaultIfEmpty.swift
-//  RxSwift
-//
-//  Created by sergdort on 23/12/2016.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Emits elements from the source observable sequence, or a default element if the source observable sequence is empty.
-
-     - seealso: [DefaultIfEmpty operator on reactivex.io](http://reactivex.io/documentation/operators/defaultifempty.html)
-
-     - parameter default: Default element to be sent if the source does not emit any elements
-     - returns: An observable sequence which emits default element end completes in case the original sequence is empty
-     */
-    public func ifEmpty(default: Element) -> Observable<Element> {
-        DefaultIfEmpty(source: self.asObservable(), default: `default`)
-    }
-}
-
-final private class DefaultIfEmptySink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    private let `default`: Element
-    private var isEmpty = true
-    
-    init(default: Element, observer: Observer, cancel: Cancelable) {
-        self.default = `default`
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.isEmpty = false
-            self.forwardOn(event)
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            if self.isEmpty {
-                self.forwardOn(.next(self.default))
-            }
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final private class DefaultIfEmpty<SourceType>: Producer<SourceType> {
-    private let source: Observable<SourceType>
-    private let `default`: SourceType
-    
-    init(source: Observable<SourceType>, `default`: SourceType) {
-        self.source = source
-        self.default = `default`
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == SourceType {
-        let sink = DefaultIfEmptySink(default: self.default, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Deferred.swift b/Pods/RxSwift/RxSwift/Observables/Deferred.swift
deleted file mode 100644
index b81cb1669..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Deferred.swift
+++ /dev/null
@@ -1,75 +0,0 @@
-//
-//  Deferred.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 4/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Returns an observable sequence that invokes the specified factory function whenever a new observer subscribes.
-
-     - seealso: [defer operator on reactivex.io](http://reactivex.io/documentation/operators/defer.html)
-
-     - parameter observableFactory: Observable factory function to invoke for each observer that subscribes to the resulting sequence.
-     - returns: An observable sequence whose observers trigger an invocation of the given observable factory function.
-     */
-    public static func deferred(_ observableFactory: @escaping () throws -> Observable<Element>)
-        -> Observable<Element> {
-        Deferred(observableFactory: observableFactory)
-    }
-}
-
-final private class DeferredSink<Source: ObservableType, Observer: ObserverType>: Sink<Observer>, ObserverType where Source.Element == Observer.Element {
-    typealias Element = Observer.Element 
-
-    private let observableFactory: () throws -> Source
-
-    init(observableFactory: @escaping () throws -> Source, observer: Observer, cancel: Cancelable) {
-        self.observableFactory = observableFactory
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        do {
-            let result = try self.observableFactory()
-            return result.subscribe(self)
-        }
-        catch let e {
-            self.forwardOn(.error(e))
-            self.dispose()
-            return Disposables.create()
-        }
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.forwardOn(event)
-        
-        switch event {
-        case .next:
-            break
-        case .error:
-            self.dispose()
-        case .completed:
-            self.dispose()
-        }
-    }
-}
-
-final private class Deferred<Source: ObservableType>: Producer<Source.Element> {
-    typealias Factory = () throws -> Source
-    
-    private let observableFactory : Factory
-    
-    init(observableFactory: @escaping Factory) {
-        self.observableFactory = observableFactory
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable)
-             where Observer.Element == Source.Element {
-        let sink = DeferredSink(observableFactory: self.observableFactory, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Delay.swift b/Pods/RxSwift/RxSwift/Observables/Delay.swift
deleted file mode 100644
index 9f71c32d0..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Delay.swift
+++ /dev/null
@@ -1,174 +0,0 @@
-//
-//  Delay.swift
-//  RxSwift
-//
-//  Created by tarunon on 2016/02/09.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-extension ObservableType {
-
-    /**
-     Returns an observable sequence by the source observable sequence shifted forward in time by a specified delay. Error events from the source observable sequence are not delayed.
-
-     - seealso: [delay operator on reactivex.io](http://reactivex.io/documentation/operators/delay.html)
-
-     - parameter dueTime: Relative time shift of the source by.
-     - parameter scheduler: Scheduler to run the subscription delay timer on.
-     - returns: the source Observable shifted in time by the specified delay.
-     */
-    public func delay(_ dueTime: RxTimeInterval, scheduler: SchedulerType)
-        -> Observable<Element> {
-            return Delay(source: self.asObservable(), dueTime: dueTime, scheduler: scheduler)
-    }
-}
-
-final private class DelaySink<Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType {
-    typealias Element = Observer.Element 
-    typealias Source = Observable<Element>
-    typealias DisposeKey = Bag<Disposable>.KeyType
-    
-    private let lock = RecursiveLock()
-
-    private let dueTime: RxTimeInterval
-    private let scheduler: SchedulerType
-    
-    private let sourceSubscription = SingleAssignmentDisposable()
-    private let cancelable = SerialDisposable()
-
-    // is scheduled some action
-    private var active = false
-    // is "run loop" on different scheduler running
-    private var running = false
-    private var errorEvent: Event<Element>?
-
-    // state
-    private var queue = Queue<(eventTime: RxTime, event: Event<Element>)>(capacity: 0)
-    
-    init(observer: Observer, dueTime: RxTimeInterval, scheduler: SchedulerType, cancel: Cancelable) {
-        self.dueTime = dueTime
-        self.scheduler = scheduler
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    // All of these complications in this method are caused by the fact that 
-    // error should be propagated immediately. Error can be potentially received on different
-    // scheduler so this process needs to be synchronized somehow.
-    //
-    // Another complication is that scheduler is potentially concurrent so internal queue is used.
-    func drainQueue(state: (), scheduler: AnyRecursiveScheduler<()>) {
-        self.lock.lock()    
-        let hasFailed = self.errorEvent != nil
-        if !hasFailed {
-            self.running = true
-        }
-        self.lock.unlock()  
-
-        if hasFailed {
-            return
-        }
-
-        var ranAtLeastOnce = false
-
-        while true {
-            self.lock.lock() 
-            let errorEvent = self.errorEvent
-
-            let eventToForwardImmediately = ranAtLeastOnce ? nil : self.queue.dequeue()?.event
-            let nextEventToScheduleOriginalTime: Date? = ranAtLeastOnce && !self.queue.isEmpty ? self.queue.peek().eventTime : nil
-
-            if errorEvent == nil {
-                if eventToForwardImmediately != nil {
-                }
-                else if nextEventToScheduleOriginalTime != nil {
-                    self.running = false
-                }
-                else {
-                    self.running = false
-                    self.active = false
-                }
-            }
-            self.lock.unlock() 
-
-            if let errorEvent = errorEvent {
-                self.forwardOn(errorEvent)
-                self.dispose()
-                return
-            }
-            else {
-                if let eventToForwardImmediately = eventToForwardImmediately {
-                    ranAtLeastOnce = true
-                    self.forwardOn(eventToForwardImmediately)
-                    if case .completed = eventToForwardImmediately {
-                        self.dispose()
-                        return
-                    }
-                }
-                else if let nextEventToScheduleOriginalTime = nextEventToScheduleOriginalTime {
-                    scheduler.schedule((), dueTime: self.dueTime.reduceWithSpanBetween(earlierDate: nextEventToScheduleOriginalTime, laterDate: self.scheduler.now))
-                    return
-                }
-                else {
-                    return
-                }
-            }
-        }
-    }
-    
-    func on(_ event: Event<Element>) {
-        if event.isStopEvent {
-            self.sourceSubscription.dispose()
-        }
-
-        switch event {
-        case .error:
-            self.lock.lock()    
-            let shouldSendImmediately = !self.running
-            self.queue = Queue(capacity: 0)
-            self.errorEvent = event
-            self.lock.unlock()  
-
-            if shouldSendImmediately {
-                self.forwardOn(event)
-                self.dispose()
-            }
-        default:
-            self.lock.lock()    
-            let shouldSchedule = !self.active
-            self.active = true
-            self.queue.enqueue((self.scheduler.now, event))
-            self.lock.unlock()  
-
-            if shouldSchedule {
-                self.cancelable.disposable = self.scheduler.scheduleRecursive((), dueTime: self.dueTime, action: self.drainQueue)
-            }
-        }
-    }
-    
-    func run(source: Observable<Element>) -> Disposable {
-        self.sourceSubscription.setDisposable(source.subscribe(self))
-        return Disposables.create(sourceSubscription, cancelable)
-    }
-}
-
-final private class Delay<Element>: Producer<Element> {
-    private let source: Observable<Element>
-    private let dueTime: RxTimeInterval
-    private let scheduler: SchedulerType
-    
-    init(source: Observable<Element>, dueTime: RxTimeInterval, scheduler: SchedulerType) {
-        self.source = source
-        self.dueTime = dueTime
-        self.scheduler = scheduler
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = DelaySink(observer: observer, dueTime: self.dueTime, scheduler: self.scheduler, cancel: cancel)
-        let subscription = sink.run(source: self.source)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/DelaySubscription.swift b/Pods/RxSwift/RxSwift/Observables/DelaySubscription.swift
deleted file mode 100644
index fd8c4951f..000000000
--- a/Pods/RxSwift/RxSwift/Observables/DelaySubscription.swift
+++ /dev/null
@@ -1,58 +0,0 @@
-//
-//  DelaySubscription.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Time shifts the observable sequence by delaying the subscription with the specified relative time duration, using the specified scheduler to run timers.
-
-     - seealso: [delay operator on reactivex.io](http://reactivex.io/documentation/operators/delay.html)
-
-     - parameter dueTime: Relative time shift of the subscription.
-     - parameter scheduler: Scheduler to run the subscription delay timer on.
-     - returns: Time-shifted sequence.
-     */
-    public func delaySubscription(_ dueTime: RxTimeInterval, scheduler: SchedulerType)
-        -> Observable<Element> {
-        DelaySubscription(source: self.asObservable(), dueTime: dueTime, scheduler: scheduler)
-    }
-}
-
-final private class DelaySubscriptionSink<Observer: ObserverType>
-    : Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    
-    func on(_ event: Event<Element>) {
-        self.forwardOn(event)
-        if event.isStopEvent {
-            self.dispose()
-        }
-    }
-    
-}
-
-final private class DelaySubscription<Element>: Producer<Element> {
-    private let source: Observable<Element>
-    private let dueTime: RxTimeInterval
-    private let scheduler: SchedulerType
-    
-    init(source: Observable<Element>, dueTime: RxTimeInterval, scheduler: SchedulerType) {
-        self.source = source
-        self.dueTime = dueTime
-        self.scheduler = scheduler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = DelaySubscriptionSink(observer: observer, cancel: cancel)
-        let subscription = self.scheduler.scheduleRelative((), dueTime: self.dueTime) { _ in
-            return self.source.subscribe(sink)
-        }
-
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Dematerialize.swift b/Pods/RxSwift/RxSwift/Observables/Dematerialize.swift
deleted file mode 100644
index 2ccd54620..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Dematerialize.swift
+++ /dev/null
@@ -1,51 +0,0 @@
-//
-//  Dematerialize.swift
-//  RxSwift
-//
-//  Created by Jamie Pinkham on 3/13/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType where Element: EventConvertible {
-    /**
-     Convert any previously materialized Observable into it's original form.
-     - seealso: [materialize operator on reactivex.io](http://reactivex.io/documentation/operators/materialize-dematerialize.html)
-     - returns: The dematerialized observable sequence.
-     */
-    public func dematerialize() -> Observable<Element.Element> {
-        Dematerialize(source: self.asObservable())
-    }
-
-}
-
-private final class DematerializeSink<T: EventConvertible, Observer: ObserverType>: Sink<Observer>, ObserverType where Observer.Element == T.Element {
-    fileprivate func on(_ event: Event<T>) {
-        switch event {
-        case .next(let element):
-            self.forwardOn(element.event)
-            if element.event.isStopEvent {
-                self.dispose()
-            }
-        case .completed:
-            self.forwardOn(.completed)
-            self.dispose()
-        case .error(let error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        }
-    }
-}
-
-final private class Dematerialize<T: EventConvertible>: Producer<T.Element> {
-    private let source: Observable<T>
-
-    init(source: Observable<T>) {
-        self.source = source
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == T.Element {
-        let sink = DematerializeSink<T, Observer>(observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/DistinctUntilChanged.swift b/Pods/RxSwift/RxSwift/Observables/DistinctUntilChanged.swift
deleted file mode 100644
index c127b5aa5..000000000
--- a/Pods/RxSwift/RxSwift/Observables/DistinctUntilChanged.swift
+++ /dev/null
@@ -1,137 +0,0 @@
-//
-//  DistinctUntilChanged.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType where Element: Equatable {
-
-    /**
-     Returns an observable sequence that contains only distinct contiguous elements according to equality operator.
-
-     - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-     - returns: An observable sequence only containing the distinct contiguous elements, based on equality operator, from the source sequence.
-     */
-    public func distinctUntilChanged()
-        -> Observable<Element> {
-        self.distinctUntilChanged({ $0 }, comparer: { ($0 == $1) })
-    }
-}
-
-extension ObservableType {
-    /**
-     Returns an observable sequence that contains only distinct contiguous elements according to the `keySelector`.
-
-     - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-     - parameter keySelector: A function to compute the comparison key for each element.
-     - returns: An observable sequence only containing the distinct contiguous elements, based on a computed key value, from the source sequence.
-     */
-    public func distinctUntilChanged<Key: Equatable>(_ keySelector: @escaping (Element) throws -> Key)
-        -> Observable<Element> {
-        self.distinctUntilChanged(keySelector, comparer: { $0 == $1 })
-    }
-
-    /**
-     Returns an observable sequence that contains only distinct contiguous elements according to the `comparer`.
-
-     - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-     - parameter comparer: Equality comparer for computed key values.
-     - returns: An observable sequence only containing the distinct contiguous elements, based on `comparer`, from the source sequence.
-     */
-    public func distinctUntilChanged(_ comparer: @escaping (Element, Element) throws -> Bool)
-        -> Observable<Element> {
-        self.distinctUntilChanged({ $0 }, comparer: comparer)
-    }
-
-    /**
-     Returns an observable sequence that contains only distinct contiguous elements according to the keySelector and the comparer.
-
-     - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-     - parameter keySelector: A function to compute the comparison key for each element.
-     - parameter comparer: Equality comparer for computed key values.
-     - returns: An observable sequence only containing the distinct contiguous elements, based on a computed key value and the comparer, from the source sequence.
-     */
-    public func distinctUntilChanged<K>(_ keySelector: @escaping (Element) throws -> K, comparer: @escaping (K, K) throws -> Bool)
-        -> Observable<Element> {
-            return DistinctUntilChanged(source: self.asObservable(), selector: keySelector, comparer: comparer)
-    }
-
-    /**
-    Returns an observable sequence that contains only contiguous elements with distinct values in the provided key path on each object.
-
-    - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-    - returns: An observable sequence only containing the distinct contiguous elements, based on equality operator on the provided key path
-    */
-    public func distinctUntilChanged<Property: Equatable>(at keyPath: KeyPath<Element, Property>) ->
-        Observable<Element> {
-        self.distinctUntilChanged { $0[keyPath: keyPath] == $1[keyPath: keyPath] }
-    }
-}
-
-final private class DistinctUntilChangedSink<Observer: ObserverType, Key>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    
-    private let parent: DistinctUntilChanged<Element, Key>
-    private var currentKey: Key?
-    
-    init(parent: DistinctUntilChanged<Element, Key>, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            do {
-                let key = try self.parent.selector(value)
-                var areEqual = false
-                if let currentKey = self.currentKey {
-                    areEqual = try self.parent.comparer(currentKey, key)
-                }
-                
-                if areEqual {
-                    return
-                }
-                
-                self.currentKey = key
-                
-                self.forwardOn(event)
-            }
-            catch let error {
-                self.forwardOn(.error(error))
-                self.dispose()
-            }
-        case .error, .completed:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-}
-
-final private class DistinctUntilChanged<Element, Key>: Producer<Element> {
-    typealias KeySelector = (Element) throws -> Key
-    typealias EqualityComparer = (Key, Key) throws -> Bool
-    
-    private let source: Observable<Element>
-    fileprivate let selector: KeySelector
-    fileprivate let comparer: EqualityComparer
-    
-    init(source: Observable<Element>, selector: @escaping KeySelector, comparer: @escaping EqualityComparer) {
-        self.source = source
-        self.selector = selector
-        self.comparer = comparer
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = DistinctUntilChangedSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Do.swift b/Pods/RxSwift/RxSwift/Observables/Do.swift
deleted file mode 100644
index 3c8c68b3d..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Do.swift
+++ /dev/null
@@ -1,112 +0,0 @@
-//
-//  Do.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Invokes an action for each event in the observable sequence, and propagates all observer messages through the result sequence.
-
-     - seealso: [do operator on reactivex.io](http://reactivex.io/documentation/operators/do.html)
-
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter afterNext: Action to invoke for each element after the observable has passed an onNext event along to its downstream.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter afterError: Action to invoke after errored termination of the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter afterCompleted: Action to invoke after graceful termination of the observable sequence.
-     - parameter onSubscribe: Action to invoke before subscribing to source observable sequence.
-     - parameter onSubscribed: Action to invoke after subscribing to source observable sequence.
-     - parameter onDispose: Action to invoke after subscription to source observable has been disposed for any reason. It can be either because sequence terminates for some reason or observer subscription being disposed.
-     - returns: The source sequence with the side-effecting behavior applied.
-     */
-    public func `do`(onNext: ((Element) throws -> Void)? = nil, afterNext: ((Element) throws -> Void)? = nil, onError: ((Swift.Error) throws -> Void)? = nil, afterError: ((Swift.Error) throws -> Void)? = nil, onCompleted: (() throws -> Void)? = nil, afterCompleted: (() throws -> Void)? = nil, onSubscribe: (() -> Void)? = nil, onSubscribed: (() -> Void)? = nil, onDispose: (() -> Void)? = nil)
-        -> Observable<Element> {
-            return Do(source: self.asObservable(), eventHandler: { e in
-                switch e {
-                case .next(let element):
-                    try onNext?(element)
-                case .error(let e):
-                    try onError?(e)
-                case .completed:
-                    try onCompleted?()
-                }
-            }, afterEventHandler: { e in
-                switch e {
-                case .next(let element):
-                    try afterNext?(element)
-                case .error(let e):
-                    try afterError?(e)
-                case .completed:
-                    try afterCompleted?()
-                }
-            }, onSubscribe: onSubscribe, onSubscribed: onSubscribed, onDispose: onDispose)
-    }
-}
-
-final private class DoSink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    typealias EventHandler = (Event<Element>) throws -> Void
-    typealias AfterEventHandler = (Event<Element>) throws -> Void
-    
-    private let eventHandler: EventHandler
-    private let afterEventHandler: AfterEventHandler
-    
-    init(eventHandler: @escaping EventHandler, afterEventHandler: @escaping AfterEventHandler, observer: Observer, cancel: Cancelable) {
-        self.eventHandler = eventHandler
-        self.afterEventHandler = afterEventHandler
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        do {
-            try self.eventHandler(event)
-            self.forwardOn(event)
-            try self.afterEventHandler(event)
-            if event.isStopEvent {
-                self.dispose()
-            }
-        }
-        catch let error {
-            self.forwardOn(.error(error))
-            self.dispose()
-        }
-    }
-}
-
-final private class Do<Element>: Producer<Element> {
-    typealias EventHandler = (Event<Element>) throws -> Void
-    typealias AfterEventHandler = (Event<Element>) throws -> Void
-    
-    private let source: Observable<Element>
-    private let eventHandler: EventHandler
-    private let afterEventHandler: AfterEventHandler
-    private let onSubscribe: (() -> Void)?
-    private let onSubscribed: (() -> Void)?
-    private let onDispose: (() -> Void)?
-    
-    init(source: Observable<Element>, eventHandler: @escaping EventHandler, afterEventHandler: @escaping AfterEventHandler, onSubscribe: (() -> Void)?, onSubscribed: (() -> Void)?, onDispose: (() -> Void)?) {
-        self.source = source
-        self.eventHandler = eventHandler
-        self.afterEventHandler = afterEventHandler
-        self.onSubscribe = onSubscribe
-        self.onSubscribed = onSubscribed
-        self.onDispose = onDispose
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        self.onSubscribe?()
-        let sink = DoSink(eventHandler: self.eventHandler, afterEventHandler: self.afterEventHandler, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        self.onSubscribed?()
-        let onDispose = self.onDispose
-        let allSubscriptions = Disposables.create {
-            subscription.dispose()
-            onDispose?()
-        }
-        return (sink: sink, subscription: allSubscriptions)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/ElementAt.swift b/Pods/RxSwift/RxSwift/Observables/ElementAt.swift
deleted file mode 100644
index 3f09c7087..000000000
--- a/Pods/RxSwift/RxSwift/Observables/ElementAt.swift
+++ /dev/null
@@ -1,105 +0,0 @@
-//
-//  ElementAt.swift
-//  RxSwift
-//
-//  Created by Junior B. on 21/10/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Returns a sequence emitting only element _n_ emitted by an Observable
-
-     - seealso: [elementAt operator on reactivex.io](http://reactivex.io/documentation/operators/elementat.html)
-
-     - parameter index: The index of the required element (starting from 0).
-     - returns: An observable sequence that emits the desired element as its own sole emission.
-     */
-    @available(*, deprecated, renamed: "element(at:)")
-    public func elementAt(_ index: Int)
-        -> Observable<Element> {
-        element(at: index)
-    }
-
-    /**
-     Returns a sequence emitting only element _n_ emitted by an Observable
-
-     - seealso: [elementAt operator on reactivex.io](http://reactivex.io/documentation/operators/elementat.html)
-
-     - parameter index: The index of the required element (starting from 0).
-     - returns: An observable sequence that emits the desired element as its own sole emission.
-     */
-    public func element(at index: Int)
-        -> Observable<Element> {
-        ElementAt(source: self.asObservable(), index: index, throwOnEmpty: true)
-    }
-}
-
-final private class ElementAtSink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias SourceType = Observer.Element
-    typealias Parent = ElementAt<SourceType>
-    
-    let parent: Parent
-    var i: Int
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.i = parent.index
-        
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<SourceType>) {
-        switch event {
-        case .next:
-
-            if self.i == 0 {
-                self.forwardOn(event)
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-            
-            do {
-                _ = try decrementChecked(&self.i)
-            } catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-                return
-            }
-            
-        case .error(let e):
-            self.forwardOn(.error(e))
-            self.dispose()
-        case .completed:
-            if self.parent.throwOnEmpty {
-                self.forwardOn(.error(RxError.argumentOutOfRange))
-            } else {
-                self.forwardOn(.completed)
-            }
-            
-            self.dispose()
-        }
-    }
-}
-
-final private class ElementAt<SourceType>: Producer<SourceType> {
-    let source: Observable<SourceType>
-    let throwOnEmpty: Bool
-    let index: Int
-    
-    init(source: Observable<SourceType>, index: Int, throwOnEmpty: Bool) {
-        if index < 0 {
-            rxFatalError("index can't be negative")
-        }
-
-        self.source = source
-        self.index = index
-        self.throwOnEmpty = throwOnEmpty
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == SourceType {
-        let sink = ElementAtSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Empty.swift b/Pods/RxSwift/RxSwift/Observables/Empty.swift
deleted file mode 100644
index 9ca596594..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Empty.swift
+++ /dev/null
@@ -1,27 +0,0 @@
-//
-//  Empty.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 8/30/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Returns an empty observable sequence, using the specified scheduler to send out the single `Completed` message.
-
-     - seealso: [empty operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: An observable sequence with no elements.
-     */
-    public static func empty() -> Observable<Element> {
-        EmptyProducer<Element>()
-    }
-}
-
-final private class EmptyProducer<Element>: Producer<Element> {
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        observer.on(.completed)
-        return Disposables.create()
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Enumerated.swift b/Pods/RxSwift/RxSwift/Observables/Enumerated.swift
deleted file mode 100644
index ef8a0ff02..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Enumerated.swift
+++ /dev/null
@@ -1,61 +0,0 @@
-//
-//  Enumerated.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 8/6/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Enumerates the elements of an observable sequence.
-
-     - seealso: [map operator on reactivex.io](http://reactivex.io/documentation/operators/map.html)
-
-     - returns: An observable sequence that contains tuples of source sequence elements and their indexes.
-     */
-    public func enumerated()
-        -> Observable<(index: Int, element: Element)> {
-        Enumerated(source: self.asObservable())
-    }
-}
-
-final private class EnumeratedSink<Element, Observer: ObserverType>: Sink<Observer>, ObserverType where Observer.Element == (index: Int, element: Element) {
-    var index = 0
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            do {
-                let nextIndex = try incrementChecked(&self.index)
-                let next = (index: nextIndex, element: value)
-                self.forwardOn(.next(next))
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        case .completed:
-            self.forwardOn(.completed)
-            self.dispose()
-        case .error(let error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        }
-    }
-}
-
-final private class Enumerated<Element>: Producer<(index: Int, element: Element)> {
-    private let source: Observable<Element>
-
-    init(source: Observable<Element>) {
-        self.source = source
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == (index: Int, element: Element) {
-        let sink = EnumeratedSink<Element, Observer>(observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Error.swift b/Pods/RxSwift/RxSwift/Observables/Error.swift
deleted file mode 100644
index 2e722d670..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Error.swift
+++ /dev/null
@@ -1,33 +0,0 @@
-//
-//  Error.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 8/30/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Returns an observable sequence that terminates with an `error`.
-
-     - seealso: [throw operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: The observable sequence that terminates with specified error.
-     */
-    public static func error(_ error: Swift.Error) -> Observable<Element> {
-        ErrorProducer(error: error)
-    }
-}
-
-final private class ErrorProducer<Element>: Producer<Element> {
-    private let error: Swift.Error
-    
-    init(error: Swift.Error) {
-        self.error = error
-    }
-    
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        observer.on(.error(self.error))
-        return Disposables.create()
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Filter.swift b/Pods/RxSwift/RxSwift/Observables/Filter.swift
deleted file mode 100644
index 61d3ce793..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Filter.swift
+++ /dev/null
@@ -1,86 +0,0 @@
-//
-//  Filter.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/17/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Filters the elements of an observable sequence based on a predicate.
-
-     - seealso: [filter operator on reactivex.io](http://reactivex.io/documentation/operators/filter.html)
-
-     - parameter predicate: A function to test each source element for a condition.
-     - returns: An observable sequence that contains elements from the input sequence that satisfy the condition.
-     */
-    public func filter(_ predicate: @escaping (Element) throws -> Bool)
-        -> Observable<Element> {
-        Filter(source: self.asObservable(), predicate: predicate)
-    }
-}
-
-extension ObservableType {
-    /**
-     Skips elements and completes (or errors) when the observable sequence completes (or errors). Equivalent to filter that always returns false.
-
-     - seealso: [ignoreElements operator on reactivex.io](http://reactivex.io/documentation/operators/ignoreelements.html)
-
-     - returns: An observable sequence that skips all elements of the source sequence.
-     */
-    public func ignoreElements()
-        -> Observable<Never> {
-        self.flatMap { _ in Observable<Never>.empty() }
-    }
-}
-
-final private class FilterSink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Predicate = (Element) throws -> Bool
-    typealias Element = Observer.Element
-    
-    private let predicate: Predicate
-    
-    init(predicate: @escaping Predicate, observer: Observer, cancel: Cancelable) {
-        self.predicate = predicate
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            do {
-                let satisfies = try self.predicate(value)
-                if satisfies {
-                    self.forwardOn(.next(value))
-                }
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        case .completed, .error:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-}
-
-final private class Filter<Element>: Producer<Element> {
-    typealias Predicate = (Element) throws -> Bool
-    
-    private let source: Observable<Element>
-    private let predicate: Predicate
-    
-    init(source: Observable<Element>, predicate: @escaping Predicate) {
-        self.source = source
-        self.predicate = predicate
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = FilterSink(predicate: self.predicate, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/First.swift b/Pods/RxSwift/RxSwift/Observables/First.swift
deleted file mode 100644
index 001411485..000000000
--- a/Pods/RxSwift/RxSwift/Observables/First.swift
+++ /dev/null
@@ -1,41 +0,0 @@
-//
-//  First.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 7/31/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-private final class FirstSink<Element, Observer: ObserverType> : Sink<Observer>, ObserverType where Observer.Element == Element? {
-    typealias Parent = First<Element>
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            self.forwardOn(.next(value))
-            self.forwardOn(.completed)
-            self.dispose()
-        case .error(let error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            self.forwardOn(.next(nil))
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final class First<Element>: Producer<Element?> {
-    private let source: Observable<Element>
-
-    init(source: Observable<Element>) {
-        self.source = source
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element? {
-        let sink = FirstSink(observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Generate.swift b/Pods/RxSwift/RxSwift/Observables/Generate.swift
deleted file mode 100644
index 7b924b381..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Generate.swift
+++ /dev/null
@@ -1,87 +0,0 @@
-//
-//  Generate.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 9/2/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Generates an observable sequence by running a state-driven loop producing the sequence's elements, using the specified scheduler
-     to run the loop send out observer messages.
-
-     - seealso: [create operator on reactivex.io](http://reactivex.io/documentation/operators/create.html)
-
-     - parameter initialState: Initial state.
-     - parameter condition: Condition to terminate generation (upon returning `false`).
-     - parameter iterate: Iteration step function.
-     - parameter scheduler: Scheduler on which to run the generator loop.
-     - returns: The generated sequence.
-     */
-    public static func generate(initialState: Element, condition: @escaping (Element) throws -> Bool, scheduler: ImmediateSchedulerType = CurrentThreadScheduler.instance, iterate: @escaping (Element) throws -> Element) -> Observable<Element> {
-        Generate(initialState: initialState, condition: condition, iterate: iterate, resultSelector: { $0 }, scheduler: scheduler)
-    }
-}
-
-final private class GenerateSink<Sequence, Observer: ObserverType>: Sink<Observer> {
-    typealias Parent = Generate<Sequence, Observer.Element>
-    
-    private let parent: Parent
-    
-    private var state: Sequence
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.state = parent.initialState
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        return self.parent.scheduler.scheduleRecursive(true) { isFirst, recurse -> Void in
-            do {
-                if !isFirst {
-                    self.state = try self.parent.iterate(self.state)
-                }
-                
-                if try self.parent.condition(self.state) {
-                    let result = try self.parent.resultSelector(self.state)
-                    self.forwardOn(.next(result))
-                    
-                    recurse(false)
-                }
-                else {
-                    self.forwardOn(.completed)
-                    self.dispose()
-                }
-            }
-            catch let error {
-                self.forwardOn(.error(error))
-                self.dispose()
-            }
-        }
-    }
-}
-
-final private class Generate<Sequence, Element>: Producer<Element> {
-    fileprivate let initialState: Sequence
-    fileprivate let condition: (Sequence) throws -> Bool
-    fileprivate let iterate: (Sequence) throws -> Sequence
-    fileprivate let resultSelector: (Sequence) throws -> Element
-    fileprivate let scheduler: ImmediateSchedulerType
-    
-    init(initialState: Sequence, condition: @escaping (Sequence) throws -> Bool, iterate: @escaping (Sequence) throws -> Sequence, resultSelector: @escaping (Sequence) throws -> Element, scheduler: ImmediateSchedulerType) {
-        self.initialState = initialState
-        self.condition = condition
-        self.iterate = iterate
-        self.resultSelector = resultSelector
-        self.scheduler = scheduler
-        super.init()
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = GenerateSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/GroupBy.swift b/Pods/RxSwift/RxSwift/Observables/GroupBy.swift
deleted file mode 100644
index 88cbda767..000000000
--- a/Pods/RxSwift/RxSwift/Observables/GroupBy.swift
+++ /dev/null
@@ -1,133 +0,0 @@
-//
-//  GroupBy.swift
-//  RxSwift
-//
-//  Created by Tomi Koskinen on 01/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /*
-     Groups the elements of an observable sequence according to a specified key selector function.
-
-     - seealso: [groupBy operator on reactivex.io](http://reactivex.io/documentation/operators/groupby.html)
-
-     - parameter keySelector: A function to extract the key for each element.
-     - returns: A sequence of observable groups, each of which corresponds to a unique key value, containing all elements that share that same key value.
-     */
-    public func groupBy<Key: Hashable>(keySelector: @escaping (Element) throws -> Key)
-        -> Observable<GroupedObservable<Key, Element>> {
-        GroupBy(source: self.asObservable(), selector: keySelector)
-    }
-}
-
-final private class GroupedObservableImpl<Element>: Observable<Element> {
-    private var subject: PublishSubject<Element>
-    private var refCount: RefCountDisposable
-    
-    init(subject: PublishSubject<Element>, refCount: RefCountDisposable) {
-        self.subject = subject
-        self.refCount = refCount
-    }
-
-    override public func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        let release = self.refCount.retain()
-        let subscription = self.subject.subscribe(observer)
-        return Disposables.create(release, subscription)
-    }
-}
-
-
-final private class GroupBySink<Key: Hashable, Element, Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType where Observer.Element == GroupedObservable<Key, Element> {
-    typealias ResultType = Observer.Element 
-    typealias Parent = GroupBy<Key, Element>
-
-    private let parent: Parent
-    private let subscription = SingleAssignmentDisposable()
-    private var refCountDisposable: RefCountDisposable!
-    private var groupedSubjectTable: [Key: PublishSubject<Element>]
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.groupedSubjectTable = [Key: PublishSubject<Element>]()
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        self.refCountDisposable = RefCountDisposable(disposable: self.subscription)
-        
-        self.subscription.setDisposable(self.parent.source.subscribe(self))
-        
-        return self.refCountDisposable
-    }
-    
-    private func onGroupEvent(key: Key, value: Element) {
-        if let writer = self.groupedSubjectTable[key] {
-            writer.on(.next(value))
-        } else {
-            let writer = PublishSubject<Element>()
-            self.groupedSubjectTable[key] = writer
-            
-            let group = GroupedObservable(
-                key: key,
-                source: GroupedObservableImpl(subject: writer, refCount: refCountDisposable)
-            )
-            
-            self.forwardOn(.next(group))
-            writer.on(.next(value))
-        }
-    }
-
-    final func on(_ event: Event<Element>) {
-        switch event {
-        case let .next(value):
-            do {
-                let groupKey = try self.parent.selector(value)
-                self.onGroupEvent(key: groupKey, value: value)
-            }
-            catch let e {
-                self.error(e)
-                return
-            }
-        case let .error(e):
-            self.error(e)
-        case .completed:
-            self.forwardOnGroups(event: .completed)
-            self.forwardOn(.completed)
-            self.subscription.dispose()
-            self.dispose()
-        }
-    }
-
-    final func error(_ error: Swift.Error) {
-        self.forwardOnGroups(event: .error(error))
-        self.forwardOn(.error(error))
-        self.subscription.dispose()
-        self.dispose()
-    }
-    
-    final func forwardOnGroups(event: Event<Element>) {
-        for writer in self.groupedSubjectTable.values {
-            writer.on(event)
-        }
-    }
-}
-
-final private class GroupBy<Key: Hashable, Element>: Producer<GroupedObservable<Key,Element>> {
-    typealias KeySelector = (Element) throws -> Key
-
-    fileprivate let source: Observable<Element>
-    fileprivate let selector: KeySelector
-    
-    init(source: Observable<Element>, selector: @escaping KeySelector) {
-        self.source = source
-        self.selector = selector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == GroupedObservable<Key,Element> {
-        let sink = GroupBySink(parent: self, observer: observer, cancel: cancel)
-        return (sink: sink, subscription: sink.run())
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Just.swift b/Pods/RxSwift/RxSwift/Observables/Just.swift
deleted file mode 100644
index 93490837f..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Just.swift
+++ /dev/null
@@ -1,87 +0,0 @@
-//
-//  Just.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 8/30/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Returns an observable sequence that contains a single element.
-
-     - seealso: [just operator on reactivex.io](http://reactivex.io/documentation/operators/just.html)
-
-     - parameter element: Single element in the resulting observable sequence.
-     - returns: An observable sequence containing the single specified element.
-     */
-    public static func just(_ element: Element) -> Observable<Element> {
-        Just(element: element)
-    }
-
-    /**
-     Returns an observable sequence that contains a single element.
-
-     - seealso: [just operator on reactivex.io](http://reactivex.io/documentation/operators/just.html)
-
-     - parameter element: Single element in the resulting observable sequence.
-     - parameter scheduler: Scheduler to send the single element on.
-     - returns: An observable sequence containing the single specified element.
-     */
-    public static func just(_ element: Element, scheduler: ImmediateSchedulerType) -> Observable<Element> {
-        JustScheduled(element: element, scheduler: scheduler)
-    }
-}
-
-final private class JustScheduledSink<Observer: ObserverType>: Sink<Observer> {
-    typealias Parent = JustScheduled<Observer.Element>
-
-    private let parent: Parent
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let scheduler = self.parent.scheduler
-        return scheduler.schedule(self.parent.element) { element in
-            self.forwardOn(.next(element))
-            return scheduler.schedule(()) { _ in
-                self.forwardOn(.completed)
-                self.dispose()
-                return Disposables.create()
-            }
-        }
-    }
-}
-
-final private class JustScheduled<Element>: Producer<Element> {
-    fileprivate let scheduler: ImmediateSchedulerType
-    fileprivate let element: Element
-
-    init(element: Element, scheduler: ImmediateSchedulerType) {
-        self.scheduler = scheduler
-        self.element = element
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = JustScheduledSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class Just<Element>: Producer<Element> {
-    private let element: Element
-    
-    init(element: Element) {
-        self.element = element
-    }
-    
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        observer.on(.next(self.element))
-        observer.on(.completed)
-        return Disposables.create()
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Map.swift b/Pods/RxSwift/RxSwift/Observables/Map.swift
deleted file mode 100644
index 0691273cc..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Map.swift
+++ /dev/null
@@ -1,77 +0,0 @@
-//
-//  Map.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Projects each element of an observable sequence into a new form.
-
-     - seealso: [map operator on reactivex.io](http://reactivex.io/documentation/operators/map.html)
-
-     - parameter transform: A transform function to apply to each source element.
-     - returns: An observable sequence whose elements are the result of invoking the transform function on each element of source.
-
-     */
-    public func map<Result>(_ transform: @escaping (Element) throws -> Result)
-        -> Observable<Result> {
-        Map(source: self.asObservable(), transform: transform)
-    }
-}
-
-final private class MapSink<SourceType, Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Transform = (SourceType) throws -> ResultType
-
-    typealias ResultType = Observer.Element 
-    typealias Element = SourceType
-
-    private let transform: Transform
-
-    init(transform: @escaping Transform, observer: Observer, cancel: Cancelable) {
-        self.transform = transform
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func on(_ event: Event<SourceType>) {
-        switch event {
-        case .next(let element):
-            do {
-                let mappedElement = try self.transform(element)
-                self.forwardOn(.next(mappedElement))
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        case .error(let error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final private class Map<SourceType, ResultType>: Producer<ResultType> {
-    typealias Transform = (SourceType) throws -> ResultType
-
-    private let source: Observable<SourceType>
-
-    private let transform: Transform
-
-    init(source: Observable<SourceType>, transform: @escaping Transform) {
-        self.source = source
-        self.transform = transform
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == ResultType {
-        let sink = MapSink(transform: self.transform, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Materialize.swift b/Pods/RxSwift/RxSwift/Observables/Materialize.swift
deleted file mode 100644
index e2577be5d..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Materialize.swift
+++ /dev/null
@@ -1,44 +0,0 @@
-//
-//  Materialize.swift
-//  RxSwift
-//
-//  Created by sergdort on 08/03/2017.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Convert any Observable into an Observable of its events.
-     - seealso: [materialize operator on reactivex.io](http://reactivex.io/documentation/operators/materialize-dematerialize.html)
-     - returns: An observable sequence that wraps events in an Event<E>. The returned Observable never errors, but it does complete after observing all of the events of the underlying Observable.
-     */
-    public func materialize() -> Observable<Event<Element>> {
-        Materialize(source: self.asObservable())
-    }
-}
-
-private final class MaterializeSink<Element, Observer: ObserverType>: Sink<Observer>, ObserverType where Observer.Element == Event<Element> {
-
-    func on(_ event: Event<Element>) {
-        self.forwardOn(.next(event))
-        if event.isStopEvent {
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final private class Materialize<T>: Producer<Event<T>> {
-    private let source: Observable<T>
-
-    init(source: Observable<T>) {
-        self.source = source
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = MaterializeSink(observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Merge.swift b/Pods/RxSwift/RxSwift/Observables/Merge.swift
deleted file mode 100644
index 51a646291..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Merge.swift
+++ /dev/null
@@ -1,600 +0,0 @@
-//
-//  Merge.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/28/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-
-     - seealso: [flatMap operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence.
-     */
-    public func flatMap<Source: ObservableConvertibleType>(_ selector: @escaping (Element) throws -> Source)
-        -> Observable<Source.Element> {
-            return FlatMap(source: self.asObservable(), selector: selector)
-    }
-
-}
-
-extension ObservableType {
-
-    /**
-     Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-     If element is received while there is some projected observable sequence being merged it will simply be ignored.
-
-     - seealso: [flatMapFirst operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to element that was observed while no observable is executing in parallel.
-     - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence that was received while no other sequence was being calculated.
-     */
-    public func flatMapFirst<Source: ObservableConvertibleType>(_ selector: @escaping (Element) throws -> Source)
-        -> Observable<Source.Element> {
-            return FlatMapFirst(source: self.asObservable(), selector: selector)
-    }
-}
-
-extension ObservableType where Element: ObservableConvertibleType {
-
-    /**
-     Merges elements from all observable sequences in the given enumerable sequence into a single observable sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - returns: The observable sequence that merges the elements of the observable sequences.
-     */
-    public func merge() -> Observable<Element.Element> {
-        Merge(source: self.asObservable())
-    }
-
-    /**
-     Merges elements from all inner observable sequences into a single observable sequence, limiting the number of concurrent subscriptions to inner sequences.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter maxConcurrent: Maximum number of inner observable sequences being subscribed to concurrently.
-     - returns: The observable sequence that merges the elements of the inner sequences.
-     */
-    public func merge(maxConcurrent: Int)
-        -> Observable<Element.Element> {
-        MergeLimited(source: self.asObservable(), maxConcurrent: maxConcurrent)
-    }
-}
-
-extension ObservableType where Element: ObservableConvertibleType {
-
-    /**
-     Concatenates all inner observable sequences, as long as the previous observable sequence terminated successfully.
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - returns: An observable sequence that contains the elements of each observed inner sequence, in sequential order.
-     */
-    public func concat() -> Observable<Element.Element> {
-        self.merge(maxConcurrent: 1)
-    }
-}
-
-extension ObservableType {
-    /**
-     Merges elements from all observable sequences from collection into a single observable sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter sources: Collection of observable sequences to merge.
-     - returns: The observable sequence that merges the elements of the observable sequences.
-     */
-    public static func merge<Collection: Swift.Collection>(_ sources: Collection) -> Observable<Element> where Collection.Element == Observable<Element> {
-        MergeArray(sources: Array(sources))
-    }
-
-    /**
-     Merges elements from all observable sequences from array into a single observable sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter sources: Array of observable sequences to merge.
-     - returns: The observable sequence that merges the elements of the observable sequences.
-     */
-    public static func merge(_ sources: [Observable<Element>]) -> Observable<Element> {
-        MergeArray(sources: sources)
-    }
-
-    /**
-     Merges elements from all observable sequences into a single observable sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter sources: Collection of observable sequences to merge.
-     - returns: The observable sequence that merges the elements of the observable sequences.
-     */
-    public static func merge(_ sources: Observable<Element>...) -> Observable<Element> {
-        MergeArray(sources: sources)
-    }
-}
-
-// MARK: concatMap
-
-extension ObservableType {
-    /**
-     Projects each element of an observable sequence to an observable sequence and concatenates the resulting observable sequences into one observable sequence.
-     
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-     
-     - returns: An observable sequence that contains the elements of each observed inner sequence, in sequential order.
-     */
-    
-    public func concatMap<Source: ObservableConvertibleType>(_ selector: @escaping (Element) throws -> Source)
-        -> Observable<Source.Element> {
-        return ConcatMap(source: self.asObservable(), selector: selector)
-    }
-}
-
-private final class MergeLimitedSinkIter<SourceElement, SourceSequence: ObservableConvertibleType, Observer: ObserverType>
-    : ObserverType
-    , LockOwnerType
-    , SynchronizedOnType where SourceSequence.Element == Observer.Element {
-    typealias Element = Observer.Element
-    typealias DisposeKey = CompositeDisposable.DisposeKey
-    typealias Parent = MergeLimitedSink<SourceElement, SourceSequence, Observer>
-    
-    private let parent: Parent
-    private let disposeKey: DisposeKey
-
-    var lock: RecursiveLock {
-        self.parent.lock
-    }
-    
-    init(parent: Parent, disposeKey: DisposeKey) {
-        self.parent = parent
-        self.disposeKey = disposeKey
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.parent.forwardOn(event)
-        case .error:
-            self.parent.forwardOn(event)
-            self.parent.dispose()
-        case .completed:
-            self.parent.group.remove(for: self.disposeKey)
-            if let next = self.parent.queue.dequeue() {
-                self.parent.subscribe(next, group: self.parent.group)
-            }
-            else {
-                self.parent.activeCount -= 1
-                
-                if self.parent.stopped && self.parent.activeCount == 0 {
-                    self.parent.forwardOn(.completed)
-                    self.parent.dispose()
-                }
-            }
-        }
-    }
-}
-
-private final class ConcatMapSink<SourceElement, SourceSequence: ObservableConvertibleType, Observer: ObserverType>: MergeLimitedSink<SourceElement, SourceSequence, Observer> where Observer.Element == SourceSequence.Element {
-    typealias Selector = (SourceElement) throws -> SourceSequence
-    
-    private let selector: Selector
-    
-    init(selector: @escaping Selector, observer: Observer, cancel: Cancelable) {
-        self.selector = selector
-        super.init(maxConcurrent: 1, observer: observer, cancel: cancel)
-    }
-    
-    override func performMap(_ element: SourceElement) throws -> SourceSequence {
-        try self.selector(element)
-    }
-}
-
-private final class MergeLimitedBasicSink<SourceSequence: ObservableConvertibleType, Observer: ObserverType>: MergeLimitedSink<SourceSequence, SourceSequence, Observer> where Observer.Element == SourceSequence.Element {
-    
-    override func performMap(_ element: SourceSequence) throws -> SourceSequence {
-        element
-    }
-}
-
-private class MergeLimitedSink<SourceElement, SourceSequence: ObservableConvertibleType, Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType where Observer.Element == SourceSequence.Element {
-    typealias QueueType = Queue<SourceSequence>
-
-    let maxConcurrent: Int
-
-    let lock = RecursiveLock()
-
-    // state
-    var stopped = false
-    var activeCount = 0
-    var queue = QueueType(capacity: 2)
-    
-    let sourceSubscription = SingleAssignmentDisposable()
-    let group = CompositeDisposable()
-    
-    init(maxConcurrent: Int, observer: Observer, cancel: Cancelable) {
-        self.maxConcurrent = maxConcurrent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run(_ source: Observable<SourceElement>) -> Disposable {
-        _ = self.group.insert(self.sourceSubscription)
-        
-        let disposable = source.subscribe(self)
-        self.sourceSubscription.setDisposable(disposable)
-        return self.group
-    }
-    
-    func subscribe(_ innerSource: SourceSequence, group: CompositeDisposable) {
-        let subscription = SingleAssignmentDisposable()
-        
-        let key = group.insert(subscription)
-        
-        if let key = key {
-            let observer = MergeLimitedSinkIter(parent: self, disposeKey: key)
-            
-            let disposable = innerSource.asObservable().subscribe(observer)
-            subscription.setDisposable(disposable)
-        }
-    }
-    
-    func performMap(_ element: SourceElement) throws -> SourceSequence {
-        rxAbstractMethod()
-    }
-
-    @inline(__always)
-    final private func nextElementArrived(element: SourceElement) -> SourceSequence? {
-        self.lock.performLocked {
-            let subscribe: Bool
-            if self.activeCount < self.maxConcurrent {
-                self.activeCount += 1
-                subscribe = true
-            }
-            else {
-                do {
-                    let value = try self.performMap(element)
-                    self.queue.enqueue(value)
-                } catch {
-                    self.forwardOn(.error(error))
-                    self.dispose()
-                }
-                subscribe = false
-            }
-
-            if subscribe {
-                do {
-                    return try self.performMap(element)
-                } catch {
-                    self.forwardOn(.error(error))
-                    self.dispose()
-                }
-            }
-
-            return nil
-        }
-    }
-
-    func on(_ event: Event<SourceElement>) {
-        switch event {
-        case .next(let element):
-            if let sequence = self.nextElementArrived(element: element) {
-                self.subscribe(sequence, group: self.group)
-            }
-        case .error(let error):
-            self.lock.performLocked {
-                self.forwardOn(.error(error))
-                self.dispose()
-            }
-        case .completed:
-            self.lock.performLocked {
-                if self.activeCount == 0 {
-                    self.forwardOn(.completed)
-                    self.dispose()
-                }
-                else {
-                    self.sourceSubscription.dispose()
-                }
-
-                self.stopped = true
-            }
-        }
-    }
-}
-
-final private class MergeLimited<SourceSequence: ObservableConvertibleType>: Producer<SourceSequence.Element> {
-    private let source: Observable<SourceSequence>
-    private let maxConcurrent: Int
-    
-    init(source: Observable<SourceSequence>, maxConcurrent: Int) {
-        self.source = source
-        self.maxConcurrent = maxConcurrent
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == SourceSequence.Element {
-        let sink = MergeLimitedBasicSink<SourceSequence, Observer>(maxConcurrent: self.maxConcurrent, observer: observer, cancel: cancel)
-        let subscription = sink.run(self.source)
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-// MARK: Merge
-
-private final class MergeBasicSink<Source: ObservableConvertibleType, Observer: ObserverType> : MergeSink<Source, Source, Observer> where Observer.Element == Source.Element {
-    override func performMap(_ element: Source) throws -> Source {
-        element
-    }
-}
-
-// MARK: flatMap
-
-private final class FlatMapSink<SourceElement, SourceSequence: ObservableConvertibleType, Observer: ObserverType> : MergeSink<SourceElement, SourceSequence, Observer> where Observer.Element == SourceSequence.Element {
-    typealias Selector = (SourceElement) throws -> SourceSequence
-
-    private let selector: Selector
-
-    init(selector: @escaping Selector, observer: Observer, cancel: Cancelable) {
-        self.selector = selector
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    override func performMap(_ element: SourceElement) throws -> SourceSequence {
-        try self.selector(element)
-    }
-}
-
-// MARK: FlatMapFirst
-
-private final class FlatMapFirstSink<SourceElement, SourceSequence: ObservableConvertibleType, Observer: ObserverType> : MergeSink<SourceElement, SourceSequence, Observer> where Observer.Element == SourceSequence.Element {
-    typealias Selector = (SourceElement) throws -> SourceSequence
-
-    private let selector: Selector
-
-    override var subscribeNext: Bool {
-        self.activeCount == 0
-    }
-
-    init(selector: @escaping Selector, observer: Observer, cancel: Cancelable) {
-        self.selector = selector
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    override func performMap(_ element: SourceElement) throws -> SourceSequence {
-        try self.selector(element)
-    }
-}
-
-private final class MergeSinkIter<SourceElement, SourceSequence: ObservableConvertibleType, Observer: ObserverType> : ObserverType where Observer.Element == SourceSequence.Element {
-    typealias Parent = MergeSink<SourceElement, SourceSequence, Observer>
-    typealias DisposeKey = CompositeDisposable.DisposeKey
-    typealias Element = Observer.Element
-    
-    private let parent: Parent
-    private let disposeKey: DisposeKey
-
-    init(parent: Parent, disposeKey: DisposeKey) {
-        self.parent = parent
-        self.disposeKey = disposeKey
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.parent.lock.performLocked {
-            switch event {
-            case .next(let value):
-                self.parent.forwardOn(.next(value))
-            case .error(let error):
-                self.parent.forwardOn(.error(error))
-                self.parent.dispose()
-            case .completed:
-                self.parent.group.remove(for: self.disposeKey)
-                self.parent.activeCount -= 1
-                self.parent.checkCompleted()
-            }
-        }
-    }
-}
-
-
-private class MergeSink<SourceElement, SourceSequence: ObservableConvertibleType, Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType where Observer.Element == SourceSequence.Element {
-    typealias ResultType = Observer.Element
-    typealias Element = SourceElement
-
-    let lock = RecursiveLock()
-
-    var subscribeNext: Bool {
-        true
-    }
-
-    // state
-    let group = CompositeDisposable()
-    let sourceSubscription = SingleAssignmentDisposable()
-
-    var activeCount = 0
-    var stopped = false
-
-    override init(observer: Observer, cancel: Cancelable) {
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func performMap(_ element: SourceElement) throws -> SourceSequence {
-        rxAbstractMethod()
-    }
-
-    @inline(__always)
-    final private func nextElementArrived(element: SourceElement) -> SourceSequence? {
-        self.lock.performLocked {
-            if !self.subscribeNext {
-                return nil
-            }
-
-            do {
-                let value = try self.performMap(element)
-                self.activeCount += 1
-                return value
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-                return nil
-            }
-        }
-    }
-    
-    func on(_ event: Event<SourceElement>) {
-        switch event {
-        case .next(let element):
-            if let value = self.nextElementArrived(element: element) {
-                self.subscribeInner(value.asObservable())
-            }
-        case .error(let error):
-            self.lock.performLocked {
-                self.forwardOn(.error(error))
-                self.dispose()
-            }
-        case .completed:
-            self.lock.performLocked {
-                self.stopped = true
-                self.sourceSubscription.dispose()
-                self.checkCompleted()
-            }
-        }
-    }
-
-    func subscribeInner(_ source: Observable<Observer.Element>) {
-        let iterDisposable = SingleAssignmentDisposable()
-        if let disposeKey = self.group.insert(iterDisposable) {
-            let iter = MergeSinkIter(parent: self, disposeKey: disposeKey)
-            let subscription = source.subscribe(iter)
-            iterDisposable.setDisposable(subscription)
-        }
-    }
-
-    func run(_ sources: [Observable<Observer.Element>]) -> Disposable {
-        self.activeCount += sources.count
-
-        for source in sources {
-            self.subscribeInner(source)
-        }
-
-        self.stopped = true
-
-        self.checkCompleted()
-
-        return self.group
-    }
-
-    @inline(__always)
-    func checkCompleted() {
-        if self.stopped && self.activeCount == 0 {
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-    
-    func run(_ source: Observable<SourceElement>) -> Disposable {
-        _ = self.group.insert(self.sourceSubscription)
-
-        let subscription = source.subscribe(self)
-        self.sourceSubscription.setDisposable(subscription)
-        
-        return self.group
-    }
-}
-
-// MARK: Producers
-
-final private class FlatMap<SourceElement, SourceSequence: ObservableConvertibleType>: Producer<SourceSequence.Element> {
-    typealias Selector = (SourceElement) throws -> SourceSequence
-
-    private let source: Observable<SourceElement>
-    
-    private let selector: Selector
-
-    init(source: Observable<SourceElement>, selector: @escaping Selector) {
-        self.source = source
-        self.selector = selector
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == SourceSequence.Element {
-        let sink = FlatMapSink(selector: self.selector, observer: observer, cancel: cancel)
-        let subscription = sink.run(self.source)
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class FlatMapFirst<SourceElement, SourceSequence: ObservableConvertibleType>: Producer<SourceSequence.Element> {
-    typealias Selector = (SourceElement) throws -> SourceSequence
-
-    private let source: Observable<SourceElement>
-
-    private let selector: Selector
-
-    init(source: Observable<SourceElement>, selector: @escaping Selector) {
-        self.source = source
-        self.selector = selector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == SourceSequence.Element {
-        let sink = FlatMapFirstSink<SourceElement, SourceSequence, Observer>(selector: self.selector, observer: observer, cancel: cancel)
-        let subscription = sink.run(self.source)
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final class ConcatMap<SourceElement, SourceSequence: ObservableConvertibleType>: Producer<SourceSequence.Element> {
-    typealias Selector = (SourceElement) throws -> SourceSequence
-    
-    private let source: Observable<SourceElement>
-    private let selector: Selector
-    
-    init(source: Observable<SourceElement>, selector: @escaping Selector) {
-        self.source = source
-        self.selector = selector
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == SourceSequence.Element {
-        let sink = ConcatMapSink<SourceElement, SourceSequence, Observer>(selector: self.selector, observer: observer, cancel: cancel)
-        let subscription = sink.run(self.source)
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final class Merge<SourceSequence: ObservableConvertibleType> : Producer<SourceSequence.Element> {
-    private let source: Observable<SourceSequence>
-
-    init(source: Observable<SourceSequence>) {
-        self.source = source
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == SourceSequence.Element {
-        let sink = MergeBasicSink<SourceSequence, Observer>(observer: observer, cancel: cancel)
-        let subscription = sink.run(self.source)
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class MergeArray<Element>: Producer<Element> {
-    private let sources: [Observable<Element>]
-
-    init(sources: [Observable<Element>]) {
-        self.sources = sources
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = MergeBasicSink<Observable<Element>, Observer>(observer: observer, cancel: cancel)
-        let subscription = sink.run(self.sources)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Multicast.swift b/Pods/RxSwift/RxSwift/Observables/Multicast.swift
deleted file mode 100644
index 1ebcf0212..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Multicast.swift
+++ /dev/null
@@ -1,405 +0,0 @@
-//
-//  Multicast.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/27/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/**
- Represents an observable wrapper that can be connected and disconnected from its underlying observable sequence.
- */
-public class ConnectableObservable<Element>
-    : Observable<Element>
-    , ConnectableObservableType {
-
-    /**
-     Connects the observable wrapper to its source. All subscribed observers will receive values from the underlying observable sequence as long as the connection is established.
-
-     - returns: Disposable used to disconnect the observable wrapper from its source, causing subscribed observer to stop receiving values from the underlying observable sequence.
-     */
-    public func connect() -> Disposable {
-        rxAbstractMethod()
-    }
-}
-
-extension ObservableType {
-
-    /**
-    Multicasts the source sequence notifications through an instantiated subject into all uses of the sequence within a selector function.
-
-    Each subscription to the resulting sequence causes a separate multicast invocation, exposing the sequence resulting from the selector function's invocation.
-
-    For specializations with fixed subject types, see `publish` and `replay`.
-
-    - seealso: [multicast operator on reactivex.io](http://reactivex.io/documentation/operators/publish.html)
-
-    - parameter subjectSelector: Factory function to create an intermediate subject through which the source sequence's elements will be multicast to the selector function.
-    - parameter selector: Selector function which can use the multicasted source sequence subject to the policies enforced by the created subject.
-    - returns: An observable sequence that contains the elements of a sequence produced by multicasting the source sequence within a selector function.
-    */
-    public func multicast<Subject: SubjectType, Result>(_ subjectSelector: @escaping () throws -> Subject, selector: @escaping (Observable<Subject.Element>) throws -> Observable<Result>)
-        -> Observable<Result> where Subject.Observer.Element == Element {
-        return Multicast(
-            source: self.asObservable(),
-            subjectSelector: subjectSelector,
-            selector: selector
-        )
-    }
-}
-
-extension ObservableType {
-
-    /**
-    Returns a connectable observable sequence that shares a single subscription to the underlying sequence.
-
-    This operator is a specialization of `multicast` using a `PublishSubject`.
-
-    - seealso: [publish operator on reactivex.io](http://reactivex.io/documentation/operators/publish.html)
-
-    - returns: A connectable observable sequence that shares a single subscription to the underlying sequence.
-    */
-    public func publish() -> ConnectableObservable<Element> {
-        self.multicast { PublishSubject() }
-    }
-}
-
-extension ObservableType {
-
-    /**
-     Returns a connectable observable sequence that shares a single subscription to the underlying sequence replaying bufferSize elements.
-
-     This operator is a specialization of `multicast` using a `ReplaySubject`.
-
-     - seealso: [replay operator on reactivex.io](http://reactivex.io/documentation/operators/replay.html)
-
-     - parameter bufferSize: Maximum element count of the replay buffer.
-     - returns: A connectable observable sequence that shares a single subscription to the underlying sequence.
-     */
-    public func replay(_ bufferSize: Int)
-        -> ConnectableObservable<Element> {
-        self.multicast { ReplaySubject.create(bufferSize: bufferSize) }
-    }
-
-    /**
-     Returns a connectable observable sequence that shares a single subscription to the underlying sequence replaying all elements.
-
-     This operator is a specialization of `multicast` using a `ReplaySubject`.
-
-     - seealso: [replay operator on reactivex.io](http://reactivex.io/documentation/operators/replay.html)
-
-     - returns: A connectable observable sequence that shares a single subscription to the underlying sequence.
-     */
-    public func replayAll()
-        -> ConnectableObservable<Element> {
-        self.multicast { ReplaySubject.createUnbounded() }
-    }
-}
-
-extension ConnectableObservableType {
-
-    /**
-    Returns an observable sequence that stays connected to the source as long as there is at least one subscription to the observable sequence.
-
-    - seealso: [refCount operator on reactivex.io](http://reactivex.io/documentation/operators/refcount.html)
-
-    - returns: An observable sequence that stays connected to the source as long as there is at least one subscription to the observable sequence.
-    */
-    public func refCount() -> Observable<Element> {
-        RefCount(source: self)
-    }
-}
-
-extension ObservableType {
-
-    /**
-     Multicasts the source sequence notifications through the specified subject to the resulting connectable observable.
-
-     Upon connection of the connectable observable, the subject is subscribed to the source exactly one, and messages are forwarded to the observers registered with the connectable observable.
-
-     For specializations with fixed subject types, see `publish` and `replay`.
-
-     - seealso: [multicast operator on reactivex.io](http://reactivex.io/documentation/operators/publish.html)
-
-     - parameter subject: Subject to push source elements into.
-     - returns: A connectable observable sequence that upon connection causes the source sequence to push results into the specified subject.
-     */
-    public func multicast<Subject: SubjectType>(_ subject: Subject)
-        -> ConnectableObservable<Subject.Element> where Subject.Observer.Element == Element {
-        ConnectableObservableAdapter(source: self.asObservable(), makeSubject: { subject })
-    }
-
-    /**
-     Multicasts the source sequence notifications through an instantiated subject to the resulting connectable observable.
-
-     Upon connection of the connectable observable, the subject is subscribed to the source exactly one, and messages are forwarded to the observers registered with the connectable observable.
-
-     Subject is cleared on connection disposal or in case source sequence produces terminal event.
-
-     - seealso: [multicast operator on reactivex.io](http://reactivex.io/documentation/operators/publish.html)
-
-     - parameter makeSubject: Factory function used to instantiate a subject for each connection.
-     - returns: A connectable observable sequence that upon connection causes the source sequence to push results into the specified subject.
-     */
-    public func multicast<Subject: SubjectType>(makeSubject: @escaping () -> Subject)
-        -> ConnectableObservable<Subject.Element> where Subject.Observer.Element == Element {
-        ConnectableObservableAdapter(source: self.asObservable(), makeSubject: makeSubject)
-    }
-}
-
-final private class Connection<Subject: SubjectType>: ObserverType, Disposable {
-    typealias Element = Subject.Observer.Element
-
-    private var lock: RecursiveLock
-    // state
-    private var parent: ConnectableObservableAdapter<Subject>?
-    private var subscription : Disposable?
-    private var subjectObserver: Subject.Observer
-
-    private let disposed = AtomicInt(0)
-
-    init(parent: ConnectableObservableAdapter<Subject>, subjectObserver: Subject.Observer, lock: RecursiveLock, subscription: Disposable) {
-        self.parent = parent
-        self.subscription = subscription
-        self.lock = lock
-        self.subjectObserver = subjectObserver
-    }
-
-    func on(_ event: Event<Subject.Observer.Element>) {
-        if isFlagSet(self.disposed, 1) {
-            return
-        }
-        if event.isStopEvent {
-            self.dispose()
-        }
-        self.subjectObserver.on(event)
-    }
-
-    func dispose() {
-        lock.lock(); defer { lock.unlock() }
-        fetchOr(self.disposed, 1)
-        guard let parent = self.parent else {
-            return
-        }
-
-        if parent.connection === self {
-            parent.connection = nil
-            parent.subject = nil
-        }
-        self.parent = nil
-
-        self.subscription?.dispose()
-        self.subscription = nil
-    }
-}
-
-final private class ConnectableObservableAdapter<Subject: SubjectType>
-    : ConnectableObservable<Subject.Element> {
-    typealias ConnectionType = Connection<Subject>
-
-    private let source: Observable<Subject.Observer.Element>
-    private let makeSubject: () -> Subject
-
-    fileprivate let lock = RecursiveLock()
-    fileprivate var subject: Subject?
-
-    // state
-    fileprivate var connection: ConnectionType?
-
-    init(source: Observable<Subject.Observer.Element>, makeSubject: @escaping () -> Subject) {
-        self.source = source
-        self.makeSubject = makeSubject
-        self.subject = nil
-        self.connection = nil
-    }
-
-    override func connect() -> Disposable {
-        return self.lock.performLocked {
-            if let connection = self.connection {
-                return connection
-            }
-
-            let singleAssignmentDisposable = SingleAssignmentDisposable()
-            let connection = Connection(parent: self, subjectObserver: self.lazySubject.asObserver(), lock: self.lock, subscription: singleAssignmentDisposable)
-            self.connection = connection
-            let subscription = self.source.subscribe(connection)
-            singleAssignmentDisposable.setDisposable(subscription)
-            return connection
-        }
-    }
-
-    private var lazySubject: Subject {
-        if let subject = self.subject {
-            return subject
-        }
-
-        let subject = self.makeSubject()
-        self.subject = subject
-        return subject
-    }
-
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Subject.Element {
-        self.lazySubject.subscribe(observer)
-    }
-}
-
-final private class RefCountSink<ConnectableSource: ConnectableObservableType, Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType where ConnectableSource.Element == Observer.Element {
-    typealias Element = Observer.Element 
-    typealias Parent = RefCount<ConnectableSource>
-
-    private let parent: Parent
-
-    private var connectionIdSnapshot: Int64 = -1
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        let subscription = self.parent.source.subscribe(self)
-        self.parent.lock.lock(); defer { self.parent.lock.unlock() }
-
-        self.connectionIdSnapshot = self.parent.connectionId
-
-        if self.isDisposed {
-            return Disposables.create()
-        }
-
-        if self.parent.count == 0 {
-            self.parent.count = 1
-            self.parent.connectableSubscription = self.parent.source.connect()
-        }
-        else {
-            self.parent.count += 1
-        }
-
-        return Disposables.create {
-            subscription.dispose()
-            self.parent.lock.lock(); defer { self.parent.lock.unlock() }
-            if self.parent.connectionId != self.connectionIdSnapshot {
-                return
-            }
-            if self.parent.count == 1 {
-                self.parent.count = 0
-                guard let connectableSubscription = self.parent.connectableSubscription else {
-                    return
-                }
-
-                connectableSubscription.dispose()
-                self.parent.connectableSubscription = nil
-            }
-            else if self.parent.count > 1 {
-                self.parent.count -= 1
-            }
-            else {
-                rxFatalError("Something went wrong with RefCount disposing mechanism")
-            }
-        }
-    }
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.forwardOn(event)
-        case .error, .completed:
-            self.parent.lock.lock()
-            if self.parent.connectionId == self.connectionIdSnapshot {
-                let connection = self.parent.connectableSubscription
-                defer { connection?.dispose() }
-                self.parent.count = 0
-                self.parent.connectionId = self.parent.connectionId &+ 1
-                self.parent.connectableSubscription = nil
-            }
-            self.parent.lock.unlock()
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-}
-
-final private class RefCount<ConnectableSource: ConnectableObservableType>: Producer<ConnectableSource.Element> {
-    fileprivate let lock = RecursiveLock()
-
-    // state
-    fileprivate var count = 0
-    fileprivate var connectionId: Int64 = 0
-    fileprivate var connectableSubscription = nil as Disposable?
-
-    fileprivate let source: ConnectableSource
-
-    init(source: ConnectableSource) {
-        self.source = source
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable)
-             where Observer.Element == ConnectableSource.Element {
-        let sink = RefCountSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class MulticastSink<Subject: SubjectType, Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    typealias ResultType = Element
-    typealias MutlicastType = Multicast<Subject, Observer.Element>
-
-    private let parent: MutlicastType
-
-    init(parent: MutlicastType, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        do {
-            let subject = try self.parent.subjectSelector()
-            let connectable = ConnectableObservableAdapter(source: self.parent.source, makeSubject: { subject })
-
-            let observable = try self.parent.selector(connectable)
-
-            let subscription = observable.subscribe(self)
-            let connection = connectable.connect()
-
-            return Disposables.create(subscription, connection)
-        }
-        catch let e {
-            self.forwardOn(.error(e))
-            self.dispose()
-            return Disposables.create()
-        }
-    }
-
-    func on(_ event: Event<ResultType>) {
-        self.forwardOn(event)
-        switch event {
-        case .next: break
-        case .error, .completed:
-            self.dispose()
-        }
-    }
-}
-
-final private class Multicast<Subject: SubjectType, Result>: Producer<Result> {
-    typealias SubjectSelectorType = () throws -> Subject
-    typealias SelectorType = (Observable<Subject.Element>) throws -> Observable<Result>
-
-    fileprivate let source: Observable<Subject.Observer.Element>
-    fileprivate let subjectSelector: SubjectSelectorType
-    fileprivate let selector: SelectorType
-
-    init(source: Observable<Subject.Observer.Element>, subjectSelector: @escaping SubjectSelectorType, selector: @escaping SelectorType) {
-        self.source = source
-        self.subjectSelector = subjectSelector
-        self.selector = selector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = MulticastSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Never.swift b/Pods/RxSwift/RxSwift/Observables/Never.swift
deleted file mode 100644
index 7b456eed9..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Never.swift
+++ /dev/null
@@ -1,27 +0,0 @@
-//
-//  Never.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 8/30/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Returns a non-terminating observable sequence, which can be used to denote an infinite duration.
-
-     - seealso: [never operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: An observable sequence whose observers will never get called.
-     */
-    public static func never() -> Observable<Element> {
-        NeverProducer()
-    }
-}
-
-final private class NeverProducer<Element>: Producer<Element> {
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        Disposables.create()
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/ObserveOn.swift b/Pods/RxSwift/RxSwift/Observables/ObserveOn.swift
deleted file mode 100644
index 6b8689e1e..000000000
--- a/Pods/RxSwift/RxSwift/Observables/ObserveOn.swift
+++ /dev/null
@@ -1,243 +0,0 @@
-//
-//  ObserveOn.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 7/25/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Wraps the source sequence in order to run its observer callbacks on the specified scheduler.
-
-     This only invokes observer callbacks on a `scheduler`. In case the subscription and/or unsubscription
-     actions have side-effects that require to be run on a scheduler, use `subscribeOn`.
-
-     - seealso: [observeOn operator on reactivex.io](http://reactivex.io/documentation/operators/observeon.html)
-
-     - parameter scheduler: Scheduler to notify observers on.
-     - returns: The source sequence whose observations happen on the specified scheduler.
-     */
-    public func observe(on scheduler: ImmediateSchedulerType)
-        -> Observable<Element> {
-        guard let serialScheduler = scheduler as? SerialDispatchQueueScheduler else {
-            return ObserveOn(source: self.asObservable(), scheduler: scheduler)
-        }
-
-        return ObserveOnSerialDispatchQueue(source: self.asObservable(),
-                                            scheduler: serialScheduler)
-    }
-
-    /**
-     Wraps the source sequence in order to run its observer callbacks on the specified scheduler.
-
-     This only invokes observer callbacks on a `scheduler`. In case the subscription and/or unsubscription
-     actions have side-effects that require to be run on a scheduler, use `subscribeOn`.
-
-     - seealso: [observeOn operator on reactivex.io](http://reactivex.io/documentation/operators/observeon.html)
-
-     - parameter scheduler: Scheduler to notify observers on.
-     - returns: The source sequence whose observations happen on the specified scheduler.
-     */
-    @available(*, deprecated, renamed: "observe(on:)")
-    public func observeOn(_ scheduler: ImmediateSchedulerType)
-        -> Observable<Element> {
-        observe(on: scheduler)
-    }
-}
-
-final private class ObserveOn<Element>: Producer<Element> {
-    let scheduler: ImmediateSchedulerType
-    let source: Observable<Element>
-
-    init(source: Observable<Element>, scheduler: ImmediateSchedulerType) {
-        self.scheduler = scheduler
-        self.source = source
-
-#if TRACE_RESOURCES
-        _ = Resources.incrementTotal()
-#endif
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = ObserveOnSink(scheduler: self.scheduler, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-
-#if TRACE_RESOURCES
-    deinit {
-        _ = Resources.decrementTotal()
-    }
-#endif
-}
-
-enum ObserveOnState : Int32 {
-    // pump is not running
-    case stopped = 0
-    // pump is running
-    case running = 1
-}
-
-final private class ObserveOnSink<Observer: ObserverType>: ObserverBase<Observer.Element> {
-    typealias Element = Observer.Element 
-
-    let scheduler: ImmediateSchedulerType
-
-    var lock = SpinLock()
-    let observer: Observer
-
-    // state
-    var state = ObserveOnState.stopped
-    var queue = Queue<Event<Element>>(capacity: 10)
-
-    let scheduleDisposable = SerialDisposable()
-    let cancel: Cancelable
-
-    init(scheduler: ImmediateSchedulerType, observer: Observer, cancel: Cancelable) {
-        self.scheduler = scheduler
-        self.observer = observer
-        self.cancel = cancel
-    }
-
-    override func onCore(_ event: Event<Element>) {
-        let shouldStart = self.lock.performLocked { () -> Bool in
-            self.queue.enqueue(event)
-
-            switch self.state {
-            case .stopped:
-                self.state = .running
-                return true
-            case .running:
-                return false
-            }
-        }
-
-        if shouldStart {
-            self.scheduleDisposable.disposable = self.scheduler.scheduleRecursive((), action: self.run)
-        }
-    }
-
-    func run(_ state: (), _ recurse: (()) -> Void) {
-        let (nextEvent, observer) = self.lock.performLocked { () -> (Event<Element>?, Observer) in
-            if !self.queue.isEmpty {
-                return (self.queue.dequeue(), self.observer)
-            }
-            else {
-                self.state = .stopped
-                return (nil, self.observer)
-            }
-        }
-
-        if let nextEvent = nextEvent, !self.cancel.isDisposed {
-            observer.on(nextEvent)
-            if nextEvent.isStopEvent {
-                self.dispose()
-            }
-        }
-        else {
-            return
-        }
-
-        let shouldContinue = self.shouldContinue_synchronized()
-
-        if shouldContinue {
-            recurse(())
-        }
-    }
-
-    func shouldContinue_synchronized() -> Bool {
-        self.lock.performLocked {
-            let isEmpty = self.queue.isEmpty
-            if isEmpty { self.state = .stopped }
-            return !isEmpty
-        }
-    }
-
-    override func dispose() {
-        super.dispose()
-
-        self.cancel.dispose()
-        self.scheduleDisposable.dispose()
-    }
-}
-
-#if TRACE_RESOURCES
-    private let numberOfSerialDispatchObservables = AtomicInt(0)
-    extension Resources {
-        /**
-         Counts number of `SerialDispatchQueueObservables`.
-
-         Purposed for unit tests.
-         */
-        public static var numberOfSerialDispatchQueueObservables: Int32 {
-            return load(numberOfSerialDispatchObservables)
-        }
-    }
-#endif
-
-final private class ObserveOnSerialDispatchQueueSink<Observer: ObserverType>: ObserverBase<Observer.Element> {
-    let scheduler: SerialDispatchQueueScheduler
-    let observer: Observer
-
-    let cancel: Cancelable
-
-    var cachedScheduleLambda: (((sink: ObserveOnSerialDispatchQueueSink<Observer>, event: Event<Element>)) -> Disposable)!
-
-    init(scheduler: SerialDispatchQueueScheduler, observer: Observer, cancel: Cancelable) {
-        self.scheduler = scheduler
-        self.observer = observer
-        self.cancel = cancel
-        super.init()
-
-        self.cachedScheduleLambda = { pair in
-            guard !cancel.isDisposed else { return Disposables.create() }
-
-            pair.sink.observer.on(pair.event)
-
-            if pair.event.isStopEvent {
-                pair.sink.dispose()
-            }
-
-            return Disposables.create()
-        }
-    }
-
-    override func onCore(_ event: Event<Element>) {
-        _ = self.scheduler.schedule((self, event), action: self.cachedScheduleLambda!)
-    }
-
-    override func dispose() {
-        super.dispose()
-
-        self.cancel.dispose()
-    }
-}
-
-final private class ObserveOnSerialDispatchQueue<Element>: Producer<Element> {
-    let scheduler: SerialDispatchQueueScheduler
-    let source: Observable<Element>
-
-    init(source: Observable<Element>, scheduler: SerialDispatchQueueScheduler) {
-        self.scheduler = scheduler
-        self.source = source
-
-        #if TRACE_RESOURCES
-            _ = Resources.incrementTotal()
-            _ = increment(numberOfSerialDispatchObservables)
-        #endif
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = ObserveOnSerialDispatchQueueSink(scheduler: self.scheduler, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-
-    #if TRACE_RESOURCES
-    deinit {
-        _ = Resources.decrementTotal()
-        _ = decrement(numberOfSerialDispatchObservables)
-    }
-    #endif
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Optional.swift b/Pods/RxSwift/RxSwift/Observables/Optional.swift
deleted file mode 100644
index 64f8f1fdd..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Optional.swift
+++ /dev/null
@@ -1,95 +0,0 @@
-//
-//  Optional.swift
-//  RxSwift
-//
-//  Created by tarunon on 2016/12/13.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Converts a optional to an observable sequence.
-
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-
-     - parameter optional: Optional element in the resulting observable sequence.
-     - returns: An observable sequence containing the wrapped value or not from given optional.
-     */
-    public static func from(optional: Element?) -> Observable<Element> {
-        ObservableOptional(optional: optional)
-    }
-
-    /**
-     Converts a optional to an observable sequence.
-
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-
-     - parameter optional: Optional element in the resulting observable sequence.
-     - parameter scheduler: Scheduler to send the optional element on.
-     - returns: An observable sequence containing the wrapped value or not from given optional.
-     */
-    public static func from(optional: Element?, scheduler: ImmediateSchedulerType) -> Observable<Element> {
-        ObservableOptionalScheduled(optional: optional, scheduler: scheduler)
-    }
-}
-
-final private class ObservableOptionalScheduledSink<Observer: ObserverType>: Sink<Observer> {
-    typealias Element = Observer.Element 
-    typealias Parent = ObservableOptionalScheduled<Element>
-
-    private let parent: Parent
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        return self.parent.scheduler.schedule(self.parent.optional) { (optional: Element?) -> Disposable in
-            if let next = optional {
-                self.forwardOn(.next(next))
-                return self.parent.scheduler.schedule(()) { _ in
-                    self.forwardOn(.completed)
-                    self.dispose()
-                    return Disposables.create()
-                }
-            } else {
-                self.forwardOn(.completed)
-                self.dispose()
-                return Disposables.create()
-            }
-        }
-    }
-}
-
-final private class ObservableOptionalScheduled<Element>: Producer<Element> {
-    fileprivate let optional: Element?
-    fileprivate let scheduler: ImmediateSchedulerType
-
-    init(optional: Element?, scheduler: ImmediateSchedulerType) {
-        self.optional = optional
-        self.scheduler = scheduler
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = ObservableOptionalScheduledSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class ObservableOptional<Element>: Producer<Element> {
-    private let optional: Element?
-    
-    init(optional: Element?) {
-        self.optional = optional
-    }
-    
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        if let element = self.optional {
-            observer.on(.next(element))
-        }
-        observer.on(.completed)
-        return Disposables.create()
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Producer.swift b/Pods/RxSwift/RxSwift/Observables/Producer.swift
deleted file mode 100644
index e611930a5..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Producer.swift
+++ /dev/null
@@ -1,92 +0,0 @@
-//
-//  Producer.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/20/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-class Producer<Element>: Observable<Element> {
-    override init() {
-        super.init()
-    }
-
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        if !CurrentThreadScheduler.isScheduleRequired {
-            // The returned disposable needs to release all references once it was disposed.
-            let disposer = SinkDisposer()
-            let sinkAndSubscription = self.run(observer, cancel: disposer)
-            disposer.setSinkAndSubscription(sink: sinkAndSubscription.sink, subscription: sinkAndSubscription.subscription)
-
-            return disposer
-        }
-        else {
-            return CurrentThreadScheduler.instance.schedule(()) { _ in
-                let disposer = SinkDisposer()
-                let sinkAndSubscription = self.run(observer, cancel: disposer)
-                disposer.setSinkAndSubscription(sink: sinkAndSubscription.sink, subscription: sinkAndSubscription.subscription)
-
-                return disposer
-            }
-        }
-    }
-
-    func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        rxAbstractMethod()
-    }
-}
-
-private final class SinkDisposer: Cancelable {
-    private enum DisposeState: Int32 {
-        case disposed = 1
-        case sinkAndSubscriptionSet = 2
-    }
-
-    private let state = AtomicInt(0)
-    private var sink: Disposable?
-    private var subscription: Disposable?
-
-    var isDisposed: Bool {
-        isFlagSet(self.state, DisposeState.disposed.rawValue)
-    }
-
-    func setSinkAndSubscription(sink: Disposable, subscription: Disposable) {
-        self.sink = sink
-        self.subscription = subscription
-
-        let previousState = fetchOr(self.state, DisposeState.sinkAndSubscriptionSet.rawValue)
-        if (previousState & DisposeState.sinkAndSubscriptionSet.rawValue) != 0 {
-            rxFatalError("Sink and subscription were already set")
-        }
-
-        if (previousState & DisposeState.disposed.rawValue) != 0 {
-            sink.dispose()
-            subscription.dispose()
-            self.sink = nil
-            self.subscription = nil
-        }
-    }
-
-    func dispose() {
-        let previousState = fetchOr(self.state, DisposeState.disposed.rawValue)
-
-        if (previousState & DisposeState.disposed.rawValue) != 0 {
-            return
-        }
-
-        if (previousState & DisposeState.sinkAndSubscriptionSet.rawValue) != 0 {
-            guard let sink = self.sink else {
-                rxFatalError("Sink not set")
-            }
-            guard let subscription = self.subscription else {
-                rxFatalError("Subscription not set")
-            }
-
-            sink.dispose()
-            subscription.dispose()
-
-            self.sink = nil
-            self.subscription = nil
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Range.swift b/Pods/RxSwift/RxSwift/Observables/Range.swift
deleted file mode 100644
index 245353249..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Range.swift
+++ /dev/null
@@ -1,73 +0,0 @@
-//
-//  Range.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 9/13/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType where Element: RxAbstractInteger {
-    /**
-     Generates an observable sequence of integral numbers within a specified range, using the specified scheduler to generate and send out observer messages.
-
-     - seealso: [range operator on reactivex.io](http://reactivex.io/documentation/operators/range.html)
-
-     - parameter start: The value of the first integer in the sequence.
-     - parameter count: The number of sequential integers to generate.
-     - parameter scheduler: Scheduler to run the generator loop on.
-     - returns: An observable sequence that contains a range of sequential integral numbers.
-     */
-    public static func range(start: Element, count: Element, scheduler: ImmediateSchedulerType = CurrentThreadScheduler.instance) -> Observable<Element> {
-        RangeProducer<Element>(start: start, count: count, scheduler: scheduler)
-    }
-}
-
-final private class RangeProducer<Element: RxAbstractInteger>: Producer<Element> {
-    fileprivate let start: Element
-    fileprivate let count: Element
-    fileprivate let scheduler: ImmediateSchedulerType
-
-    init(start: Element, count: Element, scheduler: ImmediateSchedulerType) {
-        guard count >= 0 else {
-            rxFatalError("count can't be negative")
-        }
-
-        guard start &+ (count - 1) >= start || count == 0 else {
-            rxFatalError("overflow of count")
-        }
-
-        self.start = start
-        self.count = count
-        self.scheduler = scheduler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = RangeSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class RangeSink<Observer: ObserverType>: Sink<Observer> where Observer.Element: RxAbstractInteger {
-    typealias Parent = RangeProducer<Observer.Element>
-    
-    private let parent: Parent
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        return self.parent.scheduler.scheduleRecursive(0 as Observer.Element) { i, recurse in
-            if i < self.parent.count {
-                self.forwardOn(.next(self.parent.start + i))
-                recurse(i + 1)
-            }
-            else {
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Reduce.swift b/Pods/RxSwift/RxSwift/Observables/Reduce.swift
deleted file mode 100644
index d5fab3478..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Reduce.swift
+++ /dev/null
@@ -1,109 +0,0 @@
-//
-//  Reduce.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 4/1/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-
-extension ObservableType {
-    /**
-    Applies an `accumulator` function over an observable sequence, returning the result of the aggregation as a single element in the result sequence. The specified `seed` value is used as the initial accumulator value.
-
-    For aggregation behavior with incremental intermediate results, see `scan`.
-
-    - seealso: [reduce operator on reactivex.io](http://reactivex.io/documentation/operators/reduce.html)
-
-    - parameter seed: The initial accumulator value.
-    - parameter accumulator: A accumulator function to be invoked on each element.
-    - parameter mapResult: A function to transform the final accumulator value into the result value.
-    - returns: An observable sequence containing a single element with the final accumulator value.
-    */
-    public func reduce<A, Result>(_ seed: A, accumulator: @escaping (A, Element) throws -> A, mapResult: @escaping (A) throws -> Result)
-        -> Observable<Result> {
-        Reduce(source: self.asObservable(), seed: seed, accumulator: accumulator, mapResult: mapResult)
-    }
-
-    /**
-    Applies an `accumulator` function over an observable sequence, returning the result of the aggregation as a single element in the result sequence. The specified `seed` value is used as the initial accumulator value.
-    
-    For aggregation behavior with incremental intermediate results, see `scan`.
-
-    - seealso: [reduce operator on reactivex.io](http://reactivex.io/documentation/operators/reduce.html)
-    
-    - parameter seed: The initial accumulator value.
-    - parameter accumulator: A accumulator function to be invoked on each element.
-    - returns: An observable sequence containing a single element with the final accumulator value.
-    */
-    public func reduce<A>(_ seed: A, accumulator: @escaping (A, Element) throws -> A)
-        -> Observable<A> {
-        Reduce(source: self.asObservable(), seed: seed, accumulator: accumulator, mapResult: { $0 })
-    }
-}
-
-final private class ReduceSink<SourceType, AccumulateType, Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias ResultType = Observer.Element 
-    typealias Parent = Reduce<SourceType, AccumulateType, ResultType>
-    
-    private let parent: Parent
-    private var accumulation: AccumulateType
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.accumulation = parent.seed
-        
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<SourceType>) {
-        switch event {
-        case .next(let value):
-            do {
-                self.accumulation = try self.parent.accumulator(self.accumulation, value)
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        case .error(let e):
-            self.forwardOn(.error(e))
-            self.dispose()
-        case .completed:
-            do {
-                let result = try self.parent.mapResult(self.accumulation)
-                self.forwardOn(.next(result))
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        }
-    }
-}
-
-final private class Reduce<SourceType, AccumulateType, ResultType>: Producer<ResultType> {
-    typealias AccumulatorType = (AccumulateType, SourceType) throws -> AccumulateType
-    typealias ResultSelectorType = (AccumulateType) throws -> ResultType
-    
-    private let source: Observable<SourceType>
-    fileprivate let seed: AccumulateType
-    fileprivate let accumulator: AccumulatorType
-    fileprivate let mapResult: ResultSelectorType
-    
-    init(source: Observable<SourceType>, seed: AccumulateType, accumulator: @escaping AccumulatorType, mapResult: @escaping ResultSelectorType) {
-        self.source = source
-        self.seed = seed
-        self.accumulator = accumulator
-        self.mapResult = mapResult
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == ResultType {
-        let sink = ReduceSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
-
diff --git a/Pods/RxSwift/RxSwift/Observables/Repeat.swift b/Pods/RxSwift/RxSwift/Observables/Repeat.swift
deleted file mode 100644
index 69a3ba02e..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Repeat.swift
+++ /dev/null
@@ -1,57 +0,0 @@
-//
-//  Repeat.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 9/13/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Generates an observable sequence that repeats the given element infinitely, using the specified scheduler to send out observer messages.
-
-     - seealso: [repeat operator on reactivex.io](http://reactivex.io/documentation/operators/repeat.html)
-
-     - parameter element: Element to repeat.
-     - parameter scheduler: Scheduler to run the producer loop on.
-     - returns: An observable sequence that repeats the given element infinitely.
-     */
-    public static func repeatElement(_ element: Element, scheduler: ImmediateSchedulerType = CurrentThreadScheduler.instance) -> Observable<Element> {
-        RepeatElement(element: element, scheduler: scheduler)
-    }
-}
-
-final private class RepeatElement<Element>: Producer<Element> {
-    fileprivate let element: Element
-    fileprivate let scheduler: ImmediateSchedulerType
-    
-    init(element: Element, scheduler: ImmediateSchedulerType) {
-        self.element = element
-        self.scheduler = scheduler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = RepeatElementSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class RepeatElementSink<Observer: ObserverType>: Sink<Observer> {
-    typealias Parent = RepeatElement<Observer.Element>
-    
-    private let parent: Parent
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        return self.parent.scheduler.scheduleRecursive(self.parent.element) { e, recurse in
-            self.forwardOn(.next(e))
-            recurse(e)
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/RetryWhen.swift b/Pods/RxSwift/RxSwift/Observables/RetryWhen.swift
deleted file mode 100644
index 52a27091b..000000000
--- a/Pods/RxSwift/RxSwift/Observables/RetryWhen.swift
+++ /dev/null
@@ -1,211 +0,0 @@
-//
-//  RetryWhen.swift
-//  RxSwift
-//
-//  Created by Junior B. on 06/10/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Repeats the source observable sequence on error when the notifier emits a next value.
-     If the source observable errors and the notifier completes, it will complete the source sequence.
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter notificationHandler: A handler that is passed an observable sequence of errors raised by the source observable and returns and observable that either continues, completes or errors. This behavior is then applied to the source observable.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully or is notified to error or complete.
-     */
-    public func retry<TriggerObservable: ObservableType, Error: Swift.Error>(when notificationHandler: @escaping (Observable<Error>) -> TriggerObservable)
-        -> Observable<Element> {
-        RetryWhenSequence(sources: InfiniteSequence(repeatedValue: self.asObservable()), notificationHandler: notificationHandler)
-    }
-
-    /**
-     Repeats the source observable sequence on error when the notifier emits a next value.
-     If the source observable errors and the notifier completes, it will complete the source sequence.
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter notificationHandler: A handler that is passed an observable sequence of errors raised by the source observable and returns and observable that either continues, completes or errors. This behavior is then applied to the source observable.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully or is notified to error or complete.
-     */
-    @available(*, deprecated, renamed: "retry(when:)")
-    public func retryWhen<TriggerObservable: ObservableType, Error: Swift.Error>(_ notificationHandler: @escaping (Observable<Error>) -> TriggerObservable)
-        -> Observable<Element> {
-        retry(when: notificationHandler)
-    }
-
-    /**
-     Repeats the source observable sequence on error when the notifier emits a next value.
-     If the source observable errors and the notifier completes, it will complete the source sequence.
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter notificationHandler: A handler that is passed an observable sequence of errors raised by the source observable and returns and observable that either continues, completes or errors. This behavior is then applied to the source observable.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully or is notified to error or complete.
-     */
-    public func retry<TriggerObservable: ObservableType>(when notificationHandler: @escaping (Observable<Swift.Error>) -> TriggerObservable)
-        -> Observable<Element> {
-        RetryWhenSequence(sources: InfiniteSequence(repeatedValue: self.asObservable()), notificationHandler: notificationHandler)
-    }
-
-    /**
-     Repeats the source observable sequence on error when the notifier emits a next value.
-     If the source observable errors and the notifier completes, it will complete the source sequence.
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter notificationHandler: A handler that is passed an observable sequence of errors raised by the source observable and returns and observable that either continues, completes or errors. This behavior is then applied to the source observable.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully or is notified to error or complete.
-     */
-    @available(*, deprecated, renamed: "retry(when:)")
-    public func retryWhen<TriggerObservable: ObservableType>(_ notificationHandler: @escaping (Observable<Swift.Error>) -> TriggerObservable)
-        -> Observable<Element> {
-        RetryWhenSequence(sources: InfiniteSequence(repeatedValue: self.asObservable()), notificationHandler: notificationHandler)
-    }
-}
-
-final private class RetryTriggerSink<Sequence: Swift.Sequence, Observer: ObserverType, TriggerObservable: ObservableType, Error>
-    : ObserverType where Sequence.Element: ObservableType, Sequence.Element.Element == Observer.Element {
-    typealias Element = TriggerObservable.Element
-    
-    typealias Parent = RetryWhenSequenceSinkIter<Sequence, Observer, TriggerObservable, Error>
-    
-    private let parent: Parent
-
-    init(parent: Parent) {
-        self.parent = parent
-    }
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.parent.parent.lastError = nil
-            self.parent.parent.schedule(.moveNext)
-        case .error(let e):
-            self.parent.parent.forwardOn(.error(e))
-            self.parent.parent.dispose()
-        case .completed:
-            self.parent.parent.forwardOn(.completed)
-            self.parent.parent.dispose()
-        }
-    }
-}
-
-final private class RetryWhenSequenceSinkIter<Sequence: Swift.Sequence, Observer: ObserverType, TriggerObservable: ObservableType, Error>
-    : ObserverType
-    , Disposable where Sequence.Element: ObservableType, Sequence.Element.Element == Observer.Element {
-    typealias Element = Observer.Element 
-    typealias Parent = RetryWhenSequenceSink<Sequence, Observer, TriggerObservable, Error>
-
-    fileprivate let parent: Parent
-    private let errorHandlerSubscription = SingleAssignmentDisposable()
-    private let subscription: Disposable
-
-    init(parent: Parent, subscription: Disposable) {
-        self.parent = parent
-        self.subscription = subscription
-    }
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.parent.forwardOn(event)
-        case .error(let error):
-            self.parent.lastError = error
-
-            if let failedWith = error as? Error {
-                // dispose current subscription
-                self.subscription.dispose()
-
-                let errorHandlerSubscription = self.parent.notifier.subscribe(RetryTriggerSink(parent: self))
-                self.errorHandlerSubscription.setDisposable(errorHandlerSubscription)
-                self.parent.errorSubject.on(.next(failedWith))
-            }
-            else {
-                self.parent.forwardOn(.error(error))
-                self.parent.dispose()
-            }
-        case .completed:
-            self.parent.forwardOn(event)
-            self.parent.dispose()
-        }
-    }
-
-    final func dispose() {
-        self.subscription.dispose()
-        self.errorHandlerSubscription.dispose()
-    }
-}
-
-final private class RetryWhenSequenceSink<Sequence: Swift.Sequence, Observer: ObserverType, TriggerObservable: ObservableType, Error>
-    : TailRecursiveSink<Sequence, Observer> where Sequence.Element: ObservableType, Sequence.Element.Element == Observer.Element {
-    typealias Element = Observer.Element 
-    typealias Parent = RetryWhenSequence<Sequence, TriggerObservable, Error>
-    
-    let lock = RecursiveLock()
-    
-    private let parent: Parent
-    
-    fileprivate var lastError: Swift.Error?
-    fileprivate let errorSubject = PublishSubject<Error>()
-    private let handler: Observable<TriggerObservable.Element>
-    fileprivate let notifier = PublishSubject<TriggerObservable.Element>()
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.handler = parent.notificationHandler(self.errorSubject).asObservable()
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    override func done() {
-        if let lastError = self.lastError {
-            self.forwardOn(.error(lastError))
-            self.lastError = nil
-        }
-        else {
-            self.forwardOn(.completed)
-        }
-
-        self.dispose()
-    }
-    
-    override func extract(_ observable: Observable<Element>) -> SequenceGenerator? {
-        // It is important to always return `nil` here because there are sideffects in the `run` method
-        // that are dependant on particular `retryWhen` operator so single operator stack can't be reused in this
-        // case.
-        return nil
-    }
-
-    override func subscribeToNext(_ source: Observable<Element>) -> Disposable {
-        let subscription = SingleAssignmentDisposable()
-        let iter = RetryWhenSequenceSinkIter(parent: self, subscription: subscription)
-        subscription.setDisposable(source.subscribe(iter))
-        return iter
-    }
-
-    override func run(_ sources: SequenceGenerator) -> Disposable {
-        let triggerSubscription = self.handler.subscribe(self.notifier.asObserver())
-        let superSubscription = super.run(sources)
-        return Disposables.create(superSubscription, triggerSubscription)
-    }
-}
-
-final private class RetryWhenSequence<Sequence: Swift.Sequence, TriggerObservable: ObservableType, Error>: Producer<Sequence.Element.Element> where Sequence.Element: ObservableType {
-    typealias Element = Sequence.Element.Element
-    
-    private let sources: Sequence
-    fileprivate let notificationHandler: (Observable<Error>) -> TriggerObservable
-    
-    init(sources: Sequence, notificationHandler: @escaping (Observable<Error>) -> TriggerObservable) {
-        self.sources = sources
-        self.notificationHandler = notificationHandler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = RetryWhenSequenceSink<Sequence, Observer, TriggerObservable, Error>(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run((self.sources.makeIterator(), nil))
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Sample.swift b/Pods/RxSwift/RxSwift/Observables/Sample.swift
deleted file mode 100644
index 9301c9af7..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Sample.swift
+++ /dev/null
@@ -1,139 +0,0 @@
-//
-//  Sample.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 5/1/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Samples the source observable sequence using a sampler observable sequence producing sampling ticks.
-
-     Upon each sampling tick, the latest element (if any) in the source sequence during the last sampling interval is sent to the resulting sequence.
-
-     **In case there were no new elements between sampler ticks, you may provide a default value to be emitted, instead
-       to the resulting sequence otherwise no element is sent.**
-
-     - seealso: [sample operator on reactivex.io](http://reactivex.io/documentation/operators/sample.html)
-
-     - parameter sampler: Sampling tick sequence.
-     - parameter defaultValue: a value to return if there are no new elements between sampler ticks
-     - returns: Sampled observable sequence.
-     */
-    public func sample<Source: ObservableType>(_ sampler: Source, defaultValue: Element? = nil)
-        -> Observable<Element> {
-            return Sample(source: self.asObservable(), sampler: sampler.asObservable(), defaultValue: defaultValue)
-    }
-}
-
-final private class SamplerSink<Observer: ObserverType, SampleType>
-    : ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias Element = SampleType
-    
-    typealias Parent = SampleSequenceSink<Observer, SampleType>
-    
-    private let parent: Parent
-
-    var lock: RecursiveLock {
-        self.parent.lock
-    }
-    
-    init(parent: Parent) {
-        self.parent = parent
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next, .completed:
-            if let element = parent.element ?? self.parent.defaultValue {
-                self.parent.element = nil
-                self.parent.forwardOn(.next(element))
-            }
-
-            if self.parent.atEnd {
-                self.parent.forwardOn(.completed)
-                self.parent.dispose()
-            }
-        case .error(let e):
-            self.parent.forwardOn(.error(e))
-            self.parent.dispose()
-        }
-    }
-}
-
-final private class SampleSequenceSink<Observer: ObserverType, SampleType>
-    : Sink<Observer>
-    , ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias Element = Observer.Element 
-    typealias Parent = Sample<Element, SampleType>
-    
-    fileprivate let parent: Parent
-    fileprivate let defaultValue: Element?
-
-    let lock = RecursiveLock()
-    
-    // state
-    fileprivate var element = nil as Element?
-    fileprivate var atEnd = false
-    
-    private let sourceSubscription = SingleAssignmentDisposable()
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable, defaultValue: Element? = nil) {
-        self.parent = parent
-        self.defaultValue = defaultValue
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        self.sourceSubscription.setDisposable(self.parent.source.subscribe(self))
-        let samplerSubscription = self.parent.sampler.subscribe(SamplerSink(parent: self))
-        
-        return Disposables.create(sourceSubscription, samplerSubscription)
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next(let element):
-            self.element = element
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            self.atEnd = true
-            self.sourceSubscription.dispose()
-        }
-    }
-    
-}
-
-final private class Sample<Element, SampleType>: Producer<Element> {
-    fileprivate let source: Observable<Element>
-    fileprivate let sampler: Observable<SampleType>
-    fileprivate let defaultValue: Element?
-    
-    init(source: Observable<Element>, sampler: Observable<SampleType>, defaultValue: Element? = nil) {
-        self.source = source
-        self.sampler = sampler
-        self.defaultValue = defaultValue
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = SampleSequenceSink(parent: self, observer: observer, cancel: cancel, defaultValue: self.defaultValue)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Scan.swift b/Pods/RxSwift/RxSwift/Observables/Scan.swift
deleted file mode 100644
index ecf69c80c..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Scan.swift
+++ /dev/null
@@ -1,100 +0,0 @@
-//
-//  Scan.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Applies an accumulator function over an observable sequence and returns each intermediate result. The specified seed value is used as the initial accumulator value.
-
-     For aggregation behavior with no intermediate results, see `reduce`.
-
-     - seealso: [scan operator on reactivex.io](http://reactivex.io/documentation/operators/scan.html)
-
-     - parameter seed: The initial accumulator value.
-     - parameter accumulator: An accumulator function to be invoked on each element.
-     - returns: An observable sequence containing the accumulated values.
-     */
-    public func scan<A>(into seed: A, accumulator: @escaping (inout A, Element) throws -> Void)
-        -> Observable<A> {
-        Scan(source: self.asObservable(), seed: seed, accumulator: accumulator)
-    }
-
-    /**
-     Applies an accumulator function over an observable sequence and returns each intermediate result. The specified seed value is used as the initial accumulator value.
-
-     For aggregation behavior with no intermediate results, see `reduce`.
-
-     - seealso: [scan operator on reactivex.io](http://reactivex.io/documentation/operators/scan.html)
-
-     - parameter seed: The initial accumulator value.
-     - parameter accumulator: An accumulator function to be invoked on each element.
-     - returns: An observable sequence containing the accumulated values.
-     */
-    public func scan<A>(_ seed: A, accumulator: @escaping (A, Element) throws -> A)
-        -> Observable<A> {
-        return Scan(source: self.asObservable(), seed: seed) { acc, element in
-            let currentAcc = acc
-            acc = try accumulator(currentAcc, element)
-        }
-    }
-}
-
-final private class ScanSink<Element, Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Accumulate = Observer.Element 
-    typealias Parent = Scan<Element, Accumulate>
-
-    private let parent: Parent
-    private var accumulate: Accumulate
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.accumulate = parent.seed
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let element):
-            do {
-                try self.parent.accumulator(&self.accumulate, element)
-                self.forwardOn(.next(self.accumulate))
-            }
-            catch let error {
-                self.forwardOn(.error(error))
-                self.dispose()
-            }
-        case .error(let error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-    
-}
-
-final private class Scan<Element, Accumulate>: Producer<Accumulate> {
-    typealias Accumulator = (inout Accumulate, Element) throws -> Void
-    
-    private let source: Observable<Element>
-    fileprivate let seed: Accumulate
-    fileprivate let accumulator: Accumulator
-    
-    init(source: Observable<Element>, seed: Accumulate, accumulator: @escaping Accumulator) {
-        self.source = source
-        self.seed = seed
-        self.accumulator = accumulator
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Accumulate {
-        let sink = ScanSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Sequence.swift b/Pods/RxSwift/RxSwift/Observables/Sequence.swift
deleted file mode 100644
index c6d10896e..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Sequence.swift
+++ /dev/null
@@ -1,89 +0,0 @@
-//
-//  Sequence.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 11/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    // MARK: of
-
-    /**
-     This method creates a new Observable instance with a variable number of elements.
-
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-
-     - parameter elements: Elements to generate.
-     - parameter scheduler: Scheduler to send elements on. If `nil`, elements are sent immediately on subscription.
-     - returns: The observable sequence whose elements are pulled from the given arguments.
-     */
-    public static func of(_ elements: Element ..., scheduler: ImmediateSchedulerType = CurrentThreadScheduler.instance) -> Observable<Element> {
-        ObservableSequence(elements: elements, scheduler: scheduler)
-    }
-}
-
-extension ObservableType {
-    /**
-     Converts an array to an observable sequence.
-
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-
-     - returns: The observable sequence whose elements are pulled from the given enumerable sequence.
-     */
-    public static func from(_ array: [Element], scheduler: ImmediateSchedulerType = CurrentThreadScheduler.instance) -> Observable<Element> {
-        ObservableSequence(elements: array, scheduler: scheduler)
-    }
-
-    /**
-     Converts a sequence to an observable sequence.
-
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-
-     - returns: The observable sequence whose elements are pulled from the given enumerable sequence.
-     */
-    public static func from<Sequence: Swift.Sequence>(_ sequence: Sequence, scheduler: ImmediateSchedulerType = CurrentThreadScheduler.instance) -> Observable<Element> where Sequence.Element == Element {
-        ObservableSequence(elements: sequence, scheduler: scheduler)
-    }
-}
-
-final private class ObservableSequenceSink<Sequence: Swift.Sequence, Observer: ObserverType>: Sink<Observer> where Sequence.Element == Observer.Element {
-    typealias Parent = ObservableSequence<Sequence>
-
-    private let parent: Parent
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        return self.parent.scheduler.scheduleRecursive(self.parent.elements.makeIterator()) { iterator, recurse in
-            var mutableIterator = iterator
-            if let next = mutableIterator.next() {
-                self.forwardOn(.next(next))
-                recurse(mutableIterator)
-            }
-            else {
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-        }
-    }
-}
-
-final private class ObservableSequence<Sequence: Swift.Sequence>: Producer<Sequence.Element> {
-    fileprivate let elements: Sequence
-    fileprivate let scheduler: ImmediateSchedulerType
-
-    init(elements: Sequence, scheduler: ImmediateSchedulerType) {
-        self.elements = elements
-        self.scheduler = scheduler
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = ObservableSequenceSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/ShareReplayScope.swift b/Pods/RxSwift/RxSwift/Observables/ShareReplayScope.swift
deleted file mode 100644
index 59d440dc3..000000000
--- a/Pods/RxSwift/RxSwift/Observables/ShareReplayScope.swift
+++ /dev/null
@@ -1,443 +0,0 @@
-//
-//  ShareReplayScope.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 5/28/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-/// Subject lifetime scope
-public enum SubjectLifetimeScope {
-    /**
-     **Each connection will have it's own subject instance to store replay events.**
-     **Connections will be isolated from each another.**
-
-     Configures the underlying implementation to behave equivalent to.
-     
-     ```
-     source.multicast(makeSubject: { MySubject() }).refCount()
-     ```
-
-     **This is the recommended default.**
-
-     This has the following consequences:
-     * `retry` or `concat` operators will function as expected because terminating the sequence will clear internal state.
-     * Each connection to source observable sequence will use it's own subject.
-     * When the number of subscribers drops from 1 to 0 and connection to source sequence is disposed, subject will be cleared.
-
-     
-     ```
-     let xs = Observable.deferred { () -> Observable<TimeInterval> in
-             print("Performing work ...")
-             return Observable.just(Date().timeIntervalSince1970)
-         }
-         .share(replay: 1, scope: .whileConnected)
-
-     _ = xs.subscribe(onNext: { print("next \($0)") }, onCompleted: { print("completed\n") })
-     _ = xs.subscribe(onNext: { print("next \($0)") }, onCompleted: { print("completed\n") })
-     _ = xs.subscribe(onNext: { print("next \($0)") }, onCompleted: { print("completed\n") })
-
-     ```
-
-     Notice how time interval is different and `Performing work ...` is printed each time)
-     
-     ```
-     Performing work ...
-     next 1495998900.82141
-     completed
-
-     Performing work ...
-     next 1495998900.82359
-     completed
-
-     Performing work ...
-     next 1495998900.82444
-     completed
-
-
-     ```
-     
-     */
-    case whileConnected
-
-    /**
-     **One subject will store replay events for all connections to source.**
-     **Connections won't be isolated from each another.**
-
-     Configures the underlying implementation behave equivalent to.
-
-     ```
-     source.multicast(MySubject()).refCount()
-     ```
-     
-     This has the following consequences:
-     * Using `retry` or `concat` operators after this operator usually isn't advised.
-     * Each connection to source observable sequence will share the same subject.
-     * After number of subscribers drops from 1 to 0 and connection to source observable sequence is dispose, this operator will 
-       continue holding a reference to the same subject.
-       If at some later moment a new observer initiates a new connection to source it can potentially receive
-       some of the stale events received during previous connection.
-     * After source sequence terminates any new observer will always immediately receive replayed elements and terminal event.
-       No new subscriptions to source observable sequence will be attempted.
-
-     ```
-     let xs = Observable.deferred { () -> Observable<TimeInterval> in
-             print("Performing work ...")
-             return Observable.just(Date().timeIntervalSince1970)
-         }
-         .share(replay: 1, scope: .forever)
-
-     _ = xs.subscribe(onNext: { print("next \($0)") }, onCompleted: { print("completed\n") })
-     _ = xs.subscribe(onNext: { print("next \($0)") }, onCompleted: { print("completed\n") })
-     _ = xs.subscribe(onNext: { print("next \($0)") }, onCompleted: { print("completed\n") })
-     ```
-     
-     Notice how time interval is the same, replayed, and `Performing work ...` is printed only once
-     
-     ```
-     Performing work ...
-     next 1495999013.76356
-     completed
-
-     next 1495999013.76356
-     completed
-
-     next 1495999013.76356
-     completed
-     ```
-     
-    */
-    case forever
-}
-
-extension ObservableType {
-
-    /**
-     Returns an observable sequence that **shares a single subscription to the underlying sequence**, and immediately upon subscription replays  elements in buffer.
-     
-     This operator is equivalent to:
-     * `.whileConnected`
-     ```
-     // Each connection will have it's own subject instance to store replay events.
-     // Connections will be isolated from each another.
-     source.multicast(makeSubject: { Replay.create(bufferSize: replay) }).refCount()
-     ```
-     * `.forever`
-     ```
-     // One subject will store replay events for all connections to source.
-     // Connections won't be isolated from each another.
-     source.multicast(Replay.create(bufferSize: replay)).refCount()
-     ```
-     
-     It uses optimized versions of the operators for most common operations.
-
-     - parameter replay: Maximum element count of the replay buffer.
-     - parameter scope: Lifetime scope of sharing subject. For more information see `SubjectLifetimeScope` enum.
-
-     - seealso: [shareReplay operator on reactivex.io](http://reactivex.io/documentation/operators/replay.html)
-
-     - returns: An observable sequence that contains the elements of a sequence produced by multicasting the source sequence.
-     */
-    public func share(replay: Int = 0, scope: SubjectLifetimeScope = .whileConnected)
-        -> Observable<Element> {
-        switch scope {
-        case .forever:
-            switch replay {
-            case 0: return self.multicast(PublishSubject()).refCount()
-            default: return self.multicast(ReplaySubject.create(bufferSize: replay)).refCount()
-            }
-        case .whileConnected:
-            switch replay {
-            case 0: return ShareWhileConnected(source: self.asObservable())
-            case 1: return ShareReplay1WhileConnected(source: self.asObservable())
-            default: return self.multicast(makeSubject: { ReplaySubject.create(bufferSize: replay) }).refCount()
-            }
-        }
-    }
-}
-
-private final class ShareReplay1WhileConnectedConnection<Element>
-    : ObserverType
-    , SynchronizedUnsubscribeType {
-    typealias Observers = AnyObserver<Element>.s
-    typealias DisposeKey = Observers.KeyType
-
-    typealias Parent = ShareReplay1WhileConnected<Element>
-    private let parent: Parent
-    private let subscription = SingleAssignmentDisposable()
-
-    private let lock: RecursiveLock
-    private var disposed: Bool = false
-    fileprivate var observers = Observers()
-    private var element: Element?
-
-    init(parent: Parent, lock: RecursiveLock) {
-        self.parent = parent
-        self.lock = lock
-
-        #if TRACE_RESOURCES
-            _ = Resources.incrementTotal()
-        #endif
-    }
-
-    final func on(_ event: Event<Element>) {
-        let observers = self.lock.performLocked { self.synchronized_on(event) }
-        dispatch(observers, event)
-    }
-
-    final private func synchronized_on(_ event: Event<Element>) -> Observers {
-        if self.disposed {
-            return Observers()
-        }
-
-        switch event {
-        case .next(let element):
-            self.element = element
-            return self.observers
-        case .error, .completed:
-            let observers = self.observers
-            self.synchronized_dispose()
-            return observers
-        }
-    }
-
-    final func connect() {
-        self.subscription.setDisposable(self.parent.source.subscribe(self))
-    }
-
-    final func synchronized_subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.lock.performLocked {
-            if let element = self.element {
-                observer.on(.next(element))
-            }
-
-            let disposeKey = self.observers.insert(observer.on)
-
-            return SubscriptionDisposable(owner: self, key: disposeKey)
-        }
-    }
-
-    final private func synchronized_dispose() {
-        self.disposed = true
-        if self.parent.connection === self {
-            self.parent.connection = nil
-        }
-        self.observers = Observers()
-    }
-
-    final func synchronizedUnsubscribe(_ disposeKey: DisposeKey) {
-        if self.lock.performLocked({ self.synchronized_unsubscribe(disposeKey) }) {
-            self.subscription.dispose()
-        }
-    }
-
-    @inline(__always)
-    final private func synchronized_unsubscribe(_ disposeKey: DisposeKey) -> Bool {
-        // if already unsubscribed, just return
-        if self.observers.removeKey(disposeKey) == nil {
-            return false
-        }
-
-        if self.observers.count == 0 {
-            self.synchronized_dispose()
-            return true
-        }
-
-        return false
-    }
-
-    #if TRACE_RESOURCES
-        deinit {
-            _ = Resources.decrementTotal()
-        }
-    #endif
-}
-
-// optimized version of share replay for most common case
-final private class ShareReplay1WhileConnected<Element>
-    : Observable<Element> {
-
-    fileprivate typealias Connection = ShareReplay1WhileConnectedConnection<Element>
-
-    fileprivate let source: Observable<Element>
-
-    private let lock = RecursiveLock()
-
-    fileprivate var connection: Connection?
-
-    init(source: Observable<Element>) {
-        self.source = source
-    }
-
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.lock.lock()
-        let connection = self.synchronized_subscribe(observer)
-        let count = connection.observers.count
-
-        let disposable = connection.synchronized_subscribe(observer)
-        self.lock.unlock()
-        
-        if count == 0 {
-            connection.connect()
-        }
-
-        return disposable
-    }
-
-    @inline(__always)
-    private func synchronized_subscribe<Observer: ObserverType>(_ observer: Observer) -> Connection where Observer.Element == Element {
-        let connection: Connection
-
-        if let existingConnection = self.connection {
-            connection = existingConnection
-        }
-        else {
-            connection = ShareReplay1WhileConnectedConnection<Element>(
-                parent: self,
-                lock: self.lock)
-            self.connection = connection
-        }
-
-        return connection
-    }
-}
-
-private final class ShareWhileConnectedConnection<Element>
-    : ObserverType
-    , SynchronizedUnsubscribeType {
-    typealias Observers = AnyObserver<Element>.s
-    typealias DisposeKey = Observers.KeyType
-
-    typealias Parent = ShareWhileConnected<Element>
-    private let parent: Parent
-    private let subscription = SingleAssignmentDisposable()
-
-    private let lock: RecursiveLock
-    private var disposed: Bool = false
-    fileprivate var observers = Observers()
-
-    init(parent: Parent, lock: RecursiveLock) {
-        self.parent = parent
-        self.lock = lock
-
-        #if TRACE_RESOURCES
-            _ = Resources.incrementTotal()
-        #endif
-    }
-
-    final func on(_ event: Event<Element>) {
-        let observers = self.lock.performLocked { self.synchronized_on(event) }
-        dispatch(observers, event)
-    }
-
-    final private func synchronized_on(_ event: Event<Element>) -> Observers {
-        if self.disposed {
-            return Observers()
-        }
-
-        switch event {
-        case .next:
-            return self.observers
-        case .error, .completed:
-            let observers = self.observers
-            self.synchronized_dispose()
-            return observers
-        }
-    }
-
-    final func connect() {
-        self.subscription.setDisposable(self.parent.source.subscribe(self))
-    }
-
-    final func synchronized_subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.lock.performLocked {
-            let disposeKey = self.observers.insert(observer.on)
-
-            return SubscriptionDisposable(owner: self, key: disposeKey)
-        }
-    }
-
-    final private func synchronized_dispose() {
-        self.disposed = true
-        if self.parent.connection === self {
-            self.parent.connection = nil
-        }
-        self.observers = Observers()
-    }
-
-    final func synchronizedUnsubscribe(_ disposeKey: DisposeKey) {
-        if self.lock.performLocked({ self.synchronized_unsubscribe(disposeKey) }) {
-            self.subscription.dispose()
-        }
-    }
-
-    @inline(__always)
-    final private func synchronized_unsubscribe(_ disposeKey: DisposeKey) -> Bool {
-        // if already unsubscribed, just return
-        if self.observers.removeKey(disposeKey) == nil {
-            return false
-        }
-
-        if self.observers.count == 0 {
-            self.synchronized_dispose()
-            return true
-        }
-
-        return false
-    }
-
-    #if TRACE_RESOURCES
-    deinit {
-        _ = Resources.decrementTotal()
-    }
-    #endif
-}
-
-// optimized version of share replay for most common case
-final private class ShareWhileConnected<Element>
-    : Observable<Element> {
-
-    fileprivate typealias Connection = ShareWhileConnectedConnection<Element>
-
-    fileprivate let source: Observable<Element>
-
-    private let lock = RecursiveLock()
-
-    fileprivate var connection: Connection?
-
-    init(source: Observable<Element>) {
-        self.source = source
-    }
-
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.lock.lock()
-        let connection = self.synchronized_subscribe(observer)
-        let count = connection.observers.count
-
-        let disposable = connection.synchronized_subscribe(observer)
-        self.lock.unlock()
-
-        if count == 0 {
-            connection.connect()
-        }
-
-        return disposable
-    }
-
-    @inline(__always)
-    private func synchronized_subscribe<Observer: ObserverType>(_ observer: Observer) -> Connection where Observer.Element == Element {
-        let connection: Connection
-
-        if let existingConnection = self.connection {
-            connection = existingConnection
-        }
-        else {
-            connection = ShareWhileConnectedConnection<Element>(
-                parent: self,
-                lock: self.lock)
-            self.connection = connection
-        }
-        
-        return connection
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/SingleAsync.swift b/Pods/RxSwift/RxSwift/Observables/SingleAsync.swift
deleted file mode 100644
index 04e221764..000000000
--- a/Pods/RxSwift/RxSwift/Observables/SingleAsync.swift
+++ /dev/null
@@ -1,104 +0,0 @@
-//
-//  SingleAsync.swift
-//  RxSwift
-//
-//  Created by Junior B. on 09/11/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     The single operator is similar to first, but throws a `RxError.noElements` or `RxError.moreThanOneElement`
-     if the source Observable does not emit exactly one element before successfully completing.
-
-     - seealso: [single operator on reactivex.io](http://reactivex.io/documentation/operators/first.html)
-
-     - returns: An observable sequence that emits a single element or throws an exception if more (or none) of them are emitted.
-     */
-    public func single()
-        -> Observable<Element> {
-        SingleAsync(source: self.asObservable())
-    }
-
-    /**
-     The single operator is similar to first, but throws a `RxError.NoElements` or `RxError.MoreThanOneElement`
-     if the source Observable does not emit exactly one element before successfully completing.
-
-     - seealso: [single operator on reactivex.io](http://reactivex.io/documentation/operators/first.html)
-
-     - parameter predicate: A function to test each source element for a condition.
-     - returns: An observable sequence that emits a single element or throws an exception if more (or none) of them are emitted.
-     */
-    public func single(_ predicate: @escaping (Element) throws -> Bool)
-        -> Observable<Element> {
-        SingleAsync(source: self.asObservable(), predicate: predicate)
-    }
-}
-
-private final class SingleAsyncSink<Observer: ObserverType> : Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element
-    typealias Parent = SingleAsync<Element>
-    
-    private let parent: Parent
-    private var seenValue: Bool = false
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            do {
-                let forward = try self.parent.predicate?(value) ?? true
-                if !forward {
-                    return
-                }
-            }
-            catch let error {
-                self.forwardOn(.error(error as Swift.Error))
-                self.dispose()
-                return
-            }
-
-            if self.seenValue {
-                self.forwardOn(.error(RxError.moreThanOneElement))
-                self.dispose()
-                return
-            }
-
-            self.seenValue = true
-            self.forwardOn(.next(value))
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            if self.seenValue {
-                self.forwardOn(.completed)
-            } else {
-                self.forwardOn(.error(RxError.noElements))
-            }
-            self.dispose()
-        }
-    }
-}
-
-final class SingleAsync<Element>: Producer<Element> {
-    typealias Predicate = (Element) throws -> Bool
-    
-    private let source: Observable<Element>
-    fileprivate let predicate: Predicate?
-    
-    init(source: Observable<Element>, predicate: Predicate? = nil) {
-        self.source = source
-        self.predicate = predicate
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = SingleAsyncSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Sink.swift b/Pods/RxSwift/RxSwift/Observables/Sink.swift
deleted file mode 100644
index ed4fec01e..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Sink.swift
+++ /dev/null
@@ -1,75 +0,0 @@
-//
-//  Sink.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-class Sink<Observer: ObserverType>: Disposable {
-    fileprivate let observer: Observer
-    fileprivate let cancel: Cancelable
-    private let disposed = AtomicInt(0)
-
-    #if DEBUG
-        private let synchronizationTracker = SynchronizationTracker()
-    #endif
-
-    init(observer: Observer, cancel: Cancelable) {
-#if TRACE_RESOURCES
-        _ = Resources.incrementTotal()
-#endif
-        self.observer = observer
-        self.cancel = cancel
-    }
-
-    final func forwardOn(_ event: Event<Observer.Element>) {
-        #if DEBUG
-            self.synchronizationTracker.register(synchronizationErrorMessage: .default)
-            defer { self.synchronizationTracker.unregister() }
-        #endif
-        if isFlagSet(self.disposed, 1) {
-            return
-        }
-        self.observer.on(event)
-    }
-
-    final func forwarder() -> SinkForward<Observer> {
-        SinkForward(forward: self)
-    }
-
-    final var isDisposed: Bool {
-        isFlagSet(self.disposed, 1)
-    }
-
-    func dispose() {
-        fetchOr(self.disposed, 1)
-        self.cancel.dispose()
-    }
-
-    deinit {
-#if TRACE_RESOURCES
-       _ =  Resources.decrementTotal()
-#endif
-    }
-}
-
-final class SinkForward<Observer: ObserverType>: ObserverType {
-    typealias Element = Observer.Element 
-
-    private let forward: Sink<Observer>
-
-    init(forward: Sink<Observer>) {
-        self.forward = forward
-    }
-
-    final func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.forward.observer.on(event)
-        case .error, .completed:
-            self.forward.observer.on(event)
-            self.forward.cancel.dispose()
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Skip.swift b/Pods/RxSwift/RxSwift/Observables/Skip.swift
deleted file mode 100644
index 5856f3744..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Skip.swift
+++ /dev/null
@@ -1,158 +0,0 @@
-//
-//  Skip.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/25/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Bypasses a specified number of elements in an observable sequence and then returns the remaining elements.
-
-     - seealso: [skip operator on reactivex.io](http://reactivex.io/documentation/operators/skip.html)
-
-     - parameter count: The number of elements to skip before returning the remaining elements.
-     - returns: An observable sequence that contains the elements that occur after the specified index in the input sequence.
-     */
-    public func skip(_ count: Int)
-        -> Observable<Element> {
-        SkipCount(source: self.asObservable(), count: count)
-    }
-}
-
-extension ObservableType {
-
-    /**
-     Skips elements for the specified duration from the start of the observable source sequence, using the specified scheduler to run timers.
-
-     - seealso: [skip operator on reactivex.io](http://reactivex.io/documentation/operators/skip.html)
-
-     - parameter duration: Duration for skipping elements from the start of the sequence.
-     - parameter scheduler: Scheduler to run the timer on.
-     - returns: An observable sequence with the elements skipped during the specified duration from the start of the source sequence.
-     */
-    public func skip(_ duration: RxTimeInterval, scheduler: SchedulerType)
-        -> Observable<Element> {
-        SkipTime(source: self.asObservable(), duration: duration, scheduler: scheduler)
-    }
-}
-
-// count version
-
-final private class SkipCountSink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = SkipCount<Element>
-    
-    let parent: Parent
-    
-    var remaining: Int
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.remaining = parent.count
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            
-            if self.remaining <= 0 {
-                self.forwardOn(.next(value))
-            }
-            else {
-                self.remaining -= 1
-            }
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-    
-}
-
-final private class SkipCount<Element>: Producer<Element> {
-    let source: Observable<Element>
-    let count: Int
-    
-    init(source: Observable<Element>, count: Int) {
-        self.source = source
-        self.count = count
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = SkipCountSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-// time version
-
-final private class SkipTimeSink<Element, Observer: ObserverType>: Sink<Observer>, ObserverType where Observer.Element == Element {
-    typealias Parent = SkipTime<Element>
-
-    let parent: Parent
-    
-    // state
-    var open = false
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            if self.open {
-                self.forwardOn(.next(value))
-            }
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-    
-    func tick() {
-        self.open = true
-    }
-    
-    func run() -> Disposable {
-        let disposeTimer = self.parent.scheduler.scheduleRelative((), dueTime: self.parent.duration) { _ in 
-            self.tick()
-            return Disposables.create()
-        }
-        
-        let disposeSubscription = self.parent.source.subscribe(self)
-        
-        return Disposables.create(disposeTimer, disposeSubscription)
-    }
-}
-
-final private class SkipTime<Element>: Producer<Element> {
-    let source: Observable<Element>
-    let duration: RxTimeInterval
-    let scheduler: SchedulerType
-    
-    init(source: Observable<Element>, duration: RxTimeInterval, scheduler: SchedulerType) {
-        self.source = source
-        self.scheduler = scheduler
-        self.duration = duration
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = SkipTimeSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/SkipUntil.swift b/Pods/RxSwift/RxSwift/Observables/SkipUntil.swift
deleted file mode 100644
index c8fe19340..000000000
--- a/Pods/RxSwift/RxSwift/Observables/SkipUntil.swift
+++ /dev/null
@@ -1,152 +0,0 @@
-//
-//  SkipUntil.swift
-//  RxSwift
-//
-//  Created by Yury Korolev on 10/3/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Returns the elements from the source observable sequence that are emitted after the other observable sequence produces an element.
-
-     - seealso: [skipUntil operator on reactivex.io](http://reactivex.io/documentation/operators/skipuntil.html)
-
-     - parameter other: Observable sequence that starts propagation of elements of the source sequence.
-     - returns: An observable sequence containing the elements of the source sequence that are emitted after the other sequence emits an item.
-     */
-    public func skip<Source: ObservableType>(until other: Source)
-        -> Observable<Element> {
-        SkipUntil(source: self.asObservable(), other: other.asObservable())
-    }
-
-    /**
-     Returns the elements from the source observable sequence that are emitted after the other observable sequence produces an element.
-
-     - seealso: [skipUntil operator on reactivex.io](http://reactivex.io/documentation/operators/skipuntil.html)
-
-     - parameter other: Observable sequence that starts propagation of elements of the source sequence.
-     - returns: An observable sequence containing the elements of the source sequence that are emitted after the other sequence emits an item.
-     */
-    @available(*, deprecated, renamed: "skip(until:)")
-    public func skipUntil<Source: ObservableType>(_ other: Source)
-        -> Observable<Element> {
-        skip(until: other)
-    }
-}
-
-final private class SkipUntilSinkOther<Other, Observer: ObserverType>
-    : ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias Parent = SkipUntilSink<Other, Observer>
-    typealias Element = Other
-    
-    private let parent: Parent
-
-    var lock: RecursiveLock {
-        self.parent.lock
-    }
-    
-    let subscription = SingleAssignmentDisposable()
-
-    init(parent: Parent) {
-        self.parent = parent
-        #if TRACE_RESOURCES
-            _ = Resources.incrementTotal()
-        #endif
-    }
-
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.parent.forwardElements = true
-            self.subscription.dispose()
-        case .error(let e):
-            self.parent.forwardOn(.error(e))
-            self.parent.dispose()
-        case .completed:
-            self.subscription.dispose()
-        }
-    }
-    
-    #if TRACE_RESOURCES
-    deinit {
-        _ = Resources.decrementTotal()
-    }
-    #endif
-
-}
-
-
-final private class SkipUntilSink<Other, Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias Element = Observer.Element 
-    typealias Parent = SkipUntil<Element, Other>
-    
-    let lock = RecursiveLock()
-    private let parent: Parent
-    fileprivate var forwardElements = false
-    
-    private let sourceSubscription = SingleAssignmentDisposable()
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            if self.forwardElements {
-                self.forwardOn(event)
-            }
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            if self.forwardElements {
-                self.forwardOn(event)
-            }
-            self.dispose()
-        }
-    }
-    
-    func run() -> Disposable {
-        let sourceSubscription = self.parent.source.subscribe(self)
-        let otherObserver = SkipUntilSinkOther(parent: self)
-        let otherSubscription = self.parent.other.subscribe(otherObserver)
-        self.sourceSubscription.setDisposable(sourceSubscription)
-        otherObserver.subscription.setDisposable(otherSubscription)
-        
-        return Disposables.create(sourceSubscription, otherObserver.subscription)
-    }
-}
-
-final private class SkipUntil<Element, Other>: Producer<Element> {
-    
-    fileprivate let source: Observable<Element>
-    fileprivate let other: Observable<Other>
-    
-    init(source: Observable<Element>, other: Observable<Other>) {
-        self.source = source
-        self.other = other
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = SkipUntilSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/SkipWhile.swift b/Pods/RxSwift/RxSwift/Observables/SkipWhile.swift
deleted file mode 100644
index a62f88ddd..000000000
--- a/Pods/RxSwift/RxSwift/Observables/SkipWhile.swift
+++ /dev/null
@@ -1,87 +0,0 @@
-//
-//  SkipWhile.swift
-//  RxSwift
-//
-//  Created by Yury Korolev on 10/9/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Bypasses elements in an observable sequence as long as a specified condition is true and then returns the remaining elements.
-
-     - seealso: [skipWhile operator on reactivex.io](http://reactivex.io/documentation/operators/skipwhile.html)
-
-     - parameter predicate: A function to test each element for a condition.
-     - returns: An observable sequence that contains the elements from the input sequence starting at the first element in the linear series that does not pass the test specified by predicate.
-     */
-    public func skip(while predicate: @escaping (Element) throws -> Bool) -> Observable<Element> {
-        SkipWhile(source: self.asObservable(), predicate: predicate)
-    }
-
-    /**
-     Bypasses elements in an observable sequence as long as a specified condition is true and then returns the remaining elements.
-
-     - seealso: [skipWhile operator on reactivex.io](http://reactivex.io/documentation/operators/skipwhile.html)
-
-     - parameter predicate: A function to test each element for a condition.
-     - returns: An observable sequence that contains the elements from the input sequence starting at the first element in the linear series that does not pass the test specified by predicate.
-     */
-    @available(*, deprecated, renamed: "skip(while:)")
-    public func skipWhile(_ predicate: @escaping (Element) throws -> Bool) -> Observable<Element> {
-        SkipWhile(source: self.asObservable(), predicate: predicate)
-    }
-}
-
-final private class SkipWhileSink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = SkipWhile<Element>
-
-    private let parent: Parent
-    private var running = false
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            if !self.running {
-                do {
-                    self.running = try !self.parent.predicate(value)
-                } catch let e {
-                    self.forwardOn(.error(e))
-                    self.dispose()
-                    return
-                }
-            }
-
-            if self.running {
-                self.forwardOn(.next(value))
-            }
-        case .error, .completed:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-}
-
-final private class SkipWhile<Element>: Producer<Element> {
-    typealias Predicate = (Element) throws -> Bool
-
-    private let source: Observable<Element>
-    fileprivate let predicate: Predicate
-
-    init(source: Observable<Element>, predicate: @escaping Predicate) {
-        self.source = source
-        self.predicate = predicate
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = SkipWhileSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/StartWith.swift b/Pods/RxSwift/RxSwift/Observables/StartWith.swift
deleted file mode 100644
index 13fb31d33..000000000
--- a/Pods/RxSwift/RxSwift/Observables/StartWith.swift
+++ /dev/null
@@ -1,42 +0,0 @@
-//
-//  StartWith.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 4/6/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Prepends a sequence of values to an observable sequence.
-
-     - seealso: [startWith operator on reactivex.io](http://reactivex.io/documentation/operators/startwith.html)
-
-     - parameter elements: Elements to prepend to the specified sequence.
-     - returns: The source sequence prepended with the specified values.
-     */
-    public func startWith(_ elements: Element ...)
-        -> Observable<Element> {
-            return StartWith(source: self.asObservable(), elements: elements)
-    }
-}
-
-final private class StartWith<Element>: Producer<Element> {
-    let elements: [Element]
-    let source: Observable<Element>
-
-    init(source: Observable<Element>, elements: [Element]) {
-        self.source = source
-        self.elements = elements
-        super.init()
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        for e in self.elements {
-            observer.on(.next(e))
-        }
-
-        return (sink: Disposables.create(), subscription: self.source.subscribe(observer))
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/SubscribeOn.swift b/Pods/RxSwift/RxSwift/Observables/SubscribeOn.swift
deleted file mode 100644
index e8e41d9cf..000000000
--- a/Pods/RxSwift/RxSwift/Observables/SubscribeOn.swift
+++ /dev/null
@@ -1,103 +0,0 @@
-//
-//  SubscribeOn.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Wraps the source sequence in order to run its subscription and unsubscription logic on the specified
-     scheduler.
-
-     This operation is not commonly used.
-
-     This only performs the side-effects of subscription and unsubscription on the specified scheduler.
-
-     In order to invoke observer callbacks on a `scheduler`, use `observeOn`.
-
-     - seealso: [subscribeOn operator on reactivex.io](http://reactivex.io/documentation/operators/subscribeon.html)
-
-     - parameter scheduler: Scheduler to perform subscription and unsubscription actions on.
-     - returns: The source sequence whose subscriptions and unsubscriptions happen on the specified scheduler.
-     */
-    public func subscribe(on scheduler: ImmediateSchedulerType)
-        -> Observable<Element> {
-        SubscribeOn(source: self, scheduler: scheduler)
-    }
-
-    /**
-     Wraps the source sequence in order to run its subscription and unsubscription logic on the specified
-     scheduler.
-
-     This operation is not commonly used.
-
-     This only performs the side-effects of subscription and unsubscription on the specified scheduler.
-
-     In order to invoke observer callbacks on a `scheduler`, use `observeOn`.
-
-     - seealso: [subscribeOn operator on reactivex.io](http://reactivex.io/documentation/operators/subscribeon.html)
-
-     - parameter scheduler: Scheduler to perform subscription and unsubscription actions on.
-     - returns: The source sequence whose subscriptions and unsubscriptions happen on the specified scheduler.
-     */
-    @available(*, deprecated, renamed: "subscribe(on:)")
-    public func subscribeOn(_ scheduler: ImmediateSchedulerType)
-        -> Observable<Element> {
-        subscribe(on: scheduler)
-    }
-}
-
-final private class SubscribeOnSink<Ob: ObservableType, Observer: ObserverType>: Sink<Observer>, ObserverType where Ob.Element == Observer.Element {
-    typealias Element = Observer.Element 
-    typealias Parent = SubscribeOn<Ob>
-    
-    let parent: Parent
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.forwardOn(event)
-        
-        if event.isStopEvent {
-            self.dispose()
-        }
-    }
-    
-    func run() -> Disposable {
-        let disposeEverything = SerialDisposable()
-        let cancelSchedule = SingleAssignmentDisposable()
-        
-        disposeEverything.disposable = cancelSchedule
-        
-        let disposeSchedule = self.parent.scheduler.schedule(()) { _ -> Disposable in
-            let subscription = self.parent.source.subscribe(self)
-            disposeEverything.disposable = ScheduledDisposable(scheduler: self.parent.scheduler, disposable: subscription)
-            return Disposables.create()
-        }
-
-        cancelSchedule.setDisposable(disposeSchedule)
-    
-        return disposeEverything
-    }
-}
-
-final private class SubscribeOn<Ob: ObservableType>: Producer<Ob.Element> {
-    let source: Ob
-    let scheduler: ImmediateSchedulerType
-    
-    init(source: Ob, scheduler: ImmediateSchedulerType) {
-        self.source = source
-        self.scheduler = scheduler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Ob.Element {
-        let sink = SubscribeOnSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Switch.swift b/Pods/RxSwift/RxSwift/Observables/Switch.swift
deleted file mode 100644
index 5aa60b97a..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Switch.swift
+++ /dev/null
@@ -1,251 +0,0 @@
-//
-//  Switch.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Projects each element of an observable sequence into a new sequence of observable sequences and then
-     transforms an observable sequence of observable sequences into an observable sequence producing values only from the most recent observable sequence.
-
-     It is a combination of `map` + `switchLatest` operator
-
-     - seealso: [flatMapLatest operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the transform function on each element of source producing an
-     Observable of Observable sequences and that at any point in time produces the elements of the most recent inner observable sequence that has been received.
-     */
-    public func flatMapLatest<Source: ObservableConvertibleType>(_ selector: @escaping (Element) throws -> Source)
-        -> Observable<Source.Element> {
-        return FlatMapLatest(source: self.asObservable(), selector: selector)
-    }
-
-    /**
-     Projects each element of an observable sequence into a new sequence of observable sequences and then
-     transforms an observable sequence of observable sequences into an observable sequence producing values only from the most recent observable sequence.
-
-     It is a combination of `map` + `switchLatest` operator
-
-     - seealso: [flatMapLatest operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the transform function on each element of source producing an
-     Observable of Observable sequences and that at any point in time produces the elements of the most recent inner observable sequence that has been received.
-     */
-    public func flatMapLatest<Source: InfallibleType>(_ selector: @escaping (Element) throws -> Source)
-        -> Infallible<Source.Element> {
-        return Infallible(flatMapLatest(selector))
-    }
-}
-
-extension ObservableType where Element: ObservableConvertibleType {
-
-    /**
-     Transforms an observable sequence of observable sequences into an observable sequence
-     producing values only from the most recent observable sequence.
-
-     Each time a new inner observable sequence is received, unsubscribe from the
-     previous inner observable sequence.
-
-     - seealso: [switch operator on reactivex.io](http://reactivex.io/documentation/operators/switch.html)
-
-     - returns: The observable sequence that at any point in time produces the elements of the most recent inner observable sequence that has been received.
-     */
-    public func switchLatest() -> Observable<Element.Element> {
-        Switch(source: self.asObservable())
-    }
-}
-
-private class SwitchSink<SourceType, Source: ObservableConvertibleType, Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType where Source.Element == Observer.Element {
-    typealias Element = SourceType
-
-    private let subscriptions: SingleAssignmentDisposable = SingleAssignmentDisposable()
-    private let innerSubscription: SerialDisposable = SerialDisposable()
-
-    let lock = RecursiveLock()
-    
-    // state
-    fileprivate var stopped = false
-    fileprivate var latest = 0
-    fileprivate var hasLatest = false
-    
-    override init(observer: Observer, cancel: Cancelable) {
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run(_ source: Observable<SourceType>) -> Disposable {
-        let subscription = source.subscribe(self)
-        self.subscriptions.setDisposable(subscription)
-        return Disposables.create(subscriptions, innerSubscription)
-    }
-
-    func performMap(_ element: SourceType) throws -> Source {
-        rxAbstractMethod()
-    }
-
-    @inline(__always)
-    final private func nextElementArrived(element: Element) -> (Int, Observable<Source.Element>)? {
-        self.lock.lock(); defer { self.lock.unlock() }
-
-        do {
-            let observable = try self.performMap(element).asObservable()
-            self.hasLatest = true
-            self.latest = self.latest &+ 1
-            return (self.latest, observable)
-        }
-        catch let error {
-            self.forwardOn(.error(error))
-            self.dispose()
-        }
-
-        return nil
-    }
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let element):
-            if let (latest, observable) = self.nextElementArrived(element: element) {
-                let d = SingleAssignmentDisposable()
-                self.innerSubscription.disposable = d
-                   
-                let observer = SwitchSinkIter(parent: self, id: latest, this: d)
-                let disposable = observable.subscribe(observer)
-                d.setDisposable(disposable)
-            }
-        case .error(let error):
-            self.lock.lock(); defer { self.lock.unlock() }
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            self.lock.lock(); defer { self.lock.unlock() }
-            self.stopped = true
-            
-            self.subscriptions.dispose()
-            
-            if !self.hasLatest {
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-        }
-    }
-}
-
-final private class SwitchSinkIter<SourceType, Source: ObservableConvertibleType, Observer: ObserverType>
-    : ObserverType
-    , LockOwnerType
-    , SynchronizedOnType where Source.Element == Observer.Element {
-    typealias Element = Source.Element
-    typealias Parent = SwitchSink<SourceType, Source, Observer>
-    
-    private let parent: Parent
-    private let id: Int
-    private let this: Disposable
-
-    var lock: RecursiveLock {
-        self.parent.lock
-    }
-
-    init(parent: Parent, id: Int, this: Disposable) {
-        self.parent = parent
-        self.id = id
-        self.this = this
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next: break
-        case .error, .completed:
-            self.this.dispose()
-        }
-        
-        if self.parent.latest != self.id {
-            return
-        }
-       
-        switch event {
-        case .next:
-            self.parent.forwardOn(event)
-        case .error:
-            self.parent.forwardOn(event)
-            self.parent.dispose()
-        case .completed:
-            self.parent.hasLatest = false
-            if self.parent.stopped {
-                self.parent.forwardOn(event)
-                self.parent.dispose()
-            }
-        }
-    }
-}
-
-// MARK: Specializations
-
-final private class SwitchIdentitySink<Source: ObservableConvertibleType, Observer: ObserverType>: SwitchSink<Source, Source, Observer>
-    where Observer.Element == Source.Element {
-    override init(observer: Observer, cancel: Cancelable) {
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    override func performMap(_ element: Source) throws -> Source {
-        element
-    }
-}
-
-final private class MapSwitchSink<SourceType, Source: ObservableConvertibleType, Observer: ObserverType>: SwitchSink<SourceType, Source, Observer> where Observer.Element == Source.Element {
-    typealias Selector = (SourceType) throws -> Source
-
-    private let selector: Selector
-
-    init(selector: @escaping Selector, observer: Observer, cancel: Cancelable) {
-        self.selector = selector
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    override func performMap(_ element: SourceType) throws -> Source {
-        try self.selector(element)
-    }
-}
-
-// MARK: Producers
-
-final private class Switch<Source: ObservableConvertibleType>: Producer<Source.Element> {
-    private let source: Observable<Source>
-    
-    init(source: Observable<Source>) {
-        self.source = source
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Source.Element {
-        let sink = SwitchIdentitySink<Source, Observer>(observer: observer, cancel: cancel)
-        let subscription = sink.run(self.source)
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class FlatMapLatest<SourceType, Source: ObservableConvertibleType>: Producer<Source.Element> {
-    typealias Selector = (SourceType) throws -> Source
-
-    private let source: Observable<SourceType>
-    private let selector: Selector
-
-    init(source: Observable<SourceType>, selector: @escaping Selector) {
-        self.source = source
-        self.selector = selector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Source.Element {
-        let sink = MapSwitchSink<SourceType, Source, Observer>(selector: self.selector, observer: observer, cancel: cancel)
-        let subscription = sink.run(self.source)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/SwitchIfEmpty.swift b/Pods/RxSwift/RxSwift/Observables/SwitchIfEmpty.swift
deleted file mode 100644
index a8827c455..000000000
--- a/Pods/RxSwift/RxSwift/Observables/SwitchIfEmpty.swift
+++ /dev/null
@@ -1,104 +0,0 @@
-//
-//  SwitchIfEmpty.swift
-//  RxSwift
-//
-//  Created by sergdort on 23/12/2016.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Returns the elements of the specified sequence or `switchTo` sequence if the sequence is empty.
-
-     - seealso: [DefaultIfEmpty operator on reactivex.io](http://reactivex.io/documentation/operators/defaultifempty.html)
-
-     - parameter switchTo: Observable sequence being returned when source sequence is empty.
-     - returns: Observable sequence that contains elements from switchTo sequence if source is empty, otherwise returns source sequence elements.
-     */
-    public func ifEmpty(switchTo other: Observable<Element>) -> Observable<Element> {
-        SwitchIfEmpty(source: self.asObservable(), ifEmpty: other)
-    }
-}
-
-final private class SwitchIfEmpty<Element>: Producer<Element> {
-    
-    private let source: Observable<Element>
-    private let ifEmpty: Observable<Element>
-    
-    init(source: Observable<Element>, ifEmpty: Observable<Element>) {
-        self.source = source
-        self.ifEmpty = ifEmpty
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = SwitchIfEmptySink(ifEmpty: self.ifEmpty,
-                                     observer: observer,
-                                     cancel: cancel)
-        let subscription = sink.run(self.source.asObservable())
-        
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class SwitchIfEmptySink<Observer: ObserverType>: Sink<Observer>
-    , ObserverType {
-    typealias Element = Observer.Element
-    
-    private let ifEmpty: Observable<Element>
-    private var isEmpty = true
-    private let ifEmptySubscription = SingleAssignmentDisposable()
-    
-    init(ifEmpty: Observable<Element>, observer: Observer, cancel: Cancelable) {
-        self.ifEmpty = ifEmpty
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run(_ source: Observable<Observer.Element>) -> Disposable {
-        let subscription = source.subscribe(self)
-        return Disposables.create(subscription, ifEmptySubscription)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.isEmpty = false
-            self.forwardOn(event)
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            guard self.isEmpty else {
-                self.forwardOn(.completed)
-                self.dispose()
-                return
-            }
-            let ifEmptySink = SwitchIfEmptySinkIter(parent: self)
-            self.ifEmptySubscription.setDisposable(self.ifEmpty.subscribe(ifEmptySink))
-        }
-    }
-}
-
-final private class SwitchIfEmptySinkIter<Observer: ObserverType>
-    : ObserverType {
-    typealias Element = Observer.Element
-    typealias Parent = SwitchIfEmptySink<Observer>
-    
-    private let parent: Parent
-
-    init(parent: Parent) {
-        self.parent = parent
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.parent.forwardOn(event)
-        case .error:
-            self.parent.forwardOn(event)
-            self.parent.dispose()
-        case .completed:
-            self.parent.forwardOn(event)
-            self.parent.dispose()
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Take.swift b/Pods/RxSwift/RxSwift/Observables/Take.swift
deleted file mode 100644
index e5746880f..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Take.swift
+++ /dev/null
@@ -1,193 +0,0 @@
-//
-//  Take.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/12/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Returns a specified number of contiguous elements from the start of an observable sequence.
-
-     - seealso: [take operator on reactivex.io](http://reactivex.io/documentation/operators/take.html)
-
-     - parameter count: The number of elements to return.
-     - returns: An observable sequence that contains the specified number of elements from the start of the input sequence.
-     */
-    public func take(_ count: Int)
-        -> Observable<Element> {
-        if count == 0 {
-            return Observable.empty()
-        }
-        else {
-            return TakeCount(source: self.asObservable(), count: count)
-        }
-    }
-}
-
-extension ObservableType {
-    /**
-     Takes elements for the specified duration from the start of the observable source sequence, using the specified scheduler to run timers.
-
-     - seealso: [take operator on reactivex.io](http://reactivex.io/documentation/operators/take.html)
-
-     - parameter duration: Duration for taking elements from the start of the sequence.
-     - parameter scheduler: Scheduler to run the timer on.
-     - returns: An observable sequence with the elements taken during the specified duration from the start of the source sequence.
-     */
-    public func take(for duration: RxTimeInterval, scheduler: SchedulerType)
-        -> Observable<Element> {
-        TakeTime(source: self.asObservable(), duration: duration, scheduler: scheduler)
-    }
-
-    /**
-     Takes elements for the specified duration from the start of the observable source sequence, using the specified scheduler to run timers.
-
-     - seealso: [take operator on reactivex.io](http://reactivex.io/documentation/operators/take.html)
-
-     - parameter duration: Duration for taking elements from the start of the sequence.
-     - parameter scheduler: Scheduler to run the timer on.
-     - returns: An observable sequence with the elements taken during the specified duration from the start of the source sequence.
-     */
-    @available(*, deprecated, renamed: "take(for:scheduler:)")
-    public func take(_ duration: RxTimeInterval, scheduler: SchedulerType)
-        -> Observable<Element> {
-        take(for: duration, scheduler: scheduler)
-    }
-}
-
-// count version
-
-final private class TakeCountSink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = TakeCount<Element>
-    
-    private let parent: Parent
-    
-    private var remaining: Int
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.remaining = parent.count
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            
-            if self.remaining > 0 {
-                self.remaining -= 1
-                
-                self.forwardOn(.next(value))
-            
-                if self.remaining == 0 {
-                    self.forwardOn(.completed)
-                    self.dispose()
-                }
-            }
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-    
-}
-
-final private class TakeCount<Element>: Producer<Element> {
-    private let source: Observable<Element>
-    fileprivate let count: Int
-    
-    init(source: Observable<Element>, count: Int) {
-        if count < 0 {
-            rxFatalError("count can't be negative")
-        }
-        self.source = source
-        self.count = count
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = TakeCountSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-// time version
-
-final private class TakeTimeSink<Element, Observer: ObserverType>
-    : Sink<Observer>
-    , LockOwnerType
-    , ObserverType
-    , SynchronizedOnType where Observer.Element == Element {
-    typealias Parent = TakeTime<Element>
-
-    private let parent: Parent
-    
-    let lock = RecursiveLock()
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            self.forwardOn(.next(value))
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-    
-    func tick() {
-        self.lock.performLocked {
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-    
-    func run() -> Disposable {
-        let disposeTimer = self.parent.scheduler.scheduleRelative((), dueTime: self.parent.duration) { _ in
-            self.tick()
-            return Disposables.create()
-        }
-        
-        let disposeSubscription = self.parent.source.subscribe(self)
-        
-        return Disposables.create(disposeTimer, disposeSubscription)
-    }
-}
-
-final private class TakeTime<Element>: Producer<Element> {
-    typealias TimeInterval = RxTimeInterval
-    
-    fileprivate let source: Observable<Element>
-    fileprivate let duration: TimeInterval
-    fileprivate let scheduler: SchedulerType
-    
-    init(source: Observable<Element>, duration: TimeInterval, scheduler: SchedulerType) {
-        self.source = source
-        self.scheduler = scheduler
-        self.duration = duration
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = TakeTimeSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/TakeLast.swift b/Pods/RxSwift/RxSwift/Observables/TakeLast.swift
deleted file mode 100644
index 91833872d..000000000
--- a/Pods/RxSwift/RxSwift/Observables/TakeLast.swift
+++ /dev/null
@@ -1,78 +0,0 @@
-//
-//  TakeLast.swift
-//  RxSwift
-//
-//  Created by Tomi Koskinen on 25/10/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Returns a specified number of contiguous elements from the end of an observable sequence.
-
-     This operator accumulates a buffer with a length enough to store elements count elements. Upon completion of the source sequence, this buffer is drained on the result sequence. This causes the elements to be delayed.
-
-     - seealso: [takeLast operator on reactivex.io](http://reactivex.io/documentation/operators/takelast.html)
-
-     - parameter count: Number of elements to take from the end of the source sequence.
-     - returns: An observable sequence containing the specified number of elements from the end of the source sequence.
-     */
-    public func takeLast(_ count: Int)
-        -> Observable<Element> {
-        TakeLast(source: self.asObservable(), count: count)
-    }
-}
-
-final private class TakeLastSink<Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = TakeLast<Element>
-    
-    private let parent: Parent
-    
-    private var elements: Queue<Element>
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.elements = Queue<Element>(capacity: parent.count + 1)
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            self.elements.enqueue(value)
-            if self.elements.count > self.parent.count {
-                _ = self.elements.dequeue()
-            }
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            for e in self.elements {
-                self.forwardOn(.next(e))
-            }
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final private class TakeLast<Element>: Producer<Element> {
-    private let source: Observable<Element>
-    fileprivate let count: Int
-    
-    init(source: Observable<Element>, count: Int) {
-        if count < 0 {
-            rxFatalError("count can't be negative")
-        }
-        self.source = source
-        self.count = count
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = TakeLastSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/TakeWithPredicate.swift b/Pods/RxSwift/RxSwift/Observables/TakeWithPredicate.swift
deleted file mode 100644
index 6c28d19ba..000000000
--- a/Pods/RxSwift/RxSwift/Observables/TakeWithPredicate.swift
+++ /dev/null
@@ -1,285 +0,0 @@
-//
-//  TakeWithPredicate.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/7/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Returns the elements from the source observable sequence until the other observable sequence produces an element.
-
-     - seealso: [takeUntil operator on reactivex.io](http://reactivex.io/documentation/operators/takeuntil.html)
-
-     - parameter other: Observable sequence that terminates propagation of elements of the source sequence.
-     - returns: An observable sequence containing the elements of the source sequence up to the point the other sequence interrupted further propagation.
-     */
-    public func take<Source: ObservableType>(until other: Source)
-        -> Observable<Element> {
-        TakeUntil(source: self.asObservable(), other: other.asObservable())
-    }
-
-    /**
-     Returns elements from an observable sequence until the specified condition is true.
-
-     - seealso: [takeUntil operator on reactivex.io](http://reactivex.io/documentation/operators/takeuntil.html)
-
-     - parameter predicate: A function to test each element for a condition.
-     - parameter behavior: Whether or not to include the last element matching the predicate. Defaults to `exclusive`.
-
-     - returns: An observable sequence that contains the elements from the input sequence that occur before the element at which the test passes.
-     */
-    public func take(until predicate: @escaping (Element) throws -> Bool,
-                     behavior: TakeBehavior = .exclusive)
-        -> Observable<Element> {
-        TakeUntilPredicate(source: self.asObservable(),
-                           behavior: behavior,
-                           predicate: predicate)
-    }
-
-    /**
-     Returns elements from an observable sequence as long as a specified condition is true.
-
-     - seealso: [takeWhile operator on reactivex.io](http://reactivex.io/documentation/operators/takewhile.html)
-
-     - parameter predicate: A function to test each element for a condition.
-     - returns: An observable sequence that contains the elements from the input sequence that occur before the element at which the test no longer passes.
-     */
-    public func take(while predicate: @escaping (Element) throws -> Bool,
-                     behavior: TakeBehavior = .exclusive)
-        -> Observable<Element> {
-        take(until: { try !predicate($0) }, behavior: behavior)
-    }
-
-    /**
-     Returns the elements from the source observable sequence until the other observable sequence produces an element.
-
-     - seealso: [takeUntil operator on reactivex.io](http://reactivex.io/documentation/operators/takeuntil.html)
-
-     - parameter other: Observable sequence that terminates propagation of elements of the source sequence.
-     - returns: An observable sequence containing the elements of the source sequence up to the point the other sequence interrupted further propagation.
-     */
-    @available(*, deprecated, renamed: "take(until:)")
-    public func takeUntil<Source: ObservableType>(_ other: Source)
-        -> Observable<Element> {
-        take(until: other)
-    }
-
-    /**
-     Returns elements from an observable sequence until the specified condition is true.
-
-     - seealso: [takeUntil operator on reactivex.io](http://reactivex.io/documentation/operators/takeuntil.html)
-
-     - parameter behavior: Whether or not to include the last element matching the predicate.
-     - parameter predicate: A function to test each element for a condition.
-     - returns: An observable sequence that contains the elements from the input sequence that occur before the element at which the test passes.
-     */
-    @available(*, deprecated, renamed: "take(until:behavior:)")
-    public func takeUntil(_ behavior: TakeBehavior,
-                          predicate: @escaping (Element) throws -> Bool)
-        -> Observable<Element> {
-        take(until: predicate, behavior: behavior)
-    }
-
-    /**
-     Returns elements from an observable sequence as long as a specified condition is true.
-
-     - seealso: [takeWhile operator on reactivex.io](http://reactivex.io/documentation/operators/takewhile.html)
-
-     - parameter predicate: A function to test each element for a condition.
-     - returns: An observable sequence that contains the elements from the input sequence that occur before the element at which the test no longer passes.
-     */
-    @available(*, deprecated, renamed: "take(while:)")
-    public func takeWhile(_ predicate: @escaping (Element) throws -> Bool)
-        -> Observable<Element> {
-        take(until: { try !predicate($0) }, behavior: .exclusive)
-    }
-}
-
-/// Behaviors for the take operator family.
-public enum TakeBehavior {
-    /// Include the last element matching the predicate.
-    case inclusive
-
-    /// Exclude the last element matching the predicate.
-    case exclusive
-}
-
-// MARK: - TakeUntil Observable
-final private class TakeUntilSinkOther<Other, Observer: ObserverType>
-    : ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias Parent = TakeUntilSink<Other, Observer>
-    typealias Element = Other
-    
-    private let parent: Parent
-
-    var lock: RecursiveLock {
-        self.parent.lock
-    }
-    
-    fileprivate let subscription = SingleAssignmentDisposable()
-    
-    init(parent: Parent) {
-        self.parent = parent
-#if TRACE_RESOURCES
-        _ = Resources.incrementTotal()
-#endif
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.parent.forwardOn(.completed)
-            self.parent.dispose()
-        case .error(let e):
-            self.parent.forwardOn(.error(e))
-            self.parent.dispose()
-        case .completed:
-            self.subscription.dispose()
-        }
-    }
-    
-#if TRACE_RESOURCES
-    deinit {
-        _ = Resources.decrementTotal()
-    }
-#endif
-}
-
-final private class TakeUntilSink<Other, Observer: ObserverType>
-    : Sink<Observer>
-    , LockOwnerType
-    , ObserverType
-    , SynchronizedOnType {
-    typealias Element = Observer.Element 
-    typealias Parent = TakeUntil<Element, Other>
-    
-    private let parent: Parent
- 
-    let lock = RecursiveLock()
-    
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            self.forwardOn(event)
-        case .error:
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-    
-    func run() -> Disposable {
-        let otherObserver = TakeUntilSinkOther(parent: self)
-        let otherSubscription = self.parent.other.subscribe(otherObserver)
-        otherObserver.subscription.setDisposable(otherSubscription)
-        let sourceSubscription = self.parent.source.subscribe(self)
-        
-        return Disposables.create(sourceSubscription, otherObserver.subscription)
-    }
-}
-
-final private class TakeUntil<Element, Other>: Producer<Element> {
-    
-    fileprivate let source: Observable<Element>
-    fileprivate let other: Observable<Other>
-    
-    init(source: Observable<Element>, other: Observable<Other>) {
-        self.source = source
-        self.other = other
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = TakeUntilSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-// MARK: - TakeUntil Predicate
-final private class TakeUntilPredicateSink<Observer: ObserverType>
-    : Sink<Observer>, ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = TakeUntilPredicate<Element>
-
-    private let parent: Parent
-    private var running = true
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next(let value):
-            if !self.running {
-                return
-            }
-
-            do {
-                self.running = try !self.parent.predicate(value)
-            } catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-                return
-            }
-
-            if self.running {
-                self.forwardOn(.next(value))
-            } else {
-                if self.parent.behavior == .inclusive {
-                    self.forwardOn(.next(value))
-                }
-
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-        case .error, .completed:
-            self.forwardOn(event)
-            self.dispose()
-        }
-    }
-
-}
-
-final private class TakeUntilPredicate<Element>: Producer<Element> {
-    typealias Predicate = (Element) throws -> Bool
-
-    private let source: Observable<Element>
-    fileprivate let predicate: Predicate
-    fileprivate let behavior: TakeBehavior
-
-    init(source: Observable<Element>,
-         behavior: TakeBehavior,
-         predicate: @escaping Predicate) {
-        self.source = source
-        self.behavior = behavior
-        self.predicate = predicate
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = TakeUntilPredicateSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Throttle.swift b/Pods/RxSwift/RxSwift/Observables/Throttle.swift
deleted file mode 100644
index 86152a837..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Throttle.swift
+++ /dev/null
@@ -1,160 +0,0 @@
-//
-//  Throttle.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/22/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-extension ObservableType {
-
-    /**
-     Returns an Observable that emits the first and the latest item emitted by the source Observable during sequential time windows of a specified duration.
-
-     This operator makes sure that no two elements are emitted in less then dueTime.
-
-     - seealso: [debounce operator on reactivex.io](http://reactivex.io/documentation/operators/debounce.html)
-
-     - parameter dueTime: Throttling duration for each element.
-     - parameter latest: Should latest element received in a dueTime wide time window since last element emission be emitted.
-     - parameter scheduler: Scheduler to run the throttle timers on.
-     - returns: The throttled sequence.
-     */
-    public func throttle(_ dueTime: RxTimeInterval, latest: Bool = true, scheduler: SchedulerType)
-        -> Observable<Element> {
-        Throttle(source: self.asObservable(), dueTime: dueTime, latest: latest, scheduler: scheduler)
-    }
-}
-
-final private class ThrottleSink<Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias Element = Observer.Element 
-    typealias ParentType = Throttle<Element>
-    
-    private let parent: ParentType
-    
-    let lock = RecursiveLock()
-    
-    // state
-    private var lastUnsentElement: Element?
-    private var lastSentTime: Date?
-    private var completed: Bool = false
-
-    let cancellable = SerialDisposable()
-    
-    init(parent: ParentType, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        let subscription = self.parent.source.subscribe(self)
-        
-        return Disposables.create(subscription, cancellable)
-    }
-
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case .next(let element):
-            let now = self.parent.scheduler.now
-
-            let reducedScheduledTime: RxTimeInterval
-
-            if let lastSendingTime = self.lastSentTime {
-                reducedScheduledTime = self.parent.dueTime.reduceWithSpanBetween(earlierDate: lastSendingTime, laterDate: now)
-            }
-            else {
-                reducedScheduledTime = .nanoseconds(0)
-            }
-
-            if reducedScheduledTime.isNow {
-                self.sendNow(element: element)
-                return
-            }
-
-            if !self.parent.latest {
-                return
-            }
-
-            let isThereAlreadyInFlightRequest = self.lastUnsentElement != nil
-            
-            self.lastUnsentElement = element
-
-            if isThereAlreadyInFlightRequest {
-                return
-            }
-
-            let scheduler = self.parent.scheduler
-
-            let d = SingleAssignmentDisposable()
-            self.cancellable.disposable = d
-
-            d.setDisposable(scheduler.scheduleRelative(0, dueTime: reducedScheduledTime, action: self.propagate))
-        case .error:
-            self.lastUnsentElement = nil
-            self.forwardOn(event)
-            self.dispose()
-        case .completed:
-            if self.lastUnsentElement != nil {
-                self.completed = true
-            }
-            else {
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-        }
-    }
-
-    private func sendNow(element: Element) {
-        self.lastUnsentElement = nil
-        self.forwardOn(.next(element))
-        // in case element processing takes a while, this should give some more room
-        self.lastSentTime = self.parent.scheduler.now
-    }
-    
-    func propagate(_: Int) -> Disposable {
-        self.lock.performLocked {
-            if let lastUnsentElement = self.lastUnsentElement {
-                self.sendNow(element: lastUnsentElement)
-            }
-
-            if self.completed {
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-        }
-
-        return Disposables.create()
-    }
-}
-
-final private class Throttle<Element>: Producer<Element> {
-    fileprivate let source: Observable<Element>
-    fileprivate let dueTime: RxTimeInterval
-    fileprivate let latest: Bool
-    fileprivate let scheduler: SchedulerType
-
-    init(source: Observable<Element>, dueTime: RxTimeInterval, latest: Bool, scheduler: SchedulerType) {
-        self.source = source
-        self.dueTime = dueTime
-        self.latest = latest
-        self.scheduler = scheduler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = ThrottleSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-    
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Timeout.swift b/Pods/RxSwift/RxSwift/Observables/Timeout.swift
deleted file mode 100644
index efcc7917d..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Timeout.swift
+++ /dev/null
@@ -1,151 +0,0 @@
-//
-//  Timeout.swift
-//  RxSwift
-//
-//  Created by Tomi Koskinen on 13/11/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Applies a timeout policy for each element in the observable sequence. If the next element isn't received within the specified timeout duration starting from its predecessor, a TimeoutError is propagated to the observer.
-
-     - seealso: [timeout operator on reactivex.io](http://reactivex.io/documentation/operators/timeout.html)
-
-     - parameter dueTime: Maximum duration between values before a timeout occurs.
-     - parameter scheduler: Scheduler to run the timeout timer on.
-     - returns: An observable sequence with a `RxError.timeout` in case of a timeout.
-     */
-    public func timeout(_ dueTime: RxTimeInterval, scheduler: SchedulerType)
-        -> Observable<Element> {
-            return Timeout(source: self.asObservable(), dueTime: dueTime, other: Observable.error(RxError.timeout), scheduler: scheduler)
-    }
-
-    /**
-     Applies a timeout policy for each element in the observable sequence, using the specified scheduler to run timeout timers. If the next element isn't received within the specified timeout duration starting from its predecessor, the other observable sequence is used to produce future messages from that point on.
-
-     - seealso: [timeout operator on reactivex.io](http://reactivex.io/documentation/operators/timeout.html)
-
-     - parameter dueTime: Maximum duration between values before a timeout occurs.
-     - parameter other: Sequence to return in case of a timeout.
-     - parameter scheduler: Scheduler to run the timeout timer on.
-     - returns: The source sequence switching to the other sequence in case of a timeout.
-     */
-    public func timeout<Source: ObservableConvertibleType>(_ dueTime: RxTimeInterval, other: Source, scheduler: SchedulerType)
-        -> Observable<Element> where Element == Source.Element {
-            return Timeout(source: self.asObservable(), dueTime: dueTime, other: other.asObservable(), scheduler: scheduler)
-    }
-}
-
-final private class TimeoutSink<Observer: ObserverType>: Sink<Observer>, LockOwnerType, ObserverType {
-    typealias Element = Observer.Element 
-    typealias Parent = Timeout<Element>
-    
-    private let parent: Parent
-    
-    let lock = RecursiveLock()
-
-    private let timerD = SerialDisposable()
-    private let subscription = SerialDisposable()
-    
-    private var id = 0
-    private var switched = false
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        let original = SingleAssignmentDisposable()
-        self.subscription.disposable = original
-        
-        self.createTimeoutTimer()
-        
-        original.setDisposable(self.parent.source.subscribe(self))
-        
-        return Disposables.create(subscription, timerD)
-    }
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            var onNextWins = false
-            
-            self.lock.performLocked {
-                onNextWins = !self.switched
-                if onNextWins {
-                    self.id = self.id &+ 1
-                }
-            }
-            
-            if onNextWins {
-                self.forwardOn(event)
-                self.createTimeoutTimer()
-            }
-        case .error, .completed:
-            var onEventWins = false
-            
-            self.lock.performLocked {
-                onEventWins = !self.switched
-                if onEventWins {
-                    self.id = self.id &+ 1
-                }
-            }
-            
-            if onEventWins {
-                self.forwardOn(event)
-                self.dispose()
-            }
-        }
-    }
-    
-    private func createTimeoutTimer() {
-        if self.timerD.isDisposed {
-            return
-        }
-        
-        let nextTimer = SingleAssignmentDisposable()
-        self.timerD.disposable = nextTimer
-        
-        let disposeSchedule = self.parent.scheduler.scheduleRelative(self.id, dueTime: self.parent.dueTime) { state in
-            
-            var timerWins = false
-            
-            self.lock.performLocked {
-                self.switched = (state == self.id)
-                timerWins = self.switched
-            }
-            
-            if timerWins {
-                self.subscription.disposable = self.parent.other.subscribe(self.forwarder())
-            }
-            
-            return Disposables.create()
-        }
-
-        nextTimer.setDisposable(disposeSchedule)
-    }
-}
-
-
-final private class Timeout<Element>: Producer<Element> {
-    fileprivate let source: Observable<Element>
-    fileprivate let dueTime: RxTimeInterval
-    fileprivate let other: Observable<Element>
-    fileprivate let scheduler: SchedulerType
-    
-    init(source: Observable<Element>, dueTime: RxTimeInterval, other: Observable<Element>, scheduler: SchedulerType) {
-        self.source = source
-        self.dueTime = dueTime
-        self.other = other
-        self.scheduler = scheduler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = TimeoutSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Timer.swift b/Pods/RxSwift/RxSwift/Observables/Timer.swift
deleted file mode 100644
index 30bbdf67d..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Timer.swift
+++ /dev/null
@@ -1,117 +0,0 @@
-//
-//  Timer.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/7/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType where Element: RxAbstractInteger {
-    /**
-     Returns an observable sequence that produces a value after each period, using the specified scheduler to run timers and to send out observer messages.
-
-     - seealso: [interval operator on reactivex.io](http://reactivex.io/documentation/operators/interval.html)
-
-     - parameter period: Period for producing the values in the resulting sequence.
-     - parameter scheduler: Scheduler to run the timer on.
-     - returns: An observable sequence that produces a value after each period.
-     */
-    public static func interval(_ period: RxTimeInterval, scheduler: SchedulerType)
-        -> Observable<Element> {
-        return Timer(
-            dueTime: period,
-            period: period,
-            scheduler: scheduler
-        )
-    }
-}
-
-extension ObservableType where Element: RxAbstractInteger {
-    /**
-     Returns an observable sequence that periodically produces a value after the specified initial relative due time has elapsed, using the specified scheduler to run timers.
-
-     - seealso: [timer operator on reactivex.io](http://reactivex.io/documentation/operators/timer.html)
-
-     - parameter dueTime: Relative time at which to produce the first value.
-     - parameter period: Period to produce subsequent values.
-     - parameter scheduler: Scheduler to run timers on.
-     - returns: An observable sequence that produces a value after due time has elapsed and then each period.
-     */
-    public static func timer(_ dueTime: RxTimeInterval, period: RxTimeInterval? = nil, scheduler: SchedulerType)
-        -> Observable<Element> {
-        return Timer(
-            dueTime: dueTime,
-            period: period,
-            scheduler: scheduler
-        )
-    }
-}
-
-import Foundation
-
-final private class TimerSink<Observer: ObserverType> : Sink<Observer> where Observer.Element : RxAbstractInteger  {
-    typealias Parent = Timer<Observer.Element>
-
-    private let parent: Parent
-    private let lock = RecursiveLock()
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        return self.parent.scheduler.schedulePeriodic(0 as Observer.Element, startAfter: self.parent.dueTime, period: self.parent.period!) { state in
-            self.lock.performLocked {
-                self.forwardOn(.next(state))
-                return state &+ 1
-            }
-        }
-    }
-}
-
-final private class TimerOneOffSink<Observer: ObserverType>: Sink<Observer> where Observer.Element: RxAbstractInteger {
-    typealias Parent = Timer<Observer.Element>
-
-    private let parent: Parent
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func run() -> Disposable {
-        return self.parent.scheduler.scheduleRelative(self, dueTime: self.parent.dueTime) { [unowned self] _ -> Disposable in
-            self.forwardOn(.next(0))
-            self.forwardOn(.completed)
-            self.dispose()
-
-            return Disposables.create()
-        }
-    }
-}
-
-final private class Timer<Element: RxAbstractInteger>: Producer<Element> {
-    fileprivate let scheduler: SchedulerType
-    fileprivate let dueTime: RxTimeInterval
-    fileprivate let period: RxTimeInterval?
-
-    init(dueTime: RxTimeInterval, period: RxTimeInterval?, scheduler: SchedulerType) {
-        self.scheduler = scheduler
-        self.dueTime = dueTime
-        self.period = period
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        if self.period != nil {
-            let sink = TimerSink(parent: self, observer: observer, cancel: cancel)
-            let subscription = sink.run()
-            return (sink: sink, subscription: subscription)
-        }
-        else {
-            let sink = TimerOneOffSink(parent: self, observer: observer, cancel: cancel)
-            let subscription = sink.run()
-            return (sink: sink, subscription: subscription)
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/ToArray.swift b/Pods/RxSwift/RxSwift/Observables/ToArray.swift
deleted file mode 100644
index 76c7370aa..000000000
--- a/Pods/RxSwift/RxSwift/Observables/ToArray.swift
+++ /dev/null
@@ -1,64 +0,0 @@
-//
-//  ToArray.swift
-//  RxSwift
-//
-//  Created by Junior B. on 20/10/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-    Converts an Observable into a Single that emits the whole sequence as a single array and then terminates.
-    
-    For aggregation behavior see `reduce`.
-
-    - seealso: [toArray operator on reactivex.io](http://reactivex.io/documentation/operators/to.html)
-    
-    - returns: A Single sequence containing all the emitted elements as array.
-    */
-    public func toArray()
-        -> Single<[Element]> {
-        PrimitiveSequence(raw: ToArray(source: self.asObservable()))
-    }
-}
-
-final private class ToArraySink<SourceType, Observer: ObserverType>: Sink<Observer>, ObserverType where Observer.Element == [SourceType] {
-    typealias Parent = ToArray<SourceType>
-    
-    let parent: Parent
-    var list = [SourceType]()
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<SourceType>) {
-        switch event {
-        case .next(let value):
-            self.list.append(value)
-        case .error(let e):
-            self.forwardOn(.error(e))
-            self.dispose()
-        case .completed:
-            self.forwardOn(.next(self.list))
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final private class ToArray<SourceType>: Producer<[SourceType]> {
-    let source: Observable<SourceType>
-
-    init(source: Observable<SourceType>) {
-        self.source = source
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == [SourceType] {
-        let sink = ToArraySink(parent: self, observer: observer, cancel: cancel)
-        let subscription = self.source.subscribe(sink)
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Using.swift b/Pods/RxSwift/RxSwift/Observables/Using.swift
deleted file mode 100644
index ca48d2fb8..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Using.swift
+++ /dev/null
@@ -1,90 +0,0 @@
-//
-//  Using.swift
-//  RxSwift
-//
-//  Created by Yury Korolev on 10/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Constructs an observable sequence that depends on a resource object, whose lifetime is tied to the resulting observable sequence's lifetime.
-
-     - seealso: [using operator on reactivex.io](http://reactivex.io/documentation/operators/using.html)
-
-     - parameter resourceFactory: Factory function to obtain a resource object.
-     - parameter observableFactory: Factory function to obtain an observable sequence that depends on the obtained resource.
-     - returns: An observable sequence whose lifetime controls the lifetime of the dependent resource object.
-     */
-    public static func using<Resource: Disposable>(_ resourceFactory: @escaping () throws -> Resource, observableFactory: @escaping (Resource) throws -> Observable<Element>) -> Observable<Element> {
-        Using(resourceFactory: resourceFactory, observableFactory: observableFactory)
-    }
-}
-
-final private class UsingSink<ResourceType: Disposable, Observer: ObserverType>: Sink<Observer>, ObserverType {
-    typealias SourceType = Observer.Element 
-    typealias Parent = Using<SourceType, ResourceType>
-
-    private let parent: Parent
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        var disposable = Disposables.create()
-        
-        do {
-            let resource = try self.parent.resourceFactory()
-            disposable = resource
-            let source = try self.parent.observableFactory(resource)
-            
-            return Disposables.create(
-                source.subscribe(self),
-                disposable
-            )
-        } catch let error {
-            return Disposables.create(
-                Observable.error(error).subscribe(self),
-                disposable
-            )
-        }
-    }
-    
-    func on(_ event: Event<SourceType>) {
-        switch event {
-        case let .next(value):
-            self.forwardOn(.next(value))
-        case let .error(error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final private class Using<SourceType, ResourceType: Disposable>: Producer<SourceType> {
-    
-    typealias Element = SourceType
-    
-    typealias ResourceFactory = () throws -> ResourceType
-    typealias ObservableFactory = (ResourceType) throws -> Observable<SourceType>
-    
-    fileprivate let resourceFactory: ResourceFactory
-    fileprivate let observableFactory: ObservableFactory
-    
-    
-    init(resourceFactory: @escaping ResourceFactory, observableFactory: @escaping ObservableFactory) {
-        self.resourceFactory = resourceFactory
-        self.observableFactory = observableFactory
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = UsingSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Window.swift b/Pods/RxSwift/RxSwift/Observables/Window.swift
deleted file mode 100644
index b2a37a5c4..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Window.swift
+++ /dev/null
@@ -1,168 +0,0 @@
-//
-//  Window.swift
-//  RxSwift
-//
-//  Created by Junior B. on 29/10/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Projects each element of an observable sequence into a window that is completed when either it’s full or a given amount of time has elapsed.
-
-     - seealso: [window operator on reactivex.io](http://reactivex.io/documentation/operators/window.html)
-
-     - parameter timeSpan: Maximum time length of a window.
-     - parameter count: Maximum element count of a window.
-     - parameter scheduler: Scheduler to run windowing timers on.
-     - returns: An observable sequence of windows (instances of `Observable`).
-     */
-    public func window(timeSpan: RxTimeInterval, count: Int, scheduler: SchedulerType)
-        -> Observable<Observable<Element>> {
-            return WindowTimeCount(source: self.asObservable(), timeSpan: timeSpan, count: count, scheduler: scheduler)
-    }
-}
-
-final private class WindowTimeCountSink<Element, Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType
-    , LockOwnerType
-    , SynchronizedOnType where Observer.Element == Observable<Element> {
-    typealias Parent = WindowTimeCount<Element>
-    
-    private let parent: Parent
-    
-    let lock = RecursiveLock()
-    
-    private var subject = PublishSubject<Element>()
-    private var count = 0
-    private var windowId = 0
-    
-    private let timerD = SerialDisposable()
-    private let refCountDisposable: RefCountDisposable
-    private let groupDisposable = CompositeDisposable()
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        
-        _ = self.groupDisposable.insert(self.timerD)
-        
-        self.refCountDisposable = RefCountDisposable(disposable: self.groupDisposable)
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        
-        self.forwardOn(.next(AddRef(source: self.subject, refCount: self.refCountDisposable).asObservable()))
-        self.createTimer(self.windowId)
-        
-        _ = self.groupDisposable.insert(self.parent.source.subscribe(self))
-        return self.refCountDisposable
-    }
-    
-    func startNewWindowAndCompleteCurrentOne() {
-        self.subject.on(.completed)
-        self.subject = PublishSubject<Element>()
-        
-        self.forwardOn(.next(AddRef(source: self.subject, refCount: self.refCountDisposable).asObservable()))
-    }
-
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        var newWindow = false
-        var newId = 0
-        
-        switch event {
-        case .next(let element):
-            self.subject.on(.next(element))
-            
-            do {
-                _ = try incrementChecked(&self.count)
-            } catch let e {
-                self.subject.on(.error(e as Swift.Error))
-                self.dispose()
-            }
-            
-            if self.count == self.parent.count {
-                newWindow = true
-                self.count = 0
-                self.windowId += 1
-                newId = self.windowId
-                self.startNewWindowAndCompleteCurrentOne()
-            }
-            
-        case .error(let error):
-            self.subject.on(.error(error))
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            self.subject.on(.completed)
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-
-        if newWindow {
-            self.createTimer(newId)
-        }
-    }
-    
-    func createTimer(_ windowId: Int) {
-        if self.timerD.isDisposed {
-            return
-        }
-        
-        if self.windowId != windowId {
-            return
-        }
-
-        let nextTimer = SingleAssignmentDisposable()
-
-        self.timerD.disposable = nextTimer
-
-        let scheduledRelative = self.parent.scheduler.scheduleRelative(windowId, dueTime: self.parent.timeSpan) { previousWindowId in
-            
-            var newId = 0
-            
-            self.lock.performLocked {
-                if previousWindowId != self.windowId {
-                    return
-                }
-                
-                self.count = 0
-                self.windowId = self.windowId &+ 1
-                newId = self.windowId
-                self.startNewWindowAndCompleteCurrentOne()
-            }
-            
-            self.createTimer(newId)
-            
-            return Disposables.create()
-        }
-
-        nextTimer.setDisposable(scheduledRelative)
-    }
-}
-
-final private class WindowTimeCount<Element>: Producer<Observable<Element>> {
-    fileprivate let timeSpan: RxTimeInterval
-    fileprivate let count: Int
-    fileprivate let scheduler: SchedulerType
-    fileprivate let source: Observable<Element>
-    
-    init(source: Observable<Element>, timeSpan: RxTimeInterval, count: Int, scheduler: SchedulerType) {
-        self.source = source
-        self.timeSpan = timeSpan
-        self.count = count
-        self.scheduler = scheduler
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Observable<Element> {
-        let sink = WindowTimeCountSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/WithLatestFrom.swift b/Pods/RxSwift/RxSwift/Observables/WithLatestFrom.swift
deleted file mode 100644
index d2868121a..000000000
--- a/Pods/RxSwift/RxSwift/Observables/WithLatestFrom.swift
+++ /dev/null
@@ -1,151 +0,0 @@
-//
-//  WithLatestFrom.swift
-//  RxSwift
-//
-//  Created by Yury Korolev on 10/19/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-
-    /**
-     Merges two observable sequences into one observable sequence by combining each element from self with the latest element from the second source, if any.
-
-     - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-     - note: Elements emitted by self before the second source has emitted any values will be omitted.
-
-     - parameter second: Second observable source.
-     - parameter resultSelector: Function to invoke for each element from the self combined with the latest element from the second source, if any.
-     - returns: An observable sequence containing the result of combining each element of the self  with the latest element from the second source, if any, using the specified result selector function.
-     */
-    public func withLatestFrom<Source: ObservableConvertibleType, ResultType>(_ second: Source, resultSelector: @escaping (Element, Source.Element) throws -> ResultType) -> Observable<ResultType> {
-        WithLatestFrom(first: self.asObservable(), second: second.asObservable(), resultSelector: resultSelector)
-    }
-
-    /**
-     Merges two observable sequences into one observable sequence by using latest element from the second sequence every time when `self` emits an element.
-
-     - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-     - note: Elements emitted by self before the second source has emitted any values will be omitted.
-
-     - parameter second: Second observable source.
-     - returns: An observable sequence containing the result of combining each element of the self  with the latest element from the second source, if any, using the specified result selector function.
-     */
-    public func withLatestFrom<Source: ObservableConvertibleType>(_ second: Source) -> Observable<Source.Element> {
-        WithLatestFrom(first: self.asObservable(), second: second.asObservable(), resultSelector: { $1 })
-    }
-}
-
-final private class WithLatestFromSink<FirstType, SecondType, Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias ResultType = Observer.Element
-    typealias Parent = WithLatestFrom<FirstType, SecondType, ResultType>
-    typealias Element = FirstType
-    
-    private let parent: Parent
-    
-    fileprivate var lock = RecursiveLock()
-    fileprivate var latest: SecondType?
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func run() -> Disposable {
-        let sndSubscription = SingleAssignmentDisposable()
-        let sndO = WithLatestFromSecond(parent: self, disposable: sndSubscription)
-        
-        sndSubscription.setDisposable(self.parent.second.subscribe(sndO))
-        let fstSubscription = self.parent.first.subscribe(self)
-
-        return Disposables.create(fstSubscription, sndSubscription)
-    }
-
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case let .next(value):
-            guard let latest = self.latest else { return }
-            do {
-                let res = try self.parent.resultSelector(value, latest)
-                
-                self.forwardOn(.next(res))
-            } catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        case .completed:
-            self.forwardOn(.completed)
-            self.dispose()
-        case let .error(error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        }
-    }
-}
-
-final private class WithLatestFromSecond<FirstType, SecondType, Observer: ObserverType>
-    : ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    
-    typealias ResultType = Observer.Element
-    typealias Parent = WithLatestFromSink<FirstType, SecondType, Observer>
-    typealias Element = SecondType
-    
-    private let parent: Parent
-    private let disposable: Disposable
-
-    var lock: RecursiveLock {
-        self.parent.lock
-    }
-
-    init(parent: Parent, disposable: Disposable) {
-        self.parent = parent
-        self.disposable = disposable
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        switch event {
-        case let .next(value):
-            self.parent.latest = value
-        case .completed:
-            self.disposable.dispose()
-        case let .error(error):
-            self.parent.forwardOn(.error(error))
-            self.parent.dispose()
-        }
-    }
-}
-
-final private class WithLatestFrom<FirstType, SecondType, ResultType>: Producer<ResultType> {
-    typealias ResultSelector = (FirstType, SecondType) throws -> ResultType
-    
-    fileprivate let first: Observable<FirstType>
-    fileprivate let second: Observable<SecondType>
-    fileprivate let resultSelector: ResultSelector
-
-    init(first: Observable<FirstType>, second: Observable<SecondType>, resultSelector: @escaping ResultSelector) {
-        self.first = first
-        self.second = second
-        self.resultSelector = resultSelector
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == ResultType {
-        let sink = WithLatestFromSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/WithUnretained.swift b/Pods/RxSwift/RxSwift/Observables/WithUnretained.swift
deleted file mode 100644
index 4dc2eadff..000000000
--- a/Pods/RxSwift/RxSwift/Observables/WithUnretained.swift
+++ /dev/null
@@ -1,58 +0,0 @@
-//
-//  WithUnretained.swift
-//  RxSwift
-//
-//  Created by Vincent Pradeilles on 01/01/2021.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Provides an unretained, safe to use (i.e. not implicitly unwrapped), reference to an object along with the events emitted by the sequence.
-     
-     In the case the provided object cannot be retained successfully, the seqeunce will complete.
-     
-     - note: Be careful when using this operator in a sequence that has a buffer or replay, for example `share(replay: 1)`, as the sharing buffer will also include the provided object, which could potentially cause a retain cycle.
-     
-     - parameter obj: The object to provide an unretained reference on.
-     - parameter resultSelector: A function to combine the unretained referenced on `obj` and the value of the observable sequence.
-     - returns: An observable sequence that contains the result of `resultSelector` being called with an unretained reference on `obj` and the values of the original sequence.
-     */
-    public func withUnretained<Object: AnyObject, Out>(
-        _ obj: Object,
-        resultSelector: @escaping (Object, Element) -> Out
-    ) -> Observable<Out> {
-        map { [weak obj] element -> Out in
-            guard let obj = obj else { throw UnretainedError.failedRetaining }
-
-            return resultSelector(obj, element)
-        }
-        .catch{ error -> Observable<Out> in
-            guard let unretainedError = error as? UnretainedError,
-                  unretainedError == .failedRetaining else {
-                return .error(error)
-            }
-
-            return .empty()
-        }
-    }
-
-    
-    /**
-     Provides an unretained, safe to use (i.e. not implicitly unwrapped), reference to an object along with the events emitted by the sequence.
-     
-     In the case the provided object cannot be retained successfully, the seqeunce will complete.
-     
-     - note: Be careful when using this operator in a sequence that has a buffer or replay, for example `share(replay: 1)`, as the sharing buffer will also include the provided object, which could potentially cause a retain cycle.
-     
-     - parameter obj: The object to provide an unretained reference on.
-     - returns: An observable sequence of tuples that contains both an unretained reference on `obj` and the values of the original sequence.
-     */
-    public func withUnretained<Object: AnyObject>(_ obj: Object) -> Observable<(Object, Element)> {
-        return withUnretained(obj) { ($0, $1) }
-    }
-}
-
-private enum UnretainedError: Swift.Error {
-    case failedRetaining
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Zip+Collection.swift b/Pods/RxSwift/RxSwift/Observables/Zip+Collection.swift
deleted file mode 100644
index 2d7f8877c..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Zip+Collection.swift
+++ /dev/null
@@ -1,168 +0,0 @@
-//
-//  Zip+Collection.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 8/30/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-     - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-     - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-     - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-     */
-    public static func zip<Collection: Swift.Collection>(_ collection: Collection, resultSelector: @escaping ([Collection.Element.Element]) throws -> Element) -> Observable<Element>
-        where Collection.Element: ObservableType {
-        ZipCollectionType(sources: collection, resultSelector: resultSelector)
-    }
-
-    /**
-     Merges the specified observable sequences into one observable sequence whenever all of the observable sequences have produced an element at a corresponding index.
-
-     - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-     - returns: An observable sequence containing the result of combining elements of the sources.
-     */
-    public static func zip<Collection: Swift.Collection>(_ collection: Collection) -> Observable<[Element]>
-        where Collection.Element: ObservableType, Collection.Element.Element == Element {
-        ZipCollectionType(sources: collection, resultSelector: { $0 })
-    }
-    
-}
-
-final private class ZipCollectionTypeSink<Collection: Swift.Collection, Observer: ObserverType>
-    : Sink<Observer> where Collection.Element: ObservableConvertibleType {
-    typealias Result = Observer.Element 
-    typealias Parent = ZipCollectionType<Collection, Result>
-    typealias SourceElement = Collection.Element.Element
-    
-    private let parent: Parent
-    
-    private let lock = RecursiveLock()
-    
-    // state
-    private var numberOfValues = 0
-    private var values: [Queue<SourceElement>]
-    private var isDone: [Bool]
-    private var numberOfDone = 0
-    private var subscriptions: [SingleAssignmentDisposable]
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        self.values = [Queue<SourceElement>](repeating: Queue(capacity: 4), count: parent.count)
-        self.isDone = [Bool](repeating: false, count: parent.count)
-        self.subscriptions = [SingleAssignmentDisposable]()
-        self.subscriptions.reserveCapacity(parent.count)
-        
-        for _ in 0 ..< parent.count {
-            self.subscriptions.append(SingleAssignmentDisposable())
-        }
-        
-        super.init(observer: observer, cancel: cancel)
-    }
-    
-    func on(_ event: Event<SourceElement>, atIndex: Int) {
-        self.lock.lock(); defer { self.lock.unlock() }
-        switch event {
-        case .next(let element):
-            self.values[atIndex].enqueue(element)
-            
-            if self.values[atIndex].count == 1 {
-                self.numberOfValues += 1
-            }
-            
-            if self.numberOfValues < self.parent.count {
-                if self.numberOfDone == self.parent.count - 1 {
-                    self.forwardOn(.completed)
-                    self.dispose()
-                }
-                return
-            }
-            
-            do {
-                var arguments = [SourceElement]()
-                arguments.reserveCapacity(self.parent.count)
-                
-                // recalculate number of values
-                self.numberOfValues = 0
-                
-                for i in 0 ..< self.values.count {
-                    arguments.append(self.values[i].dequeue()!)
-                    if !self.values[i].isEmpty {
-                        self.numberOfValues += 1
-                    }
-                }
-                
-                let result = try self.parent.resultSelector(arguments)
-                self.forwardOn(.next(result))
-            }
-            catch let error {
-                self.forwardOn(.error(error))
-                self.dispose()
-            }
-            
-        case .error(let error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .completed:
-            if self.isDone[atIndex] {
-                return
-            }
-            
-            self.isDone[atIndex] = true
-            self.numberOfDone += 1
-            
-            if self.numberOfDone == self.parent.count {
-                self.forwardOn(.completed)
-                self.dispose()
-            }
-            else {
-                self.subscriptions[atIndex].dispose()
-            }
-        }
-    }
-    
-    func run() -> Disposable {
-        var j = 0
-        for i in self.parent.sources {
-            let index = j
-            let source = i.asObservable()
-
-            let disposable = source.subscribe(AnyObserver { event in
-                self.on(event, atIndex: index)
-                })
-            self.subscriptions[j].setDisposable(disposable)
-            j += 1
-        }
-
-        if self.parent.sources.isEmpty {
-            self.forwardOn(.completed)
-        }
-        
-        return Disposables.create(subscriptions)
-    }
-}
-
-final private class ZipCollectionType<Collection: Swift.Collection, Result>: Producer<Result> where Collection.Element: ObservableConvertibleType {
-    typealias ResultSelector = ([Collection.Element.Element]) throws -> Result
-    
-    let sources: Collection
-    let resultSelector: ResultSelector
-    let count: Int
-    
-    init(sources: Collection, resultSelector: @escaping ResultSelector) {
-        self.sources = sources
-        self.resultSelector = resultSelector
-        self.count = self.sources.count
-    }
-    
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = ZipCollectionTypeSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observables/Zip+arity.swift b/Pods/RxSwift/RxSwift/Observables/Zip+arity.swift
deleted file mode 100644
index b6d876d1d..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Zip+arity.swift
+++ /dev/null
@@ -1,934 +0,0 @@
-// This file is autogenerated. Take a look at `Preprocessor` target in RxSwift project 
-//
-//  Zip+arity.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 5/23/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-
-
-// 2
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType>
-        (_ source1: O1, _ source2: O2, resultSelector: @escaping (O1.Element, O2.Element) throws -> Element)
-        -> Observable<Element> {
-        return Zip2(
-            source1: source1.asObservable(), source2: source2.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType>
-        (_ source1: O1, _ source2: O2)
-        -> Observable<(O1.Element, O2.Element)> {
-        return Zip2(
-            source1: source1.asObservable(), source2: source2.asObservable(),
-            resultSelector: { ($0, $1) }
-        )
-    }
-}
-
-final class ZipSink2_<E1, E2, Observer: ObserverType> : ZipSink<Observer> {
-    typealias Result = Observer.Element 
-    typealias Parent = Zip2<E1, E2, Result>
-
-    let parent: Parent
-
-    var values1: Queue<E1> = Queue(capacity: 2)
-    var values2: Queue<E2> = Queue(capacity: 2)
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 2, observer: observer, cancel: cancel)
-    }
-
-    override func hasElements(_ index: Int) -> Bool {
-        switch index {
-        case 0: return !self.values1.isEmpty
-        case 1: return !self.values2.isEmpty
-
-        default:
-            rxFatalError("Unhandled case (Function)")
-        }
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-
-        let observer1 = ZipObserver(lock: self.lock, parent: self, index: 0, setNextValue: { self.values1.enqueue($0) }, this: subscription1)
-        let observer2 = ZipObserver(lock: self.lock, parent: self, index: 1, setNextValue: { self.values2.enqueue($0) }, this: subscription2)
-
-        subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-        subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-
-        return Disposables.create([
-           subscription1,
-           subscription2
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.values1.dequeue()!, self.values2.dequeue()!)
-    }
-}
-
-final class Zip2<E1, E2, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = ZipSink2_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 3
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, resultSelector: @escaping (O1.Element, O2.Element, O3.Element) throws -> Element)
-        -> Observable<Element> {
-        return Zip3(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3)
-        -> Observable<(O1.Element, O2.Element, O3.Element)> {
-        return Zip3(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(),
-            resultSelector: { ($0, $1, $2) }
-        )
-    }
-}
-
-final class ZipSink3_<E1, E2, E3, Observer: ObserverType> : ZipSink<Observer> {
-    typealias Result = Observer.Element 
-    typealias Parent = Zip3<E1, E2, E3, Result>
-
-    let parent: Parent
-
-    var values1: Queue<E1> = Queue(capacity: 2)
-    var values2: Queue<E2> = Queue(capacity: 2)
-    var values3: Queue<E3> = Queue(capacity: 2)
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 3, observer: observer, cancel: cancel)
-    }
-
-    override func hasElements(_ index: Int) -> Bool {
-        switch index {
-        case 0: return !self.values1.isEmpty
-        case 1: return !self.values2.isEmpty
-        case 2: return !self.values3.isEmpty
-
-        default:
-            rxFatalError("Unhandled case (Function)")
-        }
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-
-        let observer1 = ZipObserver(lock: self.lock, parent: self, index: 0, setNextValue: { self.values1.enqueue($0) }, this: subscription1)
-        let observer2 = ZipObserver(lock: self.lock, parent: self, index: 1, setNextValue: { self.values2.enqueue($0) }, this: subscription2)
-        let observer3 = ZipObserver(lock: self.lock, parent: self, index: 2, setNextValue: { self.values3.enqueue($0) }, this: subscription3)
-
-        subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-        subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-        subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-
-        return Disposables.create([
-           subscription1,
-           subscription2,
-           subscription3
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.values1.dequeue()!, self.values2.dequeue()!, self.values3.dequeue()!)
-    }
-}
-
-final class Zip3<E1, E2, E3, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = ZipSink3_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 4
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element) throws -> Element)
-        -> Observable<Element> {
-        return Zip4(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4)
-        -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element)> {
-        return Zip4(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(),
-            resultSelector: { ($0, $1, $2, $3) }
-        )
-    }
-}
-
-final class ZipSink4_<E1, E2, E3, E4, Observer: ObserverType> : ZipSink<Observer> {
-    typealias Result = Observer.Element 
-    typealias Parent = Zip4<E1, E2, E3, E4, Result>
-
-    let parent: Parent
-
-    var values1: Queue<E1> = Queue(capacity: 2)
-    var values2: Queue<E2> = Queue(capacity: 2)
-    var values3: Queue<E3> = Queue(capacity: 2)
-    var values4: Queue<E4> = Queue(capacity: 2)
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 4, observer: observer, cancel: cancel)
-    }
-
-    override func hasElements(_ index: Int) -> Bool {
-        switch index {
-        case 0: return !self.values1.isEmpty
-        case 1: return !self.values2.isEmpty
-        case 2: return !self.values3.isEmpty
-        case 3: return !self.values4.isEmpty
-
-        default:
-            rxFatalError("Unhandled case (Function)")
-        }
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-
-        let observer1 = ZipObserver(lock: self.lock, parent: self, index: 0, setNextValue: { self.values1.enqueue($0) }, this: subscription1)
-        let observer2 = ZipObserver(lock: self.lock, parent: self, index: 1, setNextValue: { self.values2.enqueue($0) }, this: subscription2)
-        let observer3 = ZipObserver(lock: self.lock, parent: self, index: 2, setNextValue: { self.values3.enqueue($0) }, this: subscription3)
-        let observer4 = ZipObserver(lock: self.lock, parent: self, index: 3, setNextValue: { self.values4.enqueue($0) }, this: subscription4)
-
-        subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-        subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-        subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-        subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-
-        return Disposables.create([
-           subscription1,
-           subscription2,
-           subscription3,
-           subscription4
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.values1.dequeue()!, self.values2.dequeue()!, self.values3.dequeue()!, self.values4.dequeue()!)
-    }
-}
-
-final class Zip4<E1, E2, E3, E4, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = ZipSink4_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 5
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element) throws -> Element)
-        -> Observable<Element> {
-        return Zip5(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5)
-        -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element, O5.Element)> {
-        return Zip5(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(),
-            resultSelector: { ($0, $1, $2, $3, $4) }
-        )
-    }
-}
-
-final class ZipSink5_<E1, E2, E3, E4, E5, Observer: ObserverType> : ZipSink<Observer> {
-    typealias Result = Observer.Element 
-    typealias Parent = Zip5<E1, E2, E3, E4, E5, Result>
-
-    let parent: Parent
-
-    var values1: Queue<E1> = Queue(capacity: 2)
-    var values2: Queue<E2> = Queue(capacity: 2)
-    var values3: Queue<E3> = Queue(capacity: 2)
-    var values4: Queue<E4> = Queue(capacity: 2)
-    var values5: Queue<E5> = Queue(capacity: 2)
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 5, observer: observer, cancel: cancel)
-    }
-
-    override func hasElements(_ index: Int) -> Bool {
-        switch index {
-        case 0: return !self.values1.isEmpty
-        case 1: return !self.values2.isEmpty
-        case 2: return !self.values3.isEmpty
-        case 3: return !self.values4.isEmpty
-        case 4: return !self.values5.isEmpty
-
-        default:
-            rxFatalError("Unhandled case (Function)")
-        }
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-        let subscription5 = SingleAssignmentDisposable()
-
-        let observer1 = ZipObserver(lock: self.lock, parent: self, index: 0, setNextValue: { self.values1.enqueue($0) }, this: subscription1)
-        let observer2 = ZipObserver(lock: self.lock, parent: self, index: 1, setNextValue: { self.values2.enqueue($0) }, this: subscription2)
-        let observer3 = ZipObserver(lock: self.lock, parent: self, index: 2, setNextValue: { self.values3.enqueue($0) }, this: subscription3)
-        let observer4 = ZipObserver(lock: self.lock, parent: self, index: 3, setNextValue: { self.values4.enqueue($0) }, this: subscription4)
-        let observer5 = ZipObserver(lock: self.lock, parent: self, index: 4, setNextValue: { self.values5.enqueue($0) }, this: subscription5)
-
-        subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-        subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-        subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-        subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-        subscription5.setDisposable(self.parent.source5.subscribe(observer5))
-
-        return Disposables.create([
-           subscription1,
-           subscription2,
-           subscription3,
-           subscription4,
-           subscription5
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.values1.dequeue()!, self.values2.dequeue()!, self.values3.dequeue()!, self.values4.dequeue()!, self.values5.dequeue()!)
-    }
-}
-
-final class Zip5<E1, E2, E3, E4, E5, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4, E5) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-    let source5: Observable<E5>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, source5: Observable<E5>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-        self.source5 = source5
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = ZipSink5_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 6
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element) throws -> Element)
-        -> Observable<Element> {
-        return Zip6(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6)
-        -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element)> {
-        return Zip6(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(),
-            resultSelector: { ($0, $1, $2, $3, $4, $5) }
-        )
-    }
-}
-
-final class ZipSink6_<E1, E2, E3, E4, E5, E6, Observer: ObserverType> : ZipSink<Observer> {
-    typealias Result = Observer.Element 
-    typealias Parent = Zip6<E1, E2, E3, E4, E5, E6, Result>
-
-    let parent: Parent
-
-    var values1: Queue<E1> = Queue(capacity: 2)
-    var values2: Queue<E2> = Queue(capacity: 2)
-    var values3: Queue<E3> = Queue(capacity: 2)
-    var values4: Queue<E4> = Queue(capacity: 2)
-    var values5: Queue<E5> = Queue(capacity: 2)
-    var values6: Queue<E6> = Queue(capacity: 2)
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 6, observer: observer, cancel: cancel)
-    }
-
-    override func hasElements(_ index: Int) -> Bool {
-        switch index {
-        case 0: return !self.values1.isEmpty
-        case 1: return !self.values2.isEmpty
-        case 2: return !self.values3.isEmpty
-        case 3: return !self.values4.isEmpty
-        case 4: return !self.values5.isEmpty
-        case 5: return !self.values6.isEmpty
-
-        default:
-            rxFatalError("Unhandled case (Function)")
-        }
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-        let subscription5 = SingleAssignmentDisposable()
-        let subscription6 = SingleAssignmentDisposable()
-
-        let observer1 = ZipObserver(lock: self.lock, parent: self, index: 0, setNextValue: { self.values1.enqueue($0) }, this: subscription1)
-        let observer2 = ZipObserver(lock: self.lock, parent: self, index: 1, setNextValue: { self.values2.enqueue($0) }, this: subscription2)
-        let observer3 = ZipObserver(lock: self.lock, parent: self, index: 2, setNextValue: { self.values3.enqueue($0) }, this: subscription3)
-        let observer4 = ZipObserver(lock: self.lock, parent: self, index: 3, setNextValue: { self.values4.enqueue($0) }, this: subscription4)
-        let observer5 = ZipObserver(lock: self.lock, parent: self, index: 4, setNextValue: { self.values5.enqueue($0) }, this: subscription5)
-        let observer6 = ZipObserver(lock: self.lock, parent: self, index: 5, setNextValue: { self.values6.enqueue($0) }, this: subscription6)
-
-        subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-        subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-        subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-        subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-        subscription5.setDisposable(self.parent.source5.subscribe(observer5))
-        subscription6.setDisposable(self.parent.source6.subscribe(observer6))
-
-        return Disposables.create([
-           subscription1,
-           subscription2,
-           subscription3,
-           subscription4,
-           subscription5,
-           subscription6
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.values1.dequeue()!, self.values2.dequeue()!, self.values3.dequeue()!, self.values4.dequeue()!, self.values5.dequeue()!, self.values6.dequeue()!)
-    }
-}
-
-final class Zip6<E1, E2, E3, E4, E5, E6, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4, E5, E6) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-    let source5: Observable<E5>
-    let source6: Observable<E6>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, source5: Observable<E5>, source6: Observable<E6>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-        self.source5 = source5
-        self.source6 = source6
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = ZipSink6_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 7
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType, O7: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element) throws -> Element)
-        -> Observable<Element> {
-        return Zip7(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType, O7: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7)
-        -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element)> {
-        return Zip7(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(),
-            resultSelector: { ($0, $1, $2, $3, $4, $5, $6) }
-        )
-    }
-}
-
-final class ZipSink7_<E1, E2, E3, E4, E5, E6, E7, Observer: ObserverType> : ZipSink<Observer> {
-    typealias Result = Observer.Element 
-    typealias Parent = Zip7<E1, E2, E3, E4, E5, E6, E7, Result>
-
-    let parent: Parent
-
-    var values1: Queue<E1> = Queue(capacity: 2)
-    var values2: Queue<E2> = Queue(capacity: 2)
-    var values3: Queue<E3> = Queue(capacity: 2)
-    var values4: Queue<E4> = Queue(capacity: 2)
-    var values5: Queue<E5> = Queue(capacity: 2)
-    var values6: Queue<E6> = Queue(capacity: 2)
-    var values7: Queue<E7> = Queue(capacity: 2)
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 7, observer: observer, cancel: cancel)
-    }
-
-    override func hasElements(_ index: Int) -> Bool {
-        switch index {
-        case 0: return !self.values1.isEmpty
-        case 1: return !self.values2.isEmpty
-        case 2: return !self.values3.isEmpty
-        case 3: return !self.values4.isEmpty
-        case 4: return !self.values5.isEmpty
-        case 5: return !self.values6.isEmpty
-        case 6: return !self.values7.isEmpty
-
-        default:
-            rxFatalError("Unhandled case (Function)")
-        }
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-        let subscription5 = SingleAssignmentDisposable()
-        let subscription6 = SingleAssignmentDisposable()
-        let subscription7 = SingleAssignmentDisposable()
-
-        let observer1 = ZipObserver(lock: self.lock, parent: self, index: 0, setNextValue: { self.values1.enqueue($0) }, this: subscription1)
-        let observer2 = ZipObserver(lock: self.lock, parent: self, index: 1, setNextValue: { self.values2.enqueue($0) }, this: subscription2)
-        let observer3 = ZipObserver(lock: self.lock, parent: self, index: 2, setNextValue: { self.values3.enqueue($0) }, this: subscription3)
-        let observer4 = ZipObserver(lock: self.lock, parent: self, index: 3, setNextValue: { self.values4.enqueue($0) }, this: subscription4)
-        let observer5 = ZipObserver(lock: self.lock, parent: self, index: 4, setNextValue: { self.values5.enqueue($0) }, this: subscription5)
-        let observer6 = ZipObserver(lock: self.lock, parent: self, index: 5, setNextValue: { self.values6.enqueue($0) }, this: subscription6)
-        let observer7 = ZipObserver(lock: self.lock, parent: self, index: 6, setNextValue: { self.values7.enqueue($0) }, this: subscription7)
-
-        subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-        subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-        subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-        subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-        subscription5.setDisposable(self.parent.source5.subscribe(observer5))
-        subscription6.setDisposable(self.parent.source6.subscribe(observer6))
-        subscription7.setDisposable(self.parent.source7.subscribe(observer7))
-
-        return Disposables.create([
-           subscription1,
-           subscription2,
-           subscription3,
-           subscription4,
-           subscription5,
-           subscription6,
-           subscription7
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.values1.dequeue()!, self.values2.dequeue()!, self.values3.dequeue()!, self.values4.dequeue()!, self.values5.dequeue()!, self.values6.dequeue()!, self.values7.dequeue()!)
-    }
-}
-
-final class Zip7<E1, E2, E3, E4, E5, E6, E7, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4, E5, E6, E7) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-    let source5: Observable<E5>
-    let source6: Observable<E6>
-    let source7: Observable<E7>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, source5: Observable<E5>, source6: Observable<E6>, source7: Observable<E7>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-        self.source5 = source5
-        self.source6 = source6
-        self.source7 = source7
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = ZipSink7_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
-
-// 8
-
-extension ObservableType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType, O7: ObservableType, O8: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, _ source8: O8, resultSelector: @escaping (O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element) throws -> Element)
-        -> Observable<Element> {
-        return Zip8(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(), source8: source8.asObservable(),
-            resultSelector: resultSelector
-        )
-    }
-}
-
-extension ObservableType where Element == Any {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources.
-    */
-    public static func zip<O1: ObservableType, O2: ObservableType, O3: ObservableType, O4: ObservableType, O5: ObservableType, O6: ObservableType, O7: ObservableType, O8: ObservableType>
-        (_ source1: O1, _ source2: O2, _ source3: O3, _ source4: O4, _ source5: O5, _ source6: O6, _ source7: O7, _ source8: O8)
-        -> Observable<(O1.Element, O2.Element, O3.Element, O4.Element, O5.Element, O6.Element, O7.Element, O8.Element)> {
-        return Zip8(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(), source8: source8.asObservable(),
-            resultSelector: { ($0, $1, $2, $3, $4, $5, $6, $7) }
-        )
-    }
-}
-
-final class ZipSink8_<E1, E2, E3, E4, E5, E6, E7, E8, Observer: ObserverType> : ZipSink<Observer> {
-    typealias Result = Observer.Element 
-    typealias Parent = Zip8<E1, E2, E3, E4, E5, E6, E7, E8, Result>
-
-    let parent: Parent
-
-    var values1: Queue<E1> = Queue(capacity: 2)
-    var values2: Queue<E2> = Queue(capacity: 2)
-    var values3: Queue<E3> = Queue(capacity: 2)
-    var values4: Queue<E4> = Queue(capacity: 2)
-    var values5: Queue<E5> = Queue(capacity: 2)
-    var values6: Queue<E6> = Queue(capacity: 2)
-    var values7: Queue<E7> = Queue(capacity: 2)
-    var values8: Queue<E8> = Queue(capacity: 2)
-
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(arity: 8, observer: observer, cancel: cancel)
-    }
-
-    override func hasElements(_ index: Int) -> Bool {
-        switch index {
-        case 0: return !self.values1.isEmpty
-        case 1: return !self.values2.isEmpty
-        case 2: return !self.values3.isEmpty
-        case 3: return !self.values4.isEmpty
-        case 4: return !self.values5.isEmpty
-        case 5: return !self.values6.isEmpty
-        case 6: return !self.values7.isEmpty
-        case 7: return !self.values8.isEmpty
-
-        default:
-            rxFatalError("Unhandled case (Function)")
-        }
-    }
-
-    func run() -> Disposable {
-        let subscription1 = SingleAssignmentDisposable()
-        let subscription2 = SingleAssignmentDisposable()
-        let subscription3 = SingleAssignmentDisposable()
-        let subscription4 = SingleAssignmentDisposable()
-        let subscription5 = SingleAssignmentDisposable()
-        let subscription6 = SingleAssignmentDisposable()
-        let subscription7 = SingleAssignmentDisposable()
-        let subscription8 = SingleAssignmentDisposable()
-
-        let observer1 = ZipObserver(lock: self.lock, parent: self, index: 0, setNextValue: { self.values1.enqueue($0) }, this: subscription1)
-        let observer2 = ZipObserver(lock: self.lock, parent: self, index: 1, setNextValue: { self.values2.enqueue($0) }, this: subscription2)
-        let observer3 = ZipObserver(lock: self.lock, parent: self, index: 2, setNextValue: { self.values3.enqueue($0) }, this: subscription3)
-        let observer4 = ZipObserver(lock: self.lock, parent: self, index: 3, setNextValue: { self.values4.enqueue($0) }, this: subscription4)
-        let observer5 = ZipObserver(lock: self.lock, parent: self, index: 4, setNextValue: { self.values5.enqueue($0) }, this: subscription5)
-        let observer6 = ZipObserver(lock: self.lock, parent: self, index: 5, setNextValue: { self.values6.enqueue($0) }, this: subscription6)
-        let observer7 = ZipObserver(lock: self.lock, parent: self, index: 6, setNextValue: { self.values7.enqueue($0) }, this: subscription7)
-        let observer8 = ZipObserver(lock: self.lock, parent: self, index: 7, setNextValue: { self.values8.enqueue($0) }, this: subscription8)
-
-        subscription1.setDisposable(self.parent.source1.subscribe(observer1))
-        subscription2.setDisposable(self.parent.source2.subscribe(observer2))
-        subscription3.setDisposable(self.parent.source3.subscribe(observer3))
-        subscription4.setDisposable(self.parent.source4.subscribe(observer4))
-        subscription5.setDisposable(self.parent.source5.subscribe(observer5))
-        subscription6.setDisposable(self.parent.source6.subscribe(observer6))
-        subscription7.setDisposable(self.parent.source7.subscribe(observer7))
-        subscription8.setDisposable(self.parent.source8.subscribe(observer8))
-
-        return Disposables.create([
-           subscription1,
-           subscription2,
-           subscription3,
-           subscription4,
-           subscription5,
-           subscription6,
-           subscription7,
-           subscription8
-        ])
-    }
-
-    override func getResult() throws -> Result {
-        try self.parent.resultSelector(self.values1.dequeue()!, self.values2.dequeue()!, self.values3.dequeue()!, self.values4.dequeue()!, self.values5.dequeue()!, self.values6.dequeue()!, self.values7.dequeue()!, self.values8.dequeue()!)
-    }
-}
-
-final class Zip8<E1, E2, E3, E4, E5, E6, E7, E8, Result> : Producer<Result> {
-    typealias ResultSelector = (E1, E2, E3, E4, E5, E6, E7, E8) throws -> Result
-
-    let source1: Observable<E1>
-    let source2: Observable<E2>
-    let source3: Observable<E3>
-    let source4: Observable<E4>
-    let source5: Observable<E5>
-    let source6: Observable<E6>
-    let source7: Observable<E7>
-    let source8: Observable<E8>
-
-    let resultSelector: ResultSelector
-
-    init(source1: Observable<E1>, source2: Observable<E2>, source3: Observable<E3>, source4: Observable<E4>, source5: Observable<E5>, source6: Observable<E6>, source7: Observable<E7>, source8: Observable<E8>, resultSelector: @escaping ResultSelector) {
-        self.source1 = source1
-        self.source2 = source2
-        self.source3 = source3
-        self.source4 = source4
-        self.source5 = source5
-        self.source6 = source6
-        self.source7 = source7
-        self.source8 = source8
-
-        self.resultSelector = resultSelector
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Result {
-        let sink = ZipSink8_(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-
diff --git a/Pods/RxSwift/RxSwift/Observables/Zip.swift b/Pods/RxSwift/RxSwift/Observables/Zip.swift
deleted file mode 100644
index 328a40ef7..000000000
--- a/Pods/RxSwift/RxSwift/Observables/Zip.swift
+++ /dev/null
@@ -1,135 +0,0 @@
-//
-//  Zip.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 5/23/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-protocol ZipSinkProtocol: AnyObject {
-    func next(_ index: Int)
-    func fail(_ error: Swift.Error)
-    func done(_ index: Int)
-}
-
-class ZipSink<Observer: ObserverType> : Sink<Observer>, ZipSinkProtocol {
-    typealias Element = Observer.Element
-    
-    let arity: Int
-
-    let lock = RecursiveLock()
-
-    // state
-    private var isDone: [Bool]
-    
-    init(arity: Int, observer: Observer, cancel: Cancelable) {
-        self.isDone = [Bool](repeating: false, count: arity)
-        self.arity = arity
-        
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func getResult() throws -> Element {
-        rxAbstractMethod()
-    }
-    
-    func hasElements(_ index: Int) -> Bool {
-        rxAbstractMethod()
-    }
-    
-    func next(_ index: Int) {
-        var hasValueAll = true
-        
-        for i in 0 ..< self.arity {
-            if !self.hasElements(i) {
-                hasValueAll = false
-                break
-            }
-        }
-        
-        if hasValueAll {
-            do {
-                let result = try self.getResult()
-                self.forwardOn(.next(result))
-            }
-            catch let e {
-                self.forwardOn(.error(e))
-                self.dispose()
-            }
-        }
-    }
-    
-    func fail(_ error: Swift.Error) {
-        self.forwardOn(.error(error))
-        self.dispose()
-    }
-    
-    func done(_ index: Int) {
-        self.isDone[index] = true
-        
-        var allDone = true
-        
-        for done in self.isDone where !done {
-            allDone = false
-            break
-        }
-        
-        if allDone {
-            self.forwardOn(.completed)
-            self.dispose()
-        }
-    }
-}
-
-final class ZipObserver<Element>
-    : ObserverType
-    , LockOwnerType
-    , SynchronizedOnType {
-    typealias ValueSetter = (Element) -> Void
-
-    private var parent: ZipSinkProtocol?
-    
-    let lock: RecursiveLock
-    
-    // state
-    private let index: Int
-    private let this: Disposable
-    private let setNextValue: ValueSetter
-    
-    init(lock: RecursiveLock, parent: ZipSinkProtocol, index: Int, setNextValue: @escaping ValueSetter, this: Disposable) {
-        self.lock = lock
-        self.parent = parent
-        self.index = index
-        self.this = this
-        self.setNextValue = setNextValue
-    }
-    
-    func on(_ event: Event<Element>) {
-        self.synchronizedOn(event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) {
-        if self.parent != nil {
-            switch event {
-            case .next:
-                break
-            case .error:
-                self.this.dispose()
-            case .completed:
-                self.this.dispose()
-            }
-        }
-        
-        if let parent = self.parent {
-            switch event {
-            case .next(let value):
-                self.setNextValue(value)
-                parent.next(self.index)
-            case .error(let error):
-                parent.fail(error)
-            case .completed:
-                parent.done(self.index)
-            }
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/ObserverType.swift b/Pods/RxSwift/RxSwift/ObserverType.swift
deleted file mode 100644
index b7a66480e..000000000
--- a/Pods/RxSwift/RxSwift/ObserverType.swift
+++ /dev/null
@@ -1,40 +0,0 @@
-//
-//  ObserverType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Supports push-style iteration over an observable sequence.
-public protocol ObserverType {
-    /// The type of elements in sequence that observer can observe.
-    associatedtype Element
-
-    /// Notify observer about sequence event.
-    ///
-    /// - parameter event: Event that occurred.
-    func on(_ event: Event<Element>)
-}
-
-/// Convenience API extensions to provide alternate next, error, completed events
-extension ObserverType {
-    
-    /// Convenience method equivalent to `on(.next(element: Element))`
-    ///
-    /// - parameter element: Next element to send to observer(s)
-    public func onNext(_ element: Element) {
-        self.on(.next(element))
-    }
-    
-    /// Convenience method equivalent to `on(.completed)`
-    public func onCompleted() {
-        self.on(.completed)
-    }
-    
-    /// Convenience method equivalent to `on(.error(Swift.Error))`
-    /// - parameter error: Swift.Error to send to observer(s)
-    public func onError(_ error: Swift.Error) {
-        self.on(.error(error))
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observers/AnonymousObserver.swift b/Pods/RxSwift/RxSwift/Observers/AnonymousObserver.swift
deleted file mode 100644
index cbb42dc82..000000000
--- a/Pods/RxSwift/RxSwift/Observers/AnonymousObserver.swift
+++ /dev/null
@@ -1,30 +0,0 @@
-//
-//  AnonymousObserver.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-final class AnonymousObserver<Element>: ObserverBase<Element> {
-    typealias EventHandler = (Event<Element>) -> Void
-    
-    private let eventHandler : EventHandler
-    
-    init(_ eventHandler: @escaping EventHandler) {
-#if TRACE_RESOURCES
-        _ = Resources.incrementTotal()
-#endif
-        self.eventHandler = eventHandler
-    }
-
-    override func onCore(_ event: Event<Element>) {
-        self.eventHandler(event)
-    }
-    
-#if TRACE_RESOURCES
-    deinit {
-        _ = Resources.decrementTotal()
-    }
-#endif
-}
diff --git a/Pods/RxSwift/RxSwift/Observers/ObserverBase.swift b/Pods/RxSwift/RxSwift/Observers/ObserverBase.swift
deleted file mode 100644
index 48e09868b..000000000
--- a/Pods/RxSwift/RxSwift/Observers/ObserverBase.swift
+++ /dev/null
@@ -1,32 +0,0 @@
-//
-//  ObserverBase.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/15/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-class ObserverBase<Element> : Disposable, ObserverType {
-    private let isStopped = AtomicInt(0)
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .next:
-            if load(self.isStopped) == 0 {
-                self.onCore(event)
-            }
-        case .error, .completed:
-            if fetchOr(self.isStopped, 1) == 0 {
-                self.onCore(event)
-            }
-        }
-    }
-
-    func onCore(_ event: Event<Element>) {
-        rxAbstractMethod()
-    }
-
-    func dispose() {
-        fetchOr(self.isStopped, 1)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Observers/TailRecursiveSink.swift b/Pods/RxSwift/RxSwift/Observers/TailRecursiveSink.swift
deleted file mode 100644
index fd527001d..000000000
--- a/Pods/RxSwift/RxSwift/Observers/TailRecursiveSink.swift
+++ /dev/null
@@ -1,151 +0,0 @@
-//
-//  TailRecursiveSink.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/21/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-enum TailRecursiveSinkCommand {
-    case moveNext
-    case dispose
-}
-
-#if DEBUG || TRACE_RESOURCES
-    public var maxTailRecursiveSinkStackSize = 0
-#endif
-
-/// This class is usually used with `Generator` version of the operators.
-class TailRecursiveSink<Sequence: Swift.Sequence, Observer: ObserverType>
-    : Sink<Observer>
-    , InvocableWithValueType where Sequence.Element: ObservableConvertibleType, Sequence.Element.Element == Observer.Element {
-    typealias Value = TailRecursiveSinkCommand
-    typealias Element = Observer.Element 
-    typealias SequenceGenerator = (generator: Sequence.Iterator, remaining: IntMax?)
-
-    var generators: [SequenceGenerator] = []
-    var disposed = false
-    var subscription = SerialDisposable()
-
-    // this is thread safe object
-    var gate = AsyncLock<InvocableScheduledItem<TailRecursiveSink<Sequence, Observer>>>()
-
-    override init(observer: Observer, cancel: Cancelable) {
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func run(_ sources: SequenceGenerator) -> Disposable {
-        self.generators.append(sources)
-
-        self.schedule(.moveNext)
-
-        return self.subscription
-    }
-
-    func invoke(_ command: TailRecursiveSinkCommand) {
-        switch command {
-        case .dispose:
-            self.disposeCommand()
-        case .moveNext:
-            self.moveNextCommand()
-        }
-    }
-
-    // simple implementation for now
-    func schedule(_ command: TailRecursiveSinkCommand) {
-        self.gate.invoke(InvocableScheduledItem(invocable: self, state: command))
-    }
-
-    func done() {
-        self.forwardOn(.completed)
-        self.dispose()
-    }
-
-    func extract(_ observable: Observable<Element>) -> SequenceGenerator? {
-        rxAbstractMethod()
-    }
-
-    // should be done on gate locked
-
-    private func moveNextCommand() {
-        var next: Observable<Element>?
-
-        repeat {
-            guard let (g, left) = self.generators.last else {
-                break
-            }
-            
-            if self.isDisposed {
-                return
-            }
-
-            self.generators.removeLast()
-            
-            var e = g
-
-            guard let nextCandidate = e.next()?.asObservable() else {
-                continue
-            }
-
-            // `left` is a hint of how many elements are left in generator.
-            // In case this is the last element, then there is no need to push
-            // that generator on stack.
-            //
-            // This is an optimization used to make sure in tail recursive case
-            // there is no memory leak in case this operator is used to generate non terminating
-            // sequence.
-
-            if let knownOriginalLeft = left {
-                // `- 1` because generator.next() has just been called
-                if knownOriginalLeft - 1 >= 1 {
-                    self.generators.append((e, knownOriginalLeft - 1))
-                }
-            }
-            else {
-                self.generators.append((e, nil))
-            }
-
-            let nextGenerator = self.extract(nextCandidate)
-
-            if let nextGenerator = nextGenerator {
-                self.generators.append(nextGenerator)
-                #if DEBUG || TRACE_RESOURCES
-                    if maxTailRecursiveSinkStackSize < self.generators.count {
-                        maxTailRecursiveSinkStackSize = self.generators.count
-                    }
-                #endif
-            }
-            else {
-                next = nextCandidate
-            }
-        } while next == nil
-
-        guard let existingNext = next else {
-            self.done()
-            return
-        }
-
-        let disposable = SingleAssignmentDisposable()
-        self.subscription.disposable = disposable
-        disposable.setDisposable(self.subscribeToNext(existingNext))
-    }
-
-    func subscribeToNext(_ source: Observable<Element>) -> Disposable {
-        rxAbstractMethod()
-    }
-
-    func disposeCommand() {
-        self.disposed = true
-        self.generators.removeAll(keepingCapacity: false)
-    }
-
-    override func dispose() {
-        super.dispose()
-        
-        self.subscription.dispose()
-        self.gate.dispose()
-        
-        self.schedule(.dispose)
-    }
-}
-
diff --git a/Pods/RxSwift/RxSwift/Reactive.swift b/Pods/RxSwift/RxSwift/Reactive.swift
deleted file mode 100644
index 1bf390dc5..000000000
--- a/Pods/RxSwift/RxSwift/Reactive.swift
+++ /dev/null
@@ -1,80 +0,0 @@
-//
-//  Reactive.swift
-//  RxSwift
-//
-//  Created by Yury Korolev on 5/2/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-/**
- Use `Reactive` proxy as customization point for constrained protocol extensions.
-
- General pattern would be:
-
- // 1. Extend Reactive protocol with constrain on Base
- // Read as: Reactive Extension where Base is a SomeType
- extension Reactive where Base: SomeType {
- // 2. Put any specific reactive extension for SomeType here
- }
-
- With this approach we can have more specialized methods and properties using
- `Base` and not just specialized on common base type.
-
- `Binder`s are also automatically synthesized using `@dynamicMemberLookup` for writable reference properties of the reactive base.
- */
-
-@dynamicMemberLookup
-public struct Reactive<Base> {
-    /// Base object to extend.
-    public let base: Base
-
-    /// Creates extensions with base object.
-    ///
-    /// - parameter base: Base object.
-    public init(_ base: Base) {
-        self.base = base
-    }
-
-    /// Automatically synthesized binder for a key path between the reactive
-    /// base and one of its properties
-    public subscript<Property>(dynamicMember keyPath: ReferenceWritableKeyPath<Base, Property>) -> Binder<Property> where Base: AnyObject {
-        Binder(self.base) { base, value in
-            base[keyPath: keyPath] = value
-        }
-    }
-}
-
-/// A type that has reactive extensions.
-public protocol ReactiveCompatible {
-    /// Extended type
-    associatedtype ReactiveBase
-
-    /// Reactive extensions.
-    static var rx: Reactive<ReactiveBase>.Type { get set }
-
-    /// Reactive extensions.
-    var rx: Reactive<ReactiveBase> { get set }
-}
-
-extension ReactiveCompatible {
-    /// Reactive extensions.
-    public static var rx: Reactive<Self>.Type {
-        get { Reactive<Self>.self }
-        // this enables using Reactive to "mutate" base type
-        // swiftlint:disable:next unused_setter_value
-        set { }
-    }
-
-    /// Reactive extensions.
-    public var rx: Reactive<Self> {
-        get { Reactive(self) }
-        // this enables using Reactive to "mutate" base object
-        // swiftlint:disable:next unused_setter_value
-        set { }
-    }
-}
-
-import Foundation
-
-/// Extend NSObject with `rx` proxy.
-extension NSObject: ReactiveCompatible { }
diff --git a/Pods/RxSwift/RxSwift/Rx.swift b/Pods/RxSwift/RxSwift/Rx.swift
deleted file mode 100644
index bcdd27947..000000000
--- a/Pods/RxSwift/RxSwift/Rx.swift
+++ /dev/null
@@ -1,142 +0,0 @@
-//
-//  Rx.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if TRACE_RESOURCES
-    private let resourceCount = AtomicInt(0)
-
-    /// Resource utilization information
-    public struct Resources {
-        /// Counts internal Rx resource allocations (Observables, Observers, Disposables, etc.). This provides a simple way to detect leaks during development.
-        public static var total: Int32 {
-            load(resourceCount)
-        }
-
-        /// Increments `Resources.total` resource count.
-        ///
-        /// - returns: New resource count
-        public static func incrementTotal() -> Int32 {
-            increment(resourceCount)
-        }
-
-        /// Decrements `Resources.total` resource count
-        ///
-        /// - returns: New resource count
-        public static func decrementTotal() -> Int32 {
-            decrement(resourceCount)
-        }
-    }
-#endif
-
-/// Swift does not implement abstract methods. This method is used as a runtime check to ensure that methods which intended to be abstract (i.e., they should be implemented in subclasses) are not called directly on the superclass.
-func rxAbstractMethod(file: StaticString = #file, line: UInt = #line) -> Swift.Never {
-    rxFatalError("Abstract method", file: file, line: line)
-}
-
-func rxFatalError(_ lastMessage: @autoclosure () -> String, file: StaticString = #file, line: UInt = #line) -> Swift.Never  {
-    fatalError(lastMessage(), file: file, line: line)
-}
-
-func rxFatalErrorInDebug(_ lastMessage: @autoclosure () -> String, file: StaticString = #file, line: UInt = #line) {
-    #if DEBUG
-        fatalError(lastMessage(), file: file, line: line)
-    #else
-        print("\(file):\(line): \(lastMessage())")
-    #endif
-}
-
-func incrementChecked(_ i: inout Int) throws -> Int {
-    if i == Int.max {
-        throw RxError.overflow
-    }
-    defer { i += 1 }
-    return i
-}
-
-func decrementChecked(_ i: inout Int) throws -> Int {
-    if i == Int.min {
-        throw RxError.overflow
-    }
-    defer { i -= 1 }
-    return i
-}
-
-#if DEBUG
-    import Foundation
-    final class SynchronizationTracker {
-        private let lock = RecursiveLock()
-
-        public enum SynchronizationErrorMessages: String {
-            case variable = "Two different threads are trying to assign the same `Variable.value` unsynchronized.\n    This is undefined behavior because the end result (variable value) is nondeterministic and depends on the \n    operating system thread scheduler. This will cause random behavior of your program.\n"
-            case `default` = "Two different unsynchronized threads are trying to send some event simultaneously.\n    This is undefined behavior because the ordering of the effects caused by these events is nondeterministic and depends on the \n    operating system thread scheduler. This will result in a random behavior of your program.\n"
-        }
-
-        private var threads = [UnsafeMutableRawPointer: Int]()
-
-        private func synchronizationError(_ message: String) {
-            #if FATAL_SYNCHRONIZATION
-                rxFatalError(message)
-            #else
-                print(message)
-            #endif
-        }
-        
-        func register(synchronizationErrorMessage: SynchronizationErrorMessages) {
-            self.lock.lock(); defer { self.lock.unlock() }
-            let pointer = Unmanaged.passUnretained(Thread.current).toOpaque()
-            let count = (self.threads[pointer] ?? 0) + 1
-
-            if count > 1 {
-                self.synchronizationError(
-                    "⚠️ Reentrancy anomaly was detected.\n" +
-                    "  > Debugging: To debug this issue you can set a breakpoint in \(#file):\(#line) and observe the call stack.\n" +
-                    "  > Problem: This behavior is breaking the observable sequence grammar. `next (error | completed)?`\n" +
-                    "    This behavior breaks the grammar because there is overlapping between sequence events.\n" +
-                    "    Observable sequence is trying to send an event before sending of previous event has finished.\n" +
-                    "  > Interpretation: This could mean that there is some kind of unexpected cyclic dependency in your code,\n" +
-                    "    or that the system is not behaving in the expected way.\n" +
-                    "  > Remedy: If this is the expected behavior this message can be suppressed by adding `.observe(on:MainScheduler.asyncInstance)`\n" +
-                    "    or by enqueuing sequence events in some other way.\n"
-                )
-            }
-            
-            self.threads[pointer] = count
-
-            if self.threads.count > 1 {
-                self.synchronizationError(
-                    "⚠️ Synchronization anomaly was detected.\n" +
-                    "  > Debugging: To debug this issue you can set a breakpoint in \(#file):\(#line) and observe the call stack.\n" +
-                    "  > Problem: This behavior is breaking the observable sequence grammar. `next (error | completed)?`\n" +
-                    "    This behavior breaks the grammar because there is overlapping between sequence events.\n" +
-                    "    Observable sequence is trying to send an event before sending of previous event has finished.\n" +
-                    "  > Interpretation: " + synchronizationErrorMessage.rawValue +
-                    "  > Remedy: If this is the expected behavior this message can be suppressed by adding `.observe(on:MainScheduler.asyncInstance)`\n" +
-                    "    or by synchronizing sequence events in some other way.\n"
-                )
-            }
-        }
-
-        func unregister() {
-            self.lock.performLocked { 
-                let pointer = Unmanaged.passUnretained(Thread.current).toOpaque()
-                self.threads[pointer] = (self.threads[pointer] ?? 1) - 1
-                if self.threads[pointer] == 0 {
-                    self.threads[pointer] = nil
-                }
-            }
-        }
-    }
-
-#endif
-
-/// RxSwift global hooks
-public enum Hooks {
-    
-    // Should capture call stack
-    public static var recordCallStackOnError: Bool = false
-
-}
diff --git a/Pods/RxSwift/RxSwift/RxMutableBox.swift b/Pods/RxSwift/RxSwift/RxMutableBox.swift
deleted file mode 100644
index 73476c367..000000000
--- a/Pods/RxSwift/RxSwift/RxMutableBox.swift
+++ /dev/null
@@ -1,53 +0,0 @@
-//
-//  RxMutableBox.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 5/22/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-#if os(Linux)
-/// As Swift 5 was released, A patch to `Thread` for Linux
-/// changed `threadDictionary` to a `NSMutableDictionary` instead of
-/// a `Dictionary<String, Any>`: https://github.com/apple/swift-corelibs-foundation/pull/1762/files
-///
-/// This means that on Linux specifically, `RxMutableBox` must be a `NSObject`
-/// or it won't be possible to store it in `Thread.threadDictionary`.
-///
-/// For more information, read the discussion at:
-/// https://github.com/ReactiveX/RxSwift/issues/1911#issuecomment-479723298
-import Foundation
-
-/// Creates mutable reference wrapper for any type.
-final class RxMutableBox<T>: NSObject {
-    /// Wrapped value
-    var value: T
-
-    /// Creates reference wrapper for `value`.
-    ///
-    /// - parameter value: Value to wrap.
-    init (_ value: T) {
-        self.value = value
-    }
-}
-#else
-/// Creates mutable reference wrapper for any type.
-final class RxMutableBox<T>: CustomDebugStringConvertible {
-    /// Wrapped value
-    var value: T
-    
-    /// Creates reference wrapper for `value`.
-    ///
-    /// - parameter value: Value to wrap.
-    init (_ value: T) {
-        self.value = value
-    }
-}
-
-extension RxMutableBox {
-    /// - returns: Box description.
-    var debugDescription: String {
-        "MutatingBox(\(self.value))"
-    }
-}
-#endif
diff --git a/Pods/RxSwift/RxSwift/SchedulerType.swift b/Pods/RxSwift/RxSwift/SchedulerType.swift
deleted file mode 100644
index 6c8fe4a38..000000000
--- a/Pods/RxSwift/RxSwift/SchedulerType.swift
+++ /dev/null
@@ -1,71 +0,0 @@
-//
-//  SchedulerType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-import Foundation
-
-// Type that represents time interval in the context of RxSwift.
-public typealias RxTimeInterval = DispatchTimeInterval
-
-/// Type that represents absolute time in the context of RxSwift.
-public typealias RxTime = Date
-
-/// Represents an object that schedules units of work.
-public protocol SchedulerType: ImmediateSchedulerType {
-
-    /// - returns: Current time.
-    var now : RxTime {
-        get
-    }
-
-    /**
-    Schedules an action to be executed.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter dueTime: Relative time after which to execute the action.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    func scheduleRelative<StateType>(_ state: StateType, dueTime: RxTimeInterval, action: @escaping (StateType) -> Disposable) -> Disposable
- 
-    /**
-    Schedules a periodic piece of work.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter startAfter: Period after which initial work should be run.
-    - parameter period: Period for running the work periodically.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    func schedulePeriodic<StateType>(_ state: StateType, startAfter: RxTimeInterval, period: RxTimeInterval, action: @escaping (StateType) -> StateType) -> Disposable
-}
-
-extension SchedulerType {
-
-    /**
-    Periodic task will be emulated using recursive scheduling.
-
-    - parameter state: Initial state passed to the action upon the first iteration.
-    - parameter startAfter: Period after which initial work should be run.
-    - parameter period: Period for running the work periodically.
-    - returns: The disposable object used to cancel the scheduled recurring action (best effort).
-    */
-    public func schedulePeriodic<StateType>(_ state: StateType, startAfter: RxTimeInterval, period: RxTimeInterval, action: @escaping (StateType) -> StateType) -> Disposable {
-        let schedule = SchedulePeriodicRecursive(scheduler: self, startAfter: startAfter, period: period, action: action, state: state)
-            
-        return schedule.start()
-    }
-
-    func scheduleRecursive<State>(_ state: State, dueTime: RxTimeInterval, action: @escaping (State, AnyRecursiveScheduler<State>) -> Void) -> Disposable {
-        let scheduler = AnyRecursiveScheduler(scheduler: self, action: action)
-         
-        scheduler.schedule(state, dueTime: dueTime)
-            
-        return Disposables.create(with: scheduler.dispose)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/ConcurrentDispatchQueueScheduler.swift b/Pods/RxSwift/RxSwift/Schedulers/ConcurrentDispatchQueueScheduler.swift
deleted file mode 100644
index 02c47c917..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/ConcurrentDispatchQueueScheduler.swift
+++ /dev/null
@@ -1,82 +0,0 @@
-//
-//  ConcurrentDispatchQueueScheduler.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 7/5/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-import Foundation
-
-/// Abstracts the work that needs to be performed on a specific `dispatch_queue_t`. You can also pass a serial dispatch queue, it shouldn't cause any problems.
-///
-/// This scheduler is suitable when some work needs to be performed in background.
-public class ConcurrentDispatchQueueScheduler: SchedulerType {
-    public typealias TimeInterval = Foundation.TimeInterval
-    public typealias Time = Date
-    
-    public var now : Date {
-        Date()
-    }
-
-    let configuration: DispatchQueueConfiguration
-    
-    /// Constructs new `ConcurrentDispatchQueueScheduler` that wraps `queue`.
-    ///
-    /// - parameter queue: Target dispatch queue.
-    /// - parameter leeway: The amount of time, in nanoseconds, that the system will defer the timer.
-    public init(queue: DispatchQueue, leeway: DispatchTimeInterval = DispatchTimeInterval.nanoseconds(0)) {
-        self.configuration = DispatchQueueConfiguration(queue: queue, leeway: leeway)
-    }
-    
-    /// Convenience init for scheduler that wraps one of the global concurrent dispatch queues.
-    ///
-    /// - parameter qos: Target global dispatch queue, by quality of service class.
-    /// - parameter leeway: The amount of time, in nanoseconds, that the system will defer the timer.
-    public convenience init(qos: DispatchQoS, leeway: DispatchTimeInterval = DispatchTimeInterval.nanoseconds(0)) {
-        self.init(queue: DispatchQueue(
-            label: "rxswift.queue.\(qos)",
-            qos: qos,
-            attributes: [DispatchQueue.Attributes.concurrent],
-            target: nil),
-            leeway: leeway
-        )
-    }
-
-    /**
-    Schedules an action to be executed immediately.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public final func schedule<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable {
-        self.configuration.schedule(state, action: action)
-    }
-    
-    /**
-    Schedules an action to be executed.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter dueTime: Relative time after which to execute the action.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public final func scheduleRelative<StateType>(_ state: StateType, dueTime: RxTimeInterval, action: @escaping (StateType) -> Disposable) -> Disposable {
-        self.configuration.scheduleRelative(state, dueTime: dueTime, action: action)
-    }
-    
-    /**
-    Schedules a periodic piece of work.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter startAfter: Period after which initial work should be run.
-    - parameter period: Period for running the work periodically.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public func schedulePeriodic<StateType>(_ state: StateType, startAfter: RxTimeInterval, period: RxTimeInterval, action: @escaping (StateType) -> StateType) -> Disposable {
-        self.configuration.schedulePeriodic(state, startAfter: startAfter, period: period, action: action)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/ConcurrentMainScheduler.swift b/Pods/RxSwift/RxSwift/Schedulers/ConcurrentMainScheduler.swift
deleted file mode 100644
index c438d7d4d..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/ConcurrentMainScheduler.swift
+++ /dev/null
@@ -1,87 +0,0 @@
-//
-//  ConcurrentMainScheduler.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 10/17/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-import Foundation
-
-/**
-Abstracts work that needs to be performed on `MainThread`. In case `schedule` methods are called from main thread, it will perform action immediately without scheduling.
-
-This scheduler is optimized for `subscribeOn` operator. If you want to observe observable sequence elements on main thread using `observeOn` operator,
-`MainScheduler` is more suitable for that purpose.
-*/
-public final class ConcurrentMainScheduler : SchedulerType {
-    public typealias TimeInterval = Foundation.TimeInterval
-    public typealias Time = Date
-
-    private let mainScheduler: MainScheduler
-    private let mainQueue: DispatchQueue
-
-    /// - returns: Current time.
-    public var now: Date {
-        self.mainScheduler.now as Date
-    }
-
-    private init(mainScheduler: MainScheduler) {
-        self.mainQueue = DispatchQueue.main
-        self.mainScheduler = mainScheduler
-    }
-
-    /// Singleton instance of `ConcurrentMainScheduler`
-    public static let instance = ConcurrentMainScheduler(mainScheduler: MainScheduler.instance)
-
-    /**
-    Schedules an action to be executed immediately.
-
-    - parameter state: State passed to the action to be executed.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public func schedule<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable {
-        if DispatchQueue.isMain {
-            return action(state)
-        }
-
-        let cancel = SingleAssignmentDisposable()
-
-        self.mainQueue.async {
-            if cancel.isDisposed {
-                return
-            }
-
-            cancel.setDisposable(action(state))
-        }
-
-        return cancel
-    }
-
-    /**
-    Schedules an action to be executed.
-
-    - parameter state: State passed to the action to be executed.
-    - parameter dueTime: Relative time after which to execute the action.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public final func scheduleRelative<StateType>(_ state: StateType, dueTime: RxTimeInterval, action: @escaping (StateType) -> Disposable) -> Disposable {
-        self.mainScheduler.scheduleRelative(state, dueTime: dueTime, action: action)
-    }
-
-    /**
-    Schedules a periodic piece of work.
-
-    - parameter state: State passed to the action to be executed.
-    - parameter startAfter: Period after which initial work should be run.
-    - parameter period: Period for running the work periodically.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public func schedulePeriodic<StateType>(_ state: StateType, startAfter: RxTimeInterval, period: RxTimeInterval, action: @escaping (StateType) -> StateType) -> Disposable {
-        self.mainScheduler.schedulePeriodic(state, startAfter: startAfter, period: period, action: action)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/CurrentThreadScheduler.swift b/Pods/RxSwift/RxSwift/Schedulers/CurrentThreadScheduler.swift
deleted file mode 100644
index 16a7dd328..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/CurrentThreadScheduler.swift
+++ /dev/null
@@ -1,131 +0,0 @@
-//
-//  CurrentThreadScheduler.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 8/30/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-import Foundation
-
-#if os(Linux)
-    fileprivate enum CurrentThreadSchedulerQueueKey {
-        fileprivate static let instance = "RxSwift.CurrentThreadScheduler.Queue"
-    }
-#else
-    private class CurrentThreadSchedulerQueueKey: NSObject, NSCopying {
-        static let instance = CurrentThreadSchedulerQueueKey()
-        private override init() {
-            super.init()
-        }
-
-        override var hash: Int {
-            return 0
-        }
-
-        public func copy(with zone: NSZone? = nil) -> Any {
-            return self
-        }
-    }
-#endif
-
-/// Represents an object that schedules units of work on the current thread.
-///
-/// This is the default scheduler for operators that generate elements.
-///
-/// This scheduler is also sometimes called `trampoline scheduler`.
-public class CurrentThreadScheduler : ImmediateSchedulerType {
-    typealias ScheduleQueue = RxMutableBox<Queue<ScheduledItemType>>
-
-    /// The singleton instance of the current thread scheduler.
-    public static let instance = CurrentThreadScheduler()
-
-    private static var isScheduleRequiredKey: pthread_key_t = { () -> pthread_key_t in
-        let key = UnsafeMutablePointer<pthread_key_t>.allocate(capacity: 1)
-        defer { key.deallocate() }
-                                                               
-        guard pthread_key_create(key, nil) == 0 else {
-            rxFatalError("isScheduleRequired key creation failed")
-        }
-
-        return key.pointee
-    }()
-
-    private static var scheduleInProgressSentinel: UnsafeRawPointer = { () -> UnsafeRawPointer in
-        return UnsafeRawPointer(UnsafeMutablePointer<Int>.allocate(capacity: 1))
-    }()
-
-    static var queue : ScheduleQueue? {
-        get {
-            return Thread.getThreadLocalStorageValueForKey(CurrentThreadSchedulerQueueKey.instance)
-        }
-        set {
-            Thread.setThreadLocalStorageValue(newValue, forKey: CurrentThreadSchedulerQueueKey.instance)
-        }
-    }
-
-    /// Gets a value that indicates whether the caller must call a `schedule` method.
-    public static private(set) var isScheduleRequired: Bool {
-        get {
-            return pthread_getspecific(CurrentThreadScheduler.isScheduleRequiredKey) == nil
-        }
-        set(isScheduleRequired) {
-            if pthread_setspecific(CurrentThreadScheduler.isScheduleRequiredKey, isScheduleRequired ? nil : scheduleInProgressSentinel) != 0 {
-                rxFatalError("pthread_setspecific failed")
-            }
-        }
-    }
-
-    /**
-    Schedules an action to be executed as soon as possible on current thread.
-
-    If this method is called on some thread that doesn't have `CurrentThreadScheduler` installed, scheduler will be
-    automatically installed and uninstalled after all work is performed.
-
-    - parameter state: State passed to the action to be executed.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public func schedule<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable {
-        if CurrentThreadScheduler.isScheduleRequired {
-            CurrentThreadScheduler.isScheduleRequired = false
-
-            let disposable = action(state)
-
-            defer {
-                CurrentThreadScheduler.isScheduleRequired = true
-                CurrentThreadScheduler.queue = nil
-            }
-
-            guard let queue = CurrentThreadScheduler.queue else {
-                return disposable
-            }
-
-            while let latest = queue.value.dequeue() {
-                if latest.isDisposed {
-                    continue
-                }
-                latest.invoke()
-            }
-
-            return disposable
-        }
-
-        let existingQueue = CurrentThreadScheduler.queue
-
-        let queue: RxMutableBox<Queue<ScheduledItemType>>
-        if let existingQueue = existingQueue {
-            queue = existingQueue
-        }
-        else {
-            queue = RxMutableBox(Queue<ScheduledItemType>(capacity: 1))
-            CurrentThreadScheduler.queue = queue
-        }
-
-        let scheduledItem = ScheduledItem(action: action, state: state)
-        queue.value.enqueue(scheduledItem)
-
-        return scheduledItem
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/HistoricalScheduler.swift b/Pods/RxSwift/RxSwift/Schedulers/HistoricalScheduler.swift
deleted file mode 100644
index fede60e66..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/HistoricalScheduler.swift
+++ /dev/null
@@ -1,22 +0,0 @@
-//
-//  HistoricalScheduler.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 12/27/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-/// Provides a virtual time scheduler that uses `Date` for absolute time and `NSTimeInterval` for relative time.
-public class HistoricalScheduler : VirtualTimeScheduler<HistoricalSchedulerTimeConverter> {
-
-    /**
-      Creates a new historical scheduler with initial clock value.
-     
-     - parameter initialClock: Initial value for virtual clock.
-    */
-    public init(initialClock: RxTime = Date(timeIntervalSince1970: 0)) {
-        super.init(initialClock: initialClock, converter: HistoricalSchedulerTimeConverter())
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/HistoricalSchedulerTimeConverter.swift b/Pods/RxSwift/RxSwift/Schedulers/HistoricalSchedulerTimeConverter.swift
deleted file mode 100644
index a8fae8a40..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/HistoricalSchedulerTimeConverter.swift
+++ /dev/null
@@ -1,67 +0,0 @@
-//
-//  HistoricalSchedulerTimeConverter.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 12/27/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-/// Converts historical virtual time into real time.
-///
-/// Since historical virtual time is also measured in `Date`, this converter is identity function.
-public struct HistoricalSchedulerTimeConverter : VirtualTimeConverterType {
-    /// Virtual time unit used that represents ticks of virtual clock.
-    public typealias VirtualTimeUnit = RxTime
-
-    /// Virtual time unit used to represent differences of virtual times.
-    public typealias VirtualTimeIntervalUnit = TimeInterval
-
-    /// Returns identical value of argument passed because historical virtual time is equal to real time, just
-    /// decoupled from local machine clock.
-    public func convertFromVirtualTime(_ virtualTime: VirtualTimeUnit) -> RxTime {
-        virtualTime
-    }
-
-    /// Returns identical value of argument passed because historical virtual time is equal to real time, just
-    /// decoupled from local machine clock.
-    public func convertToVirtualTime(_ time: RxTime) -> VirtualTimeUnit {
-        time
-    }
-
-    /// Returns identical value of argument passed because historical virtual time is equal to real time, just
-    /// decoupled from local machine clock.
-    public func convertFromVirtualTimeInterval(_ virtualTimeInterval: VirtualTimeIntervalUnit) -> TimeInterval {
-        virtualTimeInterval
-    }
-
-    /// Returns identical value of argument passed because historical virtual time is equal to real time, just
-    /// decoupled from local machine clock.
-    public func convertToVirtualTimeInterval(_ timeInterval: TimeInterval) -> VirtualTimeIntervalUnit {
-        timeInterval
-    }
-
-    /**
-     Offsets `Date` by time interval.
-     
-     - parameter time: Time.
-     - parameter timeInterval: Time interval offset.
-     - returns: Time offsetted by time interval.
-    */
-    public func offsetVirtualTime(_ time: VirtualTimeUnit, offset: VirtualTimeIntervalUnit) -> VirtualTimeUnit {
-        time.addingTimeInterval(offset)
-    }
-
-    /// Compares two `Date`s.
-    public func compareVirtualTime(_ lhs: VirtualTimeUnit, _ rhs: VirtualTimeUnit) -> VirtualTimeComparison {
-        switch lhs.compare(rhs as Date) {
-        case .orderedAscending:
-            return .lessThan
-        case .orderedSame:
-            return .equal
-        case .orderedDescending:
-            return .greaterThan
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/Internal/DispatchQueueConfiguration.swift b/Pods/RxSwift/RxSwift/Schedulers/Internal/DispatchQueueConfiguration.swift
deleted file mode 100644
index f313c0b34..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/Internal/DispatchQueueConfiguration.swift
+++ /dev/null
@@ -1,97 +0,0 @@
-//
-//  DispatchQueueConfiguration.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 7/23/16.
-//  Copyright © 2016 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-import Foundation
-
-struct DispatchQueueConfiguration {
-    let queue: DispatchQueue
-    let leeway: DispatchTimeInterval
-}
-
-extension DispatchQueueConfiguration {
-    func schedule<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable {
-        let cancel = SingleAssignmentDisposable()
-
-        self.queue.async {
-            if cancel.isDisposed {
-                return
-            }
-
-
-            cancel.setDisposable(action(state))
-        }
-
-        return cancel
-    }
-
-    func scheduleRelative<StateType>(_ state: StateType, dueTime: RxTimeInterval, action: @escaping (StateType) -> Disposable) -> Disposable {
-        let deadline = DispatchTime.now() + dueTime
-
-        let compositeDisposable = CompositeDisposable()
-
-        let timer = DispatchSource.makeTimerSource(queue: self.queue)
-        timer.schedule(deadline: deadline, leeway: self.leeway)
-
-        // TODO:
-        // This looks horrible, and yes, it is.
-        // It looks like Apple has made a conceputal change here, and I'm unsure why.
-        // Need more info on this.
-        // It looks like just setting timer to fire and not holding a reference to it
-        // until deadline causes timer cancellation.
-        var timerReference: DispatchSourceTimer? = timer
-        let cancelTimer = Disposables.create {
-            timerReference?.cancel()
-            timerReference = nil
-        }
-
-        timer.setEventHandler(handler: {
-            if compositeDisposable.isDisposed {
-                return
-            }
-            _ = compositeDisposable.insert(action(state))
-            cancelTimer.dispose()
-        })
-        timer.resume()
-
-        _ = compositeDisposable.insert(cancelTimer)
-
-        return compositeDisposable
-    }
-
-    func schedulePeriodic<StateType>(_ state: StateType, startAfter: RxTimeInterval, period: RxTimeInterval, action: @escaping (StateType) -> StateType) -> Disposable {
-        let initial = DispatchTime.now() + startAfter
-
-        var timerState = state
-
-        let timer = DispatchSource.makeTimerSource(queue: self.queue)
-        timer.schedule(deadline: initial, repeating: period, leeway: self.leeway)
-        
-        // TODO:
-        // This looks horrible, and yes, it is.
-        // It looks like Apple has made a conceputal change here, and I'm unsure why.
-        // Need more info on this.
-        // It looks like just setting timer to fire and not holding a reference to it
-        // until deadline causes timer cancellation.
-        var timerReference: DispatchSourceTimer? = timer
-        let cancelTimer = Disposables.create {
-            timerReference?.cancel()
-            timerReference = nil
-        }
-
-        timer.setEventHandler(handler: {
-            if cancelTimer.isDisposed {
-                return
-            }
-            timerState = action(timerState)
-        })
-        timer.resume()
-        
-        return cancelTimer
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/Internal/InvocableScheduledItem.swift b/Pods/RxSwift/RxSwift/Schedulers/Internal/InvocableScheduledItem.swift
deleted file mode 100644
index 0e1505610..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/Internal/InvocableScheduledItem.swift
+++ /dev/null
@@ -1,22 +0,0 @@
-//
-//  InvocableScheduledItem.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 11/7/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-struct InvocableScheduledItem<I: InvocableWithValueType> : InvocableType {
-
-    let invocable: I
-    let state: I.Value
-
-    init(invocable: I, state: I.Value) {
-        self.invocable = invocable
-        self.state = state
-    }
-
-    func invoke() {
-        self.invocable.invoke(self.state)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/Internal/InvocableType.swift b/Pods/RxSwift/RxSwift/Schedulers/Internal/InvocableType.swift
deleted file mode 100644
index 0dba4336a..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/Internal/InvocableType.swift
+++ /dev/null
@@ -1,17 +0,0 @@
-//
-//  InvocableType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 11/7/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-protocol InvocableType {
-    func invoke()
-}
-
-protocol InvocableWithValueType {
-    associatedtype Value
-
-    func invoke(_ value: Value)
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/Internal/ScheduledItem.swift b/Pods/RxSwift/RxSwift/Schedulers/Internal/ScheduledItem.swift
deleted file mode 100644
index 3d790d7af..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/Internal/ScheduledItem.swift
+++ /dev/null
@@ -1,35 +0,0 @@
-//
-//  ScheduledItem.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 9/2/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-struct ScheduledItem<T>
-    : ScheduledItemType
-    , InvocableType {
-    typealias Action = (T) -> Disposable
-    
-    private let action: Action
-    private let state: T
-
-    private let disposable = SingleAssignmentDisposable()
-
-    var isDisposed: Bool {
-        self.disposable.isDisposed
-    }
-    
-    init(action: @escaping Action, state: T) {
-        self.action = action
-        self.state = state
-    }
-    
-    func invoke() {
-         self.disposable.setDisposable(self.action(self.state))
-    }
-    
-    func dispose() {
-        self.disposable.dispose()
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/Internal/ScheduledItemType.swift b/Pods/RxSwift/RxSwift/Schedulers/Internal/ScheduledItemType.swift
deleted file mode 100644
index d2b16cab7..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/Internal/ScheduledItemType.swift
+++ /dev/null
@@ -1,13 +0,0 @@
-//
-//  ScheduledItemType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 11/7/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-protocol ScheduledItemType
-    : Cancelable
-    , InvocableType {
-    func invoke()
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/MainScheduler.swift b/Pods/RxSwift/RxSwift/Schedulers/MainScheduler.swift
deleted file mode 100644
index 703ab440a..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/MainScheduler.swift
+++ /dev/null
@@ -1,80 +0,0 @@
-//
-//  MainScheduler.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-#if !os(Linux)
-    import Foundation
-#endif
-
-/**
-Abstracts work that needs to be performed on `DispatchQueue.main`. In case `schedule` methods are called from `DispatchQueue.main`, it will perform action immediately without scheduling.
-
-This scheduler is usually used to perform UI work.
-
-Main scheduler is a specialization of `SerialDispatchQueueScheduler`.
-
-This scheduler is optimized for `observeOn` operator. To ensure observable sequence is subscribed on main thread using `subscribeOn`
-operator please use `ConcurrentMainScheduler` because it is more optimized for that purpose.
-*/
-public final class MainScheduler : SerialDispatchQueueScheduler {
-
-    private let mainQueue: DispatchQueue
-
-    let numberEnqueued = AtomicInt(0)
-
-    /// Initializes new instance of `MainScheduler`.
-    public init() {
-        self.mainQueue = DispatchQueue.main
-        super.init(serialQueue: self.mainQueue)
-    }
-
-    /// Singleton instance of `MainScheduler`
-    public static let instance = MainScheduler()
-
-    /// Singleton instance of `MainScheduler` that always schedules work asynchronously
-    /// and doesn't perform optimizations for calls scheduled from main queue.
-    public static let asyncInstance = SerialDispatchQueueScheduler(serialQueue: DispatchQueue.main)
-
-    /// In case this method is called on a background thread it will throw an exception.
-    public class func ensureExecutingOnScheduler(errorMessage: String? = nil) {
-        if !DispatchQueue.isMain {
-            rxFatalError(errorMessage ?? "Executing on background thread. Please use `MainScheduler.instance.schedule` to schedule work on main thread.")
-        }
-    }
-
-    /// In case this method is running on a background thread it will throw an exception.
-    public class func ensureRunningOnMainThread(errorMessage: String? = nil) {
-        #if !os(Linux) // isMainThread is not implemented in Linux Foundation
-            guard Thread.isMainThread else {
-                rxFatalError(errorMessage ?? "Running on background thread.")
-            }
-        #endif
-    }
-
-    override func scheduleInternal<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable {
-        let previousNumberEnqueued = increment(self.numberEnqueued)
-
-        if DispatchQueue.isMain && previousNumberEnqueued == 0 {
-            let disposable = action(state)
-            decrement(self.numberEnqueued)
-            return disposable
-        }
-
-        let cancel = SingleAssignmentDisposable()
-
-        self.mainQueue.async {
-            if !cancel.isDisposed {
-                cancel.setDisposable(action(state))
-            }
-
-            decrement(self.numberEnqueued)
-        }
-
-        return cancel
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/OperationQueueScheduler.swift b/Pods/RxSwift/RxSwift/Schedulers/OperationQueueScheduler.swift
deleted file mode 100644
index f0ad3d3ce..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/OperationQueueScheduler.swift
+++ /dev/null
@@ -1,54 +0,0 @@
-//
-//  OperationQueueScheduler.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 4/4/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-import Foundation
-
-/// Abstracts the work that needs to be performed on a specific `NSOperationQueue`.
-///
-/// This scheduler is suitable for cases when there is some bigger chunk of work that needs to be performed in background and you want to fine tune concurrent processing using `maxConcurrentOperationCount`.
-public class OperationQueueScheduler: ImmediateSchedulerType {
-    public let operationQueue: OperationQueue
-    public let queuePriority: Operation.QueuePriority
-    
-    /// Constructs new instance of `OperationQueueScheduler` that performs work on `operationQueue`.
-    ///
-    /// - parameter operationQueue: Operation queue targeted to perform work on.
-    /// - parameter queuePriority: Queue priority which will be assigned to new operations.
-    public init(operationQueue: OperationQueue, queuePriority: Operation.QueuePriority = .normal) {
-        self.operationQueue = operationQueue
-        self.queuePriority = queuePriority
-    }
-    
-    /**
-    Schedules an action to be executed recursively.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter action: Action to execute recursively. The last parameter passed to the action is used to trigger recursive scheduling of the action, passing in recursive invocation state.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public func schedule<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable {
-        let cancel = SingleAssignmentDisposable()
-
-        let operation = BlockOperation {
-            if cancel.isDisposed {
-                return
-            }
-
-
-            cancel.setDisposable(action(state))
-        }
-
-        operation.queuePriority = self.queuePriority
-
-        self.operationQueue.addOperation(operation)
-        
-        return cancel
-    }
-
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/RecursiveScheduler.swift b/Pods/RxSwift/RxSwift/Schedulers/RecursiveScheduler.swift
deleted file mode 100644
index 0ee78cd18..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/RecursiveScheduler.swift
+++ /dev/null
@@ -1,220 +0,0 @@
-//
-//  RecursiveScheduler.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/7/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-private enum ScheduleState {
-    case initial
-    case added(CompositeDisposable.DisposeKey)
-    case done
-}
-
-/// Type erased recursive scheduler.
-final class AnyRecursiveScheduler<State> {
-    
-    typealias Action =  (State, AnyRecursiveScheduler<State>) -> Void
-
-    private let lock = RecursiveLock()
-    
-    // state
-    private let group = CompositeDisposable()
-
-    private var scheduler: SchedulerType
-    private var action: Action?
-    
-    init(scheduler: SchedulerType, action: @escaping Action) {
-        self.action = action
-        self.scheduler = scheduler
-    }
-
-    /**
-    Schedules an action to be executed recursively.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter dueTime: Relative time after which to execute the recursive action.
-    */
-    func schedule(_ state: State, dueTime: RxTimeInterval) {
-        var scheduleState: ScheduleState = .initial
-
-        let d = self.scheduler.scheduleRelative(state, dueTime: dueTime) { state -> Disposable in
-            // best effort
-            if self.group.isDisposed {
-                return Disposables.create()
-            }
-            
-            let action = self.lock.performLocked { () -> Action? in
-                switch scheduleState {
-                case let .added(removeKey):
-                    self.group.remove(for: removeKey)
-                case .initial:
-                    break
-                case .done:
-                    break
-                }
-
-                scheduleState = .done
-
-                return self.action
-            }
-            
-            if let action = action {
-                action(state, self)
-            }
-            
-            return Disposables.create()
-        }
-            
-        self.lock.performLocked {
-            switch scheduleState {
-            case .added:
-                rxFatalError("Invalid state")
-            case .initial:
-                if let removeKey = self.group.insert(d) {
-                    scheduleState = .added(removeKey)
-                }
-                else {
-                    scheduleState = .done
-                }
-            case .done:
-                break
-            }
-        }
-    }
-
-    /// Schedules an action to be executed recursively.
-    ///
-    /// - parameter state: State passed to the action to be executed.
-    func schedule(_ state: State) {
-        var scheduleState: ScheduleState = .initial
-
-        let d = self.scheduler.schedule(state) { state -> Disposable in
-            // best effort
-            if self.group.isDisposed {
-                return Disposables.create()
-            }
-            
-            let action = self.lock.performLocked { () -> Action? in
-                switch scheduleState {
-                case let .added(removeKey):
-                    self.group.remove(for: removeKey)
-                case .initial:
-                    break
-                case .done:
-                    break
-                }
-
-                scheduleState = .done
-                
-                return self.action
-            }
-           
-            if let action = action {
-                action(state, self)
-            }
-            
-            return Disposables.create()
-        }
-        
-        self.lock.performLocked {
-            switch scheduleState {
-            case .added:
-                rxFatalError("Invalid state")
-            case .initial:
-                if let removeKey = self.group.insert(d) {
-                    scheduleState = .added(removeKey)
-                }
-                else {
-                    scheduleState = .done
-                }
-            case .done:
-                break
-            }
-        }
-    }
-    
-    func dispose() {
-        self.lock.performLocked {
-            self.action = nil
-        }
-        self.group.dispose()
-    }
-}
-
-/// Type erased recursive scheduler.
-final class RecursiveImmediateScheduler<State> {
-    typealias Action =  (_ state: State, _ recurse: (State) -> Void) -> Void
-    
-    private var lock = SpinLock()
-    private let group = CompositeDisposable()
-    
-    private var action: Action?
-    private let scheduler: ImmediateSchedulerType
-    
-    init(action: @escaping Action, scheduler: ImmediateSchedulerType) {
-        self.action = action
-        self.scheduler = scheduler
-    }
-    
-    // immediate scheduling
-    
-    /// Schedules an action to be executed recursively.
-    ///
-    /// - parameter state: State passed to the action to be executed.
-    func schedule(_ state: State) {
-        var scheduleState: ScheduleState = .initial
-
-        let d = self.scheduler.schedule(state) { state -> Disposable in
-            // best effort
-            if self.group.isDisposed {
-                return Disposables.create()
-            }
-            
-            let action = self.lock.performLocked { () -> Action? in
-                switch scheduleState {
-                case let .added(removeKey):
-                    self.group.remove(for: removeKey)
-                case .initial:
-                    break
-                case .done:
-                    break
-                }
-
-                scheduleState = .done
-
-                return self.action
-            }
-            
-            if let action = action {
-                action(state, self.schedule)
-            }
-            
-            return Disposables.create()
-        }
-        
-        self.lock.performLocked {
-            switch scheduleState {
-            case .added:
-                rxFatalError("Invalid state")
-            case .initial:
-                if let removeKey = self.group.insert(d) {
-                    scheduleState = .added(removeKey)
-                }
-                else {
-                    scheduleState = .done
-                }
-            case .done:
-                break
-            }
-        }
-    }
-    
-    func dispose() {
-        self.lock.performLocked {
-            self.action = nil
-        }
-        self.group.dispose()
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/SchedulerServices+Emulation.swift b/Pods/RxSwift/RxSwift/Schedulers/SchedulerServices+Emulation.swift
deleted file mode 100644
index cab2bc8b3..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/SchedulerServices+Emulation.swift
+++ /dev/null
@@ -1,61 +0,0 @@
-//
-//  SchedulerServices+Emulation.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 6/6/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-enum SchedulePeriodicRecursiveCommand {
-    case tick
-    case dispatchStart
-}
-
-final class SchedulePeriodicRecursive<State> {
-    typealias RecursiveAction = (State) -> State
-    typealias RecursiveScheduler = AnyRecursiveScheduler<SchedulePeriodicRecursiveCommand>
-
-    private let scheduler: SchedulerType
-    private let startAfter: RxTimeInterval
-    private let period: RxTimeInterval
-    private let action: RecursiveAction
-
-    private var state: State
-    private let pendingTickCount = AtomicInt(0)
-
-    init(scheduler: SchedulerType, startAfter: RxTimeInterval, period: RxTimeInterval, action: @escaping RecursiveAction, state: State) {
-        self.scheduler = scheduler
-        self.startAfter = startAfter
-        self.period = period
-        self.action = action
-        self.state = state
-    }
-
-    func start() -> Disposable {
-        self.scheduler.scheduleRecursive(SchedulePeriodicRecursiveCommand.tick, dueTime: self.startAfter, action: self.tick)
-    }
-
-    func tick(_ command: SchedulePeriodicRecursiveCommand, scheduler: RecursiveScheduler) {
-        // Tries to emulate periodic scheduling as best as possible.
-        // The problem that could arise is if handling periodic ticks take too long, or
-        // tick interval is short.
-        switch command {
-        case .tick:
-            scheduler.schedule(.tick, dueTime: self.period)
-
-            // The idea is that if on tick there wasn't any item enqueued, schedule to perform work immediately.
-            // Else work will be scheduled after previous enqueued work completes.
-            if increment(self.pendingTickCount) == 0 {
-                self.tick(.dispatchStart, scheduler: scheduler)
-            }
-
-        case .dispatchStart:
-            self.state = self.action(self.state)
-            // Start work and schedule check is this last batch of work
-            if decrement(self.pendingTickCount) > 1 {
-                // This gives priority to scheduler emulation, it's not perfect, but helps
-                scheduler.schedule(SchedulePeriodicRecursiveCommand.dispatchStart)
-            }
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/SerialDispatchQueueScheduler.swift b/Pods/RxSwift/RxSwift/Schedulers/SerialDispatchQueueScheduler.swift
deleted file mode 100644
index bb0013c8f..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/SerialDispatchQueueScheduler.swift
+++ /dev/null
@@ -1,131 +0,0 @@
-//
-//  SerialDispatchQueueScheduler.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/8/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Dispatch
-import Foundation
-
-/**
-Abstracts the work that needs to be performed on a specific `dispatch_queue_t`. It will make sure 
-that even if concurrent dispatch queue is passed, it's transformed into a serial one.
-
-It is extremely important that this scheduler is serial, because
-certain operator perform optimizations that rely on that property.
-
-Because there is no way of detecting is passed dispatch queue serial or
-concurrent, for every queue that is being passed, worst case (concurrent)
-will be assumed, and internal serial proxy dispatch queue will be created.
-
-This scheduler can also be used with internal serial queue alone.
-
-In case some customization need to be made on it before usage,
-internal serial queue can be customized using `serialQueueConfiguration`
-callback.
-*/
-public class SerialDispatchQueueScheduler : SchedulerType {
-    public typealias TimeInterval = Foundation.TimeInterval
-    public typealias Time = Date
-    
-    /// - returns: Current time.
-    public var now : Date {
-        Date()
-    }
-
-    let configuration: DispatchQueueConfiguration
-    
-    /**
-    Constructs new `SerialDispatchQueueScheduler` that wraps `serialQueue`.
-
-    - parameter serialQueue: Target dispatch queue.
-    - parameter leeway: The amount of time, in nanoseconds, that the system will defer the timer.
-    */
-    init(serialQueue: DispatchQueue, leeway: DispatchTimeInterval = DispatchTimeInterval.nanoseconds(0)) {
-        self.configuration = DispatchQueueConfiguration(queue: serialQueue, leeway: leeway)
-    }
-
-    /**
-    Constructs new `SerialDispatchQueueScheduler` with internal serial queue named `internalSerialQueueName`.
-    
-    Additional dispatch queue properties can be set after dispatch queue is created using `serialQueueConfiguration`.
-    
-    - parameter internalSerialQueueName: Name of internal serial dispatch queue.
-    - parameter serialQueueConfiguration: Additional configuration of internal serial dispatch queue.
-    - parameter leeway: The amount of time, in nanoseconds, that the system will defer the timer.
-    */
-    public convenience init(internalSerialQueueName: String, serialQueueConfiguration: ((DispatchQueue) -> Void)? = nil, leeway: DispatchTimeInterval = DispatchTimeInterval.nanoseconds(0)) {
-        let queue = DispatchQueue(label: internalSerialQueueName, attributes: [])
-        serialQueueConfiguration?(queue)
-        self.init(serialQueue: queue, leeway: leeway)
-    }
-    
-    /**
-    Constructs new `SerialDispatchQueueScheduler` named `internalSerialQueueName` that wraps `queue`.
-    
-    - parameter queue: Possibly concurrent dispatch queue used to perform work.
-    - parameter internalSerialQueueName: Name of internal serial dispatch queue proxy.
-    - parameter leeway: The amount of time, in nanoseconds, that the system will defer the timer.
-    */
-    public convenience init(queue: DispatchQueue, internalSerialQueueName: String, leeway: DispatchTimeInterval = DispatchTimeInterval.nanoseconds(0)) {
-        // Swift 3.0 IUO
-        let serialQueue = DispatchQueue(label: internalSerialQueueName,
-                                        attributes: [],
-                                        target: queue)
-        self.init(serialQueue: serialQueue, leeway: leeway)
-    }
-
-    /**
-     Constructs new `SerialDispatchQueueScheduler` that wraps one of the global concurrent dispatch queues.
-     
-     - parameter qos: Identifier for global dispatch queue with specified quality of service class.
-     - parameter internalSerialQueueName: Custom name for internal serial dispatch queue proxy.
-     - parameter leeway: The amount of time, in nanoseconds, that the system will defer the timer.
-     */
-    @available(macOS 10.10, *)
-    public convenience init(qos: DispatchQoS, internalSerialQueueName: String = "rx.global_dispatch_queue.serial", leeway: DispatchTimeInterval = DispatchTimeInterval.nanoseconds(0)) {
-        self.init(queue: DispatchQueue.global(qos: qos.qosClass), internalSerialQueueName: internalSerialQueueName, leeway: leeway)
-    }
-    
-    /**
-    Schedules an action to be executed immediately.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public final func schedule<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable {
-        self.scheduleInternal(state, action: action)
-    }
-
-    func scheduleInternal<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable {
-        self.configuration.schedule(state, action: action)
-    }
-
-    /**
-    Schedules an action to be executed.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter dueTime: Relative time after which to execute the action.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public final func scheduleRelative<StateType>(_ state: StateType, dueTime: RxTimeInterval, action: @escaping (StateType) -> Disposable) -> Disposable {
-        self.configuration.scheduleRelative(state, dueTime: dueTime, action: action)
-    }
-    
-    /**
-    Schedules a periodic piece of work.
-    
-    - parameter state: State passed to the action to be executed.
-    - parameter startAfter: Period after which initial work should be run.
-    - parameter period: Period for running the work periodically.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public func schedulePeriodic<StateType>(_ state: StateType, startAfter: RxTimeInterval, period: RxTimeInterval, action: @escaping (StateType) -> StateType) -> Disposable {
-        self.configuration.schedulePeriodic(state, startAfter: startAfter, period: period, action: action)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/VirtualTimeConverterType.swift b/Pods/RxSwift/RxSwift/Schedulers/VirtualTimeConverterType.swift
deleted file mode 100644
index 34151f700..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/VirtualTimeConverterType.swift
+++ /dev/null
@@ -1,97 +0,0 @@
-//
-//  VirtualTimeConverterType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 12/23/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-/// Parametrization for virtual time used by `VirtualTimeScheduler`s.
-public protocol VirtualTimeConverterType {
-    /// Virtual time unit used that represents ticks of virtual clock.
-    associatedtype VirtualTimeUnit
-
-    /// Virtual time unit used to represent differences of virtual times.
-    associatedtype VirtualTimeIntervalUnit
-
-    /**
-     Converts virtual time to real time.
-     
-     - parameter virtualTime: Virtual time to convert to `Date`.
-     - returns: `Date` corresponding to virtual time.
-    */
-    func convertFromVirtualTime(_ virtualTime: VirtualTimeUnit) -> RxTime
-
-    /**
-     Converts real time to virtual time.
-     
-     - parameter time: `Date` to convert to virtual time.
-     - returns: Virtual time corresponding to `Date`.
-    */
-    func convertToVirtualTime(_ time: RxTime) -> VirtualTimeUnit
-
-    /**
-     Converts from virtual time interval to `NSTimeInterval`.
-     
-     - parameter virtualTimeInterval: Virtual time interval to convert to `NSTimeInterval`.
-     - returns: `NSTimeInterval` corresponding to virtual time interval.
-    */
-    func convertFromVirtualTimeInterval(_ virtualTimeInterval: VirtualTimeIntervalUnit) -> TimeInterval
-
-    /**
-     Converts from `NSTimeInterval` to virtual time interval.
-     
-     - parameter timeInterval: `NSTimeInterval` to convert to virtual time interval.
-     - returns: Virtual time interval corresponding to time interval.
-    */
-    func convertToVirtualTimeInterval(_ timeInterval: TimeInterval) -> VirtualTimeIntervalUnit
-
-    /**
-     Offsets virtual time by virtual time interval.
-     
-     - parameter time: Virtual time.
-     - parameter offset: Virtual time interval.
-     - returns: Time corresponding to time offsetted by virtual time interval.
-    */
-    func offsetVirtualTime(_ time: VirtualTimeUnit, offset: VirtualTimeIntervalUnit) -> VirtualTimeUnit
-
-    /**
-     This is additional abstraction because `Date` is unfortunately not comparable.
-     Extending `Date` with `Comparable` would be too risky because of possible collisions with other libraries.
-    */
-    func compareVirtualTime(_ lhs: VirtualTimeUnit, _ rhs: VirtualTimeUnit) -> VirtualTimeComparison
-}
-
-/**
- Virtual time comparison result.
-
- This is additional abstraction because `Date` is unfortunately not comparable.
- Extending `Date` with `Comparable` would be too risky because of possible collisions with other libraries.
-*/
-public enum VirtualTimeComparison {
-    /// lhs < rhs.
-    case lessThan
-    /// lhs == rhs.
-    case equal
-    /// lhs > rhs.
-    case greaterThan
-}
-
-extension VirtualTimeComparison {
-    /// lhs < rhs.
-    var lessThen: Bool {
-        self == .lessThan
-    }
-
-    /// lhs > rhs
-    var greaterThan: Bool {
-        self == .greaterThan
-    }
-
-    /// lhs == rhs
-    var equal: Bool {
-        self == .equal
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Schedulers/VirtualTimeScheduler.swift b/Pods/RxSwift/RxSwift/Schedulers/VirtualTimeScheduler.swift
deleted file mode 100644
index e74d5be69..000000000
--- a/Pods/RxSwift/RxSwift/Schedulers/VirtualTimeScheduler.swift
+++ /dev/null
@@ -1,267 +0,0 @@
-//
-//  VirtualTimeScheduler.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Base class for virtual time schedulers using a priority queue for scheduled items.
-open class VirtualTimeScheduler<Converter: VirtualTimeConverterType>
-    : SchedulerType {
-
-    public typealias VirtualTime = Converter.VirtualTimeUnit
-    public typealias VirtualTimeInterval = Converter.VirtualTimeIntervalUnit
-
-    private var running : Bool
-
-    private var currentClock: VirtualTime
-
-    private var schedulerQueue : PriorityQueue<VirtualSchedulerItem<VirtualTime>>
-    private var converter: Converter
-
-    private var nextId = 0
-
-    /// - returns: Current time.
-    public var now: RxTime {
-        self.converter.convertFromVirtualTime(self.clock)
-    }
-
-    /// - returns: Scheduler's absolute time clock value.
-    public var clock: VirtualTime {
-        self.currentClock
-    }
-
-    /// Creates a new virtual time scheduler.
-    ///
-    /// - parameter initialClock: Initial value for the clock.
-    public init(initialClock: VirtualTime, converter: Converter) {
-        self.currentClock = initialClock
-        self.running = false
-        self.converter = converter
-        self.schedulerQueue = PriorityQueue(hasHigherPriority: {
-            switch converter.compareVirtualTime($0.time, $1.time) {
-            case .lessThan:
-                return true
-            case .equal:
-                return $0.id < $1.id
-            case .greaterThan:
-                return false
-            }
-        }, isEqual: { $0 === $1 })
-        #if TRACE_RESOURCES
-            _ = Resources.incrementTotal()
-        #endif
-    }
-
-    /**
-    Schedules an action to be executed immediately.
-
-    - parameter state: State passed to the action to be executed.
-    - parameter action: Action to be executed.
-    - returns: The disposable object used to cancel the scheduled action (best effort).
-    */
-    public func schedule<StateType>(_ state: StateType, action: @escaping (StateType) -> Disposable) -> Disposable {
-        return self.scheduleRelative(state, dueTime: .microseconds(0)) { a in
-            return action(a)
-        }
-    }
-
-    /**
-     Schedules an action to be executed.
-
-     - parameter state: State passed to the action to be executed.
-     - parameter dueTime: Relative time after which to execute the action.
-     - parameter action: Action to be executed.
-     - returns: The disposable object used to cancel the scheduled action (best effort).
-     */
-    public func scheduleRelative<StateType>(_ state: StateType, dueTime: RxTimeInterval, action: @escaping (StateType) -> Disposable) -> Disposable {
-        let time = self.now.addingDispatchInterval(dueTime)
-        let absoluteTime = self.converter.convertToVirtualTime(time)
-        let adjustedTime = self.adjustScheduledTime(absoluteTime)
-        return self.scheduleAbsoluteVirtual(state, time: adjustedTime, action: action)
-    }
-
-    /**
-     Schedules an action to be executed after relative time has passed.
-
-     - parameter state: State passed to the action to be executed.
-     - parameter time: Absolute time when to execute the action. If this is less or equal then `now`, `now + 1`  will be used.
-     - parameter action: Action to be executed.
-     - returns: The disposable object used to cancel the scheduled action (best effort).
-     */
-    public func scheduleRelativeVirtual<StateType>(_ state: StateType, dueTime: VirtualTimeInterval, action: @escaping (StateType) -> Disposable) -> Disposable {
-        let time = self.converter.offsetVirtualTime(self.clock, offset: dueTime)
-        return self.scheduleAbsoluteVirtual(state, time: time, action: action)
-    }
-
-    /**
-     Schedules an action to be executed at absolute virtual time.
-
-     - parameter state: State passed to the action to be executed.
-     - parameter time: Absolute time when to execute the action.
-     - parameter action: Action to be executed.
-     - returns: The disposable object used to cancel the scheduled action (best effort).
-     */
-    public func scheduleAbsoluteVirtual<StateType>(_ state: StateType, time: VirtualTime, action: @escaping (StateType) -> Disposable) -> Disposable {
-        MainScheduler.ensureExecutingOnScheduler()
-
-        let compositeDisposable = CompositeDisposable()
-
-        let item = VirtualSchedulerItem(action: {
-            return action(state)
-        }, time: time, id: self.nextId)
-
-        self.nextId += 1
-
-        self.schedulerQueue.enqueue(item)
-        
-        _ = compositeDisposable.insert(item)
-        
-        return compositeDisposable
-    }
-
-    /// Adjusts time of scheduling before adding item to schedule queue.
-    open func adjustScheduledTime(_ time: VirtualTime) -> VirtualTime {
-        time
-    }
-
-    /// Starts the virtual time scheduler.
-    public func start() {
-        MainScheduler.ensureExecutingOnScheduler()
-
-        if self.running {
-            return
-        }
-
-        self.running = true
-        repeat {
-            guard let next = self.findNext() else {
-                break
-            }
-
-            if self.converter.compareVirtualTime(next.time, self.clock).greaterThan {
-                self.currentClock = next.time
-            }
-
-            next.invoke()
-            self.schedulerQueue.remove(next)
-        } while self.running
-
-        self.running = false
-    }
-
-    func findNext() -> VirtualSchedulerItem<VirtualTime>? {
-        while let front = self.schedulerQueue.peek() {
-            if front.isDisposed {
-                self.schedulerQueue.remove(front)
-                continue
-            }
-
-            return front
-        }
-
-        return nil
-    }
-
-    /// Advances the scheduler's clock to the specified time, running all work till that point.
-    ///
-    /// - parameter virtualTime: Absolute time to advance the scheduler's clock to.
-    public func advanceTo(_ virtualTime: VirtualTime) {
-        MainScheduler.ensureExecutingOnScheduler()
-
-        if self.running {
-            fatalError("Scheduler is already running")
-        }
-
-        self.running = true
-        repeat {
-            guard let next = self.findNext() else {
-                break
-            }
-
-            if self.converter.compareVirtualTime(next.time, virtualTime).greaterThan {
-                break
-            }
-
-            if self.converter.compareVirtualTime(next.time, self.clock).greaterThan {
-                self.currentClock = next.time
-            }
-            next.invoke()
-            self.schedulerQueue.remove(next)
-        } while self.running
-
-        self.currentClock = virtualTime
-        self.running = false
-    }
-
-    /// Advances the scheduler's clock by the specified relative time.
-    public func sleep(_ virtualInterval: VirtualTimeInterval) {
-        MainScheduler.ensureExecutingOnScheduler()
-
-        let sleepTo = self.converter.offsetVirtualTime(self.clock, offset: virtualInterval)
-        if self.converter.compareVirtualTime(sleepTo, self.clock).lessThen {
-            fatalError("Can't sleep to past.")
-        }
-
-        self.currentClock = sleepTo
-    }
-
-    /// Stops the virtual time scheduler.
-    public func stop() {
-        MainScheduler.ensureExecutingOnScheduler()
-
-        self.running = false
-    }
-
-    #if TRACE_RESOURCES
-        deinit {
-            _ = Resources.decrementTotal()
-        }
-    #endif
-}
-
-// MARK: description
-
-extension VirtualTimeScheduler: CustomDebugStringConvertible {
-    /// A textual representation of `self`, suitable for debugging.
-    public var debugDescription: String {
-        self.schedulerQueue.debugDescription
-    }
-}
-
-final class VirtualSchedulerItem<Time>
-    : Disposable {
-    typealias Action = () -> Disposable
-    
-    let action: Action
-    let time: Time
-    let id: Int
-
-    var isDisposed: Bool {
-        self.disposable.isDisposed
-    }
-    
-    var disposable = SingleAssignmentDisposable()
-    
-    init(action: @escaping Action, time: Time, id: Int) {
-        self.action = action
-        self.time = time
-        self.id = id
-    }
-
-    func invoke() {
-         self.disposable.setDisposable(self.action())
-    }
-    
-    func dispose() {
-        self.disposable.dispose()
-    }
-}
-
-extension VirtualSchedulerItem
-    : CustomDebugStringConvertible {
-    var debugDescription: String {
-        "\(self.time)"
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Subjects/AsyncSubject.swift b/Pods/RxSwift/RxSwift/Subjects/AsyncSubject.swift
deleted file mode 100644
index 30b012f0b..000000000
--- a/Pods/RxSwift/RxSwift/Subjects/AsyncSubject.swift
+++ /dev/null
@@ -1,154 +0,0 @@
-//
-//  AsyncSubject.swift
-//  RxSwift
-//
-//  Created by Victor Galán on 07/01/2017.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-/// An AsyncSubject emits the last value (and only the last value) emitted by the source Observable,
-/// and only after that source Observable completes.
-///
-/// (If the source Observable does not emit any values, the AsyncSubject also completes without emitting any values.)
-public final class AsyncSubject<Element>
-    : Observable<Element>
-    , SubjectType
-    , ObserverType
-    , SynchronizedUnsubscribeType {
-    public typealias SubjectObserverType = AsyncSubject<Element>
-
-    typealias Observers = AnyObserver<Element>.s
-    typealias DisposeKey = Observers.KeyType
-
-    /// Indicates whether the subject has any observers
-    public var hasObservers: Bool {
-        self.lock.performLocked {
-            self.observers.count > 0
-        }
-    }
-
-    let lock = RecursiveLock()
-
-    // state
-    private var observers = Observers()
-    private var isStopped = false
-    private var stoppedEvent = nil as Event<Element>? {
-        didSet {
-            self.isStopped = self.stoppedEvent != nil
-        }
-    }
-    private var lastElement: Element?
-
-    #if DEBUG
-        private let synchronizationTracker = SynchronizationTracker()
-    #endif
-
-
-    /// Creates a subject.
-    public override init() {
-        #if TRACE_RESOURCES
-            _ = Resources.incrementTotal()
-        #endif
-        super.init()
-    }
-
-    /// Notifies all subscribed observers about next event.
-    ///
-    /// - parameter event: Event to send to the observers.
-    public func on(_ event: Event<Element>) {
-        #if DEBUG
-            self.synchronizationTracker.register(synchronizationErrorMessage: .default)
-            defer { self.synchronizationTracker.unregister() }
-        #endif
-        let (observers, event) = self.synchronized_on(event)
-        switch event {
-        case .next:
-            dispatch(observers, event)
-            dispatch(observers, .completed)
-        case .completed:
-            dispatch(observers, event)
-        case .error:
-            dispatch(observers, event)
-        }
-    }
-
-    func synchronized_on(_ event: Event<Element>) -> (Observers, Event<Element>) {
-        self.lock.lock(); defer { self.lock.unlock() }
-        if self.isStopped {
-            return (Observers(), .completed)
-        }
-
-        switch event {
-        case .next(let element):
-            self.lastElement = element
-            return (Observers(), .completed)
-        case .error:
-            self.stoppedEvent = event
-
-            let observers = self.observers
-            self.observers.removeAll()
-
-            return (observers, event)
-        case .completed:
-
-            let observers = self.observers
-            self.observers.removeAll()
-
-            if let lastElement = self.lastElement {
-                self.stoppedEvent = .next(lastElement)
-                return (observers, .next(lastElement))
-            }
-            else {
-                self.stoppedEvent = event
-                return (observers, .completed)
-            }
-        }
-    }
-
-    /// Subscribes an observer to the subject.
-    ///
-    /// - parameter observer: Observer to subscribe to the subject.
-    /// - returns: Disposable object that can be used to unsubscribe the observer from the subject.
-    public override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.lock.performLocked { self.synchronized_subscribe(observer) }
-    }
-
-    func synchronized_subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        if let stoppedEvent = self.stoppedEvent {
-            switch stoppedEvent {
-            case .next:
-                observer.on(stoppedEvent)
-                observer.on(.completed)
-            case .completed:
-                observer.on(stoppedEvent)
-            case .error:
-                observer.on(stoppedEvent)
-            }
-            return Disposables.create()
-        }
-
-        let key = self.observers.insert(observer.on)
-
-        return SubscriptionDisposable(owner: self, key: key)
-    }
-
-    func synchronizedUnsubscribe(_ disposeKey: DisposeKey) {
-        self.lock.performLocked { self.synchronized_unsubscribe(disposeKey) }
-    }
-    
-    func synchronized_unsubscribe(_ disposeKey: DisposeKey) {
-        _ = self.observers.removeKey(disposeKey)
-    }
-    
-    /// Returns observer interface for subject.
-    public func asObserver() -> AsyncSubject<Element> {
-        self
-    }
-
-    #if TRACE_RESOURCES
-    deinit {
-        _ = Resources.decrementTotal()
-    }
-    #endif
-}
-
diff --git a/Pods/RxSwift/RxSwift/Subjects/BehaviorSubject.swift b/Pods/RxSwift/RxSwift/Subjects/BehaviorSubject.swift
deleted file mode 100644
index 7251f616b..000000000
--- a/Pods/RxSwift/RxSwift/Subjects/BehaviorSubject.swift
+++ /dev/null
@@ -1,157 +0,0 @@
-//
-//  BehaviorSubject.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 5/23/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents a value that changes over time.
-///
-/// Observers can subscribe to the subject to receive the last (or initial) value and all subsequent notifications.
-public final class BehaviorSubject<Element>
-    : Observable<Element>
-    , SubjectType
-    , ObserverType
-    , SynchronizedUnsubscribeType
-    , Cancelable {
-    public typealias SubjectObserverType = BehaviorSubject<Element>
-
-    typealias Observers = AnyObserver<Element>.s
-    typealias DisposeKey = Observers.KeyType
-    
-    /// Indicates whether the subject has any observers
-    public var hasObservers: Bool {
-        self.lock.performLocked { self.observers.count > 0 }
-    }
-    
-    let lock = RecursiveLock()
-    
-    // state
-    private var disposed = false
-    private var element: Element
-    private var observers = Observers()
-    private var stoppedEvent: Event<Element>?
-
-    #if DEBUG
-        private let synchronizationTracker = SynchronizationTracker()
-    #endif
-
-    /// Indicates whether the subject has been disposed.
-    public var isDisposed: Bool {
-        self.disposed
-    }
- 
-    /// Initializes a new instance of the subject that caches its last value and starts with the specified value.
-    ///
-    /// - parameter value: Initial value sent to observers when no other value has been received by the subject yet.
-    public init(value: Element) {
-        self.element = value
-
-        #if TRACE_RESOURCES
-            _ = Resources.incrementTotal()
-        #endif
-    }
-    
-    /// Gets the current value or throws an error.
-    ///
-    /// - returns: Latest value.
-    public func value() throws -> Element {
-        self.lock.lock(); defer { self.lock.unlock() }
-        if self.isDisposed {
-            throw RxError.disposed(object: self)
-        }
-        
-        if let error = self.stoppedEvent?.error {
-            // intentionally throw exception
-            throw error
-        }
-        else {
-            return self.element
-        }
-    }
-    
-    /// Notifies all subscribed observers about next event.
-    ///
-    /// - parameter event: Event to send to the observers.
-    public func on(_ event: Event<Element>) {
-        #if DEBUG
-            self.synchronizationTracker.register(synchronizationErrorMessage: .default)
-            defer { self.synchronizationTracker.unregister() }
-        #endif
-        dispatch(self.synchronized_on(event), event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) -> Observers {
-        self.lock.lock(); defer { self.lock.unlock() }
-        if self.stoppedEvent != nil || self.isDisposed {
-            return Observers()
-        }
-        
-        switch event {
-        case .next(let element):
-            self.element = element
-        case .error, .completed:
-            self.stoppedEvent = event
-        }
-        
-        return self.observers
-    }
-    
-    /// Subscribes an observer to the subject.
-    ///
-    /// - parameter observer: Observer to subscribe to the subject.
-    /// - returns: Disposable object that can be used to unsubscribe the observer from the subject.
-    public override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.lock.performLocked { self.synchronized_subscribe(observer) }
-    }
-
-    func synchronized_subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        if self.isDisposed {
-            observer.on(.error(RxError.disposed(object: self)))
-            return Disposables.create()
-        }
-        
-        if let stoppedEvent = self.stoppedEvent {
-            observer.on(stoppedEvent)
-            return Disposables.create()
-        }
-        
-        let key = self.observers.insert(observer.on)
-        observer.on(.next(self.element))
-    
-        return SubscriptionDisposable(owner: self, key: key)
-    }
-
-    func synchronizedUnsubscribe(_ disposeKey: DisposeKey) {
-        self.lock.performLocked { self.synchronized_unsubscribe(disposeKey) }
-    }
-
-    func synchronized_unsubscribe(_ disposeKey: DisposeKey) {
-        if self.isDisposed {
-            return
-        }
-
-        _ = self.observers.removeKey(disposeKey)
-    }
-
-    /// Returns observer interface for subject.
-    public func asObserver() -> BehaviorSubject<Element> {
-        self
-    }
-
-    /// Unsubscribe all observers and release resources.
-    public func dispose() {
-        self.lock.performLocked {
-            self.disposed = true
-            self.observers.removeAll()
-            self.stoppedEvent = nil
-        }
-    }
-
-    #if TRACE_RESOURCES
-        deinit {
-        _ = Resources.decrementTotal()
-        }
-    #endif
-}
diff --git a/Pods/RxSwift/RxSwift/Subjects/PublishSubject.swift b/Pods/RxSwift/RxSwift/Subjects/PublishSubject.swift
deleted file mode 100644
index 0318486ef..000000000
--- a/Pods/RxSwift/RxSwift/Subjects/PublishSubject.swift
+++ /dev/null
@@ -1,140 +0,0 @@
-//
-//  PublishSubject.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 2/11/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents an object that is both an observable sequence as well as an observer.
-///
-/// Each notification is broadcasted to all subscribed observers.
-public final class PublishSubject<Element>
-    : Observable<Element>
-    , SubjectType
-    , Cancelable
-    , ObserverType
-    , SynchronizedUnsubscribeType {
-    public typealias SubjectObserverType = PublishSubject<Element>
-
-    typealias Observers = AnyObserver<Element>.s
-    typealias DisposeKey = Observers.KeyType
-    
-    /// Indicates whether the subject has any observers
-    public var hasObservers: Bool {
-        self.lock.performLocked { self.observers.count > 0 }
-    }
-    
-    private let lock = RecursiveLock()
-    
-    // state
-    private var disposed = false
-    private var observers = Observers()
-    private var stopped = false
-    private var stoppedEvent = nil as Event<Element>?
-
-    #if DEBUG
-        private let synchronizationTracker = SynchronizationTracker()
-    #endif
-
-    /// Indicates whether the subject has been isDisposed.
-    public var isDisposed: Bool {
-        self.disposed
-    }
-    
-    /// Creates a subject.
-    public override init() {
-        super.init()
-        #if TRACE_RESOURCES
-            _ = Resources.incrementTotal()
-        #endif
-    }
-    
-    /// Notifies all subscribed observers about next event.
-    ///
-    /// - parameter event: Event to send to the observers.
-    public func on(_ event: Event<Element>) {
-        #if DEBUG
-            self.synchronizationTracker.register(synchronizationErrorMessage: .default)
-            defer { self.synchronizationTracker.unregister() }
-        #endif
-        dispatch(self.synchronized_on(event), event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) -> Observers {
-        self.lock.lock(); defer { self.lock.unlock() }
-        switch event {
-        case .next:
-            if self.isDisposed || self.stopped {
-                return Observers()
-            }
-            
-            return self.observers
-        case .completed, .error:
-            if self.stoppedEvent == nil {
-                self.stoppedEvent = event
-                self.stopped = true
-                let observers = self.observers
-                self.observers.removeAll()
-                return observers
-            }
-
-            return Observers()
-        }
-    }
-    
-    /**
-    Subscribes an observer to the subject.
-    
-    - parameter observer: Observer to subscribe to the subject.
-    - returns: Disposable object that can be used to unsubscribe the observer from the subject.
-    */
-    public override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.lock.performLocked { self.synchronized_subscribe(observer) }
-    }
-
-    func synchronized_subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        if let stoppedEvent = self.stoppedEvent {
-            observer.on(stoppedEvent)
-            return Disposables.create()
-        }
-        
-        if self.isDisposed {
-            observer.on(.error(RxError.disposed(object: self)))
-            return Disposables.create()
-        }
-        
-        let key = self.observers.insert(observer.on)
-        return SubscriptionDisposable(owner: self, key: key)
-    }
-
-    func synchronizedUnsubscribe(_ disposeKey: DisposeKey) {
-        self.lock.performLocked { self.synchronized_unsubscribe(disposeKey) }
-    }
-
-    func synchronized_unsubscribe(_ disposeKey: DisposeKey) {
-        _ = self.observers.removeKey(disposeKey)
-    }
-    
-    /// Returns observer interface for subject.
-    public func asObserver() -> PublishSubject<Element> {
-        self
-    }
-    
-    /// Unsubscribe all observers and release resources.
-    public func dispose() {
-        self.lock.performLocked { self.synchronized_dispose() }
-    }
-
-    final func synchronized_dispose() {
-        self.disposed = true
-        self.observers.removeAll()
-        self.stoppedEvent = nil
-    }
-
-    #if TRACE_RESOURCES
-        deinit {
-            _ = Resources.decrementTotal()
-        }
-    #endif
-}
diff --git a/Pods/RxSwift/RxSwift/Subjects/ReplaySubject.swift b/Pods/RxSwift/RxSwift/Subjects/ReplaySubject.swift
deleted file mode 100644
index 6fb54912a..000000000
--- a/Pods/RxSwift/RxSwift/Subjects/ReplaySubject.swift
+++ /dev/null
@@ -1,271 +0,0 @@
-//
-//  ReplaySubject.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 4/14/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents an object that is both an observable sequence as well as an observer.
-///
-/// Each notification is broadcasted to all subscribed and future observers, subject to buffer trimming policies.
-public class ReplaySubject<Element>
-    : Observable<Element>
-    , SubjectType
-    , ObserverType
-    , Disposable {
-    public typealias SubjectObserverType = ReplaySubject<Element>
-
-    typealias Observers = AnyObserver<Element>.s
-    typealias DisposeKey = Observers.KeyType
-
-    /// Indicates whether the subject has any observers
-    public var hasObservers: Bool {
-        self.lock.performLocked { self.observers.count > 0 }
-    }
-    
-    fileprivate let lock = RecursiveLock()
-    
-    // state
-    fileprivate var isDisposed = false
-    fileprivate var stopped = false
-    fileprivate var stoppedEvent = nil as Event<Element>? {
-        didSet {
-            self.stopped = self.stoppedEvent != nil
-        }
-    }
-    fileprivate var observers = Observers()
-
-    #if DEBUG
-        fileprivate let synchronizationTracker = SynchronizationTracker()
-    #endif
-
-    func unsubscribe(_ key: DisposeKey) {
-        rxAbstractMethod()
-    }
-
-    final var isStopped: Bool {
-        self.stopped
-    }
-    
-    /// Notifies all subscribed observers about next event.
-    ///
-    /// - parameter event: Event to send to the observers.
-    public func on(_ event: Event<Element>) {
-        rxAbstractMethod()
-    }
-    
-    /// Returns observer interface for subject.
-    public func asObserver() -> ReplaySubject<Element> {
-        self
-    }
-    
-    /// Unsubscribe all observers and release resources.
-    public func dispose() {
-    }
-
-    /// Creates new instance of `ReplaySubject` that replays at most `bufferSize` last elements of sequence.
-    ///
-    /// - parameter bufferSize: Maximal number of elements to replay to observer after subscription.
-    /// - returns: New instance of replay subject.
-    public static func create(bufferSize: Int) -> ReplaySubject<Element> {
-        if bufferSize == 1 {
-            return ReplayOne()
-        }
-        else {
-            return ReplayMany(bufferSize: bufferSize)
-        }
-    }
-
-    /// Creates a new instance of `ReplaySubject` that buffers all the elements of a sequence.
-    /// To avoid filling up memory, developer needs to make sure that the use case will only ever store a 'reasonable'
-    /// number of elements.
-    public static func createUnbounded() -> ReplaySubject<Element> {
-        ReplayAll()
-    }
-
-    #if TRACE_RESOURCES
-        override init() {
-            _ = Resources.incrementTotal()
-        }
-
-        deinit {
-            _ = Resources.decrementTotal()
-        }
-    #endif
-}
-
-private class ReplayBufferBase<Element>
-    : ReplaySubject<Element>
-    , SynchronizedUnsubscribeType {
-    
-    func trim() {
-        rxAbstractMethod()
-    }
-    
-    func addValueToBuffer(_ value: Element) {
-        rxAbstractMethod()
-    }
-    
-    func replayBuffer<Observer: ObserverType>(_ observer: Observer) where Observer.Element == Element {
-        rxAbstractMethod()
-    }
-    
-    override func on(_ event: Event<Element>) {
-        #if DEBUG
-            self.synchronizationTracker.register(synchronizationErrorMessage: .default)
-            defer { self.synchronizationTracker.unregister() }
-        #endif
-        dispatch(self.synchronized_on(event), event)
-    }
-
-    func synchronized_on(_ event: Event<Element>) -> Observers {
-        self.lock.lock(); defer { self.lock.unlock() }
-        if self.isDisposed {
-            return Observers()
-        }
-        
-        if self.isStopped {
-            return Observers()
-        }
-        
-        switch event {
-        case .next(let element):
-            self.addValueToBuffer(element)
-            self.trim()
-            return self.observers
-        case .error, .completed:
-            self.stoppedEvent = event
-            self.trim()
-            let observers = self.observers
-            self.observers.removeAll()
-            return observers
-        }
-    }
-    
-    override func subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        self.lock.performLocked { self.synchronized_subscribe(observer) }
-    }
-
-    func synchronized_subscribe<Observer: ObserverType>(_ observer: Observer) -> Disposable where Observer.Element == Element {
-        if self.isDisposed {
-            observer.on(.error(RxError.disposed(object: self)))
-            return Disposables.create()
-        }
-     
-        let anyObserver = observer.asObserver()
-        
-        self.replayBuffer(anyObserver)
-        if let stoppedEvent = self.stoppedEvent {
-            observer.on(stoppedEvent)
-            return Disposables.create()
-        }
-        else {
-            let key = self.observers.insert(observer.on)
-            return SubscriptionDisposable(owner: self, key: key)
-        }
-    }
-
-    func synchronizedUnsubscribe(_ disposeKey: DisposeKey) {
-        self.lock.performLocked { self.synchronized_unsubscribe(disposeKey) }
-    }
-
-    func synchronized_unsubscribe(_ disposeKey: DisposeKey) {
-        if self.isDisposed {
-            return
-        }
-        
-        _ = self.observers.removeKey(disposeKey)
-    }
-    
-    override func dispose() {
-        super.dispose()
-
-        self.synchronizedDispose()
-    }
-
-    func synchronizedDispose() {
-        self.lock.performLocked { self.synchronized_dispose() }
-    }
-
-    func synchronized_dispose() {
-        self.isDisposed = true
-        self.observers.removeAll()
-    }
-}
-
-private final class ReplayOne<Element> : ReplayBufferBase<Element> {
-    private var value: Element?
-    
-    override init() {
-        super.init()
-    }
-    
-    override func trim() {
-        
-    }
-    
-    override func addValueToBuffer(_ value: Element) {
-        self.value = value
-    }
-
-    override func replayBuffer<Observer: ObserverType>(_ observer: Observer) where Observer.Element == Element {
-        if let value = self.value {
-            observer.on(.next(value))
-        }
-    }
-
-    override func synchronized_dispose() {
-        super.synchronized_dispose()
-        self.value = nil
-    }
-}
-
-private class ReplayManyBase<Element>: ReplayBufferBase<Element> {
-    fileprivate var queue: Queue<Element>
-    
-    init(queueSize: Int) {
-        self.queue = Queue(capacity: queueSize + 1)
-    }
-    
-    override func addValueToBuffer(_ value: Element) {
-        self.queue.enqueue(value)
-    }
-
-    override func replayBuffer<Observer: ObserverType>(_ observer: Observer) where Observer.Element == Element {
-        for item in self.queue {
-            observer.on(.next(item))
-        }
-    }
-
-    override func synchronized_dispose() {
-        super.synchronized_dispose()
-        self.queue = Queue(capacity: 0)
-    }
-}
-
-private final class ReplayMany<Element> : ReplayManyBase<Element> {
-    private let bufferSize: Int
-    
-    init(bufferSize: Int) {
-        self.bufferSize = bufferSize
-        
-        super.init(queueSize: bufferSize)
-    }
-    
-    override func trim() {
-        while self.queue.count > self.bufferSize {
-            _ = self.queue.dequeue()
-        }
-    }
-}
-
-private final class ReplayAll<Element> : ReplayManyBase<Element> {
-    init() {
-        super.init(queueSize: 0)
-    }
-    
-    override func trim() {
-        
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Subjects/SubjectType.swift b/Pods/RxSwift/RxSwift/Subjects/SubjectType.swift
deleted file mode 100644
index 8651c5a41..000000000
--- a/Pods/RxSwift/RxSwift/Subjects/SubjectType.swift
+++ /dev/null
@@ -1,21 +0,0 @@
-//
-//  SubjectType.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/1/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-/// Represents an object that is both an observable sequence as well as an observer.
-public protocol SubjectType : ObservableType {
-    /// The type of the observer that represents this subject.
-    ///
-    /// Usually this type is type of subject itself, but it doesn't have to be.
-    associatedtype Observer: ObserverType
-
-    /// Returns observer interface for subject.
-    ///
-    /// - returns: Observer interface for subject.
-    func asObserver() -> Observer
-    
-}
diff --git a/Pods/RxSwift/RxSwift/SwiftSupport/SwiftSupport.swift b/Pods/RxSwift/RxSwift/SwiftSupport/SwiftSupport.swift
deleted file mode 100644
index 8779888ac..000000000
--- a/Pods/RxSwift/RxSwift/SwiftSupport/SwiftSupport.swift
+++ /dev/null
@@ -1,18 +0,0 @@
-//
-//  SwiftSupport.swift
-//  RxSwift
-//
-//  Created by Volodymyr  Gorbenko on 3/6/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-typealias IntMax = Int64
-public typealias RxAbstractInteger = FixedWidthInteger
-
-extension SignedInteger {
-    func toIntMax() -> IntMax {
-        IntMax(self)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+CombineLatest+arity.swift b/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+CombineLatest+arity.swift
deleted file mode 100644
index ef422a3a2..000000000
--- a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+CombineLatest+arity.swift
+++ /dev/null
@@ -1,151 +0,0 @@
-// This file is autogenerated. Take a look at `Preprocessor` target in RxSwift project 
-//
-//  Infallible+CombineLatest+arity.swift
-//  RxSwift
-//
-//  Created by Shai Mishali on 27/08/2020.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-// MARK: - Combine Latest
-
-// 2
-extension Infallible {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<I1: InfallibleType, I2: InfallibleType>
-        (_ source1: I1, _ source2: I2, resultSelector: @escaping (I1.Element, I2.Element) throws -> Element)
-            -> Infallible<Element> {
-        Infallible(CombineLatest2(
-            source1: source1.asObservable(), source2: source2.asObservable(),
-            resultSelector: resultSelector
-        ))
-    }
-}
-
-// 3
-extension Infallible {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<I1: InfallibleType, I2: InfallibleType, I3: InfallibleType>
-        (_ source1: I1, _ source2: I2, _ source3: I3, resultSelector: @escaping (I1.Element, I2.Element, I3.Element) throws -> Element)
-            -> Infallible<Element> {
-        Infallible(CombineLatest3(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(),
-            resultSelector: resultSelector
-        ))
-    }
-}
-
-// 4
-extension Infallible {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<I1: InfallibleType, I2: InfallibleType, I3: InfallibleType, I4: InfallibleType>
-        (_ source1: I1, _ source2: I2, _ source3: I3, _ source4: I4, resultSelector: @escaping (I1.Element, I2.Element, I3.Element, I4.Element) throws -> Element)
-            -> Infallible<Element> {
-        Infallible(CombineLatest4(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(),
-            resultSelector: resultSelector
-        ))
-    }
-}
-
-// 5
-extension Infallible {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<I1: InfallibleType, I2: InfallibleType, I3: InfallibleType, I4: InfallibleType, I5: InfallibleType>
-        (_ source1: I1, _ source2: I2, _ source3: I3, _ source4: I4, _ source5: I5, resultSelector: @escaping (I1.Element, I2.Element, I3.Element, I4.Element, I5.Element) throws -> Element)
-            -> Infallible<Element> {
-        Infallible(CombineLatest5(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(),
-            resultSelector: resultSelector
-        ))
-    }
-}
-
-// 6
-extension Infallible {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<I1: InfallibleType, I2: InfallibleType, I3: InfallibleType, I4: InfallibleType, I5: InfallibleType, I6: InfallibleType>
-        (_ source1: I1, _ source2: I2, _ source3: I3, _ source4: I4, _ source5: I5, _ source6: I6, resultSelector: @escaping (I1.Element, I2.Element, I3.Element, I4.Element, I5.Element, I6.Element) throws -> Element)
-            -> Infallible<Element> {
-        Infallible(CombineLatest6(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(),
-            resultSelector: resultSelector
-        ))
-    }
-}
-
-// 7
-extension Infallible {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<I1: InfallibleType, I2: InfallibleType, I3: InfallibleType, I4: InfallibleType, I5: InfallibleType, I6: InfallibleType, I7: InfallibleType>
-        (_ source1: I1, _ source2: I2, _ source3: I3, _ source4: I4, _ source5: I5, _ source6: I6, _ source7: I7, resultSelector: @escaping (I1.Element, I2.Element, I3.Element, I4.Element, I5.Element, I6.Element, I7.Element) throws -> Element)
-            -> Infallible<Element> {
-        Infallible(CombineLatest7(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(),
-            resultSelector: resultSelector
-        ))
-    }
-}
-
-// 8
-extension Infallible {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever any of the observable sequences produces an element.
-
-    - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-
-    - parameter resultSelector: Function to invoke whenever any of the sources produces an element.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func combineLatest<I1: InfallibleType, I2: InfallibleType, I3: InfallibleType, I4: InfallibleType, I5: InfallibleType, I6: InfallibleType, I7: InfallibleType, I8: InfallibleType>
-        (_ source1: I1, _ source2: I2, _ source3: I3, _ source4: I4, _ source5: I5, _ source6: I6, _ source7: I7, _ source8: I8, resultSelector: @escaping (I1.Element, I2.Element, I3.Element, I4.Element, I5.Element, I6.Element, I7.Element, I8.Element) throws -> Element)
-            -> Infallible<Element> {
-        Infallible(CombineLatest8(
-            source1: source1.asObservable(), source2: source2.asObservable(), source3: source3.asObservable(), source4: source4.asObservable(), source5: source5.asObservable(), source6: source6.asObservable(), source7: source7.asObservable(), source8: source8.asObservable(),
-            resultSelector: resultSelector
-        ))
-    }
-}
-
diff --git a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+Create.swift b/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+Create.swift
deleted file mode 100644
index 2a37f8fad..000000000
--- a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+Create.swift
+++ /dev/null
@@ -1,44 +0,0 @@
-//
-//  Infallible+Create.swift
-//  RxSwift
-//
-//  Created by Shai Mishali on 27/08/2020.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-import Foundation
-
-public enum InfallibleEvent<Element> {
-    /// Next element is produced.
-    case next(Element)
-
-    /// Sequence completed successfully.
-    case completed
-}
-
-extension Infallible {
-    public typealias InfallibleObserver = (InfallibleEvent<Element>) -> Void
-
-    /**
-     Creates an observable sequence from a specified subscribe method implementation.
-
-     - seealso: [create operator on reactivex.io](http://reactivex.io/documentation/operators/create.html)
-
-     - parameter subscribe: Implementation of the resulting observable sequence's `subscribe` method.
-     - returns: The observable sequence with the specified implementation for the `subscribe` method.
-     */
-    public static func create(subscribe: @escaping (@escaping InfallibleObserver) -> Disposable) -> Infallible<Element> {
-        let source = Observable<Element>.create { observer in
-            subscribe { event in
-                switch event {
-                case .next(let element):
-                    observer.onNext(element)
-                case .completed:
-                    observer.onCompleted()
-                }
-            }
-        }
-
-        return Infallible(source)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+Operators.swift b/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+Operators.swift
deleted file mode 100644
index ca2a14ae6..000000000
--- a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+Operators.swift
+++ /dev/null
@@ -1,711 +0,0 @@
-//
-//  Infallible+Operators.swift
-//  RxSwift
-//
-//  Created by Shai Mishali on 27/08/2020.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-// MARK: - Static allocation
-extension InfallibleType {
-    /**
-     Returns an infallible sequence that contains a single element.
-
-     - seealso: [just operator on reactivex.io](http://reactivex.io/documentation/operators/just.html)
-
-     - parameter element: Single element in the resulting infallible sequence.
-
-     - returns: An infallible sequence containing the single specified element.
-     */
-    public static func just(_ element: Element) -> Infallible<Element> {
-        Infallible(.just(element))
-    }
-
-    /**
-     Returns an infallible sequence that contains a single element.
-
-     - seealso: [just operator on reactivex.io](http://reactivex.io/documentation/operators/just.html)
-
-     - parameter element: Single element in the resulting infallible sequence.
-     - parameter scheduler: Scheduler to send the single element on.
-     - returns: An infallible sequence containing the single specified element.
-     */
-    public static func just(_ element: Element, scheduler: ImmediateSchedulerType) -> Infallible<Element> {
-        Infallible(.just(element, scheduler: scheduler))
-    }
-
-    /**
-     Returns a non-terminating infallible sequence, which can be used to denote an infinite duration.
-
-     - seealso: [never operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: An infallible sequence whose observers will never get called.
-     */
-    public static func never() -> Infallible<Element> {
-        Infallible(.never())
-    }
-
-    /**
-     Returns an empty infallible sequence, using the specified scheduler to send out the single `Completed` message.
-
-     - seealso: [empty operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: An infallible sequence with no elements.
-     */
-    public static func empty() -> Infallible<Element> {
-        Infallible(.empty())
-    }
-
-    /**
-     Returns an infallible sequence that invokes the specified factory function whenever a new observer subscribes.
-
-     - seealso: [defer operator on reactivex.io](http://reactivex.io/documentation/operators/defer.html)
-
-     - parameter observableFactory: Observable factory function to invoke for each observer that subscribes to the resulting sequence.
-     - returns: An observable sequence whose observers trigger an invocation of the given observable factory function.
-     */
-    public static func deferred(_ observableFactory: @escaping () throws -> Infallible<Element>)
-        -> Infallible<Element> {
-        Infallible(.deferred { try observableFactory().asObservable() })
-    }
-}
-
-// MARK: From & Of
-
-extension Infallible {
-    /**
-     This method creates a new Infallible instance with a variable number of elements.
-
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-
-     - parameter elements: Elements to generate.
-     - parameter scheduler: Scheduler to send elements on. If `nil`, elements are sent immediately on subscription.
-     - returns: The Infallible sequence whose elements are pulled from the given arguments.
-     */
-    public static func of(_ elements: Element ..., scheduler: ImmediateSchedulerType = CurrentThreadScheduler.instance) -> Infallible<Element> {
-        Infallible(Observable.from(elements, scheduler: scheduler))
-    }
-}
-
-extension Infallible {
-    /**
-     Converts an array to an Infallible sequence.
-
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-
-     - returns: The Infallible sequence whose elements are pulled from the given enumerable sequence.
-     */
-    public static func from(_ array: [Element], scheduler: ImmediateSchedulerType = CurrentThreadScheduler.instance) -> Infallible<Element> {
-        Infallible(Observable.from(array, scheduler: scheduler))
-    }
-
-    /**
-     Converts a sequence to an Infallible sequence.
-
-     - seealso: [from operator on reactivex.io](http://reactivex.io/documentation/operators/from.html)
-
-     - returns: The Infallible sequence whose elements are pulled from the given enumerable sequence.
-     */
-    public static func from<Sequence: Swift.Sequence>(_ sequence: Sequence, scheduler: ImmediateSchedulerType = CurrentThreadScheduler.instance) -> Infallible<Element> where Sequence.Element == Element {
-        Infallible(Observable.from(sequence, scheduler: scheduler))
-    }
-}
-
-// MARK: - Filter
-extension InfallibleType {
-    /**
-     Filters the elements of an observable sequence based on a predicate.
-
-     - seealso: [filter operator on reactivex.io](http://reactivex.io/documentation/operators/filter.html)
-
-     - parameter predicate: A function to test each source element for a condition.
-     - returns: An observable sequence that contains elements from the input sequence that satisfy the condition.
-     */
-    public func filter(_ predicate: @escaping (Element) -> Bool)
-        -> Infallible<Element> {
-        Infallible(asObservable().filter(predicate))
-    }
-}
-
-// MARK: - Map
-extension InfallibleType {
-    /**
-     Projects each element of an observable sequence into a new form.
-
-     - seealso: [map operator on reactivex.io](http://reactivex.io/documentation/operators/map.html)
-
-     - parameter transform: A transform function to apply to each source element.
-     - returns: An observable sequence whose elements are the result of invoking the transform function on each element of source.
-
-     */
-    public func map<Result>(_ transform: @escaping (Element) -> Result)
-        -> Infallible<Result> {
-        Infallible(asObservable().map(transform))
-    }
-
-    /**
-     Projects each element of an observable sequence into an optional form and filters all optional results.
-
-     - parameter transform: A transform function to apply to each source element and which returns an element or nil.
-     - returns: An observable sequence whose elements are the result of filtering the transform function for each element of the source.
-
-     */
-    public func compactMap<Result>(_ transform: @escaping (Element) -> Result?)
-        -> Infallible<Result> {
-        Infallible(asObservable().compactMap(transform))
-    }
-}
-
-// MARK: - Distinct
-
-extension InfallibleType where Element: Comparable {
-    /**
-     Returns an observable sequence that contains only distinct contiguous elements according to equality operator.
-
-     - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-     - returns: An observable sequence only containing the distinct contiguous elements, based on equality operator, from the source sequence.
-     */
-    public func distinctUntilChanged()
-        -> Infallible<Element> {
-        Infallible(asObservable().distinctUntilChanged())
-    }
-}
-
-extension InfallibleType {
-    /**
-     Returns an observable sequence that contains only distinct contiguous elements according to the `keySelector`.
-
-     - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-     - parameter keySelector: A function to compute the comparison key for each element.
-     - returns: An observable sequence only containing the distinct contiguous elements, based on a computed key value, from the source sequence.
-     */
-    public func distinctUntilChanged<Key: Equatable>(_ keySelector: @escaping (Element) throws -> Key)
-        -> Infallible<Element> {
-        Infallible(self.asObservable().distinctUntilChanged(keySelector, comparer: { $0 == $1 }))
-    }
-
-    /**
-     Returns an observable sequence that contains only distinct contiguous elements according to the `comparer`.
-
-     - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-     - parameter comparer: Equality comparer for computed key values.
-     - returns: An observable sequence only containing the distinct contiguous elements, based on `comparer`, from the source sequence.
-     */
-    public func distinctUntilChanged(_ comparer: @escaping (Element, Element) throws -> Bool)
-        -> Infallible<Element> {
-        Infallible(self.asObservable().distinctUntilChanged({ $0 }, comparer: comparer))
-    }
-
-    /**
-     Returns an observable sequence that contains only distinct contiguous elements according to the keySelector and the comparer.
-
-     - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-     - parameter keySelector: A function to compute the comparison key for each element.
-     - parameter comparer: Equality comparer for computed key values.
-     - returns: An observable sequence only containing the distinct contiguous elements, based on a computed key value and the comparer, from the source sequence.
-     */
-    public func distinctUntilChanged<K>(_ keySelector: @escaping (Element) throws -> K, comparer: @escaping (K, K) throws -> Bool)
-        -> Infallible<Element> {
-        Infallible(asObservable().distinctUntilChanged(keySelector, comparer: comparer))
-    }
-
-    /**
-    Returns an observable sequence that contains only contiguous elements with distinct values in the provided key path on each object.
-
-    - seealso: [distinct operator on reactivex.io](http://reactivex.io/documentation/operators/distinct.html)
-
-    - returns: An observable sequence only containing the distinct contiguous elements, based on equality operator on the provided key path
-    */
-    public func distinctUntilChanged<Property: Equatable>(at keyPath: KeyPath<Element, Property>) ->
-        Infallible<Element> {
-        Infallible(asObservable().distinctUntilChanged { $0[keyPath: keyPath] == $1[keyPath: keyPath] })
-    }
-}
-
-// MARK: - Throttle
-extension InfallibleType {
-    /**
-     Ignores elements from an observable sequence which are followed by another element within a specified relative time duration, using the specified scheduler to run throttling timers.
-
-     - seealso: [debounce operator on reactivex.io](http://reactivex.io/documentation/operators/debounce.html)
-
-     - parameter dueTime: Throttling duration for each element.
-     - parameter scheduler: Scheduler to run the throttle timers on.
-     - returns: The throttled sequence.
-     */
-    public func debounce(_ dueTime: RxTimeInterval, scheduler: SchedulerType)
-        -> Infallible<Element> {
-        Infallible(asObservable().debounce(dueTime, scheduler: scheduler))
-    }
-
-    /**
-     Returns an Observable that emits the first and the latest item emitted by the source Observable during sequential time windows of a specified duration.
-
-     This operator makes sure that no two elements are emitted in less then dueTime.
-
-     - seealso: [debounce operator on reactivex.io](http://reactivex.io/documentation/operators/debounce.html)
-
-     - parameter dueTime: Throttling duration for each element.
-     - parameter latest: Should latest element received in a dueTime wide time window since last element emission be emitted.
-     - parameter scheduler: Scheduler to run the throttle timers on.
-     - returns: The throttled sequence.
-     */
-    public func throttle(_ dueTime: RxTimeInterval, latest: Bool = true, scheduler: SchedulerType)
-        -> Infallible<Element> {
-        Infallible(asObservable().throttle(dueTime, latest: latest, scheduler: scheduler))
-    }
-}
-
-// MARK: - FlatMap
-extension InfallibleType {
-    /**
-     Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-
-     - seealso: [flatMap operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence.
-     */
-    public func flatMap<Source: ObservableConvertibleType>(_ selector: @escaping (Element) -> Source)
-        -> Infallible<Source.Element> {
-        Infallible(asObservable().flatMap(selector))
-    }
-
-    /**
-     Projects each element of an observable sequence into a new sequence of observable sequences and then
-     transforms an observable sequence of observable sequences into an observable sequence producing values only from the most recent observable sequence.
-
-     It is a combination of `map` + `switchLatest` operator
-
-     - seealso: [flatMapLatest operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the transform function on each element of source producing an
-     Observable of Observable sequences and that at any point in time produces the elements of the most recent inner observable sequence that has been received.
-     */
-    public func flatMapLatest<Source: ObservableConvertibleType>(_ selector: @escaping (Element) -> Source)
-        -> Infallible<Source.Element> {
-        Infallible(asObservable().flatMapLatest(selector))
-    }
-
-    /**
-     Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-     If element is received while there is some projected observable sequence being merged it will simply be ignored.
-
-     - seealso: [flatMapFirst operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to element that was observed while no observable is executing in parallel.
-     - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence that was received while no other sequence was being calculated.
-     */
-    public func flatMapFirst<Source: ObservableConvertibleType>(_ selector: @escaping (Element) -> Source)
-        -> Infallible<Source.Element> {
-        Infallible(asObservable().flatMapFirst(selector))
-    }
-}
-
-// MARK: - Concat
-extension InfallibleType {
-    /**
-     Concatenates the second observable sequence to `self` upon successful termination of `self`.
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - parameter second: Second observable sequence.
-     - returns: An observable sequence that contains the elements of `self`, followed by those of the second sequence.
-     */
-    public func concat<Source: ObservableConvertibleType>(_ second: Source) -> Infallible<Element> where Source.Element == Element {
-        Infallible(Observable.concat([self.asObservable(), second.asObservable()]))
-    }
-
-    /**
-     Concatenates all observable sequences in the given sequence, as long as the previous observable sequence terminated successfully.
-
-     This operator has tail recursive optimizations that will prevent stack overflow.
-
-     Optimizations will be performed in cases equivalent to following:
-
-     [1, [2, [3, .....].concat()].concat].concat()
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat<Sequence: Swift.Sequence>(_ sequence: Sequence) -> Infallible<Element>
-        where Sequence.Element == Infallible<Element> {
-        Infallible(Observable.concat(sequence.map { $0.asObservable() }))
-    }
-
-    /**
-     Concatenates all observable sequences in the given collection, as long as the previous observable sequence terminated successfully.
-
-     This operator has tail recursive optimizations that will prevent stack overflow.
-
-     Optimizations will be performed in cases equivalent to following:
-
-     [1, [2, [3, .....].concat()].concat].concat()
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat<Collection: Swift.Collection>(_ collection: Collection) -> Infallible<Element>
-        where Collection.Element == Infallible<Element> {
-        Infallible(Observable.concat(collection.map { $0.asObservable() }))
-    }
-
-    /**
-     Concatenates all observable sequences in the given collection, as long as the previous observable sequence terminated successfully.
-
-     This operator has tail recursive optimizations that will prevent stack overflow.
-
-     Optimizations will be performed in cases equivalent to following:
-
-     [1, [2, [3, .....].concat()].concat].concat()
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat(_ sources: Infallible<Element> ...) -> Infallible<Element> {
-        Infallible(Observable.concat(sources.map { $0.asObservable() }))
-    }
-
-    /**
-     Projects each element of an observable sequence to an observable sequence and concatenates the resulting observable sequences into one observable sequence.
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - returns: An observable sequence that contains the elements of each observed inner sequence, in sequential order.
-     */
-    public func concatMap<Source: ObservableConvertibleType>(_ selector: @escaping (Element) -> Source)
-        -> Infallible<Source.Element> {
-        Infallible(asObservable().concatMap(selector))
-    }
-}
-
-// MARK: - Merge
-extension InfallibleType {
-    /**
-     Merges elements from all observable sequences from collection into a single observable sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter sources: Collection of observable sequences to merge.
-     - returns: The observable sequence that merges the elements of the observable sequences.
-     */
-    public static func merge<Collection: Swift.Collection>(_ sources: Collection) -> Infallible<Element> where Collection.Element == Infallible<Element> {
-        Infallible(Observable.concat(sources.map { $0.asObservable() }))
-    }
-
-    /**
-     Merges elements from all infallible sequences from array into a single infallible sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter sources: Array of infallible sequences to merge.
-     - returns: The infallible sequence that merges the elements of the infallible sequences.
-     */
-    public static func merge(_ sources: [Infallible<Element>]) -> Infallible<Element> {
-        Infallible(Observable.merge(sources.map { $0.asObservable() }))
-    }
-
-    /**
-     Merges elements from all infallible sequences into a single infallible sequence.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-
-     - parameter sources: Collection of infallible sequences to merge.
-     - returns: The infallible sequence that merges the elements of the infallible sequences.
-     */
-    public static func merge(_ sources: Infallible<Element>...) -> Infallible<Element> {
-        Infallible(Observable.merge(sources.map { $0.asObservable() }))
-    }
-}
-
-// MARK: - Do
-
-extension Infallible {
-    /**
-     Invokes an action for each event in the infallible sequence, and propagates all observer messages through the result sequence.
-
-     - seealso: [do operator on reactivex.io](http://reactivex.io/documentation/operators/do.html)
-
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter afterNext: Action to invoke for each element after the observable has passed an onNext event along to its downstream.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter afterCompleted: Action to invoke after graceful termination of the observable sequence.
-     - parameter onSubscribe: Action to invoke before subscribing to source observable sequence.
-     - parameter onSubscribed: Action to invoke after subscribing to source observable sequence.
-     - parameter onDispose: Action to invoke after subscription to source observable has been disposed for any reason. It can be either because sequence terminates for some reason or observer subscription being disposed.
-     - returns: The source sequence with the side-effecting behavior applied.
-     */
-    public func `do`(onNext: ((Element) throws -> Void)? = nil, afterNext: ((Element) throws -> Void)? = nil, onCompleted: (() throws -> Void)? = nil, afterCompleted: (() throws -> Void)? = nil, onSubscribe: (() -> Void)? = nil, onSubscribed: (() -> Void)? = nil, onDispose: (() -> Void)? = nil) -> Infallible<Element> {
-        Infallible(asObservable().do(onNext: onNext, afterNext: afterNext, onCompleted: onCompleted, afterCompleted: afterCompleted, onSubscribe: onSubscribe, onSubscribed: onSubscribed, onDispose: onDispose))
-    }
-}
-
-// MARK: - Scan
-extension InfallibleType {
-    /**
-     Applies an accumulator function over an observable sequence and returns each intermediate result. The specified seed value is used as the initial accumulator value.
-
-     For aggregation behavior with no intermediate results, see `reduce`.
-
-     - seealso: [scan operator on reactivex.io](http://reactivex.io/documentation/operators/scan.html)
-
-     - parameter seed: The initial accumulator value.
-     - parameter accumulator: An accumulator function to be invoked on each element.
-     - returns: An observable sequence containing the accumulated values.
-     */
-    public func scan<Seed>(into seed: Seed, accumulator: @escaping (inout Seed, Element) -> Void)
-        -> Infallible<Seed> {
-        Infallible(asObservable().scan(into: seed, accumulator: accumulator))
-    }
-
-    /**
-     Applies an accumulator function over an observable sequence and returns each intermediate result. The specified seed value is used as the initial accumulator value.
-
-     For aggregation behavior with no intermediate results, see `reduce`.
-
-     - seealso: [scan operator on reactivex.io](http://reactivex.io/documentation/operators/scan.html)
-
-     - parameter seed: The initial accumulator value.
-     - parameter accumulator: An accumulator function to be invoked on each element.
-     - returns: An observable sequence containing the accumulated values.
-     */
-    public func scan<Seed>(_ seed: Seed, accumulator: @escaping (Seed, Element) -> Seed)
-        -> Infallible<Seed> {
-        Infallible(asObservable().scan(seed, accumulator: accumulator))
-    }
-}
-
-// MARK: - Start with
-
-extension InfallibleType {
-    /**
-    Prepends a value to an observable sequence.
-
-    - seealso: [startWith operator on reactivex.io](http://reactivex.io/documentation/operators/startwith.html)
-
-    - parameter element: Element to prepend to the specified sequence.
-    - returns: The source sequence prepended with the specified values.
-    */
-    public func startWith(_ element: Element) -> Infallible<Element> {
-        Infallible(asObservable().startWith(element))
-    }
-}
-
-
-
-// MARK: - Take and Skip {
-extension InfallibleType {
-    /**
-     Returns the elements from the source observable sequence until the other observable sequence produces an element.
-
-     - seealso: [takeUntil operator on reactivex.io](http://reactivex.io/documentation/operators/takeuntil.html)
-
-     - parameter other: Observable sequence that terminates propagation of elements of the source sequence.
-     - returns: An observable sequence containing the elements of the source sequence up to the point the other sequence interrupted further propagation.
-     */
-    public func take<Source: InfallibleType>(until other: Source)
-        -> Infallible<Element> {
-        Infallible(asObservable().take(until: other.asObservable()))
-    }
-
-    /**
-     Returns the elements from the source observable sequence until the other observable sequence produces an element.
-
-     - seealso: [takeUntil operator on reactivex.io](http://reactivex.io/documentation/operators/takeuntil.html)
-
-     - parameter other: Observable sequence that terminates propagation of elements of the source sequence.
-     - returns: An observable sequence containing the elements of the source sequence up to the point the other sequence interrupted further propagation.
-     */
-    public func take<Source: ObservableType>(until other: Source)
-        -> Infallible<Element> {
-        Infallible(asObservable().take(until: other))
-    }
-
-    /**
-     Returns elements from an observable sequence until the specified condition is true.
-
-     - seealso: [takeUntil operator on reactivex.io](http://reactivex.io/documentation/operators/takeuntil.html)
-
-     - parameter predicate: A function to test each element for a condition.
-     - parameter behavior: Whether or not to include the last element matching the predicate. Defaults to `exclusive`.
-
-     - returns: An observable sequence that contains the elements from the input sequence that occur before the element at which the test passes.
-     */
-    public func take(until predicate: @escaping (Element) throws -> Bool,
-                     behavior: TakeBehavior = .exclusive)
-        -> Infallible<Element> {
-        Infallible(asObservable().take(until: predicate, behavior: behavior))
-    }
-
-    /**
-     Returns elements from an observable sequence as long as a specified condition is true.
-
-     - seealso: [takeWhile operator on reactivex.io](http://reactivex.io/documentation/operators/takewhile.html)
-
-     - parameter predicate: A function to test each element for a condition.
-     - returns: An observable sequence that contains the elements from the input sequence that occur before the element at which the test no longer passes.
-     */
-    public func take(while predicate: @escaping (Element) throws -> Bool,
-                     behavior: TakeBehavior = .exclusive)
-        -> Infallible<Element> {
-        Infallible(asObservable().take(while: predicate, behavior: behavior))
-    }
-
-    /**
-     Returns a specified number of contiguous elements from the start of an observable sequence.
-
-     - seealso: [take operator on reactivex.io](http://reactivex.io/documentation/operators/take.html)
-
-     - parameter count: The number of elements to return.
-     - returns: An observable sequence that contains the specified number of elements from the start of the input sequence.
-     */
-    public func take(_ count: Int) -> Infallible<Element> {
-        Infallible(asObservable().take(count))
-    }
-
-    /**
-     Takes elements for the specified duration from the start of the infallible source sequence, using the specified scheduler to run timers.
-
-     - seealso: [take operator on reactivex.io](http://reactivex.io/documentation/operators/take.html)
-
-     - parameter duration: Duration for taking elements from the start of the sequence.
-     - parameter scheduler: Scheduler to run the timer on.
-     - returns: An infallible sequence with the elements taken during the specified duration from the start of the source sequence.
-     */
-    public func take(for duration: RxTimeInterval, scheduler: SchedulerType)
-        -> Infallible<Element> {
-        Infallible(asObservable().take(for: duration, scheduler: scheduler))
-    }
-
-    /**
-     Bypasses elements in an infallible sequence as long as a specified condition is true and then returns the remaining elements.
-
-     - seealso: [skipWhile operator on reactivex.io](http://reactivex.io/documentation/operators/skipwhile.html)
-
-     - parameter predicate: A function to test each element for a condition.
-     - returns: An infallible sequence that contains the elements from the input sequence starting at the first element in the linear series that does not pass the test specified by predicate.
-     */
-    public func skip(while predicate: @escaping (Element) throws -> Bool) -> Infallible<Element> {
-        Infallible(asObservable().skip(while: predicate))
-    }
-
-    /**
-     Returns the elements from the source infallible sequence that are emitted after the other infallible sequence produces an element.
-
-     - seealso: [skipUntil operator on reactivex.io](http://reactivex.io/documentation/operators/skipuntil.html)
-
-     - parameter other: Infallible sequence that starts propagation of elements of the source sequence.
-     - returns: An infallible sequence containing the elements of the source sequence that are emitted after the other sequence emits an item.
-     */
-    public func skip<Source: ObservableType>(until other: Source)
-        -> Infallible<Element> {
-        Infallible(asObservable().skip(until: other))
-    }
-}
-
-// MARK: - Share
-extension InfallibleType {
-    /**
-     Returns an observable sequence that **shares a single subscription to the underlying sequence**, and immediately upon subscription replays  elements in buffer.
-
-     This operator is equivalent to:
-     * `.whileConnected`
-     ```
-     // Each connection will have it's own subject instance to store replay events.
-     // Connections will be isolated from each another.
-     source.multicast(makeSubject: { Replay.create(bufferSize: replay) }).refCount()
-     ```
-     * `.forever`
-     ```
-     // One subject will store replay events for all connections to source.
-     // Connections won't be isolated from each another.
-     source.multicast(Replay.create(bufferSize: replay)).refCount()
-     ```
-
-     It uses optimized versions of the operators for most common operations.
-
-     - parameter replay: Maximum element count of the replay buffer.
-     - parameter scope: Lifetime scope of sharing subject. For more information see `SubjectLifetimeScope` enum.
-
-     - seealso: [shareReplay operator on reactivex.io](http://reactivex.io/documentation/operators/replay.html)
-
-     - returns: An observable sequence that contains the elements of a sequence produced by multicasting the source sequence.
-     */
-    public func share(replay: Int = 0, scope: SubjectLifetimeScope = .whileConnected)
-        -> Infallible<Element> {
-        Infallible(asObservable().share(replay: replay, scope: scope))
-    }
-}
-
-// MARK: - withUnretained
-extension InfallibleType {
-    /**
-     Provides an unretained, safe to use (i.e. not implicitly unwrapped), reference to an object along with the events emitted by the sequence.
-     
-     In the case the provided object cannot be retained successfully, the seqeunce will complete.
-     
-     - note: Be careful when using this operator in a sequence that has a buffer or replay, for example `share(replay: 1)`, as the sharing buffer will also include the provided object, which could potentially cause a retain cycle.
-     
-     - parameter obj: The object to provide an unretained reference on.
-     - parameter resultSelector: A function to combine the unretained referenced on `obj` and the value of the observable sequence.
-     - returns: An observable sequence that contains the result of `resultSelector` being called with an unretained reference on `obj` and the values of the original sequence.
-     */
-    public func withUnretained<Object: AnyObject, Out>(
-        _ obj: Object,
-        resultSelector: @escaping (Object, Element) -> Out
-    ) -> Infallible<Out> {
-        Infallible(self.asObservable().withUnretained(obj, resultSelector: resultSelector))
-    }
-    
-    /**
-     Provides an unretained, safe to use (i.e. not implicitly unwrapped), reference to an object along with the events emitted by the sequence.
-     
-     In the case the provided object cannot be retained successfully, the seqeunce will complete.
-     
-     - note: Be careful when using this operator in a sequence that has a buffer or replay, for example `share(replay: 1)`, as the sharing buffer will also include the provided object, which could potentially cause a retain cycle.
-     
-     - parameter obj: The object to provide an unretained reference on.
-     - returns: An observable sequence of tuples that contains both an unretained reference on `obj` and the values of the original sequence.
-     */
-    public func withUnretained<Object: AnyObject>(_ obj: Object) -> Infallible<(Object, Element)> {
-        withUnretained(obj) { ($0, $1) }
-    }
-}
-
-extension InfallibleType {
-    // MARK: - withLatestFrom
-    /**
-     Merges two observable sequences into one observable sequence by combining each element from self with the latest element from the second source, if any.
-
-     - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-     - note: Elements emitted by self before the second source has emitted any values will be omitted.
-
-     - parameter second: Second observable source.
-     - parameter resultSelector: Function to invoke for each element from the self combined with the latest element from the second source, if any.
-     - returns: An observable sequence containing the result of combining each element of the self  with the latest element from the second source, if any, using the specified result selector function.
-     */
-    public func withLatestFrom<Source: InfallibleType, ResultType>(_ second: Source, resultSelector: @escaping (Element, Source.Element) throws -> ResultType) -> Infallible<ResultType> {
-        Infallible(self.asObservable().withLatestFrom(second.asObservable(), resultSelector: resultSelector))
-    }
-
-    /**
-     Merges two observable sequences into one observable sequence by using latest element from the second sequence every time when `self` emits an element.
-
-     - seealso: [combineLatest operator on reactivex.io](http://reactivex.io/documentation/operators/combinelatest.html)
-     - note: Elements emitted by self before the second source has emitted any values will be omitted.
-
-     - parameter second: Second observable source.
-     - returns: An observable sequence containing the result of combining each element of the self  with the latest element from the second source, if any, using the specified result selector function.
-     */
-    public func withLatestFrom<Source: InfallibleType>(_ second: Source) -> Infallible<Source.Element> {
-        withLatestFrom(second) { $1 }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+Zip+arity.swift b/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+Zip+arity.swift
deleted file mode 100644
index 02eb4f641..000000000
--- a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible+Zip+arity.swift
+++ /dev/null
@@ -1,138 +0,0 @@
-// This file is autogenerated. Take a look at `Preprocessor` target in RxSwift project 
-//
-//  Infallible+Zip+arity.swift
-//  RxSwift
-//
-//  Created by Shai Mishali on 27/8/20.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-// MARK: - Zip
-
-
-// 2
-extension InfallibleType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2>(_ source1: Infallible<E1>, _ source2: Infallible<E2>, resultSelector: @escaping (E1, E2) throws -> Element)
-        -> Infallible<Element> {
-        Infallible(
-            Observable.zip(source1.asObservable(), source2.asObservable(), resultSelector: resultSelector)
-        )
-    }
-}
-
-// 3
-extension InfallibleType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3>(_ source1: Infallible<E1>, _ source2: Infallible<E2>, _ source3: Infallible<E3>, resultSelector: @escaping (E1, E2, E3) throws -> Element)
-        -> Infallible<Element> {
-        Infallible(
-            Observable.zip(source1.asObservable(), source2.asObservable(), source3.asObservable(), resultSelector: resultSelector)
-        )
-    }
-}
-
-// 4
-extension InfallibleType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4>(_ source1: Infallible<E1>, _ source2: Infallible<E2>, _ source3: Infallible<E3>, _ source4: Infallible<E4>, resultSelector: @escaping (E1, E2, E3, E4) throws -> Element)
-        -> Infallible<Element> {
-        Infallible(
-            Observable.zip(source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), resultSelector: resultSelector)
-        )
-    }
-}
-
-// 5
-extension InfallibleType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5>(_ source1: Infallible<E1>, _ source2: Infallible<E2>, _ source3: Infallible<E3>, _ source4: Infallible<E4>, _ source5: Infallible<E5>, resultSelector: @escaping (E1, E2, E3, E4, E5) throws -> Element)
-        -> Infallible<Element> {
-        Infallible(
-            Observable.zip(source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), resultSelector: resultSelector)
-        )
-    }
-}
-
-// 6
-extension InfallibleType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6>(_ source1: Infallible<E1>, _ source2: Infallible<E2>, _ source3: Infallible<E3>, _ source4: Infallible<E4>, _ source5: Infallible<E5>, _ source6: Infallible<E6>, resultSelector: @escaping (E1, E2, E3, E4, E5, E6) throws -> Element)
-        -> Infallible<Element> {
-        Infallible(
-            Observable.zip(source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), resultSelector: resultSelector)
-        )
-    }
-}
-
-// 7
-extension InfallibleType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7>(_ source1: Infallible<E1>, _ source2: Infallible<E2>, _ source3: Infallible<E3>, _ source4: Infallible<E4>, _ source5: Infallible<E5>, _ source6: Infallible<E6>, _ source7: Infallible<E7>, resultSelector: @escaping (E1, E2, E3, E4, E5, E6, E7) throws -> Element)
-        -> Infallible<Element> {
-        Infallible(
-            Observable.zip(source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable(), resultSelector: resultSelector)
-        )
-    }
-}
-
-// 8
-extension InfallibleType {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7, E8>(_ source1: Infallible<E1>, _ source2: Infallible<E2>, _ source3: Infallible<E3>, _ source4: Infallible<E4>, _ source5: Infallible<E5>, _ source6: Infallible<E6>, _ source7: Infallible<E7>, _ source8: Infallible<E8>, resultSelector: @escaping (E1, E2, E3, E4, E5, E6, E7, E8) throws -> Element)
-        -> Infallible<Element> {
-        Infallible(
-            Observable.zip(source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable(), source8.asObservable(), resultSelector: resultSelector)
-        )
-    }
-}
-
diff --git a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible.swift b/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible.swift
deleted file mode 100644
index ae563c656..000000000
--- a/Pods/RxSwift/RxSwift/Traits/Infallible/Infallible.swift
+++ /dev/null
@@ -1,92 +0,0 @@
-//
-//  Infallible.swift
-//  RxSwift
-//
-//  Created by Shai Mishali on 27/08/2020.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-/// `Infallible` is an `Observable`-like push-style interface
-/// which is guaranteed to not emit error events.
-///
-/// Unlike `SharedSequence`, it does not share its resources or
-/// replay its events, but acts as a standard `Observable`.
-public protocol InfallibleType: ObservableConvertibleType {}
-
-/// `Infallible` is an `Observable`-like push-style interface
-/// which is guaranteed to not emit error events.
-///
-/// Unlike `SharedSequence`, it does not share its resources or
-/// replay its events, but acts as a standard `Observable`.
-public struct Infallible<Element>: InfallibleType {
-    private let source: Observable<Element>
-
-    init(_ source: Observable<Element>) {
-        self.source = source
-    }
-
-    public func asObservable() -> Observable<Element> { source }
-}
-
-extension InfallibleType {
-    /**
-     Subscribes an element handler, a completion handler and disposed handler to an observable sequence.
-     
-     Error callback is not exposed because `Infallible` can't error out.
-     
-     Also, take in an object and provide an unretained, safe to use (i.e. not implicitly unwrapped), reference to it along with the events emitted by the sequence.
-     
-     - Note: If `object` can't be retained, none of the other closures will be invoked.
-     
-     - parameter object: The object to provide an unretained reference on.
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     gracefully completed, errored, or if the generation is canceled by disposing subscription)
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription)
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe<Object: AnyObject>(
-        with object: Object,
-        onNext: ((Object, Element) -> Void)? = nil,
-        onCompleted: ((Object) -> Void)? = nil,
-        onDisposed: ((Object) -> Void)? = nil
-    ) -> Disposable {
-        self.asObservable().subscribe(
-            with: object,
-            onNext: onNext,
-            onCompleted: onCompleted,
-            onDisposed: onDisposed
-        )
-    }
-    
-    /**
-     Subscribes an element handler, a completion handler and disposed handler to an observable sequence.
-     
-     Error callback is not exposed because `Infallible` can't error out.
-     
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     gracefully completed, errored, or if the generation is canceled by disposing subscription)
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription)
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-    */
-    public func subscribe(onNext: ((Element) -> Void)? = nil,
-                          onCompleted: (() -> Void)? = nil,
-                          onDisposed: (() -> Void)? = nil) -> Disposable {
-        self.asObservable().subscribe(onNext: onNext,
-                                      onCompleted: onCompleted,
-                                      onDisposed: onDisposed)
-    }
-
-    /**
-     Subscribes an event handler to an observable sequence.
-     
-     - parameter on: Action to invoke for each event in the observable sequence.
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe(_ on: @escaping (Event<Element>) -> Void) -> Disposable {
-        self.asObservable().subscribe(on)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/Infallible/ObservableConvertibleType+Infallible.swift b/Pods/RxSwift/RxSwift/Traits/Infallible/ObservableConvertibleType+Infallible.swift
deleted file mode 100644
index d54d28da3..000000000
--- a/Pods/RxSwift/RxSwift/Traits/Infallible/ObservableConvertibleType+Infallible.swift
+++ /dev/null
@@ -1,35 +0,0 @@
-//
-//  ObservableConvertibleType+Infallible.swift
-//  RxSwift
-//
-//  Created by Shai Mishali on 27/08/2020.
-//  Copyright © 2020 Krunoslav Zaher. All rights reserved.
-//
-
-public extension ObservableConvertibleType {
-    /// Convert to an `Infallible`
-    ///
-    /// - returns: `Infallible<Element>`
-    func asInfallible(onErrorJustReturn element: Element) -> Infallible<Element> {
-        Infallible(self.asObservable().catchAndReturn(element))
-    }
-
-    /// Convert to an `Infallible`
-    ///
-    /// - parameter onErroFallbackTo: Fall back to this provided infallible on error
-    ///
-    ///
-    /// - returns: `Infallible<Element>`
-    func asInfallible(onErrorFallbackTo infallible: Infallible<Element>) -> Infallible<Element> {
-        Infallible(self.asObservable().catch { _ in infallible.asObservable() })
-    }
-
-    /// Convert to an `Infallible`
-    ///
-    /// - parameter onErrorRecover: Recover with the this infallible closure
-    ///
-    /// - returns: `Infallible<Element>`
-    func asInfallible(onErrorRecover: @escaping (Swift.Error) -> Infallible<Element>) -> Infallible<Element> {
-        Infallible(asObservable().catch { onErrorRecover($0).asObservable() })
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Completable+AndThen.swift b/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Completable+AndThen.swift
deleted file mode 100644
index f63c3f17f..000000000
--- a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Completable+AndThen.swift
+++ /dev/null
@@ -1,132 +0,0 @@
-//
-//  Completable+AndThen.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 7/2/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-extension PrimitiveSequenceType where Trait == CompletableTrait, Element == Never {
-    /**
-     Concatenates the second observable sequence to `self` upon successful termination of `self`.
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - parameter second: Second observable sequence.
-     - returns: An observable sequence that contains the elements of `self`, followed by those of the second sequence.
-     */
-    public func andThen<Element>(_ second: Single<Element>) -> Single<Element> {
-        let completable = self.primitiveSequence.asObservable()
-        return Single(raw: ConcatCompletable(completable: completable, second: second.asObservable()))
-    }
-
-    /**
-     Concatenates the second observable sequence to `self` upon successful termination of `self`.
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - parameter second: Second observable sequence.
-     - returns: An observable sequence that contains the elements of `self`, followed by those of the second sequence.
-     */
-    public func andThen<Element>(_ second: Maybe<Element>) -> Maybe<Element> {
-        let completable = self.primitiveSequence.asObservable()
-        return Maybe(raw: ConcatCompletable(completable: completable, second: second.asObservable()))
-    }
-
-    /**
-     Concatenates the second observable sequence to `self` upon successful termination of `self`.
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - parameter second: Second observable sequence.
-     - returns: An observable sequence that contains the elements of `self`, followed by those of the second sequence.
-     */
-    public func andThen(_ second: Completable) -> Completable {
-        let completable = self.primitiveSequence.asObservable()
-        return Completable(raw: ConcatCompletable(completable: completable, second: second.asObservable()))
-    }
-
-    /**
-     Concatenates the second observable sequence to `self` upon successful termination of `self`.
-
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-
-     - parameter second: Second observable sequence.
-     - returns: An observable sequence that contains the elements of `self`, followed by those of the second sequence.
-     */
-    public func andThen<Element>(_ second: Observable<Element>) -> Observable<Element> {
-        let completable = self.primitiveSequence.asObservable()
-        return ConcatCompletable(completable: completable, second: second.asObservable())
-    }
-}
-
-final private class ConcatCompletable<Element>: Producer<Element> {
-    fileprivate let completable: Observable<Never>
-    fileprivate let second: Observable<Element>
-
-    init(completable: Observable<Never>, second: Observable<Element>) {
-        self.completable = completable
-        self.second = second
-    }
-
-    override func run<Observer: ObserverType>(_ observer: Observer, cancel: Cancelable) -> (sink: Disposable, subscription: Disposable) where Observer.Element == Element {
-        let sink = ConcatCompletableSink(parent: self, observer: observer, cancel: cancel)
-        let subscription = sink.run()
-        return (sink: sink, subscription: subscription)
-    }
-}
-
-final private class ConcatCompletableSink<Observer: ObserverType>
-    : Sink<Observer>
-    , ObserverType {
-    typealias Element = Never
-    typealias Parent = ConcatCompletable<Observer.Element>
-
-    private let parent: Parent
-    private let subscription = SerialDisposable()
-    
-    init(parent: Parent, observer: Observer, cancel: Cancelable) {
-        self.parent = parent
-        super.init(observer: observer, cancel: cancel)
-    }
-
-    func on(_ event: Event<Element>) {
-        switch event {
-        case .error(let error):
-            self.forwardOn(.error(error))
-            self.dispose()
-        case .next:
-            break
-        case .completed:
-            let otherSink = ConcatCompletableSinkOther(parent: self)
-            self.subscription.disposable = self.parent.second.subscribe(otherSink)
-        }
-    }
-
-    func run() -> Disposable {
-        let subscription = SingleAssignmentDisposable()
-        self.subscription.disposable = subscription
-        subscription.setDisposable(self.parent.completable.subscribe(self))
-        return self.subscription
-    }
-}
-
-final private class ConcatCompletableSinkOther<Observer: ObserverType>
-    : ObserverType {
-    typealias Element = Observer.Element 
-
-    typealias Parent = ConcatCompletableSink<Observer>
-    
-    private let parent: Parent
-
-    init(parent: Parent) {
-        self.parent = parent
-    }
-
-    func on(_ event: Event<Observer.Element>) {
-        self.parent.forwardOn(event)
-        if event.isStopEvent {
-            self.parent.dispose()
-        }
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Completable.swift b/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Completable.swift
deleted file mode 100644
index ff8fae21a..000000000
--- a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Completable.swift
+++ /dev/null
@@ -1,320 +0,0 @@
-//
-//  Completable.swift
-//  RxSwift
-//
-//  Created by sergdort on 19/08/2017.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-#if DEBUG
-import Foundation
-#endif
-
-/// Sequence containing 0 elements
-public enum CompletableTrait { }
-/// Represents a push style sequence containing 0 elements.
-public typealias Completable = PrimitiveSequence<CompletableTrait, Swift.Never>
-
-@frozen public enum CompletableEvent {
-    /// Sequence terminated with an error. (underlying observable sequence emits: `.error(Error)`)
-    case error(Swift.Error)
-    
-    /// Sequence completed successfully.
-    case completed
-}
-
-extension PrimitiveSequenceType where Trait == CompletableTrait, Element == Swift.Never {
-    public typealias CompletableObserver = (CompletableEvent) -> Void
-    
-    /**
-     Creates an observable sequence from a specified subscribe method implementation.
-     
-     - seealso: [create operator on reactivex.io](http://reactivex.io/documentation/operators/create.html)
-     
-     - parameter subscribe: Implementation of the resulting observable sequence's `subscribe` method.
-     - returns: The observable sequence with the specified implementation for the `subscribe` method.
-     */
-    public static func create(subscribe: @escaping (@escaping CompletableObserver) -> Disposable) -> PrimitiveSequence<Trait, Element> {
-        let source = Observable<Element>.create { observer in
-            return subscribe { event in
-                switch event {
-                case .error(let error):
-                    observer.on(.error(error))
-                case .completed:
-                    observer.on(.completed)
-                }
-            }
-        }
-        
-        return PrimitiveSequence(raw: source)
-    }
-    
-    /**
-     Subscribes `observer` to receive events for this sequence.
-     
-     - returns: Subscription for `observer` that can be used to cancel production of sequence elements and free resources.
-     */
-    public func subscribe(_ observer: @escaping (CompletableEvent) -> Void) -> Disposable {
-        var stopped = false
-        return self.primitiveSequence.asObservable().subscribe { event in
-            if stopped { return }
-            stopped = true
-            
-            switch event {
-            case .next:
-                rxFatalError("Completables can't emit values")
-            case .error(let error):
-                observer(.error(error))
-            case .completed:
-                observer(.completed)
-            }
-        }
-    }
-    
-    /**
-     Subscribes a completion handler and an error handler for this sequence.
-     
-     Also, take in an object and provide an unretained, safe to use (i.e. not implicitly unwrapped), reference to it along with the events emitted by the sequence.
-     
-     - Note: If `object` can't be retained, none of the other closures will be invoked.
-     
-     - parameter object: The object to provide an unretained reference on.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription).
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe<Object: AnyObject>(
-        with object: Object,
-        onCompleted: ((Object) -> Void)? = nil,
-        onError: ((Object, Swift.Error) -> Void)? = nil,
-        onDisposed: ((Object) -> Void)? = nil
-    ) -> Disposable {
-        subscribe(
-            onCompleted: { [weak object] in
-                guard let object = object else { return }
-                onCompleted?(object)
-            }, onError: { [weak object] in
-                guard let object = object else { return }
-                onError?(object, $0)
-            }, onDisposed: { [weak object] in
-                guard let object = object else { return }
-                onDisposed?(object)
-            }
-        )
-    }
-    
-    /**
-     Subscribes a completion handler and an error handler for this sequence.
-     
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription).
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe(onCompleted: (() -> Void)? = nil,
-                          onError: ((Swift.Error) -> Void)? = nil,
-                          onDisposed: (() -> Void)? = nil) -> Disposable {
-        #if DEBUG
-                let callStack = Hooks.recordCallStackOnError ? Thread.callStackSymbols : []
-        #else
-                let callStack = [String]()
-        #endif
-
-        let disposable: Disposable
-        if let onDisposed = onDisposed {
-            disposable = Disposables.create(with: onDisposed)
-        } else {
-            disposable = Disposables.create()
-        }
-
-        let observer: CompletableObserver = { event in
-            switch event {
-            case .error(let error):
-                if let onError = onError {
-                    onError(error)
-                } else {
-                    Hooks.defaultErrorHandler(callStack, error)
-                }
-                disposable.dispose()
-            case .completed:
-                onCompleted?()
-                disposable.dispose()
-            }
-        }
-
-        return Disposables.create(
-            self.primitiveSequence.subscribe(observer),
-            disposable
-        )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == CompletableTrait, Element == Swift.Never {
-    /**
-     Returns an observable sequence that terminates with an `error`.
-
-     - seealso: [throw operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: The observable sequence that terminates with specified error.
-     */
-    public static func error(_ error: Swift.Error) -> Completable {
-        PrimitiveSequence(raw: Observable.error(error))
-    }
-
-    /**
-     Returns a non-terminating observable sequence, which can be used to denote an infinite duration.
-
-     - seealso: [never operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: An observable sequence whose observers will never get called.
-     */
-    public static func never() -> Completable {
-        PrimitiveSequence(raw: Observable.never())
-    }
-
-    /**
-     Returns an empty observable sequence, using the specified scheduler to send out the single `Completed` message.
-
-     - seealso: [empty operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: An observable sequence with no elements.
-     */
-    public static func empty() -> Completable {
-        Completable(raw: Observable.empty())
-    }
-
-}
-
-extension PrimitiveSequenceType where Trait == CompletableTrait, Element == Swift.Never {
-    /**
-     Invokes an action for each event in the observable sequence, and propagates all observer messages through the result sequence.
-     
-     - seealso: [do operator on reactivex.io](http://reactivex.io/documentation/operators/do.html)
-     
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter afterError: Action to invoke after errored termination of the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter afterCompleted: Action to invoke after graceful termination of the observable sequence.
-     - parameter onSubscribe: Action to invoke before subscribing to source observable sequence.
-     - parameter onSubscribed: Action to invoke after subscribing to source observable sequence.
-     - parameter onDispose: Action to invoke after subscription to source observable has been disposed for any reason. It can be either because sequence terminates for some reason or observer subscription being disposed.
-     - returns: The source sequence with the side-effecting behavior applied.
-     */
-    public func `do`(onError: ((Swift.Error) throws -> Void)? = nil,
-                     afterError: ((Swift.Error) throws -> Void)? = nil,
-                     onCompleted: (() throws -> Void)? = nil,
-                     afterCompleted: (() throws -> Void)? = nil,
-                     onSubscribe: (() -> Void)? = nil,
-                     onSubscribed: (() -> Void)? = nil,
-                     onDispose: (() -> Void)? = nil)
-        -> Completable {
-            return Completable(raw: self.primitiveSequence.source.do(
-                onError: onError,
-                afterError: afterError,
-                onCompleted: onCompleted,
-                afterCompleted: afterCompleted,
-                onSubscribe: onSubscribe,
-                onSubscribed: onSubscribed,
-                onDispose: onDispose)
-            )
-    }
-
-
-
-    /**
-     Concatenates the second observable sequence to `self` upon successful termination of `self`.
-     
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-     
-     - parameter second: Second observable sequence.
-     - returns: An observable sequence that contains the elements of `self`, followed by those of the second sequence.
-     */
-    public func concat(_ second: Completable) -> Completable {
-        Completable.concat(self.primitiveSequence, second)
-    }
-    
-    /**
-     Concatenates all observable sequences in the given sequence, as long as the previous observable sequence terminated successfully.
-     
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-     
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat<Sequence: Swift.Sequence>(_ sequence: Sequence) -> Completable
-        where Sequence.Element == Completable {
-            let source = Observable.concat(sequence.lazy.map { $0.asObservable() })
-            return Completable(raw: source)
-    }
-    
-    /**
-     Concatenates all observable sequences in the given sequence, as long as the previous observable sequence terminated successfully.
-     
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-     
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat<Collection: Swift.Collection>(_ collection: Collection) -> Completable
-        where Collection.Element == Completable {
-            let source = Observable.concat(collection.map { $0.asObservable() })
-            return Completable(raw: source)
-    }
-    
-    /**
-     Concatenates all observable sequences in the given sequence, as long as the previous observable sequence terminated successfully.
-     
-     - seealso: [concat operator on reactivex.io](http://reactivex.io/documentation/operators/concat.html)
-     
-     - returns: An observable sequence that contains the elements of each given sequence, in sequential order.
-     */
-    public static func concat(_ sources: Completable ...) -> Completable {
-        let source = Observable.concat(sources.map { $0.asObservable() })
-        return Completable(raw: source)
-    }
-
-    /**
-     Merges the completion of all Completables from a collection into a single Completable.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-     - note: For `Completable`, `zip` is an alias for `merge`.
-
-     - parameter sources: Collection of Completables to merge.
-     - returns: A Completable that merges the completion of all Completables.
-     */
-    public static func zip<Collection: Swift.Collection>(_ sources: Collection) -> Completable
-           where Collection.Element == Completable {
-        let source = Observable.merge(sources.map { $0.asObservable() })
-        return Completable(raw: source)
-    }
-
-    /**
-     Merges the completion of all Completables from an array into a single Completable.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-     - note: For `Completable`, `zip` is an alias for `merge`.
-
-     - parameter sources: Array of observable sequences to merge.
-     - returns: A Completable that merges the completion of all Completables.
-     */
-    public static func zip(_ sources: [Completable]) -> Completable {
-        let source = Observable.merge(sources.map { $0.asObservable() })
-        return Completable(raw: source)
-    }
-
-    /**
-     Merges the completion of all Completables into a single Completable.
-
-     - seealso: [merge operator on reactivex.io](http://reactivex.io/documentation/operators/merge.html)
-     - note: For `Completable`, `zip` is an alias for `merge`.
-
-     - parameter sources: Collection of observable sequences to merge.
-     - returns: The observable sequence that merges the elements of the observable sequences.
-     */
-    public static func zip(_ sources: Completable...) -> Completable {
-        let source = Observable.merge(sources.map { $0.asObservable() })
-        return Completable(raw: source)
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Maybe.swift b/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Maybe.swift
deleted file mode 100644
index 3692eb163..000000000
--- a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Maybe.swift
+++ /dev/null
@@ -1,387 +0,0 @@
-//
-//  Maybe.swift
-//  RxSwift
-//
-//  Created by sergdort on 19/08/2017.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-#if DEBUG
-import Foundation
-#endif
-
-/// Sequence containing 0 or 1 elements
-public enum MaybeTrait { }
-/// Represents a push style sequence containing 0 or 1 element.
-public typealias Maybe<Element> = PrimitiveSequence<MaybeTrait, Element>
-
-@frozen public enum MaybeEvent<Element> {
-    /// One and only sequence element is produced. (underlying observable sequence emits: `.next(Element)`, `.completed`)
-    case success(Element)
-    
-    /// Sequence terminated with an error. (underlying observable sequence emits: `.error(Error)`)
-    case error(Swift.Error)
-    
-    /// Sequence completed successfully.
-    case completed
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    public typealias MaybeObserver = (MaybeEvent<Element>) -> Void
-    
-    /**
-     Creates an observable sequence from a specified subscribe method implementation.
-     
-     - seealso: [create operator on reactivex.io](http://reactivex.io/documentation/operators/create.html)
-     
-     - parameter subscribe: Implementation of the resulting observable sequence's `subscribe` method.
-     - returns: The observable sequence with the specified implementation for the `subscribe` method.
-     */
-    public static func create(subscribe: @escaping (@escaping MaybeObserver) -> Disposable) -> PrimitiveSequence<Trait, Element> {
-        let source = Observable<Element>.create { observer in
-            return subscribe { event in
-                switch event {
-                case .success(let element):
-                    observer.on(.next(element))
-                    observer.on(.completed)
-                case .error(let error):
-                    observer.on(.error(error))
-                case .completed:
-                    observer.on(.completed)
-                }
-            }
-        }
-        
-        return PrimitiveSequence(raw: source)
-    }
-    
-    /**
-     Subscribes `observer` to receive events for this sequence.
-     
-     - returns: Subscription for `observer` that can be used to cancel production of sequence elements and free resources.
-     */
-    public func subscribe(_ observer: @escaping (MaybeEvent<Element>) -> Void) -> Disposable {
-        var stopped = false
-        return self.primitiveSequence.asObservable().subscribe { event in
-            if stopped { return }
-            stopped = true
-            
-            switch event {
-            case .next(let element):
-                observer(.success(element))
-            case .error(let error):
-                observer(.error(error))
-            case .completed:
-                observer(.completed)
-            }
-        }
-    }
-    
-    /**
-     Subscribes a success handler, an error handler, and a completion handler for this sequence.
-     
-     Also, take in an object and provide an unretained, safe to use (i.e. not implicitly unwrapped), reference to it along with the events emitted by the sequence.
-     
-     - Note: If `object` can't be retained, none of the other closures will be invoked.
-     
-     - parameter object: The object to provide an unretained reference on.
-     - parameter onSuccess: Action to invoke for each element in the observable sequence.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription).
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe<Object: AnyObject>(
-        with object: Object,
-        onSuccess: ((Object, Element) -> Void)? = nil,
-        onError: ((Object, Swift.Error) -> Void)? = nil,
-        onCompleted: ((Object) -> Void)? = nil,
-        onDisposed: ((Object) -> Void)? = nil
-    ) -> Disposable {
-        subscribe(
-            onSuccess: { [weak object] in
-                guard let object = object else { return }
-                onSuccess?(object, $0)
-            },
-            onError: { [weak object] in
-                guard let object = object else { return }
-                onError?(object, $0)
-            },
-            onCompleted: { [weak object] in
-                guard let object = object else { return }
-                onCompleted?(object)
-            },
-            onDisposed: { [weak object] in
-                guard let object = object else { return }
-                onDisposed?(object)
-            }
-        )
-    }
-    
-    /**
-     Subscribes a success handler, an error handler, and a completion handler for this sequence.
-     
-     - parameter onSuccess: Action to invoke for each element in the observable sequence.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription).
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe(onSuccess: ((Element) -> Void)? = nil,
-                          onError: ((Swift.Error) -> Void)? = nil,
-                          onCompleted: (() -> Void)? = nil,
-                          onDisposed: (() -> Void)? = nil) -> Disposable {
-        #if DEBUG
-            let callStack = Hooks.recordCallStackOnError ? Thread.callStackSymbols : []
-        #else
-            let callStack = [String]()
-        #endif
-        let disposable: Disposable
-        if let onDisposed = onDisposed {
-            disposable = Disposables.create(with: onDisposed)
-        } else {
-            disposable = Disposables.create()
-        }
-
-        let observer: MaybeObserver = { event in
-            switch event {
-            case .success(let element):
-                onSuccess?(element)
-                disposable.dispose()
-            case .error(let error):
-                if let onError = onError {
-                    onError(error)
-                } else {
-                    Hooks.defaultErrorHandler(callStack, error)
-                }
-                disposable.dispose()
-            case .completed:
-                onCompleted?()
-                disposable.dispose()
-            }
-        }
-
-        return Disposables.create(
-            self.primitiveSequence.subscribe(observer),
-            disposable
-        )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    /**
-     Returns an observable sequence that contains a single element.
-     
-     - seealso: [just operator on reactivex.io](http://reactivex.io/documentation/operators/just.html)
-     
-     - parameter element: Single element in the resulting observable sequence.
-     - returns: An observable sequence containing the single specified element.
-     */
-    public static func just(_ element: Element) -> Maybe<Element> {
-        Maybe(raw: Observable.just(element))
-    }
-    
-    /**
-     Returns an observable sequence that contains a single element.
-     
-     - seealso: [just operator on reactivex.io](http://reactivex.io/documentation/operators/just.html)
-     
-     - parameter element: Single element in the resulting observable sequence.
-     - parameter scheduler: Scheduler to send the single element on.
-     - returns: An observable sequence containing the single specified element.
-     */
-    public static func just(_ element: Element, scheduler: ImmediateSchedulerType) -> Maybe<Element> {
-        Maybe(raw: Observable.just(element, scheduler: scheduler))
-    }
-
-    /**
-     Returns an observable sequence that terminates with an `error`.
-
-     - seealso: [throw operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: The observable sequence that terminates with specified error.
-     */
-    public static func error(_ error: Swift.Error) -> Maybe<Element> {
-        PrimitiveSequence(raw: Observable.error(error))
-    }
-
-    /**
-     Returns a non-terminating observable sequence, which can be used to denote an infinite duration.
-
-     - seealso: [never operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: An observable sequence whose observers will never get called.
-     */
-    public static func never() -> Maybe<Element> {
-        PrimitiveSequence(raw: Observable.never())
-    }
-
-    /**
-     Returns an empty observable sequence, using the specified scheduler to send out the single `Completed` message.
-
-     - seealso: [empty operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: An observable sequence with no elements.
-     */
-    public static func empty() -> Maybe<Element> {
-        Maybe(raw: Observable.empty())
-    }
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    /**
-     Invokes an action for each event in the observable sequence, and propagates all observer messages through the result sequence.
-     
-     - seealso: [do operator on reactivex.io](http://reactivex.io/documentation/operators/do.html)
-     
-     - parameter onNext: Action to invoke for each element in the observable sequence.
-     - parameter afterNext: Action to invoke for each element after the observable has passed an onNext event along to its downstream.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter afterError: Action to invoke after errored termination of the observable sequence.
-     - parameter onCompleted: Action to invoke upon graceful termination of the observable sequence.
-     - parameter afterCompleted: Action to invoke after graceful termination of the observable sequence.
-     - parameter onSubscribe: Action to invoke before subscribing to source observable sequence.
-     - parameter onSubscribed: Action to invoke after subscribing to source observable sequence.
-     - parameter onDispose: Action to invoke after subscription to source observable has been disposed for any reason. It can be either because sequence terminates for some reason or observer subscription being disposed.
-     - returns: The source sequence with the side-effecting behavior applied.
-     */
-    public func `do`(onNext: ((Element) throws -> Void)? = nil,
-                     afterNext: ((Element) throws -> Void)? = nil,
-                     onError: ((Swift.Error) throws -> Void)? = nil,
-                     afterError: ((Swift.Error) throws -> Void)? = nil,
-                     onCompleted: (() throws -> Void)? = nil,
-                     afterCompleted: (() throws -> Void)? = nil,
-                     onSubscribe: (() -> Void)? = nil,
-                     onSubscribed: (() -> Void)? = nil,
-                     onDispose: (() -> Void)? = nil)
-        -> Maybe<Element> {
-            return Maybe(raw: self.primitiveSequence.source.do(
-                onNext: onNext,
-                afterNext: afterNext,
-                onError: onError,
-                afterError: afterError,
-                onCompleted: onCompleted,
-                afterCompleted: afterCompleted,
-                onSubscribe: onSubscribe,
-                onSubscribed: onSubscribed,
-                onDispose: onDispose)
-            )
-    }
-    
-    /**
-     Filters the elements of an observable sequence based on a predicate.
-     
-     - seealso: [filter operator on reactivex.io](http://reactivex.io/documentation/operators/filter.html)
-     
-     - parameter predicate: A function to test each source element for a condition.
-     - returns: An observable sequence that contains elements from the input sequence that satisfy the condition.
-     */
-    public func filter(_ predicate: @escaping (Element) throws -> Bool)
-        -> Maybe<Element> {
-            return Maybe(raw: self.primitiveSequence.source.filter(predicate))
-    }
-    
-    /**
-     Projects each element of an observable sequence into a new form.
-     
-     - seealso: [map operator on reactivex.io](http://reactivex.io/documentation/operators/map.html)
-     
-     - parameter transform: A transform function to apply to each source element.
-     - returns: An observable sequence whose elements are the result of invoking the transform function on each element of source.
-     
-     */
-    public func map<Result>(_ transform: @escaping (Element) throws -> Result)
-        -> Maybe<Result> {
-            return Maybe(raw: self.primitiveSequence.source.map(transform))
-    }
-
-    /**
-     Projects each element of an observable sequence into an optional form and filters all optional results.
-     
-     - parameter transform: A transform function to apply to each source element.
-     - returns: An observable sequence whose elements are the result of filtering the transform function for each element of the source.
-     
-     */
-    public func compactMap<Result>(_ transform: @escaping (Element) throws -> Result?)
-        -> Maybe<Result> {
-        Maybe(raw: self.primitiveSequence.source.compactMap(transform))
-    }
-
-    /**
-     Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-
-     - seealso: [flatMap operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence.
-     */
-    public func flatMap<Result>(_ selector: @escaping (Element) throws -> Maybe<Result>)
-        -> Maybe<Result> {
-            return Maybe<Result>(raw: self.primitiveSequence.source.flatMap(selector))
-    }
-
-    /**
-     Emits elements from the source observable sequence, or a default element if the source observable sequence is empty.
-
-     - seealso: [DefaultIfEmpty operator on reactivex.io](http://reactivex.io/documentation/operators/defaultifempty.html)
-
-     - parameter default: Default element to be sent if the source does not emit any elements
-     - returns: An observable sequence which emits default element end completes in case the original sequence is empty
-     */
-    public func ifEmpty(default: Element) -> Single<Element> {
-        Single(raw: self.primitiveSequence.source.ifEmpty(default: `default`))
-    }
-
-    /**
-     Returns the elements of the specified sequence or `switchTo` sequence if the sequence is empty.
-
-     - seealso: [DefaultIfEmpty operator on reactivex.io](http://reactivex.io/documentation/operators/defaultifempty.html)
-
-     - parameter switchTo: Observable sequence being returned when source sequence is empty.
-     - returns: Observable sequence that contains elements from switchTo sequence if source is empty, otherwise returns source sequence elements.
-     */
-    public func ifEmpty(switchTo other: Maybe<Element>) -> Maybe<Element> {
-        Maybe(raw: self.primitiveSequence.source.ifEmpty(switchTo: other.primitiveSequence.source))
-    }
-
-    /**
-     Returns the elements of the specified sequence or `switchTo` sequence if the sequence is empty.
-
-     - seealso: [DefaultIfEmpty operator on reactivex.io](http://reactivex.io/documentation/operators/defaultifempty.html)
-
-     - parameter switchTo: Observable sequence being returned when source sequence is empty.
-     - returns: Observable sequence that contains elements from switchTo sequence if source is empty, otherwise returns source sequence elements.
-     */
-    public func ifEmpty(switchTo other: Single<Element>) -> Single<Element> {
-        Single(raw: self.primitiveSequence.source.ifEmpty(switchTo: other.primitiveSequence.source))
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with a single element.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter element: Last element in an observable sequence in case error occurs.
-     - returns: An observable sequence containing the source sequence's elements, followed by the `element` in case an error occurred.
-     */
-    public func catchAndReturn(_ element: Element)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.primitiveSequence.source.catchAndReturn(element))
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with a single element.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter element: Last element in an observable sequence in case error occurs.
-     - returns: An observable sequence containing the source sequence's elements, followed by the `element` in case an error occurred.
-     */
-    @available(*, deprecated, renamed: "catchAndReturn(_:)")
-    public func catchErrorJustReturn(_ element: Element)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.primitiveSequence.source.catchAndReturn(element))
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/ObservableType+PrimitiveSequence.swift b/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/ObservableType+PrimitiveSequence.swift
deleted file mode 100644
index 8543f9661..000000000
--- a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/ObservableType+PrimitiveSequence.swift
+++ /dev/null
@@ -1,55 +0,0 @@
-//
-//  ObservableType+PrimitiveSequence.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 9/17/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-extension ObservableType {
-    /**
-     The `asSingle` operator throws a `RxError.noElements` or `RxError.moreThanOneElement`
-     if the source Observable does not emit exactly one element before successfully completing.
-
-     - seealso: [single operator on reactivex.io](http://reactivex.io/documentation/operators/first.html)
-
-     - returns: An observable sequence that emits a single element when the source Observable has completed, or throws an exception if more (or none) of them are emitted.
-     */
-    public func asSingle() -> Single<Element> {
-        PrimitiveSequence(raw: AsSingle(source: self.asObservable()))
-    }
-    
-    /**
-     The `first` operator emits only the very first item emitted by this Observable,
-     or nil if this Observable completes without emitting anything.
-     
-     - seealso: [single operator on reactivex.io](http://reactivex.io/documentation/operators/first.html)
-     
-     - returns: An observable sequence that emits a single element or nil if the source observable sequence completes without emitting any items.
-     */
-    public func first() -> Single<Element?> {
-        PrimitiveSequence(raw: First(source: self.asObservable()))
-    }
-
-    /**
-     The `asMaybe` operator throws a `RxError.moreThanOneElement`
-     if the source Observable does not emit at most one element before successfully completing.
-
-     - seealso: [single operator on reactivex.io](http://reactivex.io/documentation/operators/first.html)
-
-     - returns: An observable sequence that emits a single element, completes when the source Observable has completed, or throws an exception if more of them are emitted.
-     */
-    public func asMaybe() -> Maybe<Element> {
-        PrimitiveSequence(raw: AsMaybe(source: self.asObservable()))
-    }
-}
-
-extension ObservableType where Element == Never {
-    /**
-     - returns: An observable sequence that completes.
-     */
-    public func asCompletable()
-        -> Completable {
-            return PrimitiveSequence(raw: self.asObservable())
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/PrimitiveSequence+Zip+arity.swift b/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/PrimitiveSequence+Zip+arity.swift
deleted file mode 100644
index 80a6928f4..000000000
--- a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/PrimitiveSequence+Zip+arity.swift
+++ /dev/null
@@ -1,521 +0,0 @@
-// This file is autogenerated. Take a look at `Preprocessor` target in RxSwift project 
-//
-//  PrimitiveSequence+Zip+arity.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 5/23/15.
-//  Copyright © 2015 Krunoslav Zaher. All rights reserved.
-//
-
-
-
-// 2
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, resultSelector: @escaping (E1, E2) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>)
-        -> PrimitiveSequence<Trait, (E1, E2)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable())
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, resultSelector: @escaping (E1, E2) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>)
-        -> PrimitiveSequence<Trait, (E1, E2)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable())
-            )
-    }
-}
-
-
-
-
-// 3
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, resultSelector: @escaping (E1, E2, E3) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable())
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, resultSelector: @escaping (E1, E2, E3) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable())
-            )
-    }
-}
-
-
-
-
-// 4
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, resultSelector: @escaping (E1, E2, E3, E4) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable())
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, resultSelector: @escaping (E1, E2, E3, E4) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable())
-            )
-    }
-}
-
-
-
-
-// 5
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, resultSelector: @escaping (E1, E2, E3, E4, E5) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4, E5)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable())
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, resultSelector: @escaping (E1, E2, E3, E4, E5) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4, E5)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable())
-            )
-    }
-}
-
-
-
-
-// 6
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, resultSelector: @escaping (E1, E2, E3, E4, E5, E6) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4, E5, E6)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable())
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, resultSelector: @escaping (E1, E2, E3, E4, E5, E6) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4, E5, E6)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable())
-            )
-    }
-}
-
-
-
-
-// 7
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, _ source7: PrimitiveSequence<Trait, E7>, resultSelector: @escaping (E1, E2, E3, E4, E5, E6, E7) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, _ source7: PrimitiveSequence<Trait, E7>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4, E5, E6, E7)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable())
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, _ source7: PrimitiveSequence<Trait, E7>, resultSelector: @escaping (E1, E2, E3, E4, E5, E6, E7) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, _ source7: PrimitiveSequence<Trait, E7>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4, E5, E6, E7)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable())
-            )
-    }
-}
-
-
-
-
-// 8
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7, E8>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, _ source7: PrimitiveSequence<Trait, E7>, _ source8: PrimitiveSequence<Trait, E8>, resultSelector: @escaping (E1, E2, E3, E4, E5, E6, E7, E8) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable(), source8.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == SingleTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7, E8>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, _ source7: PrimitiveSequence<Trait, E7>, _ source8: PrimitiveSequence<Trait, E8>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4, E5, E6, E7, E8)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable(), source8.asObservable())
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7, E8>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, _ source7: PrimitiveSequence<Trait, E7>, _ source8: PrimitiveSequence<Trait, E8>, resultSelector: @escaping (E1, E2, E3, E4, E5, E6, E7, E8) throws -> Element)
-        -> PrimitiveSequence<Trait, Element> {
-            return PrimitiveSequence(raw: Observable.zip(
-            source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable(), source8.asObservable(),
-                resultSelector: resultSelector)
-            )
-    }
-}
-
-extension PrimitiveSequenceType where Element == Any, Trait == MaybeTrait {
-    /**
-    Merges the specified observable sequences into one observable sequence of tuples whenever all of the observable sequences have produced an element at a corresponding index.
-
-    - seealso: [zip operator on reactivex.io](http://reactivex.io/documentation/operators/zip.html)
-
-    - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-    */
-    public static func zip<E1, E2, E3, E4, E5, E6, E7, E8>(_ source1: PrimitiveSequence<Trait, E1>, _ source2: PrimitiveSequence<Trait, E2>, _ source3: PrimitiveSequence<Trait, E3>, _ source4: PrimitiveSequence<Trait, E4>, _ source5: PrimitiveSequence<Trait, E5>, _ source6: PrimitiveSequence<Trait, E6>, _ source7: PrimitiveSequence<Trait, E7>, _ source8: PrimitiveSequence<Trait, E8>)
-        -> PrimitiveSequence<Trait, (E1, E2, E3, E4, E5, E6, E7, E8)> {
-        return PrimitiveSequence(raw: Observable.zip(
-                source1.asObservable(), source2.asObservable(), source3.asObservable(), source4.asObservable(), source5.asObservable(), source6.asObservable(), source7.asObservable(), source8.asObservable())
-            )
-    }
-}
-
-
-
diff --git a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/PrimitiveSequence.swift b/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/PrimitiveSequence.swift
deleted file mode 100644
index c662b5b10..000000000
--- a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/PrimitiveSequence.swift
+++ /dev/null
@@ -1,342 +0,0 @@
-//
-//  PrimitiveSequence.swift
-//  RxSwift
-//
-//  Created by Krunoslav Zaher on 3/5/17.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-/// Observable sequences containing 0 or 1 element.
-public struct PrimitiveSequence<Trait, Element> {
-    let source: Observable<Element>
-
-    init(raw: Observable<Element>) {
-        self.source = raw
-    }
-}
-
-/// Observable sequences containing 0 or 1 element
-public protocol PrimitiveSequenceType {
-    /// Additional constraints
-    associatedtype Trait
-
-    /// Sequence element type
-    associatedtype Element
-
-    // Converts `self` to primitive sequence.
-    ///
-    /// - returns: Observable sequence that represents `self`.
-    var primitiveSequence: PrimitiveSequence<Trait, Element> { get }
-}
-
-extension PrimitiveSequence: PrimitiveSequenceType {
-    // Converts `self` to primitive sequence.
-    ///
-    /// - returns: Observable sequence that represents `self`.
-    public var primitiveSequence: PrimitiveSequence<Trait, Element> {
-        self
-    }
-}
-
-extension PrimitiveSequence: ObservableConvertibleType {
-    /// Converts `self` to `Observable` sequence.
-    ///
-    /// - returns: Observable sequence that represents `self`.
-    public func asObservable() -> Observable<Element> {
-        self.source
-    }
-}
-
-extension PrimitiveSequence {
-    /**
-     Returns an observable sequence that invokes the specified factory function whenever a new observer subscribes.
-
-     - seealso: [defer operator on reactivex.io](http://reactivex.io/documentation/operators/defer.html)
-
-     - parameter observableFactory: Observable factory function to invoke for each observer that subscribes to the resulting sequence.
-     - returns: An observable sequence whose observers trigger an invocation of the given observable factory function.
-     */
-    public static func deferred(_ observableFactory: @escaping () throws -> PrimitiveSequence<Trait, Element>)
-        -> PrimitiveSequence<Trait, Element> {
-        return PrimitiveSequence(raw: Observable.deferred {
-            try observableFactory().asObservable()
-        })
-    }
-
-    /**
-     Returns an observable sequence by the source observable sequence shifted forward in time by a specified delay. Error events from the source observable sequence are not delayed.
-
-     - seealso: [delay operator on reactivex.io](http://reactivex.io/documentation/operators/delay.html)
-
-     - parameter dueTime: Relative time shift of the source by.
-     - parameter scheduler: Scheduler to run the subscription delay timer on.
-     - returns: the source Observable shifted in time by the specified delay.
-     */
-    public func delay(_ dueTime: RxTimeInterval, scheduler: SchedulerType)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.primitiveSequence.source.delay(dueTime, scheduler: scheduler))
-    }
-
-    /**
-     Time shifts the observable sequence by delaying the subscription with the specified relative time duration, using the specified scheduler to run timers.
-
-     - seealso: [delay operator on reactivex.io](http://reactivex.io/documentation/operators/delay.html)
-
-     - parameter dueTime: Relative time shift of the subscription.
-     - parameter scheduler: Scheduler to run the subscription delay timer on.
-     - returns: Time-shifted sequence.
-     */
-    public func delaySubscription(_ dueTime: RxTimeInterval, scheduler: SchedulerType)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.source.delaySubscription(dueTime, scheduler: scheduler))
-    }
-    
-    /**
-     Wraps the source sequence in order to run its observer callbacks on the specified scheduler.
-
-     This only invokes observer callbacks on a `scheduler`. In case the subscription and/or unsubscription
-     actions have side-effects that require to be run on a scheduler, use `subscribeOn`.
-
-     - seealso: [observeOn operator on reactivex.io](http://reactivex.io/documentation/operators/observeon.html)
-
-     - parameter scheduler: Scheduler to notify observers on.
-     - returns: The source sequence whose observations happen on the specified scheduler.
-     */
-    public func observe(on scheduler: ImmediateSchedulerType)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.source.observe(on: scheduler))
-    }
-
-    /**
-     Wraps the source sequence in order to run its observer callbacks on the specified scheduler.
-
-     This only invokes observer callbacks on a `scheduler`. In case the subscription and/or unsubscription
-     actions have side-effects that require to be run on a scheduler, use `subscribeOn`.
-
-     - seealso: [observeOn operator on reactivex.io](http://reactivex.io/documentation/operators/observeon.html)
-
-     - parameter scheduler: Scheduler to notify observers on.
-     - returns: The source sequence whose observations happen on the specified scheduler.
-     */
-    @available(*, deprecated, renamed: "observe(on:)")
-    public func observeOn(_ scheduler: ImmediateSchedulerType)
-        -> PrimitiveSequence<Trait, Element> {
-        observe(on: scheduler)
-    }
-
-    /**
-    Wraps the source sequence in order to run its subscription and unsubscription logic on the specified 
-    scheduler. 
-    
-    This operation is not commonly used.
-    
-    This only performs the side-effects of subscription and unsubscription on the specified scheduler. 
-    
-    In order to invoke observer callbacks on a `scheduler`, use `observeOn`.
-
-    - seealso: [subscribeOn operator on reactivex.io](http://reactivex.io/documentation/operators/subscribeon.html)
-    
-    - parameter scheduler: Scheduler to perform subscription and unsubscription actions on.
-    - returns: The source sequence whose subscriptions and unsubscriptions happen on the specified scheduler.
-    */
-    public func subscribe(on scheduler: ImmediateSchedulerType)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.source.subscribe(on: scheduler))
-    }
-
-    /**
-    Wraps the source sequence in order to run its subscription and unsubscription logic on the specified
-    scheduler.
-
-    This operation is not commonly used.
-
-    This only performs the side-effects of subscription and unsubscription on the specified scheduler.
-
-    In order to invoke observer callbacks on a `scheduler`, use `observeOn`.
-
-    - seealso: [subscribeOn operator on reactivex.io](http://reactivex.io/documentation/operators/subscribeon.html)
-
-    - parameter scheduler: Scheduler to perform subscription and unsubscription actions on.
-    - returns: The source sequence whose subscriptions and unsubscriptions happen on the specified scheduler.
-    */
-    @available(*, deprecated, renamed: "subscribe(on:)")
-    public func subscribeOn(_ scheduler: ImmediateSchedulerType)
-        -> PrimitiveSequence<Trait, Element> {
-        subscribe(on: scheduler)
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with the observable sequence produced by the handler.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter handler: Error handler function, producing another observable sequence.
-     - returns: An observable sequence containing the source sequence's elements, followed by the elements produced by the handler's resulting observable sequence in case an error occurred.
-     */
-    @available(*, deprecated, renamed: "catch(_:)")
-    public func catchError(_ handler: @escaping (Swift.Error) throws -> PrimitiveSequence<Trait, Element>)
-        -> PrimitiveSequence<Trait, Element> {
-        `catch`(handler)
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with the observable sequence produced by the handler.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter handler: Error handler function, producing another observable sequence.
-     - returns: An observable sequence containing the source sequence's elements, followed by the elements produced by the handler's resulting observable sequence in case an error occurred.
-     */
-    public func `catch`(_ handler: @escaping (Swift.Error) throws -> PrimitiveSequence<Trait, Element>)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.source.catch { try handler($0).asObservable() })
-    }
-
-    /**
-     If the initial subscription to the observable sequence emits an error event, try repeating it up to the specified number of attempts (inclusive of the initial attempt) or until is succeeds. For example, if you want to retry a sequence once upon failure, you should use retry(2) (once for the initial attempt, and once for the retry).
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter maxAttemptCount: Maximum number of times to attempt the sequence subscription.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully.
-     */
-    public func retry(_ maxAttemptCount: Int)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.source.retry(maxAttemptCount))
-    }
-
-    /**
-     Repeats the source observable sequence on error when the notifier emits a next value.
-     If the source observable errors and the notifier completes, it will complete the source sequence.
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter notificationHandler: A handler that is passed an observable sequence of errors raised by the source observable and returns and observable that either continues, completes or errors. This behavior is then applied to the source observable.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully or is notified to error or complete.
-     */
-    public func retry<TriggerObservable: ObservableType, Error: Swift.Error>(when notificationHandler: @escaping (Observable<Error>) -> TriggerObservable)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.source.retry(when: notificationHandler))
-    }
-
-    /**
-     Repeats the source observable sequence on error when the notifier emits a next value.
-     If the source observable errors and the notifier completes, it will complete the source sequence.
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter notificationHandler: A handler that is passed an observable sequence of errors raised by the source observable and returns and observable that either continues, completes or errors. This behavior is then applied to the source observable.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully or is notified to error or complete.
-     */
-    @available(*, deprecated, renamed: "retry(when:)")
-    public func retryWhen<TriggerObservable: ObservableType, Error: Swift.Error>(_ notificationHandler: @escaping (Observable<Error>) -> TriggerObservable)
-        -> PrimitiveSequence<Trait, Element> {
-        retry(when: notificationHandler)
-    }
-
-    /**
-     Repeats the source observable sequence on error when the notifier emits a next value.
-     If the source observable errors and the notifier completes, it will complete the source sequence.
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter notificationHandler: A handler that is passed an observable sequence of errors raised by the source observable and returns and observable that either continues, completes or errors. This behavior is then applied to the source observable.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully or is notified to error or complete.
-     */
-    public func retry<TriggerObservable: ObservableType>(when notificationHandler: @escaping (Observable<Swift.Error>) -> TriggerObservable)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.source.retry(when: notificationHandler))
-    }
-
-    /**
-     Repeats the source observable sequence on error when the notifier emits a next value.
-     If the source observable errors and the notifier completes, it will complete the source sequence.
-
-     - seealso: [retry operator on reactivex.io](http://reactivex.io/documentation/operators/retry.html)
-
-     - parameter notificationHandler: A handler that is passed an observable sequence of errors raised by the source observable and returns and observable that either continues, completes or errors. This behavior is then applied to the source observable.
-     - returns: An observable sequence producing the elements of the given sequence repeatedly until it terminates successfully or is notified to error or complete.
-     */
-    @available(*, deprecated, renamed: "retry(when:)")
-    public func retryWhen<TriggerObservable: ObservableType>(_ notificationHandler: @escaping (Observable<Swift.Error>) -> TriggerObservable)
-        -> PrimitiveSequence<Trait, Element> {
-        retry(when: notificationHandler)
-    }
-
-    /**
-     Prints received events for all observers on standard output.
-
-     - seealso: [do operator on reactivex.io](http://reactivex.io/documentation/operators/do.html)
-
-     - parameter identifier: Identifier that is printed together with event description to standard output.
-     - parameter trimOutput: Should output be trimmed to max 40 characters.
-     - returns: An observable sequence whose events are printed to standard output.
-     */
-    public func debug(_ identifier: String? = nil, trimOutput: Bool = false, file: String = #file, line: UInt = #line, function: String = #function)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.source.debug(identifier, trimOutput: trimOutput, file: file, line: line, function: function))
-    }
-    
-    /**
-     Constructs an observable sequence that depends on a resource object, whose lifetime is tied to the resulting observable sequence's lifetime.
-     
-     - seealso: [using operator on reactivex.io](http://reactivex.io/documentation/operators/using.html)
-     
-     - parameter resourceFactory: Factory function to obtain a resource object.
-     - parameter primitiveSequenceFactory: Factory function to obtain an observable sequence that depends on the obtained resource.
-     - returns: An observable sequence whose lifetime controls the lifetime of the dependent resource object.
-     */
-    public static func using<Resource: Disposable>(_ resourceFactory: @escaping () throws -> Resource, primitiveSequenceFactory: @escaping (Resource) throws -> PrimitiveSequence<Trait, Element>)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: Observable.using(resourceFactory, observableFactory: { (resource: Resource) throws -> Observable<Element> in
-            return try primitiveSequenceFactory(resource).asObservable()
-        }))
-    }
-
-    /**
-     Applies a timeout policy for each element in the observable sequence. If the next element isn't received within the specified timeout duration starting from its predecessor, a TimeoutError is propagated to the observer.
-     
-     - seealso: [timeout operator on reactivex.io](http://reactivex.io/documentation/operators/timeout.html)
-     
-     - parameter dueTime: Maximum duration between values before a timeout occurs.
-     - parameter scheduler: Scheduler to run the timeout timer on.
-     - returns: An observable sequence with a `RxError.timeout` in case of a timeout.
-     */
-    public func timeout(_ dueTime: RxTimeInterval, scheduler: SchedulerType)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence<Trait, Element>(raw: self.primitiveSequence.source.timeout(dueTime, scheduler: scheduler))
-    }
-    
-    /**
-     Applies a timeout policy for each element in the observable sequence, using the specified scheduler to run timeout timers. If the next element isn't received within the specified timeout duration starting from its predecessor, the other observable sequence is used to produce future messages from that point on.
-     
-     - seealso: [timeout operator on reactivex.io](http://reactivex.io/documentation/operators/timeout.html)
-     
-     - parameter dueTime: Maximum duration between values before a timeout occurs.
-     - parameter other: Sequence to return in case of a timeout.
-     - parameter scheduler: Scheduler to run the timeout timer on.
-     - returns: The source sequence switching to the other sequence in case of a timeout.
-     */
-    public func timeout(_ dueTime: RxTimeInterval,
-                        other: PrimitiveSequence<Trait, Element>,
-                        scheduler: SchedulerType) -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence<Trait, Element>(raw: self.primitiveSequence.source.timeout(dueTime, other: other.source, scheduler: scheduler))
-    }
-}
-
-extension PrimitiveSequenceType where Element: RxAbstractInteger
-{
-    /**
-     Returns an observable sequence that periodically produces a value after the specified initial relative due time has elapsed, using the specified scheduler to run timers.
-
-     - seealso: [timer operator on reactivex.io](http://reactivex.io/documentation/operators/timer.html)
-
-     - parameter dueTime: Relative time at which to produce the first value.
-     - parameter scheduler: Scheduler to run timers on.
-     - returns: An observable sequence that produces a value after due time has elapsed and then each period.
-     */
-    public static func timer(_ dueTime: RxTimeInterval, scheduler: SchedulerType)
-        -> PrimitiveSequence<Trait, Element>  {
-        PrimitiveSequence(raw: Observable<Element>.timer(dueTime, scheduler: scheduler))
-    }
-}
diff --git a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Single.swift b/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Single.swift
deleted file mode 100644
index ffb8aa917..000000000
--- a/Pods/RxSwift/RxSwift/Traits/PrimitiveSequence/Single.swift
+++ /dev/null
@@ -1,403 +0,0 @@
-//
-//  Single.swift
-//  RxSwift
-//
-//  Created by sergdort on 19/08/2017.
-//  Copyright © 2017 Krunoslav Zaher. All rights reserved.
-//
-
-#if DEBUG
-import Foundation
-#endif
-
-/// Sequence containing exactly 1 element
-public enum SingleTrait { }
-/// Represents a push style sequence containing 1 element.
-public typealias Single<Element> = PrimitiveSequence<SingleTrait, Element>
-public typealias SingleEvent<Element> = Result<Element, Swift.Error>
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-    public typealias SingleObserver = (SingleEvent<Element>) -> Void
-    
-    /**
-     Creates an observable sequence from a specified subscribe method implementation.
-     
-     - seealso: [create operator on reactivex.io](http://reactivex.io/documentation/operators/create.html)
-     
-     - parameter subscribe: Implementation of the resulting observable sequence's `subscribe` method.
-     - returns: The observable sequence with the specified implementation for the `subscribe` method.
-     */
-    public static func create(subscribe: @escaping (@escaping SingleObserver) -> Disposable) -> Single<Element> {
-        let source = Observable<Element>.create { observer in
-            return subscribe { event in
-                switch event {
-                case .success(let element):
-                    observer.on(.next(element))
-                    observer.on(.completed)
-                case .failure(let error):
-                    observer.on(.error(error))
-                }
-            }
-        }
-        
-        return PrimitiveSequence(raw: source)
-    }
-    
-    /**
-     Subscribes `observer` to receive events for this sequence.
-     
-     - returns: Subscription for `observer` that can be used to cancel production of sequence elements and free resources.
-     */
-    public func subscribe(_ observer: @escaping (SingleEvent<Element>) -> Void) -> Disposable {
-        var stopped = false
-        return self.primitiveSequence.asObservable().subscribe { event in
-            if stopped { return }
-            stopped = true
-            
-            switch event {
-            case .next(let element):
-                observer(.success(element))
-            case .error(let error):
-                observer(.failure(error))
-            case .completed:
-                rxFatalErrorInDebug("Singles can't emit a completion event")
-            }
-        }
-    }
-
-    /**
-     Subscribes a success handler, and an error handler for this sequence.
-
-     - parameter onSuccess: Action to invoke for each element in the observable sequence.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription).
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    @available(*, deprecated, renamed: "subscribe(onSuccess:onFailure:onDisposed:)")
-    public func subscribe(onSuccess: ((Element) -> Void)? = nil,
-                          onError: @escaping ((Swift.Error) -> Void),
-                          onDisposed: (() -> Void)? = nil) -> Disposable {
-        subscribe(onSuccess: onSuccess, onFailure: onError, onDisposed: onDisposed)
-    }
-    
-    /**
-     Subscribes a success handler, and an error handler for this sequence.
-     
-     Also, take in an object and provide an unretained, safe to use (i.e. not implicitly unwrapped), reference to it along with the events emitted by the sequence.
-     
-     - Note: If `object` can't be retained, none of the other closures will be invoked.
-     
-     - parameter object: The object to provide an unretained reference on.
-     - parameter onSuccess: Action to invoke for each element in the observable sequence.
-     - parameter onFailure: Action to invoke upon errored termination of the observable sequence.
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription).
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe<Object: AnyObject>(
-        with object: Object,
-        onSuccess: ((Object, Element) -> Void)? = nil,
-        onFailure: ((Object, Swift.Error) -> Void)? = nil,
-        onDisposed: ((Object) -> Void)? = nil
-    ) -> Disposable {
-        subscribe(
-            onSuccess: { [weak object] in
-                guard let object = object else { return }
-                onSuccess?(object, $0)
-            },
-            onFailure: { [weak object] in
-                guard let object = object else { return }
-                onFailure?(object, $0)
-            },
-            onDisposed: { [weak object] in
-                guard let object = object else { return }
-                onDisposed?(object)
-            }
-        )
-    }
-    
-    /**
-     Subscribes a success handler, and an error handler for this sequence.
-     
-     - parameter onSuccess: Action to invoke for each element in the observable sequence.
-     - parameter onFailure: Action to invoke upon errored termination of the observable sequence.
-     - parameter onDisposed: Action to invoke upon any type of termination of sequence (if the sequence has
-     gracefully completed, errored, or if the generation is canceled by disposing subscription).
-     - returns: Subscription object used to unsubscribe from the observable sequence.
-     */
-    public func subscribe(onSuccess: ((Element) -> Void)? = nil,
-                          onFailure: ((Swift.Error) -> Void)? = nil,
-                          onDisposed: (() -> Void)? = nil) -> Disposable {
-        #if DEBUG
-            let callStack = Hooks.recordCallStackOnError ? Thread.callStackSymbols : []
-        #else
-            let callStack = [String]()
-        #endif
-
-        let disposable: Disposable
-        if let onDisposed = onDisposed {
-            disposable = Disposables.create(with: onDisposed)
-        } else {
-            disposable = Disposables.create()
-        }
-
-        let observer: SingleObserver = { event in
-            switch event {
-            case .success(let element):
-                onSuccess?(element)
-                disposable.dispose()
-            case .failure(let error):
-                if let onFailure = onFailure {
-                    onFailure(error)
-                } else {
-                    Hooks.defaultErrorHandler(callStack, error)
-                }
-                disposable.dispose()
-            }
-        }
-
-        return Disposables.create(
-            self.primitiveSequence.subscribe(observer),
-            disposable
-        )
-    }
-}
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-    /**
-     Returns an observable sequence that contains a single element.
-     
-     - seealso: [just operator on reactivex.io](http://reactivex.io/documentation/operators/just.html)
-     
-     - parameter element: Single element in the resulting observable sequence.
-     - returns: An observable sequence containing the single specified element.
-     */
-    public static func just(_ element: Element) -> Single<Element> {
-        Single(raw: Observable.just(element))
-    }
-    
-    /**
-     Returns an observable sequence that contains a single element.
-     
-     - seealso: [just operator on reactivex.io](http://reactivex.io/documentation/operators/just.html)
-     
-     - parameter element: Single element in the resulting observable sequence.
-     - parameter scheduler: Scheduler to send the single element on.
-     - returns: An observable sequence containing the single specified element.
-     */
-    public static func just(_ element: Element, scheduler: ImmediateSchedulerType) -> Single<Element> {
-        Single(raw: Observable.just(element, scheduler: scheduler))
-    }
-
-    /**
-     Returns an observable sequence that terminates with an `error`.
-
-     - seealso: [throw operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: The observable sequence that terminates with specified error.
-     */
-    public static func error(_ error: Swift.Error) -> Single<Element> {
-        PrimitiveSequence(raw: Observable.error(error))
-    }
-
-    /**
-     Returns a non-terminating observable sequence, which can be used to denote an infinite duration.
-
-     - seealso: [never operator on reactivex.io](http://reactivex.io/documentation/operators/empty-never-throw.html)
-
-     - returns: An observable sequence whose observers will never get called.
-     */
-    public static func never() -> Single<Element> {
-        PrimitiveSequence(raw: Observable.never())
-    }
-}
-
-extension PrimitiveSequenceType where Trait == SingleTrait {
-
-    /**
-     Invokes an action for each event in the observable sequence, and propagates all observer messages through the result sequence.
-
-     - seealso: [do operator on reactivex.io](http://reactivex.io/documentation/operators/do.html)
-
-     - parameter onSuccess: Action to invoke for each element in the observable sequence.
-     - parameter afterSuccess: Action to invoke for each element after the observable has passed an onNext event along to its downstream.
-     - parameter onError: Action to invoke upon errored termination of the observable sequence.
-     - parameter afterError: Action to invoke after errored termination of the observable sequence.
-     - parameter onSubscribe: Action to invoke before subscribing to source observable sequence.
-     - parameter onSubscribed: Action to invoke after subscribing to source observable sequence.
-     - parameter onDispose: Action to invoke after subscription to source observable has been disposed for any reason. It can be either because sequence terminates for some reason or observer subscription being disposed.
-     - returns: The source sequence with the side-effecting behavior applied.
-     */
-    public func `do`(onSuccess: ((Element) throws -> Void)? = nil,
-                     afterSuccess: ((Element) throws -> Void)? = nil,
-                     onError: ((Swift.Error) throws -> Void)? = nil,
-                     afterError: ((Swift.Error) throws -> Void)? = nil,
-                     onSubscribe: (() -> Void)? = nil,
-                     onSubscribed: (() -> Void)? = nil,
-                     onDispose: (() -> Void)? = nil)
-        -> Single<Element> {
-            return Single(raw: self.primitiveSequence.source.do(
-                onNext: onSuccess,
-                afterNext: afterSuccess,
-                onError: onError,
-                afterError: afterError,
-                onSubscribe: onSubscribe,
-                onSubscribed: onSubscribed,
-                onDispose: onDispose)
-            )
-    }
-
-    /**
-     Filters the elements of an observable sequence based on a predicate.
-     
-     - seealso: [filter operator on reactivex.io](http://reactivex.io/documentation/operators/filter.html)
-     
-     - parameter predicate: A function to test each source element for a condition.
-     - returns: An observable sequence that contains elements from the input sequence that satisfy the condition.
-     */
-    public func filter(_ predicate: @escaping (Element) throws -> Bool)
-        -> Maybe<Element> {
-            return Maybe(raw: self.primitiveSequence.source.filter(predicate))
-    }
-
-    /**
-     Projects each element of an observable sequence into a new form.
-     
-     - seealso: [map operator on reactivex.io](http://reactivex.io/documentation/operators/map.html)
-     
-     - parameter transform: A transform function to apply to each source element.
-     - returns: An observable sequence whose elements are the result of invoking the transform function on each element of source.
-     
-     */
-    public func map<Result>(_ transform: @escaping (Element) throws -> Result)
-        -> Single<Result> {
-            return Single(raw: self.primitiveSequence.source.map(transform))
-    }
-    
-    /**
-     Projects each element of an observable sequence into an optional form and filters all optional results.
-
-     - parameter transform: A transform function to apply to each source element.
-     - returns: An observable sequence whose elements are the result of filtering the transform function for each element of the source.
-
-     */
-    public func compactMap<Result>(_ transform: @escaping (Element) throws -> Result?)
-        -> Maybe<Result> {
-        Maybe(raw: self.primitiveSequence.source.compactMap(transform))
-    }
-    
-    /**
-     Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-     
-     - seealso: [flatMap operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-     
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence.
-     */
-    public func flatMap<Result>(_ selector: @escaping (Element) throws -> Single<Result>)
-        -> Single<Result> {
-            return Single<Result>(raw: self.primitiveSequence.source.flatMap(selector))
-    }
-
-    /**
-     Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-
-     - seealso: [flatMap operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence.
-     */
-    public func flatMapMaybe<Result>(_ selector: @escaping (Element) throws -> Maybe<Result>)
-        -> Maybe<Result> {
-            return Maybe<Result>(raw: self.primitiveSequence.source.flatMap(selector))
-    }
-
-    /**
-     Projects each element of an observable sequence to an observable sequence and merges the resulting observable sequences into one observable sequence.
-
-     - seealso: [flatMap operator on reactivex.io](http://reactivex.io/documentation/operators/flatmap.html)
-
-     - parameter selector: A transform function to apply to each element.
-     - returns: An observable sequence whose elements are the result of invoking the one-to-many transform function on each element of the input sequence.
-     */
-    public func flatMapCompletable(_ selector: @escaping (Element) throws -> Completable)
-        -> Completable {
-            return Completable(raw: self.primitiveSequence.source.flatMap(selector))
-    }
-
-    /**
-     Merges the specified observable sequences into one observable sequence by using the selector function whenever all of the observable sequences have produced an element at a corresponding index.
-     
-     - parameter resultSelector: Function to invoke for each series of elements at corresponding indexes in the sources.
-     - returns: An observable sequence containing the result of combining elements of the sources using the specified result selector function.
-     */
-    public static func zip<Collection: Swift.Collection, Result>(_ collection: Collection, resultSelector: @escaping ([Element]) throws -> Result) -> PrimitiveSequence<Trait, Result> where Collection.Element == PrimitiveSequence<Trait, Element> {
-        
-        if collection.isEmpty {
-            return PrimitiveSequence<Trait, Result>.deferred {
-                return PrimitiveSequence<Trait, Result>(raw: .just(try resultSelector([])))
-            }
-        }
-        
-        let raw = Observable.zip(collection.map { $0.asObservable() }, resultSelector: resultSelector)
-        return PrimitiveSequence<Trait, Result>(raw: raw)
-    }
-    
-    /**
-     Merges the specified observable sequences into one observable sequence all of the observable sequences have produced an element at a corresponding index.
-     
-     - returns: An observable sequence containing the result of combining elements of the sources.
-     */
-    public static func zip<Collection: Swift.Collection>(_ collection: Collection) -> PrimitiveSequence<Trait, [Element]> where Collection.Element == PrimitiveSequence<Trait, Element> {
-        
-        if collection.isEmpty {
-            return PrimitiveSequence<Trait, [Element]>(raw: .just([]))
-        }
-        
-        let raw = Observable.zip(collection.map { $0.asObservable() })
-        return PrimitiveSequence(raw: raw)
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with a single element.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter element: Last element in an observable sequence in case error occurs.
-     - returns: An observable sequence containing the source sequence's elements, followed by the `element` in case an error occurred.
-     */
-    public func catchAndReturn(_ element: Element)
-        -> PrimitiveSequence<Trait, Element> {
-        PrimitiveSequence(raw: self.primitiveSequence.source.catchAndReturn(element))
-    }
-
-    /**
-     Continues an observable sequence that is terminated by an error with a single element.
-
-     - seealso: [catch operator on reactivex.io](http://reactivex.io/documentation/operators/catch.html)
-
-     - parameter element: Last element in an observable sequence in case error occurs.
-     - returns: An observable sequence containing the source sequence's elements, followed by the `element` in case an error occurred.
-     */
-    @available(*, deprecated, renamed: "catchAndReturn(_:)")
-    public func catchErrorJustReturn(_ element: Element)
-        -> PrimitiveSequence<Trait, Element> {
-        catchAndReturn(element)
-    }
-
-    /// Converts `self` to `Maybe` trait.
-    ///
-    /// - returns: Maybe trait that represents `self`.
-    public func asMaybe() -> Maybe<Element> {
-        Maybe(raw: self.primitiveSequence.source)
-    }
-
-    /// Converts `self` to `Completable` trait, ignoring its emitted value if
-    /// one exists.
-    /// 
-    /// - returns: Completable trait that represents `self`.
-    public func asCompletable() -> Completable {
-        self.primitiveSequence.source.ignoreElements().asCompletable()
-    }
-}
diff --git a/Pods/Target Support Files/Alamofire/Alamofire-Info.plist b/Pods/Target Support Files/Alamofire/Alamofire-Info.plist
deleted file mode 100644
index f6f37a1a1..000000000
--- a/Pods/Target Support Files/Alamofire/Alamofire-Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>5.4.3</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/Alamofire/Alamofire-dummy.m b/Pods/Target Support Files/Alamofire/Alamofire-dummy.m
deleted file mode 100644
index a6c459424..000000000
--- a/Pods/Target Support Files/Alamofire/Alamofire-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_Alamofire : NSObject
-@end
-@implementation PodsDummy_Alamofire
-@end
diff --git a/Pods/Target Support Files/Alamofire/Alamofire-prefix.pch b/Pods/Target Support Files/Alamofire/Alamofire-prefix.pch
deleted file mode 100644
index 082f8af22..000000000
--- a/Pods/Target Support Files/Alamofire/Alamofire-prefix.pch	
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
diff --git a/Pods/Target Support Files/Alamofire/Alamofire-umbrella.h b/Pods/Target Support Files/Alamofire/Alamofire-umbrella.h
deleted file mode 100644
index c83c1a521..000000000
--- a/Pods/Target Support Files/Alamofire/Alamofire-umbrella.h	
+++ /dev/null
@@ -1,16 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
-
-FOUNDATION_EXPORT double AlamofireVersionNumber;
-FOUNDATION_EXPORT const unsigned char AlamofireVersionString[];
-
diff --git a/Pods/Target Support Files/Alamofire/Alamofire.debug.xcconfig b/Pods/Target Support Files/Alamofire/Alamofire.debug.xcconfig
deleted file mode 100644
index bff12e652..000000000
--- a/Pods/Target Support Files/Alamofire/Alamofire.debug.xcconfig	
+++ /dev/null
@@ -1,14 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/Alamofire
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_LDFLAGS = $(inherited) -framework "CFNetwork"
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/Alamofire
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/Alamofire/Alamofire.modulemap b/Pods/Target Support Files/Alamofire/Alamofire.modulemap
deleted file mode 100644
index d1f125fab..000000000
--- a/Pods/Target Support Files/Alamofire/Alamofire.modulemap	
+++ /dev/null
@@ -1,6 +0,0 @@
-framework module Alamofire {
-  umbrella header "Alamofire-umbrella.h"
-
-  export *
-  module * { export * }
-}
diff --git a/Pods/Target Support Files/Alamofire/Alamofire.release.xcconfig b/Pods/Target Support Files/Alamofire/Alamofire.release.xcconfig
deleted file mode 100644
index bff12e652..000000000
--- a/Pods/Target Support Files/Alamofire/Alamofire.release.xcconfig	
+++ /dev/null
@@ -1,14 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/Alamofire
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_LDFLAGS = $(inherited) -framework "CFNetwork"
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/Alamofire
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/Alamofire/Alamofire.xcconfig b/Pods/Target Support Files/Alamofire/Alamofire.xcconfig
deleted file mode 100644
index 267e31c4b..000000000
--- a/Pods/Target Support Files/Alamofire/Alamofire.xcconfig	
+++ /dev/null
@@ -1,10 +0,0 @@
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/Alamofire
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/Alamofire
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
diff --git a/Pods/Target Support Files/Alamofire/Info.plist b/Pods/Target Support Files/Alamofire/Info.plist
deleted file mode 100644
index 341253067..000000000
--- a/Pods/Target Support Files/Alamofire/Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>4.7.2</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser-dummy.m b/Pods/Target Support Files/BRLOptionParser/BRLOptionParser-dummy.m
deleted file mode 100644
index 4f03dd877..000000000
--- a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_BRLOptionParser : NSObject
-@end
-@implementation PodsDummy_BRLOptionParser
-@end
diff --git a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser-prefix.pch b/Pods/Target Support Files/BRLOptionParser/BRLOptionParser-prefix.pch
deleted file mode 100644
index 082f8af22..000000000
--- a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser-prefix.pch	
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
diff --git a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser.debug.xcconfig b/Pods/Target Support Files/BRLOptionParser/BRLOptionParser.debug.xcconfig
deleted file mode 100644
index 1cff975fb..000000000
--- a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser.debug.xcconfig	
+++ /dev/null
@@ -1,12 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/BRLOptionParser
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-HEADER_SEARCH_PATHS = $(inherited) "${PODS_ROOT}/Headers/Private" "${PODS_ROOT}/Headers/Private/BRLOptionParser" "${PODS_ROOT}/Headers/Public" "${PODS_ROOT}/Headers/Public/BRLOptionParser"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/BRLOptionParser
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser.release.xcconfig b/Pods/Target Support Files/BRLOptionParser/BRLOptionParser.release.xcconfig
deleted file mode 100644
index 1cff975fb..000000000
--- a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser.release.xcconfig	
+++ /dev/null
@@ -1,12 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/BRLOptionParser
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-HEADER_SEARCH_PATHS = $(inherited) "${PODS_ROOT}/Headers/Private" "${PODS_ROOT}/Headers/Private/BRLOptionParser" "${PODS_ROOT}/Headers/Public" "${PODS_ROOT}/Headers/Public/BRLOptionParser"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/BRLOptionParser
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser.xcconfig b/Pods/Target Support Files/BRLOptionParser/BRLOptionParser.xcconfig
deleted file mode 100644
index 74e0192aa..000000000
--- a/Pods/Target Support Files/BRLOptionParser/BRLOptionParser.xcconfig	
+++ /dev/null
@@ -1,9 +0,0 @@
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/BRLOptionParser
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-HEADER_SEARCH_PATHS = $(inherited) "${PODS_ROOT}/Headers/Private" "${PODS_ROOT}/Headers/Private/BRLOptionParser" "${PODS_ROOT}/Headers/Public" "${PODS_ROOT}/Headers/Public/BRLOptionParser"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/BRLOptionParser
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
diff --git a/Pods/Target Support Files/GCDWebServer/GCDWebServer-Info.plist b/Pods/Target Support Files/GCDWebServer/GCDWebServer-Info.plist
deleted file mode 100644
index 96c4609c5..000000000
--- a/Pods/Target Support Files/GCDWebServer/GCDWebServer-Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>3.5.4</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/GCDWebServer/GCDWebServer-dummy.m b/Pods/Target Support Files/GCDWebServer/GCDWebServer-dummy.m
deleted file mode 100644
index 4cb3a8383..000000000
--- a/Pods/Target Support Files/GCDWebServer/GCDWebServer-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_GCDWebServer : NSObject
-@end
-@implementation PodsDummy_GCDWebServer
-@end
diff --git a/Pods/Target Support Files/GCDWebServer/GCDWebServer-prefix.pch b/Pods/Target Support Files/GCDWebServer/GCDWebServer-prefix.pch
deleted file mode 100644
index 082f8af22..000000000
--- a/Pods/Target Support Files/GCDWebServer/GCDWebServer-prefix.pch	
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
diff --git a/Pods/Target Support Files/GCDWebServer/GCDWebServer-umbrella.h b/Pods/Target Support Files/GCDWebServer/GCDWebServer-umbrella.h
deleted file mode 100644
index e7ae40039..000000000
--- a/Pods/Target Support Files/GCDWebServer/GCDWebServer-umbrella.h	
+++ /dev/null
@@ -1,30 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
-#import "GCDWebServer.h"
-#import "GCDWebServerConnection.h"
-#import "GCDWebServerFunctions.h"
-#import "GCDWebServerHTTPStatusCodes.h"
-#import "GCDWebServerRequest.h"
-#import "GCDWebServerResponse.h"
-#import "GCDWebServerDataRequest.h"
-#import "GCDWebServerFileRequest.h"
-#import "GCDWebServerMultiPartFormRequest.h"
-#import "GCDWebServerURLEncodedFormRequest.h"
-#import "GCDWebServerDataResponse.h"
-#import "GCDWebServerErrorResponse.h"
-#import "GCDWebServerFileResponse.h"
-#import "GCDWebServerStreamedResponse.h"
-
-FOUNDATION_EXPORT double GCDWebServerVersionNumber;
-FOUNDATION_EXPORT const unsigned char GCDWebServerVersionString[];
-
diff --git a/Pods/Target Support Files/GCDWebServer/GCDWebServer.debug.xcconfig b/Pods/Target Support Files/GCDWebServer/GCDWebServer.debug.xcconfig
deleted file mode 100644
index 37ce11784..000000000
--- a/Pods/Target Support Files/GCDWebServer/GCDWebServer.debug.xcconfig	
+++ /dev/null
@@ -1,13 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_LDFLAGS = $(inherited) -l"z" -framework "SystemConfiguration"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/GCDWebServer
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/GCDWebServer/GCDWebServer.modulemap b/Pods/Target Support Files/GCDWebServer/GCDWebServer.modulemap
deleted file mode 100644
index a5af57623..000000000
--- a/Pods/Target Support Files/GCDWebServer/GCDWebServer.modulemap	
+++ /dev/null
@@ -1,6 +0,0 @@
-framework module GCDWebServer {
-  umbrella header "GCDWebServer-umbrella.h"
-
-  export *
-  module * { export * }
-}
diff --git a/Pods/Target Support Files/GCDWebServer/GCDWebServer.release.xcconfig b/Pods/Target Support Files/GCDWebServer/GCDWebServer.release.xcconfig
deleted file mode 100644
index 37ce11784..000000000
--- a/Pods/Target Support Files/GCDWebServer/GCDWebServer.release.xcconfig	
+++ /dev/null
@@ -1,13 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_LDFLAGS = $(inherited) -l"z" -framework "SystemConfiguration"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/GCDWebServer
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/GCDWebServer/GCDWebServer.xcconfig b/Pods/Target Support Files/GCDWebServer/GCDWebServer.xcconfig
deleted file mode 100644
index 7edf50dda..000000000
--- a/Pods/Target Support Files/GCDWebServer/GCDWebServer.xcconfig	
+++ /dev/null
@@ -1,10 +0,0 @@
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_LDFLAGS = $(inherited) -l"z" -framework "SystemConfiguration"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/GCDWebServer
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
diff --git a/Pods/Target Support Files/GCDWebServer/Info.plist b/Pods/Target Support Files/GCDWebServer/Info.plist
deleted file mode 100644
index 152c333e4..000000000
--- a/Pods/Target Support Files/GCDWebServer/Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>3.4.2</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/MASShortcut/Info.plist b/Pods/Target Support Files/MASShortcut/Info.plist
deleted file mode 100644
index 05bef89ce..000000000
--- a/Pods/Target Support Files/MASShortcut/Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>2.3.6</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/MASShortcut/MASShortcut-Info.plist b/Pods/Target Support Files/MASShortcut/MASShortcut-Info.plist
deleted file mode 100644
index e52684960..000000000
--- a/Pods/Target Support Files/MASShortcut/MASShortcut-Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>2.4.0</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/MASShortcut/MASShortcut-dummy.m b/Pods/Target Support Files/MASShortcut/MASShortcut-dummy.m
deleted file mode 100644
index 0757dcc24..000000000
--- a/Pods/Target Support Files/MASShortcut/MASShortcut-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_MASShortcut : NSObject
-@end
-@implementation PodsDummy_MASShortcut
-@end
diff --git a/Pods/Target Support Files/MASShortcut/MASShortcut-prefix.pch b/Pods/Target Support Files/MASShortcut/MASShortcut-prefix.pch
deleted file mode 100644
index 082f8af22..000000000
--- a/Pods/Target Support Files/MASShortcut/MASShortcut-prefix.pch	
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
diff --git a/Pods/Target Support Files/MASShortcut/MASShortcut-umbrella.h b/Pods/Target Support Files/MASShortcut/MASShortcut-umbrella.h
deleted file mode 100644
index 73b04d43b..000000000
--- a/Pods/Target Support Files/MASShortcut/MASShortcut-umbrella.h	
+++ /dev/null
@@ -1,28 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
-#import "MASKeyCodes.h"
-#import "MASKeyMasks.h"
-#import "MASShortcut.h"
-#import "MASShortcutValidator.h"
-#import "MASHotKey.h"
-#import "MASShortcutMonitor.h"
-#import "Shortcut.h"
-#import "MASLocalization.h"
-#import "MASShortcutView+Bindings.h"
-#import "MASShortcutView.h"
-#import "MASDictionaryTransformer.h"
-#import "MASShortcutBinder.h"
-
-FOUNDATION_EXPORT double MASShortcutVersionNumber;
-FOUNDATION_EXPORT const unsigned char MASShortcutVersionString[];
-
diff --git a/Pods/Target Support Files/MASShortcut/MASShortcut.debug.xcconfig b/Pods/Target Support Files/MASShortcut/MASShortcut.debug.xcconfig
deleted file mode 100644
index 95a3b7a73..000000000
--- a/Pods/Target Support Files/MASShortcut/MASShortcut.debug.xcconfig	
+++ /dev/null
@@ -1,13 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_LDFLAGS = $(inherited) -framework "AppKit" -framework "Carbon"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/MASShortcut
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/MASShortcut/MASShortcut.modulemap b/Pods/Target Support Files/MASShortcut/MASShortcut.modulemap
deleted file mode 100644
index b8aec8fdc..000000000
--- a/Pods/Target Support Files/MASShortcut/MASShortcut.modulemap	
+++ /dev/null
@@ -1,6 +0,0 @@
-framework module MASShortcut {
-  umbrella header "MASShortcut-umbrella.h"
-
-  export *
-  module * { export * }
-}
diff --git a/Pods/Target Support Files/MASShortcut/MASShortcut.release.xcconfig b/Pods/Target Support Files/MASShortcut/MASShortcut.release.xcconfig
deleted file mode 100644
index 95a3b7a73..000000000
--- a/Pods/Target Support Files/MASShortcut/MASShortcut.release.xcconfig	
+++ /dev/null
@@ -1,13 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_LDFLAGS = $(inherited) -framework "AppKit" -framework "Carbon"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/MASShortcut
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/MASShortcut/MASShortcut.xcconfig b/Pods/Target Support Files/MASShortcut/MASShortcut.xcconfig
deleted file mode 100644
index b859647f5..000000000
--- a/Pods/Target Support Files/MASShortcut/MASShortcut.xcconfig	
+++ /dev/null
@@ -1,10 +0,0 @@
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_LDFLAGS = $(inherited) -framework "AppKit" -framework "Carbon"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/MASShortcut
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
diff --git a/Pods/Target Support Files/MASShortcut/ResourceBundle-MASShortcut-Info.plist b/Pods/Target Support Files/MASShortcut/ResourceBundle-MASShortcut-Info.plist
deleted file mode 100644
index 3d638696f..000000000
--- a/Pods/Target Support Files/MASShortcut/ResourceBundle-MASShortcut-Info.plist	
+++ /dev/null
@@ -1,24 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>BNDL</string>
-  <key>CFBundleShortVersionString</key>
-  <string>2.3.6</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>1</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/MASShortcut/ResourceBundle-MASShortcut-MASShortcut-Info.plist b/Pods/Target Support Files/MASShortcut/ResourceBundle-MASShortcut-MASShortcut-Info.plist
deleted file mode 100644
index 76f452ad7..000000000
--- a/Pods/Target Support Files/MASShortcut/ResourceBundle-MASShortcut-MASShortcut-Info.plist	
+++ /dev/null
@@ -1,24 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>BNDL</string>
-  <key>CFBundleShortVersionString</key>
-  <string>2.4.0</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>1</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Info.plist b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Info.plist
deleted file mode 100644
index 2243fe6e2..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>1.0.0</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-Info.plist b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-Info.plist
deleted file mode 100644
index 2243fe6e2..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>1.0.0</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-acknowledgements.markdown b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-acknowledgements.markdown
deleted file mode 100644
index 53b21f8d3..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-acknowledgements.markdown	
+++ /dev/null
@@ -1,119 +0,0 @@
-# Acknowledgements
-This application makes use of the following third party libraries:
-
-## Alamofire
-
-Copyright (c) 2014-2021 Alamofire Software Foundation (http://alamofire.org/)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-
-## GCDWebServer
-
-Copyright (c) 2012-2014, Pierre-Olivier Latour
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-    * The name of Pierre-Olivier Latour may not be used to endorse
-      or promote products derived from this software without specific
-      prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
-DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-## MASShortcut
-
-Copyright (c) 2012-2013, Vadim Shpakovski
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-## RxCocoa
-
-**The MIT License**
-**Copyright © 2015 Krunoslav Zaher, Shai Mishali**
-**All rights reserved.**
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-
-## RxRelay
-
-**The MIT License**
-**Copyright © 2015 Krunoslav Zaher, Shai Mishali**
-**All rights reserved.**
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-
-## RxSwift
-
-**The MIT License**
-**Copyright © 2015 Krunoslav Zaher, Shai Mishali**
-**All rights reserved.**
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-Generated by CocoaPods - https://cocoapods.org
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-acknowledgements.plist b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-acknowledgements.plist
deleted file mode 100644
index 67c64683c..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-acknowledgements.plist	
+++ /dev/null
@@ -1,181 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>PreferenceSpecifiers</key>
-	<array>
-		<dict>
-			<key>FooterText</key>
-			<string>This application makes use of the following third party libraries:</string>
-			<key>Title</key>
-			<string>Acknowledgements</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>Copyright (c) 2014-2021 Alamofire Software Foundation (http://alamofire.org/)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-</string>
-			<key>License</key>
-			<string>MIT</string>
-			<key>Title</key>
-			<string>Alamofire</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>Copyright (c) 2012-2014, Pierre-Olivier Latour
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-    * The name of Pierre-Olivier Latour may not be used to endorse
-      or promote products derived from this software without specific
-      prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL PIERRE-OLIVIER LATOUR BE LIABLE FOR ANY
-DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-</string>
-			<key>License</key>
-			<string>BSD</string>
-			<key>Title</key>
-			<string>GCDWebServer</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>Copyright (c) 2012-2013, Vadim Shpakovski
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-</string>
-			<key>License</key>
-			<string>BSD 2-clause</string>
-			<key>Title</key>
-			<string>MASShortcut</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>**The MIT License**
-**Copyright © 2015 Krunoslav Zaher, Shai Mishali**
-**All rights reserved.**
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-</string>
-			<key>License</key>
-			<string>MIT</string>
-			<key>Title</key>
-			<string>RxCocoa</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>**The MIT License**
-**Copyright © 2015 Krunoslav Zaher, Shai Mishali**
-**All rights reserved.**
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-</string>
-			<key>License</key>
-			<string>MIT</string>
-			<key>Title</key>
-			<string>RxRelay</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>**The MIT License**
-**Copyright © 2015 Krunoslav Zaher, Shai Mishali**
-**All rights reserved.**
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-</string>
-			<key>License</key>
-			<string>MIT</string>
-			<key>Title</key>
-			<string>RxSwift</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>Generated by CocoaPods - https://cocoapods.org</string>
-			<key>Title</key>
-			<string></string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-	</array>
-	<key>StringsTable</key>
-	<string>Acknowledgements</string>
-	<key>Title</key>
-	<string>Acknowledgements</string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-dummy.m b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-dummy.m
deleted file mode 100644
index 8e2360c95..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_Pods_ShadowsocksX_NG : NSObject
-@end
-@implementation PodsDummy_Pods_ShadowsocksX_NG
-@end
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-frameworks.sh b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-frameworks.sh
deleted file mode 100755
index 3ebd557ee..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-frameworks.sh	
+++ /dev/null
@@ -1,195 +0,0 @@
-#!/bin/sh
-set -e
-set -u
-set -o pipefail
-
-function on_error {
-  echo "$(realpath -mq "${0}"):$1: error: Unexpected failure"
-}
-trap 'on_error $LINENO' ERR
-
-if [ -z ${FRAMEWORKS_FOLDER_PATH+x} ]; then
-  # If FRAMEWORKS_FOLDER_PATH is not set, then there's nowhere for us to copy
-  # frameworks to, so exit 0 (signalling the script phase was successful).
-  exit 0
-fi
-
-echo "mkdir -p ${CONFIGURATION_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-mkdir -p "${CONFIGURATION_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-
-COCOAPODS_PARALLEL_CODE_SIGN="${COCOAPODS_PARALLEL_CODE_SIGN:-false}"
-SWIFT_STDLIB_PATH="${DT_TOOLCHAIN_DIR}/usr/lib/swift/${PLATFORM_NAME}"
-BCSYMBOLMAP_DIR="BCSymbolMaps"
-
-
-# This protects against multiple targets copying the same framework dependency at the same time. The solution
-# was originally proposed here: https://lists.samba.org/archive/rsync/2008-February/020158.html
-RSYNC_PROTECT_TMP_FILES=(--filter "P .*.??????")
-
-# Copies and strips a vendored framework
-install_framework()
-{
-  if [ -r "${BUILT_PRODUCTS_DIR}/$1" ]; then
-    local source="${BUILT_PRODUCTS_DIR}/$1"
-  elif [ -r "${BUILT_PRODUCTS_DIR}/$(basename "$1")" ]; then
-    local source="${BUILT_PRODUCTS_DIR}/$(basename "$1")"
-  elif [ -r "$1" ]; then
-    local source="$1"
-  fi
-
-  local destination="${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-
-  if [ -L "${source}" ]; then
-    echo "Symlinked..."
-    source="$(readlink "${source}")"
-  fi
-
-  if [ -d "${source}/${BCSYMBOLMAP_DIR}" ]; then
-    # Locate and install any .bcsymbolmaps if present, and remove them from the .framework before the framework is copied
-    find "${source}/${BCSYMBOLMAP_DIR}" -name "*.bcsymbolmap"|while read f; do
-      echo "Installing $f"
-      install_bcsymbolmap "$f" "$destination"
-      rm "$f"
-    done
-    rmdir "${source}/${BCSYMBOLMAP_DIR}"
-  fi
-
-  # Use filter instead of exclude so missing patterns don't throw errors.
-  echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --links --filter \"- CVS/\" --filter \"- .svn/\" --filter \"- .git/\" --filter \"- .hg/\" --filter \"- Headers\" --filter \"- PrivateHeaders\" --filter \"- Modules\" \"${source}\" \"${destination}\""
-  rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --links --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${source}" "${destination}"
-
-  local basename
-  basename="$(basename -s .framework "$1")"
-  binary="${destination}/${basename}.framework/${basename}"
-
-  if ! [ -r "$binary" ]; then
-    binary="${destination}/${basename}"
-  elif [ -L "${binary}" ]; then
-    echo "Destination binary is symlinked..."
-    dirname="$(dirname "${binary}")"
-    binary="${dirname}/$(readlink "${binary}")"
-  fi
-
-  # Strip invalid architectures so "fat" simulator / device frameworks work on device
-  if [[ "$(file "$binary")" == *"dynamically linked shared library"* ]]; then
-    strip_invalid_archs "$binary"
-  fi
-
-  # Resign the code if required by the build settings to avoid unstable apps
-  code_sign_if_enabled "${destination}/$(basename "$1")"
-
-  # Embed linked Swift runtime libraries. No longer necessary as of Xcode 7.
-  if [ "${XCODE_VERSION_MAJOR}" -lt 7 ]; then
-    local swift_runtime_libs
-    swift_runtime_libs=$(xcrun otool -LX "$binary" | grep --color=never @rpath/libswift | sed -E s/@rpath\\/\(.+dylib\).*/\\1/g | uniq -u)
-    for lib in $swift_runtime_libs; do
-      echo "rsync -auv \"${SWIFT_STDLIB_PATH}/${lib}\" \"${destination}\""
-      rsync -auv "${SWIFT_STDLIB_PATH}/${lib}" "${destination}"
-      code_sign_if_enabled "${destination}/${lib}"
-    done
-  fi
-}
-# Copies and strips a vendored dSYM
-install_dsym() {
-  local source="$1"
-  warn_missing_arch=${2:-true}
-  if [ -r "$source" ]; then
-    # Copy the dSYM into the targets temp dir.
-    echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter \"- CVS/\" --filter \"- .svn/\" --filter \"- .git/\" --filter \"- .hg/\" --filter \"- Headers\" --filter \"- PrivateHeaders\" --filter \"- Modules\" \"${source}\" \"${DERIVED_FILES_DIR}\""
-    rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${source}" "${DERIVED_FILES_DIR}"
-
-    local basename
-    basename="$(basename -s .dSYM "$source")"
-    binary_name="$(ls "$source/Contents/Resources/DWARF")"
-    binary="${DERIVED_FILES_DIR}/${basename}.dSYM/Contents/Resources/DWARF/${binary_name}"
-
-    # Strip invalid architectures from the dSYM.
-    if [[ "$(file "$binary")" == *"Mach-O "*"dSYM companion"* ]]; then
-      strip_invalid_archs "$binary" "$warn_missing_arch"
-    fi
-    if [[ $STRIP_BINARY_RETVAL == 0 ]]; then
-      # Move the stripped file into its final destination.
-      echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --links --filter \"- CVS/\" --filter \"- .svn/\" --filter \"- .git/\" --filter \"- .hg/\" --filter \"- Headers\" --filter \"- PrivateHeaders\" --filter \"- Modules\" \"${DERIVED_FILES_DIR}/${basename}.framework.dSYM\" \"${DWARF_DSYM_FOLDER_PATH}\""
-      rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --links --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${DERIVED_FILES_DIR}/${basename}.dSYM" "${DWARF_DSYM_FOLDER_PATH}"
-    else
-      # The dSYM was not stripped at all, in this case touch a fake folder so the input/output paths from Xcode do not reexecute this script because the file is missing.
-      touch "${DWARF_DSYM_FOLDER_PATH}/${basename}.dSYM"
-    fi
-  fi
-}
-
-# Used as a return value for each invocation of `strip_invalid_archs` function.
-STRIP_BINARY_RETVAL=0
-
-# Strip invalid architectures
-strip_invalid_archs() {
-  binary="$1"
-  warn_missing_arch=${2:-true}
-  # Get architectures for current target binary
-  binary_archs="$(lipo -info "$binary" | rev | cut -d ':' -f1 | awk '{$1=$1;print}' | rev)"
-  # Intersect them with the architectures we are building for
-  intersected_archs="$(echo ${ARCHS[@]} ${binary_archs[@]} | tr ' ' '\n' | sort | uniq -d)"
-  # If there are no archs supported by this binary then warn the user
-  if [[ -z "$intersected_archs" ]]; then
-    if [[ "$warn_missing_arch" == "true" ]]; then
-      echo "warning: [CP] Vendored binary '$binary' contains architectures ($binary_archs) none of which match the current build architectures ($ARCHS)."
-    fi
-    STRIP_BINARY_RETVAL=1
-    return
-  fi
-  stripped=""
-  for arch in $binary_archs; do
-    if ! [[ "${ARCHS}" == *"$arch"* ]]; then
-      # Strip non-valid architectures in-place
-      lipo -remove "$arch" -output "$binary" "$binary"
-      stripped="$stripped $arch"
-    fi
-  done
-  if [[ "$stripped" ]]; then
-    echo "Stripped $binary of architectures:$stripped"
-  fi
-  STRIP_BINARY_RETVAL=0
-}
-
-# Copies the bcsymbolmap files of a vendored framework
-install_bcsymbolmap() {
-    local bcsymbolmap_path="$1"
-    local destination="${BUILT_PRODUCTS_DIR}"
-    echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${bcsymbolmap_path}" "${destination}""
-    rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${bcsymbolmap_path}" "${destination}"
-}
-
-# Signs a framework with the provided identity
-code_sign_if_enabled() {
-  if [ -n "${EXPANDED_CODE_SIGN_IDENTITY:-}" -a "${CODE_SIGNING_REQUIRED:-}" != "NO" -a "${CODE_SIGNING_ALLOWED}" != "NO" ]; then
-    # Use the current code_sign_identity
-    echo "Code Signing $1 with Identity ${EXPANDED_CODE_SIGN_IDENTITY_NAME}"
-    local code_sign_cmd="/usr/bin/codesign --force --sign ${EXPANDED_CODE_SIGN_IDENTITY} ${OTHER_CODE_SIGN_FLAGS:-} --preserve-metadata=identifier,entitlements '$1'"
-
-    if [ "${COCOAPODS_PARALLEL_CODE_SIGN}" == "true" ]; then
-      code_sign_cmd="$code_sign_cmd &"
-    fi
-    echo "$code_sign_cmd"
-    eval "$code_sign_cmd"
-  fi
-}
-
-if [[ "$CONFIGURATION" == "Debug" ]]; then
-  install_framework "${BUILT_PRODUCTS_DIR}/Alamofire/Alamofire.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/GCDWebServer/GCDWebServer.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/MASShortcut/MASShortcut.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/RxCocoa/RxCocoa.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/RxRelay/RxRelay.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/RxSwift/RxSwift.framework"
-fi
-if [[ "$CONFIGURATION" == "Release" ]]; then
-  install_framework "${BUILT_PRODUCTS_DIR}/Alamofire/Alamofire.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/GCDWebServer/GCDWebServer.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/MASShortcut/MASShortcut.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/RxCocoa/RxCocoa.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/RxRelay/RxRelay.framework"
-  install_framework "${BUILT_PRODUCTS_DIR}/RxSwift/RxSwift.framework"
-fi
-if [ "${COCOAPODS_PARALLEL_CODE_SIGN}" == "true" ]; then
-  wait
-fi
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-resources.sh b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-resources.sh
deleted file mode 100755
index a7df4405b..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-resources.sh	
+++ /dev/null
@@ -1,106 +0,0 @@
-#!/bin/sh
-set -e
-
-mkdir -p "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-
-RESOURCES_TO_COPY=${PODS_ROOT}/resources-to-copy-${TARGETNAME}.txt
-> "$RESOURCES_TO_COPY"
-
-XCASSET_FILES=()
-
-# This protects against multiple targets copying the same framework dependency at the same time. The solution
-# was originally proposed here: https://lists.samba.org/archive/rsync/2008-February/020158.html
-RSYNC_PROTECT_TMP_FILES=(--filter "P .*.??????")
-
-case "${TARGETED_DEVICE_FAMILY}" in
-  1,2)
-    TARGET_DEVICE_ARGS="--target-device ipad --target-device iphone"
-    ;;
-  1)
-    TARGET_DEVICE_ARGS="--target-device iphone"
-    ;;
-  2)
-    TARGET_DEVICE_ARGS="--target-device ipad"
-    ;;
-  3)
-    TARGET_DEVICE_ARGS="--target-device tv"
-    ;;
-  4)
-    TARGET_DEVICE_ARGS="--target-device watch"
-    ;;
-  *)
-    TARGET_DEVICE_ARGS="--target-device mac"
-    ;;
-esac
-
-install_resource()
-{
-  if [[ "$1" = /* ]] ; then
-    RESOURCE_PATH="$1"
-  else
-    RESOURCE_PATH="${PODS_ROOT}/$1"
-  fi
-  if [[ ! -e "$RESOURCE_PATH" ]] ; then
-    cat << EOM
-error: Resource "$RESOURCE_PATH" not found. Run 'pod install' to update the copy resources script.
-EOM
-    exit 1
-  fi
-  case $RESOURCE_PATH in
-    *.storyboard)
-      echo "ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile ${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .storyboard`.storyboardc $RESOURCE_PATH --sdk ${SDKROOT} ${TARGET_DEVICE_ARGS}" || true
-      ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .storyboard`.storyboardc" "$RESOURCE_PATH" --sdk "${SDKROOT}" ${TARGET_DEVICE_ARGS}
-      ;;
-    *.xib)
-      echo "ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile ${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .xib`.nib $RESOURCE_PATH --sdk ${SDKROOT} ${TARGET_DEVICE_ARGS}" || true
-      ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .xib`.nib" "$RESOURCE_PATH" --sdk "${SDKROOT}" ${TARGET_DEVICE_ARGS}
-      ;;
-    *.framework)
-      echo "mkdir -p ${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}" || true
-      mkdir -p "${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-      echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" $RESOURCE_PATH ${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}" || true
-      rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-      ;;
-    *.xcdatamodel)
-      echo "xcrun momc \"$RESOURCE_PATH\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH"`.mom\"" || true
-      xcrun momc "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcdatamodel`.mom"
-      ;;
-    *.xcdatamodeld)
-      echo "xcrun momc \"$RESOURCE_PATH\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcdatamodeld`.momd\"" || true
-      xcrun momc "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcdatamodeld`.momd"
-      ;;
-    *.xcmappingmodel)
-      echo "xcrun mapc \"$RESOURCE_PATH\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcmappingmodel`.cdm\"" || true
-      xcrun mapc "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcmappingmodel`.cdm"
-      ;;
-    *.xcassets)
-      ABSOLUTE_XCASSET_FILE="$RESOURCE_PATH"
-      XCASSET_FILES+=("$ABSOLUTE_XCASSET_FILE")
-      ;;
-    *)
-      echo "$RESOURCE_PATH" || true
-      echo "$RESOURCE_PATH" >> "$RESOURCES_TO_COPY"
-      ;;
-  esac
-}
-
-mkdir -p "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-rsync -avr --copy-links --no-relative --exclude '*/.svn/*' --files-from="$RESOURCES_TO_COPY" / "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-if [[ "${ACTION}" == "install" ]] && [[ "${SKIP_INSTALL}" == "NO" ]]; then
-  mkdir -p "${INSTALL_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-  rsync -avr --copy-links --no-relative --exclude '*/.svn/*' --files-from="$RESOURCES_TO_COPY" / "${INSTALL_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-fi
-rm -f "$RESOURCES_TO_COPY"
-
-if [[ -n "${WRAPPER_EXTENSION}" ]] && [ "`xcrun --find actool`" ] && [ -n "$XCASSET_FILES" ]
-then
-  # Find all other xcassets (this unfortunately includes those of path pods and other targets).
-  OTHER_XCASSETS=$(find "$PWD" -iname "*.xcassets" -type d)
-  while read line; do
-    if [[ $line != "${PODS_ROOT}*" ]]; then
-      XCASSET_FILES+=("$line")
-    fi
-  done <<<"$OTHER_XCASSETS"
-
-  printf "%s\0" "${XCASSET_FILES[@]}" | xargs -0 xcrun actool --output-format human-readable-text --notices --warnings --platform "${PLATFORM_NAME}" --minimum-deployment-target "${!DEPLOYMENT_TARGET_SETTING_NAME}" ${TARGET_DEVICE_ARGS} --compress-pngs --compile "${BUILT_PRODUCTS_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-fi
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-umbrella.h b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-umbrella.h
deleted file mode 100644
index 9422e612f..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-umbrella.h	
+++ /dev/null
@@ -1,16 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
-
-FOUNDATION_EXPORT double Pods_ShadowsocksX_NGVersionNumber;
-FOUNDATION_EXPORT const unsigned char Pods_ShadowsocksX_NGVersionString[];
-
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.debug.xcconfig b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.debug.xcconfig
deleted file mode 100644
index 17a8700b2..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.debug.xcconfig	
+++ /dev/null
@@ -1,14 +0,0 @@
-ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-FRAMEWORK_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/Alamofire" "${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer" "${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut" "${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa" "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift"
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-HEADER_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/Alamofire/Alamofire.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer/GCDWebServer.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut/MASShortcut.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa/RxCocoa.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay/RxRelay.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift/RxSwift.framework/Headers"
-LD_RUNPATH_SEARCH_PATHS = $(inherited) '@executable_path/../Frameworks' '@loader_path/Frameworks'
-OTHER_LDFLAGS = $(inherited) -l"z" -framework "Alamofire" -framework "AppKit" -framework "CFNetwork" -framework "Carbon" -framework "GCDWebServer" -framework "MASShortcut" -framework "RxCocoa" -framework "RxRelay" -framework "RxSwift" -framework "SystemConfiguration"
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_PODFILE_DIR_PATH = ${SRCROOT}/.
-PODS_ROOT = ${SRCROOT}/Pods
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.modulemap b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.modulemap
deleted file mode 100644
index f29cbfd4a..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.modulemap	
+++ /dev/null
@@ -1,6 +0,0 @@
-framework module Pods_ShadowsocksX_NG {
-  umbrella header "Pods-ShadowsocksX-NG-umbrella.h"
-
-  export *
-  module * { export * }
-}
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.release.xcconfig b/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.release.xcconfig
deleted file mode 100644
index 17a8700b2..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.release.xcconfig	
+++ /dev/null
@@ -1,14 +0,0 @@
-ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-FRAMEWORK_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/Alamofire" "${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer" "${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut" "${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa" "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift"
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-HEADER_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/Alamofire/Alamofire.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer/GCDWebServer.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut/MASShortcut.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa/RxCocoa.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay/RxRelay.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift/RxSwift.framework/Headers"
-LD_RUNPATH_SEARCH_PATHS = $(inherited) '@executable_path/../Frameworks' '@loader_path/Frameworks'
-OTHER_LDFLAGS = $(inherited) -l"z" -framework "Alamofire" -framework "AppKit" -framework "CFNetwork" -framework "Carbon" -framework "GCDWebServer" -framework "MASShortcut" -framework "RxCocoa" -framework "RxRelay" -framework "RxSwift" -framework "SystemConfiguration"
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_PODFILE_DIR_PATH = ${SRCROOT}/.
-PODS_ROOT = ${SRCROOT}/Pods
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Info.plist b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Info.plist
deleted file mode 100644
index 2243fe6e2..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>1.0.0</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-Info.plist b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-Info.plist
deleted file mode 100644
index 2243fe6e2..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>1.0.0</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-acknowledgements.markdown b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-acknowledgements.markdown
deleted file mode 100644
index 102af7538..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-acknowledgements.markdown	
+++ /dev/null
@@ -1,3 +0,0 @@
-# Acknowledgements
-This application makes use of the following third party libraries:
-Generated by CocoaPods - https://cocoapods.org
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-acknowledgements.plist b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-acknowledgements.plist
deleted file mode 100644
index 7acbad1ea..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-acknowledgements.plist	
+++ /dev/null
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>PreferenceSpecifiers</key>
-	<array>
-		<dict>
-			<key>FooterText</key>
-			<string>This application makes use of the following third party libraries:</string>
-			<key>Title</key>
-			<string>Acknowledgements</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>Generated by CocoaPods - https://cocoapods.org</string>
-			<key>Title</key>
-			<string></string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-	</array>
-	<key>StringsTable</key>
-	<string>Acknowledgements</string>
-	<key>Title</key>
-	<string>Acknowledgements</string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-dummy.m b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-dummy.m
deleted file mode 100644
index 98e68288a..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_Pods_ShadowsocksX_NGTests : NSObject
-@end
-@implementation PodsDummy_Pods_ShadowsocksX_NGTests
-@end
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-frameworks.sh b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-frameworks.sh
deleted file mode 100755
index 881cbaed3..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-frameworks.sh	
+++ /dev/null
@@ -1,137 +0,0 @@
-#!/bin/sh
-set -e
-
-echo "mkdir -p ${CONFIGURATION_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-mkdir -p "${CONFIGURATION_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-
-SWIFT_STDLIB_PATH="${DT_TOOLCHAIN_DIR}/usr/lib/swift/${PLATFORM_NAME}"
-
-# Used as a return value for each invocation of `strip_invalid_archs` function.
-STRIP_BINARY_RETVAL=0
-
-# This protects against multiple targets copying the same framework dependency at the same time. The solution
-# was originally proposed here: https://lists.samba.org/archive/rsync/2008-February/020158.html
-RSYNC_PROTECT_TMP_FILES=(--filter "P .*.??????")
-
-# Copies and strips a vendored framework
-install_framework()
-{
-  if [ -r "${BUILT_PRODUCTS_DIR}/$1" ]; then
-    local source="${BUILT_PRODUCTS_DIR}/$1"
-  elif [ -r "${BUILT_PRODUCTS_DIR}/$(basename "$1")" ]; then
-    local source="${BUILT_PRODUCTS_DIR}/$(basename "$1")"
-  elif [ -r "$1" ]; then
-    local source="$1"
-  fi
-
-  local destination="${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-
-  if [ -L "${source}" ]; then
-      echo "Symlinked..."
-      source="$(readlink "${source}")"
-  fi
-
-  # Use filter instead of exclude so missing patterns don't throw errors.
-  echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter \"- CVS/\" --filter \"- .svn/\" --filter \"- .git/\" --filter \"- .hg/\" --filter \"- Headers\" --filter \"- PrivateHeaders\" --filter \"- Modules\" \"${source}\" \"${destination}\""
-  rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${source}" "${destination}"
-
-  local basename
-  basename="$(basename -s .framework "$1")"
-  binary="${destination}/${basename}.framework/${basename}"
-  if ! [ -r "$binary" ]; then
-    binary="${destination}/${basename}"
-  fi
-
-  # Strip invalid architectures so "fat" simulator / device frameworks work on device
-  if [[ "$(file "$binary")" == *"dynamically linked shared library"* ]]; then
-    strip_invalid_archs "$binary"
-  fi
-
-  # Resign the code if required by the build settings to avoid unstable apps
-  code_sign_if_enabled "${destination}/$(basename "$1")"
-
-  # Embed linked Swift runtime libraries. No longer necessary as of Xcode 7.
-  if [ "${XCODE_VERSION_MAJOR}" -lt 7 ]; then
-    local swift_runtime_libs
-    swift_runtime_libs=$(xcrun otool -LX "$binary" | grep --color=never @rpath/libswift | sed -E s/@rpath\\/\(.+dylib\).*/\\1/g | uniq -u  && exit ${PIPESTATUS[0]})
-    for lib in $swift_runtime_libs; do
-      echo "rsync -auv \"${SWIFT_STDLIB_PATH}/${lib}\" \"${destination}\""
-      rsync -auv "${SWIFT_STDLIB_PATH}/${lib}" "${destination}"
-      code_sign_if_enabled "${destination}/${lib}"
-    done
-  fi
-}
-
-# Copies and strips a vendored dSYM
-install_dsym() {
-  local source="$1"
-  if [ -r "$source" ]; then
-    # Copy the dSYM into a the targets temp dir.
-    echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter \"- CVS/\" --filter \"- .svn/\" --filter \"- .git/\" --filter \"- .hg/\" --filter \"- Headers\" --filter \"- PrivateHeaders\" --filter \"- Modules\" \"${source}\" \"${DERIVED_FILES_DIR}\""
-    rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${source}" "${DERIVED_FILES_DIR}"
-
-    local basename
-    basename="$(basename -s .framework.dSYM "$source")"
-    binary="${DERIVED_FILES_DIR}/${basename}.framework.dSYM/Contents/Resources/DWARF/${basename}"
-
-    # Strip invalid architectures so "fat" simulator / device frameworks work on device
-    if [[ "$(file "$binary")" == *"Mach-O dSYM companion"* ]]; then
-      strip_invalid_archs "$binary"
-    fi
-
-    if [[ $STRIP_BINARY_RETVAL == 1 ]]; then
-      # Move the stripped file into its final destination.
-      echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter \"- CVS/\" --filter \"- .svn/\" --filter \"- .git/\" --filter \"- .hg/\" --filter \"- Headers\" --filter \"- PrivateHeaders\" --filter \"- Modules\" \"${DERIVED_FILES_DIR}/${basename}.framework.dSYM\" \"${DWARF_DSYM_FOLDER_PATH}\""
-      rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${DERIVED_FILES_DIR}/${basename}.framework.dSYM" "${DWARF_DSYM_FOLDER_PATH}"
-    else
-      # The dSYM was not stripped at all, in this case touch a fake folder so the input/output paths from Xcode do not reexecute this script because the file is missing.
-      touch "${DWARF_DSYM_FOLDER_PATH}/${basename}.framework.dSYM"
-    fi
-  fi
-}
-
-# Signs a framework with the provided identity
-code_sign_if_enabled() {
-  if [ -n "${EXPANDED_CODE_SIGN_IDENTITY}" -a "${CODE_SIGNING_REQUIRED}" != "NO" -a "${CODE_SIGNING_ALLOWED}" != "NO" ]; then
-    # Use the current code_sign_identitiy
-    echo "Code Signing $1 with Identity ${EXPANDED_CODE_SIGN_IDENTITY_NAME}"
-    local code_sign_cmd="/usr/bin/codesign --force --sign ${EXPANDED_CODE_SIGN_IDENTITY} ${OTHER_CODE_SIGN_FLAGS} --preserve-metadata=identifier,entitlements '$1'"
-
-    if [ "${COCOAPODS_PARALLEL_CODE_SIGN}" == "true" ]; then
-      code_sign_cmd="$code_sign_cmd &"
-    fi
-    echo "$code_sign_cmd"
-    eval "$code_sign_cmd"
-  fi
-}
-
-# Strip invalid architectures
-strip_invalid_archs() {
-  binary="$1"
-  # Get architectures for current target binary
-  binary_archs="$(lipo -info "$binary" | rev | cut -d ':' -f1 | awk '{$1=$1;print}' | rev)"
-  # Intersect them with the architectures we are building for
-  intersected_archs="$(echo ${ARCHS[@]} ${binary_archs[@]} | tr ' ' '\n' | sort | uniq -d)"
-  # If there are no archs supported by this binary then warn the user
-  if [[ -z "$intersected_archs" ]]; then
-    echo "warning: [CP] Vendored binary '$binary' contains architectures ($binary_archs) none of which match the current build architectures ($ARCHS)."
-    STRIP_BINARY_RETVAL=0
-    return
-  fi
-  stripped=""
-  for arch in $binary_archs; do
-    if ! [[ "${ARCHS}" == *"$arch"* ]]; then
-      # Strip non-valid architectures in-place
-      lipo -remove "$arch" -output "$binary" "$binary" || exit 1
-      stripped="$stripped $arch"
-    fi
-  done
-  if [[ "$stripped" ]]; then
-    echo "Stripped $binary of architectures:$stripped"
-  fi
-  STRIP_BINARY_RETVAL=1
-}
-
-if [ "${COCOAPODS_PARALLEL_CODE_SIGN}" == "true" ]; then
-  wait
-fi
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-resources.sh b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-resources.sh
deleted file mode 100755
index a7df4405b..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-resources.sh	
+++ /dev/null
@@ -1,106 +0,0 @@
-#!/bin/sh
-set -e
-
-mkdir -p "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-
-RESOURCES_TO_COPY=${PODS_ROOT}/resources-to-copy-${TARGETNAME}.txt
-> "$RESOURCES_TO_COPY"
-
-XCASSET_FILES=()
-
-# This protects against multiple targets copying the same framework dependency at the same time. The solution
-# was originally proposed here: https://lists.samba.org/archive/rsync/2008-February/020158.html
-RSYNC_PROTECT_TMP_FILES=(--filter "P .*.??????")
-
-case "${TARGETED_DEVICE_FAMILY}" in
-  1,2)
-    TARGET_DEVICE_ARGS="--target-device ipad --target-device iphone"
-    ;;
-  1)
-    TARGET_DEVICE_ARGS="--target-device iphone"
-    ;;
-  2)
-    TARGET_DEVICE_ARGS="--target-device ipad"
-    ;;
-  3)
-    TARGET_DEVICE_ARGS="--target-device tv"
-    ;;
-  4)
-    TARGET_DEVICE_ARGS="--target-device watch"
-    ;;
-  *)
-    TARGET_DEVICE_ARGS="--target-device mac"
-    ;;
-esac
-
-install_resource()
-{
-  if [[ "$1" = /* ]] ; then
-    RESOURCE_PATH="$1"
-  else
-    RESOURCE_PATH="${PODS_ROOT}/$1"
-  fi
-  if [[ ! -e "$RESOURCE_PATH" ]] ; then
-    cat << EOM
-error: Resource "$RESOURCE_PATH" not found. Run 'pod install' to update the copy resources script.
-EOM
-    exit 1
-  fi
-  case $RESOURCE_PATH in
-    *.storyboard)
-      echo "ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile ${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .storyboard`.storyboardc $RESOURCE_PATH --sdk ${SDKROOT} ${TARGET_DEVICE_ARGS}" || true
-      ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .storyboard`.storyboardc" "$RESOURCE_PATH" --sdk "${SDKROOT}" ${TARGET_DEVICE_ARGS}
-      ;;
-    *.xib)
-      echo "ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile ${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .xib`.nib $RESOURCE_PATH --sdk ${SDKROOT} ${TARGET_DEVICE_ARGS}" || true
-      ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .xib`.nib" "$RESOURCE_PATH" --sdk "${SDKROOT}" ${TARGET_DEVICE_ARGS}
-      ;;
-    *.framework)
-      echo "mkdir -p ${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}" || true
-      mkdir -p "${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-      echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" $RESOURCE_PATH ${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}" || true
-      rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-      ;;
-    *.xcdatamodel)
-      echo "xcrun momc \"$RESOURCE_PATH\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH"`.mom\"" || true
-      xcrun momc "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcdatamodel`.mom"
-      ;;
-    *.xcdatamodeld)
-      echo "xcrun momc \"$RESOURCE_PATH\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcdatamodeld`.momd\"" || true
-      xcrun momc "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcdatamodeld`.momd"
-      ;;
-    *.xcmappingmodel)
-      echo "xcrun mapc \"$RESOURCE_PATH\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcmappingmodel`.cdm\"" || true
-      xcrun mapc "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcmappingmodel`.cdm"
-      ;;
-    *.xcassets)
-      ABSOLUTE_XCASSET_FILE="$RESOURCE_PATH"
-      XCASSET_FILES+=("$ABSOLUTE_XCASSET_FILE")
-      ;;
-    *)
-      echo "$RESOURCE_PATH" || true
-      echo "$RESOURCE_PATH" >> "$RESOURCES_TO_COPY"
-      ;;
-  esac
-}
-
-mkdir -p "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-rsync -avr --copy-links --no-relative --exclude '*/.svn/*' --files-from="$RESOURCES_TO_COPY" / "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-if [[ "${ACTION}" == "install" ]] && [[ "${SKIP_INSTALL}" == "NO" ]]; then
-  mkdir -p "${INSTALL_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-  rsync -avr --copy-links --no-relative --exclude '*/.svn/*' --files-from="$RESOURCES_TO_COPY" / "${INSTALL_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-fi
-rm -f "$RESOURCES_TO_COPY"
-
-if [[ -n "${WRAPPER_EXTENSION}" ]] && [ "`xcrun --find actool`" ] && [ -n "$XCASSET_FILES" ]
-then
-  # Find all other xcassets (this unfortunately includes those of path pods and other targets).
-  OTHER_XCASSETS=$(find "$PWD" -iname "*.xcassets" -type d)
-  while read line; do
-    if [[ $line != "${PODS_ROOT}*" ]]; then
-      XCASSET_FILES+=("$line")
-    fi
-  done <<<"$OTHER_XCASSETS"
-
-  printf "%s\0" "${XCASSET_FILES[@]}" | xargs -0 xcrun actool --output-format human-readable-text --notices --warnings --platform "${PLATFORM_NAME}" --minimum-deployment-target "${!DEPLOYMENT_TARGET_SETTING_NAME}" ${TARGET_DEVICE_ARGS} --compress-pngs --compile "${BUILT_PRODUCTS_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-fi
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-umbrella.h b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-umbrella.h
deleted file mode 100644
index 6531c0d11..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests-umbrella.h	
+++ /dev/null
@@ -1,16 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
-
-FOUNDATION_EXPORT double Pods_ShadowsocksX_NGTestsVersionNumber;
-FOUNDATION_EXPORT const unsigned char Pods_ShadowsocksX_NGTestsVersionString[];
-
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.debug.xcconfig b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.debug.xcconfig
deleted file mode 100644
index 7c156c9ce..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.debug.xcconfig	
+++ /dev/null
@@ -1,11 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-FRAMEWORK_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/Alamofire" "${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer" "${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut" "${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa" "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift"
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-HEADER_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/Alamofire/Alamofire.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer/GCDWebServer.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut/MASShortcut.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa/RxCocoa.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay/RxRelay.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift/RxSwift.framework/Headers"
-OTHER_LDFLAGS = $(inherited) -l"z" -framework "Alamofire" -framework "AppKit" -framework "CFNetwork" -framework "Carbon" -framework "GCDWebServer" -framework "MASShortcut" -framework "RxCocoa" -framework "RxRelay" -framework "RxSwift" -framework "SystemConfiguration"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_PODFILE_DIR_PATH = ${SRCROOT}/.
-PODS_ROOT = ${SRCROOT}/Pods
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.modulemap b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.modulemap
deleted file mode 100644
index dc4c51afc..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.modulemap	
+++ /dev/null
@@ -1,6 +0,0 @@
-framework module Pods_ShadowsocksX_NGTests {
-  umbrella header "Pods-ShadowsocksX-NGTests-umbrella.h"
-
-  export *
-  module * { export * }
-}
diff --git a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.release.xcconfig b/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.release.xcconfig
deleted file mode 100644
index 7c156c9ce..000000000
--- a/Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.release.xcconfig	
+++ /dev/null
@@ -1,11 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-FRAMEWORK_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/Alamofire" "${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer" "${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut" "${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa" "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift"
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-HEADER_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/Alamofire/Alamofire.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/GCDWebServer/GCDWebServer.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/MASShortcut/MASShortcut.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa/RxCocoa.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay/RxRelay.framework/Headers" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift/RxSwift.framework/Headers"
-OTHER_LDFLAGS = $(inherited) -l"z" -framework "Alamofire" -framework "AppKit" -framework "CFNetwork" -framework "Carbon" -framework "GCDWebServer" -framework "MASShortcut" -framework "RxCocoa" -framework "RxRelay" -framework "RxSwift" -framework "SystemConfiguration"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_PODFILE_DIR_PATH = ${SRCROOT}/.
-PODS_ROOT = ${SRCROOT}/Pods
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-acknowledgements.markdown b/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-acknowledgements.markdown
deleted file mode 100644
index 22ed19d64..000000000
--- a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-acknowledgements.markdown	
+++ /dev/null
@@ -1,29 +0,0 @@
-# Acknowledgements
-This application makes use of the following third party libraries:
-
-## BRLOptionParser
-
-(The MIT License)
-
-Copyright © 2013-2015 Stephen Celis (<stephen@stephencelis.com>)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
-Generated by CocoaPods - https://cocoapods.org
diff --git a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-acknowledgements.plist b/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-acknowledgements.plist
deleted file mode 100644
index db9809040..000000000
--- a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-acknowledgements.plist	
+++ /dev/null
@@ -1,61 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>PreferenceSpecifiers</key>
-	<array>
-		<dict>
-			<key>FooterText</key>
-			<string>This application makes use of the following third party libraries:</string>
-			<key>Title</key>
-			<string>Acknowledgements</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>(The MIT License)
-
-Copyright © 2013-2015 Stephen Celis (&lt;stephen@stephencelis.com&gt;)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-</string>
-			<key>License</key>
-			<string>MIT</string>
-			<key>Title</key>
-			<string>BRLOptionParser</string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-		<dict>
-			<key>FooterText</key>
-			<string>Generated by CocoaPods - https://cocoapods.org</string>
-			<key>Title</key>
-			<string></string>
-			<key>Type</key>
-			<string>PSGroupSpecifier</string>
-		</dict>
-	</array>
-	<key>StringsTable</key>
-	<string>Acknowledgements</string>
-	<key>Title</key>
-	<string>Acknowledgements</string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-dummy.m b/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-dummy.m
deleted file mode 100644
index 256c8af12..000000000
--- a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_Pods_proxy_conf_helper : NSObject
-@end
-@implementation PodsDummy_Pods_proxy_conf_helper
-@end
diff --git a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-frameworks.sh b/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-frameworks.sh
deleted file mode 100755
index 881cbaed3..000000000
--- a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-frameworks.sh	
+++ /dev/null
@@ -1,137 +0,0 @@
-#!/bin/sh
-set -e
-
-echo "mkdir -p ${CONFIGURATION_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-mkdir -p "${CONFIGURATION_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-
-SWIFT_STDLIB_PATH="${DT_TOOLCHAIN_DIR}/usr/lib/swift/${PLATFORM_NAME}"
-
-# Used as a return value for each invocation of `strip_invalid_archs` function.
-STRIP_BINARY_RETVAL=0
-
-# This protects against multiple targets copying the same framework dependency at the same time. The solution
-# was originally proposed here: https://lists.samba.org/archive/rsync/2008-February/020158.html
-RSYNC_PROTECT_TMP_FILES=(--filter "P .*.??????")
-
-# Copies and strips a vendored framework
-install_framework()
-{
-  if [ -r "${BUILT_PRODUCTS_DIR}/$1" ]; then
-    local source="${BUILT_PRODUCTS_DIR}/$1"
-  elif [ -r "${BUILT_PRODUCTS_DIR}/$(basename "$1")" ]; then
-    local source="${BUILT_PRODUCTS_DIR}/$(basename "$1")"
-  elif [ -r "$1" ]; then
-    local source="$1"
-  fi
-
-  local destination="${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-
-  if [ -L "${source}" ]; then
-      echo "Symlinked..."
-      source="$(readlink "${source}")"
-  fi
-
-  # Use filter instead of exclude so missing patterns don't throw errors.
-  echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter \"- CVS/\" --filter \"- .svn/\" --filter \"- .git/\" --filter \"- .hg/\" --filter \"- Headers\" --filter \"- PrivateHeaders\" --filter \"- Modules\" \"${source}\" \"${destination}\""
-  rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${source}" "${destination}"
-
-  local basename
-  basename="$(basename -s .framework "$1")"
-  binary="${destination}/${basename}.framework/${basename}"
-  if ! [ -r "$binary" ]; then
-    binary="${destination}/${basename}"
-  fi
-
-  # Strip invalid architectures so "fat" simulator / device frameworks work on device
-  if [[ "$(file "$binary")" == *"dynamically linked shared library"* ]]; then
-    strip_invalid_archs "$binary"
-  fi
-
-  # Resign the code if required by the build settings to avoid unstable apps
-  code_sign_if_enabled "${destination}/$(basename "$1")"
-
-  # Embed linked Swift runtime libraries. No longer necessary as of Xcode 7.
-  if [ "${XCODE_VERSION_MAJOR}" -lt 7 ]; then
-    local swift_runtime_libs
-    swift_runtime_libs=$(xcrun otool -LX "$binary" | grep --color=never @rpath/libswift | sed -E s/@rpath\\/\(.+dylib\).*/\\1/g | uniq -u  && exit ${PIPESTATUS[0]})
-    for lib in $swift_runtime_libs; do
-      echo "rsync -auv \"${SWIFT_STDLIB_PATH}/${lib}\" \"${destination}\""
-      rsync -auv "${SWIFT_STDLIB_PATH}/${lib}" "${destination}"
-      code_sign_if_enabled "${destination}/${lib}"
-    done
-  fi
-}
-
-# Copies and strips a vendored dSYM
-install_dsym() {
-  local source="$1"
-  if [ -r "$source" ]; then
-    # Copy the dSYM into a the targets temp dir.
-    echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter \"- CVS/\" --filter \"- .svn/\" --filter \"- .git/\" --filter \"- .hg/\" --filter \"- Headers\" --filter \"- PrivateHeaders\" --filter \"- Modules\" \"${source}\" \"${DERIVED_FILES_DIR}\""
-    rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${source}" "${DERIVED_FILES_DIR}"
-
-    local basename
-    basename="$(basename -s .framework.dSYM "$source")"
-    binary="${DERIVED_FILES_DIR}/${basename}.framework.dSYM/Contents/Resources/DWARF/${basename}"
-
-    # Strip invalid architectures so "fat" simulator / device frameworks work on device
-    if [[ "$(file "$binary")" == *"Mach-O dSYM companion"* ]]; then
-      strip_invalid_archs "$binary"
-    fi
-
-    if [[ $STRIP_BINARY_RETVAL == 1 ]]; then
-      # Move the stripped file into its final destination.
-      echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter \"- CVS/\" --filter \"- .svn/\" --filter \"- .git/\" --filter \"- .hg/\" --filter \"- Headers\" --filter \"- PrivateHeaders\" --filter \"- Modules\" \"${DERIVED_FILES_DIR}/${basename}.framework.dSYM\" \"${DWARF_DSYM_FOLDER_PATH}\""
-      rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" --filter "- CVS/" --filter "- .svn/" --filter "- .git/" --filter "- .hg/" --filter "- Headers" --filter "- PrivateHeaders" --filter "- Modules" "${DERIVED_FILES_DIR}/${basename}.framework.dSYM" "${DWARF_DSYM_FOLDER_PATH}"
-    else
-      # The dSYM was not stripped at all, in this case touch a fake folder so the input/output paths from Xcode do not reexecute this script because the file is missing.
-      touch "${DWARF_DSYM_FOLDER_PATH}/${basename}.framework.dSYM"
-    fi
-  fi
-}
-
-# Signs a framework with the provided identity
-code_sign_if_enabled() {
-  if [ -n "${EXPANDED_CODE_SIGN_IDENTITY}" -a "${CODE_SIGNING_REQUIRED}" != "NO" -a "${CODE_SIGNING_ALLOWED}" != "NO" ]; then
-    # Use the current code_sign_identitiy
-    echo "Code Signing $1 with Identity ${EXPANDED_CODE_SIGN_IDENTITY_NAME}"
-    local code_sign_cmd="/usr/bin/codesign --force --sign ${EXPANDED_CODE_SIGN_IDENTITY} ${OTHER_CODE_SIGN_FLAGS} --preserve-metadata=identifier,entitlements '$1'"
-
-    if [ "${COCOAPODS_PARALLEL_CODE_SIGN}" == "true" ]; then
-      code_sign_cmd="$code_sign_cmd &"
-    fi
-    echo "$code_sign_cmd"
-    eval "$code_sign_cmd"
-  fi
-}
-
-# Strip invalid architectures
-strip_invalid_archs() {
-  binary="$1"
-  # Get architectures for current target binary
-  binary_archs="$(lipo -info "$binary" | rev | cut -d ':' -f1 | awk '{$1=$1;print}' | rev)"
-  # Intersect them with the architectures we are building for
-  intersected_archs="$(echo ${ARCHS[@]} ${binary_archs[@]} | tr ' ' '\n' | sort | uniq -d)"
-  # If there are no archs supported by this binary then warn the user
-  if [[ -z "$intersected_archs" ]]; then
-    echo "warning: [CP] Vendored binary '$binary' contains architectures ($binary_archs) none of which match the current build architectures ($ARCHS)."
-    STRIP_BINARY_RETVAL=0
-    return
-  fi
-  stripped=""
-  for arch in $binary_archs; do
-    if ! [[ "${ARCHS}" == *"$arch"* ]]; then
-      # Strip non-valid architectures in-place
-      lipo -remove "$arch" -output "$binary" "$binary" || exit 1
-      stripped="$stripped $arch"
-    fi
-  done
-  if [[ "$stripped" ]]; then
-    echo "Stripped $binary of architectures:$stripped"
-  fi
-  STRIP_BINARY_RETVAL=1
-}
-
-if [ "${COCOAPODS_PARALLEL_CODE_SIGN}" == "true" ]; then
-  wait
-fi
diff --git a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-resources.sh b/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-resources.sh
deleted file mode 100755
index a7df4405b..000000000
--- a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper-resources.sh	
+++ /dev/null
@@ -1,106 +0,0 @@
-#!/bin/sh
-set -e
-
-mkdir -p "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-
-RESOURCES_TO_COPY=${PODS_ROOT}/resources-to-copy-${TARGETNAME}.txt
-> "$RESOURCES_TO_COPY"
-
-XCASSET_FILES=()
-
-# This protects against multiple targets copying the same framework dependency at the same time. The solution
-# was originally proposed here: https://lists.samba.org/archive/rsync/2008-February/020158.html
-RSYNC_PROTECT_TMP_FILES=(--filter "P .*.??????")
-
-case "${TARGETED_DEVICE_FAMILY}" in
-  1,2)
-    TARGET_DEVICE_ARGS="--target-device ipad --target-device iphone"
-    ;;
-  1)
-    TARGET_DEVICE_ARGS="--target-device iphone"
-    ;;
-  2)
-    TARGET_DEVICE_ARGS="--target-device ipad"
-    ;;
-  3)
-    TARGET_DEVICE_ARGS="--target-device tv"
-    ;;
-  4)
-    TARGET_DEVICE_ARGS="--target-device watch"
-    ;;
-  *)
-    TARGET_DEVICE_ARGS="--target-device mac"
-    ;;
-esac
-
-install_resource()
-{
-  if [[ "$1" = /* ]] ; then
-    RESOURCE_PATH="$1"
-  else
-    RESOURCE_PATH="${PODS_ROOT}/$1"
-  fi
-  if [[ ! -e "$RESOURCE_PATH" ]] ; then
-    cat << EOM
-error: Resource "$RESOURCE_PATH" not found. Run 'pod install' to update the copy resources script.
-EOM
-    exit 1
-  fi
-  case $RESOURCE_PATH in
-    *.storyboard)
-      echo "ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile ${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .storyboard`.storyboardc $RESOURCE_PATH --sdk ${SDKROOT} ${TARGET_DEVICE_ARGS}" || true
-      ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .storyboard`.storyboardc" "$RESOURCE_PATH" --sdk "${SDKROOT}" ${TARGET_DEVICE_ARGS}
-      ;;
-    *.xib)
-      echo "ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile ${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .xib`.nib $RESOURCE_PATH --sdk ${SDKROOT} ${TARGET_DEVICE_ARGS}" || true
-      ibtool --reference-external-strings-file --errors --warnings --notices --minimum-deployment-target ${!DEPLOYMENT_TARGET_SETTING_NAME} --output-format human-readable-text --compile "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename \"$RESOURCE_PATH\" .xib`.nib" "$RESOURCE_PATH" --sdk "${SDKROOT}" ${TARGET_DEVICE_ARGS}
-      ;;
-    *.framework)
-      echo "mkdir -p ${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}" || true
-      mkdir -p "${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-      echo "rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" $RESOURCE_PATH ${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}" || true
-      rsync --delete -av "${RSYNC_PROTECT_TMP_FILES[@]}" "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
-      ;;
-    *.xcdatamodel)
-      echo "xcrun momc \"$RESOURCE_PATH\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH"`.mom\"" || true
-      xcrun momc "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcdatamodel`.mom"
-      ;;
-    *.xcdatamodeld)
-      echo "xcrun momc \"$RESOURCE_PATH\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcdatamodeld`.momd\"" || true
-      xcrun momc "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcdatamodeld`.momd"
-      ;;
-    *.xcmappingmodel)
-      echo "xcrun mapc \"$RESOURCE_PATH\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcmappingmodel`.cdm\"" || true
-      xcrun mapc "$RESOURCE_PATH" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/`basename "$RESOURCE_PATH" .xcmappingmodel`.cdm"
-      ;;
-    *.xcassets)
-      ABSOLUTE_XCASSET_FILE="$RESOURCE_PATH"
-      XCASSET_FILES+=("$ABSOLUTE_XCASSET_FILE")
-      ;;
-    *)
-      echo "$RESOURCE_PATH" || true
-      echo "$RESOURCE_PATH" >> "$RESOURCES_TO_COPY"
-      ;;
-  esac
-}
-
-mkdir -p "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-rsync -avr --copy-links --no-relative --exclude '*/.svn/*' --files-from="$RESOURCES_TO_COPY" / "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-if [[ "${ACTION}" == "install" ]] && [[ "${SKIP_INSTALL}" == "NO" ]]; then
-  mkdir -p "${INSTALL_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-  rsync -avr --copy-links --no-relative --exclude '*/.svn/*' --files-from="$RESOURCES_TO_COPY" / "${INSTALL_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-fi
-rm -f "$RESOURCES_TO_COPY"
-
-if [[ -n "${WRAPPER_EXTENSION}" ]] && [ "`xcrun --find actool`" ] && [ -n "$XCASSET_FILES" ]
-then
-  # Find all other xcassets (this unfortunately includes those of path pods and other targets).
-  OTHER_XCASSETS=$(find "$PWD" -iname "*.xcassets" -type d)
-  while read line; do
-    if [[ $line != "${PODS_ROOT}*" ]]; then
-      XCASSET_FILES+=("$line")
-    fi
-  done <<<"$OTHER_XCASSETS"
-
-  printf "%s\0" "${XCASSET_FILES[@]}" | xargs -0 xcrun actool --output-format human-readable-text --notices --warnings --platform "${PLATFORM_NAME}" --minimum-deployment-target "${!DEPLOYMENT_TARGET_SETTING_NAME}" ${TARGET_DEVICE_ARGS} --compress-pngs --compile "${BUILT_PRODUCTS_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
-fi
diff --git a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper.debug.xcconfig b/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper.debug.xcconfig
deleted file mode 100644
index 82a948c42..000000000
--- a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper.debug.xcconfig	
+++ /dev/null
@@ -1,11 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-HEADER_SEARCH_PATHS = $(inherited) "${PODS_ROOT}/Headers/Public" "${PODS_ROOT}/Headers/Public/BRLOptionParser"
-LIBRARY_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/BRLOptionParser"
-OTHER_LDFLAGS = $(inherited) -ObjC -l"BRLOptionParser"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_PODFILE_DIR_PATH = ${SRCROOT}/.
-PODS_ROOT = ${SRCROOT}/Pods
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper.release.xcconfig b/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper.release.xcconfig
deleted file mode 100644
index 82a948c42..000000000
--- a/Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper.release.xcconfig	
+++ /dev/null
@@ -1,11 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-HEADER_SEARCH_PATHS = $(inherited) "${PODS_ROOT}/Headers/Public" "${PODS_ROOT}/Headers/Public/BRLOptionParser"
-LIBRARY_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/BRLOptionParser"
-OTHER_LDFLAGS = $(inherited) -ObjC -l"BRLOptionParser"
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_PODFILE_DIR_PATH = ${SRCROOT}/.
-PODS_ROOT = ${SRCROOT}/Pods
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/RxCocoa/Info.plist b/Pods/Target Support Files/RxCocoa/Info.plist
deleted file mode 100644
index 7ecb368db..000000000
--- a/Pods/Target Support Files/RxCocoa/Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>4.1.2</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/RxCocoa/RxCocoa-Info.plist b/Pods/Target Support Files/RxCocoa/RxCocoa-Info.plist
deleted file mode 100644
index 45024a7b2..000000000
--- a/Pods/Target Support Files/RxCocoa/RxCocoa-Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>6.2.0</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/RxCocoa/RxCocoa-dummy.m b/Pods/Target Support Files/RxCocoa/RxCocoa-dummy.m
deleted file mode 100644
index d4711fd41..000000000
--- a/Pods/Target Support Files/RxCocoa/RxCocoa-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_RxCocoa : NSObject
-@end
-@implementation PodsDummy_RxCocoa
-@end
diff --git a/Pods/Target Support Files/RxCocoa/RxCocoa-prefix.pch b/Pods/Target Support Files/RxCocoa/RxCocoa-prefix.pch
deleted file mode 100644
index 082f8af22..000000000
--- a/Pods/Target Support Files/RxCocoa/RxCocoa-prefix.pch	
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
diff --git a/Pods/Target Support Files/RxCocoa/RxCocoa-umbrella.h b/Pods/Target Support Files/RxCocoa/RxCocoa-umbrella.h
deleted file mode 100644
index dff5fb186..000000000
--- a/Pods/Target Support Files/RxCocoa/RxCocoa-umbrella.h	
+++ /dev/null
@@ -1,22 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
-#import "RxCocoaRuntime.h"
-#import "_RX.h"
-#import "_RXDelegateProxy.h"
-#import "_RXKVOObserver.h"
-#import "_RXObjCRuntime.h"
-#import "RxCocoa.h"
-
-FOUNDATION_EXPORT double RxCocoaVersionNumber;
-FOUNDATION_EXPORT const unsigned char RxCocoaVersionString[];
-
diff --git a/Pods/Target Support Files/RxCocoa/RxCocoa.debug.xcconfig b/Pods/Target Support Files/RxCocoa/RxCocoa.debug.xcconfig
deleted file mode 100644
index 4a1b0c654..000000000
--- a/Pods/Target Support Files/RxCocoa/RxCocoa.debug.xcconfig	
+++ /dev/null
@@ -1,14 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa
-FRAMEWORK_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift"
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/RxCocoa
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/RxCocoa/RxCocoa.modulemap b/Pods/Target Support Files/RxCocoa/RxCocoa.modulemap
deleted file mode 100644
index 0aa97aa36..000000000
--- a/Pods/Target Support Files/RxCocoa/RxCocoa.modulemap	
+++ /dev/null
@@ -1,6 +0,0 @@
-framework module RxCocoa {
-  umbrella header "RxCocoa-umbrella.h"
-
-  export *
-  module * { export * }
-}
diff --git a/Pods/Target Support Files/RxCocoa/RxCocoa.release.xcconfig b/Pods/Target Support Files/RxCocoa/RxCocoa.release.xcconfig
deleted file mode 100644
index 4a1b0c654..000000000
--- a/Pods/Target Support Files/RxCocoa/RxCocoa.release.xcconfig	
+++ /dev/null
@@ -1,14 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa
-FRAMEWORK_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/RxRelay" "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift"
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/RxCocoa
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/RxCocoa/RxCocoa.xcconfig b/Pods/Target Support Files/RxCocoa/RxCocoa.xcconfig
deleted file mode 100644
index 57f6a18aa..000000000
--- a/Pods/Target Support Files/RxCocoa/RxCocoa.xcconfig	
+++ /dev/null
@@ -1,11 +0,0 @@
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/RxCocoa
-FRAMEWORK_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift"
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/RxCocoa
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
diff --git a/Pods/Target Support Files/RxRelay/RxRelay-Info.plist b/Pods/Target Support Files/RxRelay/RxRelay-Info.plist
deleted file mode 100644
index 45024a7b2..000000000
--- a/Pods/Target Support Files/RxRelay/RxRelay-Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>6.2.0</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/RxRelay/RxRelay-dummy.m b/Pods/Target Support Files/RxRelay/RxRelay-dummy.m
deleted file mode 100644
index eec01908c..000000000
--- a/Pods/Target Support Files/RxRelay/RxRelay-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_RxRelay : NSObject
-@end
-@implementation PodsDummy_RxRelay
-@end
diff --git a/Pods/Target Support Files/RxRelay/RxRelay-prefix.pch b/Pods/Target Support Files/RxRelay/RxRelay-prefix.pch
deleted file mode 100644
index 082f8af22..000000000
--- a/Pods/Target Support Files/RxRelay/RxRelay-prefix.pch	
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
diff --git a/Pods/Target Support Files/RxRelay/RxRelay-umbrella.h b/Pods/Target Support Files/RxRelay/RxRelay-umbrella.h
deleted file mode 100644
index 734d5e44c..000000000
--- a/Pods/Target Support Files/RxRelay/RxRelay-umbrella.h	
+++ /dev/null
@@ -1,16 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
-
-FOUNDATION_EXPORT double RxRelayVersionNumber;
-FOUNDATION_EXPORT const unsigned char RxRelayVersionString[];
-
diff --git a/Pods/Target Support Files/RxRelay/RxRelay.debug.xcconfig b/Pods/Target Support Files/RxRelay/RxRelay.debug.xcconfig
deleted file mode 100644
index 655398c02..000000000
--- a/Pods/Target Support Files/RxRelay/RxRelay.debug.xcconfig	
+++ /dev/null
@@ -1,14 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/RxRelay
-FRAMEWORK_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift"
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/RxRelay
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/RxRelay/RxRelay.modulemap b/Pods/Target Support Files/RxRelay/RxRelay.modulemap
deleted file mode 100644
index 96a115a14..000000000
--- a/Pods/Target Support Files/RxRelay/RxRelay.modulemap	
+++ /dev/null
@@ -1,6 +0,0 @@
-framework module RxRelay {
-  umbrella header "RxRelay-umbrella.h"
-
-  export *
-  module * { export * }
-}
diff --git a/Pods/Target Support Files/RxRelay/RxRelay.release.xcconfig b/Pods/Target Support Files/RxRelay/RxRelay.release.xcconfig
deleted file mode 100644
index 655398c02..000000000
--- a/Pods/Target Support Files/RxRelay/RxRelay.release.xcconfig	
+++ /dev/null
@@ -1,14 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/RxRelay
-FRAMEWORK_SEARCH_PATHS = $(inherited) "${PODS_CONFIGURATION_BUILD_DIR}/RxSwift"
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/RxRelay
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/RxSwift/Info.plist b/Pods/Target Support Files/RxSwift/Info.plist
deleted file mode 100644
index 7ecb368db..000000000
--- a/Pods/Target Support Files/RxSwift/Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>4.1.2</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/RxSwift/RxSwift-Info.plist b/Pods/Target Support Files/RxSwift/RxSwift-Info.plist
deleted file mode 100644
index 45024a7b2..000000000
--- a/Pods/Target Support Files/RxSwift/RxSwift-Info.plist	
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>${EXECUTABLE_NAME}</string>
-  <key>CFBundleIdentifier</key>
-  <string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>${PRODUCT_NAME}</string>
-  <key>CFBundlePackageType</key>
-  <string>FMWK</string>
-  <key>CFBundleShortVersionString</key>
-  <string>6.2.0</string>
-  <key>CFBundleSignature</key>
-  <string>????</string>
-  <key>CFBundleVersion</key>
-  <string>${CURRENT_PROJECT_VERSION}</string>
-  <key>NSPrincipalClass</key>
-  <string></string>
-</dict>
-</plist>
diff --git a/Pods/Target Support Files/RxSwift/RxSwift-dummy.m b/Pods/Target Support Files/RxSwift/RxSwift-dummy.m
deleted file mode 100644
index 3783f72ce..000000000
--- a/Pods/Target Support Files/RxSwift/RxSwift-dummy.m	
+++ /dev/null
@@ -1,5 +0,0 @@
-#import <Foundation/Foundation.h>
-@interface PodsDummy_RxSwift : NSObject
-@end
-@implementation PodsDummy_RxSwift
-@end
diff --git a/Pods/Target Support Files/RxSwift/RxSwift-prefix.pch b/Pods/Target Support Files/RxSwift/RxSwift-prefix.pch
deleted file mode 100644
index 082f8af22..000000000
--- a/Pods/Target Support Files/RxSwift/RxSwift-prefix.pch	
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
diff --git a/Pods/Target Support Files/RxSwift/RxSwift-umbrella.h b/Pods/Target Support Files/RxSwift/RxSwift-umbrella.h
deleted file mode 100644
index 2e05561de..000000000
--- a/Pods/Target Support Files/RxSwift/RxSwift-umbrella.h	
+++ /dev/null
@@ -1,16 +0,0 @@
-#ifdef __OBJC__
-#import <Cocoa/Cocoa.h>
-#else
-#ifndef FOUNDATION_EXPORT
-#if defined(__cplusplus)
-#define FOUNDATION_EXPORT extern "C"
-#else
-#define FOUNDATION_EXPORT extern
-#endif
-#endif
-#endif
-
-
-FOUNDATION_EXPORT double RxSwiftVersionNumber;
-FOUNDATION_EXPORT const unsigned char RxSwiftVersionString[];
-
diff --git a/Pods/Target Support Files/RxSwift/RxSwift.debug.xcconfig b/Pods/Target Support Files/RxSwift/RxSwift.debug.xcconfig
deleted file mode 100644
index 7c0e99933..000000000
--- a/Pods/Target Support Files/RxSwift/RxSwift.debug.xcconfig	
+++ /dev/null
@@ -1,13 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/RxSwift
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/RxSwift
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/RxSwift/RxSwift.modulemap b/Pods/Target Support Files/RxSwift/RxSwift.modulemap
deleted file mode 100644
index eae3d1c41..000000000
--- a/Pods/Target Support Files/RxSwift/RxSwift.modulemap	
+++ /dev/null
@@ -1,6 +0,0 @@
-framework module RxSwift {
-  umbrella header "RxSwift-umbrella.h"
-
-  export *
-  module * { export * }
-}
diff --git a/Pods/Target Support Files/RxSwift/RxSwift.release.xcconfig b/Pods/Target Support Files/RxSwift/RxSwift.release.xcconfig
deleted file mode 100644
index 7c0e99933..000000000
--- a/Pods/Target Support Files/RxSwift/RxSwift.release.xcconfig	
+++ /dev/null
@@ -1,13 +0,0 @@
-CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = NO
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/RxSwift
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/RxSwift
-PODS_XCFRAMEWORKS_BUILD_DIR = $(PODS_CONFIGURATION_BUILD_DIR)/XCFrameworkIntermediates
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
-USE_RECURSIVE_SCRIPT_INPUTS_IN_SCRIPT_PHASES = YES
diff --git a/Pods/Target Support Files/RxSwift/RxSwift.xcconfig b/Pods/Target Support Files/RxSwift/RxSwift.xcconfig
deleted file mode 100644
index 248ed93fd..000000000
--- a/Pods/Target Support Files/RxSwift/RxSwift.xcconfig	
+++ /dev/null
@@ -1,10 +0,0 @@
-CODE_SIGN_IDENTITY =
-CONFIGURATION_BUILD_DIR = ${PODS_CONFIGURATION_BUILD_DIR}/RxSwift
-GCC_PREPROCESSOR_DEFINITIONS = $(inherited) COCOAPODS=1
-OTHER_SWIFT_FLAGS = $(inherited) -D COCOAPODS
-PODS_BUILD_DIR = ${BUILD_DIR}
-PODS_CONFIGURATION_BUILD_DIR = ${PODS_BUILD_DIR}/$(CONFIGURATION)$(EFFECTIVE_PLATFORM_NAME)
-PODS_ROOT = ${SRCROOT}
-PODS_TARGET_SRCROOT = ${PODS_ROOT}/RxSwift
-PRODUCT_BUNDLE_IDENTIFIER = org.cocoapods.${PRODUCT_NAME:rfc1034identifier}
-SKIP_INSTALL = YES
diff --git a/README.md b/README.md
index 3846bb326..ff976b5a0 100644
--- a/README.md
+++ b/README.md
@@ -1,63 +1,41 @@
-# ShadowsocksX-NG
+# ShadowsocksX-NG2
 
-[Download](https://github.com/shadowsocks/ShadowsocksX-NG/releases/latest)
+English | [简体中文](README.zh.md)
 
-[![Actions Status](https://github.com/shadowsocks/ShadowsocksX-NG/workflows/CI/badge.svg)](https://github.com/shadowsocks/ShadowsocksX-NG/actions)
+A native Shadowsocks client for Apple Silicon Macs. Manage servers, subscriptions, and routing from the menu bar. Mac apps can connect through its SOCKS5 and HTTP proxies.
 
-Next Generation of [ShadowsocksX](https://github.com/shadowsocks/shadowsocks-iOS)
+> Download the latest ShadowsocksX-NG2 release from [GitHub Releases](https://github.com/shadowsocks/ShadowsocksX-NG/releases). The page also hosts legacy 1.x releases.
 
-## Why a new implementation?
+## Project status
 
-It's hard to maintain the original implementation as there is too much unused code in it.
-It also embeds the `ss-local` source code. It's crazy to maintain dependencies of `ss-local`.
-So it's hard to update the `ss-local` version.
+ShadowsocksX-NG is undergoing a major rewrite. The legacy version is no longer maintained, and ShadowsocksX-NG 2 is still in development.
 
-Now I just copied the `ss-local` from Homebrew. Run `ss-local` executable as a Launch Agent in the background.
-So there is only some source code related to GUI left.
-Then I have rewrited the GUI code in Swift.
+We will close all remaining legacy issues and temporarily restrict new Issues and PRs until the v2 code is stable and officially released.
 
-## Requirements
+Until then, please use [Discussions](https://github.com/shadowsocks/ShadowsocksX-NG/discussions) for questions, bug reports, feedback, and suggestions. Thanks for your understanding and support.
 
-### Running
+## System requirements
 
-macOS 10.12+
+- macOS 15 or later
+- An Apple Silicon (arm64) Mac
 
-### Building
-
-- Xcode 12.5.1+
-- CocoaPods 1.10.1+
-
-## Download
-
-From [here](https://github.com/shadowsocks/ShadowsocksX-NG/releases/)
+> [!NOTE]
+> This project provides a client. It does not provide servers or subscription services.
 
 ## Features
 
-- `ss-local` from shadowsocks-libev 3.2.5.
-- Support SIP003 plugins. Embed `kcptun`,  `simple-obfs` and `v2ray-plugin`.
-- Could update PAC by download GFW List from GitHub.
-- Share your server profiles by qrcode or url.
-- Import server profile urls from pasteboard.
-- Import server profile by scan QRCode on screen.
-- Custom rules for PAC.
-- Support for [AEAD Ciphers](https://shadowsocks.org/en/spec/AEAD-Ciphers.html)
-- HTTP Proxy by [privoxy](http://www.privoxy.org/)
-
-## Difference from original ShadowsocksX
-
-`ss-local` is run as a background service through launchd, not as an in-app process.
-So after you quit the app, the `ss-local` might be still running.
-
-Added a manual mode which won't configure the system proxy settings,
-so that you could configure your apps to use the SOCKS5 proxy manually.
-
-## Contributing
-
-Contributions must be available on a separately named branch based on the latest version of the main branch `develop`.
-
-ref: [GitFlow](http://nvie.com/posts/a-successful-git-branching-model/)
-
-## License
-
-The project is released under the terms of the GPLv3.
-
+- Add or import Shadowsocks configurations, organize servers into groups, and mark favorites. Add HTTPS SIP-008 subscriptions and view traffic and expiry information provided by the service provider.
+- Use global, rules, or direct mode. In rules mode, choose a rule preset: `proxy GFW List destinations`, `connect to mainland China destinations directly`, or `proxy mainland China destinations`. Review bundled rules and manage custom rules for each preset.
+- Use SIP022 AEAD-2022 ciphers, SIP023 Shadowsocks 2022 Extensible Identity Headers, and load balancing across multiple servers through upstream `sslocal`.
+- Test server latency.
+- Connect Mac apps and LAN devices through local SOCKS5 and HTTP proxies. You can enable LAN listeners and set access credentials when needed; LAN listeners are off by default.
+- [v2ray-plugin](https://github.com/shadowsocks/v2ray-plugin) and [Cloak](https://github.com/cbeuw/Cloak) are included. The bundled `v2ray-plugin` also provides a [Hysteria2 transport mode](https://github.com/shadowsocks/v2ray-plugin#shadowsocks-over-hysteria2-transport) for Shadowsocks TCP traffic. Both ends must use this mode; ordinary Hysteria2 proxy nodes are not compatible. You can also configure your own plugins.
+- The server library and listener configuration are encrypted on your Mac using age. Diagnostic reports exclude sensitive data such as passwords, plugin options, and subscription URLs.
+- Use the menu bar app in Simplified Chinese or English, and optionally launch it at login.
+
+## Project and documentation
+
+- [Legacy source archive](https://github.com/shadowsocks/ShadowsocksX-NG/tree/legacy-v1)
+- [NG2 developer documentation](ShadowsocksX-NG2/README.md)
+- [Development and validation guide](docs/development.md)
+- [GPL-3.0 license](LICENSE)
diff --git a/README.zh.md b/README.zh.md
new file mode 100644
index 000000000..a3b32db2d
--- /dev/null
+++ b/README.zh.md
@@ -0,0 +1,41 @@
+# ShadowsocksX-NG2
+
+[English](README.md) | 简体中文
+
+面向 Apple Silicon Mac 的原生 Shadowsocks 客户端。通过菜单栏管理服务器、订阅和代理规则，并为 Mac 应用提供 SOCKS5 与 HTTP 代理入口。
+
+> 请从 [GitHub Releases](https://github.com/shadowsocks/ShadowsocksX-NG/releases) 下载最新的 ShadowsocksX-NG2 版本。发布页也会保留旧版 1.x。
+
+## 项目状态
+
+ShadowsocksX-NG 正在进行大规模重构。旧版已停止维护，ShadowsocksX-NG 2 仍在开发中。
+
+我们会关闭旧版遗留的所有 Issue。v2 代码稳定并正式发布前，暂不接受新的 Issue 和 PR。
+
+在此期间，欢迎到 [Discussions](https://github.com/shadowsocks/ShadowsocksX-NG/discussions) 提问、报告 Bug 或分享反馈和建议。感谢大家的理解与支持。
+
+## 系统要求
+
+- macOS 15 或更新版本
+- Apple Silicon（arm64）Mac
+
+> [!NOTE]
+> 本项目提供客户端，不提供服务器或订阅服务。
+
+## 功能
+
+- 手动添加或导入 Shadowsocks 配置，按分组和收藏整理服务器；添加 HTTPS SIP-008 订阅，并查看服务商提供的流量与到期信息。
+- 使用全局模式、规则模式或直连模式。规则模式提供三种规则方案：`仅代理 GFW 列表内目标`、`中国大陆目标直连`、`中国大陆目标代理`。可查看内置规则，并为每个方案管理自定义规则。
+- 通过上游 `sslocal` 支持 SIP022 AEAD-2022 加密方法、SIP023 Shadowsocks 2022 可扩展身份标头和多服务器负载均衡。
+- 支持服务器延迟检测。
+- 通过本机 SOCKS5 与 HTTP 代理连接 Mac 应用和局域网设备。需要时可开启局域网监听，并设置访问凭据；局域网监听默认关闭。
+- 内置 [v2ray-plugin](https://github.com/shadowsocks/v2ray-plugin) 和 [Cloak](https://github.com/cbeuw/Cloak)，也支持配置用户自己的插件。内嵌的 `v2ray-plugin` 还提供 [Hysteria2 传输模式](https://github.com/shadowsocks/v2ray-plugin#shadowsocks-over-hysteria2-transport)，用于传输 Shadowsocks TCP 流量；通信两端都需使用该模式，普通 Hysteria2 代理节点不兼容。
+- 服务器库和监听配置以 age 格式加密保存在本机。诊断报告会排除密码、插件选项和订阅地址等敏感内容。
+- 菜单栏界面提供简体中文和英语，可设置登录时启动。
+
+## 项目与文档
+
+- [旧版源码归档](https://github.com/shadowsocks/ShadowsocksX-NG/tree/legacy-v1)
+- [NG2 开发文档](ShadowsocksX-NG2/README.zh.md)
+- [开发与验证指南](docs/development.zh.md)
+- [GPL-3.0 许可证](LICENSE)
diff --git a/ShadowsocksX-NG.xcodeproj/project.pbxproj b/ShadowsocksX-NG.xcodeproj/project.pbxproj
deleted file mode 100644
index 612380f3e..000000000
--- a/ShadowsocksX-NG.xcodeproj/project.pbxproj
+++ /dev/null
@@ -1,1228 +0,0 @@
-// !$*UTF8*$!
-{
-	archiveVersion = 1;
-	classes = {
-	};
-	objectVersion = 46;
-	objects = {
-
-/* Begin PBXBuildFile section */
-		1C82DBA81FA96C7500B32551 /* obfs-local in Resources */ = {isa = PBXBuildFile; fileRef = 1C82DBA51FA96C7400B32551 /* obfs-local */; };
-		1C82DBAA1FA96FB600B32551 /* install_simple_obfs.sh in Resources */ = {isa = PBXBuildFile; fileRef = 1C82DBA91FA96F0300B32551 /* install_simple_obfs.sh */; };
-		9B07EFA71D048BBB0052D9DF /* ss-local in Resources */ = {isa = PBXBuildFile; fileRef = 9B07EFA61D048BBB0052D9DF /* ss-local */; };
-		9B0BFFE91D0460A70040E62B /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B0BFFE81D0460A70040E62B /* AppDelegate.swift */; };
-		9B0BFFEB1D0460A70040E62B /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 9B0BFFEA1D0460A70040E62B /* Assets.xcassets */; };
-		9B0BFFEE1D0460A70040E62B /* MainMenu.xib in Resources */ = {isa = PBXBuildFile; fileRef = 9B0BFFEC1D0460A70040E62B /* MainMenu.xib */; };
-		9B20804A2326AC460075386C /* kcptun.sh in Resources */ = {isa = PBXBuildFile; fileRef = 9B2080482326AC460075386C /* kcptun.sh */; };
-		9B20804B2326AC460075386C /* client in Resources */ = {isa = PBXBuildFile; fileRef = 9B2080492326AC460075386C /* client */; };
-		9B2491B41D0ACC3A003BBECC /* PreferencesWindowController.xib in Resources */ = {isa = PBXBuildFile; fileRef = 9B2491B61D0ACC3A003BBECC /* PreferencesWindowController.xib */; };
-		9B3546721E802B1200B510B4 /* ToastWindowController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B3546701E802B1200B510B4 /* ToastWindowController.swift */; };
-		9B3546731E802B1200B510B4 /* ToastWindowController.xib in Resources */ = {isa = PBXBuildFile; fileRef = 9B3546711E802B1200B510B4 /* ToastWindowController.xib */; };
-		9B3F7BFF1E82BF5B00C68B75 /* libev.4.dylib in Resources */ = {isa = PBXBuildFile; fileRef = 9B3F7BF71E82BF2D00C68B75 /* libev.4.dylib */; };
-		9B3FFF0D1D05FEB30019A709 /* Utils.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B3FFF0C1D05FEB30019A709 /* Utils.swift */; };
-		9B3FFF141D0705810019A709 /* Notifications.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B3FFF131D0705810019A709 /* Notifications.swift */; };
-		9B3FFF171D072FDE0019A709 /* LaunchAtLoginController.m in Sources */ = {isa = PBXBuildFile; fileRef = 9B3FFF161D072FDE0019A709 /* LaunchAtLoginController.m */; };
-		9B3FFF1E1D0732660019A709 /* Utils.m in Sources */ = {isa = PBXBuildFile; fileRef = 9B3FFF1D1D0732660019A709 /* Utils.m */; };
-		9B3FFF211D08826E0019A709 /* PACUtils.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B3FFF201D08826E0019A709 /* PACUtils.swift */; };
-		9B3FFF231D088E8D0019A709 /* abp.js in Resources */ = {isa = PBXBuildFile; fileRef = 9B3FFF221D088E8D0019A709 /* abp.js */; };
-		9B3FFF271D0898EB0019A709 /* gfwlist.txt in Resources */ = {isa = PBXBuildFile; fileRef = 9B3FFF261D0898EB0019A709 /* gfwlist.txt */; };
-		9B3FFF291D08A1DF0019A709 /* user-rule.txt in Resources */ = {isa = PBXBuildFile; fileRef = 9B3FFF281D08A1DF0019A709 /* user-rule.txt */; };
-		9B3FFF321D08CEE40019A709 /* SWBQRCodeWindowController.m in Sources */ = {isa = PBXBuildFile; fileRef = 9B3FFF311D08CEE40019A709 /* SWBQRCodeWindowController.m */; };
-		9B3FFF341D08CEF70019A709 /* SWBQRCodeWindowController.xib in Resources */ = {isa = PBXBuildFile; fileRef = 9B3FFF331D08CEF70019A709 /* SWBQRCodeWindowController.xib */; };
-		9B3FFF3E1D08D9910019A709 /* SystemConfiguration.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 9B3FFF3D1D08D9910019A709 /* SystemConfiguration.framework */; };
-		9B3FFF471D09CD3B0019A709 /* main.m in Sources */ = {isa = PBXBuildFile; fileRef = 9B3FFF461D09CD3B0019A709 /* main.m */; };
-		9B3FFF4C1D09D8F70019A709 /* install_helper.sh in Resources */ = {isa = PBXBuildFile; fileRef = 9B3FFF4B1D09D8F70019A709 /* install_helper.sh */; };
-		9B3FFF4F1D09D9D50019A709 /* ProxyConfHelper.m in Sources */ = {isa = PBXBuildFile; fileRef = 9B3FFF4E1D09D9D50019A709 /* ProxyConfHelper.m */; };
-		9B3FFF541D09E2D10019A709 /* proxy_conf_helper in Resources */ = {isa = PBXBuildFile; fileRef = 9B3FFF441D09CD3B0019A709 /* proxy_conf_helper */; };
-		9B5831F61E7302F8009D5B7D /* ShortcutsController.m in Sources */ = {isa = PBXBuildFile; fileRef = 9B5831F51E7302F8009D5B7D /* ShortcutsController.m */; };
-		9B5831FF1E741969009D5B7D /* PreferencesWinController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B5831FD1E741969009D5B7D /* PreferencesWinController.swift */; };
-		9B5AA0AC209C43C200E8B659 /* Credits.rtf in Resources */ = {isa = PBXBuildFile; fileRef = 9B5AA0AB209C43C200E8B659 /* Credits.rtf */; };
-		9B5D132A2154A62600F99F03 /* install_kcptun.sh in Resources */ = {isa = PBXBuildFile; fileRef = 9B5D13272154A50700F99F03 /* install_kcptun.sh */; };
-		9B5DD7B02683A354005EFEF7 /* ShadowsocksX_NGTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B5DD7AF2683A354005EFEF7 /* ShadowsocksX_NGTests.swift */; };
-		9B5DD7B82683A369005EFEF7 /* ServerProfileTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B5DD7B72683A369005EFEF7 /* ServerProfileTests.swift */; };
-		9B6BF9541E27B2570061B9A7 /* ServiceManagement.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 9B6BF9531E27B2570061B9A7 /* ServiceManagement.framework */; };
-		9B7297E7214D69C300FD24AA /* libmbedcrypto.2.12.0.dylib in Resources */ = {isa = PBXBuildFile; fileRef = 9B7297E5214D68F800FD24AA /* libmbedcrypto.2.12.0.dylib */; };
-		9B7297EA214D7C6B00FD24AA /* ShareServerProfilesWindowController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B7297E8214D7C6B00FD24AA /* ShareServerProfilesWindowController.swift */; };
-		9B7297EC214DA88A00FD24AA /* ShareServerProfilesWindowController.xib in Resources */ = {isa = PBXBuildFile; fileRef = 9B7297EE214DA88A00FD24AA /* ShareServerProfilesWindowController.xib */; };
-		9B72FB62232782A300C6AAAE /* ImportWindowController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B72FB60232782A300C6AAAE /* ImportWindowController.swift */; };
-		9B74B5E9232949B100DEA386 /* ImportWindowController.xib in Resources */ = {isa = PBXBuildFile; fileRef = 9B74B5EB232949B100DEA386 /* ImportWindowController.xib */; };
-		9B7725E6232E30C50062299F /* PACURLFormatter.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B7725E5232E30C50062299F /* PACURLFormatter.swift */; };
-		9B7725EA232E54A20062299F /* menu_e_icon.png in Resources */ = {isa = PBXBuildFile; fileRef = 9B7725E8232E54A20062299F /* menu_e_icon.png */; };
-		9B7725EB232E54A20062299F /* menu_e_icon@2x.png in Resources */ = {isa = PBXBuildFile; fileRef = 9B7725E9232E54A20062299F /* menu_e_icon@2x.png */; };
-		9B84DAED2163A72F00DFF068 /* Diagnose.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B84DAEC2163A72F00DFF068 /* Diagnose.swift */; };
-		9B86459D1E7C2CAD00A84029 /* ProxyInterfacesViewCtrl.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B86459C1E7C2CAD00A84029 /* ProxyInterfacesViewCtrl.swift */; };
-		9B9B9966236992CA0036600F /* v2ray-plugin in Resources */ = {isa = PBXBuildFile; fileRef = 9B9B9965236992C90036600F /* v2ray-plugin */; };
-		9B9CBCAF1E263B1600FC61AA /* libpcre.1.dylib in Resources */ = {isa = PBXBuildFile; fileRef = 9B9CBCAD1E263A6600FC61AA /* libpcre.1.dylib */; };
-		9B9F13A71E8A28B300DE4794 /* LaunchHelper.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = 9B9F13A61E8A282D00DE4794 /* LaunchHelper.app */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
-		9BA04B231D23D5A5005AAD7F /* ProxyConfTool.m in Sources */ = {isa = PBXBuildFile; fileRef = 9BA04B221D23D5A5005AAD7F /* ProxyConfTool.m */; };
-		9BAA662723295FAB00F5CC99 /* icons8-Eye Filled-50.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA661723295FAB00F5CC99 /* icons8-Eye Filled-50.png */; };
-		9BAA662823295FAB00F5CC99 /* menu_m_icon.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA661823295FAB00F5CC99 /* menu_m_icon.png */; };
-		9BAA662923295FAB00F5CC99 /* menu_p_icon.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA661923295FAB00F5CC99 /* menu_p_icon.png */; };
-		9BAA662A23295FAB00F5CC99 /* menu_icon@2x.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA661A23295FAB00F5CC99 /* menu_icon@2x.png */; };
-		9BAA662B23295FAB00F5CC99 /* http.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA661B23295FAB00F5CC99 /* http.png */; };
-		9BAA662C23295FAC00F5CC99 /* menu_g_icon@2x.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA661C23295FAB00F5CC99 /* menu_g_icon@2x.png */; };
-		9BAA662D23295FAC00F5CC99 /* icons8-Blind Filled-50.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA661D23295FAB00F5CC99 /* icons8-Blind Filled-50.png */; };
-		9BAA662E23295FAC00F5CC99 /* menu_p_icon@2x.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA661E23295FAB00F5CC99 /* menu_p_icon@2x.png */; };
-		9BAA662F23295FAC00F5CC99 /* menu_icon_disabled@2x.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA661F23295FAB00F5CC99 /* menu_icon_disabled@2x.png */; };
-		9BAA663023295FAC00F5CC99 /* menu_icon_disabled.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA662023295FAB00F5CC99 /* menu_icon_disabled.png */; };
-		9BAA663123295FAC00F5CC99 /* menu_m_icon@2x.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA662123295FAB00F5CC99 /* menu_m_icon@2x.png */; };
-		9BAA663223295FAC00F5CC99 /* command-512.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA662223295FAB00F5CC99 /* command-512.png */; };
-		9BAA663323295FAC00F5CC99 /* terminal-logo.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA662323295FAB00F5CC99 /* terminal-logo.png */; };
-		9BAA663423295FAC00F5CC99 /* menu_icon.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA662423295FAB00F5CC99 /* menu_icon.png */; };
-		9BAA663523295FAC00F5CC99 /* virtual-server-icon-3.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA662523295FAB00F5CC99 /* virtual-server-icon-3.png */; };
-		9BAA663623295FAC00F5CC99 /* menu_g_icon.png in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA662623295FAB00F5CC99 /* menu_g_icon.png */; };
-		9BAA66382329636200F5CC99 /* user-privoxy.config in Resources */ = {isa = PBXBuildFile; fileRef = 9BAA66372329636200F5CC99 /* user-privoxy.config */; };
-		9BAFE2E21E83ED7F00F71CCE /* PreferencesWinController.xib in Resources */ = {isa = PBXBuildFile; fileRef = 9BAFE2E41E83ED7F00F71CCE /* PreferencesWinController.xib */; };
-		9BB706A71D1B982300551F0E /* SWBApplication.m in Sources */ = {isa = PBXBuildFile; fileRef = 9BB706A51D1B982300551F0E /* SWBApplication.m */; };
-		9BBE7B751F508A0E00E8FFE5 /* fix_dir_owner.sh in Resources */ = {isa = PBXBuildFile; fileRef = 9BBE7B711F50790500E8FFE5 /* fix_dir_owner.sh */; };
-		9BC70EDC1D2E3E3100EDA4CA /* Localizable.strings in Resources */ = {isa = PBXBuildFile; fileRef = 9B172A6C1D0ADDDD00B87B9A /* Localizable.strings */; };
-		9BCB1D6C20A15B0E005BABE7 /* libsodium.23.dylib in Resources */ = {isa = PBXBuildFile; fileRef = 9B5AA09F209C100C00E8B659 /* libsodium.23.dylib */; };
-		9BCB1D6D20A15B0E005BABE7 /* libcares.2.dylib in Resources */ = {isa = PBXBuildFile; fileRef = 9B5AA0A2209C103900E8B659 /* libcares.2.dylib */; };
-		9BEEF0691D04D4D500FC52B3 /* install_ss_local.sh in Resources */ = {isa = PBXBuildFile; fileRef = 9BEEF0651D04CB8500FC52B3 /* install_ss_local.sh */; };
-		9BEEF06A1D04D4D500FC52B3 /* start_ss_local.sh in Resources */ = {isa = PBXBuildFile; fileRef = 9BEEF0661D04CE8D00FC52B3 /* start_ss_local.sh */; };
-		9BEEF06B1D04D4D500FC52B3 /* stop_ss_local.sh in Resources */ = {isa = PBXBuildFile; fileRef = 9BEEF0671D04CE9A00FC52B3 /* stop_ss_local.sh */; };
-		9BEEF06E1D04DCE400FC52B3 /* ServerProfile.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9BEEF06D1D04DCE400FC52B3 /* ServerProfile.swift */; };
-		9BEEF0701D04DDB100FC52B3 /* ServerProfileManager.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9BEEF06F1D04DDB100FC52B3 /* ServerProfileManager.swift */; };
-		9BEEF0751D04EF3E00FC52B3 /* PreferencesWindowController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9BEEF0731D04EF3E00FC52B3 /* PreferencesWindowController.swift */; };
-		9BEEF0781D04FE8A00FC52B3 /* LaunchAgentUtils.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9BEEF0771D04FE8A00FC52B3 /* LaunchAgentUtils.swift */; };
-		B5A2AB04221A72EC003F77B7 /* install_v2ray_plugin.sh in Resources */ = {isa = PBXBuildFile; fileRef = B5A2AB02221A72EC003F77B7 /* install_v2ray_plugin.sh */; };
-		C6D429931DA75988002A5711 /* install_privoxy.sh in Resources */ = {isa = PBXBuildFile; fileRef = C6D4298E1DA75988002A5711 /* install_privoxy.sh */; };
-		C6D429941DA75988002A5711 /* privoxy in Resources */ = {isa = PBXBuildFile; fileRef = C6D4298F1DA75988002A5711 /* privoxy */; };
-		C6D429961DA75988002A5711 /* start_privoxy.sh in Resources */ = {isa = PBXBuildFile; fileRef = C6D429911DA75988002A5711 /* start_privoxy.sh */; };
-		C6D429971DA75988002A5711 /* stop_privoxy.sh in Resources */ = {isa = PBXBuildFile; fileRef = C6D429921DA75988002A5711 /* stop_privoxy.sh */; };
-		C6D429991DA76FBC002A5711 /* privoxy.template.config in Resources */ = {isa = PBXBuildFile; fileRef = C6D429981DA76FBC002A5711 /* privoxy.template.config */; };
-		C8E42A6C1D4F270A0074C7EA /* UserRulesController.swift in Sources */ = {isa = PBXBuildFile; fileRef = C8E42A6A1D4F270A0074C7EA /* UserRulesController.swift */; };
-		C8E42A6E1D4F2CAF0074C7EA /* UserRulesController.xib in Resources */ = {isa = PBXBuildFile; fileRef = C8E42A701D4F2CAF0074C7EA /* UserRulesController.xib */; };
-		F0809FF1595BE2966343D3C7 /* libPods-proxy_conf_helper.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 1E7783AEDB4A3BDDC9FF16AC /* libPods-proxy_conf_helper.a */; };
-/* End PBXBuildFile section */
-
-/* Begin PBXContainerItemProxy section */
-		9B3FFF521D09E2B30019A709 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = 9B0BFFDD1D0460A70040E62B /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 9B3FFF431D09CD3B0019A709;
-			remoteInfo = proxy_conf_helper;
-		};
-		9B5DD7B22683A354005EFEF7 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = 9B0BFFDD1D0460A70040E62B /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 9B0BFFE41D0460A70040E62B;
-			remoteInfo = "ShadowsocksX-NG";
-		};
-		9B9F13A51E8A282D00DE4794 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = 9B9F13A11E8A282C00DE4794 /* LaunchHelper.xcodeproj */;
-			proxyType = 2;
-			remoteGlobalIDString = 9B9F138D1E8A282C00DE4794;
-			remoteInfo = LaunchHelper;
-		};
-/* End PBXContainerItemProxy section */
-
-/* Begin PBXCopyFilesBuildPhase section */
-		9B3FFF421D09CD3B0019A709 /* CopyFiles */ = {
-			isa = PBXCopyFilesBuildPhase;
-			buildActionMask = 2147483647;
-			dstPath = /usr/share/man/man1/;
-			dstSubfolderSpec = 0;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 1;
-		};
-		9B6BF9511E27B2250061B9A7 /* CopyFiles */ = {
-			isa = PBXCopyFilesBuildPhase;
-			buildActionMask = 2147483647;
-			dstPath = Contents/Library/LoginItems;
-			dstSubfolderSpec = 1;
-			files = (
-				9B9F13A71E8A28B300DE4794 /* LaunchHelper.app in CopyFiles */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXCopyFilesBuildPhase section */
-
-/* Begin PBXFileReference section */
-		19083CFCED87354F006967FF /* Pods_ShadowsocksX_NGUITests.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_ShadowsocksX_NGUITests.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		1C82DBA51FA96C7400B32551 /* obfs-local */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.executable"; path = "obfs-local"; sourceTree = "<group>"; };
-		1C82DBA91FA96F0300B32551 /* install_simple_obfs.sh */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = install_simple_obfs.sh; sourceTree = "<group>"; };
-		1E7783AEDB4A3BDDC9FF16AC /* libPods-proxy_conf_helper.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-proxy_conf_helper.a"; sourceTree = BUILT_PRODUCTS_DIR; };
-		283ED1A8E9B711AC65670031 /* Pods_ShadowsocksX_NG.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_ShadowsocksX_NG.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		297AF069022A197FD8E9D226 /* Pods-proxy_conf_helper.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-proxy_conf_helper.release.xcconfig"; path = "Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper.release.xcconfig"; sourceTree = "<group>"; };
-		388120F062D7EB7DD0D8DDCA /* Pods_ShadowsocksX_NGTests.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_ShadowsocksX_NGTests.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		3AC7CD9886196A997D6FC78D /* Pods-ShadowsocksX-NGTests.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-ShadowsocksX-NGTests.release.xcconfig"; path = "Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.release.xcconfig"; sourceTree = "<group>"; };
-		5B6203C1228FCD3D365814AC /* Pods-ShadowsocksX-NGTests.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-ShadowsocksX-NGTests.debug.xcconfig"; path = "Pods/Target Support Files/Pods-ShadowsocksX-NGTests/Pods-ShadowsocksX-NGTests.debug.xcconfig"; sourceTree = "<group>"; };
-		9B07EFA61D048BBB0052D9DF /* ss-local */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.executable"; path = "ss-local"; sourceTree = "<group>"; };
-		9B0BFFE51D0460A70040E62B /* ShadowsocksX-NG.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = "ShadowsocksX-NG.app"; sourceTree = BUILT_PRODUCTS_DIR; };
-		9B0BFFE81D0460A70040E62B /* AppDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
-		9B0BFFEA1D0460A70040E62B /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
-		9B0BFFED1D0460A70040E62B /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/MainMenu.xib; sourceTree = "<group>"; };
-		9B0BFFEF1D0460A70040E62B /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
-		9B172A601D0ADA5B00B87B9A /* genstrings.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = genstrings.py; sourceTree = "<group>"; };
-		9B172A6B1D0ADDDD00B87B9A /* Base */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = Base; path = Base.lproj/Localizable.strings; sourceTree = "<group>"; };
-		9B172A6D1D0ADDE800B87B9A /* zh-Hans */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.strings; name = "zh-Hans"; path = "zh-Hans.lproj/Localizable.strings"; sourceTree = "<group>"; };
-		9B2080482326AC460075386C /* kcptun.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = kcptun.sh; sourceTree = "<group>"; };
-		9B2080492326AC460075386C /* client */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.executable"; path = client; sourceTree = "<group>"; };
-		9B2491B51D0ACC3A003BBECC /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/PreferencesWindowController.xib; sourceTree = "<group>"; };
-		9B3546701E802B1200B510B4 /* ToastWindowController.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = ToastWindowController.swift; sourceTree = "<group>"; };
-		9B3546711E802B1200B510B4 /* ToastWindowController.xib */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = file.xib; path = ToastWindowController.xib; sourceTree = "<group>"; };
-		9B3F7BF71E82BF2D00C68B75 /* libev.4.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; path = libev.4.dylib; sourceTree = "<group>"; };
-		9B3FFF0C1D05FEB30019A709 /* Utils.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = Utils.swift; sourceTree = "<group>"; };
-		9B3FFF131D0705810019A709 /* Notifications.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = Notifications.swift; sourceTree = "<group>"; };
-		9B3FFF151D072FDE0019A709 /* LaunchAtLoginController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LaunchAtLoginController.h; sourceTree = "<group>"; };
-		9B3FFF161D072FDE0019A709 /* LaunchAtLoginController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = LaunchAtLoginController.m; sourceTree = "<group>"; };
-		9B3FFF1D1D0732660019A709 /* Utils.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = Utils.m; sourceTree = "<group>"; };
-		9B3FFF1F1D0734060019A709 /* Utils.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = Utils.h; sourceTree = "<group>"; };
-		9B3FFF201D08826E0019A709 /* PACUtils.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = PACUtils.swift; sourceTree = "<group>"; };
-		9B3FFF221D088E8D0019A709 /* abp.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = abp.js; sourceTree = "<group>"; };
-		9B3FFF261D0898EB0019A709 /* gfwlist.txt */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = gfwlist.txt; sourceTree = "<group>"; };
-		9B3FFF281D08A1DF0019A709 /* user-rule.txt */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = "user-rule.txt"; sourceTree = "<group>"; };
-		9B3FFF301D08CEE40019A709 /* SWBQRCodeWindowController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SWBQRCodeWindowController.h; sourceTree = "<group>"; };
-		9B3FFF311D08CEE40019A709 /* SWBQRCodeWindowController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SWBQRCodeWindowController.m; sourceTree = "<group>"; };
-		9B3FFF331D08CEF70019A709 /* SWBQRCodeWindowController.xib */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = file.xib; path = SWBQRCodeWindowController.xib; sourceTree = "<group>"; };
-		9B3FFF3B1D08D93B0019A709 /* WebKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = WebKit.framework; path = System/Library/Frameworks/WebKit.framework; sourceTree = SDKROOT; };
-		9B3FFF3D1D08D9910019A709 /* SystemConfiguration.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = SystemConfiguration.framework; path = System/Library/Frameworks/SystemConfiguration.framework; sourceTree = SDKROOT; };
-		9B3FFF441D09CD3B0019A709 /* proxy_conf_helper */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = proxy_conf_helper; sourceTree = BUILT_PRODUCTS_DIR; };
-		9B3FFF461D09CD3B0019A709 /* main.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = main.m; sourceTree = "<group>"; };
-		9B3FFF4B1D09D8F70019A709 /* install_helper.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = install_helper.sh; sourceTree = "<group>"; };
-		9B3FFF4D1D09D9D50019A709 /* ProxyConfHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyConfHelper.h; sourceTree = "<group>"; };
-		9B3FFF4E1D09D9D50019A709 /* ProxyConfHelper.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = ProxyConfHelper.m; sourceTree = "<group>"; };
-		9B3FFF501D09DAEA0019A709 /* proxy_conf_helper_version.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = proxy_conf_helper_version.h; sourceTree = "<group>"; };
-		9B3FFF511D09DBA20019A709 /* ShadowsocksX-NG-Bridging-Header.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = "ShadowsocksX-NG-Bridging-Header.h"; sourceTree = "<group>"; };
-		9B5831F41E7302F8009D5B7D /* ShortcutsController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShortcutsController.h; sourceTree = "<group>"; };
-		9B5831F51E7302F8009D5B7D /* ShortcutsController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = ShortcutsController.m; sourceTree = "<group>"; };
-		9B5831FA1E73098F009D5B7D /* README.md */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = net.daringfireball.markdown; path = README.md; sourceTree = "<group>"; };
-		9B5831FD1E741969009D5B7D /* PreferencesWinController.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = PreferencesWinController.swift; sourceTree = "<group>"; };
-		9B5AA09F209C100C00E8B659 /* libsodium.23.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; path = libsodium.23.dylib; sourceTree = "<group>"; };
-		9B5AA0A2209C103900E8B659 /* libcares.2.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; path = libcares.2.dylib; sourceTree = "<group>"; };
-		9B5AA0AB209C43C200E8B659 /* Credits.rtf */ = {isa = PBXFileReference; lastKnownFileType = text.rtf; path = Credits.rtf; sourceTree = "<group>"; };
-		9B5D13272154A50700F99F03 /* install_kcptun.sh */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = install_kcptun.sh; sourceTree = "<group>"; };
-		9B5DD7AD2683A354005EFEF7 /* ShadowsocksX-NGTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = "ShadowsocksX-NGTests.xctest"; sourceTree = BUILT_PRODUCTS_DIR; };
-		9B5DD7AF2683A354005EFEF7 /* ShadowsocksX_NGTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ShadowsocksX_NGTests.swift; sourceTree = "<group>"; };
-		9B5DD7B12683A354005EFEF7 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
-		9B5DD7B72683A369005EFEF7 /* ServerProfileTests.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = ServerProfileTests.swift; sourceTree = "<group>"; };
-		9B6BF9531E27B2570061B9A7 /* ServiceManagement.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = ServiceManagement.framework; path = System/Library/Frameworks/ServiceManagement.framework; sourceTree = SDKROOT; };
-		9B7297E5214D68F800FD24AA /* libmbedcrypto.2.12.0.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; path = libmbedcrypto.2.12.0.dylib; sourceTree = "<group>"; };
-		9B7297E8214D7C6B00FD24AA /* ShareServerProfilesWindowController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ShareServerProfilesWindowController.swift; sourceTree = "<group>"; };
-		9B7297ED214DA88A00FD24AA /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/ShareServerProfilesWindowController.xib; sourceTree = "<group>"; };
-		9B7297F0214DA89000FD24AA /* zh-Hans */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = "zh-Hans"; path = "zh-Hans.lproj/ShareServerProfilesWindowController.strings"; sourceTree = "<group>"; };
-		9B72FB60232782A300C6AAAE /* ImportWindowController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ImportWindowController.swift; sourceTree = "<group>"; };
-		9B74B5EF232949D400DEA386 /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/ImportWindowController.xib; sourceTree = "<group>"; };
-		9B74B5F1232949E800DEA386 /* zh-Hans */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = "zh-Hans"; path = "zh-Hans.lproj/ImportWindowController.strings"; sourceTree = "<group>"; };
-		9B7725E5232E30C50062299F /* PACURLFormatter.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PACURLFormatter.swift; sourceTree = "<group>"; };
-		9B7725E8232E54A20062299F /* menu_e_icon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = menu_e_icon.png; sourceTree = "<group>"; };
-		9B7725E9232E54A20062299F /* menu_e_icon@2x.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "menu_e_icon@2x.png"; sourceTree = "<group>"; };
-		9B84DAEC2163A72F00DFF068 /* Diagnose.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Diagnose.swift; sourceTree = "<group>"; };
-		9B86459C1E7C2CAD00A84029 /* ProxyInterfacesViewCtrl.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = ProxyInterfacesViewCtrl.swift; sourceTree = "<group>"; };
-		9B9B9965236992C90036600F /* v2ray-plugin */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.executable"; path = "v2ray-plugin"; sourceTree = "<group>"; };
-		9B9CBCAD1E263A6600FC61AA /* libpcre.1.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; path = libpcre.1.dylib; sourceTree = "<group>"; };
-		9B9F13A11E8A282C00DE4794 /* LaunchHelper.xcodeproj */ = {isa = PBXFileReference; lastKnownFileType = "wrapper.pb-project"; name = LaunchHelper.xcodeproj; path = LaunchHelper/LaunchHelper.xcodeproj; sourceTree = "<group>"; };
-		9BA04B211D23D5A5005AAD7F /* ProxyConfTool.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyConfTool.h; sourceTree = "<group>"; };
-		9BA04B221D23D5A5005AAD7F /* ProxyConfTool.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = ProxyConfTool.m; sourceTree = "<group>"; };
-		9BAA661723295FAB00F5CC99 /* icons8-Eye Filled-50.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "icons8-Eye Filled-50.png"; sourceTree = "<group>"; };
-		9BAA661823295FAB00F5CC99 /* menu_m_icon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = menu_m_icon.png; sourceTree = "<group>"; };
-		9BAA661923295FAB00F5CC99 /* menu_p_icon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = menu_p_icon.png; sourceTree = "<group>"; };
-		9BAA661A23295FAB00F5CC99 /* menu_icon@2x.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "menu_icon@2x.png"; sourceTree = "<group>"; };
-		9BAA661B23295FAB00F5CC99 /* http.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = http.png; sourceTree = "<group>"; };
-		9BAA661C23295FAB00F5CC99 /* menu_g_icon@2x.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "menu_g_icon@2x.png"; sourceTree = "<group>"; };
-		9BAA661D23295FAB00F5CC99 /* icons8-Blind Filled-50.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "icons8-Blind Filled-50.png"; sourceTree = "<group>"; };
-		9BAA661E23295FAB00F5CC99 /* menu_p_icon@2x.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "menu_p_icon@2x.png"; sourceTree = "<group>"; };
-		9BAA661F23295FAB00F5CC99 /* menu_icon_disabled@2x.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "menu_icon_disabled@2x.png"; sourceTree = "<group>"; };
-		9BAA662023295FAB00F5CC99 /* menu_icon_disabled.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = menu_icon_disabled.png; sourceTree = "<group>"; };
-		9BAA662123295FAB00F5CC99 /* menu_m_icon@2x.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "menu_m_icon@2x.png"; sourceTree = "<group>"; };
-		9BAA662223295FAB00F5CC99 /* command-512.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "command-512.png"; sourceTree = "<group>"; };
-		9BAA662323295FAB00F5CC99 /* terminal-logo.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "terminal-logo.png"; sourceTree = "<group>"; };
-		9BAA662423295FAB00F5CC99 /* menu_icon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = menu_icon.png; sourceTree = "<group>"; };
-		9BAA662523295FAB00F5CC99 /* virtual-server-icon-3.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "virtual-server-icon-3.png"; sourceTree = "<group>"; };
-		9BAA662623295FAB00F5CC99 /* menu_g_icon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = menu_g_icon.png; sourceTree = "<group>"; };
-		9BAA66372329636200F5CC99 /* user-privoxy.config */ = {isa = PBXFileReference; lastKnownFileType = text; path = "user-privoxy.config"; sourceTree = "<group>"; };
-		9BAFE2E31E83ED7F00F71CCE /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/PreferencesWinController.xib; sourceTree = "<group>"; };
-		9BAFE2E91E83EDDF00F71CCE /* zh-Hans */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = "zh-Hans"; path = "zh-Hans.lproj/PreferencesWinController.strings"; sourceTree = "<group>"; };
-		9BAFE2EB1E83F91D00F71CCE /* zh-Hans */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = "zh-Hans"; path = "zh-Hans.lproj/MainMenu.strings"; sourceTree = "<group>"; };
-		9BB706A51D1B982300551F0E /* SWBApplication.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SWBApplication.m; sourceTree = "<group>"; };
-		9BB706A61D1B982300551F0E /* SWBApplication.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SWBApplication.h; sourceTree = "<group>"; };
-		9BBE7B711F50790500E8FFE5 /* fix_dir_owner.sh */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = fix_dir_owner.sh; sourceTree = "<group>"; };
-		9BE8FBC11D0B71CF00CAFD01 /* zh-Hans */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = "zh-Hans"; path = "zh-Hans.lproj/PreferencesWindowController.strings"; sourceTree = "<group>"; };
-		9BEEF0651D04CB8500FC52B3 /* install_ss_local.sh */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = install_ss_local.sh; sourceTree = "<group>"; };
-		9BEEF0661D04CE8D00FC52B3 /* start_ss_local.sh */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = start_ss_local.sh; sourceTree = "<group>"; };
-		9BEEF0671D04CE9A00FC52B3 /* stop_ss_local.sh */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = stop_ss_local.sh; sourceTree = "<group>"; };
-		9BEEF06D1D04DCE400FC52B3 /* ServerProfile.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = ServerProfile.swift; sourceTree = "<group>"; };
-		9BEEF06F1D04DDB100FC52B3 /* ServerProfileManager.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = ServerProfileManager.swift; sourceTree = "<group>"; };
-		9BEEF0731D04EF3E00FC52B3 /* PreferencesWindowController.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = PreferencesWindowController.swift; sourceTree = "<group>"; };
-		9BEEF0771D04FE8A00FC52B3 /* LaunchAgentUtils.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = LaunchAgentUtils.swift; sourceTree = "<group>"; };
-		B4E6A97CA843F3943524B686 /* Pods-proxy_conf_helper.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-proxy_conf_helper.debug.xcconfig"; path = "Pods/Target Support Files/Pods-proxy_conf_helper/Pods-proxy_conf_helper.debug.xcconfig"; sourceTree = "<group>"; };
-		B5A2AB02221A72EC003F77B7 /* install_v2ray_plugin.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = install_v2ray_plugin.sh; sourceTree = "<group>"; };
-		C6D4298E1DA75988002A5711 /* install_privoxy.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = install_privoxy.sh; sourceTree = "<group>"; };
-		C6D4298F1DA75988002A5711 /* privoxy */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.executable"; path = privoxy; sourceTree = "<group>"; };
-		C6D429911DA75988002A5711 /* start_privoxy.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = start_privoxy.sh; sourceTree = "<group>"; };
-		C6D429921DA75988002A5711 /* stop_privoxy.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = stop_privoxy.sh; sourceTree = "<group>"; };
-		C6D429981DA76FBC002A5711 /* privoxy.template.config */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = privoxy.template.config; sourceTree = "<group>"; };
-		C8E42A6A1D4F270A0074C7EA /* UserRulesController.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = UserRulesController.swift; sourceTree = "<group>"; };
-		C8E42A6F1D4F2CAF0074C7EA /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/UserRulesController.xib; sourceTree = "<group>"; };
-		C8E42A721D4F2CB10074C7EA /* zh-Hans */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = "zh-Hans"; path = "zh-Hans.lproj/UserRulesController.strings"; sourceTree = "<group>"; };
-		E9E9FB3855DA55D0710EE7BD /* Pods-ShadowsocksX-NG.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-ShadowsocksX-NG.release.xcconfig"; path = "Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.release.xcconfig"; sourceTree = "<group>"; };
-		FE3237E9FB24D9B924A0E630 /* Pods-ShadowsocksX-NG.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-ShadowsocksX-NG.debug.xcconfig"; path = "Pods/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG.debug.xcconfig"; sourceTree = "<group>"; };
-/* End PBXFileReference section */
-
-/* Begin PBXFrameworksBuildPhase section */
-		9B0BFFE21D0460A70040E62B /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9B6BF9541E27B2570061B9A7 /* ServiceManagement.framework in Frameworks */,
-				9B3FFF3E1D08D9910019A709 /* SystemConfiguration.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		9B3FFF411D09CD3B0019A709 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				F0809FF1595BE2966343D3C7 /* libPods-proxy_conf_helper.a in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		9B5DD7AA2683A354005EFEF7 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXFrameworksBuildPhase section */
-
-/* Begin PBXGroup section */
-		1C82DBA31FA96C7400B32551 /* simple-obfs */ = {
-			isa = PBXGroup;
-			children = (
-				1C82DBA51FA96C7400B32551 /* obfs-local */,
-				1C82DBA91FA96F0300B32551 /* install_simple_obfs.sh */,
-			);
-			path = "simple-obfs";
-			sourceTree = "<group>";
-		};
-		33F4F299F89330966F4526E4 /* Pods */ = {
-			isa = PBXGroup;
-			children = (
-				FE3237E9FB24D9B924A0E630 /* Pods-ShadowsocksX-NG.debug.xcconfig */,
-				E9E9FB3855DA55D0710EE7BD /* Pods-ShadowsocksX-NG.release.xcconfig */,
-				5B6203C1228FCD3D365814AC /* Pods-ShadowsocksX-NGTests.debug.xcconfig */,
-				3AC7CD9886196A997D6FC78D /* Pods-ShadowsocksX-NGTests.release.xcconfig */,
-				B4E6A97CA843F3943524B686 /* Pods-proxy_conf_helper.debug.xcconfig */,
-				297AF069022A197FD8E9D226 /* Pods-proxy_conf_helper.release.xcconfig */,
-			);
-			name = Pods;
-			sourceTree = "<group>";
-		};
-		9B07EFB01D048E900052D9DF /* Support Files */ = {
-			isa = PBXGroup;
-			children = (
-				9BAA661623295F7F00F5CC99 /* images */,
-				B5A2AB00221A72EC003F77B7 /* v2ray-plugin */,
-				9B5D13252154A4B400F99F03 /* kcptun */,
-				9B5AA0A9209C41EC00E8B659 /* ss-local */,
-				1C82DBA31FA96C7400B32551 /* simple-obfs */,
-				9B5AA0AA209C42A900E8B659 /* privoxy */,
-				9B172A6C1D0ADDDD00B87B9A /* Localizable.strings */,
-				9B3FFF4B1D09D8F70019A709 /* install_helper.sh */,
-				9B3FFF281D08A1DF0019A709 /* user-rule.txt */,
-				9B3FFF261D0898EB0019A709 /* gfwlist.txt */,
-				9B3FFF221D088E8D0019A709 /* abp.js */,
-				9BBE7B711F50790500E8FFE5 /* fix_dir_owner.sh */,
-				9B5AA0AB209C43C200E8B659 /* Credits.rtf */,
-			);
-			name = "Support Files";
-			sourceTree = "<group>";
-		};
-		9B0BFFDC1D0460A70040E62B = {
-			isa = PBXGroup;
-			children = (
-				9B5831FA1E73098F009D5B7D /* README.md */,
-				9B172A601D0ADA5B00B87B9A /* genstrings.py */,
-				9B9F13A11E8A282C00DE4794 /* LaunchHelper.xcodeproj */,
-				9B0BFFE71D0460A70040E62B /* ShadowsocksX-NG */,
-				9B3FFF451D09CD3B0019A709 /* proxy_conf_helper */,
-				9B5DD7AE2683A354005EFEF7 /* ShadowsocksX-NGTests */,
-				9B0BFFE61D0460A70040E62B /* Products */,
-				33F4F299F89330966F4526E4 /* Pods */,
-				D3CE66CC039F651F28057DDB /* Frameworks */,
-			);
-			sourceTree = "<group>";
-		};
-		9B0BFFE61D0460A70040E62B /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				9B0BFFE51D0460A70040E62B /* ShadowsocksX-NG.app */,
-				9B3FFF441D09CD3B0019A709 /* proxy_conf_helper */,
-				9B5DD7AD2683A354005EFEF7 /* ShadowsocksX-NGTests.xctest */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-		9B0BFFE71D0460A70040E62B /* ShadowsocksX-NG */ = {
-			isa = PBXGroup;
-			children = (
-				9BB706A51D1B982300551F0E /* SWBApplication.m */,
-				9BB706A61D1B982300551F0E /* SWBApplication.h */,
-				9B3FFF511D09DBA20019A709 /* ShadowsocksX-NG-Bridging-Header.h */,
-				9B3FFF151D072FDE0019A709 /* LaunchAtLoginController.h */,
-				9B3FFF161D072FDE0019A709 /* LaunchAtLoginController.m */,
-				9B3FFF0B1D05D8B80019A709 /* UI */,
-				9B07EFB01D048E900052D9DF /* Support Files */,
-				9B0BFFE81D0460A70040E62B /* AppDelegate.swift */,
-				9B0BFFEA1D0460A70040E62B /* Assets.xcassets */,
-				9B0BFFEC1D0460A70040E62B /* MainMenu.xib */,
-				9B0BFFEF1D0460A70040E62B /* Info.plist */,
-				9BEEF06D1D04DCE400FC52B3 /* ServerProfile.swift */,
-				9B7725E5232E30C50062299F /* PACURLFormatter.swift */,
-				9BEEF06F1D04DDB100FC52B3 /* ServerProfileManager.swift */,
-				9BEEF0771D04FE8A00FC52B3 /* LaunchAgentUtils.swift */,
-				9B3FFF0C1D05FEB30019A709 /* Utils.swift */,
-				9B3FFF201D08826E0019A709 /* PACUtils.swift */,
-				9B3FFF131D0705810019A709 /* Notifications.swift */,
-				9B3FFF1D1D0732660019A709 /* Utils.m */,
-				9B3FFF1F1D0734060019A709 /* Utils.h */,
-				9B3FFF4D1D09D9D50019A709 /* ProxyConfHelper.h */,
-				9B3FFF4E1D09D9D50019A709 /* ProxyConfHelper.m */,
-				9B3FFF501D09DAEA0019A709 /* proxy_conf_helper_version.h */,
-				9BA04B211D23D5A5005AAD7F /* ProxyConfTool.h */,
-				9BA04B221D23D5A5005AAD7F /* ProxyConfTool.m */,
-				9B5831F41E7302F8009D5B7D /* ShortcutsController.h */,
-				9B5831F51E7302F8009D5B7D /* ShortcutsController.m */,
-				9B84DAEC2163A72F00DFF068 /* Diagnose.swift */,
-			);
-			path = "ShadowsocksX-NG";
-			sourceTree = "<group>";
-		};
-		9B3FFF0B1D05D8B80019A709 /* UI */ = {
-			isa = PBXGroup;
-			children = (
-				9B3FFF331D08CEF70019A709 /* SWBQRCodeWindowController.xib */,
-				9B3FFF301D08CEE40019A709 /* SWBQRCodeWindowController.h */,
-				9B3FFF311D08CEE40019A709 /* SWBQRCodeWindowController.m */,
-				9BEEF0731D04EF3E00FC52B3 /* PreferencesWindowController.swift */,
-				9B2491B61D0ACC3A003BBECC /* PreferencesWindowController.xib */,
-				C8E42A6A1D4F270A0074C7EA /* UserRulesController.swift */,
-				C8E42A701D4F2CAF0074C7EA /* UserRulesController.xib */,
-				9B5831FD1E741969009D5B7D /* PreferencesWinController.swift */,
-				9BAFE2E41E83ED7F00F71CCE /* PreferencesWinController.xib */,
-				9B86459C1E7C2CAD00A84029 /* ProxyInterfacesViewCtrl.swift */,
-				9B3546701E802B1200B510B4 /* ToastWindowController.swift */,
-				9B3546711E802B1200B510B4 /* ToastWindowController.xib */,
-				9B7297E8214D7C6B00FD24AA /* ShareServerProfilesWindowController.swift */,
-				9B7297EE214DA88A00FD24AA /* ShareServerProfilesWindowController.xib */,
-				9B72FB60232782A300C6AAAE /* ImportWindowController.swift */,
-				9B74B5EB232949B100DEA386 /* ImportWindowController.xib */,
-			);
-			name = UI;
-			sourceTree = "<group>";
-		};
-		9B3FFF451D09CD3B0019A709 /* proxy_conf_helper */ = {
-			isa = PBXGroup;
-			children = (
-				9B3FFF461D09CD3B0019A709 /* main.m */,
-			);
-			path = proxy_conf_helper;
-			sourceTree = "<group>";
-		};
-		9B5AA0A9209C41EC00E8B659 /* ss-local */ = {
-			isa = PBXGroup;
-			children = (
-				9B7297E5214D68F800FD24AA /* libmbedcrypto.2.12.0.dylib */,
-				9B3F7BF71E82BF2D00C68B75 /* libev.4.dylib */,
-				9B5AA09F209C100C00E8B659 /* libsodium.23.dylib */,
-				9B5AA0A2209C103900E8B659 /* libcares.2.dylib */,
-				9B9CBCAD1E263A6600FC61AA /* libpcre.1.dylib */,
-				9B07EFA61D048BBB0052D9DF /* ss-local */,
-				9BEEF0651D04CB8500FC52B3 /* install_ss_local.sh */,
-				9BEEF0661D04CE8D00FC52B3 /* start_ss_local.sh */,
-				9BEEF0671D04CE9A00FC52B3 /* stop_ss_local.sh */,
-			);
-			path = "ss-local";
-			sourceTree = "<group>";
-		};
-		9B5AA0AA209C42A900E8B659 /* privoxy */ = {
-			isa = PBXGroup;
-			children = (
-				C6D429981DA76FBC002A5711 /* privoxy.template.config */,
-				9BAA66372329636200F5CC99 /* user-privoxy.config */,
-				C6D4298F1DA75988002A5711 /* privoxy */,
-				C6D4298E1DA75988002A5711 /* install_privoxy.sh */,
-				C6D429911DA75988002A5711 /* start_privoxy.sh */,
-				C6D429921DA75988002A5711 /* stop_privoxy.sh */,
-			);
-			path = privoxy;
-			sourceTree = "<group>";
-		};
-		9B5D13252154A4B400F99F03 /* kcptun */ = {
-			isa = PBXGroup;
-			children = (
-				9B2080492326AC460075386C /* client */,
-				9B2080482326AC460075386C /* kcptun.sh */,
-				9B5D13272154A50700F99F03 /* install_kcptun.sh */,
-			);
-			path = kcptun;
-			sourceTree = "<group>";
-		};
-		9B5DD7AE2683A354005EFEF7 /* ShadowsocksX-NGTests */ = {
-			isa = PBXGroup;
-			children = (
-				9B5DD7B72683A369005EFEF7 /* ServerProfileTests.swift */,
-				9B5DD7AF2683A354005EFEF7 /* ShadowsocksX_NGTests.swift */,
-				9B5DD7B12683A354005EFEF7 /* Info.plist */,
-			);
-			path = "ShadowsocksX-NGTests";
-			sourceTree = "<group>";
-		};
-		9B9F13A21E8A282C00DE4794 /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				9B9F13A61E8A282D00DE4794 /* LaunchHelper.app */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-		9BAA661623295F7F00F5CC99 /* images */ = {
-			isa = PBXGroup;
-			children = (
-				9B7725E8232E54A20062299F /* menu_e_icon.png */,
-				9B7725E9232E54A20062299F /* menu_e_icon@2x.png */,
-				9BAA662223295FAB00F5CC99 /* command-512.png */,
-				9BAA661B23295FAB00F5CC99 /* http.png */,
-				9BAA661D23295FAB00F5CC99 /* icons8-Blind Filled-50.png */,
-				9BAA661723295FAB00F5CC99 /* icons8-Eye Filled-50.png */,
-				9BAA662623295FAB00F5CC99 /* menu_g_icon.png */,
-				9BAA661C23295FAB00F5CC99 /* menu_g_icon@2x.png */,
-				9BAA662023295FAB00F5CC99 /* menu_icon_disabled.png */,
-				9BAA661F23295FAB00F5CC99 /* menu_icon_disabled@2x.png */,
-				9BAA662423295FAB00F5CC99 /* menu_icon.png */,
-				9BAA661A23295FAB00F5CC99 /* menu_icon@2x.png */,
-				9BAA661823295FAB00F5CC99 /* menu_m_icon.png */,
-				9BAA662123295FAB00F5CC99 /* menu_m_icon@2x.png */,
-				9BAA661923295FAB00F5CC99 /* menu_p_icon.png */,
-				9BAA661E23295FAB00F5CC99 /* menu_p_icon@2x.png */,
-				9BAA662323295FAB00F5CC99 /* terminal-logo.png */,
-				9BAA662523295FAB00F5CC99 /* virtual-server-icon-3.png */,
-			);
-			path = images;
-			sourceTree = "<group>";
-		};
-		B5A2AB00221A72EC003F77B7 /* v2ray-plugin */ = {
-			isa = PBXGroup;
-			children = (
-				9B9B9965236992C90036600F /* v2ray-plugin */,
-				B5A2AB02221A72EC003F77B7 /* install_v2ray_plugin.sh */,
-			);
-			path = "v2ray-plugin";
-			sourceTree = "<group>";
-		};
-		D3CE66CC039F651F28057DDB /* Frameworks */ = {
-			isa = PBXGroup;
-			children = (
-				9B6BF9531E27B2570061B9A7 /* ServiceManagement.framework */,
-				9B3FFF3D1D08D9910019A709 /* SystemConfiguration.framework */,
-				9B3FFF3B1D08D93B0019A709 /* WebKit.framework */,
-				283ED1A8E9B711AC65670031 /* Pods_ShadowsocksX_NG.framework */,
-				388120F062D7EB7DD0D8DDCA /* Pods_ShadowsocksX_NGTests.framework */,
-				19083CFCED87354F006967FF /* Pods_ShadowsocksX_NGUITests.framework */,
-				1E7783AEDB4A3BDDC9FF16AC /* libPods-proxy_conf_helper.a */,
-			);
-			name = Frameworks;
-			sourceTree = "<group>";
-		};
-/* End PBXGroup section */
-
-/* Begin PBXNativeTarget section */
-		9B0BFFE41D0460A70040E62B /* ShadowsocksX-NG */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 9B0B00081D0460A70040E62B /* Build configuration list for PBXNativeTarget "ShadowsocksX-NG" */;
-			buildPhases = (
-				A3C8167BB5EB01FBDE2A08BC /* [CP] Check Pods Manifest.lock */,
-				9B0BFFE11D0460A70040E62B /* Sources */,
-				9B0BFFE21D0460A70040E62B /* Frameworks */,
-				9B0BFFE31D0460A70040E62B /* Resources */,
-				5E160625E3EC80E27DA7EF05 /* [CP] Embed Pods Frameworks */,
-				9B6BF9511E27B2250061B9A7 /* CopyFiles */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				9B3FFF531D09E2B30019A709 /* PBXTargetDependency */,
-			);
-			name = "ShadowsocksX-NG";
-			productName = "ShadowsocksX-NG";
-			productReference = 9B0BFFE51D0460A70040E62B /* ShadowsocksX-NG.app */;
-			productType = "com.apple.product-type.application";
-		};
-		9B3FFF431D09CD3B0019A709 /* proxy_conf_helper */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 9B3FFF481D09CD3B0019A709 /* Build configuration list for PBXNativeTarget "proxy_conf_helper" */;
-			buildPhases = (
-				3545247EFCD033C3FA63EA6C /* [CP] Check Pods Manifest.lock */,
-				9B3FFF401D09CD3B0019A709 /* Sources */,
-				9B3FFF411D09CD3B0019A709 /* Frameworks */,
-				9B3FFF421D09CD3B0019A709 /* CopyFiles */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = proxy_conf_helper;
-			productName = proxy_conf_helper;
-			productReference = 9B3FFF441D09CD3B0019A709 /* proxy_conf_helper */;
-			productType = "com.apple.product-type.tool";
-		};
-		9B5DD7AC2683A354005EFEF7 /* ShadowsocksX-NGTests */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 9B5DD7B42683A354005EFEF7 /* Build configuration list for PBXNativeTarget "ShadowsocksX-NGTests" */;
-			buildPhases = (
-				9B5DD7A92683A354005EFEF7 /* Sources */,
-				9B5DD7AA2683A354005EFEF7 /* Frameworks */,
-				9B5DD7AB2683A354005EFEF7 /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				9B5DD7B32683A354005EFEF7 /* PBXTargetDependency */,
-			);
-			name = "ShadowsocksX-NGTests";
-			productName = "ShadowsocksX-NGTests";
-			productReference = 9B5DD7AD2683A354005EFEF7 /* ShadowsocksX-NGTests.xctest */;
-			productType = "com.apple.product-type.bundle.unit-test";
-		};
-/* End PBXNativeTarget section */
-
-/* Begin PBXProject section */
-		9B0BFFDD1D0460A70040E62B /* Project object */ = {
-			isa = PBXProject;
-			attributes = {
-				LastSwiftUpdateCheck = 1250;
-				LastUpgradeCheck = 1250;
-				ORGANIZATIONNAME = qiuyuzhou;
-				TargetAttributes = {
-					9B0BFFE41D0460A70040E62B = {
-						CreatedOnToolsVersion = 7.3.1;
-						LastSwiftMigration = 1250;
-						ProvisioningStyle = Manual;
-					};
-					9B3FFF431D09CD3B0019A709 = {
-						CreatedOnToolsVersion = 7.3.1;
-						ProvisioningStyle = Manual;
-					};
-					9B5DD7AC2683A354005EFEF7 = {
-						CreatedOnToolsVersion = 12.5.1;
-						ProvisioningStyle = Manual;
-						TestTargetID = 9B0BFFE41D0460A70040E62B;
-					};
-				};
-			};
-			buildConfigurationList = 9B0BFFE01D0460A70040E62B /* Build configuration list for PBXProject "ShadowsocksX-NG" */;
-			compatibilityVersion = "Xcode 3.2";
-			developmentRegion = English;
-			hasScannedForEncodings = 0;
-			knownRegions = (
-				English,
-				en,
-				Base,
-				"zh-Hans",
-			);
-			mainGroup = 9B0BFFDC1D0460A70040E62B;
-			productRefGroup = 9B0BFFE61D0460A70040E62B /* Products */;
-			projectDirPath = "";
-			projectReferences = (
-				{
-					ProductGroup = 9B9F13A21E8A282C00DE4794 /* Products */;
-					ProjectRef = 9B9F13A11E8A282C00DE4794 /* LaunchHelper.xcodeproj */;
-				},
-			);
-			projectRoot = "";
-			targets = (
-				9B0BFFE41D0460A70040E62B /* ShadowsocksX-NG */,
-				9B3FFF431D09CD3B0019A709 /* proxy_conf_helper */,
-				9B5DD7AC2683A354005EFEF7 /* ShadowsocksX-NGTests */,
-			);
-		};
-/* End PBXProject section */
-
-/* Begin PBXReferenceProxy section */
-		9B9F13A61E8A282D00DE4794 /* LaunchHelper.app */ = {
-			isa = PBXReferenceProxy;
-			fileType = wrapper.application;
-			path = LaunchHelper.app;
-			remoteRef = 9B9F13A51E8A282D00DE4794 /* PBXContainerItemProxy */;
-			sourceTree = BUILT_PRODUCTS_DIR;
-		};
-/* End PBXReferenceProxy section */
-
-/* Begin PBXResourcesBuildPhase section */
-		9B0BFFE31D0460A70040E62B /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9B5D132A2154A62600F99F03 /* install_kcptun.sh in Resources */,
-				9B7297E7214D69C300FD24AA /* libmbedcrypto.2.12.0.dylib in Resources */,
-				9BCB1D6C20A15B0E005BABE7 /* libsodium.23.dylib in Resources */,
-				9BCB1D6D20A15B0E005BABE7 /* libcares.2.dylib in Resources */,
-				9BBE7B751F508A0E00E8FFE5 /* fix_dir_owner.sh in Resources */,
-				9BAA66382329636200F5CC99 /* user-privoxy.config in Resources */,
-				9B3F7BFF1E82BF5B00C68B75 /* libev.4.dylib in Resources */,
-				9BAA662D23295FAC00F5CC99 /* icons8-Blind Filled-50.png in Resources */,
-				9BAA663623295FAC00F5CC99 /* menu_g_icon.png in Resources */,
-				9BAA662E23295FAC00F5CC99 /* menu_p_icon@2x.png in Resources */,
-				1C82DBAA1FA96FB600B32551 /* install_simple_obfs.sh in Resources */,
-				9B74B5E9232949B100DEA386 /* ImportWindowController.xib in Resources */,
-				9BAA663523295FAC00F5CC99 /* virtual-server-icon-3.png in Resources */,
-				9B9CBCAF1E263B1600FC61AA /* libpcre.1.dylib in Resources */,
-				9B3FFF541D09E2D10019A709 /* proxy_conf_helper in Resources */,
-				9BAA662723295FAB00F5CC99 /* icons8-Eye Filled-50.png in Resources */,
-				9BEEF0691D04D4D500FC52B3 /* install_ss_local.sh in Resources */,
-				9B2491B41D0ACC3A003BBECC /* PreferencesWindowController.xib in Resources */,
-				9B3FFF291D08A1DF0019A709 /* user-rule.txt in Resources */,
-				9BAA663123295FAC00F5CC99 /* menu_m_icon@2x.png in Resources */,
-				C6D429971DA75988002A5711 /* stop_privoxy.sh in Resources */,
-				9BAA662F23295FAC00F5CC99 /* menu_icon_disabled@2x.png in Resources */,
-				C8E42A6E1D4F2CAF0074C7EA /* UserRulesController.xib in Resources */,
-				9BAA663423295FAC00F5CC99 /* menu_icon.png in Resources */,
-				9BEEF06A1D04D4D500FC52B3 /* start_ss_local.sh in Resources */,
-				9B3546731E802B1200B510B4 /* ToastWindowController.xib in Resources */,
-				9B7725EA232E54A20062299F /* menu_e_icon.png in Resources */,
-				9BAA662923295FAB00F5CC99 /* menu_p_icon.png in Resources */,
-				C6D429941DA75988002A5711 /* privoxy in Resources */,
-				C6D429991DA76FBC002A5711 /* privoxy.template.config in Resources */,
-				9BEEF06B1D04D4D500FC52B3 /* stop_ss_local.sh in Resources */,
-				9B3FFF341D08CEF70019A709 /* SWBQRCodeWindowController.xib in Resources */,
-				9B3FFF231D088E8D0019A709 /* abp.js in Resources */,
-				9BAFE2E21E83ED7F00F71CCE /* PreferencesWinController.xib in Resources */,
-				9BAA663223295FAC00F5CC99 /* command-512.png in Resources */,
-				9BAA663023295FAC00F5CC99 /* menu_icon_disabled.png in Resources */,
-				9B7725EB232E54A20062299F /* menu_e_icon@2x.png in Resources */,
-				9BAA662C23295FAC00F5CC99 /* menu_g_icon@2x.png in Resources */,
-				9BAA663323295FAC00F5CC99 /* terminal-logo.png in Resources */,
-				9B0BFFEB1D0460A70040E62B /* Assets.xcassets in Resources */,
-				B5A2AB04221A72EC003F77B7 /* install_v2ray_plugin.sh in Resources */,
-				9BAA662B23295FAB00F5CC99 /* http.png in Resources */,
-				1C82DBA81FA96C7500B32551 /* obfs-local in Resources */,
-				9B7297EC214DA88A00FD24AA /* ShareServerProfilesWindowController.xib in Resources */,
-				9B3FFF271D0898EB0019A709 /* gfwlist.txt in Resources */,
-				C6D429931DA75988002A5711 /* install_privoxy.sh in Resources */,
-				9BC70EDC1D2E3E3100EDA4CA /* Localizable.strings in Resources */,
-				9B20804B2326AC460075386C /* client in Resources */,
-				9B0BFFEE1D0460A70040E62B /* MainMenu.xib in Resources */,
-				9B9B9966236992CA0036600F /* v2ray-plugin in Resources */,
-				9B3FFF4C1D09D8F70019A709 /* install_helper.sh in Resources */,
-				9BAA662823295FAB00F5CC99 /* menu_m_icon.png in Resources */,
-				C6D429961DA75988002A5711 /* start_privoxy.sh in Resources */,
-				9BAA662A23295FAB00F5CC99 /* menu_icon@2x.png in Resources */,
-				9B5AA0AC209C43C200E8B659 /* Credits.rtf in Resources */,
-				9B07EFA71D048BBB0052D9DF /* ss-local in Resources */,
-				9B20804A2326AC460075386C /* kcptun.sh in Resources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		9B5DD7AB2683A354005EFEF7 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXResourcesBuildPhase section */
-
-/* Begin PBXShellScriptBuildPhase section */
-		3545247EFCD033C3FA63EA6C /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"${PODS_PODFILE_DIR_PATH}/Podfile.lock",
-				"${PODS_ROOT}/Manifest.lock",
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputPaths = (
-				"$(DERIVED_FILE_DIR)/Pods-proxy_conf_helper-checkManifestLockResult.txt",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
-			showEnvVarsInLog = 0;
-		};
-		5E160625E3EC80E27DA7EF05 /* [CP] Embed Pods Frameworks */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"${PODS_ROOT}/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-frameworks.sh",
-				"${BUILT_PRODUCTS_DIR}/Alamofire/Alamofire.framework",
-				"${BUILT_PRODUCTS_DIR}/GCDWebServer/GCDWebServer.framework",
-				"${BUILT_PRODUCTS_DIR}/MASShortcut/MASShortcut.framework",
-				"${BUILT_PRODUCTS_DIR}/RxCocoa/RxCocoa.framework",
-				"${BUILT_PRODUCTS_DIR}/RxRelay/RxRelay.framework",
-				"${BUILT_PRODUCTS_DIR}/RxSwift/RxSwift.framework",
-			);
-			name = "[CP] Embed Pods Frameworks";
-			outputPaths = (
-				"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/Alamofire.framework",
-				"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/GCDWebServer.framework",
-				"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/MASShortcut.framework",
-				"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/RxCocoa.framework",
-				"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/RxRelay.framework",
-				"${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/RxSwift.framework",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "\"${PODS_ROOT}/Target Support Files/Pods-ShadowsocksX-NG/Pods-ShadowsocksX-NG-frameworks.sh\"\n";
-			showEnvVarsInLog = 0;
-		};
-		A3C8167BB5EB01FBDE2A08BC /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"${PODS_PODFILE_DIR_PATH}/Podfile.lock",
-				"${PODS_ROOT}/Manifest.lock",
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputPaths = (
-				"$(DERIVED_FILE_DIR)/Pods-ShadowsocksX-NG-checkManifestLockResult.txt",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
-			showEnvVarsInLog = 0;
-		};
-/* End PBXShellScriptBuildPhase section */
-
-/* Begin PBXSourcesBuildPhase section */
-		9B0BFFE11D0460A70040E62B /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9B3FFF171D072FDE0019A709 /* LaunchAtLoginController.m in Sources */,
-				9B7725E6232E30C50062299F /* PACURLFormatter.swift in Sources */,
-				9B86459D1E7C2CAD00A84029 /* ProxyInterfacesViewCtrl.swift in Sources */,
-				9B3FFF4F1D09D9D50019A709 /* ProxyConfHelper.m in Sources */,
-				9B5831F61E7302F8009D5B7D /* ShortcutsController.m in Sources */,
-				9BB706A71D1B982300551F0E /* SWBApplication.m in Sources */,
-				9B3FFF1E1D0732660019A709 /* Utils.m in Sources */,
-				9B7297EA214D7C6B00FD24AA /* ShareServerProfilesWindowController.swift in Sources */,
-				9B3FFF321D08CEE40019A709 /* SWBQRCodeWindowController.m in Sources */,
-				9B3FFF211D08826E0019A709 /* PACUtils.swift in Sources */,
-				9B3FFF141D0705810019A709 /* Notifications.swift in Sources */,
-				9BEEF0701D04DDB100FC52B3 /* ServerProfileManager.swift in Sources */,
-				9BEEF06E1D04DCE400FC52B3 /* ServerProfile.swift in Sources */,
-				9B72FB62232782A300C6AAAE /* ImportWindowController.swift in Sources */,
-				9B3FFF0D1D05FEB30019A709 /* Utils.swift in Sources */,
-				9BEEF0751D04EF3E00FC52B3 /* PreferencesWindowController.swift in Sources */,
-				9B0BFFE91D0460A70040E62B /* AppDelegate.swift in Sources */,
-				9B84DAED2163A72F00DFF068 /* Diagnose.swift in Sources */,
-				9BA04B231D23D5A5005AAD7F /* ProxyConfTool.m in Sources */,
-				9B5831FF1E741969009D5B7D /* PreferencesWinController.swift in Sources */,
-				9BEEF0781D04FE8A00FC52B3 /* LaunchAgentUtils.swift in Sources */,
-				9B3546721E802B1200B510B4 /* ToastWindowController.swift in Sources */,
-				C8E42A6C1D4F270A0074C7EA /* UserRulesController.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		9B3FFF401D09CD3B0019A709 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9B3FFF471D09CD3B0019A709 /* main.m in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		9B5DD7A92683A354005EFEF7 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9B5DD7B82683A369005EFEF7 /* ServerProfileTests.swift in Sources */,
-				9B5DD7B02683A354005EFEF7 /* ShadowsocksX_NGTests.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXSourcesBuildPhase section */
-
-/* Begin PBXTargetDependency section */
-		9B3FFF531D09E2B30019A709 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			target = 9B3FFF431D09CD3B0019A709 /* proxy_conf_helper */;
-			targetProxy = 9B3FFF521D09E2B30019A709 /* PBXContainerItemProxy */;
-		};
-		9B5DD7B32683A354005EFEF7 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			target = 9B0BFFE41D0460A70040E62B /* ShadowsocksX-NG */;
-			targetProxy = 9B5DD7B22683A354005EFEF7 /* PBXContainerItemProxy */;
-		};
-/* End PBXTargetDependency section */
-
-/* Begin PBXVariantGroup section */
-		9B0BFFEC1D0460A70040E62B /* MainMenu.xib */ = {
-			isa = PBXVariantGroup;
-			children = (
-				9B0BFFED1D0460A70040E62B /* Base */,
-				9BAFE2EB1E83F91D00F71CCE /* zh-Hans */,
-			);
-			name = MainMenu.xib;
-			sourceTree = "<group>";
-		};
-		9B172A6C1D0ADDDD00B87B9A /* Localizable.strings */ = {
-			isa = PBXVariantGroup;
-			children = (
-				9B172A6B1D0ADDDD00B87B9A /* Base */,
-				9B172A6D1D0ADDE800B87B9A /* zh-Hans */,
-			);
-			name = Localizable.strings;
-			sourceTree = "<group>";
-		};
-		9B2491B61D0ACC3A003BBECC /* PreferencesWindowController.xib */ = {
-			isa = PBXVariantGroup;
-			children = (
-				9B2491B51D0ACC3A003BBECC /* Base */,
-				9BE8FBC11D0B71CF00CAFD01 /* zh-Hans */,
-			);
-			name = PreferencesWindowController.xib;
-			sourceTree = "<group>";
-		};
-		9B7297EE214DA88A00FD24AA /* ShareServerProfilesWindowController.xib */ = {
-			isa = PBXVariantGroup;
-			children = (
-				9B7297ED214DA88A00FD24AA /* Base */,
-				9B7297F0214DA89000FD24AA /* zh-Hans */,
-			);
-			name = ShareServerProfilesWindowController.xib;
-			sourceTree = "<group>";
-		};
-		9B74B5EB232949B100DEA386 /* ImportWindowController.xib */ = {
-			isa = PBXVariantGroup;
-			children = (
-				9B74B5EF232949D400DEA386 /* Base */,
-				9B74B5F1232949E800DEA386 /* zh-Hans */,
-			);
-			name = ImportWindowController.xib;
-			sourceTree = "<group>";
-		};
-		9BAFE2E41E83ED7F00F71CCE /* PreferencesWinController.xib */ = {
-			isa = PBXVariantGroup;
-			children = (
-				9BAFE2E31E83ED7F00F71CCE /* Base */,
-				9BAFE2E91E83EDDF00F71CCE /* zh-Hans */,
-			);
-			name = PreferencesWinController.xib;
-			sourceTree = "<group>";
-		};
-		C8E42A701D4F2CAF0074C7EA /* UserRulesController.xib */ = {
-			isa = PBXVariantGroup;
-			children = (
-				C8E42A6F1D4F2CAF0074C7EA /* Base */,
-				C8E42A721D4F2CB10074C7EA /* zh-Hans */,
-			);
-			name = UserRulesController.xib;
-			sourceTree = "<group>";
-		};
-/* End PBXVariantGroup section */
-
-/* Begin XCBuildConfiguration section */
-		9B0B00061D0460A70040E62B /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = "$(inherited)";
-				ALWAYS_SEARCH_USER_PATHS = "$(inherited)";
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				CODE_SIGN_IDENTITY = "";
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu99;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"DEBUG=1",
-					"$(inherited)",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MTL_ENABLE_DEBUG_INFO = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				SDKROOT = macosx;
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-			};
-			name = Debug;
-		};
-		9B0B00071D0460A70040E62B /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = "$(inherited)";
-				ALWAYS_SEARCH_USER_PATHS = "$(inherited)";
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				CODE_SIGN_IDENTITY = "";
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu99;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MTL_ENABLE_DEBUG_INFO = NO;
-				SDKROOT = macosx;
-				SWIFT_OPTIMIZATION_LEVEL = "-Owholemodule";
-			};
-			name = Release;
-		};
-		9B0B00091D0460A70040E62B /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = FE3237E9FB24D9B924A0E630 /* Pods-ShadowsocksX-NG.debug.xcconfig */;
-			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CLANG_ENABLE_MODULES = YES;
-				CODE_SIGN_IDENTITY = "-";
-				CODE_SIGN_STYLE = Manual;
-				COMBINE_HIDPI_IMAGES = YES;
-				DEVELOPMENT_TEAM = "";
-				HEADER_SEARCH_PATHS = (
-					"$(inherited)",
-					"$(SRCROOT)/libcork/include/",
-					"$(SRCROOT)/libipset/include/",
-				);
-				INFOPLIST_FILE = "ShadowsocksX-NG/Info.plist";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks";
-				LIBRARY_SEARCH_PATHS = (
-					"$(inherited)",
-					"$(SDKROOT)/usr/lib/system",
-					"$(PROJECT_DIR)/ShadowsocksX-NG",
-					"$(PROJECT_DIR)/ShadowsocksX-NG/simple-obfs",
-				);
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MARKETING_VERSION = 1.9.4;
-				PRODUCT_BUNDLE_IDENTIFIER = "com.qiuyuzhou.ShadowsocksX-NG";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SWIFT_OBJC_BRIDGING_HEADER = "ShadowsocksX-NG/ShadowsocksX-NG-Bridging-Header.h";
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_SWIFT3_OBJC_INFERENCE = Default;
-				SWIFT_VERSION = 5.0;
-			};
-			name = Debug;
-		};
-		9B0B000A1D0460A70040E62B /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = E9E9FB3855DA55D0710EE7BD /* Pods-ShadowsocksX-NG.release.xcconfig */;
-			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CLANG_ENABLE_MODULES = YES;
-				CODE_SIGN_IDENTITY = "-";
-				CODE_SIGN_STYLE = Manual;
-				COMBINE_HIDPI_IMAGES = YES;
-				DEVELOPMENT_TEAM = "";
-				HEADER_SEARCH_PATHS = (
-					"$(inherited)",
-					"$(SRCROOT)/libcork/include/",
-					"$(SRCROOT)/libipset/include/",
-				);
-				INFOPLIST_FILE = "ShadowsocksX-NG/Info.plist";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks";
-				LIBRARY_SEARCH_PATHS = (
-					"$(inherited)",
-					"$(SDKROOT)/usr/lib/system",
-					"$(PROJECT_DIR)/ShadowsocksX-NG",
-					"$(PROJECT_DIR)/ShadowsocksX-NG/simple-obfs",
-				);
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MARKETING_VERSION = 1.9.4;
-				PRODUCT_BUNDLE_IDENTIFIER = "com.qiuyuzhou.ShadowsocksX-NG";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SWIFT_OBJC_BRIDGING_HEADER = "ShadowsocksX-NG/ShadowsocksX-NG-Bridging-Header.h";
-				SWIFT_SWIFT3_OBJC_INFERENCE = Default;
-				SWIFT_VERSION = 5.0;
-			};
-			name = Release;
-		};
-		9B3FFF491D09CD3B0019A709 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = B4E6A97CA843F3943524B686 /* Pods-proxy_conf_helper.debug.xcconfig */;
-			buildSettings = {
-				CODE_SIGN_IDENTITY = "-";
-				CODE_SIGN_STYLE = Manual;
-				DEVELOPMENT_TEAM = "";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SKIP_INSTALL = YES;
-			};
-			name = Debug;
-		};
-		9B3FFF4A1D09CD3B0019A709 /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = 297AF069022A197FD8E9D226 /* Pods-proxy_conf_helper.release.xcconfig */;
-			buildSettings = {
-				CODE_SIGN_IDENTITY = "-";
-				DEVELOPMENT_TEAM = "";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SKIP_INSTALL = YES;
-			};
-			name = Release;
-		};
-		9B5DD7B52683A354005EFEF7 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				BUNDLE_LOADER = "$(TEST_HOST)";
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CODE_SIGN_IDENTITY = "-";
-				CODE_SIGN_STYLE = Manual;
-				COMBINE_HIDPI_IMAGES = YES;
-				DEVELOPMENT_TEAM = "";
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				INFOPLIST_FILE = "ShadowsocksX-NGTests/Info.plist";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/../Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				PRODUCT_BUNDLE_IDENTIFIER = "com.qiuyuzhou.ShadowsocksX-NGTests";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_VERSION = 5.0;
-				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/ShadowsocksX-NG.app/Contents/MacOS/ShadowsocksX-NG";
-			};
-			name = Debug;
-		};
-		9B5DD7B62683A354005EFEF7 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				BUNDLE_LOADER = "$(TEST_HOST)";
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CODE_SIGN_IDENTITY = "-";
-				CODE_SIGN_STYLE = Manual;
-				COMBINE_HIDPI_IMAGES = YES;
-				DEVELOPMENT_TEAM = "";
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				INFOPLIST_FILE = "ShadowsocksX-NGTests/Info.plist";
-				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/../Frameworks @loader_path/../Frameworks";
-				MACOSX_DEPLOYMENT_TARGET = 10.12;
-				MTL_FAST_MATH = YES;
-				PRODUCT_BUNDLE_IDENTIFIER = "com.qiuyuzhou.ShadowsocksX-NGTests";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SWIFT_VERSION = 5.0;
-				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/ShadowsocksX-NG.app/Contents/MacOS/ShadowsocksX-NG";
-			};
-			name = Release;
-		};
-/* End XCBuildConfiguration section */
-
-/* Begin XCConfigurationList section */
-		9B0B00081D0460A70040E62B /* Build configuration list for PBXNativeTarget "ShadowsocksX-NG" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				9B0B00091D0460A70040E62B /* Debug */,
-				9B0B000A1D0460A70040E62B /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		9B0BFFE01D0460A70040E62B /* Build configuration list for PBXProject "ShadowsocksX-NG" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				9B0B00061D0460A70040E62B /* Debug */,
-				9B0B00071D0460A70040E62B /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		9B3FFF481D09CD3B0019A709 /* Build configuration list for PBXNativeTarget "proxy_conf_helper" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				9B3FFF491D09CD3B0019A709 /* Debug */,
-				9B3FFF4A1D09CD3B0019A709 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		9B5DD7B42683A354005EFEF7 /* Build configuration list for PBXNativeTarget "ShadowsocksX-NGTests" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				9B5DD7B52683A354005EFEF7 /* Debug */,
-				9B5DD7B62683A354005EFEF7 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-/* End XCConfigurationList section */
-	};
-	rootObject = 9B0BFFDD1D0460A70040E62B /* Project object */;
-}
diff --git a/ShadowsocksX-NG.xcodeproj/project.xcworkspace/contents.xcworkspacedata b/ShadowsocksX-NG.xcodeproj/project.xcworkspace/contents.xcworkspacedata
deleted file mode 100644
index b2f2197e7..000000000
--- a/ShadowsocksX-NG.xcodeproj/project.xcworkspace/contents.xcworkspacedata
+++ /dev/null
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Workspace
-   version = "1.0">
-   <FileRef
-      location = "self:ShadowsocksX-NG.xcodeproj">
-   </FileRef>
-</Workspace>
diff --git a/ShadowsocksX-NG.xcodeproj/xcshareddata/xcschemes/ShadowsocksX-NG.xcscheme b/ShadowsocksX-NG.xcodeproj/xcshareddata/xcschemes/ShadowsocksX-NG.xcscheme
deleted file mode 100644
index 3b96caf36..000000000
--- a/ShadowsocksX-NG.xcodeproj/xcshareddata/xcschemes/ShadowsocksX-NG.xcscheme
+++ /dev/null
@@ -1,97 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "1250"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "9B0BFFE41D0460A70040E62B"
-               BuildableName = "ShadowsocksX-NG.app"
-               BlueprintName = "ShadowsocksX-NG"
-               ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "9B0BFFE41D0460A70040E62B"
-            BuildableName = "ShadowsocksX-NG.app"
-            BlueprintName = "ShadowsocksX-NG"
-            ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <Testables>
-         <TestableReference
-            skipped = "NO">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "9B0BFFF31D0460A70040E62B"
-               BuildableName = "ShadowsocksX-NGTests.xctest"
-               BlueprintName = "ShadowsocksX-NGTests"
-               ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-            </BuildableReference>
-         </TestableReference>
-      </Testables>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-      <BuildableProductRunnable
-         runnableDebuggingMode = "0">
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "9B0BFFE41D0460A70040E62B"
-            BuildableName = "ShadowsocksX-NG.app"
-            BlueprintName = "ShadowsocksX-NG"
-            ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-         </BuildableReference>
-      </BuildableProductRunnable>
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-      <BuildableProductRunnable
-         runnableDebuggingMode = "0">
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "9B0BFFE41D0460A70040E62B"
-            BuildableName = "ShadowsocksX-NG.app"
-            BlueprintName = "ShadowsocksX-NG"
-            ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-         </BuildableReference>
-      </BuildableProductRunnable>
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>
diff --git a/ShadowsocksX-NG.xcodeproj/xcshareddata/xcschemes/ShadowsocksX-NGTests.xcscheme b/ShadowsocksX-NG.xcodeproj/xcshareddata/xcschemes/ShadowsocksX-NGTests.xcscheme
deleted file mode 100644
index c7de1b765..000000000
--- a/ShadowsocksX-NG.xcodeproj/xcshareddata/xcschemes/ShadowsocksX-NGTests.xcscheme
+++ /dev/null
@@ -1,52 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "1250"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <Testables>
-         <TestableReference
-            skipped = "NO">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "9B0BFFF31D0460A70040E62B"
-               BuildableName = "ShadowsocksX-NGTests.xctest"
-               BlueprintName = "ShadowsocksX-NGTests"
-               ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-            </BuildableReference>
-         </TestableReference>
-      </Testables>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>
diff --git a/ShadowsocksX-NG.xcodeproj/xcshareddata/xcschemes/proxy_conf_helper.xcscheme b/ShadowsocksX-NG.xcodeproj/xcshareddata/xcschemes/proxy_conf_helper.xcscheme
deleted file mode 100644
index ec3a5f422..000000000
--- a/ShadowsocksX-NG.xcodeproj/xcshareddata/xcschemes/proxy_conf_helper.xcscheme
+++ /dev/null
@@ -1,87 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "1250"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "9B3FFF431D09CD3B0019A709"
-               BuildableName = "proxy_conf_helper"
-               BlueprintName = "proxy_conf_helper"
-               ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "9B3FFF431D09CD3B0019A709"
-            BuildableName = "proxy_conf_helper"
-            BlueprintName = "proxy_conf_helper"
-            ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <Testables>
-      </Testables>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-      <BuildableProductRunnable
-         runnableDebuggingMode = "0">
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "9B3FFF431D09CD3B0019A709"
-            BuildableName = "proxy_conf_helper"
-            BlueprintName = "proxy_conf_helper"
-            ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-         </BuildableReference>
-      </BuildableProductRunnable>
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-      <BuildableProductRunnable
-         runnableDebuggingMode = "0">
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "9B3FFF431D09CD3B0019A709"
-            BuildableName = "proxy_conf_helper"
-            BlueprintName = "proxy_conf_helper"
-            ReferencedContainer = "container:ShadowsocksX-NG.xcodeproj">
-         </BuildableReference>
-      </BuildableProductRunnable>
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>
diff --git a/ShadowsocksX-NG.xcworkspace/contents.xcworkspacedata b/ShadowsocksX-NG.xcworkspace/contents.xcworkspacedata
deleted file mode 100644
index 9ccb78549..000000000
--- a/ShadowsocksX-NG.xcworkspace/contents.xcworkspacedata
+++ /dev/null
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Workspace
-   version = "1.0">
-   <FileRef
-      location = "group:ShadowsocksX-NG.xcodeproj">
-   </FileRef>
-   <FileRef
-      location = "group:Pods/Pods.xcodeproj">
-   </FileRef>
-</Workspace>
diff --git a/ShadowsocksX-NG.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings b/ShadowsocksX-NG.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings
deleted file mode 100644
index 54782e32f..000000000
--- a/ShadowsocksX-NG.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings
+++ /dev/null
@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>IDEWorkspaceSharedSettings_AutocreateContextsIfNeeded</key>
-	<true/>
-</dict>
-</plist>
diff --git a/ShadowsocksX-NG/AppDelegate.swift b/ShadowsocksX-NG/AppDelegate.swift
deleted file mode 100755
index 015db581d..000000000
--- a/ShadowsocksX-NG/AppDelegate.swift
+++ /dev/null
@@ -1,691 +0,0 @@
-//
-//  AppDelegate.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/5.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-import Carbon
-import RxCocoa
-import RxSwift
-
-@NSApplicationMain
-class AppDelegate: NSObject, NSApplicationDelegate, NSUserNotificationCenterDelegate {
-    
-    var shareWinCtrl: ShareServerProfilesWindowController!
-    var qrcodeWinCtrl: SWBQRCodeWindowController!
-    var preferencesWinCtrl: PreferencesWindowController!
-    var editUserRulesWinCtrl: UserRulesController!
-    var allInOnePreferencesWinCtrl: PreferencesWinController!
-    var toastWindowCtrl: ToastWindowController!
-    var importWinCtrl: ImportWindowController!
-
-    @IBOutlet weak var window: NSWindow!
-    @IBOutlet weak var statusMenu: NSMenu!
-    
-    @IBOutlet weak var runningStatusMenuItem: NSMenuItem!
-    @IBOutlet weak var toggleRunningMenuItem: NSMenuItem!
-    @IBOutlet weak var autoModeMenuItem: NSMenuItem!
-    @IBOutlet weak var globalModeMenuItem: NSMenuItem!
-    @IBOutlet weak var manualModeMenuItem: NSMenuItem!
-    @IBOutlet weak var externalPACModeMenuItem: NSMenuItem!
-    
-    @IBOutlet weak var serversMenuItem: NSMenuItem!
-    @IBOutlet var showQRCodeMenuItem: NSMenuItem!
-    @IBOutlet var scanQRCodeMenuItem: NSMenuItem!
-    @IBOutlet var serverProfilesBeginSeparatorMenuItem: NSMenuItem!
-    @IBOutlet var serverProfilesEndSeparatorMenuItem: NSMenuItem!
-    
-    @IBOutlet weak var copyHttpProxyExportCmdLineMenuItem: NSMenuItem!
-    
-    @IBOutlet weak var lanchAtLoginMenuItem: NSMenuItem!
-
-    @IBOutlet weak var hudWindow: NSPanel!
-    @IBOutlet weak var panelView: NSView!
-    @IBOutlet weak var isNameTextField: NSTextField!
-
-    let kProfileMenuItemIndexBase = 100
-
-    var statusItem: NSStatusItem!
-    static let StatusItemIconWidth: CGFloat = NSStatusItem.variableLength
-    
-    func ensureLaunchAgentsDirOwner () {
-        let dirPath = NSHomeDirectory() + "/Library/LaunchAgents"
-        let fileMgr = FileManager.default
-        if fileMgr.fileExists(atPath: dirPath) {
-            do {
-                let attrs = try fileMgr.attributesOfItem(atPath: dirPath)
-                if attrs[FileAttributeKey.ownerAccountName] as! String != NSUserName() {
-                    //try fileMgr.setAttributes([FileAttributeKey.ownerAccountName: NSUserName()], ofItemAtPath: dirPath)
-                    let bashFilePath = Bundle.main.path(forResource: "fix_dir_owner.sh", ofType: nil)!
-                    let script = "do shell script \"bash \\\"\(bashFilePath)\\\" \(NSUserName()) \" with administrator privileges"
-                    if let appleScript = NSAppleScript(source: script) {
-                        var err: NSDictionary? = nil
-                        appleScript.executeAndReturnError(&err)
-                    }
-                }
-            }
-            catch {
-                NSLog("Error when ensure the owner of $HOME/Library/LaunchAgents, \(error.localizedDescription)")
-            }
-        }
-    }
-    
-    func applicationDidFinishLaunching(_ aNotification: Notification) {
-        
-        _ = LaunchAtLoginController()// Ensure set when launch
-        
-        NSUserNotificationCenter.default.delegate = self
-        
-        self.ensureLaunchAgentsDirOwner()
-        
-        // Prepare ss-local
-        InstallSSLocal()
-        InstallPrivoxy()
-        InstallSimpleObfs()
-        InstallKcptun()
-        InstallV2rayPlugin()
-        
-        // Prepare defaults
-        let defaults = UserDefaults.standard
-        defaults.register(defaults: [
-            "ShadowsocksOn": true,
-            "ShadowsocksRunningMode": "auto",
-            "LocalSocks5.ListenPort": NSNumber(value: 1086 as UInt16),
-            "LocalSocks5.ListenAddress": "127.0.0.1",
-            "PacServer.BindToLocalhost": NSNumber(value: true as Bool),
-            "PacServer.ListenPort":NSNumber(value: 1089 as UInt16),
-            "LocalSocks5.Timeout": NSNumber(value: 60 as UInt),
-            "LocalSocks5.EnableUDPRelay": NSNumber(value: false as Bool),
-            "LocalSocks5.EnableVerboseMode": NSNumber(value: false as Bool),
-            "GFWListURL": "https://cdn.jsdelivr.net/gh/gfwlist/gfwlist/gfwlist.txt",
-            "AutoConfigureNetworkServices": NSNumber(value: true as Bool),
-            "LocalHTTP.ListenAddress": "127.0.0.1",
-            "LocalHTTP.ListenPort": NSNumber(value: 1087 as UInt16),
-            "LocalHTTPOn": true,
-            "LocalHTTP.FollowGlobal": false,
-            "ProxyExceptions": "127.0.0.1, localhost, 192.168.0.0/16, 10.0.0.0/8, FE80::/64, ::1, FD00::/8",
-            "ExternalPACURL": "",
-            "EnableSwitchMode.PAC": true,
-            "EnableSwitchMode.Global": true,
-            "EnableSwitchMode.Manual": false,
-            "EnableSwitchMode.ExternalPAC": false,
-            ])
-        
-        statusItem = NSStatusBar.system.statusItem(withLength: AppDelegate.StatusItemIconWidth)
-        let image : NSImage = NSImage(named: "menu_icon")!
-        image.isTemplate = true
-        statusItem.image = image
-        statusItem.menu = statusMenu
-        
-        let notifyCenter = NotificationCenter.default
-        
-        _ = notifyCenter.rx.notification(NOTIFY_CONF_CHANGED)
-            .subscribe(onNext: { noti in
-                self.applyConfig()
-                self.updateRunningModeMenu()
-                self.updateCopyHttpProxyExportMenu()
-            })
-        
-        notifyCenter.addObserver(forName: NOTIFY_SERVER_PROFILES_CHANGED, object: nil, queue: nil
-            , using: {
-                (note) in
-                let profileMgr = ServerProfileManager.instance
-                if profileMgr.activeProfileId == nil &&
-                    profileMgr.profiles.count > 0{
-                    if profileMgr.profiles[0].isValid(){
-                        profileMgr.setActiveProfiledId(profileMgr.profiles[0].uuid)
-                    }
-                }
-                self.updateServersMenu()
-                self.updateRunningModeMenu()
-                SyncSSLocal()
-            }
-        )
-        _ = notifyCenter.rx.notification(NOTIFY_TOGGLE_RUNNING_SHORTCUT)
-            .subscribe(onNext: { noti in
-                self.doToggleRunning(showToast: true)
-            })
-        _ = notifyCenter.rx.notification(NOTIFY_SWITCH_PROXY_MODE_SHORTCUT)
-            .subscribe(onNext: { noti in
-                let mode = defaults.string(forKey: "ShadowsocksRunningMode")!
-                
-                var enabledModeList: [String] = []
-                if defaults.bool(forKey: "EnableSwitchMode.PAC") {
-                    enabledModeList.append("auto")
-                }
-                if defaults.bool(forKey: "EnableSwitchMode.Global") {
-                    enabledModeList.append("global")
-                }
-                if defaults.bool(forKey: "EnableSwitchMode.Manual") {
-                    enabledModeList.append("manual")
-                }
-                if defaults.bool(forKey: "EnableSwitchMode.ExternalPAC")
-                    && self.externalPACModeMenuItem.isEnabled {
-                    enabledModeList.append("externalPAC")
-                }
-                
-                if enabledModeList.isEmpty {
-                    return
-                }
-                
-                var nextMode = ""
-                if enabledModeList.contains(mode) {
-                    let i = enabledModeList.firstIndex(of: mode)!
-                    if i + 1 == enabledModeList.count {
-                        nextMode = enabledModeList[0]
-                    } else {
-                        nextMode = enabledModeList[i+1]
-                    }
-                } else {
-                    nextMode = enabledModeList[0]
-                }
-                
-                defaults.setValue(nextMode, forKey: "ShadowsocksRunningMode")
-                
-                self.updateRunningModeMenu()
-                self.applyConfig()
-                
-                // Show toast message
-                let toastMessages = [
-                    "auto": "Auto Mode By PAC".localized,
-                    "global": "Global Mode".localized,
-                    "manual": "Manual Mode".localized,
-                    "externalPAC": "Auto Mode By External PAC".localized,
-                ]
-                self.makeToast(toastMessages[nextMode]!)
-            })
-        
-        _ = notifyCenter.rx.notification(NOTIFY_FOUND_SS_URL)
-            .subscribe(onNext: { noti in
-                self.handleFoundSSURL(noti)
-            })
-        
-        // Handle ss url scheme
-        NSAppleEventManager.shared().setEventHandler(self
-            , andSelector: #selector(self.handleURLEvent)
-            , forEventClass: AEEventClass(kInternetEventClass), andEventID: AEEventID(kAEGetURL))
-        
-        updateMainMenu()
-        updateCopyHttpProxyExportMenu()
-        updateServersMenu()
-        updateRunningModeMenu()
-        
-        ProxyConfHelper.install()
-        ProxyConfHelper.startMonitorPAC()
-        applyConfig()
-
-        // Register global hotkey
-        ShortcutsController.bindShortcuts()
-    }
-    
-    func applicationWillTerminate(_ aNotification: Notification) {
-        // Insert code here to tear down your application
-        StopSSLocal()
-        StopPrivoxy()
-        ProxyConfHelper.disableProxy()
-    }
-
-    func applyConfig() {
-        SyncSSLocal()
-        
-        let defaults = UserDefaults.standard
-        let isOn = defaults.bool(forKey: "ShadowsocksOn")
-        let mode = defaults.string(forKey: "ShadowsocksRunningMode")
-        
-        if isOn {
-            if mode == "auto" {
-                ProxyConfHelper.enablePACProxy()
-            } else if mode == "global" {
-                ProxyConfHelper.enableGlobalProxy()
-            } else if mode == "manual" {
-                ProxyConfHelper.disableProxy()
-            } else if mode == "externalPAC" {
-                ProxyConfHelper.enableExternalPACProxy()
-            }
-        } else {
-            ProxyConfHelper.disableProxy()
-        }
-    }
-
-    // MARK: - UI Methods
-    @IBAction func toggleRunning(_ sender: NSMenuItem) {
-        self.doToggleRunning(showToast: false)
-    }
-    
-    func doToggleRunning(showToast: Bool) {
-        let defaults = UserDefaults.standard
-        var isOn = UserDefaults.standard.bool(forKey: "ShadowsocksOn")
-        isOn = !isOn
-        defaults.set(isOn, forKey: "ShadowsocksOn")
-        
-        self.updateMainMenu()
-        self.applyConfig()
-        
-        if showToast {
-            if isOn {
-                self.makeToast("Shadowsocks: On".localized)
-            }
-            else {
-                self.makeToast("Shadowsocks: Off".localized)
-            }
-        }
-    }
-    
-    @IBAction func updateGFWList(_ sender: NSMenuItem) {
-        UpdatePACFromGFWList()
-    }
-    
-    @IBAction func editUserRulesForPAC(_ sender: NSMenuItem) {
-        if editUserRulesWinCtrl != nil {
-            editUserRulesWinCtrl.close()
-        }
-        let ctrl = UserRulesController(windowNibName: "UserRulesController")
-        editUserRulesWinCtrl = ctrl
-        
-        ctrl.showWindow(self)
-        NSApp.activate(ignoringOtherApps: true)
-        ctrl.window?.makeKeyAndOrderFront(self)
-    }
-    
-    @IBAction func showShareServerProfiles(_ sender: NSMenuItem) {
-        if shareWinCtrl != nil {
-            shareWinCtrl.close()
-        }
-        shareWinCtrl = ShareServerProfilesWindowController(windowNibName: "ShareServerProfilesWindowController")
-        shareWinCtrl.showWindow(self)
-        NSApp.activate(ignoringOtherApps: true)
-        shareWinCtrl.window?.makeKeyAndOrderFront(nil)
-    }
-    
-    @IBAction func showImportWindow(_ sender: NSMenuItem) {
-        if importWinCtrl != nil {
-            importWinCtrl.close()
-        }
-        importWinCtrl = ImportWindowController(windowNibName: "ImportWindowController")
-        importWinCtrl.showWindow(self)
-        NSApp.activate(ignoringOtherApps: true)
-        importWinCtrl.window?.makeKeyAndOrderFront(nil)
-    }
-    
-    @IBAction func scanQRCodeFromScreen(_ sender: NSMenuItem) {
-        ScanQRCodeOnScreen()
-    }
-    
-    @IBAction func importProfileURLFromPasteboard(_ sender: NSMenuItem) {
-        let pb = NSPasteboard.general
-        if #available(OSX 10.13, *) {
-            if let text = pb.string(forType: NSPasteboard.PasteboardType.URL) {
-                if let url = URL(string: text) {
-                    NotificationCenter.default.post(
-                        name: NOTIFY_FOUND_SS_URL, object: nil
-                        , userInfo: [
-                            "urls": [url],
-                            "source": "pasteboard",
-                            ])
-                }
-            }
-        }
-        if let text = pb.string(forType: NSPasteboard.PasteboardType.string) {
-            var urls = text.split(separator: "\n")
-                .map { String($0).trimmingCharacters(in: CharacterSet.whitespacesAndNewlines) }
-                .map { URL(string: $0) }
-                .filter { $0 != nil }
-                .map { $0! }
-            urls = urls.filter { $0.scheme == "ss" }
-            
-            NotificationCenter.default.post(
-                name: NOTIFY_FOUND_SS_URL, object: nil
-                , userInfo: [
-                    "urls": urls,
-                    "source": "pasteboard",
-                    ])
-        }
-    }
-
-    @IBAction func selectPACMode(_ sender: NSMenuItem) {
-        let defaults = UserDefaults.standard
-        defaults.setValue("auto", forKey: "ShadowsocksRunningMode")
-        updateRunningModeMenu()
-        applyConfig()
-    }
-    
-    @IBAction func selectGlobalMode(_ sender: NSMenuItem) {
-        let defaults = UserDefaults.standard
-        defaults.setValue("global", forKey: "ShadowsocksRunningMode")
-        updateRunningModeMenu()
-        applyConfig()
-    }
-    
-    @IBAction func selectManualMode(_ sender: NSMenuItem) {
-        let defaults = UserDefaults.standard
-        defaults.setValue("manual", forKey: "ShadowsocksRunningMode")
-        updateRunningModeMenu()
-        applyConfig()
-    }
-    
-    @IBAction func selectExternalPACMode(_ sender: NSMenuItem) {
-        let defaults = UserDefaults.standard
-        defaults.setValue("externalPAC", forKey: "ShadowsocksRunningMode")
-        updateRunningModeMenu()
-        applyConfig()
-    }
-    
-    @IBAction func editServerPreferences(_ sender: NSMenuItem) {
-        if preferencesWinCtrl != nil {
-            preferencesWinCtrl.close()
-        }
-        preferencesWinCtrl = PreferencesWindowController(windowNibName: "PreferencesWindowController")
-        
-        preferencesWinCtrl.showWindow(self)
-        NSApp.activate(ignoringOtherApps: true)
-    }
-    
-    @IBAction func showAllInOnePreferences(_ sender: NSMenuItem) {
-        if allInOnePreferencesWinCtrl != nil {
-            allInOnePreferencesWinCtrl.close()
-        }
-        
-        allInOnePreferencesWinCtrl = PreferencesWinController(windowNibName: "PreferencesWinController")
-        
-        allInOnePreferencesWinCtrl.showWindow(self)
-        NSApp.activate(ignoringOtherApps: true)
-        allInOnePreferencesWinCtrl.window?.makeKeyAndOrderFront(self)
-    }
-    
-    @IBAction func selectServer(_ sender: NSMenuItem) {
-        let index = sender.tag - kProfileMenuItemIndexBase
-        let spMgr = ServerProfileManager.instance
-        let newProfile = spMgr.profiles[index]
-        if newProfile.uuid != spMgr.activeProfileId {
-            spMgr.setActiveProfiledId(newProfile.uuid)
-            updateServersMenu()
-            SyncSSLocal()
-            applyConfig()
-        }
-        updateRunningModeMenu()
-    }
-    
-    @IBAction func copyExportCommand(_ sender: NSMenuItem) {
-        // Get the Http proxy config.
-        let defaults = UserDefaults.standard
-        let address = defaults.string(forKey: "LocalHTTP.ListenAddress")!
-        let port = defaults.integer(forKey: "LocalHTTP.ListenPort")
-        
-        // Format an export string.
-        let command = "export http_proxy=http://\(address):\(port);export https_proxy=http://\(address):\(port);"
-        
-        // Copy to paste board.
-        NSPasteboard.general.clearContents()
-        NSPasteboard.general.setString(command, forType: NSPasteboard.PasteboardType.string)
-        
-        // Show a toast notification.
-        self.makeToast("Export Command Copied.".localized)
-    }
-    
-    @IBAction func showLogs(_ sender: NSMenuItem) {
-        let ws = NSWorkspace.shared
-        if let appUrl = ws.urlForApplication(withBundleIdentifier: "com.apple.Console") {
-            try! ws.launchApplication(at: appUrl
-                ,options: NSWorkspace.LaunchOptions.default
-                ,configuration: [NSWorkspace.LaunchConfigurationKey.arguments: "~/Library/Logs/ss-local.log"])
-        }
-    }
-    
-    @IBAction func feedback(_ sender: NSMenuItem) {
-        NSWorkspace.shared.open(URL(string: "https://github.com/qiuyuzhou/ShadowsocksX-NG/issues")!)
-    }
-    
-    @IBAction func checkForUpdates(_ sender: NSMenuItem) {
-        NSWorkspace.shared.open(URL(string: "https://github.com/shadowsocks/ShadowsocksX-NG/releases")!)
-    }
-    
-    @IBAction func exportDiagnosis(_ sender: NSMenuItem) {
-        let savePanel = NSSavePanel()
-        savePanel.title = "Save Diagnosis to File".localized
-        savePanel.canCreateDirectories = true
-        savePanel.allowedFileTypes = ["txt"]
-        savePanel.isExtensionHidden = false
-        
-        let formatter = DateFormatter()
-        formatter.dateFormat = "yyyyMMdd_HHmmss"
-        let dateString = formatter.string(from: Date())
-        
-        savePanel.nameFieldStringValue = "ShadowsocksX-NG_diagnose_\(dateString)"
-        
-        savePanel.becomeKey()
-        let result = savePanel.runModal()
-        if (result.rawValue == NSFileHandlingPanelOKButton) {
-            if let url = savePanel.url {
-                let diagnosisText = diagnose()
-                try! diagnosisText.write(to: url, atomically: false, encoding: String.Encoding.utf8)
-            }
-        }
-    }
-    
-    @IBAction func showHelp(_ sender: NSMenuItem) {
-        NSWorkspace.shared.open(URL(string: "https://github.com/shadowsocks/ShadowsocksX-NG/wiki")!)
-    }
-    
-    @IBAction func showAbout(_ sender: NSMenuItem) {
-        NSApp.orderFrontStandardAboutPanel(sender);
-        NSApp.activate(ignoringOtherApps: true)
-    }
-    
-    func updateRunningModeMenu() {
-        let defaults = UserDefaults.standard
-        
-        if let pacURL = defaults.string(forKey: "ExternalPACURL") {
-            if pacURL != "" {
-                externalPACModeMenuItem.isEnabled = true
-            } else {
-                externalPACModeMenuItem.isEnabled = false
-            }
-        }
-
-        // Update running mode state
-        autoModeMenuItem.state = .off
-        globalModeMenuItem.state = .off
-        manualModeMenuItem.state = .off
-        externalPACModeMenuItem.state = .off
-        
-        let mode = defaults.string(forKey: "ShadowsocksRunningMode")
-        if mode == "auto" {
-            autoModeMenuItem.state = .on
-        } else if mode == "global" {
-            globalModeMenuItem.state = .on
-        } else if mode == "manual" {
-            manualModeMenuItem.state = .on
-        } else if mode == "externalPAC" {
-            externalPACModeMenuItem.state = .on
-        }
-        updateStatusMenuImage()
-        
-        // Update selected server name
-        var serverMenuText = "Servers - (No Selected)".localized
-        
-        let mgr = ServerProfileManager.instance
-        for p in mgr.profiles {
-            if mgr.activeProfileId == p.uuid {
-                var profileName :String
-                if !p.remark.isEmpty {
-                    profileName = String(p.remark.prefix(24))
-                } else {
-                    profileName = p.serverHost
-                }
-                serverMenuText = "Servers".localized + " - \(profileName)"
-                break
-            }
-        }
-        serversMenuItem.title = serverMenuText
-    }
-    
-    func updateStatusMenuImage() {
-        let defaults = UserDefaults.standard
-        let mode = defaults.string(forKey: "ShadowsocksRunningMode")
-        let isOn = defaults.bool(forKey: "ShadowsocksOn")
-        if isOn {
-            if let m = mode {
-                switch m {
-                    case "auto":
-                        statusItem.image = NSImage(named: "menu_p_icon")
-                    case "global":
-                        statusItem.image = NSImage(named: "menu_g_icon")
-                    case "manual":
-                        statusItem.image = NSImage(named: "menu_m_icon")
-                    case "externalPAC":
-                        statusItem.image = NSImage(named: "menu_e_icon")
-                default: break
-                }
-                statusItem.image?.isTemplate = true
-            }
-        } else {
-            statusItem.image = NSImage(named: "menu_icon_disabled")
-            statusItem.image?.isTemplate = true
-        }
-    }
-    
-    func updateMainMenu() {
-        let defaults = UserDefaults.standard
-        let isOn = defaults.bool(forKey: "ShadowsocksOn")
-        if isOn {
-            runningStatusMenuItem.title = "Shadowsocks: On".localized
-            runningStatusMenuItem.image = NSImage(named: "NSStatusAvailable")
-            toggleRunningMenuItem.title = "Turn Shadowsocks Off".localized
-            let image = NSImage(named: "menu_icon")
-            statusItem.image = image
-        } else {
-            runningStatusMenuItem.title = "Shadowsocks: Off".localized
-            toggleRunningMenuItem.title = "Turn Shadowsocks On".localized
-            runningStatusMenuItem.image = NSImage(named: "NSStatusNone")
-            let image = NSImage(named: "menu_icon_disabled")
-            statusItem.image = image
-        }
-        statusItem.image?.isTemplate = true
-        
-        updateStatusMenuImage()
-    }
-    
-    func updateCopyHttpProxyExportMenu() {
-        let defaults = UserDefaults.standard
-        let isOn = defaults.bool(forKey: "LocalHTTPOn")
-        copyHttpProxyExportCmdLineMenuItem.isHidden = !isOn
-    }
-    
-    func updateServersMenu() {
-        guard let menu = serversMenuItem.submenu else { return }
-
-        let mgr = ServerProfileManager.instance
-        let profiles = mgr.profiles
-
-        // Remove all profile menu items
-        let beginIndex = menu.index(of: serverProfilesBeginSeparatorMenuItem) + 1
-        let endIndex = menu.index(of: serverProfilesEndSeparatorMenuItem)
-        // Remove from end to begin, so the index won't change :)
-        for index in (beginIndex..<endIndex).reversed() {
-            menu.removeItem(at: index)
-        }
-
-        // Insert all profile menu items
-        for (i, profile) in profiles.enumerated().reversed() {
-            let item = NSMenuItem()
-            item.tag = i + kProfileMenuItemIndexBase
-            item.title = profile.title()
-            item.state = (mgr.activeProfileId == profile.uuid) ? .on : .off
-            item.isEnabled = profile.isValid()
-            // Use number keys for faster switch between the first 10 servers from main menu
-            if i < 10 {
-                var key = i + 1
-                if key == 10 {
-                    key = 0
-                }
-                item.keyEquivalent = String(key)
-                item.keyEquivalentModifierMask = .init()
-            }
-            item.action = #selector(AppDelegate.selectServer)
-            
-            menu.insertItem(item, at: beginIndex)
-        }
-
-        // End separator is redundant if profile section is empty
-        serverProfilesEndSeparatorMenuItem.isHidden = profiles.isEmpty
-    }
-    
-    @objc func handleURLEvent(_ event: NSAppleEventDescriptor, withReplyEvent replyEvent: NSAppleEventDescriptor) {
-        if let urlString = event.paramDescriptor(forKeyword: AEKeyword(keyDirectObject))?.stringValue {
-            if let url = URL(string: urlString) {
-                NotificationCenter.default.post(
-                    name: NOTIFY_FOUND_SS_URL, object: nil
-                    , userInfo: [
-                        "urls": [url],
-                        "source": "url",
-                        ])
-            }
-        }
-    }
-    
-    func handleFoundSSURL(_ note: Notification) {
-        let sendNotify = {
-            (title: String, subtitle: String, infoText: String) in
-            
-            let userNote = NSUserNotification()
-            userNote.title = title
-            userNote.subtitle = subtitle
-            userNote.informativeText = infoText
-            userNote.soundName = NSUserNotificationDefaultSoundName
-            
-            NSUserNotificationCenter.default
-                .deliver(userNote);
-        }
-        
-        if let userInfo = (note as NSNotification).userInfo {
-            let urls: [URL] = userInfo["urls"] as! [URL]
-            
-            let mgr = ServerProfileManager.instance
-            let addCount = mgr.addServerProfileByURL(urls: urls)
-            
-            if addCount > 0 {
-                var subtitle: String = ""
-                if userInfo["source"] as! String == "qrcode" {
-                    subtitle = "By scan QR Code".localized
-                } else if userInfo["source"] as! String == "url" {
-                    subtitle = "By handle SS URL".localized
-                } else if userInfo["source"] as! String == "pasteboard" {
-                    subtitle = "By import from pasteboard".localized
-                }
-                
-                sendNotify("Add \(addCount) Shadowsocks Server Profile".localized, subtitle, "")
-            } else {
-                if userInfo["source"] as! String == "qrcode" {
-                    sendNotify("", "", "Not found valid QRCode of shadowsocks profile".localized)
-                } else if userInfo["source"] as! String == "url" {
-                    sendNotify("", "", "Not found valid URL of shadowsocks profile".localized)
-                }
-            }
-        }
-    }
-    
-    //------------------------------------------------------------
-    // NSUserNotificationCenterDelegate
-    
-    func userNotificationCenter(_ center: NSUserNotificationCenter
-        , shouldPresent notification: NSUserNotification) -> Bool {
-        return true
-    }
-    
-    
-    func makeToast(_ message: String) {
-        if toastWindowCtrl != nil {
-            toastWindowCtrl.close()
-        }
-        toastWindowCtrl = ToastWindowController(windowNibName: "ToastWindowController")
-        toastWindowCtrl.message = message
-        toastWindowCtrl.showWindow(self)
-        //NSApp.activate(ignoringOtherApps: true)
-        //toastWindowCtrl.window?.makeKeyAndOrderFront(self)
-        toastWindowCtrl.fadeInHud()
-    }
-}
-
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Contents.json b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Contents.json
deleted file mode 100755
index db41bc027..000000000
--- a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Contents.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "images" : [
-    {
-      "size" : "16x16",
-      "idiom" : "mac",
-      "filename" : "Icon_16x16.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "16x16",
-      "idiom" : "mac",
-      "filename" : "Icon_16x16@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "32x32",
-      "idiom" : "mac",
-      "filename" : "Icon_32x32.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "32x32",
-      "idiom" : "mac",
-      "filename" : "Icon_32x32@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "128x128",
-      "idiom" : "mac",
-      "filename" : "Icon_128x128.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "128x128",
-      "idiom" : "mac",
-      "filename" : "Icon_128x128@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "256x256",
-      "idiom" : "mac",
-      "filename" : "Icon_256x256.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "256x256",
-      "idiom" : "mac",
-      "filename" : "Icon_256x256@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "512x512",
-      "idiom" : "mac",
-      "filename" : "Icon_512x512.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "512x512",
-      "idiom" : "mac",
-      "filename" : "Icon_512x512@2x.png",
-      "scale" : "2x"
-    }
-  ],
-  "info" : {
-    "version" : 1,
-    "author" : "xcode"
-  }
-}
\ No newline at end of file
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_128x128.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_128x128.png
deleted file mode 100644
index e37e4b539..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_128x128.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_128x128@2x.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_128x128@2x.png
deleted file mode 100644
index 8dc10c069..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_128x128@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_16x16.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_16x16.png
deleted file mode 100644
index 749fa641d..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_16x16.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_16x16@2x.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_16x16@2x.png
deleted file mode 100644
index 07f5a2489..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_16x16@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_256x256.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_256x256.png
deleted file mode 100644
index 8dc10c069..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_256x256.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_256x256@2x.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_256x256@2x.png
deleted file mode 100644
index 21b4a19c1..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_256x256@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_32x32.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_32x32.png
deleted file mode 100644
index f46c87427..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_32x32.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_32x32@2x.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_32x32@2x.png
deleted file mode 100644
index cf80929c1..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_32x32@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_512x512.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_512x512.png
deleted file mode 100644
index 608e1d942..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_512x512.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_512x512@2x.png b/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_512x512@2x.png
deleted file mode 100644
index 70e8eb7c4..000000000
Binary files a/ShadowsocksX-NG/Assets.xcassets/AppIcon.appiconset/Icon_512x512@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/Assets.xcassets/Contents.json b/ShadowsocksX-NG/Assets.xcassets/Contents.json
deleted file mode 100644
index da4a164c9..000000000
--- a/ShadowsocksX-NG/Assets.xcassets/Contents.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "info" : {
-    "version" : 1,
-    "author" : "xcode"
-  }
-}
\ No newline at end of file
diff --git a/ShadowsocksX-NG/Base.lproj/ImportWindowController.xib b/ShadowsocksX-NG/Base.lproj/ImportWindowController.xib
deleted file mode 100644
index bd9f58485..000000000
--- a/ShadowsocksX-NG/Base.lproj/ImportWindowController.xib
+++ /dev/null
@@ -1,64 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="14490.70" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
-    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="14490.70"/>
-        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="ImportWindowController" customModule="ShadowsocksX_NG" customModuleProvider="target">
-            <connections>
-                <outlet property="inputBox" destination="EgI-Py-Op1" id="zNx-W4-NkW"/>
-                <outlet property="window" destination="F0z-JX-Cv5" id="gIp-Ho-8D9"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Import Server URLs" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" releasedWhenClosed="NO" animationBehavior="default" id="F0z-JX-Cv5">
-            <windowStyleMask key="styleMask" titled="YES" closable="YES" miniaturizable="YES" resizable="YES"/>
-            <windowPositionMask key="initialPositionMask" topStrut="YES" bottomStrut="YES"/>
-            <rect key="contentRect" x="544" y="557" width="680" height="270"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1680" height="1027"/>
-            <view key="contentView" id="se5-gp-TjO">
-                <rect key="frame" x="0.0" y="0.0" width="680" height="270"/>
-                <autoresizingMask key="autoresizingMask"/>
-                <subviews>
-                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" translatesAutoresizingMaskIntoConstraints="NO" id="EgI-Py-Op1">
-                        <rect key="frame" x="20" y="49" width="640" height="201"/>
-                        <constraints>
-                            <constraint firstAttribute="height" constant="201" id="Nj4-mV-JHl"/>
-                        </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" placeholderString="Copy the shadowsocks URLs to here" drawsBackground="YES" id="h31-8G-f2d">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                    </textField>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="doh-o9-XXh">
-                        <rect key="frame" x="516" y="13" width="150" height="32"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="138" id="uoX-dr-Ak1"/>
-                        </constraints>
-                        <buttonCell key="cell" type="push" title="Import" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="EW8-ld-aGr">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                        </buttonCell>
-                        <connections>
-                            <action selector="handleImport:" target="-2" id="Ch1-iY-BAo"/>
-                        </connections>
-                    </button>
-                </subviews>
-                <constraints>
-                    <constraint firstItem="EgI-Py-Op1" firstAttribute="trailing" secondItem="doh-o9-XXh" secondAttribute="trailing" id="K62-uO-jYd"/>
-                    <constraint firstItem="EgI-Py-Op1" firstAttribute="leading" secondItem="se5-gp-TjO" secondAttribute="leading" constant="20" symbolic="YES" id="ghl-kH-ozW"/>
-                    <constraint firstAttribute="trailing" secondItem="EgI-Py-Op1" secondAttribute="trailing" constant="20" symbolic="YES" id="mTU-X2-mS7"/>
-                    <constraint firstItem="EgI-Py-Op1" firstAttribute="top" secondItem="se5-gp-TjO" secondAttribute="top" constant="20" symbolic="YES" id="oet-Qd-ugX"/>
-                    <constraint firstItem="doh-o9-XXh" firstAttribute="top" secondItem="EgI-Py-Op1" secondAttribute="bottom" constant="8" symbolic="YES" id="wZC-Am-Hdd"/>
-                </constraints>
-            </view>
-            <connections>
-                <outlet property="delegate" destination="-2" id="0bl-1N-AYu"/>
-            </connections>
-        </window>
-    </objects>
-</document>
diff --git a/ShadowsocksX-NG/Base.lproj/Localizable.strings b/ShadowsocksX-NG/Base.lproj/Localizable.strings
deleted file mode 100755
index 0b14a344a..000000000
--- a/ShadowsocksX-NG/Base.lproj/Localizable.strings
+++ /dev/null
@@ -1,84 +0,0 @@
-
-
-
-
-
-
-/*
- * SHARED STRINGS
- */
-
-/*
- * ./ShadowsocksX-NG/UserRulesController.swift
- */
-
-"PAC has been updated by User Rules." = "PAC has been updated by User Rules.";
-
-"It's failed to update PAC by User Rules." = "It's failed to update PAC by User Rules.";
-
-/*
- * ./ShadowsocksX-NG/AppDelegate.swift
- */
-
-"Global Mode" = "Global Mode";
-
-"Manual Mode" = "Manual Mode";
-
-"Auto Mode By PAC" = "Auto Mode By PAC";
-
-"Shadowsocks: On" = "Shadowsocks: On";
-
-"Shadowsocks: Off" = "Shadowsocks: Off";
-
-"Export Command Copied." = "Export Command Copied.";
-
-"Save Diagnosis to File" = "Save Diagnosis to File";
-
-"Servers" = "Servers";
-
-"Turn Shadowsocks Off" = "Turn Shadowsocks Off";
-
-"Turn Shadowsocks On" = "Turn Shadowsocks On";
-
-"By scan QR Code" = "By scan QR Code";
-
-"By handle SS URL" = "By handle SS URL";
-
-"By import from pasteboard" = "By import from pasteboard";
-
-"Add \(addCount) Shadowsocks Server Profile" = "Add \(addCount) Shadowsocks Server Profile";
-
-"Not found valid QRCode of shadowsocks profile" = "Not found valid QRCode of shadowsocks profile";
-
-"Not found valid URL of shadowsocks profile" = "Not found valid URL of shadowsocks profile";
-
-/*
- * ./ShadowsocksX-NG/ShareServerProfilesWindowController.swift
- */
-
-"Save QRCode As File" = "Save QRCode As File";
-
-"Save All Server URLs To File" = "Save All Server URLs To File";
-
-/*
- * ./ShadowsocksX-NG/PACUtils.swift
- */
-
-"PAC has been updated by latest GFW List." = "PAC has been updated by latest GFW List.";
-
-"Failed to download latest GFW List." = "Failed to download latest GFW List.";
-
-/*
- * ./ShadowsocksX-NG/ImportWindowController.swift
- */
-
-"Success to add \(addCount) server." = "Success to add \(addCount) server.";
-
-"Not found valid shadowsocks server urls." = "Not found valid shadowsocks server urls.";
-
-/*
- * ./ShadowsocksX-NG/PreferencesWindowController.swift
- */
-
-"New Server" = "New Server";
-
diff --git a/ShadowsocksX-NG/Base.lproj/MainMenu.xib b/ShadowsocksX-NG/Base.lproj/MainMenu.xib
deleted file mode 100755
index daca7d060..000000000
--- a/ShadowsocksX-NG/Base.lproj/MainMenu.xib
+++ /dev/null
@@ -1,169 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="14490.70" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
-    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="14490.70"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="NSApplication">
-            <connections>
-                <outlet property="delegate" destination="Voe-Tx-rLC" id="GzC-gU-4Uq"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <customObject id="Voe-Tx-rLC" customClass="AppDelegate" customModule="ShadowsocksX_NG" customModuleProvider="target">
-            <connections>
-                <outlet property="autoModeMenuItem" destination="r07-Gu-aEz" id="9aH-pQ-Rgi"/>
-                <outlet property="copyHttpProxyExportCmdLineMenuItem" destination="lg6-To-GZA" id="VTb-he-dg4"/>
-                <outlet property="externalPACModeMenuItem" destination="U9N-QS-BwB" id="ING-P9-2Xz"/>
-                <outlet property="globalModeMenuItem" destination="Mw3-Jm-eXA" id="ar5-Yx-3ze"/>
-                <outlet property="manualModeMenuItem" destination="8PR-gs-c5N" id="9qz-mU-5kt"/>
-                <outlet property="runningStatusMenuItem" destination="fzk-mE-CEV" id="Vwm-Rg-Ykn"/>
-                <outlet property="scanQRCodeMenuItem" destination="Qe6-bF-paT" id="XHa-pa-nCa"/>
-                <outlet property="serverProfilesBeginSeparatorMenuItem" destination="4iN-w2-but" id="Jyu-48-AzD"/>
-                <outlet property="serverProfilesEndSeparatorMenuItem" destination="3cf-dF-7dx" id="eyc-6W-nWV"/>
-                <outlet property="serversMenuItem" destination="u5M-hQ-VSc" id="8gp-SY-Y4U"/>
-                <outlet property="statusMenu" destination="Hob-KD-bx9" id="clA-ZW-0pT"/>
-                <outlet property="toggleRunningMenuItem" destination="GSu-Tf-StS" id="XHw-pU-nCa"/>
-            </connections>
-        </customObject>
-        <customObject id="YLy-65-1bz" customClass="NSFontManager"/>
-        <menu title="ShadowsocksX-NG" autoenablesItems="NO" id="Hob-KD-bx9">
-            <items>
-                <menuItem title="Showsocks: On" enabled="NO" id="fzk-mE-CEV">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                </menuItem>
-                <menuItem title="Turn ShadowsocksX On" keyEquivalent="s" id="GSu-Tf-StS">
-                    <connections>
-                        <action selector="toggleRunning:" target="Voe-Tx-rLC" id="EvE-23-Wiv"/>
-                    </connections>
-                </menuItem>
-                <menuItem isSeparatorItem="YES" id="LXP-yK-yQu"/>
-                <menuItem title="Auto Mode By PAC" keyEquivalent="a" id="r07-Gu-aEz">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="selectPACMode:" target="Voe-Tx-rLC" id="l36-cd-xl7"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Global Mode" keyEquivalent="g" id="Mw3-Jm-eXA">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="selectGlobalMode:" target="Voe-Tx-rLC" id="7QH-HB-B2e"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Manual Mode" keyEquivalent="m" id="8PR-gs-c5N">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="selectManualMode:" target="Voe-Tx-rLC" id="Xxb-28-6fi"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Auto Mode By External PAC" id="U9N-QS-BwB">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="selectExternalPACMode:" target="Voe-Tx-rLC" id="LnX-Ec-hc4"/>
-                    </connections>
-                </menuItem>
-                <menuItem isSeparatorItem="YES" id="BMf-0T-UcX"/>
-                <menuItem title="Servers" id="u5M-hQ-VSc">
-                    <modifierMask key="keyEquivalentModifierMask" shift="YES"/>
-                    <menu key="submenu" title="Servers" id="9Y1-db-3HK">
-                        <items>
-                            <menuItem title="Server Preferences..." keyEquivalent="e" id="M5r-E7-44f">
-                                <connections>
-                                    <action selector="editServerPreferences:" target="Voe-Tx-rLC" id="6Lv-6i-Neb"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="4iN-w2-but"/>
-                            <menuItem isSeparatorItem="YES" id="3cf-dF-7dx"/>
-                        </items>
-                    </menu>
-                </menuItem>
-                <menuItem title="Scan QR Code From Screen" id="Qe6-bF-paT">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="scanQRCodeFromScreen:" target="Voe-Tx-rLC" id="zQZ-IT-H4a"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Import Server URLs..." id="geG-dQ-OYl">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="showImportWindow:" target="-1" id="CsE-vW-Wcn"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Share Server Profiles..." image="NSShareTemplate" id="r5z-RB-LIZ">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="showShareServerProfiles:" target="Voe-Tx-rLC" id="3Qv-n1-5h1"/>
-                    </connections>
-                </menuItem>
-                <menuItem isSeparatorItem="YES" id="vwY-hQ-ZIz"/>
-                <menuItem title="Preferences..." keyEquivalent="," id="4CS-qD-zW5">
-                    <connections>
-                        <action selector="showAllInOnePreferences:" target="Voe-Tx-rLC" id="2of-nZ-atc"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="HTTP Proxy Export Line To Pasteboard" image="terminal-logo" keyEquivalent="c" id="lg6-To-GZA">
-                    <connections>
-                        <action selector="copyExportCommand:" target="Voe-Tx-rLC" id="2U4-3M-sAK"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Update PAC from GFW List" id="TFc-Ec-duM">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="updateGFWList:" target="Voe-Tx-rLC" id="Ztt-PS-F3T"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Edit User Rules For PAC..." id="rms-p0-CvB">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="editUserRulesForPAC:" target="Voe-Tx-rLC" id="ZtK-2d-Pcl"/>
-                    </connections>
-                </menuItem>
-                <menuItem isSeparatorItem="YES" id="DTJ-NF-Wxr"/>
-                <menuItem title="Show Logs..." id="Jfy-sf-Fhl">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="showLogs:" target="Voe-Tx-rLC" id="5FZ-Xo-DGb"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Export Diagnosis..." id="eNh-vY-utd">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="exportDiagnosis:" target="Voe-Tx-rLC" id="YM9-l3-PHa"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Check for Updates..." id="hLv-bp-doM">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="checkForUpdates:" target="Voe-Tx-rLC" id="rWL-H9-me8"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="Help" id="Xg8-er-4Ov">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="showHelp:" target="Voe-Tx-rLC" id="Q7X-kb-TWD"/>
-                    </connections>
-                </menuItem>
-                <menuItem title="About" id="LgB-6g-Gba">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="showAbout:" target="Voe-Tx-rLC" id="ToP-D0-suY"/>
-                    </connections>
-                </menuItem>
-                <menuItem isSeparatorItem="YES" id="lSf-ni-kjo"/>
-                <menuItem title="Quit" keyEquivalent="q" id="vJS-JW-byz">
-                    <connections>
-                        <action selector="terminate:" target="-2" id="Mrp-4z-omR"/>
-                    </connections>
-                </menuItem>
-            </items>
-            <point key="canvasLocation" x="-2367" y="-139"/>
-        </menu>
-        <userDefaultsController representsSharedInstance="YES" id="jhL-aG-BFA"/>
-    </objects>
-    <resources>
-        <image name="NSShareTemplate" width="11" height="16"/>
-        <image name="terminal-logo" width="22.695652008056641" height="17.217391967773438"/>
-    </resources>
-</document>
diff --git a/ShadowsocksX-NG/Base.lproj/PreferencesWinController.xib b/ShadowsocksX-NG/Base.lproj/PreferencesWinController.xib
deleted file mode 100644
index cc271d256..000000000
--- a/ShadowsocksX-NG/Base.lproj/PreferencesWinController.xib
+++ /dev/null
@@ -1,711 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="15400" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
-    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="15400"/>
-        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="PreferencesWinController" customModule="ShadowsocksX_NG" customModuleProvider="target">
-            <connections>
-                <outlet property="tabView" destination="h22-uy-K1x" id="yH1-8m-Qpe"/>
-                <outlet property="toolbar" destination="D9u-IW-4jN" id="Q34-fm-M45"/>
-                <outlet property="window" destination="F0z-JX-Cv5" id="gIp-Ho-8D9"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Preferences" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" restorable="NO" animationBehavior="default" id="F0z-JX-Cv5">
-            <windowStyleMask key="styleMask" titled="YES" closable="YES"/>
-            <windowPositionMask key="initialPositionMask" topStrut="YES" bottomStrut="YES"/>
-            <rect key="contentRect" x="609" y="533" width="480" height="326"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1680" height="1027"/>
-            <view key="contentView" wantsLayer="YES" misplaced="YES" id="se5-gp-TjO">
-                <rect key="frame" x="0.0" y="0.0" width="479" height="326"/>
-                <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                <subviews>
-                    <tabView type="noTabsNoBorder" translatesAutoresizingMaskIntoConstraints="NO" id="h22-uy-K1x">
-                        <rect key="frame" x="0.0" y="0.0" width="480" height="326"/>
-                        <font key="font" metaFont="system"/>
-                        <tabViewItems>
-                            <tabViewItem label="General" identifier="general" id="xbG-eW-Prj">
-                                <view key="view" id="78E-rb-Ecu">
-                                    <rect key="frame" x="0.0" y="0.0" width="479" height="326"/>
-                                    <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                    <subviews>
-                                        <customView translatesAutoresizingMaskIntoConstraints="NO" id="3eT-fn-moA" customClass="MASShortcutView">
-                                            <rect key="frame" x="240" y="228" width="163" height="20"/>
-                                            <userDefinedRuntimeAttributes>
-                                                <userDefinedRuntimeAttribute type="string" keyPath="associatedUserDefaultsKey" value="SwitchProxyMode"/>
-                                            </userDefinedRuntimeAttributes>
-                                        </customView>
-                                        <customView translatesAutoresizingMaskIntoConstraints="NO" id="pbX-DJ-7mU" customClass="MASShortcutView">
-                                            <rect key="frame" x="240" y="256" width="163" height="20"/>
-                                            <userDefinedRuntimeAttributes>
-                                                <userDefinedRuntimeAttribute type="string" keyPath="associatedUserDefaultsKey" value="ToggleRunning"/>
-                                            </userDefinedRuntimeAttributes>
-                                        </customView>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="q90-qj-BXy">
-                                            <rect key="frame" x="18" y="230" width="216" height="16"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="left" title="Switch proxy mode:" id="BaL-cn-m8v">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="hbS-Ox-rTR">
-                                            <rect key="frame" x="18" y="258" width="216" height="16"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="left" title="Toggle Shadowsocks On/Off:" id="95S-ma-8Q7">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <button translatesAutoresizingMaskIntoConstraints="NO" id="Q6E-ur-aIL">
-                                            <rect key="frame" x="18" y="290" width="120" height="18"/>
-                                            <buttonCell key="cell" type="check" title="Launch At Login" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="XJx-j4-bBr">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="YAC-3k-qMR" name="value" keyPath="launchAtLogin" id="lF3-G5-F0w"/>
-                                            </connections>
-                                        </button>
-                                        <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="nKV-Vh-uaW">
-                                            <rect key="frame" x="315" y="13" width="151" height="32"/>
-                                            <buttonCell key="cell" type="push" title="Reset Preferences" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="mQC-AR-HXC">
-                                                <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <action selector="resetAllPreferencesWithSender:" target="-2" id="uck-d4-Zun"/>
-                                            </connections>
-                                        </button>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="Jbe-9l-xF4">
-                                            <rect key="frame" x="18" y="149" width="92" height="16"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="left" title="GFW List URL:" id="v7a-wf-aEm">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="71I-66-7Vm">
-                                            <rect key="frame" x="20" y="96" width="440" height="45"/>
-                                            <constraints>
-                                                <constraint firstAttribute="height" constant="45" id="iCq-yU-Y2M"/>
-                                            </constraints>
-                                            <textFieldCell key="cell" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" alignment="left" drawsBackground="YES" id="YqN-0f-ODA">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.GFWListURL" id="Rqt-XM-aCE">
-                                                    <dictionary key="options">
-                                                        <bool key="NSContinuouslyUpdatesValue" value="YES"/>
-                                                    </dictionary>
-                                                </binding>
-                                            </connections>
-                                        </textField>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="P6I-yN-chl">
-                                            <rect key="frame" x="18" y="204" width="281" height="16"/>
-                                            <textFieldCell key="cell" lineBreakMode="clipping" title="The mode will be switched to by the shortcut:" id="JZn-Si-mym">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="WCm-yO-4iG">
-                                            <rect key="frame" x="18" y="180" width="48" height="18"/>
-                                            <buttonCell key="cell" type="check" title="PAC" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="LtL-Fu-qXy">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.EnableSwitchMode.PAC" id="8Ud-4g-FJA"/>
-                                            </connections>
-                                        </button>
-                                        <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="3IG-rd-b11">
-                                            <rect key="frame" x="132" y="180" width="61" height="18"/>
-                                            <buttonCell key="cell" type="check" title="Global" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="aAp-dI-e5Q">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.EnableSwitchMode.Global" id="fwM-0H-0RB"/>
-                                            </connections>
-                                        </button>
-                                        <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="Rhd-R5-G5h">
-                                            <rect key="frame" x="238" y="180" width="66" height="18"/>
-                                            <buttonCell key="cell" type="check" title="Manual" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="HEX-K9-W2f">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.EnableSwitchMode.Manual" id="C3s-U6-qkc"/>
-                                            </connections>
-                                        </button>
-                                        <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="Bb7-im-uLW">
-                                            <rect key="frame" x="362" y="180" width="100" height="18"/>
-                                            <buttonCell key="cell" type="check" title="External PAC" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="wQp-fv-2mb">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.EnableSwitchMode.ExternalPAC" id="RpF-o3-gZh"/>
-                                            </connections>
-                                        </button>
-                                    </subviews>
-                                    <constraints>
-                                        <constraint firstItem="Rhd-R5-G5h" firstAttribute="baseline" secondItem="Bb7-im-uLW" secondAttribute="baseline" id="1yr-EN-h3l"/>
-                                        <constraint firstItem="3IG-rd-b11" firstAttribute="leading" secondItem="WCm-yO-4iG" secondAttribute="trailing" constant="70" id="22p-Tc-rHc"/>
-                                        <constraint firstItem="hbS-Ox-rTR" firstAttribute="centerY" secondItem="pbX-DJ-7mU" secondAttribute="centerY" id="2P5-T2-RkV"/>
-                                        <constraint firstItem="Jbe-9l-xF4" firstAttribute="top" secondItem="WCm-yO-4iG" secondAttribute="bottom" constant="17" id="5ej-R0-r46"/>
-                                        <constraint firstItem="Bb7-im-uLW" firstAttribute="leading" secondItem="Rhd-R5-G5h" secondAttribute="trailing" constant="62" id="5kp-aA-o9G"/>
-                                        <constraint firstItem="3IG-rd-b11" firstAttribute="baseline" secondItem="Rhd-R5-G5h" secondAttribute="baseline" id="6vf-yU-5hh"/>
-                                        <constraint firstItem="71I-66-7Vm" firstAttribute="top" secondItem="Jbe-9l-xF4" secondAttribute="bottom" constant="8" symbolic="YES" id="DI0-F3-nPx"/>
-                                        <constraint firstAttribute="bottom" secondItem="nKV-Vh-uaW" secondAttribute="bottom" constant="20" symbolic="YES" id="Dbi-Kv-Prd"/>
-                                        <constraint firstItem="3eT-fn-moA" firstAttribute="top" secondItem="pbX-DJ-7mU" secondAttribute="bottom" constant="8" symbolic="YES" id="DyC-vv-4hm"/>
-                                        <constraint firstItem="Q6E-ur-aIL" firstAttribute="leading" secondItem="hbS-Ox-rTR" secondAttribute="leading" id="Hpf-nE-hPy"/>
-                                        <constraint firstItem="3eT-fn-moA" firstAttribute="leading" secondItem="q90-qj-BXy" secondAttribute="trailing" constant="8" symbolic="YES" id="Ikf-Jk-Tz6"/>
-                                        <constraint firstItem="WCm-yO-4iG" firstAttribute="top" secondItem="P6I-yN-chl" secondAttribute="bottom" constant="8" symbolic="YES" id="O9s-j5-mi9"/>
-                                        <constraint firstItem="WCm-yO-4iG" firstAttribute="baseline" secondItem="3IG-rd-b11" secondAttribute="baseline" id="PIh-fb-Tzm"/>
-                                        <constraint firstItem="Q6E-ur-aIL" firstAttribute="leading" secondItem="78E-rb-Ecu" secondAttribute="leading" constant="20" symbolic="YES" id="PYb-Gf-rr5"/>
-                                        <constraint firstItem="hbS-Ox-rTR" firstAttribute="top" secondItem="Q6E-ur-aIL" secondAttribute="bottom" constant="18" id="T6H-PC-XvB"/>
-                                        <constraint firstItem="hbS-Ox-rTR" firstAttribute="leading" secondItem="q90-qj-BXy" secondAttribute="leading" id="TBQ-sz-KTB"/>
-                                        <constraint firstItem="Jbe-9l-xF4" firstAttribute="leading" secondItem="71I-66-7Vm" secondAttribute="leading" id="Tex-pk-ZD5"/>
-                                        <constraint firstItem="q90-qj-BXy" firstAttribute="centerY" secondItem="3eT-fn-moA" secondAttribute="centerY" id="VZw-mA-zAc"/>
-                                        <constraint firstItem="P6I-yN-chl" firstAttribute="top" secondItem="q90-qj-BXy" secondAttribute="bottom" constant="10" id="Wp6-vh-c45"/>
-                                        <constraint firstItem="WCm-yO-4iG" firstAttribute="leading" secondItem="Jbe-9l-xF4" secondAttribute="leading" id="Y0x-fT-GRh"/>
-                                        <constraint firstItem="71I-66-7Vm" firstAttribute="trailing" secondItem="nKV-Vh-uaW" secondAttribute="trailing" id="YMU-yy-gfG"/>
-                                        <constraint firstItem="pbX-DJ-7mU" firstAttribute="leading" secondItem="hbS-Ox-rTR" secondAttribute="trailing" constant="8" symbolic="YES" id="bDi-Yo-gUu"/>
-                                        <constraint firstItem="q90-qj-BXy" firstAttribute="top" secondItem="hbS-Ox-rTR" secondAttribute="bottom" constant="12" id="cgo-tr-moS"/>
-                                        <constraint firstItem="P6I-yN-chl" firstAttribute="leading" secondItem="WCm-yO-4iG" secondAttribute="leading" id="crm-aD-7SO"/>
-                                        <constraint firstItem="pbX-DJ-7mU" firstAttribute="leading" secondItem="3eT-fn-moA" secondAttribute="leading" id="dxN-Bw-raD"/>
-                                        <constraint firstItem="Q6E-ur-aIL" firstAttribute="top" secondItem="78E-rb-Ecu" secondAttribute="top" constant="20" symbolic="YES" id="fS2-Xh-qxI"/>
-                                        <constraint firstItem="Rhd-R5-G5h" firstAttribute="leading" secondItem="3IG-rd-b11" secondAttribute="trailing" constant="49" id="lmS-0A-XJL"/>
-                                        <constraint firstItem="P6I-yN-chl" firstAttribute="top" secondItem="3eT-fn-moA" secondAttribute="bottom" constant="8" symbolic="YES" id="oXD-FV-cSV"/>
-                                        <constraint firstItem="pbX-DJ-7mU" firstAttribute="trailing" secondItem="3eT-fn-moA" secondAttribute="trailing" id="osE-Ta-cCX"/>
-                                        <constraint firstItem="q90-qj-BXy" firstAttribute="leading" secondItem="P6I-yN-chl" secondAttribute="leading" id="wYd-Ib-vG5"/>
-                                        <constraint firstItem="3eT-fn-moA" firstAttribute="leading" secondItem="Rhd-R5-G5h" secondAttribute="leading" id="y5S-xd-IIK"/>
-                                        <constraint firstItem="Bb7-im-uLW" firstAttribute="trailing" secondItem="71I-66-7Vm" secondAttribute="trailing" id="zPo-Sm-LX1"/>
-                                        <constraint firstAttribute="trailing" secondItem="pbX-DJ-7mU" secondAttribute="trailing" constant="76" id="zw4-bz-JLZ"/>
-                                    </constraints>
-                                </view>
-                            </tabViewItem>
-                            <tabViewItem label="Advance" identifier="adv" id="ksf-9b-qoz" userLabel="Advanced">
-                                <view key="view" id="Pc1-f7-0zA">
-                                    <rect key="frame" x="0.0" y="0.0" width="480" height="326"/>
-                                    <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                    <subviews>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="r8z-mM-M0X">
-                                            <rect key="frame" x="35" y="257" width="181" height="16"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Local Socks5 Listen Port:" id="8fk-fw-Tsx">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="c8B-qf-UNK">
-                                            <rect key="frame" x="35" y="288" width="181" height="16"/>
-                                            <constraints>
-                                                <constraint firstAttribute="width" constant="177" id="37M-JU-n0c"/>
-                                            </constraints>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Local Socks5 Listen Address:" id="jkc-e3-4O0">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="cd8-PU-OwG">
-                                            <rect key="frame" x="222" y="285" width="238" height="21"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" drawsBackground="YES" id="LBl-2M-X7O">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.LocalSocks5.ListenAddress" id="UR8-Hk-Nyh">
-                                                    <dictionary key="options">
-                                                        <bool key="NSContinuouslyUpdatesValue" value="YES"/>
-                                                    </dictionary>
-                                                </binding>
-                                            </connections>
-                                        </textField>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="MvY-R0-1FU">
-                                            <rect key="frame" x="35" y="164" width="181" height="16"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Timeout:" id="sQ9-bj-V0I">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="Zfl-10-Wdk">
-                                            <rect key="frame" x="222" y="161" width="60" height="21"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" alignment="right" drawsBackground="YES" id="Ity-ir-Fyi">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.LocalSocks5.Timeout" id="gut-fs-P9y">
-                                                    <dictionary key="options">
-                                                        <bool key="NSContinuouslyUpdatesValue" value="YES"/>
-                                                    </dictionary>
-                                                </binding>
-                                                <outlet property="formatter" destination="2LX-ic-DJh" id="xUL-JA-BJu"/>
-                                            </connections>
-                                        </textField>
-                                        <button translatesAutoresizingMaskIntoConstraints="NO" id="tGd-pe-2xJ">
-                                            <rect key="frame" x="220" y="137" width="154" height="18"/>
-                                            <buttonCell key="cell" type="check" title="Enable UDP Relay" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="R3v-iN-zu8">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.LocalSocks5.EnableUDPRelay" id="aYQ-xT-BcZ"/>
-                                            </connections>
-                                        </button>
-                                        <textField verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="2rw-0u-LXJ">
-                                            <rect key="frame" x="222" y="254" width="60" height="21"/>
-                                            <constraints>
-                                                <constraint firstAttribute="width" constant="60" id="afC-Ya-WgP"/>
-                                            </constraints>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" alignment="right" drawsBackground="YES" id="MV1-4D-sap">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.LocalSocks5.ListenPort" id="m5T-YP-Pyp">
-                                                    <dictionary key="options">
-                                                        <bool key="NSContinuouslyUpdatesValue" value="YES"/>
-                                                    </dictionary>
-                                                </binding>
-                                                <outlet property="formatter" destination="C7t-aU-bub" id="ANT-yN-RZL"/>
-                                            </connections>
-                                        </textField>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="a60-LH-adV">
-                                            <rect key="frame" x="288" y="164" width="119" height="16"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="Seconds" id="4R2-UO-qs7">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <button translatesAutoresizingMaskIntoConstraints="NO" id="RcT-mn-xqK">
-                                            <rect key="frame" x="220" y="117" width="154" height="18"/>
-                                            <buttonCell key="cell" type="check" title="Enable Verbose Mode" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="cIS-Wb-Rzg">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.LocalSocks5.EnableVerboseMode" id="iOb-fx-G7F"/>
-                                            </connections>
-                                        </button>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="RYj-h6-uAT">
-                                            <rect key="frame" x="35" y="195" width="181" height="16"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Local PAC Server Listen Port:" id="IMQ-c4-gmc">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="KXG-O0-ake">
-                                            <rect key="frame" x="222" y="192" width="60" height="21"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" alignment="right" drawsBackground="YES" id="T9o-Og-neF">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.PacServer.ListenPort" id="EkJ-YG-WZk">
-                                                    <dictionary key="options">
-                                                        <bool key="NSContinuouslyUpdatesValue" value="YES"/>
-                                                    </dictionary>
-                                                </binding>
-                                                <outlet property="formatter" destination="C7t-aU-bub" id="3M6-FE-SDQ"/>
-                                            </connections>
-                                        </textField>
-                                        <textField verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="kjx-TJ-4n3">
-                                            <rect key="frame" x="20" y="66" width="352" height="21"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" borderStyle="bezel" drawsBackground="YES" id="8u6-Mz-FmD">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.ExternalPACURL" id="Txm-wz-loc"/>
-                                                <outlet property="formatter" destination="TUK-vL-Gf1" id="P0K-qn-jbx"/>
-                                            </connections>
-                                        </textField>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="4xg-iR-B4f">
-                                            <rect key="frame" x="18" y="95" width="115" height="16"/>
-                                            <textFieldCell key="cell" lineBreakMode="clipping" title="External PAC URL:" id="kBe-eq-uZL">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="67s-wg-2Sy">
-                                            <rect key="frame" x="220" y="224" width="237" height="18"/>
-                                            <buttonCell key="cell" type="check" title="Local PAC Server Bind To Localhost" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="oCf-id-PAx">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                                <connections>
-                                                    <binding destination="uQz-5y-ZL2" name="value" keyPath="values.PacServer.BindToLocalhost" id="Yar-rA-DFY"/>
-                                                </connections>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.PacServer.BindToLocalhost" id="BDg-Bb-qTa"/>
-                                            </connections>
-                                        </button>
-                                    </subviews>
-                                    <constraints>
-                                        <constraint firstItem="RYj-h6-uAT" firstAttribute="leading" secondItem="MvY-R0-1FU" secondAttribute="leading" id="1aA-6v-Q8B"/>
-                                        <constraint firstItem="2rw-0u-LXJ" firstAttribute="trailing" secondItem="KXG-O0-ake" secondAttribute="trailing" id="2sM-Ud-zaK"/>
-                                        <constraint firstItem="Zfl-10-Wdk" firstAttribute="leading" secondItem="MvY-R0-1FU" secondAttribute="trailing" constant="8" symbolic="YES" id="72a-tV-4gM"/>
-                                        <constraint firstItem="r8z-mM-M0X" firstAttribute="leading" secondItem="RYj-h6-uAT" secondAttribute="leading" id="7dL-ac-PRT"/>
-                                        <constraint firstItem="67s-wg-2Sy" firstAttribute="top" secondItem="2rw-0u-LXJ" secondAttribute="bottom" constant="14" id="8FC-1g-GY6"/>
-                                        <constraint firstItem="r8z-mM-M0X" firstAttribute="baseline" secondItem="2rw-0u-LXJ" secondAttribute="baseline" id="Avs-sU-9rl"/>
-                                        <constraint firstItem="cd8-PU-OwG" firstAttribute="leading" secondItem="c8B-qf-UNK" secondAttribute="trailing" constant="8" symbolic="YES" id="BRO-xg-HnA"/>
-                                        <constraint firstItem="cd8-PU-OwG" firstAttribute="leading" secondItem="2rw-0u-LXJ" secondAttribute="leading" id="ByT-YT-4YP"/>
-                                        <constraint firstItem="kjx-TJ-4n3" firstAttribute="top" secondItem="RcT-mn-xqK" secondAttribute="bottom" constant="32" id="DhD-hY-Hei"/>
-                                        <constraint firstItem="tGd-pe-2xJ" firstAttribute="top" secondItem="Zfl-10-Wdk" secondAttribute="bottom" constant="8" symbolic="YES" id="ERy-Kz-wm9"/>
-                                        <constraint firstItem="c8B-qf-UNK" firstAttribute="leading" secondItem="Pc1-f7-0zA" secondAttribute="leading" constant="37" id="FC0-Uf-JHj"/>
-                                        <constraint firstAttribute="trailing" secondItem="a60-LH-adV" secondAttribute="trailing" constant="75" id="Gid-Dg-5o3"/>
-                                        <constraint firstItem="RcT-mn-xqK" firstAttribute="trailing" secondItem="kjx-TJ-4n3" secondAttribute="trailing" id="JIF-rX-Yva"/>
-                                        <constraint firstItem="c8B-qf-UNK" firstAttribute="baseline" secondItem="cd8-PU-OwG" secondAttribute="baseline" id="NZe-9h-P0V"/>
-                                        <constraint firstItem="Zfl-10-Wdk" firstAttribute="baseline" secondItem="a60-LH-adV" secondAttribute="baseline" id="PM4-3S-XXa"/>
-                                        <constraint firstItem="KXG-O0-ake" firstAttribute="leading" secondItem="Zfl-10-Wdk" secondAttribute="leading" id="S1b-KD-JDg"/>
-                                        <constraint firstItem="c8B-qf-UNK" firstAttribute="leading" secondItem="r8z-mM-M0X" secondAttribute="leading" id="VDu-iy-6vK"/>
-                                        <constraint firstItem="4xg-iR-B4f" firstAttribute="leading" secondItem="Pc1-f7-0zA" secondAttribute="leading" constant="20" symbolic="YES" id="VJI-th-aeN"/>
-                                        <constraint firstItem="RcT-mn-xqK" firstAttribute="top" secondItem="tGd-pe-2xJ" secondAttribute="bottom" constant="6" symbolic="YES" id="WlH-NJ-RUt"/>
-                                        <constraint firstItem="tGd-pe-2xJ" firstAttribute="leading" secondItem="RcT-mn-xqK" secondAttribute="leading" id="YLA-i2-7Fi"/>
-                                        <constraint firstItem="KXG-O0-ake" firstAttribute="top" secondItem="67s-wg-2Sy" secondAttribute="bottom" constant="13" id="ZIU-je-F0U"/>
-                                        <constraint firstItem="Zfl-10-Wdk" firstAttribute="top" secondItem="KXG-O0-ake" secondAttribute="bottom" constant="10" symbolic="YES" id="ahT-23-auY"/>
-                                        <constraint firstItem="4xg-iR-B4f" firstAttribute="leading" secondItem="kjx-TJ-4n3" secondAttribute="leading" id="aoH-EQ-rvn"/>
-                                        <constraint firstItem="a60-LH-adV" firstAttribute="leading" secondItem="Zfl-10-Wdk" secondAttribute="trailing" constant="8" symbolic="YES" id="bOO-HZ-pGJ"/>
-                                        <constraint firstItem="MvY-R0-1FU" firstAttribute="baseline" secondItem="Zfl-10-Wdk" secondAttribute="baseline" id="cTU-sU-Hbg"/>
-                                        <constraint firstItem="Zfl-10-Wdk" firstAttribute="leading" secondItem="tGd-pe-2xJ" secondAttribute="leading" id="fOM-N9-QWD"/>
-                                        <constraint firstItem="RYj-h6-uAT" firstAttribute="baseline" secondItem="KXG-O0-ake" secondAttribute="baseline" id="hAh-N6-Vph"/>
-                                        <constraint firstItem="67s-wg-2Sy" firstAttribute="leading" secondItem="KXG-O0-ake" secondAttribute="leading" id="isi-Hl-Asv"/>
-                                        <constraint firstItem="tGd-pe-2xJ" firstAttribute="trailing" secondItem="RcT-mn-xqK" secondAttribute="trailing" id="j1r-Q0-FKa"/>
-                                        <constraint firstItem="cd8-PU-OwG" firstAttribute="top" secondItem="Pc1-f7-0zA" secondAttribute="top" constant="20" symbolic="YES" id="l9o-ay-eyU"/>
-                                        <constraint firstItem="2rw-0u-LXJ" firstAttribute="top" secondItem="cd8-PU-OwG" secondAttribute="bottom" constant="10" symbolic="YES" id="n0x-Ms-zP0"/>
-                                        <constraint firstItem="kjx-TJ-4n3" firstAttribute="top" secondItem="4xg-iR-B4f" secondAttribute="bottom" constant="8" symbolic="YES" id="qo9-qW-tK8"/>
-                                        <constraint firstItem="2rw-0u-LXJ" firstAttribute="leading" secondItem="r8z-mM-M0X" secondAttribute="trailing" constant="8" symbolic="YES" id="rEO-dX-nm4"/>
-                                        <constraint firstItem="KXG-O0-ake" firstAttribute="trailing" secondItem="Zfl-10-Wdk" secondAttribute="trailing" id="usG-2D-Jps"/>
-                                        <constraint firstItem="2rw-0u-LXJ" firstAttribute="leading" secondItem="67s-wg-2Sy" secondAttribute="leading" id="vXT-hO-fLs"/>
-                                        <constraint firstAttribute="trailing" secondItem="cd8-PU-OwG" secondAttribute="trailing" constant="20" symbolic="YES" id="zrF-jX-3fl"/>
-                                    </constraints>
-                                </view>
-                            </tabViewItem>
-                            <tabViewItem label="HTTP" identifier="http" id="F5Q-Ce-JJN">
-                                <view key="view" id="kK3-29-KeI">
-                                    <rect key="frame" x="0.0" y="0.0" width="479" height="326"/>
-                                    <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                    <subviews>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="XI2-x3-9ie">
-                                            <rect key="frame" x="18" y="288" width="217" height="16"/>
-                                            <constraints>
-                                                <constraint firstAttribute="width" constant="213" id="pd4-On-JhI"/>
-                                            </constraints>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="HTTP Proxy Listen Address:" id="6W4-TY-Bw5">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="URa-Z3-BgW">
-                                            <rect key="frame" x="18" y="257" width="217" height="16"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="HTTP Proxy Listen Port:" id="Ww9-j9-WYR">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="A8G-1x-YxA">
-                                            <rect key="frame" x="247" y="285" width="213" height="21"/>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" drawsBackground="YES" id="p6k-oG-17u">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.LocalHTTP.ListenAddress" id="OWW-xe-Axa">
-                                                    <dictionary key="options">
-                                                        <bool key="NSContinuouslyUpdatesValue" value="YES"/>
-                                                    </dictionary>
-                                                </binding>
-                                            </connections>
-                                        </textField>
-                                        <textField verticalHuggingPriority="750" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="OoG-C4-oji">
-                                            <rect key="frame" x="247" y="254" width="70" height="21"/>
-                                            <constraints>
-                                                <constraint firstAttribute="width" constant="70" id="xcK-p4-AFO"/>
-                                            </constraints>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" alignment="right" drawsBackground="YES" id="0bX-LS-7QW">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.LocalHTTP.ListenPort" id="ehW-40-ivo">
-                                                    <dictionary key="options">
-                                                        <bool key="NSContinuouslyUpdatesValue" value="YES"/>
-                                                    </dictionary>
-                                                </binding>
-                                                <outlet property="formatter" destination="C7t-aU-bub" id="I35-3e-hTk"/>
-                                            </connections>
-                                        </textField>
-                                        <button translatesAutoresizingMaskIntoConstraints="NO" id="xWf-Bw-9V9">
-                                            <rect key="frame" x="30" y="220" width="138" height="18"/>
-                                            <buttonCell key="cell" type="check" title="HTTP Proxy Enable" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="jr6-x7-WJD">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.LocalHTTPOn" id="Be3-2x-hs4"/>
-                                            </connections>
-                                        </button>
-                                        <button translatesAutoresizingMaskIntoConstraints="NO" id="Ee3-wg-WSi">
-                                            <rect key="frame" x="30" y="186" width="371" height="18"/>
-                                            <buttonCell key="cell" type="check" title="Set HTTP proxy to system proxy configure in global mode" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="m8L-D6-ye3">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.LocalHTTP.FollowGlobal" id="J5j-AM-zeV"/>
-                                            </connections>
-                                        </button>
-                                    </subviews>
-                                    <constraints>
-                                        <constraint firstItem="URa-Z3-BgW" firstAttribute="baseline" secondItem="OoG-C4-oji" secondAttribute="baseline" id="Aj1-X9-AaX"/>
-                                        <constraint firstItem="xWf-Bw-9V9" firstAttribute="leading" secondItem="Ee3-wg-WSi" secondAttribute="leading" id="D5c-Hf-hbn"/>
-                                        <constraint firstItem="XI2-x3-9ie" firstAttribute="baseline" secondItem="A8G-1x-YxA" secondAttribute="baseline" id="GBh-Wy-StZ"/>
-                                        <constraint firstItem="Ee3-wg-WSi" firstAttribute="top" secondItem="xWf-Bw-9V9" secondAttribute="bottom" constant="20" id="MRV-c0-DsH"/>
-                                        <constraint firstItem="XI2-x3-9ie" firstAttribute="trailing" secondItem="URa-Z3-BgW" secondAttribute="trailing" id="Ndh-r0-5BA"/>
-                                        <constraint firstAttribute="trailing" secondItem="A8G-1x-YxA" secondAttribute="trailing" constant="19" id="P7w-PO-lyw"/>
-                                        <constraint firstItem="A8G-1x-YxA" firstAttribute="leading" secondItem="OoG-C4-oji" secondAttribute="leading" id="R8T-f7-dn2"/>
-                                        <constraint firstItem="A8G-1x-YxA" firstAttribute="top" secondItem="kK3-29-KeI" secondAttribute="top" constant="20" symbolic="YES" id="aXD-oD-GcI"/>
-                                        <constraint firstItem="A8G-1x-YxA" firstAttribute="leading" secondItem="XI2-x3-9ie" secondAttribute="trailing" constant="14" id="c1Q-No-GbX"/>
-                                        <constraint firstItem="OoG-C4-oji" firstAttribute="top" secondItem="A8G-1x-YxA" secondAttribute="bottom" constant="10" symbolic="YES" id="g7t-rt-dUV"/>
-                                        <constraint firstItem="XI2-x3-9ie" firstAttribute="leading" secondItem="URa-Z3-BgW" secondAttribute="leading" id="mZ6-ha-7XJ"/>
-                                        <constraint firstItem="xWf-Bw-9V9" firstAttribute="leading" secondItem="kK3-29-KeI" secondAttribute="leading" constant="32" id="nh8-k4-cWC"/>
-                                        <constraint firstItem="XI2-x3-9ie" firstAttribute="leading" secondItem="kK3-29-KeI" secondAttribute="leading" constant="20" symbolic="YES" id="wbx-Xy-yfh"/>
-                                        <constraint firstItem="xWf-Bw-9V9" firstAttribute="top" secondItem="URa-Z3-BgW" secondAttribute="bottom" constant="21" id="ysE-Xx-EKD"/>
-                                    </constraints>
-                                </view>
-                            </tabViewItem>
-                            <tabViewItem label="Interfaces" identifier="interfaces" id="eDR-CZ-P4p">
-                                <view key="view" misplaced="YES" id="Ati-LQ-RB7">
-                                    <rect key="frame" x="0.0" y="0.0" width="479" height="326"/>
-                                    <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                    <subviews>
-                                        <button translatesAutoresizingMaskIntoConstraints="NO" id="x9X-2w-cOy">
-                                            <rect key="frame" x="18" y="241" width="114" height="18"/>
-                                            <buttonCell key="cell" type="check" title="Auto Configure" bezelStyle="regularSquare" imagePosition="left" state="on" inset="2" id="bu3-s5-bYM">
-                                                <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.AutoConfigureNetworkServices" id="lqW-ja-MOj"/>
-                                            </connections>
-                                        </button>
-                                        <scrollView autohidesScrollers="YES" horizontalLineScroll="19" horizontalPageScroll="10" verticalLineScroll="19" verticalPageScroll="10" usesPredominantAxisScrolling="NO" translatesAutoresizingMaskIntoConstraints="NO" id="dGc-zC-AYJ">
-                                            <rect key="frame" x="20" y="111" width="440" height="119"/>
-                                            <clipView key="contentView" id="9Wy-0J-wQ8">
-                                                <rect key="frame" x="1" y="1" width="438" height="117"/>
-                                                <autoresizingMask key="autoresizingMask"/>
-                                                <subviews>
-                                                    <tableView verticalHuggingPriority="750" allowsExpansionToolTips="YES" columnAutoresizingStyle="lastColumnOnly" columnSelection="YES" multipleSelection="NO" autosaveColumns="NO" id="Vp3-dp-iqv">
-                                                        <rect key="frame" x="0.0" y="0.0" width="438" height="117"/>
-                                                        <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                                        <size key="intercellSpacing" width="3" height="2"/>
-                                                        <color key="backgroundColor" name="controlBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                                        <color key="gridColor" name="gridColor" catalog="System" colorSpace="catalog"/>
-                                                        <tableColumns>
-                                                            <tableColumn width="435" minWidth="40" maxWidth="1000" id="4CL-dk-HUu">
-                                                                <tableHeaderCell key="headerCell" lineBreakMode="truncatingTail" borderStyle="border">
-                                                                    <font key="font" metaFont="menu" size="11"/>
-                                                                    <color key="textColor" name="headerTextColor" catalog="System" colorSpace="catalog"/>
-                                                                    <color key="backgroundColor" name="headerColor" catalog="System" colorSpace="catalog"/>
-                                                                </tableHeaderCell>
-                                                                <buttonCell key="dataCell" type="check" title="Check" bezelStyle="regularSquare" imagePosition="left" inset="2" id="8Ku-VV-ZaY">
-                                                                    <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                                                                    <font key="font" metaFont="system"/>
-                                                                </buttonCell>
-                                                                <tableColumnResizingMask key="resizingMask" resizeWithTable="YES" userResizable="YES"/>
-                                                            </tableColumn>
-                                                        </tableColumns>
-                                                        <connections>
-                                                            <binding destination="uQz-5y-ZL2" name="enabled" keyPath="values.AutoConfigureNetworkServices" id="h72-DX-clT">
-                                                                <dictionary key="options">
-                                                                    <string key="NSValueTransformerName">NSNegateBoolean</string>
-                                                                </dictionary>
-                                                            </binding>
-                                                            <outlet property="dataSource" destination="2Fn-b8-1pQ" id="Ri8-L6-adR"/>
-                                                            <outlet property="delegate" destination="2Fn-b8-1pQ" id="w7K-z3-I2P"/>
-                                                        </connections>
-                                                    </tableView>
-                                                </subviews>
-                                            </clipView>
-                                            <scroller key="horizontalScroller" hidden="YES" wantsLayer="YES" verticalHuggingPriority="750" horizontal="YES" id="FHm-ib-d94">
-                                                <rect key="frame" x="-7" y="-14" width="0.0" height="15"/>
-                                                <autoresizingMask key="autoresizingMask"/>
-                                            </scroller>
-                                            <scroller key="verticalScroller" hidden="YES" wantsLayer="YES" verticalHuggingPriority="750" horizontal="NO" id="sEE-Wn-Fcs">
-                                                <rect key="frame" x="94" y="1" width="15" height="0.0"/>
-                                                <autoresizingMask key="autoresizingMask"/>
-                                            </scroller>
-                                        </scrollView>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="fMc-SG-EDy">
-                                            <rect key="frame" x="18" y="265" width="444" height="41"/>
-                                            <constraints>
-                                                <constraint firstAttribute="height" constant="41" id="8Tc-8R-1jj"/>
-                                            </constraints>
-                                            <textFieldCell key="cell" sendsActionOnEndEditing="YES" title="Which network interfaces proxy setting would be controlled by ShadowsocksX-NG" id="t0I-6n-gnu">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="1lH-rX-WZT">
-                                            <rect key="frame" x="18" y="78" width="373" height="16"/>
-                                            <constraints>
-                                                <constraint firstAttribute="width" constant="369" id="uWk-mY-ajK"/>
-                                            </constraints>
-                                            <textFieldCell key="cell" sendsActionOnEndEditing="YES" title="Bypass proxy settings for these Hosts &amp; Domains:" id="v4F-L4-s8U">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                        </textField>
-                                        <textField verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="N84-AY-ecA">
-                                            <rect key="frame" x="20" y="20" width="440" height="45"/>
-                                            <constraints>
-                                                <constraint firstAttribute="height" constant="45" id="R7N-ad-q8p"/>
-                                            </constraints>
-                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" drawsBackground="YES" id="g2Z-r8-ipF">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <connections>
-                                                <binding destination="uQz-5y-ZL2" name="value" keyPath="values.ProxyExceptions" id="Cjp-zo-o6K">
-                                                    <dictionary key="options">
-                                                        <bool key="NSContinuouslyUpdatesValue" value="YES"/>
-                                                    </dictionary>
-                                                </binding>
-                                            </connections>
-                                        </textField>
-                                        <button horizontalHuggingPriority="750" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="qG0-rB-6MR">
-                                            <rect key="frame" x="391" y="68" width="75" height="32"/>
-                                            <buttonCell key="cell" type="push" title="Reset" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="Afd-bH-wOk">
-                                                <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                                                <font key="font" metaFont="system"/>
-                                            </buttonCell>
-                                            <connections>
-                                                <action selector="resetProxyExceptionsWithSender:" target="-2" id="cUx-aD-yJN"/>
-                                            </connections>
-                                        </button>
-                                    </subviews>
-                                    <constraints>
-                                        <constraint firstItem="dGc-zC-AYJ" firstAttribute="top" secondItem="x9X-2w-cOy" secondAttribute="bottom" constant="13" id="5jW-Mo-Pc5"/>
-                                        <constraint firstItem="x9X-2w-cOy" firstAttribute="leading" secondItem="dGc-zC-AYJ" secondAttribute="leading" id="7eE-eY-Whe"/>
-                                        <constraint firstItem="dGc-zC-AYJ" firstAttribute="leading" secondItem="1lH-rX-WZT" secondAttribute="leading" id="DH7-r8-mwZ"/>
-                                        <constraint firstItem="1lH-rX-WZT" firstAttribute="leading" secondItem="N84-AY-ecA" secondAttribute="leading" id="GgB-L7-cW8"/>
-                                        <constraint firstItem="fMc-SG-EDy" firstAttribute="leading" secondItem="x9X-2w-cOy" secondAttribute="leading" id="HtT-3a-mit"/>
-                                        <constraint firstItem="dGc-zC-AYJ" firstAttribute="trailing" secondItem="qG0-rB-6MR" secondAttribute="trailing" id="Hvf-rM-FRI"/>
-                                        <constraint firstItem="qG0-rB-6MR" firstAttribute="trailing" secondItem="N84-AY-ecA" secondAttribute="trailing" id="Q6X-Sp-lFi"/>
-                                        <constraint firstItem="qG0-rB-6MR" firstAttribute="leading" secondItem="1lH-rX-WZT" secondAttribute="trailing" constant="8" symbolic="YES" id="c5y-iA-dyS"/>
-                                        <constraint firstItem="fMc-SG-EDy" firstAttribute="leading" secondItem="Ati-LQ-RB7" secondAttribute="leading" constant="20" symbolic="YES" id="doB-b9-Gri"/>
-                                        <constraint firstAttribute="bottom" secondItem="N84-AY-ecA" secondAttribute="bottom" constant="20" symbolic="YES" id="eWN-hg-7YJ"/>
-                                        <constraint firstItem="qG0-rB-6MR" firstAttribute="top" secondItem="dGc-zC-AYJ" secondAttribute="bottom" constant="15" id="hpv-9Y-g7G"/>
-                                        <constraint firstItem="fMc-SG-EDy" firstAttribute="trailing" secondItem="dGc-zC-AYJ" secondAttribute="trailing" id="ikc-gG-3MB"/>
-                                        <constraint firstItem="N84-AY-ecA" firstAttribute="top" secondItem="qG0-rB-6MR" secondAttribute="bottom" constant="10" id="jDx-Uy-AhQ"/>
-                                        <constraint firstItem="fMc-SG-EDy" firstAttribute="top" secondItem="Ati-LQ-RB7" secondAttribute="top" constant="20" symbolic="YES" id="kY4-8C-LzC"/>
-                                        <constraint firstItem="x9X-2w-cOy" firstAttribute="top" secondItem="fMc-SG-EDy" secondAttribute="bottom" constant="8" symbolic="YES" id="luD-Zw-Bag"/>
-                                        <constraint firstItem="fMc-SG-EDy" firstAttribute="centerX" secondItem="Ati-LQ-RB7" secondAttribute="centerX" id="qiF-jK-5Jt"/>
-                                        <constraint firstItem="1lH-rX-WZT" firstAttribute="baseline" secondItem="qG0-rB-6MR" secondAttribute="baseline" id="rtB-T6-I3K"/>
-                                    </constraints>
-                                </view>
-                            </tabViewItem>
-                        </tabViewItems>
-                    </tabView>
-                </subviews>
-                <constraints>
-                    <constraint firstItem="h22-uy-K1x" firstAttribute="leading" secondItem="se5-gp-TjO" secondAttribute="leading" id="HCv-ZJ-Q2c"/>
-                    <constraint firstAttribute="trailing" secondItem="h22-uy-K1x" secondAttribute="trailing" id="MeG-fb-l06"/>
-                    <constraint firstAttribute="bottom" secondItem="h22-uy-K1x" secondAttribute="bottom" id="XlW-sY-ILc"/>
-                    <constraint firstItem="h22-uy-K1x" firstAttribute="top" secondItem="se5-gp-TjO" secondAttribute="top" id="Yrg-VE-f0G"/>
-                </constraints>
-            </view>
-            <toolbar key="toolbar" implicitIdentifier="8C4EF182-55FF-4325-A88F-2B007115CF4C" autosavesConfiguration="NO" allowsUserCustomization="NO" displayMode="iconAndLabel" sizeMode="regular" id="D9u-IW-4jN">
-                <allowedToolbarItems>
-                    <toolbarItem implicitItemIdentifier="0F065718-7F7B-4558-84B0-7A74B8F8AF88" explicitItemIdentifier="general" label="General" paletteLabel="General" tag="-1" image="NSPreferencesGeneral" selectable="YES" id="Mp8-cF-kQ7">
-                        <connections>
-                            <action selector="toolbarActionWithSender:" target="-2" id="dFv-Bx-jbl"/>
-                        </connections>
-                    </toolbarItem>
-                    <toolbarItem implicitItemIdentifier="NSToolbarSpaceItem" id="hn4-gj-wF1"/>
-                    <toolbarItem implicitItemIdentifier="NSToolbarFlexibleSpaceItem" id="hy4-IW-j13"/>
-                    <toolbarItem implicitItemIdentifier="20667A16-FBAB-459E-9094-87ABC9B66795" explicitItemIdentifier="adv" label="Advanced" paletteLabel="Advanced" tag="-1" image="NSAdvanced" selectable="YES" id="kuN-wm-bl5">
-                        <connections>
-                            <action selector="toolbarActionWithSender:" target="-2" id="W2m-K9-R3F"/>
-                        </connections>
-                    </toolbarItem>
-                    <toolbarItem implicitItemIdentifier="6CA73D5D-9BB2-495A-8658-D0A96900A764" explicitItemIdentifier="http" label="HTTP" paletteLabel="HTTP" tag="-1" image="http" selectable="YES" id="D0F-6S-Ztu">
-                        <connections>
-                            <action selector="toolbarActionWithSender:" target="-2" id="tnS-2P-ws4"/>
-                        </connections>
-                    </toolbarItem>
-                    <toolbarItem implicitItemIdentifier="E4909835-8791-41EE-919B-0DC2AECD6F26" explicitItemIdentifier="interfaces" label="Interfaces" paletteLabel="Interfaces" tag="-1" image="NSNetwork" selectable="YES" id="Bdm-pj-Ckd">
-                        <connections>
-                            <action selector="toolbarActionWithSender:" target="-2" id="X6O-F1-Axw"/>
-                        </connections>
-                    </toolbarItem>
-                </allowedToolbarItems>
-                <defaultToolbarItems>
-                    <toolbarItem reference="Mp8-cF-kQ7"/>
-                    <toolbarItem reference="kuN-wm-bl5"/>
-                    <toolbarItem reference="D0F-6S-Ztu"/>
-                    <toolbarItem reference="Bdm-pj-Ckd"/>
-                    <toolbarItem reference="hy4-IW-j13"/>
-                </defaultToolbarItems>
-            </toolbar>
-            <connections>
-                <outlet property="delegate" destination="-2" id="0bl-1N-AYu"/>
-            </connections>
-            <point key="canvasLocation" x="141" y="146"/>
-        </window>
-        <userDefaultsController representsSharedInstance="YES" id="uQz-5y-ZL2"/>
-        <customFormatter id="TUK-vL-Gf1" userLabel="PAC URL Formatter" customClass="PACURLFormatter" customModule="ShadowsocksX_NG" customModuleProvider="target"/>
-        <numberFormatter formatterBehavior="default10_4" usesGroupingSeparator="NO" groupingSize="0" minimumIntegerDigits="0" maximumIntegerDigits="42" id="C7t-aU-bub" userLabel="Port Number Formatter">
-            <real key="minimum" value="128"/>
-            <real key="maximum" value="65535"/>
-        </numberFormatter>
-        <numberFormatter formatterBehavior="default10_4" usesGroupingSeparator="NO" groupingSize="0" minimumIntegerDigits="0" maximumIntegerDigits="42" id="2LX-ic-DJh" userLabel="Timeout Number Formatter">
-            <real key="minimum" value="10"/>
-            <real key="maximum" value="600"/>
-        </numberFormatter>
-        <numberFormatter formatterBehavior="default10_4" usesGroupingSeparator="NO" groupingSize="0" minimumIntegerDigits="0" maximumIntegerDigits="42" id="1En-Ey-GAr" userLabel="Num of Kcptun Conn Formatter">
-            <real key="minimum" value="1"/>
-            <real key="maximum" value="16"/>
-        </numberFormatter>
-        <customObject id="YAC-3k-qMR" customClass="LaunchAtLoginController"/>
-        <customObject id="2Fn-b8-1pQ" customClass="ProxyInterfacesViewCtrl" customModule="ShadowsocksX_NG" customModuleProvider="target">
-            <connections>
-                <outlet property="tableView" destination="Vp3-dp-iqv" id="e8T-To-sCx"/>
-                <outlet property="view" destination="Ati-LQ-RB7" id="KcW-Hq-Jmh"/>
-            </connections>
-        </customObject>
-    </objects>
-    <resources>
-        <image name="NSAdvanced" width="32" height="32"/>
-        <image name="NSNetwork" width="32" height="32"/>
-        <image name="NSPreferencesGeneral" width="32" height="32"/>
-        <image name="http" width="512" height="512"/>
-    </resources>
-</document>
diff --git a/ShadowsocksX-NG/Base.lproj/PreferencesWindowController.xib b/ShadowsocksX-NG/Base.lproj/PreferencesWindowController.xib
deleted file mode 100644
index 7e48444d6..000000000
--- a/ShadowsocksX-NG/Base.lproj/PreferencesWindowController.xib
+++ /dev/null
@@ -1,402 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="15400" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
-    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="15400"/>
-        <capability name="System colors introduced in macOS 10.14" minToolsVersion="10.0"/>
-        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="PreferencesWindowController" customModule="ShadowsocksX_NG" customModuleProvider="target">
-            <connections>
-                <outlet property="hostTextField" destination="R4F-j7-GkK" id="a1I-WO-Qdj"/>
-                <outlet property="methodTextField" destination="ef4-8J-eFn" id="OXd-fC-ICR"/>
-                <outlet property="passwordSecureTextField" destination="ZXA-oi-Zv3" id="ZMF-s4-w53"/>
-                <outlet property="passwordTabView" destination="DHz-Hx-kZ5" id="8W3-H3-Ezq"/>
-                <outlet property="passwordTextField" destination="3Ad-X4-DBi" id="FHf-t3-D8t"/>
-                <outlet property="pluginOptionsTextField" destination="5eh-s9-YH8" id="k4c-c6-OIq"/>
-                <outlet property="pluginTextField" destination="0PP-Ng-z0v" id="Dif-aD-nRE"/>
-                <outlet property="portTextField" destination="lng-AE-g0J" id="7b1-ox-WSL"/>
-                <outlet property="profileBox" destination="oZ5-85-pwY" id="D19-PQ-X7E"/>
-                <outlet property="profilesTableView" destination="r91-ho-Lum" id="TNk-f6-Vgo"/>
-                <outlet property="remarkTextField" destination="q3C-S0-iNn" id="DSv-lV-PX7"/>
-                <outlet property="removeButton" destination="3ei-2f-kHB" id="DdP-dA-coT"/>
-                <outlet property="togglePasswordVisibleButton" destination="jDI-cn-wYa" id="wc1-ra-kya"/>
-                <outlet property="window" destination="F0z-JX-Cv5" id="gIp-Ho-8D9"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Server Preferences" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" restorable="NO" animationBehavior="default" id="F0z-JX-Cv5">
-            <windowStyleMask key="styleMask" titled="YES" closable="YES"/>
-            <windowPositionMask key="initialPositionMask" topStrut="YES" bottomStrut="YES"/>
-            <rect key="contentRect" x="423" y="484" width="557" height="354"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1680" height="1027"/>
-            <view key="contentView" id="se5-gp-TjO">
-                <rect key="frame" x="0.0" y="0.0" width="557" height="354"/>
-                <autoresizingMask key="autoresizingMask"/>
-                <subviews>
-                    <scrollView focusRingType="none" fixedFrame="YES" autohidesScrollers="YES" horizontalLineScroll="19" horizontalPageScroll="10" verticalLineScroll="19" verticalPageScroll="10" usesPredominantAxisScrolling="NO" translatesAutoresizingMaskIntoConstraints="NO" id="u4U-Ju-FJV">
-                        <rect key="frame" x="20" y="79" width="200" height="255"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <clipView key="contentView" focusRingType="none" ambiguous="YES" id="1oC-7s-16v">
-                            <rect key="frame" x="1" y="1" width="198" height="253"/>
-                            <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                            <subviews>
-                                <tableView focusRingType="none" verticalHuggingPriority="750" ambiguous="YES" allowsExpansionToolTips="YES" columnAutoresizingStyle="lastColumnOnly" columnReordering="NO" columnSelection="YES" multipleSelection="NO" emptySelection="NO" autosaveColumns="NO" id="r91-ho-Lum">
-                                    <rect key="frame" x="0.0" y="0.0" width="198" height="253"/>
-                                    <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                    <size key="intercellSpacing" width="3" height="2"/>
-                                    <color key="backgroundColor" name="controlBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                    <color key="gridColor" name="gridColor" catalog="System" colorSpace="catalog"/>
-                                    <tableColumns>
-                                        <tableColumn identifier="status" width="20" minWidth="10" maxWidth="3.4028234663852886e+38" id="wR0-vc-Gtr">
-                                            <tableHeaderCell key="headerCell" lineBreakMode="truncatingTail" borderStyle="border" alignment="left">
-                                                <font key="font" metaFont="message" size="11"/>
-                                                <color key="textColor" name="headerTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" white="0.0" alpha="0.0" colorSpace="calibratedWhite"/>
-                                            </tableHeaderCell>
-                                            <imageCell key="dataCell" refusesFirstResponder="YES" alignment="left" identifier="status" imageScaling="proportionallyDown" id="aBb-XB-tD7"/>
-                                            <tableColumnResizingMask key="resizingMask" resizeWithTable="YES" userResizable="YES"/>
-                                        </tableColumn>
-                                        <tableColumn identifier="main" width="135" minWidth="40" maxWidth="1000" id="6gc-9b-Qnw">
-                                            <tableHeaderCell key="headerCell" lineBreakMode="truncatingTail" borderStyle="border">
-                                                <font key="font" metaFont="message" size="11"/>
-                                                <color key="textColor" name="headerTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="headerColor" catalog="System" colorSpace="catalog"/>
-                                            </tableHeaderCell>
-                                            <textFieldCell key="dataCell" lineBreakMode="truncatingTail" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" identifier="main" title="Text" id="COZ-Qr-bmU">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <tableColumnResizingMask key="resizingMask" resizeWithTable="YES" userResizable="YES"/>
-                                        </tableColumn>
-                                    </tableColumns>
-                                    <connections>
-                                        <outlet property="dataSource" destination="-2" id="fz3-X6-PbB"/>
-                                        <outlet property="delegate" destination="-2" id="6zR-v1-wZj"/>
-                                        <outlet property="menu" destination="QmU-th-vjP" id="J0d-c9-pYs"/>
-                                    </connections>
-                                </tableView>
-                            </subviews>
-                        </clipView>
-                        <scroller key="horizontalScroller" hidden="YES" wantsLayer="YES" verticalHuggingPriority="750" horizontal="YES" id="jTp-ja-h3t">
-                            <rect key="frame" x="1" y="-15" width="0.0" height="16"/>
-                            <autoresizingMask key="autoresizingMask"/>
-                        </scroller>
-                        <scroller key="verticalScroller" hidden="YES" wantsLayer="YES" verticalHuggingPriority="750" horizontal="NO" id="dLS-Vz-L6A">
-                            <rect key="frame" x="-15" y="1" width="16" height="0.0"/>
-                            <autoresizingMask key="autoresizingMask"/>
-                        </scroller>
-                    </scrollView>
-                    <box fixedFrame="YES" boxType="custom" borderType="none" titlePosition="noTitle" translatesAutoresizingMaskIntoConstraints="NO" id="oZ5-85-pwY">
-                        <rect key="frame" x="240" y="61" width="297" height="273"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <view key="contentView" ambiguous="YES" id="a3z-VL-3xV">
-                            <rect key="frame" x="0.0" y="0.0" width="297" height="273"/>
-                            <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                            <subviews>
-                                <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="HPg-NP-kjP">
-                                    <rect key="frame" x="44" y="245" width="58" height="16"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Address:" id="yHs-XE-XEB">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <comboBox verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="ef4-8J-eFn">
-                                    <rect key="frame" x="108" y="180" width="164" height="25"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <comboBoxCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" borderStyle="bezel" drawsBackground="YES" completes="NO" numberOfVisibleItems="11" id="5Qb-ey-uS5">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                    </comboBoxCell>
-                                </comboBox>
-                                <textField verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="q3C-S0-iNn">
-                                    <rect key="frame" x="108" y="29" width="161" height="21"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" drawsBackground="YES" id="oxu-qq-MGC">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <textField verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="5eh-s9-YH8">
-                                    <rect key="frame" x="108" y="60" width="161" height="21"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" drawsBackground="YES" id="dtO-2M-4yX">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <textField verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="0PP-Ng-z0v">
-                                    <rect key="frame" x="108" y="124" width="129" height="21"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" drawsBackground="YES" id="IGs-KE-ySP">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="DGz-Sq-t0c">
-                                    <rect key="frame" x="56" y="127" width="46" height="16"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Plugin:" id="gDt-yZ-Mqs">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <textField verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="R4F-j7-GkK">
-                                    <rect key="frame" x="108" y="242" width="161" height="21"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" placeholderString="IP" drawsBackground="YES" id="MWO-hQ-nMt">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <tabView focusRingType="none" fixedFrame="YES" drawsBackground="NO" type="noTabsNoBorder" initialItem="aRD-sh-uEl" translatesAutoresizingMaskIntoConstraints="NO" id="DHz-Hx-kZ5">
-                                    <rect key="frame" x="108" y="153" width="129" height="21"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <font key="font" metaFont="system"/>
-                                    <tabViewItems>
-                                        <tabViewItem label="Secure" identifier="secure" id="aRD-sh-uEl">
-                                            <view key="view" ambiguous="YES" id="rXs-ye-nly">
-                                                <rect key="frame" x="0.0" y="0.0" width="129" height="21"/>
-                                                <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                                <subviews>
-                                                    <secureTextField verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="ZXA-oi-Zv3">
-                                                        <rect key="frame" x="0.0" y="0.0" width="129" height="21"/>
-                                                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                                        <secureTextFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" borderStyle="bezel" drawsBackground="YES" usesSingleLineMode="YES" id="zuN-Jd-LeS">
-                                                            <font key="font" metaFont="system"/>
-                                                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                                            <allowedInputSourceLocales>
-                                                                <string>NSAllRomanInputSourcesLocaleIdentifier</string>
-                                                            </allowedInputSourceLocales>
-                                                        </secureTextFieldCell>
-                                                    </secureTextField>
-                                                </subviews>
-                                            </view>
-                                        </tabViewItem>
-                                        <tabViewItem label="Insecure" identifier="insecure" id="SYv-Tn-tur">
-                                            <view key="view" id="Z6k-mP-BgX">
-                                                <rect key="frame" x="0.0" y="0.0" width="129" height="21"/>
-                                                <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                                <subviews>
-                                                    <textField verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="3Ad-X4-DBi">
-                                                        <rect key="frame" x="0.0" y="0.0" width="129" height="21"/>
-                                                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" drawsBackground="YES" id="DNt-0X-3Z0">
-                                                            <font key="font" metaFont="system"/>
-                                                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                                        </textFieldCell>
-                                                    </textField>
-                                                </subviews>
-                                            </view>
-                                        </tabViewItem>
-                                    </tabViewItems>
-                                </tabView>
-                                <button verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="jDI-cn-wYa">
-                                    <rect key="frame" x="244" y="151" width="26" height="26"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <buttonCell key="cell" type="squareTextured" bezelStyle="texturedSquare" image="icons8-Blind Filled-50" imagePosition="only" alignment="center" lineBreakMode="truncatingTail" state="on" borderStyle="border" imageScaling="axesIndependently" inset="2" id="8Bw-DM-zYg">
-                                        <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                                        <font key="font" metaFont="system"/>
-                                    </buttonCell>
-                                    <connections>
-                                        <action selector="togglePasswordVisible:" target="-2" id="3kh-Pz-mr0"/>
-                                    </connections>
-                                </button>
-                                <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="Kft-TG-O5S">
-                                    <rect key="frame" x="28" y="186" width="74" height="16"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Encryption:" id="mOh-nD-7EX">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <button verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="jch-rI-Swc">
-                                    <rect key="frame" x="232" y="120" width="50" height="25"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <buttonCell key="cell" type="help" bezelStyle="helpButton" imagePosition="left" borderStyle="border" inset="2" id="IF1-Fy-5la">
-                                        <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                                        <font key="font" metaFont="system"/>
-                                    </buttonCell>
-                                    <connections>
-                                        <action selector="openPluginHelp:" target="-2" id="ZjN-36-KgP"/>
-                                    </connections>
-                                </button>
-                                <button verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="ApG-51-Uva">
-                                    <rect key="frame" x="102" y="82" width="173" height="38"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <buttonCell key="cell" type="push" title="Open Plugins Folder..." bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="T8q-g1-qjN">
-                                        <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                                        <font key="font" metaFont="system"/>
-                                    </buttonCell>
-                                    <connections>
-                                        <action selector="openPluginFolder:" target="-2" id="eyc-L3-7US"/>
-                                    </connections>
-                                </button>
-                                <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="4LD-CD-u7b">
-                                    <rect key="frame" x="24" y="63" width="78" height="16"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Plugin Opts:" id="orT-7j-dxE">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="Opl-x8-XTI">
-                                    <rect key="frame" x="68" y="214" width="34" height="16"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Port:" id="fRO-Pq-XeJ">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <textField verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="lng-AE-g0J">
-                                    <rect key="frame" x="108" y="211" width="50" height="21"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" sendsActionOnEndEditing="YES" state="on" borderStyle="bezel" placeholderString="Port" drawsBackground="YES" id="e1F-jd-e0J">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                        <allowedInputSourceLocales>
-                                            <string>NSAllRomanInputSourcesLocaleIdentifier</string>
-                                        </allowedInputSourceLocales>
-                                    </textFieldCell>
-                                    <connections>
-                                        <outlet property="formatter" destination="QZc-kt-D7Z" id="ZB9-Of-Xi9"/>
-                                    </connections>
-                                </textField>
-                                <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="Qfe-Ql-iCO">
-                                    <rect key="frame" x="36" y="156" width="66" height="16"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Password:" id="kil-xC-HPD">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                                <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="YES" translatesAutoresizingMaskIntoConstraints="NO" id="Baj-Yh-kmj">
-                                    <rect key="frame" x="41" y="31" width="61" height="17"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Remarks:" id="MiN-VE-FtC">
-                                        <font key="font" metaFont="system"/>
-                                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                        <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                    </textFieldCell>
-                                </textField>
-                            </subviews>
-                        </view>
-                        <color key="fillColor" name="controlBackgroundColor" catalog="System" colorSpace="catalog"/>
-                    </box>
-                    <button verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="yyD-qq-aSk">
-                        <rect key="frame" x="462" y="13" width="81" height="32"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <buttonCell key="cell" type="push" title="OK" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="zPE-oD-PwK">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                            <string key="keyEquivalent" base64-UTF8="YES">
-DQ
-</string>
-                        </buttonCell>
-                        <connections>
-                            <action selector="ok:" target="-2" id="ifI-e4-Htf"/>
-                        </connections>
-                    </button>
-                    <button verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kGm-Zm-ipY">
-                        <rect key="frame" x="381" y="13" width="81" height="32"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <buttonCell key="cell" type="push" title="Cancel" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="j03-9E-uHW">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                            <string key="keyEquivalent" base64-UTF8="YES">
-Gw
-</string>
-                        </buttonCell>
-                        <connections>
-                            <action selector="cancel:" target="-2" id="514-4D-a6S"/>
-                        </connections>
-                    </button>
-                    <box fixedFrame="YES" boxType="custom" borderType="none" title="Box" titlePosition="noTitle" translatesAutoresizingMaskIntoConstraints="NO" id="Gqv-5O-Wwf">
-                        <rect key="frame" x="20" y="61" width="200" height="18"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <view key="contentView" ambiguous="YES" id="MbP-FS-YEs">
-                            <rect key="frame" x="0.0" y="0.0" width="200" height="18"/>
-                            <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                            <subviews>
-                                <button verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="4ig-lF-m2R">
-                                    <rect key="frame" x="0.0" y="-1" width="22" height="20"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <buttonCell key="cell" type="smallSquare" bezelStyle="smallSquare" image="NSAddTemplate" imagePosition="overlaps" alignment="center" lineBreakMode="truncatingTail" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="VkE-bG-mJb">
-                                        <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                                        <font key="font" metaFont="system"/>
-                                    </buttonCell>
-                                    <connections>
-                                        <action selector="addProfile:" target="-2" id="NEh-IP-KO8"/>
-                                    </connections>
-                                </button>
-                                <button verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="3ei-2f-kHB">
-                                    <rect key="frame" x="20" y="-1" width="22" height="20"/>
-                                    <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                                    <buttonCell key="cell" type="smallSquare" bezelStyle="smallSquare" image="NSRemoveTemplate" imagePosition="overlaps" alignment="center" lineBreakMode="truncatingTail" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="Nu6-Aw-ihE">
-                                        <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                                        <font key="font" metaFont="system"/>
-                                    </buttonCell>
-                                    <connections>
-                                        <action selector="removeProfile:" target="-2" id="CJC-GL-qeS"/>
-                                    </connections>
-                                </button>
-                            </subviews>
-                        </view>
-                        <color key="fillColor" name="alternatingContentBackgroundColor" catalog="System" colorSpace="catalog"/>
-                    </box>
-                </subviews>
-            </view>
-            <connections>
-                <outlet property="delegate" destination="-2" id="0bl-1N-AYu"/>
-            </connections>
-            <point key="canvasLocation" x="389.5" y="74"/>
-        </window>
-        <numberFormatter formatterBehavior="default10_4" usesGroupingSeparator="NO" groupingSize="0" minimumIntegerDigits="0" maximumIntegerDigits="42" id="QZc-kt-D7Z" userLabel="Port Number Formatter">
-            <real key="minimum" value="1"/>
-            <real key="maximum" value="65535"/>
-        </numberFormatter>
-        <menu showsStateColumn="NO" id="QmU-th-vjP">
-            <items>
-                <menuItem title="Clone" id="bl9-lq-u9V">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="duplicate:" target="-2" id="dEb-Dt-yBW"/>
-                    </connections>
-                </menuItem>
-            </items>
-            <point key="canvasLocation" x="-25.5" y="171.5"/>
-        </menu>
-        <userDefaultsController representsSharedInstance="YES" id="UV9-ar-oJ3"/>
-        <numberFormatter formatterBehavior="default10_4" localizesFormat="NO" usesGroupingSeparator="NO" groupingSize="0" minimumIntegerDigits="0" maximumIntegerDigits="42" id="B8F-00-aMS">
-            <real key="minimum" value="250"/>
-            <real key="maximum" value="1350"/>
-        </numberFormatter>
-        <numberFormatter formatterBehavior="default10_4" localizesFormat="NO" usesGroupingSeparator="NO" groupingSize="0" minimumIntegerDigits="0" maximumIntegerDigits="42" id="fck-0V-svg">
-            <real key="minimum" value="0.0"/>
-            <real key="maximum" value="100"/>
-        </numberFormatter>
-    </objects>
-    <resources>
-        <image name="NSAddTemplate" width="11" height="11"/>
-        <image name="NSRemoveTemplate" width="11" height="11"/>
-        <image name="icons8-Blind Filled-50" width="50" height="50"/>
-    </resources>
-</document>
diff --git a/ShadowsocksX-NG/Base.lproj/ShareServerProfilesWindowController.xib b/ShadowsocksX-NG/Base.lproj/ShareServerProfilesWindowController.xib
deleted file mode 100644
index bc22d701f..000000000
--- a/ShadowsocksX-NG/Base.lproj/ShareServerProfilesWindowController.xib
+++ /dev/null
@@ -1,196 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="14490.70" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
-    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="14490.70"/>
-        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="ShareServerProfilesWindowController" customModule="ShadowsocksX_NG" customModuleProvider="target">
-            <connections>
-                <outlet property="copyAllServerURLsButton" destination="PkN-2i-ex7" id="5gY-Vs-cfn"/>
-                <outlet property="copyQRCodeButton" destination="GPl-Kb-AZg" id="pId-jX-erp"/>
-                <outlet property="copyURLButton" destination="Myo-Gh-Sba" id="3uJ-PP-nOS"/>
-                <outlet property="profilesTableView" destination="LWb-xh-GIK" id="qqJ-Qa-fWq"/>
-                <outlet property="qrCodeImageView" destination="atP-ge-P5H" id="Wc7-Ht-oJE"/>
-                <outlet property="saveAllServerURLsAsFileButton" destination="WOW-rs-fyP" id="A7T-IN-ub2"/>
-                <outlet property="saveQRCodeAsFileButton" destination="4WD-tD-JDA" id="Bfg-wE-8ls"/>
-                <outlet property="window" destination="F0z-JX-Cv5" id="gIp-Ho-8D9"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Share Server Profiles" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" releasedWhenClosed="NO" animationBehavior="default" id="F0z-JX-Cv5">
-            <windowStyleMask key="styleMask" titled="YES" closable="YES" miniaturizable="YES" resizable="YES"/>
-            <windowPositionMask key="initialPositionMask" topStrut="YES" bottomStrut="YES"/>
-            <rect key="contentRect" x="562" y="460" width="508" height="419"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1680" height="1027"/>
-            <view key="contentView" wantsLayer="YES" id="se5-gp-TjO">
-                <rect key="frame" x="0.0" y="0.0" width="508" height="419"/>
-                <autoresizingMask key="autoresizingMask"/>
-                <subviews>
-                    <scrollView autohidesScrollers="YES" horizontalLineScroll="19" horizontalPageScroll="10" verticalLineScroll="19" verticalPageScroll="10" usesPredominantAxisScrolling="NO" translatesAutoresizingMaskIntoConstraints="NO" id="d0q-qb-o6U">
-                        <rect key="frame" x="20" y="119" width="200" height="280"/>
-                        <clipView key="contentView" id="G7B-Z5-glP">
-                            <rect key="frame" x="1" y="1" width="198" height="278"/>
-                            <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                            <subviews>
-                                <tableView verticalHuggingPriority="750" allowsExpansionToolTips="YES" columnAutoresizingStyle="lastColumnOnly" columnReordering="NO" columnSelection="YES" columnResizing="NO" multipleSelection="NO" autosaveColumns="NO" rowSizeStyle="automatic" viewBased="YES" id="LWb-xh-GIK">
-                                    <rect key="frame" x="0.0" y="0.0" width="198" height="278"/>
-                                    <autoresizingMask key="autoresizingMask"/>
-                                    <size key="intercellSpacing" width="3" height="2"/>
-                                    <color key="backgroundColor" name="controlBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                    <color key="gridColor" name="gridColor" catalog="System" colorSpace="catalog"/>
-                                    <tableColumns>
-                                        <tableColumn editable="NO" width="195" minWidth="40" maxWidth="1000" id="BVB-7v-GrU">
-                                            <tableHeaderCell key="headerCell" lineBreakMode="truncatingTail" borderStyle="border" title="Server">
-                                                <font key="font" metaFont="smallSystem"/>
-                                                <color key="textColor" name="headerTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="headerColor" catalog="System" colorSpace="catalog"/>
-                                            </tableHeaderCell>
-                                            <textFieldCell key="dataCell" lineBreakMode="truncatingTail" selectable="YES" editable="YES" title="Text Cell" id="Z7X-TN-APg">
-                                                <font key="font" metaFont="system"/>
-                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                <color key="backgroundColor" name="controlBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                            </textFieldCell>
-                                            <tableColumnResizingMask key="resizingMask" resizeWithTable="YES" userResizable="YES"/>
-                                            <prototypeCellViews>
-                                                <tableCellView identifier="cellTitle" id="a8X-ox-vkA">
-                                                    <rect key="frame" x="1" y="1" width="195" height="17"/>
-                                                    <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                                    <subviews>
-                                                        <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" translatesAutoresizingMaskIntoConstraints="NO" id="Kni-HI-MDc">
-                                                            <rect key="frame" x="0.0" y="0.0" width="195" height="17"/>
-                                                            <textFieldCell key="cell" lineBreakMode="truncatingTail" sendsActionOnEndEditing="YES" title="Table View Cell" id="EIQ-Bg-vVe">
-                                                                <font key="font" metaFont="system"/>
-                                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                                                            </textFieldCell>
-                                                        </textField>
-                                                    </subviews>
-                                                    <constraints>
-                                                        <constraint firstItem="Kni-HI-MDc" firstAttribute="leading" secondItem="a8X-ox-vkA" secondAttribute="leading" constant="2" id="7KO-0D-dgp"/>
-                                                        <constraint firstItem="Kni-HI-MDc" firstAttribute="centerX" secondItem="a8X-ox-vkA" secondAttribute="centerX" id="Fe7-da-2Ni"/>
-                                                        <constraint firstItem="Kni-HI-MDc" firstAttribute="centerY" secondItem="a8X-ox-vkA" secondAttribute="centerY" id="jIj-uO-Kop"/>
-                                                    </constraints>
-                                                    <connections>
-                                                        <outlet property="textField" destination="Kni-HI-MDc" id="wnh-Vn-cT5"/>
-                                                    </connections>
-                                                </tableCellView>
-                                            </prototypeCellViews>
-                                        </tableColumn>
-                                    </tableColumns>
-                                    <connections>
-                                        <outlet property="dataSource" destination="-2" id="4GA-ch-rOE"/>
-                                        <outlet property="delegate" destination="-2" id="IdR-br-h7j"/>
-                                    </connections>
-                                </tableView>
-                            </subviews>
-                        </clipView>
-                        <scroller key="horizontalScroller" hidden="YES" verticalHuggingPriority="750" horizontal="YES" id="gkA-hM-aoX">
-                            <rect key="frame" x="1" y="224" width="178" height="16"/>
-                            <autoresizingMask key="autoresizingMask"/>
-                        </scroller>
-                        <scroller key="verticalScroller" hidden="YES" verticalHuggingPriority="750" horizontal="NO" id="UQv-FS-DZa">
-                            <rect key="frame" x="224" y="17" width="15" height="102"/>
-                            <autoresizingMask key="autoresizingMask"/>
-                        </scroller>
-                    </scrollView>
-                    <imageView horizontalHuggingPriority="251" verticalHuggingPriority="251" translatesAutoresizingMaskIntoConstraints="NO" id="atP-ge-P5H">
-                        <rect key="frame" x="238" y="119" width="250" height="250"/>
-                        <imageCell key="cell" refusesFirstResponder="YES" alignment="left" imageScaling="proportionallyDown" id="V51-A5-F2F"/>
-                    </imageView>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="GPl-Kb-AZg">
-                        <rect key="frame" x="232" y="46" width="262" height="32"/>
-                        <buttonCell key="cell" type="push" title="Copy QRCode" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="PrW-s6-Uab">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                        </buttonCell>
-                        <connections>
-                            <action selector="copyQRCode:" target="-2" id="cLd-uU-Mqd"/>
-                        </connections>
-                    </button>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="4WD-tD-JDA">
-                        <rect key="frame" x="232" y="13" width="262" height="32"/>
-                        <buttonCell key="cell" type="push" title="Save QRCode As File" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="IaI-Rj-Kss">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                        </buttonCell>
-                        <connections>
-                            <action selector="saveQRCodeAsFile:" target="-2" id="cHE-5h-cbg"/>
-                        </connections>
-                    </button>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="PkN-2i-ex7">
-                        <rect key="frame" x="14" y="79" width="212" height="32"/>
-                        <buttonCell key="cell" type="push" title="Copy All Server URLs" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="Yt2-p1-4w0">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                        </buttonCell>
-                        <connections>
-                            <action selector="copyAllServerURLs:" target="-2" id="y34-hx-a7y"/>
-                        </connections>
-                    </button>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="WOW-rs-fyP">
-                        <rect key="frame" x="14" y="46" width="212" height="32"/>
-                        <buttonCell key="cell" type="push" title="Save All Server URLs As File" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="9OS-xy-GB1">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                        </buttonCell>
-                        <connections>
-                            <action selector="saveAllServerURLsAsFile:" target="-2" id="Urh-dz-B8d"/>
-                        </connections>
-                    </button>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="Myo-Gh-Sba">
-                        <rect key="frame" x="232" y="79" width="262" height="32"/>
-                        <buttonCell key="cell" type="push" title="Copy URL" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="PHX-gY-lZe">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                        </buttonCell>
-                        <connections>
-                            <action selector="copyURL:" target="-2" id="dqq-Ps-sEh"/>
-                        </connections>
-                    </button>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="9o8-fU-fd5">
-                        <rect key="frame" x="236" y="378" width="200" height="17"/>
-                        <textFieldCell key="cell" lineBreakMode="clipping" title="The QRCode is in SIP002 format" id="czc-dd-Tcq">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                    </textField>
-                </subviews>
-                <constraints>
-                    <constraint firstItem="PkN-2i-ex7" firstAttribute="baseline" secondItem="Myo-Gh-Sba" secondAttribute="baseline" id="0JZ-YU-1ku"/>
-                    <constraint firstItem="WOW-rs-fyP" firstAttribute="baseline" secondItem="GPl-Kb-AZg" secondAttribute="baseline" id="2KL-CL-2ZT"/>
-                    <constraint firstItem="PkN-2i-ex7" firstAttribute="top" secondItem="d0q-qb-o6U" secondAttribute="bottom" constant="12" id="5B6-SC-Lfb"/>
-                    <constraint firstItem="GPl-Kb-AZg" firstAttribute="leading" secondItem="4WD-tD-JDA" secondAttribute="leading" id="BMf-K1-TVf"/>
-                    <constraint firstItem="4WD-tD-JDA" firstAttribute="top" secondItem="GPl-Kb-AZg" secondAttribute="bottom" constant="12" symbolic="YES" id="IhQ-NN-0wa"/>
-                    <constraint firstItem="d0q-qb-o6U" firstAttribute="leading" secondItem="PkN-2i-ex7" secondAttribute="leading" id="OIj-KG-9aT"/>
-                    <constraint firstItem="atP-ge-P5H" firstAttribute="leading" secondItem="Myo-Gh-Sba" secondAttribute="leading" id="OW7-ys-grj"/>
-                    <constraint firstItem="atP-ge-P5H" firstAttribute="trailing" secondItem="Myo-Gh-Sba" secondAttribute="trailing" id="Ond-No-6XU"/>
-                    <constraint firstItem="d0q-qb-o6U" firstAttribute="top" secondItem="se5-gp-TjO" secondAttribute="top" constant="20" symbolic="YES" id="P4g-uT-iiA"/>
-                    <constraint firstAttribute="bottom" secondItem="4WD-tD-JDA" secondAttribute="bottom" constant="20" symbolic="YES" id="Pzp-Xq-ySf"/>
-                    <constraint firstItem="9o8-fU-fd5" firstAttribute="leading" secondItem="d0q-qb-o6U" secondAttribute="trailing" constant="18" id="YhZ-3f-Vhg"/>
-                    <constraint firstItem="PkN-2i-ex7" firstAttribute="leading" secondItem="WOW-rs-fyP" secondAttribute="leading" id="aVv-aq-6Uw"/>
-                    <constraint firstItem="9o8-fU-fd5" firstAttribute="top" secondItem="se5-gp-TjO" secondAttribute="top" constant="24" id="djw-QK-Hkh"/>
-                    <constraint firstItem="d0q-qb-o6U" firstAttribute="leading" secondItem="se5-gp-TjO" secondAttribute="leading" constant="20" symbolic="YES" id="eBs-kY-b4F"/>
-                    <constraint firstAttribute="trailing" secondItem="9o8-fU-fd5" secondAttribute="trailing" constant="74" id="fMj-gc-6a3"/>
-                    <constraint firstItem="WOW-rs-fyP" firstAttribute="top" secondItem="PkN-2i-ex7" secondAttribute="bottom" constant="12" symbolic="YES" id="hFL-Fk-vnh"/>
-                    <constraint firstItem="d0q-qb-o6U" firstAttribute="bottom" secondItem="atP-ge-P5H" secondAttribute="bottom" id="j2N-0R-fbF"/>
-                    <constraint firstItem="PkN-2i-ex7" firstAttribute="trailing" secondItem="WOW-rs-fyP" secondAttribute="trailing" id="jYr-de-nuz"/>
-                    <constraint firstItem="Myo-Gh-Sba" firstAttribute="leading" secondItem="GPl-Kb-AZg" secondAttribute="leading" id="lZg-Ig-xNO"/>
-                    <constraint firstAttribute="trailing" secondItem="atP-ge-P5H" secondAttribute="trailing" constant="20" symbolic="YES" id="lwK-X8-kuL"/>
-                    <constraint firstItem="GPl-Kb-AZg" firstAttribute="trailing" secondItem="4WD-tD-JDA" secondAttribute="trailing" id="u6y-c4-plW"/>
-                    <constraint firstItem="atP-ge-P5H" firstAttribute="top" secondItem="9o8-fU-fd5" secondAttribute="bottom" constant="9" id="uwM-zJ-SN7"/>
-                    <constraint firstItem="d0q-qb-o6U" firstAttribute="trailing" secondItem="PkN-2i-ex7" secondAttribute="trailing" id="v7l-fK-lVF"/>
-                    <constraint firstItem="9o8-fU-fd5" firstAttribute="leading" secondItem="atP-ge-P5H" secondAttribute="leading" id="vJ0-fV-7FM"/>
-                    <constraint firstItem="Myo-Gh-Sba" firstAttribute="trailing" secondItem="GPl-Kb-AZg" secondAttribute="trailing" id="yu7-lx-VDg"/>
-                </constraints>
-            </view>
-            <connections>
-                <outlet property="delegate" destination="-2" id="0bl-1N-AYu"/>
-            </connections>
-            <point key="canvasLocation" x="143" y="223.5"/>
-        </window>
-    </objects>
-</document>
diff --git a/ShadowsocksX-NG/Base.lproj/UserRulesController.xib b/ShadowsocksX-NG/Base.lproj/UserRulesController.xib
deleted file mode 100644
index ca2e2e119..000000000
--- a/ShadowsocksX-NG/Base.lproj/UserRulesController.xib
+++ /dev/null
@@ -1,104 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="14490.70" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
-    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="14490.70"/>
-        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="UserRulesController" customModule="ShadowsocksX_NG" customModuleProvider="target">
-            <connections>
-                <outlet property="didCancel" destination="2bi-hW-nd9" id="wKx-Nb-7Kt"/>
-                <outlet property="userRulesView" destination="4yV-hS-knY" id="HF3-TH-oBY"/>
-                <outlet property="window" destination="F0z-JX-Cv5" id="gIp-Ho-8D9"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="User Rules" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" releasedWhenClosed="NO" animationBehavior="default" id="F0z-JX-Cv5">
-            <windowStyleMask key="styleMask" titled="YES" closable="YES" miniaturizable="YES" resizable="YES"/>
-            <windowPositionMask key="initialPositionMask" topStrut="YES" bottomStrut="YES"/>
-            <rect key="contentRect" x="196" y="519" width="480" height="270"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1680" height="1027"/>
-            <view key="contentView" id="se5-gp-TjO">
-                <rect key="frame" x="0.0" y="0.0" width="480" height="270"/>
-                <autoresizingMask key="autoresizingMask"/>
-                <subviews>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="N2T-OG-SO9">
-                        <rect key="frame" x="385" y="13" width="81" height="32"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="69" id="aO3-kK-V9p"/>
-                        </constraints>
-                        <buttonCell key="cell" type="push" title="OK" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="0Sc-cm-Vyu">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                            <string key="keyEquivalent" base64-UTF8="YES">
-DQ
-</string>
-                            <modifierMask key="keyEquivalentModifierMask" command="YES"/>
-                        </buttonCell>
-                        <connections>
-                            <action selector="didOK:" target="-2" id="216-18-SFI"/>
-                        </connections>
-                    </button>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="2bi-hW-nd9">
-                        <rect key="frame" x="304" y="13" width="81" height="32"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="69" id="jXL-pY-uDw"/>
-                        </constraints>
-                        <buttonCell key="cell" type="push" title="Cancel" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="QAR-9i-kmv">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                            <string key="keyEquivalent" base64-UTF8="YES">
-Gw
-</string>
-                        </buttonCell>
-                        <connections>
-                            <action selector="didCancel:" target="-2" id="SFh-eD-YLV"/>
-                        </connections>
-                    </button>
-                    <scrollView horizontalLineScroll="10" horizontalPageScroll="10" verticalLineScroll="10" verticalPageScroll="10" hasHorizontalScroller="NO" usesPredominantAxisScrolling="NO" translatesAutoresizingMaskIntoConstraints="NO" id="J3L-MK-p8I">
-                        <rect key="frame" x="20" y="61" width="440" height="189"/>
-                        <clipView key="contentView" drawsBackground="NO" id="fO6-Dc-ZUL">
-                            <rect key="frame" x="1" y="1" width="423" height="187"/>
-                            <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                            <subviews>
-                                <textView importsGraphics="NO" richText="NO" verticallyResizable="YES" usesFontPanel="YES" findStyle="panel" continuousSpellChecking="YES" allowsUndo="YES" usesRuler="YES" allowsNonContiguousLayout="YES" quoteSubstitution="YES" dashSubstitution="YES" spellingCorrection="YES" smartInsertDelete="YES" id="4yV-hS-knY">
-                                    <rect key="frame" x="0.0" y="0.0" width="423" height="187"/>
-                                    <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
-                                    <color key="textColor" name="textColor" catalog="System" colorSpace="catalog"/>
-                                    <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                                    <size key="minSize" width="423" height="187"/>
-                                    <size key="maxSize" width="463" height="10000000"/>
-                                    <color key="insertionPointColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                                </textView>
-                            </subviews>
-                        </clipView>
-                        <scroller key="horizontalScroller" hidden="YES" wantsLayer="YES" verticalHuggingPriority="750" doubleValue="1" horizontal="YES" id="z0Z-PW-muW">
-                            <rect key="frame" x="-100" y="-100" width="87" height="18"/>
-                            <autoresizingMask key="autoresizingMask"/>
-                        </scroller>
-                        <scroller key="verticalScroller" wantsLayer="YES" verticalHuggingPriority="750" horizontal="NO" id="Us9-yx-gj4">
-                            <rect key="frame" x="424" y="1" width="15" height="187"/>
-                            <autoresizingMask key="autoresizingMask"/>
-                        </scroller>
-                    </scrollView>
-                </subviews>
-                <constraints>
-                    <constraint firstItem="N2T-OG-SO9" firstAttribute="leading" secondItem="2bi-hW-nd9" secondAttribute="trailing" constant="12" symbolic="YES" id="aMv-5A-H00"/>
-                    <constraint firstItem="2bi-hW-nd9" firstAttribute="baseline" secondItem="N2T-OG-SO9" secondAttribute="baseline" id="bCp-AI-xph"/>
-                    <constraint firstItem="J3L-MK-p8I" firstAttribute="trailing" secondItem="N2T-OG-SO9" secondAttribute="trailing" id="ceZ-Kz-tzP"/>
-                    <constraint firstItem="J3L-MK-p8I" firstAttribute="leading" secondItem="se5-gp-TjO" secondAttribute="leading" constant="20" symbolic="YES" id="jkN-Yi-047"/>
-                    <constraint firstItem="2bi-hW-nd9" firstAttribute="top" secondItem="J3L-MK-p8I" secondAttribute="bottom" constant="20" symbolic="YES" id="n5u-fC-X85"/>
-                    <constraint firstItem="J3L-MK-p8I" firstAttribute="top" secondItem="se5-gp-TjO" secondAttribute="top" constant="20" symbolic="YES" id="nm4-yK-hmi"/>
-                    <constraint firstAttribute="bottom" secondItem="2bi-hW-nd9" secondAttribute="bottom" constant="20" symbolic="YES" id="tqM-nL-hC0"/>
-                    <constraint firstAttribute="trailing" secondItem="J3L-MK-p8I" secondAttribute="trailing" constant="20" symbolic="YES" id="ziG-gJ-Fcg"/>
-                </constraints>
-            </view>
-            <connections>
-                <outlet property="delegate" destination="-2" id="0bl-1N-AYu"/>
-            </connections>
-            <point key="canvasLocation" x="343" y="474"/>
-        </window>
-    </objects>
-</document>
diff --git a/ShadowsocksX-NG/Credits.rtf b/ShadowsocksX-NG/Credits.rtf
deleted file mode 100644
index b30a49aae..000000000
--- a/ShadowsocksX-NG/Credits.rtf
+++ /dev/null
@@ -1,18 +0,0 @@
-{\rtf1\ansi\ansicpg936\cocoartf2509
-\cocoatextscaling0\cocoaplatform0{\fonttbl\f0\fnil\fcharset134 STHeitiSC-Light;}
-{\colortbl;\red255\green255\blue255;}
-{\*\expandedcolortbl;;}
-\paperw12240\paperh15840\margl1440\margr1440\vieww12420\viewh9780\viewkind0
-\pard\tx560\tx1133\tx1700\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\pardirnatural\partightenfactor0
-{\field{\*\fldinst{HYPERLINK "https://github.com/shadowsocks/shadowsocks-libev"}}{\fldrslt 
-\f0\fs24 \cf0 ss-local}}
-\f0\fs24  v3.2.5\
-\pard\tx560\tx1133\tx1700\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\pardirnatural\partightenfactor0
-{\field{\*\fldinst{HYPERLINK "https://github.com/shadowsocks/kcptun"}}{\fldrslt \cf0 kcptun}} v20190905\
-\pard\tx560\tx1133\tx1700\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\pardirnatural\partightenfactor0
-{\field{\*\fldinst{HYPERLINK "https://github.com/shadowsocks/simple-obfs"}}{\fldrslt \cf0 simple-obfs}} v0.0.5\
-\pard\tx560\tx1133\tx1700\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\pardirnatural\partightenfactor0
-{\field{\*\fldinst{HYPERLINK "https://www.privoxy.org/"}}{\fldrslt \cf0 privoxy}} v3.0.26\
-\pard\tx560\tx1133\tx1700\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\pardirnatural\partightenfactor0
-{\field{\*\fldinst{HYPERLINK "https://github.com/shadowsocks/v2ray-plugin"}}{\fldrslt \cf0 v2ray-plugin}} v1.2.0\
-}
\ No newline at end of file
diff --git a/ShadowsocksX-NG/Diagnose.swift b/ShadowsocksX-NG/Diagnose.swift
deleted file mode 100644
index 1befdfd09..000000000
--- a/ShadowsocksX-NG/Diagnose.swift
+++ /dev/null
@@ -1,97 +0,0 @@
-//
-//  diagnose.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 2018/10/2.
-//  Copyright © 2018 qiuyuzhou. All rights reserved.
-//
-
-import Foundation
-
-func shell(_ args: String...) -> String {
-    let task = Process()
-    task.launchPath = "/usr/bin/env"
-    task.arguments = args
-    
-    let pipe = Pipe()
-    task.standardOutput = pipe
-    
-    task.launch()
-    task.waitUntilExit()
-    
-    let data = pipe.fileHandleForReading.readDataToEndOfFile()
-    let output = String(data: data, encoding: String.Encoding.utf8)
-    
-    return output ?? ""
-}
-
-func diagnose() -> String {
-    var strs = [String]()
-    
-    strs.append("\n-----------------------------------\n")
-    let infoDict = Bundle.main.infoDictionary!
-    let infoDictJsonData = try! JSONSerialization.data(withJSONObject: infoDict, options: JSONSerialization.WritingOptions.prettyPrinted)
-    
-    strs.append(String(data: infoDictJsonData, encoding: String.Encoding.utf8)!)
-    strs.append("\n-----------------------------------\n")
-    
-    let defaults = UserDefaults.standard
-    let keys = [
-        "ShadowsocksOn",
-        "ShadowsocksRunningMode",
-        "LocalSocks5.ListenPort",
-        "LocalSocks5.ListenAddress",
-        "PacServer.BindToLocalhost",
-        "PacServer.ListenPort",
-        "LocalSocks5.Timeout",
-        "LocalSocks5.EnableUDPRelay",
-        "LocalSocks5.EnableVerboseMode",
-        "GFWListURL",
-        "LocalHTTP.ListenAddress",
-        "LocalHTTP.ListenPort",
-        "LocalHTTPOn",
-        "LocalHTTP.FollowGlobal",
-        "ProxyExceptions",
-        ]
-    
-    strs.append("Preferences:\n")
-    for key in keys {
-        if let obj = defaults.object(forKey: key) {
-            strs.append("\(key)=\(obj)\n")
-        }
-    }
-    strs.append("-----------------------------------\n")
-    strs.append("Active server profile: \n")
-    
-    if let profile = ServerProfileManager.instance.getActiveProfile() {
-        strs.append(profile.debugString())
-    } else {
-        strs.append("No actived server profile!")
-    }
-    
-    strs.append("-----------------------------------\n")
-    strs.append("$ ls -l ~/Library/Application Support/ShadowsocksX-NG/\n")
-    strs.append(shell("ls", "-l", NSHomeDirectory() + "/Library/Application Support/ShadowsocksX-NG/"))
-    strs.append("-----------------------------------\n")
-    strs.append("$ ls -l ~/Library/LaunchAgents/\n")
-    strs.append(shell("ls", "-l", NSHomeDirectory() + "/Library/LaunchAgents/"))
-    strs.append("-----------------------------------\n")
-    strs.append("$ ls -l ~/.ShadowsocksX-NG/\n")
-    strs.append(shell("ls", "-l", NSHomeDirectory() + "/.ShadowsocksX-NG/"))
-    strs.append("-----------------------------------\n")
-    strs.append("$ ls -l /Library/Application Support/ShadowsocksX-NG/\n")
-    strs.append(shell("ls", "-l", "/Library/Application Support/ShadowsocksX-NG/"))
-    strs.append("-----------------------------------\n")
-    strs.append("$ lsof -PiTCP -sTCP:LISTEN\n")
-    strs.append(shell("lsof", "-PiTCP", "-sTCP:LISTEN"))
-    strs.append("-----------------------------------\n")
-    strs.append("$ ifconfig\n")
-    strs.append(shell("ifconfig"))
-    strs.append("-----------------------------------\n")
-    strs.append("$ launchctl list | grep com.qiuyuzhou.\n")
-    strs.append(shell("bash", "-c", "launchctl list | grep com.qiuyuzhou."))
-    strs.append("-----------------------------------\n")
-    
-    let output = strs.joined()
-    return output
-}
diff --git a/ShadowsocksX-NG/ImportWindowController.swift b/ShadowsocksX-NG/ImportWindowController.swift
deleted file mode 100644
index 99aa114d6..000000000
--- a/ShadowsocksX-NG/ImportWindowController.swift
+++ /dev/null
@@ -1,57 +0,0 @@
-//
-//  ImportWindowController.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 2019/9/10.
-//  Copyright © 2019 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-
-class ImportWindowController: NSWindowController {
-    @IBOutlet weak var inputBox: NSTextField!
-    
-    override func windowDidLoad() {
-        super.windowDidLoad()
-
-        // Implement this method to handle any initialization after your window controller's window has been loaded from its nib file.
-        
-        let pb = NSPasteboard.general
-        if #available(OSX 10.13, *) {
-            if let text = pb.string(forType: NSPasteboard.PasteboardType.URL) {
-                if let url = URL(string: text) {
-                    if url.scheme == "ss" {
-                        inputBox.stringValue = text
-                    }
-                }
-            }
-        }
-        if let text = pb.string(forType: NSPasteboard.PasteboardType.string) {
-            let urls = ServerProfileManager.findURLSInText(text)
-            if urls.count > 0 {
-                inputBox.stringValue = text
-            }
-        }
-    }
-    
-    @IBAction func handleImport(_ sender: NSButton) {
-        let mgr = ServerProfileManager.instance
-        let urls = ServerProfileManager.findURLSInText(inputBox.stringValue)
-        let addCount = mgr.addServerProfileByURL(urls: urls)
-
-        if addCount > 0 {
-            let alert = NSAlert.init()
-            alert.alertStyle = .informational;
-            alert.messageText = "Success to add \(addCount) server.".localized
-            alert.addButton(withTitle: "OK")
-            alert.runModal()
-            self.close()
-        } else {
-            let alert = NSAlert.init()
-            alert.alertStyle = .informational;
-            alert.messageText = "Not found valid shadowsocks server urls.".localized
-            alert.addButton(withTitle: "OK")
-            alert.runModal()
-        }
-    }
-}
diff --git a/ShadowsocksX-NG/Info.plist b/ShadowsocksX-NG/Info.plist
deleted file mode 100644
index 5fc2d7788..000000000
--- a/ShadowsocksX-NG/Info.plist
+++ /dev/null
@@ -1,53 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>en</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIconFile</key>
-	<string></string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>APPL</string>
-	<key>CFBundleShortVersionString</key>
-	<string>$(MARKETING_VERSION)</string>
-	<key>CFBundleSignature</key>
-	<string>????</string>
-	<key>CFBundleURLTypes</key>
-	<array>
-		<dict>
-			<key>CFBundleTypeRole</key>
-			<string>Viewer</string>
-			<key>CFBundleURLIconFile</key>
-			<string>menu_icon@2x</string>
-			<key>CFBundleURLName</key>
-			<string>shadowsocks</string>
-			<key>CFBundleURLSchemes</key>
-			<array>
-				<string>ss</string>
-			</array>
-		</dict>
-	</array>
-	<key>CFBundleVersion</key>
-	<string>1</string>
-	<key>LSApplicationCategoryType</key>
-	<string>public.app-category.utilities</string>
-	<key>LSMinimumSystemVersion</key>
-	<string>$(MACOSX_DEPLOYMENT_TARGET)</string>
-	<key>LSUIElement</key>
-	<true/>
-	<key>NSHumanReadableCopyright</key>
-	<string>Copyright © 2016-2019 qiuyuzhou. All rights reserved. License GPLv3.</string>
-	<key>NSMainNibFile</key>
-	<string>MainMenu</string>
-	<key>NSPrincipalClass</key>
-	<string>SWBApplication</string>
-</dict>
-</plist>
diff --git a/ShadowsocksX-NG/LaunchAgentUtils.swift b/ShadowsocksX-NG/LaunchAgentUtils.swift
deleted file mode 100644
index f81d1c512..000000000
--- a/ShadowsocksX-NG/LaunchAgentUtils.swift
+++ /dev/null
@@ -1,425 +0,0 @@
-//
-//  BGUtils.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/6.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-import Foundation
-
-let SS_LOCAL_VERSION = "3.2.5"
-let KCPTUN_CLIENT_VERSION = "v20190905_1"
-let V2RAY_PLUGIN_VERSION = "v1.3.1-9-gddd7ab4"
-let PRIVOXY_VERSION = "3.0.26.static"
-let SIMPLE_OBFS_VERSION = "0.0.5_1"
-let APP_SUPPORT_DIR = "/Library/Application Support/ShadowsocksX-NG/"
-let USER_CONFIG_DIR = "/.ShadowsocksX-NG/"
-let LAUNCH_AGENT_DIR = "/Library/LaunchAgents/"
-let LAUNCH_AGENT_CONF_SSLOCAL_NAME = "com.qiuyuzhou.shadowsocksX-NG.local.plist"
-let LAUNCH_AGENT_CONF_PRIVOXY_NAME = "com.qiuyuzhou.shadowsocksX-NG.http.plist"
-let LAUNCH_AGENT_CONF_KCPTUN_NAME = "com.qiuyuzhou.shadowsocksX-NG.kcptun.plist"
-
-
-func getFileSHA1Sum(_ filepath: String) -> String {
-    if let data = try? Data(contentsOf: URL(fileURLWithPath: filepath)) {
-        return data.sha1()
-    }
-    return ""
-}
-
-// Ref: https://developer.apple.com/library/mac/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
-// Genarate the mac launch agent service plist
-
-//  MARK: sslocal
-
-func generateSSLocalLauchAgentPlist() -> Bool {
-    let sslocalPath = NSHomeDirectory() + APP_SUPPORT_DIR + "ss-local-latest/ss-local"
-    let logFilePath = NSHomeDirectory() + "/Library/Logs/ss-local.log"
-    let launchAgentDirPath = NSHomeDirectory() + LAUNCH_AGENT_DIR
-    let plistFilepath = launchAgentDirPath + LAUNCH_AGENT_CONF_SSLOCAL_NAME
-    
-    // Ensure launch agent directory is existed.
-    let fileMgr = FileManager.default
-    if !fileMgr.fileExists(atPath: launchAgentDirPath) {
-        try! fileMgr.createDirectory(atPath: launchAgentDirPath, withIntermediateDirectories: true, attributes: nil)
-    }
-    
-    let oldSha1Sum = getFileSHA1Sum(plistFilepath)
-    
-    let defaults = UserDefaults.standard
-    let enableUdpRelay = defaults.bool(forKey: "LocalSocks5.EnableUDPRelay")
-    let enableVerboseMode = defaults.bool(forKey: "LocalSocks5.EnableVerboseMode")
-    
-    var arguments = [sslocalPath, "-c", "ss-local-config.json"]
-    if enableUdpRelay {
-        arguments.append("-u")
-    }
-    if enableVerboseMode {
-        arguments.append("-v")
-    }
-    arguments.append("--reuse-port")
-    
-    // For a complete listing of the keys, see the launchd.plist manual page.
-    let dyld_library_paths = [
-        NSHomeDirectory() + APP_SUPPORT_DIR + "ss-local-latest/",
-        NSHomeDirectory() + APP_SUPPORT_DIR + "plugins/",
-        ]
-    
-    let dict: NSMutableDictionary = [
-        "Label": "com.qiuyuzhou.shadowsocksX-NG.local",
-        "WorkingDirectory": NSHomeDirectory() + APP_SUPPORT_DIR,
-        "StandardOutPath": logFilePath,
-        "StandardErrorPath": logFilePath,
-        "ProgramArguments": arguments,
-        "EnvironmentVariables": ["DYLD_LIBRARY_PATH": dyld_library_paths.joined(separator: ":")]
-    ]
-    dict.write(toFile: plistFilepath, atomically: true)
-    let Sha1Sum = getFileSHA1Sum(plistFilepath)
-    if oldSha1Sum != Sha1Sum {
-        NSLog("generateSSLocalLauchAgentPlist - File has been changed.")
-        return true
-    } else {
-        NSLog("generateSSLocalLauchAgentPlist - File has not been changed.")
-        return false
-    }
-}
-
-func StartSSLocal() {
-    let bundle = Bundle.main
-    let installerPath = bundle.path(forResource: "start_ss_local.sh", ofType: nil)
-    let task = Process.launchedProcess(launchPath: installerPath!, arguments: [""])
-    task.waitUntilExit()
-    if task.terminationStatus == 0 {
-        NSLog("Start ss-local succeeded.")
-    } else {
-        NSLog("Start ss-local failed.")
-    }
-}
-
-func StopSSLocal() {
-    let bundle = Bundle.main
-    let installerPath = bundle.path(forResource: "stop_ss_local.sh", ofType: nil)
-    let task = Process.launchedProcess(launchPath: installerPath!, arguments: [""])
-    task.waitUntilExit()
-    if task.terminationStatus == 0 {
-        NSLog("Stop ss-local succeeded.")
-    } else {
-        NSLog("Stop ss-local failed.")
-    }
-}
-
-func InstallSSLocal() {
-    let fileMgr = FileManager.default
-    let homeDir = NSHomeDirectory()
-    let appSupportDir = homeDir+APP_SUPPORT_DIR
-    if !fileMgr.fileExists(atPath: appSupportDir + "ss-local-\(SS_LOCAL_VERSION)/ss-local")
-       || !fileMgr.fileExists(atPath: appSupportDir + "ss-local-\(SS_LOCAL_VERSION)/libmbedcrypto.0.dylib") {
-        let bundle = Bundle.main
-        let installerPath = bundle.path(forResource: "install_ss_local.sh", ofType: nil)
-        let task = Process.launchedProcess(launchPath: installerPath!, arguments: [""])
-        task.waitUntilExit()
-        if task.terminationStatus == 0 {
-            NSLog("Install ss-local succeeded.")
-        } else {
-            NSLog("Install ss-local failed.")
-        }
-    }
-}
-
-func writeSSLocalConfFile(_ conf:[String:AnyObject]) -> Bool {
-    do {
-        let filepath = NSHomeDirectory() + APP_SUPPORT_DIR + "ss-local-config.json"
-        var data: Data = try JSONSerialization.data(withJSONObject: conf, options: .prettyPrinted)
-
-        // https://github.com/shadowsocks/ShadowsocksX-NG/issues/1104
-        // This is NSJSONSerialization.dataWithJSONObject that likes to insert additional backslashes.
-        // Escaped forward slashes is also valid json.
-        // Workaround:
-        let s = String(data:data, encoding: .utf8)!
-        data = s.replacingOccurrences(of: "\\/", with: "/").data(using: .utf8)!
-        
-        let oldSum = getFileSHA1Sum(filepath)
-        try data.write(to: URL(fileURLWithPath: filepath), options: .atomic)
-        let newSum = data.sha1()
-        
-        if oldSum == newSum {
-            NSLog("writeSSLocalConfFile - File has not been changed.")
-            return false
-        }
-        
-        NSLog("writeSSLocalConfFile - File has been changed.")
-        return true
-    } catch {
-        NSLog("Write ss-local file failed.")
-    }
-    return false
-}
-
-func removeSSLocalConfFile() {
-    do {
-        let filepath = NSHomeDirectory() + APP_SUPPORT_DIR + "ss-local-config.json"
-        try FileManager.default.removeItem(atPath: filepath)
-    } catch {
-        
-    }
-}
-
-func SyncSSLocal() {
-    var changed: Bool = false
-    changed = changed || generateSSLocalLauchAgentPlist()
-    let mgr = ServerProfileManager.instance
-    if mgr.activeProfileId != nil {
-        if let profile = mgr.getActiveProfile() {
-            changed = changed || writeSSLocalConfFile((profile.toJsonConfig()))
-        }
-        
-        let on = UserDefaults.standard.bool(forKey: "ShadowsocksOn")
-        if on {
-            if changed {
-                StopSSLocal()
-                DispatchQueue.main.asyncAfter(
-                    deadline: DispatchTime.now() + DispatchTimeInterval.seconds(1),
-                    execute: {
-                        () in
-                        StartSSLocal()
-                })
-            } else {
-                StartSSLocal()
-            }
-        } else {
-            StopSSLocal()
-        }
-    } else {
-        removeSSLocalConfFile()
-        StopSSLocal()
-    }
-    SyncPac()
-    SyncPrivoxy()
-}
-
-// --------------------------------------------------------------------------------
-//  MARK: simple-obfs
-
-func InstallSimpleObfs() {
-    let fileMgr = FileManager.default
-    let homeDir = NSHomeDirectory()
-    let appSupportDir = homeDir + APP_SUPPORT_DIR
-    if !fileMgr.fileExists(atPath: appSupportDir + "simple-obfs-\(SIMPLE_OBFS_VERSION)/obfs-local")
-        || !fileMgr.fileExists(atPath: appSupportDir + "plugins/obfs-local") {
-        let bundle = Bundle.main
-        let installerPath = bundle.path(forResource: "install_simple_obfs.sh", ofType: nil)
-        let task = Process.launchedProcess(launchPath: "/bin/sh", arguments: [installerPath!])
-        task.waitUntilExit()
-        if task.terminationStatus == 0 {
-            NSLog("Install simple-obfs succeeded.")
-        } else {
-            NSLog("Install simple-obfs failed.")
-        }
-    }
-}
-
-// --------------------------------------------------------------------------------
-//  MARK: kcptun
-
-func InstallKcptun() {
-    let fileMgr = FileManager.default
-    let homeDir = NSHomeDirectory()
-    let appSupportDir = homeDir+APP_SUPPORT_DIR
-    if !fileMgr.fileExists(atPath: appSupportDir + "kcptun_\(KCPTUN_CLIENT_VERSION)/client") {
-        let bundle = Bundle.main
-        let installerPath = bundle.path(forResource: "install_kcptun", ofType: "sh")
-        let task = Process.launchedProcess(launchPath: "/bin/sh", arguments: [installerPath!])
-        task.waitUntilExit()
-        if task.terminationStatus == 0 {
-            NSLog("Install kcptun succeeded.")
-        } else {
-            NSLog("Install kcptun failed.")
-        }
-    }
-}
-
-// --------------------------------------------------------------------------------
-//  MARK: v2ray-plugin
-
-func InstallV2rayPlugin() {
-    let fileMgr = FileManager.default
-    let homeDir = NSHomeDirectory()
-    let appSupportDir = homeDir+APP_SUPPORT_DIR
-    if !fileMgr.fileExists(atPath: appSupportDir + "v2ray-plugin_\(V2RAY_PLUGIN_VERSION)/v2ray-plugin") {
-        let bundle = Bundle.main
-        let installerPath = bundle.path(forResource: "install_v2ray_plugin", ofType: "sh")
-        let task = Process.launchedProcess(launchPath: "/bin/sh", arguments: [installerPath!])
-        task.waitUntilExit()
-        if task.terminationStatus == 0 {
-            NSLog("Install v2ray-plugin succeeded.")
-        } else {
-            NSLog("Install v2ray-plugin failed.")
-        }
-    }
-}
-
-// --------------------------------------------------------------------------------
-//  MARK: privoxy
-
-func generatePrivoxyLauchAgentPlist() -> Bool {
-    let privoxyPath = NSHomeDirectory() + APP_SUPPORT_DIR + "privoxy"
-    let logFilePath = NSHomeDirectory() + "/Library/Logs/privoxy.log"
-    let launchAgentDirPath = NSHomeDirectory() + LAUNCH_AGENT_DIR
-    let plistFilepath = launchAgentDirPath + LAUNCH_AGENT_CONF_PRIVOXY_NAME
-    
-    // Ensure launch agent directory is existed.
-    let fileMgr = FileManager.default
-    if !fileMgr.fileExists(atPath: launchAgentDirPath) {
-        try! fileMgr.createDirectory(atPath: launchAgentDirPath, withIntermediateDirectories: true, attributes: nil)
-    }
-    
-    let oldSha1Sum = getFileSHA1Sum(plistFilepath)
-    
-    let arguments = [privoxyPath, "--no-daemon", "privoxy.config"]
-    
-    // For a complete listing of the keys, see the launchd.plist manual page.
-    let dict: NSMutableDictionary = [
-        "Label": "com.qiuyuzhou.shadowsocksX-NG.http",
-        "WorkingDirectory": NSHomeDirectory() + APP_SUPPORT_DIR,
-        "StandardOutPath": logFilePath,
-        "StandardErrorPath": logFilePath,
-        "ProgramArguments": arguments
-    ]
-    dict.write(toFile: plistFilepath, atomically: true)
-    let Sha1Sum = getFileSHA1Sum(plistFilepath)
-    if oldSha1Sum != Sha1Sum {
-        return true
-    } else {
-        return false
-    }
-}
-
-func StartPrivoxy() {
-    let bundle = Bundle.main
-    let installerPath = bundle.path(forResource: "start_privoxy.sh", ofType: nil)
-    let task = Process.launchedProcess(launchPath: installerPath!, arguments: [""])
-    task.waitUntilExit()
-    if task.terminationStatus == 0 {
-        NSLog("Start privoxy succeeded.")
-    } else {
-        NSLog("Start privoxy failed.")
-    }
-}
-
-func StopPrivoxy() {
-    let bundle = Bundle.main
-    let installerPath = bundle.path(forResource: "stop_privoxy.sh", ofType: nil)
-    let task = Process.launchedProcess(launchPath: installerPath!, arguments: [""])
-    task.waitUntilExit()
-    if task.terminationStatus == 0 {
-        NSLog("Stop privoxy succeeded.")
-    } else {
-        NSLog("Stop privoxy failed.")
-    }
-}
-
-func InstallPrivoxy() {
-    let fileMgr = FileManager.default
-    let homeDir = NSHomeDirectory()
-    let appSupportDir = homeDir+APP_SUPPORT_DIR
-    if !fileMgr.fileExists(atPath: appSupportDir + "privoxy-\(PRIVOXY_VERSION)/privoxy") {
-        let bundle = Bundle.main
-        let installerPath = bundle.path(forResource: "install_privoxy.sh", ofType: nil)
-        let task = Process.launchedProcess(launchPath: installerPath!, arguments: [""])
-        task.waitUntilExit()
-        if task.terminationStatus == 0 {
-            NSLog("Install privoxy succeeded.")
-        } else {
-            NSLog("Install privoxy failed.")
-        }
-    }
-    
-    let userConfigDir = homeDir + USER_CONFIG_DIR
-    // Make dir: '~/.ShadowsocksX-NG'
-    if !fileMgr.fileExists(atPath: userConfigDir) {
-        try! fileMgr.createDirectory(atPath: userConfigDir
-        , withIntermediateDirectories: true, attributes: nil)
-    }
-
-    // Install empty `user-privoxy.config` file.
-    let userConfigPath = userConfigDir + "user-privoxy.config"
-    if !fileMgr.fileExists(atPath: userConfigPath) {
-        let srcPath = Bundle.main.path(forResource: "user-privoxy", ofType: "config")!
-        try! fileMgr.copyItem(atPath: srcPath, toPath: userConfigPath)
-    }
-}
-
-func writePrivoxyConfFile() -> Bool {
-    do {
-        let defaults = UserDefaults.standard
-        let bundle = Bundle.main
-        let templatePath = bundle.path(forResource: "privoxy.template.config", ofType: nil)
-        
-        // Read template file
-        var template = try String(contentsOfFile: templatePath!, encoding: .utf8)
-        
-        template = template.replacingOccurrences(of: "{http}", with: defaults.string(forKey: "LocalHTTP.ListenAddress")! + ":" + String(defaults.integer(forKey: "LocalHTTP.ListenPort")))
-        template = template.replacingOccurrences(of: "{socks5}", with: defaults.string(forKey: "LocalSocks5.ListenAddress")! + ":" + String(defaults.integer(forKey: "LocalSocks5.ListenPort")))
-        
-        // Append the user config file to the end
-        let userConfigPath = NSHomeDirectory() + USER_CONFIG_DIR + "user-privoxy.config"
-        let userConfig = try String(contentsOfFile: userConfigPath, encoding: .utf8)
-        template.append(contentsOf: userConfig)
-        
-        // Write to file
-        let data = template.data(using: .utf8)
-        let filepath = NSHomeDirectory() + APP_SUPPORT_DIR + "privoxy.config"
-        
-        let oldSum = getFileSHA1Sum(filepath)
-        try data?.write(to: URL(fileURLWithPath: filepath), options: .atomic)
-        let newSum = getFileSHA1Sum(filepath)
-        
-        if oldSum == newSum {
-            return false
-        }
-        
-        return true
-    } catch {
-        NSLog("Write privoxy file failed.")
-    }
-    return false
-}
-
-func removePrivoxyConfFile() {
-    do {
-        let filepath = NSHomeDirectory() + APP_SUPPORT_DIR + "privoxy.config"
-        try FileManager.default.removeItem(atPath: filepath)
-    } catch {
-        
-    }
-}
-
-func SyncPrivoxy() {
-    var changed: Bool = false
-    changed = changed || generatePrivoxyLauchAgentPlist()
-    let mgr = ServerProfileManager.instance
-    if mgr.activeProfileId != nil {
-        changed = changed || writePrivoxyConfFile()
-        
-        let on = UserDefaults.standard.bool(forKey: "LocalHTTPOn")
-        if on {
-            if changed {
-                StopPrivoxy()
-                DispatchQueue.main.asyncAfter(
-                    deadline: DispatchTime.now() + DispatchTimeInterval.seconds(1),
-                    execute: {
-                        () in
-                        StartPrivoxy()
-                })
-            } else {
-                StartPrivoxy()
-            }
-        } else {
-            StopPrivoxy()
-        }
-    } else {
-        removePrivoxyConfFile()
-        StopPrivoxy()
-    }
-}
diff --git a/ShadowsocksX-NG/LaunchAtLoginController.h b/ShadowsocksX-NG/LaunchAtLoginController.h
deleted file mode 100755
index e9c9dee31..000000000
--- a/ShadowsocksX-NG/LaunchAtLoginController.h
+++ /dev/null
@@ -1,32 +0,0 @@
-//
-//  LaunchAtLoginController.h
-//
-//  Copyright 2011 Tomáš Znamenáček
-//  Copyright 2010 Ben Clark-Robinson
-//
-//  Permission is hereby granted, free of charge, to any person obtaining
-//  a copy of this software and associated documentation files (the ‘Software’),
-//  to deal in the Software without restriction, including without limitation
-//  the rights to use, copy, modify, merge, publish, distribute, sublicense,
-//  and/or sell copies of the Software, and to permit persons to whom the
-//  Software is furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be
-//  included in all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED ‘AS IS’, WITHOUT WARRANTY OF ANY KIND,
-//  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-//  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-//  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-//  CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-//  TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-//  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-#import <Foundation/Foundation.h>
-
-@interface LaunchAtLoginController : NSObject
-
-@property(assign) BOOL launchAtLogin;
-
-+ (instancetype) shared;
-
-@end
diff --git a/ShadowsocksX-NG/LaunchAtLoginController.m b/ShadowsocksX-NG/LaunchAtLoginController.m
deleted file mode 100755
index 586fb0b6e..000000000
--- a/ShadowsocksX-NG/LaunchAtLoginController.m
+++ /dev/null
@@ -1,89 +0,0 @@
-//
-//  LaunchAtLoginController.m
-//
-//  Copyright 2011 Tomáš Znamenáček
-//  Copyright 2010 Ben Clark-Robinson
-//
-//  Permission is hereby granted, free of charge, to any person obtaining
-//  a copy of this software and associated documentation files (the ‘Software’),
-//  to deal in the Software without restriction, including without limitation
-//  the rights to use, copy, modify, merge, publish, distribute, sublicense,
-//  and/or sell copies of the Software, and to permit persons to whom the
-//  Software is furnished to do so, subject to the following conditions:
-//
-//  The above copyright notice and this permission notice shall be
-//  included in all copies or substantial portions of the Software.
-//
-//  THE SOFTWARE IS PROVIDED ‘AS IS’, WITHOUT WARRANTY OF ANY KIND,
-//  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-//  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-//  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-//  CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-//  TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-//  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-#import "LaunchAtLoginController.h"
-#import <ServiceManagement/SMLoginItem.h>
-
-//static NSString *const StartAtLoginKey = @"launchAtLogin";
-
-@interface LaunchAtLoginController () {
-    BOOL _enabled;
-}
-
-@end
-
-@implementation LaunchAtLoginController
-
-#pragma mark Change Observing
-
-
-#pragma mark Initialization
-
-- (id) init
-{
-    self = [super init];
-    if (self) {
-        _enabled = NO;
-        BOOL enabled = [[NSUserDefaults standardUserDefaults] boolForKey: @"LaunchAtLogin"];
-        [self setLaunchAtLogin:enabled];
-    }
-    return self;
-}
-    
-- (void) dealloc
-{
-}
-
-+ (instancetype) shared {
-    static LaunchAtLoginController* ctrl = nil;
-    static dispatch_once_t onceToken;
-    dispatch_once(&onceToken, ^{
-        ctrl = [[self alloc]init];
-    });
-    return ctrl;
-}
-
-- (void) setLaunchAtLogin: (BOOL) enabled
-{
-    static NSString* bundleID = @"com.qiuyuzhou.ShadowsocksX-NG.LaunchHelper";
-    
-    if (SMLoginItemSetEnabled(
-                              (__bridge CFStringRef)bundleID
-                              , enabled)) {
-        _enabled = enabled;
-        NSUserDefaults* defaults = [NSUserDefaults standardUserDefaults];
-        [defaults setBool: enabled forKey: @"LaunchAtLogin"];
-        
-        NSLog(@"Call SMLoginItemSetEnabled with [%hhd] success", enabled);
-    } else {
-        NSLog(@"Call SMLoginItemSetEnabled with [%hhd] failed", enabled);
-    }
-}
-
-- (BOOL) launchAtLogin
-{
-    return _enabled;
-}
-
-@end
diff --git a/ShadowsocksX-NG/Notifications.swift b/ShadowsocksX-NG/Notifications.swift
deleted file mode 100644
index 974910c31..000000000
--- a/ShadowsocksX-NG/Notifications.swift
+++ /dev/null
@@ -1,18 +0,0 @@
-//
-//  Notifications.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/7.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-import Foundation
-
-let NOTIFY_SERVER_PROFILES_CHANGED = Notification.Name(rawValue: "NOTIFY_SERVER_PROFILES_CHANGED")
-
-let NOTIFY_CONF_CHANGED = Notification.Name(rawValue: "NOTIFY_CONF_CHANGED")
-
-let NOTIFY_TOGGLE_RUNNING_SHORTCUT = Notification.Name(rawValue: "NOTIFY_TOGGLE_RUNNING_SHORTCUT")
-let NOTIFY_SWITCH_PROXY_MODE_SHORTCUT = Notification.Name(rawValue: "NOTIFY_SWITCH_PROXY_MODE_SHORTCUT")
-
-let NOTIFY_FOUND_SS_URL = Notification.Name(rawValue: "NOTIFY_FOUND_SS_URL")
diff --git a/ShadowsocksX-NG/PACURLFormatter.swift b/ShadowsocksX-NG/PACURLFormatter.swift
deleted file mode 100644
index b39d84847..000000000
--- a/ShadowsocksX-NG/PACURLFormatter.swift
+++ /dev/null
@@ -1,53 +0,0 @@
-//
-//  PACURLFormatter.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 2019/9/15.
-//  Copyright © 2019 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-
-
-
-class PACURLFormatter: Formatter {
-    override func string(for obj: Any?) -> String? {
-        if let _obj = obj {
-            switch _obj {
-            case let s as String:
-                return s
-            default:
-                return ""
-            }
-        }
-        return ""
-    }
-    
-    override func getObjectValue(_ obj: AutoreleasingUnsafeMutablePointer<AnyObject?>?, for string: String, errorDescription error: AutoreleasingUnsafeMutablePointer<NSString?>?) -> Bool {
-
-        let input = string.trimmingCharacters(in: .whitespaces)
-        if input == "" {
-            return true
-        }
-
-        let errorMessage = "Must be a valid URL with scheme 'file', 'http' or 'https'".localized
-        
-        if let url = URL.init(string: input) {
-            if let scheme = url.scheme {
-                if !(["http", "https", "file"].contains(scheme) ) {
-                    error?.pointee = errorMessage as NSString
-                    return false
-                }
-                
-                obj?.pointee = url.absoluteString as AnyObject
-                return true
-            } else {
-                error?.pointee = errorMessage as NSString
-                return false
-            }
-        } else {
-            error?.pointee = errorMessage as NSString
-            return false
-        }
-    }
-}
diff --git a/ShadowsocksX-NG/PACUtils.swift b/ShadowsocksX-NG/PACUtils.swift
deleted file mode 100644
index 240397511..000000000
--- a/ShadowsocksX-NG/PACUtils.swift
+++ /dev/null
@@ -1,199 +0,0 @@
-//
-//  PACUtils.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/9.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-import Foundation
-import Alamofire
-
-let OldErrorPACRulesDirPath = NSHomeDirectory() + "/.ShadowsocksX-NE/"
-
-let PACRulesDirPath = NSHomeDirectory() + "/.ShadowsocksX-NG/"
-let PACUserRuleFilePath = PACRulesDirPath + "user-rule.txt"
-let PACFilePath = PACRulesDirPath + "gfwlist.js"
-let GFWListFilePath = PACRulesDirPath + "gfwlist.txt"
-
-
-// Because of LocalSocks5.ListenPort may be changed
-func SyncPac() {
-    var needGenerate = false
-    
-    let nowSocks5Address = UserDefaults.standard.string(forKey: "LocalSocks5.ListenAddress")
-    let oldSocks5Address = UserDefaults.standard.string(forKey: "LocalSocks5.ListenAddress.Old")
-    if nowSocks5Address != oldSocks5Address {
-        needGenerate = true
-        UserDefaults.standard.set(nowSocks5Address, forKey: "LocalSocks5.ListenAddress.Old")
-    }
-    
-    let nowSocks5Port = UserDefaults.standard.integer(forKey: "LocalSocks5.ListenPort")
-    let oldSocks5Port = UserDefaults.standard.integer(forKey: "LocalSocks5.ListenPort.Old")
-    if nowSocks5Port != oldSocks5Port {
-        needGenerate = true
-        UserDefaults.standard.set(nowSocks5Port, forKey: "LocalSocks5.ListenPort.Old")
-    }
-    
-    let fileMgr = FileManager.default
-    if !fileMgr.fileExists(atPath: PACFilePath) {
-        needGenerate = true
-    }
-    
-    if needGenerate {
-        if !GeneratePACFile() {
-            NSLog("GeneratePACFile failed!")
-        }
-    }
-}
-
-
-func GeneratePACFile() -> Bool {
-    let fileMgr = FileManager.default
-    // Maker the dir if rulesDirPath is not exesited.
-    if !fileMgr.fileExists(atPath: PACRulesDirPath) {
-        if fileMgr.fileExists(atPath: OldErrorPACRulesDirPath) {
-            try! fileMgr.moveItem(atPath: OldErrorPACRulesDirPath, toPath: PACRulesDirPath)
-        } else {
-            try! fileMgr.createDirectory(atPath: PACRulesDirPath
-                , withIntermediateDirectories: true, attributes: nil)
-        }
-    }
-    
-    // If gfwlist.txt is not exsited, copy from bundle
-    if !fileMgr.fileExists(atPath: GFWListFilePath) {
-        let src = Bundle.main.path(forResource: "gfwlist", ofType: "txt")
-        try! fileMgr.copyItem(atPath: src!, toPath: GFWListFilePath)
-    }
-    
-    // If user-rule.txt is not exsited, copy from bundle
-    if !fileMgr.fileExists(atPath: PACUserRuleFilePath) {
-        let src = Bundle.main.path(forResource: "user-rule", ofType: "txt")
-        try! fileMgr.copyItem(atPath: src!, toPath: PACUserRuleFilePath)
-    }
-    
-    let socks5Address = UserDefaults.standard.string(forKey: "LocalSocks5.ListenAddress")!
-    let socks5Port = UserDefaults.standard.integer(forKey: "LocalSocks5.ListenPort")
-    
-    do {
-        let gfwlist = try String(contentsOfFile: GFWListFilePath, encoding: String.Encoding.utf8)
-        if let data = Data(base64Encoded: gfwlist, options: .ignoreUnknownCharacters) {
-            let str = String(data: data, encoding: String.Encoding.utf8)
-            var lines = str!.components(separatedBy: CharacterSet.newlines)
-            
-            do {
-                let userRuleStr = try String(contentsOfFile: PACUserRuleFilePath, encoding: String.Encoding.utf8)
-                let userRuleLines = userRuleStr.components(separatedBy: CharacterSet.newlines)
-                
-                lines = userRuleLines + lines.filter { (line) in
-                    // ignore the rule from gwf if user provide same rule for the same url
-                    var i = line.startIndex
-                    while i < line.endIndex {
-                        if line[i] == "@" || line[i] == "|" {
-                            i = line.index(after: i)
-                            continue
-                        }
-                        break
-                    }
-                    if i == line.startIndex {
-                        return !userRuleLines.contains(line)
-                    }
-                    return !userRuleLines.contains(String(line[i...]))
-                }
-            } catch {
-                NSLog("Not found user-rule.txt")
-            }
-            
-            // Filter empty and comment lines
-            lines = lines.filter({ (s: String) -> Bool in
-                if s.isEmpty {
-                    return false
-                }
-                let c = s[s.startIndex]
-                if c == "!" || c == "[" {
-                    return false
-                }
-                return true
-            })
-            
-            do {
-                // rule lines to json array
-                let rulesJsonData: Data
-                    = try JSONSerialization.data(withJSONObject: lines, options: .prettyPrinted)
-                let rulesJsonStr = String(data: rulesJsonData, encoding: String.Encoding.utf8)
-                
-                // Get raw pac js
-                let jsPath = Bundle.main.url(forResource: "abp", withExtension: "js")
-                let jsData = try? Data(contentsOf: jsPath!)
-                var jsStr = String(data: jsData!, encoding: String.Encoding.utf8)
-                
-                // Replace rules placeholder in pac js
-                jsStr = jsStr!.replacingOccurrences(of: "__RULES__"
-                    , with: rulesJsonStr!)
-                // Replace __SOCKS5PORT__ palcholder in pac js
-                jsStr = jsStr!.replacingOccurrences(of: "__SOCKS5PORT__"
-                    , with: "\(socks5Port)")
-                // Replace __SOCKS5ADDR__ palcholder in pac js
-                var sin6 = sockaddr_in6()
-                if socks5Address.withCString({ cstring in inet_pton(AF_INET6, cstring, &sin6.sin6_addr) }) == 1 {
-                    jsStr = jsStr!.replacingOccurrences(of: "__SOCKS5ADDR__"
-                        , with: "[\(socks5Address)]")
-                } else {
-                    jsStr = jsStr!.replacingOccurrences(of: "__SOCKS5ADDR__"
-                        , with: socks5Address)
-                }
-                
-                // Write the pac js to file.
-                try jsStr!.data(using: String.Encoding.utf8)?
-                    .write(to: URL(fileURLWithPath: PACFilePath), options: .atomic)
-                
-                return true
-            } catch {
-                
-            }
-        }
-        
-    } catch {
-        NSLog("Not found gfwlist.txt")
-    }
-    return false
-}
-
-func UpdatePACFromGFWList() {
-    // Make the dir if rulesDirPath is not exesited.
-    if !FileManager.default.fileExists(atPath: PACRulesDirPath) {
-        do {
-            try FileManager.default.createDirectory(atPath: PACRulesDirPath
-                , withIntermediateDirectories: true, attributes: nil)
-        } catch {
-        }
-    }
-    
-    let url = UserDefaults.standard.string(forKey: "GFWListURL")
-    AF.request(url!)
-        .validate()
-        .responseString {
-            response in
-            switch response.result {
-            case .success(let v):
-                do {
-                    try v.write(toFile: GFWListFilePath, atomically: true, encoding: String.Encoding.utf8)
-                    if GeneratePACFile() {
-                        // Popup a user notification
-                        let notification = NSUserNotification()
-                        notification.title = "PAC has been updated by latest GFW List.".localized
-                        NSUserNotificationCenter.default
-                            .deliver(notification)
-                    }
-                } catch {
-                    
-                }
-            case .failure:
-                // Popup a user notification
-                let notification = NSUserNotification()
-                notification.title = "Failed to download latest GFW List.".localized
-                NSUserNotificationCenter.default
-                    .deliver(notification)
-            }
-        }
-}
diff --git a/ShadowsocksX-NG/PreferencesWinController.swift b/ShadowsocksX-NG/PreferencesWinController.swift
deleted file mode 100644
index 4401cf91e..000000000
--- a/ShadowsocksX-NG/PreferencesWinController.swift
+++ /dev/null
@@ -1,67 +0,0 @@
-//
-//  PreferencesWinController.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 2017/3/11.
-//  Copyright © 2017年 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-import RxCocoa
-import RxSwift
-
-class PreferencesWinController: NSWindowController {
-    
-    @IBOutlet weak var toolbar: NSToolbar!
-    @IBOutlet weak var tabView: NSTabView!
-    
-    override func windowDidLoad() {
-        super.windowDidLoad()
-
-        // Implement this method to handle any initialization after your window controller's window has been loaded from its nib file.
-        toolbar.selectedItemIdentifier = NSToolbarItem.Identifier(rawValue: "general")
-    }
-    
-    @objc func windowWillClose(_ notification: Notification) {
-        NotificationCenter.default
-            .post(name: NOTIFY_CONF_CHANGED, object: nil)
-    }
-    
-    @IBAction func toolbarAction(sender: NSToolbarItem) {
-        tabView.selectTabViewItem(withIdentifier: sender.itemIdentifier)
-    }
-
-    @IBAction func resetProxyExceptions(sender: NSButton) {
-        let defaults = UserDefaults.standard
-        defaults.removeObject(forKey: "ProxyExceptions")
-    }
-    
-    @IBAction func resetAllPreferences(sender: NSButton) {
-        let alert = NSAlert.init()
-        alert.alertStyle = .warning;
-        alert.messageText = "Are you sure you want to reset the preferences to defaults?".localized
-        alert.informativeText = "All your changes of preferences will be lost.".localized
-        alert.addButton(withTitle: "OK")
-        alert.addButton(withTitle: "Cancel")
-        if alert.runModal() == .alertFirstButtonReturn {
-            self.resetUserDefaults()
-        }
-    }
-    
-    func resetUserDefaults() {
-        let domain = Bundle.main.bundleIdentifier!
-        let defaults = UserDefaults.standard
-        
-        // Don't reset server profiles, restore them later.
-        let profiles = defaults.array(forKey: "ServerProfiles")
-        let activeProfileId = defaults.string(forKey: "ActiveServerProfileId")
-        
-        defaults.removePersistentDomain(forName: domain)
-        defaults.synchronize()
-        
-        // Restore server profiles.
-        defaults.set(profiles, forKey: "ServerProfiles")
-        defaults.set(activeProfileId, forKey: "ActiveServerProfileId")
-        defaults.synchronize()
-    }
-}
diff --git a/ShadowsocksX-NG/PreferencesWindowController.swift b/ShadowsocksX-NG/PreferencesWindowController.swift
deleted file mode 100644
index 470330e12..000000000
--- a/ShadowsocksX-NG/PreferencesWindowController.swift
+++ /dev/null
@@ -1,396 +0,0 @@
-//
-//  PreferencesWindowController.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/6.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-import RxCocoa
-import RxSwift
-
-class PreferencesWindowController: NSWindowController
-    , NSTableViewDataSource, NSTableViewDelegate {
-    
-    @IBOutlet weak var profilesTableView: NSTableView!
-    
-    @IBOutlet weak var profileBox: NSBox!
-    
-    @IBOutlet weak var hostTextField: NSTextField!
-    @IBOutlet weak var portTextField: NSTextField!
-    @IBOutlet weak var methodTextField: NSComboBox!
-    
-    @IBOutlet weak var passwordTabView: NSTabView!
-    @IBOutlet weak var passwordTextField: NSTextField!
-    @IBOutlet weak var passwordSecureTextField: NSSecureTextField!
-    @IBOutlet weak var togglePasswordVisibleButton: NSButton!
-    @IBOutlet weak var pluginTextField: NSTextField!
-    @IBOutlet weak var pluginOptionsTextField: NSTextField!
-    @IBOutlet weak var remarkTextField: NSTextField!
-    @IBOutlet weak var removeButton: NSButton!
-    
-    let tableViewDragType: String = "ss.server.profile.data"
-    
-    var defaults: UserDefaults!
-    var profileMgr: ServerProfileManager!
-    
-    var editingProfile: ServerProfile!
-
-
-    override func windowDidLoad() {
-        super.windowDidLoad()
-
-        // Implement this method to handle any initialization after your window controller's window has been loaded from its nib file.
-        
-        defaults = UserDefaults.standard
-        profileMgr = ServerProfileManager.instance
-        
-        methodTextField.addItems(withObjectValues: [
-            "aes-128-gcm",
-            "aes-192-gcm",
-            "aes-256-gcm",
-            "aes-128-cfb",
-            "aes-192-cfb",
-            "aes-256-cfb",
-            "aes-128-ctr",
-            "aes-192-ctr",
-            "aes-256-ctr",
-            "camellia-128-cfb",
-            "camellia-192-cfb",
-            "camellia-256-cfb",
-            "bf-cfb",
-            "chacha20-ietf-poly1305",
-            "xchacha20-ietf-poly1305",
-            "salsa20",
-            "chacha20",
-            "chacha20-ietf",
-            "rc4-md5",
-            ])
-        
-        profilesTableView.reloadData()
-        updateProfileBoxVisible()
-    }
-    
-    override func awakeFromNib() {
-        profilesTableView.registerForDraggedTypes([NSPasteboard.PasteboardType(rawValue: tableViewDragType)])
-        profilesTableView.allowsMultipleSelection = true
-    }
-    
-    @IBAction func addProfile(_ sender: NSButton) {
-        if editingProfile != nil && !editingProfile.isValid(){
-            shakeWindows()
-            return
-        }
-        profilesTableView.beginUpdates()
-        let profile = ServerProfile()
-        profile.remark = "New Server".localized
-        profileMgr.profiles.append(profile)
-        
-        let index = IndexSet(integer: profileMgr.profiles.count-1)
-        profilesTableView.insertRows(at: index, withAnimation: NSTableView.AnimationOptions.effectFade)
-        
-        self.profilesTableView.scrollRowToVisible(self.profileMgr.profiles.count-1)
-        self.profilesTableView.selectRowIndexes(index, byExtendingSelection: false)
-        profilesTableView.endUpdates()
-        updateProfileBoxVisible()
-    }
-    
-    @IBAction func removeProfile(_ sender: NSButton) {
-        let index = Int(profilesTableView.selectedRowIndexes.first!)
-        var deleteCount = 0
-        if index >= 0 {
-            profilesTableView.beginUpdates()
-            for (_, toDeleteIndex) in profilesTableView.selectedRowIndexes.enumerated() {
-                print(profileMgr.profiles.count)
-                profileMgr.profiles.remove(at: toDeleteIndex - deleteCount)
-                profilesTableView.removeRows(at: IndexSet(integer: toDeleteIndex - deleteCount), withAnimation: NSTableView.AnimationOptions.effectFade)
-                deleteCount += 1
-            }
-            profilesTableView.endUpdates()
-        }
-        self.profilesTableView.scrollRowToVisible(index-1)
-        self.profilesTableView.selectRowIndexes(IndexSet(integer: index-1), byExtendingSelection: false)
-        updateProfileBoxVisible()
-    }
-    
-    @IBAction func ok(_ sender: NSButton) {
-        if editingProfile != nil {
-            if !editingProfile.isValid() {
-                // TODO Shake window?
-                shakeWindows()
-                return
-            }
-        }
-        profileMgr.save()
-        window?.performClose(nil)
-
-        NotificationCenter.default
-            .post(name: NOTIFY_SERVER_PROFILES_CHANGED, object: nil)
-    }
-    
-    @IBAction func cancel(_ sender: NSButton) {
-        profileMgr.reload()
-        window?.performClose(self)
-    }
-    
-    @IBAction func duplicate(_ sender: Any) {
-        var copyCount = 0
-        for (_, toDuplicateIndex) in profilesTableView.selectedRowIndexes.enumerated() {
-            print(profileMgr.profiles.count)
-            let profile = profileMgr.profiles[toDuplicateIndex + copyCount]
-            let duplicateProfile = profile.copy() as! ServerProfile
-            duplicateProfile.uuid = UUID().uuidString
-            profileMgr.profiles.insert(duplicateProfile, at:toDuplicateIndex + copyCount)
-            
-            profilesTableView.beginUpdates()
-            let index = IndexSet(integer: toDuplicateIndex + copyCount)
-            profilesTableView.insertRows(at: index, withAnimation: NSTableView.AnimationOptions.effectFade)
-            self.profilesTableView.scrollRowToVisible(toDuplicateIndex + copyCount)
-            self.profilesTableView.selectRowIndexes(index, byExtendingSelection: false)
-            profilesTableView.endUpdates()
-            
-            copyCount += 1
-        }
-        updateProfileBoxVisible()
-    }
-    
-    @IBAction func togglePasswordVisible(_ sender: Any) {
-        if passwordTabView.selectedTabViewItem?.identifier as! String == "secure" {
-            passwordTabView.selectTabViewItem(withIdentifier: "insecure")
-            togglePasswordVisibleButton.image = NSImage(named: "icons8-Eye Filled-50")
-        } else {
-            passwordTabView.selectTabViewItem(withIdentifier: "secure")
-            togglePasswordVisibleButton.image = NSImage(named: "icons8-Blind Filled-50")
-        }
-    }
-    
-    @IBAction func openPluginHelp(_ sender: Any) {
-        let url = URL(string: "https://github.com/shadowsocks/ShadowsocksX-NG/wiki/SIP003-Plugin")
-        NSWorkspace.shared.open(url!)
-    }
-    
-    @IBAction func openPluginFolder(_ sender: Any) {
-        let folderPath = NSHomeDirectory() + APP_SUPPORT_DIR + "plugins/"
-        let url = URL(fileURLWithPath: folderPath, isDirectory: true)
-        NSWorkspace.shared.open(url)
-    }
-    
-    @IBAction func copyCurrentProfileURL2Pasteboard(_ sender: NSButton) {
-        let index = profilesTableView.selectedRow
-        if  index >= 0 {
-            let profile = profileMgr.profiles[index]
-            let ssURL = profile.URL()
-            if let url = ssURL {
-                // Then copy url to pasteboard
-                // TODO Why it not working?? It's ok in objective-c
-                let pboard = NSPasteboard.general
-                pboard.clearContents()
-                let rs = pboard.writeObjects([url as NSPasteboardWriting])
-                if rs {
-                    NSLog("copy to pasteboard success")
-                } else {
-                    NSLog("copy to pasteboard failed")
-                }
-            }
-        }
-    }
-    
-    func updateProfileBoxVisible() {
-        if profileMgr.profiles.count <= 0 {
-            removeButton.isEnabled = false
-        }else{
-            removeButton.isEnabled = true
-        }
-
-        if profileMgr.profiles.isEmpty {
-            profileBox.isHidden = true
-        } else {
-            profileBox.isHidden = false
-        }
-    }
-    
-    func bindProfile(_ index:Int) {
-        NSLog("bind profile \(index)")
-
-        if index >= 0 && index < profileMgr.profiles.count {
-            let editingProfile = profileMgr.profiles[index]
-            
-            hostTextField.bind(NSBindingName(rawValue: "value"), to: editingProfile, withKeyPath: "serverHost"
-                , options: [NSBindingOption.continuouslyUpdatesValue: true])
-            portTextField.bind(NSBindingName(rawValue: "value"), to: editingProfile, withKeyPath: "serverPort"
-                , options: [NSBindingOption.continuouslyUpdatesValue: true])
-            
-            methodTextField.bind(NSBindingName(rawValue: "value"), to: editingProfile, withKeyPath: "method"
-                , options: [NSBindingOption.continuouslyUpdatesValue: true])
-            passwordTextField.bind(NSBindingName(rawValue: "value"), to: editingProfile, withKeyPath: "password"
-                , options: [NSBindingOption.continuouslyUpdatesValue: true])
-            passwordSecureTextField.bind(NSBindingName(rawValue: "value"), to: editingProfile, withKeyPath: "password"
-                , options: [NSBindingOption.continuouslyUpdatesValue: true])
-
-            pluginTextField.bind(NSBindingName(rawValue: "value"), to: editingProfile, withKeyPath: "plugin"
-                , options: [NSBindingOption.continuouslyUpdatesValue: true])
-            pluginOptionsTextField.bind(NSBindingName(rawValue: "value"), to: editingProfile, withKeyPath: "pluginOptions"
-                , options: [NSBindingOption.continuouslyUpdatesValue: true])
-            
-            remarkTextField.bind(NSBindingName(rawValue: "value"), to: editingProfile, withKeyPath: "remark"
-                , options: [NSBindingOption.continuouslyUpdatesValue: true])
-        } else {
-            editingProfile = nil
-            hostTextField.unbind(NSBindingName(rawValue: "value"))
-            portTextField.unbind(NSBindingName(rawValue: "value"))
-            
-            methodTextField.unbind(NSBindingName(rawValue: "value"))
-            passwordTextField.unbind(NSBindingName(rawValue: "value"))
-            
-            remarkTextField.unbind(NSBindingName(rawValue: "value"))
-        }
-    }
-    
-    func getDataAtRow(_ index:Int) -> (String, Bool) {
-        let profile = profileMgr.profiles[index]
-        let isActive = (profileMgr.activeProfileId == profile.uuid)
-        if !profile.remark.isEmpty {
-            return (String(profile.remark.prefix(24)), isActive)
-        } else {
-            return (profile.serverHost, isActive)
-        }
-    }
-    
-    //--------------------------------------------------
-    // For NSTableViewDataSource
-    
-    func numberOfRows(in tableView: NSTableView) -> Int {
-        if let mgr = profileMgr {
-            return mgr.profiles.count
-        }
-        return 0
-    }
-    
-    func tableView(_ tableView: NSTableView
-        , objectValueFor tableColumn: NSTableColumn?
-        , row: Int) -> Any? {
-        
-        let (title, isActive) = getDataAtRow(row)
-        
-        if tableColumn?.identifier == NSUserInterfaceItemIdentifier("main") {
-            return title
-        } else if tableColumn?.identifier == NSUserInterfaceItemIdentifier("status") {
-            if isActive {
-                return NSImage(named: "NSMenuOnStateTemplate")
-            } else {
-                return nil
-            }
-        }
-        return ""
-    }
-    
-    // Drag & Drop reorder rows
-    
-    func tableView(_ tableView: NSTableView, pasteboardWriterForRow row: Int) -> NSPasteboardWriting? {
-        let item = NSPasteboardItem()
-        item.setString(String(row), forType: NSPasteboard.PasteboardType(rawValue: tableViewDragType))
-        return item
-    }
-    
-    func tableView(_ tableView: NSTableView, validateDrop info: NSDraggingInfo, proposedRow row: Int
-        , proposedDropOperation dropOperation: NSTableView.DropOperation) -> NSDragOperation {
-        if dropOperation == .above {
-            return .move
-        }
-        return NSDragOperation()
-    }
-    
-    func tableView(_ tableView: NSTableView, acceptDrop info: NSDraggingInfo
-        , row: Int, dropOperation: NSTableView.DropOperation) -> Bool {
-        if let mgr = profileMgr {
-            var oldIndexes = [Int]()
-            info.enumerateDraggingItems(options: [], for: tableView, classes: [NSPasteboardItem.self], searchOptions: [:], using: {
-                (draggingItem: NSDraggingItem, idx: Int, stop: UnsafeMutablePointer<ObjCBool>) in
-                if let str = (draggingItem.item as! NSPasteboardItem).string(forType: NSPasteboard.PasteboardType(rawValue: self.tableViewDragType)), let index = Int(str) {
-                    oldIndexes.append(index)
-                }
-            })
-            
-            var oldIndexOffset = 0
-            var newIndexOffset = 0
-            
-            // For simplicity, the code below uses `tableView.moveRowAtIndex` to move rows around directly.
-            // You may want to move rows in your content array and then call `tableView.reloadData()` instead.
-            tableView.beginUpdates()
-            for oldIndex in oldIndexes {
-                if oldIndex < row {
-                    let o = mgr.profiles.remove(at: oldIndex + oldIndexOffset)
-                    mgr.profiles.insert(o, at:row - 1)
-                    tableView.moveRow(at: oldIndex + oldIndexOffset, to: row - 1)
-                    oldIndexOffset -= 1
-                } else {
-                    let o = mgr.profiles.remove(at: oldIndex)
-                    mgr.profiles.insert(o, at:row + newIndexOffset)
-                    tableView.moveRow(at: oldIndex, to: row + newIndexOffset)
-                    newIndexOffset += 1
-                }
-            }
-            tableView.endUpdates()
-        
-            return true
-        }
-        return false
-    }
-    
-    //--------------------------------------------------
-    // For NSTableViewDelegate
-    
-    func tableView(_ tableView: NSTableView
-        , shouldEdit tableColumn: NSTableColumn?, row: Int) -> Bool {
-        return false
-    }
-    
-    func tableView(_ tableView: NSTableView, shouldSelectRow row: Int) -> Bool {
-        if row < 0 {
-            editingProfile = nil
-            return true
-        }
-        if editingProfile != nil {
-            if !editingProfile.isValid() {
-                return false
-            }
-        }
-        
-        return true
-    }
-    
-    func tableViewSelectionDidChange(_ notification: Notification) {
-        if profilesTableView.selectedRow >= 0 {
-            bindProfile(profilesTableView.selectedRow)
-        } else {
-            if !profileMgr.profiles.isEmpty {
-                let index = IndexSet(integer: profileMgr.profiles.count - 1)
-                profilesTableView.selectRowIndexes(index, byExtendingSelection: false)
-            }
-        }
-    }
-
-    func shakeWindows(){
-        let numberOfShakes:Int = 8
-        let durationOfShake:Float = 0.5
-        let vigourOfShake:Float = 0.05
-
-        let frame:CGRect = (window?.frame)!
-        let shakeAnimation = CAKeyframeAnimation()
-
-        let shakePath = CGMutablePath()
-        shakePath.move(to: CGPoint(x:NSMinX(frame), y:NSMinY(frame)))
-
-        for _ in 1...numberOfShakes{
-            shakePath.addLine(to: CGPoint(x: NSMinX(frame) - frame.size.width * CGFloat(vigourOfShake), y: NSMinY(frame)))
-            shakePath.addLine(to: CGPoint(x: NSMinX(frame) + frame.size.width * CGFloat(vigourOfShake), y: NSMinY(frame)))
-        }
-
-        shakePath.closeSubpath()
-        shakeAnimation.path = shakePath
-        shakeAnimation.duration = CFTimeInterval(durationOfShake)
-        window?.animations = ["frameOrigin":shakeAnimation]
-        window?.animator().setFrameOrigin(window!.frame.origin)
-    }
-}
diff --git a/ShadowsocksX-NG/ProxyConfHelper.h b/ShadowsocksX-NG/ProxyConfHelper.h
deleted file mode 100644
index 7a7899a28..000000000
--- a/ShadowsocksX-NG/ProxyConfHelper.h
+++ /dev/null
@@ -1,27 +0,0 @@
-//
-//  ProxyConfHelper.h
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/10.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-#import <GCDWebServer/GCDWebServer.h>
-#import <GCDWebServer/GCDWebServerDataResponse.h>
-
-@interface ProxyConfHelper : NSObject
-
-+ (void)install;
-
-+ (void)enablePACProxy;
-
-+ (void)enableGlobalProxy;
-
-+ (void)disableProxy;
-
-+ (void)enableExternalPACProxy;
-
-+ (void)startMonitorPAC;
-
-@end
diff --git a/ShadowsocksX-NG/ProxyConfHelper.m b/ShadowsocksX-NG/ProxyConfHelper.m
deleted file mode 100644
index 76ec8d6fd..000000000
--- a/ShadowsocksX-NG/ProxyConfHelper.m
+++ /dev/null
@@ -1,296 +0,0 @@
-//
-//  ProxyConfHelper.m
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/10.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-#import "ProxyConfHelper.h"
-#import "proxy_conf_helper_version.h"
-
-#define kShadowsocksHelper @"/Library/Application Support/ShadowsocksX-NG/proxy_conf_helper"
-
-@implementation ProxyConfHelper
-
-GCDWebServer *webServer = nil;
-
-+ (BOOL)isVersionOk {
-    NSTask *task;
-    task = [[NSTask alloc] init];
-    [task setLaunchPath:kShadowsocksHelper];
-    
-    NSArray *args;
-    args = [NSArray arrayWithObjects:@"-v", nil];
-    [task setArguments: args];
-    
-    NSPipe *pipe;
-    pipe = [NSPipe pipe];
-    [task setStandardOutput:pipe];
-    
-    NSFileHandle *fd;
-    fd = [pipe fileHandleForReading];
-    
-    [task launch];
-    
-    NSData *data;
-    data = [fd readDataToEndOfFile];
-    
-    NSString *str;
-    str = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
-    
-    if (![str isGreaterThanOrEqualTo: kProxyConfHelperVersion]) {
-        return NO;
-    }
-    return YES;
-}
-
-+ (void)install {
-    NSFileManager *fileManager = [NSFileManager defaultManager];
-    if (![fileManager fileExistsAtPath:kShadowsocksHelper] || ![self isVersionOk]) {
-        NSString *helperPath = [NSString stringWithFormat:@"%@/%@", [[NSBundle mainBundle] resourcePath], @"install_helper.sh"];
-        NSLog(@"run install script: %@", helperPath);
-        NSDictionary *error;
-        NSString *script = [NSString stringWithFormat:@"do shell script \"/bin/bash \\\"%@\\\"\" with administrator privileges", helperPath];
-        NSAppleScript *appleScript = [[NSAppleScript new] initWithSource:script];
-        if ([appleScript executeAndReturnError:&error]) {
-            NSLog(@"installation success");
-        } else {
-            NSLog(@"installation failure: %@", error);
-        }
-    }
-}
-
-+ (void)callHelper:(NSArray*) arguments {
-    NSTask *task;
-    task = [[NSTask alloc] init];
-    [task setLaunchPath:kShadowsocksHelper];
-
-    // this log is very important
-    NSLog(@"run shadowsocks helper: %@", kShadowsocksHelper);
-    [task setArguments:arguments];
-
-    NSPipe *stdoutpipe;
-    stdoutpipe = [NSPipe pipe];
-    [task setStandardOutput:stdoutpipe];
-
-    NSPipe *stderrpipe;
-    stderrpipe = [NSPipe pipe];
-    [task setStandardError:stderrpipe];
-
-    NSFileHandle *file;
-    file = [stdoutpipe fileHandleForReading];
-
-    [task launch];
-
-    NSData *data;
-    data = [file readDataToEndOfFile];
-
-    NSString *string;
-    string = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
-    if (string.length > 0) {
-        NSLog(@"%@", string);
-    }
-
-    file = [stderrpipe fileHandleForReading];
-    data = [file readDataToEndOfFile];
-    string = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
-    if (string.length > 0) {
-        NSLog(@"%@", string);
-    }
-}
-
-+ (void)addArguments4ManualSpecifyNetworkServices:(NSMutableArray*) args {
-    NSUserDefaults* defaults = [NSUserDefaults standardUserDefaults];
-    
-    if (![defaults boolForKey:@"AutoConfigureNetworkServices"]) {
-        NSArray* serviceKeys = [defaults arrayForKey:@"Proxy4NetworkServices"];
-        if (serviceKeys) {
-            for (NSString* key in serviceKeys) {
-                [args addObject:@"--network-service"];
-                [args addObject:key];
-            }
-        }
-    }
-}
-
-+ (void)addArguments4ManualSpecifyProxyExceptions:(NSMutableArray*) args {
-    NSUserDefaults* defaults = [NSUserDefaults standardUserDefaults];
-
-    NSString* rawExceptions = [defaults stringForKey:@"ProxyExceptions"];
-    if (rawExceptions) {
-        NSCharacterSet* whites = [NSCharacterSet whitespaceAndNewlineCharacterSet];
-        NSMutableCharacterSet* seps = [NSMutableCharacterSet characterSetWithCharactersInString:@",、"];
-        [seps formUnionWithCharacterSet:whites];
-
-        NSArray* exceptions = [rawExceptions componentsSeparatedByCharactersInSet:seps];
-        for (NSString* domainOrHost in exceptions) {
-            if ([domainOrHost length] > 0) {
-                [args addObject:@"-x"];
-                [args addObject:domainOrHost];
-            }
-        }
-    }
-}
-
-+ (NSString*)getPACFilePath {
-    return [NSString stringWithFormat:@"%@/%@", NSHomeDirectory(), @".ShadowsocksX-NG/gfwlist.js"];
-}
-
-+ (void)enablePACProxy {
-    //start server here and then using the string next line
-    //next two lines can open gcdwebserver and work around pac file
-    NSString* PACFilePath = [self getPACFilePath];
-    [self startPACServer: PACFilePath];
-    
-    NSURL* url = [NSURL URLWithString: [self getHttpPACUrl]];
-    
-    NSMutableArray* args = [@[@"--mode", @"auto", @"--pac-url", [url absoluteString]]mutableCopy];
-    
-    [self addArguments4ManualSpecifyNetworkServices:args];
-    [self addArguments4ManualSpecifyProxyExceptions:args];
-    [self callHelper:args];
-}
-
-+ (void)enableGlobalProxy {
-    NSString* socks5ListenAddress = [[NSUserDefaults standardUserDefaults]stringForKey:@"LocalSocks5.ListenAddress"];
-    NSUInteger port = [[NSUserDefaults standardUserDefaults]integerForKey:@"LocalSocks5.ListenPort"];
-    
-    NSMutableArray* args = [@[@"--mode", @"global", @"--port"
-                              , [NSString stringWithFormat:@"%lu", (unsigned long)port],@"--socks-listen-address",socks5ListenAddress]mutableCopy];
-    
-    // Known issue #106 https://github.com/shadowsocks/ShadowsocksX-NG/issues/106
-    if ([[NSUserDefaults standardUserDefaults] boolForKey:@"LocalHTTPOn"] && [[NSUserDefaults standardUserDefaults] boolForKey:@"LocalHTTP.FollowGlobal"]) {
-        NSUInteger privoxyPort = [[NSUserDefaults standardUserDefaults]integerForKey:@"LocalHTTP.ListenPort"];
-        NSString* privoxyListenAddress = [[NSUserDefaults standardUserDefaults]stringForKey:@"LocalHTTP.ListenAddress"];
-        [args addObject:@"--privoxy-port"];
-        [args addObject:[NSString stringWithFormat:@"%lu", (unsigned long)privoxyPort]];
-        [args addObject:@"--privoxy-listen-address"];
-        [args addObject:privoxyListenAddress];
-    }
-    
-    [self addArguments4ManualSpecifyNetworkServices:args];
-    [self addArguments4ManualSpecifyProxyExceptions:args];
-    [self callHelper:args];
-    [self stopPACServer];
-}
-
-+ (void)disableProxy {
-    // 带上所有参数是为了判断是否原有代理设置是否由ssx-ng设置的。如果是用户手工设置的其他配置，则不进行清空。
-    NSURL* url = [NSURL URLWithString: [self getHttpPACUrl]];
-    NSString* socks5ListenAddress = [[NSUserDefaults standardUserDefaults]stringForKey:@"LocalSocks5.ListenAddress"];
-    NSUInteger port = [[NSUserDefaults standardUserDefaults]integerForKey:@"LocalSocks5.ListenPort"];
-    
-    NSMutableArray* args = [@[@"--mode", @"off"
-                              , @"--pac-url", [url absoluteString]
-                              , @"--port", [NSString stringWithFormat:@"%lu", (unsigned long)port]
-                              , @"--socks-listen-address",socks5ListenAddress
-                              ]mutableCopy];
-    [self addArguments4ManualSpecifyNetworkServices:args];
-    [self addArguments4ManualSpecifyProxyExceptions:args];
-    [self callHelper:args];
-    [self stopPACServer];
-}
-
-+ (void)enableExternalPACProxy {
-    NSURL* url = [NSURL URLWithString: [self getExternalPACUrl]];
-    NSMutableArray* args = [@[@"--mode", @"auto"
-                              , @"--pac-url", [url absoluteString]
-                              ]mutableCopy];
-    [self addArguments4ManualSpecifyNetworkServices:args];
-    [self addArguments4ManualSpecifyProxyExceptions:args];
-    [self callHelper:args];
-    [self stopPACServer];
-}
-
-+ (NSString*)getHttpPACUrl {
-    NSString * routerPath = @"/proxy.pac";
-    
-    NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
-
-    NSString * address = @"localhost";
-    int port = (short)[defaults integerForKey:@"PacServer.ListenPort"];
-    
-    return [NSString stringWithFormat:@"%@%@:%d%@",@"http://",address,port,routerPath];
-}
-
-+ (NSString*)getExternalPACUrl {
-    NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
-    
-    return [defaults stringForKey:@"ExternalPACURL"];
-}
-
-+ (void)startPACServer:(NSString*) PACFilePath {
-    [self stopPACServer];
-    
-    NSString * routerPath = @"/proxy.pac";
-    
-    NSData* originalPACData = [NSData dataWithContentsOfFile:PACFilePath];
-    
-    webServer = [[GCDWebServer alloc] init];
-    
-
-    [webServer addHandlerForMethod:@"GET"
-                              path:routerPath
-                      requestClass:[GCDWebServerRequest class]
-                      processBlock:^GCDWebServerResponse *(GCDWebServerRequest *request)
-    {
-        GCDWebServerDataResponse* resp = [GCDWebServerDataResponse responseWithData:originalPACData
-                                                                        contentType:@"application/x-ns-proxy-autoconfig"];
-        return resp;
-    }
-     ];
-    
-    NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
-    
-    BOOL bindToLocalhost = [defaults boolForKey:@"PacServer.BindToLocalhost"];
-    int port = (short)[defaults integerForKey:@"PacServer.ListenPort"];
-    
-    [webServer startWithOptions:@{
-        GCDWebServerOption_BindToLocalhost: @(bindToLocalhost),
-        GCDWebServerOption_Port: @(port)
-    } error:nil];
-}
-
-+ (void)stopPACServer {
-    //原版似乎没有处理这个，本来设计计划如果切换到全局模式或者手动模式就关掉webserver 似乎没有这个必要了？
-    if ([webServer isRunning]) {
-        [webServer stop];
-    }
-}
-
-+ (void)startMonitorPAC {
-    // Monitor change event of the PAC file.
-    NSString* PACFilePath = [self getPACFilePath];
-    dispatch_queue_t queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0);
-    int fileId = open([PACFilePath UTF8String], O_EVTONLY);
-    __block dispatch_source_t source = dispatch_source_create(DISPATCH_SOURCE_TYPE_VNODE, fileId,
-                                                              DISPATCH_VNODE_DELETE | DISPATCH_VNODE_WRITE | DISPATCH_VNODE_EXTEND | DISPATCH_VNODE_ATTRIB | DISPATCH_VNODE_LINK | DISPATCH_VNODE_RENAME | DISPATCH_VNODE_REVOKE,
-                                                              queue);
-    dispatch_source_set_event_handler(source, ^
-                                      {
-                                          unsigned long flags = dispatch_source_get_data(source);
-                                          if(flags & DISPATCH_VNODE_DELETE)
-                                          {
-                                              dispatch_source_cancel(source);
-                                          }
-                                          
-                                          // The PAC file was written by atomically (PACUtils.swift:134)
-                                          // That means DISPATCH_VNODE_DELETE event always be trigged
-                                          // Need to be run the following statements in any events
-                                          NSUserDefaults* defaults = [NSUserDefaults standardUserDefaults];
-                                          if ([defaults boolForKey:@"ShadowsocksOn"]) {
-                                              if ([[defaults stringForKey:@"ShadowsocksRunningMode"] isEqualToString:@"auto"]) {
-                                                  [ProxyConfHelper disableProxy];
-                                                  [ProxyConfHelper enablePACProxy];
-                                              }
-                                          }
-                                      });
-    dispatch_source_set_cancel_handler(source, ^(void) 
-                                       {
-                                           close(fileId);
-                                       });
-    dispatch_resume(source);
-}
-
-@end
diff --git a/ShadowsocksX-NG/ProxyConfTool.h b/ShadowsocksX-NG/ProxyConfTool.h
deleted file mode 100644
index 467abdf8c..000000000
--- a/ShadowsocksX-NG/ProxyConfTool.h
+++ /dev/null
@@ -1,16 +0,0 @@
-//
-//  ProxyConfTool.h
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/29.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-
-
-@interface ProxyConfTool : NSObject
-
-+(NSArray*)networkServicesList;
-
-@end
diff --git a/ShadowsocksX-NG/ProxyConfTool.m b/ShadowsocksX-NG/ProxyConfTool.m
deleted file mode 100644
index 69705dd49..000000000
--- a/ShadowsocksX-NG/ProxyConfTool.m
+++ /dev/null
@@ -1,52 +0,0 @@
-//
-//  ProxyConfTool.m
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/29.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-#import "ProxyConfTool.h"
-#import <SystemConfiguration/SystemConfiguration.h>
-
-//https://developer.apple.com/library/mac/documentation/Networking/Conceptual/SystemConfigFrameworks/SC_Intro/SC_Intro.html
-
-@implementation ProxyConfTool
-
-
-+(NSArray*)networkServicesList {
-    NSMutableArray* results = [NSMutableArray array];
-    
-    SCPreferencesRef prefRef = SCPreferencesCreate(nil, CFSTR("Shadowsocks"), nil);
-    NSDictionary *sets = (__bridge NSDictionary *)SCPreferencesGetValue(prefRef, kSCPrefNetworkServices);
-    // 遍历系统中的网络设备列表
-    for (NSString *key in [sets allKeys]) {
-        NSMutableDictionary *service = [sets objectForKey:key];
-        NSString *userDefinedName = [service valueForKey:(__bridge NSString *)kSCPropUserDefinedName];
-//        NSString *hardware = [service valueForKeyPath:@"Interface.Hardware"];
-//        NSString *deviceName = [service valueForKeyPath:@"Interface.DeviceName"];
-//        NSString *deviceType = [service valueForKeyPath:@"Interface.Type"];
-        
-        BOOL isActive = ![service objectForKey:(NSString *)kSCResvInactive];
-        //                NSLog(@"%@", hardware);
-//        NSLog(@"%@-------------------", key);
-//        for(NSString* key in service) {
-//            NSLog(@"key=%@ value=%@", key, [service objectForKey:key]);
-//        }
-//
-        if (isActive) {
-            if (isActive && userDefinedName) {
-                NSDictionary* v = @{
-                                    @"key": key,
-                                    @"userDefinedName": userDefinedName,
-                                    };
-                [results addObject:v];
-            }
-        }
-    }
-    
-    return results;
-}
-
-
-@end
diff --git a/ShadowsocksX-NG/ProxyInterfacesViewCtrl.swift b/ShadowsocksX-NG/ProxyInterfacesViewCtrl.swift
deleted file mode 100644
index 12ee19b69..000000000
--- a/ShadowsocksX-NG/ProxyInterfacesViewCtrl.swift
+++ /dev/null
@@ -1,75 +0,0 @@
-//
-//  ProxyInterfacesTableViewCtrl.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 2017/3/17.
-//  Copyright © 2017年 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-import RxCocoa
-import RxSwift
-
-class ProxyInterfacesViewCtrl: NSViewController, NSTableViewDataSource, NSTableViewDelegate {
-    
-    var networkServices: NSArray!
-    var selectedNetworkServices: NSMutableSet!
-    
-    @IBOutlet weak var tableView: NSTableView!
-    @IBOutlet weak var autoConfigCheckBox: NSButton!
-    
-    override func viewDidLoad() {
-        super.viewDidLoad()
-        
-        let defaults = UserDefaults.standard
-        if let services = defaults.array(forKey: "Proxy4NetworkServices") {
-            selectedNetworkServices = NSMutableSet(array: services)
-        } else {
-            selectedNetworkServices = NSMutableSet()
-        }
-        
-        networkServices = ProxyConfTool.networkServicesList() as NSArray?
-        tableView.reloadData()
-    }
-
-    //--------------------------------------------------
-    // For NSTableViewDataSource
-    func numberOfRows(in tableView: NSTableView) -> Int {
-        if networkServices != nil {
-            return networkServices.count
-        }
-        return 0;
-    }
-    
-    func tableView(_ tableView: NSTableView, objectValueFor tableColumn: NSTableColumn?
-        , row: Int) -> Any? {
-        let cell = tableColumn!.dataCell as! NSButtonCell
-        
-        let networkService = networkServices[row] as! [String: Any]
-        let key = networkService["key"] as! String
-        if selectedNetworkServices.contains(key) {
-            cell.state = .on
-        } else {
-            cell.state = .off
-        }
-        let userDefinedName = networkService["userDefinedName"] as! String
-        cell.title = userDefinedName
-        return cell
-    }
-    
-    func tableView(_ tableView: NSTableView, setObjectValue object: Any?
-        , for tableColumn: NSTableColumn?, row: Int) {
-        let networkService = networkServices[row] as! [String: Any]
-        let key = networkService["key"] as! String
-        
-//        NSLog("%d", object!.integerValue)
-        if (object! as AnyObject).intValue == 1 {
-            selectedNetworkServices.add(key)
-        } else {
-            selectedNetworkServices.remove(key)
-        }
-
-        UserDefaults.standard.set(selectedNetworkServices.allObjects,
-                                  forKey: "Proxy4NetworkServices")
-    }
-}
diff --git a/ShadowsocksX-NG/SWBApplication.h b/ShadowsocksX-NG/SWBApplication.h
deleted file mode 100644
index c04a8b653..000000000
--- a/ShadowsocksX-NG/SWBApplication.h
+++ /dev/null
@@ -1,11 +0,0 @@
-//
-// Created by clowwindy on 3/1/14.
-// Copyright (c) 2014 clowwindy. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-@import AppKit;
-
-
-@interface SWBApplication : NSApplication
-@end
\ No newline at end of file
diff --git a/ShadowsocksX-NG/SWBApplication.m b/ShadowsocksX-NG/SWBApplication.m
deleted file mode 100644
index 55a2c7541..000000000
--- a/ShadowsocksX-NG/SWBApplication.m
+++ /dev/null
@@ -1,49 +0,0 @@
-//
-// Created by clowwindy on 3/1/14.
-// Copyright (c) 2014 clowwindy. All rights reserved.
-//
-
-#import "SWBApplication.h"
-
-
-@implementation SWBApplication {
-
-}
-
-// Enable Key Shortcuts
-// http://stackoverflow.com/questions/970707/cocoa-keyboard-shortcuts-in-dialog-without-an-edit-menu
-- (void) sendEvent:(NSEvent *)event {
-    if ([event type] == NSEventTypeKeyDown ) {
-        if (([event modifierFlags] & NSEventModifierFlagDeviceIndependentFlagsMask) == NSEventModifierFlagCommand) {
-            if ([[event charactersIgnoringModifiers] isEqualToString:@"x"]) {
-                if ([self sendAction:@selector(cut:) to:nil from:self])
-                    return;
-            }
-            else if ([[event charactersIgnoringModifiers] isEqualToString:@"c"]) {
-                if ([self sendAction:@selector(copy:) to:nil from:self])
-                    return;
-            }
-            else if ([[event charactersIgnoringModifiers] isEqualToString:@"v"]) {
-                if ([self sendAction:@selector(paste:) to:nil from:self])
-                    return;
-            }
-            else if ([[event charactersIgnoringModifiers] isEqualToString:@"z"]) {
-                if ([self sendAction:@selector(undo) to:nil from:self])
-                    return;
-            }
-            else if ([[event charactersIgnoringModifiers] isEqualToString:@"a"]) {
-                if ([self sendAction:@selector(selectAll:) to:nil from:self])
-                    return;
-            }
-        }
-        else if (([event modifierFlags] & NSEventModifierFlagDeviceIndependentFlagsMask) == (NSEventModifierFlagCommand | NSEventModifierFlagShift)) {
-            if ([[event charactersIgnoringModifiers] isEqualToString:@"Z"]) {
-                if ([self sendAction:@selector(redo) to:nil from:self])
-                    return;
-            }
-        }
-    }
-    [super sendEvent:event];
-}
-
-@end
diff --git a/ShadowsocksX-NG/SWBQRCodeWindowController.h b/ShadowsocksX-NG/SWBQRCodeWindowController.h
deleted file mode 100644
index ff9b194c0..000000000
--- a/ShadowsocksX-NG/SWBQRCodeWindowController.h
+++ /dev/null
@@ -1,23 +0,0 @@
-//
-//  QRCodeWindowController.h
-//  shadowsocks
-//
-//  Created by clowwindy on 10/12/14.
-//  Copyright (c) 2014 clowwindy. All rights reserved.
-//
-
-#import <Cocoa/Cocoa.h>
-#import <WebKit/WebKit.h>
-
-@interface SWBQRCodeWindowController : NSWindowController
-
-@property (nonatomic, copy) NSString *legacyQRCode;
-@property (nonatomic, copy) NSString *qrCode;
-@property (nonatomic, copy) NSString *title;
-
-@property (nonatomic, weak) NSTextField *titleTextField;
-@property (nonatomic, weak) NSImageView *imageView;
-
-- (IBAction) copyQRCode: (id) sender;
-
-@end
diff --git a/ShadowsocksX-NG/SWBQRCodeWindowController.m b/ShadowsocksX-NG/SWBQRCodeWindowController.m
deleted file mode 100644
index 46fc47b2f..000000000
--- a/ShadowsocksX-NG/SWBQRCodeWindowController.m
+++ /dev/null
@@ -1,100 +0,0 @@
-//
-//  QRCodeWindowController.m
-//  shadowsocks
-//
-//  Created by clowwindy on 10/12/14.
-//  Copyright (c) 2014 clowwindy. All rights reserved.
-//
-
-#import "SWBQRCodeWindowController.h"
-@import CoreImage;
-
-@interface SWBQRCodeWindowController ()
-
-@end
-
-@implementation SWBQRCodeWindowController
-
-- (void)windowDidLoad {
-    [super windowDidLoad];
-    
-    // Implement this method to handle any initialization after your window controller's window has been loaded from its nib file.
-    [self setQRCode:self.qrCode withOverlayText:@"SIP002"];
-}
-
-- (void)setQRCode:(NSString*) qrCode withOverlayText: (NSString*) text {
-    NSImage *image = [self createQRImageForString:qrCode size:NSMakeSize(250, 250)];
-    
-    if (text) {
-        // Draw overlay text
-        NSDictionary* attrs = @{
-                                NSForegroundColorAttributeName: [NSColor colorWithRed:28/255.0 green:155/255.0 blue:71/255.0 alpha:1],
-                                NSBackgroundColorAttributeName: [NSColor whiteColor],
-                                NSFontAttributeName: [NSFont fontWithName:@"Helvetica" size:(CGFloat)16],
-                                };
-        NSMutableAttributedString* attrsText = [[NSMutableAttributedString alloc] initWithString: text
-                                                                        attributes: attrs];
-        
-        [image lockFocus];
-        [attrsText drawAtPoint: NSMakePoint(100, 5)];
-        [image unlockFocus];
-    }
-    self.imageView.image = image;
-}
-
-- (NSImage*)createQRImageForString:(NSString *)string size:(NSSize)size {
-    NSImage *outputImage = [[NSImage alloc]initWithSize:size];
-    [outputImage lockFocus];
-    
-    // Setup the QR filter with our string
-    CIFilter *filter = [CIFilter filterWithName:@"CIQRCodeGenerator"];
-    [filter setDefaults];
-    
-    NSData *data = [string dataUsingEncoding:NSUTF8StringEncoding];
-    [filter setValue:data forKey:@"inputMessage"];
-    /*
-         L: 7%
-         M: 15%
-         Q: 25%
-         H: 30%
-     */
-    [filter setValue:@"Q" forKey:@"inputCorrectionLevel"];
-    
-    CIImage *image = [filter valueForKey:@"outputImage"];
-    
-    // Calculate the size of the generated image and the scale for the desired image size
-    CGRect extent = CGRectIntegral(image.extent);
-    CGFloat scale = MIN(size.width / CGRectGetWidth(extent), size.height / CGRectGetHeight(extent));
-    
-    CGImageRef bitmapImage = [NSGraphicsContext.currentContext.CIContext createCGImage:image fromRect:extent];
-    
-    CGContextRef graphicsContext = NSGraphicsContext.currentContext.CGContext;
-    
-    CGContextSetInterpolationQuality(graphicsContext, kCGInterpolationNone);
-    CGContextScaleCTM(graphicsContext, scale, scale);
-    CGContextDrawImage(graphicsContext, extent, bitmapImage);
-    
-    // Cleanup
-    CGImageRelease(bitmapImage);
-    
-    [outputImage unlockFocus];
-    return outputImage;
-}
-
-- (IBAction) copyQRCode: (id) sender{
-    NSPasteboard *pasteboard = [NSPasteboard generalPasteboard];
-    [pasteboard clearContents];
-    NSArray *copiedObjects = [NSArray arrayWithObject: self.imageView.image];
-    [pasteboard writeObjects:copiedObjects];
-}
-
-- (void)flagsChanged:(NSEvent *)event {
-    NSUInteger modifiers = event.modifierFlags & NSEventModifierFlagDeviceIndependentFlagsMask;
-    if (modifiers & NSEventModifierFlagOption) {
-        [self setQRCode:self.legacyQRCode withOverlayText:@"Legacy"];
-    } else {
-        [self setQRCode:self.qrCode withOverlayText:@"SIP002"];
-    }
-}
-
-@end
diff --git a/ShadowsocksX-NG/SWBQRCodeWindowController.xib b/ShadowsocksX-NG/SWBQRCodeWindowController.xib
deleted file mode 100644
index 96a94e9c7..000000000
--- a/ShadowsocksX-NG/SWBQRCodeWindowController.xib
+++ /dev/null
@@ -1,82 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="12121" systemVersion="16G29" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
-    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="12121"/>
-        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
-        <capability name="system font weights other than Regular or Bold" minToolsVersion="7.0"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="SWBQRCodeWindowController">
-            <connections>
-                <outlet property="imageView" destination="yRy-QH-TEe" id="aa5-Ri-k04"/>
-                <outlet property="window" destination="QvC-M9-y7g" id="HLy-eJ-5RD"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="QR Code" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" restorable="NO" oneShot="NO" animationBehavior="default" id="QvC-M9-y7g">
-            <windowStyleMask key="styleMask" titled="YES" closable="YES" miniaturizable="YES"/>
-            <rect key="contentRect" x="566" y="456" width="290" height="379"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1440" height="877"/>
-            <view key="contentView" id="EiT-Mj-1SZ">
-                <rect key="frame" x="0.0" y="0.0" width="290" height="379"/>
-                <autoresizingMask key="autoresizingMask"/>
-                <subviews>
-                    <imageView horizontalHuggingPriority="251" verticalHuggingPriority="251" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="yRy-QH-TEe">
-                        <rect key="frame" x="20" y="81" width="250" height="250"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <imageCell key="cell" refusesFirstResponder="YES" alignment="left" imageScaling="proportionallyDown" id="iAJ-tw-LNU"/>
-                        <connections>
-                            <outlet property="menu" destination="5h4-gO-Rh7" id="Ps3-TP-31Y"/>
-                        </connections>
-                    </imageView>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="NO" translatesAutoresizingMaskIntoConstraints="NO" id="9f5-sB-jlD">
-                        <rect key="frame" x="18" y="342" width="254" height="17"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="center" title="Title For Server" id="fHU-xF-zyc">
-                            <font key="font" metaFont="systemSemibold" size="13"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.title" id="VU2-sZ-3fH"/>
-                        </connections>
-                    </textField>
-                    <button verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="fAd-u3-u8m">
-                        <rect key="frame" x="14" y="20" width="262" height="32"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <buttonCell key="cell" type="push" title="Copy To Pasteboard" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="3q0-EO-Vug">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                        </buttonCell>
-                        <connections>
-                            <action selector="copyQRCode:" target="-2" id="4fF-ID-p1E"/>
-                        </connections>
-                    </button>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" allowsCharacterPickerTouchBarItem="NO" translatesAutoresizingMaskIntoConstraints="NO" id="dqP-hN-9CY">
-                        <rect key="frame" x="34" y="56" width="222" height="17"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="Press option/alt key to show legacy " id="x9U-Ti-73h">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                    </textField>
-                </subviews>
-            </view>
-            <point key="canvasLocation" x="152" y="-60.5"/>
-        </window>
-        <menu id="5h4-gO-Rh7">
-            <items>
-                <menuItem title="Copy QRCode" id="m8q-W6-UjX">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <connections>
-                        <action selector="copyQRCode:" target="-2" id="vD4-PS-09w"/>
-                    </connections>
-                </menuItem>
-            </items>
-        </menu>
-        <userDefaultsController representsSharedInstance="YES" id="owc-dp-6hu"/>
-    </objects>
-</document>
diff --git a/ShadowsocksX-NG/ServerProfile.swift b/ShadowsocksX-NG/ServerProfile.swift
deleted file mode 100644
index 0f7696e61..000000000
--- a/ShadowsocksX-NG/ServerProfile.swift
+++ /dev/null
@@ -1,335 +0,0 @@
-//
-//  ServerProfile.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/6.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-
-
-class ServerProfile: NSObject, NSCopying {
-    
-    @objc var uuid: String
-
-    @objc var serverHost: String = ""
-    @objc var serverPort: uint16 = 8379
-    @objc var method:String = "aes-128-gcm"
-    @objc var password:String = ""
-    @objc var remark:String = ""
-    
-    // SIP003 Plugin
-    @objc var plugin: String = ""  // empty string disables plugin
-    @objc var pluginOptions: String = ""
-    
-    override init() {
-        uuid = UUID().uuidString
-    }
-
-    init(uuid: String) {
-        self.uuid = uuid
-    }
-
-    convenience init?(url: URL) {
-        self.init()
-
-        func padBase64(string: String) -> String {
-            var length = string.utf8.count
-            if length % 4 == 0 {
-                return string
-            } else {
-                length = 4 - length % 4 + length
-                return string.padding(toLength: length, withPad: "=", startingAt: 0)
-            }
-        }
-
-        func decodeUrl(url: URL) -> (String?,String?) {
-            let urlStr = url.absoluteString
-            let base64Begin = urlStr.index(urlStr.startIndex, offsetBy: 5)
-            let base64End = urlStr.firstIndex(of: "#")
-            let encodedStr = String(urlStr[base64Begin..<(base64End ?? urlStr.endIndex)])
-            guard let data = Data(base64Encoded: padBase64(string: encodedStr)) else {
-                // Not legacy format URI
-                return (url.absoluteString, nil)
-            }
-            guard let decoded = String(data: data, encoding: String.Encoding.utf8) else {
-                return (nil, nil)
-            }
-            var s = decoded.trimmingCharacters(in: CharacterSet(charactersIn: "\n"))
-            
-            // May be legacy format URI
-            // Note that the legacy URI doesn't follow RFC3986. It means the password here
-            // should be plain text, not percent-encoded.
-            // Ref: https://shadowsocks.org/en/config/quick-guide.html
-            let parser = try? NSRegularExpression(
-                pattern: "(.+):(.+)@(.+)", options: .init())
-            if let match = parser?.firstMatch(in:s, options: [], range: NSRange(location: 0, length: s.utf16.count)) {
-                // Convert legacy format to SIP002 format
-                let r1 = Range(match.range(at: 1), in: s)!
-                let r2 = Range(match.range(at: 2), in: s)!
-                let r3 = Range(match.range(at: 3), in: s)!
-                let user = String(s[r1])
-                let password = String(s[r2])
-                let hostAndPort = String(s[r3])
-                
-                let rawUserInfo = "\(user):\(password)".data(using: .utf8)!
-                let userInfo = rawUserInfo.base64EncodedString()
-                
-                s = "ss://\(userInfo)@\(hostAndPort)"
-            }
-            
-            if let index = base64End {
-                let i = urlStr.index(index, offsetBy: 1)
-                let fragment = String(urlStr[i...])
-                return (s, fragment.removingPercentEncoding)
-            }
-            return (s, nil)
-        }
-        func decodeLegacyFormat(url: String) -> (URL?,String?) {
-            return (nil, nil)
-        }
-        
-        let (_decodedUrl, _tag) = decodeUrl(url: url)
-        guard let decodedUrl = _decodedUrl else {
-            return nil
-        }
-        guard let parsedUrl = URLComponents(string: decodedUrl) else {
-            return nil
-        }
-        guard let host = parsedUrl.host, let port = parsedUrl.port,
-            let user = parsedUrl.user else {
-            return nil
-        }
-
-        self.serverHost = host
-        self.serverPort = UInt16(port)
-
-        // This can be overriden by the fragment part of SIP002 URL
-        remark = parsedUrl.queryItems?
-            .filter({ $0.name == "Remark" }).first?.value ?? ""
-        
-        if let tag = _tag {
-            remark = tag
-        }
-
-        // SIP002 URL have no password section
-        guard let data = Data(base64Encoded: padBase64(string: user)),
-            let userInfo = String(data: data, encoding: .utf8) else {
-            return nil
-        }
-
-        let parts = userInfo.split(separator: ":", maxSplits: 1, omittingEmptySubsequences: false)
-        if parts.count != 2 {
-            return nil
-        }
-        self.method = String(parts[0]).lowercased()
-        self.password = String(parts[1])
-
-        // SIP002 defines where to put the profile name
-        if let profileName = parsedUrl.fragment {
-            self.remark = profileName
-        }
-
-        if let pluginStr = parsedUrl.queryItems?
-            .filter({ $0.name == "plugin" }).first?.value {
-            let parts = pluginStr.split(separator: ";", maxSplits: 1)
-            if parts.count == 2 {
-                plugin = String(parts[0])
-                pluginOptions = String(parts[1])
-            } else if parts.count == 1 {
-                plugin = String(parts[0])
-            }
-        }
-    }
-    
-    public func copy(with zone: NSZone? = nil) -> Any {
-        let copy = ServerProfile()
-        copy.serverHost = self.serverHost
-        copy.serverPort = self.serverPort
-        copy.method = self.method
-        copy.password = self.password
-        copy.remark = self.remark
-        
-        copy.plugin = self.plugin
-        copy.pluginOptions = self.pluginOptions
-        return copy;
-    }
-    
-    static func fromDictionary(_ data:[String:Any?]) -> ServerProfile {
-        let cp = {
-            (profile: ServerProfile) in
-            profile.serverHost = data["ServerHost"] as! String
-            profile.serverPort = (data["ServerPort"] as! NSNumber).uint16Value
-            profile.method = data["Method"] as! String
-            profile.password = data["Password"] as! String
-            if let remark = data["Remark"] {
-                profile.remark = remark as! String
-            }
-            if let plugin = data["Plugin"] as? String {
-                profile.plugin = plugin
-            }
-            if let pluginOptions = data["PluginOptions"] as? String {
-                profile.pluginOptions = pluginOptions
-            }
-        }
-
-        if let id = data["Id"] as? String {
-            let profile = ServerProfile(uuid: id)
-            cp(profile)
-            return profile
-        } else {
-            let profile = ServerProfile()
-            cp(profile)
-            return profile
-        }
-    }
-
-    func toDictionary() -> [String:AnyObject] {
-        var d = [String:AnyObject]()
-        d["Id"] = uuid as AnyObject?
-        d["ServerHost"] = serverHost as AnyObject?
-        d["ServerPort"] = NSNumber(value: serverPort as UInt16)
-        d["Method"] = method as AnyObject?
-        d["Password"] = password as AnyObject?
-        d["Remark"] = remark as AnyObject?
-        d["Plugin"] = plugin as AnyObject
-        d["PluginOptions"] = pluginOptions as AnyObject
-        return d
-    }
-
-    func toJsonConfig() -> [String: AnyObject] {
-        var conf: [String: AnyObject] = ["password": password as AnyObject,
-                                         "method": method as AnyObject,]
-        
-        let defaults = UserDefaults.standard
-        conf["local_port"] = NSNumber(value: UInt16(defaults.integer(forKey: "LocalSocks5.ListenPort")) as UInt16)
-        conf["local_address"] = defaults.string(forKey: "LocalSocks5.ListenAddress") as AnyObject?
-        conf["timeout"] = NSNumber(value: UInt32(defaults.integer(forKey: "LocalSocks5.Timeout")) as UInt32)
-        conf["server"] = serverHost as AnyObject
-        conf["server_port"] = NSNumber(value: serverPort as UInt16)
-
-        if !plugin.isEmpty {
-            // all plugin binaries should be located in the plugins dir
-            // so that we don't have to mess up with PATH envvars
-            conf["plugin"] = "plugins/\(plugin)" as AnyObject
-            conf["plugin_opts"] = pluginOptions as AnyObject
-        }
-
-        return conf
-    }
-    
-    func debugString() -> String {
-        var buf = ""
-        print("ServerHost=\(String(repeating: "*", count: serverHost.count))", to: &buf)
-        print("ServerPort=\(serverPort)", to: &buf)
-        print("Method=\(method)", to: &buf)
-        print("Password=\(String(repeating: "*", count: password.count))", to: &buf)
-        print("Plugin=\(plugin)", to: &buf)
-        print("PluginOptions=\(pluginOptions)", to: &buf)
-        return buf
-    }
-
-    func isValid() -> Bool {
-        func validateIpAddress(_ ipToValidate: String) -> Bool {
-
-            var sin = sockaddr_in()
-            var sin6 = sockaddr_in6()
-
-            if ipToValidate.withCString({ cstring in inet_pton(AF_INET6, cstring, &sin6.sin6_addr) }) == 1 {
-                // IPv6 peer.
-                return true
-            }
-            else if ipToValidate.withCString({ cstring in inet_pton(AF_INET, cstring, &sin.sin_addr) }) == 1 {
-                // IPv4 peer.
-                return true
-            }
-
-            return false;
-        }
-
-        func validateDomainName(_ value: String) -> Bool {
-            let validHostnameRegex = "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])$"
-
-            if (value.range(of: validHostnameRegex, options: .regularExpression) != nil) {
-                return true
-            } else {
-                return false
-            }
-        }
-
-        if !(validateIpAddress(serverHost) || validateDomainName(serverHost)){
-            return false
-        }
-
-        if password.isEmpty {
-            return false
-        }
-
-        return true
-    }
-
-    private func makeLegacyURL() -> URL? {
-        var url = URLComponents()
-
-        url.host = serverHost
-        url.user = method
-        url.password = password
-        url.port = Int(serverPort)
-
-        url.fragment = remark
-
-        let parts = url.string?.replacingOccurrences(
-            of: "//", with: "",
-            options: String.CompareOptions.anchored, range: nil)
-
-        let base64String = parts?.data(using: String.Encoding.utf8)?
-            .base64EncodedString(options: Data.Base64EncodingOptions())
-        if var s = base64String {
-            s = s.trimmingCharacters(in: CharacterSet(charactersIn: "="))
-            return Foundation.URL(string: "ss://\(s)")
-        }
-        return nil
-    }
-
-    func URL(legacy: Bool = false) -> URL? {
-        // If you want the URL from <= 1.5.1
-        if (legacy) {
-            return self.makeLegacyURL()
-        }
-
-        guard let rawUserInfo = "\(method):\(password)".data(using: .utf8) else {
-            return nil
-        }
-        let userInfo = rawUserInfo.base64EncodedString()
-
-        var items: [URLQueryItem] = []
-        if !plugin.isEmpty {
-            let value = "\(plugin);\(pluginOptions)"
-            items.append(URLQueryItem(name: "plugin", value: value))
-        }
-
-        var comps = URLComponents()
-
-        comps.scheme = "ss"
-        comps.host = serverHost
-        comps.port = Int(serverPort)
-        comps.user = userInfo
-        comps.path = "/"  // This is required by SIP0002 for URLs with fragment or query
-        comps.fragment = remark
-        comps.queryItems = items
-
-        let url = try? comps.asURL()
-
-        return url
-    }
-    
-    func title() -> String {
-        if remark.isEmpty {
-            return "\(serverHost):\(serverPort)"
-        } else {
-            return "\(String(remark.prefix(24))) (\(serverHost):\(serverPort))"
-        }
-    }
-    
-}
diff --git a/ShadowsocksX-NG/ServerProfileManager.swift b/ShadowsocksX-NG/ServerProfileManager.swift
deleted file mode 100644
index 27f1a8c05..000000000
--- a/ShadowsocksX-NG/ServerProfileManager.swift
+++ /dev/null
@@ -1,105 +0,0 @@
-//
-//  ServerProfileManager.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/6. Modified by 秦宇航 16/9/12
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-
-class ServerProfileManager: NSObject {
-    
-    static let instance:ServerProfileManager = ServerProfileManager()
-    
-    var profiles:[ServerProfile] = [ServerProfile]()
-    var activeProfileId: String?
-    
-    fileprivate override init() {
-        let defaults = UserDefaults.standard
-        if let _profiles = defaults.array(forKey: "ServerProfiles") {
-            for _profile in _profiles {
-                let profile = ServerProfile.fromDictionary(_profile as! [String: Any])
-                profiles.append(profile)
-            }
-        }
-        activeProfileId = defaults.string(forKey: "ActiveServerProfileId")
-    }
-    
-    func setActiveProfiledId(_ id: String) {
-        activeProfileId = id
-        let defaults = UserDefaults.standard
-        defaults.set(id, forKey: "ActiveServerProfileId")
-    }
-    
-    func save() {
-        let defaults = UserDefaults.standard
-        var _profiles = [AnyObject]()
-        for profile in profiles {
-            if profile.isValid() {
-                let _profile = profile.toDictionary()
-                _profiles.append(_profile as AnyObject)
-            }
-        }
-        defaults.set(_profiles, forKey: "ServerProfiles")
-        
-        if getActiveProfile() == nil {
-            activeProfileId = nil
-        }
-    }
-    
-    func reload() {
-        profiles.removeAll()
-        
-        let defaults = UserDefaults.standard
-        if let _profiles = defaults.array(forKey: "ServerProfiles") {
-            for _profile in _profiles {
-                let profile = ServerProfile.fromDictionary(_profile as! [String: Any])
-                profiles.append(profile)
-            }
-        }
-        activeProfileId = defaults.string(forKey: "ActiveServerProfileId")
-    }
-    
-    func getActiveProfile() -> ServerProfile? {
-        if let id = activeProfileId {
-            for p in profiles {
-                if p.uuid == id {
-                    return p
-                }
-            }
-            return nil
-        } else {
-            return nil
-        }
-    }
-    
-    func addServerProfileByURL(urls: [URL]) -> Int {
-        var addCount = 0
-        
-        for url in urls {
-            if let profile = ServerProfile(url: url) {
-                profiles.append(profile)
-                addCount = addCount + 1
-            }
-        }
-        
-        if addCount > 0 {
-            save()
-            NotificationCenter.default
-                .post(name: NOTIFY_SERVER_PROFILES_CHANGED, object: nil)
-        }
-        
-        return addCount
-    }
-    
-    static func findURLSInText(_ text: String) -> [URL] {
-        var urls = text.split(separator: "\n")
-            .map { String($0).trimmingCharacters(in: CharacterSet.whitespacesAndNewlines) }
-            .map { URL(string: $0) }
-            .filter { $0 != nil }
-            .map { $0! }
-        urls = urls.filter { $0.scheme == "ss" }
-        return urls
-    }
-}
diff --git a/ShadowsocksX-NG/ShadowsocksX-NG-Bridging-Header.h b/ShadowsocksX-NG/ShadowsocksX-NG-Bridging-Header.h
deleted file mode 100644
index db59115d7..000000000
--- a/ShadowsocksX-NG/ShadowsocksX-NG-Bridging-Header.h
+++ /dev/null
@@ -1,12 +0,0 @@
-//
-//  Use this file to import your target's public headers that you would like to expose to Swift.
-//
-
-#import <CommonCrypto/CommonCrypto.h>
-
-#import "LaunchAtLoginController.h"
-#import "SWBQRCodeWindowController.h"
-#import "ShortcutsController.h"
-#import "Utils.h"
-#import "ProxyConfHelper.h"
-#import "ProxyConfTool.h"
diff --git a/ShadowsocksX-NG/ShareServerProfilesWindowController.swift b/ShadowsocksX-NG/ShareServerProfilesWindowController.swift
deleted file mode 100644
index 1c1e9f91d..000000000
--- a/ShadowsocksX-NG/ShareServerProfilesWindowController.swift
+++ /dev/null
@@ -1,190 +0,0 @@
-//
-//  ShareServerProfilesWindowController.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 2018/9/16.
-//  Copyright © 2018年 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-
-class ShareServerProfilesWindowController: NSWindowController
-    , NSTableViewDataSource, NSTableViewDelegate {
-
-    @IBOutlet weak var profilesTableView: NSTableView!
-    
-    @IBOutlet weak var qrCodeImageView: NSImageView!
-    
-    @IBOutlet weak var copyAllServerURLsButton: NSButton!
-    @IBOutlet weak var saveAllServerURLsAsFileButton: NSButton!
-    
-    @IBOutlet weak var copyURLButton: NSButton!
-    @IBOutlet weak var copyQRCodeButton: NSButton!
-    @IBOutlet weak var saveQRCodeAsFileButton: NSButton!
-    
-    var defaults: UserDefaults!
-    var profileMgr: ServerProfileManager!
-
-    override func windowDidLoad() {
-        super.windowDidLoad()
-        
-        defaults = UserDefaults.standard
-        profileMgr = ServerProfileManager.instance
-        profilesTableView.reloadData()
-        
-        if !profileMgr.profiles.isEmpty {
-            let index = IndexSet(integer: 0)
-            profilesTableView.selectRowIndexes(index, byExtendingSelection: false)
-        } else {
-            copyAllServerURLsButton.isEnabled = false
-            saveAllServerURLsAsFileButton.isEnabled = false
-            copyURLButton.isEnabled = false
-            copyQRCodeButton.isEnabled = false
-            saveQRCodeAsFileButton.isEnabled = false
-        }
-    }
-    
-    @IBAction func copyURL(_ sender: NSButton) {
-        let profile = getSelectedProfile()
-        if profile.isValid(), let url = profile.URL() {
-            let pb = NSPasteboard.general
-            pb.clearContents()
-            if pb.writeObjects([url.absoluteString as NSPasteboardWriting]) {
-                NSLog("Copy URL to clipboard")
-            } else {
-                NSLog("Failed to copy URL to clipboard")
-            }
-        }
-    }
-    
-    @IBAction func copyQRCode(_ sender: NSButton) {
-        if let img = qrCodeImageView.image {
-            let pb = NSPasteboard.general
-            pb.clearContents()
-            if pb.writeObjects([img as NSPasteboardWriting]) {
-                NSLog("Copy QRCode to clipboard")
-            } else {
-                NSLog("Failed to copy QRCode to clipboard")
-            }
-        }
-    }
-    
-    @IBAction func saveQRCodeAsFile(_ sender: NSButton) {
-        if let img = qrCodeImageView.image {
-            let savePanel = NSSavePanel()
-            savePanel.title = "Save QRCode As File".localized
-            savePanel.canCreateDirectories = true
-            savePanel.allowedFileTypes = ["gif"]
-            savePanel.isExtensionHidden = false
-            
-            let profile = getSelectedProfile()
-            if profile.remark.isEmpty {
-                savePanel.nameFieldStringValue = "shadowsocks_qrcode.gif"
-            } else {
-                savePanel.nameFieldStringValue = "shadowsocks_qrcode_\(profile.remark).gif"
-            }
-            
-            savePanel.becomeKey()
-            let result = savePanel.runModal()
-            if (result.rawValue == NSFileHandlingPanelOKButton && (savePanel.url) != nil) {
-                let imgRep = NSBitmapImageRep(data: img.tiffRepresentation!)
-                let data = imgRep?.representation(using: NSBitmapImageRep.FileType.gif, properties: [:])
-                try! data?.write(to: savePanel.url!)
-            }
-        }
-    }
-    
-    @IBAction func copyAllServerURLs(_ sender: NSButton) {
-        let pb = NSPasteboard.general
-        pb.clearContents()
-        if pb.writeObjects([getAllServerURLs() as NSPasteboardWriting]) {
-            NSLog("Copy all server URLs to clipboard")
-        } else {
-            NSLog("Failed to all server URLs to clipboard")
-        }
-    }
-    
-    @IBAction func saveAllServerURLsAsFile(_ sender: NSButton) {
-        let formatter = DateFormatter()
-        formatter.dateFormat = "yyyyMMdd"
-        let date_string = formatter.string(from: Date())
-
-        let savePanel = NSSavePanel()
-        savePanel.title = "Save All Server URLs To File".localized
-        savePanel.canCreateDirectories = true
-        savePanel.allowedFileTypes = ["txt"]
-        savePanel.isExtensionHidden = false
-        savePanel.nameFieldStringValue = "shadowsocks_profiles_\(date_string).txt"
-        savePanel.becomeKey()
-        let result = savePanel.runModal()
-        if (result.rawValue == NSFileHandlingPanelOKButton && (savePanel.url) != nil) {
-            let urls = getAllServerURLs()
-            try! urls.write(to: (savePanel.url)!, atomically: true, encoding: String.Encoding.utf8)
-        }
-    }
-    
-    func getAllServerURLs() -> String {
-        let urls = profileMgr.profiles.filter({ (profile) -> Bool in
-            return profile.isValid()
-        }).map { (profile) -> String in
-            return profile.URL()!.absoluteString
-        }
-        return urls.joined(separator: "\n")
-    }
-    
-    func getSelectedProfile() -> ServerProfile {
-        let i = profilesTableView.selectedRow
-        return profileMgr.profiles[i]
-    }
-    
-    func getDataAtRow(_ index:Int) -> String {
-        let profile = profileMgr.profiles[index]
-        if !profile.remark.isEmpty {
-            return profile.remark
-        } else {
-            return profile.serverHost
-        }
-    }
-    
-    //--------------------------------------------------
-    // For NSTableViewDataSource
-    
-    func numberOfRows(in tableView: NSTableView) -> Int {
-        if let mgr = profileMgr {
-            return mgr.profiles.count
-        }
-        return 0
-    }
-    
-    //--------------------------------------------------
-    // For NSTableViewDelegate
-    
-    func tableView(_ tableView: NSTableView, viewFor tableColumn: NSTableColumn?, row: Int) -> NSView? {
-        let colId = NSUserInterfaceItemIdentifier(rawValue: "cellTitle")
-        if let cell = tableView.makeView(withIdentifier: colId, owner: self) as? NSTableCellView {
-            cell.textField?.stringValue = getDataAtRow(row)
-            return cell
-        }
-        return nil
-    }
-    
-    func tableViewSelectionDidChange(_ notification: Notification) {
-        if profilesTableView.selectedRow >= 0 {
-            let profile = getSelectedProfile()
-            if profile.isValid(), let url = profile.URL() {
-                let img = createQRImage(url.absoluteString, NSMakeSize(250, 250))
-                qrCodeImageView.image = img
-                
-                copyURLButton.isEnabled = true
-                copyQRCodeButton.isEnabled = true
-                saveQRCodeAsFileButton.isEnabled = true
-                return
-            }
-        }
-        qrCodeImageView.image = nil
-            
-        copyURLButton.isEnabled = false
-        copyQRCodeButton.isEnabled = false
-        saveQRCodeAsFileButton.isEnabled = false
-    }
-}
diff --git a/ShadowsocksX-NG/ShortcutsController.h b/ShadowsocksX-NG/ShortcutsController.h
deleted file mode 100644
index e14bfde3c..000000000
--- a/ShadowsocksX-NG/ShortcutsController.h
+++ /dev/null
@@ -1,15 +0,0 @@
-//
-//  ShortcutsController.h
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 2017/3/10.
-//  Copyright © 2017年 qiuyuzhou. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-
-@interface ShortcutsController : NSObject
-
-+ (void)bindShortcuts;
-
-@end
diff --git a/ShadowsocksX-NG/ShortcutsController.m b/ShadowsocksX-NG/ShortcutsController.m
deleted file mode 100644
index 9656a9064..000000000
--- a/ShadowsocksX-NG/ShortcutsController.m
+++ /dev/null
@@ -1,30 +0,0 @@
-//
-//  ShortcutsController.m
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 2017/3/10.
-//  Copyright © 2017年 qiuyuzhou. All rights reserved.
-//
-
-#import "ShortcutsController.h"
-
-#import <MASShortcut/Shortcut.h>
-
-
-@implementation ShortcutsController
-
-+ (void)bindShortcuts {
-    MASShortcutBinder* binder = [MASShortcutBinder sharedBinder];
-    [binder
-     bindShortcutWithDefaultsKey: @"ToggleRunning"
-     toAction:^{
-         [[NSNotificationCenter defaultCenter] postNotificationName: @"NOTIFY_TOGGLE_RUNNING_SHORTCUT" object: nil];
-     }];    
-    [binder
-     bindShortcutWithDefaultsKey: @"SwitchProxyMode"
-     toAction:^{
-         [[NSNotificationCenter defaultCenter] postNotificationName: @"NOTIFY_SWITCH_PROXY_MODE_SHORTCUT" object: nil];
-     }];    
-}
-
-@end
diff --git a/ShadowsocksX-NG/ToastWindowController.swift b/ShadowsocksX-NG/ToastWindowController.swift
deleted file mode 100644
index 8d354773c..000000000
--- a/ShadowsocksX-NG/ToastWindowController.swift
+++ /dev/null
@@ -1,121 +0,0 @@
-//
-//  ToastWindowController.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 2017/3/20.
-//  Copyright © 2017年 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-
-class ToastWindowController: NSWindowController {
-    
-    var message: String = ""
-    
-    @IBOutlet weak var titleTextField: NSTextField!
-    @IBOutlet weak var panelView: NSView!
-    
-    let kHudFadeInDuration: Double = 0.35
-    let kHudFadeOutDuration: Double = 0.35
-    let kHudDisplayDuration: Double = 1.2
-
-    let kHudAlphaValue: CGFloat = 0.75
-    let kHudCornerRadius: CGFloat = 18.0
-    let kHudHorizontalMargin: CGFloat = 30
-    let kHudHeight: CGFloat = 90.0
-    
-    var timerToFadeOut: Timer? = nil
-    var fadingOut: Bool = false
-
-    override func windowDidLoad() {
-        super.windowDidLoad()
-
-        self.shouldCascadeWindows = false
-
-        // Implement this method to handle any initialization after your window controller's window has been loaded from its nib file.
-        if let win = self.window {
-            win.isOpaque = false
-            win.backgroundColor = .clear
-            win.styleMask = NSWindow.StyleMask.borderless
-            win.hidesOnDeactivate = false
-            win.collectionBehavior = NSWindow.CollectionBehavior.canJoinAllSpaces
-            win.level = NSWindow.Level(rawValue: Int(CGWindowLevelForKey(.floatingWindow)))
-            win.orderFrontRegardless()
-        }
-
-        let viewLayer: CALayer = CALayer()
-        viewLayer.backgroundColor = CGColor.init(red: 0.05, green: 0.05, blue: 0.05, alpha: kHudAlphaValue)
-        viewLayer.cornerRadius = kHudCornerRadius
-        panelView.wantsLayer = true
-        panelView.layer = viewLayer
-        panelView.layer?.opacity = 0.0
-        
-        self.titleTextField.stringValue = self.message
-        
-        setupHud()
-    }
-    
-    func setupHud() -> Void {
-        titleTextField.sizeToFit()
-
-        var labelFrame: CGRect = titleTextField.frame
-        var hudWindowFrame: CGRect = self.window!.frame
-        hudWindowFrame.size.width = labelFrame.size.width + kHudHorizontalMargin * 2
-        hudWindowFrame.size.height = kHudHeight
-
-        let screenRect: NSRect = NSScreen.screens[0].visibleFrame
-        hudWindowFrame.origin.x = (screenRect.size.width - hudWindowFrame.size.width) / 2
-        hudWindowFrame.origin.y = (screenRect.size.height - hudWindowFrame.size.height) / 2
-        self.window!.setFrame(hudWindowFrame, display: true)
-
-        var viewFrame: NSRect = hudWindowFrame;
-        viewFrame.origin.x = 0
-        viewFrame.origin.y = 0
-        panelView.frame = viewFrame
-
-        labelFrame.origin.x = kHudHorizontalMargin
-        labelFrame.origin.y = (hudWindowFrame.size.height - labelFrame.size.height) / 2
-        titleTextField.frame = labelFrame
-    }
-    
-    func fadeInHud() -> Void {
-        if timerToFadeOut != nil {
-            timerToFadeOut?.invalidate()
-            timerToFadeOut = nil
-        }
-
-        fadingOut = false
-
-        CATransaction.begin()
-        CATransaction.setAnimationDuration(kHudFadeInDuration)
-        CATransaction.setCompletionBlock { self.didFadeIn() }
-        panelView.layer?.opacity = 1.0
-        CATransaction.commit()
-    }
-
-    func didFadeIn() -> Void {
-        timerToFadeOut = Timer.scheduledTimer(
-            timeInterval: kHudDisplayDuration,
-            target: self,
-            selector: #selector(fadeOutHud),
-            userInfo: nil,
-            repeats: false)
-    }
-
-    @objc func fadeOutHud() -> Void {
-        fadingOut = true
-
-        CATransaction.begin()
-        CATransaction.setAnimationDuration(kHudFadeOutDuration)
-        CATransaction.setCompletionBlock { self.didFadeOut() }
-        panelView.layer?.opacity = 0.0
-        CATransaction.commit()
-    }
-
-    func didFadeOut() -> Void {
-        if fadingOut {
-            self.window?.orderOut(self)
-        }
-        fadingOut = false
-    }
-}
diff --git a/ShadowsocksX-NG/ToastWindowController.xib b/ShadowsocksX-NG/ToastWindowController.xib
deleted file mode 100644
index d8c55fa1b..000000000
--- a/ShadowsocksX-NG/ToastWindowController.xib
+++ /dev/null
@@ -1,41 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="11762" systemVersion="16D32" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
-    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="11762"/>
-        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="ToastWindowController" customModule="ShadowsocksX_NG" customModuleProvider="target">
-            <connections>
-                <outlet property="panelView" destination="KRY-zc-8By" id="a3Z-ll-K4V"/>
-                <outlet property="titleTextField" destination="scG-hz-bja" id="8Dk-Hq-eUS"/>
-                <outlet property="window" destination="kRK-Pd-y69" id="pHW-35-GCT"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Window" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" hidesOnDeactivate="YES" oneShot="NO" showsToolbarButton="NO" visibleAtLaunch="NO" animationBehavior="default" id="kRK-Pd-y69" customClass="NSPanel">
-            <windowStyleMask key="styleMask" closable="YES" miniaturizable="YES" resizable="YES" utility="YES"/>
-            <rect key="contentRect" x="139" y="81" width="300" height="100"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1920" height="1057"/>
-            <value key="minSize" type="size" width="200" height="100"/>
-            <view key="contentView" id="KRY-zc-8By" userLabel="Panel View">
-                <rect key="frame" x="0.0" y="0.0" width="300" height="100"/>
-                <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                <subviews>
-                    <textField verticalHuggingPriority="750" fixedFrame="YES" preferredMaxLayoutWidth="162" translatesAutoresizingMaskIntoConstraints="NO" id="scG-hz-bja" userLabel="Is Name">
-                        <rect key="frame" x="24" y="33" width="258" height="31"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMinX="YES" flexibleMaxX="YES" flexibleMinY="YES" flexibleMaxY="YES"/>
-                        <textFieldCell key="cell" sendsActionOnEndEditing="YES" alignment="center" title="Label" usesSingleLineMode="YES" id="eQL-ri-Y7Z">
-                            <font key="font" metaFont="system" size="24"/>
-                            <color key="textColor" white="1" alpha="1" colorSpace="calibratedWhite"/>
-                            <color key="backgroundColor" name="alternateSelectedControlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                    </textField>
-                </subviews>
-            </view>
-            <point key="canvasLocation" x="-2307" y="172"/>
-        </window>
-    </objects>
-</document>
diff --git a/ShadowsocksX-NG/UserRulesController.swift b/ShadowsocksX-NG/UserRulesController.swift
deleted file mode 100644
index 9a5ef8778..000000000
--- a/ShadowsocksX-NG/UserRulesController.swift
+++ /dev/null
@@ -1,53 +0,0 @@
-//
-//  UserRulesController.swift
-//  ShadowsocksX-NG
-//
-//  Created by 周斌佳 on 16/8/1.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-import Cocoa
-
-class UserRulesController: NSWindowController {
-
-    @IBOutlet var userRulesView: NSTextView!
-
-    override func windowDidLoad() {
-        super.windowDidLoad()
-
-        let fileMgr = FileManager.default
-        if !fileMgr.fileExists(atPath: PACUserRuleFilePath) {
-            let src = Bundle.main.path(forResource: "user-rule", ofType: "txt")
-            try! fileMgr.copyItem(atPath: src!, toPath: PACUserRuleFilePath)
-        }
-
-        let str = try? String(contentsOfFile: PACUserRuleFilePath, encoding: String.Encoding.utf8)
-        userRulesView.string = str!
-    }
-    
-    @IBAction func didCancel(_ sender: AnyObject) {
-        window?.performClose(self)
-    }
-
-    @IBAction func didOK(_ sender: AnyObject) {
-        if let str = userRulesView?.string {
-            do {
-                try str.data(using: String.Encoding.utf8)?.write(to: URL(fileURLWithPath: PACUserRuleFilePath), options: .atomic)
-
-                if GeneratePACFile() {
-                    // Popup a user notification
-                    let notification = NSUserNotification()
-                    notification.title = "PAC has been updated by User Rules.".localized
-                    NSUserNotificationCenter.default
-                        .deliver(notification)
-                } else {
-                    let notification = NSUserNotification()
-                    notification.title = "It's failed to update PAC by User Rules.".localized
-                    NSUserNotificationCenter.default
-                        .deliver(notification)
-                }
-            } catch {}
-        }
-        window?.performClose(self)
-    }
-}
diff --git a/ShadowsocksX-NG/Utils.h b/ShadowsocksX-NG/Utils.h
deleted file mode 100644
index 9c30936e8..000000000
--- a/ShadowsocksX-NG/Utils.h
+++ /dev/null
@@ -1,16 +0,0 @@
-//
-//  QRCodeUtils.h
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/8.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-#ifndef QRCodeUtils_h
-#define QRCodeUtils_h
-
-void ScanQRCodeOnScreen();
-
-NSImage* createQRImage(NSString *string, NSSize size);
-
-#endif /* QRCodeUtils_h */
diff --git a/ShadowsocksX-NG/Utils.m b/ShadowsocksX-NG/Utils.m
deleted file mode 100644
index 20f0fb767..000000000
--- a/ShadowsocksX-NG/Utils.m
+++ /dev/null
@@ -1,117 +0,0 @@
-//
-//  QRCodeUtils.m
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/8.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-#import <CoreImage/CoreImage.h>
-#import <AppKit/AppKit.h>
-
-void ScanQRCodeOnScreen(void) {
-    /* displays[] Quartz display ID's */
-    CGDirectDisplayID   *displays = nil;
-    
-    CGError             err = CGDisplayNoErr;
-    CGDisplayCount      dspCount = 0;
-    
-    /* How many active displays do we have? */
-    err = CGGetActiveDisplayList(0, NULL, &dspCount);
-    
-    /* If we are getting an error here then their won't be much to display. */
-    if(err != CGDisplayNoErr)
-    {
-        NSLog(@"Could not get active display count (%d)\n", err);
-        return;
-    }
-    
-    /* Allocate enough memory to hold all the display IDs we have. */
-    displays = calloc((size_t)dspCount, sizeof(CGDirectDisplayID));
-    
-    // Get the list of active displays
-    err = CGGetActiveDisplayList(dspCount,
-                                 displays,
-                                 &dspCount);
-    
-    /* More error-checking here. */
-    if(err != CGDisplayNoErr)
-    {
-        NSLog(@"Could not get active display list (%d)\n", err);
-        return;
-    }
-    
-    NSMutableArray* foundSSUrls = [NSMutableArray array];
-    
-    CIDetector *detector = [CIDetector detectorOfType:@"CIDetectorTypeQRCode"
-                                              context:nil
-                                              options:@{ CIDetectorAccuracy:CIDetectorAccuracyHigh }];
-    
-    for (unsigned int displaysIndex = 0; displaysIndex < dspCount; displaysIndex++)
-    {
-        /* Make a snapshot image of the current display. */
-        CGImageRef image = CGDisplayCreateImage(displays[displaysIndex]);
-        NSArray *features = [detector featuresInImage:[CIImage imageWithCGImage:image]];
-        for (CIQRCodeFeature *feature in features) {
-            NSLog(@"%@", feature.messageString);
-            if ( [feature.messageString hasPrefix:@"ss://"] )
-            {
-                NSURL *url = [NSURL URLWithString:feature.messageString];
-                if (url) {
-                    [foundSSUrls addObject:url];
-                }
-            }
-        }
-         CGImageRelease(image);
-    }
-    
-    free(displays);
-    
-    [[NSNotificationCenter defaultCenter]
-     postNotificationName:@"NOTIFY_FOUND_SS_URL"
-     object:nil
-     userInfo: @{ @"urls": foundSSUrls,
-                  @"source": @"qrcode"
-                 }
-     ];
-}
-
-NSImage* createQRImage(NSString *string, NSSize size) {
-    NSImage *outputImage = [[NSImage alloc]initWithSize:size];
-    [outputImage lockFocus];
-    
-    // Setup the QR filter with our string
-    CIFilter *filter = [CIFilter filterWithName:@"CIQRCodeGenerator"];
-    [filter setDefaults];
-    
-    NSData *data = [string dataUsingEncoding:NSUTF8StringEncoding];
-    [filter setValue:data forKey:@"inputMessage"];
-    /*
-     L: 7%
-     M: 15%
-     Q: 25%
-     H: 30%
-     */
-    [filter setValue:@"Q" forKey:@"inputCorrectionLevel"];
-    
-    CIImage *image = [filter valueForKey:@"outputImage"];
-    
-    // Calculate the size of the generated image and the scale for the desired image size
-    CGRect extent = CGRectIntegral(image.extent);
-    CGFloat scale = MIN(size.width / CGRectGetWidth(extent), size.height / CGRectGetHeight(extent));
-    
-    CGImageRef bitmapImage = [NSGraphicsContext.currentContext.CIContext createCGImage:image fromRect:extent];
-    
-    CGContextRef graphicsContext = NSGraphicsContext.currentContext.CGContext;
-    
-    CGContextSetInterpolationQuality(graphicsContext, kCGInterpolationNone);
-    CGContextScaleCTM(graphicsContext, scale, scale);
-    CGContextDrawImage(graphicsContext, extent, bitmapImage);
-    
-    // Cleanup
-    CGImageRelease(bitmapImage);
-    
-    [outputImage unlockFocus];
-    return outputImage;
-}
diff --git a/ShadowsocksX-NG/Utils.swift b/ShadowsocksX-NG/Utils.swift
deleted file mode 100644
index 08956a1bc..000000000
--- a/ShadowsocksX-NG/Utils.swift
+++ /dev/null
@@ -1,38 +0,0 @@
-//
-//  Utils.swift
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/7.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-import Foundation
-
-extension String {
-    var localized: String {
-        return NSLocalizedString(self, tableName: "Localizable", comment: "")
-    }
-    
-    func localized(withComment:String) -> String {
-        return NSLocalizedString(self, tableName: "Localizable", comment: withComment)
-    }
-}
-
-extension Data {
-    func sha1() -> String {
-        let data = self
-        var digest = [UInt8](repeating: 0, count: Int(CC_SHA1_DIGEST_LENGTH))
-        CC_SHA1((data as NSData).bytes, CC_LONG(data.count), &digest)
-        let hexBytes = digest.map { String(format: "%02hhx", $0) }
-        return hexBytes.joined(separator: "")
-    }
-}
-
-enum ProxyType {
-    case pac
-    case global
-}
-
-struct Globals {
-    static var proxyType = ProxyType.pac
-}
diff --git a/ShadowsocksX-NG/abp.js b/ShadowsocksX-NG/abp.js
deleted file mode 100644
index 119c462ad..000000000
--- a/ShadowsocksX-NG/abp.js
+++ /dev/null
@@ -1,777 +0,0 @@
-// Generated by gfwlist2pac in precise mode
-// https://github.com/clowwindy/gfwlist2pac
-
-var proxy = "SOCKS5 __SOCKS5ADDR__:__SOCKS5PORT__; SOCKS __SOCKS5ADDR__:__SOCKS5PORT__; DIRECT;";
-
-var rules = __RULES__;
-
-/*
- * This file is part of Adblock Plus <http://adblockplus.org/>,
- * Copyright (C) 2006-2014 Eyeo GmbH
- *
- * Adblock Plus is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 3 as
- * published by the Free Software Foundation.
- *
- * Adblock Plus is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Adblock Plus.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-function createDict()
-{
-  var result = {};
-  result.__proto__ = null;
-  return result;
-}
-
-function getOwnPropertyDescriptor(obj, key)
-{
-  if (obj.hasOwnProperty(key))
-  {
-    return obj[key];
-  }
-  return null;
-}
-
-function extend(subclass, superclass, definition)
-{
-  if (Object.__proto__)
-  {
-    definition.__proto__ = superclass.prototype;
-    subclass.prototype = definition;
-  }
-  else
-  {
-    var tmpclass = function(){}, ret;
-    tmpclass.prototype = superclass.prototype;
-    subclass.prototype = new tmpclass();
-    subclass.prototype.constructor = superclass;
-    for (var i in definition)
-    {
-      if (definition.hasOwnProperty(i))
-      {
-        subclass.prototype[i] = definition[i];
-      }
-    }
-  }
-}
-
-function Filter(text)
-{
-  this.text = text;
-  this.subscriptions = [];
-}
-Filter.prototype = {
-text: null,
-subscriptions: null,
-toString: function()
-  {
-    return this.text;
-  }
-};
-Filter.knownFilters = createDict();
-Filter.elemhideRegExp = /^([^\/\*\|\@"!]*?)#(\@)?(?:([\w\-]+|\*)((?:\([\w\-]+(?:[$^*]?=[^\(\)"]*)?\))*)|#([^{}]+))$/;
-Filter.regexpRegExp = /^(@@)?\/.*\/(?:\$~?[\w\-]+(?:=[^,\s]+)?(?:,~?[\w\-]+(?:=[^,\s]+)?)*)?$/;
-Filter.optionsRegExp = /\$(~?[\w\-]+(?:=[^,\s]+)?(?:,~?[\w\-]+(?:=[^,\s]+)?)*)$/;
-Filter.fromText = function(text)
-{
-  if (text in Filter.knownFilters)
-  {
-    return Filter.knownFilters[text];
-  }
-  var ret;
-  if (text[0] == "!")
-  {
-    ret = new CommentFilter(text);
-  }
-  else
-  {
-    ret = RegExpFilter.fromText(text);
-  }
-  Filter.knownFilters[ret.text] = ret;
-  return ret;
-};
-
-function InvalidFilter(text, reason)
-{
-  Filter.call(this, text);
-  this.reason = reason;
-}
-extend(InvalidFilter, Filter, {
-       reason: null
-       });
-
-function CommentFilter(text)
-{
-  Filter.call(this, text);
-}
-extend(CommentFilter, Filter, {
-       });
-
-function ActiveFilter(text, domains)
-{
-  Filter.call(this, text);
-  this.domainSource = domains;
-}
-extend(ActiveFilter, Filter, {
-       domainSource: null,
-       domainSeparator: null,
-       ignoreTrailingDot: true,
-       domainSourceIsUpperCase: false,
-       getDomains: function()
-       {
-       var prop = getOwnPropertyDescriptor(this, "domains");
-       if (prop)
-       {
-       return prop;
-       }
-       var domains = null;
-       if (this.domainSource)
-       {
-       var source = this.domainSource;
-       if (!this.domainSourceIsUpperCase)
-       {
-       source = source.toUpperCase();
-       }
-       var list = source.split(this.domainSeparator);
-       if (list.length == 1 && list[0][0] != "~")
-       {
-       domains = createDict();
-       domains[""] = false;
-       if (this.ignoreTrailingDot)
-       {
-       list[0] = list[0].replace(/\.+$/, "");
-       }
-       domains[list[0]] = true;
-       }
-       else
-       {
-       var hasIncludes = false;
-       for (var i = 0; i < list.length; i++)
-       {
-       var domain = list[i];
-       if (this.ignoreTrailingDot)
-       {
-       domain = domain.replace(/\.+$/, "");
-       }
-       if (domain == "")
-       {
-       continue;
-       }
-       var include;
-       if (domain[0] == "~")
-       {
-       include = false;
-       domain = domain.substr(1);
-       }
-       else
-       {
-       include = true;
-       hasIncludes = true;
-       }
-       if (!domains)
-       {
-       domains = createDict();
-       }
-       domains[domain] = include;
-       }
-       domains[""] = !hasIncludes;
-       }
-       this.domainSource = null;
-       }
-       return this.domains;
-       },
-       sitekeys: null,
-       isActiveOnDomain: function(docDomain, sitekey)
-       {
-       if (this.getSitekeys() && (!sitekey || this.getSitekeys().indexOf(sitekey.toUpperCase()) < 0))
-       {
-       return false;
-       }
-       if (!this.getDomains())
-       {
-       return true;
-       }
-       if (!docDomain)
-       {
-       return this.getDomains()[""];
-       }
-       if (this.ignoreTrailingDot)
-       {
-       docDomain = docDomain.replace(/\.+$/, "");
-       }
-       docDomain = docDomain.toUpperCase();
-       while (true)
-       {
-       if (docDomain in this.getDomains())
-       {
-       return this.domains[docDomain];
-       }
-       var nextDot = docDomain.indexOf(".");
-       if (nextDot < 0)
-       {
-       break;
-       }
-       docDomain = docDomain.substr(nextDot + 1);
-       }
-       return this.domains[""];
-       },
-       isActiveOnlyOnDomain: function(docDomain)
-       {
-       if (!docDomain || !this.getDomains() || this.getDomains()[""])
-       {
-       return false;
-       }
-       if (this.ignoreTrailingDot)
-       {
-       docDomain = docDomain.replace(/\.+$/, "");
-       }
-       docDomain = docDomain.toUpperCase();
-       for (var domain in this.getDomains())
-       {
-       if (this.domains[domain] && domain != docDomain && (domain.length <= docDomain.length || domain.indexOf("." + docDomain) != domain.length - docDomain.length - 1))
-       {
-       return false;
-       }
-       }
-       return true;
-       }
-       });
-
-function RegExpFilter(text, regexpSource, contentType, matchCase, domains, thirdParty, sitekeys)
-{
-  ActiveFilter.call(this, text, domains, sitekeys);
-  if (contentType != null)
-  {
-    this.contentType = contentType;
-  }
-  if (matchCase)
-  {
-    this.matchCase = matchCase;
-  }
-  if (thirdParty != null)
-  {
-    this.thirdParty = thirdParty;
-  }
-  if (sitekeys != null)
-  {
-    this.sitekeySource = sitekeys;
-  }
-  if (regexpSource.length >= 2 && regexpSource[0] == "/" && regexpSource[regexpSource.length - 1] == "/")
-  {
-    var regexp = new RegExp(regexpSource.substr(1, regexpSource.length - 2), this.matchCase ? "" : "i");
-    this.regexp = regexp;
-  }
-  else
-  {
-    this.regexpSource = regexpSource;
-  }
-}
-extend(RegExpFilter, ActiveFilter, {
-       domainSourceIsUpperCase: true,
-       length: 1,
-       domainSeparator: "|",
-       regexpSource: null,
-       getRegexp: function()
-       {
-       var prop = getOwnPropertyDescriptor(this, "regexp");
-       if (prop)
-       {
-       return prop;
-       }
-       var source = this.regexpSource.replace(/\*+/g, "*").replace(/\^\|$/, "^").replace(/\W/g, "\\$&").replace(/\\\*/g, ".*").replace(/\\\^/g, "(?:[\\x00-\\x24\\x26-\\x2C\\x2F\\x3A-\\x40\\x5B-\\x5E\\x60\\x7B-\\x7F]|$)").replace(/^\\\|\\\|/, "^[\\w\\-]+:\\/+(?!\\/)(?:[^\\/]+\\.)?").replace(/^\\\|/, "^").replace(/\\\|$/, "$").replace(/^(\.\*)/, "").replace(/(\.\*)$/, "");
-       var regexp = new RegExp(source, this.matchCase ? "" : "i");
-       this.regexp = regexp;
-       return regexp;
-       },
-       contentType: 2147483647,
-       matchCase: false,
-       thirdParty: null,
-       sitekeySource: null,
-       getSitekeys: function()
-       {
-       var prop = getOwnPropertyDescriptor(this, "sitekeys");
-       if (prop)
-       {
-       return prop;
-       }
-       var sitekeys = null;
-       if (this.sitekeySource)
-       {
-       sitekeys = this.sitekeySource.split("|");
-       this.sitekeySource = null;
-       }
-       this.sitekeys = sitekeys;
-       return this.sitekeys;
-       },
-       matches: function(location, contentType, docDomain, thirdParty, sitekey)
-       {
-       if (this.getRegexp().test(location) && this.isActiveOnDomain(docDomain, sitekey))
-       {
-       return true;
-       }
-       return false;
-       }
-       });
-RegExpFilter.prototype["0"] = "#this";
-RegExpFilter.fromText = function(text)
-{
-  var blocking = true;
-  var origText = text;
-  if (text.indexOf("@@") == 0)
-  {
-    blocking = false;
-    text = text.substr(2);
-  }
-  var contentType = null;
-  var matchCase = null;
-  var domains = null;
-  var sitekeys = null;
-  var thirdParty = null;
-  var collapse = null;
-  var options;
-  var match = text.indexOf("$") >= 0 ? Filter.optionsRegExp.exec(text) : null;
-  if (match)
-  {
-    options = match[1].toUpperCase().split(",");
-    text = match.input.substr(0, match.index);
-    for (var _loopIndex6 = 0; _loopIndex6 < options.length; ++_loopIndex6)
-    {
-      var option = options[_loopIndex6];
-      var value = null;
-      var separatorIndex = option.indexOf("=");
-      if (separatorIndex >= 0)
-      {
-        value = option.substr(separatorIndex + 1);
-        option = option.substr(0, separatorIndex);
-      }
-      option = option.replace(/-/, "_");
-      if (option in RegExpFilter.typeMap)
-      {
-        if (contentType == null)
-        {
-          contentType = 0;
-        }
-        contentType |= RegExpFilter.typeMap[option];
-      }
-      else if (option[0] == "~" && option.substr(1) in RegExpFilter.typeMap)
-      {
-        if (contentType == null)
-        {
-          contentType = RegExpFilter.prototype.contentType;
-        }
-        contentType &= ~RegExpFilter.typeMap[option.substr(1)];
-      }
-      else if (option == "MATCH_CASE")
-      {
-        matchCase = true;
-      }
-      else if (option == "~MATCH_CASE")
-      {
-        matchCase = false;
-      }
-      else if (option == "DOMAIN" && typeof value != "undefined")
-      {
-        domains = value;
-      }
-      else if (option == "THIRD_PARTY")
-      {
-        thirdParty = true;
-      }
-      else if (option == "~THIRD_PARTY")
-      {
-        thirdParty = false;
-      }
-      else if (option == "COLLAPSE")
-      {
-        collapse = true;
-      }
-      else if (option == "~COLLAPSE")
-      {
-        collapse = false;
-      }
-      else if (option == "SITEKEY" && typeof value != "undefined")
-      {
-        sitekeys = value;
-      }
-      else
-      {
-        return new InvalidFilter(origText, "Unknown option " + option.toLowerCase());
-      }
-    }
-  }
-  if (!blocking && (contentType == null || contentType & RegExpFilter.typeMap.DOCUMENT) && (!options || options.indexOf("DOCUMENT") < 0) && !/^\|?[\w\-]+:/.test(text))
-  {
-    if (contentType == null)
-    {
-      contentType = RegExpFilter.prototype.contentType;
-    }
-    contentType &= ~RegExpFilter.typeMap.DOCUMENT;
-  }
-  try
-  {
-    if (blocking)
-    {
-      return new BlockingFilter(origText, text, contentType, matchCase, domains, thirdParty, sitekeys, collapse);
-    }
-    else
-    {
-      return new WhitelistFilter(origText, text, contentType, matchCase, domains, thirdParty, sitekeys);
-    }
-  }
-  catch (e)
-  {
-    return new InvalidFilter(origText, e);
-  }
-};
-RegExpFilter.typeMap = {
-OTHER: 1,
-SCRIPT: 2,
-IMAGE: 4,
-STYLESHEET: 8,
-OBJECT: 16,
-SUBDOCUMENT: 32,
-DOCUMENT: 64,
-XBL: 1,
-PING: 1,
-XMLHTTPREQUEST: 2048,
-OBJECT_SUBREQUEST: 4096,
-DTD: 1,
-MEDIA: 16384,
-FONT: 32768,
-BACKGROUND: 4,
-POPUP: 268435456,
-ELEMHIDE: 1073741824
-};
-RegExpFilter.prototype.contentType &= ~ (RegExpFilter.typeMap.ELEMHIDE | RegExpFilter.typeMap.POPUP);
-
-function BlockingFilter(text, regexpSource, contentType, matchCase, domains, thirdParty, sitekeys, collapse)
-{
-  RegExpFilter.call(this, text, regexpSource, contentType, matchCase, domains, thirdParty, sitekeys);
-  this.collapse = collapse;
-}
-extend(BlockingFilter, RegExpFilter, {
-       collapse: null
-       });
-
-function WhitelistFilter(text, regexpSource, contentType, matchCase, domains, thirdParty, sitekeys)
-{
-  RegExpFilter.call(this, text, regexpSource, contentType, matchCase, domains, thirdParty, sitekeys);
-}
-extend(WhitelistFilter, RegExpFilter, {
-       });
-
-function Matcher()
-{
-  this.clear();
-}
-Matcher.prototype = {
-filterByKeyword: null,
-keywordByFilter: null,
-clear: function()
-  {
-    this.filterByKeyword = createDict();
-    this.keywordByFilter = createDict();
-  },
-add: function(filter)
-  {
-    if (filter.text in this.keywordByFilter)
-    {
-      return;
-    }
-    var keyword = this.findKeyword(filter);
-    var oldEntry = this.filterByKeyword[keyword];
-    if (typeof oldEntry == "undefined")
-    {
-      this.filterByKeyword[keyword] = filter;
-    }
-    else if (oldEntry.length == 1)
-    {
-      this.filterByKeyword[keyword] = [oldEntry, filter];
-    }
-    else
-    {
-      oldEntry.push(filter);
-    }
-    this.keywordByFilter[filter.text] = keyword;
-  },
-remove: function(filter)
-  {
-    if (!(filter.text in this.keywordByFilter))
-    {
-      return;
-    }
-    var keyword = this.keywordByFilter[filter.text];
-    var list = this.filterByKeyword[keyword];
-    if (list.length <= 1)
-    {
-      delete this.filterByKeyword[keyword];
-    }
-    else
-    {
-      var index = list.indexOf(filter);
-      if (index >= 0)
-      {
-        list.splice(index, 1);
-        if (list.length == 1)
-        {
-          this.filterByKeyword[keyword] = list[0];
-        }
-      }
-    }
-    delete this.keywordByFilter[filter.text];
-  },
-findKeyword: function(filter)
-  {
-    var result = "";
-    var text = filter.text;
-    if (Filter.regexpRegExp.test(text))
-    {
-      return result;
-    }
-    var match = Filter.optionsRegExp.exec(text);
-    if (match)
-    {
-      text = match.input.substr(0, match.index);
-    }
-    if (text.substr(0, 2) == "@@")
-    {
-      text = text.substr(2);
-    }
-    var candidates = text.toLowerCase().match(/[^a-z0-9%*][a-z0-9%]{3,}(?=[^a-z0-9%*])/g);
-    if (!candidates)
-    {
-      return result;
-    }
-    var hash = this.filterByKeyword;
-    var resultCount = 16777215;
-    var resultLength = 0;
-    for (var i = 0, l = candidates.length; i < l; i++)
-    {
-      var candidate = candidates[i].substr(1);
-      var count = candidate in hash ? hash[candidate].length : 0;
-      if (count < resultCount || count == resultCount && candidate.length > resultLength)
-      {
-        result = candidate;
-        resultCount = count;
-        resultLength = candidate.length;
-      }
-    }
-    return result;
-  },
-hasFilter: function(filter)
-  {
-    return filter.text in this.keywordByFilter;
-  },
-getKeywordForFilter: function(filter)
-  {
-    if (filter.text in this.keywordByFilter)
-    {
-      return this.keywordByFilter[filter.text];
-    }
-    else
-    {
-      return null;
-    }
-  },
-_checkEntryMatch: function(keyword, location, contentType, docDomain, thirdParty, sitekey)
-  {
-    var list = this.filterByKeyword[keyword];
-    for (var i = 0; i < list.length; i++)
-    {
-      var filter = list[i];
-      if (filter == "#this")
-      {
-        filter = list;
-      }
-      if (filter.matches(location, contentType, docDomain, thirdParty, sitekey))
-      {
-        return filter;
-      }
-    }
-    return null;
-  },
-matchesAny: function(location, contentType, docDomain, thirdParty, sitekey)
-  {
-    var candidates = location.toLowerCase().match(/[a-z0-9%]{3,}/g);
-    if (candidates === null)
-    {
-      candidates = [];
-    }
-    candidates.push("");
-    for (var i = 0, l = candidates.length; i < l; i++)
-    {
-      var substr = candidates[i];
-      if (substr in this.filterByKeyword)
-      {
-        var result = this._checkEntryMatch(substr, location, contentType, docDomain, thirdParty, sitekey);
-        if (result)
-        {
-          return result;
-        }
-      }
-    }
-    return null;
-  }
-};
-
-function CombinedMatcher()
-{
-  this.blacklist = new Matcher();
-  this.whitelist = new Matcher();
-  this.resultCache = createDict();
-}
-CombinedMatcher.maxCacheEntries = 1000;
-CombinedMatcher.prototype = {
-blacklist: null,
-whitelist: null,
-resultCache: null,
-cacheEntries: 0,
-clear: function()
-  {
-    this.blacklist.clear();
-    this.whitelist.clear();
-    this.resultCache = createDict();
-    this.cacheEntries = 0;
-  },
-add: function(filter)
-  {
-    if (filter instanceof WhitelistFilter)
-    {
-      this.whitelist.add(filter);
-    }
-    else
-    {
-      this.blacklist.add(filter);
-    }
-    if (this.cacheEntries > 0)
-    {
-      this.resultCache = createDict();
-      this.cacheEntries = 0;
-    }
-  },
-remove: function(filter)
-  {
-    if (filter instanceof WhitelistFilter)
-    {
-      this.whitelist.remove(filter);
-    }
-    else
-    {
-      this.blacklist.remove(filter);
-    }
-    if (this.cacheEntries > 0)
-    {
-      this.resultCache = createDict();
-      this.cacheEntries = 0;
-    }
-  },
-findKeyword: function(filter)
-  {
-    if (filter instanceof WhitelistFilter)
-    {
-      return this.whitelist.findKeyword(filter);
-    }
-    else
-    {
-      return this.blacklist.findKeyword(filter);
-    }
-  },
-hasFilter: function(filter)
-  {
-    if (filter instanceof WhitelistFilter)
-    {
-      return this.whitelist.hasFilter(filter);
-    }
-    else
-    {
-      return this.blacklist.hasFilter(filter);
-    }
-  },
-getKeywordForFilter: function(filter)
-  {
-    if (filter instanceof WhitelistFilter)
-    {
-      return this.whitelist.getKeywordForFilter(filter);
-    }
-    else
-    {
-      return this.blacklist.getKeywordForFilter(filter);
-    }
-  },
-isSlowFilter: function(filter)
-  {
-    var matcher = filter instanceof WhitelistFilter ? this.whitelist : this.blacklist;
-    if (matcher.hasFilter(filter))
-    {
-      return !matcher.getKeywordForFilter(filter);
-    }
-    else
-    {
-      return !matcher.findKeyword(filter);
-    }
-  },
-matchesAnyInternal: function(location, contentType, docDomain, thirdParty, sitekey)
-  {
-    var candidates = location.toLowerCase().match(/[a-z0-9%]{3,}/g);
-    if (candidates === null)
-    {
-      candidates = [];
-    }
-    candidates.push("");
-    var blacklistHit = null;
-    for (var i = 0, l = candidates.length; i < l; i++)
-    {
-      var substr = candidates[i];
-      if (substr in this.whitelist.filterByKeyword)
-      {
-        var result = this.whitelist._checkEntryMatch(substr, location, contentType, docDomain, thirdParty, sitekey);
-        if (result)
-        {
-          return result;
-        }
-      }
-      if (substr in this.blacklist.filterByKeyword && blacklistHit === null)
-      {
-        blacklistHit = this.blacklist._checkEntryMatch(substr, location, contentType, docDomain, thirdParty, sitekey);
-      }
-    }
-    return blacklistHit;
-  },
-matchesAny: function(location, docDomain)
-  {
-    var key = location + " " + docDomain + " ";
-    if (key in this.resultCache)
-    {
-      return this.resultCache[key];
-    }
-    var result = this.matchesAnyInternal(location, 0, docDomain, null, null);
-    if (this.cacheEntries >= CombinedMatcher.maxCacheEntries)
-    {
-      this.resultCache = createDict();
-      this.cacheEntries = 0;
-    }
-    this.resultCache[key] = result;
-    this.cacheEntries++;
-    return result;
-  }
-};
-var defaultMatcher = new CombinedMatcher();
-
-var direct = 'DIRECT;';
-
-for (var i = 0; i < rules.length; i++) {
-  defaultMatcher.add(Filter.fromText(rules[i]));
-}
-
-function FindProxyForURL(url, host) {
-  if (defaultMatcher.matchesAny(url, host) instanceof BlockingFilter) {
-    return proxy;
-  }
-  return direct;
-}
diff --git a/ShadowsocksX-NG/fix_dir_owner.sh b/ShadowsocksX-NG/fix_dir_owner.sh
deleted file mode 100755
index 60f0fa570..000000000
--- a/ShadowsocksX-NG/fix_dir_owner.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/sh
-
-#  fix_dir_owner.sh
-#  ShadowsocksX-NG
-#
-#  Created by 邱宇舟 on 2017/8/25.
-#  Copyright © 2017年 qiuyuzhou. All rights reserved.
-
-
-LAUNCH_AGENTS_DIR="$HOME/Library/LaunchAgents"
-sudo chown $@ "$HOME/Library/LaunchAgents"
-
diff --git a/ShadowsocksX-NG/gfwlist.txt b/ShadowsocksX-NG/gfwlist.txt
deleted file mode 100644
index ba9395033..000000000
--- a/ShadowsocksX-NG/gfwlist.txt
+++ /dev/null
@@ -1,2921 +0,0 @@
-W0F1dG9Qcm94eSAwLjIuOV0KISBDaGVja3N1bTogVVFhQ0k0RnJ4SngxR3FVcXlq
-U3FCdwohIEV4cGlyZXM6IDZoCiEgVGl0bGU6IEdGV0xpc3Q0TEwKISBHRldMaXN0
-IHdpdGggRVZFUllUSElORyBpbmNsdWRlZAohIExhc3QgTW9kaWZpZWQ6IEZyaSwg
-MDkgQXVnIDIwMTkgMDE6MTE6MTYgLTA0MDAKIQohIEhvbWVQYWdlOiBodHRwczov
-L2dpdGh1Yi5jb20vZ2Z3bGlzdC9nZndsaXN0CiEgTGljZW5zZTogaHR0cHM6Ly93
-d3cuZ251Lm9yZy9saWNlbnNlcy9vbGQtbGljZW5zZXMvbGdwbC0yLjEudHh0CiEK
-ISBHRldMaXN0IGlzIHVubGlrZWx5IHRvIGZ1bGx5IGNvbXByaXNlIHRoZSByZWFs
-CiEgcnVsZXMgYmVpbmcgZGVwbG95ZWQgaW5zaWRlIEdGVyBzeXN0ZW0uIFdlIHRy
-eQohIG91ciBiZXN0IHRvIGtlZXAgdGhlIGxpc3QgdXAgdG8gZGF0ZS4gUGxlYXNl
-CiEgY29udGFjdCB1cyByZWdhcmRpbmcgVVJMIHN1Ym1pc3Npb24gLyByZW1vdmFs
-LAohIG9yIHN1Z2dlc3Rpb24gLyBlbmhhbmNlbWVudCBhdCBpc3N1ZSB0cmFja2Vy
-OgohIGh0dHBzOi8vZ2l0aHViLmNvbS9nZndsaXN0L2dmd2xpc3QvaXNzdWVzLy4K
-CiEtLS0tLS0tLS00MDMvNDUxLzUyMCAmIFVSTCBSZWRpcmVjdHMtLS0tLS0tLS0K
-IS0tZWhlbnRhaQp8aHR0cDovLzg1LjE3LjczLjMxLwohLS18fGFkb3JhbWEuY29t
-Cnx8YWduZXNiLmZyCnx8YWtpYmEtd2ViLmNvbQp8fGFsdHJlYy5jb20KfHxhbmdl
-bGEtbWVya2VsLmRlCnx8YW5nb2xhLm9yZwp8fGFwYXJ0bWVudHJhdGluZ3MuY29t
-Cnx8YXBhcnRtZW50cy5jb20KfHxhcmVuYS50YWlwZWkKfHxhc2lhbnNwaXNzLmNv
-bQp8fGFzc2ltcC5vcmcKfHxhdGhlbmFlaXpvdS5jb20KfHxhenVidS50dgp8fGJh
-bmttb2JpbGV2aWJlLmNvbQp8fGJhbm9ydGUuY29tCnx8YmFzaC1oYWNrZXJzLm9y
-Zwp8fGJlZWcuY29tCnx8Z2xvYmFsLmJpbmcuY29tCnx8Ymxvb21iZXJndmlldy5j
-b20KfHxib29rdG9waWEuY29tLmF1Cnx8Ym95c21hc3Rlci5jb20KfHxieW5ldC5j
-by5pbAp8fGNhcmZheC5jb20KLmNhc2lub2JlbGxpbmkuY29tCnx8Y2FzaW5vYmVs
-bGluaS5jb20KfHxjZW50YXVyby5jb20uYnIKfHxjaG9iaXQuY2MKfHxjbGVhcnN1
-cmFuY2UuY29tCnx8aW1hZ2VzLmNvbWljby50dwp8fHN0YXRpYy5jb21pY28udHcK
-fHxjb3VudGVyLnNvY2lhbAp8fGNvc3Rjby5jb20KfHxjcm9zc2ZpcmUuY28ua3IK
-fHxkMnBhc3MuY29tCnx8ZGFycGEubWlsCnx8ZGF3YW5naWRjLmNvbQp8fGRlZXpl
-ci5jb20KfHxkZXNpcHJvLmRlCnx8ZGluZ2NoaW4uY29tLnR3Cnx8ZGlzY29yZGFw
-cC5jb20KfHxkaXNjb3JkYXBwLm5ldAp8fGRpc2guY29tCnxodHRwOi8vaW1nLmRs
-c2l0ZS5qcC8KfHxkbTUzMC5uZXQKc2hhcmUuZG1oeS5vcmcKQEB8aHR0cHM6Ly9z
-aGFyZS5kbWh5Lm9yZwp8fGRtbS5jby5qcAp8aHR0cDovL3d3dy5kbW0uY29tL25l
-dGdhbWUKfHxkbnZvZC50dgp8fGR2ZHBhYy5jb20KfHxlZXN0aS5lZQp8fGVzdXJh
-bmNlLmNvbQouZXhwZWt0LmNvbQp8fGV4cGVrdC5jb20KLmV4dG1hdHJpeC5jb20K
-fHxleHRtYXRyaXguY29tCnx8ZmFra3UubmV0Cnx8ZmFzdHBpYy5ydQp8fGZpbGVz
-b3IuY29tCnx8ZmluYW5jZXR3aXR0ZXIuY29tCnx8ZmxpcGJvYXJkLmNvbQp8fGZs
-aXR0by5jb20KfHxmbmFjLmJlCnx8Zm5hYy5jb20KfHxmdW5reWltZy5jb20KfHxm
-eG5ldHdvcmtzLmNvbQp8fGctYXJlYS5vcmcKfHxnZXR0eWltYWdlcy5jb20KfHxn
-ZXR1cGxvYWRlci5jb20KIS0tfGh0dHBzOi8vZ2l0aHViLmNvbS9wcm9ncmFtdGhp
-bmsvemhhbwp8aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL3Byb2dy
-YW10aGluay96aGFvCnx8Z2xhc3M4LmV1Cnx8Z2x5cGUuY29tCnx8Z28xNDEuY29t
-Cnx8Z3VvLm1lZGlhCnx8aGF1dGVsb29rLmNvbQp8fGhhdXRlbG9va2Nkbi5jb20K
-fHx3ZWdvLmhlcmUuY29tCnx8Z2FtZXItY2RzLmNkbi5oaW5ldC5uZXQKfHxnYW1l
-cjItY2RzLmNkbi5oaW5ldC5uZXQKfHxobXZkaWdpdGFsLmNhCnx8aG12ZGlnaXRh
-bC5jb20KfHxob21lZGVwb3QuY29tCnx8aG9vdmVycy5jb20KfHxodWx1LmNvbQp8
-fGh1bHVpbS5jb20KfGh0dHA6Ly9zZWN1cmUuaHVzdGxlci5jb20KfGh0dHA6Ly9o
-dXN0bGVyY2FzaC5jb20KfGh0dHA6Ly93d3cuaHVzdGxlcmNhc2guY29tCnx8aHli
-cmlkLWFuYWx5c2lzLmNvbQp8fGNkbiouaS1zY21wLmNvbQp8fGlsb3ZlbG9uZ3Rv
-ZXMuY29tCnxodHRwOi8vaW1nbWVnYS5jb20vKi5naWYuaHRtbAp8aHR0cDovL2lt
-Z21lZ2EuY29tLyouanBnLmh0bWwKfGh0dHA6Ly9pbWdtZWdhLmNvbS8qLmpwZWcu
-aHRtbAp8aHR0cDovL2ltZ21lZ2EuY29tLyoucG5nLmh0bWwKfHxpbWxpdmUuY29t
-Cnx8dHcuaXFpeWkuY29tCnx8amF2aHViLm5ldAp8fGphdmh1Z2UuY29tCi5qYXZs
-aWJyYXJ5LmNvbQp8fGphdmxpYnJhcnkuY29tCnx8amNwZW5uZXkuY29tCnx8amlt
-cy5uZXQKfHxqdWt1am8tY2x1Yi5jb20KfHxqdWxpZXBvc3QuY29tCnx8a2F3YWlp
-a2F3YWlpLmpwCnx8a2VuZGF0aXJlLmNvbQp8fGtoYXRyaW1hemEub3JnCnx8a2ti
-b3guY29tCnx8bGVpc3VyZXByby5jb20KfHxsaWZlbWlsZXMuY29tCnx8bG9uZ3Rv
-ZXMuY29tCnx8bG92ZXR2c2hvdy5jb20KfGh0dHA6Ly93d3cubS1zcG9ydC5jby51
-awp8fG1hY2dhbWVzdG9yZS5jb20KfHxtYWRvbm5hLWF2LmNvbQp8fG1hbmdhZm94
-LmNvbQp8fG1hbmdhZm94Lm1lCnx8bWFudGEuY29tCnx8bWF0b21lLXBsdXMuY29t
-Cnx8bWF0b21lLXBsdXMubmV0Cnx8bWF0dHdpbGNveC5uZXQKfHxtZXRhcnRodW50
-ZXIuY29tCnx8bWZ4bWVkaWEuY29tCnx8bW9qaW0uY29tCnx8a2IubW9uaXRvcndh
-cmUuY29tCnx8bW9uc3Rlci5jb20KfHxtb29keXouY29tCnx8bW9vbmJpbmdvLmNv
-bQp8fG1vcy5ydQp8fG1zaGEuZ292Cnx8bXV6dS50dgp8fG12Zy5qcAoubXliZXQu
-Y29tCnx8bXliZXQuY29tCnx8bmF0aW9ud2lkZS5jb20KfGh0dHA6Ly93d3cubmJj
-LmNvbS9saXZlCnx8bmVvLW1pcmFjbGUuY29tCnx8bmV0ZmxpeC5jb20KfHxuZmx4
-aW1nLmNvbQp8fG5mbHhpbWcubmV0Cnx8bmZseGV4dC5jb20KfHxuZmx4c28ubmV0
-Cnx8bmZseHZpZGVvLm5ldAp8fG5pYy5nb3YKfGh0dHA6Ly9tby5uaWdodGxpZmUx
-NDEuY29tCnx8bm9yZHN0cm9tLmNvbQp8fG5vcmRzdHJvbWltYWdlLmNvbQp8fG5v
-cmRzdHJvbXJhY2suY29tCnx8bm90dGluZ2hhbXBvc3QuY29tCnx8bnBzYm9vc3Qu
-Y29tCnx8bnRkdHYuY3oKfHxzMS5udWRlenouY29tCnx8bnVzYXRyaXAuY29tCnx8
-bnV1dmVtLmNvbQp8fG9tbmk3LmpwCnx8b25hcHAuY29tCiEtLVdlIGFyZSBjb25m
-dXNlZCBhcyB3ZWxsCnx8b250cmFjLmNvbQpAQHxodHRwOi8vYmxvZy5vbnRyYWMu
-Y29tCnx8cGFuZG9yYS5jb20KLnBhbmRvcmEudHYKfHxwYXJrYW5za3kuY29tCnx8
-cGhtc29jaWV0eS5vcmcKfGh0dHA6Ly8qLnBpbWcudHcvCnx8cHVyZTE4LmNvbQp8
-fHB5dG9yY2gub3JnCnx8cXEuY28uemEKfHxyMTguY29tCnxodHRwOi8vcmFkaWtv
-LmpwCnx8cmFtY2l0eS5jb20uYXUKfHxyZC5jb20KfHxyZGlvLmNvbQp8aHR0cHM6
-Ly9yaXNldXAubmV0Cnx8c2FkaXN0aWMtdi5jb20KfHxpc2Muc2Fucy5lZHUKfGh0
-dHA6Ly9jZG4qLnNlYXJjaC54eHgvCnx8c2hpa3NoYS5jb20KfHxzbGFja2VyLmNv
-bQp8fHNtLW1pcmFjbGUuY29tCnx8c295bGVudG5ld3Mub3JnCnx8c3BvdGlmeS5j
-b20KfHxzcHJlYWRzaGlydC5lcwp8fHNwcmluZ2JvYXJkcGxhdGZvcm0uY29tCnx8
-c3ByaXRlLm9yZwpAQHxodHRwOi8vc3RvcmUuc3ByaXRlLm9yZwp8fHN1cGVyb2th
-eWFtYS5jb20KfHxzdXBlcnBhZ2VzLmNvbQp8fHN3YWdidWNrcy5jb20KfHxzd2l0
-Y2gxLmpwCnx8dGFwYW53YXAuY29tCnx8Z3NwLnRhcmdldC5jb20KfHxsb2dpbi50
-YXJnZXQuY29tCiEtLUBAfHxpbnRsLnRhcmdldC5jb20KfHxyY2FtLnRhcmdldC5j
-b20KfHx0aGlua2dlZWsuY29tCnx8dGhlYm9keXNob3AtdXNhLmNvbQp8fHRtYS5j
-by5qcAp8fHRyYWNmb25lLmNvbQp8fHRyeWhlYXJ0LmpwCnx8dHVybnRhYmxlLmZt
-Cnx8dHdlcmtpbmdidXR0LmNvbQp8fHVsb3AubmV0Cnx8dXVrYW5zaHUuY29tCnx8
-dmVnYXNyZWQuY29tCnx8dmV2by5jb20KfHx2aXAtZW50ZXJwcmlzZS5jb20KfGh0
-dHA6Ly92aXUudHYvY2gvCnxodHRwOi8vdml1LnR2L2VuY29yZS8KfHx2bXBzb2Z0
-LmNvbQp8aHR0cDovL2Vjc20udnMuY29tLwp8fHdhbnotZmFjdG9yeS5jb20KfHxz
-c2wud2VicGFjay5kZQp8fHdoZXJldG93YXRjaC5jb20KfHx3aW5nYW1lc3RvcmUu
-Y29tCnx8d2l6Y3JhZnRzLm5ldAp8fHZvZC53d2UuY29tCnx8eGZpbml0eS5jb20K
-fHx5b3V3aW4uY29tCnx8eXRuLmNvLmtyCnx8emF0dG9vLmNvbQp8fHppbS52bgp8
-fHpvem90b3duLmNvbQoKISMjIyMjIyMjIyMjIyMjR2VuZXJhbCBMaXN0IFN0YXJ0
-IyMjIyMjIyMjIyMjIyMjCiEtLS0tLS0tLS0tLS0tLS0tLS0tUHVyZSBJUC0tLS0t
-LS0tLS0tLS0tLS0tLS0tLQoxNC4xMDIuMjUwLjE4CjE0LjEwMi4yNTAuMTkKNTAu
-Ny4zMS4yMzA6ODg5OAoxNzQuMTQyLjEwNS4xNTMKNjkuNjUuMTkuMTYwCgohLS0t
-LS0tLS0tLS0tLS0tLS0tLS0tLUlETi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KfHx4
-bi0tNGdxMTcxcC5jb20KfHx4bi0tY3pxNzVwdnYxYWo1Yy5vcmcKfHx4bi0taTJy
-dThxMnFnLmNvbQp8fHhuLS1vaXEuY2MKfHx4bi0tcDhqOWEwZDljOWEueG4tLXE5
-anliNGMKCiEtLS0tLS0tLS0tLS0tLS0tLUROUyBQb2lzb25pbmctLS0tLS0tLS0t
-LS0tLS0tLQohLS0tQW1hem9uLS0tCiEtfHxjZG4taW1hZ2VzLm1haWxjaGltcC5j
-b20KfHxhYmVib29rcy5jb20KfGh0dHBzOi8vKi5zMy5hbWF6b25hd3MuY29tCnx8
-czMtYXAtc291dGhlYXN0LTIuYW1hem9uYXdzLmNvbQoKfHw0MzExMC5jZgp8fDln
-YWcuY29tCnx8YWdyby5oawp8fHNoYXJlLmFtZXJpY2EuZ292Cnx8YXBrbWlycm9y
-LmNvbQp8fGFydGUudHYKfHxhcnRzdGF0aW9uLmNvbQp8fGJhbmdkcmVhbS5zcGFj
-ZQp8fGJlaGFuY2UubmV0Cnx8YmlyZC5zbwp8fHpoLmJpdHRlcndpbnRlci5vcmcK
-fHxibm4uY28KfHxidXNpbmVzc2luc2lkZXIuY29tCnx8Ym9vbXNzci5jb20KfHxi
-d2d5aHcuY29tCnx8Y2FzdGJveC5mbQp8fGNoaW5hdGltZXMuY29tCnx8Y2x5cC5p
-dAp8fGNtY24ub3JnCnx8Y214LmltCnx8ZGFpbHl2aWV3LnR3Cnx8ZGF1bS5uZXQK
-fHxkZXBvc2l0cGhvdG9zLmNvbQp8fGRpc2Nvbm5lY3QubWUKfHxkb3ViaWJhY2t1
-cC5jb20KfHxkb3VibWlycm9yLmNmCnx8ZW5jeWNsb3BlZGlhLmNvbQp8fGZhbmdl
-cWlhbmcuY29tCnx8Y2xvdWQuZmVlZGx5LmNvbQp8fGZseXp5MjAwNS5jb20KfHxm
-b3JlaWducG9saWN5LmNvbQp8fGZyZWUtc3Muc2l0ZQp8fGJsb2cuZnVja2dmdzIz
-My5vcmcKfHxnMHYuc29jaWFsCnx8Z2xvYmFsdm9pY2VzLm9yZwp8fGdsb3J5c3Rh
-ci5tZQp8fGdvcmVncmlzaC5jb20KfHxoYm8uY29tCnx8c3BhY2VzLmhpZ2h0YWls
-LmNvbQp8fGhrZ2FsZGVuLmNvbQp8fGhrZ29sZGVuLmNvbQp8fGh1ZHNvbi5vcmcK
-fHxpcGZzLmlvCnx8amFwYW50aW1lcy5jby5qcAp8fGppamkuY29tCnx8amludGlh
-bi5uZXQKfHxqaW54LmNvbQp8fGpvaW5tYXN0b2Rvbi5vcmcKfHxsaWFuZ3poaWNo
-dWFubWVpLmNvbQp8fGxpZ2h0aS5tZQp8fGxpaGtnLmNvbQp8fGxpbmUtc2Nkbi5u
-ZXQKfHxpLmxpdGhpdW0uY29tCnx8Y2xvdWQubWFpbC5ydQp8fGNkbi1pbWFnZXMu
-bWFpbGNoaW1wLmNvbQp8fG1hc3RvZG9uLmNsb3VkCnx8bWFzdG9kb24uaG9zdAp8
-fG1hc3RvZG9uLnNvY2lhbAp8fG1hdHRlcnMubmV3cwp8fG1lLm1lCnx8bWV0YXJ0
-LmNvbQp8fG1vaHUuY2x1Ygp8fG1vaHUubWwKfHxtb3RpeXVuLmNvbQp8fG1zYS1p
-dC5vcmcKfHxkaWN0aW9uYXJ5Lmdvby5uZS5qcAp8fGdvLm5lc25vZGUuY29tCnx8
-aW50ZXJuYXRpb25hbC1uZXdzLm5ld3NtYWdhemluZS5hc2lhCnx8bmlra2VpLmNv
-bQp8fG5pdS5tb2UKfHxub2ZpbGUuaW8KfHxub3cuY29tCnx8c3VrZWJlaS5ueWFh
-LnNpCnx8b3BlbnZwbi5vcmcKfHxvbmVqYXYuY29tCnx8cGFzdGUuZWUKfHxteS5w
-Y2xvdWQuY29tCnx8cGljYWNvbWljLmNvbQp8fHBpbmNvbmcucm9ja3MKfHxwaXhp
-di5uZXQKfHxwb3RhdG8uaW0KfHxwcmVtcHJveHkuY29tCnx8cHJpc20tYnJlYWsu
-b3JnCnx8cHJvdG9udnBuLmNvbQp8fGFwaS5wdXJlYXBrLmNvbQp8fHF1b3JhLmNv
-bQp8fHF1b3JhY2RuLm5ldAp8fGNkbi5zZWF0Z3VydS5jb20KfHxzZWN1cmUucmF4
-Y2RuLmNvbQp8fHJlZGQuaXQKfHxyZWRkaXQuY29tCi5yZWRkaXRsaXN0LmNvbQp8
-aHR0cDovL3JlZGRpdGxpc3QuY29tCnx8cmVkZGl0bWVkaWEuY29tCnx8cmVkZGl0
-c3RhdGljLmNvbQp8fHJpeGNsb3VkLmNvbQp8fHJpeGNsb3VkLnVzCnx8cnNkbG1v
-bml0b3IuY29tCnx8c2hhZG93c29ja3MuYmUKfHxzaGFkb3dzb2NrczkuY29tCnx8
-dG4xLnNoZW1hbGV6LmNvbQp8fHRuMi5zaGVtYWxlei5jb20KfHx0bjMuc2hlbWFs
-ZXouY29tCnx8c3RhdGljLnNoZW1hbGV6LmNvbQp8fHNpeC1kZWdyZWVzLmlvCnx8
-c29mdGZhbW91cy5jb20KfHxzb2Z0c21pcnJvci5jZgp8fHNvc3JlYWRlci5jb20K
-fHxzc3BhbmVsLm5ldAp8fHN1bGlhbi5tZQp8fHN1cGNoaW5hLmNvbQp8fHRlZGR5
-c3VuLmNvbQp8fHRleHRub3cubWUKfHx0aW5leWUuY29tCnx8dG9wMTB2cG4uY29t
-Cnx8dHViZXBvcm5jbGFzc2ljLmNvbQp8fHVrdS5pbQp8fHVuc2Vlbi5pcwp8fGNu
-LnVwdG9kb3duLmNvbQp8fHVyYWJhbi5tZQp8fHZyc21hc2guY29tCnx8dnVsdHJ5
-aHcuY29tCnx8c2NhY2hlLnZ6dy5jb20KfHxzY2FjaGUxLnZ6dy5jb20KfHxzY2Fj
-aGUyLnZ6dy5jb20KfHxzczcudnp3LmNvbQp8fHNzci50b29scwp8fHN0ZWVtaXQu
-Y29tCnx8dGFpd2FuanVzdGljZS5uZXQKfHx0aW5jLXZwbi5vcmcKfHx3ZW56aGFv
-LmNhCnx8d2hhdHNvbndlaWJvLmNvbQp8fHdpcmUuY29tCnx8YmxvZy53b3JrZmxv
-dy5pcwp8fHhtLmNvbQp8fHh1ZWh1YS51cwp8fHllcy1uZXdzLmNvbQp8fHlvdS1n
-ZXQub3JnCnx8enpjbG91ZC5tZQoKIS0tLURpZ2l0YWwgQ3VycmVuY3kgRXhjaGFu
-Z2UoQ1JZUFRPKS0tLQp8fGFleC5jb20KfHxhbGxjb2luLmNvbQp8fGFkY2V4LmNv
-bQp8fGJjZXguY2EKfHxiaWJveC5jb20KfHxiaWcub25lCnx8YmluYW5jZS5jb20K
-fHxiaXQtei5jb20KfHxiaXRjb2lud29ybGQuY29tCnx8Yml0ZmluZXguY29tCnx8
-Yml0aHVtYi5jb20KfHxiaXRpbmthLmNvbS5hcgp8fGJpdG1leC5jb20KfHxidGM5
-OC5jb20KfHxidGNiYW5rLmJhbmsKfHxidGN0cmFkZS5pbQp8fGMyY3guY29tCnx8
-Y2hhb2V4LmNvbQp8fGNvYmluaG9vZC5jb20KfHxjb2luMmNvLmluCnx8Y29pbmJl
-bmUuY29tCi5jb2luZWdnLmNvbQp8fGNvaW5lZ2cuY29tCnx8Y29pbmV4LmNvbQoh
-LS18aHR0cHM6Ly93d3cuY29pbmV4Y2hhbmdlLmlvLwp8fGNvaW5naS5jb20KfHxj
-b2lucmFpbC5jby5rcgp8fGNvaW50aWdlci5jb20KfHxjb2ludG9iZS5jb20KfHxj
-b2ludXQuY29tCnx8ZGlzY29pbnMuY29tCnx8ZHJhZ29uZXguaW8KfHxlYnRjYmFu
-ay5jb20KfHxldGhlcmRlbHRhLmNvbQp8fGV4bW8uY29tCnx8ZXhyYXRlcy5tZQp8
-fGV4eC5jb20KfHxmYXRidGMuY29tCnx8Z2F0ZS5pbwp8fGdhdGVjb2luLmNvbQp8
-fGhiZy5jb20KfHxoaXRidGMuY29tCnx8aHVvYmkuY29tCnx8aHVvYmkucHJvCnx8
-aHVvYmlwcm8uY29tCnx8YnguaW4udGgKfHxqZXguY29tCnx8a2V4LmNvbQp8fGtz
-cGNvaW4uY29tCnx8a3Vjb2luLmNvbQp8fGxiYW5rLmluZm8KfHxsaXZlY29pbi5u
-ZXQKfHxsb2NhbGJpdGNvaW5zLmNvbQp8fG1lcmNhdG94LmNvbQp8fG9leC5jb20K
-fHxva2V4LmNvbQp8fG90Y2J0Yy5jb20KfHxyaWdodGJ0Yy5jb20KfHx0b3BidGMu
-Y29tCnx8eGJ0Y2UuY29tCnx8eW9iaXQubmV0Cnx8emIuY29tCgohLS0tLS0tLS0t
-LS0tLS0tLUZyYXVkcyAmIFNjYW1zLS0tLS0tLS0tLS0tLS0tLS0KISEtLS1Db250
-ZW50IEZhcm0oZmFrZSA1MDAgZXJyb3IpLS0tCnx8cmVhZDAxLmNvbQp8fGtrbmV3
-cy5jYwoKY2hpbmEtbW1tLmpwLm5ldAoubHN4c3p6Zy5jb20KLmNoaW5hLW1tbS5u
-ZXQKfHxjaGluYS1tbW0ubmV0CmNoaW5hLW1tbS5zYS5jb20KCiEtLS0tLS0tLS0t
-LS0tLS0tLS0tLS1Hcm91cHMtLS0tLS0tLS0tLS0tLS0tLS0tLQohIS0tLUFmcmFp
-ZCBGcmVlRE5TLS0tCi5hbGxvd2VkLm9yZwoubm93LmltCgohIS0tLUFtYXpvbi0t
-LQp8fGFtYXpvbi5jby5qcAouYW1hem9uLmNvbS9EYWxhaS1MYW1hCmFtYXpvbi5j
-b20vUHJpc29uZXItU3RhdGUtU2VjcmV0LUpvdXJuYWwtUHJlbWllcgpzMy1hcC1u
-b3J0aGVhc3QtMS5hbWF6b25hd3MuY29tCgohIS0tLUFPTC0tLQp8fGFvbGNoYW5u
-ZWxzLmFvbC5jb20KdmlkZW8uYW9sLmNhL3ZpZGVvLWRldGFpbAp2aWRlby5hb2wu
-Y28udWsvdmlkZW8tZGV0YWlsCnZpZGVvLmFvbC5jb20KfHx2aWRlby5hb2wuY29t
-Cnx8c2VhcmNoLmFvbC5jb20Kd3d3LmFvbG5ld3MuY29tCgohIS0tLUF2TW9vLS0t
-Ci5hdm1vLnB3CiEtLXxodHRwOi8vYXZtby5wdwouYXZtb28uY29tCnxodHRwOi8v
-YXZtb28uY29tCi5hdm1vby5uZXQKfGh0dHA6Ly9hdm1vby5uZXQKfHxhdm1vby5w
-dwouamF2bW9vLnh5egp8aHR0cDovL2phdm1vby54eXoKLmphdnRhZy5jb20KfGh0
-dHA6Ly9qYXZ0YWcuY29tCi5qYXZ6b28uY29tCnxodHRwOi8vamF2em9vLmNvbQou
-dGVsbG1lLnB3CgohIS0tLUJCQy0tLQohLS0uYmJjLmNvLnVrL2Jsb2dzCiEtLS5i
-YmMuY28udWsvY2hpbmVzZQohLS0uYmJjLmNvLnVrL25ld3Mvd29ybGQtYXNpYS1j
-aGluYQohLS0uYmJjLmNvLnVrL3R2CiEtLS5iYmMuY28udWsvemhvbmd3ZW4KIS0t
-LmJiYy5jb20vdWtjaGluYQohLS0uYmJjLmNvbS96aG9uZ3dlbgohLS0uYmJjLmNv
-bSUyRnpob25nd2VuCiEtLW5ld3MuYmJjLmNvLnVrL29udGhpc2RheSpuZXdzaWRf
-MjQ5NjAwMC8yNDk2Mjc3CiEtLW5ld3Nmb3J1bXMuYmJjLmNvLnVrCi5iYmMuY29t
-Cnx8YmJjLmNvbQouYmJjLmNvLnVrCnx8YmJjLmNvLnVrCnx8YmJjaS5jby51awou
-YmJjY2hpbmVzZS5jb20KfHxiYmNjaGluZXNlLmNvbQp8aHR0cDovL2JiYy5pbgoK
-ISEtLS1DaGFuZ2VJUC0tLQouMWR1bWIuY29tCi4yNXUuY29tCi4yd2FreS5jb20K
-LjMtYS5uZXQKLjRkcS5jb20KLjRteWRvbWFpbi5jb20KLjRwdS5jb20KLmFjbWV0
-b3kuY29tCi5hbG1vc3RteS5jb20KLmFtZXJpY2FudW5maW5pc2hlZC5jb20KLmF1
-dGhvcml6ZWRkbnMubmV0Ci5hdXRob3JpemVkZG5zLm9yZwouYXV0aG9yaXplZGRu
-cy51cwouYmlnbW9uZXkuYml6Ci5jaGFuZ2VpcC5uYW1lCi5jaGFuZ2VpcC5uZXQK
-LmNoYW5nZWlwLm9yZwouY2xlYW5zaXRlLmJpegouY2xlYW5zaXRlLmluZm8KLmNs
-ZWFuc2l0ZS51cwouY29tcHJlc3MudG8KLmRkbnMuaW5mbwouZGRucy5tZS51awou
-ZGRucy5tb2JpCi5kZG5zLm1zCi5kZG5zLm5hbWUKLmRkbnMudXMKLmRoY3AuYml6
-Ci5kbnMtZG5zLmNvbQouZG5zLXN0dWZmLmNvbQouZG5zMDQuY29tCi5kbnMwNS5j
-b20KLmRuczEudXMKLmRuczIudXMKLmRuc2V0LmNvbQouZG5zcmQuY29tCi5kc210
-cC5jb20KLmR1bWIxLmNvbQouZHluYW1pYy1kbnMubmV0Ci5keW5hbWljZG5zLmJp
-egouZHluYW1pY2Rucy5jby51awouZHluYW1pY2Rucy5tZS51awouZHluYW1pY2Ru
-cy5vcmcudWsKLmR5bmRucy5wcm8KLmR5bnNzbC5jb20KLmVkbnMuYml6Ci5lcGFj
-LnRvCi5lc210cC5iaXoKLmV6dWEuY29tCi5mYXFzZXJ2LmNvbQouZmFydGl0LmNv
-bQouZnJlZWRkbnMuY29tCi5mcmVldGNwLmNvbQouZnJlZXd3dy5iaXoKLmZyZWV3
-d3cuaW5mbwouZnRwMS5iaXoKLmZ0cHNlcnZlci5iaXoKLmdldHRyaWFscy5jb20K
-LmdvdC1nYW1lLm9yZwouZ3I4ZG9tYWluLmJpegouZ3I4bmFtZS5iaXoKLmh0dHBz
-NDQzLm5ldAouaHR0cHM0NDMub3JnCi5pa3diLmNvbQouaW5zdGFudGhxLmNvbQou
-aW93bnlvdXIuYml6Ci5pb3dueW91ci5vcmcKLmlzYXNlY3JldC5jb20KLml0ZW1k
-Yi5jb20KLml0c2FvbC5jb20KLmpldG9zLmNvbQouamt1Yi5jb20KLmp1bmdsZWhl
-YXJ0LmNvbQouanVzdGRpZWQuY29tCi5sZmxpbmsuY29tCi5sZmxpbmt1cC5jb20K
-LmxmbGlua3VwLm5ldAoubGZsaW5rdXAub3JnCi5sb25nbXVzaWMuY29tCi5tZWZv
-dW5kLmNvbQoubW9uZXlob21lLmJpegoubXJiYXNpYy5jb20KLm1yYm9udXMuY29t
-Ci5tcmZhY2UuY29tCi5tcnNsb3ZlLmNvbQoubXkwMy5jb20KLm15ZGFkLmluZm8K
-Lm15ZGRucy5jb20KLm15ZnRwLmluZm8KLm15ZnRwLm5hbWUKLm15bGZ0di5jb20K
-Lm15bW9tLmluZm8KLm15bmV0YXYubmV0Ci5teW5ldGF2Lm9yZwoubXludW1iZXIu
-b3JnCi5teXBpY3R1cmUuaW5mbwoubXlwb3AzLm5ldAoubXlwb3AzLm9yZwoubXlz
-ZWNvbmRhcnlkbnMuY29tCi5teXd3dy5iaXoKLm15ei5pbmZvCi5uaW50aC5iaXoK
-Lm5zMDEuYml6Ci5uczAxLmluZm8KLm5zMDEudXMKLm5zMDIuYml6Ci5uczAyLmlu
-Zm8KLm5zMDIudXMKLm5zMS5uYW1lCi5uczIubmFtZQoubnMzLm5hbWUKLm9jcnku
-Y29tCi5vbmVkdW1iLmNvbQoub25teXBjLmJpegoub25teXBjLmluZm8KLm9ubXlw
-Yy5uZXQKLm9ubXlwYy5vcmcKLm9ubXlwYy51cwoub3JnYW5pY2NyYXAuY29tCi5v
-dHpvLmNvbQoub3VyaG9iYnkuY29tCi5wY2FueXdoZXJlLm5ldAoucG9ydDI1LmJp
-egoucHJveHlkbnMuY29tCi5xaGlnaC5jb20KLnFwb2UuY29tCi5yZWJhdGVzcnVs
-ZS5uZXQKLnNlbGxjbGFzc2ljcy5jb20KLnNlbmRzbXRwLmNvbQouc2VydmV1c2Vy
-LmNvbQouc2VydmV1c2Vycy5jb20KLnNleGlkdWRlLmNvbQouc2V4eHh5LmJpegou
-c2l4dGguYml6Ci5zcXVpcmx5LmluZm8KLnNzbDQ0My5vcmcKLnRvaC5pbmZvCi50
-b3l0aGlldmVzLmNvbQoudHJpY2tpcC5uZXQKLnRyaWNraXAub3JnCi52aXp2YXou
-Y29tCi53aGEubGEKLndpa2FiYS5jb20KLnd3dzEuYml6Ci53d3dob3N0LmJpegpA
-QHxodHRwOi8veHgud3d3aG9zdC5iaXoKLngyNGhyLmNvbQoueHh1ei5jb20KLnh4
-eHkuYml6Ci54eHh5LmluZm8KLnlndG8uY29tCi55b3Vkb250Y2FyZS5jb20KLnlv
-dXJ0cmFwLmNvbQouenlucy5jb20KLnp6dXguY29tCgohIS0tLUNsb3VkRnJvbnQt
-LS0KZDFiMTgzc2cwbnZudWguY2xvdWRmcm9udC5uZXQKfGh0dHBzOi8vZDFiMTgz
-c2cwbnZudWguY2xvdWRmcm9udC5uZXQKZDFjMzdnandhMjZ0YWEuY2xvdWRmcm9u
-dC5uZXQKfGh0dHBzOi8vZDFjMzdnandhMjZ0YWEuY2xvdWRmcm9udC5uZXQKZDNj
-MzNoY2dpd2V2My5jbG91ZGZyb250Lm5ldAp8aHR0cHM6Ly9kM2MzM2hjZ2l3ZXYz
-LmNsb3VkZnJvbnQubmV0Cnx8ZDNyaHI3a2dtdHJxMXYuY2xvdWRmcm9udC5uZXQK
-CiEhLS0tRHRETlMtLS0KISMjI2h0dHBzOi8vd3d3LmR0ZG5zLmNvbS9kdHNpdGUv
-ZmFxCi4zZC1nYW1lLmNvbQouNGlyYy5jb20KLmIwbmUuY29tCi5jaGF0bm9vay5j
-b20KLmRhcmt0ZWNoLm9yZwouZGVhZnRvbmUuY29tCi5kdGRucy5uZXQKLmVmZmVy
-cy5jb20KLmV0b3ducy5uZXQKLmV0b3ducy5vcmcKLmZsbmV0Lm9yZwouZ290Z2Vl
-a3MuY29tCi5zY2llcm9uLmNvbQouc2x5aXAuY29tCi5zbHlpcC5uZXQKLnN1cm9v
-dC5jb20KCiEhLS0tRHluRE5TLS0tCiEjIyNodHRwczovL2hlbHAuZHluLmNvbS9s
-aXN0LW9mLWR5bi1kbnMtcHJvLXJlbW90ZS1hY2Nlc3MtZG9tYWluLW5hbWVzLwou
-YmxvZ2Rucy5vcmcKLmR5bmRucy5vcmcKLmR5bmRucy1pcC5jb20KLmR5bmRucy1w
-aWNzLmNvbQouZnJvbS1zZC5jb20KLmZyb20tcHIuY29tCi5pcy1hLWh1bnRlci5j
-b20KCiEhLS0tRHludS0tLQouZHludS5jb20KLmR5bnUubmV0Ci5mcmVlZGRucy5v
-cmcKCiEhLS0tRmFjZWJvb2stLS0KY2RuaW5zdGFncmFtLmNvbQp8fGNkbmluc3Rh
-Z3JhbS5jb20KfHxmYWNlYm9vay5icgouZmFjZWJvb2suY29tCnx8ZmFjZWJvb2su
-Y29tCiEtLS9eaHR0cHM/OlwvXC9bXlwvXStmYWNlYm9va1wuY29tLwpAQHx8djYu
-ZmFjZWJvb2suY29tCnx8ZmFjZWJvb2suZGVzaWduCnx8Y29ubmVjdC5mYWNlYm9v
-ay5uZXQKfHxmYWNlYm9vay5odQp8fGZhY2Vib29rLmluCnx8ZmFjZWJvb2submwK
-fHxmYWNlYm9vay5zZQp8fGZhY2Vib29rbWFpbC5jb20KfHxmYi5jb20KfHxmYi5t
-ZQp8fGZiY2RuLm5ldAp8fGZic2J4LmNvbQp8fGZiYWRkaW5zLmNvbQp8fGZid29y
-a21haWwuY29tCi5pbnN0YWdyYW0uY29tCnx8aW5zdGFncmFtLmNvbQp8fG0ubWUK
-fHxtZXNzZW5nZXIuY29tCnx8b2N1bHVzLmNvbQp8fG9jdWx1c2Nkbi5jb20KfHxy
-b2Nrc2RiLm9yZwpAQHx8aXA2LnN0YXRpYy5zbC1yZXZlcnNlLmNvbQp8fHRoZWZh
-Y2Vib29rLmNvbQp8fHdoYXRzYXBwLmNvbQp8fHdoYXRzYXBwLm5ldAoKISEtLS1G
-VENoaW5lc2UtLS0KLmZ0Y2hpbmVzZS5jb20KfHxmdGNoaW5lc2UuY29tCiEtLS5m
-dGNoaW5lc2UuY29tL2NoYW5uZWwvdmlkZW8KIS0tLmZ0Y2hpbmVzZS5jb20vcHJl
-bWl1bS8wMDEwODEwNjYKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDI3NTMK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDI2NjE2CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTAyNjc0OQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-MjY4MDcKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDI2ODA4CiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTAyNjgzNAohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwMjY4ODAKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDI3NDI5CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTAzMDM0MQohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwMzA1MDIKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDMw
-ODAzCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTAzMTMxNwohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwMzI2MTcKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDMyNjM2CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTAzMjY5MgohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwMzI3NjIKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDMzMTM4CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTAzNDkx
-NwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwMzQ5MjYKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDM0OTI3CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTAzNDkyOAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwMzQ5NTIKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDM1ODkwCiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTAzNTk3MgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwMzU5OTMK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDM2NDE3CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTAzNzA5MAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-MzcwOTEKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDM4MTc4CiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTAzODE5OQohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwMzgyMjAKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDM4ODE5CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTAzODg2MgohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwMzkwNjcKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDM5
-MTc4CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTAzOTIxMQohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwMzkyNzEKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDM5Mjk1CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTAzOTM2OQohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwMzk0ODIKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDM5NTM0CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTAzOTU1
-NQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwMzk1NzYKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDM5NzEyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTAzOTc3OQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwMzk4MDkKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQwMTM0CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA0MDgzNQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNDA4OTAK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQwOTE4CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA0MDk5MgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NDEyMDkKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQyMTAwCiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA0MjI1MgohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNDIyNzIKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQyMjgwCiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA0MzAyOQohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNDMwNjYKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQz
-MDk2CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA0MzEyNAohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNDMxNTIKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDQzMTg5CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA0MzQyOAohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNDM0MzkKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDQzNTM0CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA0MzY3
-NQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNDM2ODAKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDQzNzAyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA0Mzg0OQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNDQwOTkKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQ0Nzc2CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA0NDg3MQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNDQ4OTcK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQ1MTE0CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA0NTEzOQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NDUxODYKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQ1NzU1CiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA0NjA4NwohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNDYxMDUKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQ2MTE4CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA0NjEzMgohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNDY1MTcKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQ2
-ODIyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA0Njg2NgohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNDY5NDIKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDQ3MTgwCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA0NzIwNgohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNDczMDQKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDQ3MzE3CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA0NzM0
-NQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNDczNTgKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDQ3Mzc1CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA0NzM4MQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNDc0MTMKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQ3NDU2CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA0NzQ5MQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNDc1NDUK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQ3NTU4CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA0NzU2OAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NDc2MjcKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQ4MjkzCiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA0ODM0MwohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNDg3MTAKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDQ5Mjg5CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA0OTM2MAohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNDk4OTYKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDUw
-MTUyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1MTAyNwohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNTExNjEKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDUxMzcyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1MTQ3OQohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTIxMzgKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDUyMTYxCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1MjUy
-NQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTI1NDkKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDUyNzAxCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA1Mjk2NQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTMxNDkKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDUzMTUwCiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA1MzIwMAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTM0MjUK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDUzNDk2CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA1MzUyNgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NTM1NTcKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDUzOTA2CiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA1NDA0OQohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNTQxMDMKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU0MTA5CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NDExOQohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNTQxMjMKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU0
-MTM5CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NDE2NgohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNTQxNjgKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDU0MTkwCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NDQzNwohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTQ1MjYKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDU0NjA3CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NDY0
-NAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTQ3ODYKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDU0ODQzCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA1NDkyNQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTQ5NDAKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU1MDUxCiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA1NTA2MwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTUwNjkK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU1MTM2CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA1NTE3MAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NTUyMDIKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU1MjQyCiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA1NTI2MwohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNTUyNzQKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU1Mjk5CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NTQ4MAohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNTU1NTEKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU1
-NTU5CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NTU2NgohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNTU4NDAKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDU2MDk5CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NjEwOAohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTYxMzEKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDU2Mzc1CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NjQ5
-MQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTY1MjkKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDU2NTM0CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA1NjUzOAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTY1NDEKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU2NTU0CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA1NjU1NwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTY1NjAK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU2NTY3CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA1NjU3NAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NTY1ODgKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU2NTk0CiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA1NjU5NgohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNTY2ODQKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU2ODMyCiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NjgzMwohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNTY4NTEKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU2
-ODc0CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1Njg5NgohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNTY5MjcKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDU3MDExCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NzAxOAohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTcwNDQKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDU3MTYyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1NzUw
-MAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTc1MDQKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDU3NTA5CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA1NzUxOAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTc1MzIKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU3NTMzCiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA1NzU1NgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTc1ODAK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU3NjM4CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA1NzY0NAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NTc4MTcKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU3ODc1CiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA1ODAwOQohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNTgwNTYKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU4MjI0CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1ODI1NwohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNTgyOTUKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU4
-MzI4CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1ODMzOQohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNTgzNDQKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDU4MzUyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1ODQxMwohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTg0MjEKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDU4NDQwCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1ODQ1
-OAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTg0NjgKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDU4NTYxCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA1ODU2NgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTg1NjcKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU4NTg1CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA1ODYyOAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNTg2NTYK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU4NjY1CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA1ODY3OAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NTg2OTEKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU4NzIxCiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA1ODcyOAohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNTk0NjQKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU5NDg0CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1OTUzNwohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNTk1MzgKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDU5
-NTUxCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1OTgxOAohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNTk5MTQKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDU5OTIwCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA1OTk1NwohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjAwODgKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDYwMTU2CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2MDE1
-NwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjAxNjAKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDYwMTgxCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA2MDE4NQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjA0OTMKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYwNDk1CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA2MDU5MAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjA4NDYK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYwODQ3CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA2MDg3NQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NjA5MjEKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYwOTQ2CiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA2MTEyMAohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNjE0NzQKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYxNTI0CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2MTY0MgohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNjIwMTcKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYy
-MDIwCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2MjAyOAohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNjIwOTIKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDYyMDk2CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2MjE0NwohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjIxNzYKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDYyMTg4CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2MjI1
-NAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjIzNzQKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDYyNDgyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA2MjQ5NgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjI1MDEKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYyNTA4CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA2MjUxOQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjI1NTQK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYyNzQxCiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA2Mjc5NAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NjMxNjAKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYzMzU5CiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA2MzUxMgohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNjM2NjgKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYzNjkyCiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2Mzc2MwohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNjM3NjQKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDYz
-ODI2CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2NDEyNwohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNjQzMTIKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDY0NzA1CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2NDgwNwohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjUxMjAKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDY1MTY4CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2NTI0
-OQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjUyODcKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDY1MzM1CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA2NTMzNwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjU1NDEKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDY1NzE1CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA2NTczNQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjU3NTYK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDY1ODAyCiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA2NjExMgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NjYxMzYKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDY2MTQwCiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA2NjQ2NQohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNjY4ODEKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDY2OTUwCiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2Njk1OQohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNjc0MzUKIS0td3d3LmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAx
-MDY3NDc5CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2NzUyOAohLS0uZnRj
-aGluZXNlLmNvbS9zdG9yeS8wMDEwNjc1NDUKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rv
-cnkvMDAxMDY3NTcyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2NzY0OAoh
-LS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjc2NTAKIS0tLmZ0Y2hpbmVzZS5j
-b20vc3RvcnkvMDAxMDY3NjgwCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2
-NzY5MgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjc4NzEKIS0tLmZ0Y2hp
-bmVzZS5jb20vc3RvcnkvMDAxMDY3OTIzCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5
-LzAwMTA2ODA2MgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjgyNDgKIS0t
-LmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDY4Mjc4CiEtLS5mdGNoaW5lc2UuY29t
-L3N0b3J5LzAwMTA2ODM3OQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNjg0
-ODMKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDY4NTA2CiEtLS5mdGNoaW5l
-c2UuY29tL3N0b3J5LzAwMTA2ODU0NwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8w
-MDEwNjg2MTYKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDY4NjIyCiEtLS5m
-dGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2ODcwNwohLS0uZnRjaGluZXNlLmNvbS9z
-dG9yeS8wMDEwNjkxNDYKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDY5Mzcz
-CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2OTUxNgohLS0uZnRjaGluZXNl
-LmNvbS9zdG9yeS8wMDEwNjk1MTcKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAx
-MDY5Njg3CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA2OTc0MQohLS0uZnRj
-aGluZXNlLmNvbS9zdG9yeS8wMDEwNjk4NjEKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rv
-cnkvMDAxMDY5OTUyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3MDA1Mwoh
-LS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzAxNzcKIS0tLmZ0Y2hpbmVzZS5j
-b20vc3RvcnkvMDAxMDcwMzA3CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3
-MDgwOQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzA5OTAKIS0tLmZ0Y2hp
-bmVzZS5jb20vc3RvcnkvMDAxMDcxMDQyCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5
-LzAwMTA3MTA0NAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzExMDYKIS0t
-LmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDcxMTY2CiEtLS5mdGNoaW5lc2UuY29t
-L3N0b3J5LzAwMTA3MTE4MQohLS1mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3MTIw
-MAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzEyMDgKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDcxMjM4CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA3MTY4MwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzIyNzEKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDcyMzQ4CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA3MjY3NwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzI3MjYK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDcyNzk0CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA3Mjg1MwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NzI4OTUKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDcyOTkzCiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA3MzA0MwohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNzMxMDMKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDczMTU3CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3MzIxNgohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNzMyNDYKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDcz
-MzA1CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3MzMwNwohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNzM0MDgKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDczNTM3CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3MzY3MgohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzM4NDkKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDczOTA2CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3NDA4
-OQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzQxMTAKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDc0MTI4CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA3NDE1NwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzQyNDYKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc0MzA3CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA3NDM0NwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzQ0MjMK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc0NDU0CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA3NDQ2NwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NzQ0OTMKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc0NTUwCiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA3NDU2MgohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNzQ2NTMKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc0NjkzCiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3NDY5OQohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNzQ3MTIKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc0
-NzEzCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3NDc2OAohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNzQ3ODIKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDc0Nzk0CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3NDgyMgohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzQ4NzQKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDc0ODkxCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3NDkx
-OAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzUwODEKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDc1MTM0CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA3NTE0MgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzUyMTYKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc1MjMwCiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA3NTIzOAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzUyNjIK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc1MjY5CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA3NTQ5MQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-NzU1MDAKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc1NjUwCiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA3NTY3OAohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNzU3MDMKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc1NzM5CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3NjA2NgohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNzYxNDIKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc2
-NDU5CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3NjQ3MAohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwNzY1MzgKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDc2NTczCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3NjkwMQohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzcwNjcKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDc3MDg0CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3NzIz
-NQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzczNDQKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDc3MzkwCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA3NzM5MgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzc0NjUKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc3NDY4CiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA3NzQ5MgohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwNzc3NDUK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc3NzY4CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA3NzgwNAohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEw
-Nzc4NTIKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc4NjQ2CiEtLS5mdGNo
-aW5lc2UuY29tL3N0b3J5LzAwMTA3ODkyOAohLS0uZnRjaGluZXNlLmNvbS9zdG9y
-eS8wMDEwNzg5NjcKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc5NTU5CiEt
-LS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3OTY0MQohLS0uZnRjaGluZXNlLmNv
-bS9zdG9yeS8wMDEwNzk5MDkKIS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDc5
-OTM0CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA3OTk5MgohLS0uZnRjaGlu
-ZXNlLmNvbS9zdG9yeS8wMDEwODAwNTQKIS0tLmZ0Y2hpbmVzZS5jb20vc3Rvcnkv
-MDAxMDgwMTA5CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA4MDE2OQohLS0u
-ZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwODAyMjYKIS0tLmZ0Y2hpbmVzZS5jb20v
-c3RvcnkvMDAxMDgwNDI5CiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAwMTA4MDQ3
-MQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwODA1NTAKIS0tLmZ0Y2hpbmVz
-ZS5jb20vc3RvcnkvMDAxMDgwNTgxCiEtLS5mdGNoaW5lc2UuY29tL3N0b3J5LzAw
-MTA4MDY0NwohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwODA3NzgKIS0tLmZ0
-Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDgwODkyCiEtLS5mdGNoaW5lc2UuY29tL3N0
-b3J5LzAwMTA4MDkxNQohLS0uZnRjaGluZXNlLmNvbS9zdG9yeS8wMDEwODA5MzUK
-IS0tLmZ0Y2hpbmVzZS5jb20vc3RvcnkvMDAxMDgxMDU5CiEtLS5mdGNoaW5lc2Uu
-Y29tL3N0b3J5LzAwMTA4MTEyNwohLS0uZnRjaGluZXNlLmNvbS90YWcvJUU1JThE
-JTgxJUU1JTg1JUFCJUU1JUIxJThBJUU0JUI4JTg5JUU0JUI4JUFEJUU1JTg1JUE4
-JUU0JUJDJTlBCiEtLS5mdGNoaW5lc2UuY29tL3RhZy8lRTYlQjglQTklRTUlQUUl
-QjYlRTUlQUUlOUQKIS0tLmZ0Y2hpbmVzZS5jb20vdGFnLyVFOCU5NiU4NCVFNyU4
-NiU5OSVFNiU5RCVBNQohLS0uZnRjaGluZXNlLmNvbS92aWRlby8xNDM3CiEtLS5m
-dGNoaW5lc2UuY29tL3ZpZGVvLzE4ODIKIS0tLmZ0Y2hpbmVzZS5jb20vdmlkZW8v
-MjQ0NgohLS0uZnRjaGluZXNlLmNvbS92aWRlby8yNjAxCiEtLS5mdGNoaW5lc2Uu
-Y29tL2NvbW1lbnRzCgohIS0tLUdvb2dsZS0tLQohIyMjaHR0cHM6Ly93d3cuZ29v
-Z2xlLmNvbS9zdXBwb3J0ZWRfZG9tYWlucyMjIwohLi4uR0ZXTGlzdCBkb2Vzbid0
-IGludGVuZCB0byBzdXBwb3J0IHR5cG9zcXVhdHRpbmcuLi4KfHwxZTEwMC5uZXQK
-fHw0NjY0NTMuY29tCnx8YWJjLnh5egp8fGFib3V0Lmdvb2dsZQp8fGFkbW9iLmNv
-bQp8fGFkc2Vuc2UuY29tCnx8YWdvb2dsZWFkYXkuY29tCnx8YWkuZ29vZ2xlCnx8
-YW1wcHJvamVjdC5vcmcKQEB8aHR0cHM6Ly93d3cuYW1wcHJvamVjdC5vcmcKQEB8
-aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcKfHxhbmRyb2lkLmNvbQp8fGFuZHJv
-aWRpZnkuY29tCnx8YW5kcm9pZHR2LmNvbQp8fGFwaS5haQouYXBwc3BvdC5jb20K
-fHxhcHBzcG90LmNvbQp8fGF1dG9kcmF3LmNvbQp8fGJsb2cuZ29vZ2xlCnx8Ymxv
-Z2Jsb2cuY29tCmJsb2dzcG90LmNvbQovXmh0dHBzPzpcL1wvW15cL10rYmxvZ3Nw
-b3RcLiguKikvCi5ibG9nc3BvdC5oawouYmxvZ3Nwb3QuanAKLmJsb2dzcG90LnR3
-CiEtLXx8Y2FwaXRhbGcuY29tCnx8Y2VydGlmaWNhdGUtdHJhbnNwYXJlbmN5Lm9y
-Zwp8fGNocm9tZS5jb20KfHxjaHJvbWVjYXN0LmNvbQp8fGNocm9tZWV4cGVyaW1l
-bnRzLmNvbQp8fGNocm9tZXJjaXNlLmNvbQp8fGNocm9tZXN0YXR1cy5jb20KfHxj
-aHJvbWl1bS5vcmcKfHxjb20uZ29vZ2xlCnx8Y3JidWcuY29tCnx8Y3JlYXRpdmVs
-YWI1LmNvbQp8fGNyaXNpc3Jlc3BvbnNlLmdvb2dsZQp8fGNycmV2LmNvbQp8fGRh
-dGEtdm9jYWJ1bGFyeS5vcmcKfHxkZWJ1Zy5jb20KfHxkZWVwbWluZC5jb20KfHxk
-ZWphLmNvbQp8fGRlc2lnbi5nb29nbGUKfHxkaWdpc2ZlcmEuY29tCnx8ZG5zLmdv
-b2dsZQp8fGRvbWFpbnMuZ29vZ2xlCnx8ZHVjay5jb20KfHxlbnZpcm9ubWVudC5n
-b29nbGUKfHxmZWVkYnVybmVyLmNvbQp8fGZpcmViYXNlaW8uY29tCnx8Zy5jbwp8
-fGdjci5pbwp8fGdldC5hcHAKfHxnZXQuZGV2Cnx8Z2V0Lmhvdwp8fGdldC5wYWdl
-Cnx8Z2V0bWRsLmlvCnx8Z2V0b3V0bGluZS5vcmcKfHxnZ3BodC5jb20KfHxnbWFp
-bC5jb20KfHxnbW9kdWxlcy5jb20KfHxnb2RvYy5vcmcKfHxnb2xhbmcub3JnCnx8
-Z29vLmdsCi5nb29nbGUuYWUKLmdvb2dsZS5hcwouZ29vZ2xlLmFtCi5nb29nbGUu
-YXQKLmdvb2dsZS5hegouZ29vZ2xlLmJhCi5nb29nbGUuYmUKLmdvb2dsZS5iZwou
-Z29vZ2xlLmNhCi5nb29nbGUuY2QKLmdvb2dsZS5jaQouZ29vZ2xlLmNvLmlkCi5n
-b29nbGUuY28uanAKLmdvb2dsZS5jby5rcgouZ29vZ2xlLmNvLm1hCi5nb29nbGUu
-Y28udWsKLmdvb2dsZS5jb20KLmdvb2dsZS5kZQp8fGdvb2dsZS5kZXYKLmdvb2ds
-ZS5kagouZ29vZ2xlLmRrCi5nb29nbGUuZXMKLmdvb2dsZS5maQouZ29vZ2xlLmZt
-Ci5nb29nbGUuZnIKLmdvb2dsZS5nZwouZ29vZ2xlLmdsCi5nb29nbGUuZ3IKLmdv
-b2dsZS5pZQouZ29vZ2xlLmlzCi5nb29nbGUuaXQKLmdvb2dsZS5qbwouZ29vZ2xl
-Lmt6Ci5nb29nbGUubHYKLmdvb2dsZS5tbgouZ29vZ2xlLm1zCi5nb29nbGUubmwK
-Lmdvb2dsZS5udQouZ29vZ2xlLm5vCi5nb29nbGUucm8KLmdvb2dsZS5ydQouZ29v
-Z2xlLnJ3Ci5nb29nbGUuc2MKLmdvb2dsZS5zaAouZ29vZ2xlLnNrCi5nb29nbGUu
-c20KLmdvb2dsZS5zbgouZ29vZ2xlLnRrCi5nb29nbGUudG0KLmdvb2dsZS50bwou
-Z29vZ2xlLnR0Ci5nb29nbGUudnUKLmdvb2dsZS53cwovXmh0dHBzPzpcL1wvKFte
-XC9dK1wuKSpnb29nbGVcLihhY3xhZHxhZXxhZnxhbHxhbXxhc3xhdHxhenxiYXxi
-ZXxiZnxiZ3xiaXxianxic3xidHxieXxjYXxjYXR8Y2R8Y2Z8Y2d8Y2h8Y2l8Y2x8
-Y218Y28uYW98Y28uYnd8Y28uY2t8Y28uY3J8Y28uaWR8Y28uaWx8Y28uaW58Y28u
-anB8Y28ua2V8Y28ua3J8Y28ubHN8Y28ubWF8Y29tfGNvbS5hZnxjb20uYWd8Y29t
-LmFpfGNvbS5hcnxjb20uYXV8Y29tLmJkfGNvbS5iaHxjb20uYm58Y29tLmJvfGNv
-bS5icnxjb20uYnp8Y29tLmNvfGNvbS5jdXxjb20uY3l8Y29tLmRvfGNvbS5lY3xj
-b20uZWd8Y29tLmV0fGNvbS5manxjb20uZ2h8Y29tLmdpfGNvbS5ndHxjb20uaGt8
-Y29tLmptfGNvbS5raHxjb20ua3d8Y29tLmxifGNvbS5seXxjb20ubW18Y29tLm10
-fGNvbS5teHxjb20ubXl8Y29tLm5hfGNvbS5uZnxjb20ubmd8Y29tLm5pfGNvbS5u
-cHxjb20ub218Y29tLnBhfGNvbS5wZXxjb20ucGd8Y29tLnBofGNvbS5wa3xjb20u
-cHJ8Y29tLnB5fGNvbS5xYXxjb20uc2F8Y29tLnNifGNvbS5zZ3xjb20uc2x8Y29t
-LnN2fGNvbS50anxjb20udHJ8Y29tLnR3fGNvbS51YXxjb20udXl8Y29tLnZjfGNv
-bS52bnxjby5tenxjby5uenxjby50aHxjby50enxjby51Z3xjby51a3xjby51enxj
-by52ZXxjby52aXxjby56YXxjby56bXxjby56d3xjdnxjenxkZXxkanxka3xkbXxk
-enxlZXxlc3xldXxmaXxmbXxmcnxnYXxnZXxnZ3xnbHxnbXxncHxncnxneXxoa3xo
-bnxocnxodHxodXxpZXxpbXxpcXxpc3xpdHxpdC5hb3xqZXxqb3xrZ3xraXxrenxs
-YXxsaXxsa3xsdHxsdXxsdnxtZHxtZXxtZ3xta3xtbHxtbnxtc3xtdXxtdnxtd3xt
-eHxuZXxubHxub3xucnxudXxvcmd8cGx8cG58cHN8cHR8cm98cnN8cnV8cnd8c2N8
-c2V8c2h8c2l8c2t8c218c258c298c3J8c3R8dGR8dGd8dGt8dGx8dG18dG58dG98
-dHR8dXN8dmd8dm58dnV8d3MpXC8uKi8KIS0tfHxnb29nbGUtYW5hbHl0aWNzLmNv
-bQohLS18fGdvb2dsZWFkc2VydmljZXMuY29tCnx8Z29vZ2xlYXBpcy5jbgp8fGdv
-b2dsZWFwaXMuY29tCnx8Z29vZ2xlYXBwcy5jb20KfHxnb29nbGVhcnRwcm9qZWN0
-LmNvbQp8fGdvb2dsZWJsb2cuY29tCnx8Z29vZ2xlYm90LmNvbQohLS18fGdvb2ds
-ZWNhcGl0YWwuY29tCnx8Z29vZ2xlY2hpbmF3ZWJtYXN0ZXIuY29tCnx8Z29vZ2xl
-Y29kZS5jb20KfHxnb29nbGVjb21tZXJjZS5jb20KfHxnb29nbGVkb21haW5zLmNv
-bQp8fGdvb2dsZWFydGguY29tCnx8Z29vZ2xlZWFydGguY29tCnx8Z29vZ2xlZHJp
-dmUuY29tCnx8Z29vZ2xlZ3JvdXBzLmNvbQp8fGdvb2dsZWhvc3RlZC5jb20KfHxn
-b29nbGVpZGVhcy5jb20KfHxnb29nbGVpbnNpZGVzZWFyY2guY29tCnx8Z29vZ2xl
-bGFicy5jb20KfHxnb29nbGVtYWlsLmNvbQp8fGdvb2dsZW1hc2h1cHMuY29tCnx8
-Z29vZ2xlcGFnZWNyZWF0b3IuY29tCnx8Z29vZ2xlcGxheS5jb20KfHxnb29nbGVw
-bHVzLmNvbQp8fGdvb2dsZXNjaG9sYXIuY29tCnx8Z29vZ2xlc291cmNlLmNvbQoh
-LS18fGdvb2dsZXN5bmRpY2F0aW9uLmNvbQohLS18fGdvb2dsZXRhZ21hbmFnZXIu
-Y29tCiEtLXx8Z29vZ2xldGFnc2VydmljZXMuY29tCnx8Z29vZ2xldXNlcmNvbnRl
-bnQuY29tCi5nb29nbGV2aWRlby5jb20KfHxnb29nbGV2aWRlby5jb20KfHxnb29n
-bGV3ZWJsaWdodC5jb20KfHxnb29nbGV6aXAubmV0Cnx8Z3JvdXBzLmdvb2dsZS5j
-bgp8fGdyb3cuZ29vZ2xlCnx8Z3N0YXRpYy5jb20KIS0tfHxndi5jb20KfHxndnQw
-LmNvbQp8fGd2dDEuY29tCkBAfHxyZWRpcmVjdG9yLmd2dDEuY29tCnx8Z3Z0My5j
-b20KfHxnd3Rwcm9qZWN0Lm9yZwp8fGh0bWw1cm9ja3MuY29tCnx8aWFtLnNveQp8
-fGlnb29nbGUuY29tCnx8aXRhc29mdHdhcmUuY29tCnx8bGVycy5nb29nbGUKfHxs
-aWtlLmNvbQp8fG1hZGV3aXRoY29kZS5jb20KfHxtYXRlcmlhbC5pbwp8fG5pYy5n
-b29nbGUKfHxvbjIuY29tCnx8cGFub3JhbWlvLmNvbQp8fHBpY2FzYXdlYi5jb20K
-fHxwa2kuZ29vZwp8fHBsdXMuY29kZXMKfHxwb2x5bWVyLXByb2plY3Qub3JnCnx8
-cHJpZGUuZ29vZ2xlCnx8cXVlc3R2aXN1YWwuY29tCnx8YWRtaW4ucmVjYXB0Y2hh
-Lm5ldAp8fGFwaS5yZWNhcHRjaGEubmV0Cnx8YXBpLXNlY3VyZS5yZWNhcHRjaGEu
-bmV0Cnx8YXBpLXZlcmlmeS5yZWNhcHRjaGEubmV0Cnx8cmVkaG90bGFicy5jb20K
-fHxyZWdpc3RyeS5nb29nbGUKfHxzYWZldHkuZ29vZ2xlCnx8c2F2ZXRoZWRhdGUu
-Zm9vCnx8c2NoZW1hLm9yZwp8fHNoYXR0ZXJlZC5pbwp8aHR0cDovL3NpcG1sNS5v
-cmcvCnx8c3Rvcmllcy5nb29nbGUKfHxzdXN0YWluYWJpbGl0eS5nb29nbGUKfHxz
-eW5lcmd5c2UuY29tCnx8dGVhY2hwYXJlbnRzdGVjaC5vcmcKfHx0ZW5zb3JmbG93
-Lm9yZwp8fHRmaHViLmRldgp8fHRoaW5rd2l0aGdvb2dsZS5jb20KfHx0aWx0YnJ1
-c2guY29tCnx8dXJjaGluLmNvbQohLS18fHd3dy5nb29nbGUKfHx3YXZlcHJvdG9j
-b2wub3JnCnx8d2F5bW8uY29tCnx8d2ViLmRldgp8fHdlYm1wcm9qZWN0Lm9yZwp8
-fHdlYnJ0Yy5vcmcKfHx3aGF0YnJvd3Nlci5vcmcKfHx3aWRldmluZS5jb20KfHx3
-aXRoZ29vZ2xlLmNvbQp8fHdpdGh5b3V0dWJlLmNvbQp8fHguY29tcGFueQp8fHhu
-LS1uZ3N0ci1scmE4ai5jb20KfHx5b3V0dS5iZQoueW91dHViZS5jb20KfHx5b3V0
-dWJlLmNvbQp8fHlvdXR1YmUtbm9jb29raWUuY29tCnx8eW91dHViZWVkdWNhdGlv
-bi5jb20KfHx5b3V0dWJlZ2FtaW5nLmNvbQp8fHl0LmJlCnx8eXRpbWcuY29tCnx8
-enluYW1pY3MuY29tCgohIS0tLUtpY2tBU1MtLS0KIS0tT0ZGSUNJQUwgVVJMIGxp
-c3QgYXQ6IGh0dHBzOi8va2FzdGF0dXMuY29tCgohIS0tLU5hdWdodHlBbWVyaWNh
-LS0tCnx8bmF1Z2h0eWFtZXJpY2EuY29tCgohIS0tLU5ZVGltZXMtLS0KIS0tfHxk
-MWYxZXJ5aXF5anMwci5jbG91ZGZyb250Lm5ldAohLS18fGQzbGFyMDl4Yndsc2dl
-LmNsb3VkZnJvbnQubmV0CiEtLXx8ZDNxMXFqOWp6c3U4bncuY2xvdWRmcm9udC5u
-ZXQKIS0tfHxkYzh4bDBuZHpuMmNiLmNsb3VkZnJvbnQubmV0CiEtLXx8YTEubnl0
-LmNvbQohLS18fGludC5ueXQuY29tCiEtLXx8czEubnl0LmNvbQpzdGF0aWMwMS5u
-eXQuY29tCiEtLXx8c3RhdGljMDEubnl0LmNvbQohLS18fHR5cGVmYWNlLm55dC5j
-b20KfHxueXQuY29tCm55dGNoaW5hLmNvbQpueXRjbi5tZQp8fG55dGNuLm1lCnx8
-bnl0Y28uY29tCnxodHRwOi8vbnl0aS5tcy8KLm55dGltZXMuY29tCnx8bnl0aW1l
-cy5jb20KfHxueXRpbWcuY29tCnVzZXJhcGkubnl0bG9nLmNvbQpjbi5ueXRzdHls
-ZS5jb20KfHxueXRzdHlsZS5jb20KCiEhLS0tU3RlYW0tLS0KLnN0ZWFtY29tbXVu
-aXR5LmNvbQp8fHN0ZWFtY29tbXVuaXR5LmNvbQohLS1zdGVhbWNvbW11bml0eS5j
-b20vcHJvZmlsZXMvNzY1NjExOTgwNjI3NzE2MDkKIS0tc3RlYW1jb21tdW5pdHku
-Y29tL2dyb3Vwcy9MaWJldFRpYmV0CiEtLXN0ZWFtY29tbXVuaXR5LmNvbS9ncm91
-cHMvemhvbmdnb25nCiEtLXN0ZWFtY29tbXVuaXR5LmNvbS9pZC9DSlRfSmFja3Rv
-bgp8aHR0cDovL3N0b3JlLnN0ZWFtcG93ZXJlZC5jb20vYXBwLzMzMzYwMAoKISEt
-LS1UZWxlZ3JhbS0tLQohISEtLS1Eb21haW4tLS0KfHx0Lm1lCnx8dXBkYXRlcy50
-ZGVza3RvcC5jb20KfHx0ZWxlZ3JhbS5kb2cKfHx0ZWxlZ3JhbS5tZQp8fHRlbGVn
-cmFtLm9yZwoudGVsZWdyYW1kb3dubG9hZC5jb20KfHx0ZWxlc2NvLnBlCiEhIS0t
-LUlQLS0tCgohIS0tLVR3aXRjaC0tLQp8fGp0dm53Lm5ldAp8fHR0dm53Lm5ldAp8
-fHR3aXRjaC50dgp8fHR3aXRjaGNkbi5uZXQKCiEhLS0tVHdpdHRlci0tLQp8fHBl
-cmlzY29wZS50dgoucHNjcC50dgp8fHBzY3AudHYKLnQuY28KfHx0LmNvCi50d2Vl
-dGRlY2suY29tCnx8dHdlZXRkZWNrLmNvbQp8fHR3aW1nLmNvbQoudHdpdHBpYy5j
-b20KfHx0d2l0cGljLmNvbQoudHdpdHRlci5jb20KfHx0d2l0dGVyLmNvbQp8fHR3
-aXR0ZXIuanAKfHx2aW5lLmNvCgohIS0tLVRhaXdhbi0tLQp8fGdvdi50YWlwZWkK
-Lmdvdi50dwp8aHR0cHM6Ly9haXNzLmFud3MuZ292LnR3Cnx8YXJjaGl2ZXMuZ292
-LnR3Cnx8dGFjYy5jd2IuZ292LnR3Cnx8ZGF0YS5nb3YudHcKfHxlcGEuZ292LnR3
-Cnx8ZmEuZ292LnR3Cnx8ZmRhLmdvdi50dwp8fGhwYS5nb3YudHcKfHxpbW1pZ3Jh
-dGlvbi5nb3YudHcKfHxpdGFpd2FuLmdvdi50dwp8fG1qaWIuZ292LnR3Cnx8bW9l
-YWljLmdvdi50dwp8fG1vZmEuZ292LnR3Cnx8bW9sLmdvdi50dwp8fG12ZGlzLmdv
-di50dwp8fG5hdC5nb3YudHcKfHxuaGkuZ292LnR3Cnx8bnBhLmdvdi50dwp8fG5z
-Yy5nb3YudHcKfHxudGJrLmdvdi50dwp8fG50Ym5hLmdvdi50dwp8fG50YnQuZ292
-LnR3Cnx8bnRzbmEuZ292LnR3Cnx8cGNjLmdvdi50dwp8fHN0YXQuZ292LnR3Cnx8
-dGFpcGVpLmdvdi50dwp8fHRhaXdhbmpvYnMuZ292LnR3Cnx8dGhiLmdvdi50dwp8
-fHRpcG8uZ292LnR3Cnx8d2RhLmdvdi50dwoKfHx0ZWNvLWhrLm9yZwp8fHRlY28t
-bW8ub3JnCgpAQHx8YWZ0eWdoLmdvdi50dwpAQHx8YWlkZS5nb3YudHcKQEB8fHRw
-ZGUuYWlkZS5nb3YudHcKQEB8fGFydGUuZ292LnR3CkBAfHxjaHVrdWFuZy5nb3Yu
-dHcKQEB8fGN3Yi5nb3YudHcKQEB8fGN5Y2FiLmdvdi50dwpAQHx8ZGJuc2EuZ292
-LnR3CkBAfHxkZi5nb3YudHcKQEB8fGVhc3Rjb2FzdC1uc2EuZ292LnR3CkBAfHxl
-cnYtbnNhLmdvdi50dwpAQHx8Z3JiLmdvdi50dwpAQHx8Z3lzZC5ueWMuZ292LnR3
-CkBAfHxoY2hjYy5nb3YudHcKQEB8fGhzaW5jaHUtY2MuZ292LnR3CkBAfHxpbmVy
-Lmdvdi50dwpAQHx8a2xzaW8uZ292LnR3CkBAfHxrbXNlaC5nb3YudHcKQEB8fGx1
-bmd0YW5oci5nb3YudHcKQEB8fG1hb2xpbi1uc2EuZ292LnR3CkBAfHxtYXRzdS1u
-ZXdzLmdvdi50dwpAQHx8bWF0c3UtbnNhLmdvdi50dwpAQHx8bWF0c3VjYy5nb3Yu
-dHcKQEB8fG1vZS5nb3YudHcKQEB8fG12ZGlzLmdvdi50dwpAQHx8bmFua2FuLmdv
-di50dwpAQHx8bmNyZWUuZ292LnR3CkBAfHxuZWNvYXN0LW5zYS5nb3YudHcKQEB8
-fHNpcmF5YS1uc2EuZ292LnR3CkBAfHxjcm9tb3RjLm5hdC5nb3YudHcKQEB8fHRh
-eC5uYXQuZ292LnR3CkBAfHxuZWNvYXN0LW5zYS5nb3YudHcKQEB8fG5lci5nb3Yu
-dHcKQEB8fG5tbWJhLmdvdi50dwpAQHx8bm1wLmdvdi50dwpAQHx8bm12dHRjLmdv
-di50dwpAQHx8bm9ydGhndWFuLW5zYS5nb3YudHcKQEB8fG5wbS5nb3YudHcKQEB8
-fG5zdG0uZ292LnR3CkBAfHxudGRtaC5nb3YudHcKQEB8fG50bC5nb3YudHcKQEB8
-fG50c2VjLmdvdi50dwpAQHx8bnR1aC5nb3YudHcKQEB8fG52cmkuZ292LnR3CkBA
-fHxwZW5naHUtbnNhLmdvdi50dwpAQHx8cG9zdC5nb3YudHcKQEB8fHNpcmF5YS1u
-c2EuZ292LnR3CkBAfHxzdGR0aW1lLmdvdi50dwpAQHx8c3VubW9vbmxha2UuZ292
-LnR3CkBAfHx0YWl0dW5nLWhvdXNlLmdvdi50dwpAQHx8dGFveXVhbi5nb3YudHcK
-QEB8fHRwaGNjLmdvdi50dwpAQHx8dHJpbXQtbnNhLmdvdi50dwpAQHx8dmdodHBl
-Lmdvdi50dwpAQHx8dmdoa3MuZ292LnR3CkBAfHx2Z2h0Yy5nb3YudHcKQEB8fHdh
-bmZhbmcuZ292LnR3CkBAfHx5YXRzZW4uZ292LnR3CkBAfHx5ZGEuZ292LnR3Cgoh
-LS1AQHx8NHBwcGMuZ292LnR3CiEtLUBAfHw5MjEuZ292LnR3CiEtLUBAfHxkbXRp
-cC5nb3YudHcKIS0tQEB8fGV0cmFpbmluZy5nb3YudHcKIS0tQEB8fGdzbi1jZXJ0
-Lm5hdC5nb3YudHcKIS0tQEB8fG5pY2kubmF0Lmdvdi50dwohLS1AQHx8aGNjLmdv
-di50dwohLS1AQHx8aGVuZ2NodWVuLmdvdi50dwohLS1AQHx8a2hjYy5nb3YudHcK
-IS0tQEB8fGtobXMuZ292LnR3CiEtLUBAfHxray5nb3YudHcKIS0tQEB8fGtsY2Nh
-Yi5nb3YudHcKIS0tQEB8fGtscmEuZ292LnR3CiEtLUBAfHxubWguZ292LnR3CiEt
-LUBAfHxubXRsLmdvdi50dwohLS1AQHx8cGFicC5nb3YudHcKIS0tQEB8fHBldC5n
-b3YudHcKIS0tQEB8fHRjaGIuZ292LnR3CiEtLUBAfHx0Y3NhYy5nb3YudHcKIS0t
-QEB8fHRuY3NlYy5nb3YudHcKfHxraW5tZW4ub3JnLnR3CgohIS0tLVYyRVgtLS0K
-LnYyZXguY29tCiEtLUluY2x1ZGVkIGluIGFib3ZlIHJ1bGU6IGRucy52MmV4LmNv
-bQpAQHxodHRwOi8vdjJleC5jb20KQEB8aHR0cDovL2Nkbi52MmV4LmNvbQpAQHxo
-dHRwOi8vY24udjJleC5jb20KQEB8aHR0cDovL2hrLnYyZXguY29tCkBAfGh0dHA6
-Ly9pLnYyZXguY29tCkBAfGh0dHA6Ly9sYXgudjJleC5jb20KQEB8aHR0cDovL25l
-dWUudjJleC5jb20KQEB8aHR0cDovL3BhZ2VzcGVlZC52MmV4LmNvbQpAQHxodHRw
-Oi8vc3RhdGljLnYyZXguY29tCkBAfGh0dHA6Ly93b3Jrc3BhY2UudjJleC5jb20K
-QEB8aHR0cDovL3d3dy52MmV4LmNvbQoKISEtLS1ZYWhvby0tLQp8fGRhdGEuZmx1
-cnJ5LmNvbQpwYWdlLmJpZC55YWhvby5jb20KdHcuYmlkLnlhaG9vLmNvbQp8aHR0
-cHM6Ly90dy5iaWQueWFob28uY29tCmJsb2dzLnlhaG9vLmNvLmpwCnx8c2VhcmNo
-LnlhaG9vLmNvLmpwCmJ1eS55YWhvby5jb20udHcvZ2RzYWxlCmhrLnlhaG9vLmNv
-bQpoay5rbm93bGVkZ2UueWFob28uY29tCnR3Lm1vbmV5LnlhaG9vLmNvbQpoay5t
-eWJsb2cueWFob28uY29tCm5ld3MueWFob28uY29tL2NoaW5hLWJsb2Nrcy1iYmMK
-fHxoay5uZXdzLnlhaG9vLmNvbQpoay5yZC55YWhvby5jb20KaGsuc2VhcmNoLnlh
-aG9vLmNvbS9zZWFyY2gKaGsudmlkZW8ubmV3cy55YWhvby5jb20vdmlkZW8KbWVt
-ZS55YWhvby5jb20KIS0tdHcueWFob28uY29tCnR3LmFuc3dlcnMueWFob28uY29t
-CnxodHRwczovL3R3LmFuc3dlcnMueWFob28uY29tCnx8dHcua25vd2xlZGdlLnlh
-aG9vLmNvbQp8fHR3Lm1hbGwueWFob28uY29tCnR3LnlhaG9vLmNvbQp8fHR3Lm1v
-YmkueWFob28uY29tCnR3Lm15YmxvZy55YWhvby5jb20KfHx0dy5uZXdzLnlhaG9v
-LmNvbQpwdWxzZS55YWhvby5jb20KfHxzZWFyY2gueWFob28uY29tCnVwY29taW5n
-LnlhaG9vLmNvbQp2aWRlby55YWhvby5jb20KfHx5YWhvby5jb20uaGsKfHxkdWNr
-ZHVja2dvLW93bmVkLXNlcnZlci55YWhvby5uZXQKCiEtLS0tLS0tLS0tLS0tLS0t
-LS1OdW1lcmljcy0tLS0tLS0tLS0tLS0tLS0tLS0tLQouMDMwYnV5LmNvbQouMHJ6
-LnR3CnxodHRwOi8vMHJ6LnR3CjEtYXBwbGUuY29tLnR3Cnx8MS1hcHBsZS5jb20u
-dHcKLjEwLnR0Ci4xMDBrZS5vcmcKLjEwMDBnaXJpLm5ldAp8fDEwMDBnaXJpLm5l
-dAouMTBjb25kaXRpb25zb2Zsb3ZlLmNvbQp8fDEwbXVzdW1lLmNvbQoxMjNyZi5j
-b20KLjEyYmV0LmNvbQp8fDEyYmV0LmNvbQouMTJ2cG4uY29tCi4xMnZwbi5uZXQK
-fHwxMnZwbi5jb20KfHwxMnZwbi5uZXQKLjEzOC5jb20KMTQxaG9uZ2tvbmcuY29t
-L2ZvcnVtCnx8MTQxamouY29tCi4xNDF0dWJlLmNvbQouMTY4OC5jb20uYXUKLjE3
-M25nLmNvbQp8fDE3M25nLmNvbQouMTc3cGljLmluZm8KLjE3dDE3cC5jb20KfHwx
-OGJvYXJkLmNvbQp8fDE4Ym9hcmQuaW5mbwoxOG9ubHlnaXJscy5jb20KLjE4cDJw
-LmNvbQouMTh2aXJnaW5zZXguY29tCi4xOTQ5ZXIub3JnCnpoYW8uMTk4NC5jaXR5
-Cnx8emhhby4xOTg0LmNpdHkKMTk4NGJicy5jb20KfHwxOTg0YmJzLmNvbQohLS18
-fDE5ODRibG9nLmNvbQouMTk4NGJicy5vcmcKfHwxOTg0YmJzLm9yZwouMTk5MXdh
-eS5jb20KfHwxOTkxd2F5LmNvbQouMTk5OGNkcC5vcmcKLjFiYW8ub3JnCnxodHRw
-Oi8vMWJhby5vcmcKLjFlZXcuY29tCi4xbW9iaWxlLmNvbQp8aHR0cDovLyouMW1v
-YmlsZS50dwp8fDFwb25kby50dgouMi1oYW5kLmluZm8KLjIwMDBmdW4uY29tL2Ji
-cwouMjAwOHhpYW56aGFuZy5pbmZvCnx8MjAwOHhpYW56aGFuZy5pbmZvCnx8MjAx
-Ny5oawoyMWFuZHkuY29tL2Jsb2cKLjIxcHJvbi5jb20KMjFzZXh0dXJ5LmNvbQou
-MjI4Lm5ldC50dwp8fDIzM2FiYy5jb20KfHwyNGhycy5jYQoyNHNtaWxlLm9yZwoy
-bGlwc3R1YmUuY29tCi4yc2hhcmVkLmNvbQozMGJveGVzLmNvbQouMzE1bHouY29t
-Cnx8MzJyZWQuY29tCnx8MzZyYWluLmNvbQouM2E1YS5jb20KM2FyYWJ0di5jb20K
-LjNib3lzMmdpcmxzLmNvbQouM3Byb3h5LnJ1Ci4zcmVuLmNhCi4zdHVpLm5ldAp8
-fDRibHVlc3RvbmVzLmJpegouNGNoYW4uY29tCiEtLXx8NGNoYW4ub3JnCi40ZXZl
-cnByb3h5LmNvbQp8fDRldmVycHJveHkuY29tCnx8NHJidHYuY29tCnx8NHNoYXJl
-ZC5jb20KdGFpd2FubmF0aW9uLjUwd2Vicy5jb20KfHw1MS5jYQp8fDUxamF2Lm9y
-ZwouNTFsdW9iZW4uY29tCnx8NTFsdW9iZW4uY29tCi41Mjc4LmNjCi41Mjk5LnR2
-CjVhaW1pa3UuY29tCjVpMDEuY29tCi41aXNvdG9pNS5vcmcKLjVtYW9kYW5nLmNv
-bQp8fDYzaS5jb20KLjY0bXVzZXVtLm9yZwo2NHRpYW53YW5nLmNvbQo2NHdpa2ku
-Y29tCi42Ni5jYQo2NjZrYi5jb20KNnBhcmsuY29tCnx8NnBhcmsuY29tCnx8NnBh
-cmtlci5jb20KfHw3Y2FwdHVyZS5jb20KLjdjb3cuY29tCi44LWQuY29tCnxodHRw
-Oi8vOC1kLmNvbQo4NWNjLm5ldAouODVjYy51cwp8aHR0cDovLzg1Y2MudXMKfGh0
-dHA6Ly84NXN0LmNvbQouODgxOTAzLmNvbS9wYWdlL3poLXR3Lwp8fDg4MTkwMy5j
-b20KLjg4OC5jb20KLjg4OHBva2VyLmNvbQo4OS42NC5jaGFydGVyLmNvbnN0aXR1
-dGlvbmFsaXNtLnNvbHV0aW9ucwo4OS02NC5vcmcKfHw4OS02NC5vcmcKLjhuZXdz
-LmNvbS50dwouOHoxLm5ldAp8fDh6MS5uZXQKLjkwMDE3MDAuY29tCnxodHRwOi8v
-OTA4dGFpd2FuLm9yZy8KfHw5MXBvcm4uY29tCnx8OTF2cHMuY2x1YgouOTJjY2F2
-LmNvbQouOTkxLmNvbQp8aHR0cDovLzk5MS5jb20KLjk5YnRnYzAxLmNvbQp8fDk5
-YnRnYzAxLmNvbQouOTljbi5pbmZvCnxodHRwOi8vOTljbi5pbmZvCnx8OWJpcy5j
-b20KfHw5YmlzLm5ldAoKIS0tLS0tLS0tLS0tLS0tLS0tLS0tQUEtLS0tLS0tLS0t
-LS0tLS0tLS0tLS0tLS0tCi50aWJldC5hLnNlCnxodHRwOi8vdGliZXQuYS5zZQp8
-fGEtbm9ybWFsLWRheS5jb20KYTUuY29tLnJ1CnxodHRwOi8vYWFtYWNhdS5jb20K
-IS0tfGh0dHA6Ly9jZG4qLmFiYy5jb20vCi5hYmMuY29tCi5hYmMubmV0LmF1Cnx8
-YWJjLm5ldC5hdQouYWJjaGluZXNlLmNvbQphYmNsaXRlLm5ldAp8aHR0cHM6Ly93
-d3cuYWJjbGl0ZS5uZXQKLmFibHdhbmcuY29tCi5hYm9sdW93YW5nLmNvbQp8fGFi
-b2x1b3dhbmcuY29tCi5hYm91dGdmdy5jb20KLmFicy5lZHUKLmFjY2ltLm9yZwou
-YWNlcm9zLWRlLWhpc3BhbmlhLmNvbQouYWNldnBuLmNvbQp8fGFjZXZwbi5jb20K
-LmFjZzE4Lm1lCnxodHRwOi8vYWNnMTgubWUKfHxhY2drai5jb20KLmFjbWVkaWEz
-NjUuY29tCi5hY253LmNvbS5hdQphY3Rmb3J0aWJldC5vcmcKYWN0aW1lcy5jb20u
-YXUKYWN0aXZwbi5jb20KfHxhY3RpdnBuLmNvbQp8fGFjdWxvLnVzCnx8YWRkaWN0
-ZWR0b2NvZmZlZS5kZQouYWRlbGFpZGViYnMuY29tL2JicwouYWRwbC5vcmcuaGsK
-fGh0dHA6Ly9hZHBsLm9yZy5oawouYWR1bHQtc2V4LWdhbWVzLmNvbQp8fGFkdWx0
-LXNleC1nYW1lcy5jb20KYWR1bHRmcmllbmRmaW5kZXIuY29tCmFkdWx0a2VlcC5u
-ZXQvcGVlcHNob3cvbWVtYmVycy9tYWluLmh0bQp8fGFkdmFuc2NlbmUuY29tCnx8
-YWR2ZXJ0ZmFuLmNvbQouYWUub3JnCnx8YWVuaGFuY2Vycy5jb20KfHxhZi5taWwK
-LmFmYW50aWJicy5jb20KfGh0dHA6Ly9hZmFudGliYnMuY29tCi5haS1rYW4ubmV0
-Cnx8YWkta2FuLm5ldAphaS13ZW4ubmV0Ci5haXBoLm5ldAp8fGFpcGgubmV0Ci5h
-aXJhc2lhLmNvbQp8fGFpcmNvbnNvbGUuY29tCnxodHRwOi8vZG93bmxvYWQuYWly
-Y3JhY2stbmcub3JnCi5haXJ2cG4ub3JnCnx8YWlydnBuLm9yZwouYWlzZXguY29t
-Cnx8YWl0Lm9yZy50dwphaXdlaXdlaS5jb20KLmFpd2Vpd2VpYmxvZy5jb20KfHxh
-aXdlaXdlaWJsb2cuY29tCnx8d3d3LmFqc2FuZHMuY29tCgohIS0tLUFrYW1haS0t
-LQphMjQ4LmUuYWthbWFpLm5ldAp8fGEyNDguZS5ha2FtYWkubmV0CgpyZmFsaXZl
-MS5ha2FjYXN0LmFrYW1haXN0cmVhbS5uZXQKdm9hLTExLmFrYWNhc3QuYWthbWFp
-c3RyZWFtLm5ldAoKISEtLTQwMwp8fGFiZW1hdHYuYWthbWFpemVkLm5ldAp8fGxp
-bmVhci1hYmVtYXR2LmFrYW1haXplZC5uZXQKfHx2b2QtYWJlbWF0di5ha2FtYWl6
-ZWQubmV0Cgp8aHR0cHM6Ly9mYmNkbiouYWthbWFpaGQubmV0LwohLS18fGZiZXh0
-ZXJuYWwtYS5ha2FtYWloZC5uZXQKIS0tfHxmYnN0YXRpYy1hLmFrYW1haWhkLm5l
-dAohLS18aHR0cHM6Ly9pZ2NkbiouYWthbWFpaGQubmV0CnJ0aGtsaXZlMi1saC5h
-a2FtYWloZC5uZXQKCi5ha2FkZW1peWUub3JnL3VnCnxodHRwOi8vYWthZGVtaXll
-Lm9yZy91Zwp8fGFraWJhLW9ubGluZS5jb20KfHxha293Lm9yZwouYWwtaXNsYW0u
-Y29tCnx8YWwtcWltbWFoLm5ldAp8fGFsYWJvdXQuY29tCi5hbGFuaG91LmNvbQp8
-aHR0cDovL2FsYW5ob3UuY29tCi5hbGFyYWIucWEKfHxhbGFzYmFycmljYWRhcy5v
-cmcKYWxleGx1ci5vcmcKfHxhbGZvcmF0dHYubmV0Ci5hbGhheWF0LmNvbQouYWxp
-Y2VqYXBhbi5jby5qcAphbGllbmd1LmNvbQp8fGFsa2FzaXIuY29tCnx8YWxsY29u
-bmVjdGVkLmNvCi5hbGxkcmF3bnNleC5jb20KfHxhbGxkcmF3bnNleC5jb20KLmFs
-bGVydnBuLmNvbQp8fGFsbGZpbmVnaXJscy5jb20KLmFsbGdpcmxtYXNzYWdlLmNv
-bQphbGxnaXJsc2FsbG93ZWQub3JnCi5hbGxncmF2dXJlLmNvbQphbGxpYW5jZS5v
-cmcuaGsKLmFsbGluZmEuY29tCnx8YWxsaW5mYS5jb20KLmFsbGphY2twb3RzY2Fz
-aW5vLmNvbQp8fGFsbG1vdmllLmNvbQp8fGFsbWFzZGFybmV3cy5jb20KLmFscGhh
-cG9ybm8uY29tCnx8YWx0ZXJuYXRlLXRvb2xzLmNvbQphbHRlcm5hdGl2ZXRvLm5l
-dC9zb2Z0d2FyZQphbHZpbmFsZXhhbmRlci5jb20KYWx3YXlzZGF0YS5jb20KfHxh
-bHdheXNkYXRhLmNvbQp8fGFsd2F5c2RhdGEubmV0Ci5hbHdheXN2cG4uY29tCnx8
-YWx3YXlzdnBuLmNvbQp8fGFtNzMwLmNvbS5oawphbWVibG8uanAKfHxhbWVibG8u
-anAKd3d3MS5hbWVyaWNhbi5lZHUvdGVkL2ljZS90aWJldAp8fGFtZXJpY2FuZ3Jl
-ZW5jYXJkLmNvbQp8aHR0cDovL3d3dy5hbWVyaWNvcnBzLmdvdgp8fGFtaWJsb2Nr
-ZWRvcm5vdC5jb20KLmFtaWdvYmJzLm5ldAouYW1pdGFiaGFmb3VuZGF0aW9uLnVz
-CnxodHRwOi8vYW1pdGFiaGFmb3VuZGF0aW9uLnVzCi5hbW5lc3R5Lm9yZwp8fGFt
-bmVzdHkub3JnCnx8YW1uZXN0eS5vcmcuaGsKLmFtbmVzdHkudHcKLmFtbmVzdHl1
-c2Eub3JnCnx8YW1uZXN0eXVzYS5vcmcKLmFtbnllbWFjaGVuLm9yZwouYW1vaWlz
-dC5jb20KLmFtdGItdGFpcGVpLm9yZwphbmRyb2lkcGx1cy5jby9hcGsKLmFuZHln
-b2QuY29tCnxodHRwOi8vYW5keWdvZC5jb20KYW5uYXRhbS5jb20vY2hpbmVzZQp8
-fGFuY2hvcmZyZWUuY29tCiEtLUdIUwp8fGFuY3Njb25mLm9yZwp8fGFuZGZhcmF3
-YXkubmV0Cnx8YW5kcm9pZC14ODYub3JnCmFuZ2VsZmlyZS5jb20vaGkvaGF5YXNo
-aQp8fGFuZ3VsYXJqcy5vcmcKYW5pbWVjcmF6eS5uZXQKLmFuaW1lc2hpcHB1dWRl
-bi5jb20KYW5pc2NhcnR1am8uY29tCnx8YW5pc2NhcnR1am8uY29tCnx8YW5vYmlp
-LmNvbQphbm9ueW1pc2UudXMKLmFub255bWl0eW5ldHdvcmsuY29tCi5hbm9ueW1p
-emVyLmNvbQouYW5vbnltb3VzZS5vcmcKfHxhbm9ueW1vdXNlLm9yZwphbm9udGV4
-dC5jb20KLmFucG9wby5jb20KLmFuc3dlcmluZy1pc2xhbS5vcmcKfGh0dHA6Ly93
-d3cuYW50ZC5vcmcKfHxhbnRob255Y2FsemFkaWxsYS5jb20KLmFudGkxOTg0LmNv
-bQphbnRpY2hyaXN0ZW5kb20uY29tCi5hbnRpd2F2ZS5uZXQKfGh0dHA6Ly9hbnRp
-d2F2ZS5uZXQKLmFueXBvcm4uY29tCi5hbnlzZXguY29tCnxodHRwOi8vYW55c2V4
-LmNvbQp8fGFvYm8uY29tLmF1Ci5hb2ZyaWVuZC5jb20KfGh0dHA6Ly9hb2ZyaWVu
-ZC5jb20KLmFvZnJpZW5kLmNvbS5hdQouYW9qaWFvLm9yZwp8fGFvbWl3YW5nLmNv
-bQp2aWRlby5hcC5vcmcKLmFwZXR1YmUuY29tCnx8YXBpYXJ5LmlvCi5hcGlnZWUu
-Y29tCnx8YXBpZ2VlLmNvbQphcGstZGwuY29tCmFwa2RsZXIuY29tL2Fway92aWV3
-Ci5hcGttb25rLmNvbS9hcHAKfHxhcGtwbHouY29tCmFwa3B1cmUuY29tCnx8YXBr
-cHVyZS5jb20KLmFwbHVzdnBuLmNvbQohLS18fGFwcGFubmllLmNvbQouYXBwZG93
-bmxvYWRlci5uZXQvQW5kcm9pZAouYXBwbGVkYWlseS5jb20KfHxhcHBsZWRhaWx5
-LmNvbQphcHBsZWRhaWx5LmNvbS5oawp8fGFwcGxlZGFpbHkuY29tLmhrCmFwcGxl
-ZGFpbHkuY29tLnR3Cnx8YXBwbGVkYWlseS5jb20udHcKLmFwcHNob3BwZXIuY29t
-CnxodHRwOi8vYXBwc2hvcHBlci5jb20KfHxhcHBzb2Nrcy5uZXQKfHxhcHBzdG8u
-cmUKLmFwdG9pZGUuY29tCnx8YXB0b2lkZS5jb20KfHxhcmNoaXZlcy5nb3YKLmFy
-Y2hpdmUuZm8KfHxhcmNoaXZlLmZvCi5hcmNoaXZlLmlzCnx8YXJjaGl2ZS5pcwou
-YXJjaGl2ZS5saQp8fGFyY2hpdmUubGkKfHxhcmNoaXZlLm9yZwphcmNoaXZlLnRv
-ZGF5CnxodHRwczovL2FyY2hpdmUudG9kYXkKLmFyY3Rvc2lhLmNvbQp8aHR0cDov
-L2FyY3Rvc2lhLmNvbQp8fGFyZWNhLWJhY2t1cC5vcmcKLmFyZXRodXNhLnN1Cnx8
-YXJldGh1c2Euc3UKfHxhcmxpbmd0b25jZW1ldGVyeS5taWwKfHxhcm15Lm1pbAou
-YXJ0NHRpYmV0MTk5OC5vcmcKYXJ0b2ZwZWFjZWZvdW5kYXRpb24ub3JnCmFydHN5
-Lm5ldAp8fGFzYWNwLm9yZwphc2RmZy5qcC9kYWJyCmFzZy50bwouYXNpYS1nYW1p
-bmcuY29tCi5hc2lhaGFydmVzdC5vcmcKfHxhc2lhaGFydmVzdC5vcmcKYXNpYW5l
-d3MuaXQKfGh0dHA6Ly9qYXBhbmZpcnN0LmFzaWFuZnJlZWZvcnVtLmNvbS8KfHxh
-c2lhbnNleGRpYXJ5LmNvbQp8fGFzaWFud29tZW5zZmlsbS5kZQouYXNpYXRncC5j
-b20KLmFzaWF0b2RheS51cwp8fGFza3N0dWRlbnQuY29tCi5hc2t5bnoubmV0Cnx8
-YXNreW56Lm5ldAp8fGFzc2VtYmxhLmNvbQp8fGFzdHJpbGwuY29tCnx8YXRjLm9y
-Zy5hdQouYXRjaGluZXNlLmNvbQp8aHR0cDovL2F0Y2hpbmVzZS5jb20KYXRnZncu
-b3JnCi5hdGxhc3Bvc3QuY29tCnx8YXRsYXNwb3N0LmNvbQp8fGF0ZG10LmNvbQou
-YXRsYW50YTE2OC5jb20vZm9ydW0KLmF0bmV4dC5jb20KfHxhdG5leHQuY29tCmlj
-ZS5hdWRpb25vdy5jb20KLmF2LmNvbQp8fGF2Lm1vdmllCi5hdi1lLWJvZHkuY29t
-CmF2YWF6Lm9yZwp8fGF2YWF6Lm9yZwohLS18fGF2YXN0LmNvbQouYXZib2R5LnR2
-Ci5hdmNpdHkudHYKLmF2Y29vbC5jb20KLmF2ZGIuaW4KfHxhdmRiLmluCi5hdmRi
-LnR2Cnx8YXZkYi50dgouYXZmYW50YXN5LmNvbQouYXZnbGUuY29tCnx8YXZnbGUu
-Y29tCnx8YXZpZGVtdXgub3JnCnx8YXZvaXNpb24uY29tCi5hdnlhaG9vLmNvbQp8
-fGF4dXJlZm9ybWFjLmNvbQouYXplcmJheWNhbi50dgphemVyaW1peC5jb20KIS0t
-Ym94dW4uYXp1cmV3ZWJzaXRlcy5uZXQgZG9lc24ndCBleGlzdC4KYm94dW4qLmF6
-dXJld2Vic2l0ZXMubmV0Cnx8Ym94dW4qLmF6dXJld2Vic2l0ZXMubmV0CgohLS0t
-LS0tLS0tLS0tLS0tLS0tLS1CQi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KZm9y
-dW0uYmFieS1raW5nZG9tLmNvbQpiYWJ5bmV0LmNvbS5oawpiYWNrY2hpbmEuY29t
-Cnx8YmFja2NoaW5hLmNvbQouYmFja3BhY2tlcnMuY29tLnR3L2ZvcnVtCmJhY2t0
-b3RpYW5hbm1lbi5jb20KLmJhZGl1Y2FvLmNvbQp8fGJhZGl1Y2FvLmNvbQouYmFk
-am9qby5jb20KYmFkb28uY29tCnxodHRwOi8vKjIuYmFoYW11dC5jb20udHcKfHxi
-YWlkdS5qcAouYmFpamllLm9yZwp8aHR0cDovL2JhaWppZS5vcmcKfHxiYWlsYW5k
-YWlseS5jb20KfHxiYWl4aW5nLm1lCnx8YmFrZ2Vla2hvbWUudGsKLmJhbmFuYS12
-cG4uY29tCnx8YmFuYW5hLXZwbi5jb20KLmJhbmQudXMKLmJhbmR3YWdvbmhvc3Qu
-Y29tCnx8YmFuZHdhZ29uaG9zdC5jb20KLmJhbmdicm9zbmV0d29yay5jb20KLmJh
-bmdjaGVuLm5ldAp8aHR0cDovL2JhbmdjaGVuLm5ldAp8fGJhbmd5b3VsYXRlci5j
-b20KYmFubmVkYm9vay5vcmcKfHxiYW5uZWRib29rLm9yZwouYmFubmVkbmV3cy5v
-cmcKLmJhcmFtYW5nYW9ubGluZS5jb20KfGh0dHA6Ly9iYXJhbWFuZ2FvbmxpbmUu
-Y29tCi5iYXJlbmFrZWRpc2xhbS5jb20KfHxiYXJuYWJ1LmNvLnVrCnx8YmFydG9u
-LmRlCmJhcnR2cG4uY29tCi5iYXN0aWxsZXBvc3QuY29tCmJheXZvaWNlLm5ldAp8
-fGJheXZvaWNlLm5ldApkYWp1c2hhLmJheXdvcmRzLmNvbQp8fGJiY2hhdC50dgp8
-fGJiLWNoYXQudHYKLmJiZy5nb3YKLmJia3ouY29tL2ZvcnVtCi5iYm5yYWRpby5v
-cmcKYmJzLXR3LmNvbQouYmJzZGlnZXN0LmNvbS90aHJlYWQKfHxiYnNmZWVkLmNv
-bQpiYnNsYW5kLmNvbQouYmJzbW8uY29tCi5iYnNvbmUuY29tCmJidG95c3RvcmUu
-Y29tCi5iY2FzdC5jby5uegouYmNjLmNvbS50dy9ib2FyZAouYmNjaGluZXNlLm5l
-dAouYmNtb3JuaW5nLmNvbQpiZHNtdmlkZW9zLm5ldAouYmVhY29uZXZlbnRzLmNv
-bQouYmViby5jb20KfHxiZWJvLmNvbQouYmVldnBuLmNvbQp8fGJlZXZwbi5jb20K
-LmJlaGluZGtpbmsuY29tCnx8YmVpamluZzE5ODkuY29tCmJlaWppbmdzcHJpbmcu
-Y29tCnx8YmVpamluZ3NwcmluZy5jb20KLmJlaWppbmd6eC5vcmcKfGh0dHA6Ly9i
-ZWlqaW5nengub3JnCi5iZWxhbWlvbmxpbmUuY29tCi5iZWxsLndpa2kKfGh0dHA6
-Ly9iZWxsLndpa2kKYmVteXdpZmUuY2MKYmVyaWMubWUKLmJlcmxpbnR3aXR0ZXJ3
-YWxsLmNvbQp8fGJlcmxpbnR3aXR0ZXJ3YWxsLmNvbQouYmVybS5jby5uegouYmVz
-dGZvcmNoaW5hLm9yZwp8fGJlc3Rmb3JjaGluYS5vcmcKLmJlc3Rnb3JlLmNvbQou
-YmVzdHBvcm5zdGFyZGIuY29tCnx8YmVzdHZwbi5jb20KLmJlc3R2cG5hbmFseXNp
-cy5jb20KLmJlc3R2cG5zZXJ2ZXIuY29tCi5iZXN0dnBuc2VydmljZS5jb20KLmJl
-c3R2cG51c2EuY29tCnx8YmV0MzY1LmNvbQouYmV0ZmFpci5jb20KfHxiZXR0ZXJu
-ZXQuY28KLmJldHRlcnZwbi5jb20KfHxiZXR0ZXJ2cG4uY29tCi5iZXR0d2Vlbi5j
-b20KfHxiZXR0d2Vlbi5jb20KfHxiZXR2aWN0b3IuY29tCi5iZXd3dy5uZXQKLmJl
-eW9uZGZpcmV3YWxsLmNvbQp8fGJmbm4ub3JnCnx8YmZzaC5oawouYmd2cG4uY29t
-Cnx8Ymd2cG4uY29tCi5iaWFubGVpLmNvbQpAQHx8YmlhbmxlaS5jb20KYmlhbnRh
-aWxhamlhby5jb20KYmlhbnRhaWxhamlhby5pbgouYmlibGVzZm9yYW1lcmljYS5v
-cmcKfGh0dHA6Ly9iaWJsZXNmb3JhbWVyaWNhLm9yZwouYmljMjAxMS5vcmcKYmln
-Zm9vbHMuY29tCnx8YmlnamFwYW5lc2VzZXguY29tCi5iaWduZXdzLm9yZwp8fGJp
-Z25ld3Mub3JnCi5iaWdzb3VuZC5vcmcKLmJpbGl3b3JsZC5jb20KfGh0dHA6Ly9i
-aWxpd29ybGQuY29tCnxodHRwOi8vYmlsbHlwYW4uY29tL3dpa2kKLmJpbnV4Lm1l
-CmFpLmJpbndhbmcubWUvY291cGxldApiaXBpYy5uZXQKLmJpdC5kbwp8aHR0cDov
-L2JpdC5kbwouYml0Lmx5CnxodHRwOi8vYml0Lmx5CiEtLXx8Yml0YnVja2V0Lm9y
-Zwp8fGJpdGNvaW50YWxrLm9yZwouYml0c2hhcmUuY29tCnx8Yml0c2hhcmUuY29t
-CmJpdHNub29wLmNvbQouYml0dmlzZS5jb20KfHxiaXR2aXNlLmNvbQpiaXpoYXQu
-Y29tCnx8YmwtZG91amluc291a28uY29tCi5iam5ld2xpZmUub3JnCi5ianMub3Jn
-CmJqemMub3JnCnx8Ymp6Yy5vcmcKLmJsYWNrbG9naWMuY29tCi5ibGFja3Zwbi5j
-b20KfHxibGFja3Zwbi5jb20KYmxld3Bhc3MuY29tCnRvci5ibGluZ2JsaW5nc3F1
-YWQubmV0Ci5ibGlua3guY29tCnx8Ymxpbmt4LmNvbQpibGludy5jb20KLmJsaXAu
-dHYKfHxibGlwLnR2LwouYmxvY2tjbi5jb20KfHxibG9ja2NuLmNvbQp8fGJsb2Nr
-bGVzcy5jb20KfHxibG9nLmRlCi5ibG9nLmpwCnxodHRwOi8vYmxvZy5qcApAQHx8
-anB1c2guY24KLmJsb2djYXRhbG9nLmNvbQp8fGJsb2djYXRhbG9nLmNvbQp8fGJs
-b2djaXR5Lm1lCi5ibG9nZ2VyLmNvbQp8fGJsb2dnZXIuY29tCmJsb2dpbWcuanAK
-fHxibG9nLmthbmd5ZS5vcmcKLmJsb2dsaW5lcy5jb20KfHxibG9nbGluZXMuY29t
-Cnx8YmxvZ2xvdmluLmNvbQpyY29udmVyc2F0aW9uLmJsb2dzLmNvbQpibG9ndGQu
-bmV0Ci5ibG9ndGQub3JnCnxodHRwOi8vYmxvZ3RkLm9yZwp8fGJsb29kc2hlZC5u
-ZXQKLmJsb29tYmVyZy5jbgp8fGJsb29tYmVyZy5jbgouYmxvb21iZXJnLmNvbQp8
-fGJsb29tYmVyZy5jb20KYmxvb21iZXJnLmRlCnx8Ymxvb21iZXJnLmRlCiEtLTQw
-Mwp8fGFzc2V0cy5id2J4LmlvCgp8fGJsb29tZm9ydHVuZS5jb20KYmx1ZWFuZ2Vs
-bGl2ZS5jb20KLmJtZmlubi5jb20KLmJuZXdzLmNvCnx8Ym5ld3MuY28KfHxibnJt
-ZXRhbC5jb20KYm9hcmRyZWFkZXIuY29tL3RocmVhZAp8fGJvYXJkcmVhZGVyLmNv
-bQouYm9kLmFzaWEKfGh0dHA6Ly9ib2QuYXNpYQouYm9kb2c4OC5jb20KLmJvbGVo
-dnBuLm5ldAp8fGJvbGVodnBuLm5ldApib25ib25tZS5jb20KLmJvbmJvbnNleC5j
-b20KLmJvbmZvdW5kYXRpb24ub3JnCi5ib25nYWNhbXMuY29tCnx8Ym9vYnN0YWdy
-YW0uY29tCnx8Ym9vay5jb20udHcKYm9va2VwdWIuY29tCnx8Ym9va3MuY29tLnR3
-Cnx8Ym90YW53YW5nLmNvbQouYm90Lm51Ci5ib3dlbnByZXNzLmNvbQp8fGJvd2Vu
-cHJlc3MuY29tCnx8YXBwLmJveC5jb20KZGwuYm94Lm5ldAp8fGRsLmJveC5uZXQK
-LmJveHBuLmNvbQp8fGJveHBuLmNvbQpib3h1bi5jb20KfHxib3h1bi5jb20KLmJv
-eHVuLnR2Cnx8Ym94dW4udHYKYm94dW5ibG9nLmNvbQp8fGJveHVuYmxvZy5jb20K
-LmJveHVuY2x1Yi5jb20KYm95YW5ndS5jb20KLmJveWZyaWVuZHR2LmNvbQouYm95
-c2Zvb2QuY29tCnx8YnIuc3QKLmJyYWlueXF1b3RlLmNvbS9xdW90ZXMvYXV0aG9y
-cy9kL2RhbGFpX2xhbWEKfHxicmFuZG9uaHV0Y2hpbnNvbi5jb20KfHxicmF1bWVp
-c3Rlci5vcmcKLmJyYXZvdHViZS5uZXQKfHxicmF2b3R1YmUubmV0Ci5icmF6emVy
-cy5jb20KfHxicmF6emVycy5jb20KLmJyZWFrLmNvbQp8fGJyZWFrLmNvbQpicmVh
-a2dmdy5jb20KfHxicmVha2dmdy5jb20KYnJlYWtpbmc5MTEuY29tCi5icmVha2lu
-Z3R3ZWV0cy5jb20KfHxicmVha2luZ3R3ZWV0cy5jb20KfHxicmVha3dhbGwubmV0
-CmJyaWlhbi5jb20vNjUxMS9mcmVlZ2F0ZQouYnJpZWZkcmVhbS5jb20vJUU3JUI0
-JUEwJUU2JUEzJUJBCmJyaXp6bHkuY29tCnx8YnJpenpseS5jb20KfHxicmttZC5j
-b20KYnJvYWRib29rLmNvbQouYnJvYWRwcmVzc2luYy5jb20KfHxicm9hZHByZXNz
-aW5jLmNvbQpiYnMuYnJvY2tiYnMuY29tCmJydWNld2FuZy5uZXQKLmJydXRhbHRn
-cC5jb20KfHxicnV0YWx0Z3AuY29tCi5idDJtYWcuY29tCnx8YnQ5NS5jb20KLmJ0
-YWlhLmNvbQouYnRidGF2LmNvbQp8aHR0cDovL2J0ZGlnZy5vcmcKLmJ0a3UubWUK
-fHxidGt1Lm1lCnx8YnRrdS5vcmcKLmJ0c3ByZWFkLmNvbQouYnRzeW5ja2V5cy5j
-b20KLmJ1ZGFlZHUub3JnCnx8YnVkYWVkdS5vcmcKLmJ1ZGRoYW5ldC5jb20udHcv
-emZyb3AvdGliZXQKLmJ1ZGRoaXN0Y2hhbm5lbC50dgouYnVmZmVyZWQuY29tCnxo
-dHRwOi8vYnVmZmVyZWQuY29tCi5idWxsb2cub3JnCnx8YnVsbG9nLm9yZwouYnVs
-bG9nZ2VyLmNvbQp8fGJ1bGxvZ2dlci5jb20KYnVuYnVuaGsuY29tCi5idXNheWFy
-aS5jb20KfGh0dHA6Ly9idXNheWFyaS5jb20KLmJ1c2luZXNzaW5zaWRlci5jb20v
-YmluZy1jb3VsZC1iZS1jZW5zb3Jpbmctc2VhcmNoLXJlc3VsdHMtMjAxNAouYnVz
-aW5lc3NpbnNpZGVyLmNvbS9jaGluYS1iYW5rcy1wcmVwYXJpbmctZm9yLWRlYnQt
-aW1wbG9zaW9uLTIwMTQKLmJ1c2luZXNzaW5zaWRlci5jb20vaG9uZy1rb25nLWFj
-dGl2aXN0cy1kZWZ5LXBvbGljZS10ZWFyLWdhcy1hcy1wcm90ZXN0cy1jb250aW51
-ZS1vdmVybmlnaHQtMjAxNAouYnVzaW5lc3NpbnNpZGVyLmNvbS9pbnRlcm5ldC1v
-dXRhZ2VzLXJlcG9ydGVkLWluLW5vcnRoLWtvcmVhLTIwMTQKLmJ1c2luZXNzaW5z
-aWRlci5jb20vaXBob25lLTYtaXMtYXBwcm92ZWQtZm9yLXNhbGUtaW4tY2hpbmEt
-MjAxNAouYnVzaW5lc3NpbnNpZGVyLmNvbS9uZmwtYW5ub3VuY2Vycy1zdXJmYWNl
-LXRhYmxldHMtMjAxNAouYnVzaW5lc3NpbnNpZGVyLmNvbS9wYW5hbWEtcGFwZXJz
-Ci5idXNpbmVzc2luc2lkZXIuY29tL3VtYnJlbGxhLW1hbi1ob25nLWtvbmctMjAx
-NAp8aHR0cDovL3d3dy5idXNpbmVzc2luc2lkZXIuY29tLmF1LyoKLmJ1c2luZXNz
-dG9kYXkuY29tLnR3Cnx8YnVzaW5lc3N0b2RheS5jb20udHcKLmJ1c2luZXNzd2Vl
-ay5jb20KLmJ1c3Uub3JnL25ld3MKfGh0dHA6Ly9idXN1Lm9yZy9uZXdzCmJ1c3l0
-cmFkZS5jb20KLmJ1dWdhYS5jb20KLmJ1enpoYW5kLmNvbQouYnV6emhhbmQubmV0
-Ci5idXp6b3JhbmdlLmNvbQp8fGJ1enpvcmFuZ2UuY29tCnx8YnZwbi5jb20KfHxi
-d2gxLm5ldApid3NqLmhrCnx8YngudGwKCiEtLS0tLS0tLS0tLS0tLS0tLS0tLUND
-LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQouYy1zcGFudmlkZW8ub3JnCnx8Yy1z
-cGFudmlkZW8ub3JnCnx8Yy1lc3Qtc2ltcGxlLmNvbQouYzEwMHRpYmV0Lm9yZwp8
-fGNhYmxlZ2F0ZXNlYXJjaC5uZXQKLmNhY2hpbmVzZS5jb20KLmNhY253LmNvbQp8
-aHR0cDovL2NhY253LmNvbQouY2FjdHVzdnBuLmNvbQp8fGNhY3R1c3Zwbi5jb20K
-LmNhZmVwcmVzcy5jb20KLmNhaHIub3JnLnR3Ci5jYWxhbWVvLmNvbS9ib29rcwpj
-bi5jYWxhbWVvLmNvbQp8aHR0cDovL2NuLmNhbGFtZW8uY29tCi5jYWxnYXJ5Y2hp
-bmVzZS5jYQouY2FsZ2FyeWNoaW5lc2UuY29tCi5jYWxnYXJ5Y2hpbmVzZS5uZXQK
-fGh0dHA6Ly9ibG9nLmNhbGlicmUtZWJvb2suY29tCnxodHRwOi8vZ29vZ2xlLmNh
-bHN0YXRlLmVkdQpmYWx1bi5jYWx0ZWNoLmVkdQouaXRzLmNhbHRlY2guZWR1L35m
-YWx1bi8KLmNhbTQuY29tCi5jYW00LmpwCi5jYW00LnNnCi5jYW1mcm9nLmNvbQp8
-fGNhbWZyb2cuY29tCnx8Y2Ftcy5jb20KLmNhbXMub3JnLnNnCmNhbmFkYW1lZXQu
-Y29tCi5jYW5hbHBvcm5vLmNvbQp8aHR0cDovL2Jicy5jYW50b25lc2UuYXNpYS8K
-IS0taHR0cDovL3d3dy5jYW50b25lc2UuYXNpYS9hY3Rpb24tYmJzLmh0bWwKLmNh
-bnl1Lm9yZwp8fGNhbnl1Lm9yZwouY2FvLmltCi5jYW9iaWFuLmluZm8KfHxjYW9i
-aWFuLmluZm8KY2FvY2hhbmdxaW5nLmNvbQp8fGNhb2NoYW5ncWluZy5jb20KLmNh
-cC5vcmcuaGsKfHxjYXAub3JnLmhrCi5jYXJhYmluYXN5cGlzdG9sYXMuY29tCmNh
-cmRpbmFsa3VuZ2ZvdW5kYXRpb24ub3JnCmNhcm1vdG9yc2hvdy5jb20Kc3MuY2Fy
-cnl6aG91LmNvbQouY2FydG9vbm1vdmVtZW50LmNvbQp8fGNhcnRvb25tb3ZlbWVu
-dC5jb20KLmNhc2FkZWx0aWJldGJjbi5vcmcKLmNhc2F0aWJldC5vcmcubXgKfGh0
-dHA6Ly9jYXNhdGliZXQub3JnLm14CmNhcmkuY29tLm15Cnx8Y2FyaWJiZWFuY29t
-LmNvbQouY2FzaW5va2luZy5jb20KLmNhc2lub3JpdmEuY29tCnx8Y2F0Y2gyMi5u
-ZXQKLmNhdGNoZ29kLmNvbQp8aHR0cDovL2NhdGNoZ29kLmNvbQp8fGNhdGZpZ2h0
-cGF5cGVydmlldy54eHgKLmNhdGhvbGljLm9yZy5oawp8fGNhdGhvbGljLm9yZy5o
-awpjYXRob2xpYy5vcmcudHcKfHxjYXRob2xpYy5vcmcudHcKLmNhdGh2b2ljZS5v
-cmcudHcKfHxjYXR0dC5jb20KLmNiYy5jYQp8fGNiYy5jYQouY2JzbmV3cy5jb20v
-dmlkZW8KLmNidGMub3JnLmhrCiEtLmNjYy5kZQohLXx8Y2NjLmRlCnx8Y2NjYXQu
-Y2MKfHxjY2NhdC5jbwouY2NkdHIub3JnCnx8Y2NkdHIub3JnCi5jY2hlcmUuY29t
-Cnx8Y2NoZXJlLmNvbQouY2NpbS5vcmcKLmNjbGlmZS5jYQpjY2xpZmUub3JnCmNj
-bGlmZWZsLm9yZwouY2N0aGVyZS5jb20KfHxjY3RoZXJlLmNvbQp8fGNjdGhlcmUu
-bmV0Ci5jY3Rtd2ViLm5ldAouY2N0b25nYmFvLmNvbS9hcnRpY2xlLzIwNzg3MzIK
-Y2N1ZS5jYQpjY3VlLmNvbQouY2N2b2ljZS5jYQouY2N3Lm9yZy50dwouY2dkZXBv
-dC5vcmcKfGh0dHA6Ly9jZ2RlcG90Lm9yZwp8fGNkYm9vay5vcmcKLmNkY3BhcnR5
-LmNvbQouY2RlZi5vcmcKfHxjZGVmLm9yZwp8fGNkaWcuaW5mbwpjZGpwLm9yZwp8
-fGNkanAub3JnCi5jZG4tYXBwbGUuY29tCnx8Y2RuLWFwcGxlLmNvbQouY2RuZXdz
-LmNvbS50dwpjZHAxOTg5Lm9yZwpjZHAxOTk4Lm9yZwp8fGNkcDE5OTgub3JnCmNk
-cDIwMDYub3JnCnx8Y2RwMjAwNi5vcmcKLmNkcGEudXJsLnR3CmNkcGV1Lm9yZwpj
-ZHB1c2Eub3JnCmNkcHdlYi5vcmcKfHxjZHB3ZWIub3JnCmNkcHd1Lm9yZwp8fGNk
-cHd1Lm9yZwp8fGNkdy5jb20KLmNlY2MuZ292Cnx8Y2VjYy5nb3YKfHxjZWxsdWxv
-LmluZm8KfHxjZW5ld3MuZXUKfHxjZW50ZXJmb3JodW1hbnJlcHJvZC5jb20KfHxj
-ZW50cmFsbmF0aW9uLmNvbQouY2VudHVyeXMubmV0CnxodHRwOi8vY2VudHVyeXMu
-bmV0Ci5jZmhrcy5vcmcuaGsKLmNmb3MuZGUKLmNmdGZjLmNvbQouY2dzdC5lZHUK
-LmNoYW5nZS5vcmcKfHxjaGFuZ2Uub3JnCi5jaGFuZ3AuY29tCnx8Y2hhbmdwLmNv
-bQouY2hhbmdzYS5uZXQKfGh0dHA6Ly9jaGFuZ3NhLm5ldAouY2hhbm5lbDhuZXdz
-LnNnL25ld3M4Ci5jaGFwbTI1LmNvbQouY2hhdHVyYmF0ZS5jb20KLmNodWFuZy15
-ZW4ub3JnCmNoZW5nbWluZ21hZy5jb20KLmNoZW5ndWFuZ2NoZW5nLmNvbQp8fGNo
-ZW5ndWFuZ2NoZW5nLmNvbQouY2hlbnBva29uZy5jb20KLmNoZW5wb2tvbmcubmV0
-CnxodHRwOi8vY2hlbnBva29uZy5uZXQKfHxjaGVycnlzYXZlLmNvbQouY2hob25n
-Ymkub3JnCmNoaWNhZ29uY210di5jb20KfGh0dHA6Ly9jaGljYWdvbmNtdHYuY29t
-Ci5jaGluYS13ZWVrLmNvbQpjaGluYTEwMS5jb20KfHxjaGluYTEwMS5jb20KfHxj
-aGluYTE4Lm9yZwp8fGNoaW5hMjEuY29tCmNoaW5hMjEub3JnCnx8Y2hpbmEyMS5v
-cmcKLmNoaW5hNTAwMC51cwpjaGluYWFmZmFpcnMub3JnCnx8Y2hpbmFhZmZhaXJz
-Lm9yZwp8fGNoaW5hYWlkLm1lCmNoaW5hYWlkLnVzCmNoaW5hYWlkLm9yZwpjaGlu
-YWFpZC5uZXQKY2hpbmFjb21tZW50cy5vcmcKfHxjaGluYWNvbW1lbnRzLm9yZwou
-Y2hpbmFjaGFuZ2Uub3JnCnx8Y2hpbmFjaGFuZ2Uub3JnCmNoaW5hY2hhbm5lbC5o
-awp8fGNoaW5hY2hhbm5lbC5oawouY2hpbmFjaXR5bmV3cy5iZQouY2hpbmFkaWFs
-b2d1ZS5uZXQKLmNoaW5hZGlnaXRhbHRpbWVzLm5ldAp8fGNoaW5hZGlnaXRhbHRp
-bWVzLm5ldAouY2hpbmFlbGVjdGlvbnMub3JnCnx8Y2hpbmFlbGVjdGlvbnMub3Jn
-Ci5jaGluYWV3ZWVrbHkuY29tCnx8Y2hpbmFld2Vla2x5LmNvbQp8fGNoaW5hZnJl
-ZXByZXNzLm9yZwouY2hpbmFnYXRlLmNvbQpjaGluYWdlZWtzLm9yZwpjaGluYWdm
-dy5vcmcKfHxjaGluYWdmdy5vcmcKLmNoaW5hZ29uZXQuY29tCi5jaGluYWdyZWVu
-cGFydHkub3JnCnx8Y2hpbmFncmVlbnBhcnR5Lm9yZwouY2hpbmFob3Jpem9uLm9y
-Zwp8fGNoaW5haG9yaXpvbi5vcmcKLmNoaW5haHVzaC5jb20KLmNoaW5haW5wZXJz
-cGVjdGl2ZS5jb20KfHxjaGluYWludGVyaW1nb3Yub3JnCmNoaW5hbGFib3J3YXRj
-aC5vcmcKY2hpbmFsYXd0cmFuc2xhdGUuY29tCi5jaGluYXBvc3QuY29tLnR3L3Rh
-aXdhbi9uYXRpb25hbC9uYXRpb25hbC1uZXdzCmNoaW5heGNoaW5hLmNvbS9ob3d0
-bwpjaGluYWxhd2FuZHBvbGljeS5jb20KLmNoaW5hbXVsZS5jb20KfHxjaGluYW11
-bGUuY29tCmNoaW5hbXoub3JnCi5jaGluYW5ld3NjZW50ZXIuY29tCnxodHRwczov
-L2NoaW5hbmV3c2NlbnRlci5jb20KLmNoaW5hcHJlc3MuY29tLm15Cnx8Y2hpbmFw
-cmVzcy5jb20ubXkKLmNoaW5hLXJldmlldy5jb20udWEKfGh0dHA6Ly9jaGluYS1y
-ZXZpZXcuY29tLnVhCi5jaGluYXJpZ2h0c2lhLm9yZwpjaGluYXNtaWxlLm5ldC9m
-b3J1bXMKY2hpbmFzb2NpYWxkZW1vY3JhdGljcGFydHkuY29tCnx8Y2hpbmFzb2Np
-YWxkZW1vY3JhdGljcGFydHkuY29tCmNoaW5hc291bC5vcmcKfHxjaGluYXNvdWwu
-b3JnCi5jaGluYXN1Y2tzLm5ldAp8fGNoaW5hdG9wc2V4LmNvbQouY2hpbmF0b3du
-LmNvbS5hdQpjaGluYXR3ZWVwcy5jb20KY2hpbmF3YXkub3JnCi5jaGluYXdvcmtl
-ci5pbmZvCnx8Y2hpbmF3b3JrZXIuaW5mbwpjaGluYXlvdXRoLm9yZy5oawpjaGlu
-YXl1YW5taW4ub3JnCnx8Y2hpbmF5dWFubWluLm9yZwouY2hpbmVzZS1oZXJtaXQu
-bmV0CmNoaW5lc2UtbGVhZGVycy5vcmcKY2hpbmVzZS1tZW1vcmlhbC5vcmcKLmNo
-aW5lc2VkYWlseS5jb20KfHxjaGluZXNlZGFpbHluZXdzLmNvbQouY2hpbmVzZWRl
-bW9jcmFjeS5jb20KfHxjaGluZXNlZGVtb2NyYWN5LmNvbQp8fGNoaW5lc2VnYXku
-b3JnCi5jaGluZXNlbi5kZQp8fGNoaW5lc2VuLmRlCi5jaGluZXNlbmV3cy5uZXQu
-YXUvCi5jaGluZXNlcGVuLm9yZwouY2hpbmVzZXRhbGtzLm5ldC9jaAp8fGNoaW5l
-c2V1cHJlc3MuY29tCi5jaGluZ2NoZW9uZy5jb20KfHxjaGluZ2NoZW9uZy5jb20K
-LmNoaW5tYW4ubmV0CnxodHRwOi8vY2hpbm1hbi5uZXQKY2hpdGh1Lm9yZwp8aHR0
-cDovL2Nobi5jaG9zdW4uY29tCmNubmV3cy5jaG9zdW4uY29tL2NsaWVudC9uZXdz
-L3Zpdy5hc3A/Y2F0ZT1DMDEmbWNhdGUKLmNocmRuZXQuY29tCnxodHRwOi8vY2hy
-ZG5ldC5jb20KLmNocmlzdGlhbmZyZWVkb20ub3JnCnxodHRwOi8vY2hyaXN0aWFu
-ZnJlZWRvbS5vcmcKY2hyaXN0aWFuc3R1ZHkuY29tCnx8Y2hyaXN0aWFuc3R1ZHku
-Y29tCmNocmlzdHVzcmV4Lm9yZy93d3cxL3NkYwouY2h1Ym9sZC5jb20KY2h1YnVu
-LmNvbQpjaHVpemkubmV0CmNocmlzdGlhbnRpbWVzLm9yZy5oawouY2hybGF3eWVy
-cy5oawp8aHR0cDovL2Nocmxhd3llcnMuaGsKLmNodXJjaGluaG9uZ2tvbmcub3Jn
-L2I1L2luZGV4LnBocAp8aHR0cDovL2NodXJjaGluaG9uZ2tvbmcub3JnL2I1L2lu
-ZGV4LnBocAouY2h1c2hpZ2FuZ2RydWcuY2gKLmNpZW5lbi5jb20KLmNpbmVhc3Rl
-bnRyZWZmLmRlCi5jaXBmZy5vcmcKfHxjaXJjbGV0aGViYXlmb3J0aWJldC5vcmcK
-fHxjaXJvc2FudGlsbGkuY29tCi5jaXRpemVuY24uY29tCnx8Y2l0aXplbmNuLmNv
-bQp8aHR0cDovL2NpdGl6ZW5sYWIub3JnCnxodHRwOi8vd3d3LmNpdGl6ZW5sYWIu
-b3JnCnx8Y2l0aXplbnNjb21taXNzaW9uLmhrCi5jaXRpemVubGFiLm9yZwpjaXRp
-emVuc3JhZGlvLm9yZwouY2l0eTM2NS5jYQp8aHR0cDovL2NpdHkzNjUuY2EKY2l0
-eTl4LmNvbQp8fGNpdHlwb3B1bGF0aW9uLmRlCi5jaXR5dGFsay50dy9ldmVudAou
-Y2l2aWNwYXJ0eS5oawp8fGNpdmljcGFydHkuaGsKLmNpdmlsZGlzb2JlZGllbmNl
-bW92ZW1lbnQub3JnCmNpdmlsaHJmcm9udC5vcmcKfHxjaXZpbGhyZnJvbnQub3Jn
-Ci5jaXZpbGlhbmd1bm5lci5jb20KLmNpdmlsbWVkaWEudHcKfHxjaXZpbG1lZGlh
-LnR3CnBzaXBob24uY2l2aXNlYy5vcmcKfHx2cG4uY2piLm5ldAouY2sxMDEuY29t
-Cnx8Y2sxMDEuY29tCi5jbGFyaW9ucHJvamVjdC5vcmcvbmV3cy9pc2xhbWljLXN0
-YXRlLWlzaXMtaXNpbC1wcm9wYWdhbmRhCnx8Y2xhc3NpY2FsZ3VpdGFyYmxvZy5u
-ZXQKLmNsYi5vcmcuaGsKY2xlYXJoYXJtb255Lm5ldApjbGVhcndpc2RvbS5uZXQK
-Y2xpbmljYS10aWJldC5ydQouY2xpcGZpc2guZGUKY2xvYWtwb2ludC5jb20KfHxj
-bHViMTA2OS5jb20KY21pLm9yZy50dwp8aHR0cDovL3d3dy5jbW9pbmMub3JnCmNt
-cC5oa3UuaGsKaGt1cG9wLmhrdS5oawp8fGNtdWxlLmNvbQp8fGNtdWxlLm9yZwp8
-fGNtcy5nb3YKfGh0dHA6Ly92cG4uY211LmVkdQp8aHR0cDovL3Zwbi5zdi5jbXUu
-ZWR1Ci5jbjYuZXUKLmNuYS5jb20udHcKfHxjbmEuY29tLnR3Ci5jbmFiYy5jb20K
-LmNuZC5vcmcKfHxjbmQub3JnCmRvd25sb2FkLmNuZXQuY29tCi5jbmV4Lm9yZy5j
-bgouY25pbmV1LmNvbQp3aWtpLmNuaXR0ZXIuY29tCi5jbm4uY29tL3ZpZGVvCi5j
-bnBvbGl0aWNzLm9yZwp8fGNucG9saXRpY3Mub3JnCi5jbi1wcm94eS5jb20KfGh0
-dHA6Ly9jbi1wcm94eS5jb20KLmNucHJveHkuY29tCmJsb2cuY255ZXMuY29tCm5l
-d3MuY255ZXMuY29tCnx8Y29hdC5jby5qcAouY29jaGluYS5jbwp8fGNvY2hpbmEu
-Y28KfHxjb2NoaW5hLm9yZwouY29kZTE5ODQuY29tLzY0CnxodHRwOi8vZ29hZ2Vu
-dC5jb2RlcGxleC5jb20KfHxjb2Rlc2hhcmUuaW8KfHxjb2Rlc2t1bHB0b3Iub3Jn
-CnxodHRwOi8vdG9zaC5jb21lZHljZW50cmFsLmNvbQpjb21lZnJvbWNoaW5hLmNv
-bQp8fGNvbWVmcm9tY2hpbmEuY29tCi5jb21pYy1tZWdhLm1lCmNvbW1hbmRhcm1z
-LmNvbQp8fGNvbW1lbnRzaGsuY29tCi5jb21tdW5pc3RjcmltZXMub3JnCnx8Y29t
-bXVuaXN0Y3JpbWVzLm9yZwp8fGNvbW11bml0eWNob2ljZWN1LmNvbQp8fGNvbXBp
-bGVoZWFydC5jb20KfHxjb25vaGEuanAKLmNvbnRhY3RtYWdhemluZS5uZXQKLmNv
-bnZpby5uZXQKLmNvb2JheS5jb20KfGh0dHA6Ly93d3cuY29vbDE4LmNvbS9iYnMq
-LwouY29vbGFsZXIuY29tCnx8Y29vbGFsZXIuY29tCmNvb2xkZXIuY29tCnx8Y29v
-bGRlci5jb20KfHxjb29sbG91ZC5vcmcudHcKLmNvb2xuY3V0ZS5jb20KfHxjb29s
-c3R1ZmZpbmMuY29tCmNvcnVtY29sbGVnZS5jb20KLmNvcy1tb2UuY29tCnxodHRw
-Oi8vY29zLW1vZS5jb20KLmNvc3BsYXlqYXYucGwKfGh0dHA6Ly9jb3NwbGF5amF2
-LnBsCi5jb3R3ZWV0LmNvbQp8fGNvdHdlZXQuY29tCi5jb3Vyc2VoZXJvLmNvbQp8
-fGNvdXJzZWhlcm8uY29tCmNwai5vcmcKfHxjcGoub3JnCi5jcTk5LnVzCnxodHRw
-Oi8vY3E5OS51cwpjcmFja2xlLmNvbQp8fGNyYWNrbGUuY29tCi5jcmF6eXMuY2MK
-LmNyYXp5c2hpdC5jb20KfHxjcmNoaW5hLm9yZwpjcmQtbmV0Lm9yZwpjcmVhZGVy
-cy5uZXQKfHxjcmVhZGVycy5uZXQKLmNyZWFkZXJzbmV0LmNvbQp8fGNyaXN0eWxp
-LmNvbQouY3JvY290dWJlLmNvbQp8aHR0cDovL2Nyb2NvdHViZS5jb20KLmNyb3Nz
-dGhld2FsbC5uZXQKfHxjcm9zc3RoZXdhbGwubmV0Ci5jcm9zc3Zwbi5uZXQKfHxj
-cm9zc3Zwbi5uZXQKfHxjcnVjaWFsLmNvbQpjc2RwYXJ0eS5jb20KfHxjc2RwYXJ0
-eS5jb20KfHxjc3VjaGVuLmRlCi5jc3cub3JnLnVrCi5jdC5vcmcudHcKfHxjdC5v
-cmcudHcKLmN0YW8ub3JnCi5jdGZyaWVuZC5uZXQKLmN0aXR2LmNvbS50dwpjdHMu
-Y29tLnR3CnxodHRwOi8vbGlicmFyeS51c2MuY3Voay5lZHUuaGsvCnxodHRwOi8v
-bWpsc2gudXNjLmN1aGsuZWR1LmhrLwouY3Voa2Fjcy5vcmcvfmJlbm5nCi5jdWlo
-dWEub3JnCnx8Y3VpaHVhLm9yZwouY3Vpd2VpcGluZy5uZXQKfHxjdWl3ZWlwaW5n
-Lm5ldAp8fGN1bHR1cmUudHcKLmN1bWxvdWRlci5jb20KfHxjdW1sb3VkZXIuY29t
-Cnx8Y3VydmVmaXNoLmNvbQouY3VzdS5oawp8fGN1c3UuaGsKLmN1dHNjZW5lcy5u
-ZXQKLmN3LmNvbS50dwp8fGN3LmNvbS50dwp8aHR0cDovL2ZvcnVtLmN5YmVyY3Rt
-LmNvbQpjeWJlcmdob3N0dnBuLmNvbQp8fGN5YmVyZ2hvc3R2cG4uY29tCnx8Y3lu
-c2NyaWJlLmNvbQpjeXRvZGUudXMKfHxpZmFuLmN6LmNjCnx8bWlrZS5jei5jYwp8
-fG5pYy5jei5jYwoKIS0tLS0tLS0tLS0tLS0tLS0tLS0tREQtLS0tLS0tLS0tLS0t
-LS0tLS0tLS0tLS0tCi5kLWZ1a3l1LmNvbQp8aHR0cDovL2QtZnVreXUuY29tCmNs
-LmQwei5uZXQKLmQxMDAubmV0Cnx8ZDEwMC5uZXQKLmQyYmF5LmNvbQp8aHR0cDov
-L2QyYmF5LmNvbQouZGFici5jby51awp8fGRhYnIuY28udWsKZGFici5ldQpkYWJy
-Lm1vYmkKfHxkYWJyLm1vYmkKfHxkYWJyLm1lCmRhZGF6aW0uY29tCnx8ZGFkYXpp
-bS5jb20KLmRhZGkzNjAuY29tCi5kYWZhYmV0LmNvbQpkYWZhZ29vZC5jb20KZGFm
-YWhhby5jb20KLmRhZm9oLm9yZwouZGFmdHBvcm4uY29tCi5kYWdlbGlqa3Nlc3Rh
-bmRhYXJkLm5sCi5kYWlkb3N0dXAucnUKfGh0dHA6Ly9kYWlkb3N0dXAucnUKLmRh
-aWxpZGFpbGkuY29tCnx8ZGFpbGlkYWlsaS5jb20KLmRhaWx5bW90aW9uLmNvbQp8
-fGRhaWx5bW90aW9uLmNvbQpkYWlwaGFwaW5mby5uZXQKLmRhaml5dWFuLmNvbQp8
-fGRhaml5dWFuLmRlCmRhaml5dWFuLmV1CmRhbGFpbGFtYS5jb20KLmRhbGFpbGFt
-YS5tbgp8aHR0cDovL2RhbGFpbGFtYS5tbgouZGFsYWlsYW1hLnJ1Cnx8ZGFsYWls
-YW1hLnJ1CmRhbGFpbGFtYTgwLm9yZwouZGFsYWlsYW1hLWFyY2hpdmVzLm9yZwou
-ZGFsYWlsYW1hY2VudGVyLm9yZwp8aHR0cDovL2RhbGFpbGFtYWNlbnRlci5vcmcK
-ZGFsYWlsYW1hZmVsbG93cy5vcmcKLmRhbGFpbGFtYWZpbG0uY29tCi5kYWxhaWxh
-bWFmb3VuZGF0aW9uLm9yZwouZGFsYWlsYW1haGluZGkuY29tCi5kYWxhaWxhbWFp
-bmF1c3RyYWxpYS5vcmcKLmRhbGFpbGFtYWphcGFuZXNlLmNvbQouZGFsYWlsYW1h
-cHJvdGVzdGVycy5pbmZvCi5kYWxhaWxhbWFxdW90ZXMub3JnCi5kYWxhaWxhbWF0
-cnVzdC5vcmcKLmRhbGFpbGFtYXZpc2l0Lm9yZy5uegouZGFsYWlsYW1hd29ybGQu
-Y29tCnx8ZGFsYWlsYW1hd29ybGQuY29tCmRhbGlhbm1lbmcub3JnCnx8ZGFsaWFu
-bWVuZy5vcmcKLmRhbGl1bGlhbi5vcmcKfHxkYWxpdWxpYW4ub3JnCi5kYW5rZTRj
-aGluYS5uZXQKfHxkYW5rZTRjaGluYS5uZXQKLmRhbndlaS5vcmcKZGFvbGFuLm5l
-dAouZGFvemhvbmd4aW5nLm9yZwpkYXJrdG95Lm5ldAp8fGRhc3RyYXNzaS5vcmcK
-YmxvZy5kYXVtLm5ldC9fYmxvZwouZGF2aWQta2lsZ291ci5jb20KfGh0dHA6Ly9k
-YXZpZC1raWxnb3VyLmNvbQpkYXhhLmNuCnx8ZGF4YS5jbgpjbi5kYXlhYm9vay5j
-b20KLmRheWxpZmUuY29tL3RvcGljL2RhbGFpX2xhbWEKfHxkYi50dAouZGJjLmhr
-L21haW4KfHxkY2FyZC50dwpkY21pbGl0YXJ5LmNvbQouZGRjLmNvbS50dwouZGRo
-dy5pbmZvCnx8ZGUtc2NpLm9yZwouZGUtc2NpLm9yZwpwYWNrYWdlcy5kZWJpYW4u
-b3JnL3poLWNuL2xlbm55L2dwYXNzCnx8ZGVjb2RldC5jbwoKIS0tT3JpZ2luOmNk
-bi1pMzAkXwohLS1FeGNlcHRpb246IEhvbWVwYWdlIGFjY2VzcyB3aXRob3V0IHJz
-dAohLS1LZXl3b3JkIGlzICRfCi5kZWZpbmViYWJlLmNvbQoKfHxkZWxjYW1wLm5l
-dApkZWxpY2lvdXMuY29tL0dGV2Jvb2ttYXJrCi5kZW1vY3JhdHMub3JnCnx8ZGVt
-b2NyYXRzLm9yZwp8fGRlc2Muc2UKfHxkZXNzY2kuY29tCi5kZXN0cm95LWNoaW5h
-LmpwCnx8ZGV1dHNjaGUtd2VsbGUuZGUKIS0tfHxkZXZpYW50YXJ0LmNvbQohLS18
-fGRldmlhbnRhcnQubmV0Cnx8ZGV2aW8udXMKfHxkZXZwbi5jb20KfHxkZmFzLm1p
-bApkZm4ub3JnCmRoYXJtYWthcmEubmV0Ci5kaGFyYW1zYWxhbmV0LmNvbQouZGlh
-b3l1aXNsYW5kcy5vcmcKfHxkaWFveXVpc2xhbmRzLm9yZwouZGlmYW5nd2VuZ2Uu
-b3JnCnxodHRwOi8vZGlnaWxhbmQudHcvCnx8ZGlnaXRhbG5vbWFkc3Byb2plY3Qu
-b3JnCi5kaWlnby5jb20KfHxkaWlnby5jb20KfHxkaWxiZXIuc2UKfHxmdXJsLm5l
-dAouZGlwaXR5LmNvbQp8fGRpcmVjdGNyZWF0aXZlLmNvbQohLS18fGRpc2NvZ3Mu
-Y29tCiEtLUBAfHxjZG4uZGlzY29ncy5jb20KLmRpc2N1c3MuY29tLmhrCnx8ZGlz
-Y3Vzcy5jb20uaGsKLmRpc2N1c3M0dS5jb20KZGlzcC5jYwouZGlzcXVzLmNvbQp8
-fGRpc3F1cy5jb20KLmRpdC1pbmMudXMKfHxkaXQtaW5jLnVzCi5kaXpoaWRpemhp
-LmNvbQp8fGRpemh1emhpc2hhbmcuY29tCmRqYW5nb3NuaXBwZXRzLm9yZwouZGpv
-cnouY29tCnx8ZGpvcnouY29tCnx8ZGwtbGFieS5qcAp8fGRsc2l0ZS5jb20KfHxk
-bHlvdXR1YmUuY29tCnx8ZG1jZG4ubmV0Ci5kbnNjcnlwdC5vcmcKfHxkbnNjcnlw
-dC5vcmcKfHxkbnMyZ28uY29tCnx8ZG5zc2VjLm5ldApkb2N0b3J2b2ljZS5vcmcK
-CiEtLURvZ0ZhcnROZXR3b3JrCi5kb2dmYXJ0bmV0d29yay5jb20vdG91cgpnbG9y
-eWhvbGUuY29tCgouZG9qaW4uY29tCi5kb2stZm9ydW0ubmV0Cnx8ZG9sYy5kZQp8
-fGRvbGYub3JnLmhrCnx8ZG9sbGYuY29tCi5kb21haW4uY2x1Yi50dwouZG9tYWlu
-dG9kYXkuY29tLmF1CmNoaW5lc2UuZG9uZ2EuY29tCmRvbmd0YWl3YW5nLmNvbQp8
-fGRvbmd0YWl3YW5nLmNvbQouZG9uZ3RhaXdhbmcubmV0Cnx8ZG9uZ3RhaXdhbmcu
-bmV0Ci5kb25neWFuZ2ppbmcuY29tCnxodHRwOi8vZGFuYm9vcnUuZG9ubWFpLnVz
-Ci5kb250ZmlsdGVyLnVzCnx8ZG9udG1vdmV0b2NoaW5hLmNvbQouZG9yamVzaHVn
-ZGVuLmNvbQouZG90cGxhbmUuY29tCnx8ZG90cGxhbmUuY29tCnx8ZG90c3ViLmNv
-bQouZG90dnBuLmNvbQp8fGRvdHZwbi5jb20KLmRvdWIuaW8KfHxkb3ViLmlvCnx8
-ZG91Z3NjcmlwdHMuY29tCnx8ZG91aG9rYW5rby5uZXQKfHxkb3VqaW5jYWZlLmNv
-bQpkb3dlaS5vcmcKZHBoay5vcmcKZHBwLm9yZy50dwp8fGRwcC5vcmcudHcKfHxk
-cHIuaW5mbwp8fGRyYWdvbnNwcmluZ3Mub3JnCiEtLXx8ZHJhdy5pbwouZHJlYW1h
-bWF0ZXVycy5jb20KLmRyZXB1bmcub3JnCnx8ZHJnYW4ubmV0Ci5kcm1pbmd4aWEu
-b3JnCnxodHRwOi8vZHJtaW5neGlhLm9yZwp8fGRyb3Bib29rcy50dgp8fGRyb3Bi
-b3guY29tCnx8YXBpLmRyb3Bib3hhcGkuY29tCnx8bm90aWZ5LmRyb3Bib3hhcGku
-Y29tCnx8ZHJvcGJveHVzZXJjb250ZW50LmNvbQpkcnN1bmFjYWRlbXkuY29tCi5k
-cnR1YmVyLmNvbQouZHNjbi5pbmZvCnxodHRwOi8vZHNjbi5pbmZvCi5kc3RrLmRr
-CnxodHRwOi8vZHN0ay5kawp8fGR0aWJsb2cuY29tCnx8ZHRpYy5taWwKLmR0d2Fu
-Zy5vcmcKLmR1YW56aGlodS5jb20KLmR1Y2tkbnMub3JnCnxodHRwOi8vZHVja2Ru
-cy5vcmcKLmR1Y2tkdWNrZ28uY29tCnx8ZHVja2R1Y2tnby5jb20KLmR1Y2tsb2Fk
-LmNvbS9kb3dubG9hZAp8fGR1Y2tteWxpZmUuY29tCi5kdWdhLmpwCnxodHRwOi8v
-ZHVnYS5qcAouZHVpaHVhLm9yZwp8fGR1aWh1YS5vcmcKfHxkdWlodWFocmpvdXJu
-YWwub3JnCi5kdW55YWJ1bHRlbmkubmV0Ci5kdW93ZWl0aW1lcy5jb20KfHxkdW93
-ZWl0aW1lcy5jb20KZHVwaW5nLm5ldAp8fGR1cGxpY2F0aS5jb20KZHVwb2xhLmNv
-bQpkdXBvbGEubmV0Ci5kdXNoaS5jYQp8fGR2b3Jhay5vcmcKLmR3LmNvbQp8fGR3
-LmNvbQp8fGR3LmRlCi5kdy13b3JsZC5jb20KfHxkdy13b3JsZC5jb20KLmR3LXdv
-cmxkLmRlCnxodHRwOi8vZHctd29ybGQuZGUKd3d3LmR3aGVlbGVyLmNvbQpkd25l
-d3MuY29tCnx8ZHduZXdzLmNvbQpkd25ld3MubmV0Cnx8ZHduZXdzLm5ldAp4eXMu
-ZHhpb25nLmNvbQp8fGR5bmF3ZWJpbmMuY29tCnx8ZHlzZnouY2MKLmR6emUuY29t
-CgohLS0tLS0tLS0tLS0tLS0tLS0tLS1FRS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
-LS0KfHxlLWNsYXNzaWNhbC5jb20udHcKfHxlLWdvbGQuY29tCi5lLWdvbGQuY29t
-Ci5lLWhlbnRhaS5vcmcKfHxlLWhlbnRhaS5vcmcKLmUtaGVudGFpZGIuY29tCnxo
-dHRwOi8vZS1oZW50YWlkYi5jb20KZS1pbmZvLm9yZy50dwouZS10cmFkZXJsYW5k
-Lm5ldC9ib2FyZAouZS16b25lLmNvbS5oay9kaXNjdXoKfGh0dHA6Ly9lLXpvbmUu
-Y29tLmhrL2Rpc2N1egouZTEyMy5oawp8fGUxMjMuaGsKLmVhcmx5dGliZXQuY29t
-CnxodHRwOi8vZWFybHl0aWJldC5jb20KLmVhcnRoY2FtLmNvbQouZWFydGh2cG4u
-Y29tCnx8ZWFydGh2cG4uY29tCmVhc3Rlcm4tYXJrLmNvbQouZWFzdGVybmxpZ2h0
-bmluZy5vcmcKLmVhc3R0dXJrZXN0YW4uY29tCnxodHRwOi8vd3d3LmVhc3R0dXJr
-aXN0YW4ubmV0LwouZWFzdHR1cmtpc3Rhbi1nb3Yub3JnCi5lYXN0dHVya2lzdGFu
-Y2Mub3JnCi5lYXN0dHVya2lzdGFuZ292ZXJubWVudGluZXhpbGUudXMKfHxlYXN0
-dHVya2lzdGFuZ292ZXJubWVudGluZXhpbGUudXMKLmVhc3ljYS5jYQouZWFzeXBp
-Yy5jb20KLmVib255LWJlYXV0eS5jb20KZWJvb2ticm93c2UuY29tCmVib29rZWUu
-Y29tCnx8ZWNmYS5vcmcudHcKdXNodWFyZW5jaXR5LmVjaGFpbmhvc3QuY29tCnx8
-ZWNpbWcudHcKZWNtaW5pc3RyeS5uZXQKLmVjb25vbWlzdC5jb20KYmJzLmVjc3Rh
-cnQuY29tCmVkZ2VjYXN0Y2RuLm5ldAp8fGVkZ2VjYXN0Y2RuLm5ldAovdHdpbWdc
-LmVkZ2VzdWl0ZVwubmV0XC9cLz9hcHBsZWRhaWx5LwplZGljeXBhZ2VzLmNvbQou
-ZWRtb250b25jaGluYS5jbgouZWRtb250b25zZXJ2aWNlLmNvbQplZG9vcnMuY29t
-Ci5lZHVicmlkZ2UuY29tCnx8ZWR1YnJpZGdlLmNvbQouZWR1cHJvLm9yZwp8fGVl
-dnBuLmNvbQplZmNjLm9yZy5oawouZWZ1a3QuY29tCnxodHRwOi8vZWZ1a3QuY29t
-Cnx8ZWljLWF2LmNvbQp8fGVpcmVpbmlrb3RhZXJ1a2FpLmNvbQouZWlzYmIuY29t
-Ci5la3Npc296bHVrLmNvbQp8fGVrc2lzb3psdWsuY29tCmVsZWN0aW9uc21ldGVy
-LmNvbQp8fGVsZ29vZy5pbQouZWxsYXdpbmUub3JnCi5lbHBhaXMuY29tCnx8ZWxw
-YWlzLmNvbQouZWx0b25kaXNuZXkuY29tCi5lbWFnYS5jb20vaW5mby8zNDA3CmVt
-aWx5bGF1Lm9yZy5oawouZW1hbm5hLmNvbS9jaGluZXNlVHJhZGl0aW9uYWwKYml0
-Yy5ibWUuZW1vcnkuZWR1L35semhvdS9ibG9ncwouZW1wZmlsLmNvbQouZW11bGUt
-ZWQyay5jb20KfGh0dHA6Ly9lbXVsZS1lZDJrLmNvbQouZW11bGVmYW5zLmNvbQp8
-aHR0cDovL2VtdWxlZmFucy5jb20KLmVtdXBhcmFkaXNlLm1lCi5lbmFueWFuZy5t
-eQohLS0uZW5hbnlhbmcubXkvbmV3cy8yMDE3MDUwMi8lRTclQkUlOEUlRTUlOUIl
-QkQlRTQlQjklOEIlRTklOUYlQjMlRTUlQTQlQTclRTUlOUMlQjAlRTklOUMlODcl
-RTMlODAlOEElRTglOEIlQjklRTYlOUUlOUMlRTMlODAlOEIlRTclOEIlQUMlRTUl
-QUUlQjYKfHxlbmV3c3RyZWUuY29tCi5lbmZhbC5kZQpjaGluZXNlLmVuZ2FkZ2V0
-LmNvbQp8fGVuZ2FnZWRhaWx5Lm9yZwplbmdsaXNoZm9yZXZlcnlvbmUub3JnCnx8
-ZW5nbGlzaGZyb21lbmdsYW5kLmNvLnVrCmVuZ2xpc2hwZW4ub3JnCi5lbmxpZ2h0
-ZW4ub3JnLnR3Cnx8ZW50ZXJtYXAuY29tCi5lbnRudC5jb20KfGh0dHA6Ly9lbnRu
-dC5jb20KLmVwaXNjb3BhbGNodXJjaC5vcmcKLmVwb2NoaGsuY29tCnxodHRwOi8v
-ZXBvY2hoay5jb20KZXBvY2h0aW1lcy1iZy5jb20KfHxlcG9jaHRpbWVzLWJnLmNv
-bQplcG9jaHRpbWVzLXJvbWFuaWEuY29tCnx8ZXBvY2h0aW1lcy1yb21hbmlhLmNv
-bQplcG9jaHRpbWVzLmNvLmlsCnx8ZXBvY2h0aW1lcy5jby5pbAplcG9jaHRpbWVz
-LmNvLmtyCnx8ZXBvY2h0aW1lcy5jby5rcgplcG9jaHRpbWVzLmNvbQp8fGVwb2No
-dGltZXMuY29tCi5lcG9jaHRpbWVzLmN6CmVwb2NodGltZXMuZGUKZXBvY2h0aW1l
-cy5mcgouZXBvY2h0aW1lcy5pZQouZXBvY2h0aW1lcy5pdAplcG9jaHRpbWVzLmpw
-CmVwb2NodGltZXMucnUKZXBvY2h0aW1lcy5zZQplcG9jaHRpbWVzdHIuY29tCi5l
-cG9jaHdlZWsuY29tCnx8ZXBvY2h3ZWVrLmNvbQp8fGVwb2Nod2Vla2x5LmNvbQou
-ZXBvcm5lci5jb20KLmVxdWluZW5vdy5jb20KZXJhYmFydS5uZXQKLmVyYWNvbS5j
-b20udHcKLmVyYXlzb2Z0LmNvbS50cgouZXJlcHVibGlrLmNvbQouZXJpZ2h0cy5u
-ZXQKfHxlcmlnaHRzLm5ldAouZXJrdHYuY29tCnxodHRwOi8vZXJrdHYuY29tCnx8
-ZXJuZXN0bWFuZGVsLm9yZwp8fGVyb2RhaXplbnN5dS5jb20KfHxlcm9kb3VqaW5s
-b2cuY29tCnx8ZXJvZG91amlud29ybGQuY29tCnx8ZXJvbWFuZ2Eta2luZ2RvbS5j
-b20KfHxlcm9tYW5nYWRvdXppbi5jb20KLmVyb21vbi5uZXQKfGh0dHA6Ly9lcm9t
-b24ubmV0Ci5lcm9wcm9maWxlLmNvbQouZXJvdGljc2Fsb29uLm5ldAouZXNsaXRl
-LmNvbQp8fGVzbGl0ZS5jb20KIS0tLmVzbGl0ZS5jb20vcHJvZHVjdAohLS0uZXNs
-aXRlLmNvbS9TZWFyY2hfQlcuYXNweD9xCndpa2kuZXN1LmltLyVFOCU5QiVBNCVF
-OCU5QiVBNCVFOCVBRiVBRCVFNSVCRCU5NQouZXRhYS5vcmcuYXUKLmV0YWR1bHQu
-Y29tCmV0YWl3YW5uZXdzLmNvbQp8fGV0aXplci5vcmcKfHxldG9ra2kuY29tCiEt
-LS5ldHRvZGF5Lm5ldAouZXR0b2RheS5uZXQvbmV3cy8yMDE1MTIxNi82MTQwODEK
-ZXR2b25saW5lLmhrCi5ldS5vcmcKfHxldS5vcmcKLmV1Y2FzaW5vLmNvbQouZXVs
-YW0uY29tCi5ldXJla2F2cHQuY29tCnx8ZXVyZWthdnB0LmNvbQouZXVyb25ld3Mu
-Y29tCnx8ZXVyb25ld3MuY29tCmVlYXMuZXVyb3BhLmV1L2RlbGVnYXRpb25zL2No
-aW5hL3ByZXNzX2Nvcm5lci9hbGxfbmV3cy9uZXdzLzIwMTUvMjAxNTA3MTZfemgK
-ZWVhcy5ldXJvcGEuZXUvc3RhdGVtZW50cy1lZWFzLzIwMTUvMTUxMDIyCi5ldnNj
-aG9vbC5uZXQKfGh0dHA6Ly9ldnNjaG9vbC5uZXQKfHxleGJsb2cuanAKfHxibG9n
-LmV4YmxvZy5jby5qcApAQHx8d3d3LmV4YmxvZy5qcAouZXhjaHJpc3RpYW4uaGsK
-fHxleGNocmlzdGlhbi5oawp8aHR0cDovL2Jsb2cuZXhjaXRlLmNvLmpwCnx8ZXht
-b3Jtb24ub3JnCnx8ZXhwYXRzaGllbGQuY29tCi5leHBlY3RoaW0uY29tCnx8ZXhw
-ZWN0aGltLmNvbQpleHBlcnRzLXVuaXZlcnMuY29tCnx8ZXhwbG9hZGVyLm5ldAou
-ZXhwcmVzc3Zwbi5jb20KfHxleHByZXNzdnBuLmNvbQouZXh0cmVtZXR1YmUuY29t
-CmV5ZXZpby5qcAp8fGV5ZXZpby5qcAouZXlueS5jb20KfHxleW55LmNvbQouZXpw
-Yy50ay9jYXRlZ29yeS9zb2Z0Ci5lenBlZXIuY29tCgohLS0tLS0tLS0tLS0tLS0t
-LS0tLS1GRi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KfHxmYWNlYm9va3F1b3Rl
-czR1LmNvbQouZmFjZWxlc3MubWUKfHxmYWNlbGVzcy5tZQp8aHR0cDovL2ZhY2Vz
-b2Z0aWJldGFuc2VsZmltbW9sYXRvcnMuaW5mbwp8fGZhY2Vzb2ZueWZ3LmNvbQou
-ZmFpdGgxMDAub3JnCnxodHRwOi8vZmFpdGgxMDAub3JnCgohLS1FbmhhbmNlbWVu
-dDoKIS0taHR0cDovL2ZhaXRoZnVsZXllLmNvbS5kZXRhaWwud2Vic2l0ZS8KIS0t
-aHR0cDovL2ZhaXRoZnVsZXllLmNvbS5pcGFkZHJlc3MuY29tLwouZmFpdGhmdWxl
-eWUuY29tCgp8fGZhaXRodGhlZG9nLmluZm8KLmZha2t1Lm5ldAouZmFsc2VmaXJl
-LmNvbQp8fGZhbHNlZmlyZS5jb20KZmFsdW4tY28ub3JnCmZhbHVuYXJ0Lm9yZwp8
-fGZhbHVuYXNpYS5pbmZvCnxodHRwOi8vZmFsdW5hdS5vcmcKLmZhbHVuYXoubmV0
-CmZhbHVuZGFmYS5vcmcKZmFsdW5kYWZhLWRjLm9yZwp8fGZhbHVuZGFmYS1mbG9y
-aWRhLm9yZwp8fGZhbHVuZGFmYS1uYy5vcmcKfHxmYWx1bmRhZmEtcGEubmV0Cnx8
-ZmFsdW5kYWZhLXNhY3JhbWVudG8ub3JnCmZhbHVuLW55Lm5ldAp8fGZhbHVuZGFm
-YWluZGlhLm9yZwpmYWx1bmRhZmFtdXNldW0ub3JnCi5mYWx1bmdvbmcuY2x1Ygou
-ZmFsdW5nb25nLmRlCmZhbHVuZ29uZy5vcmcudWsKfHxmYWx1bmhyLm9yZwpmYWx1
-bmluZm8uZGUKZmFsdW5pbmZvLm5ldAouZmFsdW5waWxpcGluYXMubmV0Cnx8ZmFs
-dW53b3JsZC5uZXQKZmFtaWx5ZmVkLm9yZwouZmFuZ2VtaW5nLmNvbQp8fGZhbmds
-aXpoaS5pbmZvCnx8ZmFuZ29uZy5vcmcKZmFuZ29uZ2hlaWtlLmNvbQouZmFucWlh
-bmcudGsKZmFucWlhbmdob3UuY29tCnx8ZmFucWlhbmdob3UuY29tCi5mYW5xaWFu
-Z3poZS5jb20KfHxmYW5xaWFuZ3poZS5jb20KZmFwZHUuY29tCmZhcHJveHkuY29t
-CiEtLS5mYXJ4aWFuLmNvbQouZmF3YW5naHVpaHVpLm9yZwpmYW5xaWFuZ3lha2V4
-aS5uZXQKZmFpbC5oawp8fGZhbXVuaW9uLmNvbQouZmFuLXFpYW5nLmNvbQouZmFu
-Z2JpbnhpbmcuY29tCnx8ZmFuZ2JpbnhpbmcuY29tCmZhbmdlbWluZy5jb20KLmZh
-bmdtaW5jbi5vcmcKfHxmYW5nbWluY24ub3JnCi5mYW5oYW9kYW5nLmNvbQp8fGZh
-bnN3b25nLmNvbQouZmFueXVlLmluZm8KLmZhcndlc3RjaGluYS5jb20KCiEtLUZh
-c3RseQplbi5mYXZvdHRlci5uZXQKIS0tfHxybncuZ2xvYmFsLnNzbC5mYXN0bHku
-bmV0CiEtLXxodHRwczovLypnbG9iYWwuc3NsLmZhc3RseS5uZXQvCm55dGltZXMu
-bWFwLmZhc3RseS5uZXQKfHxueXRpbWVzLm1hcC5mYXN0bHkubmV0Cnx8ZmFzdC53
-aXN0aWEuY29tCgp8fGZhc3Rzc2guY29tCnx8ZmFzdHN0b25lLm9yZwpmYXZzdGFy
-LmZtCnx8ZmF2c3Rhci5mbQpmYXlkYW8uY29tL3dlYmxvZwouZmMyLmNvbQouZmMy
-Y2hpbmEuY29tCi5mYzJjbi5jb20KfHxmYzJjbi5jb20KZmMyYmxvZy5uZXQKfGh0
-dHA6Ly91eWd1ci5mYzJ3ZWIuY29tLwp2aWRlby5mZGJveC5jb20KLmZkYzY0LmRl
-Ci5mZGM2NC5vcmcKLmZkYzg5LmpwCnx8Zm91cmZhY2Uubm9kZXNub29wLmNvbQoh
-LS1mZWVkYm9va3MubW9iaQp8fGZlZWxzc2guY29tCmZlZXIuY29tCi5mZWlmZWlz
-cy5jb20KfGh0dHA6Ly9mZWl0aWFuYWNhZGVteS5vcmcKLmZlaXRpYW4tY2FsaWZv
-cm5pYS5vcmcKfHxmZW1pbmlzdHRlYWNoZXIuY29tCi5mZW5nemhlbmdodS5jb20K
-fHxmZW5nemhlbmdodS5jb20KLmZlbmd6aGVuZ2h1Lm5ldAp8fGZlbmd6aGVuZ2h1
-Lm5ldAouZmV2ZXJuZXQuY29tCnxodHRwOi8vZmYuaW0KZmZmZmYuYXQKZmZsaWNr
-LmNvbQouZmZ2cG4uY29tCmZnbXR2Lm5ldAouZmdtdHYub3JnCi5maHJlcG9ydHMu
-bmV0CnxodHRwOi8vZmhyZXBvcnRzLm5ldAouZmlncHJheWVyLmNvbQp8fGZpZ3By
-YXllci5jb20KLmZpbGVmbHllci5jb20KfHxmaWxlZmx5ZXIuY29tCnxodHRwOi8v
-ZmVlZHMuZmlsZWZvcnVtLmNvbQouZmlsZXMybWUuY29tCi5maWxlc2VydmUuY29t
-L2ZpbGUKZmlsbHRoZXNxdWFyZS5vcmcKZmlsbWluZ2ZvcnRpYmV0Lm9yZwouZmls
-dGhkdW1wLmNvbQouZmluY2h2cG4uY29tCnx8ZmluY2h2cG4uY29tCiEtLWZpbmRi
-b29rLnR3CmZpbmRtZXNwb3QuY29tCnx8ZmluZHlvdXR1YmUuY29tCnx8ZmluZHlv
-dXR1YmUubmV0Ci5maW5nZXJkYWlseS5jb20KZmlubGVyLm5ldAouZmlyZWFybXN3
-b3JsZC5uZXQKfGh0dHA6Ly9maXJlYXJtc3dvcmxkLm5ldAouZmlyZW9mbGliZXJ0
-eS5vcmcKfHxmaXJlb2ZsaWJlcnR5Lm9yZwouZmlyZXR3ZWV0LmlvCnx8ZmlyZXR3
-ZWV0LmlvCiEtLXx8ZmxhZ2ZveC5uZXQKLmZsYWdzb25saW5lLml0CmZsZXNoYm90
-LmNvbQouZmxldXJzZGVzbGV0dHJlcy5jb20KfGh0dHA6Ly9mbGV1cnNkZXNsZXR0
-cmVzLmNvbQp8fGZsZ2cudXMKfHxmbGdqdXN0aWNlLm9yZwoKIS0tfHxmYXJtNi5z
-dGF0aWNmbGlja3IuY29tCiEtLS5mbGlja3IuY29tL3Bob3Rvcy80NjIzMTA3N0BO
-MDYKIS0tLmZsaWNrci5jb20vZ3JvdXBzL2Fpd2Vpd2VpCiEtLS5mbGlja3IuY29t
-L3Bob3Rvcy9kaWdpdGFsYm95MTAwCiEtLS5mbGlja3IuY29tL3Bob3Rvcy9memhl
-bmdodQohLS0uZmxpY2tyLmNvbS9waG90b3MvbG9uZWx5Zm94CiEtLWZsaWNrci5j
-b20vcGhvdG9zL3ZhbnZhbi81Mjk5MjUxNTcKIS0tLmZsaWNrci5jb20vcGhvdG9z
-L3dpbnRlcmthbmFsCiEtLS5mbGlja3IuY29tL3Bob3Rvcy96b2xhCnx8ZmxpY2ty
-LmNvbQp8fHN0YXRpY2ZsaWNrci5jb20KCmZsaWNrcmhpdmVtaW5kLm5ldAouZmxp
-Y2tyaXZlci5jb20KLmZsaW5nLmNvbQp8fGZsaXBrYXJ0LmNvbQp8fGZsb2cudHcK
-LmZseXZwbi5jb20KfHxmbHl2cG4uY29tCnxodHRwOi8vY24uZm1ubm93LmNvbQpm
-b2ZsZGZyYWRpby5vcmcKYmxvZy5mb29sc21vdW50YWluLmNvbQouZm9ydW00aGsu
-Y29tCmZhbmdvbmcuZm9ydW1zLWZyZWUuY29tCnBpb25lZXItd29ya2VyLmZvcnVt
-cy1mcmVlLmNvbQohLS1mb3Vyc3F1YXJlLmNvbQohLS18aHR0cDovLzRzcS5jb20K
-fGh0dHBzOi8vc3MqLjRzcWkubmV0CnZpZGVvLmZveGJ1c2luZXNzLmNvbQp8aHR0
-cDovL2ZveGdheS5jb20KfHxmcmluZ2VuZXR3b3JrLmNvbQp8fGZsZWNoZWludGhl
-cGVjaGUuZnIKLmZvY2hrLm9yZwp8aHR0cDovL2ZvY2hrLm9yZwp8fGZvY3VzdGFp
-d2FuLnR3Ci5mb2N1c3Zwbi5jb20KfHxmb2ZnLm9yZwouZm9mZy1ldXJvcGUubmV0
-Ci5mb29vb28uY29tCnx8Zm9vb29vLmNvbQpmb290d2liYWxsLmNvbQouZm90aWxl
-Lm1lCnx8Zm91cnRoaW50ZXJuYXRpb25hbC5vcmcKfHxmb3hkaWUudXMKfHxmb3hz
-dWIuY29tCmZveHRhbmcuY29tCi5mcG10Lm9yZwp8aHR0cDovL2ZwbXQub3JnCi5m
-cG10LnR3Ci5mcG10LW9zZWwub3JnCnx8ZnBtdG1leGljby5vcmcKZnFvay5vcmcK
-fHxmcXJvdXRlci5jb20KfHxmcmFua2xjLmNvbQouZnJlYWtzaGFyZS5jb20KfGh0
-dHA6Ly9mcmVha3NoYXJlLmNvbQp8fGZyZWU0dS5jb20uYXIKZnJlZS1nYXRlLm9y
-ZwouZnJlZS1oYWRhLW5vdy5vcmcKZnJlZS1wcm94eS5jegouZnJlZS5mci9hZHNs
-CmtpbmVveC5mcmVlLmZyCnRpYmV0bGlicmUuZnJlZS5mcgp8fGZyZWVhbGltLmNv
-bQp3aGl0ZWJlYXIuZnJlZWJlYXJibG9nLm9yZwp8fGZyZWVicm93c2VyLm9yZwou
-ZnJlZWNoYWwuY29tCi5mcmVlZG9tY2hpbmEuaW5mbwp8fGZyZWVkb21jaGluYS5p
-bmZvCi5mcmVlZG9taG91c2Uub3JnCnx8ZnJlZWRvbWhvdXNlLm9yZwouZnJlZWRv
-bXNoZXJhbGQub3JnCnx8ZnJlZWRvbXNoZXJhbGQub3JnCi5mcmVlZnEuY29tCi5m
-cmVlZnVja3ZpZHMuY29tCi5mcmVlZ2FvLmNvbQp8fGZyZWVnYW8uY29tCmZyZWVp
-bGhhbXRvaHRpLm9yZwouZnJlZWt3b25weW9uZy5vcmcKfHxzYXZlbGl1eGlhb2Jv
-LmNvbQouZnJlZWxvdHRvLmNvbQp8fGZyZWVsb3R0by5jb20KZnJlZW1hbjIuY29t
-Ci5mcmVlb3BlbnZwbi5jb20KZnJlZW1vcmVuLmNvbQpmcmVlbW9yZW5ld3MuY29t
-CmZyZWVtdXNlLm9yZy9hcmNoaXZlcy83ODkKZnJlZW5ldC1jaGluYS5vcmcKZnJl
-ZW5ld3Njbi5jb20KY24uZnJlZW9uZXMuY29tCi5mcmVlb3oub3JnL2Jicwp8fGZy
-ZWVvei5vcmcKfHxmcmVlc3NoLnVzCmZyZWU0dS5jb20uYXIKLmZyZWUtc3NoLmNv
-bQp8fGZyZWUtc3NoLmNvbQouZnJlZWNoaW5hLm5ld3MvCnx8ZnJlZWNoaW5hZm9y
-dW0ub3JnCnx8ZnJlZWNoaW5hd2VpYm8uY29tCi5mcmVlZG9tY29sbGVjdGlvbi5v
-cmcvaW50ZXJ2aWV3cy9yZWJpeWFfa2FkZWVyCi5mcmVlZm9ydW1zLm9yZwp8fGZy
-ZWVuZXRwcm9qZWN0Lm9yZwouZnJlZW96Lm9yZwouZnJlZXRpYmV0Lm5ldAp8fGZy
-ZWV0aWJldC5vcmcKLmZyZWV0aWJldGFuaGVyb2VzLm9yZwp8aHR0cDovL2ZyZWV0
-aWJldGFuaGVyb2VzLm9yZwouZnJlZXZpZXdtb3ZpZXMuY29tCi5mcmVldnBuLm1l
-CnxodHRwOi8vZnJlZXZwbi5tZQp8fGZyZWV3YWxscGFwZXI0Lm1lCi5mcmVld2Vi
-cy5jb20KLmZyZWV3ZWNoYXQuY29tCnx8ZnJlZXdlY2hhdC5jb20KZnJlZXdlaWJv
-LmNvbQp8fGZyZWV3ZWliby5jb20KLmZyZWV4aW53ZW4uY29tCi5mcmVleW91dHVi
-ZXByb3h5Lm5ldAp8fGZyZWV5b3V0dWJlcHJveHkubmV0CmZyaWVuZGZlZWQuY29t
-CmZyaWVuZGZlZWQtbWVkaWEuY29tL2U5OWE0ZWJlMmZiNGMxOTg1YzJhNTg3NzVl
-YjQ0MjI5NjFhYTVhMmUKZnJpZW5kcy1vZi10aWJldC5vcmcKLmZyaWVuZHNvZnRp
-YmV0Lm9yZwpmcmVlY2hpbmEubmV0CnxodHRwOi8vd3d3LnplbnN1ci5mcmVlcmsu
-Y29tLwpmcmVldnBuLm5sCmZyZWV5ZWxsb3cuY29tCmhrLmZyaWVuZGR5LmNvbS9o
-awp8aHR0cDovL2FkdWx0LmZyaWVuZGZpbmRlci5jb20vCi5mcmluZy5jb20KfHxm
-cmluZy5jb20KLmZyb21jaGluYXRvdXNhLm5ldAp8fGZyb21tZWwubmV0Ci5mcm9u
-dGxpbmVkZWZlbmRlcnMub3JnCi5mcm9vdHZwbi5jb20KfHxmcm9vdHZwbi5jb20K
-fHxmc2NrZWQub3JnCi5mc3VyZi5jb20KLmZ0di5jb20udHcKZnVjZC5jb20KLmZ1
-Y2tjbm5pYy5uZXQKfHxmdWNrY25uaWMubmV0CmZ1Y2tnZncub3JnCi5mdWxpb25l
-LmNvbQp8aHR0cHM6Ly9mdWxpb25lLmNvbQp8fGZ1bGxlcmNvbnNpZGVyYXRpb24u
-Y29tCmZ1bHVlLmNvbQouZnVuZi50dwpmdW5wLmNvbQouZnVxLmNvbQouZnVyaGhk
-bC5vcmcKfHxmdXJpbmthbi5jb20KLmZ1dHVyZWNoaW5hZm9ydW0ub3JnCnx8ZnV0
-dXJlbWVzc2FnZS5vcmcKLmZ1eC5jb20KLmZ1eWluLm5ldAouZnV5aW5kaWFudGFp
-Lm9yZwouZnV5dS5vcmcudHcKfHxmdy5jbQouZnhjbS1jaGluZXNlLmNvbQp8fGZ4
-Y20tY2hpbmVzZS5jb20KZnpoOTk5LmNvbQpmemg5OTkubmV0CmZ6bG0uY29tCgoh
-LS0tLS0tLS0tLS0tLS0tLS0tLS1HRy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0K
-Lmc2aGVudGFpLmNvbQp8aHR0cDovL2c2aGVudGFpLmNvbQp8fGctcXVlZW4uY29t
-Cnx8Z2Fib2NvcnAuY29tCi5nYWVwcm94eS5jb20KLmdhZm9ydW0ub3JnCi5nYWxh
-eHltYWNhdS5jb20KfHxnYWxlbnd1LmNvbQouZ2Fsc3RhcnMubmV0Cnx8Z2FtZTcz
-NS5jb20KZ2FtZWJhc2UuY29tLnR3CmdhbWVqb2x0LmNvbQp8aHR0cDovL3dpa2ku
-Z2FtZXJwLmpwCnx8Z2FtZXIuY29tLnR3Ci5nYW1lci5jb20udHcKLmdhbWV6LmNv
-bS50dwp8fGdhbWV6LmNvbS50dwouZ2Ftb3VzYS5jb20KLmdhb21pbmcubmV0Cnx8
-Z2FvbWluZy5uZXQKZ2FuZ2VzLmNvbQouZ2FvcGkubmV0CnxodHRwOi8vZ2FvcGku
-bmV0Ci5nYW96aGlzaGVuZy5vcmcKLmdhb3poaXNoZW5nLm5ldApnYXJkZW5uZXR3
-b3Jrcy5jb20KfHxnYXJkZW5uZXR3b3Jrcy5vcmcKIS0tSVAgb2YgR2FyZGVuIE5l
-dHdvcmsKNzIuNTIuODEuMjIKfHxnYXJ0bGl2ZS5jb20KfHxnYXRlLXByb2plY3Qu
-Y29tCnx8Z2F0aGVyLmNvbQouZ2F0aGVycHJveHkuY29tCmdhdGkub3JnLnR3Ci5n
-YXlidWJibGUuY29tCi5nYXljbi5uZXQKLmdheWh1Yi5jb20KfHxnYXltYXAuY2MK
-LmdheW1lbnJpbmcuY29tCi5nYXl0dWJlLmNvbQohLS18fGdheXR1YmUuY29tCnx8
-aW1hZ2VzLWdheXR1YmUuY29tCi5nYXl3YXRjaC5jb20KfGh0dHA6Ly9nYXl3YXRj
-aC5jb20KLmdhem90dWJlLmNvbQp8fGdhem90dWJlLmNvbQp8fGdjYy5vcmcuaGsK
-fHxnY2xvb25leS5jb20KfHxnY21hc2lhLmNvbQouZ2NwbmV3cy5jb20KfGh0dHA6
-Ly9nY3BuZXdzLmNvbQouZ2RidC5uZXQvZm9ydW0KZ2R6Zi5vcmcKfHxnZWVrLWFy
-dC5uZXQKZ2Vla2VyaG9tZS5jb20vMjAxMC8wMy94aXhpYW5nLXByb2plY3QtY3Jv
-c3MtZ2Z3Cnx8Z2Vla2hlYXJ0LmluZm8KLmdla2lrYW1lLmNvbQp8aHR0cDovL2dl
-a2lrYW1lLmNvbQouZ2VsYm9vcnUuY29tCnxodHRwOi8vZ2VsYm9vcnUuY29tCiEt
-LXx8Z2VudWl0ZWMuY29tCi5nZW9jaXRpZXMuY28uanAKLmdlb2NpdGllcy5jb20v
-U2lsaWNvblZhbGxleS9DaXJjdWl0LzU2ODMvZG93bmxvYWQuaHRtbApoay5nZW9j
-aXRpZXMuY29tCmdlb2NpdGllcy5qcAouZ2VyZWZvdW5kYXRpb24ub3JnCnx8Z2V0
-YXN0cmlsbC5jb20KLmdldGNodS5jb20KLmdldGNsb2FrLmNvbQp8fGdldGNsb2Fr
-LmNvbQp8fGdldGZveHlwcm94eS5vcmcKLmdldGZyZWVkdXIuY29tCnx8Z2V0Z29t
-LmNvbQouZ2V0aTJwLm5ldAp8fGdldGkycC5uZXQKLmdldGxhbnRlcm4ub3JnCnx8
-Z2V0bGFudGVybi5vcmcKLmdldGpldHNvLmNvbS9mb3J1bQpnZXRpdG9uLmNvbQou
-Z2V0c29jaWFsc2NvcGUuY29tCnx8Z2V0c3luYy5jb20KZ2Zidi5kZQouZ2Znb2xk
-LmNvbS5oawouZ2ZzYWxlLmNvbQp8fGdmc2FsZS5jb20KZ2Z3Lm9yZy51YQouZ2Z3
-LnByZXNzCnx8Z2Z3LnByZXNzCi5nZ3NzbC5jb20KfHxnZ3NzbC5jb20KIS0tfHxn
-aG9zdC5vcmcKLmdob3N0cGF0aC5jb20KfHxnaG9zdHBhdGguY29tCnx8Z2h1dC5v
-cmcKLmdpYW50ZXNzbmlnaHQuY29tCnxodHRwOi8vZ2lhbnRlc3NuaWdodC5jb20K
-LmdpZnJlZS5jb20KfHxnaWdhLXdlYi5qcAp0dy5naWdhY2lyY2xlLmNvbQp8aHR0
-cDovL2NuLmdpZ2FuZXdzLmNvbS8KZ2lncG9ybm8ucnUKfHxnaXJsYmFua2VyLmNv
-bQouZ2l0LmlvCnx8Z2l0LmlvCnxodHRwOi8vc29mdHdhcmVkb3dubG9hZC5naXRi
-b29rcy5pbwoKIS0tLUdpdEh1Yi0tLQpnaXRodWIuY29tL2dldGxhbnRlcm4KfGh0
-dHBzOi8vZ2lzdC5naXRodWIuY29tCmh0dHA6Ly9jdGhsby5naXRodWIuaW8vaGt0
-dgpoYWhheGl4aS5naXRodWIuaW8KfGh0dHBzOi8vaGFoYXhpeGkuZ2l0aHViLmlv
-Cnx8aGFvZWwuZ2l0aHViLmlvCiEtLXxodHRwOi8vb25pb25oYWNrZXIuZ2l0aHVi
-LmlvCnx8cmczLmdpdGh1Yi5pbwp8fHNpa2FvemhlMTk5Ny5naXRodWIuaW8KfHxz
-b2RhdGVhLmdpdGh1Yi5pbwp8fHRlcm1pbnVzMjA0OS5naXRodWIuaW8KfHx0b3V0
-eXJhdGVyLmdpdGh1Yi5pbwp3c2d6YW8uZ2l0aHViLmlvCnxodHRwczovL3dzZ3ph
-by5naXRodWIuaW8KIS0tLmdpdGh1Yi5pbwoKLmdpemxlbi5uZXQKfHxnaXpsZW4u
-bmV0Ci5namN6ei5jb20KfHxnamN6ei5jb20KZ2xvYmFsamloYWQubmV0Cmdsb2Jh
-bG1lZGlhb3V0cmVhY2guY29tCmdsb2JhbG11c2V1bW9uY29tbXVuaXNtLm9yZwp8
-fGdsb2JhbHJlc2N1ZS5uZXQKLmdsb2JhbHRtLm9yZwouZ2xvYmFsdm9pY2Vzb25s
-aW5lLm9yZwp8fGdsb2JhbHZvaWNlc29ubGluZS5vcmcKfHxnbG9iYWx2cG4ubmV0
-Ci5nbG9jay5jb20KZ2x1Y2ttYW4uY29tL0RhbGFpTGFtYQpnbWJkLmNuCnx8Z21o
-ei5vcmcKfGh0dHA6Ly93d3cuZ21pZGRsZS5jb20KfGh0dHA6Ly93d3cuZ21pZGRs
-ZS5uZXQKLmdtbGwub3JnCnx8Z25jaS5vcmcuaGsKZ28tcGtpLmNvbQp8fGdvYWdl
-bnQuYml6Cnx8Z29hZ2VudHBsdXMuY29tCmdvYmV0LmNjCmdvZGZvb3RzdGVwcy5v
-cmcKfHxnb2Rmb290c3RlcHMub3JnCmdvZG5zLndvcmsKZ29kc2RpcmVjdGNvbnRh
-Y3QuY28udWsKLmdvZHNkaXJlY3Rjb250YWN0Lm9yZwpnb2RzZGlyZWN0Y29udGFj
-dC5vcmcudHcKLmdvZHNpbW1lZGlhdGVjb250YWN0LmNvbQouZ29nb3R1bm5lbC5j
-b20KfHxnb2hhcHB5LmNvbS50dwouZ29rYmF5cmFrLmNvbQouZ29sZGJldC5jb20K
-fHxnb2xkYmV0c3BvcnRzLmNvbQp8fGdvbGRlbmV5ZXZhdWx0LmNvbQouZ29sZGVu
-ZnJvZy5jb20KfHxnb2xkZW5mcm9nLmNvbQouZ29sZGppenouY29tCnxodHRwOi8v
-Z29sZGppenouY29tCi5nb2xkc3RlcC5uZXQKfHxnb2xkd2F2ZS5jb20KZ29uZ21l
-bmcuaW5mbwpnb25nbS5pbgpnb25nbWlubGlsaWFuZy5jb20KLmdvbmd3dC5jb20K
-fGh0dHA6Ly9nb25nd3QuY29tCmJsb2cuZ29vLm5lLmpwL2R1Y2stdGFpbF8yMDA5
-Ci5nb29kYXkueHl6CnxodHRwOi8vZ29vZGF5Lnh5egouZ29vZHJlYWRzLmNvbQp8
-fGdvb2RyZWFkcy5jb20KLmdvb2RyZWFkZXJzLmNvbQp8fGdvb2RyZWFkZXJzLmNv
-bQouZ29vZHR2LmNvbS50dwouZ29vZHR2LnR2Cnx8Z29vZmluZC5jb20KLmdvb2ds
-ZXNpbGUuY29tCi5nb3BldGl0aW9uLmNvbQp8fGdvcGV0aXRpb24uY29tCi5nb3By
-b3hpbmcubmV0Ci5nb3RydXN0ZWQuY29tCnx8Z290cnVzdGVkLmNvbQp8fGdvdHcu
-Y2EKfHxncmFtbWFseS5jb20KZ3JhbmR0cmlhbC5vcmcKLmdyYXBoaXMubmUuanAK
-fHxncmFwaGlzLm5lLmpwCnx8Z3JhcGhxbC5vcmcKIS0tfHxzLmdyYXZhdGFyLmNv
-bQpncmVhdGZpcmV3YWxsLmJpegp8fGdyZWF0ZmlyZXdhbGxvZmNoaW5hLm5ldAou
-Z3JlYXRmaXJld2FsbG9mY2hpbmEub3JnCnx8Z3JlYXRmaXJld2FsbG9mY2hpbmEu
-b3JnCnx8Z3JlZW5maWVsZGJvb2tzdG9yZS5jb20uaGsKLmdyZWVucGFydHkub3Jn
-LnR3Cnx8Z3JlZW5wZWFjZS5vcmcKLmdyZWVucmVhZGluZ3MuY29tL2ZvcnVtCmdy
-ZWF0LWZpcmV3YWxsLmNvbQpncmVhdC1yb2Mub3JnCmdyZWF0cm9jLm9yZwpncmVh
-dHpob25naHVhLm9yZwouZ3JlZW5wZWFjZS5jb20udHcKLmdyZWVudnBuLm5ldAp8
-fGdyZWVudnBuLm5ldAouZ3JlZW52cG4ub3JnCnx8Z3JvdHR5LW1vbmRheS5jb20K
-Z3MtZGlzY3Vzcy5jb20KfHxndHJpY2tzLmNvbQpndWFuY2hhLm9yZwpndWFuZXJ5
-dS5jb20KLmd1YXJkc3Rlci5jb20KLmd1bi13b3JsZC5uZXQKZ3Vuc2FuZGFtbW8u
-Y29tCnx8Z3V0dGVydW5jZW5zb3JlZC5jb20KfHxndm0uY29tLnR3Ci5nem0udHYK
-fHxnem9uZS1hbmltZS5pbmZvCgohLS0tLS0tLS0tLS0tLUdIUy0tLS0tCiEtfHxm
-ZWVkcy5jYnNuZXdzLmNvbQohLXx8d3d3LmNoaW5lc2VhbGJ1bWFydC5jb20KfHxj
-bGVtZW50aW5lLXBsYXllci5vcmcKIS18fGNsZW1lc2hhLm9yZwohLXx8d3d3LmNs
-b3VkZ2lybGZyaWVuZC5jb20KIS18fGNvY29hd2l0aGxvdmUuY29tCiEtfHxibG9n
-LmNvbnRyb2xzcGFjZS5vcmcKIS1ECiEtfHx3d3cuZGFpbHlneWFuLmNvbQohLXx8
-ZGFpbHl0b2RvLm9yZwohLXx8YmxvZy5kYW5tYXJuZXIuY29tCiEtfHxnaXRodWIu
-ZGFubWFybmVyLmNvbQohLXx8ZGVzaWduLXNlZWRzLmNvbQohLXx8ZGVzaWduZXJz
-LWFydGlzdHMuY29tCiEtfHxtYWlsLmRpeWFuZy5vcmcKIS18fGJsb2cuZG91Z2hl
-bGxtYW5uLmNvbQohLXx8ZG93bmZvcmV2ZXJ5b25lb3JqdXN0bWUuY29tCiEtfHxk
-cm9pZHNlY3VyaXR5LmNvbQohLXx8d3d3LmRyb3Btb2Nrcy5jb20KIS18fGR1bWJs
-aXR0bGVtYW4uY29tCiEtRQplY2hvZm9uLmNvbQohLXx8ZWNob2Zvbi5jb20KIS18
-fGVwYy1qYXYuY29tCiEtfHxldmVyZGFyay5pbmZvCiEtfHxldmhlYWQuY29tCiEt
-RgohLXx8ZmFjaWxlbG9naW4uY29tCiEtfHwqLmZhdGR1Y2sub3JnCiEtfHxibG9n
-LmZkY24ub3JnCiEtfHxmZnRvZ28uY29tCiEtfHxmbGlnaHRzaW10YWxrLmNvbQoh
-LXx8bWNsZWUuZm9vbG1lLm5ldAohLXx8d3d3LmZyaWVuZGRlY2suY29tCiEtfHxm
-cmluZ2VzcG9pbGVycy5jb20KIS18fGZyaW5nZXRlbGV2aXNpb24uY29tCiEtfHxm
-dW5wZWEuY29tCiEtRwohLXx8YmxvZy5nYXRlaW4ub3JnCiEtfHxmZWVkcy5nYXdr
-ZXIuY29tCiEtfHxnZWVrdGFuZy5jb20KIS18fGdlb2hvdC51cwohLXx8Z2V0YXJv
-dW5kLmNvbQohLXx8Z21lci5uZXQKIS18fHd3dy5nbW90ZS5vcmcKIS18fGJsb2cu
-Z28yd2ViMjAubmV0CiEtfHxnb29nbGUtbWVsYW5nZS5jb20KIS18fGZhbWUuZ29u
-em9sYWJzLm9yZwohLXx8Z292ZWNuLm9yZwohLXx8Z3F1ZXVlcy5jb20KIS18fGdy
-YXBoeWNhbGMuY29tCnx8Z3JlYXNlc3BvdC5uZXQKIS18fGJsb2cuZ3Jvd2xmb3J3
-aW5kb3dzLmNvbQohLUgKIS18fGhjbS5jb20udHcKIS18fGJsb2cuaGVhZGl1cy5j
-b20KIS18fGhvZ2JheXNvZnR3YXJlLmNvbQohLXx8YmxvZy5ob3RvdC5vcmcKIS18
-fGZlZWRzLmhvd3N0dWZmd29ya3MuY29tCiEtfHxodWhhaXRhaS5jb20KIS18fGJs
-b2cuaHVtYW5yaWdodHNmaXJzdC5vcmcKIS1JCiEtfHxzaXRlLmljdS1wcm9qZWN0
-Lm9yZwohLXx8aWdvcndhcmUuY29tCiEtfHxpaGFzMTMzN2NvZGUuY29tCiEtfHxp
-bmtub3V2ZWF1LmNvbQohLXx8aW5vdGUudHcKIS18fGlyb25oZWxtZXQuY29tCiEt
-fHxpd2Z3Y2YuY29tCiEtSgohLXx8YmxvZy5qYW5nbXQuY29tCiEtfHxibG9nLmph
-eWZpZWxkcy5jb20KIS18fGJsb2cuam9pbnQubmV0CiEtfHxibG9nLmpzcXVhcmVk
-amF2YXNjcmlwdC5jb20KIS18fGJsb2cuanRid29ybGQuY29tCiEtSwohLXx8a2F0
-aHlzY2h3YWxiZS5jb20KIS18fHRvbWF0b3Zwbi5rZWl0aG1veWVyLmNvbQohLXx8
-d3d3LmtlaXRobW95ZXIuY29tCiEtfHxrZW5kYWx2YW5keWtlLmNvbQohLXx8Ymxv
-Zy5rZW5nYW8udHcKIS18fGxvZy5rZXNvLmNuCiEtfHx3d3cua2hhbmFjYWRlbXku
-b3JnCnx8d3d3LmtsaXAubWUKIS18fHVzYmxvYWRlcmd4LmtvdXJlaW8ubmV0CiEt
-fHxibG9nLmtvd2FsY3p5ay5pbmZvCiEtTAohLXx8bGFieXJpbnRoMi5jb20KIS18
-fGxhcnNnZW9yZ2UuY29tCiEtfHxibG9nLmxhc3RwYXNzLmNvbQohLXx8ZG9jcy5s
-YXRleGxhYi5vcmcKIS18fGxlYW5lc3NheXMuY29tCiEtfHxibG9nLmxpZGFvYmlu
-Zy5pbmZvCiEtfHxsb2cubGlnaHRvcnkubmV0CiEtfHxmZWVkcy5saW1pLm5ldAoh
-LXx8d3d3LmxpdGVhcHBsaWNhdGlvbnMuY29tCiEtfHxibG9nLmxpdWthbmd4dS5p
-bmZvCiEtfHx0d2l0dGVyLmxpdWthbmd4dS5pbmZvCiEtfHxvYXNpc25ld3Nyb29t
-LmxpdmU0ZXZlci51cwohLXx8d3d3LmxvY2tlcmdub21lLmNvbQohLXx8bG9jcWwu
-Y29tCkBAfHxzaXRlLmxvY3FsLmNvbQohLXx8ZmVlZHMubG9pY2xlbWV1ci5jb20K
-IS18fGJsb2cubG91aXNncmF5LmNvbQohLU0KIS18fG1hZGVieXNvZmEuY29tCiEt
-fHxtYWRlbW9pc2VsbGVyb2JvdC5jb20KIS18fG1hc2FtaXhlcy5jb20KIS18fHd3
-dy5tZXRhbXVzZS5uZXQKIS18fGJsb2cubWV0YXNwbG9pdC5jb20KIS18fG1pbGF6
-aS5jb20KIS18fHd3dy5taW5pd2VhdGhlci5jb20KIS18fHR3aXR0ZXIubWlzc2l1
-LmNvbQohLXx8cGx1cmt0b3AtYnV0dG9uLm1tZGF5cy5jb20KIS18fGZlZWRzLm1v
-YmlsZXJlYWQuY29tCiEtfHx3d3cubW9kZXJuaXpyLmNvbQohLXx8d3d3Lm1vZGsu
-aXQKIS18fG15dHdpc2hpcnQuY29tCiEtTgohLXx8YmxvZy5uZXRmbGl4LmNvbQoh
-LXx8YmxvZy5uaWhpbG9naWMuZGsKIS18fG50bGsub3JnCiEtfHxudnF1YW4ub3Jn
-CiEtfHxub2dvb2RhdGNvZGluZy5jb20KIS18fGJsb2cubm90ZG90Lm5ldAohLXx8
-d3d3Lm5vdGlmeS5pbwohLU8KIS18fGJsb2cub2J2aW91cy5jb20KIS18fG9uZWJp
-Z2ZsdWtlLmNvbQohLXx8b3ZlcnN0aW11bGF0ZS5jb20KIS1QCiEtfHxwY2dlZWti
-bG9nLmNvbQohLXx8ZmVlZHMucGRmY2htLm5ldAohLXx8ZmVlZHMucGVvcGxlLmNv
-bQohLXx8YmxvZy5wZXJzaXN0ZW50LmluZm8KIS18fGNocm9tZS5wbGFudHN2c3pv
-bWJpZXMuY29tCiEtfHxwb3J0YWJsZXNvZnQub3JnLnJ1CiEtfHxwcmFzYW5uYXRl
-Y2gubmV0CiEtfHx0YWxrLm5ld3MucHRzLm9yZy50dwohLXx8cHl0aG9uLWV4Y2Vs
-Lm9yZwohLVEKIS1SCiEtfHxyLWNoYXJ0LmNvbQohLXx8cmFtZXNoc3VicmFtYW5p
-YW4ub3JnCiEtfHxyYXBpZC5wawohLXx8YmxvZy5yZW5hbnNlLmNvbQohLXx8cm9i
-ZXJ0bWFvLmNvbQohLXx8d3d3LnJvbWVvLWZveHRyb3QuY29tCiEtUwohLXx8c2Fs
-bWl5dWNrLmNvbQohLXx8c2Ftc2FsLmNvbQohLXx8YmxvZy5zZWVtaW5nbGVlLmNv
-bQohLXx8YmxvZy5zZmxvdy5jb20KIS18fGJsb2cuc2lnZnBlLmNvbQohLXx8c2lt
-cGxldGV4dC53cwohLXx8d3d3LnNrdWxwdC5vcmcKIS18fHJzcy5zbGFzaGRvdC5v
-cmcKIS18fHNuaXBwZXRzYXBwLmNvbQohLXx8dy5zbnMubHkKIS18fHd3dy5zb2Np
-YWxubW9iaWxlLmNvbQohLXx8d3d3LnNvY2lhbHdob2lzLmNvbQohLXx8c3Bpcml0
-amIub3JnCiEtfHxzc2Jvb2suY29tCiEtfHxzc2hmb3J3YXJkaW5nLmNvbQohLXx8
-c3RhdGlvbmVyaWEuY29tCnx8c3RlcGhhbmllcmVkLmNvbQohLXx8c3Vuamlkb25n
-Lm5ldAohLXx8c3luaXVtc29mdHdhcmUuY29tCkBAfHxkb3dubG9hZC5zeW5pdW1z
-b2Z0d2FyZS5jb20KIS1UCiEtfHx0YWd4ZWRvLmNvbQohLXx8YmxvZy50YXRvZWJh
-Lm9yZwohLXx8d3d3LnRlY2hmb2IuY29tCiEtfHx0ZWFjaHBhcmVudHN0ZWNoLm9y
-ZwohLXx8dGhlOHBlbi5jb20KIS18fHRoZWlwaG9uZXdpa2kuY29tCiEtfHxibG9n
-LnRoZXNpbGVudG51bWJlci5tZQohLXx8dGhlc3BvbnR5LmNvbQohLXx8dGhldWx0
-cmFsaW54LmNvbQohLXx8YmxvZy50aGluay1hc3luYy5jb20KIS18fHRvcm5hZG93
-ZWIub3JnCiEtfHx0cmFuc3BhcmVudHVwdGltZS5jb20KIS18fHRyaWFuZ3VsYXRp
-b25ibG9nLmNvbQohLXx8YmxvZy50c3VuYW5ldC5uZXQKIS18fGVuLnR1eGVyby5j
-b20KIS18fHR3YXp6dXAuY29tCiEtfHx0d2VldHN3ZWxsLmNvbQohLXx8dHdpYmVz
-LmNvbQohLXx8YXJ0LnR3Z2cub3JnCiEtfHx0d2l2ZXJ0LmNvbQohLVUKfGh0dHA6
-Ly91YjAuY2MKIS18fGpvbm55LnVidW50dS10dy5uZXQKIS18fGJsb2cudW1vbmtl
-eS5uZXQKIS1WCiEtfHx0cC52YmFwLmNvbS5hdQohLXx8d3d3LnZpcnR1b3Vzcm9t
-LmNvbQohLXx8YmxvZy52aXNpYm90ZWNoLmNvbQohLVcKIS18fHdhdmVwcm90b2Nv
-bC5vcmcKIS18fHd3dy53YXZlc2FuZGJveC5jb20KIS18fHdlYmZlZS5vcmcucnUK
-IS18fGJsb2cud2VibXByb2plY3Qub3JnCiEtfHx3ZWJ1cGQ4Lm9yZwohLXx8d3d3
-LndoYXRicm93c2VyLm9yZwohLXx8d3d3LndoZXJlZG95b3Vnby5uZXQKIS18fHdp
-bGxoYWlucy5jb20KIS18fGZlZWRzLndpcmVkLmNvbQohLXx8d2lzZW1hcHBpbmcu
-b3JnCndvenkuaW4KIS18fHdvenkuaW4vCiEtfHxibG9nLnd1bmRlcmNvdW50ZXIu
-Y29tCiEtWAohLXx8eGRlbHRhLm9yZwohLXx8eGlhb2dhb3ppLm9yZwohLXx8eGls
-b3UudXMKIS18fHh6eS5vcmcucnUKIS1ZCiEtfHx5b29wZXIuYmUKIS18fHRzb25n
-Lnl1bnhpLm5ldAohLVoKCmdvc3BlbGhlcmFsZC5jb20KfHxnb3NwZWxoZXJhbGQu
-Y29tCnxodHRwOi8vaGsuZ3JhZGNvbm5lY3Rpb24uY29tLwp8fGdyYW5nb3J6Lm9y
-ZwpncmVhdGZpcmUub3JnCnx8Z3JlYXRmaXJlLm9yZwpncmVhdGZpcmV3YWxsb2Zj
-aGluYS5vcmcKfHxncmVhdHJvYy50dwouZ3RzLXZwbi5jb20KfGh0dHA6Ly9ndHMt
-dnBuLmNvbQouZ3UtY2h1LXN1bS5vcmcKfGh0dHA6Ly9ndS1jaHUtc3VtLm9yZwou
-Z3VhZ3Vhc3MuY29tCnxodHRwOi8vZ3VhZ3Vhc3MuY29tCi5ndWFndWFzcy5vcmcK
-fGh0dHA6Ly9ndWFndWFzcy5vcmcKLmd1YW5nbWluZy5jb20ubXkKZ3Vpc2hhbi5v
-cmcKfHxndWlzaGFuLm9yZwouZ3Vtcm9hZC5jb20KfHxndW1yb2FkLmNvbQp8fGd1
-bnNhbWVyaWNhLmNvbQpndXJ1b25saW5lLmhrCnxodHRwOi8vZ3ZsaWIuY29tCi5n
-eWFsd2FyaW5wb2NoZS5jb20KLmd5YXRzb3N0dWRpby5jb20KCiEtLS0tLS0tLS0t
-LS0tLS0tLS0tLUhILS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQouaDUyOC5jb20K
-Lmg1ZG0uY29tCi5oNWdhbGdhbWUubWUKfHxoLWNoaW5hLm9yZwouaC1tb2UuY29t
-CnxodHRwOi8vaC1tb2UuY29tCmgxbjFjaGluYS5vcmcKLmhhY2cuY2x1Ygp8fGhh
-Y2cuY2x1YgouaGFjZy5pbgp8aHR0cDovL2hhY2cuaW4KLmhhY2cubGkKfGh0dHA6
-Ly9oYWNnLmxpCi5oYWNnLm1lCnxodHRwOi8vaGFjZy5tZQouaGFjZy5yZWQKfGh0
-dHA6Ly9oYWNnLnJlZAouaGFja2VuLmNjL2JicwouaGFja2VyLm9yZwp8fGhhY2t0
-aGF0cGhvbmUubmV0CmhhaGxvLmNvbQp8fGhha2thdHYub3JnLnR3Ci5oYW5kY3Jh
-ZnRlZHNvZnR3YXJlLm9yZwp8aHR0cDovL2Jicy5oYW5taW56dS5vcmcvCi5oYW51
-bnlpLmNvbQouaGFvLm5ld3MvbmV3cwp8aHR0cDovL2FlLmhhbzEyMy5jb20KfGh0
-dHA6Ly9hci5oYW8xMjMuY29tCnxodHRwOi8vYnIuaGFvMTIzLmNvbQp8aHR0cDov
-L2VuLmhhbzEyMy5jb20KfGh0dHA6Ly9pZC5oYW8xMjMuY29tCnxodHRwOi8vanAu
-aGFvMTIzLmNvbQp8aHR0cDovL21hLmhhbzEyMy5jb20KfGh0dHA6Ly9teC5oYW8x
-MjMuY29tCnxodHRwOi8vc2EuaGFvMTIzLmNvbQp8aHR0cDovL3RoLmhhbzEyMy5j
-b20KfGh0dHA6Ly90dy5oYW8xMjMuY29tCnxodHRwOi8vdm4uaGFvMTIzLmNvbQp8
-aHR0cDovL2hrLmhhbzEyM2ltZy5jb20KfGh0dHA6Ly9sZC5oYW8xMjNpbWcuY29t
-Cnx8aGFwcHktdnBuLmNvbQouaGFwcm94eS5vcmcKfHxoYXJkc2V4dHViZS5jb20K
-LmhhcnVueWFoeWEuY29tCnxodHRwOi8vaGFydW55YWh5YS5jb20KYmJzLmhhc2ku
-d2FuZwpoYXZlOC5jb20KQEB8fGhheWdvLmNvbQouaGNsaXBzLmNvbQp8fGhkbHQu
-bWUKfHxoZHR2Yi5uZXQKLmhkem9nLmNvbQp8aHR0cDovL2hkem9nLmNvbQp8fGhl
-YXJ0eWl0LmNvbQouaGVhdnktci5jb20KLmhlYy5zdQp8aHR0cDovL2hlYy5zdQou
-aGVjYWl0b3UubmV0Cnx8aGVjYWl0b3UubmV0Ci5oZWNoYWppLmNvbQp8fGhlY2hh
-amkuY29tCnx8aGVlYWN0LmVkdS50dwouaGVncmUtYXJ0LmNvbQp8aHR0cDovL2hl
-Z3JlLWFydC5jb20KfHxjZG4uaGVsaXhzdHVkaW9zLm5ldAp8fGhlbHBsaW5mZW4u
-Y29tCnx8aGVsbG9hbmRyb2lkLmNvbQp8fGhlbGxvcXVlZXIuY29tCi5oZWxsb3Nz
-LnB3CmhlbGxvdHh0LmNvbQp8fGhlbGxvdHh0LmNvbQouaGVudGFpLnRvCi5oZWxs
-b3VrLm9yZy9mb3J1bS9sb2ZpdmVyc2lvbgouaGVscGVhY2hwZW9wbGUuY29tCnx8
-aGVscGVhY2hwZW9wbGUuY29tCnx8aGVscHN0ZXIuZGUKLmhlbHB6aHVsaW5nLm9y
-ZwpoZW50YWl0dWJlLnR2Ci5oZW50YWl2aWRlb3dvcmxkLmNvbQoKISMjIyMjIyMj
-IyMjLS1IZXJva3UtLSMjIyMjIyMjIyMKIS0tfHxnZXRjbG91ZGFwcC5jb20KIS0t
-fHxjbC5seQohLS1AQHx8Zi5jbC5seQohLS1FQzIgRE5TIFBvaXNvbmVkCnx8aWQu
-aGVyb2t1LmNvbQoKaGVxaW5nbGlhbi5uZXQKfHxoZXVuZ2tvbmdkaXNjdXNzLmNv
-bQouaGV4aWVzaGUuY29tCnx8aGV4aWVzaGUuY29tCnx8aGV4aWVzaGUueHl6CiEt
-LUdvb2dsZSBlbXBsb3llZSB3aXRoaW4gR29vZ2xlIElQCnx8aGV4eGVoLm5ldAph
-cHAuaGV5d2lyZS5jb20KLmhleXpvLmNvbQouaGdzZWF2LmNvbQouaGhkY2Izb2Zm
-aWNlLm9yZwouaGh0aGVzYWt5YXRyaXppbi5vcmcKaGktb24ub3JnLnR3CmhpZGRl
-bi1hZHZlbnQub3JnCnx8aGlkZGVuLWFkdmVudC5vcmcKaGlkZWNsb3VkLmNvbS9i
-bG9nLzIwMDgvMDcvMjkvZnVjay1iZWlqaW5nLW9seW1waWNzLmh0bWwKfHxoaWRl
-Lm1lCi5oaWRlaW4ubmV0Ci5oaWRlaXB2cG4uY29tCnx8aGlkZWlwdnBuLmNvbQou
-aGlkZW1hbi5uZXQKfHxoaWRlbWFuLm5ldApoaWRlbWUubmwKfHxoaWRlbXkubmFt
-ZQouaGlkZW15YXNzLmNvbQp8fGhpZGVteWFzcy5jb20KaGlkZW15Y29tcC5jb20K
-fHxoaWRlbXljb21wLmNvbQouaGloaWZvcnVtLmNvbQouaGloaXN0b3J5Lm5ldAp8
-fGhpaGlzdG9yeS5uZXQKLmhpZ2Z3LmNvbQpoaWdocGVha3NwdXJlZWFydGguY29t
-Cnx8aGlnaHJvY2ttZWRpYS5jb20KfHxoaWl0Y2guY29tCnx8aGlraW5nZ2Z3Lm9y
-ZwouaGlsaXZlLnR2Ci5oaW1hbGF5YW4tZm91bmRhdGlvbi5vcmcKaGltYWxheWFu
-Z2xhY2llci5jb20KLmhpbWVtaXguY29tCnx8aGltZW1peC5jb20KLmhpbWVtaXgu
-bmV0CnRpbWVzLmhpbmV0Lm5ldAouaGl0b21pLmxhCnxodHRwOi8vaGl0b21pLmxh
-Ci5oaXdpZmkuY29tCkBAfHxoaXdpZmkuY29tCmhpemJ1dHRhaHJpci5vcmcKaGl6
-Yi11dC10YWhyaXIuaW5mbwpoaXpiLXV0LXRhaHJpci5vcmcKLmhqY2x1Yi5pbmZv
-Ci5oay1wdWIuY29tL2ZvcnVtCnxodHRwOi8vaGstcHViLmNvbQouaGswMS5jb20K
-fHxoazAxLmNvbQouaGszMjE2OC5jb20KfHxoazMyMTY4LmNvbQp8fGhrYWNnLmNv
-bQp8fGhrYWNnLm5ldAouaGthdHZuZXdzLmNvbQpoa2JjLm5ldAouaGtiZi5vcmcK
-LmhrYm9va2NpdHkuY29tCnx8aGtib29rY2l0eS5jb20KLmhrY2h1cmNoLm9yZwpo
-a2NpLm9yZy5oawouaGtjbWkuZWR1Cnx8aGtjbmV3cy5jb20KfHxoa2NvYy5jb20K
-aGtkYXkubmV0Ci5oa2RhaWx5bmV3cy5jb20uaGsvY2hpbmEucGhwCmhrZGYub3Jn
-Ci5oa2VqLmNvbQouaGtlcGMuY29tL2ZvcnVtL3ZpZXd0aHJlYWQucGhwP3RpZD0x
-MTUzMzIyCmNoaW5hLmhrZXQuY29tCnx8aGtmYWEuY29tCmhrZnJlZXpvbmUuY29t
-CmhrZnJvbnQub3JnCm0uaGtnYWxkZW4uY29tCnxodHRwczovL20uaGtnYWxkZW4u
-Y29tCi5oa2dyZWVucmFkaW8ub3JnL2hvbWUKLmhraGVhZGxpbmUuY29tKmJsb2cK
-LmhraGVhZGxpbmUuY29tL2luc3RhbnRuZXdzCmhraGtoay5jb20KaGtocmMub3Jn
-LmhrCmhraHJtLm9yZy5oawp8fGhraXAub3JnLnVrCjE5ODlyZXBvcnQuaGtqYS5v
-cmcuaGsKaGtqYy5jb20KLmhranAub3JnCi5oa2xmdC5jb20KLmhrbHRzLm9yZy5o
-awp8fGhrbHRzLm9yZy5oawpuZXdzLmhrcGVhbnV0LmNvbQpoa3B0dS5vcmcKLmhr
-cmVwb3J0ZXIuY29tCnx8aGtyZXBvcnRlci5jb20KfGh0dHA6Ly9oa3Vwb3AuaGt1
-LmhrLwouaGt1c3UubmV0Cnx8aGt1c3UubmV0Ci5oa3Z3ZXQuY29tCi5oa3djYy5v
-cmcuaGsKfHxoa3pvbmUub3JnCi5obW9uZ2hvdC5jb20KfGh0dHA6Ly9obW9uZ2hv
-dC5jb20KLmhtdi5jby5qcC8KaG5qaGouY29tCnx8aG5qaGouY29tCi5obm50dWJl
-LmNvbQp8fGhvbGEuY29tCnx8aG9sYS5vcmcKaG9seW1vdW50YWluY24uY29tCmhv
-bHlzcGlyaXRzcGVha3Mub3JnCnx8aG9seXNwaXJpdHNwZWFrcy5vcmcKfHxkZXJl
-a2hzdS5ob21laXAubmV0Ci5ob21lcGVydmVyc2lvbi5jb20KfGh0dHA6Ly9ob21l
-c2VydmVyc2hvdy5jb20KfGh0dHA6Ly9vbGQuaG9uZXluZXQub3JnL3NjYW5zL3Nj
-YW4zMS9zdWIvZG91Z19lcmljL3NwYW1fdHJhbnNsYXRpb24uaHRtbAouaG9uZ2tv
-bmdmcC5jb20KfHxob25na29uZ2ZwLmNvbQpob25nbWVpbWVpLmNvbQp8fGhvbmd6
-aGkubGkKLmhvb3RzdWl0ZS5jb20KfHxob290c3VpdGUuY29tCi5ob3BlZGlhbG9n
-dWUub3JnCnxodHRwOi8vaG9wZWRpYWxvZ3VlLm9yZwouaG9wdG8ub3JnCi5ob3Ju
-eWdhbWVyLmNvbQouaG9ybnl0cmlwLmNvbQp8aHR0cDovL2hvcm55dHJpcC5jb20K
-LmhvdGF2LnR2Ci5ob3RlbHMuY24KaG90ZnJvZy5jb20udHcKaG90Z29vLmNvbQou
-aG90cG9ybnNob3cuY29tCmhvdHBvdC5oawouaG90c2hhbWUuY29tCnx8aG90c3Bv
-dHNoaWVsZC5jb20KLmhvdHZwbi5jb20KfHxob3R2cG4uY29tCnx8aG91Z2FpZ2Uu
-Y29tCnx8aG93dG9mb3JnZS5jb20KfHxob3h4LmNvbQouaHFjZHAub3JnCnx8aHFj
-ZHAub3JnCnx8aHFqYXBhbmVzZXNleC5jb20KaHFtb3ZpZXMuY29tCi5ocmNpci5j
-b20KLmhyY2NoaW5hLm9yZwouaHJlYS5vcmcKLmhyaWNoaW5hLm9yZwp8fGhyaWNo
-aW5hLm9yZwouaHJ0c2VhLmNvbQouaHJ3Lm9yZwp8fGhydy5vcmcKaHJ3ZWIub3Jn
-Cnx8aHNqcC5uZXQKfHxoc3NlbGl0ZS5jb20KfGh0dHA6Ly9oc3QubmV0LnR3Ci5o
-c3Rlcm4ubmV0Ci5oc3R0Lm5ldAouaHRrb3UubmV0Cnx8aHRrb3UubmV0Ci5odWEt
-eXVlLm5ldAouaHVhZ2xhZC5jb20KfHxodWFnbGFkLmNvbQouaHVhbmdodWFnYW5n
-Lm9yZwp8fGh1YW5naHVhZ2FuZy5vcmcKLmh1YW5neWl5dS5jb20KLmh1YXJlbi51
-cwp8fGh1YXJlbi51cwouaHVhcmVuNHVzLmNvbQouaHVhc2hhbmduZXdzLmNvbQp8
-aHR0cDovL2h1YXNoYW5nbmV3cy5jb20KYmJzLmh1YXNpbmcub3JnCmh1YXhpYS1u
-ZXdzLmNvbQpodWF4aWFiYW8ub3JnCmh1YXhpbi5waAp8fGh1YXl1d29ybGQub3Jn
-Ci5odWZmaW5ndG9ucG9zdC5jb20vcmViaXlhLWthZGVlcgp8fGh1Z29yb3kuZXUK
-fHxodWhhaXRhaS5jb20KfHxodWhhbWhpcmUuY29tCmh1aXlpLmluCi5odWxrc2hh
-cmUuY29tCmh1bWFucmlnaHRzYnJpZWZpbmcub3JnCnx8aHVuZy15YS5jb20KfHxo
-dW5nZXJzdHJpa2Vmb3JhaWRzLm9yZwp8fGh1cGluZy5uZXQKaHVyZ29rYmF5cmFr
-LmNvbQouaHVycml5ZXQuY29tLnRyCi5odXQyLnJ1Cnx8aHV0aWFueWkubmV0Cmh1
-dG9uZzkubmV0Cmh1eWFuZGV4LmNvbQouaHdhZHphbi50dwp8fGh3YXl1ZS5vcmcu
-dHcKfHxod2luZm8uY29tCnx8aHh3ay5vcmcKaHh3cS5vcmcKfHxoeXBlcnJhdGUu
-Y29tCmVib29rLmh5cmVhZC5jb20udHcKfHxlYm9vay5oeXJlYWQuY29tLnR3Cgoh
-LS0tLS0tLS0tLS0tLS0tLS0tLS1JSS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0K
-fHxpMS5oawp8fGkycDIuZGUKfHxpMnJ1bm5lci5jb20KfHxpODE4aGsuY29tCi5p
-LWNhYmxlLmNvbQouaS1wYXJ0LmNvbS50dwouaWFtdG9wb25lLmNvbQppYXNrLmNh
-Cnx8aWFzay5jYQppYXNrLmJ6Cnx8aWFzay5iegouaWF2MTkuY29tCmliaWJsaW8u
-b3JnL3B1Yi9wYWNrYWdlcy9jY2ljCi5pYmxpc3QuY29tCnx8aWJsb2dzZXJ2LWYu
-bmV0Cmlicm9zLm9yZwp8aHR0cDovL2NuLmlidGltZXMuY29tCi5pYnZwbi5jb20K
-fHxpYnZwbi5jb20KaWNhbXMuY29tCmJsb2dzLmljZXJvY2tldC5jb20vdGFnCi5p
-Y2lqLm9yZwp8fGljaWoub3JnCnx8aWNsLWZpLm9yZwouaWNvY28uY29tCnx8aWNv
-Y28uY29tCgohLS0zOC4xMDMuMTY1LjUwCnx8ZnVyYm8ub3JnCiEtLXx8aWNvbmZh
-Y3RvcnkuY29tCnx8d2FyYmxlci5pY29uZmFjdG9yeS5uZXQKCnx8aWNvbnBhcGVy
-Lm9yZwohLS0gR29vZ2xlIFBhZ2VzCnx8aWN1LXByb2plY3Qub3JnCncuaWRhaXdh
-bi5jb20vZm9ydW0KfHxpZGRkZGcuY29tCmlkZW1vY3JhY3kuYXNpYQouaWRlbnRp
-LmNhCnx8aWRlbnRpLmNhCnx8aWRpb21jb25uZWN0aW9uLmNvbQp8aHR0cDovL3d3
-dy5pZGxjb3lvdGUuY29tCi5pZG91Z2EuY29tCi5pZHJlYW14LmNvbQpmb3J1bS5p
-ZHNhbS5jb20KLmlkdi50dwouaWVhc3k1LmNvbQp8aHR0cDovL2llYXN5NS5jb20K
-LmllZDJrLm5ldAouaWVuZXJneTEuY29tCnxodHRwOi8vaWYudHR0LwppZmFucWlh
-bmcuY29tCi5pZmNzcy5vcmcKfHxpZmNzcy5vcmcKaWZqYy5vcmcKLmlmdC50dAp8
-aHR0cDovL2lmdC50dAp8fGlmcmVld2FyZXMuY29tCnx8aWdjZC5uZXQKLmlnZncu
-bmV0Cnx8aWdmdy5uZXQKLmlnZncudGVjaAp8fGlnZncudGVjaAouaWdtZy5kZQp8
-fGlnbml0ZWRldHJvaXQubmV0Ci5pZ290bWFpbC5jb20udHcKfHxpZ3ZpdGEuY29t
-Cnx8aWhha2thLm5ldAouaWhhby5vcmcvZHo1Cnx8aWljbnMuY29tCi5pa3N0YXIu
-Y29tCnx8aWxsdXNpb25mYWN0b3J5LmNvbQp8fGlsb3ZlODAuYmUKfHxpbS50dgpA
-QHx8bXl2bG9nLmltLnR2Cnx8aW04OC50dwouaW1nY2hpbGkubmV0CnxodHRwOi8v
-aW1nY2hpbGkubmV0Ci5pbWFnZWFiLmNvbQouaW1hZ2VmYXAuY29tCnx8aW1hZ2Vm
-YXAuY29tCnx8aW1hZ2VmbGVhLmNvbQppbWFnZXNoYWNrLnVzCnx8aW1hZ2V2ZW51
-ZS5jb20KfHxpbWFnZXppbGxhLm5ldAouaW1iLm9yZwp8aHR0cDovL2ltYi5vcmcK
-CiEtLUlNREIKfGh0dHA6Ly93d3cuaW1kYi5jb20vbmFtZS9ubTA0ODI3MzAKLmlt
-ZGIuY29tL3RpdGxlL3R0MDgxOTM1NAouaW1kYi5jb20vdGl0bGUvdHQxNTQwMDY4
-Ci5pbWRiLmNvbS90aXRsZS90dDQ5MDg2NDQKCi5pbWcubHkKfHxpbWcubHkKLmlt
-Z3VyLmNvbQp8fGltZ3VyLmNvbQouaW1rZXYuY29tCnx8aW1rZXYuY29tCi5pbWxp
-dmUuY29tCi5pbW1vcmFsLmpwCmltcGFjdC5vcmcuYXUKaW1wcC5tbgp8aHR0cDov
-L3RlY2gyLmluLmNvbS92aWRlby8KaW45OS5vcmcKaW4tZGlzZ3Vpc2UuY29tCi5p
-bmNhcGRucy5uZXQKLmluY2xvYWsuY29tCnx8aW5jbG9hay5jb20KfHxpbmNyZWRp
-Ym94LmZyCnx8aW5kaWFuZGVmZW5zZW5ld3MuaW4KdGltZXNvZmluZGlhLmluZGlh
-dGltZXMuY29tL2RhbGFpCnRpbWVzb2ZpbmRpYS5pbmRpYXRpbWVzLmNvbS9kZWZh
-dWx0aW50ZXJzdGl0aWFsLmNtcwouaW5kaWVtZXJjaC5jb20KfHxpbmRpZW1lcmNo
-LmNvbQppbmZvLWdyYWYuZnIKd2Vic2l0ZS5pbmZvcm1lci5jb20KLmluaXRpYXRp
-dmVzZm9yY2hpbmEub3JnCi5pbmt1aS5jb20KLmlubWVkaWFoay5uZXQKfHxpbm1l
-ZGlhaGsubmV0Cnx8aW5uZXJtb25nb2xpYS5vcmcKfGh0dHA6Ly9ibG9nLmlub3Jl
-YWRlci5jb20KLmlub3RlLnR3Ci5pbnNlY2FtLm9yZwp8aHR0cDovL2luc2VjYW0u
-b3JnCnx8aW5zaWRldm9hLmNvbQouaW5zdGl0dXQtdGliZXRhaW4ub3JnCnxodHRw
-Oi8vaW50ZXJuZXQub3JnLwppbnRlcm5ldGRlZmVuc2VsZWFndWUub3JnCmludGVy
-bmV0ZnJlZWRvbS5vcmcKIS0tfHxpbnRlcnBvbC5pbnQKfHxpbnRlcm5ldHBvcGN1
-bHR1cmUuY29tCi5pbnRoZW5hbWVvZmNvbmZ1Y2l1c21vdmllLmNvbQp8fGludGhl
-bmFtZW9mY29uZnVjaXVzbW92aWUuY29tCmlueGlhbi5jb20KfHxpbnhpYW4uY29t
-CmlwYWx0ZXIuY29tCiEtLXx8aXBjZi5vcmcudHcKLmlwZmlyZS5vcmcKfHxpcGhv
-bmU0aG9uZ2tvbmcuY29tCnx8aXBob25laGFja3MuY29tCnx8aXBob25ldGFpd2Fu
-Lm9yZwp8fGlwaG9uaXguZnIKfHxpcGljdHVyZS5ydQouaXBqZXRhYmxlLm5ldAp8
-fGlwamV0YWJsZS5uZXQKLmlwb2Jhci5jb20vcmVhZC5waHA/Cmlwb29jay5jb20v
-aW1nCi5pcG9ydGFsLm1lCnxodHRwOi8vaXBvcnRhbC5tZQp8fGlwcG90di5jb20K
-LmlwcmVkYXRvci5zZQp8fGlwcmVkYXRvci5zZQouaXB0di5jb20udHcKfHxpcHR2
-YmluLmNvbQp8fGlwdmFuaXNoLmNvbQppcmVkbWFpbC5vcmcKY2hpbmVzZS5pcmli
-LmlyCnx8aXJvbmJpZ2Zvb2xzLmNvbXB5dGhvbi5uZXQKfHxpcm9ucHl0aG9uLm5l
-dAouaXJvbnNvY2tldC5jb20KfHxpcm9uc29ja2V0LmNvbQouaXMuZ2QKLmlzbGFo
-aGFiZXIubmV0Ci5pc2xhbS5vcmcuaGsKfGh0dHA6Ly9pc2xhbS5vcmcuaGsKLmlz
-bGFtYXdhcmVuZXNzLm5ldC9Bc2lhL0NoaW5hCi5pc2xhbWhvdXNlLmNvbQp8fGlz
-bGFtaG91c2UuY29tCi5pc2xhbWljaXR5LmNvbQouaXNsYW1pY3BsdXJhbGlzbS5v
-cmcKLmlzbGFtdG9kYXkubmV0Ci5pc2FhY21hby5jb20KfHxpc2FhY21hby5jb20K
-fHxpc2dyZWF0Lm9yZwp8fGlzbWFlbGFuLmNvbQouaXNtYWxsdGl0cy5jb20KfHxp
-c21wcm9mZXNzaW9uYWwubmV0Cmlzb2h1bnQuY29tCnx8aXNyYWJveC5jb20KLmlz
-c3V1LmNvbQp8fGlzc3V1LmNvbQouaXN0YXJzLmNvLm56Cm92ZXJzZWEuaXN0YXJz
-aGluZS5jb20KfHxvdmVyc2VhLmlzdGFyc2hpbmUuY29tCmJsb2cuaXN0ZWYuaW5m
-by8yMDA3LzEwLzIxL215ZW50dW5uZWwKLmlzdGlxbGFsaGV3ZXIuY29tCi5pc3Rv
-Y2twaG90by5jb20KaXN1bmFmZmFpcnMuY29tCmlzdW50di5jb20KaXRhYm9vLmlu
-Zm8KfHxpdGFib28uaW5mbwouaXRhbGlhdGliZXQub3JnCmRvd25sb2FkLml0aG9t
-ZS5jb20udHcKaXRoZWxwLml0aG9tZS5jb20udHcKfHxpdHNoaWRkZW4uY29tCi5p
-dHNreS5pdAouaXR3ZWV0Lm5ldAp8aHR0cDovL2l0d2VldC5uZXQKLml1NDUuY29t
-Ci5pdWhyZGYub3JnCnx8aXVocmRmLm9yZwouaXVrc2t5LmNvbQouaXZhY3kuY29t
-Cnx8aXZhY3kuY29tCi5pdmVyeWNkLmNvbQouaXZwbi5uZXQKIS0tfHxpdnBuLm5l
-dAp8fGl4cXVpY2suY29tCi5peHh4LmNvbQppeW91cG9ydC5jb20KfHxpeW91cG9y
-dC5jb20KLml6YW9iYW8udXMKfHxnbW96b21nLml6aWhvc3Qub3JnCi5pemxlcy5u
-ZXQKLml6bGVzZW0ub3JnCgohLS0tLS0tLS0tLS0tLS0tLS0tLS1KSi0tLS0tLS0t
-LS0tLS0tLS0tLS0tLS0tLS0KfHxqLm1wCmJsb2cuamFja2ppYS5jb20KamFtYWF0
-Lm9yZwouamFteWFuZ25vcmJ1LmNvbQp8aHR0cDovL2phbXlhbmdub3JidS5jb20K
-LmphbmR5eC5jb20KfHxqYW53b25ncGhvdG8uY29tCnx8amFwYW4td2hvcmVzLmNv
-bQouamF2LmNvbQouamF2MTAxLmNvbQouamF2MmJlLmNvbQp8fGphdjJiZS5jb20K
-LmphdjY4LnR2Ci5qYXZha2liYS5vcmcKfGh0dHA6Ly9qYXZha2liYS5vcmcKLmph
-dmJ1cy5jb20KfHxqYXZidXMuY29tCnx8amF2Zm9yLm1lCi5qYXZoZC5jb20KLmph
-dmhpcC5jb20KLmphdm1vYmlsZS5uZXQKfGh0dHA6Ly9qYXZtb2JpbGUubmV0Ci5q
-YXZtb28uY29tCi5qYXZzZWVuLmNvbQp8aHR0cDovL2phdnNlZW4uY29tCmpidGFs
-a3MuY2MKamJ0YWxrcy5jb20KamJ0YWxrcy5teQouamR3c3kuY29tCmplYW55aW0u
-Y29tCnx8amZxdTM2LmNsdWIKfHxqZnF1MzcueHl6Cnx8amdvb2RpZXMuY29tCi5q
-aWFuZ3dlaXBpbmcuY29tCnx8amlhbmd3ZWlwaW5nLmNvbQp8fGppYW95b3U4LmNv
-bQouamllaHVhLmN6Cnx8aGsuamllcGFuZy5jb20KfHx0dy5qaWVwYW5nLmNvbQpq
-aWVzaGliYW9iYW8uY29tCi5qaWdnbGVnaWZzLmNvbQo1NmN1bjA0LmppZ3N5LmNv
-bQpqaWdvbmcxMDI0LmNvbQpkYW9kdTE0LmppZ3N5LmNvbQpzcGVjeGluemwuamln
-c3kuY29tCndsY25ldy5qaWdzeS5jb20KLmppaGFkb2xvZ3kubmV0CnxodHRwOi8v
-amloYWRvbG9neS5uZXQKamluYnVzaGUub3JnCnx8amluYnVzaGUub3JnCi5qaW5n
-c2ltLm9yZwp6aGFvLmppbmhhaS5kZQpqaW5ncGluLm9yZwp8fGppbmdwaW4ub3Jn
-CmppbnBpYW53YW5nLmNvbQouamlucm91a29uZy5jb20KYWMuamlydWFuLm5ldAp8
-fGppdG91Y2guY29tCi5qaXp6dGhpcy5jb20KampnaXJscy5jb20KLmprYi5jYwp8
-aHR0cDovL2prYi5jYwpqa2ZvcnVtLm5ldAp8fGptYS5nby5qcApyZXNlYXJjaC5q
-bXNjLmhrdS5oay9zb2NpYWwKd2VpYm9zY29wZS5qbXNjLmhrdS5oawouam1zY3Vs
-dC5jb20KfGh0dHA6Ly9qbXNjdWx0LmNvbQp8fGpvYWNoaW1zLm9yZwp8fGpvYnNv
-LnR2Ci5zdW53aW5pc20uam9pbmJicy5uZXQKLmpvdXJuYWxjaHJldGllbi5uZXQK
-fHxqb3VybmFsb2ZkZW1vY3JhY3kub3JnCi5qb3ltaWlodWIuY29tCi5qb3lvdXJz
-ZWxmLmNvbQpqcG9wZm9ydW0ubmV0Cnx8ZmlkZGxlLmpzaGVsbC5uZXQKLmp1YnVz
-aG91c2hlbi5jb20KfHxqdWJ1c2hvdXNoZW4uY29tCiEtLURvYW1pbiBwYXJraW5n
-Ci5qdWh1YXJlbi5jb20KfHxqdWxpZXJleWMuY29tCnx8anVuYXV6YS5jb20KLmp1
-bmU0Y29tbWVtb3JhdGlvbi5vcmcKLmp1bmVmb3VydGgtMjAubmV0Cnx8anVuZWZv
-dXJ0aC0yMC5uZXQKfHxiYnMuanVuZ2xvYmFsLm5ldAouanVvYWEuY29tCnxodHRw
-Oi8vanVvYWEuY29tCmp1c3RmcmVldnBuLmNvbQouanVzdGljZWZvcnRlbnppbi5v
-cmcKanVzdHBhc3RlLml0Cmp1c3R0cmlzdGFuLmNvbQpqdXl1YW5nZS5vcmcKanV6
-aXl1ZS5jb20KfHxqdXppeXVlLmNvbQp8fGp3bXVzaWMub3JnCkBAfHxtdXNpYy5q
-d211c2ljLm9yZwouanl4Zi5uZXQKCiEtLS0tLS0tLS0tLS0tLS0tLS0tLUtLLS0t
-LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQp8fGstZG91amluLm5ldAp8fGthLXdhaS5j
-b20KLmthZ3l1Lm9yZwp8fGthZ3l1Lm9yZy56YQoua2FneXVtb25sYW0ub3JnCi5r
-YWd5dW5ld3MuY29tLmhrCi5rYWd5dW9mZmljZS5vcmcKfHxrYWd5dW9mZmljZS5v
-cmcKfHxrYWd5dW9mZmljZS5vcmcudHcKLmthaXl1YW4uZGUKLmtha2FvLmNvbQp8
-fGtha2FvLmNvbQoua2FsYWNoYWtyYWx1Z2Fuby5vcmcKLmthbmthbi50b2RheQou
-a2FubmV3eW9yay5jb20KfHxrYW5uZXd5b3JrLmNvbQoua2Fuc2hpZmFuZy5jb20K
-fHxrYW5zaGlmYW5nLmNvbQp8fGthbnRpZS5vcmcKa2FuemhvbmdndW8uY29tCmth
-bnpob25nZ3VvLmV1Ci5rYW90aWMuY29tCnx8a2FyYXlvdS5jb20Ka2Fya2h1bmcu
-Y29tCi5rYXJtYXBhLm9yZwoua2FybWFwYS10ZWFjaGluZ3Mub3JnCnx8a2F3YXNl
-LmNvbQoua2JhLXR4Lm9yZwoua2Nvb2xvbmxpbmUuY29tCi5rZWJydW0uY29tCnx8
-a2VicnVtLmNvbQoua2VjaGFyYS5jb20KLmtlZXBhbmRzaGFyZS5jb20vdmlzaXQv
-dmlzaXRfcGFnZS5waHA/aT02ODgxNTQKIS0tfHxrZWVwdmlkLmNvbQoua2Vlem1v
-dmllcy5jb20KLmtlbmRpbmNvcy5uZXQKLmtlbmVuZ2JhLmNvbQp8fGtlbmVuZ2Jh
-LmNvbQp8fGtlb250ZWNoLm5ldAoua2VwYXJkLmNvbQp8fGtlcGFyZC5jb20Kd2lr
-aS5rZXNvLmNuL0hvbWUKfHxrZXljZG4uY29tCi5raGFiZGhhLm9yZwoua2htdXNp
-Yy5jb20udHcKfHxraWNoaWt1LWRvdWppbmtvLmNvbQoua2lrLmNvbQp8fGtpay5j
-b20KYmJzLmtpbXkuY29tLnR3Ci5raW5kbGVyZW4uY29tCnxodHRwOi8va2luZGxl
-cmVuLmNvbQp8aHR0cDovL3d3dy5raW5kbGVyZW4uY29tCi5raW5nZG9tc2FsdmF0
-aW9uLm9yZwp8fGtpbmdkb21zYWx2YXRpb24ub3JnCmtpbmdob3N0LmNvbQohLS0u
-a2luZ3N0b25lLmNvbS50dy9ib29rLwp8fGtpbmdzdG9uZS5jb20udHcKLmtpbmsu
-Y29tCi5raW5va3VuaXlhLmNvbQp8fGtpbm9rdW5peWEuY29tCmtpbGx3YWxsLmNv
-bQp8fGtpbGx3YWxsLmNvbQp8fGtpbm1lbi50cmF2ZWwKLmtpci5qcAoua2lzc2Ji
-YW8uY24KfGh0dHA6Ly9raXdpLmt6Cnx8a2std2h5cy5jby5qcAohLS18fGttdC5v
-cmcudHcKLmttdWgub3JnLnR3Ci5rbm93bGVkZ2VydXNoLmNvbS9rci9lbmN5Y2xv
-cGVkaWEKLmtvYm8uY29tCnx8a29iby5jb20KLmtvYm9ib29rcy5jb20KfHxrb2Jv
-Ym9va3MuY29tCnx8a29kaW5nZW4uY29tCkBAfHx3d3cua29kaW5nZW4uY29tCnx8
-a29tcG96ZXIubmV0Ci5rb25hY2hhbi5jb20KfGh0dHA6Ly9rb25hY2hhbi5jb20K
-LmtvbmUuY29tCnx8a29vbHNvbHV0aW9ucy5jb20KLmtvb3Juay5jb20KfHxrb29y
-bmsuY29tCnx8a29yYW5tYW5kYXJpbi5jb20KLmtvcmVuYW4yLmNvbQp8aHR0cDov
-L2dvamV0LmtydGNvLmNvbS50dwoua3NkbC5vcmcKLmtzbmV3cy5jb20udHcKfHxr
-dHpoay5jb20KLmt1aS5uYW1lL2V2ZW50Cmt1bi5pbQoua3VyYXNoc3VsdGFuLmNv
-bQp8fGt1cnRtdW5nZXIuY29tCmt1c29jaXR5LmNvbQp8fGt3Y2cuY2EKa3dvbmd3
-YWguY29tLm15Ci5reHN3LmxpZmUKfHxreHN3LmxpZmUKLmt5b2Z1bi5jb20Ka3lv
-aGsubmV0Cnx8a3lveXVlLmNvbQoua3l6eWhlbGxvLmNvbQp8fGt5enloZWxsby5j
-b20KLmt6ZW5nLmluZm8KfHxremVuZy5pbmZvCgohLS0tLS0tLS0tLS0tLS0tLS0t
-LS1MTC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KbGEtZm9ydW0ub3JnCmxhZGJy
-b2tlcy5jb20KfHxsYWJpZW5uYWxlLm9yZwoubGFncmFuZXBvY2EuY29tCnx8bGFn
-cmFuZXBvY2EuY29tCi5sYWx1bGFsdS5jb20KLmxhbWEuY29tLnR3Cnx8bGFtYS5j
-b20udHcKLmxhbWF5ZXNoZS5jb20KfGh0dHA6Ly9sYW1heWVzaGUuY29tCnxodHRw
-Oi8vd3d3LmxhbWVuaHUuY29tCi5sYW1uaWEuY28udWsKfHxsYW1uaWEuY28udWsK
-bGFtcmltLmNvbQoubGFudGVybmNuLmNuCnxodHRwOi8vbGFudGVybmNuLmNuCi5s
-YW50b3Nmb3VuZGF0aW9uLm9yZwoubGFvZC5jbgp8aHR0cDovL2xhb2QuY24KbGFv
-Z2FpLm9yZwp8fGxhb2dhaS5vcmcKbGFvbWl1LmNvbQoubGFveWFuZy5pbmZvCnxo
-dHRwOi8vbGFveWFuZy5pbmZvCnx8bGFwdG9wbG9ja2Rvd24uY29tCi5sYXFpbmdk
-YW4ubmV0Cnx8bGFxaW5nZGFuLm5ldAp8fGxhcnNnZW9yZ2UuY29tCi5sYXN0Y29t
-YmF0LmNvbQp8aHR0cDovL2xhc3Rjb21iYXQuY29tCnx8bGFzdGZtLmVzCmxhdGVs
-aW5lbmV3cy5jb20KLmxhdGliZXQub3JnCnx8bGUtdnBuLmNvbQoubGVhZnl2cG4u
-bmV0Cnx8bGVhZnl2cG4ubmV0CmxlZWFvLmNvbS5jbi9iYnMvZm9ydW0ucGhwCiEt
-LXx8bGVlY2hldWt5YW4ub3JnCmxlZm9yYS5jb20KfHxsZWZ0MjEuaGsKLmxlZ2Fs
-cG9ybm8uY29tCi5sZWdzamFwYW4uY29tCnxodHRwOi8vbGVpcmVudHYuY2EKbGVp
-c3VyZWNhZmUuY2EKfHxsZW1hdGluLmNoCi5sZW1vbmRlLmZyCnx8bGVud2hpdGUu
-Y29tCmxlcm9zdWEub3JnCnx8bGVyb3N1YS5vcmcKYmxvZy5sZXN0ZXI4NTAuaW5m
-bwp8fGxlc29pci5iZQoubGV0b3UuY29tCmxldHNjb3JwLm5ldAp8fGxldHNjb3Jw
-Lm5ldAp8fHNzLmxldnloc3UuY29tCiE2OS4xNi4xNzUuNDIKfHxjZG4uYXNzZXRz
-LmxmcGNvbnRlbnQuY29tCi5saGFrYXIub3JnCnxodHRwOi8vbGhha2FyLm9yZwou
-bGhhc29jaWFsd29yay5vcmcKLmxpYW5neW91Lm5ldAp8fGxpYW5neW91Lm5ldAou
-bGlhbnl1ZS5uZXQKfHxsaWFvd2FuZ3hpemFuZy5uZXQKLmxpYW93YW5neGl6YW5n
-Lm5ldAp8fGxpYmVyYWwub3JnLmhrCi5saWJlcnR5dGltZXMuY29tLnR3CmJsb2dz
-LmxpYnJhcnlpbmZvcm1hdGlvbnRlY2hub2xvZ3kuY29tL2p4eXoKLmxpZGVjaGVu
-Zy5jb20vYmxvZy9mdWNraW5nLWdmdwoubGlnaHRlbi5vcmcudHcKLmxpZ2h0bm92
-ZWwuY24KQEB8aHR0cHM6Ly93d3cubGlnaHRub3ZlbC5jbgpsaW1pYW8ubmV0Cmxp
-bmt1c3dlbGwuY29tCmFiaXRuby5saW5waWUuY29tL3VzZS1pcHY2LXRvLWZ1Y2st
-Z2Z3Cnx8bGluZS5tZQp8fGxpbmUtYXBwcy5jb20KLmxpbmdsaW5nZmEuY29tCnx8
-bGluZ3ZvZGljcy5jb20KLmxpbmstby1yYW1hLmNvbQp8aHR0cDovL2xpbmstby1y
-YW1hLmNvbQoubGlua2lkZW8uY29tCnx8YXBpLmxpbmtzYWxwaGEuY29tCnx8YXBp
-ZG9jcy5saW5rc2FscGhhLmNvbQp8fHd3dy5saW5rc2FscGhhLmNvbQp8fGhlbHAu
-bGlua3NhbHBoYS5jb20KfHxsaW51eC5vcmcuaGsKbGludXh0b3kub3JnL2FyY2hp
-dmVzL2luc3RhbGxpbmctd2VzdC1jaGFtYmVyLW9uLXVidW50dQoubGlvbnNyb2Fy
-LmNvbQoubGlwdW1hbi5jb20KfHxsaXF1aWR2cG4uY29tCnx8Z3JlYXRmaXJlLnVz
-Ny5saXN0LW1hbmFnZS5jb20KfHxsaXN0ZW50b3lvdXR1YmUuY29tCmxpc3Rvcmlv
-dXMuY29tCi5saXUteGlhb2JvLm9yZwp8fGxpdWRlanVuLmNvbQoubGl1aGFueXUu
-Y29tCi5saXVqaWFuc2h1LmNvbQp8fGxpdWppYW5zaHUuY29tCi5saXV4aWFvYm8u
-bmV0CnxodHRwOi8vbGl1eGlhb2JvLm5ldApsaXV4aWFvdG9uZy5jb20KfHxsaXV4
-aWFvdG9uZy5jb20KLmxpdmVkb29yLmpwCi5saXZlbGVhay5jb20KfHxsaXZlbGVh
-ay5jb20KLmxpdmVzdGF0aW9uLmNvbQpsaXZlc3RyZWFtLmNvbQp8fGxpdmVzdHJl
-YW0uY29tCnx8bGl2aW5nb25saW5lLnVzCnx8bGl2aW5nc3RyZWFtLmNvbQp8fGxp
-dmV2aWRlby5jb20KLmxpdmV2aWRlby5jb20KLmxpd2FuZ3lhbmcuY29tCmxpemhp
-emh1YW5nYmkuY29tCmxrY24ubmV0Ci5sbHNzLm1lLwoubG9hZC50bwoubG9ic2Fu
-Z3dhbmd5YWwuY29tCi5sb2NhbGRvbWFpbi53cwp8fGxvY2FsZG9tYWluLndzCmxv
-Y2FscHJlc3Noay5jb20KfHxsb2NrZXN0ZWsuY29tCmxvZ2JvdC5uZXQKfHxsb2dp
-cXguY29tCnNlY3VyZS5sb2dtZWluLmNvbQp8fHNlY3VyZS5sb2dtZWluLmNvbQou
-bG9uZG9uY2hpbmVzZS5jYQoubG9uZ2hhaXIuaGsKbG9uZ211c2ljLmNvbQp8fGxv
-bmd0ZXJtbHkubmV0Cnx8bG9va3BpYy5jb20KLmxvb2t0b3JvbnRvLmNvbQp8aHR0
-cDovL2xvb2t0b3JvbnRvLmNvbQoubG90c2F3YWhvdXNlLm9yZy90aWJldGFuLW1h
-c3RlcnMvZm91cnRlZW50aC1kYWxhaS1sYW1hCi5sb3R1c2xpZ2h0Lm9yZy5oawou
-bG90dXNsaWdodC5vcmcudHcKaGtyZXBvcnRlci5sb3ZlZC5oawohLS00MDM/Cnx8
-bHBzZy5jb20KfHxscmZ6LmNvbQoubHJpcC5vcmcKfHxscmlwLm9yZwoubHNkLm9y
-Zy5oawp8fGxzZC5vcmcuaGsKbHNmb3J1bS5uZXQKLmxzbS5vcmcKfHxsc20ub3Jn
-Ci5sc21jaGluZXNlLm9yZwp8fGxzbWNoaW5lc2Uub3JnCi5sc21rb3JlYW4ub3Jn
-Cnx8bHNta29yZWFuLm9yZwoubHNtcmFkaW8uY29tL3JhZF9hcmNoaXZlcwoubHNt
-d2ViY2FzdC5jb20KLmx0bi5jb20udHcKfGh0dHA6Ly9sdG4uY29tLnR3Ci5sdWtl
-NTQuY29tCi5sdWtlNTQub3JnCi5sdXBtLm9yZwp8fGx1cG0ub3JnCnx8bHVzaHN0
-b3JpZXMuY29tCmx1eGViYy5jb20KbHZoYWkub3JnCnx8bHZoYWkub3JnCnx8bHZ2
-Mi5jb20KLmx5ZmhrLm5ldAp8aHR0cDovL2x5ZmhrLm5ldAoubHptdG5ld3Mub3Jn
-Cnx8bHptdG5ld3Mub3JnCgohLS0tLS0tLS0tLS0tLS0tLS0tLS1NTS0tLS0tLS0t
-LS0tLS0tLS0tLS0tLS0tLS0KaHR0cDovLyoubS10ZWFtLmNjCiEtLW0tdGVhbS5j
-Yy9mb3J1bQoubWFjcm92cG4uY29tCm1hY3RzLmNvbS50dwp8fG1hZC1hci5jaAp8
-fG1hZHJhdS5jb20KfHxtYWR0aHVtYnMuY29tCnx8bWFnaWMtbmV0LmluZm8KbWFo
-YWJvZGhpLm9yZwpteS5tYWlsLnJ1Ci5tYWlwbHVzLmNvbQp8aHR0cDovL21haXBs
-dXMuY29tCi5tYWl6aG9uZy5vcmcKbWFra2FobmV3c3BhcGVyLmNvbQoubWFtaW5n
-emhlLmNvbQptYW5pY3VyNGlrLnJ1Ci5tYXBsZXcuY29tCnxodHRwOi8vbWFwbGV3
-LmNvbQp8fG1hcmMuaW5mbwptYXJndWVyaXRlLnN1Cnx8bWFydGluY2FydG9vbnMu
-Y29tCm1hc2tlZGlwLmNvbQoubWFpaW8ubmV0Ci5tYWlsLWFyY2hpdmUuY29tCi5t
-YWxheXNpYWtpbmkuY29tCnx8bWFrZW15bW9vZC5jb20KLm1hbmNodWt1by5uZXQK
-Lm1hbmlhc2guY29tCnxodHRwOi8vbWFuaWFzaC5jb20KLm1hbnNpb24uY29tCi5t
-YW5zaW9ucG9rZXIuY29tCiEtLXx8bWFyaW5lcy5taWwKIS0tbWFya21haWwub3Jn
-Km1lc3NhZ2UKfHxtYXJ0YXUuY29tCnxodHRwOi8vYmxvZy5tYXJ0aW5vZWkuY29t
-Ci5tYXJ0c2FuZ2thZ3l1b2ZmaWNpYWwub3JnCnxodHRwOi8vbWFydHNhbmdrYWd5
-dW9mZmljaWFsLm9yZwptYXJ1dGEuYmUvZm9yZ2V0Ci5tYXJ4aXN0LmNvbQp8fG1h
-cnhpc3QubmV0Ci5tYXJ4aXN0cy5vcmcvY2hpbmVzZQohLS18fG1hc2hhYmxlLmNv
-bQp8fG1hdGFpbmphLmNvbQp8fG1hdGhhYmxlLmlvCnx8bWF0aGlldy1iYWRpbW9u
-LmNvbQp8fG1hdHN1c2hpbWFrYWVkZS5jb20KfGh0dHA6Ly9tYXR1cmVqcC5jb20K
-bWF5aW1heWkuY29tCi5tYXhpbmcuanAKLm1jYWYuZWUKfGh0dHA6Ly9tY2FmLmVl
-Cnx8bWNhZGZvcnVtcy5jb20KbWNmb2cuY29tCm1jcmVhc2l0ZS5jb20KLm1kLXQu
-b3JnCnx8bWQtdC5vcmcKfHxtZWFuc3lzLmNvbQoubWVkaWEub3JnLmhrCi5tZWRp
-YWNoaW5lc2UuY29tCnx8bWVkaWFjaGluZXNlLmNvbQoubWVkaWFmaXJlLmNvbS8/
-Ci5tZWRpYWZpcmUuY29tL2Rvd25sb2FkCi5tZWRpYWZyZWFrY2l0eS5jb20KfHxt
-ZWRpYWZyZWFrY2l0eS5jb20KLm1lZGl1bS5jb20KfHxtZWRpdW0uY29tCi5tZWV0
-YXYuY29tCnx8bWVldHVwLmNvbQptZWZlZWRpYS5jb20KamloYWRpbnRlbC5tZWZv
-cnVtLm9yZwp8fG1lZ2EubnoKfHxtZWdhcHJveHkuY29tCnx8bWVnYXJvdGljLmNv
-bQptZWdhdmlkZW8uY29tCnx8bWVndXJpbmVsdWthLmNvbQptZWlyaXhpYW9jaGFv
-LmNvbQoubWVsdG9kYXkuY29tCi5tZW1laGsuY29tCnx8bWVtZWhrLmNvbQptZW1v
-cnliYnMuY29tCi5tZW1yaS5vcmcKLm1lbXJpanR0bS5vcmcKLm1lcmN5cHJvcGhl
-dC5vcmcKfGh0dHA6Ly9tZXJjeXByb3BoZXQub3JnCnx8bWVyZ2Vyc2FuZGlucXVp
-c2l0aW9ucy5vcmcKLm1lcmlkaWFuLXRydXN0Lm9yZwp8aHR0cDovL21lcmlkaWFu
-LXRydXN0Lm9yZwoubWVyaXBldC5iaXoKfGh0dHA6Ly9tZXJpcGV0LmJpegoubWVy
-aXBldC5jb20KfGh0dHA6Ly9tZXJpcGV0LmNvbQptZXJpdC10aW1lcy5jb20udHcK
-bWVzaHJlcC5jb20KLm1lc290dy5jb20vYmJzCm1ldGFjYWZlLmNvbS93YXRjaAp8
-fG1ldGVvcnNob3dlcnNvbmxpbmUuY29tCnxodHRwOi8vd3d3Lm1ldHJvLnRhaXBl
-aS8KLm1ldHJvaGsuY29tLmhrLz9jbWQ9ZGV0YWlsJmNhdGVnb3J5SUQ9Mgp8fG1l
-dHJvbGlmZS5jYQoubWV0cm9yYWRpby5jb20uaGsKfGh0dHA6Ly9tZXRyb3JhZGlv
-LmNvbS5oawptZXlvdS5qcAoubWV5dWwuY29tCnx8bWdvb24uY29tCnx8bWdzdGFn
-ZS5jb20KfHxtaDR1Lm9yZwptaHJhZGlvLm9yZwp8aHR0cDovL21pY2hhZWxhbnRp
-LmNvbQp8fG1pY2hhZWxtYXJrZXRsLmNvbQp8aHR0cDovL2Jicy5taWtvY29uLmNv
-bQoubWljcm92cG4uY29tCnxodHRwOi8vbWljcm92cG4uY29tCm1pZGRsZS13YXku
-bmV0Ci5taWhrLmhrL2ZvcnVtCi5taWhyLmNvbQptaWh1YS5vcmcKIS0tSVAKfHxt
-aWtlc29sdHlzLmNvbQoubWlscGgubmV0CnxodHRwOi8vbWlscGgubmV0Ci5taWxz
-dXJwcy5jb20KbWltaWFpLm5ldAoubWltaXZpcC5jb20KLm1pbWl2di5jb20KLm1p
-bmRyb2xsaW5nLm9yZwp8aHR0cDovL21pbmRyb2xsaW5nLm9yZwoubWluZ2h1aS5v
-ci5rcgp8aHR0cDovL21pbmdodWkub3Iua3IKbWluZ2h1aS5vcmcKfHxtaW5naHVp
-Lm9yZwptaW5naHVpLWEub3JnCm1pbmdodWktYi5vcmcKbWluZ2h1aS1zY2hvb2wu
-b3JnCi5taW5namluZ2xpc2hpLmNvbQp8fG1pbmdqaW5nbGlzaGkuY29tCm1pbmdq
-aW5nbmV3cy5jb20KfHxtaW5namluZ3RpbWVzLmNvbQoubWluZ3Bhby5jb20KfHxt
-aW5ncGFvLmNvbQoubWluZ3Bhb2NhbmFkYS5jb20KLm1pbmdwYW9tb250aGx5LmNv
-bQp8aHR0cDovL21pbmdwYW9tb250aGx5LmNvbQptaW5ncGFvbmV3cy5jb20KLm1p
-bmdwYW9ueS5jb20KLm1pbmdwYW9zZi5jb20KLm1pbmdwYW90b3IuY29tCi5taW5n
-cGFvdmFuLmNvbQoubWluZ3NoZW5nYmFvLmNvbQoubWluaGh1ZS5uZXQKLm1pbmlm
-b3J1bS5vcmcKLm1pbmlzdHJ5Ym9va3Mub3JnCi5taW56aHVodWEubmV0Cnx8bWlu
-emh1aHVhLm5ldAptaW56aHV6aGFueGlhbi5jb20KbWluemh1emhvbmdndW8ub3Jn
-Cnx8bWlyb2d1aWRlLmNvbQptaXJyb3Jib29rcy5jb20KLm1pc3QudmlwCnRoZWNl
-bnRlci5taXQuZWR1Ci5taXRhby5jb20udHcKLm1pdGJicy5jb20KfHxtaXRiYnMu
-Y29tCm1pdGJic2F1LmNvbQoubWl4ZXJvLmNvbQp8fG1peGVyby5jb20KbWl4cG9k
-LmNvbQoubWl4eC5jb20KfHxtaXh4LmNvbQp8fG1penptb25hLmNvbQoubWs1MDAw
-LmNvbQoubWxjb29sLmNvbQp8fG1senMud29yawoubW0tY2cuY29tCnx8bW1hYXh4
-LmNvbQoubW1tY2EuY29tCm1uZXdzdHYuY29tCnx8bW9iYXRlay5uZXQKLm1vYmls
-ZTAxLmNvbQp8fG1vYmlsZTAxLmNvbQp8fG1vYmlsZXdheXMuZGUKLm1vYnlwaWN0
-dXJlLmNvbQp8aHR0cDovL21vYnkudG8KfHxtb2Vlcm9saWJyYXJ5LmNvbQp3aWtp
-Lm1vZWdpcmwub3JnCi5tb2ZheGllaHVpLmNvbQoubW9mb3MuY29tCnx8bW9nLmNv
-bQptb2xpaHVhLm9yZwp8fG1vbmRleC5vcmcKLm1vbmV5LWxpbmsuY29tLnR3Cnxo
-dHRwOi8vbW9uZXktbGluay5jb20udHcKfGh0dHA6Ly93d3cubW9ubGFtaXQub3Jn
-Ci5tb29uYmJzLmNvbQp8fG1vb25iYnMuY29tCmMxNTIyLm1vb28uY29tCnx8bW9u
-aXRvcmNoaW5hLm9yZwpiYnMubW9yYmVsbC5jb20KfHxtb3JuaW5nc3VuLm9yZwp8
-fG1vcm9uZXRhLmNvbQoubW90aGVybGVzcy5jb20KfGh0dHA6Ly9tb3RoZXJsZXNz
-LmNvbQptb3RvcjRpay5ydQoubW91c2VicmVha2VyLmNvbQohLS18fG1vdmFibGV0
-eXBlLmNvbQoubW92ZW1lbnRzLm9yZwp8fG1vdmVtZW50cy5vcmcKfHxtb3ZpZWZh
-cC5jb20KfHx3d3cubW96dHcub3JnCi5tcDNidXNjYWRvci5jb20KbXAzeWUuZXUK
-fHxtcGV0dGlzLmNvbQptcGZpbmFuY2UuY29tCm1waW5ld3MuY29tCm1wb25saW5l
-LmhrCi5tcXhkLm9yZwp8aHR0cDovL21xeGQub3JnCm1ydHdlZXQuY29tCnx8bXJ0
-d2VldC5jb20KbmV3cy5oay5tc24uY29tCm5ld3MubXNuLmNvbS50dwptc2d1YW5j
-aGEuY29tCi5tc3dlMS5vcmcKfGh0dHA6Ly9tc3dlMS5vcmcKfHxtdGhydWYuY29t
-Cm11Y2hvc3Vja28uY29tCnx8bXVsdGlwbHkuY29tCm11bHRpcHJveHkub3JnCm11
-bHRpdXBsb2FkLmNvbQoubXVsbHZhZC5uZXQKfHxtdWxsdmFkLm5ldAoubXVtbXlz
-Z29sZC5jb20KLm11cm11ci50dwp8aHR0cDovL211cm11ci50dwoubXVzaWNhZGUu
-bmV0Ci5tdXNsaW12aWRlby5jb20KfHxtdXppLmNvbQp8fG11emkubmV0Cnx8bXg5
-ODEuY29tCi5teS1mb3Jtb3NhLmNvbQoubXktcHJveHkuY29tCi5teS1wcml2YXRl
-LW5ldHdvcmsuY28udWsKfHxteS1wcml2YXRlLW5ldHdvcmsuY28udWsKZm9ydW0u
-bXk5MDMuY29tCi5teWFjdGltZXMuY29tL2FjdGltZXMKfHxteWFubml1LmNvbQou
-bXlhdWRpb2Nhc3QuY29tCnx8bXlhdWRpb2Nhc3QuY29tCi5teWF2LmNvbS50dy9i
-YnMKLm15YmJzLnVzCi5teWNhMTY4LmNvbQoubXljYW5hZGFub3cuY29tCnx8YmJz
-Lm15Y2hhdC50bwp8fG15Y2hpbmFteWhvbWUuY29tCi5teWNoaW5hbXlob21lLmNv
-bQoubXljaGluYW5ldC5jb20KLm15Y2hpbmFuZXdzLmNvbQp8fG15Y2hpbmFuZXdz
-LmNvbQoubXljaGluZXNlLm5ld3MKfHxteWNubmV3cy5jb20KfHxteWtvbWljYS5v
-cmcKbXljb3VsZC5jb20vZGlzY3V6Ci5teWVhc3l0di5jb20KfHxteWVjbGlwc2Vp
-ZGUuY29tCi5teWZvcnVtLmNvbS5oawp8fG15Zm9ydW0uY29tLmhrCnx8bXlmb3J1
-bS5jb20udWsKLm15ZnJlZWNhbXMuY29tCi5teWZyZWVwYXlzaXRlLmNvbQoubXlm
-cmVzaG5ldC5jb20KLm15aXBoaWRlLmNvbQp8fG15aXBoaWRlLmNvbQpmb3J1bS5t
-eW1hamkuY29tCm15bWVkaWFyb20uY29tL2ZpbGVzL2JveAp8fG15bW9lLm1vZQp8
-fG15bXVzaWMubmV0LnR3Cnx8bXlwYXJhZ2xpZGluZy5jb20KfHxteXBvcGVzY3Uu
-Y29tCm15cmFkaW8uaGsvcG9kY2FzdAoubXlyZWFkaW5nbWFuZ2EuaW5mbwpteXNp
-bmFibG9nLmNvbQoubXlzcGFjZS5jb20KIS0tLmJsb2dzLm15c3BhY2UuY29tCiEt
-LXx8YmxvZ3MubXlzcGFjZS5jb20KIS0tdmlkcy5teXNwYWNlLmNvbS9pbmRleC5j
-Zm0/ZnVzZWFjdGlvbj12aWRzLgohLS12aWV3bW9yZXBpY3MubXlzcGFjZS5jb20K
-fHxteXNwYWNlY2RuLmNvbQoubXl0YWxrYm94LmNvbQoubXl0aXppLmNvbQoKIS0t
-LS0tLS0tLS0tLS0tLS0tLS0tTk4tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCnx8
-bmFhY29hbGl0aW9uLm9yZwpvbGQubmFiYmxlLmNvbQp8fG5haXRpay5uZXQKLm5h
-a3V6LmNvbS9iYnMKfHxuYWxhbmRhYm9kaGkub3JnCnx8bmFsYW5kYXdlc3Qub3Jn
-Ci5uYW1neWFsLm9yZwpuYW1neWFsbW9uYXN0ZXJ5Lm9yZwp8fG5hbXNpc2kuY29t
-Ci5uYW55YW5nLmNvbQp8fG5hbnlhbmcuY29tCi5uYW55YW5ncG9zdC5jb20KfHxu
-YW55YW5ncG9zdC5jb20KLm5hbnphby5jb20KIS0tLm5hbnphby5jb20vc2MvY2hp
-bmEvMjAyMjMKIS0tLm5hbnphby5jb20vc2MvaGstbWFjYXUtdHcKfHxqcGwubmFz
-YS5nb3YKfHxwZHMubmFzYS5nb3YKfHxzb2xhcnN5c3RlbS5uYXNhLmdvdgoubmFr
-aWRvLmNvbQp8fG5ha2lkby5jb20KLm5hb2wuY2EKLm5hb2wuY2MKdWlnaHVyLm5h
-cm9kLnJ1Ci5uYXQubW9lCnx8bmF0Lm1vZQpjeWJlcmdob3N0Lm5hdGFkby5jb20K
-fHxuYXRpb25hbC1sb3R0ZXJ5LmNvLnVrCm5ld3MubmF0aW9uYWxnZW9ncmFwaGlj
-LmNvbS9uZXdzLzIwMTQvMDYvMTQwNjAzLXRpYW5hbm1lbi1zcXVhcmUKLm5hdGlv
-bnNvbmxpbmUub3JnL29uZXdvcmxkL3RpYmV0Cnx8bGluZS5uYXZlci5qcAp8fG5h
-dnlmYW1pbHkubmF2eS5taWwKfHxuYXZ5cmVzZXJ2ZS5uYXZ5Lm1pbAp8fG5rby5u
-YXZ5Lm1pbAp8fHVzbm8ubmF2eS5taWwKbmF3ZWVrbHl0aW1lcy5jb20KLm5idHZw
-bi5jb20KfGh0dHA6Ly9uYnR2cG4uY29tCm5jY3dhdGNoLm9yZy50dwoubmNoLmNv
-bS50dwoubmNuLm9yZwp8fG5jbi5vcmcKfHxldG9vbHMubmNvbC5jb20KLm5kZS5k
-ZQoubmRyLmRlCi5uZWQub3JnCnx8bmVrb3Nsb3Zha2lhLm5ldAp8fG5lcHVzb2t1
-LmNvbQp8fG5ldC1maXRzLnBybwohLS1iYnNuZXcubmV0YmlnLmNvbQpiYnMubmV0
-YmlnLmNvbQoubmV0YmlyZHMuY29tCm5ldGNvbG9ueS5jb20KYm9saW4ubmV0Zmly
-bXMuY29tCnx8bmV0bWUuY2MKbmV0c25lYWsuY29tCi5uZXR3b3JrNTQuY29tCm5l
-dHdvcmtlZGJsb2dzLmNvbQoubmV0d29ya3R1bm5lbC5uZXQKbmV2ZXJmb3JnZXQ4
-OTY0Lm9yZwpuZXctM2x1bmNoLm5ldAoubmV3LWFraWJhLmNvbQoubmV3OTYuY2EK
-Lm5ld2NlbnR1cnltYy5jb20KfGh0dHA6Ly9uZXdjZW50dXJ5bWMuY29tCm5ld2Nl
-bnR1cnluZXdzLmNvbQp8fG5ld2NoZW4uY29tCi5uZXdjaGVuLmNvbQoubmV3Z3Jv
-dW5kcy5jb20KbmV3aXBub3cuY29tCi5uZXdsYW5kbWFnYXppbmUuY29tLmF1Ci5u
-ZXduZXdzLmNhCm5ld3MxMDAuY29tLnR3Cm5ld3NjaGluYWNvbW1lbnQub3JnCi5u
-ZXdzY24ub3JnCnx8bmV3c2NuLm9yZwpuZXdzcGVhay5jYy9zdG9yeQoubmV3c2Fu
-Y2FpLmNvbQp8fG5ld3NhbmNhaS5jb20KLm5ld3NkZXRveC5jYQoubmV3c2RoLmNv
-bQp8fG5ld3N0YW1hZ28uY29tCnx8bmV3c3RhcGEub3JnCm5ld3N0YXJuZXQuY29t
-Ci5uZXd0YWl3YW4uY29tLnR3Cm5ld3RhbGsudHcKfHxuZXd0YWxrLnR3Cm5ld3lv
-cmt0aW1lcy5jb20KfHxuZXhvbi5jb20KLm5leHQxMS5jby5qcAoubmV4dG1hZy5j
-b20udHcKCiEtLWhrKi5uZXh0bWVkaWEuY29tCiEtLXR3Ki5uZXh0bWVkaWEuY29t
-CiEtLXN0YXRpYyoubmV4dG1lZGlhLmNvbQoubmV4dG1lZGlhLmNvbQoKfHxuZXh0
-b24tbmV0LmpwCm5leHR0di5jb20udHcKLm5manR5ZC5jb20KfHxjby5uZy5taWwK
-fHxuZ2EubWlsCm5nZW5zaXMuY29tCi5uaGVudGFpLm5ldAp8aHR0cDovL25oZW50
-YWkubmV0Ci5uaGstb25kZW1hbmQuanAKLm5pY292aWRlby5qcC93YXRjaAp8fG5p
-Y292aWRlby5qcAp8fG5pZ2hvc3Qub3JnCmF2Lm5pZ2h0bGlmZTE0MS5jb20Kbmlu
-ZWNvbW1lbnRhcmllcy5jb20KLm5pbmphY2xvYWsuY29tCnx8bmluamFwcm94eS5u
-aW5qYQpuaW50ZW5kaXVtLmNvbQp0YWl3YW55ZXMubmluZy5jb20KdXNtZ3RjZy5u
-aW5nLmNvbS9mb3J1bQp8fG5pdXNuZXdzLmNvbQp8fG5qYWN0Yi5vcmcKbmp1aWNl
-LmNvbQp8fG5qdWljZS5jb20KbmxmcmVldnBuLmNvbQoKIS0tbm8taXAuY29tI05P
-SVAKLmRkbnMubmV0LwouZ29vZGRucy5pbmZvCnx8Z290ZG5zLmNoCi5tYWlsZG5z
-Lnh5egoubm8taXAub3JnCi5vcGVuZG4ueHl6Ci5zZXJ2ZWh0dHAuY29tCnN5dGVz
-Lm5ldAoud2hvZG5zLnh5egouemFwdG8ub3JnCnxodHRwOi8vZHludXBkYXRlLm5v
-LWlwLmNvbS8KCnx8bm9iZWwuc2UKIS0tLm5vYmVscHJpemUub3JnCiEtLXxodHRw
-Oi8vbm9iZWxwcml6ZS5vcmcKbm9iZWxwcml6ZS5vcmcvbm9iZWxfcHJpemVzL3Bl
-YWNlL2xhdXJlYXRlcy8xOTg5Cm5vYmVscHJpemUub3JnL25vYmVsX3ByaXplcy9w
-ZWFjZS9sYXVyZWF0ZXMvMjAxMApub2JvZHljYW5zdG9wLnVzCnx8bm9ib2R5Y2Fu
-c3RvcC51cwp8fG5va29naXJpLm9yZwp8fG5va29sYS5jb20Kbm9vZGxldnBuLmNv
-bQoubm9yYnVsaW5na2Eub3JnCm5vcmR2cG4uY29tCnx8bm9yZHZwbi5jb20KfHxu
-b3ZlbGFzaWEuY29tCi5uZXdzLm5vdy5jb20KfGh0dHA6Ly9uZXdzLm5vdy5jb20K
-IS0tfGh0dHA6Ly9uZXdzLm5vdy5jb20vaG9tZSoKbmV3cy5ub3cuY29tJTJGaG9t
-ZQp8fG5vd25ld3MuY29tCi5ub3d0b3JyZW50cy5jb20KLm5veXBmLmNvbQp8fG5v
-eXBmLmNvbQp8fG5wYS5nby5qcAoubnBudC5tZQp8aHR0cDovL25wbnQubWUKLm5w
-cy5nb3YKLm5yYWRpby5tZQp8aHR0cDovL25yYWRpby5tZQoubnJrLm5vCnx8bnJr
-Lm5vCi5udGQudHYKfHxudGQudHYKISEtLU9yaWc6bnRkdHYuY29tCi5udGR0di5j
-b20KfHxudGR0di5jb20KLm50ZHR2LmNvLmtyCm50ZHR2LmNhCm50ZHR2Lm9yZwpu
-dGR0di5ydQpudGR0dmxhLmNvbQoubnRyZnVuLmNvbQp8fGNicy5udHUuZWR1LnR3
-Cnx8bWVkaWEubnUubmwKLm51YmlsZXMubmV0Cnx8bnVleHBvLmNvbQoubnVraXN0
-cmVhbS5jb20KfHxudXJnby1zb2Z0d2FyZS5jb20KfHxudXRha3UubmV0Ci5udXZp
-ZC5jb20KfHxudmRzdC5jb20KbnV6Y29tLmNvbQoubnZxdWFuLm9yZwoubnZ0b25n
-emhpc2hlbmcub3JnCnxodHRwOi8vbnZ0b25nemhpc2hlbmcub3JnCi5ud3RjYS5v
-cmcKfGh0dHA6Ly9ueWFhLmV1CiEtLXx8bnlhYS5zaQoubnlkdXMuY2EKbnlsb24t
-YW5nZWwuY29tCm55bG9uc3RvY2tpbmdzb25saW5lLmNvbQohLS1ueXNpbmd0YW8u
-Y29tCi5uemNoaW5lc2UuY29tCnx8bnpjaGluZXNlLm5ldC5uegoKIS0tLS0tLS0t
-LS0tLS0tLS0tLS0tT08tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCm9ic2VydmVj
-aGluYS5uZXQKLm9idXR1LmNvbQpvY2FzcHJvLmNvbQpvY2N1cHl0aWFuYW5tZW4u
-Y29tCm9jbHAuaGsKLm9jcmVhbXBpZXMuY29tCnx8b2N0b2Jlci1yZXZpZXcub3Jn
-Cm9mZmJlYXRjaGluYS5jb20Kb2ZmaWNlb2Z0aWJldC5jb20KfGh0dHA6Ly9vZmls
-ZS5vcmcKfHxvZ2FvZ2Eub3JnCnR3dHIyc3JjLm9nYW9nYS5vcmcKLm9nYXRlLm9y
-Zwp8fG9nYXRlLm9yZwp3d3cyLm9oY2hyLm9yZy9lbmdsaXNoL2JvZGllcy9jYXQv
-ZG9jcy9uZ29zL0lJX0NoaW5hXzQxLnBkZgoub2lrb3MuY29tLnR3L3Y0Ci5vaWt0
-di5jb20Kb2l6b2Jsb2cuY29tCi5vay5ydQp8fG9rLnJ1Ci5va2F5ZnJlZWRvbS5j
-b20KfHxva2F5ZnJlZWRvbS5jb20Kb2trLnR3CnxodHRwOi8vZmlsbXkub2xhYmxv
-Z2EucGwvcGxheWVyCm9sZC1jYXQubmV0Cnx8b2x1bXBvLmNvbQoub2x5bXBpY3dh
-dGNoLm9yZwpvbWdpbGkuY29tCnx8b21uaXRhbGsuY29tCnx8b21uaXRhbGsub3Jn
-CmNsaW5nLm9teS5zZwpmb3J1bS5vbXkuc2cKbmV3cy5vbXkuc2cKc2hvd2Jpei5v
-bXkuc2cKfHxvbi5jYwp8fG9uZWRyaXZlLmxpdmUuY29tCnx8b25pb24uY2l0eQou
-b25saW5lY2hhLmNvbQp8fG9ubGluZXlvdXR1YmUuY29tCi5vbmx5dHdlZXRzLmNv
-bQp8aHR0cDovL29ubHl0d2VldHMuY29tCm9ubW9vbi5uZXQKb25tb29uLmNvbQou
-b250aGVodW50LmNvbQp8aHR0cDovL29udGhlaHVudC5jb20KLm9vcHNmb3J1bS5j
-b20Kb3Blbi5jb20uaGsKb3BlbmFsbHdlYi5jb20Kb3BlbmRlbW9jcmFjeS5uZXQK
-fHxvcGVuZGVtb2NyYWN5Lm5ldAoub3BlbmVydnBuLmluCm9wZW5pZC5uZXQKfHxv
-cGVuaWQubmV0Ci5vcGVubGVha3Mub3JnCnx8b3BlbmxlYWtzLm9yZwpvcGVudnBu
-Lm5ldAp8fG9wZW52cG4ubmV0Cnx8b3BlbndlYnN0ZXIuY29tCi5vcGVud3J0Lm9y
-Zy5jbgpAQHx8b3BlbndydC5vcmcuY24KbXkub3BlcmEuY29tL2RhaGVtYQp8fGRl
-bW8ub3BlcmEtbWluaS5uZXQKLm9wdXMtZ2FtaW5nLmNvbQp8aHR0cDovL29wdXMt
-Z2FtaW5nLmNvbQp3d3cub3JjaGlkYmJzLmNvbQoub3JnYW5jYXJlLm9yZy50dwpv
-cmdhbmhhcnZlc3RpbnZlc3RpZ2F0aW9uLm5ldAoub3JnYXNtLmNvbQoub3JnZnJl
-ZS5jb20KfHxvcmllbnQtZG9sbC5jb20Kb3JpZW50YWxkYWlseS5jb20ubXkKfHxv
-cmllbnRhbGRhaWx5LmNvbS5teQohLS1vcmllbnRhbGRhaWx5Lm9uLmNjCnx8b3Ju
-LmpwCnQub3J6ZHJlYW0uY29tCnx8dC5vcnpkcmVhbS5jb20KdHVpLm9yemRyZWFt
-LmNvbQp8fG9yemlzdGljLm9yZwp8fG9zZm9vcmEuY29tCi5vdG5kLm9yZwp8fG90
-bmQub3JnCnx8b3R0by5kZQp8fG91cmRlYXJhbXkuY29tCm91cnNvZ28uY29tCi5v
-dXJzdGVwcy5jb20uYXUKfHxvdXJzdGVwcy5jb20uYXUKLm91cnN3ZWIubmV0Cnx8
-b3VydHYuaGsKeGlucWltZW5nLm92ZXItYmxvZy5jb20KfHxvdmVycGxheS5uZXQK
-c2hhcmUub3ZpLmNvbS9tZWRpYQp8aHR0cDovL293bC5saQp8aHR0cDovL2h0Lmx5
-CnxodHRwOi8vaHRsLmxpCnxodHRwOi8vbWFzaC50bwp3d3cub3dpbmQuY29tCnxo
-dHRwOi8vd3d3Lm94aWQuaXQKb3lheC5jb20Kb3lnaGFuLmNvbS93cHMKLm96Y2hp
-bmVzZS5jb20vYmJzCnx8b3cubHkKYmJzLm96Y2hpbmVzZS5jb20KLm96dm9pY2Uu
-b3JnCnx8b3p2b2ljZS5vcmcKLm96eHcuY29tCi5venlveW8uY29tCgohLS0tLS0t
-LS0tLS0tLS0tLS0tLS1QUC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KfHxwYWNo
-b3N0aW5nLmNvbQoucGFjaWZpY3Bva2VyLmNvbQoucGFja2V0aXgubmV0Cnx8cGFj
-b3BhY29tYW1hLmNvbQoucGFkbWFuZXQuY29tCnBhZ2UycnNzLmNvbQp8fHBhZ29k
-YWJveC5jb20KLnBhbGFjZW1vb24uY29tCmZvcnVtLnBhbG1pc2xpZmUuY29tCnx8
-ZXJpdmVyc29mdC5jb20KLnBhbGRlbmd5YWwuY29tCnBhbGpvcnB1YmxpY2F0aW9u
-cy5jb20KLnBhbHRhbGsuY29tCiEtLXx8cGFuZ2NpLm5ldAp8fHBhbmRhcG93LmNv
-Ci5wYW5kYXBvdy5uZXQKLnBhbmRhdnBuLWpwLmNvbQoucGFubHVhbi5uZXQKfHxw
-YW5sdWFuLm5ldAp8fHBhby1wYW8ubmV0CnBhcGVyLmxpCnBhcGVyYi51cwoucGFy
-YWRpc2VoaWxsLmNjCi5wYXJhZGlzZXBva2VyLmNvbQoucGFydHljYXNpbm8uY29t
-Ci5wYXJ0eXBva2VyLmNvbQoucGFzc2lvbi5jb20KfHxwYXNzaW9uLmNvbQoucGFz
-c2lvbnRpbWVzLmhrCnBhc3RlYmluLmNvbQoucGFzdGllLm9yZwp8fHBhc3RpZS5v
-cmcKfHxibG9nLnBhdGh0b3NoYXJlcG9pbnQuY29tCnBicy5vcmcvd2diaC9wYWdl
-cy9mcm9udGxpbmUvZ2F0ZQpwYnMub3JnL3dnYmgvcGFnZXMvZnJvbnRsaW5lL3Rh
-bmttYW4KcGJzLm9yZy93Z2JoL3BhZ2VzL2Zyb250bGluZS90aWJldAp2aWRlby5w
-YnMub3JnCgohLS1QYndpa2kKcGJ3aWtpLmNvbQp8fHBid29ya3MuY29tCnx8ZGV2
-ZWxvcGVycy5ib3gubmV0Cnx8d2lraS5vYXV0aC5uZXQKfHx3aWtpLnBob25lZ2Fw
-LmNvbQp8fHdpa2kuanF1ZXJ5dWkuY29tCgp8fHBieGVzLmNvbQp8fHBieGVzLm9y
-ZwpwY2R2ZC5jb20udHcKLnBjaG9tZS5jb20udHcKfGh0dHA6Ly9wY2lqLm9yZwou
-cGNzdG9yZS5jb20udHcKfHxwY3Qub3JnLnR3CnBkZXRhaWxzLmNvbQp8fHBkcHJv
-eHkuY29tCnx8cGVhY2UuY2EKcGVhY2VmaXJlLm9yZwpwZWFjZWhhbGwuY29tCnx8
-cGVhY2VoYWxsLmNvbQp8aHR0cDovL3BlYXJsaGVyLm9yZwoucGVlYXNpYW4uY29t
-Ci5wZWtpbmdkdWNrLm9yZwp8fHBla2luZ2R1Y2sub3JnCi5wZW11bGloYW4ub3Iu
-aWQKfGh0dHA6Ly9wZW11bGloYW4ub3IuaWQKfHxwZW4uaW8KcGVuY2hpbmVzZS5j
-b20KfHxwZW5jaGluZXNlLm5ldAoucGVuY2hpbmVzZS5uZXQKcGVuZ3l1bG9uZy5j
-b20KcGVuaXNib3QuY29tCnx8YmxvZy5wZW50YWxvZ2ljLm5ldAoucGVudGhvdXNl
-LmNvbQoucGVudG95LmhrLyVFNCVCOCVBRCVFNSU5QyU4QgoucGVudG95LmhrLyVF
-NiU5OSU4MiVFNCVCQSU4QgoucGVvcGxlYm9va2NhZmUuY29tCi5wZW9wbGVuZXdz
-LnR3Cnx8cGVvcGxlbmV3cy50dwoucGVvcG8ub3JnCnx8cGVvcG8ub3JnCi5wZXJj
-eS5pbgoucGVyZmVjdGdpcmxzLm5ldApwZXJmZWN0dnBuLm5ldAoucGVyc2VjdXRp
-b25ibG9nLmNvbQoucGVyc2lhbmtpdHR5LmNvbQpwZmQub3JnLmhrCnBoYXBsdWFu
-Lm9yZwpwaGF5dWwuY29tCnBoaWxib3JnZXMuY29tCnBoaWxseS5jb20KfHxwaG5j
-ZG4uY29tCnx8cGhvdG9kaGFybWEubmV0Cnx8cGhvdG9mb2N1cy5jb20KfHxwaHVx
-dW9jc2VydmljZXMuY29tCnx8cGljYWNvbWljY24uY29tCi5waWNpZGFlLm5ldAp8
-fGltZyoucGljdHVyZWRpcC5jb20KcGljdHVyZXNvY2lhbC5jb20KfHxwaW4tY29u
-Zy5jb20KLnBpbjYuY29tCnx8cGluNi5jb20KLnBpbmcuZm0KfHxwaW5nLmZtCnx8
-cGluaW1nLmNvbQoucGlua3JvZC5jb20KfHxwaW5veS1uLmNvbQp8fHBpbnRlcmVz
-dC5hdAp8fHBpbnRlcmVzdC5jYQp8fHBpbnRlcmVzdC5jby5rcgp8fHBpbnRlcmVz
-dC5jby51awoucGludGVyZXN0LmNvbQp8fHBpbnRlcmVzdC5jb20KfHxwaW50ZXJl
-c3QuZGUKfHxwaW50ZXJlc3QuZGsKfHxwaW50ZXJlc3QuZnIKfHxwaW50ZXJlc3Qu
-anAKfHxwaW50ZXJlc3QubmwKfHxwaW50ZXJlc3Quc2UKLnBpcGlpLnR2Ci5waXBv
-c2F5LmNvbQpwaXJhYXR0aWxhaHRpLm9yZwoucGlyaW5nLmNvbQp8fHBpeGVscWku
-Y29tCnx8Y3NzLnBpeG5ldC5pbgp8fHBpeG5ldC5uZXQKLnBpeG5ldC5uZXQKLnBr
-LmNvbQp8fHBsYWNlbWl4LmNvbQohLS0ucGxhbmV0c3V6eS5vcmcKfGh0dHA6Ly9w
-aWN0dXJlcy5wbGF5Ym95LmNvbQp8fHBsYXlib3kuY29tCi5wbGF5Ym95cGx1cy5j
-b20KfHxwbGF5Ym95cGx1cy5jb20KfHxwbGF5ZXIuZm0KLnBsYXlubzEuY29tCnx8
-cGxheW5vMS5jb20KfHxwbGF5cGNlc29yLmNvbQpwbGF5cy5jb20udHcKfHxtLnBs
-aXhpLmNvbQpwbG0ub3JnLmhrCnBsdW5kZXIuY29tCi5wbHVyay5jb20KfHxwbHVy
-ay5jb20KLnBsdXMyOC5jb20KLnBsdXNiYi5jb20KLnBtYXRlaHVudGVyLmNvbQp8
-aHR0cDovL3BtYXRlaHVudGVyLmNvbQoucG1hdGVzLmNvbQp8fHBvMmIuY29tCnBv
-YmllcmFteS50b3AKIS0tfHxwb2Nvby5vcmcKfHxwb2RpY3Rpb25hcnkuY29tCi5w
-b2tlcnN0YXJzLmNvbQp8fHBva2Vyc3RhcnMuY29tCi5wb2tlcnN0YXJzLm5ldAp6
-aC5wb2tlcnN0cmF0ZWd5LmNvbQpwb2xpdGljYWxjaGluYS5vcmcKcG9saXRpY2Fs
-Y29uc3VsdGF0aW9uLm9yZwoucG9saXRpc2NhbGVzLm5ldAp8fHBvbG9uaWV4LmNv
-bQoucG9seW1lcmhrLmNvbQp8aHR0cDovL3BvbHltZXJoay5jb20KLnBvcG8udHcK
-IS0tfHxwb3B1bGFycGFnZXMubmV0Cnx8cG9wdm90ZS5oawoucG9weWFyZC5jb20K
-fHxwb3B5YXJkLm9yZwoucG9ybi5jb20KLnBvcm4yLmNvbQoucG9ybjUuY29tCi5w
-b3JuYmFzZS5vcmcKLnBvcm5lcmJyb3MuY29tCnx8cG9ybmhkLmNvbQoucG9ybmhv
-c3QuY29tCi5wb3JuaHViLmNvbQp8fHBvcm5odWIuY29tCi5wb3JuaHViZGV1dHNj
-aC5uZXQKfGh0dHA6Ly9wb3JuaHViZGV1dHNjaC5uZXQKfHxwb3JubW0ubmV0Ci5w
-b3Jub3hvLmNvbQoucG9ybnJhcGlkc2hhcmUuY29tCnx8cG9ybnJhcGlkc2hhcmUu
-Y29tCi5wb3Juc2hhcmluZy5jb20KfGh0dHA6Ly9wb3Juc2hhcmluZy5jb20KLnBv
-cm5zb2NrZXQuY29tCi5wb3Juc3RhcmNsdWIuY29tCnx8cG9ybnN0YXJjbHViLmNv
-bQoucG9ybnR1YmUuY29tCi5wb3JudHViZW5ld3MuY29tCi5wb3JudHZibG9nLmNv
-bQp8fHBvcm50dmJsb2cuY29tCi5wb3JudmlzaXQuY29tCi5wb3J0YWJsZXZwbi5u
-bAp8fHBvc2tvdGFuZXdzLmNvbQoucG9zdDAxLmNvbQoucG9zdDc2LmNvbQp8fHBv
-c3Q3Ni5jb20KLnBvc3Q4NTIuY29tCnBvc3RhZHVsdC5jb20KLnBvc3RpbWcub3Jn
-Cnx8cG90dnBuLmNvbQp8fHBvd2VyY3guY29tCi5wb3dlcnBob3RvLm9yZwp8fHd3
-dy5wb3dlcnBvaW50bmluamEuY29tCnx8cHJlc2lkZW50bGVlLnR3Cnx8Y2RuLnBy
-aW50ZnJpZW5kbHkuY29tCi5wcml0dW5sLmNvbQpwcm92cG5hY2NvdW50cy5jb20K
-fHxwcm92cG5hY2NvdW50cy5jb20KLnByb3hmcmVlLmNvbQp8fHByb3hmcmVlLmNv
-bQpwcm94eWFub25pbW8uZXMKLnByb3h5bmV0d29yay5vcmcudWsKfHxwcm94eW5l
-dHdvcmsub3JnLnVrCnx8cHRzLm9yZy50dwoucHR0dmFuLm9yZwpwdWJ1LmNvbS50
-dwpwdWZmaW5icm93c2VyLmNvbQpwdXJlaW5zaWdodC5vcmcKLnB1c2hjaGluYXdh
-bGwuY29tCi5wdXR0eS5vcmcKfHxwdXR0eS5vcmcKCiEtLS0tLS0tLS0tLS0tUG9z
-dGVyb3VzLS0tLS0KfHxjYWxlYmVsc3Rvbi5jb20KfHxibG9nLmZpenppay5jb20K
-fHxuZi5pZC5hdQp8fHNvZ3JhZHkubWUKfHx2YXRuLm9yZwp8fHZlbnR1cmVzd2Vs
-bC5jb20KfHx3aGVyZWlzd2VybmVyLmNvbQoKLnBvd2VyLmNvbQp8fHBvd2VyLmNv
-bQpwb3dlcmFwcGxlLmNvbQp8fHBvd2VyYXBwbGUuY29tCnx8YWJjLnBwLnJ1Cmhl
-aXgucHAucnUKfHxwcmF5Zm9yY2hpbmEubmV0Cnx8cHJlbWVmb3J3aW5kb3dzNy5j
-b20KfHxwcmVzZW50YXRpb256ZW4uY29tCnx8cHJlc3RpZ2UtYXYuY29tCnByaXNv
-bmVyLXN0YXRlLXNlY3JldC1qb3VybmFsLXByZW1pZXIKLnByaXNvbmVyYWxlcnQu
-Y29tCnx8cHJpdHVubC5jb20KfHxwcml2YWN5Ym94LmRlCi5wcml2YXRlLmNvbS9o
-b21lCnx8cHJpdmF0ZWludGVybmV0YWNjZXNzLmNvbQpwcml2YXRlcGFzdGUuY29t
-Cnx8cHJpdmF0ZXBhc3RlLmNvbQpwcml2YXRldHVubmVsLmNvbQp8fHByaXZhdGV0
-dW5uZWwuY29tCnx8cHJpdmF0ZXZwbi5jb20KfHxwcm9jb3B5dGlwcy5jb20KcHJv
-dmlkZW9jb2FsaXRpb24uY29tCnx8cHJvc2liZW4uZGUKcHJveGlmaWVyLmNvbQph
-cGkucHJveGxldC5jb20KfHxwcm94b21pdHJvbi5pbmZvCi5wcm94cG4uY29tCnx8
-cHJveHBuLmNvbQoucHJveHlsaXN0Lm9yZy51awp8fHByb3h5bGlzdC5vcmcudWsK
-LnByb3h5cHkubmV0Cnx8cHJveHlweS5uZXQKcHJveHlyb2FkLmNvbQoucHJveHl0
-dW5uZWwubmV0CiEtLTQwMyBtYXliZQp8fHByb3llY3RvY2x1YmVzLmNvbQpwcm96
-ei5uZXQKcHNibG9nLm5hbWUKfHxwc2Jsb2cubmFtZQp8fHBzaXBob24uY2EKLnBz
-aXBob24zLmNvbQp8fHBzaXBob24zLmNvbQoucHNpcGhvbnRvZGF5LmNvbQoucHR0
-LmNjCnx8cHR0LmNjCi5wdWZmc3RvcmUuY29tCi5wdXVrby5jb20KfHxwdWxsZm9s
-aW8uY29tCi5wdW55dS5jb20vcHVueQp8fHB1cmVjb25jZXB0cy5uZXQKfHxwdXJl
-aW5zaWdodC5vcmcKfHxwdXJlcGRmLmNvbQp8fHB1cmV2cG4uY29tCi5wdXJwbGVs
-b3R1cy5vcmcKLnB1cnN1ZXN0YXIuY29tCnx8cHVyc3Vlc3Rhci5jb20KLnB1c3N5
-c3BhY2UuY29tCi5wdXRpaG9tZS5vcmcKLnB1dGxvY2tlci5jb20vZmlsZQpwd25l
-ZC5jb20KcHl0aG9uLmNvbQoucHl0aG9uLmNvbS50dwp8aHR0cDovL3B5dGhvbi5j
-b20udHcKcHl0aG9uaGFja2Vycy5jb20vcApzcy5weXRob25pYy5saWZlLwoKIS0t
-LS0tLS0tLS0tLS0tLS0tLS0tUVEtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCi5x
-YW5vdGUuY29tCnx8cWFub3RlLmNvbQoucWdpcmwuY29tLnR3Cnx8cWlhbmRhby50
-b2RheQoucWktZ29uZy5tZQp8fHFpLWdvbmcubWUKIS0tIzkyMQp8fHFpYW5neW91
-Lm9yZwoucWlkaWFuLmNhCi5xaWVua3Vlbi5vcmcKfHxxaWVua3Vlbi5vcmcKfHxx
-aXdlbi5sdQpxaXhpYW5nbHUuY24KYmJzLnFtemRkLmNvbQoucWtzaGFyZS5jb20K
-cW9vcy5jb20KfHxxb29zLmNvbQpibG9nLnFvb3phLmhrL2RhZmVuZ3FpeGkKfHxl
-Zmtzb2Z0LmNvbQp8fHFzdGF0dXMuY29tCnx8cXR3ZWV0ZXIuY29tCnx8cXRyYWMu
-ZXUKLnF1YW5uZW5nc2hlbi5vcmcKfGh0dHA6Ly9xdWFubmVuZ3NoZW4ub3JnCnF1
-YW50dW1ib290ZXIubmV0Cnx8cXVpdGNjcC5uZXQKLnF1aXRjY3AubmV0Cnx8cXVp
-dGNjcC5vcmcKLnF1aXRjY3Aub3JnCi5xdW9yYS5jb20vQ2hpbmFzLUZ1dHVyZQou
-cXVyYW4uY29tCnxodHRwOi8vcXVyYW4uY29tCi5xdXJhbmV4cGxvcmVyLmNvbQpx
-dXNpOC5uZXQKLnF2b2R6eS5vcmcKbmVtZXNpczIucXgubmV0L3BhZ2VzL015RW5U
-dW5uZWwKcXhiYnMub3JnCgohLS0tLS0tLS0tLS0tLS0tLS0tLS1SUi0tLS0tLS0t
-LS0tLS0tLS0tLS0tLS0tLS0KLnJhLmdnCnxodHRwOi8vcmEuZ2cvCi5yYWRpY2Fs
-cGFydHkub3JnCnx8cmFlbC5vcmcKcmFkaWNhbHBhcnR5Lm9yZwpyYWRpb2F1c3Ry
-YWxpYS5uZXQuYXUKLnJhZGlvaGlsaWdodC5uZXQKfHxyYWRpb2hpbGlnaHQubmV0
-Cm9wbWwucmFkaW90aW1lLmNvbQp8fHJhZGlvdmF0aWNhbmEub3JnCnx8cmFkaW92
-bmNyLmNvbQp8fHJhZ2dlZGJhbm5lci5jb20KfHxyYWlkY2FsbC5jb20udHcKLnJh
-aWR0YWxrLmNvbS50dwoucmFpbmJvd3BsYW4ub3JnL2Jicwp8aHR0cHM6Ly9yYWlu
-ZHJvcC5pby8KLnJhaXpvamkub3IuanAKfGh0dHA6Ly9yYWl6b2ppLm9yLmpwCnJh
-bmd3YW5nLmJpegpyYW5nemVuLmNvbQpyYW5nemVuLm5ldApyYW5nemVuLm9yZwp8
-aHR0cDovL2Jsb2cucmFueGlhbmcuY29tLwpyYW55dW5mZWkuY29tCnx8cmFueXVu
-ZmVpLmNvbQoucmFwYnVsbC5uZXQKfGh0dHA6Ly9yYXBpZGdhdG9yLm5ldC8KfHxy
-YXBpZG1vdmllei5jb20KcmFwaWR2cG4uY29tCnx8cmFwaWR2cG4uY29tCi5yYXJl
-bW92aWUuY2MKfGh0dHA6Ly9yYXJlbW92aWUuY2MKLnJhcmVtb3ZpZS5uZXQKfGh0
-dHA6Ly9yYXJlbW92aWUubmV0Cnx8cmF3Z2l0LmNvbQp8fHJhd2dpdGh1Yi5jb20K
-IS0tLnJheWZtZS5jb20vYmJzCnx8cmF6eWJvYXJkLmNvbQpyY2luZXQuY2EKLnJl
-YWQxMDAuY29tCi5yZWFkaW5ndGltZXMuY29tLnR3Cnx8cmVhZGluZ3RpbWVzLmNv
-bS50dwp8fHJlYWRtb28uY29tCi5yZWFkeWRvd24uY29tCnxodHRwOi8vcmVhZHlk
-b3duLmNvbQoucmVhbGNvdXJhZ2Uub3JnCi5yZWFsaXR5a2luZ3MuY29tCnx8cmVh
-bGl0eWtpbmdzLmNvbQoucmVhbHJhcHRhbGsuY29tCi5yZWFsc2V4cGFzcy5jb20K
-LnJlY29yZGhpc3Rvcnkub3JnCi5yZWNvdmVyeS5vcmcudHcKfGh0dHA6Ly9vbmxp
-bmUucmVjb3Zlcnl2ZXJzaW9uLm9yZwp8fHJlY292ZXJ5dmVyc2lvbi5jb20udHcK
-fHxyZWQtbGFuZy5vcmcKcmVkYmFsbG9vbnNvbGlkYXJpdHkub3JnCi5yZWRjaGlu
-YWNuLm5ldAp8aHR0cDovL3JlZGNoaW5hY24ubmV0CnJlZGNoaW5hY24ub3JnCnJl
-ZHR1YmUuY29tCnJlZmVyZXIudXMKfHxyZWZlcmVyLnVzCnx8cmVmbGVjdGl2ZWNv
-ZGUuY29tCnJlbGF4YmJzLmNvbQoucmVsYXkuY29tLnR3Ci5yZWxlYXNlaW50ZXJu
-YXRpb25hbC5vcmcKcmVsaWdpb3VzdG9sZXJhbmNlLm9yZwpyZW5taW5iYW8uY29t
-Cnx8cmVubWluYmFvLmNvbQoucmVueXVyZW5xdWFuLm9yZwp8fHJlbnl1cmVucXVh
-bi5vcmcKfGh0dHA6Ly9jZXJ0aWZpY2F0ZS5yZXZvY2F0aW9uY2hlY2suY29tCnN1
-YmFjbWUucmVyb3V0ZWQub3JnCnx8cmVzaWxpby5jb20KLnJldXRlcnMuY29tCnx8
-cmV1dGVycy5jb20KfHxyZXV0ZXJzbWVkaWEubmV0Ci5yZXZsZWZ0LmNvbQpyZXR3
-ZWV0aXN0LmNvbQp8fHJldHdlZXRyYW5rLmNvbQohLS1jb25uZWN0ZWRjaGluYS5y
-ZXV0ZXJzLmNvbQohLS18aHR0cDovL3d3dy5yZXV0ZXJzLmNvbS9uZXdzL3ZpZGVv
-CnJldnZlci5jb20KLnJmYS5vcmcKfHxyZmEub3JnCi5yZmFjaGluYS5jb20KLnJm
-YW1vYmlsZS5vcmcKcmZhd2ViLm9yZwp8fHJmZXJsLm9yZwoucmZpLmZyCnx8cmZp
-LmZyCnxodHRwOi8vcmZpLm15LwohLS0ucmhjbG91ZC5jb20KIS0tRWRnZWNhc3QK
-fGh0dHA6Ly92ZHMucmlnaHRzdGVyLmNvbS8KLnJpZ3BhLm9yZwoucmlsZXlndWlk
-ZS5jb20KcmlrdS5tZS8KLnJpdG91a2kuanAKfHxyaXR0ZXIudmcKLnJsd2x3LmNv
-bQp8fHJsd2x3LmNvbQoucm1qZHcuY29tCi5ybWpkdzEzMi5pbmZvCi5yb2Fkc2hv
-dy5oawoucm9ib2ZvcmV4LmNvbQp8fHJvYnVzdG5lc3Npc2tleS5jb20KIS0tfHxy
-b2MtdGFpd2FuLm9yZwp8fHJvY2tldC1pbmMubmV0CnxodHRwOi8vd3d3Mi5yb2Nr
-ZXRiYnMuY29tLzExL2Jicy5jZ2k/aWQ9NW11cwp8aHR0cDovL3d3dzIucm9ja2V0
-YmJzLmNvbS8xMS9iYnMuY2dpP2lkPWZyZWVtZ2wKIS0tfHxyb2NtcC5vcmcKfHxy
-b2pvLmNvbQp8fHJvbmpvbmVzd3JpdGVyLmNvbQp8fHJvbGlhLm5ldAoucm9vZG8u
-Y29tCi5yb3NlY2hpbmEubmV0Ci5yb3R0ZW4uY29tCi5yc2Yub3JnCnx8cnNmLm9y
-ZwoucnNmLWNoaW5lc2Uub3JnCnx8cnNmLWNoaW5lc2Uub3JnCi5yc2dhbWVuLm9y
-Zwp8fHBob3NwaGF0aW9uMTMucnNzaW5nLmNvbQoucnNzbWVtZS5jb20KfHxyc3Nt
-ZW1lLmNvbQp8fHJ0YWxhYmVsLm9yZwoucnRoay5oawp8aHR0cDovL3J0aGsuaGsK
-LnJ0aGsub3JnLmhrCnxodHRwOi8vcnRoay5vcmcuaGsKLnJ0aS5vcmcudHcKfHxy
-dGkub3JnLnR3Ci5ydHljbWlubmVzb3RhLm9yZwoucnVhbnlpZmVuZy5jb20vYmxv
-Zypzb21lX3dheXNfdG9fYnJlYWtfdGhlX2dyZWF0X2ZpcmV3YWxsCnJ1a29yLm9y
-ZwoucnVuYnR4LmNvbQoucnVzaGJlZS5jb20KLnJ1dGVuLmNvbS50dwpydXR1YmUu
-cnUKLnJ1eWlzZWVrLmNvbQoucnhoai5uZXQKfGh0dHA6Ly9yeGhqLm5ldAoKIS0t
-LS0tLS0tLS0tLS0tLS0tLS0tU1MtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCi5z
-MXMxczEuY29tCnx8cy1jdXRlLmNvbQoucy1kcmFnb24ub3JnCnx8czFoZW5nLmNv
-bQp8aHR0cDovL3d3dy5zNG1pbmlhcmNoaXZlLmNvbQp8fHM4Zm9ydW0uY29tCmNk
-bjEubHAuc2Fib29tLmNvbQp8fHNhY2tzLmNvbQpzYWNvbS5oawp8fHNhY29tLmhr
-Cnx8c2FkcGFuZGEudXMKLnNhZmVydnBuLmNvbQp8fHNhZmVydnBuLmNvbQouc2Fp
-bnR5Y3VsdHVyZS5jb20KfGh0dHA6Ly9zYWludHljdWx0dXJlLmNvbQouc2FpcS5t
-ZQp8fHNhaXEubWUKfHxzYWt1cmFsaXZlLmNvbQouc2FreWEub3JnCi5zYWx2YXRp
-b24ub3JnLmhrCnx8c2FsdmF0aW9uLm9yZy5oawouc2FtYWlyLnJ1L3Byb3h5L3R5
-cGUtMDEKLnNhbWJob3RhLm9yZwouY24uc2FuZHNjb3RhaWNlbnRyYWwuY29tCnxo
-dHRwOi8vY24uc2FuZHNjb3RhaWNlbnRyYWwuY29tCi5zYW5taW4uY29tLnR3CnNh
-cGlrYWNodS5uZXQKc2F2ZW1lZGlhLmNvbQp8fHNhdmV0aGVzb3VuZHMuaW5mbwou
-c2F2ZXRpYmV0LmRlCnx8c2F2ZXRpYmV0LmRlCnNhdmV0aWJldC5mcgpzYXZldGli
-ZXQubmwKLnNhdmV0aWJldC5vcmcKfHxzYXZldGliZXQub3JnCnNhdmV0aWJldC5y
-dQouc2F2ZXRpYmV0c3RvcmUub3JnCnx8c2F2ZXRpYmV0c3RvcmUub3JnCnNhdmV2
-aWQuY29tCnx8c2F5Mi5pbmZvCi5zYm1lLm1lCnxodHRwOi8vc2JtZS5tZQouc2Jz
-LmNvbS5hdS95b3VybGFuZ3VhZ2UKLnNjYXNpbm8uY29tCnxodHRwOi8vd3d3LnNj
-aWVuY2VtYWcub3JnL2NvbnRlbnQvMzQ0LzYxODcvOTUzCi5zY2llbmNlbmV0cy5j
-b20KLnNjbXAuY29tCnx8c2NtcC5jb20KLnNjbXBjaGluZXNlLmNvbQp8fHNjcmFt
-YmxlLmlvCi5zY3JpYmQuY29tCnx8c2NyaWJkLmNvbQp8fHNjcmlwdHNwb3QuY29t
-CnNlYXB1ZmYuY29tCmRvbWFpbmhlbHAuc2VhcmNoLmNvbQouc2VhcmNodHJ1dGgu
-Y29tCnNlY3JldGNoaW5hLmNvbQp8fHNlY3JldGNoaW5hLmNvbQp8fHNlY3JldGdh
-cmRlbi5ubwouc2VjcmV0c2xpbmUuYml6Cnx8c2VjcmV0c2xpbmUuYml6Cnx8c2Vj
-dXJldHVubmVsLmNvbQpzZWN1cml0eWluYWJveC5vcmcKfGh0dHBzOi8vc2VjdXJp
-dHlpbmFib3gub3JnCi5zZWN1cml0eWtpc3MuY29tCnx8c2VjdXJpdHlraXNzLmNv
-bQp8fHNlZWQ0Lm1lCm5ld3Muc2VlaHVhLmNvbQpzZWVzbWljLmNvbQp8fHNlZXZw
-bi5jb20KfHxzZWV6b25lLm5ldApzZWppZS5jb20KLnNlbmRzcGFjZS5jb20KfGh0
-dHA6Ly90d2VldHMuc2VyYXBoLm1lLwpzZXNhd2UubmV0Cnx8c2VzYXdlLm5ldAou
-c2VzYXdlLm9yZwp8fHNldGh3a2xlaW4ubmV0Ci5zZXRuLmNvbQouc2V0dHYuY29t
-LnR3CmZvcnVtLnNldHR5LmNvbS50dwouc2V2ZW5sb2FkLmNvbQp8fHNldmVubG9h
-ZC5jb20KLnNleC5jb20KLnNleC0xMS5jb20KfHxzZXgzLmNvbQp8fHNleDguY2MK
-LnNleGFuZHN1Ym1pc3Npb24uY29tCi5zZXhib3QuY29tCi5zZXhodS5jb20KLnNl
-eGh1YW5nLmNvbQpzZXhpbnNleC5uZXQKfHxzZXhpbnNleC5uZXQKLnNleHR2eC5j
-b20KCiEtLUlQIG9mIFNleEluU2V4CjY3LjIyMC45MS4xNQo2Ny4yMjAuOTEuMTgK
-NjcuMjIwLjkxLjIzCgp8aHR0cDovLyouc2YubmV0Ci5zZmlsZXlkeS5jb20KfHxz
-ZnNoaWJhby5jb20KLnNmdGluZGlhLm9yZwouc2Z0dWsub3JnCnx8c2Z0dWsub3Jn
-Cnx8c2hhZGV5b3V2cG4uY29tCnNoYWRvdy5tYQouc2hhZG93c2t5Lnh5egouc2hh
-ZG93c29ja3MuYXNpYQp8fHd3dy5zaGFkb3dzb2Nrcy5jb20KLnNoYWRvd3NvY2tz
-LmNvbQp8fHNoYWRvd3NvY2tzLmNvbS5oawouc2hhZG93c29ja3Mub3JnCnx8c2hh
-ZG93c29ja3Mub3JnCnx8c2hhZG93c29ja3Mtci5jb20KfGh0dHA6Ly9jbi5zaGFm
-YXFuYS5jb20KLnNoYW1iYWxhcG9zdC5jb20KLnNoYW1iaGFsYXN1bi5jb20KLnNo
-YW5nZmFuZy5vcmcKfHxzaGFuZ2Zhbmcub3JnCnNoYXBlc2VydmljZXMuY29tCi5z
-aGFyZWJlZS5jb20KfHxzaGFyZWNvb2wub3JnCiEtLXx8c2hhcmtkb2xwaGluLmNv
-bQpzaGFycGRhaWx5LmNvbS5oawp8fHNoYXJwZGFpbHkuY29tLmhrCi5zaGFycGRh
-aWx5LmhrCi5zaGFycGRhaWx5LnR3Ci5zaGF0LXRpYmV0LmNvbQpzaGVpa3llcm1h
-bWkuY29tCi5zaGVsbGZpcmUuZGUKfHxzaGVsbGZpcmUuZGUKLnNoZW5zaG91Lm9y
-ZwpzaGVueXVuLmNvbQpzaGVueXVucGVyZm9ybWluZ2FydHMub3JnCnx8c2hlbnl1
-bnBlcmZvcm1pbmdhcnRzLm9yZwpzaGVuemhvdWZpbG0uY29tCnx8c2hlbnpob3Vm
-aWxtLmNvbQp8fHNoZXJhYmd5YWx0c2VuLmNvbQouc2hpYXR2Lm5ldAouc2hpY2hl
-bmcub3JnCnNoaW55Y2hhbi5jb20Kc2hpcGNhbW91ZmxhZ2UuY29tCi5zaGlyZXlp
-c2h1bmppYW4uY29tCi5zaGl0YW90di5vcmcKfHxzaGl4aWFvLm9yZwp8fHNoaXpo
-YW8ub3JnCnNoaXpoYW8ub3JnCnNoa3Nwci5tb2JpL2RhYnIKfHxzaG9kYW5ocS5j
-b20KfHxzaG9vc2h0aW1lLmNvbQouc2hvcDIwMDAuY29tLnR3Ci5zaG9wcGluZy5j
-b20KLnNob3doYW90dS5jb20KLnNob3d0aW1lLmpwCi5zaHV0dGVyc3RvY2suY29t
-Cnx8c2h1dHRlcnN0b2NrLmNvbQpjaC5zaHZvb25nLmNvbQouc2h3Y2h1cmNoLm9y
-Zwp8fHd3dy5zaHdjaHVyY2gub3JnCi5zaHdjaHVyY2gzLmNvbQp8aHR0cDovL3No
-d2NodXJjaDMuY29tCi5zaWRkaGFydGhhc2ludGVudC5vcmcKfHxzaWRlbGluZXNu
-ZXdzLmNvbQouc2lkZWxpbmVzc3BvcnRzZWF0ZXJ5LmNvbQouc2lqaWh1aXN1by5j
-bHViCi5zaWppaHVpc3VvLmNvbQouc2lsa2Jvb2suY29tCnx8c2ltYm9sb3N0d2l0
-dGVyLmNvbQpzaW1wbGVjZC5vcmcKfHxzaW1wbGVjZC5vcmcKQEB8fHNpbXBsZWNk
-Lm1lCnNpbXBsZXByb2R1Y3Rpdml0eWJsb2cuY29tCmJicy5zaW5hLmNvbS8KYmJz
-LnNpbmEuY29tJTJGCmJsb2cuc2luYS5jb20udHcKZGFpbHluZXdzLnNpbmEuY29t
-LwpkYWlseW5ld3Muc2luYS5jb20lMkYKZm9ydW0uc2luYS5jb20uaGsKaG9tZS5z
-aW5hLmNvbQp8fG1hZ2F6aW5lcy5zaW5hLmNvbS50dwpuZXdzLnNpbmEuY29tLmhr
-Cm5ld3Muc2luYS5jb20udHcKbmV3cy5zaW5jaGV3LmNvbS5teQouc2luY2hldy5j
-b20ubXkvbm9kZS8KLnNpbmNoZXcuY29tLm15L3RheG9ub215L3Rlcm0KLnNpbmdh
-cG9yZXBvb2xzLmNvbS5zZwp8fHNpbmdhcG9yZXBvb2xzLmNvbS5zZwouc2luZ2Zv
-cnRpYmV0LmNvbQouc2luZ3Bhby5jb20uaGsKc2luZ3Rhby5jb20KfHxzaW5ndGFv
-LmNvbQpuZXdzLnNpbmd0YW8uY2EKLnNpbmd0YW91c2EuY29tCnx8c2luZ3Rhb3Vz
-YS5jb20KIS0tfHxjZHAuc2luaWNhLmVkdS50dwpzaW5vLW1vbnRobHkuY29tCnx8
-c2lub2Nhc3QuY29tCnNpbm9jaXNtLmNvbQpzaW5vbW9udHJlYWwuY2EKLnNpbm9u
-ZXQuY2EKLnNpbm9waXR0LmluZm8KLnNpbm9hbnRzLmNvbQp8fHNpbm9hbnRzLmNv
-bQouc2lub3F1ZWJlYy5jb20KLnNpZXJyYWZyaWVuZHNvZnRpYmV0Lm9yZwpzaXMu
-eHh4Cnx8c2lzMDAxLmNvbQpzaXMwMDEudXMKLnNpdGUydW5ibG9jay5jb20KfHxz
-aXRlOTAubmV0Ci5zaXRlYnJvLnR3Cnx8c2l0ZWtyZWF0b3IuY29tCnx8c2l0ZWtz
-LnVrLnRvCnx8c2l0ZW1hcHMub3JnCi5zanJ0Lm9yZwp8aHR0cDovL3NqcnQub3Jn
-Cnx8c2p1bS5jbgp8fHNrZXRjaGFwcHNvdXJjZXMuY29tCnx8c2tpbXR1YmUuY29t
-Cnx8c2t5YmV0LmNvbQp8aHR0cDovL3VzZXJzLnNreW5ldC5iZS9yZXZlcy90aWJl
-dGhvbWUuaHRtbAouc2t5a2luZy5jb20udHcKYmJzLnNreWtpd2kuY29tCnxodHRw
-Oi8vd3d3LnNreXBlLmNvbS9pbnRsLwp8aHR0cDovL3d3dy5za3lwZS5jb20vemgt
-SGFudAp8fHNreXZlZ2FzLmNvbQoueHNreXdhbGtlci5jb20KfHx4c2t5d2Fsa2Vy
-LmNvbQp8fHNreXh2cG4uY29tCm0uc2xhbmRyLm5ldAouc2xheXRpemxlLmNvbQou
-c2xlYXp5ZHJlYW0uY29tCnx8c2xoZW5nLmNvbQp8fHNsaWRlc2hhcmUubmV0CmZv
-cnVtLnNsaW1lLmNvbS50dwouc2xpbmtzZXQuY29tCnx8c2xpY2t2cG4uY29tCi5z
-bHV0bG9hZC5jb20KfHxzbWFydGRuc3Byb3h5LmNvbQouc21hcnRoaWRlLmNvbQp8
-fGFwcC5zbWFydG1haWxjbG91ZC5jb20Kc21jaGJvb2tzLmNvbQouc21oLmNvbS5h
-dS93b3JsZC9kZWF0aC1vZi1jaGluZXNlLXBsYXlib3ktbGVhdmVzLWZyZXNoLXNj
-cmF0Y2hlcy1pbi1wYXJ0eS1wYWludHdvcmstMjAxMjA5MDMtMjVhOHYKc21ocmlj
-Lm9yZwouc21pdGguZWR1L2RhbGFpbGFtYQouc215eHkub3JnCiEtLVRPRE8tbm8t
-aG9tZXBhZ2UKfHxzbmFwY2hhdC5jb20KLnNuYXB0dS5jb20KfHxzbmFwdHUuY29t
-Cnx8c25kY2RuLmNvbQpzbmVha21lLm5ldApzbm93bGlvbnB1Yi5jb20KaG9tZS5z
-by1uZXQubmV0LnR3L3lpc2FfdHNhaQp8fHNvYy5taWwKLnNvY2tzLXByb3h5Lm5l
-dAp8fHNvY2tzLXByb3h5Lm5ldAouc29ja3NjYXA2NC5jb20KfHxzb2Nrc2xpc3Qu
-bmV0Ci5zb2NyZWMub3JnCnxodHRwOi8vc29jcmVjLm9yZwouc29kLmNvLmpwCi5z
-b2Z0ZXRoZXIub3JnCnx8c29mdGV0aGVyLm9yZwouc29mdGV0aGVyLWRvd25sb2Fk
-LmNvbQp8fHNvZnRldGhlci1kb3dubG9hZC5jb20KfHxjZG4uc29mdGxheWVyLm5l
-dAp8fHNvZ2NsdWIuY29tCnNvaGNyYWRpby5jb20KfHxzb2hjcmFkaW8uY29tCi5z
-b2ttaWwuY29tCnx8c29ydGluZy1hbGdvcml0aG1zLmNvbQouc29zdGliZXQub3Jn
-Ci5zb3Vtby5pbmZvCnx8c291cC5pbwpAQHx8c3RhdGljLnNvdXAuaW8KLnNvYmVl
-cy5jb20KfHxzb2JlZXMuY29tCnNvY2lhbHdoYWxlLmNvbQouc29mdGV0aGVyLmNv
-LmpwCnx8c29mdHdhcmVieWNodWNrLmNvbQpibG9nLnNvZ29vLm9yZwpzb2gudHcK
-fHxzb2gudHcKc29oZnJhbmNlLm9yZwp8fHNvaGZyYW5jZS5vcmcKY2hpbmVzZS5z
-b2lmaW5kLmNvbQpzb2thbW9ubGluZS5jb20KLnNvbGlkYXJpdGV0aWJldC5vcmcK
-LnNvbGlkZmlsZXMuY29tCnx8c29tZWUuY29tCi5zb25namlhbmp1bi5jb20KfHxz
-b25namlhbmp1bi5jb20KLnNvbmljYmJzLmNjCi5zb25pZG9kZWxhZXNwZXJhbnph
-Lm9yZwouc29wY2FzdC5jb20KLnNvcGNhc3Qub3JnCi5zb3Jhem9uZS5uZXQKfHxz
-b3Mub3JnCmJicy5zb3UtdG9uZy5vcmcKLnNvdWJvcnkuY29tCnxodHRwOi8vc291
-Ym9yeS5jb20KLnNvdWwtcGx1cy5uZXQKLnNvdWxjYWxpYnVyaGVudGFpLm5ldAp8
-fHNvdWxjYWxpYnVyaGVudGFpLm5ldAp8fHNvdW5kY2xvdWQuY29tCiEtLXxodHRw
-czovL3NvdW5kY2xvdWQuY29tL3B1bmtnb2QKLnNvdW5kb2Zob3BlLmtyCnNvdW5k
-b2Zob3BlLm9yZwp8fHNvdW5kb2Zob3BlLm9yZwp8fHNvdXBvZm1lZGlhLmNvbQoh
-LS0uc291cmNlZm9yZ2UubmV0CiEtfGh0dHA6Ly9zb3VyY2Vmb3JnZS5uZXQKfGh0
-dHA6Ly9zb3VyY2Vmb3JnZS5uZXQvcCovc2hhZG93c29ja3NndWkvCi5zb3VyY2V3
-YWRpby5jb20Kc291dGhuZXdzLmNvbS50dwpzb3dlcnMub3JnLmhrCnx8d2x4LnNv
-d2lraS5uZXQKfHxzcGFua2JhbmcuY29tCi5zcGFua2luZ3R1YmUuY29tCi5zcGFu
-a3dpcmUuY29tCnx8c3BiLmNvbQp8fHNwZWFrZXJkZWNrLmNvbQp8fHNwZWVkaWZ5
-LmNvbQpzcGVtLmF0Cnx8c3BlbmNlcnRpcHBpbmcuY29tCnx8c3BlbmRlZS5jb20K
-fHxzcGljZXZwbi5jb20KLnNwaWRlcm9hay5jb20KfHxzcGlkZXJvYWsuY29tCi5z
-cGlrZS5jb20KLnNwb3RmbHV4LmNvbQp8fHNwb3RmbHV4LmNvbQouc3ByaW5nNHUu
-aW5mbwp8aHR0cDovL3NwcmluZzR1LmluZm8KfHxzcHJvdXRjb3JlLmNvbQp8fHNw
-cm94eS5pbmZvCnx8c3JvY2tldC51cwouc3MtbGluay5jb20KfHxzcy1saW5rLmNv
-bQouc3NnbG9iYWwuY28vd3AKfGh0dHA6Ly9zc2dsb2JhbC5jbwouc3NnbG9iYWwu
-bWUKfHxzc2g5MS5jb20KLnNzcHJvLm1sCnxodHRwOi8vc3Nwcm8ubWwKLnNzcnNo
-YXJlLmNvbQp8fHNzcnNoYXJlLmNvbQp8fHNzcy5jYW1wCiEtLXxodHRwOi8vY2Ru
-LnNzdGF0aWMubmV0Lwp8fHNzdG1sdC5tb2UKc3N0bWx0Lm5ldAp8fHNzdG1sdC5u
-ZXQKfGh0dHA6Ly9zdGFja292ZXJmbG93LmNvbS91c2Vycy84OTUyNDUKLnN0YWdl
-NjQuaGsKfHxzdGFnZTY0LmhrCnx8c3RhbmR1cGZvcnRpYmV0Lm9yZwpzdGFuZm9y
-ZC5lZHUvZ3JvdXAvZmFsdW4KdXNpbmZvLnN0YXRlLmdvdgp8fHN0YXR1ZW9mZGVt
-b2NyYWN5Lm9yZwouc3RhcmZpc2hmeC5jb20KLnN0YXJwMnAuY29tCnx8c3RhcnAy
-cC5jb20KLnN0YXJ0cGFnZS5jb20KfHxzdGFydHBhZ2UuY29tCi5zdGFydHVwbGl2
-aW5nY2hpbmEuY29tCnxodHRwOi8vc3RhcnR1cGxpdmluZ2NoaW5hLmNvbQp8fHN0
-YXRpYy1lY29ub21pc3QuY29tCnx8c3RjLmNvbS5zYQp8fHN0ZWVsLXN0b3JtLmNv
-bQouc3RlZ2Fub3MuY29tCnx8c3RlZ2Fub3MuY29tCi5zdGVnYW5vcy5uZXQKLnN0
-ZXBjaGluYS5jb20KIS0tfHxzdGVwbWFuaWEuY29tCm55LnN0Z2xvYmFsbGluay5j
-b20KaGQuc3RoZWFkbGluZS5jb20vbmV3cy9yZWFsdGltZQpzdGhvby5jb20KfHxz
-dGhvby5jb20KLnN0aWNrYW0uY29tCnN0aWNrZXJhY3Rpb24uY29tL3Nlc2F3ZQou
-c3RpbGVwcm9qZWN0LmNvbQouc3RvLmNjCi5zdG9wb3JnYW5oYXJ2ZXN0aW5nLm9y
-Zwp8fHN0b3JhZ2VuZXdzbGV0dGVyLmNvbQouc3Rvcm0ubWcKfHxzdG9ybS5tZwou
-c3RvcHRpYmV0Y3Jpc2lzLm5ldAp8fHN0b3B0aWJldGNyaXNpcy5uZXQKfHxzdG9y
-aWZ5LmNvbQouc3Rvcm1tZWRpYWdyb3VwLmNvbQp8fHN0b3dlYm95ZC5jb20Kc3Ry
-YW5hYmcuY29tCnx8c3RyYXBsZXNzZGlsZG8uY29tCnx8c3RyZWFtaW5ndGhlLm5l
-dApzdHJlZW1hLmNvbS90di9OVERUVl9DaGluZXNlCmNuLnN0cmVldHZvaWNlLmNv
-bS9hcnRpY2xlCmNuLnN0cmVldHZvaWNlLmNvbS9kaWFyeQpjbjIuc3RyZWV0dm9p
-Y2UuY29tCnR3LnN0cmVldHZvaWNlLmNvbQouc3RyaWtpbmdseS5jb20KfHxzdHJv
-bmd2cG4uY29tCi5zdHJvbmd3aW5kcHJlc3MuY29tCi5zdHVkZW50LnR3L2RiCnx8
-c3R1ZGVudHNmb3JhZnJlZXRpYmV0Lm9yZwp8fHN0dW1ibGV1cG9uLmNvbQpzdHVw
-aWR2aWRlb3MuY29tCi5zdWNjZXNzZm4uY29tCnBhbmFtYXBhcGVycy5zdWVkZGV1
-dHNjaGUuZGUKLnN1Z2Fyc3luYy5jb20KfHxzdWdhcnN5bmMuY29tCi5zdWdvYmJz
-LmNvbQp8fHN1Z3VtaXJ1MTguY29tCnx8c3Vpc3NsLmNvbQpzdW1taWZ5LmNvbQou
-c3VtcmFuZG8uY29tCnx8c3VtcmFuZG8uY29tCnN1bjE5MTEuY29tCi5zdW5wb3Ju
-by5jb20KfHxzdW5tZWRpYS5jYQp8fHN1bnBvcm5vLmNvbQouc3Vuc2t5Zm9ydW0u
-Y29tCi5zdW50YS5jb20udHcKLnN1bnZwbi5uZXQKLnN1b2x1by5vcmcKLnN1cGVy
-ZnJlZXZwbi5jb20KLnN1cGVydnBuLm5ldAp8fHN1cGVydnBuLm5ldAouc3VwZXJ6
-b29pLmNvbQp8aHR0cDovL3N1cGVyem9vaS5jb20KLnN1cHBpZy5uZXQKLnN1cHJl
-bWVtYXN0ZXJ0di5jb20KfGh0dHA6Ly9zdXByZW1lbWFzdGVydHYuY29tCi5zdXJm
-ZWFzeS5jb20KfHxzdXJmZWFzeS5jb20KLnN1cmZlYXN5LmNvbS5hdQp8aHR0cDov
-L3N1cmZlYXN5LmNvbS5hdQp8fHN1cnJlbmRlcmF0MjAubmV0Ci5zdXlhbmdnLmNv
-bQp8aHR0cDovL3N1eWFuZ2cuY29tCi5zdnNmeC5jb20KLnN3aXNzaW5mby5jaAp8
-fHN3aXNzaW5mby5jaAouc3dpc3N2cG4ubmV0Cnx8c3dpc3N2cG4ubmV0CnN3aXRj
-aHZwbi5uZXQKfHxzd2l0Y2h2cG4ubmV0Ci5zeWRuZXl0b2RheS5jb20KfHxzeWRu
-ZXl0b2RheS5jb20KLnN5bGZvdW5kYXRpb24ub3JnCnx8c3luY2JhY2suY29tCnN5
-c3Jlc2NjZC5vcmcKLnN5dGVzLm5ldApibG9nLnN5eDg2LmNvbS8yMDA5LzA5L3B1
-ZmYKYmxvZy5zeXg4Ni5jbi8yMDA5LzA5L3B1ZmYKLnN6YmJzLm5ldAouc3pldG93
-YWgub3JnLmhrCgohLS0tLS0tLS0tLS0tLS0tLS0tLS1UVC0tLS0tLS0tLS0tLS0t
-LS0tLS0tLS0tLS0KfHx0LWcuY29tCi50MzUuY29tCi50NjZ5LmNvbQp8fHQ2Nnku
-Y29tCi50YWEtdXNhLm9yZwp8aHR0cDovL3RhYS11c2Eub3JnCi50YWF6ZS50dwp8
-fHRhYXplLnR3CnxodHRwOi8vd3d3LnRhYmxlc2dlbmVyYXRvci5jb20vCnRhYnR0
-ZXIuanAKLnRhY2VtLm9yZwoudGFjb25ldC5jb20udHcKfHx0YWVkcC5vcmcudHcK
-LnRhZm0ub3JnCi50YWd3YS5vcmcuYXUKdGFnd2Fsay5jb20KfHx0YWd3YWxrLmNv
-bQp0YWhyLm9yZy50dwoudGFpcGVpc29jaWV0eS5vcmcKfHx0YWlwZWlzb2NpZXR5
-Lm9yZwoudGFpd2FuYmlibGUuY29tCi50YWl3YW5jb24uY29tCi50YWl3YW5kYWls
-eS5uZXQKfHx0YWl3YW5kYWlseS5uZXQKLnRhaXdhbmRjLm9yZwohLS18fHRhaXdh
-bmVtYmFzc3kub3JnCi50YWl3YW5qdXN0aWNlLmNvbQp0YWl3YW5raXNzLmNvbQp0
-YWl3YW5uYXRpb24uY29tCnRhaXdhbm5hdGlvbi5jb20udHcKfHx0YWl3YW5uY2Yu
-b3JnLnR3Cnx8dGFpd2FubmV3cy5jb20udHcKfGh0dHA6Ly93d3cudGFpd2Fub25s
-aW5lLmNjLwohLS18fHRhaXdhbnRvZGF5LnR3CnRhaXdhbnRwLm5ldAp8fHRhaXdh
-bnR0Lm9yZy50dwp0YWl3YW51cy5uZXQKdGFpd2FueWVzLmNvbQp0YWl3YW4tc2V4
-LmNvbQoudGFsazg1My5jb20KLnRhbGtib3hhcHAuY29tCnx8dGFsa2JveGFwcC5j
-b20KLnRhbGtjYy5jb20KfHx0YWxrY2MuY29tCi50YWxrb25seS5uZXQKfHx0YWxr
-b25seS5uZXQKfHx0YW1pYW9kZS50awp8fHRhbmMub3JnCnRhbmdiZW4uY29tCi50
-YW5ncmVuLnVzCi50YW9pc20ubmV0CnxodHRwOi8vdGFvaXNtLm5ldAoudGFvbHVu
-LmluZm8KfHx0YW9sdW4uaW5mbwoudGFwYXRhbGsuY29tCnx8dGFwYXRhbGsuY29t
-CmJsb2cudGFyYWdhbmEuY29tCi50YXNjbi5jb20uYXUKfHx0YXVwLm5ldAp8aHR0
-cDovL3d3dy50YXVwLm9yZy50dwoudGF3ZWV0LmNvbQp8fHRhd2VldC5jb20KLnRi
-Y29sbGVnZS5vcmcKfHx0YmNvbGxlZ2Uub3JnCi50Ymkub3JnLmhrCi50Ymljbi5v
-cmcKLnRianl0Lm9yZwp8fHRicGljLmluZm8KLnRicmMub3JnCnRicy1yYWluYm93
-Lm9yZwoudGJzZWMub3JnCnx8dGJzZWMub3JnCnRic2traW5hYmFsdS5wYWdlLnRs
-Ci50YnNtYWxheXNpYS5vcmcKLnRic24ub3JnCnx8dGJzbi5vcmcKLnRic3NlYXR0
-bGUub3JnCi50YnNzcWgub3JnCnxodHRwOi8vdGJzc3FoLm9yZwp0YnN3ZC5vcmcK
-LnRidGVtcGxlLm9yZy51awoudGJ0aG91c3Rvbi5vcmcKLnRjY3dvbmxpbmUub3Jn
-Ci50Y2V3Zi5vcmcKdGNocmQub3JnCnRjbnluai5vcmcKfHx0Y3BzcGVlZC5jbwou
-dGNwc3BlZWQuY29tCnx8dGNwc3BlZWQuY29tCi50Y3NvZmJjLm9yZwoudGNzb3Zp
-Lm9yZwoudGRtLmNvbS5tbwp0ZWFtYW1lcmljYW55LmNvbQohLS1PVkgKfHx0ZWNo
-dml6Lm5ldAp8fHRlY2suaW4KLnRlZW5pZWZ1Y2submV0CnRlZW5zaW5hc2lhLmNv
-bQoudGVsZWNvbXNwYWNlLmNvbQp8fHRlbGVncmFwaC5jby51awoudGVuYWN5LmNv
-bQp8fHRlbnppbnBhbG1vLmNvbQoudGV3Lm9yZwoudGhhaWNuLmNvbQp8fHRoZWF0
-cnVtLWJlbGxpLmNvbQp0aGVibGVtaXNoLmNvbQp8fHRoZWJjb21wbGV4LmNvbQou
-dGhlYm9icy5jb20KfHx0aGVib2JzLmNvbQoudGhlY2hpbmFiZWF0Lm9yZwp8aHR0
-cDovL3d3dy50aGVjaGluYXN0b3J5Lm9yZy95ZWFyYm9va3MveWVhcmJvb2stMjAx
-Mi8KLnRoZWRhbGFpbGFtYW1vdmllLmNvbQp8aHR0cDovL3RoZWRhbGFpbGFtYW1v
-dmllLmNvbQp8fHRoZWR3LnVzCnRoZWZyb250aWVyLmhrL3RmCmNuLnRoZWdheS5j
-b20KfGh0dHA6Ly90aGVnaW9pdGluaG9jLnZuLwoudGhlZ2x5LmNvbQoudGhlaG90
-cy5pbmZvCnRoZWhvdXNlbmV3cy5jb20KfHx0aGVodW4ubmV0Ci50aGVpbml0aXVt
-LmNvbQp8fHRoZWluaXRpdW0uY29tCi50aGVuZXdzbGVucy5jb20KfHx0aGVuZXdz
-bGVucy5jb20KLnRoZXBpcmF0ZWJheS5vcmcKfHx0aGVwaXJhdGViYXkub3JnCiEt
-LXx8dGhlcGlyYXRlYmF5LnNlCi50aGVwb3JuZHVkZS5jb20KfHx0aGVwb3JuZHVk
-ZS5jb20KfHx0aGVwb3J0YWx3aWtpLmNvbQp0aGVyZWFsbG92ZS5rcgp0aGVyb2Nr
-Lm5ldC5uegp0aGVzcGVlZGVyLmNvbQp8fHRoZXN0YW5kbmV3cy5jb20KdGhldGli
-ZXRjZW50ZXIub3JnCnRoZXRpYmV0Y29ubmVjdGlvbi5vcmcKLnRoZXRpYmV0bXVz
-ZXVtLm9yZwoudGhldGliZXRwb3N0LmNvbQp8fHRoZXRpYmV0cG9zdC5jb20KIS0t
-VG9yCnx8dGhldGluaGF0LmNvbQp0aGV0cm90c2t5bW92aWUuY29tCnRoZXZpdmVr
-c3BvdC5jb20KfHx0aGV3Z28ub3JnCi50aGV5bmMuY29tCnxodHRwOi8vdGhleW5j
-LmNvbQoudGhpbmtpbmd0YWl3YW4uY29tCi50aGlzYXYuY29tCnxodHRwOi8vdGhp
-c2F2LmNvbQoudGhsaWIub3JnCnx8dGhvbWFzYmVybmhhcmQub3JnCi50aG9uZ2Ry
-ZWFtcy5jb20KdGhyZWF0Y2hhb3MuY29tCnx8dGhyb3VnaG5pZ2h0c2ZpcmUuY29t
-Ci50aHVtYnppbGxhLmNvbQp8fHRoeXdvcmRzLmNvbQoudGh5d29yZHMuY29tLnR3
-CnRpYW5hbm1lbm1vdGhlci5vcmcKLnRpYW5hbm1lbmR1aXpoaS5jb20KfHx0aWFu
-YW5tZW5kdWl6aGkuY29tCnx8dGlhbmFubWVudW5pdi5jb20KfHx0aWFuYW5tZW51
-bml2Lm5ldAp8fHRpYW5kaXhpbmcub3JnCi50aWFuaHVheXVhbi5jb20KLnRpYW5s
-YXdvZmZpY2UuY29tCnx8dGlhbnRpLmlvCnRpYW50aWJvb2tzLm9yZwp8fHRpYW50
-aWJvb2tzLm9yZwp0aWFueWFudG9uZy5vcmcuY24KLnRpYW56aHUub3JnCi50aWJl
-dC5hdAp0aWJldC5jYQoudGliZXQuY29tCnx8dGliZXQuY29tCnRpYmV0LmZyCi50
-aWJldC5uZXQKfHx0aWJldC5uZXQKdGliZXQubnUKLnRpYmV0Lm9yZwp8fHRpYmV0
-Lm9yZwoudGliZXQuc2sKdGliZXQub3JnLnR3Ci50aWJldC50bwoudGliZXQtZW52
-b3kuZXUKfHx0aWJldC1lbnZveS5ldQoudGliZXQtZm91bmRhdGlvbi5vcmcKLnRp
-YmV0LWhvdXNlLXRydXN0LmNvLnVrCnRpYmV0LWluZm8ubmV0CnRpYmV0LWluaXRp
-YXRpdmUuZGUKfHx0aWJldC1pbml0aWF0aXZlLmRlCi50aWJldC1tdW5pY2guZGUK
-LnRpYmV0M3JkcG9sZS5vcmcKfGh0dHA6Ly90aWJldDNyZHBvbGUub3JnCnRpYmV0
-YWN0aW9uLm5ldAp8fHRpYmV0YWN0aW9uLm5ldAoudGliZXRhaWQub3JnCnRpYmV0
-YWxrLmNvbQoudGliZXRhbi5mcgp0aWJldGFuLWFsbGlhbmNlLm9yZwoudGliZXRh
-bmFydHMub3JnCi50aWJldGFuYnVkZGhpc3RpbnN0aXR1dGUub3JnCnxodHRwOi8v
-dGliZXRhbmJ1ZGRoaXN0aW5zdGl0dXRlLm9yZwp0aWJldGFuY29tbXVuaXR5Lm9y
-ZwoudGliZXRhbmpvdXJuYWwuY29tCi50aWJldGFubGFuZ3VhZ2Uub3JnCi50aWJl
-dGFubGliZXJhdGlvbi5vcmcKfHx0aWJldGFubGliZXJhdGlvbi5vcmcKLnRpYmV0
-Y29sbGVjdGlvbi5jb20KLnRpYmV0YW5haWRwcm9qZWN0Lm9yZwoudGliZXRhbmNv
-bW11bml0eXVrLm5ldAp8aHR0cDovL3RpYmV0YW5jb21tdW5pdHl1ay5uZXQKdGli
-ZXRhbmN1bHR1cmUub3JnCnRpYmV0YW5mZW1pbmlzdGNvbGxlY3RpdmUub3JnCi50
-aWJldGFucGFpbnRpbmdzLmNvbQoudGliZXRhbnBob3RvcHJvamVjdC5jb20KLnRp
-YmV0YW5wb2xpdGljYWxyZXZpZXcub3JnCi50aWJldGFucmV2aWV3Lm5ldAp8aHR0
-cDovL3RpYmV0YW5zcG9ydHMub3JnCi50aWJldGFud29tZW4ub3JnCnxodHRwOi8v
-dGliZXRhbndvbWVuLm9yZwoudGliZXRhbnlvdXRoLm9yZwoudGliZXRhbnlvdXRo
-Y29uZ3Jlc3Mub3JnCnx8dGliZXRhbnlvdXRoY29uZ3Jlc3Mub3JnCi50aWJldGNo
-YXJpdHkuZGsKdGliZXRjaGFyaXR5LmluCi50aWJldGNoaWxkLm9yZwoudGliZXRj
-aXR5LmNvbQoudGliZXRjb3Jwcy5vcmcKLnRpYmV0ZXhwcmVzcy5uZXQKfGh0dHA6
-Ly90aWJldGV4cHJlc3MubmV0CnRpYmV0Zm9jdXMuY29tCnRpYmV0ZnVuZC5vcmcK
-LnRpYmV0Z2VybWFueS5jb20KfHx0aWJldGdlcm1hbnkuZGUKLnRpYmV0aGF1cy5j
-b20KLnRpYmV0aGVyaXRhZ2VmdW5kLm9yZwp0aWJldGhvdXNlLmpwCnRpYmV0aG91
-c2Uub3JnCnx8dGliZXRob3VzZS51cwoudGliZXRpbmZvbmV0Lm5ldAoudGliZXRq
-dXN0aWNlLm9yZwoudGliZXRrb21pdGUuZGsKfGh0dHA6Ly90aWJldG11c2V1bS5v
-cmcKdGliZXRuZXR3b3JrLm9yZwp8fHRpYmV0bmV0d29yay5vcmcKLnRpYmV0b2Zm
-aWNlLmNoCnxodHRwOi8vdGliZXRvZmZpY2UuY2gKdGliZXRvZmZpY2UuZXUKdGli
-ZXRvZmZpY2Uub3JnCnRpYmV0b25saW5lLmNvbQp8fHRpYmV0b25saW5lLmNvbQou
-dGliZXRvZmZpY2UuY29tLmF1CnxodHRwOi8vdGliZXRvZmZpY2UuY29tLmF1Cnx8
-dGliZXRvbmxpbmUudHYKLnRpYmV0b25saW5lLnR2Ci50aWJldG9yYWxoaXN0b3J5
-Lm9yZwp8aHR0cDovL3RpYmV0b3JhbGhpc3Rvcnkub3JnCi50aWJldHBvbGljeS5l
-dQoudGliZXRyZWxpZWZmdW5kLmNvLnVrCnRpYmV0c2l0ZXMuY29tCi50aWJldHNv
-Y2lldHkuY29tCnx8dGliZXRzb2NpZXR5LmNvbQoudGliZXRzdW4uY29tCi50aWJl
-dHN1cHBvcnRncm91cC5vcmcKfGh0dHA6Ly90aWJldHN1cHBvcnRncm91cC5vcmcK
-LnRpYmV0c3dpc3MuY2gKLnRpYmV0dGVsZWdyYXBoLmNvbQp0aWJldHRpbWVzLm5l
-dAp8fHRpYmV0d3JpdGVzLm9yZwoudGlja2V0LmNvbS50dwoudGlnZXJ2cG4uY29t
-Cnx8dGlnZXJ2cG4uY29tCi50aW1kaXIuY29tCnxodHRwOi8vdGltZGlyLmNvbQou
-dGltZS5jb20KfGh0dHA6Ly90aW1lLmNvbQohLS0udGltZS5jb20vdGltZS90aW1l
-MTAwL2xlYWRlcnMvcHJvZmlsZS9yZWJlbAohLS0udGltZS5jb20vdGltZS9zcGVj
-aWFscy9wYWNrYWdlcy9hcnRpY2xlLzAsMjg4MDQKIS0tLnRpbWUuY29tL3RpbWUv
-bWFnYXppbmUKLnRpbXNhaC5jb20KfHxibG9nLnRpbmV5LmNvbQp0aW50dWMxMDEu
-Y29tCi50aW55LmNjCnxodHRwOi8vdGlueS5jYwp0aW55Y2hhdC5jb20KfHx0aW55
-cGFzdGUuY29tCi50aXN0b3J5LmNvbQp8fHRrY3MtY29sbGlucy5jb20KLnRtYWdh
-emluZS5jb20KfHx0bWFnYXppbmUuY29tCi50bWRmaXNoLmNvbQp8aHR0cDovL3Rt
-aS5tZQoudG1wcC5vcmcKfGh0dHA6Ly90bXBwLm9yZwoudG5hZmxpeC5jb20KfHx0
-bmFmbGl4LmNvbQoudG5ncm5vdy5jb20KLnRuZ3Jub3cubmV0Ci50bnAub3JnCnxo
-dHRwOi8vdG5wLm9yZwoudG8tcG9ybm8uY29tCnx8dG8tcG9ybm8uY29tCnRvZ2V0
-dGVyLmNvbQoudG9reW8tMjQ3LmNvbQoudG9reW8taG90LmNvbQp8fHRva3lvLXBv
-cm4tdHViZS5jb20KfHx0b2t5b2NuLmNvbQp0dy50b21vbmV3cy5uZXQKLnRvbmdp
-bC5vci5rcgoudG9uby1va2EuanAKdG9ueXlhbi5uZXQKLnRvb2RvYy5jb20KdG9v
-bmVsLm5ldAp0b3A4MS53cwoudG9wbmV3cy5pbgoudG9wcG9ybnNpdGVzLmNvbQp8
-aHR0cDovL3RvcHBvcm5zaXRlcy5jb20KLnRvcmd1YXJkLm5ldAp8fHRvcmd1YXJk
-Lm5ldAp8fHRvcC50dgoudG9wc2hhcmV3YXJlLmNvbQoudG9wc3kuY29tCnx8dG9w
-c3kuY29tCnx8dG9wdGlwLmNhCnRvcmEudG8KLnRvcmNuLmNvbQoudG9ycHJvamVj
-dC5vcmcKfHx0b3Jwcm9qZWN0Lm9yZwp0b3JyZW50cHJpdmFjeS5jb20KfHx0b3Jy
-ZW50cHJpdmFjeS5jb20KfGh0dHA6Ly90b3JyZW50cHJvamVjdC5zZQp8fHRvcnJl
-bnR5Lm9yZwp8fHRvcnJlbnR6LmV1Cnx8dG9ydnBuLmNvbQp8fHRvdGFsdnBuLmNv
-bQoudG91dGlhb2FiYy5jb20KdG93bmdhaW4uY29tCnRveXBhcmsuaW4KdG95dHJh
-Y3RvcnNob3cuY29tCi50cGFyZW50cy5vcmcKLnRwaS5vcmcudHcKfHx0cGkub3Jn
-LnR3CnRyYWZmaWNoYXVzLmNvbQp8fHRyYW5zcGFyZW5jeS5vcmcKfHx0cmVlbWFs
-bC5jb20udHcKdHJlbmRzbWFwLmNvbQp8fHRyZW5kc21hcC5jb20KLnRyaWFsb2Zj
-Y3Aub3JnCnx8dHJpYWxvZmNjcC5vcmcKLnRyaW1vbmRpLmRlL1NETEUKLnRyb3V3
-Lm5sCnxodHRwOi8vdHJvdXcubmwKLnRydC5uZXQudHIKdHJ0Yy5jb20udHcKLnRy
-dWVidWRkaGEtbWQub3JnCnxodHRwOi8vdHJ1ZWJ1ZGRoYS1tZC5vcmcKdHJ1bHll
-cmdvbm9taWMuY29tCi50cnV0aDEwMS5jby50dgp8aHR0cDovL3RydXRoMTAxLmNv
-LnR2Ci50cnV0aG9udG91ci5vcmcKfGh0dHA6Ly90cnV0aG9udG91ci5vcmcKLnRy
-dXZlby5jb20KLnRzY3R2Lm5ldAoudHNlbXR1bGt1LmNvbQp0c3F1YXJlLnR2Ci50
-c3Uub3JnLnR3CnRzdW5hZ2FydW1vbi5jb20KIS0tfGh0dHA6Ly93d3cudHN1cnUt
-YmlyZC5uZXQvCi50c2N0di5uZXQKfHx0dDEwNjkuY29tCi50dHRhbi5jb20KfHx0
-dHRhbi5jb20KYmIudHR2LmNvbS50dy9iYgp0dTg5NjQuY29tCi50dWJhaG9saWMu
-Y29tCi50dWJlLmNvbQp0dWJlOC5jb20KfHx0dWJlOC5jb20KLnR1YmU5MTEuY29t
-Cnx8dHViZTkxMS5jb20KLnR1YmVjdXAuY29tCi50dWJlZ2Fscy5jb20KLnR1YmVp
-c2xhbS5jb20KfGh0dHA6Ly90dWJlaXNsYW0uY29tCi50dWJlc3RhY2suY29tCnx8
-dHViZXdvbGYuY29tCi50dWliZWl0dS5uZXQKdHVpZGFuZy5uZXQKLnR1aWRhbmcu
-b3JnCnx8dHVpZGFuZy5vcmcKLnR1aWRhbmcuc2UKYmJzLnR1aXR1aS5pbmZvCi50
-dW11dGFuemkuY29tCnxodHRwOi8vdHVtdXRhbnppLmNvbQp8fHR1bXZpZXcuY29t
-Ci50dW5laW4uY29tCnxodHRwOi8vdHVuZWluLmNvbQp8fHR1bm5lbGJlYXIuY29t
-Ci50dW5uZWxyLmNvbQp8fHR1bm5lbHIuY29tCi50dW84LmJsdWUKfHx0dW84LmJs
-dWUKLnR1bzguY2MKLnR1bzguY2x1Ygp8fHR1bzguY2x1YgoudHVvOC5maXQKLnR1
-bzguaGsKLnR1bzguaW4KLnR1bzgubmluamEKLnR1bzgub3JnCnx8dHVvOC5maXQK
-fHx0dW84Lm9yZwoudHVvOC5wdwp8aHR0cDovL3R1bzgucHcKfHx0dW84LnJlZAou
-dHVvOC5zcGFjZQp0dWl0d2l0LmNvbQoudHVyYW5zYW0ub3JnCi50dXJib2JpdC5u
-ZXQKfGh0dHA6Ly90dXJib2JpdC5uZXQKLnR1cmJvaGlkZS5jb20KfHx0dXJib2hp
-ZGUuY29tCi50dXNoeWNhc2guY29tCnxodHRwOi8vdHVzaHljYXNoLmNvbQp8fGFw
-cC50dXRhbm90YS5jb20KLnR1dnBuLmNvbQp8fHR1dnBuLmNvbQp8aHR0cDovL3R1
-emFpamlkaS5jb20KfGh0dHA6Ly8qLnR1emFpamlkaS5jb20KLnR3MDEub3JnCnxo
-dHRwOi8vdHcwMS5vcmcKCiEtLS1UdW1ibHItLS0KLnR1bWJsci5jb20KfHx0dW1i
-bHIuY29tCiEtLUBAfHxhc3NldHMudHVtYmxyLmNvbQohLS1AQHx8ZGF0YS50dW1i
-bHIuY29tCiEtLUBAfHxtZWRpYS50dW1ibHIuY29tCiEtLUBAfHxzdGF0aWMudHVt
-YmxyLmNvbQohLS1AQHx8d3d3LnR1bWJsci5jb20KfHxsZWNsb3VkLm5ldAp8aHR0
-cDovL2Nvc21pYy5tb25hci5jaAp8fHNsdXRtb29uYmVhbS5jb20KfGh0dHA6Ly9i
-bG9nLnNveWxlbnQuY29tCgoudHYuY29tCnxodHRwOi8vdHYuY29tCnR2YW50cy5j
-b20KZm9ydW0udHZiLmNvbQpuZXdzLnR2Yi5jb20vbGlzdC93b3JsZApuZXdzLnR2
-Yi5jb20vbG9jYWwKbmV3cy50dmJzLmNvbS50dwoudHZib3hub3cuY29tCnxodHRw
-Oi8vdHZib3hub3cuY29tLwp0dmlkZXIuY29tCi50dm1vc3QuY29tLmhrCi50dnBs
-YXl2aWRlb3MuY29tCnx8dHZ1bmV0d29ya3MuY29tCi50dy1ibG9nLmNvbQp8aHR0
-cHM6Ly90dy1ibG9nLmNvbQoudHctbnBvLm9yZwoudHdhaXR0ZXIuY29tCnR3YXBw
-ZXJrZWVwZXIuY29tCnx8dHdhcHBlcmtlZXBlci5jb20KfHx0d2F1ZC5pbwoudHdh
-dWQuaW8KLnR3YXZpLmNvbQoudHdiYnMubmV0LnR3CnR3YmJzLm9yZwp0d2Jicy50
-dwp8fHR3YmxvZ2dlci5jb20KdHdlZXBtYWcuY29tCi50d2VlcG1sLm9yZwp8fHR3
-ZWVwbWwub3JnCi50d2VldGJhY2t1cC5jb20KfHx0d2VldGJhY2t1cC5jb20KdHdl
-ZXRib2FyZC5jb20KfHx0d2VldGJvYXJkLmNvbQoudHdlZXRib25lci5iaXoKfHx0
-d2VldGJvbmVyLmJpegoudHdlZXRjcy5jb20KfGh0dHA6Ly90d2VldGNzLmNvbQp8
-aHR0cDovL2RlY2subHkKIS0tIE9wZXJhdGlvbiBkaXNjb250aW51ZWQKIS0tfHx0
-d2VldGUubmV0CiEtLW0udHdlZXRlLm5ldAp8fG10dy50bAp8fHR3ZWV0ZWR0aW1l
-cy5jb20KIS0tIE9wZXJhdGlvbiBkaXNjb250aW51ZWQKIS0tdHdlZXRtZW1lLmNv
-bQp8fHR3ZWV0bXlsYXN0LmZtCnR3ZWV0cGhvdG8uY29tCnx8dHdlZXRwaG90by5j
-b20KfHx0d2VldHJhbnMuY29tCnR3ZWV0cmVlLmNvbQp8fHR3ZWV0cmVlLmNvbQou
-dHdlZXR0dW5uZWwuY29tCnx8dHdlZXR0dW5uZWwuY29tCnx8dHdlZXR3YWxseS5j
-b20KdHdlZXR5bWFpbC5jb20KfHx0d2VsdmUudG9kYXkKLnR3ZWV6Lm5ldAp8aHR0
-cDovL3R3ZWV6Lm5ldAp8fHR3ZnRwLm9yZwp8fHR3Z3JlYXRkYWlseS5jb20KdHdp
-YmFzZS5jb20KLnR3aWJibGUuZGUKfHx0d2liYmxlLmRlCnR3aWJib24uY29tCnx8
-dHdpYnMuY29tCi50d2ljb3VudHJ5Lm9yZwp8aHR0cDovL3R3aWNvdW50cnkub3Jn
-CnR3aWNzeS5jb20KLnR3aWVuZHMuY29tCnxodHRwOi8vdHdpZW5kcy5jb20KLnR3
-aWZhbi5jb20KfGh0dHA6Ly90d2lmYW4uY29tCnR3aWZmby5jb20KfHx0d2lmZm8u
-Y29tCi50d2lsaWdodHNleC5jb20KdHdpbG9nLm9yZwp0d2ltYm93LmNvbQp8fHR3
-aW5kZXh4LmNvbQp0d2lwcGxlLmpwCnx8dHdpcHBsZS5qcAp8fHR3aXAubWUKdHdp
-c2hvcnQuY29tCnx8dHdpc2hvcnQuY29tCnR3aXN0YXIuY2MKfHx0d2lzdGVyLm5l
-dC5jbwp8fHR3aXN0ZXJpby5jb20KdHdpc3Rlcm5vdy5jb20KdHdpc3RvcnkubmV0
-CnR3aXRicm93c2VyLm5ldAp8fHR3aXRjYXVzZS5jb20KfHx0d2l0Z2V0aGVyLmNv
-bQp8fHR3aWdnaXQub3JnCnR3aXRnb28uY29tCnR3aXRpcS5jb20KfHx0d2l0aXEu
-Y29tCi50d2l0bG9uZ2VyLmNvbQp8fHR3aXRsb25nZXIuY29tCnxodHRwOi8vdGwu
-Z2QvCnR3aXRtYW5pYS5jb20KdHdpdG9hc3Rlci5jb20KfHx0d2l0b2FzdGVyLmNv
-bQp8fHR3aXRvbm1zbi5jb20KIS0tU2FtZSBJUAoudHdpdDJkLmNvbQp8fHR3aXQy
-ZC5jb20KLnR3aXRzdGF0LmNvbQp8fHR3aXRzdGF0LmNvbQp8fGZpcnN0Zml2ZWZv
-bGxvd2Vycy5jb20KfHxyZXR3ZWV0ZWZmZWN0LmNvbQp8fHR3ZWVwbGlrZS5tZQp8
-fHR3ZWVwZ3VpZGUuY29tCnx8dHVyYm90d2l0dGVyLmNvbQoudHdpdHZpZC5jb20K
-fHx0d2l0dmlkLmNvbQp8aHR0cDovL3R3dC50bAp0d2l0dGJvdC5uZXQKfHxhZHMt
-dHdpdHRlci5jb20KfHx0d3R0ci5jb20KfHx0d2l0dGVyNGoub3JnCi50d2l0dGVy
-Y291bnRlci5jb20KfHx0d2l0dGVyY291bnRlci5jb20KdHdpdHRlcmZlZWQuY29t
-Ci50d2l0dGVyZ2FkZ2V0LmNvbQp8fHR3aXR0ZXJnYWRnZXQuY29tCi50d2l0dGVy
-a3IuY29tCnx8dHdpdHRlcmtyLmNvbQp8fHR3aXR0ZXJtYWlsLmNvbQp8fHR3aXR0
-ZXJyaWZpYy5jb20KdHdpdHRlcnRpbS5lcwp8fHR3aXR0ZXJ0aW0uZXMKdHdpdHRo
-YXQuY29tCnx8dHdpdHR1cmsuY29tCi50d2l0dHVybHkuY29tCnx8dHdpdHR1cmx5
-LmNvbQoudHdpdHphcC5jb20KdHdpeWlhLmNvbQp8fHR3c3Rhci5uZXQKLnR3dGty
-LmNvbQp8aHR0cDovL3R3dGtyLmNvbQoudHdub3J0aC5vcmcudHcKdHdza3lwZS5j
-b20KdHd0cmxhbmQuY29tCnR3dXJsLm5sCi50d3lhYy5vcmcKfHx0d3lhYy5vcmcK
-LnR4eHguY29tCi50eWNvb2wuY29tCnx8dHljb29sLmNvbQoKIS0tdHlwZXBhZAp8
-fHR5cGVwYWQuY29tCkBAfHx3d3cudHlwZXBhZC5jb20KQEB8fHN0YXRpYy50eXBl
-cGFkLmNvbQp8fGJsb2cuZXhwb2Z1dHVyZXMuY29tCnx8bGVnYWx0ZWNoLmxhdy5j
-b20KfHxibG9ncy50YW1wYWJheS5jb20KfHxjb250ZXN0cy50d2lsaW8uY29tCiEt
-bGF3cHJvZmVzc29ycy50eXBlcGFkLmNvbS9jaGluYV9sYXdfcHJvZgoKIS0tLS0t
-LS0tLS0tLS1Ud2l0ZXNlLS0tLS0KLmVtYnIuaW4KfHxlbWJyLmluCgohLS0tLS0t
-LS0tLS0tLS0tLS0tLS1VVS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KLnU5dW4u
-Y29tCnx8dTl1bi5jb20KLnViZGRucy5vcmcKfGh0dHA6Ly91YmRkbnMub3JnCnx8
-dWJlcnByb3h5Lm5ldAoudWMtamFwYW4ub3JnCnx8dWMtamFwYW4ub3JnCi5zcmNm
-LnVjYW0ub3JnL3NhbG9uLwp8aHR0cDovL2NoaW5hLnVjYW5ld3MuY29tLwp8fHVj
-ZGMxOTk4Lm9yZwp8aHR0cDovL2h1bSoudWNoaWNhZ28uZWR1L2ZhY3VsdHkveXdh
-bmcvaGlzdG9yeQp8fHVkZXJ6by5pdAoudWRuLmNvbQp8fHVkbi5jb20KfHx1ZG4u
-Y29tLnR3CnVkbmJray5jb20vYmJzCnx8dWZvcmFkaW8uY29tLnR3CnVmcmVldnBu
-LmNvbQoudWdvLmNvbQohLS1naHMKfHx1aGR3YWxscGFwZXJzLm9yZwp8fHVocnAu
-b3JnCi51aWdodXIubmwKfHx1aWdodXIubmwKdWlnaHVyYml6Lm5ldAoudWxpa2Uu
-bmV0CnVrY2RwLmNvLnVrCnVrbGlmZXJhZGlvLmNvLnVrCnx8dWtsaWZlcmFkaW8u
-Y28udWsKdWx0cmF2cG4uZnIKfHx1bHRyYXZwbi5mcgp1bHRyYXhzLmNvbQp1bWlj
-aC5lZHUvfmZhbHVuCnx8dW5ibG9jay5jbi5jb20KLnVuYmxvY2tlci55dAp1bmJs
-b2NrLXVzLmNvbQp8fHVuYmxvY2stdXMuY29tCi51bmJsb2NrZG1tLmNvbQp8aHR0
-cDovL3VuYmxvY2tkbW0uY29tCnx8dW5ibG9ja3NpdC5lcwp1bmN5Y2xvbWVkaWEu
-b3JnCi51bmN5Y2xvcGVkaWEuaGsvd2lraQp8aHR0cDovL3VuY3ljbG9wZWRpYS5o
-awohLS11bmN5Y2xvcGVkaWEuaW5mbwp8aHR0cDovL3VuY3ljbG9wZWRpYS50dwp1
-bmRlcndvb2RhbW1vLmNvbQp8fHVuZGVyd29vZGFtbW8uY29tCnx8dW5ob2x5a25p
-Z2h0LmNvbQoudW5pLmNjCnx8Y2xkci51bmljb2RlLm9yZwoudW5pZmljYXRpb24u
-bmV0Ci51bmlmaWNhdGlvbi5vcmcudHcKfHx1bmlydWxlLmNsb3VkCi51bml0ZWRz
-b2NpYWxwcmVzcy5jb20KLnVuaXgxMDAuY29tCnx8dW5rbm93bnNwYWNlLm9yZwou
-dW5vZGVkb3MuY29tCnVucG8ub3JnCi51bnRyYWNlYWJsZS51cwp8aHR0cDovL3Vu
-dHJhY2VhYmxlLnVzCnx8dW9jbi5vcmcKdG9yLnVwZGF0ZXN0YXIuY29tCi51cGhv
-bGRqdXN0aWNlLm9yZwoudXBsb2FkNHUuaW5mbwp1cGxvYWRlZC5uZXQvZmlsZQp8
-aHR0cDovL3VwbG9hZGVkLm5ldC9maWxlCnxodHRwOi8vdXBsb2FkZWQudG8vZmls
-ZQoudXBsb2Fkc3RhdGlvbi5jb20vZmlsZQoudXBtZWRpYS5tZwp8fHVwbWVkaWEu
-bWcKLnVwb3JuaWEuY29tCnxodHRwOi8vdXBvcm5pYS5jb20KfHx1cHJveHkub3Jn
-CnxodHRwOi8vdG9yLmNuLnVwdG9kb3duLmNvbS8KLnVwd2lsbC5vcmcKdXI3cy5j
-b20KfHx1cmJhbnN1cnZpdmFsLmNvbQpteXNoYXJlLnVybC5jb20udHcvCnx8dXJs
-Ym9yZy5jb20KfHx1cmxwYXJzZXIuY29tCnVzLnRvCnx8dXNhY24uY29tCi51c2Fp
-cC5ldQp8fHVzYWlwLmV1CmRhbGFpbGFtYS51c2MuZWR1CmlpcGRpZ2l0YWwudXNl
-bWJhc3N5Lmdvdgp8fHVzZmsubWlsCnx8dXNtYS5lZHUKfHx1c21jLm1pbAoudXNv
-Y2N0bi5jb20KfGh0dHA6Ly90YXJyLnVzcHRvLmdvdi8KfHx0c2RyLnVzcHRvLmdv
-dgoudXN0cmVhbS50dgp8fHVzdHJlYW0udHYKIS0tfHx1c3R3cmFwLmluZm8KLnVz
-dW5pdGVkbmV3cy5jb20KfGh0dHA6Ly91c3VuaXRlZG5ld3MuY29tCnVzdXMuY2MK
-LnV0b3BpYW5wYWwuY29tCnx8dXRvcGlhbnBhbC5jb20KLnV1LWdnLmNvbQoudXZ3
-eHl6Lnh5egp8fHV2d3h5ei54eXoKLnV3YW50cy5jb20KLnV3YW50cy5uZXQKdXln
-aHVyLmNvLnVrCnxodHRwOi8vdXlnaHVyLWoub3JnCnx8dXlnaHVyYW1lcmljYW4u
-b3JnCi51eWdodXJjYW5hZGlhbnNvY2lldHkub3JnCi51eWdodXJlbnNlbWJsZS5j
-by51awp8fHV5Z2h1cmNvbmdyZXNzLm9yZwoudXlnaHVycGVuLm9yZwoudXlnaHVy
-cHJlc3MuY29tCnxodHRwczovL3V5Z2h1cnByZXNzLmNvbQoudXlnaHVyc3R1ZGll
-cy5vcmcKfGh0dHA6Ly91eWdodXJzdHVkaWVzLm9yZwp1eWd1ci5vcmcKfGh0dHA6
-Ly91eW1hYXJpcC5jb20vCgohLS0tLS0tLS0tLS0tLS0tLS0tLS1WVi0tLS0tLS0t
-LS0tLS0tLS0tLS0tLS0tLS0KLnYycmF5LmNvbQp8fHYycmF5LmNvbQoudmFuMDAx
-LmNvbQoudmFuNjk4LmNvbQoudmFuZW11LmNuCi52YW5pbGxhLWpwLmNvbQoudmFu
-cGVvcGxlLmNvbQp2YW5za3kuY29tCnx8dmF0aWNhbm5ld3MudmEKfHx2Y2Ytb25s
-aW5lLm9yZwp8fHZjZmJ1aWxkZXIub3JnCi52ZWdhc3JlZC5jb20KLnZlbGthZXBv
-Y2hhLnNrCi52ZW5iYnMuY29tCi52ZW5jaGluYS5jb20KLnZlbmV0aWFubWFjYW8u
-Y29tCnx8dmVuZXRpYW5tYWNhby5jb20KdmVvaC5jb20KbXlzaXRlLnZlcml6b24u
-bmV0CnZlcm1vbnR0aWJldC5vcmcKLnZlcnNhdnBuLmNvbQp8fHZlcnNhdnBuLmNv
-bQp8fHZlcnlicy5jb20KLnZmdC5jb20udHcKLnZpYmVyLmNvbQp8fHZpYmVyLmNv
-bQoudmljYS5pbmZvCi52aWN0aW1zb2Zjb21tdW5pc20ub3JnCnxodHRwOi8vdmlj
-dGltc29mY29tbXVuaXNtLm9yZwp8fHZpZC5tZQp8fHZpZGJsZS5jb20KdmlkZW9i
-YW0uY29tCnx8dmlkZW9iYW0uY29tCi52aWRlb2RldGVjdGl2ZS5jb20KLnZpZGVv
-bWVnYS50dgp8fHZpZGVvbWVnYS50dgoudmlkZW9tby5jb20KdmlkZW9wZWRpYXdv
-cmxkLmNvbQoudmlkZW9wcmVzcy5jb20KLnZpZGluZm8ub3JnL3ZpZGVvCnZpZXRk
-YWlreW5ndXllbi5jb20KLnZpamF5YXRlbXBsZS5vcmcKdmltZW8uY29tCnx8dmlt
-ZW8uY29tCnx8dmltcGVyYXRvci5vcmcKfHx2aW5jbmQuY29tCnx8dmlubmlldi5j
-b20KfGh0dHA6Ly93d3cubGliLnZpcmdpbmlhLmVkdS9hcmVhLXN0dWRpZXMvVGli
-ZXQvdGliZXQuaHRtbAoudmlydHVhbHJlYWxwb3JuLmNvbQp8fHZpcnR1YWxyZWFs
-cG9ybi5jb20KdmlzaWJsZXR3ZWV0cy5jb20KfGh0dHA6Ly9ueS52aXNpb250aW1l
-cy5jb20KLnZpdGFsMjQ3Lm9yZwp8fHZpdS5jb20KLnZpdmFoZW50YWk0dS5uZXQK
-LnZpdmF0dWJlLmNvbQoudml2dGhvbWFzLmNvbQp8fHZpdnRob21hcy5jb20KLnZq
-YXYuY29tCnx8dmphdi5jb20KLnZqbWVkaWEuY29tLmhrCi52bGxjcy5vcmcKfGh0
-dHA6Ly92bGxjcy5vcmcKfHx2bWl4Y29yZS5jb20KfHx2bmV0LmxpbmsKY24udm9h
-Lm1vYmkKdHcudm9hLm1vYmkKLnZvYWNoaW5lc2VibG9nLmNvbQp8fHZvYWNoaW5l
-c2VibG9nLmNvbQp2b2FnZC5jb20KLnZvYWNhbnRvbmVzZS5jb20KfHx2b2FjYW50
-b25lc2UuY29tCnZvYWNoaW5lc2UuY29tCnx8dm9hY2hpbmVzZS5jb20KLnZvYW5l
-d3MuY29tCnx8dm9hbmV3cy5jb20Kdm9hdGliZXRhbi5jb20KfHx2b2F0aWJldGFu
-LmNvbQoudm9hdGliZXRhbmVuZ2xpc2guY29tCnx8dm9hdGliZXRhbmVuZ2xpc2gu
-Y29tCi52b2NhdGl2LmNvbQp2b2NuLnR2Ci52b3Qub3JnCnx8dm90Lm9yZwoudm92
-bzIwMDAuY29tCnxodHRwOi8vdm92bzIwMDAuY29tCi52b3hlci5jb20KfHx2b3hl
-ci5jb20KLnZveS5jb20KfHx2cG4uYWMKLnZwbjRhbGwuY29tCnx8dnBuNGFsbC5j
-b20KLnZwbmFjY291bnQub3JnCnxodHRwOi8vdnBuYWNjb3VudC5vcmcKLnZwbmFj
-Y291bnRzLmNvbQp8fHZwbmFjY291bnRzLmNvbQoudnBuY29tcGFyaXNvbi5vcmcK
-LnZwbmN1cC5jb20KfHx2cG5jdXAuY29tCnZwbmJvb2suY29tCi52cG5jb3Vwb25z
-LmNvbQp8aHR0cDovL3ZwbmNvdXBvbnMuY29tCi52cG5kYWRhLmNvbQp8fHZwbmRh
-ZGEuY29tCi52cG5mYW4uY29tCnZwbmZpcmUuY29tCi52cG5maXJlcy5iaXoKLnZw
-bmZvcmdhbWUubmV0Cnx8dnBuZm9yZ2FtZS5uZXQKfHx2cG5nYXRlLmpwCi52cG5n
-YXRlLm5ldAp8fHZwbmdhdGUubmV0Ci52cG5ncmF0aXMubmV0CnZwbmhxLmNvbQou
-dnBubWFzdGVyLmNvbQp8fHZwbm1hc3Rlci5jb20KLnZwbm1lbnRvci5jb20KfHx2
-cG5tZW50b3IuY29tCi52cG5pbmphLm5ldAp8fHZwbmluamEubmV0Ci52cG5pbnRv
-dWNoLmNvbQp8fHZwbmludG91Y2gubmV0CnZwbmphY2suY29tCnx8dnBuamFjay5j
-b20KLnZwbnBpY2suY29tCnx8dnBucGljay5jb20KfHx2cG5wb3AuY29tCnx8dnBu
-cHJvbmV0LmNvbQoudnBucmVhY3Rvci5jb20KfHx2cG5yZWFjdG9yLmNvbQp8fHZw
-bnJldmlld3ouY29tCi52cG5zZWN1cmUubWUKfHx2cG5zZWN1cmUubWUKLnZwbnNo
-YXphbS5jb20KfHx2cG5zaGF6YW0uY29tCi52cG5zaGllbGRhcHAuY29tCnx8dnBu
-c2hpZWxkYXBwLmNvbQoudnBuc3AuY29tCi52cG50cmFmZmljLmNvbQoudnBudHVu
-bmVsLmNvbQp8fHZwbnR1bm5lbC5jb20KLnZwbnVrLmluZm8KfHx2cG51ay5pbmZv
-Cnx8dnBudW5saW1pdGVkYXBwLmNvbQoudnBudmlwLmNvbQp8fHZwbnZpcC5jb20K
-LnZwbndvcmxkd2lkZS5jb20KLnZwb3JuLmNvbQp8fHZwb3JuLmNvbQoudnBzZXIu
-bmV0CkBAfHx2cHNlci5uZXQKdnJhaWVzYWdlc3NlLm5ldAoudnJtdHIuY29tCnx8
-dnR1bm5lbC5jb20KfHx2dWt1LmNjCgohLS0tLS0tLS0tLS0tLS0tLS0tLS1XVy0t
-LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KbGlzdHMudzMub3JnL2FyY2hpdmVzL3B1
-YmxpYwp8fHczc2Nob29scy5jb20KfHx3YWZmbGUxOTk5LmNvbQoud2FoYXMuY29t
-Ci53YWlnYW9idS5jb20Kd2Fpa2V1bmcub3JnL3BocF93aW5kCi53YWlsYWlrZS5u
-ZXQKLndhaXdhaWVyLmNvbQp8aHR0cDovL3dhaXdhaWVyLmNvbQp8fHdhbGxtYW1h
-LmNvbQp3YWxsb3Jub3Qub3JnCnx8d2FsbHBhcGVyY2FzYS5jb20KLndhbGxwcm94
-eS5jb20KQEB8fHdhbGxwcm94eS5jb20uY24KfHx3YWx0ZXJtYXJ0aW4uY29tCnx8
-d2FsdGVybWFydGluLm9yZwp8fHd3dy53YW4tcHJlc3Mub3JnCnx8d2FuZGVyaW5n
-aG9yc2UubmV0Cnx8d2FuZ2FmdS5uZXQKfHx3YW5namluYm8ub3JnCi53YW5namlu
-Ym8ub3JnCndhbmdsaXhpb25nLmNvbQoud2FuZ28ub3JnCnx8d2FuZ28ub3JnCndh
-bmdydW9zaHVpLm5ldAp3d3cud2FuZ3J1b3dhbmcub3JnCndhbnQtZGFpbHkuY29t
-CndhcGVkaWEubW9iaS96aHNpbXAKfHx3YXNlbHByby5jb20KLndhdGNoaW5lc2Uu
-Y29tCi53YXR0cGFkLmNvbQp8fHdhdHRwYWQuY29tCi5tYWt6aG91LndhcmVob3Vz
-ZTMzMy5jb20Kd2FzaGVuZy5uZXQKLndhdGNoOHguY29tCnx8d2F0Y2hteWdmLm5l
-dAp8fHdhdi50dgoud2RmNS5jb20KLndlYXJlaGFpcnkuY29tCi53ZWFybi5jb20K
-fHx3ZWFybi5jb20KfGh0dHA6Ly9oa2NvYy53ZWF0aGVyLmNvbS5oawp8fGh1ZGF0
-b3JpcS53ZWIuaWQKfHx3ZWIycHJvamVjdC5uZXQKd2ViYmFuZy5uZXQKLndlYmV2
-YWRlci5vcmcKLndlYmZyZWVyLmNvbQp3ZWJsYWd1LmNvbQoud2ViamIub3JnCi53
-ZWJydXNoLm5ldAp3ZWJzLXR2Lm5ldAoud2Vic2l0ZXB1bHNlLmNvbS9oZWxwL3Rl
-c3R0b29scy5jaGluYS10ZXN0CnxodHRwOi8vd3d3LndlYnNuYXByLmNvbQoud2Vi
-d2FycGVyLm5ldAp8aHR0cDovL3dlYndhcnBlci5uZXQKd2Vid29ya2VyZGFpbHku
-Y29tCi53ZWVrbWFnLmluZm8KfHx3ZWZpZ2h0Y2Vuc29yc2hpcC5vcmcKLndlZm9u
-Zy5jb20Kd2VpYm9sZWFrLmNvbQoud2VpaHVvLm9yZwp3ZWlqaW5nc2hlbmcub3Jn
-Ci53ZWltaW5nLmluZm8KfHx3ZWltaW5nLmluZm8Kd2VpcXVhbndhbmcub3JnCnxo
-dHRwOi8vd2Vpc3VvLndzCi53ZWxvdmVjb2NrLmNvbQoud2VtaWdyYXRlLm9yZwp8
-aHR0cDovL3dlbWlncmF0ZS5vcmcKd2VuZ2V3YW5nLmNvbQp8fHdlbmdld2FuZy5v
-cmcKLndlbmh1aS5jaAp8aHR0cDovL3RyYW5zLndlbndlaXBvLmNvbS9nYi8KLndl
-bnh1ZWNpdHkuY29tCnx8d2VueHVlY2l0eS5jb20KLndlbnl1bmNoYW8uY29tCnx8
-d2VueXVuY2hhby5jb20KLndlc3RjYS5jb20KfHx3ZXN0Y2EuY29tCnx8d2VzdGVy
-bndvbHZlcy5jb20KLndlc3RraXQubmV0Cnx8d2VzdHBvaW50LmVkdQoud2VzdGVy
-bnNodWdkZW5zb2NpZXR5Lm9yZwp3ZXRwdXNzeWdhbWVzLmNvbQoud2V0cGxhY2Uu
-Y29tCndleGlhb2JvLm9yZwp8fHdleGlhb2JvLm9yZwp3ZXpoaXlvbmcub3JnCnx8
-d2V6b25lLm5ldAoud2ZvcnVtLmNvbQp8fHdmb3J1bS5jb20vCi53aGF0YmxvY2tl
-ZC5jb20KfHx3aGF0YmxvY2tlZC5jb20KLndoZWF0c2VlZHMub3JnCnx8d2hlZWxv
-Y2tzbGF0aW4uY29tCi53aGlwcGVkYXNzLmNvbQohLS18aHR0cDovL3doby5pcy8K
-Lndob2VyLm5ldAp8fHdob2VyLm5ldAp3aG90YWxraW5nLmNvbQp3aHlsb3Zlci5j
-b20KfHx3aHl4Lm9yZwp8aHR0cDovL3poLmVjZG0ud2lraWEuY29tCnxodHRwOi8v
-ZXZjaGsud2lraWEuY29tCmZxLndpa2lhLmNvbQp6aC5wdHRwZWRpYS53aWtpYS5j
-b20vd2lraS8lRTclQkYlOTIlRTUlOEMlODUlRTUlQUQlOTAlRTQlQjklOEIlRTQl
-QkElODIKY24udW5jeWNsb3BlZGlhLndpa2lhLmNvbQp6aC51bmN5Y2xvcGVkaWEu
-d2lraWEuY29tCnx8d2lraWxlYWtzLmNoCnx8d2lraWxlYWtzLmNvbQp8fHdpa2ls
-ZWFrcy5kZQp8fHdpa2lsZWFrcy5ldQp8fHdpa2lsZWFrcy5sdQoud2lraWxlYWtz
-Lm9yZwp8fHdpa2lsZWFrcy5vcmcKfHx3aWtpbGVha3MucGwKLndpa2lsZWFrcy1m
-b3J1bS5jb20Kd2lsZGFtbW8uY29tCi53aWxsaWFtaGlsbC5jb20KfHxjb2xsYXRl
-cmFsbXVyZGVyLmNvbQp8fGNvbGxhdGVyYWxtdXJkZXIub3JnCndpa2lsaXZyZXMu
-aW5mby93aWtpLyVFOSU5QiVCNiVFNSU4NSVBQiVFNSVBRSVBQSVFNyVBQiVBMAp8
-fHdpa2ltYXBpYS5vcmcKCiEtLS0tLS0tLS0tLS0tV2lraXBlZGlhIFJlbGF0ZWQt
-LS0tLS0tLS0tLS0tCiEhRW1lcmdlbmN5IG5lZWQgb25seShJUC9Qb3J0IGJsb2Nr
-IHVzYWdlKSEhCiEtLS0tLS0wLS0tLS0tCiEtLXx8bWVkaWF3aWtpLm9yZwohLS1A
-QHx8bS5tZWRpYXdpa2kub3JnCiEtLS0tLS0xLS0tLS0tCiEtLXx8d2lraWRhdGEu
-b3JnCiEtLUBAfHxtLndpa2lkYXRhLm9yZwohLS0tLS0tMi0tLS0tLQohLS18fHdp
-a2ltZWRpYS5vcmcKIS0tQEB8fGxpc3RzLndpa2ltZWRpYS5vcmcKIS0tQEB8fG0u
-d2lraW1lZGlhLm9yZwohLS1AQHx8cGhhYnJpY2F0b3Iud2lraW1lZGlhLm9yZwoh
-LS1AQHx8dXBsb2FkLndpa2ltZWRpYS5vcmcKIS0tQEB8fHdpa2l0ZWNoLndpa2lt
-ZWRpYS5vcmcKIS0tLS0tLTMtLS0tLS0KIS0tfHx3aWtpYm9va3Mub3JnCiEtLUBA
-fHxtLndpa2lib29rcy5vcmcKIS0tLS0tLTQtLS0tLS0KIS0tfHx3aWtpdmVyc2l0
-eS5vcmcKIS0tQEB8fG0ud2lraXZlcnNpdHkub3JnCiEtLS0tLS01LS0tLS0tCiEt
-LXx8d2lraXNvdXJjZS5vcmcKIS0tQEB8fG0ud2lraXNvdXJjZS5vcmcKfGh0dHA6
-Ly96aC53aWtpc291cmNlLm9yZwohLS0tLS0tNi0tLS0tLQohLS18fHdpa2lxdW90
-ZS5vcmcKIS0tQEB8fG0ud2lraXF1b3RlLm9yZwohLS0tLS0tNy0tLS0tLQohLS18
-fHdpa2luZXdzLm9yZwohLS1AQHx8bS53aWtpbmV3cy5vcmcKfHx6aC53aWtpbmV3
-cy5vcmcKIS0tLS0tLTgtLS0tLS0KIS0tfHx3aWtpdm95YWdlLm9yZwohLS1AQHx8
-bS53aWtpdm95YWdlLm9yZwohLS18aHR0cDovL3poLndpa2l2b3lhZ2Uub3JnCiEt
-LS0tLS05LS0tLS0tCiEtLXx8d2lrdGlvbmFyeS5vcmcKIS0tQEB8fG0ud2lrdGlv
-bmFyeS5vcmcKIS0tfGh0dHA6Ly96aC53aWt0aW9uYXJ5Lm9yZwohLS0tLS0xMC0t
-LS0tLQohLS18fHdpa2ltZWRpYWZvdW5kYXRpb24ub3JnCiEtLUBAfHxtLndpa2lt
-ZWRpYWZvdW5kYXRpb24ub3JnCiEtLS0tTWFpbi0tLS0tCiEhLS18fGVuLndpa2lw
-ZWRpYS5vcmcKIS0tfHx3aWtpcGVkaWEub3JnCnx8amEud2lraXBlZGlhLm9yZwoh
-IS0temgud2lraXBlZGlhLm9yZwohLS18fHpoLndpa2lwZWRpYS5vcmcKISEtLXx8
-dWcubS53aWtpcGVkaWEub3JnCiEhLS16aC5tLndpa2lwZWRpYS5vcmcKISEtLXxo
-dHRwczovL3poLm0ud2lraXBlZGlhLm9yZwohLS1AQHx8bS53aWtpcGVkaWEub3Jn
-CiEhLS18aHR0cHM6Ly96aC53aWtpcGVkaWEub3JnCiEtLU90aGVyIExhbmd1YWdl
-cyBvZiBXaWtpcGVkaWEKISEtLXd1dS53aWtpcGVkaWEub3JnCiEhLS18aHR0cHM6
-Ly93dXUud2lraXBlZGlhLm9yZwohIS0temgteXVlLndpa2lwZWRpYS5vcmcKISEt
-LXxodHRwczovL3poLXl1ZS53aWtpcGVkaWEub3JnCiEhISBTdGFydGluZyB3aXRo
-ICEhIGFyZSBwcmV2aW91cyBydWxlcyByZXBsYWNlZCBieToKfHx3aWtpcGVkaWEu
-b3JnCgp8fHdpa2l3aWtpLmpwCnx8Y2FzaW5vLndpbGxpYW1oaWxsLmNvbQp8fHNw
-b3J0cy53aWxsaWFtaGlsbC5jb20KfHx2ZWdhcy53aWxsaWFtaGlsbC5jb20KfHx3
-aWxsdy5uZXQKfHx3aW5kb3dzcGhvbmVtZS5jb20KLndpbmRzY3JpYmUuY29tCnx8
-d2luZHNjcmliZS5jb20KfHxjb21tdW5pdHkud2luZHkuY29tCnx8d2luZ3kuc2l0
-ZQp3aW5uaW5nMTEuY29tCndpbndoaXNwZXJzLmluZm8KfHx3aXJlZGJ5dGVzLmNv
-bQp8fHdpcmVkcGVuLmNvbQohLS18fHdpcmVzaGFyay5vcmcKLndpc2RvbXB1YnMu
-b3JnCi53aXNldmlkLmNvbQp8fHdpc2V2aWQuY29tCi53aXRuZXNzbGVldGVhY2hp
-bmcuY29tCi53aXRvcGlhLm5ldAoud2piay5vcmcKfHx3amJrLm9yZwp8aHR0cDov
-L3duLmNvbQoud25hY2cuY29tCi53bmFjZy5vcmcKLndvLnRjCnx8d29lc2VyLmNv
-bQp8aHR0cDovL3dvZXNlcm1pZGRsZS13YXkubmV0Lwoud29rYXIub3JnCnxodHRw
-Oi8vd29rYXIub3JnCndvbGZheC5jb20KfHx3b2xmYXguY29tCnx8d29vbHlzcy5j
-b20Kd29vcGllLmpwCnx8d29vcGllLmpwCndvb3BpZS50dgp8fHdvb3BpZS50dgp8
-fHdvcmthdHJ1bmEuY29tCi53b3JrZXJkZW1vLm9yZy5oawoud29ya2VyZW1wb3dl
-cm1lbnQub3JnCnx8d29ya2Vyc3RoZWJpZy5uZXQKLndvcmxkY2F0Lm9yZwp3b3Js
-ZGpvdXJuYWwuY29tCi53b3JsZHZwbi5uZXQKfHx3b3JsZHZwbi5uZXQKCnx8dmlk
-ZW9wcmVzcy5jb20KLndvcmRwcmVzcy5jb20KfGh0dHA6Ly8qLndvcmRwcmVzcy5j
-b20KfHxjaGVuc2hhbjIwMDQyMDA1LndvcmRwcmVzcy5jb20KfHxjaGluYXZpZXcu
-d29yZHByZXNzLmNvbQp8fGNuYmJuZXdzLndvcmRwcmVzcy5jb20KfHxmcmVlZG9t
-aW5mb25ldHdlYi53b3JkcHJlc3MuY29tCnx8aGthODk2NC53b3JkcHJlc3MuY29t
-Cnx8aGthbmV3cy53b3JkcHJlc3MuY29tCnx8aHFzYm5ldC53b3JkcHJlc3MuY29t
-Cnx8aHFzYm9ubGluZS53b3JkcHJlc3MuY29tCnx8aW52ZXN0aWdhdGluZy53b3Jk
-cHJlc3MuY29tCnx8am9ibmV3ZXJhLndvcmRwcmVzcy5jb20KfHxtaW5naHVpeXcu
-d29yZHByZXNzLmNvbQp8fHdvM3R0dC53b3JkcHJlc3MuY29tCnx8c3VqaWF0dW4u
-d29yZHByZXNzLmNvbQp8fHhpamllLndvcmRwcmVzcy5jb20KfHx3cC5jb20KCiEt
-fHx3b3Jtc2N1bHB0b3IuY29tCi53b3cuY29tCi53b3ctbGlmZS5uZXQKfHx3b3ds
-ZWdhY3kubWwKfHx3b3dwb3JuLmNvbQp8fHdvd2dpcmxzLmNvbQoud293cmsuY29t
-CndveGluZ2h1aWd1by5jb20KLndveWFvbGlhbi5vcmcKfGh0dHA6Ly93b3lhb2xp
-YW4ub3JnCi53cG9mb3J1bS5jb20KfHx3cG9mb3J1bS5jb20KLndxeWQub3JnCnx8
-d3F5ZC5vcmcKd3JjaGluYS5vcmcKd3JldGNoLmNjCiEtY24ud3NqLmNvbS9nYi8y
-MDEzMDIxNS90ZWMxMTM4NTMuYXNwCi53c2ouY29tCnx8d3NqLmNvbQoud3NqLm5l
-dAp8fHdzai5uZXQKLndzamhrLmNvbQoud3Ribi5vcmcKLnd0ZnBlb3BsZS5jb20K
-d3VlcmthaXhpLmNvbQp8fHd1ZmFmYW5nd2VuLmNvbQp3dWZpLm9yZy50dwp8fHd1
-Z3VvZ3VhbmcuY29tCnd1amllLm5ldAp3dWppZWxpdWxhbi5jb20KfHx3dWppZWxp
-dWxhbi5jb20Kd3VrYW5ncnVpLm5ldAp8fHd1dy5yZWQKfHx3dXlhbmJsb2cuY29t
-Ci53d2l0di5jb20KfHx3d2l0di5jb20Kd3p5Ym95LmltL3Bvc3QvMTYwCgohLS0t
-LS0tLS0tLS0tLS0tLS0tLS1YWC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KLngt
-YmVycnkuY29tCnx8eC1iZXJyeS5jb20KfHx4LWFydC5jb20KfHx4LXdhbGwub3Jn
-CngxOTQ5eC5jb20KeDM2NXguY29tCnhhbmdhLmNvbQp8fHhiYWJlLmNvbQoueGJv
-b2tjbi5jb20KfHx4Ym9va2NuLmNvbQp8fHhjYWZlLmluCnx8eGNpdHkuanAKLnhj
-cml0aWMuY29tCnxodHRwOi8vY2RuKi54ZGEtZGV2ZWxvcGVycy5jb20KLnhlcm90
-aWNhLmNvbQpkZXN0aW55LnhmaWxlcy50by91YmJ0aHJlYWRzCi54Zm0ucHAucnUK
-LnhnbXlkLmNvbQp8fHhnbXlkLmNvbQp4aGFtc3Rlci5jb20KfHx4aGFtc3Rlci5j
-b20KLnhpYW5iYS5uZXQKLnhpYW5jaGF3YW5nLm5ldAoueGlhbmppYW4udHcKfGh0
-dHA6Ly94aWFuamlhbi50dwoueGlhbnFpYW8ubmV0Ci54aWFvYmFpd3UuY29tCi54
-aWFvY2h1bmNuanAuY29tCi54aWFvZC5pbgoueGlhb2hleGllLmNvbQp8fHhpYW9s
-YW4ubWUKfHx4aWFvbWEub3JnCnx8eGlhb2hleGllLmNvbQp4aWV6aHVhLmNvbQou
-eGlodWEuZXMKZm9ydW0ueGluYmFvLmRlL2ZvcnVtCi54aW5nLmNvbQp8aHR0cDov
-L3hpbmcuY29tCi54aW5taWFvLmNvbS5oawp8fHhpbm1pYW8uY29tLmhrCnhpbnNo
-ZW5nLm5ldAp4aW5zaGlqdWUuY29tCnhpbmh1YW5ldC5vcmcKfGh0dHA6Ly94aW55
-dWJicy5uZXQKLnhpb25ncGlhbi5jb20KLnhpdXJlbi5vcmcKeGl6YW5nLXpoaXll
-Lm9yZwp4anAuY2MKfHx4anAuY2MKfHx4anRyYXZlbGd1aWRlLmNvbQp4bGZtdGFs
-ay5jb20KfHx4bGZtd3ouaW5mbwp8fHhtbC10cmFpbmluZy1ndWlkZS5jb20KeG1v
-dmllcy5jb20KfHx4bnh4LmNvbQp4cGRvLm5ldAp8fHhwdWQub3JnCi54cmVudGR2
-ZC5jb20KLnhza3l3YWxrZXIubmV0Cnx8eHR1YmUuY29tCmJsb2cueHVpdGUubmV0
-CnZsb2cueHVpdGUubmV0Cnh1emhpeW9uZy5uZXQKfHx4dWNoYW8ub3JnCnh1Y2hh
-by5uZXQKfHx4dWNoYW8ubmV0Cnh2aWRlby5jYwoueHZpZGVvcy5jb20KfHx4dmlk
-ZW9zLmNvbQp8fHh2aWRlb3MuZXMKLnhraXdpLnRrLwoueHhiYnguY29tCi54eGxt
-b3ZpZXMuY29tCnx8eHh4LmNvbQoueHh4Lnh4eAp8aHR0cDovL3h4eC54eHgKLnh4
-eGZ1Y2ttb20uY29tCnx8eHh4eC5jb20uYXUKLnh4eHltb3ZpZXMuY29tCnxodHRw
-Oi8veHh4eW1vdmllcy5jb20KeHlzLm9yZwp4eXNibG9ncy5vcmcKeHl5NjkuY29t
-Cnh5eTY5LmluZm8KCiEtLS0tLS0tLS0tLS0tLS0tLS0tLVlZLS0tLS0tLS0tLS0t
-LS0tLS0tLS0tLS0tLQp8fHlha2J1dHRlcmJsdWVzLmNvbQp8fHlhbS5jb20KfHx5
-YW0ub3JnLnR3Ci55YW5naGVuZ2p1bi5jb20KeWFuZ2ppYW5saS5jb20KLnlhc25p
-LmNvLnVrCnx8eWFzbmkuY28udWsKIS0tfHx5YXN1a3VuaS5vci5qcAoueWF5YWJh
-eS5jb20vZm9ydW0KLnlkeS5jb20KLnllYWh0ZWVudHViZS5jb20KfHx5ZWFodGVl
-bnR1YmUuY29tCnx8eWVjbC5uZXQKfHx5ZWVsb3UuY29tCnllZXlpLmNvbQp5ZWds
-ZS5uZXQKfHx5ZWdsZS5uZXQKLnllcy54eHgKfHx5ZXMxMjMuY29tLnR3Cnx8eWVz
-YXNpYS5jb20KfHx5ZXNhc2lhLmNvbS5oawoueWVzLW5ld3MuY29tCnxodHRwOi8v
-eWVzLW5ld3MuY29tCi55ZXNwb3JucGxlYXNlLmNvbQp8fHllc3Bvcm5wbGVhc2Uu
-Y29tCnxodHRwOi8veWV5ZWNsdWIuY29tCiEtLXlmcm9nLmNvbQp8fHloY3cubmV0
-Ci55aWJhZGEuY29tCi55aWJhb2NoaW5hLmNvbQoueWlkaW8uY29tCnx8eWlkaW8u
-Y29tCnlpbHViYnMuY29tCnhhLnlpbWcuY29tCi55aW5nc3Vvc3MuY29tCi55aXB1
-Yi5jb20KfHx5aXB1Yi5jb20KeWlubGVpLm9yZy9tdAoueWl6aGlob25neGluZy5j
-b20KLnlvYnQuY29tCi55b2J0LnR2Cnx8eW9idC50dgoueW9naWNoZW4ub3JnCnx8
-eW9naWNoZW4ub3JnCi55b2xhc2l0ZS5jb20KLnlvbWl1cmkuY28uanAKeW9uZy5o
-dQoueW9ya2Jicy5jYQp8fHlvdXh1LmluZm8KLnlvdWppenouY29tCnx8eW91aml6
-ei5jb20KLnlvdW1ha2VyLmNvbQp8fHlvdW1ha2VyLmNvbQoueW91bmdwb3Judmlk
-ZW9zLmNvbQp5b3VuZ3NwaXJhdGlvbi5oawoueW91cGFpLm9yZwp8fHlvdXBhaS5v
-cmcKLnlvdXItZnJlZWRvbS5uZXQKfHx5b3VyZXBlYXQuY29tCi55b3VycHJpdmF0
-ZXZwbi5jb20KfHx5b3VycHJpdmF0ZXZwbi5jb20KLnlvdXNlbmRpdC5jb20KfHx5
-b3VzZW5kaXQuY29tCi55b3V0aG5ldHJhZGlvLm9yZy90bWl0L2ZvcnVtCmJsb2cu
-eW91dGh3YW50LmNvbS50dwptZS55b3V0aHdhbnQuY29tLnR3CnNoYXJlLnlvdXRo
-d2FudC5jb20udHcKdG9waWMueW91dGh3YW50LmNvbS50dwoueW91cG9ybi5jb20K
-fHx5b3Vwb3JuLmNvbQoueW91cG9ybmdheS5jb20KfHx5b3Vwb3JuZ2F5LmNvbQou
-eW91cmxpc3Rlbi5jb20KfGh0dHA6Ly95b3VybGlzdGVuLmNvbQoueW91cmx1c3Qu
-Y29tCnxodHRwOi8veW91cmx1c3QuY29tCnlvdXNodW4xMi5jb20KLnlvdXR1YmVj
-bi5jb20KeW91dmVyc2lvbi5jb20KfHx5b3V2ZXJzaW9uLmNvbQpibG9nLnlvdXh1
-LmluZm8vMjAxMC8wMy8xNC93ZXN0LWNoYW1iZXIKeXRodC5uZXQKeXVhbm1pbmcu
-bmV0Ci55dWFuemhlbmd0YW5nLm9yZwoueXVsZ2h1bi5jb20KfHx5dW5jaGFvLm5l
-dAp8fHl1bnRpcHViLmNvbQoueXV2dXR1LmNvbQp8fHl2ZXNnZWxleW4uY29tCi55
-d3B3LmNvbS9mb3J1bXMvaGlzdG9yeS9wb3N0L0EwL3AwL2h0bWwvMjI3Cnl4NTEu
-bmV0Ci55eWlpLm9yZwp8fHl5aWkub3JnCi55enprLmNvbQp8aHR0cDovL3l6emsu
-Y29tCgohLS0tLS0tLS0tLS0tLS0tLS0tLS1aWi0tLS0tLS0tLS0tLS0tLS0tLS0t
-LS0tLS0KemFjZWJvb2suY29tCi56YWxtb3MuY29tCnx8emFsbW9zLmNvbQp8fHph
-bm5lbC5jb20KLnphb2Jhby5jb20KfHx6YW9iYW8uY29tCnxodHRwOi8vemFvYmFv
-LmNvbS5zZwp8fHphb2Jhby5jb20uc2cKLnphb3pvbi5jb20KfHx6ZG5ldC5jb20u
-dHcKLnplbGxvLmNvbQp8fHplbGxvLmNvbQouemVuZ2ppbnlhbi5vcmcKLnplbm1h
-dGUuY29tCnx8emVubWF0ZS5jb20KfHx6ZW5tYXRlLmNvbS5ydQp8fHplcm9uZXQu
-aW8KfHx6ZXV0Y2guY29tCiEtLXd3dy56ZnJlZXQuY29tL3Bvc3QvdXNlanVtcC1i
-cm93bnMuaHRtbAouemZyZWV0LmNvbQouemdzZGRoLmNvbQp6Z3pjamoubmV0Ci56
-aGFuYmluLm5ldAp8fHpoYW5iaW4ubmV0Ci56aGFuZ2JvbGkubmV0Cnx8emhhbmd0
-aWFubGlhbmcuY29tCnx8emhhbmx2ZS5vcmcKemhlbmdodWkub3JnCi56aGVuZ2pp
-YW4ub3JnCnx8emhlbmdqaWFuLm9yZwp6aGVuZ3d1bmV0Lm9yZwp6aGVubGlidS5p
-bmZvCnx8emhlbmxpYnUuaW5mbwouemhlbmxpYnUxOTg0LmNvbQp8fHpoZW5saWJ1
-MTk4NC5jb20KfGh0dHA6Ly96aGVueGlhbmcuYml6Ci56aGluZW5nbHV5b3UuY29t
-Cnpob25nZ3VvLmNhCnxodHRwOi8vemhvbmdndW9yZW5xdWFuLm9yZwp6aG9uZ2d1
-b3Rlc2UubmV0Cnx8emhvbmdndW90ZXNlLm5ldAp8fHpob25nbWVuZy5vcmcKLnpo
-b3VzaHVndWFuZy5jb20KfHx6aHJlYWRlci5jb20KLnpodWFuZ2JpLm1lCnx8emh1
-YW5nYmkubWUKLnpodWFueGluZy5jbgp8fHpodWF0aWViYS5jb20Kemh1aWNoYWd1
-b2ppLm9yZwp8fHpodWljaGFndW9qaS5vcmcKfGh0dHA6Ly9ib29rLnppNS5tZQou
-emlkZHUuY29tL2Rvd25sb2FkCnx8emlsbGlvbmsuY29tCi56aW5pby5jb20KfHx6
-aW5pby5jb20KLnppcG9ybi5jb20KLnppcHB5c2hhcmUuY29tCi56a2FpcC5jb20K
-fHx6a2FpcC5jb20KcmVhbGZvcnVtLnpraXouY29tCiEtLXx8emxpYi5uZXQKfHx6
-bXcuY24KLnpvZGdhbWUudXMKem9tb2JvLm5ldAouem9uYWV1cm9wYS5jb20KfHx6
-b25hZXVyb3BhLmNvbQp8fHpvbmdoZXhpbndlbi5jb20KLnpvbmdoZXhpbndlbi5u
-ZXQKfHx6b29ndnBuLmNvbQp8fHpvb3Rvb2wuY29tCi56b296bGUubmV0CndyaXRl
-ci56b2hvLmNvbQp8fHpvcnJvdnBuLmNvbQp8fHpwbi5pbQp8fHpzcGVlZGVyLm1l
-Ci56c3JoYW8uY29tCi56dW8ubGEKfHx6dW8ubGEKfHx6dW9iaWFvLm1lCi56dW9s
-YS5jb20KfHx6dW9sYS5jb20KfHx6dmVyZWZmLmNvbQouenluYWltYS5jb20Kenl6
-YzkuY29tCi56emNhcnRvb24uY29tCiEjIyMjIyMjIyMjIyMjI0dlbmVyYWwgTGlz
-dCBFbmQjIyMjIyMjIyMjIyMjIyMjIwoKISMjIyMjIyMjIyMjU3VwcGxlbWVudGFs
-IExpc3QgU3RhcnQjIyMjIyMjIyMjIyMjCiEtLS0tLS0tLS0tLS0tLS0tLVVSTCBL
-ZXl3b3Jkcy0tLS0tLS0tLS0tLS0tLS0tLQo2NG1lbW8KYUhSMGNITTZMeTk1WldO
-c0xtNWxkQQpmcmVlbmV0Ci5nb29nbGUuKi9mYWx1bgpwaG9ib3MuYXBwbGUuY29t
-Ki92aWRlbwpxPWZyZWVkb20KcSUzRGZyZWVkb20KcmVtZW1iZXJpbmdfdGlhbmFu
-bWVuXzIwX3llYXJzCnNlYXJjaCpzYWZld2ViCnE9dHJpYW5nbGUKcSUzRFRyaWFu
-Z2xlCnVsdHJhcmVhY2gKdWx0cmFzdXJmCiEjIyMjIyMjIyMjIyMjU3VwcGxlbWVu
-dGFsIExpc3QgRW5kIyMjIyMjIyMjIyMjIwoKISMjIyMjIyMjIyMjIyMjIyNXaGl0
-ZWxpc3QgU3RhcnQjIyMjIyMjIyMjIyMjIyMjCkBAfHxhbGl5dW4uY29tCkBAfHxi
-YWlkdS5jb20KIS0tQEB8fGJpbmcuY29tCkBAfHxjaGluYXNvLmNvbQpAQHx8Y2hp
-bmF6LmNvbQpAQHxodHRwOi8vbnJjaC5jdWx0dXJlLnR3LwoKIS0tLVNvbWUgYXJl
-IHBvd2VyZWQgYnkgR3VYaWFuZyAoQkdQKSwgcGxlYXNlIGNvbW1lbnQgb2ZmIGlm
-CiEtLS15b3UgZW5jb3VudGVyIGNvbm5lY3Rpdml0eSBpc3N1ZXMuCkBAfHxhZHNl
-cnZpY2UuZ29vZ2xlLmNvbQohLS1JU1AgY2FjaGUgd29ya3Mgc29tZXRpbWVzLCB2
-ZXJpZmllZCBhdCBkcnBlbmcgKyBnZWh1YS4KQEB8fGRsLmdvb2dsZS5jb20KQEB8
-fGtoLmdvb2dsZS5jb20KQEB8fGtobS5nb29nbGUuY29tCkBAfHxraG0wLmdvb2ds
-ZS5jb20KQEB8fGtobTEuZ29vZ2xlLmNvbQpAQHx8a2htMi5nb29nbGUuY29tCkBA
-fHxraG0zLmdvb2dsZS5jb20KQEB8fGtobWRiLmdvb2dsZS5jb20KQEB8fHRvb2xz
-Lmdvb2dsZS5jb20KQEB8fGNsaWVudHNlcnZpY2VzLmdvb2dsZWFwaXMuY29tCkBA
-fHxmb250cy5nb29nbGVhcGlzLmNvbQpAQHx8a2htLmdvb2dsZWFwaXMuY29tCkBA
-fHxraG0wLmdvb2dsZWFwaXMuY29tCkBAfHxraG0xLmdvb2dsZWFwaXMuY29tCkBA
-fHxraG0yLmdvb2dsZWFwaXMuY29tCkBAfHxraG0zLmdvb2dsZWFwaXMuY29tCkBA
-fHxraG1kYi5nb29nbGVhcGlzLmNvbQpAQHx8c3RvcmFnZS5nb29nbGVhcGlzLmNv
-bQpAQHx8dHJhbnNsYXRlLmdvb2dsZWFwaXMuY29tCkBAfHx1cGRhdGUuZ29vZ2xl
-YXBpcy5jb20KQEB8fHNhZmVicm93c2luZy5nb29nbGVhcGlzLmNvbQpAQHx8Y24u
-Z3JhdmF0YXIuY29tCkBAfHxjb25uZWN0aXZpdHljaGVjay5nc3RhdGljLmNvbQpA
-QHx8Y3NpLmdzdGF0aWMuY29tCkBAfHxmb250cy5nc3RhdGljLmNvbQpAQHx8c3Ns
-LmdzdGF0aWMuY29tCkBAfHxoYW9zb3UuY29tCkBAfHxpcC5jbgpAQHx8amlrZS5j
-b20KQEB8aHR0cDovL3RyYW5zbGF0ZS5nb29nbGUuY24KQEB8aHR0cDovL3d3dy5n
-b29nbGUuY24vbWFwcwpAQHx8aHR0cDIuZ29sYW5nLm9yZwpAQHx8Z292LmNuCkBA
-fHxxcS5jb20KQEB8fHNpbmEuY24KQEB8fHNpbmEuY29tLmNuCkBAfHxzb2dvdS5j
-b20KQEB8fHNvLmNvbQpAQHx8c29zby5jb20KQEB8fHVsdWFpLmNvbS5jbgpAQHx8
-d2VpYm8uY29tCkBAfHx5YWhvby5jbgpAQHx8eW91ZGFvLmNvbQpAQHx8emhvbmdz
-b3UuY29tCkBAfGh0dHA6Ly9pbWUuYmFpZHUuanAKISMjIyMjIyMjIyMjIyMjIyNX
-aGl0ZWxpc3QgRW5kIyMjIyMjIyMjIyMjIyMjIyMjCiEtLS0tLS0tLS0tLS0tLS0t
-LS0tLS1FT0YtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQo=
diff --git a/ShadowsocksX-NG/images/command-512.png b/ShadowsocksX-NG/images/command-512.png
deleted file mode 100644
index 5f8084c8c..000000000
Binary files a/ShadowsocksX-NG/images/command-512.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/http.png b/ShadowsocksX-NG/images/http.png
deleted file mode 100644
index 0fa9b96d2..000000000
Binary files a/ShadowsocksX-NG/images/http.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/icons8-Blind Filled-50.png b/ShadowsocksX-NG/images/icons8-Blind Filled-50.png
deleted file mode 100644
index 287b38c3d..000000000
Binary files a/ShadowsocksX-NG/images/icons8-Blind Filled-50.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/icons8-Eye Filled-50.png b/ShadowsocksX-NG/images/icons8-Eye Filled-50.png
deleted file mode 100644
index 5c1442c8c..000000000
Binary files a/ShadowsocksX-NG/images/icons8-Eye Filled-50.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_e_icon.png b/ShadowsocksX-NG/images/menu_e_icon.png
deleted file mode 100644
index ccd26bfa4..000000000
Binary files a/ShadowsocksX-NG/images/menu_e_icon.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_e_icon@2x.png b/ShadowsocksX-NG/images/menu_e_icon@2x.png
deleted file mode 100644
index 91ca7560a..000000000
Binary files a/ShadowsocksX-NG/images/menu_e_icon@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_g_icon.png b/ShadowsocksX-NG/images/menu_g_icon.png
deleted file mode 100644
index 6e0ce4929..000000000
Binary files a/ShadowsocksX-NG/images/menu_g_icon.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_g_icon@2x.png b/ShadowsocksX-NG/images/menu_g_icon@2x.png
deleted file mode 100644
index 36d62b9aa..000000000
Binary files a/ShadowsocksX-NG/images/menu_g_icon@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_icon.png b/ShadowsocksX-NG/images/menu_icon.png
deleted file mode 100644
index 1c1c7eb3e..000000000
Binary files a/ShadowsocksX-NG/images/menu_icon.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_icon@2x.png b/ShadowsocksX-NG/images/menu_icon@2x.png
deleted file mode 100644
index a6e85319a..000000000
Binary files a/ShadowsocksX-NG/images/menu_icon@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_icon_disabled.png b/ShadowsocksX-NG/images/menu_icon_disabled.png
deleted file mode 100644
index 5cf230e32..000000000
Binary files a/ShadowsocksX-NG/images/menu_icon_disabled.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_icon_disabled@2x.png b/ShadowsocksX-NG/images/menu_icon_disabled@2x.png
deleted file mode 100644
index b041e915b..000000000
Binary files a/ShadowsocksX-NG/images/menu_icon_disabled@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_m_icon.png b/ShadowsocksX-NG/images/menu_m_icon.png
deleted file mode 100644
index d6b909b12..000000000
Binary files a/ShadowsocksX-NG/images/menu_m_icon.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_m_icon@2x.png b/ShadowsocksX-NG/images/menu_m_icon@2x.png
deleted file mode 100644
index 98bcb6736..000000000
Binary files a/ShadowsocksX-NG/images/menu_m_icon@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_p_icon.png b/ShadowsocksX-NG/images/menu_p_icon.png
deleted file mode 100644
index 05755b38b..000000000
Binary files a/ShadowsocksX-NG/images/menu_p_icon.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/menu_p_icon@2x.png b/ShadowsocksX-NG/images/menu_p_icon@2x.png
deleted file mode 100644
index 7f3658baa..000000000
Binary files a/ShadowsocksX-NG/images/menu_p_icon@2x.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/terminal-logo.png b/ShadowsocksX-NG/images/terminal-logo.png
deleted file mode 100644
index 27bc0c284..000000000
Binary files a/ShadowsocksX-NG/images/terminal-logo.png and /dev/null differ
diff --git a/ShadowsocksX-NG/images/virtual-server-icon-3.png b/ShadowsocksX-NG/images/virtual-server-icon-3.png
deleted file mode 100644
index 2b7d5bd2a..000000000
Binary files a/ShadowsocksX-NG/images/virtual-server-icon-3.png and /dev/null differ
diff --git a/ShadowsocksX-NG/install_helper.sh b/ShadowsocksX-NG/install_helper.sh
deleted file mode 100755
index e7ac8db5c..000000000
--- a/ShadowsocksX-NG/install_helper.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/sh
-
-#  install_helper.sh
-#  shadowsocks
-#
-#  Created by clowwindy on 14-3-15.
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-sudo mkdir -p "/Library/Application Support/ShadowsocksX-NG/"
-sudo cp proxy_conf_helper "/Library/Application Support/ShadowsocksX-NG/"
-sudo chown root:admin "/Library/Application Support/ShadowsocksX-NG/proxy_conf_helper"
-sudo chmod a+rx "/Library/Application Support/ShadowsocksX-NG/proxy_conf_helper"
-sudo chmod +s "/Library/Application Support/ShadowsocksX-NG/proxy_conf_helper"
-
-echo done
diff --git a/ShadowsocksX-NG/kcptun/client b/ShadowsocksX-NG/kcptun/client
deleted file mode 100755
index 8a77ad6ce..000000000
Binary files a/ShadowsocksX-NG/kcptun/client and /dev/null differ
diff --git a/ShadowsocksX-NG/kcptun/install_kcptun.sh b/ShadowsocksX-NG/kcptun/install_kcptun.sh
deleted file mode 100644
index e7c83881c..000000000
--- a/ShadowsocksX-NG/kcptun/install_kcptun.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/sh
-
-#  install_kcptun.sh
-#  ShadowsocksX-NG
-#
-#  Created by 邱宇舟 on 2018/9/21.
-#  Copyright © 2018-2019年 qiuyuzhou. All rights reserved.
-
-# Use kcptune bianry from here which is not support SIP003.
-# We use an adatper to handle it.
-# https://github.com/xtaci/kcptun/releases
-
-VERSION="v20190905_1"
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-mkdir -p "$HOME/Library/Application Support/ShadowsocksX-NG/kcptun_$VERSION"
-cp -f client "$HOME/Library/Application Support/ShadowsocksX-NG/kcptun_$VERSION/"
-
-# Delete old kcptun symbol link
-rm -f "$HOME/Library/Application Support/ShadowsocksX-NG/plugins/kcptun"
-
-# Copy adapter shell script to plugin folder
-cp -f kcptun.sh "$HOME/Library/Application Support/ShadowsocksX-NG/plugins/kcptun"
-
-echo "install kcptun done"
diff --git a/ShadowsocksX-NG/kcptun/kcptun.sh b/ShadowsocksX-NG/kcptun/kcptun.sh
deleted file mode 100755
index 8e57ed932..000000000
--- a/ShadowsocksX-NG/kcptun/kcptun.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/bin/bash
-
-# A shadowsocks SIP003 adapter shell script.
-#
-# SIP003 Docucment: https://github.com/shadowsocks/shadowsocks-org/issues/28
-#
-# Created by Qiu Yuzhou on 2019-09-09
-# Copyright © 2019 Qiu Yuzhou. All rights reserved.
-
-# test data, Start
-# SS_REMOTE_HOST=127.0.0.1
-# SS_REMOTE_PORT=8088
-# SS_LOCAL_HOST=192.168.1.1
-# SS_LOCAL_PORT=888
-# test data, End
-
-SS_ENV_NAMES=(SS_REMOTE_HOST SS_REMOTE_PORT SS_LOCAL_HOST SS_LOCAL_PORT)
-
-for i in "${SS_ENV_NAMES[@]}"; do
-    if [ -z ${!i} ]
-    then
-        echo Not found env variable $i
-        exit
-    fi
-done
-
-# Split options
-IFS=';' read -ra _OPTS <<< "${SS_PLUGIN_OPTIONS}"
-
-# Prepend `--`
-OPTS=()
-for i in "${_OPTS[@]}"; do
-    OPTS+=("--$i")
-done
-
-PLUGIN_NAME="kcptun"
-PLUGIN_VERSION="v20190905_1"
-PLUGIN_BINARY_NAME="client"
-
-CMD="$(dirname "${BASH_SOURCE[0]}")/../${PLUGIN_NAME}_${PLUGIN_VERSION}/${PLUGIN_BINARY_NAME}"
-
-# Check if it is an IPv6 address
-if  [[ $SS_REMOTE_HOST == *":"* ]]; then
-    SS_REMOTE_ADDR="[${SS_REMOTE_HOST}]:${SS_REMOTE_PORT}"
-else
-    SS_REMOTE_ADDR="${SS_REMOTE_HOST}:${SS_REMOTE_PORT}"
-fi
-
-# Check if it is an IPv6 address
-if  [[ $SS_LOCAL_HOST == *":"* ]]; then
-    SS_LOCAL_ADDR="[${SS_LOCAL_HOST}]:${SS_LOCAL_PORT}"
-else
-    SS_LOCAL_ADDR="${SS_LOCAL_HOST}:${SS_LOCAL_PORT}"
-fi
-
-# Update this line when adapted other plugin.
-# echo -r "${SS_REMOTE_ADDR}" -l "${SS_LOCAL_ADDR}" ${OPTS[@]}
-"$CMD" -r "${SS_REMOTE_ADDR}" -l "${SS_LOCAL_ADDR}" ${OPTS[@]}
diff --git a/ShadowsocksX-NG/privoxy/install_privoxy.sh b/ShadowsocksX-NG/privoxy/install_privoxy.sh
deleted file mode 100755
index dc9d4b8d6..000000000
--- a/ShadowsocksX-NG/privoxy/install_privoxy.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/sh
-
-#  install_privoxy.sh
-#  ShadowsocksX-NG
-#
-#  Created by 王晨 on 16/10/7.
-#  Copyright © 2016年 zhfish. All rights reserved.
-
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-privoxyVersion=3.0.26.static
-mkdir -p "$HOME/Library/Application Support/ShadowsocksX-NG/privoxy-$privoxyVersion"
-cp -f privoxy "$HOME/Library/Application Support/ShadowsocksX-NG/privoxy-$privoxyVersion/"
-rm -f "$HOME/Library/Application Support/ShadowsocksX-NG/privoxy"
-ln -s "$HOME/Library/Application Support/ShadowsocksX-NG/privoxy-$privoxyVersion/privoxy" "$HOME/Library/Application Support/ShadowsocksX-NG/privoxy"
-
-echo done
diff --git a/ShadowsocksX-NG/privoxy/privoxy b/ShadowsocksX-NG/privoxy/privoxy
deleted file mode 100755
index 8c84e79c4..000000000
Binary files a/ShadowsocksX-NG/privoxy/privoxy and /dev/null differ
diff --git a/ShadowsocksX-NG/privoxy/privoxy.template.config b/ShadowsocksX-NG/privoxy/privoxy.template.config
deleted file mode 100644
index ec10bdd52..000000000
--- a/ShadowsocksX-NG/privoxy/privoxy.template.config
+++ /dev/null
@@ -1,22 +0,0 @@
-listen-address {http}
-toggle  1
-enable-remote-toggle 1
-enable-remote-http-toggle 1
-enable-edit-actions 0
-enforce-blocks 0
-buffer-limit 4096
-forwarded-connect-retries  0
-accept-intercepted-requests 0
-allow-cgi-request-crunching 0
-split-large-forms 0
-keep-alive-timeout 5
-socket-timeout 60
-
-forward         192.168.*.*/     .
-forward         10.*.*.*/        .
-forward         127.*.*.*/       .
-forward         [FE80::/64]      .
-forward         [::1]            .
-forward         [FD00::/8]       .
-forward-socks5 / {socks5} .
-
diff --git a/ShadowsocksX-NG/privoxy/start_privoxy.sh b/ShadowsocksX-NG/privoxy/start_privoxy.sh
deleted file mode 100755
index eefa769ad..000000000
--- a/ShadowsocksX-NG/privoxy/start_privoxy.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-#  start_privoxy.sh
-#  ShadowsocksX-NG
-#
-#  Created by 王晨 on 16/10/7.
-#  Copyright © 2016年 zhfish. All rights reserved.
-
-chmod 644 "$HOME/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.http.plist"
-launchctl load -wF "$HOME/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.http.plist"
-launchctl start com.qiuyuzhou.shadowsocksX-NG.http
diff --git a/ShadowsocksX-NG/privoxy/stop_privoxy.sh b/ShadowsocksX-NG/privoxy/stop_privoxy.sh
deleted file mode 100755
index e3ebb942e..000000000
--- a/ShadowsocksX-NG/privoxy/stop_privoxy.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/sh
-
-#  stop_privoxy.sh
-#  ShadowsocksX-NG
-#
-#  Created by 王晨 on 16/10/7.
-#  Copyright © 2016年 zhfish. All rights reserved.
-
-launchctl stop com.qiuyuzhou.shadowsocksX-NG.http
-launchctl unload "$HOME/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.http.plist"
diff --git a/ShadowsocksX-NG/privoxy/user-privoxy.config b/ShadowsocksX-NG/privoxy/user-privoxy.config
deleted file mode 100644
index 650710482..000000000
--- a/ShadowsocksX-NG/privoxy/user-privoxy.config
+++ /dev/null
@@ -1,3 +0,0 @@
-# Put user privoxy config line in this file.
-# Ref: https://www.privoxy.org/user-manual/index.html
-
diff --git a/ShadowsocksX-NG/proxy_conf_helper_version.h b/ShadowsocksX-NG/proxy_conf_helper_version.h
deleted file mode 100644
index d6111106f..000000000
--- a/ShadowsocksX-NG/proxy_conf_helper_version.h
+++ /dev/null
@@ -1,14 +0,0 @@
-//
-//  proxy_conf_helper_version.h
-//  ShadowsocksX-NG
-//
-//  Created by 邱宇舟 on 16/6/10.
-//  Copyright © 2016年 qiuyuzhou. All rights reserved.
-//
-
-#ifndef proxy_conf_helper_version_h
-#define proxy_conf_helper_version_h
-
-#define kProxyConfHelperVersion @"1.8.2"
-
-#endif /* proxy_conf_helper_version_h */
diff --git a/ShadowsocksX-NG/simple-obfs/install_simple_obfs.sh b/ShadowsocksX-NG/simple-obfs/install_simple_obfs.sh
deleted file mode 100644
index 5ea3aa644..000000000
--- a/ShadowsocksX-NG/simple-obfs/install_simple_obfs.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/sh
-# v0.0.5 https://bintray.com/homebrew/bottles/simple-obfs
-
-FILE_DIR=`dirname "${BASH_SOURCE[0]}"`
-cd "$FILE_DIR"
-
-NGDir="$HOME/Library/Application Support/ShadowsocksX-NG"
-TargetDir="$NGDir/simple-obfs-0.0.5_1"
-PluginDir="$NGDir/plugins"
-
-echo ngdir: ${NGDir}
-
-mkdir -p "$TargetDir"
-mkdir -p "$PluginDir"
-
-cp -f obfs-local "$TargetDir"
-
-ln -sfh "$TargetDir/obfs-local" "$PluginDir/simple-obfs"
-ln -sfh "$TargetDir/obfs-local" "$PluginDir/obfs-local"
-
-echo done
diff --git a/ShadowsocksX-NG/simple-obfs/obfs-local b/ShadowsocksX-NG/simple-obfs/obfs-local
deleted file mode 100755
index e1976a3e2..000000000
Binary files a/ShadowsocksX-NG/simple-obfs/obfs-local and /dev/null differ
diff --git a/ShadowsocksX-NG/ss-local/install_ss_local.sh b/ShadowsocksX-NG/ss-local/install_ss_local.sh
deleted file mode 100755
index 477ba90fd..000000000
--- a/ShadowsocksX-NG/ss-local/install_ss_local.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/bin/bash
-
-#  install_ss_local.sh
-#  ShadowsocksX-NG
-#
-#  Created by 邱宇舟 on 16/6/6.
-#  Copyright © 2016年 qiuyuzhou. All rights reserved.
-
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-NGDir="$HOME/Library/Application Support/ShadowsocksX-NG"
-TargetDir="$NGDir/ss-local-3.2.5"
-LatestTargetDir="$NGDir/ss-local-latest"
-
-echo ngdir: ${NGDir}
-
-# 3.2.5 https://bintray.com/homebrew/bottles/shadowsocks-libev/
-mkdir -p "$TargetDir"
-cp -f ss-local "$TargetDir"
-rm -f "$LatestTargetDir"
-ln -s "$TargetDir" "$LatestTargetDir"
-
-cp -f libev.4.dylib "$TargetDir"
-
-# 2.8.0 https://bintray.com/homebrew/bottles/mbedtls
-cp -f libmbedcrypto.2.12.0.dylib "$TargetDir"
-ln -sfh  "$TargetDir/libmbedcrypto.2.12.0.dylib" "$TargetDir/libmbedcrypto.2.dylib"
-ln -sfh  "$TargetDir/libmbedcrypto.2.12.0.dylib" "$TargetDir/libmbedcrypto.3.dylib"
-
-# 8.42 https://bintray.com/homebrew/bottles/pcre
-cp -f libpcre.1.dylib "$TargetDir"
-
-# 1.0.18 https://bintray.com/homebrew/bottles/libsodium
-cp -f libsodium.23.dylib "$TargetDir"
-ln -sfh "$TargetDir/libsodium.23.dylib" "$TargetDir/libsodium.dylib"
-
-#cp -f libudns.0.dylib "$TargetDir"
-
-# 1.15.0 https://bintray.com/homebrew/bottles/c-ares
-cp -f libcares.2.dylib "$TargetDir"
-ln -sfh "$TargetDir/libcares.2.dylib" "$TargetDir/libcares.dylib"
-
-echo done
diff --git a/ShadowsocksX-NG/ss-local/libcares.2.dylib b/ShadowsocksX-NG/ss-local/libcares.2.dylib
deleted file mode 100644
index 0d69f7983..000000000
Binary files a/ShadowsocksX-NG/ss-local/libcares.2.dylib and /dev/null differ
diff --git a/ShadowsocksX-NG/ss-local/libev.4.dylib b/ShadowsocksX-NG/ss-local/libev.4.dylib
deleted file mode 100644
index fba40d3e7..000000000
Binary files a/ShadowsocksX-NG/ss-local/libev.4.dylib and /dev/null differ
diff --git a/ShadowsocksX-NG/ss-local/libmbedcrypto.2.12.0.dylib b/ShadowsocksX-NG/ss-local/libmbedcrypto.2.12.0.dylib
deleted file mode 100644
index bfc970f6b..000000000
Binary files a/ShadowsocksX-NG/ss-local/libmbedcrypto.2.12.0.dylib and /dev/null differ
diff --git a/ShadowsocksX-NG/ss-local/libpcre.1.dylib b/ShadowsocksX-NG/ss-local/libpcre.1.dylib
deleted file mode 100644
index e1b138743..000000000
Binary files a/ShadowsocksX-NG/ss-local/libpcre.1.dylib and /dev/null differ
diff --git a/ShadowsocksX-NG/ss-local/libsodium.23.dylib b/ShadowsocksX-NG/ss-local/libsodium.23.dylib
deleted file mode 100644
index 1ae6e5052..000000000
Binary files a/ShadowsocksX-NG/ss-local/libsodium.23.dylib and /dev/null differ
diff --git a/ShadowsocksX-NG/ss-local/ss-local b/ShadowsocksX-NG/ss-local/ss-local
deleted file mode 100755
index f48262d1b..000000000
Binary files a/ShadowsocksX-NG/ss-local/ss-local and /dev/null differ
diff --git a/ShadowsocksX-NG/ss-local/start_ss_local.sh b/ShadowsocksX-NG/ss-local/start_ss_local.sh
deleted file mode 100755
index 2acccdfdc..000000000
--- a/ShadowsocksX-NG/ss-local/start_ss_local.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-#  start_ss_local.sh
-#  ShadowsocksX-NG
-#
-#  Created by 邱宇舟 on 16/6/6.
-#  Copyright © 2016年 qiuyuzhou. All rights reserved.
-
-chmod 644 "$HOME/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.local.plist"
-launchctl load -wF "$HOME/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.local.plist"
-launchctl start com.qiuyuzhou.shadowsocksX-NG.local
diff --git a/ShadowsocksX-NG/ss-local/stop_ss_local.sh b/ShadowsocksX-NG/ss-local/stop_ss_local.sh
deleted file mode 100755
index 15d59b369..000000000
--- a/ShadowsocksX-NG/ss-local/stop_ss_local.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/sh
-
-#  stop_ss_local.sh
-#  ShadowsocksX-NG
-#
-#  Created by 邱宇舟 on 16/6/6.
-#  Copyright © 2016年 qiuyuzhou. All rights reserved.
-
-launchctl stop com.qiuyuzhou.shadowsocksX-NG.local
-launchctl unload "$HOME/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.local.plist"
diff --git a/ShadowsocksX-NG/user-rule.txt b/ShadowsocksX-NG/user-rule.txt
deleted file mode 100644
index 7560bf52b..000000000
--- a/ShadowsocksX-NG/user-rule.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-! Put user rules line by line in this file.
-! See https://adblockplus.org/en/filter-cheatsheet
diff --git a/ShadowsocksX-NG/v2ray-plugin/install_v2ray_plugin.sh b/ShadowsocksX-NG/v2ray-plugin/install_v2ray_plugin.sh
deleted file mode 100644
index 2cc63dd0c..000000000
--- a/ShadowsocksX-NG/v2ray-plugin/install_v2ray_plugin.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/sh
-
-#  install_v2ray_plugin.sh
-#  ShadowsocksX-NG
-#
-#  Created by lkebin on 2019/2/18.
-#  Copyright © 2019 qiuyuzhou. All rights reserved.
-# https://github.com/shadowsocks/v2ray-plugin/
-
-# v2ray-core/v4 v4.38.3
-# build by go1.16.4
-#
-# v2ray-plugin_darwin_universal: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64]
-# v2ray-plugin_darwin_universal (for architecture x86_64):        Mach-O 64-bit executable x86_64
-# v2ray-plugin_darwin_universal (for architecture arm64): Mach-O 64-bit executable arm64
-VERSION="v1.3.1-9-gddd7ab4"
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-mkdir -p "$HOME/Library/Application Support/ShadowsocksX-NG/v2ray-plugin_$VERSION"
-cp -f v2ray-plugin "$HOME/Library/Application Support/ShadowsocksX-NG/v2ray-plugin_$VERSION/"
-
-ln -sfh "$HOME/Library/Application Support/ShadowsocksX-NG/v2ray-plugin_$VERSION/v2ray-plugin" "$HOME/Library/Application Support/ShadowsocksX-NG/plugins/v2ray-plugin"
-ln -sfh "$HOME/Library/Application Support/ShadowsocksX-NG/v2ray-plugin_$VERSION/v2ray-plugin" "$HOME/Library/Application Support/ShadowsocksX-NG/plugins/v2ray"
-
-echo "install v2ray-plugin done"
diff --git a/ShadowsocksX-NG/v2ray-plugin/v2ray-plugin b/ShadowsocksX-NG/v2ray-plugin/v2ray-plugin
deleted file mode 100755
index 02de80082..000000000
Binary files a/ShadowsocksX-NG/v2ray-plugin/v2ray-plugin and /dev/null differ
diff --git a/ShadowsocksX-NG/zh-Hans.lproj/ImportWindowController.strings b/ShadowsocksX-NG/zh-Hans.lproj/ImportWindowController.strings
deleted file mode 100644
index fd6799d78..000000000
--- a/ShadowsocksX-NG/zh-Hans.lproj/ImportWindowController.strings
+++ /dev/null
@@ -1,9 +0,0 @@
-
-/* Class = "NSButtonCell"; title = "Import"; ObjectID = "EW8-ld-aGr"; */
-"EW8-ld-aGr.title" = "导入";
-
-/* Class = "NSWindow"; title = "Import Server URLs"; ObjectID = "F0z-JX-Cv5"; */
-"F0z-JX-Cv5.title" = "导入服务器URLs";
-
-/* Class = "NSTextFieldCell"; placeholderString = "Copy your shadowsocks URLs to here"; ObjectID = "h31-8G-f2d"; */
-"h31-8G-f2d.placeholderString" = "复制shadowsocks URLs到这里";
diff --git a/ShadowsocksX-NG/zh-Hans.lproj/Localizable.strings b/ShadowsocksX-NG/zh-Hans.lproj/Localizable.strings
deleted file mode 100755
index c0b45cc8a..000000000
--- a/ShadowsocksX-NG/zh-Hans.lproj/Localizable.strings
+++ /dev/null
@@ -1,85 +0,0 @@
-
-
-
-
-/*
- * SHARED STRINGS
- */
-
-/*
- * ./PACUtils.swift
- */
-
-"PAC has been updated by latest GFW List." = "已经使用最新的 GFW List 更新PAC";
-
-"It's failed to update PAC by User Rules." = "更新 PAC 失败";
-
-"Failed to download latest GFW List." = "下载最新的 GFW 列表失败";
-
-/*
- * ./AppDelegate.swift
- */
-
-"Save Diagnosis to File" = "保存诊断信息到文件";
-
-"Global Mode" = "全局模式";
-
-"Manual Mode" = "手动模式";
-
-"Auto Mode By PAC" = "PAC自动模式";
-
-"Add \(addCount) Shadowsocks Server Profile" = "已添加\(addCount)个Shadowsocks服务器配置";
-
-"Not found valid qrcode or url of shadowsocks profile" = "没有找到有效的shadowsocks配置二维码或链接";
-
-"By scan QR Code" = "通过扫描二维码";
-
-"Shadowsocks: On" = "Shadowsocks: On";
-
-"Turn Shadowsocks Off" = "关闭 Shadowsocks";
-
-"Shadowsocks: Off" = "Shadowsocks: Off";
-
-"Turn Shadowsocks On" = "打开 Shadowsocks";
-
-"Servers" = "服务器";
-
-"Servers - (No Selected)" = "服务器 - (未选择)";
-
-"Add \(addCount) Shadowsocks Server Profile" = "新增 \(addCount) 个 Shadowsocks 服务器配置";
-
-"Not found valid QRCode of shadowsocks profile" = "未找到有效的 shadowsocks 二维码";
-
-"Not found valid URL of shadowsocks profile" = "未找到有效的 shadowsocks 链接";
-
-/*
- * ./HTTPPreferencesWindowController.swift
- */
-
-"Export Command Copied." = "Export 命令已复制至剪贴板";
-
-"Timeout" = "超时";
-
-/*
- * ./ShadowsocksX-NG/ShareServerProfilesWindowController.swift
- */
-
-"Save All Server URLs To File" = "保存所有服务器 URL 到文件";
-
-"Save QRCode As File" = "保存 QRCode 为文件";
-
-/*
- * ./ShadowsocksX-NG/ImportWindowController.swift
- */
-
-"Success to add \(addCount) server." = "成功添加 \(addCount) 个服务器";
-
-"Not found valid shadowsocks server urls." = "未找到有效的shadowsocks服务器URL";
-
-/*
- * ./ShadowsocksX-NG/PreferencesWindowController.swift
- */
-
-"New Server" = "新建服务器";
-
-
diff --git a/ShadowsocksX-NG/zh-Hans.lproj/MainMenu.strings b/ShadowsocksX-NG/zh-Hans.lproj/MainMenu.strings
deleted file mode 100644
index 9f71dac09..000000000
--- a/ShadowsocksX-NG/zh-Hans.lproj/MainMenu.strings
+++ /dev/null
@@ -1,120 +0,0 @@
-
-/* Class = "NSMenuItem"; title = "Preferences..."; ObjectID = "4CS-qD-zW5"; */
-"4CS-qD-zW5.title" = "偏好设置...";
-
-/* Class = "NSMenuItem"; title = "Import Server URLs From Pasteboard"; ObjectID = "7Eq-XD-K5c"; */
-"7Eq-XD-K5c.title" = "从剪贴板导入服务器配置链接";
-
-/* Class = "NSMenuItem"; title = "应用用户自定规则到 PAC"; ObjectID = "6qf-cg-HXc"; */
-"6qf-cg-HXc.title" = "应用用户自定规则到 PAC";
-
-/* Class = "NSMenuItem"; title = "手动模式"; ObjectID = "8PR-gs-c5N"; */
-"8PR-gs-c5N.title" = "手动模式";
-
-/* Class = "NSMenu"; title = "服务器"; ObjectID = "9Y1-db-3HK"; */
-"9Y1-db-3HK.title" = "服务器";
-
-/* Class = "NSMenuItem"; title = "打开 ShadowsocksX"; ObjectID = "GSu-Tf-StS"; */
-"GSu-Tf-StS.title" = "打开 ShadowsocksX";
-
-/* Class = "NSMenu"; title = "ShadowsocksX-NG"; ObjectID = "Hob-KD-bx9"; */
-"Hob-KD-bx9.title" = "ShadowsocksX-NG";
-
-/* Class = "NSMenuItem"; title = "显示日志..."; ObjectID = "Jfy-sf-Fhl"; */
-"Jfy-sf-Fhl.title" = "显示日志...";
-
-/* Class = "NSMenuItem"; title = "关于"; ObjectID = "LgB-6g-Gba"; */
-"LgB-6g-Gba.title" = "关于";
-
-/* Class = "NSMenuItem"; title = "服务器设置..."; ObjectID = "M5r-E7-44f"; */
-"M5r-E7-44f.title" = "服务器设置...";
-
-/* Class = "NSMenuItem"; title = "全局模式"; ObjectID = "Mw3-Jm-eXA"; */
-"Mw3-Jm-eXA.title" = "全局模式";
-
-/* Class = "NSMenuItem"; title = "扫描屏幕上的二维码..."; ObjectID = "Qe6-bF-paT"; */
-"Qe6-bF-paT.title" = "扫描屏幕上的二维码";
-
-/* Class = "NSMenuItem"; title = "显示当前服务器的二维码..."; ObjectID = "R6A-96-Zcb"; */
-"R6A-96-Zcb.title" = "显示当前服务器的二维码...";
-
-/* Class = "NSMenuItem"; title = "从 GFW List 更新PAC"; ObjectID = "TFc-Ec-duM"; */
-"TFc-Ec-duM.title" = "从 GFW List 更新PAC";
-
-/* Class = "NSMenuItem"; title = "复制终端代理命令"; ObjectID = "lg6-To-GZA"; */
-"lg6-To-GZA.title" = "复制终端代理命令";
-
-/* Class = "NSMenuItem"; title = "反馈"; ObjectID = "W7u-7g-Gv4"; */
-"W7u-7g-Gv4.title" = "反馈";
-
-/* Class = "NSMenu"; title = "代理"; ObjectID = "YZp-bf-L40"; */
-"YZp-bf-L40.title" = "代理";
-
-/* Class = "NSMenuItem"; title = "Advanced Preferences ..."; ObjectID = "bZ3-fy-34d"; */
-"bZ3-fy-34d.title" = "高级设置...";
-
-/* Class = "NSMenuItem"; title = "代理"; ObjectID = "diI-fB-Rss"; */
-"diI-fB-Rss.title" = "代理";
-
-/* Class = "NSMenuItem"; title = "登录时自动启动"; ObjectID = "eUq-p7-ICK"; */
-"eUq-p7-ICK.title" = "登录时自动启动";
-
-/* Class = "NSMenuItem"; title = "Showsocks: On"; ObjectID = "fzk-mE-CEV"; */
-"fzk-mE-CEV.title" = "Showsocks: On";
-
-/* Class = "NSMenuItem"; title = "PAC自动模式"; ObjectID = "r07-Gu-aEz"; */
-"r07-Gu-aEz.title" = "PAC自动模式";
-
-/* Class = "NSMenuItem"; title = "Auto Mode By External PAC"; ObjectID = "U9N-QS-BwB"; */
-"U9N-QS-BwB.title" = "外部PAC自动模式";
-
-/* Class = "NSMenuItem"; title = "编辑PAC用户自定规则..."; ObjectID = "rms-p0-CvB"; */
-"rms-p0-CvB.title" = "编辑PAC用户自定规则...";
-
-/* Class = "NSMenuItem"; title = "Advanced PAC Proxy Preferences..."; ObjectID = "sbx-yz-3lO"; */
-"sbx-yz-3lO.title" = "高级PAC代理设置...";
-
-/* Class = "NSMenuItem"; title = "服务器"; ObjectID = "u5M-hQ-VSc"; */
-"u5M-hQ-VSc.title" = "服务器";
-
-/* Class = "NSMenuItem"; title = "退出"; ObjectID = "vJS-JW-byz"; */
-"vJS-JW-byz.title" = "退出";
-
-/* Class = "NSMenuItem"; title = "Ping server"; ObjectID = "zfR-Jt-GmS"; */
-"zfR-Jt-GmS.title" = "服务器测速";
-
-/* Class = "NSMenuItem"; title = "Show network speed"; ObjectID = "a3h-uQ-DuO"; */
-"a3h-uQ-DuO.title" = "显示网速";
-
-/* Class = "NSMenuItem"; title = "Connect At Launch"; ObjectID = "aB3-cf-5j0"; */
-"aB3-cf-5j0.title" = "打开时自动连接";
-
-/* Class = "NSMenuItem"; title = "HTTP Proxy Preference ..."; ObjectID = "uEp-Gz-cu0"; */
-"uEp-Gz-cu0.title" = "HTTP代理设置...";
-
-/* Class = "NSMenuItem"; title = "Show Bunch Json Example File..."; ObjectID = "pdy-JE-50Q"; */
-"pdy-JE-50Q.title" = "显示示例服务器配置文件...";
-
-/* Class = "NSMenuItem"; title = "Import Bunch Json File..."; ObjectID = "T9g-gy-gvv"; */
-"T9g-gy-gvv.title" = "导入服务器配置文件...";
-
-/* Class = "NSMenuItem"; title = "Export All Server To Json..."; ObjectID = "6k0-gn-DQv"; */
-"6k0-gn-DQv.title" = "导出全部服务器配置...";
-
-/* Class = "NSMenuItem"; title = "Preferences"; ObjectID = "iVn-LD-Ynd"; */
-"iVn-LD-Ynd.title" = "偏好设置";
-
-/* Class = "NSMenuItem"; title = "Share Server Profiles..."; ObjectID = "r5z-RB-LIZ"; */
-"r5z-RB-LIZ.title" = "分享服务器配置...";
-
-/* Class = "NSMenuItem"; title = "Help"; ObjectID = "Xg8-er-4Ov"; */
-"Xg8-er-4Ov.title" = "帮助";
-
-/* Class = "NSMenuItem"; title = "Check for Updates..."; ObjectID = "hLv-bp-doM"; */
-"hLv-bp-doM.title" = "检查更新...";
-
-/* Class = "NSMenuItem"; title = "Export Diagnosis..."; ObjectID = "eNh-vY-utd"; */
-"eNh-vY-utd.title" = "导出诊断信息...";
-
-/* Class = "NSMenuItem"; title = "Import Server URLs..."; ObjectID = "geG-dQ-OYl"; */
-"geG-dQ-OYl.title" = "导入服务器URL...";
diff --git a/ShadowsocksX-NG/zh-Hans.lproj/PreferencesWinController.strings b/ShadowsocksX-NG/zh-Hans.lproj/PreferencesWinController.strings
deleted file mode 100644
index b61656e97..000000000
--- a/ShadowsocksX-NG/zh-Hans.lproj/PreferencesWinController.strings
+++ /dev/null
@@ -1,143 +0,0 @@
-/* Class = "NSTextFieldCell"; title = "Seconds"; ObjectID = "4R2-UO-qs7"; */
-"4R2-UO-qs7.title" = "秒";
-
-/* Class = "NSTextFieldCell"; title = "HTTP Proxy Listen Address:"; ObjectID = "6W4-TY-Bw5"; */
-"6W4-TY-Bw5.title" = "HTTP代理监听地址:";
-
-/* Class = "NSButtonCell"; title = "Check"; ObjectID = "8Ku-VV-ZaY"; */
-"8Ku-VV-ZaY.title" = "Check";
-
-/* Class = "NSToolbarItem"; label = "Servers"; ObjectID = "8Nu-gG-5rY"; */
-"8Nu-gG-5rY.label" = "Servers";
-
-/* Class = "NSToolbarItem"; paletteLabel = "Servers"; ObjectID = "8Nu-gG-5rY"; */
-"8Nu-gG-5rY.paletteLabel" = "Servers";
-
-/* Class = "NSTextFieldCell"; title = "Local Socks5 Listen Port:"; ObjectID = "8fk-fw-Tsx"; */
-"8fk-fw-Tsx.title" = "本地Socks5监听端口:";
-
-/* Class = "NSTextFieldCell"; title = "Toggle Shadowsocks On/Off:"; ObjectID = "95S-ma-8Q7"; */
-"95S-ma-8Q7.title" = "开关 Shadowsocks:";
-
-/* Class = "NSTextFieldCell"; title = "Switch proxy mode:"; ObjectID = "BaL-cn-m8v"; */
-"BaL-cn-m8v.title" = "切换代理模式:";
-
-/* Class = "NSToolbarItem"; label = "Interfaces"; ObjectID = "Bdm-pj-Ckd"; */
-"Bdm-pj-Ckd.label" = "网络接口";
-
-/* Class = "NSToolbarItem"; paletteLabel = "Interfaces"; ObjectID = "Bdm-pj-Ckd"; */
-"Bdm-pj-Ckd.paletteLabel" = "网络接口";
-
-/* Class = "NSToolbarItem"; label = "Kcptun"; ObjectID = "CIc-BO-xjN"; */
-"CIc-BO-xjN.label" = "Kcptun";
-
-/* Class = "NSToolbarItem"; paletteLabel = "Kcptun"; ObjectID = "CIc-BO-xjN"; */
-"CIc-BO-xjN.paletteLabel" = "Kcptun";
-
-/* Class = "NSToolbarItem"; label = "HTTP"; ObjectID = "D0F-6S-Ztu"; */
-"D0F-6S-Ztu.label" = "HTTP";
-
-/* Class = "NSToolbarItem"; paletteLabel = "HTTP"; ObjectID = "D0F-6S-Ztu"; */
-"D0F-6S-Ztu.paletteLabel" = "HTTP";
-
-/* Class = "NSTabViewItem"; label = "Servers"; ObjectID = "Dsu-Ba-zYR"; */
-"Dsu-Ba-zYR.label" = "Servers";
-
-/* Class = "NSWindow"; title = "Preferences"; ObjectID = "F0z-JX-Cv5"; */
-"F0z-JX-Cv5.title" = "偏好设置";
-
-/* Class = "NSTabViewItem"; label = "HTTP"; ObjectID = "F5Q-Ce-JJN"; */
-"F5Q-Ce-JJN.label" = "HTTP";
-
-/* Class = "NSTextFieldCell"; title = "Num of Kcptun connections:"; ObjectID = "FSi-9j-QBe"; */
-"FSi-9j-QBe.title" = "Num of Kcptun connections:";
-
-/* Class = "NSButtonCell"; title = "Local PAC Server Bind To Localhost"; ObjectID = "oCf-id-PAx"; */
-"oCf-id-PAx.title" = "本地PAC服务器监听localhost";
-
-/* Class = "NSTextFieldCell"; title = "Local PAC Server Listen Port:"; ObjectID = "IMQ-c4-gmc"; */
-"IMQ-c4-gmc.title" = "本地PAC服务器监听端口:";
-
-/* Class = "NSToolbarItem"; label = "General"; ObjectID = "Mp8-cF-kQ7"; */
-"Mp8-cF-kQ7.label" = "常规";
-
-/* Class = "NSToolbarItem"; paletteLabel = "General"; ObjectID = "Mp8-cF-kQ7"; */
-"Mp8-cF-kQ7.paletteLabel" = "常规";
-
-/* Class = "NSButtonCell"; title = "Enable Udp Replay"; ObjectID = "R3v-iN-zu8"; */
-"R3v-iN-zu8.title" = "启用 UDP 中继";
-
-/* Class = "NSTextFieldCell"; title = "HTTP Proxy Listen Port:"; ObjectID = "Ww9-j9-WYR"; */
-"Ww9-j9-WYR.title" = "HTTP代理监听端口:";
-
-/* Class = "NSButtonCell"; title = "Launch At Login"; ObjectID = "XJx-j4-bBr"; */
-"XJx-j4-bBr.title" = "开机启动";
-
-/* Class = "NSButtonCell"; title = "Auto Configure"; ObjectID = "bu3-s5-bYM"; */
-"bu3-s5-bYM.title" = "自动配置";
-
-/* Class = "NSTextFieldCell"; title = "Bypass proxy settings for these Hosts & Domains:"; ObjectID = "v4F-L4-s8U"; */
-"v4F-L4-s8U.title" = "忽略这些主机与域的代理设置：";
-
-/* Class = "NSButtonCell"; title = "Enable Verbose Mode"; ObjectID = "cIS-Wb-Rzg"; */
-"cIS-Wb-Rzg.title" = "Enable Verbose Mode";
-
-/* Class = "NSTabViewItem"; label = "Interfaces"; ObjectID = "eDR-CZ-P4p"; */
-"eDR-CZ-P4p.label" = "网络接口";
-
-/* Class = "NSTextFieldCell"; title = "Local Kcptun Listen Address:"; ObjectID = "ejW-7L-9bP"; */
-"ejW-7L-9bP.title" = "Kcptun 本地监听地址:";
-
-/* Class = "NSTabViewItem"; label = "Shortcuts"; ObjectID = "gpA-k4-fiw"; */
-"gpA-k4-fiw.label" = "快捷键";
-
-/* Class = "NSTextFieldCell"; title = "Local Socks5 Listen Address:"; ObjectID = "jkc-e3-4O0"; */
-"jkc-e3-4O0.title" = "本地Socks5监听地址:";
-
-/* Class = "NSButtonCell"; title = "HTTP Proxy Enable"; ObjectID = "jr6-x7-WJD"; */
-"jr6-x7-WJD.title" = "开启HTTP代理服务器";
-
-/* Class = "NSTabViewItem"; label = "Advanced"; ObjectID = "ksf-9b-qoz"; */
-"ksf-9b-qoz.label" = "高级";
-
-/* Class = "NSToolbarItem"; label = "Advanced"; ObjectID = "kuN-wm-bl5"; */
-"kuN-wm-bl5.label" = "高级";
-
-/* Class = "NSToolbarItem"; paletteLabel = "Advanced"; ObjectID = "kuN-wm-bl5"; */
-"kuN-wm-bl5.paletteLabel" = "高级";
-
-/* Class = "NSToolbarItem"; label = "Shortcuts"; ObjectID = "kzb-T5-CPp"; */
-"kzb-T5-CPp.label" = "快捷键";
-
-/* Class = "NSToolbarItem"; paletteLabel = "Shortcuts"; ObjectID = "kzb-T5-CPp"; */
-"kzb-T5-CPp.paletteLabel" = "快捷键";
-
-/* Class = "NSTabViewItem"; label = "Kcptun"; ObjectID = "n2m-5k-0Ws"; */
-"n2m-5k-0Ws.label" = "Kcptun";
-
-/* Class = "NSTextFieldCell"; title = "Local Kcptun Listen Port:"; ObjectID = "pdk-mh-FAj"; */
-"pdk-mh-FAj.title" = "Kcptun 本地监听端口:";
-
-/* Class = "NSTextFieldCell"; title = "Timeout:"; ObjectID = "sQ9-bj-V0I"; */
-"sQ9-bj-V0I.title" = "超时:";
-
-/* Class = "NSTextFieldCell"; title = "Which network interfaces  proxy setting would be controlled by ShadowsocksX-NG"; ObjectID = "t0I-6n-gnu"; */
-"t0I-6n-gnu.title" = "Which network interfaces  proxy setting would be controlled by ShadowsocksX-NG";
-
-/* Class = "NSTextFieldCell"; title = "GFW List URL:"; ObjectID = "v7a-wf-aEm"; */
-"v7a-wf-aEm.title" = "GFW List URL:";
-
-/* Class = "NSButtonCell"; title = "Show Running Proxy Mode In Status Bar"; ObjectID = "wXO-Qz-yDg"; */
-"wXO-Qz-yDg.title" = "在状态栏显示当前代理模式";
-
-/* Class = "NSTabViewItem"; label = "General"; ObjectID = "xbG-eW-Prj"; */
-"xbG-eW-Prj.label" = "常规";
-
-/* Class = "NSButtonCell"; title = "Set HTTP proxy to system proxy configure in global mode"; ObjectID = "m8L-D6-ye3"; */
-"m8L-D6-ye3.title" = "全局模式时，在系统代理中设置HTTP代理服务器";
-
-/* Class = "NSTextFieldCell"; title = "External PAC URL:"; ObjectID = "kBe-eq-uZL"; */
-"kBe-eq-uZL.title" = "外部PAC URL:";
-
-/* Class = "NSButtonCell"; title = "Reset Preferences"; ObjectID = "mQC-AR-HXC"; */
-"mQC-AR-HXC.title" = "重置偏好设置";
diff --git a/ShadowsocksX-NG/zh-Hans.lproj/PreferencesWindowController.strings b/ShadowsocksX-NG/zh-Hans.lproj/PreferencesWindowController.strings
deleted file mode 100644
index c3ef9a8f4..000000000
--- a/ShadowsocksX-NG/zh-Hans.lproj/PreferencesWindowController.strings
+++ /dev/null
@@ -1,48 +0,0 @@
-
-/* Class = "NSTextFieldCell"; title = "Text"; ObjectID = "COZ-Qr-bmU"; */
-"COZ-Qr-bmU.title" = "Text";
-
-/* Class = "NSWindow"; title = "Server Preferences"; ObjectID = "F0z-JX-Cv5"; */
-"F0z-JX-Cv5.title" = "服务器设置";
-
-/* Class = "NSBox"; title = "Box"; ObjectID = "Gqv-5O-Wwf"; */
-"Gqv-5O-Wwf.title" = "Box";
-
-/* Class = "NSTextFieldCell"; title = ":"; ObjectID = "Ibr-Gs-5Js"; */
-"Ibr-Gs-5Js.title" = ":";
-
-/* Class = "NSTextFieldCell"; title = "Remarks:"; ObjectID = "MiN-VE-FtC"; */
-"MiN-VE-FtC.title" = "备注:";
-
-/* Class = "NSButtonCell"; title = "Enable OTA"; ObjectID = "hRZ-Rp-I5e"; */
-"hRZ-Rp-I5e.title" = "启用 OTA (被废弃)";
-
-/* Class = "NSButtonCell"; title = "Cacnel"; ObjectID = "j03-9E-uHW"; */
-"j03-9E-uHW.title" = "取消";
-
-/* Class = "NSTextFieldCell"; title = "Password:"; ObjectID = "kil-xC-HPD"; */
-"kil-xC-HPD.title" = "密码:";
-
-/* Class = "NSTextFieldCell"; title = "Encryption:"; ObjectID = "mOh-nD-7EX"; */
-"mOh-nD-7EX.title" = "加密方法:";
-
-/* Class = "NSButtonCell"; title = "Copy URL to Clipboard"; ObjectID = "t3T-Kd-5La"; */
-"t3T-Kd-5La.title" = "复制服务器URL到剪贴板";
-
-/* Class = "NSTextFieldCell"; title = "Address:"; ObjectID = "yHs-XE-XEB"; */
-"yHs-XE-XEB.title" = "地址:";
-
-/* Class = "NSButtonCell"; title = "OK"; ObjectID = "zPE-oD-PwK"; */
-"zPE-oD-PwK.title" = "确定";
-
-/* Class = "NSMenuItem"; title = "Clone"; ObjectID = "bl9-lq-u9V"; */
-"bl9-lq-u9V.title" = "克隆";
-
-/* Class = "NSTextFieldCell"; title = "Plugin:"; ObjectID = "gDt-yZ-Mqs"; */
-"gDt-yZ-Mqs.title" = "插件:";
-
-/* Class = "NSTextFieldCell"; title = "Plugin Opts:"; ObjectID = "orT-7j-dxE"; */
-"orT-7j-dxE.title" = "插件选项:";
-
-/* Class = "NSButtonCell"; title = "Open Plugin Folder..."; ObjectID = "T8q-g1-qjN"; */
-"T8q-g1-qjN.title" = "打开插件目录...";
diff --git a/ShadowsocksX-NG/zh-Hans.lproj/ShareServerProfilesWindowController.strings b/ShadowsocksX-NG/zh-Hans.lproj/ShareServerProfilesWindowController.strings
deleted file mode 100644
index 8def4b007..000000000
--- a/ShadowsocksX-NG/zh-Hans.lproj/ShareServerProfilesWindowController.strings
+++ /dev/null
@@ -1,19 +0,0 @@
-
-/* Class = "NSButtonCell"; title = "Save All Server URLs As File"; ObjectID = "9OS-xy-GB1"; */
-"9OS-xy-GB1.title" = "保存所有服务器链接到文件";
-
-/* Class = "NSWindow"; title = "Share Server Profiles"; ObjectID = "F0z-JX-Cv5"; */
-"F0z-JX-Cv5.title" = "分享服务器配置";
-
-/* Class = "NSButtonCell"; title = "Save QRCode As File"; ObjectID = "IaI-Rj-Kss"; */
-"IaI-Rj-Kss.title" = "保存二维码到文件";
-
-/* Class = "NSButtonCell"; title = "Copy URL"; ObjectID = "PHX-gY-lZe"; */
-"PHX-gY-lZe.title" = "复制链接";
-
-/* Class = "NSButtonCell"; title = "Copy QRCode"; ObjectID = "PrW-s6-Uab"; */
-"PrW-s6-Uab.title" = "复制二维码";
-
-/* Class = "NSButtonCell"; title = "Copy All Server URLs"; ObjectID = "Yt2-p1-4w0"; */
-"Yt2-p1-4w0.title" = "复制所有服务器链接";
-
diff --git a/ShadowsocksX-NG/zh-Hans.lproj/UserRulesController.strings b/ShadowsocksX-NG/zh-Hans.lproj/UserRulesController.strings
deleted file mode 100644
index c432a0500..000000000
--- a/ShadowsocksX-NG/zh-Hans.lproj/UserRulesController.strings
+++ /dev/null
@@ -1,9 +0,0 @@
-
-/* Class = "NSButtonCell"; title = "OK"; ObjectID = "0Sc-cm-Vyu"; */
-"0Sc-cm-Vyu.title" = "确定";
-
-/* Class = "NSWindow"; title = "User Rules"; ObjectID = "F0z-JX-Cv5"; */
-"F0z-JX-Cv5.title" = "用户规则";
-
-/* Class = "NSButtonCell"; title = "Cancel"; ObjectID = "QAR-9i-kmv"; */
-"QAR-9i-kmv.title" = "取消";
diff --git a/ShadowsocksX-NG2/.editorconfig b/ShadowsocksX-NG2/.editorconfig
new file mode 100644
index 000000000..f2fa136c9
--- /dev/null
+++ b/ShadowsocksX-NG2/.editorconfig
@@ -0,0 +1,7 @@
+root = true
+
+[*.swift]
+indent_style = space
+indent_size = 2
+tab_width = 2
+max_line_length = 100
diff --git a/ShadowsocksX-NG2/.gitignore b/ShadowsocksX-NG2/.gitignore
new file mode 100644
index 000000000..11749ef09
--- /dev/null
+++ b/ShadowsocksX-NG2/.gitignore
@@ -0,0 +1 @@
+Taskfile.yml
\ No newline at end of file
diff --git a/ShadowsocksX-NG2/.swift-format b/ShadowsocksX-NG2/.swift-format
new file mode 100644
index 000000000..e9ca5e652
--- /dev/null
+++ b/ShadowsocksX-NG2/.swift-format
@@ -0,0 +1,81 @@
+{
+  "fileScopedDeclarationPrivacy" : {
+    "accessLevel" : "private"
+  },
+  "indentBlankLines" : false,
+  "indentConditionalCompilationBlocks" : true,
+  "indentSwitchCaseLabels" : false,
+  "indentation" : {
+    "spaces" : 2
+  },
+  "lineBreakAroundMultilineExpressionChainComponents" : false,
+  "lineBreakBeforeControlFlowKeywords" : false,
+  "lineBreakBeforeEachArgument" : false,
+  "lineBreakBeforeEachGenericRequirement" : false,
+  "lineBreakBetweenDeclarationAttributes" : false,
+  "lineLength" : 100,
+  "maximumBlankLines" : 1,
+  "multiElementCollectionTrailingCommas" : true,
+  "multilineTrailingCommaBehavior" : "keptAsWritten",
+  "noAssignmentInExpressions" : {
+    "allowedFunctions" : [
+      "XCTAssertNoThrow"
+    ]
+  },
+  "orderedImports" : {
+    "includeConditionalImports" : false,
+    "shouldGroupImports" : true
+  },
+  "prioritizeKeepingFunctionOutputTogether" : false,
+  "reflowMultilineStringLiterals" : "never",
+  "respectsExistingLineBreaks" : true,
+  "rules" : {
+    "AllPublicDeclarationsHaveDocumentation" : false,
+    "AlwaysUseLiteralForEmptyCollectionInit" : false,
+    "AlwaysUseLowerCamelCase" : true,
+    "AmbiguousTrailingClosureOverload" : true,
+    "AvoidRetroactiveConformances" : true,
+    "BeginDocumentationCommentWithOneLineSummary" : false,
+    "DoNotUseSemicolons" : true,
+    "DontRepeatTypeInStaticProperties" : true,
+    "FileScopedDeclarationPrivacy" : true,
+    "FullyIndirectEnum" : true,
+    "GroupNumericLiterals" : true,
+    "IdentifiersMustBeASCII" : true,
+    "NeverForceUnwrap" : false,
+    "NeverUseForceTry" : false,
+    "NeverUseImplicitlyUnwrappedOptionals" : false,
+    "NoAccessLevelOnExtensionDeclaration" : true,
+    "NoAssignmentInExpressions" : true,
+    "NoBlockComments" : true,
+    "NoCasesWithOnlyFallthrough" : true,
+    "NoEmptyLinesOpeningClosingBraces" : false,
+    "NoEmptyTrailingClosureParentheses" : true,
+    "NoLabelsInCasePatterns" : true,
+    "NoLeadingUnderscores" : false,
+    "NoParensAroundConditions" : true,
+    "NoPlaygroundLiterals" : true,
+    "NoVoidReturnOnFunctionSignature" : true,
+    "OmitExplicitReturns" : false,
+    "OneCasePerLine" : true,
+    "OneVariableDeclarationPerLine" : true,
+    "OnlyOneTrailingClosureArgument" : true,
+    "OrderedImports" : true,
+    "ReplaceForEachWithForLoop" : true,
+    "ReturnVoidInsteadOfEmptyTuple" : true,
+    "TypeNamesShouldBeCapitalized" : true,
+    "UseEarlyExits" : false,
+    "UseExplicitNilCheckInConditions" : true,
+    "UseLetInEveryBoundCaseVariable" : true,
+    "UseShorthandTypeNames" : true,
+    "UseSingleLinePropertyGetter" : true,
+    "UseSynthesizedInitializer" : true,
+    "UseTripleSlashForDocumentationComments" : true,
+    "UseWhereClausesInForLoops" : false,
+    "ValidateDocumentationComments" : false
+  },
+  "spacesAroundRangeFormationOperators" : false,
+  "spacesBeforeEndOfLineComments" : 2,
+  "tabWidth" : 8,
+  "version" : 1
+}
diff --git a/ShadowsocksX-NG2/.swiftlint.yml b/ShadowsocksX-NG2/.swiftlint.yml
new file mode 100644
index 000000000..98cb6db85
--- /dev/null
+++ b/ShadowsocksX-NG2/.swiftlint.yml
@@ -0,0 +1,20 @@
+# 默认规则起步：只声明排除项，遇到实际痛点再调规则（见本目录 AGENTS.md）。
+# 路径相对本文件所在目录。
+strict: true
+excluded:
+  # 构建产物。注意 build/ 与 .build/ 是两回事：不带 -derivedDataPath 的
+  # xcodebuild 会把构建落进项目内的 build/，其中 DerivedSources/ 下的生成源码
+  # （如 GeneratedAssetSymbols.swift）会进 lint 范围并报出与手写代码无关的违规
+  # ——这是补上 build 这条的触发案例。
+  - DerivedData
+  - .build
+  - build
+disabled_rules:
+  # 与 .swift-format 基线冲突：SwiftFormat 的多元素集合尾逗号和
+  # 多行条件/签名的换行规则会被 SwiftLint 的自动修正规则改回去。
+  # 触发案例：Domain/CredentialStore.swift 的 Keychain 查询字典由
+  # multiElementCollectionTrailingCommas=true 保留尾逗号；
+  # App/SettingsView.swift 的多行条件由 SwiftFormat 保留独立的 {。
+  # pre-commit 先 format 再 lint；关闭冲突规则以 .swift-format 为准。
+  - trailing_comma
+  - opening_brace
diff --git a/ShadowsocksX-NG2/AGENTS.md b/ShadowsocksX-NG2/AGENTS.md
new file mode 100644
index 000000000..f2aaa20ec
--- /dev/null
+++ b/ShadowsocksX-NG2/AGENTS.md
@@ -0,0 +1,11 @@
+# ShadowsocksX-NG2
+
+See the root [`AGENTS.md`](../AGENTS.md) for repository conventions and [`README.md`](README.md) for project and development documentation.
+
+## Testing principles
+
+- Keep unit tests hostless and access packaged resources through explicit dependency injection.
+- Isolate test resources to support parallel execution across multiple runners.
+- Choose the smallest deterministic inputs that serve the assertions. When optimizing duration, preserve the tested workflow, scenario relationships, and timing semantics.
+
+Before adding or modifying tests or optimizing test duration, read [Writing and optimizing tests](../docs/development.md#writing-and-optimizing-tests) for framework selection, resource lookup, fixture design, and measurement methods.
diff --git a/ShadowsocksX-NG2/Agent/AgentContract.swift b/ShadowsocksX-NG2/Agent/AgentContract.swift
new file mode 100644
index 000000000..8b1a51bbf
--- /dev/null
+++ b/ShadowsocksX-NG2/Agent/AgentContract.swift
@@ -0,0 +1,129 @@
+import Foundation
+
+// MARK: - 契约与子进程
+
+enum ContractLoad {
+  case missing
+  case invalid
+  case loaded(RuntimeSupervision)
+}
+
+func loadContract() -> ContractLoad {
+  guard FileManager.default.fileExists(atPath: supervisionURL.path) else { return .missing }
+  guard let document = RuntimePublication.load(at: supervisionURL) else { return .invalid }
+  return .loaded(document)
+}
+
+func writeRuntimeReceipt(for document: RuntimeSupervision, processID: Int32) -> Bool {
+  let receipt = RuntimeDeploymentReceipt(processID: processID, deploymentID: document.deploymentID)
+  do {
+    try AtomicFileWriter.write(JSONEncoder().encode(receipt), to: runtimeStatusFileURL)
+    return true
+  } catch { return false }
+}
+
+func deploymentHasFailed(_ document: RuntimeSupervision) -> Bool {
+  guard let data = try? Data(contentsOf: failureURL),
+    let failure = try? JSONDecoder().decode(RuntimeDeploymentFailure.self, from: data)
+  else { return false }
+  return failure.deploymentID == document.deploymentID
+}
+
+func recordDeploymentFailure(_ document: RuntimeSupervision, reason: String) {
+  do {
+    try RuntimePublication.withLock(in: contractURL.deletingLastPathComponent()) {
+      // 新发布不得被旧监管任务标成失败。
+      guard RuntimePublication.metadata(at: supervisionURL)?.deploymentID == document.deploymentID
+      else { return }
+      try AtomicFileWriter.write(
+        JSONEncoder().encode(
+          RuntimeDeploymentFailure(
+            deploymentID: document.deploymentID, reason: reason)), to: failureURL)
+    }
+  } catch {
+    RuntimeLog.emit(.runtimePersistFailed(detail: "Deployment failure persistence failed"))
+  }
+}
+
+func selectDeployment(_ document: RuntimeSupervision) -> Bool {
+  do {
+    try RuntimePublication.select(document, configurationLink: contractURL, aclLink: aclFileURL)
+    return true
+  } catch { return false }
+}
+
+func retireFiles(_ document: RuntimeSupervision, protecting: Set<String>) -> Bool {
+  do {
+    try RuntimePublication.retire(
+      before: document, publishedAt: supervisionURL, protecting: protecting)
+    return true
+  } catch {
+    RuntimeLog.emit(.runtimePersistFailed(detail: "Retired runtime file cleanup failed"))
+    return false
+  }
+}
+
+func clearRuntimeReceipt() {
+  try? FileManager.default.removeItem(at: runtimeStatusFileURL)
+}
+
+func spawnSslocal() -> Process? {
+  guard FileManager.default.isExecutableFile(atPath: sslocalURL.path) else { return nil }
+  let child = Process()
+  let errorPipe = Pipe()
+  // sslocal 输出 intake：分帧 + 密码脱敏后送两个去向——agent.log 文件
+  // （经 stderr 收敛，按统一行格式落盘）与统一日志（category `sslocal`）。
+  let outputIntake = SslocalOutputIntake(
+    destinations: [SslocalStandardErrorDestination(), SslocalUnifiedLogDestination()])
+  child.standardError = errorPipe
+  child.standardOutput = errorPipe
+  errorPipe.fileHandleForReading.readabilityHandler = { handle in
+    let data = handle.availableData
+    outputIntake.write(data)
+    if data.isEmpty { handle.readabilityHandler = nil }
+  }
+  child.executableURL = sslocalURL
+  child.arguments = ["-c", contractURL.path, "--log-without-time"]
+  var childEnvironment = environment
+  // 不配置 sslocal 日志级别；未设置时使用上游默认值，显式外部 RUST_LOG 原样透传。
+  // macOS 的 resolv.conf 可能含带 zone id 的链路本地 nameserver（RA 下发的
+  // RDNSS，如 fe80::…%en0），hickory 解析不了该后缀（hickory-dns#3713），
+  // 每次启动都报错再回退 builtin。强制 builtin getaddrinfo 即回退后的实际
+  // 路径，跳过这段噪音；显式外部设置仍可覆盖以便诊断。
+  if childEnvironment["SS_SYSTEM_DNS_RESOLVER_FORCE_BUILTIN"] == nil {
+    childEnvironment["SS_SYSTEM_DNS_RESOLVER_FORCE_BUILTIN"] = "1"
+  }
+  child.environment = childEnvironment
+  do {
+    try child.run()
+    try? errorPipe.fileHandleForWriting.close()
+  } catch {
+    return nil
+  }
+  RuntimeLog.emit(.sslocalSpawned(pid: child.processIdentifier))
+  return child
+}
+
+// MARK: - 日志收敛
+
+func redirectStandardStreams(to logURL: URL) {
+  let fileManager = FileManager.default
+  let directory = logURL.deletingLastPathComponent()
+  try? AtomicFileWriter.prepareDirectory(at: directory)
+  if fileManager.fileExists(atPath: logURL.path) {
+    let attributes = try? fileManager.attributesOfItem(atPath: logURL.path)
+    if let size = attributes?[.size] as? UInt64, size > 1_048_576 {
+      // agent.log 文件去向（stderr→freopen）的保留策略：启动时超限即截断，
+      // 当前不滚动或导出诊断日志。策略留在这个文件去向（wrapper 事件行与
+      // 脱敏后的 sslocal 行共写这一个文件），不并入 sslocal 输出 intake。
+      try? fileManager.removeItem(at: logURL)
+    }
+  }
+  if !fileManager.fileExists(atPath: logURL.path) {
+    fileManager.createFile(
+      atPath: logURL.path, contents: nil, attributes: [.posixPermissions: 0o600])
+  }
+  try? fileManager.setAttributes([.posixPermissions: 0o600], ofItemAtPath: logURL.path)
+  freopen(logURL.path, "a", stdout)
+  freopen(logURL.path, "a", stderr)
+}
diff --git a/ShadowsocksX-NG2/Agent/AgentListening.swift b/ShadowsocksX-NG2/Agent/AgentListening.swift
new file mode 100644
index 000000000..ae1060a7e
--- /dev/null
+++ b/ShadowsocksX-NG2/Agent/AgentListening.swift
@@ -0,0 +1,36 @@
+import Foundation
+
+// MARK: - 监听建立判定
+
+/// 覆盖插件启动、上游初始测速（默认超时 5 秒）与调度余量；GUI 健康窗另留拉起时间。
+let listenEstablishmentDeadline: TimeInterval = 15
+/// 单次探测超时与轮询间隔；正常启动百毫秒级完成，超时路径总耗时不超时限太多。
+let listenProbeTimeout: TimeInterval = 0.25
+let listenProbeInterval: TimeInterval = 0.1
+
+/// 返回首个未通过的检查；nil 表示所有入站已就绪。轮询只在期限到达时输出失败。
+func listenerReadinessFailure(
+  document: RuntimeSupervision,
+  child: Process
+) -> String? {
+  guard child.isRunning else { return "check=process outcome=exited" }
+  for local in document.locals {
+    let endpoint = "endpoint=\(local.inboundProtocol) \(local.localAddress):\(local.localPort)"
+    let connection = "\(endpoint) probeHost=\(local.probeHost) check=connect"
+    switch EndpointHealthProbe.probe(
+      host: local.probeHost, port: local.localPort, timeout: listenProbeTimeout)
+    {
+    case .reachable: break
+    case .refused(let detail): return "\(connection) outcome=refused detail=\(detail)"
+    case .timedOut: return "\(connection) outcome=timedOut"
+    }
+
+    if document.acl != nil,
+      !RuntimeSocketOwnershipProbe.process(
+        child.processIdentifier, ownsTCPListenerOn: local.localPort)
+    {
+      return "\(endpoint) check=ownership outcome=unconfirmed"
+    }
+  }
+  return child.isRunning ? nil : "check=process outcome=exited"
+}
diff --git a/ShadowsocksX-NG2/Agent/AgentPaths.swift b/ShadowsocksX-NG2/Agent/AgentPaths.swift
new file mode 100644
index 000000000..a112d6f0c
--- /dev/null
+++ b/ShadowsocksX-NG2/Agent/AgentPaths.swift
@@ -0,0 +1,36 @@
+import Foundation
+
+// MARK: - 进程级路径与环境（测试缝经 SSXNG_* 环境变量覆盖）
+
+let environment = ProcessInfo.processInfo.environment
+
+// 契约路径优先；运行目录覆盖仅在没有契约覆盖时使用，避免同一部署的路径分叉。
+let runtimePaths: RuntimePaths = {
+  if let path = environment["SSXNG_CONTRACT_PATH"] {
+    return RuntimePaths(fileURL: URL(fileURLWithPath: path))
+  }
+  if let path = environment["SSXNG_RUNTIME_DIR"] {
+    return RuntimePaths(directoryURL: URL(fileURLWithPath: path, isDirectory: true))
+  }
+  return ApplicationSupportPaths.current.runtime
+}()
+
+let contractURL = runtimePaths.fileURL
+let aclFileURL = runtimePaths.aclFileURL
+let pidFileURL = runtimePaths.pidFileURL
+let runtimeStatusFileURL = runtimePaths.runtimeStatusFileURL
+let supervisionURL = runtimePaths.supervisionFileURL
+let failureURL = runtimePaths.failureFileURL
+let childPIDURL = runtimePaths.childPIDFileURL
+
+let agentLogURL: URL = {
+  if let path = environment["SSXNG_LOG_PATH"] { return URL(fileURLWithPath: path) }
+  if environment["SSXNG_CONTRACT_PATH"] != nil || environment["SSXNG_RUNTIME_DIR"] != nil {
+    return runtimePaths.directoryURL.appendingPathComponent("agent.log")
+  }
+  return ApplicationSupportPaths.current.agentLogURL
+}()
+
+let sslocalURL: URL =
+  environment["SSXNG_SSLOCAL_PATH"].map { URL(fileURLWithPath: $0) }
+  ?? Bundle.main.bundleURL.appendingPathComponent("Contents/Helpers/sslocal")
diff --git a/ShadowsocksX-NG2/Agent/AgentSignals.swift b/ShadowsocksX-NG2/Agent/AgentSignals.swift
new file mode 100644
index 000000000..6cc5aa0db
--- /dev/null
+++ b/ShadowsocksX-NG2/Agent/AgentSignals.swift
@@ -0,0 +1,59 @@
+import Foundation
+
+// MARK: - 信号与共享状态
+
+/// 信号只置位并唤醒监管循环，全部判定在循环线程完成。标志与信号量成对
+/// 配合有界监听轮询，进程退出由 Process 观测，不另设共享退出状态。
+let signalsQueue = DispatchQueue(label: "com.qiuyuzhou.ShadowsocksX-NG2.agent.signals")
+
+final class SignalFlags {
+  private let lock = NSLock()
+  private var stopRequested = false
+  private var reloadRequested = false
+  private let events = DispatchSemaphore(value: 0)
+
+  func requestStop() {
+    lock.lock()
+    stopRequested = true
+    lock.unlock()
+    events.signal()
+  }
+
+  func requestReload() {
+    lock.lock()
+    reloadRequested = true
+    lock.unlock()
+    events.signal()
+  }
+
+  func wait(timeout: DispatchTime) -> DispatchTimeoutResult {
+    events.wait(timeout: timeout)
+  }
+
+  func consumeStop() -> Bool {
+    lock.lock()
+    defer { lock.unlock() }
+    let value = stopRequested
+    stopRequested = false
+    return value
+  }
+
+  func consumeReload() -> Bool {
+    lock.lock()
+    defer { lock.unlock() }
+    let value = reloadRequested
+    reloadRequested = false
+    return value
+  }
+
+}
+
+func observeSignal(_ number: Int32, flags: SignalFlags, handler: @escaping () -> Void)
+  -> DispatchSourceSignal
+{
+  signal(number, SIG_IGN)
+  let source = DispatchSource.makeSignalSource(signal: number, queue: signalsQueue)
+  source.setEventHandler(handler: handler)
+  source.resume()
+  return source
+}
diff --git a/ShadowsocksX-NG2/Agent/main.swift b/ShadowsocksX-NG2/Agent/main.swift
new file mode 100644
index 000000000..8896c59be
--- /dev/null
+++ b/ShadowsocksX-NG2/Agent/main.swift
@@ -0,0 +1,240 @@
+import Foundation
+
+// Agent 只读取非秘密监管资料，独占稳定链接切换。配置和认证由 GUI 准备。
+redirectStandardStreams(to: agentLogURL)
+// stderr 行式输出的来源标记：本进程是 wrapper，行内据此与 GUI 事件区分。
+RuntimeLog.setLineSource(.wrapper)
+
+// 日志与运行目录独立创建；不能依赖日志初始化建立生命周期锁的父目录。
+do {
+  try AtomicFileWriter.prepareDirectory(at: runtimePaths.directoryURL)
+} catch { exit(1) }
+// 生命周期锁防止两个 Agent 同时启动监听进程。锁随进程退出自动释放。
+let agentLock = open(
+  runtimePaths.agentLockURL.path, O_CREAT | O_RDWR | O_NOFOLLOW, 0o600)
+guard agentLock >= 0, flock(agentLock, LOCK_EX | LOCK_NB) == 0 else { exit(0) }
+
+try? AtomicFileWriter.write(Data("\(getpid())\n".utf8), to: pidFileURL)
+let exitStatus = supervise()
+try? FileManager.default.removeItem(at: pidFileURL)
+clearRuntimeReceipt()
+close(agentLock)
+exit(exitStatus)
+
+private func supervise() -> Int32 {
+  let flags = SignalFlags()
+  let stopSource = observeSignal(SIGTERM, flags: flags) { flags.requestStop() }
+  let interruptSource = observeSignal(SIGINT, flags: flags) { flags.requestStop() }
+  let reloadSource = observeSignal(SIGUSR1, flags: flags) { flags.requestReload() }
+  defer {
+    stopSource.cancel()
+    interruptSource.cancel()
+    reloadSource.cancel()
+  }
+
+  while !flags.consumeStop() {
+    guard let document = loadValidatedContract(), !deploymentHasFailed(document) else { return 0 }
+    // wrapper 崩溃遗留的子进程未确认退出时，宁可报错，也不能启动第二个监听实例。
+    guard !hasUnconfirmedChild() else {
+      recordDeploymentFailure(document, reason: "Previous child exit unconfirmed")
+      return 0
+    }
+    clearRuntimeReceipt()
+    guard selectDeployment(document), let child = spawnSslocal() else {
+      recordDeploymentFailure(document, reason: "Child launch failed")
+      return 0
+    }
+    do {
+      try AtomicFileWriter.write(Data(String(child.processIdentifier).utf8), to: childPIDURL)
+    } catch {
+      _ = stopChild(child)
+      recordDeploymentFailure(document, reason: "Child identity persistence failed")
+      return 0
+    }
+    let outcome = superviseChild(child, document: document, flags: flags)
+    guard !child.isRunning else { return 0 }
+    try? FileManager.default.removeItem(at: childPIDURL)
+    switch outcome {
+    case .stopped: return 0
+    case .restart: continue
+    }
+  }
+  return 0
+}
+
+private func hasUnconfirmedChild() -> Bool {
+  guard FileManager.default.fileExists(atPath: childPIDURL.path) else { return false }
+  guard let data = try? String(contentsOf: childPIDURL, encoding: .utf8),
+    let pid = Int32(data), pid > 0
+  else { return true }
+  return kill(pid, 0) == 0 || errno == EPERM
+}
+
+private func loadValidatedContract() -> RuntimeSupervision? {
+  switch loadContract() {
+  case .missing:
+    RuntimeLog.emit(.contractMissing)
+    return nil
+  case .invalid:
+    RuntimeLog.emit(.contractInvalid)
+    return nil
+  case .loaded(let document): return document
+  }
+}
+
+private enum SupervisionOutcome { case stopped, restart }
+
+private struct SupervisionState {
+  var current: RuntimeSupervision
+  var processFiles: Set<String>
+  var reloadPending = RuntimeReloadState()
+  var healthy = false
+  var receiptPublished = false
+  var readinessDeadline: Date
+}
+
+private func superviseChild(
+  _ child: Process, document: RuntimeSupervision,
+  flags: SignalFlags
+) -> SupervisionOutcome {
+  var state = SupervisionState(
+    current: document, processFiles: document.retainedFiles,
+    readinessDeadline: Date().addingTimeInterval(listenEstablishmentDeadline))
+  while true {
+    if flags.consumeStop() {
+      if !stopChild(child) {
+        recordDeploymentFailure(state.current, reason: "Child stop unconfirmed")
+      }
+      return .stopped
+    }
+    if let outcome = handleChildExit(child, state: &state) { return outcome }
+    if let outcome = establishChildReadiness(child, state: &state) { return outcome }
+    if let outcome = publishChildReceipt(child, state: &state) { return outcome }
+    if let outcome = applyReloadIfRequested(child, flags: flags, state: &state) { return outcome }
+    _ = flags.wait(timeout: .now() + listenProbeInterval)
+  }
+}
+
+private func handleChildExit(
+  _ child: Process, state: inout SupervisionState
+) -> SupervisionOutcome? {
+  guard !child.isRunning else { return nil }
+  child.waitUntilExit()
+  RuntimeLog.emit(.sslocalExitedUnexpectedly(status: child.terminationStatus))
+  clearRuntimeReceipt()
+  guard state.healthy else {
+    recordDeploymentFailure(state.current, reason: "Child exited before deployment became healthy")
+    return .stopped
+  }
+  // 已健康的当前部署发生意外退出；下一轮重放当前发布，不选择历史配置。
+  return .restart
+}
+
+private func establishChildReadiness(
+  _ child: Process, state: inout SupervisionState
+) -> SupervisionOutcome? {
+  guard !state.healthy else { return nil }
+  let readinessFailure = listenerReadinessFailure(document: state.current, child: child)
+  guard let readinessFailure else {
+    guard sendReloadSignals(&state.reloadPending, to: child.processIdentifier) else {
+      recordDeploymentFailure(state.current, reason: "Deferred reload failed")
+      _ = stopChild(child)
+      return .stopped
+    }
+    state.healthy = true
+    return nil
+  }
+  guard Date() >= state.readinessDeadline else { return nil }
+  let elapsed = listenEstablishmentDeadline - state.readinessDeadline.timeIntervalSinceNow
+  let timing = String(format: "elapsed=%.3fs deadline=%.3fs", elapsed, listenEstablishmentDeadline)
+  RuntimeLog.emit(
+    .listenNotEstablished(
+      detail: "pid=\(child.processIdentifier) \(timing) \(readinessFailure)"))
+  recordDeploymentFailure(state.current, reason: "Listener establishment failed")
+  _ = stopChild(child)
+  return .stopped
+}
+
+private func publishChildReceipt(
+  _ child: Process, state: inout SupervisionState
+) -> SupervisionOutcome? {
+  guard !state.receiptPublished, state.healthy || state.current.acl == nil else { return nil }
+  state.receiptPublished = writeRuntimeReceipt(
+    for: state.current, processID: child.processIdentifier)
+  guard state.receiptPublished else {
+    recordDeploymentFailure(state.current, reason: "Receipt publication failed")
+    _ = stopChild(child)
+    return .stopped
+  }
+  guard retireFiles(state.current, protecting: state.processFiles) else {
+    recordDeploymentFailure(state.current, reason: "Retired runtime file cleanup failed")
+    _ = stopChild(child)
+    return .stopped
+  }
+  return nil
+}
+
+private func applyReloadIfRequested(
+  _ child: Process, flags: SignalFlags, state: inout SupervisionState
+) -> SupervisionOutcome? {
+  guard flags.consumeReload() else { return nil }
+  guard let next = loadValidatedContract(), !deploymentHasFailed(next) else {
+    _ = stopChild(child)
+    return .stopped
+  }
+  guard next.generation >= state.current.generation else {
+    recordDeploymentFailure(state.current, reason: "Stale publication rejected")
+    _ = stopChild(child)
+    return .stopped
+  }
+  if next.requiresRestart(from: state.current) {
+    RuntimeLog.emit(.reloadRestarted)
+    guard stopChild(child) else {
+      recordDeploymentFailure(next, reason: "Child stop unconfirmed")
+      return .stopped
+    }
+    return .restart
+  }
+  return applyInPlaceReload(next, child: child, state: &state)
+}
+
+private func applyInPlaceReload(
+  _ next: RuntimeSupervision, child: Process, state: inout SupervisionState
+) -> SupervisionOutcome? {
+  let needsDeferral = next.acl != nil && !state.healthy
+  state.reloadPending.enqueue(next, from: state.current)
+  guard selectDeployment(next),
+    needsDeferral || sendReloadSignals(&state.reloadPending, to: child.processIdentifier)
+  else {
+    recordDeploymentFailure(next, reason: "Reload failed")
+    _ = stopChild(child)
+    return .stopped
+  }
+  RuntimeLog.emit(needsDeferral ? .reloadDeferred : .reloadForwarded)
+  state.processFiles.formUnion(next.retainedFiles)
+  state.current = next
+  state.receiptPublished = false
+  state.readinessDeadline = Date().addingTimeInterval(listenEstablishmentDeadline)
+  return nil
+}
+
+private func sendReloadSignals(_ signals: inout RuntimeReloadState, to processID: Int32) -> Bool {
+  signals.flush { kill(processID, $0) == 0 }
+}
+
+/// 停止超时不得进入启动分支。保留 pid 文件供下次 Agent 拒绝重叠启动。
+private func stopChild(_ child: Process) -> Bool {
+  RuntimeLog.emit(.sslocalStopRequested)
+  if child.isRunning { kill(child.processIdentifier, SIGTERM) }
+  var deadline = Date().addingTimeInterval(10)
+  while child.isRunning && Date() < deadline { Thread.sleep(forTimeInterval: 0.05) }
+  if child.isRunning {
+    kill(child.processIdentifier, SIGKILL)
+    deadline = Date().addingTimeInterval(5)
+    while child.isRunning && Date() < deadline { Thread.sleep(forTimeInterval: 0.05) }
+  }
+  guard !child.isRunning else { return false }
+  child.waitUntilExit()
+  clearRuntimeReceipt()
+  return true
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogCommitCoordinator.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogCommitCoordinator.swift
new file mode 100644
index 000000000..b41af4be1
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogCommitCoordinator.swift
@@ -0,0 +1,268 @@
+import Combine
+import Foundation
+
+/// 已提交目录的内存快照：协调器与运行时缝之间的传值。运行时
+/// 收敛以此为唯一目标，不回读磁盘；磁盘仍是重启与跨进程恢复的权威来源。
+struct CommittedCatalogSnapshot: Equatable, Sendable {
+  let catalog: ConfigurationCatalog
+  let subscriptions: [SubscriptionRecord]
+}
+
+/// Runtime commands read the latest committed catalog through this narrow seam.
+/// The catalog remains a value snapshot; a command captures it once and uses it
+/// for its full re-expansion operation.
+@MainActor
+protocol RuntimeCatalogSnapshotReading: AnyObject {
+  var catalogSnapshot: ConfigurationCatalog { get }
+  var isCatalogAvailable: Bool { get }
+}
+
+extension RuntimeCatalogSnapshotReading {
+  var isCatalogAvailable: Bool { true }
+}
+
+/// Shared in-process catalog value. Only the commit coordinator can publish
+/// after this file's bootstrap; runtime code receives the read-only protocol.
+@MainActor
+private final class CommittedCatalogState: RuntimeCatalogSnapshotReading {
+  private(set) var catalogSnapshot: ConfigurationCatalog
+  private(set) var isCatalogAvailable = true
+
+  init(catalog: ConfigurationCatalog, available: Bool = true) {
+    catalogSnapshot = catalog
+    isCatalogAvailable = available
+  }
+
+  fileprivate func publish(_ catalog: ConfigurationCatalog) {
+    catalogSnapshot = catalog
+    isCatalogAvailable = true
+  }
+}
+
+/// One-time startup load shared by the controller and coordinator. The reader
+/// exposes only catalog data; subscription state remains coordinator-owned.
+@MainActor
+struct CatalogCommitBootstrap {
+  let catalogSnapshotReader: RuntimeCatalogSnapshotReading
+  fileprivate let committedCatalogState: CommittedCatalogState
+  fileprivate let subscriptions: [SubscriptionRecord]
+  fileprivate let favoriteIDs: [NodeID]
+  fileprivate let loadError: Error?
+
+  fileprivate init(document: CatalogDocument, loadError: Error? = nil) {
+    self.loadError = loadError
+    let state = CommittedCatalogState(catalog: document.catalog, available: loadError == nil)
+    catalogSnapshotReader = state
+    committedCatalogState = state
+    subscriptions = document.subscriptions
+    favoriteIDs = document.favoriteIDs
+  }
+}
+
+/// 目录提交后一次运行时收敛的结构化结果。协调器不生成本地化
+/// 文案：失败细节原样携带平台运行时给出的点名事实，由上层 presentation 决定
+/// 如何呈现。
+enum RuntimeSyncOutcome: Equatable, Sendable {
+  /// 代理未开启：活动目标已按提交快照重校验，未部署。
+  case revalidated
+  /// 运行时已向提交快照收敛（部署已执行且启动健康通过）。
+  case converged(skippedServers: [SkippedServer])
+  /// 部署已执行但运行时未收敛；失败信息是安全的 typed runtime fact。
+  case failed(failure: RuntimeFailureFacts?)
+  /// 活动目标失效：目标已清除且代理已停止（无静默回退）。
+  case clearedAndStopped(ActivationFailure)
+}
+
+/// 运行时收敛的可观察阶段：目录已提交 → 运行时同步中 → 结束。
+/// generation 为提交代次；被更新提交取代的旧代次不写最终状态。
+enum RuntimeSyncStatus: Equatable {
+  /// 无进行中或已完成的同步（无活动目标时提交保持此状态）。
+  case idle
+  /// 正在向该代次提交快照收敛。
+  case syncing(generation: Int)
+  /// 该代次收敛已结束。
+  case finished(generation: Int, outcome: RuntimeSyncOutcome)
+}
+
+/// 运行时同步缝：目录提交协调器与代理运行时之间的窄接口。
+/// 生产实现适配现有代理运行时控制器；测试注入确定性 fake。
+@MainActor
+protocol CatalogRuntimeSyncing: AnyObject {
+  /// 当前是否存在活动目标（无目标时目录提交不驱动运行时）。
+  var hasActiveTarget: Bool { get }
+  /// 让运行时向刚提交的目录快照收敛。健康检查、LaunchAgent 与端点启动的
+  /// 耗时属于本调用的异步收敛阶段。
+  func converge(to snapshot: CommittedCatalogSnapshot) async -> RuntimeSyncOutcome
+}
+
+/// 目录提交—运行时同步协调器：普通配置变更的唯一提交入口。
+/// 管线为「副本变更 → 校验并原子持久化 → 发布已提交状态 → 异步运行时收敛」；
+/// 目录提交在持久化成功后立即完成，不因运行时失败回滚目录，也不被健康检查
+/// 或启动耗时阻塞。每次提交递增代次：旧代次自然结束，但不得覆盖最新代次的
+/// 最终状态；没有自动重试，后续提交、显式激活或启动代理会发起新的同步尝试。
+@MainActor
+final class CatalogCommitCoordinator {
+  /// 最新提交的运行时收敛阶段（结构化；呈现由上层决定）。存储与发布单点
+  /// 在本类：写后经 `syncStatusChanges`（didChange 语义）通知；目录工作流
+  /// 只透传读面，不再挂第二份 `@Published`。
+  private(set) var syncStatus: RuntimeSyncStatus = .idle
+  /// 收敛阶段变化通道（didChange 语义，值即当前阶段）。
+  let syncStatusChanges = PassthroughSubject<RuntimeSyncStatus, Never>()
+
+  let fileStore: CatalogFileStore
+  private let runtime: CatalogRuntimeSyncing
+  private let catalogState: CommittedCatalogState
+  /// 提交代次：每次提交递增，用于丢弃被更新提交取代的旧同步结果。
+  private var generation = 0
+  private(set) var loadError: Error?
+
+  /// 目录在共享来源中只有一份；订阅状态仍由协调器持有。
+  var committedCatalog: ConfigurationCatalog { catalogState.catalogSnapshot }
+  private(set) var committedSubscriptions: [SubscriptionRecord]
+  private(set) var committedFavoriteIDs: [NodeID]
+
+  init(
+    fileStore: CatalogFileStore,
+    runtime: CatalogRuntimeSyncing,
+    bootstrap: CatalogCommitBootstrap
+  ) {
+    self.fileStore = fileStore
+    self.runtime = runtime
+    loadError = bootstrap.loadError
+    catalogState = bootstrap.committedCatalogState
+    committedSubscriptions = bootstrap.subscriptions
+    committedFavoriteIDs = bootstrap.favoriteIDs
+  }
+
+  /// Test and isolated-module convenience: still performs exactly one document
+  /// load, then gives the coordinator sole publication authority.
+  convenience init(fileStore: CatalogFileStore, runtime: CatalogRuntimeSyncing) {
+    self.init(
+      fileStore: fileStore, runtime: runtime, bootstrap: Self.bootstrap(fileStore: fileStore))
+  }
+
+  /// Loads the initial document once so the composition root can share its
+  /// catalog with the runtime controller before constructing the adapter.
+  /// Direct out-of-band file edits are not observed during a GUI session.
+  static func bootstrap(fileStore: CatalogFileStore) -> CatalogCommitBootstrap {
+    do { return CatalogCommitBootstrap(document: try fileStore.load()) } catch {
+      return CatalogCommitBootstrap(document: CatalogDocument(), loadError: error)
+    }
+  }
+
+  /// 普通目录变更的唯一提交管线。任一同步步骤失败则已提交状态不动并原样
+  /// 上抛；运行时收敛在持久化成功后异步开始。
+  func commit<T>(
+    _ mutate: (inout ConfigurationCatalog, inout [SubscriptionRecord]) throws -> T
+  ) throws -> T {
+    if let loadError { throw loadError }
+    var workingCatalog = committedCatalog
+    var workingSubscriptions = committedSubscriptions
+    let result = try mutate(&workingCatalog, &workingSubscriptions)
+    let workingFavorites = committedFavoriteIDs.filter { workingCatalog.entry(for: $0) != nil }
+    try fileStore.save(
+      CatalogDocument(
+        catalog: workingCatalog, subscriptions: workingSubscriptions,
+        favoriteIDs: workingFavorites))
+    catalogState.publish(workingCatalog)
+    committedSubscriptions = workingSubscriptions
+    committedFavoriteIDs = workingFavorites
+    scheduleRuntimeSync(
+      CommittedCatalogSnapshot(catalog: workingCatalog, subscriptions: workingSubscriptions))
+    return result
+  }
+
+  /// 收藏只改变用户选择，不调度运行时收敛，也不修改目录节点时间戳。
+  func commitFavorites(_ favoriteIDs: [NodeID]) throws {
+    if let loadError { throw loadError }
+    guard favoriteIDs != committedFavoriteIDs else { return }
+    try fileStore.save(
+      CatalogDocument(
+        catalog: committedCatalog, subscriptions: committedSubscriptions,
+        favoriteIDs: favoriteIDs))
+    committedFavoriteIDs = favoriteIDs
+  }
+
+  /// 仅修改订阅来源资料，不重展开未改变的服务器出口。
+  func commitSubscriptions(_ mutate: (inout [SubscriptionRecord]) throws -> Void) throws {
+    if let loadError { throw loadError }
+    var subscriptions = committedSubscriptions
+    try mutate(&subscriptions)
+    try fileStore.save(
+      CatalogDocument(
+        catalog: committedCatalog, subscriptions: subscriptions,
+        favoriteIDs: committedFavoriteIDs))
+    committedSubscriptions = subscriptions
+  }
+
+  /// Legacy 导入等独立路径直接落盘后对齐已提交状态；不触发运行时收敛
+  /// （导入的运行时边界由独立路径自行驱动，不经普通提交管线）。
+  func reloadCommittedStateFromStore() {
+    do { try reload(allowingInteraction: false, synchronize: false) } catch { loadError = error }
+  }
+
+  func reload(allowingInteraction: Bool, synchronize: Bool = true) throws {
+    let document = try fileStore.load(allowingInteraction: allowingInteraction)
+    publish(document)
+    if synchronize { scheduleRuntimeSync(snapshot(document), force: true) }
+  }
+
+  func resetLibrary() throws {
+    let document = try fileStore.reset()
+    publish(document)
+    scheduleRuntimeSync(snapshot(document), force: true)
+  }
+
+  private func publish(_ document: CatalogDocument) {
+    loadError = nil
+    catalogState.publish(document.catalog)
+    committedSubscriptions = document.subscriptions
+    committedFavoriteIDs = document.favoriteIDs
+  }
+
+  private func snapshot(_ document: CatalogDocument) -> CommittedCatalogSnapshot {
+    CommittedCatalogSnapshot(catalog: document.catalog, subscriptions: document.subscriptions)
+  }
+
+  /// 异步收敛调度：无活动目标不调用运行时；同步开始前与结束后都以代次
+  /// 校验——被更新提交取代的旧同步直接结束或丢弃结果，不覆盖最新状态。
+  private func scheduleRuntimeSync(_ snapshot: CommittedCatalogSnapshot, force: Bool = false) {
+    generation += 1
+    let generation = generation
+    guard force || runtime.hasActiveTarget else {
+      setSyncStatus(.idle)
+      return
+    }
+    setSyncStatus(.syncing(generation: generation))
+    Task { @MainActor [weak self] in
+      guard let self, self.generation == generation else { return }
+      let outcome = await self.runtime.converge(to: snapshot)
+      guard !Task.isCancelled, self.generation == generation else { return }
+      self.setSyncStatus(.finished(generation: generation, outcome: outcome))
+    }
+  }
+
+  /// 写入与通知的唯一口径：先落值后发值（didChange 语义）。
+  private func setSyncStatus(_ status: RuntimeSyncStatus) {
+    syncStatus = status
+    syncStatusChanges.send(status)
+  }
+
+}
+
+/// 生产运行时适配器：协调器与现有代理运行时控制器之间的唯一
+/// 生产接线，由应用组合根建立。
+@MainActor
+final class ProxyRuntimeSyncAdapter: CatalogRuntimeSyncing {
+  private let controller: ProxyRuntimeController
+
+  init(controller: ProxyRuntimeController) {
+    self.controller = controller
+  }
+
+  var hasActiveTarget: Bool { controller.isActiveTargetPresent }
+
+  func converge(to snapshot: CommittedCatalogSnapshot) async -> RuntimeSyncOutcome {
+    await controller.catalogDidCommit(snapshot: snapshot.catalog)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+AutomaticUpdates.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+AutomaticUpdates.swift
new file mode 100644
index 000000000..59ec5561f
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+AutomaticUpdates.swift
@@ -0,0 +1,91 @@
+import Foundation
+
+extension CatalogWorkflow {
+  enum AutomaticUpdateState {
+    case stopped, idle
+    case waiting(id: UUID, task: Task<Void, Never>)
+    case updating(id: UUID, task: Task<Void, Never>)
+
+    var task: Task<Void, Never>? {
+      switch self {
+      case .stopped, .idle: nil
+      case .waiting(_, let task), .updating(_, let task): task
+      }
+    }
+
+    var id: UUID? {
+      switch self {
+      case .stopped, .idle: nil
+      case .waiting(let id, _), .updating(let id, _): id
+      }
+    }
+  }
+
+  /// Owned by the GUI process, independently of workspace presentation.
+  func startSubscriptionAutomaticUpdates() {
+    if case .stopped = automaticUpdateState { automaticUpdateState = .idle }
+    scheduleAutomaticUpdateCheck()
+  }
+
+  func stopSubscriptionAutomaticUpdates() {
+    let task = automaticUpdateState.task
+    automaticUpdateState = .stopped
+    task?.cancel()
+    for id in Array(subscriptionRequests.keys) { cancelSubscriptionRequest(id) }
+  }
+
+  /// Startup and wake use the persisted deadline directly, without catch-up jitter.
+  func subscriptionAutomaticUpdatesDidWake() {
+    scheduleAutomaticUpdateCheck()
+  }
+
+  private func refreshDueSubscriptions() async {
+    var attempted: Set<NodeID> = []
+    while !Task.isCancelled,
+      let due = subscriptions.first(where: {
+        !attempted.contains($0.id) && subscriptionRequests[$0.id] == nil
+          && $0.autoUpdate.effectiveMode != .off
+          && ($0.autoUpdate.nextUpdateAt.map { $0 <= dependencies.subscriptionNow() } ?? false)
+      })
+    {
+      attempted.insert(due.id)
+      await refreshSubscription(due.id)
+    }
+  }
+
+  func scheduleAutomaticUpdateCheck(includeOverdue: Bool = true) {
+    switch automaticUpdateState {
+    case .stopped, .updating: return
+    case .idle, .waiting:
+      automaticUpdateState.task?.cancel()
+      automaticUpdateState = .idle
+    }
+    let now = dependencies.subscriptionNow()
+    guard
+      let deadline = subscriptions.filter({
+        $0.autoUpdate.effectiveMode != .off && subscriptionRequests[$0.id] == nil
+      }).compactMap(\.autoUpdate.nextUpdateAt).filter({
+        includeOverdue || $0 > now
+      }).min()
+    else { return }
+    let delay = max(0, deadline.timeIntervalSince(now))
+    let wait = dependencies.subscriptionWait
+    let id = UUID()
+    let task = Task { [weak self] in
+      do {
+        try await wait(delay)
+        try Task.checkCancellation()
+      } catch { return }
+      guard let self, case .waiting(let currentID, let task) = self.automaticUpdateState,
+        currentID == id
+      else { return }
+      self.automaticUpdateState = .updating(id: id, task: task)
+      await self.refreshDueSubscriptions()
+      guard self.automaticUpdateState.id == id, !Task.isCancelled else { return }
+      self.automaticUpdateState = .idle
+      // An unchanged overdue plan (for example a failed save) is not a retry loop.
+      self.scheduleAutomaticUpdateCheck(includeOverdue: false)
+    }
+    automaticUpdateState = .waiting(id: id, task: task)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Connectivity.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Connectivity.swift
new file mode 100644
index 000000000..24290601e
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Connectivity.swift
@@ -0,0 +1,46 @@
+import Foundation
+
+extension CatalogTreeNode {
+  var connectivityServerIDs: [NodeID] {
+    isGroup ? childNodes.flatMap(\.connectivityServerIDs) : [id]
+  }
+}
+
+extension CatalogWorkflow {
+  /// Hash connection facts only; display-name and directory edits preserve observations.
+  func connectivityRevision(for id: NodeID) -> String {
+    guard let entry = dependencies.coordinator.committedCatalog.entry(for: id),
+      case .server(var fields) = entry.kind
+    else { return "missing" }
+    fields.remark = ""
+    let plugin = fields.pluginProgram.flatMap {
+      dependencies.plugins.catalogSnapshot().entry(for: $0)
+    }
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.sortedKeys]
+    let facts =
+      [
+        String(data: (try? encoder.encode(fields)) ?? Data(), encoding: .utf8) ?? "",
+        String(describing: plugin),
+      ]
+    return ProxyACLDocument.digest((try? JSONEncoder().encode(facts)) ?? Data())
+  }
+
+  /// This local state machine derives a single leaf without publishing activation.
+  func connectivityConfiguration(for id: NodeID) throws -> SslocalServerDocument {
+    let catalog = dependencies.coordinator.committedCatalog
+    guard case .server? = catalog.entry(for: id)?.kind else { throw ServerFormLoadError.notFound }
+    var derivation = ActivationStateMachine()
+    if case .server(let fields)? = catalog.entry(for: id)?.kind,
+      !EncryptionMethodCatalog.isSupported(fields.encryptionMethod)
+    {
+      throw ServerConnectivity.ConfigurationFailure.unsupported
+    }
+    let config = try derivation.activate(
+      id, in: catalog,
+      plugins: dependencies.plugins,
+      options: RuntimeDocumentOptions(listen: ProxyListeningConfiguration()))
+    guard let server = config.document.servers.first else { throw ServerFormLoadError.notFound }
+    return server
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Diagnostics.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Diagnostics.swift
new file mode 100644
index 000000000..7f56de946
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Diagnostics.swift
@@ -0,0 +1,13 @@
+import Foundation
+
+/// 诊断事实缝：目录只向诊断提供 domain-neutral 的
+/// 聚合事实（数量与已知无效数）。诊断报告模型（DiagnosticSnapshot）不经
+/// 本类型，原始目录与凭据不出 module。
+extension CatalogWorkflow {
+  /// 当前目录的聚合诊断事实（服务器/分组/来源/插件计数与已知无效数）。
+  var diagnosticCatalogFacts: DiagnosticCatalogFacts {
+    DiagnosticCatalogFacts(
+      counts: DiagnosticReportBuilder.counts(in: dependencies.coordinator.committedCatalog),
+      knownInvalidServerCount: tree.invalidServerCount)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Duplicate.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Duplicate.swift
new file mode 100644
index 000000000..b1e11d37e
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Duplicate.swift
@@ -0,0 +1,82 @@
+import Foundation
+
+private struct CatalogCopyContext {
+  let source: ConfigurationCatalog
+  let now: Date
+}
+
+private struct CatalogCopyDestination {
+  let parent: NodeID?
+  let index: Int?
+  let name: String
+}
+
+extension CatalogWorkflow {
+  /// 手动节点和根层订阅组可复制；订阅子组不能将手动副本放入订阅父组。
+  func canDuplicate(_ id: NodeID) -> Bool {
+    guard let node = tree.node(withID: id) else { return false }
+    return node.isManual || (node.isGroup && node.parentID == nil)
+  }
+
+  /// 同级快照复制：名称后缀由 UI 本地化，重名序号与事务由 module 处理。
+  /// 目录提交后才返回新身份；运行时收敛沿用普通目录变更语义。
+  func duplicate(_ id: NodeID, nameSuffix: String) async throws -> NodeID {
+    let source = dependencies.coordinator.committedCatalog
+    guard let entry = source.entry(for: id) else { throw CatalogError.nodeNotFound(id) }
+    guard canDuplicate(id) else { throw CatalogError.subscriptionNodeImmutable(id) }
+    let parent = try source.parentID(of: id)
+    let siblings = try source.children(of: parent)
+    guard let position = siblings.firstIndex(of: id) else { throw CatalogError.nodeNotFound(id) }
+    let names = Set(siblings.compactMap { source.entry(for: $0)?.displayName })
+    var base = "\(entry.displayName) \(nameSuffix)"
+    var name = base
+    var number = 2
+    // 两种语言的已保存后缀都识别，切换语言后仍沿用原名称的复制序列。
+    if let suffixRange = entry.displayName.range(
+      of: #" (?:副本|Copy)(?: [0-9]+)?$"#, options: .regularExpression)
+    {
+      let suffix = entry.displayName[suffixRange].split(separator: " ")[0]
+      base = "\(entry.displayName[..<suffixRange.lowerBound]) \(suffix)"
+      name = "\(base) 2"
+      number = 3
+    }
+    while names.contains(name) {
+      name = "\(base) \(number)"
+      number += 1
+    }
+    let context = CatalogCopyContext(source: source, now: Date())
+    return try commit { catalog in
+      try copyEntry(
+        entry, into: &catalog, context: context,
+        destination: CatalogCopyDestination(parent: parent, index: position + 1, name: name))
+    }
+  }
+
+  /// 副本节点获得全新身份与全新时间戳（创建时间 = 复制时刻，ADR-0031）；
+  /// 每个新建节点的落点分组按结构敏感语义更新修改时间。
+  private func copyEntry(
+    _ entry: CatalogEntry, into catalog: inout ConfigurationCatalog,
+    context: CatalogCopyContext, destination: CatalogCopyDestination
+  ) throws -> NodeID {
+    switch entry.kind {
+    case .server(var fields):
+      fields.remark = destination.name
+      return try catalog.addServer(
+        fields, to: destination.parent, index: destination.index, now: context.now)
+    case .group(let fields):
+      let copy = try catalog.addGroup(
+        destination.name, to: destination.parent, index: destination.index, now: context.now)
+      for child in fields.children {
+        guard let childEntry = context.source.entry(for: child) else {
+          throw CatalogError.nodeNotFound(child)
+        }
+        _ = try copyEntry(
+          childEntry, into: &catalog, context: context,
+          destination: CatalogCopyDestination(
+            parent: copy, index: nil, name: childEntry.displayName))
+      }
+      return copy
+    }
+  }
+
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+GroupExport.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+GroupExport.swift
new file mode 100644
index 000000000..8c92c6ba7
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+GroupExport.swift
@@ -0,0 +1,268 @@
+import CryptoKit
+import Foundation
+
+struct ConfigurationGroupExportDraft: Equatable {
+  let data: Data
+  let suggestedFileName: String
+  var format: Format = .json
+
+  enum Format: Equatable {
+    case json
+    case uriList
+  }
+}
+
+struct ConfigurationGroupShareDraft {
+  let json: ConfigurationGroupExportDraft
+  let uriList: ConfigurationGroupExportDraft
+  let uriText: String
+}
+
+enum ConfigurationGroupExportFailure: Equatable, Error {
+  enum RecordProblem: Equatable {
+    case invalidAddress
+    case invalidPort
+    case missingEncryptionMethod
+    case missingPassword
+  }
+
+  case groupNotFound
+  case targetIsNotGroup
+  case noServers
+  case invalidServer(NodeID, RecordProblem)
+  case pluginOptionsWithoutProgram(NodeID)
+  case documentEncodingFailed
+}
+
+extension CatalogWorkflow {
+  /// 两种分享格式从同一完整校验结果准备，任何服务器失败都不产生部分输出。
+  func configurationGroupShareDraft(for groupID: NodeID) throws -> ConfigurationGroupShareDraft {
+    let catalog = dependencies.coordinator.committedCatalog
+    guard let root = catalog.entry(for: groupID) else {
+      throw ConfigurationGroupExportFailure.groupNotFound
+    }
+    guard case .group(let fields) = root.kind else {
+      throw ConfigurationGroupExportFailure.targetIsNotGroup
+    }
+    var builder = SIP008GroupExportDocumentBuilder(
+      catalog: catalog)
+    let json = try builder.encode(rootID: groupID)
+    let text = builder.uriListText
+    let name = fields.name.replacingOccurrences(of: "/", with: " ")
+      .replacingOccurrences(of: ":", with: " ").trimmingCharacters(in: .whitespacesAndNewlines)
+    let base = name.isEmpty ? "ss-servers" : name
+    return ConfigurationGroupShareDraft(
+      json: ConfigurationGroupExportDraft(data: json, suggestedFileName: "\(base).json"),
+      uriList: ConfigurationGroupExportDraft(
+        data: Data(text.utf8), suggestedFileName: "\(base).txt", format: .uriList),
+      uriText: text)
+  }
+
+  /// Prepares a complete SIP-008 v1 snapshot for one group. Credentials are resolved
+  /// here so the returned draft is the only secret-bearing value passed to the exporter.
+  func configurationGroupExportDraft(for groupID: NodeID) throws -> ConfigurationGroupExportDraft {
+    let catalog = dependencies.coordinator.committedCatalog
+    guard let root = catalog.entry(for: groupID) else {
+      throw ConfigurationGroupExportFailure.groupNotFound
+    }
+    guard case .group(let rootFields) = root.kind else {
+      throw ConfigurationGroupExportFailure.targetIsNotGroup
+    }
+
+    var document = SIP008GroupExportDocumentBuilder(
+      catalog: catalog)
+    let data = try document.encode(rootID: groupID)
+    return ConfigurationGroupExportDraft(
+      data: data, suggestedFileName: "\(rootFields.name).json")
+  }
+}
+
+private struct SIP008GroupExportDocumentBuilder {
+  private let catalog: ConfigurationCatalog
+  private var servers: [SIP008ServerDTO] = []
+  private var groups: [SIP008GroupDTO] = []
+  private let identities = SIP008ExportIdentity()
+
+  var uriListText: String {
+    servers.map {
+      SsUri(
+        method: $0.method, password: $0.password, host: $0.server, port: $0.serverPort,
+        pluginProgram: $0.plugin, pluginOptions: $0.pluginOptions,
+        remark: $0.remarks.isEmpty ? nil : $0.remarks
+      ).encode()
+    }.joined(separator: "\n")
+  }
+
+  init(catalog: ConfigurationCatalog) {
+    self.catalog = catalog
+  }
+
+  mutating func encode(rootID: NodeID) throws -> Data {
+    let rootGroupID = try appendGroup(rootID)
+    guard !servers.isEmpty else { throw ConfigurationGroupExportFailure.noServers }
+
+    let document = SIP008DocumentDTO(
+      version: 1,
+      servers: servers,
+      groupExtension: SIP008GroupExtensionDTO(
+        schemaVersion: 1, rootGroupID: rootGroupID, groups: groups))
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.prettyPrinted, .sortedKeys, .withoutEscapingSlashes]
+    do {
+      return try encoder.encode(document)
+    } catch {
+      throw ConfigurationGroupExportFailure.documentEncodingFailed
+    }
+  }
+
+  private mutating func appendGroup(_ id: NodeID) throws -> String {
+    guard let entry = catalog.entry(for: id), case .group(let fields) = entry.kind else {
+      throw ConfigurationGroupExportFailure.groupNotFound
+    }
+
+    let exportID = identities.groupID(for: id)
+    var children: [SIP008ChildDTO] = []
+    for childID in fields.children {
+      guard let child = catalog.entry(for: childID) else {
+        throw ConfigurationGroupExportFailure.groupNotFound
+      }
+      switch child.kind {
+      case .group:
+        let childExportID = try appendGroup(childID)
+        children.append(SIP008ChildDTO(type: "group", id: childExportID))
+      case .server(let serverFields):
+        let serverID = try appendServer(child, fields: serverFields)
+        children.append(SIP008ChildDTO(type: "server", id: serverID))
+      }
+    }
+
+    groups.append(SIP008GroupDTO(id: exportID, name: fields.name, children: children))
+    return exportID
+  }
+
+  private mutating func appendServer(_ entry: CatalogEntry, fields: ServerFields) throws -> String {
+    guard !fields.address.isEmpty else {
+      throw ConfigurationGroupExportFailure.invalidServer(entry.id, .invalidAddress)
+    }
+    guard (1...65_535).contains(fields.port) else {
+      throw ConfigurationGroupExportFailure.invalidServer(entry.id, .invalidPort)
+    }
+    guard !fields.encryptionMethod.isEmpty else {
+      throw ConfigurationGroupExportFailure.invalidServer(entry.id, .missingEncryptionMethod)
+    }
+
+    guard !fields.password.isEmpty else {
+      throw ConfigurationGroupExportFailure.invalidServer(entry.id, .missingPassword)
+    }
+    let password = fields.password
+
+    let pluginProgram = fields.pluginProgram.flatMap { $0.isEmpty ? nil : $0 }
+    let pluginOptions = fields.pluginOptions.flatMap { $0.isEmpty ? nil : $0 }
+    guard pluginProgram != nil || pluginOptions == nil else {
+      throw ConfigurationGroupExportFailure.pluginOptionsWithoutProgram(entry.id)
+    }
+
+    let serverID = identities.serverID(for: entry)
+    servers.append(
+      SIP008ServerDTO(
+        id: serverID,
+        remarks: fields.remark,
+        server: fields.address,
+        serverPort: fields.port,
+        password: password,
+        method: fields.encryptionMethod,
+        plugin: pluginProgram,
+        pluginOptions: pluginOptions))
+    return serverID
+  }
+
+}
+
+private struct SIP008ExportIdentity {
+  private static let namespace = UUID(uuidString: "0d89e9f8-8f0e-4a55-941a-77d61736eaa3")!
+
+  func groupID(for nodeID: NodeID) -> String {
+    Self.version5(name: "group:\(nodeID.rawValue)").uuidString.lowercased()
+  }
+
+  func serverID(for entry: CatalogEntry) -> String {
+    if entry.source == .manual, let id = UUID(uuidString: entry.id.rawValue) {
+      return id.uuidString.lowercased()
+    }
+    if entry.source == .subscription,
+      let providerID = subscriptionServerID(entry.id), let id = UUID(uuidString: providerID)
+    {
+      return id.uuidString.lowercased()
+    }
+    return Self.version5(name: "server:\(entry.id.rawValue)").uuidString.lowercased()
+  }
+
+  private func subscriptionServerID(_ nodeID: NodeID) -> String? {
+    guard let marker = nodeID.rawValue.range(of: ":id:", options: .backwards) else { return nil }
+    return String(nodeID.rawValue[marker.upperBound...])
+  }
+
+  private static func version5(name: String) -> UUID {
+    var bytes = withUnsafeBytes(of: namespace.uuid) { Array($0) }
+    bytes.append(contentsOf: name.utf8)
+    var digest = Array(Insecure.SHA1.hash(data: Data(bytes)).prefix(16))
+    digest[6] = (digest[6] & 0x0f) | 0x50
+    digest[8] = (digest[8] & 0x3f) | 0x80
+    return UUID(
+      uuid: (
+        digest[0], digest[1], digest[2], digest[3], digest[4], digest[5], digest[6], digest[7],
+        digest[8], digest[9], digest[10], digest[11], digest[12], digest[13], digest[14], digest[15]
+      ))
+  }
+}
+
+private struct SIP008DocumentDTO: Encodable {
+  let version: Int
+  let servers: [SIP008ServerDTO]
+  let groupExtension: SIP008GroupExtensionDTO
+
+  enum CodingKeys: String, CodingKey {
+    case version, servers
+    case groupExtension = "x_shadowsocksx_ng"
+  }
+}
+
+private struct SIP008ServerDTO: Encodable {
+  let id: String
+  let remarks: String
+  let server: String
+  let serverPort: Int
+  let password: String
+  let method: String
+  let plugin: String?
+  let pluginOptions: String?
+
+  enum CodingKeys: String, CodingKey {
+    case id, remarks, server, password, method, plugin
+    case serverPort = "server_port"
+    case pluginOptions = "plugin_opts"
+  }
+}
+
+private struct SIP008GroupExtensionDTO: Encodable {
+  let schemaVersion: Int
+  let rootGroupID: String
+  let groups: [SIP008GroupDTO]
+
+  enum CodingKeys: String, CodingKey {
+    case schemaVersion = "schema_version"
+    case rootGroupID = "root_group_id"
+    case groups
+  }
+}
+
+private struct SIP008GroupDTO: Encodable {
+  let id: String
+  let name: String
+  let children: [SIP008ChildDTO]
+}
+
+private struct SIP008ChildDTO: Encodable {
+  let type: String
+  let id: String
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Import.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Import.swift
new file mode 100644
index 000000000..dc0b4fd00
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Import.swift
@@ -0,0 +1,239 @@
+import Foundation
+import ImageIO
+
+// MARK: - 统一服务器导入（docs/design/unified-server-import.md）
+
+/// 服务器导入深模块：UI 只认识 `importServers(from:into:)` 一个入口与
+/// `ImportRunOutcome` 一个结果类型。来源分派按内容嗅探（图片→二维码、
+/// JSON 对象→SIP-008、其余→ss:// 文本行），解码全部复用 Domain 既有实现，
+/// 每来源独立事务独立结果，来源之间互不影响。
+extension CatalogWorkflow {
+  /// 逐来源独立导入。不抛错：任何失败都折进对应来源的
+  /// `ImportSourceResult.failed`，其他来源不受影响。落点对全部来源一致。
+  func importServers(from sources: [ImportSource], into parent: NodeID?) async
+    -> ImportRunOutcome
+  {
+    var outcomes: [ImportSourceOutcome] = []
+    var newSelection: NodeID?
+    for source in sources {
+      let previousIDs = Set(importChildren(of: parent).map(\.id))
+      let result: ImportSourceResult
+      switch source {
+      case .clipboardText(let text):
+        result = importURIText(
+          text, into: parent)
+      case .file(let name, let data):
+        result = await importFile(
+          name: name, data: data, into: parent)
+      }
+      outcomes.append(ImportSourceOutcome(source: source, result: result))
+      if let created = importChildren(of: parent).last(where: { !previousIDs.contains($0.id) }) {
+        newSelection = created.id
+      }
+    }
+    return ImportRunOutcome(sources: outcomes, newNodeSelectionCandidate: newSelection)
+  }
+
+  private func importChildren(of parent: NodeID?) -> [CatalogTreeNode] {
+    if let parent { return tree.node(withID: parent)?.childNodes ?? [] }
+    return tree.roots
+  }
+
+  /// 单文件分派：内容优先嗅探。可解码位图（ImageIO 事实）走二维码；内容为
+  /// JSON 对象走 SIP-008（解析失败按整份拒绝报出，不降级文本行）；其余按
+  /// 文本逐行。
+  private func importFile(
+    name: String, data: Data, into parent: NodeID?
+  ) async -> ImportSourceResult {
+    if Self.isDecodableImage(data) {
+      return await importQRImage(name: name, data: data, into: parent)
+    }
+    if Self.looksLikeJSONObject(data) {
+      return importSIP008(fileName: name, data: data, into: parent)
+    }
+    // 非 UTF-8 文本按 UTF-8 有损解读：文本路径宁可逐行点名失败也不整份丢弃。
+    return importURIText(
+      // swiftlint:disable:next optional_data_string_conversion
+      String(decoding: data, as: UTF8.self), into: parent)
+  }
+
+  // MARK: - ss:// 文本行
+
+  /// ss:// 文本行导入（剪贴板与文本文件的共同落点）：逐行解码，可解析行
+  /// 全部添加（每次新建身份，不按内容去重）；空白行跳过不报，失败行以原始
+  /// 切分下标（含空行）+ 类型化原因点名，已成功行不被局部失败回滚。空文本
+  /// 是来源级失败。
+  private func importURIText(
+    _ text: String, into parent: NodeID?
+  ) -> ImportSourceResult {
+    var prepared: [ServerFields] = []
+    var failures: [ImportLineFailure] = []
+    let lines = text.split(
+      omittingEmptySubsequences: false, whereSeparator: \.isNewline)
+    for (index, rawLine) in lines.enumerated() {
+      let line = rawLine.trimmingCharacters(in: .whitespaces)
+      guard !line.isEmpty else { continue }
+      do {
+        let uri = try SsUri.decode(line)
+        prepared.append(Self.serverFields(from: uri))
+      } catch let error as SsUriError {
+        failures.append(ImportLineFailure(lineIndex: index, reason: .decode(error)))
+      } catch {
+        failures.append(
+          ImportLineFailure(
+            lineIndex: index, reason: .decode(.malformed(detail: String(describing: error)))))
+      }
+    }
+    guard !prepared.isEmpty else {
+      return failures.isEmpty
+        ? .failed(.noImportableLines) : .partial(addedCount: 0, failures: failures)
+    }
+    do {
+      try commit { catalog in
+        let now = Date()
+        for fields in prepared {
+          try catalog.addServer(fields, to: parent, now: now)
+        }
+      }
+    } catch {
+      return .failed(
+        .commit(error))
+    }
+    return failures.isEmpty
+      ? .imported(count: prepared.count, groupID: parent)
+      : .partial(addedCount: prepared.count, failures: failures)
+  }
+
+  // MARK: - 二维码图片
+
+  /// 二维码图片一步导入：识别全部负载、仅保留 ss:// 行后按文本行语义导入。
+  /// 识别在主线程外执行（Vision 位图处理），无预览确认态。
+  private func importQRImage(
+    name: String, data: Data, into parent: NodeID?
+  ) async -> ImportSourceResult {
+    let payloads: [String]
+    do {
+      payloads = try await Task.detached(priority: .userInitiated) {
+        try QrCodeCodec.detectPayloads(in: data)
+      }.value
+    } catch {
+      return .failed(.undecodableImage)
+    }
+    let uris = payloads.filter { $0.lowercased().hasPrefix("ss://") }
+    guard !uris.isEmpty else { return .failed(.qrPayloadNotFound) }
+    return importURIText(
+      uris.joined(separator: "\n"), into: parent)
+  }
+
+  // MARK: - SIP-008 文件（ADR-0027）
+
+  /// SIP-008 文档整树导入：解析整份校验（任一记录无效整份拒绝）；快照身份
+  /// 只作装配键，目录身份全部新建；根分组挂入选中落点，凭据与目录在同一
+  /// 事务提交。
+  private func importSIP008(
+    fileName: String, data: Data, into parent: NodeID?
+  ) -> ImportSourceResult {
+    let snapshot: SubscriptionSnapshot
+    do {
+      // 一次性会话身份只作解析作用域：快照内的 scoped NodeID 不进入目录。
+      snapshot = try SubscriptionDocumentParser.parse(data, subscriptionID: .fresh())
+    } catch let error as SubscriptionParseError {
+      return .failed(.parse(error))
+    } catch {
+      return .failed(.parse(.decodingFailure))
+    }
+    do {
+      let rootID = try commit { catalog in
+        // 一次导入一个写入时刻：根分组与全部后代节点共用（ADR-0031）。
+        let now = Date()
+        let base = snapshot.root.name.isEmpty ? Self.fileNameBase(fileName) : snapshot.root.name
+        let rootID = try catalog.addGroup(
+          Self.uniqueGroupName(base, in: catalog), to: parent, now: now)
+        try Self.mountSnapshotChildren(
+          of: snapshot.root, into: rootID, catalog: &catalog, now: now)
+        return rootID
+      }
+      return .imported(count: Self.snapshotServerCount(snapshot.root), groupID: rootID)
+    } catch {
+      return .failed(
+        .commit(error))
+    }
+  }
+
+  /// 快照后代 → 手动子树：嵌套分组与服务器按快照顺序重建（根分组由调用方
+  /// 挂载）。嵌套组缺名以占位名兜底。
+  private static func mountSnapshotChildren(
+    of group: SubscriptionSnapshot.Group,
+    into groupID: NodeID,
+    catalog: inout ConfigurationCatalog,
+    now: Date
+  ) throws {
+    for child in group.children {
+      switch child {
+      case .group(let nested):
+        let nestedID = try catalog.addGroup(
+          nested.name.isEmpty ? String(localized: "未命名分组") : nested.name, to: groupID, now: now)
+        try mountSnapshotChildren(
+          of: nested, into: nestedID, catalog: &catalog, now: now)
+      case .server(let leaf):
+        try catalog.addServer(
+          importServerFields(from: leaf.record), to: groupID, now: now)
+      }
+    }
+  }
+
+  /// 导入记录直接携带秘密；不解析插件参数，保留供应商原文。
+  static func importServerFields(from record: RemoteServerRecord) -> ServerFields {
+    ServerFields(
+      address: record.address, port: record.port, encryptionMethod: record.encryptionMethod,
+      password: record.password, remark: record.remark,
+      pluginProgram: record.pluginProgram,
+      pluginOptions: record.pluginOptions.flatMap { $0.isEmpty ? nil : $0 })
+  }
+
+  // MARK: - 命名与嗅探助手
+
+  /// 重名分组加序号后缀（沿用 Legacy 导入命名惯例）：与现有分组同名时追加
+  /// 「 2」「 3」…
+  private static func uniqueGroupName(_ base: String, in catalog: ConfigurationCatalog) -> String {
+    let names = Set(
+      catalog.entries.values.compactMap { entry -> String? in
+        guard case .group(let fields) = entry.kind else { return nil }
+        return fields.name
+      })
+    guard names.contains(base) else { return base }
+    var suffix = 2
+    while names.contains("\(base) \(suffix)") { suffix += 1 }
+    return "\(base) \(suffix)"
+  }
+
+  /// 文件名去扩展名（SIP-008 扁平回退时的根组名兜底，与导出建议文件名对称）。
+  private static func fileNameBase(_ name: String) -> String {
+    let trimmed = name.trimmingCharacters(in: .whitespacesAndNewlines)
+    let base = trimmed.isEmpty ? "" : (trimmed as NSString).deletingPathExtension
+    return base.isEmpty ? String(localized: "导入的服务器") : base
+  }
+
+  /// 内容为 JSON 对象（SIP-008 根形态）即走整份拒绝语义；数组或残缺 JSON
+  /// 不算，交由文本行路径点名。
+  private static func looksLikeJSONObject(_ data: Data) -> Bool {
+    guard let object = try? JSONSerialization.jsonObject(with: data) else { return false }
+    return object is [String: Any]
+  }
+
+  /// 数据是可解码位图（ImageIO 事实，PNG/JPEG/HEIC/GIF/TIFF 等）；位图交给
+  /// Vision 做条码识别。
+  private static func isDecodableImage(_ data: Data) -> Bool {
+    guard let source = CGImageSourceCreateWithData(data as CFData, nil) else { return false }
+    return CGImageSourceGetCount(source) > 0
+  }
+
+  private static func snapshotServerCount(_ group: SubscriptionSnapshot.Group) -> Int {
+    group.children.reduce(0) { count, child in
+      switch child {
+      case .server: return count + 1
+      case .group(let nested): return count + snapshotServerCount(nested)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Legacy.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Legacy.swift
new file mode 100644
index 000000000..440c0c863
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Legacy.swift
@@ -0,0 +1,47 @@
+import Foundation
+
+/// Legacy 导入编排：读取当前不可变快照、经导入服务原子提交
+/// 携带秘密的手动记录，随后对齐已提交状态并发布结构化报告。导入不启动代理、
+/// 不写系统代理设置、不触发普通目录提交的运行时收敛；导入后的
+/// 2.0 自身运行时边界由组合根注入的 `postLegacyImport` 闭包一次性接线。
+extension CatalogWorkflow {
+  /// 显式请求导入：`reimport` 为 `false` 时导入首次发现的
+  /// 快照（成功后不再自动重复）；`true` 时读取当前快照创建新的独立手动分组。
+  /// 返回含新建分组身份的结构化导入报告（导入/跳过/身份重生成计数），秘密值
+  /// 不出现在报告中；分组身份供统一导入面板成功后选中。
+  @discardableResult
+  func importLegacy(reimport: Bool = false) async throws -> LegacyImportOutcome {
+    let snapshot: LegacySnapshot
+    if reimport {
+      guard let current = try dependencies.legacyImportService.readSnapshot() else {
+        throw LegacyImportError.noSnapshot
+      }
+      snapshot = current
+    } else if let discoveredLegacySnapshot {
+      snapshot = discoveredLegacySnapshot
+    } else {
+      guard let current = try dependencies.legacyImportService.readSnapshot() else {
+        throw LegacyImportError.noSnapshot
+      }
+      snapshot = current
+    }
+    let outcome = try dependencies.legacyImportService.importSnapshot(
+      snapshot, reimport: reimport)
+    // 导入服务独立落盘各 store 后对齐内存已提交状态；不经普通提交管线，
+    // 因此不触发运行时收敛。
+    dependencies.coordinator.reloadCommittedStateFromStore()
+    republishCommittedState()
+    refreshLegacyImportState()
+    await dependencies.postLegacyImport?(outcome)
+    return outcome
+  }
+
+  /// 重读磁盘发现状态，不写任何标记或 Legacy 数据。
+  func refreshLegacyImportState() {
+    let completed = (try? dependencies.legacyImportService.isCompleted()) ?? false
+    discoveredLegacySnapshot = try? dependencies.legacyImportService.readSnapshot()
+    publishLegacyImportState(
+      LegacyImportAvailability(
+        snapshotFound: discoveredLegacySnapshot != nil, completed: completed))
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Policy.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Policy.swift
new file mode 100644
index 000000000..91e0617de
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Policy.swift
@@ -0,0 +1,110 @@
+import Foundation
+
+/// 目录政策查询与激活命令：删除确认档位、拖放资格
+/// 与激活资格/命令的唯一 UI-facing 出口。视图不得重推 ownership、删除确认或
+/// ADR-0001 激活预检；领域拒绝仍是不变量防线。
+extension CatalogWorkflow {
+  // MARK: - 删除确认事实
+
+  /// 删除资格（命令入口的统一 disable 判据，如分区工具栏删除钮）：节点存在
+  /// 且来源为 manual。订阅节点结构只读（GLOSSARY.md），其移除属订阅分区流程，
+  /// 不经此口径。
+  func canDelete(_ id: NodeID) -> Bool {
+    guard let node = tree.node(withID: id) else { return false }
+    return node.isManual
+  }
+
+  /// 删除确认档位（GLOSSARY.md：空手动组/服务器单次；非空手动组二次并点名规模）。
+  /// 节点不存在时为 `nil`。
+  func deleteFacts(for id: NodeID) -> DeleteConfirmKind? {
+    guard let node = tree.node(withID: id) else { return nil }
+    guard node.isGroup, node.isManual else { return .leaf }
+    if node.childNodes.isEmpty { return .emptyGroup }
+    return .subtree(
+      count: node.subtreeNodeCount,
+      includesCredentials: subtreeHasServers(node))
+  }
+
+  private func subtreeHasServers(_ node: CatalogTreeNode) -> Bool {
+    if !node.isGroup { return true }
+    return node.childNodes.contains { subtreeHasServers($0) }
+  }
+
+  // MARK: - 拖放资格
+
+  /// 移动/落点资格：存在性、非自身、被拖节点可拖、目标为根或不在被拖子树内
+  /// 的手动组；同父落点不提供重排。跨来源与成环仍由领域拒绝。
+  func canMove(_ id: NodeID, to parent: NodeID?) -> Bool {
+    guard let node = tree.node(withID: id) else { return false }
+    guard id != parent, node.parentID != parent else { return false }
+    guard node.isManual else { return false }
+    guard let parent else { return true }
+    guard let parentNode = tree.node(withID: parent), parentNode.isGroup, parentNode.isManual else {
+      return false
+    }
+    return !node.subtreeIDs.contains(parent)
+  }
+
+  /// 拖拽载荷：手动节点携带身份；订阅节点结构只读，返回 `nil`（空载荷）。
+  func dragPayload(for id: NodeID) -> String? {
+    guard let node = tree.node(withID: id), node.isManual else { return nil }
+    return id.rawValue
+  }
+
+  // MARK: - 激活资格与命令
+
+  /// 激活资格（点前门禁，ADR-0001）：空组与无 candidate 原子不可激活；
+  /// 组内已知无效叶子计入跳过数。
+  func activationEligibility(for id: NodeID) -> ActivationEligibility? {
+    guard let node = tree.node(withID: id) else { return nil }
+    if node.isGroup {
+      if node.childNodes.isEmpty {
+        return ActivationEligibility(
+          canActivate: false, candidateCount: 0, skippedInvalidCount: 0,
+          ineligibility: .emptyGroup)
+      }
+      var candidateCount = 0
+      var skipped = 0
+      countEligibility(of: node, candidates: &candidateCount, skipped: &skipped)
+      if candidateCount == 0 {
+        return ActivationEligibility(
+          canActivate: false, candidateCount: 0, skippedInvalidCount: skipped,
+          ineligibility: .noCandidates)
+      }
+      return ActivationEligibility(
+        canActivate: true, candidateCount: candidateCount, skippedInvalidCount: skipped,
+        ineligibility: nil)
+    }
+    if node.isInvalid {
+      return ActivationEligibility(
+        canActivate: false, candidateCount: 0, skippedInvalidCount: 1,
+        ineligibility: .noCandidates)
+    }
+    return ActivationEligibility(
+      canActivate: true, candidateCount: 1, skippedInvalidCount: 0, ineligibility: nil)
+  }
+
+  private func countEligibility(
+    of node: CatalogTreeNode,
+    candidates: inout Int,
+    skipped: inout Int
+  ) {
+    if !node.isGroup {
+      if node.isInvalid {
+        skipped += 1
+      } else {
+        candidates += 1
+      }
+      return
+    }
+    for child in node.childNodes {
+      countEligibility(of: child, candidates: &candidates, skipped: &skipped)
+    }
+  }
+
+  /// 激活命令（typed command surface）：经 `Activating` port 发出；编排与
+  /// 运行时收敛留在 port 背后。意外错误 throws。
+  func activate(_ id: NodeID) async throws -> ActivationCommandOutcome {
+    try await dependencies.activator.activate(id)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Presentation.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Presentation.swift
new file mode 100644
index 000000000..ac28e1306
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Presentation.swift
@@ -0,0 +1,123 @@
+import Foundation
+
+extension CatalogWorkflow {
+  /// 行显示名（导航标题、重命名预填等）；节点不存在为空串。
+  func displayName(for id: NodeID) -> String {
+    dependencies.coordinator.committedCatalog.entry(for: id)?.displayName ?? ""
+  }
+
+  /// 有序平面收藏；配置组只返回自身，详情仍使用同一个节点身份。
+  var favorites: [CatalogTreeNode] {
+    favoriteIDs.compactMap { tree.node(withID: $0) }
+  }
+
+  func isFavorite(_ id: NodeID) -> Bool { favoriteIDs.contains(id) }
+
+  /// 服务器叶子的已知阻塞原因（typed；编辑面「激活状态」区）。
+  func serverInvalidReasons(for id: NodeID) -> [LeafInvalidationReason] {
+    tree.node(withID: id)?.invalidReasons ?? []
+  }
+
+  /// Rendering returns metadata only, never credentials or form baselines.
+  func serverFormPresentation(for id: NodeID) -> ServerFormPresentation? {
+    guard let entry = dependencies.coordinator.committedCatalog.entry(for: id),
+      case .server(let fields) = entry.kind
+    else { return nil }
+    return ServerFormPresentation(
+      isEditable: entry.source == .manual, plugin: pluginPresentation(for: fields))
+  }
+
+  /// 已保存详情投影；普通渲染不向视图传递密码或参数。
+  func serverDetailPresentation(for id: NodeID) -> ServerDetailPresentation? {
+    guard let entry = dependencies.coordinator.committedCatalog.entry(for: id),
+      case .server(let fields) = entry.kind
+    else { return nil }
+    return ServerDetailPresentation(
+      name: entry.displayName, address: fields.address, port: fields.port,
+      encryptionMethod: fields.encryptionMethod, plugin: pluginPresentation(for: fields))
+  }
+
+  /// 详情参数装载独立于密码和插件可用性；未知插件仍可核对原文。
+  func serverDetailPluginOptions(for id: NodeID) throws -> String {
+    guard let entry = dependencies.coordinator.committedCatalog.entry(for: id),
+      case .server(let fields) = entry.kind
+    else { throw ServerFormLoadError.notFound }
+    return fields.pluginOptions ?? ""
+  }
+
+  /// 服务器编辑面（显式命令）：解析密码与目录中的具名插件参数明文。
+  /// 节点不存在或不是服务器叶子为 `nil`。
+  func serverEditForm(for id: NodeID) throws -> ServerEditForm? {
+    guard let entry = dependencies.coordinator.committedCatalog.entry(for: id),
+      case .server(let fields) = entry.kind
+    else { return nil }
+    let password = fields.password
+    return ServerEditForm(
+      address: fields.address,
+      port: fields.port,
+      encryptionMethod: fields.encryptionMethod,
+      password: password,
+      remark: fields.remark,
+      plugin: try loadedPluginState(for: fields),
+      isEditable: entry.source == .manual)
+  }
+
+  /// 插件区状态：集内引用给可执行文件存在性事实与参数明文；集外引用
+  /// 以显式 unknown 呈现（原样保留，激活语义由状态机点名拒绝）。
+  private func pluginPresentation(for fields: ServerFields) -> PluginSectionState {
+    let snapshot = dependencies.plugins.catalogSnapshot()
+    let selection: PluginSelection
+    if let program = fields.pluginProgram {
+      selection =
+        snapshot.entry(for: program) != nil
+        ? .named(program: program) : .unknown(program: program)
+    } else {
+      selection = .none
+    }
+    return pluginSection(
+      selection: selection, snapshot: snapshot,
+      optionsPresent: fields.pluginOptions != nil)
+  }
+
+  private func loadedPluginState(for fields: ServerFields) throws -> PluginSectionState {
+    var facts = pluginPresentation(for: fields)
+    if case .named = facts.selection, let options = fields.pluginOptions {
+      facts.options = options
+    }
+    return facts
+  }
+
+  func newFormPluginSection(selection: PluginSelection) -> PluginSectionState {
+    pluginSection(
+      selection: selection, snapshot: dependencies.plugins.catalogSnapshot(),
+      optionsPresent: false)
+  }
+
+  private func pluginSection(
+    selection: PluginSelection, snapshot: PluginCatalogSnapshot, optionsPresent: Bool
+  ) -> PluginSectionState {
+    PluginSectionState(
+      selection: selection,
+      programs: snapshot.entries.map {
+        PluginSectionState.Program(
+          program: $0.program, source: $0.source,
+          availability: $0.availability)
+      },
+      mappingsUnreadable: snapshot.mappingsUnreadable,
+      optionsPresent: optionsPresent, options: "")
+  }
+
+  /// 添加落点：选中手动分组 → 组内；选中服务器 → 其父组（仅手动）；其余 → 根。
+  func importTargetParent(for selection: NodeID?) -> NodeID? {
+    let catalog = dependencies.coordinator.committedCatalog
+    guard let selection, let entry = catalog.entry(for: selection) else { return nil }
+    switch entry.kind {
+    case .group:
+      return entry.source == .manual ? selection : nil
+    case .server:
+      guard let parent = (try? catalog.parentID(of: selection)) ?? nil else { return nil }
+      return catalog.entry(for: parent)?.source == .manual ? parent : nil
+    }
+  }
+
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Subscriptions.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Subscriptions.swift
new file mode 100644
index 000000000..6bd3012a2
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+Subscriptions.swift
@@ -0,0 +1,263 @@
+import Foundation
+
+/// 订阅生命周期：粘贴 HTTPS URL 创建、单个/全部
+/// 立即更新、编辑 URL（保留身份）、删除（递归清除）。刷新 = 完整获取、解析、
+/// 校验后同文档原子提交快照与刷新状态；任何失败保留最后成功快照、活动目标与
+/// 运行状态，仅标记来源失败。每次提交都经目录提交协调器异步
+/// 触发运行时收敛（订阅子树变更 → 活动目标原子跟随或清除停止）。
+extension CatalogWorkflow {
+  /// 当前会话最近一次失败的安全事实，保存失败时也可呈现。
+  func subscriptionRefreshFailure(for id: NodeID) -> SubscriptionRefreshFailure? {
+    subscriptionRefreshFailures[id]
+  }
+
+  /// 创建订阅：校验 HTTPS URL → 落订阅记录与空固定分组 → 立即
+  /// 首次刷新。首次刷新失败留空分组加错误态（状态在刷新内标记，创建本身总是
+  /// 成功）。返回订阅 summary（状态在首次刷新中落定）。
+  @discardableResult
+  func createSubscription(
+    urlString: String, autoUpdate: SubscriptionAutoUpdateSettings = .init()
+  ) async throws -> SubscriptionSummary {
+    let url = try Self.validatedSubscriptionURL(urlString)
+    var record = SubscriptionRecord(
+      id: .fresh(),
+      groupID: .fresh(),
+      url: url.absoluteString,
+      status: .never)
+    record.autoUpdate.save(
+      autoUpdate, at: dependencies.subscriptionNow(), jitter: dependencies.subscriptionJitter())
+    try commitSubscriptionDocument { catalog, subscriptions in
+      try catalog.addGroup(url.host ?? "", source: .subscription, id: record.groupID, now: Date())
+      subscriptions.append(record)
+    }
+    await refreshSubscription(record.id)
+    return subscriptions.first(where: { $0.id == record.id })
+      ?? SubscriptionSummary(
+        id: record.id, groupID: record.groupID, name: url.host ?? "",
+        host: url.host ?? "", status: .never, serverCount: 0)
+  }
+
+  /// 立即更新单个订阅。不抛错：失败标记到订阅状态（无静默，
+  /// 有结构化状态可呈现）。同一订阅不重入：进行中的刷新期间重复触发直接跳过。
+  func refreshSubscription(_ id: NodeID) async {
+    guard subscriptionRequests[id] == nil, let source = subscriptionRecord(withID: id),
+      !Task.isCancelled
+    else { return }
+    let token = UUID()
+    setSubscriptionRefreshCompletion(nil, for: id)
+    let request = Task { await runSubscriptionRefresh(source, token: token) }
+    subscriptionRequests[id] = (token, request)
+    await withTaskCancellationHandler {
+      await request.value
+    } onCancel: {
+      request.cancel()
+    }
+  }
+
+  private func runSubscriptionRefresh(_ source: SubscriptionRecord, token: UUID) async {
+    let id = source.id
+    defer {
+      if subscriptionRequests[id]?.token == token {
+        subscriptionRequests[id] = nil
+        scheduleAutomaticUpdateCheck()
+      }
+    }
+    do {
+      try await performRefresh(source, token: token)
+      setSubscriptionRefreshFailure(nil, for: id)
+      publishSubscriptionServerRefresh(id)
+      setSubscriptionRefreshCompletion(SubscriptionRefreshCompletion(), for: id)
+    } catch is CancellationError {
+      // Cancellation preserves the last committed result and plan.
+    } catch {
+      guard !Task.isCancelled, subscriptionRequests[id]?.token == token,
+        subscriptionRecord(withID: id)?.url == source.url
+      else { return }
+      let failure = SubscriptionRefreshFailure.from(error: error)
+      setSubscriptionRefreshFailure(failure, for: id)
+      await markRefreshFailed(subscriptionID: id, failure: failure)
+      setSubscriptionRefreshCompletion(SubscriptionRefreshCompletion(failure: failure), for: id)
+    }
+  }
+
+  /// 立即更新全部订阅（逐个顺序执行；单个失败不影响其余）。
+  func refreshAllSubscriptions() async {
+    for record in subscriptions {
+      await refreshSubscription(record.id)
+    }
+  }
+
+  /// 保存订阅地址与自动更新选择，保留订阅、固定分组与远端身份。
+  /// 仅地址变化时立即刷新；设置保存不获取远端内容或触发运行时收敛。
+  func saveSubscription(
+    _ id: NodeID, urlString: String, autoUpdate: SubscriptionAutoUpdateSettings? = nil
+  ) async throws {
+    guard let record = subscriptionRecord(withID: id) else {
+      throw SubscriptionFormError.notFound
+    }
+    let url = try Self.validatedSubscriptionURL(urlString)
+    let changedURL = record.url != url.absoluteString
+    try dependencies.coordinator.commitSubscriptions { subscriptions in
+      guard let index = subscriptions.firstIndex(where: { $0.id == id }) else {
+        throw SubscriptionFormError.notFound
+      }
+      subscriptions[index].autoUpdate.save(
+        autoUpdate, sourceChanged: changedURL,
+        at: dependencies.subscriptionNow(), jitter: dependencies.subscriptionJitter())
+      subscriptions[index].url = url.absoluteString
+    }
+    if changedURL { cancelSubscriptionRequest(id) }
+    republishCommittedState()
+    if changedURL { await refreshSubscription(record.id) }
+  }
+
+  func cancelSubscriptionRequest(_ id: NodeID) {
+    subscriptionRequests.removeValue(forKey: id)?.task.cancel()
+  }
+
+  /// 删除订阅：递归清除订阅源、固定分组与远端成员并清理凭据；
+  /// 活动目标的清除与代理停止由 postCommit 的既有激活语义处理（无静默回退）。
+  /// 返回被删身份集合供 UI 清除失效选择。
+  func removeSubscription(_ id: NodeID) async throws -> RemovalOutcome {
+    guard let record = subscriptionRecord(withID: id) else {
+      throw SubscriptionFormError.notFound
+    }
+    var removedEntries: [CatalogEntry] = []
+    try commitSubscriptionDocument { catalog, subscriptions in
+      removedEntries = try catalog.removeSubscriptionSubtree(of: record.groupID)
+      subscriptions.removeAll { $0.id == id }
+    }
+    cancelSubscriptionRequest(id)
+    setSubscriptionRefreshCompletion(nil, for: id)
+    return RemovalOutcome(removedNodeIDs: Set(removedEntries.map(\.id)))
+  }
+
+  /// 编辑面预填用：读取订阅 URL 明文（仅用户显式编辑动作触发）。
+  func subscriptionURL(for id: NodeID) throws -> String {
+    guard let record = subscriptionRecord(withID: id) else {
+      throw SubscriptionFormError.notFound
+    }
+    return record.url
+  }
+
+  // MARK: - 刷新内核
+
+  /// 完整获取 → 解析校验 → 原子提交快照与成功状态。
+  private func performRefresh(_ record: SubscriptionRecord, token: UUID) async throws {
+    let urlString = record.url
+    let url = try Self.validatedSubscriptionURL(urlString)
+    let data = try await dependencies.subscriptionFetcher.fetch(url)
+    try Task.checkCancellation()
+    guard subscriptionRequests[record.id]?.token == token,
+      subscriptionRecord(withID: record.id)?.url == record.url
+    else { throw CancellationError() }
+    let snapshot = try SubscriptionDocumentParser.parse(data, subscriptionID: record.id)
+    let summary =
+      subscriptions.first(where: { $0.id == record.id })
+      ?? SubscriptionSummary(
+        id: record.id, groupID: record.groupID, name: "", host: "",
+        status: record.status, serverCount: 0)
+    try await commitSnapshot(snapshot, summary: summary, fallbackName: url.host ?? "")
+  }
+
+  private func commitSnapshot(
+    _ snapshot: SubscriptionSnapshot, summary: SubscriptionSummary, fallbackName: String
+  ) async throws {
+    try Task.checkCancellation()
+    do {
+      try commitSubscriptionDocument { catalog, subscriptions in
+        let now = dependencies.subscriptionNow()
+        let resolved = Self.catalogSnapshot(snapshot.root, catalogGroupID: summary.groupID)
+        try Task.checkCancellation()
+        let name = snapshot.root.name.isEmpty ? fallbackName : snapshot.root.name
+        let document = CatalogSubscriptionSnapshot(name: name, root: resolved)
+        _ = try catalog.applySubscriptionSnapshot(document, into: summary.groupID, now: now)
+        if let index = subscriptions.firstIndex(where: { $0.id == summary.id }) {
+          subscriptions[index].status = .succeeded(at: now)
+          subscriptions[index].information =
+            snapshot.information.isEmpty ? nil : snapshot.information
+          subscriptions[index].lastSucceededAt = now
+          subscriptions[index].autoUpdate.refreshSucceeded(
+            policy: snapshot.autoUpdatePolicy, at: now, jitter: dependencies.subscriptionJitter())
+        }
+      }
+    } catch {
+      if error is CancellationError { throw error }
+      throw SubscriptionRefreshFailure.commit
+    }
+  }
+
+  /// 失败点名写入订阅状态。持久化的是 typed durable facts，不是已经渲染的
+  /// 用户可见句子。
+  private func markRefreshFailed(
+    subscriptionID: NodeID, failure: SubscriptionRefreshFailure
+  ) async {
+    try? commitSubscriptionDocument { _, subscriptions in
+      if let index = subscriptions.firstIndex(where: { $0.id == subscriptionID }) {
+        let now = dependencies.subscriptionNow()
+        subscriptions[index].status = .failed(at: now, failure: failure)
+        subscriptions[index].autoUpdate.refreshFailed(
+          at: now, jitter: dependencies.subscriptionJitter())
+      }
+    }
+  }
+
+  /// 订阅原始记录查询（module 内部；投影不含完整 URL）。
+  func subscriptionRecord(withID id: NodeID) -> SubscriptionRecord? {
+    dependencies.coordinator.committedSubscriptions.first { $0.id == id }
+  }
+
+  /// 订阅卡片 projection 推导（module 内部）：名称、URL host、结构化状态、
+  /// 服务器数。
+  static func subscriptionSummaries(
+    _ records: [SubscriptionRecord],
+    catalog: ConfigurationCatalog
+  ) -> [SubscriptionSummary] {
+    records.map { record in
+      let host = URL(string: record.url)?.host ?? ""
+      let subtree = (try? catalog.subscriptionSubtree(of: record.groupID)) ?? []
+      let serverCount = subtree.reduce(0) { count, entry in
+        if case .server = entry.kind { return count + 1 }
+        return count
+      }
+      return SubscriptionSummary(
+        id: record.id,
+        groupID: record.groupID,
+        name: catalog.entry(for: record.groupID)?.displayName ?? "",
+        host: host,
+        status: record.status,
+        serverCount: serverCount,
+        information: record.information,
+        lastSucceededAt: record.lastSucceededAt,
+        autoUpdate: record.autoUpdate)
+    }
+  }
+
+  /// 远端身份保留在订阅作用域中，秘密随服务器记录进入工作副本。
+  private static func catalogSnapshot(
+    _ group: SubscriptionSnapshot.Group, catalogGroupID: NodeID
+  ) -> CatalogSubscriptionSnapshot.Group {
+    let children: [CatalogSubscriptionSnapshot.Child] = group.children.map { child in
+      switch child {
+      case .server(let leaf):
+        return .server(.init(id: leaf.id, fields: importServerFields(from: leaf.record)))
+      case .group(let nested):
+        return .group(catalogSnapshot(nested, catalogGroupID: nested.id))
+      }
+    }
+    return CatalogSubscriptionSnapshot.Group(
+      id: catalogGroupID, name: group.name, children: children)
+  }
+
+  /// 订阅地址门禁：必须是带主机的 HTTPS URL（宽松模式永不提供）。
+  private static func validatedSubscriptionURL(_ string: String) throws -> URL {
+    let trimmed = string.trimmingCharacters(in: .whitespacesAndNewlines)
+    guard let url = URL(string: trimmed),
+      url.scheme?.lowercased() == "https",
+      url.host != nil
+    else {
+      throw SubscriptionFormError.invalidURL
+    }
+    return url
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+URI.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+URI.swift
new file mode 100644
index 000000000..5c6d5a01f
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow+URI.swift
@@ -0,0 +1,67 @@
+import Foundation
+
+/// 分享顶部的已保存资料，不包含密码或插件参数。
+struct ServerSharePresentation {
+  let name: String
+  let address: String
+  let port: Int
+  let encryptionMethod: String
+  let pluginProgram: String?
+}
+
+// MARK: - 分享与 URI → 服务器叶子
+
+extension CatalogWorkflow {
+  func serverSharePresentation(for id: NodeID) -> ServerSharePresentation? {
+    guard let entry = dependencies.coordinator.committedCatalog.entry(for: id),
+      case .server(let fields) = entry.kind
+    else { return nil }
+    return ServerSharePresentation(
+      name: entry.displayName, address: fields.address, port: fields.port,
+      encryptionMethod: fields.encryptionMethod, pluginProgram: fields.pluginProgram)
+  }
+
+  /// 仅在用户明确请求分享时生成包含秘密的 URI。
+  func shareURI(for id: NodeID) throws -> String {
+    guard let entry = dependencies.coordinator.committedCatalog.entry(for: id),
+      case .server(let fields) = entry.kind
+    else { throw CatalogError.notAServer(id) }
+    guard !fields.password.isEmpty else { throw ServerFormError.invalidPassword }
+    return SsUri(
+      method: fields.encryptionMethod, password: fields.password,
+      host: fields.address, port: fields.port,
+      pluginProgram: fields.pluginProgram, pluginOptions: fields.pluginOptions,
+      remark: fields.remark.isEmpty ? nil : fields.remark
+    ).encode()
+  }
+
+  static func serverFields(from uri: SsUri) -> ServerFields {
+    ServerFields(
+      address: uri.host, port: uri.port, encryptionMethod: uri.method,
+      password: uri.password, remark: uri.remark ?? "",
+      pluginProgram: uri.pluginProgram,
+      pluginOptions: uri.pluginProgram == nil ? nil : uri.pluginOptions)
+  }
+
+  static func serverFields(of entry: CatalogEntry) -> ServerFields? {
+    if case .server(let fields) = entry.kind { return fields }
+    return nil
+  }
+
+  /// 无插件时清除参数；未知插件的原始参数在其他字段编辑时保持不变。
+  static func applyPluginSelection(
+    _ selection: PluginSelection, options: String?, to fields: inout ServerFields
+  ) {
+    switch selection {
+    case .none:
+      fields.pluginProgram = nil
+      fields.pluginOptions = nil
+    case .named(let program):
+      fields.pluginProgram = program
+      let trimmed = (options ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
+      fields.pluginOptions = trimmed.isEmpty ? nil : trimmed
+    case .unknown:
+      break
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow.swift
new file mode 100644
index 000000000..b9d6269e0
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflow.swift
@@ -0,0 +1,296 @@
+import Combine
+import Foundation
+
+/// 目录工作流 module（深化为 application module）：主窗口与
+/// 配置 UI 的唯一 UI-facing seam。隐藏配置目录、秘密值、订阅快照、Legacy
+/// 导入细节、持久化协调与运行时收敛，向 UI 提供不含秘密值的树/详情/订阅
+/// projection、opaque 节点身份查询、typed command、typed error 与 structured
+/// outcome。选择、pane、sheet、alert 等窗口状态仍由 UI 持有；本类不生成
+/// 用户可见文案。
+///
+/// 内部沿用既有深 module：`ConfigurationCatalog` 的结构约束、
+/// `ActivationStateMachine` 经 `CatalogCommitCoordinator` 的激活语义与目录
+/// 持久化/runtime sync 协调，以及既有订阅获取与 Legacy 导入缝。
+/// 「目录已提交」与「运行时已收敛」是分离的观察面：提交在
+/// 持久化成功即完成，`runtimeSync` 单独呈现收敛阶段，失败不回滚目录。
+/// 实现 adapter 全部经组合根注入的 `CatalogWorkflowDependencies` 装配；
+/// 本类不自行创建生产默认实现。
+@MainActor
+final class CatalogWorkflow: ObservableObject {
+  @Published private(set) var libraryFailure: ServerLibraryFailure?
+
+  /// 目录树 projection（侧栏、级联、移动目的地、删除确认共用）。
+  @Published private(set) var tree: CatalogTreeSnapshot
+  @Published private(set) var favoriteIDs: [NodeID]
+  /// 订阅卡片 projection（非敏感）。
+  @Published private(set) var subscriptions: [SubscriptionSummary] = []
+  /// 请求登记的只读展示投影；刷新互斥仅由请求表判定。
+  @Published private(set) var refreshingSubscriptionIDs: Set<NodeID> = []
+  /// 当前会话的刷新结果；不从持久化状态重建，供各入口共用结束时间。
+  @Published private(set) var subscriptionRefreshCompletions:
+    [NodeID: SubscriptionRefreshCompletion] = [:]
+  /// 最近一次订阅刷新失败的安全事实，包括无法持久化失败状态的情况。
+  @Published private(set) var subscriptionRefreshFailures: [NodeID: SubscriptionRefreshFailure] =
+    [:]
+  /// 最近一次提交的运行时收敛阶段（与目录提交成功分离）。存储与
+  /// 发布单点在提交协调器，此处只透传读面；需要实时更新的表面订阅
+  /// `runtimeSyncChanges`（`.onReceive` 消费），不经本类 objectWillChange——
+  /// App 侧目前无视图消费者，避免每次提交徒劳失效全部目录观察者。
+  var runtimeSync: RuntimeSyncStatus { dependencies.coordinator.syncStatus }
+
+  /// 收敛阶段变化通道（didChange 语义，值即当前阶段）。
+  var runtimeSyncChanges: AnyPublisher<RuntimeSyncStatus, Never> {
+    dependencies.coordinator.syncStatusChanges.eraseToAnyPublisher()
+  }
+  /// Legacy 快照发现与一次性完成标记。
+  @Published private(set) var legacyImportState = LegacyImportAvailability(
+    snapshotFound: false, completed: false)
+
+  /// 组合根与测试装配的全部实现 adapter：coordinator、
+  /// 插件、订阅获取、Legacy 导入服务、导入后回调与激活缝只经此束持有，
+  /// 不再作为 workflow 属性暴露。仅供组合根与测试构造；视图不得访问——
+  /// 独立 target 拆分前由 architecture deletion check 守护残余可见性。
+  var connectivity: ServerConnectivity?
+
+  let dependencies: CatalogWorkflowDependencies
+  /// 启动时发现的 Legacy 快照（导入编排用；秘密值不进 projection）。
+  var discoveredLegacySnapshot: LegacySnapshot?
+  var subscriptionRequests: [NodeID: (token: UUID, task: Task<Void, Never>)] = [:] {
+    didSet { refreshingSubscriptionIDs = Set(subscriptionRequests.keys) }
+  }
+  var automaticUpdateState = AutomaticUpdateState.stopped
+
+  /// 组合根注入依赖束；workflow 不自行创建任何生产 adapter。
+  init(dependencies: CatalogWorkflowDependencies) {
+    self.dependencies = dependencies
+    let coordinator = dependencies.coordinator
+    libraryFailure = coordinator.loadError.map(ServerLibraryFailure.init)
+    favoriteIDs = coordinator.committedFavoriteIDs
+    tree = .build(
+      from: coordinator.committedCatalog,
+      plugins: dependencies.plugins)
+    subscriptions = Self.subscriptionSummaries(
+      coordinator.committedSubscriptions, catalog: coordinator.committedCatalog)
+    refreshLegacyImportState()
+  }
+
+  /// Successful subscription commits, including credential-only record changes.
+  private let subscriptionServerRefreshSubject = PassthroughSubject<Set<NodeID>, Never>()
+
+  var subscriptionServerRefreshes: AnyPublisher<Set<NodeID>, Never> {
+    subscriptionServerRefreshSubject.eraseToAnyPublisher()
+  }
+
+  private let serverUpdateSubject = PassthroughSubject<Set<NodeID>, Never>()
+
+  /// 成功保存或订阅刷新后装载详情参数，包括只改变凭据而树值不变的提交。
+  var serverDetailChanges: AnyPublisher<Set<NodeID>, Never> {
+    subscriptionServerRefreshSubject.merge(with: serverUpdateSubject).eraseToAnyPublisher()
+  }
+
+  func publishSubscriptionServerRefresh(_ id: NodeID) {
+    guard let summary = subscriptions.first(where: { $0.id == id }),
+      let group = tree.node(withID: summary.groupID)
+    else { return }
+    subscriptionServerRefreshSubject.send(group.subtreeIDs)
+  }
+
+  /// 只有用户主动操作才允许钥匙串请求交互授权。
+  func unlockLibrary() {
+    do {
+      try dependencies.coordinator.reload(allowingInteraction: true)
+      libraryFailure = nil
+      republishCommittedState()
+    } catch { libraryFailure = ServerLibraryFailure(error) }
+  }
+
+  /// UI 必须先取得用户放弃原配置的明确确认。
+  func resetLibrary() {
+    do {
+      try dependencies.coordinator.resetLibrary()
+      libraryFailure = nil
+      republishCommittedState()
+    } catch { libraryFailure = ServerLibraryFailure(error) }
+  }
+
+  // MARK: - 查询面
+
+  func setFavorite(_ id: NodeID, isFavorite: Bool) throws {
+    guard tree.containsNode(id) else { throw CatalogError.nodeNotFound(id) }
+    var updated = favoriteIDs
+    if isFavorite {
+      if !updated.contains(id) { updated.append(id) }
+    } else {
+      updated.removeAll { $0 == id }
+    }
+    try dependencies.coordinator.commitFavorites(updated)
+    favoriteIDs = dependencies.coordinator.committedFavoriteIDs
+  }
+
+  /// 将收藏移至指定收藏前；nil 表示末尾，不接受未收藏的节点。
+  func moveFavorite(_ id: NodeID, before target: NodeID?) throws {
+    guard favoriteIDs.contains(id) else { throw CatalogError.nodeNotFound(id) }
+    if let target, !favoriteIDs.contains(target) { throw CatalogError.nodeNotFound(target) }
+    guard id != target else { return }
+    var updated = favoriteIDs.filter { $0 != id }
+    let index = target.flatMap { updated.firstIndex(of: $0) } ?? updated.endIndex
+    updated.insert(id, at: index)
+    try dependencies.coordinator.commitFavorites(updated)
+    favoriteIDs = dependencies.coordinator.committedFavoriteIDs
+  }
+
+  // MARK: - 手动服务器/分组命令
+
+  /// 密码、插件参数与连接字段在同一工作副本中提交，失败不发布任何变更。
+  @discardableResult
+  func createServer(_ draft: ServerEditDraft, into parent: NodeID?) async throws -> NodeID {
+    let draft = try prepareServerDraft(draft)
+    return try commit { catalog in
+      var fields = ServerFields(
+        address: draft.address, port: draft.port, encryptionMethod: draft.encryptionMethod,
+        password: draft.password, remark: draft.remark)
+      Self.applyPluginSelection(draft.plugin, options: draft.pluginOptions, to: &fields)
+      return try catalog.addServer(fields, to: parent, now: Date())
+    }
+  }
+
+  /// 新建空手动分组；返回新分组身份。
+  @discardableResult
+  func createGroup(named name: String, into parent: NodeID?) async throws -> NodeID {
+    let trimmed = name.trimmingCharacters(in: .whitespaces)
+    guard !trimmed.isEmpty else { throw ServerFormError.emptyName }
+    return try commit { catalog in
+      try catalog.addGroup(trimmed, to: parent, now: Date())
+    }
+  }
+
+  /// 重命名手动分组：identity、父级与子项顺序不变。
+  func renameGroup(_ id: NodeID, to name: String) async throws {
+    let trimmed = name.trimmingCharacters(in: .whitespaces)
+    guard !trimmed.isEmpty else { throw ServerFormError.emptyName }
+    try commit { catalog in
+      try catalog.renameGroup(id, to: trimmed, now: Date())
+    }
+  }
+
+  /// 拖拽/移动菜单落点：跨来源、共享父级、成环由领域拒绝，
+  /// typed error 原样上抛。
+  func move(_ id: NodeID, to parent: NodeID?) async throws {
+    try commit { catalog in
+      try catalog.move(id, to: parent, now: Date())
+    }
+  }
+
+  /// 删除条目及其后代；凭据随记录一同删除。
+  func remove(_ id: NodeID) async throws -> RemovalOutcome {
+    let removed = try commit { catalog in
+      try catalog.remove(id, now: Date())
+    }
+    return RemovalOutcome(removedNodeIDs: Set(removed.map(\.id)))
+  }
+
+  /// 服务器字段与秘密作为完整值提交，未知插件参数原样保留。
+  func updateServer(_ id: NodeID, draft: ServerEditDraft) async throws {
+    let draft = try prepareServerDraft(draft)
+    try commit { catalog in
+      guard let entry = catalog.entry(for: id), case .server(var fields) = entry.kind else {
+        throw CatalogError.notAServer(id)
+      }
+      fields.password = draft.password
+      fields.address = draft.address
+      fields.port = draft.port
+      fields.encryptionMethod = draft.encryptionMethod
+      fields.remark = draft.remark
+      Self.applyPluginSelection(draft.plugin, options: draft.pluginOptions, to: &fields)
+      try catalog.updateServer(id, with: fields, now: Date())
+    }
+    serverUpdateSubject.send([id])
+  }
+
+  /// 新建与编辑共享的草稿准备：校验在目录提交之前完成。
+  /// 仅手动表单拒绝空名称；导入通过 ServerFields 的构造规则补名。
+  private func prepareServerDraft(_ input: ServerEditDraft) throws -> ServerEditDraft {
+    var draft = input
+    draft.address = draft.address.trimmingCharacters(in: .whitespaces)
+    guard !draft.address.isEmpty else { throw ServerFormError.invalidAddress }
+    guard (1...65_535).contains(draft.port) else { throw ServerFormError.invalidPort }
+    draft.encryptionMethod = draft.encryptionMethod.trimmingCharacters(in: .whitespacesAndNewlines)
+    guard !draft.encryptionMethod.isEmpty else { throw ServerFormError.missingEncryptionMethod }
+    guard EncryptionMethodCatalog.isSupported(draft.encryptionMethod) else {
+      throw ServerFormError.unsupportedEncryptionMethod(draft.encryptionMethod)
+    }
+    guard !draft.password.isEmpty else { throw ServerFormError.invalidPassword }
+    if case .named(let program) = draft.plugin,
+      dependencies.plugins.catalogSnapshot().entry(for: program) == nil
+    {
+      throw ServerFormError.pluginUnknown(program)
+    }
+    draft.remark = draft.remark.trimmingCharacters(in: .whitespacesAndNewlines)
+    guard !draft.remark.isEmpty else { throw ServerFormError.emptyName }
+    return draft
+  }
+
+  // MARK: - 提交管线（module 内部；UI 不得调用，独立 target 拆分前靠 deletion check）
+
+  /// 仅目录变更的提交便捷入口（module 内部扩展共用，同 `commitSubscriptionDocument`
+  /// 的窄缝口径）。
+  func commit<T>(
+    _ mutate: (inout ConfigurationCatalog) throws -> T
+  ) throws -> T {
+    try commitDocument { catalog, _ in
+      try mutate(&catalog)
+    }
+  }
+
+  /// 副本变更 → 协调器落盘 → 重新发布 projection；任一步失败则已发布状态
+  /// 不动。运行时收敛由协调器异步调度，不阻塞也不回滚本提交。
+  private func commitDocument<T>(
+    _ mutate: (inout ConfigurationCatalog, inout [SubscriptionRecord]) throws -> T
+  ) throws -> T {
+    let result = try dependencies.coordinator.commit(mutate)
+    republishCommittedState()
+    return result
+  }
+
+  /// 订阅扩展的唯一写路径（module 内部窄缝，替代直接摸 `commitDocument`）。
+  func commitSubscriptionDocument<T>(
+    _ mutate: (inout ConfigurationCatalog, inout [SubscriptionRecord]) throws -> T
+  ) throws -> T {
+    try commitDocument(mutate)
+  }
+
+  /// 提交成功后的 projection 重建（树 + 订阅卡片）。
+  func republishCommittedState() {
+    connectivity?.configurationsChanged()
+    let coordinator = dependencies.coordinator
+    favoriteIDs = coordinator.committedFavoriteIDs
+    tree = .build(
+      from: coordinator.committedCatalog,
+      plugins: dependencies.plugins)
+    subscriptions = Self.subscriptionSummaries(
+      coordinator.committedSubscriptions, catalog: coordinator.committedCatalog)
+    scheduleAutomaticUpdateCheck()
+  }
+
+  // MARK: - module 内部发布缝（扩展文件经此更新只读投影，setter 保持 private）
+
+  func publishLegacyImportState(_ state: LegacyImportAvailability) {
+    legacyImportState = state
+  }
+
+  func setSubscriptionRefreshCompletion(
+    _ completion: SubscriptionRefreshCompletion?, for id: NodeID
+  ) {
+    subscriptionRefreshCompletions[id] = completion
+  }
+
+  func setSubscriptionRefreshFailure(
+    _ result: SubscriptionRefreshFailure?, for id: NodeID
+  ) {
+    if let result {
+      subscriptionRefreshFailures[id] = result
+    } else {
+      subscriptionRefreshFailures.removeValue(forKey: id)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowDependencies.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowDependencies.swift
new file mode 100644
index 000000000..18aab6501
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowDependencies.swift
@@ -0,0 +1,28 @@
+import Foundation
+
+/// 组合根专用依赖束：目录工作流全部实现 adapter 的唯一装配缝。
+/// 生产 adapter 由组合根（MainApp）装配，测试注入 hermetic fake；
+/// CatalogWorkflow 不自行创建钥匙串存储、网络获取器或提交协调器。
+/// 本类型不是 UI-facing facade：视图不得引用——独立 target 拆分前，
+/// 同 target 的访问纪律由 architecture deletion check 守护。
+@MainActor
+struct CatalogWorkflowDependencies {
+  /// 提交管线与运行时收敛的唯一入口；与代理运行时路径共享同一
+  /// committed catalog source（组合根创建并注入）。
+  let coordinator: CatalogCommitCoordinator
+  /// 受管插件提供缝（编辑面集内事实与可执行文件存在性）。
+  let plugins: PluginExecutableResolving
+  /// 订阅获取缝。
+  let subscriptionFetcher: SubscriptionFetching
+  /// Legacy 导入服务（快照发现、完成标记与原子导入）。
+  let legacyImportService: LegacyImportService
+  /// Legacy 导入提交后的 2.0 运行时边界（组合根一次性接线；独立于普通提交管线）。
+  let postLegacyImport: ((LegacyImportOutcome) async -> Void)?
+  /// 激活缝：生产 adapter 为 `ProxyRuntimeController`，测试注入假 adapter。
+  let activator: Activating
+  var subscriptionNow: () -> Date = { Date() }
+  var subscriptionJitter: () -> Double = { Double.random(in: 0...0.1) }
+  var subscriptionWait: (TimeInterval) async throws -> Void = {
+    try await Task.sleep(for: .seconds($0))
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowImportModels.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowImportModels.swift
new file mode 100644
index 000000000..78062f954
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowImportModels.swift
@@ -0,0 +1,82 @@
+import Foundation
+
+// MARK: - 导入模型（docs/design/unified-server-import.md，ADR-0027）
+//
+// 导入域的 seam 类型：统一导入管线实现在 CatalogWorkflow+Import.swift，
+// Legacy 编排在 CatalogWorkflow+Legacy.swift；typed 文案归 presentation edge。
+
+/// 导入来源：剪贴板文本或单个文件。文件类型按内容嗅探分派（图片→二维码、
+/// JSON 对象→SIP-008、其余→ss:// 文本行）；来源是独立解码、独立提交与
+/// 结果报告的粒度单位。
+enum ImportSource: Equatable, Sendable {
+  case clipboardText(String)
+  case file(name: String, data: Data)
+}
+
+/// 一次导入的逐来源结果聚合；来源之间互不影响。不标 Sendable：携带的
+/// 提交失败携带 `any Error`（管线与 UI 同在
+/// 主 actor，无跨域传递）。
+struct ImportRunOutcome {
+  let sources: [ImportSourceOutcome]
+  /// 最后一个成功来源创建的节点；供收藏页导入后进入本地列表。
+  var newNodeSelectionCandidate: NodeID?
+
+  /// 成功来源中的落点/新建分组（最后一个），供导入后选中；nil 表示无可
+  /// 选中目标（全部失败，或只导入了目录根层的文本来源）。
+  var selectionCandidate: NodeID? {
+    sources.compactMap { outcome -> NodeID? in
+      if case .imported(_, let groupID) = outcome.result { return groupID }
+      return nil
+    }.last
+  }
+}
+
+struct ImportSourceOutcome {
+  let source: ImportSource
+  let result: ImportSourceResult
+}
+
+/// 单来源结果；整体失败时不产生任何目录变更。非 Equatable：提交失败携带
+/// 底层 `any Error`，测试
+/// 逐 case 模式匹配。
+enum ImportSourceResult {
+  /// 全部导入成功。`groupID` 为新建根分组（SIP-008 来源）或落点分组
+  /// （文本来源），nil 表示目录根。
+  case imported(count: Int, groupID: NodeID?)
+  /// 文本行部分成功：可解析行已全部添加，失败行逐条点名。
+  case partial(addedCount: Int, failures: [ImportLineFailure])
+  case failed(ImportSourceFailure)
+}
+
+/// 来源级失败（typed，无成句文案；呈现归 presentation edge）。
+enum ImportSourceFailure: Error {
+  /// SIP-008 文档解析失败（整份拒绝）。
+  case parse(SubscriptionParseError)
+  /// 图片不是可解码位图。
+  case undecodableImage
+  /// 二维码图片中没有 ss:// 负载。
+  case qrPayloadNotFound
+  /// 文本来源没有可解析的行（空文本）。
+  case noImportableLines
+  /// 服务器库提交失败；已提交值保持不变。
+  case commit(any Error)
+}
+
+/// 文本行导入的逐行失败（ss:// 文本与剪贴板来源共用）。
+struct ImportLineFailure: Equatable {
+  /// 失败行在输入文本按换行切分后的下标（0 起）。
+  let lineIndex: Int
+  let reason: ImportLineFailureReason
+}
+
+enum ImportLineFailureReason: Equatable, Error {
+  case decode(SsUriError)
+}
+
+/// Legacy 快照发现与完成标记：跳过不写标记，显式再导入仍
+/// 创建新的独立手动分组。首启主动弹窗已移除，发现状态仅供导入面板的
+/// Legacy 入口显隐。
+struct LegacyImportAvailability: Equatable {
+  let snapshotFound: Bool
+  let completed: Bool
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowModels.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowModels.swift
new file mode 100644
index 000000000..7e5cb9779
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowModels.swift
@@ -0,0 +1,392 @@
+import Foundation
+import Security
+
+// MARK: - 目录树 projection（非敏感）
+
+/// 目录树节点快照（目录工作流 module 的 UI-facing projection）：
+/// 名称、来源、形态、渲染原子与子树计数；不含凭据引用、密码、插件参数等
+/// 秘密值。身份为不透明 `NodeID`，重命名、移动或刷新后保持稳定。
+/// 门禁/关系型事实（删除档位、移动资格、激活资格）走 module 查询方法，
+/// 不在节点上堆政策字段。
+struct CatalogTreeNode: Identifiable, Equatable {
+  let id: NodeID
+  let name: String
+  let isGroup: Bool
+  let source: NodeSource
+  /// 父节点身份；目录根层节点为 `nil`。
+  let parentID: NodeID?
+  let createdAt: Date?
+  let updatedAt: Date?
+  /// 服务器叶子的已知阻塞原因（typed，无成句文案）；分组为空。
+  let invalidReasons: [LeafInvalidationReason]
+  /// 直接子节点数（分组）。
+  let childCount: Int
+  /// 子树全部后代节点数（分组；不含自身；删除确认的递归规模）。
+  let subtreeNodeCount: Int
+  /// 子树中已知无效的服务器数量（不含当前叶子自身；仅供 tooltip 展示）。
+  let invalidDescendantCount: Int
+  /// 分组持有子树快照；服务器叶子为 `nil`。
+  let children: [CatalogTreeNode]?
+
+  var isInvalid: Bool { !invalidReasons.isEmpty }
+  var isManual: Bool { source == .manual }
+  /// 子树快照；服务器叶子为空（与 `children` 的 nil 区分叶子语义并存）。
+  var childNodes: [CatalogTreeNode] { children ?? [] }
+
+  /// 子树服务器配置数，包含存在已知激活阻塞的服务器。
+  var serverConfigurationCount: Int {
+    isGroup ? childNodes.reduce(0) { $0 + $1.serverConfigurationCount } : 1
+  }
+
+  /// 是否包含服务器配置（含当前节点本身）；激活资格与结构性可导出性分离。
+  var containsServerConfiguration: Bool {
+    if !isGroup { return true }
+    return childNodes.contains(where: \.containsServerConfiguration)
+  }
+}
+
+extension CatalogTreeNode {
+  /// 深度优先查找子树中的节点（含自身）。
+  func find(_ id: NodeID) -> CatalogTreeNode? {
+    if id == self.id { return self }
+    for child in children ?? [] {
+      if let found = child.find(id) { return found }
+    }
+    return nil
+  }
+
+  /// 子树全部节点身份（含自身）。
+  var subtreeIDs: Set<NodeID> {
+    var ids: Set<NodeID> = [id]
+    for child in children ?? [] { ids.formUnion(child.subtreeIDs) }
+    return ids
+  }
+
+  /// 子树内已知无效服务器总数（含自身叶子）。
+  var subtreeInvalidServerCount: Int {
+    (isInvalid ? 1 : 0) + invalidDescendantCount
+  }
+}
+
+/// 侧栏树的可见行投影：节点 + 呈现深度；身份即节点身份（折叠只影响可见
+/// 集合，不影响行身份与选中）。服务器管理侧栏与首页目标树共用同一类型，
+/// 折叠集合由各自的浏览状态 owner 给出。
+struct CatalogTreeRow: Identifiable {
+  let node: CatalogTreeNode
+  let depth: Int
+  var id: NodeID { node.id }
+}
+
+/// 目录树快照：侧栏、活动目标级联、移动目的地与删除确认共用的同一份
+/// 非敏感 projection；UI 不再持有原始目录副本。
+struct CatalogTreeSnapshot: Equatable {
+  let roots: [CatalogTreeNode]
+
+  var isEmpty: Bool { roots.isEmpty }
+
+  /// 深度优先查找节点（含子树）。
+  func node(withID id: NodeID) -> CatalogTreeNode? {
+    for node in roots {
+      if let found = node.find(id) { return found }
+    }
+    return nil
+  }
+
+  /// 节点是否在树中（拖拽负载存在性校验）。
+  func containsNode(_ id: NodeID) -> Bool { node(withID: id) != nil }
+
+  /// 活动目标的显示名路径（根 → 节点，" / " 连接）；目标不在树中为 nil。
+  /// 代理控制窄缝经此取安全路径摘要，树结构不出目录 module。
+  func pathSummary(for id: NodeID) -> String? {
+    pathComponents(for: id)?.joined(separator: " / ")
+  }
+
+  /// 节点的名称路径；分隔符与来源标签由呈现层决定。
+  func pathComponents(for id: NodeID) -> [String]? {
+    guard var node = self.node(withID: id) else { return nil }
+    var names = [node.name]
+    while let parentID = node.parentID, let parent = self.node(withID: parentID) {
+      names.insert(parent.name, at: 0)
+      node = parent
+    }
+    return names
+  }
+
+  /// 节点的严格祖先身份（根 → 父，不含自身）。行级"子树含活动目标"标记经
+  /// `ancestors(of: activeTargetID)` 推导；目标为空或不在树中时为空集合。
+  func ancestors(of id: NodeID?) -> Set<NodeID> {
+    guard let id, var current = node(withID: id) else { return [] }
+    var ancestors = Set<NodeID>()
+    while let parentID = current.parentID, let parent = node(withID: parentID) {
+      ancestors.insert(parentID)
+      current = parent
+    }
+    return ancestors
+  }
+
+  /// 全树已知无效服务器总数（诊断计数）。
+  var invalidServerCount: Int {
+    roots.reduce(0) { $0 + $1.subtreeInvalidServerCount }
+  }
+}
+
+extension CatalogTreeSnapshot {
+  /// 折叠投影后的可见行（深度优先）：收起分组的子树不出现，其余保持目录
+  /// 序。行序与深度是纯树事实；折叠集合由调用方按自己的持久化策略持有。
+  func visibleRows(source: NodeSource? = nil, collapsed: Set<NodeID>) -> [CatalogTreeRow] {
+    var rows: [CatalogTreeRow] = []
+    func walk(_ nodes: [CatalogTreeNode], depth: Int) {
+      for node in nodes {
+        rows.append(CatalogTreeRow(node: node, depth: depth))
+        if node.isGroup, !collapsed.contains(node.id) {
+          walk(node.childNodes, depth: depth + 1)
+        }
+      }
+    }
+    // 来源不跨越子树，根层筛选保留完整层级与目录顺序。
+    walk(source.map { source in roots.filter { $0.source == source } } ?? roots, depth: 0)
+    return rows
+  }
+
+  /// 全树服务器叶子数（工作区侧栏角标）。
+  var serverLeafCount: Int {
+    func leaves(_ nodes: [CatalogTreeNode]) -> Int {
+      nodes.reduce(0) { $0 + ($1.isGroup ? leaves($1.childNodes) : 1) }
+    }
+    return leaves(roots)
+  }
+}
+
+extension CatalogTreeSnapshot {
+  /// 从已提交目录构建 projection（module 内部推导；测试同 target 可直接调用）。
+  /// 每个服务器叶子求值一次激活校验（与运行时口径一致）。
+  static func build(
+    from catalog: ConfigurationCatalog,
+    plugins: PluginExecutableResolving
+  ) -> CatalogTreeSnapshot {
+    let plugins = plugins.catalogSnapshot()
+    func buildNode(_ id: NodeID, entry: CatalogEntry, parentID: NodeID?) -> CatalogTreeNode {
+      switch entry.kind {
+      case .group(let fields):
+        let children = fields.children.compactMap { childID -> CatalogTreeNode? in
+          guard let childEntry = catalog.entry(for: childID) else { return nil }
+          return buildNode(childID, entry: childEntry, parentID: id)
+        }
+        return CatalogTreeNode(
+          id: id,
+          name: entry.displayName,
+          isGroup: true,
+          source: entry.source,
+          parentID: parentID,
+          createdAt: entry.createdAt,
+          updatedAt: entry.updatedAt,
+          invalidReasons: [],
+          childCount: children.count,
+          subtreeNodeCount: children.reduce(0) { $0 + 1 + $1.subtreeNodeCount },
+          invalidDescendantCount: children.reduce(0) { $0 + $1.subtreeInvalidServerCount },
+          children: children)
+      case .server(let fields):
+        return CatalogTreeNode(
+          id: id,
+          name: entry.displayName,
+          isGroup: false,
+          source: entry.source,
+          parentID: parentID,
+          createdAt: entry.createdAt,
+          updatedAt: entry.updatedAt,
+          invalidReasons: LeafPreparation.invalidReasons(
+            fields, plugins: plugins),
+          childCount: 0,
+          subtreeNodeCount: 0,
+          invalidDescendantCount: 0,
+          children: nil)
+      }
+    }
+    let roots = catalog.rootChildren.compactMap { id -> CatalogTreeNode? in
+      guard let entry = catalog.entry(for: id) else { return nil }
+      return buildNode(id, entry: entry, parentID: nil)
+    }
+    return CatalogTreeSnapshot(roots: roots)
+  }
+}
+
+// MARK: - 目录政策事实（UI 写句子；本 module 不产成句文案）
+
+/// 删除确认档位（GLOSSARY.md 删除不变量的结构化事实）。
+enum DeleteConfirmKind: Equatable, Sendable {
+  /// 服务器叶子：单次确认。
+  case leaf
+  /// 空手动分组：单次确认。
+  case emptyGroup
+  /// 非空手动分组：二次确认，点名子树规模与凭据移除。
+  case subtree(count: Int, includesCredentials: Bool)
+}
+
+/// 激活资格事实（点前门禁；与 `ActivationCommandOutcome` 的点后结果区分）。
+struct ActivationEligibility: Equatable, Sendable {
+  enum Ineligibility: Equatable, Sendable {
+    case emptyGroup
+    case noCandidates
+  }
+
+  let canActivate: Bool
+  let candidateCount: Int
+  let skippedInvalidCount: Int
+  let ineligibility: Ineligibility?
+}
+
+/// 激活命令的结构化结果（意外错误仍 throws）。
+enum ActivationCommandOutcome: Equatable, Sendable {
+  /// 成功；组展开时跳过的已知无效叶子数。
+  case activated(skippedInvalid: Int)
+  /// 原子拒绝（无 activation candidate / 目标失效）；携带 typed 点名原因，
+  /// 状态完全不动。结果自含全部事实，调用方不必回读运行时发布事实拼原因。
+  case rejectedActivation(ActivationFailure)
+}
+
+/// 激活缝：目录命令面经此发出激活意图。生产 adapter 为
+/// `ProxyRuntimeController`；测试注入假 adapter 观察目标传递。
+@MainActor
+protocol Activating: AnyObject {
+  func activate(_ target: NodeID) async throws -> ActivationCommandOutcome
+}
+
+// MARK: - 服务器详情与编辑
+
+/// 服务器编辑面状态：用户打开编辑器时经显式命令解析，凭据明文只在此出现，
+/// 不属于普通 projection。
+struct ServerEditForm: Equatable {
+  let address: String
+  let port: Int
+  let encryptionMethod: String
+  let password: String
+  let remark: String
+  let plugin: PluginSectionState
+  let isEditable: Bool
+}
+
+/// 服务器编辑的提交载荷（typed command）：配置与凭据字段作为一个逻辑变更
+/// 提交；任一持久化步骤失败时旧配置与旧凭据继续生效。
+struct ServerEditDraft: Equatable {
+  var address: String
+  var port: Int
+  var encryptionMethod: String
+  var password: String
+  var remark: String
+  var plugin: PluginSelection
+  var pluginOptions: String?
+}
+
+/// 插件选择器选中态：无、目录中的名称引用、未解析的导入引用。
+/// 托管或用户来源由有效目录解释，不参与选中值身份。
+/// Hashable 以直接充当 SwiftUI Picker 的选中值。
+enum PluginSelection: Hashable {
+  case none
+  case named(program: String)
+  case unknown(program: String)
+}
+
+/// 表单所需的目录事实，不包含本机路径或托管发布信息。
+struct PluginSectionState: Equatable {
+  struct Program: Equatable {
+    let program: String
+    let source: PluginCatalogSnapshot.Source
+    let availability: PluginCatalogSnapshot.Availability
+  }
+
+  let selection: PluginSelection
+  let programs: [Program]
+  let mappingsUnreadable: Bool
+  let optionsPresent: Bool
+  var options: String
+
+  /// 当前草稿引用可能与已保存选择不同，目录移除不能让它从表单消失。
+  func unresolvedProgram(for selection: PluginSelection) -> String? {
+    switch selection {
+    case .none: return nil
+    case .named(let program), .unknown(let program):
+      return programs.contains { $0.program == program } ? nil : program
+    }
+  }
+}
+
+// MARK: - 订阅 projection
+
+/// 订阅卡片 projection（非敏感）：完整 URL 不出现，只含 host；
+/// 状态为结构化值，本地化文案与日期格式由 UI 呈现层派生。
+struct SubscriptionSummary: Identifiable, Equatable {
+  let id: NodeID
+  let groupID: NodeID
+  let name: String
+  let host: String
+  let status: SubscriptionRefreshStatus
+  let serverCount: Int
+  var information: SubscriptionInformation?
+  var lastSucceededAt: Date?
+  var autoUpdate = SubscriptionAutoUpdate()
+}
+
+/// 非持久化的刷新回执。每次操作有独立身份，失败事实不含秘密值。
+struct SubscriptionRefreshCompletion: Identifiable, Equatable {
+  let id: UUID
+  let completedAt: Date
+  let failure: SubscriptionRefreshFailure?
+
+  init(id: UUID = UUID(), completedAt: Date = Date(), failure: SubscriptionRefreshFailure? = nil) {
+    self.id = id
+    self.completedAt = completedAt
+    self.failure = failure
+  }
+}
+
+extension SubscriptionRefreshFailure {
+  /// Single workflow conversion point from transient refresh errors to durable
+  /// safe facts. Presentation is intentionally not involved here.
+  static func from(error: Error) -> Self {
+    switch error {
+    case let error as SubscriptionFetchError:
+      return from(fetchError: error)
+    case let error as SubscriptionParseError:
+      return from(parseError: error)
+    case let error as SubscriptionFormError:
+      if case .invalidURL = error { return .invalidURL }
+      return .unknown
+    case let error as SubscriptionRefreshFailure:
+      return error
+    default:
+      return .unknown
+    }
+  }
+}
+
+/// 删除结果：被删节点身份集合。UI 据此清除失效选择（selection invalidation，
+/// 不自动改选相邻节点，活动目标语义不受影响。
+struct RemovalOutcome: Equatable, Sendable {
+  let removedNodeIDs: Set<NodeID>
+}
+
+// MARK: - 表单级 typed error（本地化由 UI 呈现层负责）
+
+/// 表单级校验失败（地址/端口/名称）；领域拒绝仍以 `CatalogError` 上抛。
+enum ServerFormError: Error, Equatable {
+  case invalidAddress
+  case invalidPort
+  case missingEncryptionMethod
+  case unsupportedEncryptionMethod(String)
+  case invalidPassword
+  case emptyName
+  /// 提交了有效目录之外的插件选择；拒绝陈旧或未知的表单选择。
+  case pluginUnknown(String)
+}
+
+/// 订阅表单级失败（URL 门禁、订阅不存在）；获取/解析失败仍以原错误上抛。
+enum SubscriptionFormError: Error, Equatable {
+  case invalidURL
+  case notFound
+}
+
+/// Safe load failure facts; no credential reference or underlying error detail escapes.
+enum ServerFormLoadError: Error, Equatable {
+  case credentialsUnavailable
+  case notFound
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowPresentationModels.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowPresentationModels.swift
new file mode 100644
index 000000000..b35f928a7
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogWorkflowPresentationModels.swift
@@ -0,0 +1,23 @@
+import Foundation
+
+/// Non-secret facts for rendering; options is always empty in this projection.
+struct ServerFormPresentation: Equatable {
+  let isEditable: Bool
+  let plugin: PluginSectionState
+
+  init(isEditable: Bool, plugin: PluginSectionState) {
+    self.isEditable = isEditable
+    var facts = plugin
+    facts.options = ""
+    self.plugin = facts
+  }
+}
+
+/// 详情的已保存展示事实，参数明文通过独立读取 interface 装载。
+struct ServerDetailPresentation {
+  let name: String
+  let address: String
+  let port: Int
+  let encryptionMethod: String
+  let plugin: PluginSectionState
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/PluginManagementModel.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/PluginManagementModel.swift
new file mode 100644
index 000000000..3dc44591d
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/PluginManagementModel.swift
@@ -0,0 +1,159 @@
+import Combine
+import Foundation
+
+struct PluginEditorSession: Identifiable {
+  let id = UUID()
+  let recordID: UUID?
+  let managedProgram: String?
+  let isEditing: Bool
+  let initialNames: [String]
+  let initialPath: String
+  let initialArguments: [String]
+  var initialMode: PluginTransportMode = .tcpOnly
+}
+
+struct PluginManagementRow: Identifiable {
+  let id: String
+  let recordID: UUID?
+  let managedProgram: String?
+  let names: [String]
+  let overriddenNames: [String]
+  let path: String?
+  let availability: PluginCatalogSnapshot.Availability?
+  let securityProgram: String?
+  let overridesManaged: Bool
+}
+
+@MainActor
+final class PluginManagementModel: ObservableObject {
+  let catalog: PluginCatalog
+  @Published private(set) var snapshot: PluginCatalogSnapshot
+  private var subscription: AnyCancellable?
+
+  init(catalog: PluginCatalog) {
+    self.catalog = catalog
+    snapshot = catalog.catalogSnapshot()
+    subscription = catalog.didCommit.sink { [weak self] _ in
+      MainActor.assumeIsolated {
+        guard let self else { return }
+        self.snapshot = self.catalog.catalogSnapshot()
+      }
+    }
+  }
+
+  var rows: [PluginManagementRow] {
+    let managed = ManagedPluginCatalog.plugins.map { info in
+      let effective = snapshot.managedRecords[info.program]
+      return PluginManagementRow(
+        id: "managed:" + info.program, recordID: nil, managedProgram: info.program,
+        names: info.names,
+        overriddenNames: info.names.filter { snapshot.entry(for: $0)?.source == .user },
+        path: effective?.path, availability: effective?.availability, securityProgram: nil,
+        overridesManaged: false)
+    }
+    let user = catalog.userRecords.map { record in
+      let entry = record.names.first.flatMap { snapshot.entry(for: $0) }
+      return PluginManagementRow(
+        id: record.id.uuidString, recordID: record.id, managedProgram: nil,
+        names: record.names, overriddenNames: [], path: record.path,
+        availability: entry?.availability, securityProgram: record.names.first,
+        overridesManaged: record.names.contains { ManagedPluginCatalog.info(forProgram: $0) != nil }
+      )
+    }
+    return managed + user
+  }
+
+  func beginAdding() -> PluginEditorSession {
+    PluginEditorSession(
+      recordID: UUID(), managedProgram: nil, isEditing: false,
+      initialNames: [""], initialPath: "", initialArguments: [])
+  }
+
+  func beginEditing(_ id: UUID) -> PluginEditorSession? {
+    guard !snapshot.mappingsUnreadable,
+      let record = catalog.userRecords.first(where: { $0.id == id })
+    else { return nil }
+    return PluginEditorSession(
+      recordID: id, managedProgram: nil, isEditing: true,
+      initialNames: record.names, initialPath: record.path, initialArguments: record.arguments,
+      initialMode: record.mode)
+  }
+
+  func beginOverriding(_ program: String) -> PluginEditorSession? {
+    guard !snapshot.mappingsUnreadable, snapshot.entry(for: program)?.source == .managed else {
+      return nil
+    }
+    return PluginEditorSession(
+      recordID: UUID(), managedProgram: nil, isEditing: false,
+      initialNames: [program], initialPath: "", initialArguments: [])
+  }
+
+  func beginManagedSettings(_ program: String) -> PluginEditorSession? {
+    guard !snapshot.mappingsUnreadable,
+      let info = ManagedPluginCatalog.plugins.first(where: { $0.program == program })
+    else { return nil }
+    return PluginEditorSession(
+      recordID: nil, managedProgram: program, isEditing: true,
+      initialNames: info.names, initialPath: "",
+      initialArguments: snapshot.managedArguments[program] ?? [],
+      initialMode: snapshot.managedRecords[program]?.mode ?? .tcpOnly)
+  }
+
+  func namesIssue(_ names: [String], session: PluginEditorSession) -> PluginMappingError? {
+    let names = names.map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+    if names.isEmpty || names.contains(where: { $0.isEmpty || $0.contains("\0") }) {
+      return .invalidName
+    }
+    if Set(names).count != names.count { return .nameExists }
+    let occupied = Set(catalog.userRecords.filter { $0.id != session.recordID }.flatMap(\.names))
+    return names.contains(where: { occupied.contains($0) }) ? .nameExists : nil
+  }
+
+  func pathIssue(_ path: String) -> PluginMappingError? {
+    path.hasPrefix("/") && !path.contains("\0") ? nil : .invalidPath
+  }
+
+  func save(
+    _ session: PluginEditorSession, names: [String], path: String, arguments: [String] = [],
+    mode: PluginTransportMode = .tcpOnly
+  )
+    throws
+  {
+    if let program = session.managedProgram {
+      try catalog.commit([
+        .managedArguments(program: program, arguments: arguments),
+        .managedMode(program: program, mode: mode),
+      ])
+    } else {
+      if let issue = namesIssue(names, session: session) { throw issue }
+      if let issue = pathIssue(path) { throw issue }
+      guard let id = session.recordID,
+        !session.isEditing || catalog.userRecords.contains(where: { $0.id == id })
+      else { throw PluginMappingError.nameMissing }
+      try catalog.commit([
+        .save(UserPluginRecord(id: id, names: names, path: path, arguments: arguments, mode: mode))
+      ])
+    }
+    refresh()
+  }
+
+  func remove(_ id: UUID) throws {
+    try catalog.commit([.remove(id)])
+    refresh()
+  }
+
+  func clearManagedArguments(_ program: String) throws {
+    try catalog.commit([.managedArguments(program: program, arguments: [])])
+    refresh()
+  }
+
+  func retryReading() throws {
+    try catalog.retryReadingMappings()
+    refresh()
+  }
+
+  func refresh() {
+    snapshot = catalog.catalogSnapshot()
+    catalog.refreshSecurityFacts()
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/PluginOptionsDraft.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/PluginOptionsDraft.swift
new file mode 100644
index 000000000..594c27f69
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/PluginOptionsDraft.swift
@@ -0,0 +1,308 @@
+import Combine
+import Foundation
+
+/// 插件参数会话草稿（见 GLOSSARY.md「Plugin parameter draft」）：
+/// 带稳定行身份的有序参数行 + 原始文本双模式。解析与拼装遵循受管
+/// v2ray-plugin 的 SIP003 转义语义（未转义 `;` 分隔项目、第一个
+/// 未转义 `=` 分隔参数名与值、反斜杠转义后续字符）；原始参数字符串仍是
+/// 持久化、凭据与运行时边界的唯一载荷，本模块状态不进入配置目录。
+@MainActor
+final class PluginOptionsDraft: ObservableObject {
+  enum Mode: Hashable {
+    case table
+    case rawText
+  }
+
+  /// 行的值形态：无等号的无值开关与带等号的键值（含空串值）。
+  enum Kind: Hashable {
+    case keyValue
+    case flag
+  }
+
+  /// 一行参数草稿：`original` 持有装载时的解析结果与原文片段，未修改的行
+  /// 拼装时逐字回写。
+  struct Row: Identifiable {
+    let id: UUID
+    var keyText: String
+    var valueText: String
+    var kind: Kind
+    let original: ParsedItem?
+
+    /// 完全空白的快速添加占位行：不计入参数项、不触发变更、不序列化。
+    var isBlank: Bool {
+      kind == .keyValue && keyText.isEmpty && valueText.isEmpty
+    }
+
+    /// 有值或开关形态却没有参数名的未完成草稿：阻止拼装与模式切换。
+    var isUnfinished: Bool {
+      keyText.isEmpty && !isBlank
+    }
+
+    /// 与装载解析结果逐字一致（编辑后改回也算），拼装时回写原文片段。
+    var isUnmodified: Bool {
+      guard let original else { return false }
+      guard keyText == original.key else { return false }
+      switch kind {
+      case .flag: return !original.hasValue
+      case .keyValue: return original.hasValue && valueText == original.value
+      }
+    }
+  }
+
+  struct ParsedItem {
+    let key: String
+    let hasValue: Bool
+    let value: String
+    let slice: String
+  }
+
+  struct ParseOutcome {
+    let items: [ParsedItem]
+    let trailingSeparator: Bool
+  }
+
+  @Published private(set) var mode: Mode = .table
+  @Published private(set) var rows: [Row] = [PluginOptionsDraft.blankRow()]
+  @Published var rawText = ""
+  @Published private(set) var hadTrailingSeparator = false
+  private var structureChanged = false
+
+  // MARK: - 装载与会话串
+
+  /// 装载（或重置）：按可解析性决定初始模式，行、原文与结构标记全部重建。
+  func load(_ raw: String) {
+    if let outcome = Self.parse(raw) {
+      mode = .table
+      rows = outcome.items.map(Self.row(from:)) + [Self.blankRow()]
+      hadTrailingSeparator = outcome.trailingSeparator
+    } else {
+      mode = .rawText
+      rows = [Self.blankRow()]
+      hadTrailingSeparator = false
+    }
+    rawText = raw
+    structureChanged = false
+  }
+
+  /// 当前会话的参数字符串：原始文本模式即其文本，列表模式拼装各行（未修改
+  /// 行逐字回写）。存在未完成行（有值或开关形态却无参数名）时为 nil。
+  var composedString: String? {
+    switch mode {
+    case .rawText: return rawText
+    case .table: return assembledFromRows()
+    }
+  }
+
+  var hasUnfinishedRows: Bool {
+    mode == .table && rows.contains { $0.isUnfinished }
+  }
+
+  // MARK: - 模式切换
+
+  /// 切到原始文本：先验证并拼装当前行草稿；有未完成行则留在列表模式。
+  @discardableResult
+  func switchToRawText() -> Bool {
+    guard mode == .table else { return true }
+    guard let assembled = assembledFromRows() else { return false }
+    rawText = assembled
+    mode = .rawText
+    return true
+  }
+
+  /// 切回参数列表：重新解析当前原始文本；不可可靠解析则留在原始模式并
+  /// 保留原文，不丢弃草稿。
+  @discardableResult
+  func switchToTable() -> Bool {
+    guard mode == .rawText else { return true }
+    guard let outcome = Self.parse(rawText) else { return false }
+    rows = outcome.items.map(Self.row(from:)) + [Self.blankRow()]
+    hadTrailingSeparator = outcome.trailingSeparator
+    structureChanged = false
+    mode = .table
+    return true
+  }
+
+  // MARK: - 行编辑
+
+  func updateKey(_ text: String, of id: UUID) {
+    mutateRow(id) { $0.keyText = text }
+  }
+
+  func updateValue(_ text: String, of id: UUID) {
+    mutateRow(id) { $0.valueText = text }
+  }
+
+  /// 键值 ⇄ 无值开关：切到开关不序列化等号；切回键值恢复本会话保留的值
+  /// 草稿（无则空串）。
+  func setKind(_ kind: Kind, of id: UUID) {
+    mutateRow(id) { $0.kind = kind }
+  }
+
+  func deleteRow(_ id: UUID) {
+    rows.removeAll { $0.id == id }
+    structureChanged = true
+    normalize()
+  }
+
+  /// 单行上移/下移一格（评审追加）：只换行序不改行内容——未修改行仍逐字
+  /// 回写原文片段，故移动不算结构修改、既有末尾分号保留。末尾快速添加行
+  /// 不可移动，也不得把行移到它之后；越界目标是无操作。
+  func moveRow(_ id: UUID, by offset: Int) {
+    guard let move = rowMove(id, by: offset) else { return }
+    rows.swapAt(move.source, move.target)
+  }
+
+  /// 按钮与移动动作共用同一判定，视图不再维护空行和目标位置约束。
+  func canMoveRow(_ id: UUID, by offset: Int) -> Bool {
+    rowMove(id, by: offset) != nil
+  }
+
+  private func rowMove(_ id: UUID, by offset: Int) -> (source: Int, target: Int)? {
+    guard mode == .table, offset == -1 || offset == 1 else { return nil }
+    guard let index = rows.firstIndex(where: { $0.id == id }), !rows[index].isBlank else {
+      return nil
+    }
+    var target = index + offset
+    if rows.last?.isBlank ?? false {
+      target = min(target, rows.count - 2)
+    }
+    guard target >= 0, target != index else { return nil }
+    return (index, target)
+  }
+
+  /// 「添加参数」入口语义：末尾空行即快速添加行，返回其身份供聚焦。
+  var quickAddRowID: UUID {
+    rows[rows.count - 1].id
+  }
+
+  // MARK: - 行状态实现
+
+  private func mutateRow(_ id: UUID, _ mutate: (inout Row) -> Void) {
+    guard let index = rows.firstIndex(where: { $0.id == id }) else { return }
+    mutate(&rows[index])
+    normalize()
+  }
+
+  /// 末尾始终保持一条完全空白的快速添加行；在空行开始输入（参数名、值或
+  /// 类型）后该行保持身份获得正式草稿地位（焦点稳定），同时补上新的空行。
+  private func normalize() {
+    if !(rows.last?.isBlank ?? true) {
+      rows.append(Self.blankRow())
+    }
+  }
+
+  private static func blankRow() -> Row {
+    Row(id: UUID(), keyText: "", valueText: "", kind: .keyValue, original: nil)
+  }
+
+  private static func row(from item: ParsedItem) -> Row {
+    Row(
+      id: UUID(),
+      keyText: item.key,
+      valueText: item.hasValue ? item.value : "",
+      kind: item.hasValue ? .keyValue : .flag,
+      original: item)
+  }
+
+  private func assembledFromRows() -> String? {
+    var slices: [String] = []
+    for row in rows where !row.isBlank {
+      guard !row.keyText.isEmpty else { return nil }
+      slices.append(encodedSlice(of: row))
+    }
+    var assembled = slices.joined(separator: ";")
+    // 既有合法的末尾分号等非内容分隔表现，在没有对应结构修改时保留。
+    if hadTrailingSeparator && !structureChanged && !slices.isEmpty {
+      assembled += ";"
+    }
+    return assembled
+  }
+
+  private func encodedSlice(of row: Row) -> String {
+    if row.isUnmodified, let original = row.original {
+      return original.slice
+    }
+    switch row.kind {
+    case .flag:
+      return Self.escaped(row.keyText, escapingEquals: false)
+    case .keyValue:
+      return
+        Self.escaped(row.keyText, escapingEquals: true) + "="
+        + Self.escaped(row.valueText, escapingEquals: false)
+    }
+  }
+}
+
+// MARK: - SIP003 解析与编码（v2ray-plugin args.go 语义）
+
+extension PluginOptionsDraft {
+  /// 解析：未转义 `;` 分隔项目，第一个未转义 `=` 分隔参数名与值，反斜杠
+  /// 转义后续字符；空参数名或结尾悬空转义返回 nil——完整原文走原始文本
+  /// 模式，不强行转换。
+  static func parse(_ raw: String) -> ParseOutcome? {
+    var items: [ParsedItem] = []
+    var trailingSeparator = false
+    var index = raw.startIndex
+
+    while index < raw.endIndex {
+      let itemStart = index
+      var key = ""
+      var value = ""
+      var hasValue = false
+      var terminatedBySeparator = false
+
+      scan: while index < raw.endIndex {
+        let character = raw[index]
+        if character == "\\" {
+          let escapedIndex = raw.index(after: index)
+          guard escapedIndex < raw.endIndex else { return nil }
+          if hasValue {
+            value.append(raw[escapedIndex])
+          } else {
+            key.append(raw[escapedIndex])
+          }
+          index = raw.index(after: escapedIndex)
+          continue
+        }
+        if character == ";" {
+          terminatedBySeparator = true
+          index = raw.index(after: index)
+          break scan
+        }
+        if character == "=" && !hasValue {
+          hasValue = true
+          index = raw.index(after: index)
+          continue
+        }
+        if hasValue {
+          value.append(character)
+        } else {
+          key.append(character)
+        }
+        index = raw.index(after: index)
+      }
+
+      guard !key.isEmpty else { return nil }
+      let itemEnd = terminatedBySeparator ? raw.index(before: index) : index
+      items.append(
+        ParsedItem(
+          key: key, hasValue: hasValue, value: value, slice: String(raw[itemStart..<itemEnd])))
+      trailingSeparator = terminatedBySeparator && index == raw.endIndex
+    }
+
+    return ParseOutcome(items: items, trailingSeparator: trailingSeparator)
+  }
+
+  /// 反向编码：反斜杠、分号（及参数名中的等号）以反斜杠转义，与
+  /// v2ray-plugin 的编码方向一致；其余字符（含换行、Unicode）原样保留。
+  private static func escaped(_ text: String, escapingEquals: Bool) -> String {
+    var result = ""
+    for character in text {
+      if character == "\\" || character == ";" || (escapingEquals && character == "=") {
+        result.append("\\")
+      }
+      result.append(character)
+    }
+    return result
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/CatalogWorkflow/ServerLibraryFailure.swift b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/ServerLibraryFailure.swift
new file mode 100644
index 000000000..fd3e73bb3
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/CatalogWorkflow/ServerLibraryFailure.swift
@@ -0,0 +1,24 @@
+import Foundation
+import Security
+
+/// 仅包含错误类别与系统状态码，不携带服务器资料或路径。
+enum ServerLibraryFailure: Equatable {
+  case authorization(OSStatus)
+  case keyUnavailable
+  case authenticationFailed
+  case unsupportedVersion
+  case malformedFile
+  case storage
+
+  init(_ error: Error) {
+    switch error {
+    case CredentialKeyStoreError.keychainStatus(let status): self = .authorization(status)
+    case ServerLibraryError.keyUnavailable: self = .keyUnavailable
+    case ServerLibraryError.authenticationFailed: self = .authenticationFailed
+    case ServerLibraryError.unsupportedVersion: self = .unsupportedVersion
+    case ServerLibraryError.malformedFile: self = .malformedFile
+    case CatalogFileStore.PersistenceError.corrupt: self = .malformedFile
+    default: self = .storage
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityDoHResolver.swift b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityDoHResolver.swift
new file mode 100644
index 000000000..9f442223f
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityDoHResolver.swift
@@ -0,0 +1,174 @@
+import Darwin
+import Foundation
+import Network
+
+/// HTTPS is confined to preparation. An ephemeral, proxy-required session has
+/// no shared connection/cache state, redirects, cookies or direct fallback.
+private struct ConnectivityDoHAnswer: Decodable {
+  let type: Int
+  let data: String
+}
+
+private struct ConnectivityDoHResponse: Decodable {
+  let status: Int
+  let answers: [ConnectivityDoHAnswer]?
+
+  enum CodingKeys: String, CodingKey {
+    case status = "Status"
+    case answers = "Answer"
+  }
+}
+
+struct ConnectivityDoHResolver: Sendable {
+  var sessionConfiguration: @Sendable () -> URLSessionConfiguration = {
+    let configuration = URLSessionConfiguration.ephemeral
+    configuration.timeoutIntervalForRequest = 3
+    configuration.timeoutIntervalForResource = 3
+    return configuration
+  }
+  var waitForDeadline: @Sendable (ContinuousClock.Instant) async -> Void = { deadline in
+    try? await ContinuousClock().sleep(until: deadline)
+  }
+
+  struct Resolution: Sendable {
+    var addresses: [String] = []
+    var trace: [ConnectivityTrace] = []
+  }
+  enum Failure: Error { case invalidResponse, deadline }
+
+  func resolve(host: String, proxyPort: Int, deadline: ContinuousClock.Instant) async -> Resolution
+  {
+    var resolution = Resolution()
+    let providers: [(ConnectivityTrace.Phase, String)] = [
+      (.google, "https://dns.google/resolve"),
+      (.cloudflare, "https://cloudflare-dns.com/dns-query"),
+    ]
+    for (phase, endpoint) in providers {
+      if Task.isCancelled || ContinuousClock.now >= deadline { break }
+      let started = ContinuousClock.now
+      let providerDeadline = min(deadline, started.advanced(by: .seconds(3)))
+      do {
+        resolution.addresses = try await query(
+          host: host, endpoint: endpoint, proxyPort: proxyPort, deadline: providerDeadline)
+        resolution.trace.append(
+          ConnectivityTrace(
+            phase: phase, status: .success, milliseconds: elapsed(since: started)))
+        return resolution
+      } catch {
+        let status: ConnectivityTrace.Status =
+          Task.isCancelled
+          ? .cancelled : ContinuousClock.now >= providerDeadline ? .timeout : .network
+        resolution.trace.append(
+          ConnectivityTrace(
+            phase: phase, status: status, milliseconds: elapsed(since: started), failureStage: .dns)
+        )
+      }
+    }
+    return resolution
+  }
+
+  /// Both address families share the provider deadline. A failed family does
+  /// not discard usable answers from the other family.
+  func query(
+    host: String, endpoint: String, proxyPort: Int, deadline: ContinuousClock.Instant
+  ) async throws -> [String] {
+    guard let port = NWEndpoint.Port(rawValue: UInt16(exactly: proxyPort) ?? 0), proxyPort > 0
+    else {
+      throw Failure.invalidResponse
+    }
+    let configuration = sessionConfiguration()
+    var proxy = ProxyConfiguration(httpCONNECTProxy: .hostPort(host: .ipv4(.loopback), port: port))
+    proxy.allowFailover = false
+    proxy.excludedDomains = []
+    configuration.proxyConfigurations = [proxy]
+    configuration.urlCache = nil
+    configuration.httpCookieStorage = nil
+    configuration.urlCredentialStorage = nil
+    configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
+    let session = URLSession(
+      configuration: configuration, delegate: NoRedirects(), delegateQueue: nil)
+    defer { session.invalidateAndCancel() }
+    let addresses = await withTaskGroup(of: [String]?.self) { group in
+      for type in [1, 28] {
+        group.addTask {
+          await answers(host: host, endpoint: endpoint, type: type, session: session)
+        }
+      }
+      group.addTask {
+        await waitForDeadline(deadline)
+        return nil
+      }
+      defer { group.cancelAll() }
+      return await Self.collectAddresses(from: group)
+    }
+    guard !addresses.isEmpty else { throw Failure.invalidResponse }
+    // Stable family order makes equal-time candidate ties reproducible.
+    return addresses.filter { ConnectivityAddress.family($0) == AF_INET }
+      + addresses.filter { ConnectivityAddress.family($0) == AF_INET6 }
+  }
+
+  /// A nil event is the shared deadline; keep families received before it.
+  static func collectAddresses<Results: AsyncSequence>(from results: Results) async rethrows
+    -> [String] where Results.Element == [String]?
+  {
+    var found: [String] = []
+    var families = 0
+    for try await family in results {
+      guard let family else { break }
+      found += family
+      families += 1
+      if families == 2 { break }
+    }
+    return found
+  }
+
+  private func answers(host: String, endpoint: String, type: Int, session: URLSession) async
+    -> [String]
+  {
+    guard var url = URLComponents(string: endpoint), url.scheme == "https" else { return [] }
+    url.queryItems = [
+      URLQueryItem(name: "name", value: host), URLQueryItem(name: "type", value: "\(type)"),
+    ]
+    guard let url = url.url else { return [] }
+    var request = URLRequest(url: url)
+    request.setValue("application/dns-json", forHTTPHeaderField: "Accept")
+    request.setValue("no-cache", forHTTPHeaderField: "Cache-Control")
+    do {
+      let (bytes, response) = try await session.bytes(for: request)
+      guard let response = response as? HTTPURLResponse, response.statusCode == 200 else {
+        return []
+      }
+      var data = Data()
+      for try await byte in bytes {
+        guard data.count < 65536 else { return [] }
+        data.append(byte)
+      }
+      return try Self.addresses(from: data, type: type)
+    } catch {
+      return []
+    }
+  }
+
+  static func addresses(from data: Data, type: Int) throws -> [String] {
+    let answer = try JSONDecoder().decode(ConnectivityDoHResponse.self, from: data)
+    guard answer.status == 0 else { return [] }
+    return (answer.answers ?? []).filter {
+      $0.type == type && ConnectivityAddress.family($0.data) == (type == 1 ? AF_INET : AF_INET6)
+    }.map(\.data)
+  }
+
+  private func elapsed(since started: ContinuousClock.Instant) -> Double {
+    let parts = started.duration(to: .now).components
+    return Double(parts.seconds) * 1000 + Double(parts.attoseconds) / 1e15
+  }
+
+  private final class NoRedirects: NSObject, URLSessionTaskDelegate {
+    func urlSession(
+      _ session: URLSession, task: URLSessionTask,
+      willPerformHTTPRedirection response: HTTPURLResponse, newRequest request: URLRequest,
+      completionHandler: @escaping @Sendable (URLRequest?) -> Void
+    ) {
+      completionHandler(nil)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityHTTPRequest.swift b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityHTTPRequest.swift
new file mode 100644
index 000000000..b97fb0dbb
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityHTTPRequest.swift
@@ -0,0 +1,96 @@
+import Darwin
+import Foundation
+
+struct ConnectivityHTTPObservation: Sendable {
+  var outcome: ServerConnectivity.Outcome = .network
+  var totalMilliseconds: Double = 0
+  var localTCPMilliseconds: Double?
+  var sendMilliseconds: Double?
+  var firstByteMilliseconds: Double?
+  var headersMilliseconds: Double?
+  var failureStage = "request"
+}
+
+/// One fresh loopback socket per request. Only client-observable phases are
+/// exposed; proxy-side DNS, transport handshakes and remote TCP remain combined.
+struct ConnectivityHTTPRequest: Sendable {
+  func perform(url: URL, proxyPort: Int) async -> ServerConnectivity.Outcome {
+    await observe(url: url, targetIP: nil, proxyPort: proxyPort, timeout: 5).outcome
+  }
+
+  func observe(
+    url: URL, targetIP: String?, proxyPort: Int, timeout: Double
+  ) async -> ConnectivityHTTPObservation {
+    guard let request = Self.request(url: url, targetIP: targetIP) else {
+      return ConnectivityHTTPObservation(outcome: .configuration)
+    }
+    let cancellation = Cancellation()
+    return await withTaskCancellationHandler {
+      if Task.isCancelled { return ConnectivityHTTPObservation() }
+      return await Task.detached(priority: .utility) {
+        let result = request.withCString {
+          ConnectivityHTTPProbe(
+            $0, Int32(clamping: proxyPort), Int32(max(0, min(timeout * 1000, 5000))),
+            cancellation.pointer)
+        }
+        let outcome: ServerConnectivity.Outcome
+        if result.timed_out != 0 {
+          outcome = .requestTimeout
+        } else if result.received_headers == 0 {
+          outcome = .network
+        } else if (200..<300).contains(result.status) {
+          outcome = .success(milliseconds: Int(result.milliseconds.rounded()))
+        } else {
+          outcome = .http(Int(result.status))
+        }
+        let stages = ["request", "local_tcp", "send", "first_byte", "headers", "complete"]
+        return ConnectivityHTTPObservation(
+          outcome: outcome, totalMilliseconds: result.milliseconds,
+          localTCPMilliseconds: result.local_tcp_ms >= 0 ? result.local_tcp_ms : nil,
+          sendMilliseconds: result.send_ms >= 0 ? result.send_ms : nil,
+          firstByteMilliseconds: result.first_byte_ms >= 0 ? result.first_byte_ms : nil,
+          headersMilliseconds: result.headers_ms >= 0 ? result.headers_ms : nil,
+          failureStage: stages[min(max(Int(result.stage), 0), 5)])
+      }.value
+    } onCancel: {
+      cancellation.cancel()
+    }
+  }
+
+  private static func request(url: URL, targetIP: String?) -> String? {
+    guard ServerConnectivity.validURL(url.absoluteString) != nil,
+      var components = URLComponents(url: url, resolvingAgainstBaseURL: false),
+      let host = components.host, components.user == nil, components.password == nil
+    else { return nil }
+    let originalHost = host.contains(":") && !host.hasPrefix("[") ? "[\(host)]" : host
+    let authority = originalHost + (components.port.map { ":\($0)" } ?? "")
+    if let targetIP {
+      guard ConnectivityAddress.family(targetIP) != nil else { return nil }
+      components.host = targetIP.contains(":") ? "[\(targetIP)]" : targetIP
+    }
+    if components.percentEncodedPath.isEmpty { components.percentEncodedPath = "/" }
+    guard let target = components.string,
+      !target.contains("\r"), !target.contains("\n"), !authority.contains("\r"),
+      !authority.contains("\n")
+    else { return nil }
+    return "GET \(target) HTTP/1.1\r\nHost: \(authority)\r\nConnection: close\r\n\r\n"
+  }
+
+  private final class Cancellation: @unchecked Sendable {
+    let pointer = ConnectivityHTTPCreateCancellation()
+    func cancel() { ConnectivityHTTPCancel(pointer) }
+    deinit { ConnectivityHTTPDestroyCancellation(pointer) }
+  }
+}
+
+/// Accept only address literals returned in matching DNS record types. No
+/// hostnames, scoped interfaces or URL syntax can enter a pinned request.
+enum ConnectivityAddress {
+  static func family(_ value: String) -> Int32? {
+    var ipv4 = in_addr()
+    if inet_pton(AF_INET, value, &ipv4) == 1 { return AF_INET }
+    var ipv6 = in6_addr()
+    if inet_pton(AF_INET6, value, &ipv6) == 1 { return AF_INET6 }
+    return nil
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityHTTPTransport.c b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityHTTPTransport.c
new file mode 100644
index 000000000..8733bcdac
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityHTTPTransport.c
@@ -0,0 +1,158 @@
+#include "ConnectivityHTTPTransport.h"
+#include <arpa/inet.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <stdatomic.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <time.h>
+#include <unistd.h>
+
+struct ConnectivityHTTPCancellation { atomic_bool cancelled; };
+
+uint64_t ConnectivityHTTPNow(void) {
+  struct timespec time;
+  clock_gettime(CLOCK_MONOTONIC, &time);
+  return (uint64_t)time.tv_sec * 1000000000ULL + (uint64_t)time.tv_nsec;
+}
+ConnectivityHTTPCancellation *ConnectivityHTTPCreateCancellation(void) {
+  ConnectivityHTTPCancellation *token = malloc(sizeof(*token));
+  if (token) atomic_init(&token->cancelled, 0);
+  return token;
+}
+void ConnectivityHTTPCancel(ConnectivityHTTPCancellation *token) {
+  if (token) atomic_store(&token->cancelled, 1);
+}
+void ConnectivityHTTPDestroyCancellation(ConnectivityHTTPCancellation *token) { free(token); }
+
+static double milliseconds(uint64_t end, uint64_t start) {
+  return (double)(end - start) / 1000000.0;
+}
+
+/* Every wait shares one monotonic deadline. Cancellation is checked at most
+   25 ms apart, including peers that accept but never read or send anything. */
+static int ready(int fd, short events, uint64_t deadline, ConnectivityHTTPCancellation *token) {
+  while (!atomic_load(&token->cancelled)) {
+    uint64_t now = ConnectivityHTTPNow();
+    if (now >= deadline) return 0;
+    uint64_t remaining = (deadline - now + 999999ULL) / 1000000ULL;
+    int timeout = remaining > 25 ? 25 : (int)remaining;
+    struct pollfd descriptor = { .fd = fd, .events = events };
+    int result = poll(&descriptor, 1, timeout);
+    if (result > 0) return 1; /* recv / SO_ERROR also handle HUP and ERR. */
+    if (result < 0 && errno != EINTR) return 0;
+  }
+  return 0;
+}
+
+/* Only HTTP/1.x final headers are accepted. The cumulative header budget also
+   bounds arbitrarily many informational responses; bodies are never awaited. */
+static int response_status(const char *bytes, size_t length) {
+  if (length < 16 ||
+      (memcmp(bytes, "HTTP/1.1 ", 9) && memcmp(bytes, "HTTP/1.0 ", 9))) return -1;
+  for (int i = 9; i < 12; i++) if (bytes[i] < '0' || bytes[i] > '9') return -1;
+  if (bytes[12] != ' ' && bytes[12] != '\r') return -1;
+  int status = (bytes[9] - '0') * 100 + (bytes[10] - '0') * 10 + bytes[11] - '0';
+  if (status < 100 || status > 599) return -1;
+  const char *end = bytes + length;
+  const char *line = memmem(bytes, length, "\r\n", 2);
+  if (!line) return -1;
+  line += 2;
+  while (line < end - 2) {
+    const char *next = memmem(line, (size_t)(end - line), "\r\n", 2);
+    if (!next || next == line || !memchr(line, ':', (size_t)(next - line))) return -1;
+    for (const char *p = line; p < next; p++) {
+      if ((unsigned char)*p < 32 && *p != '\t') return -1;
+    }
+    line = next + 2;
+  }
+  return status;
+}
+
+ConnectivityHTTPResult ConnectivityHTTPProbe(const char *request, int proxy_port,
+  int timeout_ms, ConnectivityHTTPCancellation *token) {
+  return ConnectivityHTTPProbeWithReader(request, proxy_port, timeout_ms, token, NULL, NULL);
+}
+
+ConnectivityHTTPResult ConnectivityHTTPProbeWithReader(const char *request, int proxy_port,
+  int timeout_ms, ConnectivityHTTPCancellation *token, ConnectivityHTTPReader reader, void *context) {
+  ConnectivityHTTPResult result = { .stage = 1, .local_tcp_ms = -1, .send_ms = -1,
+    .first_byte_ms = -1, .headers_ms = -1 };
+  int fd = -1;
+  uint64_t started = ConnectivityHTTPNow();
+  uint64_t deadline = started + (uint64_t)(timeout_ms > 0 ? timeout_ms : 0) * 1000000ULL;
+  if (!token || !request || proxy_port < 1 || proxy_port > 65535) goto cleanup;
+  fd = socket(AF_INET, SOCK_STREAM, 0);
+  if (fd < 0) goto cleanup;
+  int one = 1;
+  setsockopt(fd, SOL_SOCKET, SO_NOSIGPIPE, &one, sizeof(one));
+  if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0) goto cleanup;
+  struct sockaddr_in address = { .sin_family = AF_INET,
+    .sin_port = htons((uint16_t)proxy_port), .sin_addr.s_addr = htonl(INADDR_LOOPBACK) };
+  if (connect(fd, (struct sockaddr *)&address, sizeof(address)) < 0 && errno != EINPROGRESS)
+    goto cleanup;
+  if (!ready(fd, POLLOUT, deadline, token)) goto cleanup;
+  int error = 0;
+  socklen_t size = sizeof(error);
+  if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &error, &size) || error) goto cleanup;
+  uint64_t connected = ConnectivityHTTPNow();
+  result.local_tcp_ms = milliseconds(connected, started);
+  result.stage = 2;
+  size_t length = strlen(request), offset = 0;
+  while (offset < length) {
+    if (!ready(fd, POLLOUT, deadline, token)) goto cleanup;
+    ssize_t sent = send(fd, request + offset, length - offset, 0);
+    if (sent > 0) offset += (size_t)sent;
+    else if (sent == 0 || (errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)) goto cleanup;
+  }
+  uint64_t sent = ConnectivityHTTPNow(), first = 0;
+  result.send_ms = milliseconds(sent, connected);
+  result.stage = 3;
+  char bytes[65536];
+  size_t used = 0, consumed = 0, cumulative = 0;
+  while (used < sizeof(bytes)) {
+    if (!ready(fd, POLLIN, deadline, token)) goto cleanup;
+    ssize_t count = reader ? reader(bytes + used, sizeof(bytes) - used, context)
+      : recv(fd, bytes + used, sizeof(bytes) - used, 0);
+    if (count <= 0) {
+      if (count < 0 && (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR)) continue;
+      goto cleanup;
+    }
+    if (!first) {
+      first = ConnectivityHTTPNow();
+      result.first_byte_ms = milliseconds(first, sent);
+      result.stage = 4;
+    }
+    used += (size_t)count;
+    const char *end;
+    while ((end = memmem(bytes + consumed, used - consumed, "\r\n\r\n", 4))) {
+      size_t header_length = (size_t)(end - (bytes + consumed)) + 4;
+      if (cumulative + consumed + header_length > sizeof(bytes)) goto cleanup;
+      int status = response_status(bytes + consumed, header_length);
+      if (status < 0) goto cleanup;
+      consumed += header_length;
+      if (status >= 200 || status == 101) {
+        uint64_t finished = ConnectivityHTTPNow();
+        result.status = status;
+        result.headers_ms = milliseconds(finished, first);
+        result.received_headers = finished < deadline && !atomic_load(&token->cancelled);
+        if (result.received_headers) result.stage = 5;
+        goto cleanup;
+      }
+    }
+    cumulative += consumed;
+    if (cumulative + used - consumed >= sizeof(bytes)) goto cleanup;
+    if (consumed) {
+      memmove(bytes, bytes + consumed, used - consumed);
+      used -= consumed;
+      consumed = 0;
+    }
+  }
+cleanup:
+  result.milliseconds = milliseconds(ConnectivityHTTPNow(), started);
+  result.timed_out = !result.received_headers && ConnectivityHTTPNow() >= deadline;
+  if (fd >= 0) close(fd);
+  return result;
+}
diff --git a/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityHTTPTransport.h b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityHTTPTransport.h
new file mode 100644
index 000000000..3d3274717
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityHTTPTransport.h
@@ -0,0 +1,28 @@
+#ifndef ConnectivityHTTPTransport_h
+#define ConnectivityHTTPTransport_h
+#include <stdint.h>
+#include <sys/types.h>
+
+typedef struct ConnectivityHTTPCancellation ConnectivityHTTPCancellation;
+typedef struct {
+  int status;
+  int timed_out;
+  int received_headers;
+  int stage; /* 1: local TCP, 2: send, 3: first byte, 4: headers, 5: complete */
+  double milliseconds;
+  double local_tcp_ms;
+  double send_ms;
+  double first_byte_ms;
+  double headers_ms;
+} ConnectivityHTTPResult;
+ConnectivityHTTPCancellation *ConnectivityHTTPCreateCancellation(void);
+void ConnectivityHTTPCancel(ConnectivityHTTPCancellation *token);
+void ConnectivityHTTPDestroyCancellation(ConnectivityHTTPCancellation *token);
+uint64_t ConnectivityHTTPNow(void);
+ConnectivityHTTPResult ConnectivityHTTPProbe(const char *request, int proxy_port,
+  int timeout_ms, ConnectivityHTTPCancellation *token);
+/* A reader override makes response fragmentation independent of TCP packet boundaries. */
+typedef ssize_t (*ConnectivityHTTPReader)(void *buffer, size_t capacity, void *context);
+ConnectivityHTTPResult ConnectivityHTTPProbeWithReader(const char *request, int proxy_port,
+  int timeout_ms, ConnectivityHTTPCancellation *token, ConnectivityHTTPReader reader, void *context);
+#endif
diff --git a/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityMeasurement.swift b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityMeasurement.swift
new file mode 100644
index 000000000..0bf3f8f91
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityMeasurement.swift
@@ -0,0 +1,231 @@
+import Darwin
+import Foundation
+
+/// Preparation and sampling stay behind one measurement interface. Dependencies
+/// at the HTTP and DNS seams admit deterministic fixtures without real egress.
+@MainActor
+struct ConnectivityMeasurement {
+  private struct Candidate {
+    let address: String
+    let milliseconds: Double
+  }
+
+  private struct AddressResolution {
+    let addresses: [String]
+    let trace: [ConnectivityTrace]
+    let failure: ServerConnectivity.Outcome?
+  }
+
+  private struct Selection {
+    let result: Result
+    let address: String?
+  }
+
+  private struct SampleSummary {
+    let outcome: ServerConnectivity.Outcome
+    let medianMilliseconds: Double?
+  }
+
+  struct Result {
+    var outcome: ServerConnectivity.Outcome = .network
+    var selectedIP: String?
+    var samples: [ConnectivityHTTPObservation] = []
+    var trace: [ConnectivityTrace] = []
+  }
+
+  var resolve: ((String, Int, ContinuousClock.Instant) async throws -> [String])?
+  var request: (URL, String, Int, Double) async -> ConnectivityHTTPObservation = {
+    await ConnectivityHTTPRequest().observe(url: $0, targetIP: $1, proxyPort: $2, timeout: $3)
+  }
+
+  func measure(
+    url: URL, proxyPort: Int, preparationDeadline: ContinuousClock.Instant
+  ) async -> Result {
+    guard let host = validatedHost(in: url) else { return Result(outcome: .configuration) }
+    let resolution = await resolveAddresses(
+      host, proxyPort: proxyPort, deadline: preparationDeadline)
+    var result = Result(trace: resolution.trace)
+    if let failure = resolution.failure {
+      result.outcome = failure
+      result.trace.append(dnsFailureTrace())
+      return result
+    }
+    let candidates = candidateAddresses(from: resolution.addresses)
+    let selection = await selectCandidate(
+      from: candidates, url: url, proxyPort: proxyPort,
+      deadline: preparationDeadline, startingWith: result)
+    guard let address = selection.address else { return selection.result }
+    return await sample(url, address: address, proxyPort: proxyPort, startingWith: selection.result)
+  }
+
+  private func validatedHost(in url: URL) -> String? {
+    guard ServerConnectivity.validURL(url.absoluteString) != nil else { return nil }
+    return URLComponents(url: url, resolvingAgainstBaseURL: false)?.host
+  }
+
+  private func resolveAddresses(
+    _ host: String, proxyPort: Int, deadline: ContinuousClock.Instant
+  ) async -> AddressResolution {
+    let literal = host.trimmingCharacters(in: CharacterSet(charactersIn: "[]"))
+    do {
+      try Task.checkCancellation()
+      if ConnectivityAddress.family(literal) != nil {
+        return AddressResolution(addresses: [literal], trace: [], failure: nil)
+      }
+      if let resolve {
+        return AddressResolution(
+          addresses: try await resolve(host, proxyPort, deadline), trace: [], failure: nil)
+      }
+      let resolution = await ConnectivityDoHResolver().resolve(
+        host: host, proxyPort: proxyPort, deadline: deadline)
+      return AddressResolution(
+        addresses: resolution.addresses, trace: resolution.trace, failure: nil)
+    } catch {
+      let failure: ServerConnectivity.Outcome =
+        ContinuousClock.now >= deadline
+        ? .preparationTimeout : .network
+      return AddressResolution(addresses: [], trace: [], failure: failure)
+    }
+  }
+
+  private func dnsFailureTrace() -> ConnectivityTrace {
+    ConnectivityTrace(
+      phase: .summary, status: Task.isCancelled ? .cancelled : .network, failureStage: .dns)
+  }
+
+  private func candidateAddresses(from addresses: [String]) -> [String] {
+    var seen = Set<String>()
+    var counts: [Int32: Int] = [:]
+    return addresses.filter { address in
+      guard let family = ConnectivityAddress.family(address), seen.insert(address).inserted,
+        counts[family, default: 0] < 2
+      else { return false }
+      counts[family, default: 0] += 1
+      return true
+    }
+  }
+
+  private func selectCandidate(
+    from candidates: [String], url: URL, proxyPort: Int,
+    deadline: ContinuousClock.Instant, startingWith original: Result
+  ) async -> Selection {
+    var result = original
+    var best: Candidate?
+    var failure: ServerConnectivity.Outcome = .network
+    for (index, address) in candidates.enumerated() {
+      if Task.isCancelled { return Selection(result: cancelled(result), address: nil) }
+      let remaining = Self.seconds(until: deadline)
+      if remaining <= 0 { return selectionTimeout(result) }
+      let observation = await request(url, address, proxyPort, min(3, remaining))
+      result.trace.append(observation.trace(phase: .candidate, index: index + 1, address: address))
+      failure = observation.outcome
+      if isBetterCandidate(observation, than: best) {
+        best = Candidate(address: address, milliseconds: observation.totalMilliseconds)
+      }
+    }
+    if Task.isCancelled { return Selection(result: cancelled(result), address: nil) }
+    guard ContinuousClock.now < deadline else { return selectionTimeout(result) }
+    guard let best else {
+      result.outcome = failure
+      result.trace.append(
+        ConnectivityTrace(phase: .summary, status: .network, failureStage: .selection))
+      return Selection(result: result, address: nil)
+    }
+    result.selectedIP = best.address
+    result.trace.append(
+      ConnectivityTrace(phase: .selected, status: .success, address: best.address))
+    return Selection(result: result, address: best.address)
+  }
+
+  private func isBetterCandidate(
+    _ observation: ConnectivityHTTPObservation, than best: Candidate?
+  ) -> Bool {
+    guard case .success = observation.outcome else { return false }
+    guard let best else { return true }
+    return observation.totalMilliseconds < best.milliseconds
+  }
+
+  private func selectionTimeout(_ original: Result) -> Selection {
+    var result = original
+    result.outcome = .preparationTimeout
+    result.trace.append(
+      ConnectivityTrace(phase: .summary, status: .timeout, failureStage: .selection))
+    return Selection(result: result, address: nil)
+  }
+
+  private func sample(
+    _ url: URL, address: String, proxyPort: Int, startingWith original: Result
+  ) async -> Result {
+    var result = original
+    for index in 1...3 {
+      if Task.isCancelled { return cancelled(result) }
+      let observation = await request(url, address, proxyPort, 5)
+      result.samples.append(observation)
+      result.trace.append(observation.trace(phase: .sample, index: index, address: address))
+    }
+    if Task.isCancelled { return cancelled(result) }
+    let summary = sampleSummary(for: result.samples)
+    result.outcome = summary.outcome
+    if let median = summary.medianMilliseconds {
+      result.trace.append(
+        ConnectivityTrace(phase: .summary, status: .success, milliseconds: median))
+    } else {
+      result.trace.append(ConnectivityTrace(phase: .summary, status: .insufficientSamples))
+    }
+    return result
+  }
+
+  private func sampleSummary(for samples: [ConnectivityHTTPObservation]) -> SampleSummary {
+    let successes = samples.compactMap { sample -> Double? in
+      if case .success = sample.outcome { return sample.totalMilliseconds }
+      return nil
+    }.sorted()
+    guard successes.count >= 2 else {
+      let failure =
+        samples.first(where: {
+          if case .success = $0.outcome { return false }
+          return true
+        })?.outcome ?? .network
+      return SampleSummary(outcome: failure, medianMilliseconds: nil)
+    }
+    let median = successes.count == 2 ? (successes[0] + successes[1]) / 2 : successes[1]
+    return SampleSummary(
+      outcome: .success(milliseconds: Int(median.rounded())), medianMilliseconds: median)
+  }
+
+  static func seconds(until deadline: ContinuousClock.Instant) -> Double {
+    let parts = ContinuousClock.now.duration(to: deadline).components
+    return Double(parts.seconds) + Double(parts.attoseconds) / 1e18
+  }
+
+  private func cancelled(_ original: Result) -> Result {
+    var result = original
+    result.outcome = .network
+    result.trace.append(ConnectivityTrace(phase: .summary, status: .cancelled))
+    return result
+  }
+}
+
+extension ConnectivityHTTPObservation {
+  func trace(phase: ConnectivityTrace.Phase, index: Int, address: String) -> ConnectivityTrace {
+    let status: ConnectivityTrace.Status
+    var http: Int?
+    switch outcome {
+    case .success: status = .success
+    case .requestTimeout, .preparationTimeout: status = .timeout
+    case .http(let code):
+      status = .http
+      http = code
+    case .configuration, .unsupported: status = .configuration
+    default: status = .network
+    }
+    return ConnectivityTrace(
+      phase: phase, status: status, index: index, address: address,
+      milliseconds: totalMilliseconds, localTCPMilliseconds: localTCPMilliseconds,
+      sendMilliseconds: sendMilliseconds, firstByteMilliseconds: firstByteMilliseconds,
+      headersMilliseconds: headersMilliseconds,
+      failureStage: status == .success || status == .http
+        ? .none : ConnectivityTrace.FailureStage(rawValue: failureStage) ?? .request,
+      httpStatus: http)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityRuntime.swift b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityRuntime.swift
new file mode 100644
index 000000000..b118945f0
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityRuntime.swift
@@ -0,0 +1,241 @@
+import Darwin
+import Foundation
+
+/// An isolated process group owns sslocal and every SIP003 child. No formal
+/// runtime file, ACL, activity selection, or system proxy is touched.
+@MainActor
+struct ConnectivityRuntime {
+  private struct MeasurementContext {
+    let id: UUID
+    let url: URL
+    let started: ContinuousClock.Instant
+    let deadline: ContinuousClock.Instant
+    let startupDeadline: ContinuousClock.Instant
+    let directory: URL
+  }
+
+  private struct ProbeProcess {
+    let pid: pid_t
+    let port: Int
+  }
+
+  private struct ProbeRunResult {
+    let outcome: ServerConnectivity.Outcome
+    let pid: pid_t
+    let reaped: Bool
+    let startupCompleted: Bool
+  }
+
+  let executable: URL
+  var measurement = ConnectivityMeasurement()
+  var temporaryRoot: URL = FileManager.default.temporaryDirectory
+
+  func measure(
+    _ server: SslocalServerDocument, url: URL, preparationDeadline deadline: ContinuousClock.Instant
+  ) async -> ServerConnectivity.Outcome {
+    let started = ContinuousClock.now
+    let context = MeasurementContext(
+      id: UUID(), url: url, started: started, deadline: deadline,
+      startupDeadline: min(deadline, started.advanced(by: .seconds(10))),
+      directory: temporaryRoot.appendingPathComponent(UUID().uuidString))
+    let run = await run(server, context: context)
+    await cleanup(pid: run.pid, reaped: run.reaped, directory: context.directory)
+    return run.outcome
+  }
+
+  private func run(
+    _ server: SslocalServerDocument, context: MeasurementContext
+  ) async -> ProbeRunResult {
+    var pid: pid_t = 0
+    var reaped = false
+    var startupCompleted = false
+    var result: ServerConnectivity.Outcome = .startup
+    do {
+      try FileManager.default.createDirectory(
+        at: context.directory, withIntermediateDirectories: true,
+        attributes: [.posixPermissions: 0o700])
+      try Task.checkCancellation()
+      guard ContinuousClock.now < context.deadline else {
+        return ProbeRunResult(
+          outcome: .preparationTimeout, pid: 0, reaped: false, startupCompleted: false)
+      }
+      let process = try launch(server, in: context.directory)
+      pid = process.pid
+      let readiness = try await waitForServer(process, context: context)
+      reaped = readiness.reaped
+      startupCompleted = readiness.startupCompleted
+      result = readiness.outcome
+    } catch is CancellationError {
+      result = .network
+    } catch {
+      result = .startup
+    }
+    if !startupCompleted {
+      emitStartupFailure(result, context: context)
+    }
+    return ProbeRunResult(
+      outcome: result, pid: pid, reaped: reaped, startupCompleted: startupCompleted)
+  }
+
+  private func launch(_ server: SslocalServerDocument, in directory: URL) throws -> ProbeProcess {
+    let port = try freePort()
+    let config = directory.appendingPathComponent("test.json")
+    // A single TCP HTTP inbound, no ACL: every request must use this server.
+    let data = try JSONSerialization.data(withJSONObject: [
+      "servers": [try JSONSerialization.jsonObject(with: JSONEncoder().encode(server))],
+      "locals": [
+        [
+          "protocol": "http", "local_address": "127.0.0.1",
+          "local_port": port, "mode": "tcp_only",
+        ]
+      ],
+    ])
+    try AtomicFileWriter.write(data, to: config)
+    return ProbeProcess(pid: try spawn(config), port: port)
+  }
+
+  private func waitForServer(
+    _ process: ProbeProcess, context: MeasurementContext
+  ) async throws -> ProbeRunResult {
+    var reaped = false
+    while ContinuousClock.now < context.startupDeadline {
+      try Task.checkCancellation()
+      var status: Int32 = 0
+      if waitpid(process.pid, &status, WNOHANG) == process.pid {
+        reaped = true
+        break
+      }
+      if ownsHealthyListener(process) {
+        guard ContinuousClock.now < context.deadline else { break }
+        emitStartupSuccess(context)
+        let measured = await measurement.measure(
+          url: context.url, proxyPort: process.port, preparationDeadline: context.deadline)
+        for entry in measured.trace {
+          RuntimeLog.emit(.connectivityMeasurement(id: context.id, entry: entry))
+        }
+        return ProbeRunResult(
+          outcome: measured.outcome, pid: process.pid, reaped: reaped, startupCompleted: true)
+      }
+      try await Task.sleep(for: .milliseconds(25))
+    }
+    let outcome: ServerConnectivity.Outcome =
+      ContinuousClock.now >= context.startupDeadline
+      ? .preparationTimeout : .startup
+    return ProbeRunResult(
+      outcome: outcome, pid: process.pid, reaped: reaped, startupCompleted: false)
+  }
+
+  private func ownsHealthyListener(_ process: ProbeProcess) -> Bool {
+    RuntimeSocketOwnershipProbe.process(process.pid, ownsTCPListenerOn: process.port)
+      && EndpointHealthProbe.probe(
+        host: "127.0.0.1", port: process.port, timeout: 0.02) == .reachable
+  }
+
+  private func emitStartupSuccess(_ context: MeasurementContext) {
+    let parts = context.started.duration(to: .now).components
+    RuntimeLog.emit(
+      .connectivityMeasurement(
+        id: context.id,
+        entry: ConnectivityTrace(
+          phase: .startup, status: .success,
+          milliseconds: Double(parts.seconds) * 1000 + Double(parts.attoseconds) / 1e15)))
+  }
+
+  private func emitStartupFailure(
+    _ outcome: ServerConnectivity.Outcome, context: MeasurementContext
+  ) {
+    let parts = context.started.duration(to: .now).components
+    let status: ConnectivityTrace.Status =
+      Task.isCancelled
+      ? .cancelled : outcome == .preparationTimeout ? .timeout : .network
+    RuntimeLog.emit(
+      .connectivityMeasurement(
+        id: context.id,
+        entry: ConnectivityTrace(
+          phase: .startup, status: status,
+          milliseconds: Double(parts.seconds) * 1000 + Double(parts.attoseconds) / 1e15,
+          failureStage: .startup)))
+  }
+
+  private func cleanup(pid child: pid_t, reaped alreadyReaped: Bool, directory: URL) async {
+    // Cleanup is not cancelled with the measurement. Slots remain occupied until
+    // the group has been terminated and its leader reaped.
+    await Task {
+      if child > 0 {
+        _ = kill(-child, SIGTERM)
+        let deadline = ContinuousClock.now.advanced(by: .seconds(2))
+        var reaped = alreadyReaped
+        while ContinuousClock.now < deadline {
+          if !reaped {
+            var status: Int32 = 0
+            reaped = waitpid(child, &status, WNOHANG) == child
+          }
+          if kill(-child, 0) != 0 { break }
+          try? await Task.sleep(for: .milliseconds(25))
+        }
+        _ = kill(-child, SIGKILL)
+        if !reaped {
+          var status: Int32 = 0
+          _ = waitpid(child, &status, 0)
+        }
+      }
+      try? FileManager.default.removeItem(at: directory)
+    }.value
+  }
+
+  private func freePort() throws -> Int {
+    let descriptor = socket(AF_INET, SOCK_STREAM, 0)
+    guard descriptor >= 0 else { throw RuntimeError.failed }
+    defer { close(descriptor) }
+    var address = sockaddr_in()
+    address.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_addr.s_addr = inet_addr("127.0.0.1")
+    let bound = withUnsafePointer(to: &address) {
+      $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        bind(descriptor, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    guard bound == 0 else { throw RuntimeError.failed }
+    var length = socklen_t(MemoryLayout<sockaddr_in>.size)
+    let read = withUnsafeMutablePointer(to: &address) {
+      $0.withMemoryRebound(to: sockaddr.self, capacity: 1) { getsockname(descriptor, $0, &length) }
+    }
+    guard read == 0 else { throw RuntimeError.failed }
+    return Int(UInt16(bigEndian: address.sin_port))
+  }
+
+  private func spawn(_ config: URL) throws -> pid_t {
+    var attributes: posix_spawnattr_t?
+    posix_spawnattr_init(&attributes)
+    defer { posix_spawnattr_destroy(&attributes) }
+    posix_spawnattr_setflags(&attributes, Int16(POSIX_SPAWN_SETPGROUP))
+    posix_spawnattr_setpgroup(&attributes, 0)
+    var actions: posix_spawn_file_actions_t?
+    posix_spawn_file_actions_init(&actions)
+    defer { posix_spawn_file_actions_destroy(&actions) }
+    // Child output can contain plugin options and credentials; discard it.
+    for descriptor in [STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO] {
+      posix_spawn_file_actions_addopen(&actions, descriptor, "/dev/null", O_RDWR, 0)
+    }
+    var strings: [UnsafeMutablePointer<CChar>?] = []
+    defer {
+      for string in strings {
+        free(string)
+      }
+    }
+    for argument in [executable.path, "-c", config.path] {
+      guard let string = strdup(argument) else { throw RuntimeError.failed }
+      strings.append(string)
+    }
+    var argv = strings + [nil]
+    var pid: pid_t = 0
+    let status = argv.withUnsafeMutableBufferPointer {
+      posix_spawn(&pid, executable.path, &actions, &attributes, $0.baseAddress!, environ)
+    }
+    guard status == 0 else { throw RuntimeError.failed }
+    return pid
+  }
+
+  private enum RuntimeError: Error { case failed }
+}
diff --git a/ShadowsocksX-NG2/App/Application/Connectivity/ServerConnectivity.swift b/ShadowsocksX-NG2/App/Application/Connectivity/ServerConnectivity.swift
new file mode 100644
index 000000000..cdfc9c875
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Connectivity/ServerConnectivity.swift
@@ -0,0 +1,224 @@
+import Combine
+import Foundation
+
+/// Process-lifetime observations. Secrets stay inside the configuration adapter.
+@MainActor
+final class ServerConnectivity: ObservableObject {
+  enum Outcome: Equatable, Sendable {
+    case success(milliseconds: Int)
+    case unsupported, preparationTimeout, requestTimeout, configuration, startup, network
+    case http(Int)
+  }
+  enum ConfigurationFailure: Error { case unsupported }
+  struct Record: Equatable, Identifiable {
+    let id = UUID()
+    let finishedAt: Date
+    let outcome: Outcome
+  }
+  struct Batch {
+    let targets: [NodeID]
+    let cooling: [NodeID]
+    var completedIDs: Set<NodeID> = []
+    var completed: Int { completedIDs.count }
+  }
+  struct Summary {
+    let serverID: NodeID?
+    let record: Record?
+    let hasResults: Bool
+    let isTesting: Bool
+  }
+  static let defaultURL = URL(string: "http://www.gstatic.com/generate_204")!
+  @Published private(set) var testing: Set<NodeID> = []
+  @Published private var records: [NodeID: [Record]] = [:]
+  @Published private var batches: [UUID: Batch] = [:]
+  private var versions: [NodeID: String] = [:]
+  private var cooldown: [NodeID: Date] = [:]
+  private var jobs: [NodeID: Task<Void, Never>] = [:]
+  private var queue: [(NodeID, UUID)] = []
+  private var tokens: [NodeID: UUID] = [:]
+  private var running = 0
+  private var generation = 0
+  private var stopped = false
+  private var targetURL: URL? = defaultURL
+  private let revision: (NodeID) -> String
+  private let configuration: (NodeID) throws -> SslocalServerDocument
+  private let now: () -> Date
+  private let measure: (SslocalServerDocument, URL, ContinuousClock.Instant) async -> Outcome
+
+  init(
+    configuration: @escaping (NodeID) throws -> SslocalServerDocument,
+    revision: ((NodeID) -> String)? = nil,
+    now: @escaping () -> Date = Date.init,
+    measure: @escaping (SslocalServerDocument, URL, ContinuousClock.Instant) async -> Outcome
+  ) {
+    self.configuration = configuration
+    self.revision =
+      revision ?? { id in
+        let encoder = JSONEncoder()
+        encoder.outputFormatting = [.sortedKeys]
+        guard let server = try? configuration(id), let data = try? encoder.encode(server) else {
+          return "invalid"
+        }
+        return ProxyACLDocument.digest(data)
+      }
+    self.now = now
+    self.measure = measure
+  }
+
+  nonisolated static func validURL(_ raw: String) -> URL? {
+    guard let url = URL(string: raw.trimmingCharacters(in: .whitespacesAndNewlines)),
+      url.scheme?.lowercased() == "http",
+      let host = url.host, !host.isEmpty, url.fragment == nil,
+      url.user == nil, url.password == nil,
+      url.port.map({ (1...65535).contains($0) }) ?? true
+    else { return nil }
+    return url
+  }
+
+  func history(for id: NodeID) -> [Record] { records[id] ?? [] }
+  func batch(_ id: UUID) -> Batch? { batches[id] }
+  func isCooling(_ id: NodeID) -> Bool { cooldown[id].map { now() < $0 } ?? false }
+
+  /// Captures target identities, reuses queued work, and skips cooling identities.
+  @discardableResult
+  func test(_ ids: [NodeID]) -> UUID {
+    configurationsChanged()
+    let batchID = UUID()
+    var seen = Set<NodeID>()
+    let ids = ids.filter { seen.insert($0).inserted }
+    let skipped = ids.filter { !testing.contains($0) && isCooling($0) }
+    let targets = stopped ? [] : ids.filter { !skipped.contains($0) }
+    batches[batchID] = Batch(targets: targets, cooling: skipped)
+    // Bound transient batch metadata; active batches are retained.
+    if batches.count > 100 {
+      for (key, value) in batches where value.completed == value.targets.count && key != batchID {
+        batches.removeValue(forKey: key)
+      }
+    }
+    for id in targets where !testing.contains(id) {
+      let token = UUID()
+      versions[id] = revision(id)
+      tokens[id] = token
+      testing.insert(id)
+      queue.append((id, token))
+    }
+    pump()
+    return batchID
+  }
+
+  func wait(for batchID: UUID) async {
+    while let batch = batches[batchID], batch.completed < batch.targets.count {
+      await Task.yield()
+    }
+  }
+
+  func summary(for ids: [NodeID]) -> Summary {
+    let values = ids.compactMap { id in records[id]?.first.map { (id, $0) } }
+    let successes = values.filter {
+      if case .success = $0.1.outcome { return true }
+      return false
+    }
+    let fastest = successes.min { lhs, rhs in
+      guard case .success(let leftMilliseconds) = lhs.1.outcome,
+        case .success(let rightMilliseconds) = rhs.1.outcome
+      else {
+        return false
+      }
+      return leftMilliseconds < rightMilliseconds
+    }
+    return Summary(
+      serverID: fastest?.0, record: fastest?.1,
+      hasResults: !values.isEmpty, isTesting: ids.contains { testing.contains($0) })
+  }
+
+  /// Re-read values, including secrets with unchanged references and plugin mappings.
+  func configurationsChanged() {
+    for (id, previous) in versions where revision(id) != previous { invalidate(id) }
+  }
+
+  func setURL(_ url: URL?) {
+    guard url != targetURL else { return }
+    targetURL = url
+    generation += 1
+    records = [:]
+    for id in testing { invalidate(id) }
+  }
+
+  func networkChanged() {
+    generation += 1
+    for id in testing { jobs[id]?.cancel() }
+  }
+
+  func shutdown() async {
+    stopped = true
+    generation += 1
+    for id in testing { invalidate(id) }
+    let active = Array(jobs.values)
+    for job in active { await job.value }
+  }
+
+  private func invalidate(_ id: NodeID) {
+    records.removeValue(forKey: id)
+    versions.removeValue(forKey: id)
+    jobs[id]?.cancel()
+    // Queued identities are completed internally and enter cooldown too.
+    if jobs[id] == nil, testing.contains(id) { finish(id) }
+  }
+
+  private func pump() {
+    while running < 1, !queue.isEmpty, !stopped {
+      let (id, token) = queue.removeFirst()
+      guard tokens[id] == token else { continue }
+      let preparationDeadline = ContinuousClock.now.advanced(by: .seconds(30))
+      guard versions[id] == revision(id) else {
+        records.removeValue(forKey: id)
+        finish(id)
+        continue
+      }
+      running += 1
+      let epoch = generation
+      let url = targetURL
+      let version = versions[id]
+      let server: SslocalServerDocument?
+      let failure: Outcome
+      do {
+        server = try configuration(id)
+        failure = .configuration
+      } catch ConfigurationFailure.unsupported {
+        server = nil
+        failure = .unsupported
+      } catch {
+        server = nil
+        failure = .configuration
+      }
+      jobs[id] = Task { [self] in
+        let result: Outcome
+        if let server, let url {
+          result =
+            ContinuousClock.now >= preparationDeadline
+            ? .preparationTimeout : await measure(server, url, preparationDeadline)
+        } else {
+          result = url == nil ? .configuration : failure
+        }
+        let current = revision(id)
+        if !Task.isCancelled, epoch == generation, tokens[id] == token, current == version {
+          let record = Record(finishedAt: now(), outcome: result)
+          records[id] = Array(([record] + (records[id] ?? [])).prefix(10))
+        }
+        running -= 1
+        jobs.removeValue(forKey: id)
+        finish(id)
+        pump()
+      }
+    }
+  }
+
+  private func finish(_ id: NodeID) {
+    tokens.removeValue(forKey: id)
+    testing.remove(id)
+    cooldown[id] = now().addingTimeInterval(10)
+    for key in batches.keys where batches[key]?.targets.contains(id) == true {
+      batches[key]?.completedIDs.insert(id)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/DiagnosticsWorkflow/DiagnosticLogIntake.swift b/ShadowsocksX-NG2/App/Application/DiagnosticsWorkflow/DiagnosticLogIntake.swift
new file mode 100644
index 000000000..021e344eb
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/DiagnosticsWorkflow/DiagnosticLogIntake.swift
@@ -0,0 +1,141 @@
+import Darwin
+import Foundation
+
+/// 日志视图 intake（诊断日志查看器的唯一行来源）：把两个原始面——GUI 事件
+/// 环形缓冲与 wrapper `agent.log` 尾部——归一成同一种行（`LogLine`）按时间
+/// 归并。tail 窗口逻辑也收在这一处。raw 行只经显式查看/复制呈现，永不进入
+/// 诊断报告（报告走 `RuntimeLogEvent` 白名单投影，ADR-0006）。
+enum DiagnosticLogIntake {
+  /// agent.log 尾部读取（够诊断即可）：只取文件末尾有限字节并按行
+  /// 对齐。文件缺失或不可读返回 nil；内容按 UTF-8 宽容解码，起始半行丢弃。
+  static func readTail(of url: URL, maxBytes: Int = 64 * 1024) -> String? {
+    readTailSnapshot(of: url, maxBytes: maxBytes)?.text
+  }
+
+  /// 文件身份与每行的绝对字节位置随 tail 一起采样，窗口裁剪不改变保留行的身份。
+  static func readTailSnapshot(of url: URL, maxBytes: Int = 64 * 1024) -> DiagnosticLogTail? {
+    guard let handle = try? FileHandle(forReadingFrom: url) else { return nil }
+    defer { try? handle.close() }
+    var attributes = stat()
+    guard fstat(handle.fileDescriptor, &attributes) == 0 else { return nil }
+    let size = (try? handle.seekToEnd()) ?? 0
+    let window = min(UInt64(max(1, maxBytes)), size)
+    var offset = size - window
+    try? handle.seek(toOffset: offset)
+    var data = (try? handle.read(upToCount: Int(window))) ?? Data()
+    guard !data.isEmpty else { return nil }
+    if window < size, let firstNewline = data.firstIndex(of: 10) {
+      offset += UInt64(firstNewline + 1)
+      data.removeSubrange(...firstNewline)
+    }
+    return DiagnosticLogTail(
+      data: data, fileID: UInt64(attributes.st_ino), offset: offset)
+  }
+
+  /// 归并行（旧→新）：GUI 事件行与 agent.log 尾部行统一按时间戳排序。
+  /// 旧格式行（无法解析时间戳）排在最前并保持文件内顺序——它们来自升级前
+  /// 落盘，时间未知。
+  static func rows(events: [RuntimeEventStore.Entry], tail: String?) -> [LogLine] {
+    entries(
+      events: events,
+      tail: tail.map { DiagnosticLogTail(text: $0, fileID: 0, offset: 0) }
+    ).map(\.line)
+  }
+
+  static func entries(
+    events: [RuntimeEventStore.Entry], tail: DiagnosticLogTail?
+  ) -> [DiagnosticLogEntry] {
+    var merged = events.map { entry in
+      DiagnosticLogEntry(
+        id: .gui(entry.id),
+        line: LogLine(event: entry.event, timestamp: entry.timestamp, source: .gui))
+    }
+    merged.append(contentsOf: tailEntries(tail))
+    return merged.enumerated()
+      .sorted { lhs, rhs in
+        let left = lhs.element.line.timestamp ?? .distantPast
+        let right = rhs.element.line.timestamp ?? .distantPast
+        return left == right ? lhs.offset < rhs.offset : left < right
+      }
+      .map(\.element)
+  }
+
+  /// 按原始字节拆 LF，保留 CR 和空行；无效 UTF-8 不影响后续行的文件位置。
+  private static func tailEntries(_ tail: DiagnosticLogTail?) -> [DiagnosticLogEntry] {
+    guard let tail, !tail.data.isEmpty else { return [] }
+    var lines = tail.data.split(separator: 10, omittingEmptySubsequences: false)
+    if tail.data.last == 10 { lines.removeLast() }
+    var offset = tail.offset
+    return lines.map { bytes in
+      // 坏字节替换而非丢弃整行；位置仍按原始字节计数。
+      // swiftlint:disable:next optional_data_string_conversion
+      let raw = String(decoding: bytes, as: UTF8.self)
+      defer { offset += UInt64(bytes.count + 1) }
+      return DiagnosticLogEntry(
+        id: .agent(file: tail.fileID, offset: offset, text: raw),
+        line: LogLine.parse(raw) ?? LogLine.legacy(raw))
+    }
+  }
+}
+
+/// 一次文件尾部采样，offset 是 data 首字节在文件中的绝对位置。
+struct DiagnosticLogTail: Sendable {
+  let data: Data
+  let fileID: UInt64
+  let offset: UInt64
+
+  // swiftlint:disable:next optional_data_string_conversion
+  var text: String { String(decoding: data, as: UTF8.self) }
+}
+
+extension DiagnosticLogTail {
+  init(text: String, fileID: UInt64, offset: UInt64) {
+    self.init(data: Data(text.utf8), fileID: fileID, offset: offset)
+  }
+}
+
+/// 查看器行过滤（纯函数；UI 只做 chip 绑定）：级别三档与来源四档组合。
+/// 复制跟随可见行，导出面不受过滤影响。
+struct DiagnosticLogFilter: Equatable, Sendable {
+  /// 级别档：全部 / 警告+错误 / 仅错误。
+  enum Level: String, CaseIterable, Identifiable, Sendable {
+    case all, warnings, errors
+
+    var id: Self { self }
+
+    func admits(_ level: LogLineLevel) -> Bool {
+      switch self {
+      case .all: return true
+      case .warnings: return level != .info
+      case .errors: return level == .error
+      }
+    }
+  }
+
+  /// 来源档：全部 / GUI 事件 / wrapper 事件 / sslocal 上游输出。
+  enum Source: String, CaseIterable, Identifiable, Sendable {
+    case all, gui, wrapper, sslocal
+
+    var id: Self { self }
+
+    func admits(_ source: LogLineSource) -> Bool {
+      switch self {
+      case .all: return true
+      case .gui: return source == .gui
+      case .wrapper: return source == .wrapper
+      case .sslocal: return source == .sslocal
+      }
+    }
+  }
+
+  var level: Level = .all
+  var source: Source = .all
+
+  func apply(_ rows: [LogLine]) -> [LogLine] {
+    rows.filter(admits)
+  }
+
+  func admits(_ line: LogLine) -> Bool {
+    level.admits(line.level) && source.admits(line.source)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/DiagnosticsWorkflow/DiagnosticsWorkflow.swift b/ShadowsocksX-NG2/App/Application/DiagnosticsWorkflow/DiagnosticsWorkflow.swift
new file mode 100644
index 000000000..8f5d90317
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/DiagnosticsWorkflow/DiagnosticsWorkflow.swift
@@ -0,0 +1,368 @@
+import Foundation
+
+/// 代理运行时的只读诊断事实缝：runtime 只以固定状态
+/// 类别、活动目标存在性、监听事实与已脱敏契约摘要进入诊断 workflow；生产
+/// 实现是 `ProxyRuntimeController` 的诊断只读面，测试注入替身。诊断 module
+/// 不直接操作 runtime controller。
+@MainActor
+protocol ProxyRuntimeDiagnosticFacts: AnyObject {
+  /// 固定代理状态类别（不透传任意错误 detail）。
+  var proxyState: DiagnosticProxyState { get }
+  var hasActiveTarget: Bool { get }
+  /// 当前监听设置；监听地址在报告中只以回环/非回环两态呈现。
+  var listen: RuntimeListenFacts { get }
+  /// 运行时契约的脱敏摘要（数量与模式）；契约缺失或无效为 nil。
+  var contractSummary: String? { get }
+  /// 自定义规则安全摘要：数量 + 内容版本，无原始域名。
+  var customRuleSummary: CustomRuleSummary? { get }
+}
+
+/// 报告事件白名单（ADR-0006）：封闭的 RuntimeLogEvent
+/// 不自动获得导出资格——诊断 module 以只读派生属性显式决定每个事件的报告
+/// 呈现，自由错误 detail 与对外公布的主机地址一律清洗掉；数量、端口与领域
+/// 点名原因可以进入。新增事件必须先在此补充决策（漏 case 无法编译），
+/// 隐私承诺不因新增字段自动扩大。
+extension RuntimeLogEvent {
+  /// 事件在安全报告中的呈现文本；nil = 不进报告。
+  var diagnosticReportLine: String? {
+    switch self {
+    case .connectivityMeasurement:
+      return nil
+    case .contractWritten(let serverCount):
+      return "contract written (servers=\(serverCount))"
+    case .contractUnchanged:
+      return "contract unchanged, write skipped"
+    case .systemProxyUnchanged:
+      return "system proxy values unchanged, write skipped"
+    case .systemProxyHelperRegisterFailed:
+      return "system proxy helper register failed"
+    case .systemProxyWriteFailed:
+      return "system proxy write failed"
+    case .runtimeFilesDeleted:
+      return "runtime files deleted"
+    case .runtimePersistFailed:
+      return "runtime metadata persist failed"
+    case .agentRegistered:
+      return "launch agent registered"
+    case .agentRegisterFailed:
+      return "launch agent register failed"
+    case .agentUnregistered:
+      return "launch agent unregistered"
+    case .agentUnregisterFailed:
+      return "launch agent unregister failed"
+    case .sslocalSpawned(let pid):
+      return "sslocal spawned (pid=\(pid))"
+    case .sslocalSpawnFailed:
+      return "sslocal spawn failed"
+    case .sslocalExitedUnexpectedly(let status):
+      return "sslocal exited unexpectedly (status=\(status))"
+    case .sslocalStopRequested:
+      return "sslocal stop requested"
+    case .listenNotEstablished:
+      return "listen not established within deadline"
+    case .contractMissing:
+      return "contract missing"
+    case .contractInvalid:
+      return "supervision invalid, preserved"
+    case .reloadForwarded:
+      return "reload forwarded to sslocal"
+    case .reloadDeferred:
+      return "reload deferred until listeners are ready"
+    case .reloadRestarted:
+      return "reload: listen change, restarting sslocal"
+    // 本机监听端点事实只保留端口：主机地址态的对外公布地址不进报告。
+    case .endpointProbeFailed(_, let port, _):
+      return "local endpoint not ready (port=\(port))"
+    // 激活原因是领域的点名文案（短节点片段 + 固定文本，无秘密），与代理
+    // 状态类别同源；任意运行时错误 detail 不在此列。
+    case .activationFailed(let reason):
+      return "activation failed: \(reason)"
+    case .diagnosticsExported:
+      return "diagnostics report exported (redacted)"
+    case .settingsUnreadable:
+      return "settings unreadable, falling back to factory defaults"
+    // 前台应用 bundle id 等用户环境事实只进应用内日志查看器，不进共享报告。
+    case .launchActivationRetry, .windowAnchorAttached:
+      return nil
+    }
+  }
+}
+
+/// 诊断侧栏与详情共用的安全摘要：同一份最新 projection。
+struct DiagnosticSummary: Equatable, Sendable {
+  var proxyState: DiagnosticProxyState
+  var hasActiveTarget: Bool
+}
+
+/// 日志视图 projection（ADR-0006）：raw GUI 事件行与 wrapper
+/// `agent.log` 尾部行经日志视图 intake 归一为同一种行，只经显式查看/复制
+/// 呈现，永不进入诊断报告。
+struct DiagnosticLogView: Equatable, Sendable {
+  var entries: [DiagnosticLogEntry] = []
+  var rows: [LogLine] { entries.map(\.line) }
+}
+
+/// 日志行身份来自事实源，独立于排序、过滤与重复内容。
+struct DiagnosticLogEntry: Equatable, Identifiable, Sendable {
+  enum RowID: Hashable, Sendable {
+    case gui(Int)
+    // 原文也参与身份，避免文件原地截断重写后复用旧位置的选择。
+    case agent(file: UInt64, offset: UInt64, text: String)
+  }
+
+  let id: RowID
+  let line: LogLine
+}
+
+/// 报告准备的结构化产物：UI 只负责把 data 写入用户选择的文件。
+struct DiagnosticReportDraft: Equatable {
+  let data: Data
+  let suggestedFileName: String
+}
+
+enum DiagnosticReportFailure: Equatable, Error {
+  /// 报告文本无法编码为 UTF-8（module 不产生本地化 UI 字符串）。
+  case encodingFailed
+}
+
+/// 报告准备的 typed 结果：ready 携带可写入的草稿；safe projection 无法构造
+/// 时返回 typed failure，不产生报告。
+enum DiagnosticReportOutcome: Equatable {
+  case ready(DiagnosticReportDraft)
+  case failed(DiagnosticReportFailure)
+}
+
+/// 诊断工作流 module（Candidate 03）：诊断区的唯一 UI-facing
+/// seam。内部组合 runtime 事实、目录聚合事实、GUI 事件源、agent.log 尾部、
+/// 文件元数据、受管插件事实、时钟与纯报告 builder；内部事实源不暴露给 UI。
+/// 向 UI 提供：侧栏/详情共用的安全摘要、raw 日志视图 projection、读取生命
+/// 周期（代际守卫 + 取消）、报告准备（typed 结果）与导出完成登记。
+///
+/// 诊断收集是只读的：不启停代理、不写系统代理设置、不改目录与凭据。文件
+/// 写入、保存面板、剪贴板与 alert 属于 UI；只有用户选择的报告文件实际写入
+/// 成功后，UI 才调用 `noteExportCompleted` 登记既有的导出完成事件。
+@MainActor
+final class DiagnosticsWorkflow: ObservableObject {
+  /// 侧栏摘要与详情共用的最新安全 projection。
+  @Published private(set) var summary: DiagnosticSummary
+  /// 日志视图 projection：读取期间持续更新。
+  @Published private(set) var logView = DiagnosticLogView()
+
+  private let runtimeFacts: any ProxyRuntimeDiagnosticFacts
+  private let events: RuntimeEventStore
+  private let catalogFacts: @MainActor () -> DiagnosticCatalogFacts?
+  private let agentLogTail: () -> DiagnosticLogTail?
+  private let fileFacts: @MainActor () -> [DiagnosticFileFacts]
+  private let managedPlugins: @MainActor () -> [DiagnosticPluginFacts]
+  private let homePath: () -> String?
+  private let clock: () -> Date
+  private let reportRendering: (DiagnosticSnapshot) -> String?
+  /// 轮询间隔（生产 1 秒；测试注入更细粒度）。
+  private let pollInterval: Duration
+  /// 读取代际：新一轮读取使旧一轮的在途结果作废。
+  private var readGeneration = 0
+
+  init(
+    runtimeFacts: any ProxyRuntimeDiagnosticFacts,
+    events: RuntimeEventStore = .shared,
+    catalogFacts: @escaping @MainActor () -> DiagnosticCatalogFacts?,
+    agentLogTail: @escaping () -> DiagnosticLogTail? = {
+      DiagnosticLogIntake.readTailSnapshot(of: ApplicationSupportPaths.current.agentLogURL)
+    },
+    fileFacts: @escaping @MainActor () -> [DiagnosticFileFacts] =
+      DiagnosticsWorkflow.productionFileFacts,
+    managedPlugins: @escaping @MainActor () -> [DiagnosticPluginFacts] =
+      DiagnosticsWorkflow.productionManagedPlugins,
+    homePath: @escaping () -> String? = { NSHomeDirectory() },
+    clock: @escaping () -> Date = { Date() },
+    reportRendering: @escaping (DiagnosticSnapshot) -> String? = {
+      DiagnosticReportBuilder.markdown(from: $0)
+    },
+    pollInterval: Duration = .seconds(1)
+  ) {
+    self.runtimeFacts = runtimeFacts
+    self.events = events
+    self.catalogFacts = catalogFacts
+    self.agentLogTail = agentLogTail
+    self.fileFacts = fileFacts
+    self.managedPlugins = managedPlugins
+    self.homePath = homePath
+    self.clock = clock
+    self.reportRendering = reportRendering
+    self.pollInterval = pollInterval
+    summary = DiagnosticSummary(
+      proxyState: runtimeFacts.proxyState,
+      hasActiveTarget: runtimeFacts.hasActiveTarget)
+  }
+
+  /// 诊断读取生命周期（UI 在诊断区出现时驱动）：循环轮询直到任务被取消；
+  /// 每次进入递增代际，旧一轮的在途结果不再发布；
+  /// 共享实例保证侧栏与详情不重复轮询。
+  func readWhileActive() async {
+    readGeneration += 1
+    let generation = readGeneration
+    while !Task.isCancelled, generation == readGeneration {
+      refresh(generation: generation)
+      try? await Task.sleep(for: pollInterval)
+    }
+  }
+
+  /// 保存面板的建议文件名（UI 在打开面板前取用；时间戳来自注入时钟）。
+  func suggestedReportFileName() -> String {
+    "ShadowsocksX-NG2-诊断-\(fileStamp()).txt"
+  }
+
+  /// 准备脱敏诊断报告：只读采样各事实源（best-effort，单一来源缺失不阻止
+  /// 其他事实），经纯 builder 渲染并编码为 UTF-8。safe projection 无法构造
+  /// 时返回 typed failure，不生成报告。
+  func prepareReport() -> DiagnosticReportOutcome {
+    let text = reportRendering(makeSnapshot())
+    guard let data = text?.data(using: .utf8) else {
+      return .failed(.encodingFailed)
+    }
+    return .ready(DiagnosticReportDraft(data: data, suggestedFileName: suggestedReportFileName()))
+  }
+
+  /// 导出完成登记：只有用户选择的报告文件实际写入成功后由
+  /// UI 调用；打开导出面板或准备报告文本不算导出。
+  func noteExportCompleted() {
+    RuntimeLog.emit(.diagnosticsExported)
+  }
+
+  // MARK: - 事实采样与渲染（implementation，UI 不可见）
+
+  private func refresh(generation: Int) {
+    summary = DiagnosticSummary(
+      proxyState: runtimeFacts.proxyState,
+      hasActiveTarget: runtimeFacts.hasActiveTarget)
+    let entries = DiagnosticLogIntake.entries(events: events.snapshot, tail: agentLogTail())
+    guard generation == readGeneration, !Task.isCancelled else { return }
+    logView = DiagnosticLogView(entries: entries)
+  }
+
+  private func makeSnapshot() -> DiagnosticSnapshot {
+    var snapshot = DiagnosticSnapshot()
+    snapshot.generatedAt = clock()
+    snapshot.appVersion = Self.appVersion()
+    snapshot.systemSummary = Self.systemSummary()
+    snapshot.proxyState = runtimeFacts.proxyState
+    snapshot.hasActiveTarget = runtimeFacts.hasActiveTarget
+    snapshot.listen = runtimeFacts.listen
+    snapshot.runtimeDocumentSummary = runtimeFacts.contractSummary
+    snapshot.customRuleSummary = runtimeFacts.customRuleSummary
+    snapshot.catalogFacts = catalogFacts()
+    snapshot.fileFacts = fileFacts()
+    snapshot.managedPlugins = managedPlugins()
+    snapshot.eventLines = Self.reportEventLines(from: events.snapshot)
+    snapshot.homePathForRedaction = homePath()
+    return snapshot
+  }
+
+  /// 报告侧事件行：白名单清洗后的文本复用原始行的时间戳格式（原始 detail
+  /// 只留在日志视图 projection，ADR-0006）。
+  static func reportEventLines(from entries: [RuntimeEventStore.Entry]) -> [String] {
+    entries.suffix(reportEventLimit).compactMap { entry in
+      entry.event.diagnosticReportLine.map { entry.renderedLine(eventText: $0) }
+    }
+  }
+
+  private static let reportEventLimit = 200
+
+  /// 受管插件清单：静态事实表 + 可执行文件存在性（生成配置时的同一检查；
+  /// 参数与路径不入导出）。
+  private static func productionManagedPlugins() -> [DiagnosticPluginFacts] {
+    let provider = BundleManagedPluginProvider()
+    return ManagedPluginCatalog.plugins.map { info in
+      DiagnosticPluginFacts(
+        program: info.program,
+        version: info.dependency?.version ?? "",
+        present: provider.resolve(program: info.program) != nil)
+    }
+  }
+
+  private static func productionFileFacts() -> [DiagnosticFileFacts] {
+    [
+      DiagnosticFileCollector.collect(
+        label: "运行时目录", url: ApplicationSupportPaths.current.runtime.directoryURL),
+      DiagnosticFileCollector.collect(
+        label: "catalog.age", url: CatalogFileStore.defaultFileURL()),
+      DiagnosticFileCollector.collect(
+        label: "activation.json", url: ActivationStateFileStore.defaultFileURL()),
+      DiagnosticFileCollector.collect(
+        label: "sslocal-active.json", url: ApplicationSupportPaths.current.runtime.fileURL),
+      DiagnosticFileCollector.collect(
+        label: "agent.pid", url: ApplicationSupportPaths.current.runtime.pidFileURL),
+      DiagnosticFileCollector.collect(
+        label: "agent.log", url: ApplicationSupportPaths.current.agentLogURL),
+    ]
+  }
+
+  private static func appVersion() -> String? {
+    guard let info = Bundle.main.infoDictionary else { return nil }
+    let parts = [
+      (info["CFBundleShortVersionString"] as? String).map { "版本 \($0)" },
+      (info["CFBundleVersion"] as? String).map { "构建 \($0)" },
+    ].compactMap { $0 }
+    return parts.isEmpty ? nil : parts.joined(separator: "，")
+  }
+
+  private static func systemSummary() -> String {
+    let arch: String
+    #if arch(arm64)
+      arch = "arm64"
+    #elseif arch(x86_64)
+      arch = "x86_64"
+    #else
+      arch = "未知架构"
+    #endif
+    return "macOS \(ProcessInfo.processInfo.operatingSystemVersionString)，\(arch)"
+  }
+
+  private func fileStamp() -> String {
+    let formatter = DateFormatter()
+    formatter.locale = Locale(identifier: "en_US_POSIX")
+    formatter.dateFormat = "yyyyMMdd-HHmmss"
+    return formatter.string(from: clock())
+  }
+}
+
+// MARK: - 生产 runtime 事实适配
+
+extension ProxyRuntimeController: ProxyRuntimeDiagnosticFacts {
+  /// 控制器状态 → 诊断安全呈现：不透传任意错误 detail；监听地址只以
+  /// 回环/非回环两态进入导出，原始错误文本一律丢弃）。系统代理写入失败与
+  /// 激活拒绝优先于运行状态呈现（两个状态面分开后仍归入同一组
+  /// 固定诊断类别）。
+  var proxyState: DiagnosticProxyState {
+    if systemProxyState.hasOperationFailure {
+      return .systemProxyFailed
+    }
+    if let failure = lastActivationFailure {
+      return .activationFailed(reason: AppPresentation.message(for: failure))
+    }
+    switch state {
+    case .off:
+      return .off
+    case .starting:
+      return .starting
+    case .running:
+      return .running
+    case .firewallBlocked:
+      return .firewallBlocked
+    case .launchFailed:
+      return .launchFailed
+    case .requiresApproval:
+      return .requiresApproval
+    case .serviceFailed:
+      return .serviceFailed
+    }
+  }
+
+  var hasActiveTarget: Bool { isActiveTargetPresent }
+
+  var listen: RuntimeListenFacts { RuntimeListenFacts(listen: listenSettings) }
+
+  var contractSummary: String? { runtimeDocumentSummary() }
+
+  var customRuleSummary: CustomRuleSummary? { readCustomRuleSummary() }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/LocalInterfaceFacts.swift b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/LocalInterfaceFacts.swift
new file mode 100644
index 000000000..36bfa6bba
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/LocalInterfaceFacts.swift
@@ -0,0 +1,65 @@
+import Combine
+import Foundation
+
+// MARK: - 原始接口事实
+
+/// IPv6 地址的内核标志（经 `SIOCGIFAFLAG_IN6` 逐地址查询，netinet6/in6_var.h
+/// 的 `IN6_IFF_*` 子集）。仅 IPv6 单播地址携带；IPv4 或查询失败为 nil。
+struct LocalInterfaceV6Flags: OptionSet, Sendable {
+  let rawValue: Int32
+  /// `IN6_IFF_AUTOCONF`：SLAAC 自动配置地址。
+  static let autoconf = Self(rawValue: IN6_IFF_AUTOCONF)
+  /// `IN6_IFF_TEMPORARY`：RFC 4941 隐私临时地址（会轮换）。
+  static let temporary = Self(rawValue: IN6_IFF_TEMPORARY)
+  /// `IN6_IFF_SECURED`：稳定接口标识生成的地址。
+  static let secured = Self(rawValue: IN6_IFF_SECURED)
+  /// `IN6_IFF_DYNAMIC`：DHCPv6 分配的地址。
+  static let dynamic = Self(rawValue: IN6_IFF_DYNAMIC)
+}
+
+/// 单个本机接口单播地址的原始事实：族与 IPv6 标记已判明，过滤、排序与
+/// 取舍全部由工作流层策略完成。
+struct LocalInterfaceAddress: Equatable, Sendable {
+  enum Family: Equatable, Sendable {
+    case ipv4
+    case ipv6
+  }
+
+  /// 规范化 IP 文本（inet_ntop 呈现形，无作用域后缀）。
+  let address: String
+  let family: Family
+  /// IPv6 链路本地（fe80::/10）；IPv4 链路本地不置位（属于允许接口的单播
+  /// 地址时可以列出）。
+  let isIPv6LinkLocal: Bool
+  /// IPv6 地址内核标志（含临时地址、DHCPv6 等类型事实）；IPv4 或查询失败
+  /// 为 nil——nil 不触发过滤，也不注记。
+  let v6Flags: LocalInterfaceV6Flags?
+}
+
+/// 单个本机接口的原始事实：系统适配器逐接口提供，类型白名单、
+/// 地址族过滤、名称回退与排序均不在适配器内发生。
+struct LocalInterfaceFacts: Equatable, Sendable {
+  /// BSD 接口名（lo0/en0/…）：地址关联与地址身份的锚点。
+  let bsdName: String
+  /// IFF_LOOPBACK。
+  let isLoopback: Bool
+  /// SCNetworkInterfaceGetInterfaceType 原文；无 SystemConfiguration 映射
+  /// （如回环）为 nil。
+  let interfaceType: String?
+  /// SCNetworkInterfaceGetLocalizedDisplayName；缺失为 nil。
+  let localizedName: String?
+  /// 该接口的全部单播地址（未过滤）。
+  let addresses: [LocalInterfaceAddress]
+}
+
+/// 本机接口事实来源缝：唯一的工作流层可注入事实来源，统一
+/// 提供接口地址、类型、名称及变化通知；系统 API 查询细节封装于生产适配器，
+/// 不为每个底层 API 另设 mock 协议。测试注入可编程替身。
+@MainActor
+protocol LocalInterfaceFactsReading: AnyObject {
+  /// 当前全部本机接口的原始事实（未过滤、未排序）；枚举失败为 nil，
+  /// 调用方按「仅兼容回环候选」退化。
+  var interfaces: [LocalInterfaceFacts]? { get }
+  /// 接口事实变化通知（网络变化后发值）；生产实现去抖，fake 同步手动。
+  var changes: AnyPublisher<Void, Never> { get }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/ProxyControlAdapters.swift b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/ProxyControlAdapters.swift
new file mode 100644
index 000000000..e0b0781e3
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/ProxyControlAdapters.swift
@@ -0,0 +1,180 @@
+import Combine
+import Foundation
+
+/// 生产运行时 adapter：现有 `ProxyRuntimeController` 与其系统代理
+/// 观察机（`SystemProxyObserver`，ADR-0022 策略机）的唯一包装，由应用组合根
+/// 接线。只把既有能力与观察投影到 workflow 缝上，不复制状态机、generation、
+/// 健康门禁与系统代理生命周期语义。
+@MainActor
+final class ControllerProxyRuntimeAdapter: ProxyRuntimeAdapting {
+  private let controller: ProxyRuntimeController
+
+  init(controller: ProxyRuntimeController) {
+    self.controller = controller
+  }
+
+  var runtimeFacts: ProxyRuntimeFacts { controller.runtimeFacts }
+
+  var agentIntentEnabled: Bool { controller.agentIntentEnabled }
+
+  var activationFailure: ActivationFailure? { controller.lastActivationFailure }
+
+  var systemProxyIntentEnabled: Bool { controller.systemProxyIntentEnabled }
+
+  var systemProxyApplication: SystemProxyApplicationFacts {
+    controller.systemProxyState
+  }
+
+  var systemProxyInspection: SystemProxyInspectionFacts { controller.systemProxyInspection }
+
+  var systemProxyApprovalRequired: Bool { controller.systemProxyApprovalRequired }
+
+  var proxyMode: ProxyMode { controller.proxyMode }
+
+  var rulePreset: RulePreset { controller.rulePreset }
+
+  var skippedInvalidServerCount: Int { controller.skippedServers.count }
+
+  var activeTargetID: NodeID? { controller.activeTargetID }
+
+  var httpExportCapability: HTTPExportCapability {
+    HTTPExportCapability(listen: controller.listenSettings)
+  }
+
+  /// `password()` 契约 = 可直接用于 userinfo 的秘密；此处不再做形状校验
+  /// （凭据暴露边界不承诺防同用户篡改；写明文凭据文件前另有 `auth.isValid` 把关）。
+  func terminalLANPassword() throws -> String {
+    guard let password = controller.listenSettings.lan.password
+    else {
+      throw TerminalCommandFailure.credentialUnreadable
+    }
+    return password
+  }
+
+  var listenFacts: RuntimeListenFacts {
+    RuntimeListenFacts(listen: controller.listenSettings)
+  }
+
+  /// 控制器与系统代理观察机各持一条 didChange 事实通道（同一主队列轮内多次
+  /// 写合并为一次，冲洗晚于同步轮）：合并后交 workflow 整体重观察，不会读到
+  /// 半程状态。系统代理呈现事实的存储与发布在观察机上，其通道并入同一链。
+  var changes: AnyPublisher<Void, Never> {
+    Publishers.Merge(
+      controller.factChanges.changes,
+      controller.systemProxyObserver.factChanges.changes
+    )
+    .eraseToAnyPublisher()
+  }
+
+  func resyncOnLaunch() async {
+    await controller.resyncOnLaunch()
+  }
+
+  func setAgentEnabled(_ enabled: Bool) async {
+    await controller.setAgentEnabled(enabled)
+  }
+
+  func setSystemProxyEnabled(_ enabled: Bool) async {
+    await controller.setSystemProxyEnabled(enabled)
+  }
+
+  func openSystemProxyHelperApproval() async {
+    await controller.systemProxyObserver.openSystemProxyHelperApproval()
+  }
+
+  func repairSystemProxy() async { await controller.systemProxyObserver.repairSystemProxy() }
+  func retrySystemProxyClear() async {
+    await controller.systemProxyObserver.retrySystemProxyClear()
+  }
+  func recheckSystemProxy() async { await controller.systemProxyObserver.recheckSystemProxy() }
+
+  func setProxyMode(_ mode: ProxyMode) async {
+    await controller.setProxyMode(mode)
+  }
+
+  func setRulePreset(_ preset: RulePreset) async {
+    await controller.setRulePreset(preset)
+  }
+}
+
+/// HTTP 导出能力的唯一派生点：监听设置 → 可复制的 http/https 双导出行。
+/// 此导出行始终指向本地监听回环 127.0.0.1，与终端命令地址无关（ADR-0034）。
+extension HTTPExportCapability {
+  init(listen: ProxyListeningConfiguration) {
+    let endpoint = "http://127.0.0.1:\(listen.httpPort)"
+    self.init(copyableLine: "export http_proxy=\(endpoint);export https_proxy=\(endpoint);")
+  }
+}
+
+/// 终端代理环境变量命令的唯一派生点：已保存监听事实 + 生效
+/// 命令地址 → 各种 shell 的可复制命令。HTTP/HTTPS 用已保存 HTTP 端口，
+/// SOCKS 用已保存 SOCKS 端口；变量集合、小写变量名、socks5
+/// 协议与 no_proxy 内容保持不变；IPv6 URL 使用方括号。
+extension TerminalProxyEnvironmentCommands {
+  init(
+    listen: RuntimeListenFacts, commandAddress: TerminalCommandAddress,
+    password: () throws -> String = { throw TerminalCommandFailure.credentialUnreadable }
+  ) {
+    let host = commandAddress.address
+    let urlHost = host.contains(":") ? "[\(host)]" : host
+    let isLAN = host != "127.0.0.1"
+    let httpPort = isLAN ? listen.lan.httpPort : listen.httpPort
+    let socksPort = isLAN ? listen.lan.socksPort : listen.socksPort
+    var userInfo = ""
+    if isLAN && listen.lan.authenticationEnabled {
+      do {
+        // password() 契约 = 可用秘密；不再重验形状。
+        let secret = try password()
+        let allowed = CharacterSet(
+          charactersIn: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~")
+        guard
+          let username = listen.lan.username.addingPercentEncoding(withAllowedCharacters: allowed),
+          let encodedPassword = secret.addingPercentEncoding(withAllowedCharacters: allowed)
+        else {
+          throw TerminalCommandFailure.credentialUnreadable
+        }
+        userInfo = "\(username):\(encodedPassword)@"
+      } catch {
+        self.init(
+          zshBash: "", fish: "", nushell: "", windowsCMD: "", windowsPowerShell: "",
+          failure: .credentialUnreadable)
+        return
+      }
+    }
+    let httpEndpoint = "http://\(userInfo)\(urlHost):\(httpPort)"
+    let socksEndpoint = "socks5://\(userInfo)\(urlHost):\(socksPort)"
+    let variables = [
+      (name: "http_proxy", value: httpEndpoint),
+      (name: "https_proxy", value: httpEndpoint),
+      (name: "all_proxy", value: socksEndpoint),
+      (name: "no_proxy", value: "localhost,127.0.0.1,::1,.local"),
+    ]
+    let windowsAssignments = variables.map { "set \"\($0.name)=\($0.value)\"" }
+    // CMD 会把 %XX% 当作环境变量展开。用交互 FOR 变量插入字面百分号，
+    // 不写临时环境变量；逐行赋值使最长允许凭据仍不超过单行长度限制。
+    let windowsCMD =
+      userInfo.contains("%")
+      ? windowsAssignments.map { assignment in
+        assignment.contains("%")
+          ? "for %P in (\"%\") do \(assignment.replacingOccurrences(of: "%", with: "%~P"))"
+          : assignment
+      }.joined(separator: "\r\n")
+      : windowsAssignments.joined(separator: " & ")
+    self.init(
+      zshBash: variables.map { "export \($0.name)='\($0.value)'" }.joined(separator: "; ") + ";",
+      fish: variables.map { "set -gx \($0.name) '\($0.value)'" }.joined(separator: "; ") + ";",
+      nushell: variables.map { "$env.\($0.name) = '\($0.value)'" }.joined(separator: "; ") + ";",
+      windowsCMD: windowsCMD,
+      windowsPowerShell:
+        variables.map { "$env:\($0.name) = '\($0.value)'" }.joined(separator: "; ") + ";")
+  }
+}
+
+/// 目录侧唯一的目标事实出口（窄缝）：存在性 + 显示名路径摘要；
+/// 完整目录树、订阅对象与凭据不出此接口。
+extension CatalogWorkflow: ProxyTargetFactsReading {
+  func activeTargetFacts(for targetID: NodeID?) -> ProxyActiveTargetFacts? {
+    guard let targetID else { return nil }
+    return ProxyActiveTargetFacts(id: targetID, pathSummary: tree.pathSummary(for: targetID))
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/ProxyControlWorkflow.swift b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/ProxyControlWorkflow.swift
new file mode 100644
index 000000000..11dc69875
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/ProxyControlWorkflow.swift
@@ -0,0 +1,352 @@
+import Combine
+import Foundation
+
+// MARK: - Snapshot 投影
+
+/// 可安全复制的 HTTP 导出能力：shell 可直接 source 的 http/https
+/// 双导出行。原始监听设置与内部端口语义不进 snapshot。复制是 UI 的副作用，
+/// workflow 不触剪贴板。
+struct HTTPExportCapability: Equatable, Sendable {
+  /// 已就绪的导出行（UI 原样复制，不自行拼装）。
+  let copyableLine: String
+}
+
+/// 首页可复制的 shell 环境变量设置命令。不同 shell 的语法由 workflow 一次投影，
+/// 呈现层只选择格式并执行剪贴板副作用。
+enum TerminalCommandFailure: Error, Equatable, Sendable {
+  case credentialUnreadable
+  case addressUnavailable
+}
+
+struct TerminalProxyEnvironmentCommands: Equatable, Sendable {
+  let zshBash: String
+  let fish: String
+  let nushell: String
+  let windowsCMD: String
+  let windowsPowerShell: String
+  var failure: TerminalCommandFailure?
+}
+
+enum TerminalCommandShell: CaseIterable, Hashable, Sendable {
+  case zshBash, fish, nushell, windowsCMD, windowsPowerShell
+
+  func command(from commands: TerminalProxyEnvironmentCommands) -> String {
+    switch self {
+    case .zshBash: commands.zshBash
+    case .fish: commands.fish
+    case .nushell: commands.nushell
+    case .windowsCMD: commands.windowsCMD
+    case .windowsPowerShell: commands.windowsPowerShell
+    }
+  }
+}
+
+/// 活动目标安全事实：存在性 + 可展示路径摘要。身份是不透明
+/// `NodeID`（级联勾选用）；不含凭据、原始配置 URL 或目录树结构。路径摘要
+/// 是目录 projection 的显示名（导入缺名的服务器叶子以地址端口为名称，与目录树
+/// 呈现一致），不额外携带配置细节。
+struct ProxyActiveTargetFacts: Equatable, Sendable {
+  let id: NodeID
+  /// 根 → 叶显示名路径（" / " 连接）；目标已不在当前目录树中为 nil。
+  let pathSummary: String?
+}
+
+/// 代理控制的统一 UI-facing snapshot：一次 workflow
+/// observation 产出的整体安全投影，所有字段来自同一时间点。agent 意图/运行
+/// 状态与系统代理意图/实际应用是四个独立事实，两个开关互不代替；不含控制
+/// 器内部状态枚举、`ProxyRuntimeSettings`、完整目录树、凭据、原始 URL、原始日志或
+/// 本地化文案；失败保持 typed facts，成句呈现由 App presentation edge 负责。
+struct ProxyControlSnapshot: Equatable, Sendable {
+  /// Agent 运行事实：状态类别、「在跑」投影与 typed 失败。
+  let runtime: ProxyRuntimeFacts
+  /// Agent 开关意图（持久化；默认开启）。
+  let agentIntentEnabled: Bool
+  /// 最近一次激活拒绝或目标清除的点名原因（独立于运行状态；agent 可能仍在
+  /// 监听）。
+  let activationFailure: ActivationFailure?
+  /// 系统代理开关意图（持久化；默认关闭）。
+  let systemProxyIntentEnabled: Bool
+  /// 系统代理实际应用状态（与 agent 运行状态分开呈现）。
+  let systemProxyApplication: SystemProxyApplicationFacts
+  /// Helper approval blockage, including failed cleanup after intent is off.
+  let systemProxyApprovalRequired: Bool
+  var systemProxyInspection = SystemProxyInspectionFacts()
+  /// 当前已应用的代理模式（持久化成功的模式）。
+  let proxyMode: ProxyMode
+  /// 规则模式内选择的规则预设；仅规则模式呈现。
+  var rulePreset: RulePreset = .gfwlist
+  var ruleDefaultAction: RuleDefaultAction { rulePreset.defaultAction }
+  /// 可用模式由 Domain 单点策略投影；UI 不自行判断可用性。
+  let availableModes: [ProxyMode]
+  /// 活动目标事实；无活动目标为 nil。
+  let activeTarget: ProxyActiveTargetFacts?
+  /// 最近一次激活预检或目录收敛跳过的无效服务器数量。
+  let skippedInvalidServerCount: Int
+  /// HTTP 导出能力。
+  let httpExport: HTTPExportCapability
+  /// 首页命令地址选择器：可见性、候选与生效选择。
+  let commandAddressPicker: TerminalCommandAddressPicker
+  /// 首页终端代理环境变量命令；端点地址为生效
+  /// 命令地址选择，端口取已保存监听事实。
+  let terminalProxyEnvironmentCommands: TerminalProxyEnvironmentCommands
+
+  /// Windows 格式供其他设备使用，只在局域网入口与网络地址都有效时提供。
+  var terminalCommandShells: [TerminalCommandShell] {
+    commandAddressPicker.isVisible && commandAddressPicker.selected.address != "127.0.0.1"
+      ? TerminalCommandShell.allCases : [.zshBash, .fish, .nushell]
+  }
+}
+
+// MARK: - 适配缝
+
+/// 生产运行时适配缝：包装现有 `ProxyRuntimeController` 的
+/// 能力与观察。不复制状态机、generation 与健康门禁；意图持久化先行、失败
+/// 清理与系统代理生命周期语义全部留在控制器；测试注入确定性 fake。
+@MainActor
+protocol ProxyRuntimeAdapting: AnyObject {
+  /// Agent 运行事实（状态类别 + 「在跑」投影 + typed 失败）。
+  var runtimeFacts: ProxyRuntimeFacts { get }
+  /// Agent 开关意图。
+  var agentIntentEnabled: Bool { get }
+  /// 最近一次激活拒绝/目标清除的点名原因。
+  var activationFailure: ActivationFailure? { get }
+  /// 系统代理开关意图。
+  var systemProxyIntentEnabled: Bool { get }
+  /// 系统代理实际应用状态。
+  var systemProxyApplication: SystemProxyApplicationFacts { get }
+  /// 特权 helper 是否等待登录项批准。
+  var systemProxyApprovalRequired: Bool { get }
+  var systemProxyInspection: SystemProxyInspectionFacts { get }
+  /// 当前已应用的代理模式。
+  var proxyMode: ProxyMode { get }
+  /// 规则模式内选择的规则预设。
+  var rulePreset: RulePreset { get }
+  /// 最近一次激活预检或目录收敛跳过的无效服务器数量。
+  var skippedInvalidServerCount: Int { get }
+  /// 当前活动目标身份；无目标为 nil（目录侧目标事实的唯一输入）。
+  var activeTargetID: NodeID? { get }
+  /// 可安全复制的 HTTP 导出能力。
+  var httpExportCapability: HTTPExportCapability { get }
+  /// 已保存监听事实：命令地址候选过滤与命令生成的数据来源。
+  var listenFacts: RuntimeListenFacts { get }
+  func terminalLANPassword() throws -> String
+  /// 运行时事实变化通知：目录驱动、设置变更或运行时收敛导致事实变化后
+  /// 发值。生产实现合并控制器与观察机的 didChange 事实通道（同一主队列轮
+  /// 多次写合并为一次）；fake 同步发值。workflow 以此触发整体重观察。
+  var changes: AnyPublisher<Void, Never> { get }
+
+  /// 启动重同步（GUI 重启后的注册态重校验）。
+  func resyncOnLaunch() async
+  /// Agent 开关命令。
+  func setAgentEnabled(_ enabled: Bool) async
+  /// 系统代理开关命令。
+  func setSystemProxyEnabled(_ enabled: Bool) async
+  /// 打开 helper 的登录项批准路径。
+  func openSystemProxyHelperApproval() async
+  func repairSystemProxy() async
+  func retrySystemProxyClear() async
+  func recheckSystemProxy() async
+  func setProxyMode(_ mode: ProxyMode) async
+  /// 规则模式子选项命令。
+  func setRulePreset(_ preset: RulePreset) async
+}
+
+/// 窄的目录目标事实缝：目录侧只向代理控制提供活动
+/// 目标的存在性与安全路径摘要；完整目录树、订阅对象与凭据不出此接口。
+@MainActor
+protocol ProxyTargetFactsReading: AnyObject {
+  /// 活动目标安全事实：无活动目标为 nil；目标不在当前目录树中时摘要为 nil。
+  func activeTargetFacts(for targetID: NodeID?) -> ProxyActiveTargetFacts?
+}
+
+// MARK: - Workflow
+
+/// 代理控制工作流 module：状态菜单与主窗口共用的唯一
+/// UI-facing 代理控制 seam。围绕现有 `ProxyRuntimeController` 建立稳定
+/// typed interface：整体发布的 `ProxyControlSnapshot` 与 typed async
+/// commands；命令完成后重新发布完整 snapshot，预期运行时失败以
+/// `RuntimeFailureFacts` 进入 snapshot。不拆分控制器，也不持有第二套运行时
+/// 状态机；活动目标树、目标激活与订阅刷新仍由 CatalogWorkflow 负责，安全
+/// 诊断与导出仍由 DiagnosticsWorkflow 负责。
+@MainActor
+final class ProxyControlWorkflow: ObservableObject {
+  /// 最新整体 snapshot（唯一读取面；每次观察整体替换）。
+  @Published private(set) var snapshot: ProxyControlSnapshot
+
+  private let runtime: any ProxyRuntimeAdapting
+  private let targetFacts: any ProxyTargetFactsReading
+  private let interfaceFacts: any LocalInterfaceFactsReading
+  /// 会话内命令地址选择：生命周期长于首页视图，不持久化；
+  /// 每次观察与最新候选对账，失效即回退默认回环。
+  private var commandAddressSelection: TerminalCommandAddressIdentity?
+  private var cancellables: Set<AnyCancellable> = []
+
+  init(
+    runtime: any ProxyRuntimeAdapting,
+    targetFacts: any ProxyTargetFactsReading,
+    interfaceFacts: any LocalInterfaceFactsReading
+  ) {
+    self.runtime = runtime
+    self.targetFacts = targetFacts
+    self.interfaceFacts = interfaceFacts
+    let observation = Self.makeSnapshot(
+      runtime: runtime, targetFacts: targetFacts, interfaceFacts: interfaceFacts,
+      selection: nil)
+    commandAddressSelection = observation.selection
+    snapshot = observation.snapshot
+    runtime.changes
+      .sink { [weak self] _ in self?.republish() }
+      .store(in: &cancellables)
+    interfaceFacts.changes
+      .sink { [weak self] _ in self?.republish() }
+      .store(in: &cancellables)
+  }
+
+  // MARK: - 观察与命令
+
+  /// 启动观察：GUI 重启后的注册态重校验 + 整体重发布（组合根在启动时调用）。
+  func resyncOnLaunch() async {
+    await runtime.resyncOnLaunch()
+    republish()
+  }
+
+  /// Agent 开关：命令完成后返回并发布完整新 snapshot。
+  @discardableResult
+  func setAgentEnabled(_ enabled: Bool) async -> ProxyControlSnapshot {
+    await runtime.setAgentEnabled(enabled)
+    return republish()
+  }
+
+  /// 系统代理开关：命令完成后返回并发布完整新 snapshot。
+  @discardableResult
+  func setSystemProxyEnabled(_ enabled: Bool) async -> ProxyControlSnapshot {
+    await runtime.setSystemProxyEnabled(enabled)
+    return republish()
+  }
+
+  /// 打开 helper 批准路径并重试收敛；完成后整体重发布。
+  @discardableResult
+  func openSystemProxyHelperApproval() async -> ProxyControlSnapshot {
+    await runtime.openSystemProxyHelperApproval()
+    return republish()
+  }
+
+  @discardableResult
+  func repairSystemProxy() async -> ProxyControlSnapshot {
+    await runtime.repairSystemProxy()
+    return republish()
+  }
+
+  @discardableResult
+  func retrySystemProxyClear() async -> ProxyControlSnapshot {
+    await runtime.retrySystemProxyClear()
+    return republish()
+  }
+
+  @discardableResult
+  func recheckSystemProxy() async -> ProxyControlSnapshot {
+    await runtime.recheckSystemProxy()
+    return republish()
+  }
+
+  /// 切换代理模式：no-op 语义由控制器既有入口裁定；
+  /// 完成后整体重发布。持久化失败保留旧模式，失败以 typed fact 呈现。
+  @discardableResult
+  func setProxyMode(_ mode: ProxyMode) async -> ProxyControlSnapshot {
+    await runtime.setProxyMode(mode)
+    return republish()
+  }
+
+  /// 切换规则预设：完成后整体重发布。
+  @discardableResult
+  func setRulePreset(_ preset: RulePreset) async -> ProxyControlSnapshot {
+    await runtime.setRulePreset(preset)
+    return republish()
+  }
+
+  // MARK: - 首页命令地址
+
+  /// 下拉框选址：仅记录会话内选择并整体重发布；不触碰代理运行状态、监听
+  /// 设置与系统代理。
+  @discardableResult
+  func selectCommandAddress(_ address: TerminalCommandAddress) -> ProxyControlSnapshot {
+    commandAddressSelection = address.identity
+    return republish()
+  }
+
+  /// 刷新命令地址候选并整体重发布（进入首页与复制前调用；网络变化经接口
+  /// 事实变化通知自动刷新）。失效选择回退到本地地址。
+  @discardableResult
+  func refreshTerminalCommands() -> TerminalProxyEnvironmentCommands {
+    republish().terminalProxyEnvironmentCommands
+  }
+
+  /// 复制前核实按钮呈现时的 IP 仍有效；回退只更新界面，不改写剪贴板。
+  /// 显式传入原地址身份，防止网络通知先回退 snapshot 后复制旧按钮。
+  func prepareTerminalCommandsForCopy(expectedAddress: TerminalCommandAddressIdentity) throws
+    -> TerminalProxyEnvironmentCommands
+  {
+    let commands = refreshTerminalCommands()
+    guard snapshot.commandAddressPicker.selected.identity == expectedAddress else {
+      throw TerminalCommandFailure.addressUnavailable
+    }
+    if let failure = commands.failure { throw failure }
+    return commands
+  }
+
+  // MARK: - 整体观察（implementation，UI 不可见）
+
+  /// 一次 observation 内整体拼装 snapshot；任何单一事实变化后整体替换，
+  /// 不暴露「新模式配旧状态」的混合结果。命令地址选择在观察内与最新候选
+  /// 对账，回退结果同步回会话状态（失效选择不随网络恢复复活）。
+  @discardableResult
+  private func republish() -> ProxyControlSnapshot {
+    let observation = Self.makeSnapshot(
+      runtime: runtime, targetFacts: targetFacts, interfaceFacts: interfaceFacts,
+      selection: commandAddressSelection)
+    commandAddressSelection = observation.selection
+    snapshot = observation.snapshot
+    return snapshot
+  }
+
+  /// 一次 observation：整体拼装 snapshot 并对账命令地址选择，返回生效选择
+  /// （失效选择已回退到当前监听方式的默认回环地址）。
+  private static func makeSnapshot(
+    runtime: any ProxyRuntimeAdapting,
+    targetFacts: any ProxyTargetFactsReading,
+    interfaceFacts: any LocalInterfaceFactsReading,
+    selection: TerminalCommandAddressIdentity?
+  ) -> (snapshot: ProxyControlSnapshot, selection: TerminalCommandAddressIdentity) {
+    let listenFacts = runtime.listenFacts
+    let picker = TerminalCommandAddressPolicy.picker(
+      mode: listenFacts.lan.effectiveMode,
+      interfaces: interfaceFacts.interfaces,
+      selection: selection)
+    return (
+      ProxyControlSnapshot(
+        runtime: runtime.runtimeFacts,
+        agentIntentEnabled: runtime.agentIntentEnabled,
+        activationFailure: runtime.activationFailure,
+        systemProxyIntentEnabled: runtime.systemProxyIntentEnabled,
+        systemProxyApplication: runtime.systemProxyApplication,
+        systemProxyApprovalRequired: runtime.systemProxyApprovalRequired,
+        systemProxyInspection: runtime.systemProxyInspection,
+        proxyMode: runtime.proxyMode,
+        rulePreset: runtime.rulePreset,
+        availableModes: ProxyMode.availableModes,
+        activeTarget: targetFacts.activeTargetFacts(for: runtime.activeTargetID),
+        skippedInvalidServerCount: runtime.skippedInvalidServerCount,
+        httpExport: runtime.httpExportCapability,
+        commandAddressPicker: picker,
+        terminalProxyEnvironmentCommands: TerminalProxyEnvironmentCommands(
+          listen: listenFacts, commandAddress: picker.selected,
+          password: { try runtime.terminalLANPassword() })),
+      picker.selected.identity
+    )
+  }
+}
+
+// 未提供凭据读取能力的 adapter 必须拒绝认证命令，不能复制无密码的替代值。
+extension ProxyRuntimeAdapting {
+  func terminalLANPassword() throws -> String { throw TerminalCommandFailure.credentialUnreadable }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/SystemInterfaceFactsProvider.swift b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/SystemInterfaceFactsProvider.swift
new file mode 100644
index 000000000..b7d5cecdc
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/SystemInterfaceFactsProvider.swift
@@ -0,0 +1,240 @@
+import Combine
+import Foundation
+import SystemConfiguration
+
+/// 生产本机接口事实来源：getifaddrs 提供当前启用接口、回环
+/// 标记与单播地址（族与 IPv6 链路本地判定），SCNetworkInterfaceCopyAll 以
+/// BSD 名关联系统接口类型与本地化名称，SCDynamicStore 监视接口状态变化。
+/// 所有系统 API 细节封装于此；类型白名单与过滤排序在工作流层策略。
+@MainActor
+final class SystemInterfaceFactsProvider: LocalInterfaceFactsReading {
+  /// getifaddrs 只看得到链路层事实；「当前启用」以 IFF_UP 判定，未启用
+  /// 接口不进入事实。
+  var interfaces: [LocalInterfaceFacts]? { Self.enumerate() }
+
+  private let changeSubject = PassthroughSubject<Void, Never>()
+  private let changesPublisher: AnyPublisher<Void, Never>
+  /// SCDynamicStore 过渡期会按变化键连发事件，去抖避免反复枚举。
+  var changes: AnyPublisher<Void, Never> { changesPublisher }
+
+  private let observation = InterfaceFactsObservation()
+
+  init() {
+    changesPublisher =
+      changeSubject
+      .debounce(for: .milliseconds(250), scheduler: DispatchQueue.main)
+      .eraseToAnyPublisher()
+    startObserving()
+  }
+
+  private func startObserving() {
+    // 变化通知是尽力而为的增强：监视创建失败（罕见）只失去推送刷新，
+    // 进入首页与复制前刷新仍保证候选新鲜。
+    var context = SCDynamicStoreContext(
+      version: 0,
+      info: Unmanaged.passUnretained(observation).toOpaque(),
+      retain: nil,
+      release: nil,
+      copyDescription: nil)
+    guard
+      let store = SCDynamicStoreCreate(
+        kCFAllocatorDefault, "ShadowsocksX-NG2.InterfaceFacts" as CFString,
+        interfaceFactsDynamicStoreCallback, &context)
+    else { return }
+    // 接口状态键（State:/Network/Interface/<bsd>/IPv4|IPv6）覆盖地址增删与
+    // 接口启停；全局 IPv4/IPv6 键覆盖主服务切换。
+    let globalKeys =
+      [
+        "State:/Network/Global/IPv4" as CFString, "State:/Network/Global/IPv6" as CFString,
+      ] as CFArray
+    let patterns = ["State:/Network/Interface/.*"] as CFArray
+    guard SCDynamicStoreSetNotificationKeys(store, globalKeys, patterns) else { return }
+    guard SCDynamicStoreSetDispatchQueue(store, DispatchQueue.main) else { return }
+    observation.attach(store)
+    observation.setHandler { [weak self] in self?.changeSubject.send() }
+  }
+
+  // MARK: - 枚举
+
+  private static func enumerate() -> [LocalInterfaceFacts]? {
+    var interfacesPtr: UnsafeMutablePointer<ifaddrs>?
+    guard getifaddrs(&interfacesPtr) == 0, let first = interfacesPtr else { return nil }
+    defer { freeifaddrs(first) }
+
+    // IPv6 地址标志查询共用一个 DGRAM socket；打开失败只失去标志事实
+    // （nil = 不过滤、不注记），不阻断枚举。
+    let flagsSocket = socket(AF_INET6, SOCK_DGRAM, 0)
+    defer {
+      if flagsSocket >= 0 {
+        close(flagsSocket)
+      }
+    }
+
+    // 按首次出现顺序逐接口累积；同一接口的多个地址条目归并到同一事实。
+    var order: [String] = []
+    var loopbackByBSDName: [String: Bool] = [:]
+    var addressesByBSDName: [String: [LocalInterfaceAddress]] = [:]
+    var pointer: UnsafeMutablePointer<ifaddrs>? = first
+    while let current = pointer {
+      pointer = current.pointee.ifa_next
+      guard let name = current.pointee.ifa_name, let socketAddress = current.pointee.ifa_addr
+      else { continue }
+      let bsdName = String(cString: name)
+      // Darwin 的 ifaddrs.ifa_flags 是值字段。
+      let flags = Int32(current.pointee.ifa_flags)
+      guard flags & IFF_UP == IFF_UP else { continue }
+      if loopbackByBSDName[bsdName] == nil {
+        order.append(bsdName)
+        loopbackByBSDName[bsdName] = flags & IFF_LOOPBACK == IFF_LOOPBACK
+      }
+      if let address = interfaceAddress(socketAddress, flagsSocket: flagsSocket, bsdName: bsdName) {
+        addressesByBSDName[bsdName, default: []].append(address)
+      }
+    }
+
+    let metadata = systemInterfaceMetadata()
+    return order.map { bsdName in
+      LocalInterfaceFacts(
+        bsdName: bsdName,
+        isLoopback: loopbackByBSDName[bsdName] ?? false,
+        interfaceType: metadata[bsdName]?.type,
+        localizedName: metadata[bsdName]?.name,
+        addresses: addressesByBSDName[bsdName] ?? [])
+    }
+  }
+
+  /// 单个地址条目的族与链路本地判定；非 IPv4/IPv6 条目（链路层等）或无法
+  /// 规范化的地址为 nil。
+  private static func interfaceAddress(
+    _ socketAddress: UnsafeMutablePointer<sockaddr>, flagsSocket: Int32, bsdName: String
+  ) -> LocalInterfaceAddress? {
+    switch socketAddress.pointee.sa_family {
+    case sa_family_t(AF_INET):
+      let socket = socketAddress.withMemoryRebound(to: sockaddr_in.self, capacity: 1) {
+        $0.pointee
+      }
+      guard let text = addressText(family: AF_INET, address: socket.sin_addr) else { return nil }
+      return LocalInterfaceAddress(
+        address: text, family: .ipv4, isIPv6LinkLocal: false, v6Flags: nil)
+    case sa_family_t(AF_INET6):
+      let socket = socketAddress.withMemoryRebound(to: sockaddr_in6.self, capacity: 1) {
+        $0.pointee
+      }
+      guard let text = addressText(family: AF_INET6, address: socket.sin6_addr) else { return nil }
+      let v6Flags =
+        flagsSocket >= 0
+        ? v6AddressFlags(flagsSocket: flagsSocket, bsdName: bsdName, address: socketAddress)
+        : nil
+      return LocalInterfaceAddress(
+        address: text,
+        family: .ipv6,
+        isIPv6LinkLocal: isIPv6LinkLocal(socket.sin6_addr),
+        v6Flags: v6Flags)
+    default:
+      return nil
+    }
+  }
+
+  /// `SIOCGIFAFLAG_IN6` 逐地址查询内核 IPv6 标志（与 ifconfig 的
+  /// 「autoconf secured / autoconf temporary / dynamic」注记同源）。查询
+  /// 失败返回 nil。
+  private static func v6AddressFlags(
+    flagsSocket: Int32, bsdName: String, address: UnsafeMutablePointer<sockaddr>
+  ) -> LocalInterfaceV6Flags? {
+    var request = in6_ifreq()
+    // _IOWR('i', 73, struct in6_ifreq) 手工展开：Darwin 模块不导出带结构体
+    // 参数的 ioctl 请求宏。
+    let requestCode =
+      UInt32(IOC_INOUT)
+      | (UInt32(MemoryLayout<in6_ifreq>.size) & UInt32(IOCPARM_MASK)) << 16
+      | UInt32(0x69) << 8 | 73
+    withUnsafeMutableBytes(of: &request.ifr_name) { nameBuffer in
+      _ = strlcpy(
+        nameBuffer.baseAddress!.assumingMemoryBound(to: CChar.self), bsdName, Int(IFNAMSIZ))
+    }
+    address.withMemoryRebound(to: sockaddr_in6.self, capacity: 1) { sin6 in
+      request.ifr_ifru.ifru_addr = sin6.pointee
+    }
+    guard ioctl(flagsSocket, UInt(requestCode), &request) == 0 else { return nil }
+    // ifru_flags 与 ifru_addr 在联合上重叠：内核回写在偏移 IFNAMSIZ 的首
+    // 4 字节，直接按位读取（不依赖 Swift 对 C 联合成员的重叠读写语义）。
+    let rawFlags = withUnsafeBytes(of: &request) {
+      $0.loadUnaligned(fromByteOffset: Int(IFNAMSIZ), as: Int32.self)
+    }
+    return LocalInterfaceV6Flags(rawValue: rawFlags)
+  }
+
+  /// inet_ntop 规范化呈现形；转换失败不产生候选地址。
+  private static func addressText<T>(family: Int32, address: T) -> String? {
+    var buffer = [CChar](repeating: 0, count: Int(INET6_ADDRSTRLEN))
+    let result = withUnsafePointer(to: address) { pointer in
+      pointer.withMemoryRebound(
+        to: UInt8.self, capacity: MemoryLayout<T>.size
+      ) {
+        inet_ntop(family, $0, &buffer, socklen_t(INET6_ADDRSTRLEN))
+      }
+    }
+    guard result != nil else { return nil }
+    // inet_ntop 写入 null 结尾字符串且产物恒为 ASCII；先按终止符截断再解码，
+    // 校验失败分支不可达。
+    return String(bytes: buffer.prefix { $0 != 0 }.map { UInt8(bitPattern: $0) }, encoding: .utf8)
+  }
+
+  /// IPv6 链路本地判定（fe80::/10；`IN6_IS_ADDR_LINKLOCAL` 宏未导入 Swift）。
+  private static func isIPv6LinkLocal(_ address: in6_addr) -> Bool {
+    let prefix = withUnsafeBytes(of: address) { Array($0.prefix(2)) }
+    return prefix.count == 2 && prefix[0] == 0xFE && prefix[1] & 0xC0 == 0x80
+  }
+
+  /// BSD 名 → (系统接口类型, 本地化名称)。回环无 SystemConfiguration 映射，
+  /// 类型保持 nil；名称缺失由策略回退 BSD 名。
+  private static func systemInterfaceMetadata() -> [String: (type: String?, name: String?)] {
+    var metadata: [String: (type: String?, name: String?)] = [:]
+    for case let interface as SCNetworkInterface in SCNetworkInterfaceCopyAll() as NSArray {
+      guard let bsdName = SCNetworkInterfaceGetBSDName(interface) as String? else { continue }
+      metadata[bsdName] = (
+        SCNetworkInterfaceGetInterfaceType(interface) as String?,
+        SCNetworkInterfaceGetLocalizedDisplayName(interface) as String?
+      )
+    }
+    return metadata
+  }
+}
+
+/// SCDynamicStore 观察箱：跨 C 回调向 MainActor 发值，并收拢 store 生命周期
+/// ——store 的 context 以 unretained 指针回指本箱，本箱释放时先脱离队列再
+/// 释放 store，保证 context 指针不悬挂（Swift 6 禁止在 MainActor 类的
+/// nonisolated deinit 直接访问非 Sendable 存储）。
+private final class InterfaceFactsObservation: @unchecked Sendable {
+  private let lock = NSLock()
+  private var handler: (@MainActor @Sendable () -> Void)?
+  private var store: SCDynamicStore?
+
+  func attach(_ store: SCDynamicStore) {
+    lock.withLock { self.store = store }
+  }
+
+  func setHandler(_ handler: (@MainActor @Sendable () -> Void)?) {
+    lock.withLock { self.handler = handler }
+  }
+
+  func emit() {
+    let currentHandler = lock.withLock { handler }
+    guard let currentHandler else { return }
+    Task { @MainActor in currentHandler() }
+  }
+
+  deinit {
+    lock.withLock {
+      if let store {
+        SCDynamicStoreSetDispatchQueue(store, nil)
+      }
+      handler = nil
+    }
+  }
+}
+
+private let interfaceFactsDynamicStoreCallback: SCDynamicStoreCallBack = { _, _, info in
+  guard let info else { return }
+  Unmanaged<InterfaceFactsObservation>.fromOpaque(info).takeUnretainedValue().emit()
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/TerminalCommandAddress.swift b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/TerminalCommandAddress.swift
new file mode 100644
index 000000000..eaa5a9f50
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyControlWorkflow/TerminalCommandAddress.swift
@@ -0,0 +1,188 @@
+import Foundation
+import SystemConfiguration
+
+// MARK: - 命令地址投影
+
+/// 首页命令地址候选（GLOSSARY.md「Terminal command address」）。身份 = BSD
+/// 接口身份 + 规范化 IP；显示名与类型注记仅用于呈现，不参与身份，由呈现层
+/// 自行组合（菜单项主行 IP、副标题「注记 - 名称」与收起状态说明行）。
+struct TerminalCommandAddress: Equatable, Sendable {
+  /// BSD 接口名；回环固定为 lo0。
+  let bsdName: String
+  /// 规范化 IP 文本。
+  let address: String
+  /// 系统本地化接口名称，缺失回退 BSD 名；回环显示 lo0。
+  let displayName: String
+  /// IPv6 地址类型注记（与 ifconfig 同源：autoconf secured / autoconf /
+  /// dynamic）；IPv4 或标志缺失为 nil。
+  let annotation: String?
+
+  init(bsdName: String, address: String, displayName: String, annotation: String? = nil) {
+    self.bsdName = bsdName
+    self.address = address
+    self.displayName = displayName
+    self.annotation = annotation
+  }
+
+  /// 跨刷新匹配既有选择的身份（不含显示名与注记；两者变化不使选择失效）。
+  var identity: TerminalCommandAddressIdentity {
+    TerminalCommandAddressIdentity(bsdName: bsdName, address: address)
+  }
+}
+
+/// 命令地址身份：BSD 接口名 + 规范化 IP。
+struct TerminalCommandAddressIdentity: Equatable, Hashable, Sendable {
+  let bsdName: String
+  let address: String
+}
+
+/// 首页命令地址选择器投影：可见性、候选与生效选择一次观察
+/// 产出，所有字段来自同一时间点。
+struct TerminalCommandAddressPicker: Equatable, Sendable {
+  /// 局域网关闭时隐藏。
+  let isVisible: Bool
+  /// 用户可见候选（已过滤、已排序；至少含本地回环项）。
+  let candidates: [TerminalCommandAddress]
+  /// 当前生效选择；恒为候选之一（选择失效自动回退默认回环）。
+  let selected: TerminalCommandAddress
+}
+
+// MARK: - 派生策略
+
+/// 首页命令地址策略：接口原始事实 + 已保存局域网监听方式 → 用户可见
+/// 候选与生效选择。纯派生：类型白名单、地址族过滤、链路本地/通配排除、名称
+/// 回退、排序合并与失效回退全部在此。测试以原始事实替身驱动本策略，不直接
+/// 注入已过滤候选。
+enum TerminalCommandAddressPolicy {
+  /// 非回环接口的严格类型白名单：仅 SystemConfiguration 的 Wi‑Fi（IEEE80211）
+  /// 与 Ethernet 类型；不以接口名前缀或通用链路类型代替，无法确认属于允许
+  /// 类型的非回环接口排除。
+  private static let allowedInterfaceTypes: Set<String> = [
+    kSCNetworkInterfaceTypeIEEE80211 as String,
+    kSCNetworkInterfaceTypeEthernet as String,
+  ]
+
+  /// 通配绑定地址不能用作命令目标。
+  private static let wildcardAddresses: Set<String> = ["0.0.0.0", "::"]
+
+  /// 一次观察的完整选择器事实。`selection` 不在候选中（地址消失、地址族
+  /// 不兼容或枚举失败）时回退本地入口 127.0.0.1。
+  static func picker(
+    mode: ListenerMode,
+    interfaces: [LocalInterfaceFacts]?,
+    selection: TerminalCommandAddressIdentity?
+  ) -> TerminalCommandAddressPicker {
+    let candidates = candidates(for: mode, interfaces: interfaces)
+    let selected = candidates.first { $0.identity == selection } ?? defaultLoopback(for: mode)
+    return TerminalCommandAddressPicker(
+      isVisible: mode != .disabled,
+      candidates: candidates,
+      selected: selected)
+  }
+
+  /// 候选列表：本地入口 127.0.0.1 置顶，其余来自白名单接口；
+  /// 仅本机方式监听器只绑定 127.0.0.1，候选不含接口地址。枚举失败（nil）
+  /// 仅提供本地回环候选。
+  static func candidates(
+    for mode: ListenerMode,
+    interfaces: [LocalInterfaceFacts]?
+  ) -> [TerminalCommandAddress] {
+    let loopbacks = [defaultLoopback(for: mode)]
+    guard mode != .disabled, let interfaces else { return loopbacks }
+    return loopbacks + interfaceCandidates(mode: mode, interfaces: interfaces)
+  }
+
+  /// 始终有效的本地回环地址。
+  static func defaultLoopback(for mode: ListenerMode) -> TerminalCommandAddress {
+    TerminalCommandAddress(
+      bsdName: "lo0", address: "127.0.0.1", displayName: "lo0", annotation: nil)
+  }
+
+  // MARK: - 派生细节
+
+  /// 待排序的接口分组：显示名 + BSD 名 + 该接口的地址候选。
+  private struct InterfaceGroup {
+    let name: String
+    let bsdName: String
+    let addresses: [TerminalCommandAddress]
+  }
+
+  private static func interfaceCandidates(
+    mode: ListenerMode,
+    interfaces: [LocalInterfaceFacts]
+  ) -> [TerminalCommandAddress] {
+    var groups: [InterfaceGroup] = []
+    for interface in interfaces where !interface.isLoopback {
+      guard let type = interface.interfaceType, allowedInterfaceTypes.contains(type) else {
+        continue
+      }
+      // 显示名缺失回退 BSD 名；回退不放宽类型过滤。
+      let name = interface.localizedName ?? interface.bsdName
+      var seen = Set<String>()
+      let accepted = interface.addresses
+        .filter { isAcceptable($0, mode: mode) }
+        .filter { seen.insert($0.address).inserted }  // 同一接口重复 IP 合并
+      let addresses =
+        accepted
+        .sorted { lhs, rhs in
+          // 同一接口先 IPv4 后 IPv6，再按地址稳定排序。
+          if lhs.family != rhs.family { return lhs.family == .ipv4 }
+          return lhs.address < rhs.address
+        }
+        .map {
+          TerminalCommandAddress(
+            bsdName: interface.bsdName,
+            address: $0.address,
+            displayName: name,
+            annotation: annotation(for: $0))
+        }
+      if !addresses.isEmpty {
+        groups.append(InterfaceGroup(name: name, bsdName: interface.bsdName, addresses: addresses))
+      }
+    }
+    return
+      groups
+      .sorted { lhs, rhs in
+        // 其余项按接口名称排序（大小写不敏感，BSD 回退名与本地化名混排）；
+        // 同显示名以 BSD 名保持稳定。
+        let lhsName = lhs.name.lowercased()
+        let rhsName = rhs.name.lowercased()
+        return lhsName == rhsName ? lhs.bsdName < rhs.bsdName : lhsName < rhsName
+      }
+      .flatMap(\.addresses)
+  }
+
+  private static func isAcceptable(
+    _ address: LocalInterfaceAddress, mode: ListenerMode
+  ) -> Bool {
+    guard !wildcardAddresses.contains(address.address) else { return false }
+    // IPv6 链路本地需要额外接口作用域，不作为命令目标；IPv4 链路本地允许。
+    if address.family == .ipv6, address.isIPv6LinkLocal { return false }
+    // RFC 4941 隐私临时地址会轮换，不适合作为其他设备长期使用的命令目标。
+    if address.v6Flags?.contains(.temporary) == true { return false }
+    switch (mode, address.family) {
+    case (.allIPv4Interfaces, .ipv4):
+      return true
+    case (.allIPv4AndIPv6Interfaces, _):
+      return true
+    case (.allIPv6Interfaces, .ipv6):
+      return true
+    default:
+      return false
+    }
+  }
+
+  /// IPv6 地址类型注记（与 ifconfig 同源的打印逻辑）；无标志（标志查询
+  /// 失败或纯回环）不注记。
+  private static func annotation(for address: LocalInterfaceAddress) -> String? {
+    guard let flags = address.v6Flags else { return nil }
+    if flags.contains(.autoconf) {
+      if flags.contains(.secured) { return "autoconf secured" }
+      if flags.contains(.temporary) { return "autoconf temporary" }
+      return "autoconf"
+    }
+    if flags.contains(.secured) { return "secured" }
+    if flags.contains(.dynamic) { return "dynamic" }
+    return nil
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/CoalescedFactSignal.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/CoalescedFactSignal.swift
new file mode 100644
index 000000000..ca6b6d8db
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/CoalescedFactSignal.swift
@@ -0,0 +1,23 @@
+import Combine
+import Foundation
+
+/// didChange 事实信号的每主队列轮合并器：属性 didSet 汇集到 `markChanged`，
+/// 同一同步轮内多次标记只在轮末发一次。冲洗晚于当前同步轮——订阅方收到
+/// 信号时读到的必是一组完整事实，不会读到写半程状态。
+@MainActor
+final class CoalescedFactSignal {
+  /// 事实已变化通知（didChange 语义；每主队列轮至多一次）。
+  let changes = PassthroughSubject<Void, Never>()
+  private var flushScheduled = false
+
+  /// didSet 的汇集点；重复标记合并为一次轮末冲洗。
+  func markChanged() {
+    guard !flushScheduled else { return }
+    flushScheduled = true
+    Task { @MainActor [weak self] in
+      guard let self else { return }
+      flushScheduled = false
+      changes.send()
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Commands.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Commands.swift
new file mode 100644
index 000000000..8861e48aa
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Commands.swift
@@ -0,0 +1,352 @@
+import Foundation
+
+// MARK: - 用户意图与收敛（命令面）
+
+extension ProxyRuntimeController {
+  // MARK: - 用户意图
+
+  /// 激活一个服务器或分组目标（目录 UI 工单复用入口）：持久化目标；agent
+  /// 意图开启时立即把新档推到运行时。激活原子失败时目标与运行时完全不动；
+  /// 点名原因进 `lastActivationFailure` 并随 `.rejectedActivation` 自含返回；
+  /// 意外错误 throws 并进入 `serviceFailed`。
+  @discardableResult
+  func activate(_ target: NodeID) async throws -> ActivationCommandOutcome {
+    guard catalogSnapshotReader.isCatalogAvailable else { throw ServerLibraryError.notLoaded }
+    refreshPluginSecurityFacts()
+    let catalog = catalogSnapshotReader.catalogSnapshot
+    do {
+      let configuration = try machine.activate(
+        target, in: catalog, plugins: plugins,
+        options: settings.runtimeDocumentOptions)
+      activeTargetID = target
+      skippedServers = configuration.skippedServers
+      lastActivationFailure = nil
+      do {
+        try activationFileStore.save(activeTargetID: target)
+      } catch {
+        state = .serviceFailed(.persistence)
+        throw error
+      }
+      if settings.agentEnabled {
+        await deploy(configuration.document)
+      }
+      return .activated(skippedInvalid: configuration.skippedServers.count)
+    } catch let failure as ActivationFailure {
+      lastActivationFailure = failure
+      return .rejectedActivation(failure)
+    } catch {
+      state = .serviceFailed(.unknown)
+      throw error
+    }
+  }
+
+  /// Agent 开关：先持久化意图（显式关闭在 GUI 重启后仍生效），
+  /// 再收敛运行时。UserDefaults 不提供同步落盘失败信号。意图已
+  /// 开启时的开启命令仅在未达健康态时重收敛——它是启动失败/重置后的显式
+  /// 重试入口；健康运行中不做无谓的注销重拉。关闭时级联：系统代理意图仍
+  /// 开启则一并持久化为关闭，该 on→off 迁移触发清理，清理后才停止本地监听；
+  /// 系统代理意图本就关闭则不做任何系统设置操作。
+  func setAgentEnabled(_ enabled: Bool) async {
+    let retryingFailure = enabled && runtimeFileStore.readFailure() != nil
+    if enabled {
+      do { try runtimeFileStore.clearFailure() } catch {
+        state = .serviceFailed(.runtimeFile)
+        return
+      }
+    }
+    guard enabled != settings.agentEnabled else {
+      await handleUnchangedAgentIntent(enabled, retryingFailure: retryingFailure)
+      return
+    }
+    controlPreferences.agentEnabled = enabled
+    settings.agentEnabled = enabled
+    if enabled {
+      await enableAgentAfterIntent()
+    } else {
+      await disableAgentAfterIntent()
+    }
+  }
+
+  private func handleUnchangedAgentIntent(_ enabled: Bool, retryingFailure: Bool) async {
+    guard enabled else { return }
+    if retryingFailure {
+      await convergeAgent()
+      return
+    }
+    if ruleApplicationFailure != nil {
+      scheduleRuleApplication()
+      return
+    }
+    switch state {
+    case .off, .launchFailed, .serviceFailed: await convergeAgent()
+    case .starting, .running, .firewallBlocked, .requiresApproval: break
+    }
+  }
+
+  private func enableAgentAfterIntent() async {
+    await convergeAgent()
+    if settings.systemProxyEnabled { systemProxyObserver.startEnabledSystemProxyObservation() }
+  }
+
+  private func disableAgentAfterIntent() async {
+    let cleanupOutcome = await cascadeSystemProxyOffForAgentOff()
+    await stopAgent()
+    if let cleanupOutcome {
+      systemProxyObserver.presentCleanupOutcome(cleanupOutcome)
+    } else {
+      systemProxyObserver.updateSystemProxyActions()
+    }
+  }
+
+  /// 关闭 agent 时的系统代理级联：意图仍开启则一并持久化为
+  /// 关闭并请求清理（返回清理结果），不依赖监听文件保存。
+  private func cascadeSystemProxyOffForAgentOff() async -> SystemProxyControlState? {
+    guard settings.systemProxyEnabled else { return nil }
+    controlPreferences.systemProxyEnabled = false
+    settings.systemProxyEnabled = false
+    // 持久化的 on→off 迁移才触发清理；先清后停本地监听。
+    return await systemProxyObserver.clearAndStopSystemProxyObservation()
+  }
+
+  /// 系统代理开关：先持久化意图。开启时经 helper 注册门禁收敛
+  /// 应用；关闭即一次 on→off 意图迁移——请求一次无条件清理（临时观察网络
+  /// 变化直至安静，失败也不后台重试），不影响 agent 注册与本地监听。
+  func setSystemProxyEnabled(_ enabled: Bool) async {
+    guard enabled != settings.systemProxyEnabled else { return }
+    controlPreferences.systemProxyEnabled = enabled
+    settings.systemProxyEnabled = enabled
+    if enabled {
+      await systemProxyObserver.enableSystemProxyIntent()
+    } else {
+      await systemProxyObserver.disableSystemProxyIntent()
+    }
+  }
+
+  /// GUI startup restores the Agent. Healthy proxy intent only inspects; unhealthy
+  /// proxy intent suspends; disabled intent never writes SystemConfiguration.
+  func resyncOnLaunch() async {
+    guard !settingsUnreadable else {
+      state = .launchFailed(.unreadableSettings)
+      return
+    }
+    guard catalogSnapshotReader.isCatalogAvailable else { return }
+    refreshPluginSecurityFacts()
+    systemProxyObserver.beginStartupResync()
+    guard settings.agentEnabled else {
+      await stopAgent()
+      await systemProxyObserver.settleLaunchWithAgentOff()
+      return
+    }
+    let catalog = catalogSnapshotReader.catalogSnapshot
+    await convergeToReexpanded(catalog)
+    await systemProxyObserver.settleLaunchAfterAgentConverged()
+  }
+
+  // MARK: - 动作执行
+
+  /// Agent 意图开启的收敛：注册态不是事实来源，意图才是——未注册也会注册，
+  /// 已注册则重校验目标并部署。偏好重置后也走此路径，把运行时收敛到出厂设置。
+  func convergeAgent() async {
+    await convergeToReexpanded(catalogSnapshotReader.catalogSnapshot)
+  }
+
+  /// Agent 意图关闭的收敛：只停止本地监听，不做系统代理清理。
+  /// 系统代理状态按意图事实收尾——级联后意图已关闭为空闲；残留的「意图开
+  /// 启 + agent 关闭」组合保持待应用（不静默清理，也无需网络观察）。
+  func stopAgent() async {
+    systemProxyObserver.agentDidStop()
+    let outcome = await execute(.stop, document: nil)
+    guard outcome.succeeded else { return }
+    state = .off
+    runtimeObservation = nil
+    skippedServers = []
+    lastActivationFailure = nil
+  }
+
+  /// 无活动目标时 agent 仍提供本地监听：空服务器列表文档，
+  /// SOCKS/HTTP 端点照常绑定；系统代理门禁会因缺少可用出口保持待应用。
+  @discardableResult
+  func deployListeningWithoutTarget() async -> ConvergenceResult {
+    let document = SslocalRuntimeDocument(
+      servers: [],
+      listen: settings.listen)
+    return await deploy(document)
+  }
+
+  /// 普通部署意图；配置派生、执行与失败呈现由运行状态收敛 module 拥有。
+  @discardableResult
+  func deploy(_ sourceDocument: SslocalRuntimeDocument) async -> ConvergenceResult {
+    refreshPluginSecurityFacts()
+    let result = await convergeRuntime(.deployment(sourceDocument))
+    if case .failed = result { refreshPluginSecurityFacts() }
+    return result
+  }
+
+  /// 活动目标失效：清除并持久化 nil，点名原因独立呈现；agent
+  /// 继续以空服务器列表监听；系统代理清理后保留意图，条件恢复后自动
+  /// 收敛），不悄悄选择其他服务器。
+  @discardableResult
+  func handleCleared(_ failure: ActivationFailure) async -> ConvergenceResult {
+    RuntimeLog.emit(.activationFailed(reason: String(describing: failure)))
+    do {
+      try activationFileStore.save(activeTargetID: nil)
+    } catch {
+      // 清目标失败不阻断收敛：下次重同步会再次收敛（目标已不在状态机中）。
+      RuntimeLog.emit(.runtimePersistFailed(detail: String(describing: error)))
+    }
+    lastActivationFailure = failure
+    skippedServers = []
+    await systemProxyObserver.holdSystemProxyIntent()
+    if settings.agentEnabled {
+      return await deployListeningWithoutTarget()
+    } else {
+      // 会话内意图已被关闭的残余：按关闭语义收敛。
+      let outcome = await execute(.stop, document: nil)
+      guard outcome.succeeded else { return .failed }
+      state = .off
+      runtimeObservation = nil
+      return .applied
+    }
+  }
+}
+
+// MARK: - 计划动作执行
+
+extension ProxyRuntimeController {
+  /// 把「运行定义档」意图推到运行时：计划动作 → 顺序执行。返回全部动作
+  /// 是否成功与本次占用的并发流代际。
+  func execute(
+    _ intent: RuntimeIntent, document: SslocalRuntimeDocument?,
+    preparedContract: PreparedRuntimeContract? = nil
+  ) async -> RuntimeExecutionOutcome {
+    cancelFirewallObservation()
+    flowGeneration += 1
+    let flow = flowGeneration
+    let succeeded = await performPlannedActions(
+      intent, document: document, preparedContract: preparedContract, flow: flow)
+    return RuntimeExecutionOutcome(flow: flow, succeeded: succeeded)
+  }
+
+  /// 按计划顺序执行动作；返回 false 表示中途失败、状态已呈现（后续动作与
+  /// 健康探测都不应继续）。
+  private func performPlannedActions(
+    _ intent: RuntimeIntent, document: SslocalRuntimeDocument?,
+    preparedContract: PreparedRuntimeContract?, flow: Int
+  ) async -> Bool {
+    let preparation = runtimePreparationGeneration
+    let contract: PreparedRuntimeContract?
+    if case .run(let desired) = intent {
+      guard let prepared = preparedContract ?? (try? PreparedRuntimeContract(desired)),
+        prepared.document == desired, document == desired
+      else {
+        state = .serviceFailed(document == nil ? .missingDocument : .runtimeFile)
+        return false
+      }
+      contract = prepared
+    } else {
+      contract = nil
+    }
+    let actions = ProxyRuntimePlan.actions(
+      intent: intent,
+      agentStatus: agent.status,
+      wrapper: wrapperState(),
+      configurationIsCurrent: contract.map { runtimeFileStore.contains($0) } ?? false)
+    if case .run = intent, actions.isEmpty {
+      RuntimeLog.emit(.contractUnchanged)
+    }
+    for action in actions {
+      guard flow == flowGeneration, preparation == runtimePreparationGeneration,
+        await perform(action, preparedContract: contract)
+      else { return false }
+    }
+    return flow == flowGeneration && preparation == runtimePreparationGeneration
+  }
+
+  /// 执行单个动作；返回 false 表示应终止后续动作（状态已呈现）。
+  private func perform(
+    _ action: RuntimeAction, preparedContract: PreparedRuntimeContract?
+  ) async -> Bool {
+    switch action {
+    case .writeContract:
+      return performWriteContract(preparedContract)
+    case .registerAgent:
+      return performAgentRegistration()
+    case .unregisterAgent:
+      return await performAgentUnregistration()
+    case .signalReload(let pid):
+      return performSignalReload(pid)
+    case .deleteRuntimeFiles:
+      do { try runtimeFileStore.deleteRuntimeFiles() } catch {
+        state = .serviceFailed(.runtimeFile)
+        return false
+      }
+      RuntimeLog.emit(.runtimeFilesDeleted)
+      return true
+    }
+  }
+
+  /// 原子写契约文件；缺文档或写失败即终止。
+  private func performWriteContract(_ contract: PreparedRuntimeContract?) -> Bool {
+    guard let contract else {
+      state = .serviceFailed(.missingDocument)
+      return false
+    }
+    do {
+      try runtimeFileStore.write(contract)
+      RuntimeLog.emit(.contractWritten(serverCount: contract.document.servers.count))
+      return true
+    } catch {
+      state = .serviceFailed(.runtimeFile)
+      return false
+    }
+  }
+
+  /// 注册 LaunchAgent；需用户批准或注册失败即终止并呈现对应状态。
+  private func performAgentRegistration() -> Bool {
+    do {
+      try agent.register()
+    } catch {
+      RuntimeLog.emit(.agentRegisterFailed(detail: describe(error)))
+      if agent.status == .requiresApproval {
+        // 注册请求已被系统接收，等待用户在登录项中批准。
+        state = .requiresApproval
+        return false
+      }
+      if agent.status != .registered {
+        state = .serviceFailed(.agent)
+        return false
+      }
+      // 注册与状态读取之间的竞态：已注册即达意图，不视为失败。
+    }
+    RuntimeLog.emit(.agentRegistered)
+    if agent.status == .requiresApproval {
+      state = .requiresApproval
+      return false
+    }
+    return true
+  }
+
+  /// 注销 LaunchAgent 并等待 wrapper 退出；未注册竞态可忽略（尽力而为）。
+  private func performAgentUnregistration() async -> Bool {
+    do {
+      try agent.unregister()
+    } catch {
+      RuntimeLog.emit(.agentUnregisterFailed(detail: describe(error)))
+    }
+    RuntimeLog.emit(.agentUnregistered)
+    await waitForWrapperExit()
+    guard wrapperState() == .notRunning, !runtimeFileStore.hasUnconfirmedChild else {
+      state = .serviceFailed(.agent)
+      return false
+    }
+    return true
+  }
+
+  private func performSignalReload(_ pid: Int32) -> Bool {
+    guard sendSignal(pid, SIGUSR1) == 0 else {
+      state = .serviceFailed(.agent)
+      return false
+    }
+    return true
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Convergence.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Convergence.swift
new file mode 100644
index 000000000..b0086d090
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Convergence.swift
@@ -0,0 +1,400 @@
+import Foundation
+
+/// 一次计划执行的结果:动作是否全部按序成功,以及本次执行占用的并发流
+/// 代际;收敛票据用它推进 flow,避免调用方手算 `flowGeneration + 1`。
+struct RuntimeExecutionOutcome {
+  /// 本次执行占用的 `flowGeneration`。
+  let flow: Int
+  /// 全部计划动作是否按序成功。
+  let succeeded: Bool
+}
+
+/// 收敛票据:运行时收敛操作的代际快照。入口捕获三个并发代际,之后每步
+/// 推进用它判定「从入口到现在,并发流 / 模式切换 / 运行时派生是否前进了,
+/// 会话内 agent 意图是否仍开启」;被更新提交或新意图取代的旧收敛不得再
+/// 变更运行时状态或写契约。
+///
+/// 四项失效事实由票据恒全查,不随调用路径增减——「什么会使一次收敛失效」
+/// 是票据的固有语义(逐路径手选子集曾让 agent 关闭在 mode 切换的健康门
+/// await 窗口内被误分类为失败并触发复活性的 restore)。各路径只负责捕获
+/// 与推进时机:flow 分量在 execute 后以实际占用值推进,mode 切换路径在
+/// 派生后推进 preparation 分量(派生自身会推进它),rules 部署在推进 mode
+/// 代际之后捕获。
+private struct ConvergenceTicket: Equatable {
+  /// 并发流代际;每次 execute 之后由调用方以实际占用值推进。
+  var flow: Int
+  /// 模式切换代际;捕获后不再变化。
+  let mode: Int
+  /// 运行时文档派生代际;每次派生之后由调用方以当前值推进。
+  var preparation: Int
+}
+
+extension ProxyRuntimeController {
+  /// 以当前代际捕获收敛票据。
+  private func convergenceTicket() -> ConvergenceTicket {
+    ConvergenceTicket(
+      flow: flowGeneration, mode: modeChangeGeneration,
+      preparation: runtimePreparationGeneration)
+  }
+
+  /// 票据是否仍代表当前收敛:并发流 / 模式切换 / 派生三个代际均未前进,
+  /// 且会话内 agent 意图仍开启。
+  private func convergenceIsCurrent(_ ticket: ConvergenceTicket) -> Bool {
+    ticket.flow == flowGeneration && ticket.mode == modeChangeGeneration
+      && ticket.preparation == runtimePreparationGeneration
+      && settings.agentEnabled
+  }
+
+  /// 派生文档对当前运行时是否无事可做（GLOSSARY.md「有效值未变的提交不做
+  /// 运行时收敛」）：发布意图相同、输出字节未漂移、agent 已注册且 wrapper
+  /// 存活、控制器处于健康运行态——计划层动作序列为空即幂等跳过。判定在
+  /// 置 `starting` 之前进行，跳过路径不闪状态、不重走健康门；磁盘漂移或
+  /// wrapper 失踪时动作序列自然非空，走完整 deploy 自愈。
+  private func convergencePlanIsEmpty(
+    _ document: SslocalRuntimeDocument, preparedContract: PreparedRuntimeContract?
+  ) -> Bool {
+    guard runtimeReloadProcesses.isEmpty else { return false }
+    switch state {
+    case .running, .firewallBlocked:
+      break
+    case .off, .starting, .launchFailed, .requiresApproval, .serviceFailed:
+      return false
+    }
+    let actions = ProxyRuntimePlan.actions(
+      intent: .run(document),
+      agentStatus: agent.status,
+      wrapper: wrapperState(),
+      configurationIsCurrent: preparedContract.map { runtimeFileStore.contains($0) } ?? false)
+    return actions.isEmpty
+  }
+
+  /// reexpand 三-case 开关的收敛主体（显式收敛、设置保存、启动重同步共用）：
+  /// deployed → 部署派生文档；目标失效 → 清除并按意图收敛；无目标 → 空监听。
+  /// 幂等跳过由 apply 层的 plan 空判定承担；目录重校验（跳过名单、目标失效
+  /// 清除）已在 `reexpand` 完成，不受其影响。
+  func convergeToReexpanded(_ catalog: ConfigurationCatalog) async {
+    guard !settingsUnreadable else {
+      state = .launchFailed(.unreadableSettings)
+      return
+    }
+    guard catalogSnapshotReader.isCatalogAvailable else { return }
+    switch reexpand(in: catalog) {
+    case .deployed(let configuration):
+      await deploy(configuration.document)
+    case .clearedAndStopped(let failure):
+      await handleCleared(failure)
+    case nil:
+      await deployListeningWithoutTarget()
+    }
+  }
+
+  /// 一个意图入口隐藏派生、执行政策和失败呈现；调用者不组合执行选项。
+  enum RuntimeConvergenceIntent {
+    case deployment(SslocalRuntimeDocument)
+    case modeTransition
+    case savedRules
+  }
+
+  enum ConvergenceResult {
+    case applied
+    case unchanged
+    /// 派生或部署失败；失败呈现已经处理。
+    case failed
+    /// 被新意图取代，不得发布旧结果。
+    case superseded
+  }
+
+  @discardableResult
+  func convergeRuntime(_ intent: RuntimeConvergenceIntent) async -> ConvergenceResult {
+    guard !settingsUnreadable else {
+      state = .launchFailed(.unreadableSettings)
+      return .failed
+    }
+    guard catalogSnapshotReader.isCatalogAvailable else { return .failed }
+    switch intent {
+    case .deployment(let source): return await convergeDeployment(source)
+    case .modeTransition: return await convergeModeTransition()
+    case .savedRules: return await convergeSavedRules()
+    }
+  }
+
+  private func convergeDeployment(_ source: SslocalRuntimeDocument) async -> ConvergenceResult {
+    let contract: PreparedRuntimeContract
+    do {
+      contract = try PreparedRuntimeContract(await runtimeDocument(source, for: proxyMode))
+    } catch RulePreparationError.superseded {
+      return .superseded
+    } catch {
+      RuntimeLog.emit(.runtimePersistFailed(detail: String(describing: error)))
+      state = .serviceFailed(.runtimeFile)
+      return .failed
+    }
+    var ticket = convergenceTicket()
+    return await apply(contract.document, ticket: &ticket, policy: .deployment)
+  }
+
+  private func convergeModeTransition() async -> ConvergenceResult {
+    await convergeChangedIntent(policy: .modeTransition)
+  }
+
+  private func convergeSavedRules() async -> ConvergenceResult {
+    guard proxyMode == .rule else { return .unchanged }
+    let revision = ruleDocuments.revision
+    let result = await convergeChangedIntent(policy: .savedRules)
+    switch result {
+    case .applied, .unchanged:
+      if revision == ruleDocuments.revision { ruleApplicationFailure = nil }
+    case .superseded:
+      break
+    case .failed:
+      if revision == ruleDocuments.revision {
+        ruleApplicationFailure = ProxyRuntimeFacts(state: state).failure ?? .service(.runtimeFile)
+      }
+    }
+    return result
+  }
+
+  /// 三种意图的执行差异只在 module 内选择，不能由调用者拼成任意组合。
+  private enum DeploymentPolicy {
+    case deployment
+    case modeTransition
+    case savedRules
+  }
+
+  private enum ChangedIntentSource {
+    case ready(SslocalRuntimeDocument)
+    case completed(ConvergenceResult)
+  }
+
+  private struct PreparedChangedIntent {
+    let document: SslocalRuntimeDocument
+    let contract: PreparedRuntimeContract
+    let ticket: ConvergenceTicket
+  }
+
+  private enum ChangedIntentPreparation {
+    case ready(PreparedChangedIntent)
+    case completed(ConvergenceResult)
+  }
+
+  private struct RuntimeApplyAttempt {
+    let document: SslocalRuntimeDocument
+    let contract: PreparedRuntimeContract?
+    let policy: DeploymentPolicy
+    let reloadingProcessID: Int32?
+    let reloadID: UUID
+  }
+
+  private enum ApplyPreparation {
+    case ready(RuntimeApplyAttempt)
+    case completed(ConvergenceResult)
+  }
+
+  /// 模式与规则变更从同一份已保存资料重新展开，不以输出配置作为派生输入。
+  private func convergeChangedIntent(policy: DeploymentPolicy) async -> ConvergenceResult {
+    switch await changedIntentSource(policy) {
+    case .completed(let result): return result
+    case .ready(let source): return await prepareAndConverge(source, policy: policy)
+    }
+  }
+
+  private func changedIntentSource(_ policy: DeploymentPolicy) async -> ChangedIntentSource {
+    guard settings.agentEnabled, state != .off else {
+      if policy == .modeTransition { systemProxyObserver.modeTransitionAwaitingRuntime() }
+      return .completed(.unchanged)
+    }
+    switch reexpand(in: catalogSnapshotReader.catalogSnapshot) {
+    case .deployed(let configuration): return .ready(configuration.document)
+    case .clearedAndStopped(let failure):
+      return .completed(await handleCleared(failure))
+    case nil: return .ready(SslocalRuntimeDocument(servers: [], listen: settings.listen))
+    }
+  }
+
+  private func prepareAndConverge(
+    _ source: SslocalRuntimeDocument, policy: DeploymentPolicy
+  ) async -> ConvergenceResult {
+    let intent: PreparedChangedIntent
+    switch await prepareChangedIntent(source, policy: policy) {
+    case .completed(let result): return result
+    case .ready(let prepared): intent = prepared
+    }
+    if let unchanged = await unchangedIntentResult(intent, policy: policy) { return unchanged }
+    var ticket = intent.ticket
+    if policy == .savedRules {
+      modeChangeGeneration += 1
+      ticket = convergenceTicket()
+    }
+    return await apply(intent.document, ticket: &ticket, policy: policy)
+  }
+
+  private func prepareChangedIntent(
+    _ source: SslocalRuntimeDocument, policy: DeploymentPolicy
+  ) async -> ChangedIntentPreparation {
+    var ticket = convergenceTicket()
+    let next: SslocalRuntimeDocument
+    let contract: PreparedRuntimeContract
+    do {
+      next = try await runtimeDocument(source, for: proxyMode)
+      contract = try PreparedRuntimeContract(next)
+    } catch RulePreparationError.superseded {
+      return .completed(.superseded)
+    } catch {
+      RuntimeLog.emit(.runtimePersistFailed(detail: String(describing: error)))
+      if policy == .savedRules {
+        ruleApplicationFailure = .service(.runtimeFile)
+      } else {
+        state = .serviceFailed(.runtimeFile)
+      }
+      return .completed(.failed)
+    }
+    ticket.preparation = runtimePreparationGeneration
+    return .ready(PreparedChangedIntent(document: next, contract: contract, ticket: ticket))
+  }
+
+  private func unchangedIntentResult(
+    _ intent: PreparedChangedIntent, policy: DeploymentPolicy
+  ) async -> ConvergenceResult? {
+    let unchanged = runtimeFileStore.contains(intent.contract)
+    let hasNoDeploymentFailure = runtimeFileStore.readFailure() == nil
+    if policy == .savedRules, unchanged, ruleApplicationFailure == nil, hasNoDeploymentFailure {
+      return .unchanged
+    }
+    guard policy == .modeTransition, unchanged, hasNoDeploymentFailure,
+      runtimeIsAlreadyRunning, aclReloadProcessID(for: intent.document) != nil
+    else { return nil }
+    guard settings.systemProxyEnabled else { return .unchanged }
+    await systemProxyObserver.convergeSystemProxy()
+    return .applied
+  }
+
+  private var runtimeIsAlreadyRunning: Bool {
+    switch state {
+    case .running, .firewallBlocked: return true
+    default: return false
+    }
+  }
+
+  /// 仅 ACL 变化且原有子进程仍健康时，继续沿用监听事实。
+  private func aclReloadProcessID(for document: SslocalRuntimeDocument) -> Int32? {
+    switch state {
+    case .running, .firewallBlocked: break
+    default: return nil
+    }
+    guard agent.status == .registered, case .running = wrapperState(),
+      let identity = document.replacingACL(nil).intentSHA256,
+      runtimeObservation?.configurationIntentSHA256 == identity
+    else { return nil }
+    return effectiveRuntimeListenerProcessID
+      ?? runtimeReloadProcesses.values.first(where: { processIsAlive($0) })
+  }
+
+  /// 共用执行脊柱；票据不越过意图 seam。
+  private func apply(
+    _ document: SslocalRuntimeDocument,
+    ticket: inout ConvergenceTicket,
+    policy: DeploymentPolicy
+  ) async -> ConvergenceResult {
+    let preparation = await prepareApply(document, ticket: ticket, policy: policy)
+    let attempt: RuntimeApplyAttempt
+    switch preparation {
+    case .completed(let result): return result
+    case .ready(let prepared): attempt = prepared
+    }
+    defer { runtimeReloadProcesses.removeValue(forKey: attempt.reloadID) }
+    let execution = await execute(
+      .run(document), document: document, preparedContract: attempt.contract)
+    ticket.flow = execution.flow
+    return await completeApply(execution, attempt: attempt, ticket: &ticket)
+  }
+
+  private func prepareApply(
+    _ document: SslocalRuntimeDocument, ticket: ConvergenceTicket,
+    policy: DeploymentPolicy
+  ) async -> ApplyPreparation {
+    let contract = try? PreparedRuntimeContract(document)
+    if runtimeFileStore.blocksDeployment(document) {
+      state = .serviceFailed(.agent)
+      await systemProxyObserver.holdSystemProxyIntent()
+      return .completed(.failed)
+    }
+    if convergencePlanIsEmpty(document, preparedContract: contract) {
+      RuntimeLog.emit(.contractUnchanged)
+      ruleApplicationFailure = nil
+      return .completed(.unchanged)
+    }
+    guard convergenceIsCurrent(ticket) else { return .completed(.superseded) }
+    let reloadingProcessID = aclReloadProcessID(for: document)
+    let reloadID = UUID()
+    if let reloadingProcessID { runtimeReloadProcesses[reloadID] = reloadingProcessID }
+    runtimeObservation = RuntimeDeploymentFacts(document)
+    if reloadingProcessID == nil { state = .starting }
+    return .ready(
+      RuntimeApplyAttempt(
+        document: document, contract: contract, policy: policy,
+        reloadingProcessID: reloadingProcessID, reloadID: reloadID))
+  }
+
+  private func completeApply(
+    _ execution: RuntimeExecutionOutcome, attempt: RuntimeApplyAttempt,
+    ticket: inout ConvergenceTicket
+  ) async -> ConvergenceResult {
+    ticket.flow = execution.flow
+    guard convergenceIsCurrent(ticket) else { return .superseded }
+    guard execution.succeeded else {
+      if state != .requiresApproval,
+        runtimeFileStore.receiptIdentity(for: attempt.document) != nil
+      {
+        await failDeployment(ticket: &ticket)
+      }
+      return .failed
+    }
+    let healthy = await presentLaunchHealth(
+      attempt.document,
+      requiresReceipt: attempt.policy != .deployment || attempt.document.aclRuntime != nil,
+      convergeProxyOnSuccess: attempt.policy == .deployment,
+      preserveProxyOnFailure: false, preparedContract: attempt.contract,
+      reloadingProcessID: attempt.reloadingProcessID)
+    guard convergenceIsCurrent(ticket) else { return .superseded }
+    guard healthy else {
+      await failDeployment(ticket: &ticket)
+      return .failed
+    }
+    do { try runtimeFileStore.settleSuccessfulDeployment() } catch {
+      state = .serviceFailed(.runtimeFile)
+      await failDeployment(ticket: &ticket)
+      return .failed
+    }
+    runtimeObservation = RuntimeDeploymentFacts(attempt.document)
+    ruleApplicationFailure = nil
+    await convergeProxyAfterApply(attempt.policy)
+    return .applied
+  }
+
+  private func convergeProxyAfterApply(_ policy: DeploymentPolicy) async {
+    switch policy {
+    case .modeTransition: await systemProxyObserver.convergeSystemProxy(forceApply: true)
+    case .savedRules: await systemProxyObserver.convergeSystemProxy()
+    case .deployment: break
+    }
+  }
+
+  /// 发布后失败保留配置及失败身份，停止服务但不改写两个开关意图。
+  private func failDeployment(ticket: inout ConvergenceTicket) async {
+    guard convergenceIsCurrent(ticket) else { return }
+    var failureState = state
+    do { try runtimeFileStore.recordFailure(reason: "GUI deployment verification failed") } catch {
+      failureState = .serviceFailed(.runtimeFile)
+    }
+    let stopped = await unregisterFailedDeployment()
+    guard convergenceIsCurrent(ticket) else { return }
+    if stopped { state = failureState } else { state = .serviceFailed(.agent) }
+    await systemProxyObserver.holdSystemProxyIntent()
+  }
+
+  private func unregisterFailedDeployment() async -> Bool {
+    do { try agent.unregister() } catch { return false }
+    await waitForWrapperExit()
+    return wrapperState() == .notRunning && !runtimeFileStore.hasUnconfirmedChild
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+CustomRules.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+CustomRules.swift
new file mode 100644
index 000000000..bed9e00bc
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+CustomRules.swift
@@ -0,0 +1,90 @@
+import Foundation
+
+// MARK: - 结果呈现文案
+
+// outcome→文案映射供状态行与编辑器两个视图共享。
+
+extension RulesCommitFeedback {
+  var summary: String {
+    guard outcome.isSuccess else { return outcome.rulesMessage }
+    let count: String
+    switch operation {
+    case .enablement(let enabled):
+      count = String.localizedStringWithFormat(
+        RulesCopy.text(enabled ? "已启用 %lld 条规则" : "已禁用 %lld 条规则"), Int64(changedCount))
+    case .add: count = RulesCopy.text("已新增规则")
+    case .edit: count = RulesCopy.text("已编辑规则")
+    case .delete:
+      count = String.localizedStringWithFormat(
+        RulesCopy.text("已删除 %lld 条自定义规则"), Int64(changedCount))
+    }
+    return count + " · " + RulesCopy.text("已保存")
+  }
+}
+
+extension CustomRuleUpdateOutcome {
+  var rulesMessage: String {
+    switch self {
+    case .saved: RulesCopy.text("已保存")
+    case .persistenceFailed: RulesCopy.text("保存失败，规则未更改")
+    case .busy: RulesCopy.text("正在更新规则…")
+    case .superseded: RulesCopy.text("规则集合已变化，操作未执行。")
+    case .invalidDocument, .rejected: RulesCopy.text("无法更新规则")
+    }
+  }
+
+  var failureDetail: String? {
+    switch self {
+    case .invalidDocument(let detail): detail
+    case .rejected(let rejected): rejected.map(\.explanation).joined(separator: "\n")
+    default: nil
+    }
+  }
+
+  var nextStep: String? {
+    switch self {
+    case .persistenceFailed, .busy, .superseded: String(localized: "请重试规则操作。")
+    case .invalidDocument, .rejected: String(localized: "请检查规则数据后再操作。")
+    default: nil
+    }
+  }
+}
+
+// MARK: - 自定义规则命令面
+
+extension ProxyRuntimeController {
+  /// Validate and atomically save intent; runtime application is a separate worker.
+  /// Deployment failure never restores an older saved rule document.
+  /// 全局和直连模式不加载自定义规则，但持久化仍然进行（切换到规则模式后生效）。
+  func commitRuleDocument(_ document: CustomRuleDocument, preset: RulePreset? = nil) async
+    -> RuleDocumentCommit
+  {
+    let preset = preset ?? settings.rulePreset
+    let result = documents(for: preset).commit(document)
+    if result.outcome.isSuccess && preset == settings.rulePreset { scheduleRuleApplication() }
+    return result
+  }
+
+  /// One worker owns rule deployments. Saves never cancel an in-flight restart;
+  /// another saved revision is coalesced and applied after that restart finishes.
+  func scheduleRuleApplication() {
+    ruleApplicationGeneration += 1
+    guard ruleApplicationTask == nil else { return }
+    ruleApplicationTask = Task { [weak self] in
+      guard let self else { return }
+      defer { self.ruleApplicationTask = nil }
+      while !Task.isCancelled {
+        let generation = self.ruleApplicationGeneration
+        do { try await self.ruleApplicationDelay() } catch { return }
+        guard generation == self.ruleApplicationGeneration else { continue }
+        await self.convergeRuntime(.savedRules)
+        if generation == self.ruleApplicationGeneration { return }
+      }
+    }
+  }
+
+  /// 自定义规则安全摘要：数量 + 内容版本，不含原始域名。
+  func readCustomRuleSummary() -> CustomRuleSummary? {
+    try? CustomRuleSummary.summarizing(ruleDocuments.load())
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Facts.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Facts.swift
new file mode 100644
index 000000000..efe7678ab
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Facts.swift
@@ -0,0 +1,105 @@
+import Foundation
+
+// MARK: - 只读事实投影与静态缝
+
+extension ProxyRuntimeController {
+  var isActiveTargetPresent: Bool { machine.activeTargetID != nil }
+
+  /// Agent 开关意图（持久化事实；开关 UI 的绑定来源）。
+  var agentIntentEnabled: Bool { settings.agentEnabled }
+
+  /// 系统代理开关意图（持久化事实；开关 UI 的绑定来源）。
+  var systemProxyIntentEnabled: Bool { settings.systemProxyEnabled }
+
+  /// 系统代理观察机的呈现事实门面：存储与发布在 `SystemProxyObserver`，
+  /// 此处只读投影供既有测试与诊断面沿用原名。
+  var systemProxyState: SystemProxyApplicationFacts { systemProxyObserver.systemProxyState }
+  var systemProxyApprovalRequired: Bool { systemProxyObserver.systemProxyApprovalRequired }
+  var systemProxyInspection: SystemProxyInspectionFacts {
+    systemProxyObserver.systemProxyInspection
+  }
+
+  /// Desired system proxy configuration：当前保存设置要求的代理值（ADR-0022）。
+  /// 观察机经 init 闭包读取同一事实源。`nil` 只表示尚无运行时文档。
+  var desiredSystemProxyConfiguration: SystemProxyConfiguration? {
+    guard let document = runtimeObservation else { return nil }
+    return proxyMode.systemProxyConfiguration(
+      for: document.listen, exceptions: settings.proxyExceptionList)
+  }
+
+  /// Stable app-facing projection for status-menu presentation. The menu does
+  /// not depend on this controller's nested state representation.
+  var runtimeFacts: ProxyRuntimeFacts {
+    let facts = ProxyRuntimeFacts(state: state)
+    return ProxyRuntimeFacts(
+      status: facts.status, isOn: facts.isOn,
+      failure: facts.failure
+        ?? (proxyMode == .rule && settings.agentEnabled ? ruleApplicationFailure : nil))
+  }
+
+  static var defaultFirewallExecutableURLs: [URL] {
+    let bundle = Bundle.main.bundleURL
+    return [
+      bundle.appendingPathComponent("Contents/MacOS/ShadowsocksX-NG2Agent"),
+      bundle.appendingPathComponent("Contents/Helpers/sslocal"),
+    ]
+  }
+
+  /// 诊断只读面：当前监听设置；监听地址在导出中只以回环/非回环
+  /// 两态呈现。
+  var listenSettings: ProxyListeningConfiguration { settings.listen }
+
+  /// 当前已部署 runtime 的完整监听身份。已停止或启动失败时没有有效的
+  /// runtime 例外，不能拿最后一次设置快照冒充仍在监听。
+  var effectiveRuntimeListenFacts: RuntimeListenFacts? {
+    let isListening: Bool
+    switch state {
+    case .running, .firewallBlocked:
+      isListening = true
+    case .off, .starting, .launchFailed, .requiresApproval, .serviceFailed:
+      isListening = false
+    }
+    guard isListening, let runtimeObservation else { return nil }
+    return runtimeObservation.listen
+  }
+
+  /// PID of the sslocal child that owns the active runtime document. A process
+  /// name alone is not sufficient to treat an occupied listener as replaceable.
+  var effectiveRuntimeListenerProcessID: Int32? {
+    guard effectiveRuntimeListenFacts != nil,
+      let runtimeObservation,
+      let receipt = runtimeFileStore.readRuntimeReceipt(),
+      receipt.deploymentID
+        == runtimeFileStore.receiptIdentity(for: runtimeObservation.intentSHA256),
+      processIsAlive(receipt.processID)
+    else { return nil }
+    return receipt.processID
+  }
+
+  /// 运行时契约的脱敏摘要（数量与协议元数据）；契约缺失或无效返回 nil。
+  /// 诊断导出不读契约内容，只携带此摘要。
+  func runtimeDocumentSummary() -> String? {
+    runtimeFileStore.publishedSummary()
+  }
+}
+
+extension ProxyRuntimeController.AgentRunState {
+  /// Agent 运行状态的「在跑」投影（状态摘要与诊断口径）：启动失败等未运行
+  /// 态视为未跑。
+  var isOn: Bool {
+    switch self {
+    case .off, .launchFailed, .serviceFailed:
+      false
+    case .starting, .running, .firewallBlocked, .requiresApproval:
+      true
+    }
+  }
+}
+
+extension ProxyRuntimeController: Activating {}
+
+extension ProxyRuntimeController {
+  static func makeProxyMode(from settings: ProxyRuntimeSettings) -> ProxyMode {
+    ProxyMode.availableModes.first { $0.kind == settings.preferredMode } ?? .rule
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Health.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Health.swift
new file mode 100644
index 000000000..e1065666b
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Health.swift
@@ -0,0 +1,247 @@
+import Foundation
+
+private struct LocalEndpointFailure {
+  let local: SslocalLocalDocument
+  let host: String
+  let outcome: EndpointHealthProbe.Outcome
+}
+
+private enum LaunchHealthAttempt {
+  case ready(RuntimeDeploymentReceipt?)
+  case retry(LocalEndpointFailure?)
+  case agentLost
+}
+
+private struct LaunchHealthTimeout {
+  let expectedDigest: String?
+  let endpointFailure: LocalEndpointFailure?
+  let generation: Int
+  let preparation: Int
+  let preserveProxyOnFailure: Bool
+}
+
+extension ProxyRuntimeController {
+  /// 启动健康呈现：确认本地入站；直连模式额外要求
+  /// 回执持续指向当前健康子进程，防止旧监听通过共享端口冒充新实例。
+  @discardableResult
+  func presentLaunchHealth(
+    _ document: SslocalRuntimeDocument,
+    requiresReceipt: Bool = false,
+    convergeProxyOnSuccess: Bool = true,
+    preserveProxyOnFailure: Bool = false,
+    preparedContract: PreparedRuntimeContract? = nil,
+    reloadingProcessID: Int32? = nil
+  ) async -> Bool {
+    guard preparedContract == nil || preparedContract?.document == document else {
+      return await reportRuntimeFileFailure(preserveProxyOnFailure: preserveProxyOnFailure)
+    }
+    let facts = RuntimeDeploymentFacts(document)
+    let generation = flowGeneration
+    let preparation = runtimePreparationGeneration
+    let expectedDigest =
+      requiresReceipt ? runtimeFileStore.receiptIdentity(for: document.intentSHA256) : nil
+    guard !requiresReceipt || expectedDigest != nil else {
+      return await reportRuntimeFileFailure(preserveProxyOnFailure: preserveProxyOnFailure)
+    }
+
+    let deadline = Date().addingTimeInterval(launchHealthTimeoutSeconds)
+    var endpointFailure: LocalEndpointFailure?
+    while Date() < deadline {
+      guard generation == flowGeneration, preparation == runtimePreparationGeneration else {
+        return false
+      }
+      let attempt = await launchHealthAttempt(
+        facts, expectedDigest: expectedDigest, reloadingProcessID: reloadingProcessID)
+      guard generation == flowGeneration, preparation == runtimePreparationGeneration else {
+        return false
+      }
+      switch attempt {
+      case .ready(let receipt):
+        return await finishHealthyLaunch(
+          facts,
+          receipt: receipt,
+          generation: (generation, preparation),
+          convergeProxyOnSuccess: convergeProxyOnSuccess,
+          preserveProxyOnFailure: preserveProxyOnFailure)
+      case .retry(let endpoint):
+        endpointFailure = endpoint
+      case .agentLost:
+        return await reportAgentLost(preserveProxyOnFailure: preserveProxyOnFailure)
+      }
+      try? await launchHealthRetryDelay()
+    }
+    return await reportLaunchHealthTimeout(
+      LaunchHealthTimeout(
+        expectedDigest: expectedDigest,
+        endpointFailure: endpointFailure,
+        generation: generation, preparation: preparation,
+        preserveProxyOnFailure: preserveProxyOnFailure))
+  }
+
+  private func launchHealthAttempt(
+    _ document: RuntimeDeploymentFacts,
+    expectedDigest: String?, reloadingProcessID: Int32? = nil
+  ) async -> LaunchHealthAttempt {
+    if runtimeFileStore.blocksDeployment(document.intentSHA256) { return .agentLost }
+    var receiptForHealth: RuntimeDeploymentReceipt?
+    if let expectedDigest {
+      guard let receipt = runtimeFileStore.readRuntimeReceipt(),
+        receipt.deploymentID == expectedDigest
+      else {
+        return .retry(nil)
+      }
+      guard receipt.processID > 0, processIsAlive(receipt.processID) else {
+        return .agentLost
+      }
+      receiptForHealth = receipt
+    }
+
+    if reloadingProcessID == nil || receiptForHealth?.processID != reloadingProcessID {
+      if reloadingProcessID != nil { state = .starting }
+      if let endpointFailure = await unhealthyLocalEndpoint(in: document) {
+        return .retry(endpointFailure)
+      }
+    }
+
+    if let receiptForHealth {
+      guard runtimeFileStore.readRuntimeReceipt() == receiptForHealth else {
+        return .retry(nil)
+      }
+      guard processIsAlive(receiptForHealth.processID) else { return .agentLost }
+    }
+    return .ready(receiptForHealth)
+  }
+
+  private func finishHealthyLaunch(
+    _ document: RuntimeDeploymentFacts,
+    receipt: RuntimeDeploymentReceipt?,
+    generation: (flow: Int, preparation: Int),
+    convergeProxyOnSuccess: Bool,
+    preserveProxyOnFailure: Bool
+  ) async -> Bool {
+    guard generation.flow == flowGeneration,
+      generation.preparation == runtimePreparationGeneration
+    else { return false }
+    await presentFirewallStatus(for: document)
+    guard generation.flow == flowGeneration,
+      generation.preparation == runtimePreparationGeneration
+    else { return false }
+    if let receipt, !receiptIsCurrentAndLive(receipt) {
+      return await reportAgentLost(preserveProxyOnFailure: preserveProxyOnFailure)
+    }
+    if convergeProxyOnSuccess { await systemProxyObserver.convergeSystemProxy() }
+    return true
+  }
+
+  private func receiptIsCurrentAndLive(_ receipt: RuntimeDeploymentReceipt) -> Bool {
+    guard receipt.processID > 0,
+      runtimeFileStore.readRuntimeReceipt() == receipt
+    else { return false }
+    return processIsAlive(receipt.processID)
+  }
+
+  private func reportAgentLost(preserveProxyOnFailure: Bool) async -> Bool {
+    guard !preserveProxyOnFailure else { return false }
+    state = .serviceFailed(.agent)
+    await systemProxyObserver.holdSystemProxyIntent()
+    return false
+  }
+
+  private func reportRuntimeFileFailure(preserveProxyOnFailure: Bool) async -> Bool {
+    guard !preserveProxyOnFailure else { return false }
+    state = .serviceFailed(.runtimeFile)
+    await systemProxyObserver.holdSystemProxyIntent()
+    return false
+  }
+
+  private func reportLaunchHealthTimeout(_ timeout: LaunchHealthTimeout) async -> Bool {
+    guard timeout.generation == flowGeneration,
+      timeout.preparation == runtimePreparationGeneration
+    else { return false }
+    guard !timeout.preserveProxyOnFailure else { return false }
+    if let expectedDigest = timeout.expectedDigest,
+      !hasLiveReceipt(expectedDigest: expectedDigest)
+    {
+      return await reportAgentLost(preserveProxyOnFailure: false)
+    }
+    if let endpointFailure = timeout.endpointFailure {
+      presentEndpointFailure(endpointFailure)
+    } else {
+      state = .launchFailed(
+        .localEndpoint(endpoint: "SOCKS", host: "127.0.0.1", port: 0, cause: .unknown))
+    }
+    await systemProxyObserver.holdSystemProxyIntent()
+    return false
+  }
+
+  private func hasLiveReceipt(expectedDigest: String) -> Bool {
+    guard let receipt = runtimeFileStore.readRuntimeReceipt(),
+      receipt.deploymentID == expectedDigest
+    else { return false }
+    return receiptIsCurrentAndLive(receipt)
+  }
+
+  private func unhealthyLocalEndpoint(
+    in document: RuntimeDeploymentFacts
+  ) async -> LocalEndpointFailure? {
+    for local in document.locals {
+      let outcome = await probeAsync(
+        host: local.probeHost, port: local.localPort, timeout: 1.5)
+      if outcome != .reachable {
+        return LocalEndpointFailure(local: local, host: local.probeHost, outcome: outcome)
+      }
+    }
+    return nil
+  }
+
+  private func presentEndpointFailure(_ failure: LocalEndpointFailure) {
+    let detail: String
+    let cause: RuntimeEndpointFailure
+    switch failure.outcome {
+    case .reachable:
+      detail = "已连通"
+      cause = .unknown
+    case .refused(let reason):
+      detail = reason
+      cause = .refused
+    case .timedOut:
+      detail = "连接超时"
+      cause = .timedOut
+    }
+    RuntimeLog.emit(
+      .endpointProbeFailed(
+        host: failure.host, port: failure.local.localPort, detail: detail))
+    let endpointName = failure.local.inboundProtocol.uppercased()
+    state = .launchFailed(
+      .localEndpoint(
+        endpoint: endpointName, host: failure.host, port: failure.local.localPort, cause: cause))
+  }
+}
+
+extension ProxyRuntimeController {
+  /// Agent 独占稳定运行期间的故障判定；GUI 只读取明确失败，避免重复连接入站。
+  /// 任务柄仍由系统代理观察机持有，并保留批准状态与待首次应用的刷新。
+  func runSystemProxyHealthObservationLoop() async {
+    while !Task.isCancelled {
+      try? await Task.sleep(nanoseconds: systemProxyHealthPollIntervalNanoseconds)
+      guard !Task.isCancelled,
+        settings.systemProxyEnabled || systemProxyState.hasOperationFailure
+      else { return }
+      systemProxyObserver.refreshSystemProxyApproval()
+      systemProxyObserver.updateSystemProxyActions()
+      guard settings.systemProxyEnabled, state != .starting, runtimeReloadProcesses.isEmpty,
+        !systemProxyObserver.systemProxyStartupInProgress, settings.agentEnabled,
+        let document = runtimeObservation
+      else { continue }
+      if let failure = runtimeFileStore.readFailure(),
+        let deploymentID = runtimeFileStore.receiptIdentity(for: document.intentSHA256),
+        failure.deploymentID == deploymentID
+      {
+        state = .serviceFailed(.agent)
+        await systemProxyObserver.suspendSystemProxy()
+      } else if systemProxyObserver.systemProxyInitialApplyPending {
+        await systemProxyObserver.convergeSystemProxy()
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Mode.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Mode.swift
new file mode 100644
index 000000000..e3fca5ae2
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Mode.swift
@@ -0,0 +1,30 @@
+import Foundation
+
+extension ProxyRuntimeController {
+  /// The choice persists in UserDefaults independently of listening configuration. ACL-backed modes (direct
+  /// and global) also deploy and verify the ACL runtime even when system proxy
+  /// is off, because manually connected SOCKS and HTTP clients use the same ACL.
+  func setProxyMode(_ mode: ProxyMode) async {
+    guard mode != proxyMode else { return }
+    await transitionMode(mode, preset: settings.rulePreset)
+  }
+
+  /// 切换规则预设；失败保留最新意图，发布后失败停止服务并暂停系统代理。
+  func setRulePreset(_ preset: RulePreset) async {
+    guard preset != settings.rulePreset else { return }
+    await transitionMode(proxyMode, preset: preset)
+  }
+
+  private func transitionMode(
+    _ mode: ProxyMode,
+    preset: RulePreset
+  ) async {
+    controlPreferences.preferredMode = mode.kind
+    controlPreferences.rulePreset = preset
+    settings.preferredMode = mode.kind
+    settings.rulePreset = preset
+    proxyMode = mode
+    modeChangeGeneration += 1
+    await convergeRuntime(.modeTransition)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Preparation.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Preparation.swift
new file mode 100644
index 000000000..066239116
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Preparation.swift
@@ -0,0 +1,75 @@
+import Foundation
+
+// 运行状态收敛 module 的配置派生实现；异步计算前捕获事实，恢复后拒绝旧结果。
+extension ProxyRuntimeController {
+  enum RulePreparationError: Error { case superseded }
+
+  private struct RulePreparationTicket {
+    let generation: Int
+    let flow: Int
+    let modeGeneration: Int
+    let settings: ProxyRuntimeSettings
+    let target: NodeID?
+    let ruleRevision: Int?
+  }
+
+  /// Capture mutable facts before leaving the UI actor. A stale task may not
+  /// mutate runtime state or write a contract, even when its calculation fails.
+  func runtimeDocument(
+    _ source: SslocalRuntimeDocument, for mode: ProxyMode
+  ) async throws -> SslocalRuntimeDocument {
+    runtimePreparationGeneration += 1
+    let ticket = RulePreparationTicket(
+      generation: runtimePreparationGeneration, flow: flowGeneration,
+      modeGeneration: modeChangeGeneration, settings: settings, target: activeTargetID,
+      ruleRevision: mode == .rule ? ruleDocuments.revision : nil)
+    do {
+      let user = mode == .rule ? try ruleDocuments.load() : nil
+      let builtIn =
+        mode == .rule ? try await runtimeBuiltinRules(ticket.settings.rulePreset) : []
+      let aclURL = runtimeFileStore.aclFileURL
+      let result = await Task.detached(priority: .userInitiated) {
+        RuleRuntimeCompiler.compile(
+          .init(
+            source: source, mode: mode, defaultAction: ticket.settings.ruleDefaultAction,
+            document: user, builtIn: builtIn, aclURL: aclURL))
+      }.value
+      guard preparationIsCurrent(ticket) else { throw RulePreparationError.superseded }
+      let lan = ticket.settings.listen.lan
+      guard lan.isEnabled && lan.authenticationEnabled else { return result.authenticatingLAN(nil) }
+      guard let password = lan.password else {
+        throw ProxyListeningStoreError.credentialFailure(detail: String(localized: "局域网身份验证密码不可读"))
+      }
+      let auth = RuntimeListenerAuthentication(
+        username: lan.username, password: password,
+        directory: runtimeFileStore.fileURL.deletingLastPathComponent().standardizedFileURL.path)
+      guard auth.isValid else {
+        throw ProxyListeningStoreError.credentialFailure(detail: String(localized: "局域网身份验证凭据无效"))
+      }
+      return result.authenticatingLAN(auth)
+    } catch {
+      guard preparationIsCurrent(ticket) else { throw RulePreparationError.superseded }
+      throw error
+    }
+  }
+
+  private func preparationIsCurrent(_ ticket: RulePreparationTicket) -> Bool {
+    ticket.generation == runtimePreparationGeneration && ticket.flow == flowGeneration
+      && ticket.modeGeneration == modeChangeGeneration
+      && ticket.settings.listen == settings.listen
+      && ticket.settings.preferredMode == settings.preferredMode
+      && ticket.settings.rulePreset == settings.rulePreset
+      && ticket.settings.agentEnabled == settings.agentEnabled
+      && ticket.target == activeTargetID
+      && (ticket.ruleRevision == nil || ticket.ruleRevision == ruleDocuments.revision)
+  }
+
+  private func runtimeBuiltinRules(_ preset: RulePreset) async throws -> [ProxyRule] {
+    var snapshots: [RuleSnapshot] = []
+    for source in preset.sources { snapshots.append(try await ruleSnapshots.load(source)) }
+    let captured = snapshots
+    return await Task.detached(priority: .userInitiated) {
+      captured.flatMap { preset.rules(from: $0) }
+    }.value
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+SettingsSync.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+SettingsSync.swift
new file mode 100644
index 000000000..5ba06dc92
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+SettingsSync.swift
@@ -0,0 +1,112 @@
+import Foundation
+
+// MARK: - 设置变更与目录提交同步
+
+extension ProxyRuntimeController {
+  /// A published mapping invalidates prepared documents before asynchronous convergence.
+  func pluginMappingsDidPublish() {
+    runtimePreparationGeneration += 1
+  }
+
+  /// 目录提交协调器的生产适配入口：以刚提交的内存快照重展开，
+  /// 不回读磁盘（磁盘仍是重启与跨进程恢复的权威来源）。agent 意图开启时
+  /// 原子更新运行时；目标失效 → 清除目标但 agent 继续监听。返回结构化收敛
+  /// 结果，健康检查耗时属于本调用的异步收敛阶段，不改变「目录已提交」的事实。
+  /// 「有效值未变的提交不做运行时收敛」由收敛脊柱 apply 层的 plan 空判定
+  /// 承担（`convergencePlanIsEmpty`）；派生被更新的收敛取代时按重校验呈现。
+  func catalogDidCommit(snapshot catalog: ConfigurationCatalog) async -> RuntimeSyncOutcome {
+    guard catalogSnapshotReader.isCatalogAvailable else { return .failed(failure: nil) }
+    switch reexpand(in: catalog) {
+    case .deployed(let configuration):
+      guard settings.agentEnabled else {
+        return .revalidated
+      }
+      let result = await deploy(configuration.document)
+      if case .superseded = result {
+        return .revalidated
+      }
+      return Self.syncOutcome(
+        agentState: state, systemProxyState: systemProxyState,
+        skippedServers: configuration.skippedServers)
+    case .clearedAndStopped(let failure):
+      await handleCleared(failure)
+      return .clearedAndStopped(failure)
+    case nil:
+      guard settings.agentEnabled else {
+        return .revalidated
+      }
+      // 无活动目标：已在以空列表监听则不重走健康门（目录提交不该让状态闪回
+      // starting）；否则补齐空监听。
+      if state != .off, runtimeObservation?.hasServers == false {
+        return Self.syncOutcome(
+          agentState: state, systemProxyState: systemProxyState, skippedServers: [])
+      }
+      await deployListeningWithoutTarget()
+      return Self.syncOutcome(
+        agentState: state, systemProxyState: systemProxyState, skippedServers: [])
+    }
+  }
+
+  /// 部署后的控制器状态 → 结构化收敛结果：健康通过（含防火墙受阻的运行态）
+  /// 视为已收敛；系统代理写入失败携带点名细节，待应用不算目录收敛失败。
+  private static func syncOutcome(
+    agentState: AgentRunState, systemProxyState: SystemProxyControlState,
+    skippedServers: [SkippedServer]
+  ) -> RuntimeSyncOutcome {
+    if case .failed(let facts) = systemProxyState {
+      return .failed(failure: .systemProxy(facts))
+    }
+    switch agentState {
+    case .running, .firewallBlocked:
+      return .converged(skippedServers: skippedServers)
+    case .launchFailed(let facts):
+      return .failed(failure: .launch(facts))
+    case .serviceFailed(let facts):
+      return .failed(failure: .service(facts))
+    case .requiresApproval, .off, .starting:
+      return .failed(failure: nil)
+    }
+  }
+
+  /// 保存监听配置后更新内存并收敛；文件失败不发布新值。
+  func updateListening(_ proposed: ProxyListeningConfiguration) async throws {
+    guard !settingsUnreadable else { throw ProxyListeningStoreError.encryptedFile(.notLoaded) }
+    try listeningStore.save(proposed)
+    settings.listen = proposed
+    settingsUnreadable = false
+    guard state != .off else { return }
+    await convergeToReexpanded(catalogSnapshotReader.catalogSnapshot)
+  }
+
+  /// 系统代理例外是独立偏好；更新后沿用当前运行配置派生与系统代理应用路径。
+  func updateProxyExceptions(_ value: String) async {
+    controlPreferences.proxyExceptions = value
+    settings.proxyExceptions = value
+    guard state != .off else { return }
+    await convergeToReexpanded(catalogSnapshotReader.catalogSnapshot)
+  }
+
+  /// Applies the post-import 2.0 runtime boundary without touching
+  /// SystemConfiguration. Importing data leaves the user's system proxy
+  /// dictionary untouched; any currently running 2.0 runtime is stopped and
+  /// the existing 2.0 target/settings are reloaded.
+  func legacyImportDidCommit() async {
+    cancelFirewallObservation()
+    flowGeneration += 1
+    _ = await execute(.stop, document: nil)
+    state = .off
+    runtimeObservation = nil
+    skippedServers = []
+    lastActivationFailure = nil
+    // 导入边界不触碰 SystemConfiguration（既有不变量），系统代理状态面同
+    // 样不动：它呈现的是系统设置的真实作用，不由导入改写。
+
+    if let restored = try? listeningStore.load() {
+      settings.listen = restored
+      settingsUnreadable = false
+    }
+    let persistedTarget = try? activationFileStore.loadActiveTargetID()
+    machine = ActivationStateMachine(activeTargetID: persistedTarget ?? nil)
+    activeTargetID = machine.activeTargetID
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+SystemProxyGate.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+SystemProxyGate.swift
new file mode 100644
index 000000000..63e68e4eb
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+SystemProxyGate.swift
@@ -0,0 +1,134 @@
+import Foundation
+
+// MARK: - 防火墙呈现、wrapper 观测与系统代理出口事实
+
+extension ProxyRuntimeController {
+  func presentFirewallStatus(for document: RuntimeDeploymentFacts) async {
+    let generation = flowGeneration
+    let preparation = runtimePreparationGeneration
+    guard document.listen.lan.effectiveMode.exposesNetworkInterfaces else {
+      state = .running
+      return
+    }
+    let blocked = await blockedFirewallExecutable()
+    guard generation == flowGeneration, preparation == runtimePreparationGeneration else { return }
+    if let blocked {
+      presentFirewallBlocked(blocked)
+      return
+    }
+    state = .running
+    observeFirewall(generation: flowGeneration)
+  }
+
+  private func blockedFirewallExecutable() async -> URL? {
+    for executableURL in firewallExecutableURLs {
+      let status = await firewallStatus(for: executableURL)
+      if status == .blocked { return executableURL }
+    }
+    return nil
+  }
+
+  private func presentFirewallBlocked(_ executableURL: URL) {
+    let name = executableURL.lastPathComponent
+    state = .firewallBlocked(FirewallBlockedFacts(executableName: name))
+  }
+
+  private func observeFirewall(generation: Int) {
+    firewallObservationTask?.cancel()
+    let interval = firewallPollIntervalNanoseconds
+    firewallObservationTask = Task { @MainActor [weak self] in
+      while !Task.isCancelled {
+        try? await Task.sleep(nanoseconds: interval)
+        guard !Task.isCancelled, let self, generation == flowGeneration else { return }
+        if let blocked = await blockedFirewallExecutable() {
+          // await 恢复后代际可能已被 execute 推进（含取消本任务的 stop 路径）：
+          // 过期的防火墙事实不得盖到最新状态呈现上。
+          guard generation == flowGeneration else { return }
+          presentFirewallBlocked(blocked)
+          firewallObservationTask = nil
+          return
+        }
+      }
+    }
+  }
+
+  func cancelFirewallObservation() {
+    firewallObservationTask?.cancel()
+    firewallObservationTask = nil
+  }
+
+  private func firewallStatus(for executableURL: URL) async -> FirewallBlockStatus {
+    let checker = firewallChecker
+    return await Task.detached(priority: .utility) {
+      await checker.status(for: executableURL)
+    }.value
+  }
+
+  func probeAsync(
+    host: String, port: Int, timeout: TimeInterval
+  ) async -> EndpointHealthProbe.Outcome {
+    let probe = probe
+    return await Task.detached(priority: .utility) {
+      await probe.probe(host: host, port: port, timeout: timeout)
+    }.value
+  }
+
+  /// 显式停止协议次序：注销（SIGTERM wrapper → wrapper 停 sslocal 并
+  /// 等待）完成后才允许后续删文件动作。最多等 5 秒，超时也继续（launchd 会
+  /// 兜底结束进程）。
+  func waitForWrapperExit() async {
+    let deadline = Date().addingTimeInterval(5)
+    while wrapperState() != .notRunning && Date() < deadline {
+      try? await Task.sleep(nanoseconds: 100_000_000)
+    }
+  }
+
+  func wrapperState() -> WrapperProcessState {
+    guard
+      let data = try? Data(contentsOf: runtimeFileStore.pidFileURL),
+      let text = String(data: data, encoding: .utf8)?.trimmingCharacters(
+        in: .whitespacesAndNewlines),
+      let pid = Int32(text)
+    else { return .notRunning }
+    guard sendSignal(pid, 0) == 0 else { return .notRunning }
+    return .running(pid: pid)
+  }
+
+  // MARK: - 目录同步
+
+  /// Re-expands one command-start snapshot; a concurrently published catalog
+  /// is intentionally observed by the next command, not halfway through this one.
+  func reexpand(in catalog: ConfigurationCatalog) -> ActivationEffect? {
+    guard catalogSnapshotReader.isCatalogAvailable else { return nil }
+    let effect = machine.catalogDidCommit(
+      catalog, plugins: plugins,
+      options: settings.runtimeDocumentOptions)
+    activeTargetID = machine.activeTargetID
+    switch effect {
+    case .deployed(let configuration):
+      skippedServers = configuration.skippedServers
+    case .clearedAndStopped:
+      skippedServers = []
+    case nil:
+      break
+    }
+    return effect
+  }
+
+  func describe(_ error: Error) -> String {
+    String(describing: error)
+  }
+
+  // MARK: - 系统代理出口事实
+
+  /// 出口可用 = agent 入站健康（回环入口可用，含防火墙仅阻主机态的情形）
+  /// 且模式有出口；直连不依赖活动服务器目标。观察机以闭包读取同一事实源。
+  var systemProxyExitAvailable: Bool {
+    switch state {
+    case .running, .firewallBlocked:
+      return proxyMode == .direct || activeTargetID != nil
+    case .off, .starting, .launchFailed, .requiresApproval, .serviceFailed:
+      return false
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController.swift
new file mode 100644
index 000000000..de683a4c6
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController.swift
@@ -0,0 +1,200 @@
+import Foundation
+
+/// GUI-owned runtime and system-proxy manager. Agent and system-proxy switches
+/// persist independent intentions. System proxy writes use the privileged helper;
+/// current configuration is observed read-only and differs from write outcomes.
+/// Health/exit loss suspends system proxy settings, real recovery reapplies, and
+/// passive network events only inspect (ADR-0022)——该观察/修复策略机
+/// 独立在 `SystemProxyObserver`：控制器注入意图/出口/期望配置三个事实闭包并
+/// 转发命令，健康循环保留在本体（循环体含运行时健康呈现）。GUI exit ends these
+/// observations without stopping the LaunchAgent or adding helper responsibilities.
+@MainActor
+final class ProxyRuntimeController {
+  /// Agent（后台代理运行时）运行状态。系统代理结果不在此面呈现——它有
+  /// 独立的 `SystemProxyControlState`。
+  enum AgentRunState: Equatable {
+    case off
+    case starting
+    case running
+    /// 代理在本机运行，但主机地址态的入站被 macOS 防火墙拒绝。
+    case firewallBlocked(FirewallBlockedFacts)
+    /// 启动失败：携带点名端点与端口的事实。
+    case launchFailed(LaunchFailureFacts)
+    /// 需要用户在系统设置-登录项中允许后台项。
+    case requiresApproval
+    /// 服务管理或运行时文件本身失败。
+    case serviceFailed(ServiceFailureFacts)
+  }
+
+  /// Current configuration or operation result, independent of persisted intent.
+  typealias SystemProxyControlState = SystemProxyApplicationFacts
+
+  var state: AgentRunState = .off { didSet { factChanges.markChanged() } }
+  var settings: ProxyRuntimeSettings { didSet { factChanges.markChanged() } }
+  /// 当前活动目标（菜单栏状态摘要与级联只读呈现用）。machine 是
+  /// 非通道值的普通结构体，代理关闭路径的激活动作不会触碰 state，菜单的
+  /// 「目标」行依赖此属性独立触发事实通道保持实时。
+  var activeTargetID: NodeID? { didSet { factChanges.markChanged() } }
+  /// 最近一次激活预检在分组中跳过的服务器；仅记录 app 已知的本地阻塞原因。
+  var skippedServers: [SkippedServer] = [] { didSet { factChanges.markChanged() } }
+  /// 最近一次激活拒绝或目标清除的点名原因。独立于运行状态呈现：agent 可
+  /// 能仍在监听，激活失败不代表运行时停止。
+  var lastActivationFailure: ActivationFailure? { didSet { factChanges.markChanged() } }
+  var machine: ActivationStateMachine
+  /// 运行时事实变化通道（didChange 语义）：全部事实属性的 didSet 汇集于此，
+  /// 同一主队列轮内多次写合并为一次，冲洗晚于同步轮——重观察方读到的必是
+  /// 完整事实，不依赖 `objectWillChange` + 主队列跳的 willChange 时序。
+  let factChanges = CoalescedFactSignal()
+
+  let catalogSnapshotReader: RuntimeCatalogSnapshotReading
+  let activationFileStore: ActivationStateFileStore
+  let runtimeFileStore: RuntimeFileStore
+  let plugins: PluginExecutableResolving
+  let refreshPluginSecurityFacts: @MainActor () -> Void
+  let controlPreferences: ProxyControlPreferences
+  let listeningStore: ProxyListeningStoring
+  /// 自定义规则持久化：规则模式 ACL 合并的用户入口。
+  var ruleApplicationTask: Task<Void, Never>?
+  var ruleApplicationGeneration = 0
+  var ruleApplicationFailure: RuntimeFailureFacts? { didSet { factChanges.markChanged() } }
+  let customRuleStore: CustomRuleStore
+  private var presetDocuments: [RulePreset: RuleDocumentSession] = [:]
+  var ruleDocuments: RuleDocumentSession { documents(for: settings.rulePreset) }
+
+  func documents(for preset: RulePreset) -> RuleDocumentSession {
+    if let session = presetDocuments[preset] { return session }
+    let session = RuleDocumentSession(
+      store: CustomRuleStore(preset: preset, baseURL: customRuleStore.baseURL))
+    presetDocuments[preset] = session
+    return session
+  }
+  let ruleSnapshots: BuiltinRuleSnapshots
+  var runtimePreparationGeneration = 0
+  /// 新版偏好不可读时禁止部署，不以出厂端口静默替代用户配置。
+  var settingsUnreadable: Bool
+  let agent: LaunchAgentControlling
+  let probe: EndpointProbing
+  let systemProxy: SystemProxyControlling
+  let systemProxyHelper: SystemProxyHelperServicing
+  let systemProxyNetworkChangeMonitor: SystemProxyNetworkChangeMonitoring
+  /// 系统代理观察/修复策略机（ADR-0022）：呈现事实的存储与发布点，详情见
+  /// 模块文档。惰性构造：事实闭包需捕获控制器，而闭包成形必须晚于自身
+  /// 全部存储属性的初始化（首次访问发生在 init 之后）。
+  lazy var systemProxyObserver: SystemProxyObserver = SystemProxyObserver(
+    systemProxy: systemProxy,
+    systemProxyHelper: systemProxyHelper,
+    systemProxyNetworkChangeMonitor: systemProxyNetworkChangeMonitor,
+    appBundle: appBundle,
+    helperRefreshDelayNanoseconds: helperRefreshDelayNanoseconds,
+    isIntentEnabled: { [weak self] in self?.settings.systemProxyEnabled ?? false },
+    isExitAvailable: { [weak self] in self?.systemProxyExitAvailable ?? false },
+    desiredConfiguration: { [weak self] in
+      guard let self else { return nil }
+      return self.desiredSystemProxyConfiguration
+    },
+    systemProxyHealthObservationLoop: { [weak self] in
+      guard let self else { return }
+      await self.runSystemProxyHealthObservationLoop()
+    })
+  let firewallChecker: FirewallStatusChecking
+  let firewallExecutableURLs: [URL]
+  /// 宿主 app bundle 缝（生产为 Bundle.main）：内置规则快照与 LaunchDaemon
+  /// 清单等打包资源的定位基准。去宿主化（ADR 0021）后单测运行于 xctest
+  /// runner，`Bundle.main` 不再是 app，经此缝注入构建产物 bundle。
+  let appBundle: Bundle
+  let firewallPollIntervalNanoseconds: UInt64
+  let launchHealthTimeoutSeconds: TimeInterval
+  let launchHealthRetryDelay: () async throws -> Void
+  let ruleApplicationDelay: () async throws -> Void
+  /// 注册清单漂移重注时，注销与重注的间隔（launchd 对节流中 job 的移除异步）。
+  let systemProxyHealthPollIntervalNanoseconds: UInt64
+  let helperRefreshDelayNanoseconds: UInt64
+  /// 信号发送缝（默认 kill），单测观测 SIGUSR1 投递。
+  let sendSignal: @Sendable (Int32, Int32) -> Int32
+  let processIsAlive: @Sendable (Int32) -> Bool
+  /// 并发流代际：停止请求可使进行中的启动探测立即失效。
+  var flowGeneration = 0
+  var modeChangeGeneration = 0
+  var runtimeObservation: RuntimeDeploymentFacts?
+  var runtimeReloadProcesses: [UUID: Int32] = [:]
+  var firewallObservationTask: Task<Void, Never>?
+
+  var proxyMode: ProxyMode { didSet { factChanges.markChanged() } }
+
+  /// 规则模式子选项：从设置快照投影。
+  var rulePreset: RulePreset { settings.rulePreset }
+
+  init(
+    controlPreferences: ProxyControlPreferences = ProxyControlPreferences(),
+    catalogSnapshotReader: RuntimeCatalogSnapshotReading,
+    activationFileStore: ActivationStateFileStore = ActivationStateFileStore(
+      fileURL: ActivationStateFileStore.defaultFileURL()),
+    runtimeFileStore: RuntimeFileStore = RuntimeFileStore(),
+    plugins: PluginExecutableResolving = BundleManagedPluginProvider(),
+    refreshPluginSecurityFacts: @escaping @MainActor () -> Void = {},
+    listeningStore: ProxyListeningStoring = ProxyListeningFileStore(),
+    customRuleStore: CustomRuleStore = CustomRuleStore(),
+    appBundle: Bundle = .main,
+    ruleSnapshots: BuiltinRuleSnapshots? = nil,
+    settingsRestore: RestoredProxyRuntimeSettings? = nil,
+    agent: LaunchAgentControlling = SMAppLaunchAgentService(),
+    probe: EndpointProbing = SystemEndpointProbe(),
+    systemProxy: SystemProxyControlling = XPCSystemProxyController(),
+    systemProxyHelper: SystemProxyHelperServicing = SMAppServiceSystemProxyHelper(),
+    systemProxyNetworkChangeMonitor: SystemProxyNetworkChangeMonitoring =
+      NoopSystemProxyNetworkChangeMonitor(),
+    proxyMode: ProxyMode? = nil,
+    firewallChecker: FirewallStatusChecking = SocketFilterFirewallChecker(),
+    firewallExecutableURLs: [URL]? = nil,
+    firewallPollIntervalNanoseconds: UInt64 = 2_000_000_000,
+    launchHealthTimeoutSeconds: TimeInterval = 30,
+    launchHealthRetryDelay: @escaping () async throws -> Void = {
+      try await Task.sleep(for: .milliseconds(200))
+    },
+    ruleApplicationDelay: @escaping () async throws -> Void = {
+      try await Task.sleep(for: .milliseconds(150))
+    },
+    systemProxyHealthPollIntervalNanoseconds: UInt64 = 5_000_000_000,
+    helperRefreshDelayNanoseconds: UInt64 = 15_000_000_000,
+    sendSignal: @escaping @Sendable (Int32, Int32) -> Int32 = { kill($0, $1) },
+    processIsAlive: @escaping @Sendable (Int32) -> Bool = { $0 > 0 && kill($0, 0) == 0 }
+  ) {
+    self.catalogSnapshotReader = catalogSnapshotReader
+    self.activationFileStore = activationFileStore
+    self.runtimeFileStore = runtimeFileStore
+    self.plugins = plugins
+    self.refreshPluginSecurityFacts = refreshPluginSecurityFacts
+    self.controlPreferences = controlPreferences
+    self.listeningStore = listeningStore
+    self.customRuleStore = customRuleStore
+    self.ruleSnapshots = ruleSnapshots ?? BuiltinRuleSnapshots(bundle: appBundle)
+    self.appBundle = appBundle
+    let restoredSettings =
+      settingsRestore
+      ?? RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(
+          listen: ProxyListeningConfiguration(), preferences: controlPreferences),
+        unreadableError: nil)
+    settings = restoredSettings.settings
+    settingsUnreadable = restoredSettings.unreadableError != nil
+    self.agent = agent
+    self.probe = probe
+    self.systemProxy = systemProxy
+    self.systemProxyHelper = systemProxyHelper
+    self.systemProxyNetworkChangeMonitor = systemProxyNetworkChangeMonitor
+    self.firewallChecker = firewallChecker
+    self.firewallExecutableURLs = firewallExecutableURLs ?? Self.defaultFirewallExecutableURLs
+    self.firewallPollIntervalNanoseconds = firewallPollIntervalNanoseconds
+    self.launchHealthTimeoutSeconds = launchHealthTimeoutSeconds
+    self.launchHealthRetryDelay = launchHealthRetryDelay
+    self.ruleApplicationDelay = ruleApplicationDelay
+    self.systemProxyHealthPollIntervalNanoseconds = systemProxyHealthPollIntervalNanoseconds
+    self.helperRefreshDelayNanoseconds = helperRefreshDelayNanoseconds
+    self.sendSignal = sendSignal
+    self.processIsAlive = processIsAlive
+    let persistedTarget = try? activationFileStore.loadActiveTargetID()
+    machine = ActivationStateMachine(activeTargetID: persistedTarget)
+    activeTargetID = machine.activeTargetID
+    self.proxyMode = proxyMode ?? Self.makeProxyMode(from: restoredSettings.settings)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeFacts.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeFacts.swift
new file mode 100644
index 000000000..d10a1ad5c
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeFacts.swift
@@ -0,0 +1,200 @@
+import Foundation
+
+/// Stable runtime status categories exposed to app presentation surfaces.
+/// 系统代理结果不在此列：它有独立的 `SystemProxyApplicationFacts`
+/// 系统代理结果使用独立的状态面。
+enum ProxyRuntimeStatus: Equatable, Sendable {
+  case off
+  case starting
+  case running
+  case firewallBlocked
+  case launchFailed
+  case requiresApproval
+  case serviceFailed
+}
+
+/// Domain-neutral runtime projection for status-menu presentation. The
+/// controller's state representation stays behind the adapter below.
+struct ProxyRuntimeFacts: Equatable, Sendable {
+  let status: ProxyRuntimeStatus
+  let isOn: Bool
+  let failure: RuntimeFailureFacts?
+
+  init(
+    status: ProxyRuntimeStatus,
+    isOn: Bool,
+    failure: RuntimeFailureFacts? = nil
+  ) {
+    self.status = status
+    self.isOn = isOn
+    self.failure = failure
+  }
+}
+
+/// 系统代理实际作用的固定类别：意图持久化为开关事实，这里
+/// 呈现 NG2 对系统设置的真实作用，与 agent 运行状态互不代替。
+enum SystemProxyApplicationFacts: Equatable, Sendable {
+  /// 意图关闭：系统代理清理完成。
+  case idle
+  /// 意图开启，等待 agent 健康或可用出口；条件恢复后自动收敛。
+  case pending
+  /// 已应用系统代理配置。
+  case applied
+  /// 写入或恢复失败（typed）。
+  case failed(SystemProxyFailureFacts)
+  case changed
+  case applying
+  case repairing
+  case repairFailed(SystemProxyFailureFacts)
+  case clearFailed(SystemProxyFailureFacts)
+  case paused
+  case unreadable(SystemProxyFailureFacts)
+}
+
+struct SystemProxyDifference: Equatable, Sendable, Identifiable {
+  enum Kind: Equatable, Sendable { case changed, notApplied, remaining }
+  let identifier: SystemProxyServiceIdentifier
+  let name: String
+  let kind: Kind
+  var id: SystemProxyServiceIdentifier { identifier }
+}
+
+/// Current observation and action availability, independent of the last operation result.
+struct SystemProxyInspectionFacts: Equatable, Sendable {
+  var differences: [SystemProxyDifference] = []
+  var readFailure: SystemProxyFailureFacts?
+  var canRepair = false
+  var canRetryClear = false
+  var isBusy = false
+  var backgroundUnavailable = false
+}
+
+/// Safe endpoint health categories used by runtime state and presentation.
+enum RuntimeEndpointFailure: Equatable, Sendable {
+  case refused
+  case timedOut
+  case invalidResponse
+  case unknown
+}
+
+struct FirewallBlockedFacts: Equatable, Sendable {
+  let executableName: String
+}
+
+enum LaunchFailureFacts: Equatable, Sendable {
+  case missingRuntimeDocument
+  case localEndpoint(
+    endpoint: String, host: String, port: Int, cause: RuntimeEndpointFailure)
+  case unreadableSettings
+}
+
+enum ServiceFailureFacts: Equatable, Sendable {
+  case runtimeFile
+  case agent
+  case missingDocument
+  case persistence
+  case unknown
+}
+
+enum SystemProxyOperationFailure: Equatable, Sendable {
+  case preferencesUnavailable
+  case preferencesBusy
+  case noCurrentNetworkSet
+  case noNetworkLocations
+  case noProxyServices
+  case unreadableService
+  case invalidStoredConfiguration
+  case cannotWriteService
+  case commitFailed
+  case applyFailed
+  case invalidRequest
+  case helperUnavailable
+}
+
+extension SystemProxyOperationFailure {
+  /// `SystemProxyError` 的呈现类别投影：稳定事实只保留操作类别；Domain 错误
+  /// 的关联值（排查细节）不出现在运行时事实里。
+  init(_ error: SystemProxyError) {
+    self = Self.preferenceFailure(error) ?? Self.serviceFailure(error)
+  }
+
+  private static func preferenceFailure(_ error: SystemProxyError) -> Self? {
+    switch error {
+    case .preferencesUnavailable: return .preferencesUnavailable
+    case .preferencesBusy: return .preferencesBusy
+    case .noCurrentNetworkSet: return .noCurrentNetworkSet
+    case .noNetworkLocations: return .noNetworkLocations
+    case .noProxyServices: return .noProxyServices
+    default: return nil
+    }
+  }
+
+  private static func serviceFailure(_ error: SystemProxyError) -> Self {
+    switch error {
+    case .unreadableService: return .unreadableService
+    case .invalidStoredConfiguration: return .invalidStoredConfiguration
+    case .cannotWriteService: return .cannotWriteService
+    case .commitFailed: return .commitFailed
+    case .applyFailed: return .applyFailed
+    case .invalidRequest: return .invalidRequest
+    case .helperUnavailable: return .helperUnavailable
+    case .preferencesUnavailable, .preferencesBusy, .noCurrentNetworkSet,
+      .noNetworkLocations, .noProxyServices:
+      preconditionFailure("Preference failures are mapped before service failures")
+    }
+  }
+}
+
+enum SystemProxyFailureFacts: Equatable, Sendable {
+  case operation(SystemProxyOperationFailure)
+  case unknown
+}
+
+/// Structured runtime failure projection used by runtime synchronization and
+/// app presentation. No arbitrary platform detail is carried into this state.
+/// `.systemProxy` 只用于把系统代理失败携带进结构化 outcome（设置工作流与
+/// 目录收敛结果）；呈现面走 `SystemProxyApplicationFacts.failed`。
+enum RuntimeFailureFacts: Error, Equatable, Sendable {
+  case firewallBlocked(FirewallBlockedFacts)
+  case launch(LaunchFailureFacts)
+  case service(ServiceFailureFacts)
+  case activation(ActivationFailure)
+  case requiresApproval
+  case systemProxy(SystemProxyFailureFacts)
+}
+
+extension ProxyRuntimeFacts {
+  init(state: ProxyRuntimeController.AgentRunState) {
+    switch state {
+    case .off:
+      self.init(status: .off, isOn: false)
+    case .starting:
+      self.init(status: .starting, isOn: true)
+    case .running:
+      self.init(status: .running, isOn: true)
+    case .firewallBlocked(let facts):
+      self.init(
+        status: .firewallBlocked, isOn: true, failure: .firewallBlocked(facts))
+    case .launchFailed(let facts):
+      self.init(status: .launchFailed, isOn: false, failure: .launch(facts))
+    case .requiresApproval:
+      self.init(status: .requiresApproval, isOn: true, failure: .requiresApproval)
+    case .serviceFailed(let facts):
+      self.init(status: .serviceFailed, isOn: false, failure: .service(facts))
+    }
+  }
+}
+
+extension SystemProxyApplicationFacts {
+  var hasOperationFailure: Bool { isApplyFailure || isClearFailure }
+  var isApplyFailure: Bool {
+    switch self {
+    case .failed, .repairFailed: true
+    default: false
+    }
+  }
+  var isClearFailure: Bool {
+    if case .clearFailed = self { return true }
+    return false
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemEndpointProbe.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemEndpointProbe.swift
new file mode 100644
index 000000000..9c93cf87a
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemEndpointProbe.swift
@@ -0,0 +1,12 @@
+import Foundation
+
+/// 端点探测缝：注入以便控制器单测（真实探测走 EndpointHealthProbe）。
+protocol EndpointProbing: Sendable {
+  func probe(host: String, port: Int, timeout: TimeInterval) async -> EndpointHealthProbe.Outcome
+}
+
+struct SystemEndpointProbe: EndpointProbing {
+  func probe(host: String, port: Int, timeout: TimeInterval) async -> EndpointHealthProbe.Outcome {
+    EndpointHealthProbe.probe(host: host, port: port, timeout: timeout)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyNetworkChangeMonitor.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyNetworkChangeMonitor.swift
new file mode 100644
index 000000000..459edaa82
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyNetworkChangeMonitor.swift
@@ -0,0 +1,115 @@
+import Foundation
+import Network
+import SystemConfiguration
+
+struct SystemProxyNetworkChange: OptionSet, Sendable {
+  let rawValue: Int
+
+  static let networkConfiguration = SystemProxyNetworkChange(rawValue: 1 << 0)
+  static let proxyConfiguration = SystemProxyNetworkChange(rawValue: 1 << 1)
+  static let networkPath = SystemProxyNetworkChange(rawValue: 1 << 2)
+}
+
+@MainActor
+protocol SystemProxyNetworkChangeMonitoring: AnyObject {
+  func start(
+    handler: @escaping @MainActor @Sendable (SystemProxyNetworkChange) -> Void)
+  func stop()
+}
+
+@MainActor
+final class NoopSystemProxyNetworkChangeMonitor: SystemProxyNetworkChangeMonitoring {
+  func start(handler: @escaping @MainActor @Sendable (SystemProxyNetworkChange) -> Void) {}
+  func stop() {}
+}
+
+/// Observes network-location/service setup changes, proxy dictionary changes, and
+/// app-visible path changes. Consumers decide which classes matter for each intent.
+@MainActor
+final class SystemProxyNetworkChangeMonitor: SystemProxyNetworkChangeMonitoring {
+  private let callbackBox = SystemProxyNetworkChangeCallbackBox()
+  private var dynamicStore: SCDynamicStore?
+  private var pathMonitor: NWPathMonitor?
+
+  func start(
+    handler: @escaping @MainActor @Sendable (SystemProxyNetworkChange) -> Void
+  ) {
+    stop()
+    callbackBox.setHandler(handler)
+    startDynamicStoreObserver()
+
+    let monitor = NWPathMonitor()
+    monitor.pathUpdateHandler = { [weak callbackBox] _ in
+      callbackBox?.emit(.networkPath)
+    }
+    monitor.start(queue: DispatchQueue.global(qos: .utility))
+    pathMonitor = monitor
+  }
+
+  func stop() {
+    callbackBox.setHandler(nil)
+    if let dynamicStore {
+      SCDynamicStoreSetDispatchQueue(dynamicStore, nil)
+      self.dynamicStore = nil
+    }
+    pathMonitor?.cancel()
+    pathMonitor = nil
+  }
+
+  private func startDynamicStoreObserver() {
+    var context = SCDynamicStoreContext(
+      version: 0,
+      info: Unmanaged.passUnretained(callbackBox).toOpaque(),
+      retain: nil,
+      release: nil,
+      copyDescription: nil)
+    guard
+      let store = SCDynamicStoreCreate(
+        kCFAllocatorDefault, "ShadowsocksX-NG2.SystemProxy" as CFString,
+        systemProxyDynamicStoreCallback, &context)
+    else { return }
+
+    let locationKey = SCDynamicStoreKeyCreateLocation(kCFAllocatorDefault)
+    let proxiesKey = SCDynamicStoreKeyCreateProxies(kCFAllocatorDefault)
+    let keys = [locationKey, proxiesKey].compactMap { $0 } as CFArray
+    // Setup changes include service membership/interface configuration and each
+    // service's Proxies dictionary. Runtime global proxy notifications are explicit.
+    let patterns = ["Setup:/Network/.*"] as CFArray
+    guard SCDynamicStoreSetNotificationKeys(store, keys, patterns) else { return }
+    guard SCDynamicStoreSetDispatchQueue(store, DispatchQueue.main) else { return }
+    dynamicStore = store
+  }
+}
+
+private final class SystemProxyNetworkChangeCallbackBox: @unchecked Sendable {
+  private let lock = NSLock()
+  private var handler: (@MainActor @Sendable (SystemProxyNetworkChange) -> Void)?
+
+  func setHandler(
+    _ handler: (@MainActor @Sendable (SystemProxyNetworkChange) -> Void)?
+  ) {
+    lock.withLock { self.handler = handler }
+  }
+
+  func emit(_ change: SystemProxyNetworkChange) {
+    let currentHandler = lock.withLock { handler }
+    guard let currentHandler else { return }
+    Task { @MainActor in currentHandler(change) }
+  }
+}
+
+private let systemProxyDynamicStoreCallback: SCDynamicStoreCallBack = { _, changedKeys, info in
+  guard let info else { return }
+  let callbackBox = Unmanaged<SystemProxyNetworkChangeCallbackBox>.fromOpaque(info)
+    .takeUnretainedValue()
+  let keys = changedKeys as? [String] ?? []
+  var changes: SystemProxyNetworkChange = []
+  for key in keys {
+    if key.hasSuffix("/Proxies") || key == "State:/Network/Global/Proxies" {
+      changes.insert(.proxyConfiguration)
+    } else {
+      changes.insert(.networkConfiguration)
+    }
+  }
+  if !changes.isEmpty { callbackBox.emit(changes) }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyObserver+Commands.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyObserver+Commands.swift
new file mode 100644
index 000000000..737f19c64
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyObserver+Commands.swift
@@ -0,0 +1,274 @@
+import Foundation
+
+extension SystemProxyObserver {
+  /// 系统代理意图开启（setSystemProxyEnabled on）：本轮必须真实应用一次——
+  /// 清理期可能已把系统设置清空，不能凭 lastDesired 相等跳过；收敛后转入
+  /// enabled 观察与网络变化巡检。
+  func enableSystemProxyIntent() async {
+    systemProxyInitialApplyPending = true
+    systemProxyWasUnavailable = false
+    await convergeSystemProxy()
+    startEnabledSystemProxyObservation()
+  }
+
+  /// 系统代理意图关闭（setSystemProxyEnabled off）：撤销待批准/待应用标记，
+  /// 读取代际推进作废在途读，无条件清理并停观察，结果原样呈现。
+  func disableSystemProxyIntent() async {
+    systemProxyApprovalRequired = false
+    systemProxyInitialApplyPending = false
+    systemProxyReadGeneration += 1
+    systemProxyState = await clearAndStopSystemProxyObservation()
+    updateSystemProxyActions()
+  }
+
+  /// agent 停机的观察收尾（stopAgent）：停网络监视与健康循环，观察模式归
+  /// 零。呈现按代理意图分流——意图仍在则保持待应用（等 agent 恢复后收敛，
+  /// 意图已关则呈现空闲状态。
+  func agentDidStop() {
+    systemProxyNetworkChangeMonitor.stop()
+    systemProxyHealthTask?.cancel()
+    systemProxyHealthTask = nil
+    systemProxyObservationMode = .stopped
+    if isIntentEnabled() {
+      systemProxyState = .pending
+    } else {
+      if !systemProxyState.hasOperationFailure {
+        systemProxyState = .idle
+      }
+      updateSystemProxyActions()
+    }
+  }
+
+  /// agent 关闭级联的清理结果呈现（setAgentEnabled off）：typed 失败原样
+  /// 上屏（清理不重试），成功不覆盖既有呈现。
+  func presentCleanupOutcome(_ outcome: SystemProxyApplicationFacts) {
+    if outcome.hasOperationFailure {
+      systemProxyState = outcome
+    }
+    updateSystemProxyActions()
+  }
+
+  /// mode 切换发现无可收敛运行时（agent 关或无活动文档）：代理意图仍开时
+  /// 保持待应用，等运行时恢复后由健康循环收敛（+Mode 提前出口）。
+  func modeTransitionAwaitingRuntime() {
+    if isIntentEnabled() {
+      systemProxyState = .pending
+    }
+  }
+
+  /// launch 重同步开始（resyncOnLaunch 入口）：抑制期 converge/suspend 拒绝
+  /// 执行、健康循环跳过巡检；须由 settle 命令解除。
+  func beginStartupResync() {
+    systemProxyStartupInProgress = true
+  }
+
+  /// launch 重同步收尾（agent 意图关闭分支）：解除抑制（抑制期 suspend 的
+  /// 守卫会拒绝执行）；代理意图仍开则挂起残留配置并转入观察。
+  func settleLaunchWithAgentOff() async {
+    systemProxyStartupInProgress = false
+    if isIntentEnabled() {
+      await suspendSystemProxy()
+      startEnabledSystemProxyObservation()
+    }
+  }
+
+  /// launch 重同步收尾（agent 已收敛分支）：解除抑制；代理意图开则播种期望
+  /// 配置（健康 GUI 启动只巡检不强推应用），按出口可用性巡检或挂起，转入
+  /// 观察；意图关呈现空闲。
+  func settleLaunchAfterAgentConverged() async {
+    systemProxyStartupInProgress = false
+    if isIntentEnabled() {
+      lastDesiredSystemProxyConfiguration = desiredConfiguration()
+      if isExitAvailable() {
+        await recheckSystemProxy()
+      } else {
+        await suspendSystemProxy()
+      }
+      startEnabledSystemProxyObservation()
+    } else {
+      systemProxyState = .idle
+    }
+  }
+}
+
+// MARK: - helper 门禁
+
+extension SystemProxyObserver {
+  /// helper 可用性门禁：已批准即通过——仅当 LaunchDaemon 清单
+  /// 与上次注册时的指纹漂移（app 更新改过清单）才注销重注刷新 launchd 的
+  /// job 定义；未注册则尝试注册（注册本身不弹授权框，成功即记指纹）；待批准
+  /// 或注册失败时置位批准路径并保持待应用。
+  func ensureHelperAvailableForApply() async -> Bool {
+    switch systemProxyHelper.status {
+    case .approved:
+      if helperRegistrationDrifted() {
+        do {
+          try systemProxyHelper.unregister()
+          // launchd 对节流中（spawn scheduled）job 的移除是异步的：立即重注
+          // 会命中尚未移除的旧定义（实测注销重注后定义不变）。等过 minimum
+          // runtime（10s）节流窗再重注；间隔内收敛以旧定义失败呈超时。
+          try? await Task.sleep(nanoseconds: helperRefreshDelayNanoseconds)
+          try systemProxyHelper.register()
+          storeHelperRegistrationStamp()
+        } catch {
+          // 刷新失败不记指纹，下次启动重试；状态退回后由下方分支接手。
+          RuntimeLog.emit(.systemProxyHelperRegisterFailed(detail: String(describing: error)))
+        }
+      }
+      if systemProxyHelper.status == .approved {
+        systemProxyApprovalRequired = false
+        return true
+      }
+    case .notRegistered:
+      do {
+        try systemProxyHelper.register()
+        storeHelperRegistrationStamp()
+      } catch {
+        RuntimeLog.emit(.systemProxyHelperRegisterFailed(detail: String(describing: error)))
+      }
+      if systemProxyHelper.status == .approved {
+        systemProxyApprovalRequired = false
+        return true
+      }
+    case .requiresApproval:
+      break
+    }
+    systemProxyApprovalRequired = true
+    return false
+  }
+
+  private func helperRegistrationDrifted(defaults: UserDefaults = .standard) -> Bool {
+    SystemProxyHelperRegistrationStamp.drifted(
+      plistData: SystemProxyHelperIdentity.launchDaemonPlistData(in: appBundle),
+      storedStamp: defaults.string(forKey: SystemProxyHelperRegistrationStamp.defaultsKey))
+  }
+
+  private func storeHelperRegistrationStamp(defaults: UserDefaults = .standard) {
+    guard let plistData = SystemProxyHelperIdentity.launchDaemonPlistData(in: appBundle) else {
+      return
+    }
+    defaults.set(
+      SystemProxyHelperRegistrationStamp.stamp(plistData),
+      forKey: SystemProxyHelperRegistrationStamp.defaultsKey)
+  }
+
+  /// Approval continues only an unattempted initial request; failed writes need a user retry.
+  func openSystemProxyHelperApproval() async {
+    systemProxyHelper.openApprovalPath()
+    refreshSystemProxyApproval()
+    if systemProxyInitialApplyPending && !systemProxyState.hasOperationFailure {
+      await convergeSystemProxy()
+    }
+    updateSystemProxyActions()
+  }
+
+}
+
+// MARK: - 意图保持与清理
+
+extension SystemProxyObserver {
+  /// Health/exit loss clears unavailable settings while preserving enabled intent.
+  func holdSystemProxyIntent() async {
+    if isIntentEnabled() {
+      await suspendSystemProxy()
+    } else if !systemProxyState.hasOperationFailure {
+      systemProxyState = .idle
+    }
+  }
+
+  /// 无条件清除全部系统代理配置：typed 失败原样呈现，不重试。
+  func clearSystemProxyOutcome() async -> SystemProxyApplicationFacts {
+    do {
+      try await systemProxy.clear()
+      return .idle
+    } catch {
+      refreshSystemProxyApproval()
+      return .clearFailed(systemProxyFacts(for: error))
+    }
+  }
+
+  func startEnabledSystemProxyObservation() {
+    guard systemProxyObservationMode != .enabled else { return }
+    systemProxyObservationMode = .enabled
+    scheduleSystemProxyHealthObservation()
+    systemProxyNetworkChangeMonitor.start { [weak self] change in
+      self?.handleSystemProxyNetworkChange(change)
+    }
+  }
+
+  func clearAndStopSystemProxyObservation() async -> SystemProxyApplicationFacts {
+    if let systemProxyCleanupTask { return await systemProxyCleanupTask.value }
+    let task = Task { @MainActor [weak self] in
+      guard let self else { return SystemProxyApplicationFacts.idle }
+      return await self.performSystemProxyCleanupUntilQuiet()
+    }
+    systemProxyCleanupTask = task
+    let result = await task.value
+    systemProxyCleanupTask = nil
+    return result
+  }
+
+  private func performSystemProxyCleanupUntilQuiet() async -> SystemProxyApplicationFacts {
+    if systemProxyObservationMode != .enabled {
+      systemProxyObservationMode = .cleanup
+      systemProxyNetworkChangeMonitor.start { [weak self] change in
+        self?.handleSystemProxyNetworkChange(change)
+      }
+    } else {
+      systemProxyObservationMode = .cleanup
+    }
+
+    guard await waitForSystemProxyOperation() else { return systemProxyState }
+    beginSystemProxyOperation()
+    var outcome: SystemProxyApplicationFacts = .idle
+    repeat {
+      systemProxyCleanupRescanRequested = false
+      outcome = await clearSystemProxyOutcome()
+      // Let queued SystemConfiguration notifications reach the main actor. Any
+      // location/service/proxy change during this cleanup starts another full scan.
+      try? await Task.sleep(nanoseconds: cleanupSettleNanoseconds)
+      await Task.yield()
+    } while systemProxyCleanupRescanRequested && !outcome.hasOperationFailure
+
+    systemProxyNetworkChangeMonitor.stop()
+    systemProxyHealthTask?.cancel()
+    systemProxyHealthTask = nil
+    systemProxyObservationMode = .stopped
+    systemProxyInspection = SystemProxyInspectionFacts()
+    endSystemProxyOperation()
+    return outcome
+  }
+
+  private func handleSystemProxyNetworkChange(_ change: SystemProxyNetworkChange) {
+    switch systemProxyObservationMode {
+    case .stopped:
+      return
+    case .cleanup:
+      if !change.isDisjoint(with: [.networkConfiguration, .proxyConfiguration]) {
+        systemProxyCleanupRescanRequested = true
+      }
+    case .enabled:
+      guard isIntentEnabled() else { return }
+      guard !systemProxyInspectionScheduled else { return }
+      systemProxyInspectionScheduled = true
+      systemProxyInspectionTask = Task { @MainActor [weak self] in
+        await Task.yield()
+        guard let self else { return }
+        self.systemProxyInspectionScheduled = false
+        await self.recheckSystemProxy()
+      }
+    }
+  }
+
+}
+
+// MARK: - 失败事实映射
+
+extension SystemProxyObserver {
+  func systemProxyFacts(for error: Error) -> SystemProxyFailureFacts {
+    if let error = error as? SystemProxyError {
+      return .operation(SystemProxyOperationFailure(error))
+    }
+    return .unknown
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyObserver.swift b/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyObserver.swift
new file mode 100644
index 000000000..92885c0c9
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyObserver.swift
@@ -0,0 +1,327 @@
+import Foundation
+
+/// 系统代理观察/修复策略机（ADR-0022）：收敛、挂起、意图保持、
+/// 修复、清理重试、helper 门禁与 cleanup-until-quiet 观察循环的唯一属主。
+/// 意图开关、出口可用性与期望配置由组合方以闭包注入，模块不反向依赖控制器；
+/// 呈现事实经自身事实通道（didChange 语义，每主队列轮合并）由运行时
+/// adapter 合入 workflow 再发布链。
+/// 底层只依赖 `SystemProxyControlling`、helper 注册缝与网络变化监视。
+@MainActor
+final class SystemProxyObserver {
+  enum SystemProxyObservationMode: Equatable {
+    case stopped
+    case enabled
+    case cleanup
+  }
+
+  /// Current configuration or operation result, independent of persisted intent.
+  var systemProxyState: SystemProxyApplicationFacts = .idle {
+    didSet { factChanges.markChanged() }
+  }
+  /// Approval remains actionable even after an off-intent clear failure.
+  var systemProxyApprovalRequired = false { didSet { factChanges.markChanged() } }
+  var systemProxyInspection = SystemProxyInspectionFacts() {
+    didSet { factChanges.markChanged() }
+  }
+  /// 呈现事实变化通道（didChange 语义）：三个事实属性的 didSet 汇集于此。
+  let factChanges = CoalescedFactSignal()
+
+  // 命令实现拆分为文件级扩展；观察事实仅由本模块消费，其他实现细节保持 private。
+  var lastDesiredSystemProxyConfiguration: SystemProxyConfiguration?
+  private var knownSystemProxyServices: Set<SystemProxyServiceIdentifier> = []
+  private var systemProxyOperationInProgress = false
+  /// 读面：健康循环体在 launch 重同步抑制期跳过巡检。
+  var systemProxyStartupInProgress = false
+  /// 读面：健康循环的收敛条件。
+  var systemProxyInitialApplyPending = false
+  /// 读面：健康循环的收敛条件。
+  var systemProxyWasUnavailable = false
+  /// Read-only task handle lets observers await cancellation completion.
+  var systemProxyHealthTask: Task<Void, Never>?
+  var systemProxyReadGeneration = 0
+  /// 读面：观察机测试。
+  var systemProxyObservationMode = SystemProxyObservationMode.stopped
+  var systemProxyCleanupRescanRequested = false
+  var systemProxyCleanupTask: Task<SystemProxyApplicationFacts, Never>?
+  var systemProxyInspectionScheduled = false
+  /// Last passive inspection; awaiting it observes event convergence without a timing guess.
+  var systemProxyInspectionTask: Task<Void, Never>?
+
+  let systemProxy: SystemProxyControlling
+  let systemProxyHelper: SystemProxyHelperServicing
+  let systemProxyNetworkChangeMonitor: SystemProxyNetworkChangeMonitoring
+  /// 宿主 app bundle 缝（生产为 Bundle.main）：LaunchDaemon 清单指纹的定位基准。
+  let appBundle: Bundle
+  /// 注册清单漂移重注时，注销与重注的间隔（launchd 对节流中 job 的移除异步）。
+  let helperRefreshDelayNanoseconds: UInt64
+  /// cleanup 每轮扫描后等待 SystemConfiguration 通知排空的静默窗。
+  let cleanupSettleNanoseconds: UInt64
+  let isIntentEnabled: @MainActor () -> Bool
+  let isExitAvailable: @MainActor () -> Bool
+  let desiredConfiguration: @MainActor () -> SystemProxyConfiguration?
+  /// 健康观察循环体经此注入、留在控制器（循环体含运行时健康呈现）；任务柄
+  /// 由观察机创建并持有（cleanup 与停机路径都要取消它）。
+  private let systemProxyHealthObservationLoop: @MainActor () async -> Void
+
+  init(
+    systemProxy: SystemProxyControlling,
+    systemProxyHelper: SystemProxyHelperServicing,
+    systemProxyNetworkChangeMonitor: SystemProxyNetworkChangeMonitoring,
+    appBundle: Bundle,
+    helperRefreshDelayNanoseconds: UInt64,
+    cleanupSettleNanoseconds: UInt64 = 100_000_000,
+    isIntentEnabled: @escaping @MainActor () -> Bool,
+    isExitAvailable: @escaping @MainActor () -> Bool,
+    desiredConfiguration: @escaping @MainActor () -> SystemProxyConfiguration?,
+    systemProxyHealthObservationLoop: @escaping @MainActor () async -> Void
+  ) {
+    self.systemProxy = systemProxy
+    self.systemProxyHelper = systemProxyHelper
+    self.systemProxyNetworkChangeMonitor = systemProxyNetworkChangeMonitor
+    self.appBundle = appBundle
+    self.helperRefreshDelayNanoseconds = helperRefreshDelayNanoseconds
+    self.cleanupSettleNanoseconds = cleanupSettleNanoseconds
+    self.isIntentEnabled = isIntentEnabled
+    self.isExitAvailable = isExitAvailable
+    self.desiredConfiguration = desiredConfiguration
+    self.systemProxyHealthObservationLoop = systemProxyHealthObservationLoop
+  }
+
+  // MARK: - 收敛与应用
+
+  /// Explicit initial application, saved-value changes, or real health recovery.
+  /// A healthy GUI startup and passive events only inspect current settings.
+  func convergeSystemProxy(forceApply: Bool = false) async {
+    guard await waitForSystemProxyOperation() else { return }
+    guard isIntentEnabled(), !systemProxyStartupInProgress else { return }
+    guard isExitAvailable() else {
+      await suspendSystemProxy()
+      return
+    }
+    guard let configuration = desiredConfiguration() else { return }
+    let needsApplication =
+      forceApply || systemProxyInitialApplyPending || systemProxyWasUnavailable
+      || lastDesiredSystemProxyConfiguration != configuration
+    if needsApplication {
+      await applySystemProxy(configuration, repairing: false)
+    } else {
+      if systemProxyHelper.status == .approved { _ = await ensureHelperAvailableForApply() }
+      await recheckSystemProxy()
+    }
+  }
+
+  private func applySystemProxy(
+    _ configuration: SystemProxyConfiguration, repairing: Bool
+  ) async {
+    guard !systemProxyOperationInProgress else { return }
+    beginSystemProxyOperation()
+    defer { endSystemProxyOperation() }
+    guard await ensureHelperAvailableForApply() else {
+      if !systemProxyState.hasOperationFailure { systemProxyState = .pending }
+      updateSystemProxyActions()
+      return
+    }
+    guard isIntentEnabled(), isExitAvailable() else { return }
+    if repairing {
+      guard await prepareSystemProxyRepair(configuration) else { return }
+    }
+    systemProxyState = repairing ? .repairing : .applying
+    updateSystemProxyActions()
+    // Mark the attempt before awaiting: a failed operation is never implicitly retried.
+    systemProxyInitialApplyPending = false
+    systemProxyWasUnavailable = false
+    systemProxyInspection.backgroundUnavailable = false
+    lastDesiredSystemProxyConfiguration = configuration
+    do {
+      if repairing {
+        try await systemProxy.repair(configuration)
+      } else {
+        let outcome = try await systemProxy.apply(configuration)
+        if outcome == .unchanged { RuntimeLog.emit(.systemProxyUnchanged) }
+      }
+      await inspectSystemProxy(configuration: configuration, afterRepair: repairing)
+    } catch {
+      RuntimeLog.emit(.systemProxyWriteFailed(detail: String(describing: error)))
+      systemProxyState =
+        repairing
+        ? .repairFailed(systemProxyFacts(for: error)) : .failed(systemProxyFacts(for: error))
+      await inspectSystemProxy(configuration: configuration, preserveResult: true)
+    }
+  }
+
+  private func prepareSystemProxyRepair(_ configuration: SystemProxyConfiguration) async -> Bool {
+    guard
+      await inspectSystemProxy(
+        configuration: configuration,
+        preserveResult: systemProxyState.hasOperationFailure)
+    else { return false }
+    guard isIntentEnabled(), isExitAvailable(),
+      desiredConfiguration() == configuration, systemProxyHelper.status == .approved
+    else { return false }
+    guard !systemProxyInspection.differences.isEmpty else {
+      systemProxyState = .applied
+      return false
+    }
+    return true
+  }
+
+  func repairSystemProxy() async {
+    updateSystemProxyActions()
+    guard systemProxyInspection.canRepair, let configuration = desiredConfiguration()
+    else { return }
+    await applySystemProxy(configuration, repairing: true)
+  }
+
+  func recheckSystemProxy() async {
+    refreshSystemProxyApproval()
+    guard isIntentEnabled(), let configuration = desiredConfiguration() else {
+      updateSystemProxyActions()
+      return
+    }
+    guard !systemProxyOperationInProgress else { return }
+    await inspectSystemProxy(
+      configuration: configuration,
+      preserveResult: systemProxyState.hasOperationFailure || !isExitAvailable())
+    updateSystemProxyActions()
+  }
+
+  @discardableResult
+  private func inspectSystemProxy(
+    configuration: SystemProxyConfiguration, afterRepair: Bool = false,
+    preserveResult: Bool = false
+  ) async -> Bool {
+    systemProxyReadGeneration += 1
+    let generation = systemProxyReadGeneration
+    do {
+      let services = try await systemProxy.readServices()
+      guard !services.isEmpty else { throw SystemProxyError.noProxyServices }
+      guard generation == systemProxyReadGeneration, isIntentEnabled(),
+        desiredConfiguration() == configuration
+      else { return false }
+      let writes = try SystemProxyPlanner.makeApplyPlan(
+        services: services, configuration: configuration
+      ).writes
+      let differing = Set(writes.map(\.identifier))
+      systemProxyInspection.differences = services.compactMap { service in
+        guard differing.contains(service.identifier) else { return nil }
+        return SystemProxyDifference(
+          identifier: service.identifier, name: service.name,
+          kind: afterRepair
+            ? .remaining
+            : (knownSystemProxyServices.contains(service.identifier) ? .changed : .notApplied))
+      }
+      // Only observed consistency establishes a known service; an unsuccessful write
+      // response cannot establish that this app's configuration was ever present.
+      knownSystemProxyServices.formUnion(
+        services.filter {
+          !differing.contains($0.identifier)
+        }.map(\.identifier))
+      systemProxyInspection.readFailure = nil
+      if !preserveResult && !systemProxyState.isClearFailure && !systemProxyWasUnavailable {
+        systemProxyState = differing.isEmpty ? .applied : .changed
+      }
+      return true
+    } catch {
+      guard generation == systemProxyReadGeneration else { return false }
+      systemProxyInspection.differences = []
+      systemProxyInspection.readFailure = systemProxyFacts(for: error)
+      if !preserveResult && !systemProxyState.isClearFailure && !systemProxyWasUnavailable {
+        systemProxyState = .unreadable(systemProxyFacts(for: error))
+      }
+      return false
+    }
+  }
+
+  func suspendSystemProxy() async {
+    guard isIntentEnabled(), !systemProxyStartupInProgress else { return }
+    guard !systemProxyWasUnavailable else {
+      updateSystemProxyActions()
+      return
+    }
+    guard await waitForSystemProxyOperation() else { return }
+    guard isIntentEnabled(), !systemProxyWasUnavailable else { return }
+    systemProxyWasUnavailable = true
+    systemProxyInspection.backgroundUnavailable = true
+    systemProxyInitialApplyPending = false
+    beginSystemProxyOperation()
+    defer { endSystemProxyOperation() }
+    let outcome = await clearSystemProxyOutcome()
+    systemProxyState = outcome == .idle ? .paused : outcome
+    if outcome == .idle {
+      systemProxyInspection.differences = []
+      systemProxyInspection.readFailure = nil
+    }
+  }
+
+  func retrySystemProxyClear() async {
+    updateSystemProxyActions()
+    guard systemProxyInspection.canRetryClear else { return }
+    beginSystemProxyOperation()
+    defer { endSystemProxyOperation() }
+    let outcome = await clearSystemProxyOutcome()
+    systemProxyState = outcome == .idle && isIntentEnabled() ? .paused : outcome
+  }
+
+  func beginSystemProxyOperation() {
+    systemProxyOperationInProgress = true
+    systemProxyInspection.isBusy = true
+    systemProxyReadGeneration += 1
+    updateSystemProxyActions()
+  }
+
+  /// 进行中操作的等待队列：操作收尾时唤醒全部等待者，等待者再经既有二次
+  /// 门禁（begin 前的 guard）竞争下一轮；被取消的等待者照旧得到 false 中止。
+  private var operationWaiters: [CheckedContinuation<Void, Never>] = []
+
+  func waitForSystemProxyOperation() async -> Bool {
+    while systemProxyOperationInProgress {
+      await withCheckedContinuation { operationWaiters.append($0) }
+    }
+    return !Task.isCancelled
+  }
+
+  func endSystemProxyOperation() {
+    systemProxyOperationInProgress = false
+    systemProxyInspection.isBusy = false
+    let waiters = operationWaiters
+    operationWaiters = []
+    for waiter in waiters { waiter.resume() }
+    updateSystemProxyActions()
+  }
+}
+
+// MARK: - 呈现动作与批准刷新
+
+extension SystemProxyObserver {
+  func refreshSystemProxyApproval() {
+    systemProxyApprovalRequired =
+      systemProxyHelper.status != .approved
+      && (isIntentEnabled() || systemProxyState.hasOperationFailure)
+  }
+
+  func updateSystemProxyActions() {
+    refreshSystemProxyApproval()
+    let available = !systemProxyOperationInProgress && !systemProxyApprovalRequired
+    systemProxyInspection.canRepair =
+      available && isIntentEnabled()
+      && isExitAvailable() && systemProxyInspection.readFailure == nil
+      && (!systemProxyInspection.differences.isEmpty || systemProxyState.isApplyFailure)
+    systemProxyInspection.canRetryClear = available && systemProxyState.isClearFailure
+    if systemProxyState.hasOperationFailure {
+      scheduleSystemProxyHealthObservation()
+    } else if !isIntentEnabled() {
+      systemProxyHealthTask?.cancel()
+      systemProxyHealthTask = nil
+    }
+  }
+
+  /// 请求调度健康观察循环：任务柄由观察机创建并持有，已存在则幂等返回。
+  func scheduleSystemProxyHealthObservation() {
+    guard systemProxyHealthTask == nil else { return }
+    systemProxyHealthTask = Task { @MainActor [weak self] in
+      await self?.systemProxyHealthObservationLoop()
+    }
+  }
+}
+
+// MARK: - 意图命令（控制器写面唯一入口）
diff --git a/ShadowsocksX-NG2/App/Application/RulesWorkflow/RulesWorkflow.swift b/ShadowsocksX-NG2/App/Application/RulesWorkflow/RulesWorkflow.swift
new file mode 100644
index 000000000..5179716e9
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/RulesWorkflow/RulesWorkflow.swift
@@ -0,0 +1,400 @@
+import Combine
+import Foundation
+
+/// File reads and collection preparation run outside the UI actor; queries use
+/// the prepared collection and do not rebuild semantic analysis on each keypress.
+/// Operations that await capture a `RulesIntentTicket` at entry and recheck it
+/// once after every await.
+@MainActor
+final class RulesWorkflow: ObservableObject {
+  let preset: RulePreset
+  @Published private(set) var snapshot = RulesPageSnapshot()
+  @Published private(set) var reportSource: RulesSourceSnapshot?
+  private let loadCustom: @Sendable () throws -> [CustomRule]
+  private let builtinSnapshots: BuiltinRuleSnapshots
+  private let loadDocument: (@MainActor () throws -> CustomRuleDocument)?
+  private let commitDocument: (@MainActor (CustomRuleDocument) async -> RuleDocumentCommit)?
+  private var collection: RulesCollection?
+  private var refreshGeneration = 0
+  private let feedbackDelay: @Sendable () async throws -> Void
+  private var feedbackTask: Task<Void, Never>?
+  private(set) var analysisTask: Task<Void, Never>?
+  private var analysisGeneration = 0
+  private let analysisDelay: @Sendable () async throws -> Void
+
+  init(
+    preset: RulePreset = .gfwlist,
+    loadCustom: (@Sendable () throws -> [CustomRule])? = nil,
+    loadDocument: (@MainActor () throws -> CustomRuleDocument)? = nil,
+    commitDocument: (@MainActor (CustomRuleDocument) async -> RuleDocumentCommit)? = nil,
+    feedbackDelay: @escaping @Sendable () async throws -> Void = {
+      try await Task.sleep(for: .seconds(3))
+    },
+    analysisDelay: @escaping @Sendable () async throws -> Void = {
+      try await Task.sleep(for: .milliseconds(150))
+    },
+    builtinSnapshots: BuiltinRuleSnapshots = BuiltinRuleSnapshots()
+  ) {
+    self.preset = preset
+    if let loadDocument {
+      self.loadDocument = loadDocument
+    } else if loadCustom == nil {
+      self.loadDocument = { try CustomRuleStore(preset: preset).loadDocument() }
+    } else {
+      self.loadDocument = nil
+    }
+    self.commitDocument = commitDocument
+    self.feedbackDelay = feedbackDelay
+    self.analysisDelay = analysisDelay
+    self.loadCustom = loadCustom ?? { try CustomRuleStore(preset: preset).load() }
+    self.builtinSnapshots = builtinSnapshots
+    snapshot.query.source = .custom
+  }
+
+  func refresh(retryFailedSources: Bool = false) async {
+    guard !snapshot.isCommitting else { return }
+    if snapshot.commitOutcome?.isSuccess == true && !snapshot.issues.isEmpty {
+      dismissFeedback()
+    }
+    await refreshCollection(retryFailedSources: retryFailedSources)
+  }
+
+  private func refreshCollection(retryFailedSources: Bool) async {
+    analysisGeneration += 1
+    refreshGeneration += 1
+    let generation = refreshGeneration
+    invalidateAddressTest()
+    snapshot.isLoading = true
+    let custom = loadCustom
+    let preset = preset
+    let sources = await builtinSnapshots.browsingSources(
+      sources: preset.sources, retryFailures: retryFailedSources)
+    let document: Result<CustomRuleDocument, Error>?
+    if let loadDocument {
+      do { document = .success(try loadDocument()) } catch { document = .failure(error) }
+    } else {
+      document = nil
+    }
+    let result = await Task.detached(priority: .userInitiated) {
+      RulesCollection.load(
+        preset: preset, custom: custom,
+        builtin: { source in try sources[source, default: .failure(RuleSnapshotError.missing)].get()
+        },
+        document: document.map { saved in { try saved.get() } })
+    }.value
+    guard generation == refreshGeneration else { return }
+    if !result.issues.isEmpty, collection != nil {
+      snapshot.issues = result.issues
+      snapshot.isLoading = false
+      return
+    }
+    collection = result
+    var next = snapshot
+    next.version = result.version
+    next.sources = result.sources
+    next.issues = result.issues
+    next.isLoading = false
+    snapshot = applyingQuery(to: next)
+  }
+
+  var actionableSelection: Set<ProxyRule> {
+    Set(
+      snapshot.rows.filter { snapshot.selection.contains($0.id) && !$0.isFixed }
+        .compactMap(\.identity))
+  }
+
+  func setEnabled(_ enabled: Bool, identities: Set<ProxyRule>) async {
+    guard let ticket = intentTicket(), let old = ticket.document else { return }
+    let allowed = Set(snapshot.rows.filter { !$0.isFixed }.compactMap(\.identity))
+    let targets = identities.intersection(allowed)
+    guard !targets.isEmpty else { return }
+    var disabled = old.disabledIdentities
+    let changedCount =
+      enabled
+      ? targets.intersection(disabled).count : targets.subtracting(disabled).count
+    if enabled { disabled.subtract(targets) } else { disabled.formUnion(targets) }
+    guard disabled != old.disabledIdentities else { return }
+    _ = await commit(
+      CustomRuleDocument(rules: old.rules, disabledIdentities: disabled),
+      operation: .enablement(enabled), changedCount: changedCount)
+  }
+
+  private func commit(
+    _ document: CustomRuleDocument, operation: RulesCommitFeedback.Operation, changedCount: Int = 1
+  ) async -> CustomRuleUpdateOutcome {
+    guard let commitDocument else { return .busy }
+    snapshot.isCommitting = true
+    dismissFeedback()
+    invalidateAddressTest()
+    let result = await commitDocument(document)
+    var next = snapshot
+    if let document = result.document, let previous = collection,
+      document != previous.userDocument
+    {
+      let updated = previous.replacingUserDocument(document, analyzing: false)
+      collection = updated
+      next = snapshot
+      next.version = updated.version
+      next.sources = updated.sources
+      next.issues = updated.issues
+      next = applyingQuery(to: next)
+      scheduleAnalysis()
+    } else if result.document == nil {
+      next.issues = [.userDocument("Saved rule document is unavailable")]
+    }
+    next.isCommitting = false
+    publishFeedback(result.outcome, operation: operation, changedCount: changedCount, page: next)
+    return result.outcome
+  }
+
+  /// Saved facts stay interactive while explanatory relationships catch up.
+  /// One worker coalesces saves and never publishes analysis for an older version.
+  private func scheduleAnalysis() {
+    analysisGeneration += 1
+    guard analysisTask == nil else { return }
+    analysisTask = Task { [weak self] in
+      guard let self else { return }
+      defer { self.analysisTask = nil }
+      while !Task.isCancelled {
+        let generation = self.analysisGeneration
+        do { try await self.analysisDelay() } catch { return }
+        guard generation == self.analysisGeneration else { continue }
+        guard !self.snapshot.isLoading, let captured = self.collection,
+          let document = captured.userDocument
+        else { return }
+        let updated = await Task.detached(priority: .userInitiated) {
+          captured.replacingUserDocument(document)
+        }.value
+        guard generation == self.analysisGeneration else { continue }
+        guard self.collection?.version == captured.version else { return }
+        self.collection = updated
+        self.snapshot = self.applyingQuery(to: self.snapshot)
+        return
+      }
+    }
+  }
+
+  func dismissFeedback() {
+    feedbackTask?.cancel()
+    feedbackTask = nil
+    snapshot.commitFeedback = nil
+  }
+
+  private func publishFeedback(
+    _ outcome: CustomRuleUpdateOutcome, operation: RulesCommitFeedback.Operation, changedCount: Int,
+    page: RulesPageSnapshot
+  ) {
+    let feedback = RulesCommitFeedback(
+      outcome: outcome, operation: operation, changedCount: changedCount)
+    var next = page
+    next.commitFeedback = feedback
+    snapshot = next
+    guard outcome.isSuccess, snapshot.issues.isEmpty else { return }
+    let delay = feedbackDelay
+    feedbackTask = Task { [weak self] in
+      do { try await delay() } catch { return }
+      guard !Task.isCancelled, self?.snapshot.commitFeedback?.id == feedback.id else { return }
+      self?.dismissFeedback()
+    }
+  }
+
+  func setTestTarget(_ target: String) {
+    guard target != snapshot.addressTest.target else { return }
+    invalidateAddressTest()
+    snapshot.addressTest.target = target
+  }
+
+  func testAddress() async {
+    invalidateAddressTest()
+    guard snapshot.isComplete, let collection else {
+      snapshot.addressTest.failure = .incompleteCollection
+      return
+    }
+    let ticket = RulesIntentTicket(collection: collection)
+    snapshot.addressTest.isTesting = true
+    // 捕获整份测试状态：任何失效（目标编辑回原值、新测试进入、刷新/提交
+    // 重置）都会改动它，迟到的结果不得发布。
+    let intent = snapshot.addressTest
+    let result = await Task.detached(priority: .userInitiated) {
+      do {
+        return Result<OfflineRuleMatcher.Result, OfflineRuleMatcher.Failure>.success(
+          try OfflineRuleMatcher.test(collection: collection, address: intent.target))
+      } catch {
+        return .failure(error as? OfflineRuleMatcher.Failure ?? .invalidTarget)
+      }
+    }.value
+    guard snapshot.addressTest == intent, intentTicketIsCurrent(ticket) else { return }
+    snapshot.addressTest.isTesting = false
+    switch result {
+    case .success(let result): snapshot.addressTest.result = result
+    case .failure(let failure): snapshot.addressTest.failure = failure
+    }
+  }
+
+  private func invalidateAddressTest() {
+    snapshot.addressTest = RulesAddressTest(target: snapshot.addressTest.target)
+  }
+
+  func query(_ query: RulesQuery) {
+    guard query != snapshot.query else { return }
+    var next = snapshot
+    next.query = query
+    snapshot = applyingQuery(to: next)
+  }
+
+  func select(_ ids: Set<RulesRow.SelectionID>) {
+    let selection = ids.intersection(Set(snapshot.rows.map(\.id)))
+    guard selection != snapshot.selection else { return }
+    snapshot.selection = selection
+  }
+
+  /// Capture only on an explicit open request, independently of browsing and refresh.
+  @discardableResult
+  func openSourceReport(_ source: RulesSource) -> Bool {
+    guard let loaded = snapshot.sources.first(where: { $0.id == source }),
+      loaded.metadata != nil, loaded.conversionReport != nil
+    else { return false }
+    reportSource = loaded
+    return true
+  }
+
+  private func applyingQuery(to page: RulesPageSnapshot) -> RulesPageSnapshot {
+    guard let collection else { return page }
+    let query = page.query
+    let search = query.search.lowercased()
+    let rows = collection.rows.filter { row in
+      (query.action == nil || row.action == query.action)
+        && (query.source.map {
+          row.sources.contains($0)
+            || ($0 == .custom && !row.hasCurrentSource && query.enabled == false)
+        } ?? true)
+        && (query.enabled.map { row.isEnabled == $0 } ?? true)
+        && (row.hasCurrentSource || query.enabled == false)
+        && (search.isEmpty || row.content.lowercased().contains(search))
+    }
+    var next = page
+    next.rows = rows
+    next.selection.formIntersection(Set(rows.map(\.id)))
+    return next
+  }
+}
+
+/// 规则意图票据：一次规则操作意图在入口捕获的事实快照。改写意图（草稿/
+/// 预览/保存/启停/删除）经 `intentTicket()` 入口捕获——页完整、无进行中
+/// 事务、提交缝在场且用户文档已加载；只读意图（地址测试）直接以已加载
+/// 集合构造。每个 await 之后用 `intentTicketIsCurrent` 一查：页不再完整
+/// （刷新落地带来 issues、事务或加载开始）或集合版本前进（刷新/提交落地），
+/// 本次意图超期——按调用方口径退出，不得发布结果或提交文档。
+struct RulesIntentTicket {
+  /// 捕获时刻的集合；版本与页版本在写入点同步前进（分析置换除外）。
+  let collection: RulesCollection
+  var version: String { collection.version }
+  /// 捕获时刻的用户文档（改写入口保证非空；浏览态集合可为空）。
+  var document: CustomRuleDocument? { collection.userDocument }
+}
+
+extension RulesWorkflow {
+  /// 改写意图的入口捕获；nil = 此刻不容许改写（页不完整 / 事务进行中 /
+  /// 提交缝缺失 / 用户文档未加载）。
+  func intentTicket() -> RulesIntentTicket? {
+    guard commitDocument != nil, snapshot.isComplete, !snapshot.isCommitting,
+      let collection, collection.userDocument != nil
+    else { return nil }
+    return RulesIntentTicket(collection: collection)
+  }
+
+  /// 任何意图 await 后的一查：页仍完整且集合版本未前进。
+  func intentTicketIsCurrent(_ ticket: RulesIntentTicket) -> Bool {
+    snapshot.isComplete && ticket.version == snapshot.version
+  }
+}
+
+extension RulesWorkflow {
+  func makeCustomRuleDraft(editing id: UUID? = nil) -> CustomRuleDraft? {
+    guard let ticket = intentTicket(), let document = ticket.document else { return nil }
+    if let id {
+      guard let rule = document.rules.first(where: { $0.id == id }) else { return nil }
+      return CustomRuleDraft(
+        id: id, editingID: id, version: ticket.version,
+        kind: rule.identity.match.editingKind, content: rule.identity.match.editingContent,
+        action: preset.matchedAction)
+    }
+    return CustomRuleDraft(
+      id: UUID(), editingID: nil, version: ticket.version, action: preset.matchedAction)
+  }
+
+  func previewCustomRule(_ draft: CustomRuleDraft) async -> CustomRulePreview {
+    guard !snapshot.isCommitting else { return CustomRulePreview(failure: .busy) }
+    guard let ticket = intentTicket() else {
+      return CustomRulePreview(failure: .incompleteCollection)
+    }
+    guard draft.version == ticket.version else { return CustomRulePreview(failure: .staleDraft) }
+    let prepared = await Task.detached(priority: .userInitiated) {
+      ticket.collection.previewCustomRule(draft)
+    }.value
+    guard intentTicketIsCurrent(ticket) else { return CustomRulePreview(failure: .staleDraft) }
+    return prepared
+  }
+
+  func saveCustomRule(_ draft: CustomRuleDraft) async -> CustomRuleSaveResult {
+    let preview = await previewCustomRule(draft)
+    if let failure = preview.failure { return .unavailable(failure) }
+    guard snapshot.isComplete, let document = preview.document else { return .unavailable(.busy) }
+    return .committed(await commit(document, operation: draft.editingID == nil ? .add : .edit))
+  }
+}
+
+/// Deletion targets custom memberships, never the shared match-and-action identity.
+extension RulesWorkflow {
+  var deletableSelection: Set<UUID> {
+    Set(snapshot.rows.filter { snapshot.selection.contains($0.id) }.flatMap(\.customIDs))
+  }
+
+  func prepareCustomRuleDeletion() -> CustomRuleDeletion? {
+    guard let ticket = intentTicket(), !deletableSelection.isEmpty else { return nil }
+    return CustomRuleDeletion(customIDs: deletableSelection, version: ticket.version)
+  }
+
+  /// 删除的事务门拒绝（忙碌/超期）与提交失败走同一条 commitFeedback 呈现，
+  /// 不另设返回词汇：确认手势的所有失败口径一致。
+  func deleteCustomRules(_ confirmation: CustomRuleDeletion) async {
+    guard !snapshot.isCommitting else {
+      publishFeedback(.busy, operation: .delete, changedCount: 0, page: snapshot)
+      return
+    }
+    guard let ticket = intentTicket(), let old = ticket.document,
+      !confirmation.customIDs.isEmpty,
+      confirmation.version == ticket.version,
+      confirmation.customIDs.isSubset(of: Set(old.rules.map(\.id)))
+    else {
+      publishFeedback(.superseded, operation: .delete, changedCount: 0, page: snapshot)
+      return
+    }
+    let document = CustomRuleDocument(
+      rules: old.rules.filter { !confirmation.customIDs.contains($0.id) },
+      disabledIdentities: old.disabledIdentities)
+    _ = await commit(
+      document, operation: .delete, changedCount: confirmation.customIDs.count)
+  }
+}
+
+struct CustomRuleDeletion: Equatable, Sendable {
+  let customIDs: Set<UUID>
+  let version: String
+
+  fileprivate init(customIDs: Set<UUID>, version: String) {
+    self.customIDs = customIDs
+    self.version = version
+  }
+}
+
+extension RulesWorkflow {
+  var selectedRelationshipRow: RulesRow? {
+    guard snapshot.selection.count == 1,
+      let row = snapshot.rows.first(where: { snapshot.selection.contains($0.id) }),
+      !row.relationships.isEmpty || row.fixedCoverage != nil
+    else { return nil }
+    return row
+  }
+
+}
diff --git a/ShadowsocksX-NG2/App/Application/RulesWorkflow/RulesWorkspaces.swift b/ShadowsocksX-NG2/App/Application/RulesWorkflow/RulesWorkspaces.swift
new file mode 100644
index 000000000..86edbae49
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/RulesWorkflow/RulesWorkspaces.swift
@@ -0,0 +1,22 @@
+import Combine
+import Foundation
+
+/// Each preset owns an unchanged workflow, including its in-flight operations.
+@MainActor
+final class RulesWorkspaces: ObservableObject {
+  @Published var selectedPreset: RulePreset = .gfwlist
+  @Published private(set) var reportSource: RulesSourceSnapshot?
+  private let workflows: [RulePreset: RulesWorkflow]
+  private var reports: Set<AnyCancellable> = []
+
+  init(makeWorkflow: (RulePreset) -> RulesWorkflow) {
+    workflows = Dictionary(uniqueKeysWithValues: RulePreset.allCases.map { ($0, makeWorkflow($0)) })
+    for workflow in workflows.values {
+      workflow.$reportSource.compactMap { $0 }.sink { [weak self] in
+        self?.reportSource = $0
+      }.store(in: &reports)
+    }
+  }
+
+  var current: RulesWorkflow { workflows[selectedPreset]! }
+}
diff --git a/ShadowsocksX-NG2/App/Application/Services/FirewallStatusChecker.swift b/ShadowsocksX-NG2/App/Application/Services/FirewallStatusChecker.swift
new file mode 100644
index 000000000..434c4a38d
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Services/FirewallStatusChecker.swift
@@ -0,0 +1,59 @@
+import Foundation
+
+enum FirewallBlockStatus: Equatable, Sendable {
+  case permitted
+  case blocked
+  case unknown
+}
+
+protocol FirewallStatusChecking: Sendable {
+  func status(for executableURL: URL) async -> FirewallBlockStatus
+}
+
+/// `socketfilterfw --getappblocked` 是应用防火墙拒绝态的只读系统边界。
+/// 命令缺失、输出漂移或执行失败一律降级为 unknown，不阻断回环/本机代理。
+struct SocketFilterFirewallChecker: FirewallStatusChecking, @unchecked Sendable {
+  typealias CommandRunner = (URL, [String]) throws -> String
+
+  private static let toolURL = URL(
+    fileURLWithPath: "/usr/libexec/ApplicationFirewall/socketfilterfw")
+  private let runCommand: CommandRunner
+
+  init(_ runCommand: @escaping CommandRunner = Self.run) {
+    self.runCommand = runCommand
+  }
+
+  func status(for executableURL: URL) async -> FirewallBlockStatus {
+    statusSynchronously(for: executableURL)
+  }
+
+  private func statusSynchronously(for executableURL: URL) -> FirewallBlockStatus {
+    guard
+      let output = try? runCommand(
+        Self.toolURL, ["--getappblocked", executableURL.path])
+    else { return .unknown }
+    let normalized = output.lowercased()
+    if normalized.contains(" is blocked") { return .blocked }
+    if normalized.contains(" is permitted") { return .permitted }
+    return .unknown
+  }
+
+  private static func run(executableURL: URL, arguments: [String]) throws -> String {
+    let process = Process()
+    process.executableURL = executableURL
+    process.arguments = arguments
+    let pipe = Pipe()
+    process.standardOutput = pipe
+    process.standardError = pipe
+    try process.run()
+    let data = pipe.fileHandleForReading.readDataToEndOfFile()
+    process.waitUntilExit()
+    guard process.terminationStatus == 0 else {
+      throw CocoaError(.executableLoad)
+    }
+    guard let output = String(data: data, encoding: .utf8) else {
+      throw CocoaError(.fileReadInapplicableStringEncoding)
+    }
+    return output
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/Services/LaunchAgentService.swift b/ShadowsocksX-NG2/App/Application/Services/LaunchAgentService.swift
new file mode 100644
index 000000000..ca9cae1ce
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Services/LaunchAgentService.swift
@@ -0,0 +1,102 @@
+import Foundation
+import ServiceManagement
+
+/// LaunchAgent 管理缝：控制器经此协议启停 agent，单元测试以
+/// fake 替换（真实注册会改动用户登录项，不进单测）。
+protocol LaunchAgentControlling {
+  var status: LaunchAgentStatus { get }
+  func register() throws
+  func unregister() throws
+}
+
+/// 生产实现。用 `launchctl bootstrap` 注册 `~/Library/LaunchAgents/` 下带
+/// 绝对路径的 plist（SMAppService 对相对 ProgramArguments 的解析在
+/// DerivedData 等非 /Applications 路径下不可靠，launchd 报 `inferred
+/// program` + `partial import` 并以 EX_CONFIG 拒绝 spawn）。SMAppService
+/// 仅用于读取 BTM 批准状态；批准流仍走系统设置 → 登录项。
+struct SMAppLaunchAgentService: LaunchAgentControlling {
+  static let label = "com.qiuyuzhou.ShadowsocksX-NG2.agent"
+
+  private let service = SMAppService.agent(
+    plistName: "com.qiuyuzhou.ShadowsocksX-NG2.agent.plist")
+
+  var status: LaunchAgentStatus {
+    if isLoadedInLaunchd { return .registered }
+    switch service.status {
+    case .requiresApproval:
+      return .requiresApproval
+    case .enabled:
+      return .registered
+    default:
+      return .notRegistered
+    }
+  }
+
+  func register() throws {
+    try writeUserPlist()
+    try runLaunchctl(["bootstrap", "gui/\(getuid())", userPlistURL.path])
+  }
+
+  func unregister() throws {
+    _ = try? runLaunchctl(["bootout", "gui/\(getuid())/\(Self.label)"])
+    try? FileManager.default.removeItem(at: userPlistURL)
+  }
+
+  // MARK: - Implementation
+
+  private var userPlistURL: URL {
+    FileManager.default.homeDirectoryForCurrentUser
+      .appendingPathComponent("Library/LaunchAgents/\(Self.label).plist")
+  }
+
+  private var agentBinaryURL: URL {
+    Bundle.main.bundleURL.appendingPathComponent("Contents/MacOS/ShadowsocksX-NG2Agent")
+  }
+
+  private var isLoadedInLaunchd: Bool {
+    (try? runLaunchctl(["print", "gui/\(getuid())/\(Self.label)"])) != nil
+  }
+
+  /// manifest 字典单一构造点：writeUserPlist（launchctl bootstrap 用）与
+  /// 打包 plist 的一致性测试共用。KeepAlive/ThrottleInterval 承载 crash
+  /// 重放协议（Agent 崩溃 → 非零退出 → launchd 重启重放最后有效快照）。
+  static func manifestDictionary(programArguments: [String]) -> [String: Any] {
+    [
+      "Label": Self.label,
+      "ProgramArguments": programArguments,
+      "KeepAlive": ["SuccessfulExit": false],
+      "ThrottleInterval": 2,
+    ]
+  }
+
+  private func writeUserPlist() throws {
+    let plist = Self.manifestDictionary(programArguments: [agentBinaryURL.path])
+    let data = try PropertyListSerialization.data(
+      fromPropertyList: plist, format: .xml, options: 0)
+    try FileManager.default.createDirectory(
+      at: userPlistURL.deletingLastPathComponent(), withIntermediateDirectories: true)
+    try data.write(to: userPlistURL, options: .atomic)
+  }
+
+  @discardableResult
+  private func runLaunchctl(_ arguments: [String]) throws -> String {
+    let process = Process()
+    process.executableURL = URL(fileURLWithPath: "/bin/launchctl")
+    process.arguments = arguments
+    let stderr = Pipe()
+    process.standardError = stderr
+    try process.run()
+    process.waitUntilExit()
+    let errorOutput =
+      String(
+        data: stderr.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? ""
+    guard process.terminationStatus == 0 else {
+      throw LaunchAgentRegistrationError.launchctlFailed(errorOutput)
+    }
+    return errorOutput
+  }
+}
+
+enum LaunchAgentRegistrationError: Error, Equatable {
+  case launchctlFailed(String)
+}
diff --git a/ShadowsocksX-NG2/App/Application/Services/LoginAtLoginService.swift b/ShadowsocksX-NG2/App/Application/Services/LoginAtLoginService.swift
new file mode 100644
index 000000000..9f2becadc
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Services/LoginAtLoginService.swift
@@ -0,0 +1,81 @@
+import Foundation
+import ServiceManagement
+import SwiftUI
+
+enum LoginItemStatus: Equatable, Sendable {
+  case notRegistered
+  case registered
+  case requiresApproval
+  case notFound
+}
+
+protocol LaunchAtLoginControlling {
+  var status: LoginItemStatus { get }
+  func register() throws
+  func unregister() throws
+}
+
+struct SMAppLaunchAtLoginService: LaunchAtLoginControlling {
+  private let service = SMAppService.mainApp
+
+  var status: LoginItemStatus {
+    switch service.status {
+    case .notRegistered:
+      .notRegistered
+    case .enabled:
+      .registered
+    case .requiresApproval:
+      .requiresApproval
+    case .notFound:
+      .notFound
+    @unknown default:
+      .notFound
+    }
+  }
+
+  func register() throws {
+    try service.register()
+  }
+
+  func unregister() throws {
+    try service.unregister()
+  }
+}
+
+/// Owns the GUI login-item intent independently from the proxy LaunchAgent.
+/// The system's login-item registration is the only source of truth: the
+/// toggle is off until the user enables it, and enabling or disabling only
+/// issues the corresponding system call before re-reading the status.
+@MainActor
+final class LaunchAtLoginController: ObservableObject {
+  @Published private(set) var status: LoginItemStatus
+  @Published private(set) var errorMessage: String?
+
+  private let service: LaunchAtLoginControlling
+
+  init(service: LaunchAtLoginControlling = SMAppLaunchAtLoginService()) {
+    self.service = service
+    status = service.status
+  }
+
+  /// 已注册或已请求注册待批准都算开启——两者都只来自系统 API 的状态。
+  var isEnabled: Bool {
+    status == .registered || status == .requiresApproval
+  }
+
+  var requiresApproval: Bool { status == .requiresApproval }
+
+  func setEnabled(_ enabled: Bool) {
+    do {
+      if enabled {
+        try service.register()
+      } else {
+        try service.unregister()
+      }
+      errorMessage = nil
+    } catch {
+      errorMessage = error.presentableMessage
+    }
+    status = service.status
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/Services/SystemProxyHelperService.swift b/ShadowsocksX-NG2/App/Application/Services/SystemProxyHelperService.swift
new file mode 100644
index 000000000..b801598b5
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/Services/SystemProxyHelperService.swift
@@ -0,0 +1,243 @@
+import CryptoKit
+import Foundation
+import ServiceManagement
+import SystemConfiguration
+
+/// 系统代理写入缝：异步 typed apply 与无条件 clear 的边界，
+/// 形状为 XPC 就绪。GUI 域决策（意图、门禁、值、清理时机）全部在调用方；
+/// 本缝只执行。生产实现经特权 helper，测试注入 fake。
+@MainActor
+protocol SystemProxyControlling {
+  @discardableResult
+  func apply(_ configuration: SystemProxyConfiguration) async throws -> SystemProxyWriteOutcome
+  func clear() async throws
+  func readServices() async throws -> [SystemProxyServiceState]
+  func repair(_ configuration: SystemProxyConfiguration) async throws
+}
+
+/// helper 注册/审批状态缝：注册走 SMAppService.daemon；审批缺失
+/// 时 GUI 据此呈现登录项批准路径，不提供直接授权回退。unregister 供注册清单
+/// 漂移后的定义刷新使用。单测以 fake 替换（真实注册会改动系统登录项状态）。
+@MainActor
+protocol SystemProxyHelperServicing {
+  var status: SystemProxyHelperStatus { get }
+  func register() throws
+  func unregister() throws
+  func openApprovalPath()
+}
+
+enum SystemProxyHelperStatus: Equatable, Sendable {
+  case notRegistered
+  case requiresApproval
+  case approved
+}
+
+/// 生产实现：SMAppService.daemon 注册 bundle 内
+/// Contents/Library/LaunchDaemons/ 下的 LaunchDaemon 清单。
+struct SMAppServiceSystemProxyHelper: SystemProxyHelperServicing {
+  private let service = SMAppService.daemon(plistName: SystemProxyHelperIdentity.plistName)
+
+  var status: SystemProxyHelperStatus {
+    switch service.status {
+    case .requiresApproval:
+      return .requiresApproval
+    case .enabled:
+      return .approved
+    case .notRegistered, .notFound:
+      return .notRegistered
+    @unknown default:
+      return .notRegistered
+    }
+  }
+
+  func register() throws {
+    try service.register()
+  }
+
+  func unregister() throws {
+    try service.unregister()
+  }
+
+  func openApprovalPath() {
+    SMAppService.openSystemSettingsLoginItems()
+  }
+}
+
+/// 注册清单漂移指纹：launchd 对 SMAppService 提交的 job
+/// 沿用注册时的定义快照，app 更新改动 LaunchDaemon 清单不会自动生效（旧定义
+/// spawn 失败时 launchd 以 EX_CONFIG 节流循环）。以清单内容 SHA-256 检测漂移，
+/// 漂移才注销重注；审批与 bundle 签名绑定，重注不重新弹授权。
+enum SystemProxyHelperRegistrationStamp {
+  static let defaultsKey = "systemProxyHelperRegistrationStamp"
+
+  /// 清单不可读时不判漂移（无基准；未注册场景由注册路径自身兜底）。
+  static func drifted(plistData: Data?, storedStamp: String?) -> Bool {
+    guard let plistData else { return false }
+    return stamp(plistData) != storedStamp
+  }
+
+  static func stamp(_ data: Data) -> String {
+    SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined()
+  }
+}
+
+/// 经特权 helper 的系统代理写入器：每个请求一条按需连接，
+/// MachService 连接触发 launchd 激活已注册的 LaunchDaemon。应答在
+/// helper 不可达、连接失效、报错或超时时以 typed 错误呈现。
+@MainActor
+final class XPCSystemProxyController: SystemProxyControlling {
+  private let requestTimeoutNanoseconds: UInt64
+
+  init(requestTimeoutNanoseconds: UInt64 = 10_000_000_000) {
+    self.requestTimeoutNanoseconds = requestTimeoutNanoseconds
+  }
+
+  func apply(_ configuration: SystemProxyConfiguration) async throws -> SystemProxyWriteOutcome {
+    let payload = try SystemProxyHelperWire.encodeConfiguration(configuration)
+    let response = try await send { proxy, reply in proxy.apply(payload, withReply: reply) }
+    switch response {
+    case .applied(let outcome):
+      return outcome
+    case .failure(let error):
+      throw error
+    case .cleared:
+      throw SystemProxyError.helperUnavailable("apply 收到 clear 应答")
+    }
+  }
+
+  func clear() async throws {
+    let response = try await send { proxy, reply in proxy.clear(withReply: reply) }
+    switch response {
+    case .cleared:
+      return
+    case .failure(let error):
+      throw error
+    case .applied:
+      throw SystemProxyError.helperUnavailable("clear 收到 apply 应答")
+    }
+  }
+
+  /// GUI-side read only; no helper registration or privileged writes.
+  func readServices() async throws -> [SystemProxyServiceState] {
+    try await Task.detached(priority: .utility) {
+      guard let preferences = SCPreferencesCreate(nil, "ShadowsocksX-NG2.Observe" as CFString, nil)
+      else { throw SystemProxyError.preferencesUnavailable }
+      guard let set = SCNetworkSetCopyCurrent(preferences),
+        let locationID = SCNetworkSetGetSetID(set) as String?
+      else { throw SystemProxyError.noCurrentNetworkSet }
+      let services = SCNetworkSetCopyServices(set) as? [SCNetworkService] ?? []
+      guard !services.isEmpty else { throw SystemProxyError.noProxyServices }
+      return try services.map { service in
+        guard let serviceID = SCNetworkServiceGetServiceID(service) as String?
+        else { throw SystemProxyError.unreadableService("unknown") }
+        let proxyProtocol = SCNetworkServiceCopyProtocol(service, kSCNetworkProtocolTypeProxies)
+        let value = proxyProtocol.flatMap { SCNetworkProtocolGetConfiguration($0) }
+        let data: Data?
+        if let value {
+          guard let dictionary = value as? [String: Any]
+          else { throw SystemProxyError.unreadableService(serviceID) }
+          data = try SystemProxyPlanner.propertyListData(from: dictionary, serviceID: serviceID)
+        } else {
+          data = nil
+        }
+        return SystemProxyServiceState(
+          identifier: SystemProxyServiceIdentifier(locationID: locationID, serviceID: serviceID),
+          configuration: data, name: SCNetworkServiceGetName(service) as String? ?? serviceID)
+      }
+    }.value
+  }
+
+  func repair(_ configuration: SystemProxyConfiguration) async throws {
+    // The helper rereads the current location under its preferences lock and plans
+    // only differing services, preserving fields outside the managed projection.
+    _ = try await apply(configuration)
+  }
+
+  // MARK: - XPC 请求
+
+  private func send(
+    _ call:
+      @escaping @Sendable (
+        _ proxy: SystemProxyHelperControlling, _ reply: @escaping @Sendable (Data) -> Void
+      ) -> Void
+  ) async throws -> SystemProxyHelperResponse {
+    let gate = SystemProxyReplyGate()
+    // 系统域 LaunchDaemon 的 MachService 注册在系统 launchd 命名空间；不带
+    // .privileged 的连接只在 per-user 域查找，永远失败。
+    let connection = NSXPCConnection(
+      machServiceName: SystemProxyHelperIdentity.machServiceName, options: .privileged)
+    defer { connection.invalidate() }
+    connection.remoteObjectInterface = NSXPCInterface(with: SystemProxyHelperControlling.self)
+    // 回调闭包必须显式 @Sendable（nonisolated）：它们在 @MainActor 方法里形成，
+    // 传给非 @Sendable 的 Foundation 参数会被推断为主 actor 隔离，而 Foundation
+    // 在 XPC 内部队列上调起它们，Swift 6 动态隔离检查会让跨线程调用直接 trap。
+    // 闭包只捕获 Sendable 闸门，无需回主 actor。
+    connection.invalidationHandler = { @Sendable in
+      gate.finish(.failure(SystemProxyError.helperUnavailable("XPC 连接已失效")))
+    }
+    guard
+      let proxy = connection.remoteObjectProxyWithErrorHandler({ @Sendable (error: Error) in
+        gate.finish(.failure(SystemProxyError.helperUnavailable(String(describing: error))))
+      }) as? SystemProxyHelperControlling
+    else {
+      gate.finish(.failure(SystemProxyError.helperUnavailable("无法创建远程对象代理")))
+      return try await gate.wait()
+    }
+    connection.resume()
+    call(proxy) { payload in
+      gate.finish(Result { try SystemProxyHelperWire.decode(payload) })
+    }
+    // 超时兜底：已批准但卡死的 helper 不应让 UI 命令永久挂起；应答先到时取消。
+    let timeout = requestTimeoutNanoseconds
+    let timeoutTask = Task.detached(priority: .utility) {
+      do {
+        try await Task.sleep(nanoseconds: timeout)
+      } catch {
+        return
+      }
+      gate.finish(.failure(SystemProxyError.helperUnavailable("helper 应答超时")))
+    }
+    defer { timeoutTask.cancel() }
+    return try await gate.wait()
+  }
+}
+
+/// 一次性应答闸门：XPC 回调与超时兜底来自任意队列，只有第一个 finish 生效；
+/// finish 先于 wait 到达时由闸门暂存结果。
+private final class SystemProxyReplyGate: @unchecked Sendable {
+  private let lock = NSLock()
+  private var continuation: CheckedContinuation<SystemProxyHelperResponse, Error>?
+  private var result: Result<SystemProxyHelperResponse, Error>?
+
+  func finish(_ result: Result<SystemProxyHelperResponse, Error>) {
+    lock.lock()
+    if let continuation {
+      self.continuation = nil
+      lock.unlock()
+      continuation.resume(with: result)
+      return
+    }
+    if self.result == nil {
+      self.result = result
+    }
+    lock.unlock()
+  }
+
+  func wait() async throws -> SystemProxyHelperResponse {
+    try await withCheckedThrowingContinuation { continuation in
+      lock.lock()
+      if let result {
+        lock.unlock()
+        continuation.resume(with: result)
+        return
+      }
+      if self.continuation == nil {
+        self.continuation = continuation
+        lock.unlock()
+        return
+      }
+      lock.unlock()
+      continuation.resume(throwing: SystemProxyError.helperUnavailable("重复等待应答"))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/SettingsWorkflow/ListenerOccupancy.swift b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/ListenerOccupancy.swift
new file mode 100644
index 000000000..654309990
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/ListenerOccupancy.swift
@@ -0,0 +1,215 @@
+import Combine
+import Foundation
+
+/// Owns probe identity, observation lifetime and runtime ownership interpretation.
+/// Cached observations are never reinterpreted using a different runtime context.
+@MainActor
+final class ListenerOccupancy: ObservableObject {
+  private struct Context: Equatable, Sendable {
+    let draft: SettingsPortDraft
+    let proposedListen: RuntimeListenFacts
+    let runtimeListen: RuntimeListenFacts?
+    let runtimeProcessID: Int32?
+
+    func ownsListener(_ result: PortOccupancy, for id: SettingsPortID) -> Bool {
+      let endpoint = SettingsPortAdapter.endpoint(for: id, group: draft.group)
+      guard runtimeListen?.port(for: endpoint) == proposedListen.port(for: endpoint),
+        let processID = runtimeProcessID, case .occupied(let facts) = result
+      else { return false }
+      let isVerifiedOwner =
+        facts.occupiedProcessIDs == Set([processID])
+        && facts.occupiedFamilies.isSubset(of: facts.verifiedFamilies)
+      if isVerifiedOwner { return true }
+
+      let proposedMode = PortOccupancyProbeRequest(
+        endpoint: endpoint, listen: proposedListen
+      ).listenerMode
+      let runtimeMode = runtimeListen.map {
+        PortOccupancyProbeRequest(endpoint: endpoint, listen: $0).listenerMode
+      }
+      // A dual-stack IPv6 socket can own the IPv4 listener without an IPv4 PID.
+      return (proposedMode == .disabled || proposedMode == .allIPv4Interfaces)
+        && facts.occupiedFamilies == [.ipv4]
+        && runtimeMode == .allIPv4AndIPv6Interfaces
+        && facts.processIDs(for: .ipv4).isEmpty
+        && facts.processIDs(for: .ipv6).contains(processID)
+        && Set(PortOccupancyAddressFamily.allCases).isSubset(of: facts.verifiedFamilies)
+    }
+  }
+
+  private struct Preview {
+    let context: Context
+    var results: [SettingsPortID: PortOccupancy]?
+
+    var blockedPortIDs: [SettingsPortID] {
+      SettingsPortID.allCases.filter { id in
+        guard let result = results?[id], case .occupied = result else { return false }
+        return !context.ownsListener(result, for: id)
+      }
+    }
+  }
+
+  @Published private var preview: Preview?
+  private var generation = 0
+  private let committing: SettingsCommitting
+  private let probe: PortOccupancyProbing
+
+  init(committing: SettingsCommitting, probe: PortOccupancyProbing) {
+    self.committing = committing
+    self.probe = probe
+  }
+
+  func listenSettings(for draft: SettingsPortDraft) -> ProxyListeningConfiguration {
+    var listen = committing.committedSettings.listen
+    switch draft.group {
+    case .local:
+      listen.socksPort = draft.socksPort
+      listen.httpPort = draft.httpPort
+    case .lan:
+      listen.lan.socksPort = draft.socksPort
+      listen.lan.httpPort = draft.httpPort
+      listen.lan.mode = draft.listenerMode
+      listen.lan.isEnabled = draft.isEnabled
+    }
+    return listen
+  }
+
+  func reset() {
+    generation += 1
+    preview = nil
+  }
+
+  func refresh(_ draft: SettingsPortDraft) {
+    generation += 1
+    let epoch = generation
+    let context = context(for: draft)
+    preview = Preview(context: context)
+    if draft.group == .lan && !draft.isEnabled {
+      preview = Preview(context: context, results: [.socks: .free, .http: .free])
+      return
+    }
+    let probe = probe
+    Task { [weak self] in
+      let results = await Self.probe(context, using: probe)
+      guard let self, epoch == generation else { return }
+      guard context == self.context(for: draft) else {
+        refresh(draft)
+        return
+      }
+      preview = Preview(context: context, results: results)
+    }
+  }
+
+  func fieldFacts(for id: SettingsPortID, draft: SettingsPortDraft)
+    -> (occupancy: SettingsPortOccupancy?, isRuntimeException: Bool)
+  {
+    guard let preview = currentPreview(for: draft), let result = preview.results?[id] else {
+      return (nil, false)
+    }
+    return (SettingsPortOccupancy(result), preview.context.ownsListener(result, for: id))
+  }
+
+  func canSave(_ draft: SettingsPortDraft) -> Bool {
+    guard let preview = currentPreview(for: draft), preview.results != nil else { return false }
+    return preview.blockedPortIDs.isEmpty
+  }
+
+  func cachedSaveRejection(for draft: SettingsPortDraft) -> SettingsCommandRejection? {
+    guard let preview else {
+      refresh(draft)
+      return .inProgress
+    }
+    guard preview.context == context(for: draft) else {
+      refreshIfEditing(draft)
+      return .superseded
+    }
+    guard preview.results != nil else { return .inProgress }
+    return preview.blockedPortIDs.isEmpty ? nil : .occupied(preview.blockedPortIDs)
+  }
+
+  /// Save-time checks remain distinct from editor previews and never commit.
+  func recheck(_ draft: SettingsPortDraft) async -> SettingsCommandRejection? {
+    guard draft.group != .lan || draft.isEnabled else { return nil }
+    let context = context(for: draft)
+    let epoch = generation
+    let results = await Self.probe(context, using: probe)
+    guard !Task.isCancelled, epoch == generation, context == self.context(for: draft) else {
+      refreshIfEditing(draft)
+      return .superseded
+    }
+    let blocked = Preview(context: context, results: results).blockedPortIDs
+    return blocked.isEmpty ? nil : .occupied(blocked)
+  }
+
+  func suggestFreePort(for id: SettingsPortID, draft: SettingsPortDraft) async
+    -> SettingsCommandOutcome
+  {
+    let context = context(for: draft)
+    guard preview?.context == context else {
+      refreshIfEditing(draft)
+      return .rejected(.superseded)
+    }
+    let epoch = generation
+    let endpoint = SettingsPortAdapter.endpoint(for: id, group: draft.group)
+    let excluded = Set(ProxyEndpointKind.allCases.map { context.proposedListen.port(for: $0) })
+    let probe = probe
+    let candidate = await Task.detached(priority: .utility) {
+      await PortSuggestion.firstFreeAsync(excluding: excluded) { port in
+        let request = PortOccupancyProbeRequest(
+          endpoint: endpoint,
+          listen: context.proposedListen.replacingPort(port, for: endpoint), port: port)
+        if case .free = await probe.occupancy(for: request) { return true }
+        return false
+      }
+    }.value
+    guard !Task.isCancelled, epoch == generation, preview?.context == context,
+      context == self.context(for: draft)
+    else {
+      refreshIfEditing(draft)
+      return .rejected(.superseded)
+    }
+    guard let candidate else { return .rejected(.noFreePort(id)) }
+    return .suggestedPort(port: id, value: candidate)
+  }
+
+  private func context(for draft: SettingsPortDraft) -> Context {
+    Context(
+      draft: draft, proposedListen: RuntimeListenFacts(listen: listenSettings(for: draft)),
+      runtimeListen: committing.runtimeListenFacts,
+      runtimeProcessID: committing.runtimeListenerProcessID)
+  }
+
+  private func currentPreview(for draft: SettingsPortDraft) -> Preview? {
+    guard let preview, preview.context.draft == draft else { return nil }
+    guard preview.context == context(for: draft) else {
+      // Queries may run during view rendering. Publish the refresh on a later turn.
+      let epoch = generation
+      Task { [weak self] in
+        guard let self, epoch == generation else { return }
+        refreshIfEditing(draft)
+      }
+      return nil
+    }
+    return preview
+  }
+
+  private func refreshIfEditing(_ draft: SettingsPortDraft) {
+    guard preview == nil || preview?.context.draft == draft else { return }
+    refresh(draft)
+  }
+
+  private static func probe(_ context: Context, using probe: PortOccupancyProbing) async
+    -> [SettingsPortID: PortOccupancy]
+  {
+    await Task.detached(priority: .utility) {
+      var results: [SettingsPortID: PortOccupancy] = [:]
+      for id in SettingsPortID.allCases {
+        let endpoint = SettingsPortAdapter.endpoint(for: id, group: context.draft.group)
+        let request = PortOccupancyProbeRequest(
+          endpoint: endpoint, listen: context.proposedListen)
+        results[id] = await probe.occupancy(for: request)
+      }
+      return results
+    }.value
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/SettingsWorkflow/ProxyListeningStartup.swift b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/ProxyListeningStartup.swift
new file mode 100644
index 000000000..b4cb69630
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/ProxyListeningStartup.swift
@@ -0,0 +1,21 @@
+import Foundation
+
+/// 正常应用装配之前完成读取或显式重置，失败期间不构造运行时控制器。
+@MainActor
+enum ProxyListeningStartup {
+  static func load(
+    store: ProxyListeningFileStore,
+    presentReset: (ProxyListeningStoreError) -> Void
+  ) -> ProxyListeningConfiguration {
+    var failure: ProxyListeningStoreError
+    do { return try store.load() } catch { failure = listeningFailure(error) }
+    while true {
+      presentReset(failure)
+      do { return try store.reset() } catch { failure = listeningFailure(error) }
+    }
+  }
+
+  private static func listeningFailure(_ error: Error) -> ProxyListeningStoreError {
+    (error as? ProxyListeningStoreError) ?? .ioFailure(detail: String(describing: error))
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsPortAdapter.swift b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsPortAdapter.swift
new file mode 100644
index 000000000..7ae5969fc
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsPortAdapter.swift
@@ -0,0 +1,72 @@
+import Foundation
+
+/// 写入侧窄 seam：设置工作流只依赖已提交快照、当前 runtime 的
+/// typed listener facts 与提交入口。生产实现是 `ProxyRuntimeController`
+/// 的薄扩展；测试注入 fake。Domain 快照类型只出现在本缝与 adapter。读取侧是
+/// 运行时控制器的主 actor 状态，本缝随之主 actor 绑定。
+@MainActor
+protocol SettingsCommitting: AnyObject {
+  var committedSettings: ProxyRuntimeSettings { get }
+  var runtimeListenFacts: RuntimeListenFacts? { get }
+  var runtimeListenerProcessID: Int32? { get }
+  func updateListening(_ proposed: ProxyListeningConfiguration) async throws
+  func updateProxyExceptions(_ value: String) async
+}
+
+extension ProxyRuntimeController: SettingsCommitting {
+  var committedSettings: ProxyRuntimeSettings { settings }
+  var runtimeListenFacts: RuntimeListenFacts? { effectiveRuntimeListenFacts }
+  var runtimeListenerProcessID: Int32? { effectiveRuntimeListenerProcessID }
+
+}
+
+/// Settings field adapters keep port IDs, endpoints, and validation facts aligned.
+enum SettingsPortAdapter {
+  /// UI 形状端口标识 → 端点类型（module 内部复用 Domain 端口语义）。
+  static func endpoint(for id: SettingsPortID, group: SettingsListeningGroup) -> ProxyEndpointKind {
+    switch (group, id) {
+    case (.local, .socks): .socks
+    case (.local, .http): .http
+    case (.lan, .socks): .lanSocks
+    case (.lan, .http): .lanHTTP
+    }
+  }
+
+  /// 全局端口校验保留四个端点的身份，错误只归位到当前编辑组涉及的字段。
+  static func fieldIssues(
+    from errors: [PortSettingError], group: SettingsListeningGroup
+  ) -> [SettingsFieldIssue] {
+    errors.flatMap { error -> [SettingsFieldIssue] in
+      let endpoints: [ProxyEndpointKind]
+      switch error {
+      case .portOutOfRange(let endpoint, _):
+        endpoints = [endpoint]
+      case .duplicatePort(let endpoint, let otherEndpoint, _):
+        endpoints = [endpoint, otherEndpoint]
+      }
+      return endpoints.compactMap { endpoint in
+        guard
+          let id = SettingsPortID.allCases.first(where: {
+            Self.endpoint(for: $0, group: group) == endpoint
+          })
+        else { return nil }
+        return .port(id, error: error)
+      }
+    }
+  }
+
+}
+
+extension SettingsPortOccupancy {
+  /// 探测层判定 → UI 形状事实。
+  init(_ occupancy: PortOccupancy) {
+    switch occupancy {
+    case .free:
+      self = .free
+    case .occupied(let facts):
+      self = .occupied(occupier: facts.occupier)
+    case .unknown(let detail):
+      self = .unknown(detail: detail)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflow+Connectivity.swift b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflow+Connectivity.swift
new file mode 100644
index 000000000..57fe8331b
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflow+Connectivity.swift
@@ -0,0 +1,20 @@
+import Foundation
+
+extension SettingsWorkflow {
+  private static let connectivityURLKey = "connectivityTestURL"
+
+  func beginConnectivityURLEditing() -> String {
+    let url =
+      (connectivityDefaults.object(forKey: Self.connectivityURLKey) as? String)
+      .flatMap(ServerConnectivity.validURL) ?? ServerConnectivity.defaultURL
+    return url.absoluteString
+  }
+
+  func saveConnectivityURL(_ raw: String) async -> Bool {
+    guard let url = ServerConnectivity.validURL(raw), startCommit() else { return false }
+    defer { finishCommit() }
+    connectivityDefaults.set(url.absoluteString, forKey: Self.connectivityURLKey)
+    connectivityURLDidChange?(url)
+    return true
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflow+LANListening.swift b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflow+LANListening.swift
new file mode 100644
index 000000000..ced4e8b79
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflow+LANListening.swift
@@ -0,0 +1,50 @@
+import Foundation
+
+extension SettingsWorkflow {
+  var committedLANListening: LANListeningFacts {
+    LANListeningFacts(committing.committedSettings.listen.lan)
+  }
+
+  func beginLANListeningEditing() -> LANListeningDraft {
+    let lan = committing.committedSettings.listen.lan
+    let alphabet = Array("abcdefghijklmnopqrstuvwxyz0123456789")
+    let password =
+      lan.password ?? String((0..<10).map { _ in alphabet[Int.random(in: alphabet.indices)] })
+    listenerOccupancy.reset()
+    return LANListeningDraft(
+      ports: SettingsPortDraft(
+        socksPort: lan.socksPort, httpPort: lan.httpPort,
+        group: .lan, listenerMode: lan.mode, isEnabled: lan.isEnabled),
+      udpRelayEnabled: lan.udpRelayEnabled, authenticationEnabled: lan.authenticationEnabled,
+      username: lan.username, password: password)
+  }
+
+  /// 凭据形状只是身份验证启用时的保存约束；关闭时凭据是保留值（字段禁用），
+  /// 不拦本次保存。整快照端口门禁仍由 `canSavePortSettings` 承担（跨组互异）。
+  func canSaveLANListening(_ draft: LANListeningDraft) -> Bool {
+    let credentialsSatisfySave =
+      !draft.authenticationEnabled
+      || (RuntimeListenerAuthentication.validUsername(draft.username)
+        && RuntimeListenerAuthentication.validPassword(draft.password))
+    return credentialsSatisfySave && canSavePortSettings(draft.ports)
+  }
+
+  @discardableResult
+  func saveLANListening(_ draft: LANListeningDraft) async -> SettingsCommandOutcome {
+    guard startCommit() else { return .rejected(.inProgress) }
+    defer { finishCommit() }
+    guard draft.ports.group == .lan else { return .rejected(.superseded) }
+    let base = committing.committedSettings.listen
+    var proposed = listenSettings(for: draft.ports)
+    if let rejection = await listenerOccupancy.recheck(draft.ports) { return .rejected(rejection) }
+    guard base == committing.committedSettings.listen else {
+      listenerOccupancy.refresh(draft.ports)
+      return .rejected(.superseded)
+    }
+    proposed.lan.udpRelayEnabled = draft.udpRelayEnabled
+    proposed.lan.authenticationEnabled = draft.authenticationEnabled
+    proposed.lan.username = draft.username
+    proposed.lan.password = draft.password
+    return await persistListening(proposed, fieldGroup: .lan)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflow.swift b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflow.swift
new file mode 100644
index 000000000..3503c573e
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflow.swift
@@ -0,0 +1,199 @@
+import Combine
+import Foundation
+
+/// Settings item editors read the committed snapshot and submit one item at a time.
+/// The module exposes validation, occupancy facts, shared commit state, and typed
+/// commands; editor-local drafts and presentation state remain in the UI.
+///
+/// Listening writes and system-proxy exceptions use `SettingsCommitting`; the test URL
+/// preference uses UserDefaults. Runtime convergence stays behind the commit seam.
+@MainActor
+final class SettingsWorkflow: ObservableObject {
+  let listenerOccupancy: ListenerOccupancy
+  private var occupancyChanges: AnyCancellable?
+
+  /// Shared gate that prevents concurrent saves across setting items.
+  @Published private(set) var isCommitting = false
+  /// Typed persistence failure for the editor to present.
+  @Published private(set) var lastFailure: SettingsWorkflowFailure?
+
+  var connectivityURLDidChange: ((URL) -> Void)?
+
+  let committing: SettingsCommitting
+  let connectivityDefaults: UserDefaults
+
+  init(
+    committing: SettingsCommitting,
+    occupancyProbe: PortOccupancyProbing = SystemPortOccupancyProbe(),
+    connectivityDefaults: UserDefaults = .standard
+  ) {
+    self.committing = committing
+    self.connectivityDefaults = connectivityDefaults
+    listenerOccupancy = ListenerOccupancy(committing: committing, probe: occupancyProbe)
+    occupancyChanges = listenerOccupancy.objectWillChange.sink { [weak self] in
+      self?.objectWillChange.send()
+    }
+  }
+
+  /// Current committed port pair; editors start from this snapshot.
+  var committedPortDraft: SettingsPortDraft {
+    let listen = committing.committedSettings.listen
+    return SettingsPortDraft(socksPort: listen.socksPort, httpPort: listen.httpPort)
+  }
+
+  var committedProxyExceptionCount: Int {
+    committing.committedSettings.proxyExceptionList.count
+  }
+
+  func beginProxyExceptionsEditing() -> String {
+    lastFailure = nil
+    return committing.committedSettings.proxyExceptions
+  }
+
+  /// Start a port editor from committed values and discard prior probe facts.
+  func beginPortSettingsEditing() -> SettingsPortDraft {
+    lastFailure = nil
+    listenerOccupancy.reset()
+    return committedPortDraft
+  }
+
+  /// Field state uses the editor group and its proposed listening mode.
+  func portFieldState(
+    for id: SettingsPortID, editorDraft: SettingsPortDraft
+  ) -> SettingsPortFieldState {
+    let facts = listenerOccupancy.fieldFacts(for: id, draft: editorDraft)
+    let exception = facts.isRuntimeException
+    let occupancy = facts.occupancy
+    let issues = portIssues(for: editorDraft).filter { $0.field == .port(id) }
+    let canSuggest: Bool
+    if case .occupied? = occupancy {
+      canSuggest = !exception
+    } else {
+      canSuggest = false
+    }
+    return SettingsPortFieldState(
+      id: id,
+      draftValue: editorDraft.portValue(for: id),
+      occupancy: occupancy,
+      issues: issues,
+      isRuntimePortException: exception,
+      canSuggestFreePort: canSuggest)
+  }
+
+  /// Refresh port occupancy facts. Results from an older editor draft are ignored.
+  func refreshPortEditorOccupancy(for editorDraft: SettingsPortDraft) {
+    listenerOccupancy.refresh(editorDraft)
+  }
+
+  /// Invalid ports and known external occupancy block the save. Unknown
+  /// occupancy remains advisory, and probing must finish for this exact draft.
+  func canSavePortSettings(_ editorDraft: SettingsPortDraft) -> Bool {
+    listenSettings(for: editorDraft).portValidationErrors().isEmpty
+      && listenerOccupancy.canSave(editorDraft)
+      && !isCommitting
+  }
+
+  /// Return an available port candidate for the editor to apply. This command
+  /// never persists the candidate.
+  @discardableResult
+  func suggestFreePort(
+    for id: SettingsPortID, from editorDraft: SettingsPortDraft
+  ) async -> SettingsCommandOutcome {
+    guard !isCommitting else { return .rejected(.inProgress) }
+    return await listenerOccupancy.suggestFreePort(for: id, draft: editorDraft)
+  }
+
+  /// Save the SOCKS5 and HTTP ports as one item. Validity is enforced at the
+  /// store seam; this command only maps a store rejection back to field issues.
+  @discardableResult
+  func savePortSettings(_ editorDraft: SettingsPortDraft) async -> SettingsCommandOutcome {
+    guard !isCommitting else { return .rejected(.inProgress) }
+    guard editorDraft.group == .local else { return .rejected(.superseded) }
+    if let rejection = listenerOccupancy.cachedSaveRejection(for: editorDraft) {
+      return .rejected(rejection)
+    }
+
+    var proposed = committing.committedSettings.listen
+    proposed.socksPort = editorDraft.socksPort
+    proposed.httpPort = editorDraft.httpPort
+    return await commitPortSettings(proposed, fieldGroup: editorDraft.group)
+  }
+
+  /// Save only user-added system-proxy exceptions.
+  @discardableResult
+  func saveProxyExceptions(_ rawValue: String) async -> SettingsCommandOutcome {
+    guard !isCommitting else { return .rejected(.inProgress) }
+    let value =
+      rawValue.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty ? "" : rawValue
+    guard value != committing.committedSettings.proxyExceptions else {
+      lastFailure = nil
+      return .persisted
+    }
+
+    isCommitting = true
+    lastFailure = nil
+    await committing.updateProxyExceptions(value)
+    isCommitting = false
+    return .persisted
+  }
+
+  func listenSettings(for editorDraft: SettingsPortDraft) -> ProxyListeningConfiguration {
+    listenerOccupancy.listenSettings(for: editorDraft)
+  }
+
+  private func portIssues(for editorDraft: SettingsPortDraft) -> [SettingsFieldIssue] {
+    let errors = listenSettings(for: editorDraft).portValidationErrors()
+    return SettingsPortAdapter.fieldIssues(from: errors, group: editorDraft.group)
+  }
+
+  func startCommit() -> Bool {
+    guard !isCommitting else { return false }
+    isCommitting = true
+    lastFailure = nil
+    return true
+  }
+
+  func finishCommit() { isCommitting = false }
+
+  func commitPortSettings(
+    _ proposed: ProxyListeningConfiguration, fieldGroup: SettingsListeningGroup? = nil
+  ) async -> SettingsCommandOutcome {
+    guard startCommit() else { return .rejected(.inProgress) }
+    defer { finishCommit() }
+    return await persistListening(proposed, fieldGroup: fieldGroup)
+  }
+
+  /// 调用方持有共享提交锁；持久化结果与运行状态分别报告。
+  /// store 的 `.invalid` 按编辑组归位成字段 issue；其余失败保持持久化形状。
+  func persistListening(
+    _ proposed: ProxyListeningConfiguration, fieldGroup: SettingsListeningGroup? = nil
+  ) async -> SettingsCommandOutcome {
+    do {
+      try await committing.updateListening(proposed)
+      lastFailure = nil
+      return .persisted
+    } catch {
+      if let fieldGroup,
+        let error = error as? ProxyListeningStoreError,
+        case .invalid(let portErrors) = error
+      {
+        return .rejected(
+          .validation(SettingsPortAdapter.fieldIssues(from: portErrors, group: fieldGroup)))
+      }
+      return commitFailure(for: error)
+    }
+  }
+
+  private func commitFailure(for error: Error) -> SettingsCommandOutcome {
+    let failure = Self.workflowFailure(for: error)
+    lastFailure = failure
+    return .commitFailed(failure)
+  }
+
+  private static func workflowFailure(for error: Error) -> SettingsWorkflowFailure {
+    if let error = error as? ProxyListeningStoreError {
+      return .store(error)
+    }
+    return .unknown
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflowModels.swift b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflowModels.swift
new file mode 100644
index 000000000..39996ecc1
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Application/SettingsWorkflow/SettingsWorkflowModels.swift
@@ -0,0 +1,138 @@
+import Foundation
+
+// MARK: - Setting editor models
+
+/// Stable UI identifier for the SOCKS5 and HTTP port fields. The view does not
+/// need to import the probe layer's endpoint type.
+enum SettingsPortID: CaseIterable, Hashable, Sendable {
+  case socks
+  case http
+}
+
+/// The SOCKS5 and HTTP ports edited and saved together as one settings item.
+enum SettingsListeningGroup: Sendable { case local, lan }
+
+struct SettingsPortDraft: Equatable, Sendable {
+  var socksPort: Int
+  var httpPort: Int
+  var group: SettingsListeningGroup = .local
+  var listenerMode: LANListenerMode = .allIPv4Interfaces
+  var isEnabled = false
+
+  func portValue(for id: SettingsPortID) -> Int {
+    switch id {
+    case .socks: socksPort
+    case .http: httpPort
+    }
+  }
+
+  mutating func setPortValue(_ value: Int, for id: SettingsPortID) {
+    switch id {
+    case .socks: socksPort = value
+    case .http: httpPort = value
+    }
+  }
+}
+
+// MARK: - 按字段归位的校验问题
+
+/// 字段标识（按字段归位查询）；端口问题用端口标识变体。
+enum SettingsFieldID: Hashable, Sendable {
+  case port(SettingsPortID)
+}
+
+/// 按字段归位的校验问题：每条保留 Domain 的 typed fact；文案由 App
+/// presentation edge 派生。
+enum SettingsFieldIssue: Hashable, Sendable {
+  case port(SettingsPortID, error: PortSettingError)
+
+  var field: SettingsFieldID {
+    switch self {
+    case .port(let id, _): .port(id)
+    }
+  }
+
+  var error: PortSettingError {
+    switch self {
+    case .port(_, let error):
+      error
+    }
+  }
+}
+
+// MARK: - 端口 field state
+
+/// 端口占用的类型化事实（UI 形状）：文案与颜色由视图决定。
+enum SettingsPortOccupancy: Equatable, Sendable {
+  case free
+  /// 端口不可绑定；占用进程名尽力解析（未知为 nil）。
+  case occupied(occupier: String?)
+  case unknown(detail: String)
+}
+
+/// 每个端口字段的 field state：两个端口行复用同一套呈现逻辑。
+struct SettingsPortFieldState: Equatable, Sendable {
+  let id: SettingsPortID
+  /// 该端口当前草稿值。
+  let draftValue: Int
+  /// 类型化占用事实；`nil` = 尚未探测。
+  let occupancy: SettingsPortOccupancy?
+  /// 该端口的字段问题事实；文案由 presentation edge 派生。
+  let issues: [SettingsFieldIssue]
+  /// Whether the running listener matches the complete edited listen identity.
+  let isRuntimePortException: Bool
+  /// 是否可建议空闲端口（被占用且不是运行中端口例外）。
+  let canSuggestFreePort: Bool
+}
+
+// MARK: - 命令结果与拒绝原因
+
+/// Typed reasons why a command cannot proceed. The workflow exposes facts,
+/// not localized strings or a Boolean that makes validation and occupancy
+/// failures indistinguishable.
+enum SettingsCommandRejection: Equatable, Sendable {
+  case inProgress
+  case superseded
+  case validation([SettingsFieldIssue])
+  case occupied([SettingsPortID])
+  case noFreePort(SettingsPortID)
+}
+
+/// Settings workflow 的持久化/提交失败；workflow 不提前渲染句子。
+enum SettingsWorkflowFailure: Error, Equatable, Sendable {
+  case store(ProxyListeningStoreError)
+  case unknown
+}
+
+/// Results for port suggestion and item-save commands. Proxy runtime status is
+/// presented by its owning status UI, not this settings interface.
+enum SettingsCommandOutcome: Equatable, Sendable {
+  case rejected(SettingsCommandRejection)
+  case suggestedPort(port: SettingsPortID, value: Int)
+  case persisted
+  case commitFailed(SettingsWorkflowFailure)
+}
+
+/// 局域网 sheet 的完整草稿；密码只属于编辑会话。
+struct LANListeningDraft: Equatable, Sendable {
+  var ports: SettingsPortDraft
+  var udpRelayEnabled: Bool
+  var authenticationEnabled: Bool
+  var username: String
+  var password: String
+
+  var hasValidCredentials: Bool {
+    RuntimeListenerAuthentication.validUsername(username)
+      && RuntimeListenerAuthentication.validPassword(password)
+  }
+
+  var isEnabled: Bool {
+    get { ports.isEnabled }
+    set { ports.isEnabled = newValue }
+  }
+
+  var mode: LANListenerMode {
+    get { ports.listenerMode }
+    set { ports.listenerMode = newValue }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Composition/AboutScenes.swift b/ShadowsocksX-NG2/App/Composition/AboutScenes.swift
new file mode 100644
index 000000000..a7a6f39ad
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Composition/AboutScenes.swift
@@ -0,0 +1,25 @@
+import SwiftUI
+
+struct AboutScenes: Scene {
+  let windowActivation: WindowActivationPolicyCoordinator
+
+  var body: some Scene {
+    Window("关于 ShadowsocksX-NG2", id: AboutView.sceneID) {
+      AboutView()
+        .modifier(WindowActivationPolicy(coordinator: windowActivation))
+    }
+    .defaultLaunchBehavior(.suppressed)
+    .restorationBehavior(.disabled)
+    .commandsRemoved()
+    .windowResizability(.contentSize)
+
+    Window("第三方组件与许可证", id: ThirdPartyComponentsView.sceneID) {
+      ThirdPartyComponentsView()
+        .modifier(WindowActivationPolicy(coordinator: windowActivation))
+    }
+    .defaultLaunchBehavior(.suppressed)
+    .restorationBehavior(.disabled)
+    .commandsRemoved()
+    .defaultSize(width: 1000, height: 680)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Composition/AppLanguagePreferences.swift b/ShadowsocksX-NG2/App/Composition/AppLanguagePreferences.swift
new file mode 100644
index 000000000..f45e3bd40
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Composition/AppLanguagePreferences.swift
@@ -0,0 +1,30 @@
+import Combine
+import Foundation
+
+/// 应用语言覆盖使用 macOS 的应用级 AppleLanguages 偏好；不写全局偏好。
+/// Bundle 在进程内缓存语言选择，因此保存后由下次启动统一应用。
+@MainActor
+final class AppLanguagePreferences: ObservableObject {
+  @Published private(set) var selection: AppLanguage
+
+  private let defaults: UserDefaults
+
+  init(
+    defaults: UserDefaults = .standard,
+    applicationID: String = "com.qiuyuzhou.ShadowsocksX-NG2"
+  ) {
+    self.defaults = defaults
+    let languages =
+      defaults.persistentDomain(forName: applicationID)?["AppleLanguages"] as? [String]
+    selection = languages?.first.flatMap(AppLanguage.init(rawValue:)) ?? .automatic
+  }
+
+  func select(_ language: AppLanguage) {
+    if language == .automatic {
+      defaults.removeObject(forKey: "AppleLanguages")
+    } else {
+      defaults.set([language.rawValue], forKey: "AppleLanguages")
+    }
+    selection = language
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Composition/ApplicationDependencies.swift b/ShadowsocksX-NG2/App/Composition/ApplicationDependencies.swift
new file mode 100644
index 000000000..1984439c2
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Composition/ApplicationDependencies.swift
@@ -0,0 +1,52 @@
+import AppKit
+
+/// 组合根依赖集（仅生产形态）：单测不再以本 app 为宿主（去宿主化，ADR 0021），
+/// 装配永远面向真实存储、系统服务与用户默认域。
+@MainActor
+struct ApplicationDependencies {
+  let catalogFileStore: CatalogFileStore
+  let activationFileStore: ActivationStateFileStore
+  let runtimeFileStore: RuntimeFileStore
+  let listeningStore: ProxyListeningFileStore
+  let settingsRestore: RestoredProxyRuntimeSettings
+  let legacyImportService: LegacyImportService
+  let launchAgent: LaunchAgentControlling
+  let loginService: LaunchAtLoginControlling
+  let silentLaunchStore: SilentLaunchStore
+  let textClipboard: any TextClipboard
+  let imageClipboard: any ImageClipboard
+  let diagnosticReportExporter: any DiagnosticReportExporter
+  let configurationGroupFileExporter: any ConfigurationGroupFileExporter
+  let qrImageSaver: any QrImageSaver
+
+  static func make() -> ApplicationDependencies {
+    let listeningStore = ProxyListeningFileStore()
+    let listening = ProxyListeningStartup.load(
+      store: listeningStore, presentReset: ProxyListeningResetAlert.present)
+    let library = ServerLibraryStorage()
+    let catalogFileStore = CatalogFileStore(
+      fileURL: CatalogFileStore.defaultFileURL(), library: library)
+    let restoredSettings = RestoredProxyRuntimeSettings(
+      settings: ProxyRuntimeSettings(
+        listen: listening, preferences: ProxyControlPreferences()),
+      unreadableError: nil)
+    return ApplicationDependencies(
+      catalogFileStore: catalogFileStore,
+      activationFileStore: ActivationStateFileStore(
+        fileURL: ActivationStateFileStore.defaultFileURL()),
+      runtimeFileStore: RuntimeFileStore(),
+      listeningStore: listeningStore,
+      settingsRestore: restoredSettings,
+      legacyImportService: LegacyImportService(
+        catalogStore: catalogFileStore),
+      launchAgent: SMAppLaunchAgentService(),
+      loginService: SMAppLaunchAtLoginService(),
+      silentLaunchStore: SilentLaunchStore(),
+      textClipboard: AppKitTextClipboard(),
+      imageClipboard: AppKitImageClipboard(),
+      diagnosticReportExporter: AppKitDiagnosticReportExporter(),
+      configurationGroupFileExporter: AppKitConfigurationGroupFileExporter(),
+      qrImageSaver: AppKitQrImageSaver())
+  }
+
+}
diff --git a/ShadowsocksX-NG2/App/Composition/ConnectivityLifecycle.swift b/ShadowsocksX-NG2/App/Composition/ConnectivityLifecycle.swift
new file mode 100644
index 000000000..ac9e77ff6
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Composition/ConnectivityLifecycle.swift
@@ -0,0 +1,61 @@
+import AppKit
+import Network
+
+/// Held by the composition, independently of workspace windows.
+@MainActor
+final class ConnectivityLifecycle: NSObject, NSApplicationDelegate {
+  let module: ServerConnectivity
+  private let monitor = NWPathMonitor()
+  private var receivedInitialPath = false
+  private var terminating = false
+
+  init(module: ServerConnectivity) {
+    self.module = module
+    super.init()
+    monitor.pathUpdateHandler = { [weak self] _ in
+      Task { @MainActor in
+        guard let self else { return }
+        if self.receivedInitialPath { self.module.networkChanged() }
+        self.receivedInitialPath = true
+      }
+    }
+    monitor.start(queue: DispatchQueue(label: "connectivity.network"))
+  }
+
+  func applicationShouldTerminate(_ sender: NSApplication) -> NSApplication.TerminateReply {
+    guard !terminating else { return .terminateLater }
+    terminating = true
+    monitor.cancel()
+    Task {
+      await module.shutdown()
+      sender.reply(toApplicationShouldTerminate: true)
+    }
+    return .terminateLater
+  }
+}
+
+@MainActor
+final class ConnectivityApplicationDelegate: NSObject, NSApplicationDelegate {
+  var lifecycle: ConnectivityLifecycle?
+  var catalogWorkflow: CatalogWorkflow?
+
+  func applicationDidFinishLaunching(_ notification: Notification) {
+    catalogWorkflow?.startSubscriptionAutomaticUpdates()
+    NSWorkspace.shared.notificationCenter.addObserver(
+      self, selector: #selector(didWake), name: NSWorkspace.didWakeNotification, object: nil)
+  }
+
+  @objc private func didWake(_ notification: Notification) {
+    catalogWorkflow?.subscriptionAutomaticUpdatesDidWake()
+  }
+
+  func applicationWillTerminate(_ notification: Notification) {
+    catalogWorkflow?.stopSubscriptionAutomaticUpdates()
+    NSWorkspace.shared.notificationCenter.removeObserver(self)
+  }
+
+  func applicationShouldTerminate(_ sender: NSApplication) -> NSApplication.TerminateReply {
+    catalogWorkflow?.stopSubscriptionAutomaticUpdates()
+    return lifecycle?.applicationShouldTerminate(sender) ?? .terminateNow
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Composition/MainApp.swift b/ShadowsocksX-NG2/App/Composition/MainApp.swift
new file mode 100644
index 000000000..5e651152c
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Composition/MainApp.swift
@@ -0,0 +1,376 @@
+import AppKit
+import SwiftUI
+
+@main
+struct ShadowsocksXNG2App: App {
+  /// 进程期强持有（组合根装配一次）。body 不读它：事实发布经各 workflow 的
+  /// didChange 通道，不借 @StateObject 订阅控制器变化。
+  @NSApplicationDelegateAdaptor(ConnectivityApplicationDelegate.self) private var appDelegate
+  private let connectivityLifecycle: ConnectivityLifecycle
+  private let proxyController: ProxyRuntimeController
+  /// 状态显示 debounce 模型：进程期强持有（与首页/菜单栏两个表面共享同一
+  /// 门控状态机），body 不读它。
+  private let statusDisplay: StatusDisplayModel
+  @StateObject private var catalogWorkflow: CatalogWorkflow
+  @StateObject private var proxyControl: ProxyControlWorkflow
+  @StateObject private var loginController: LaunchAtLoginController
+  @StateObject private var settingsWorkflow: SettingsWorkflow
+  @StateObject private var diagnosticsWorkflow: DiagnosticsWorkflow
+  @StateObject private var workspaceRoute: WorkspaceRoute
+  @StateObject private var silentLaunch: SilentLaunchController
+  @StateObject private var rulesWorkflow: RulesWorkspaces
+  @StateObject private var windowActivation: WindowActivationPolicyCoordinator
+  private let textClipboard: any TextClipboard
+  private let diagnosticReportExporter: any DiagnosticReportExporter
+  @StateObject private var diagnosticsWindow = DiagnosticsWindowState()
+  private let workspaceContent: MainWindowView
+  /// 窗口工具栏标签风格默认「图标和文本」。绑定版修饰符让用户仍可经工具栏
+  /// 右键改选，选择回写本 AppStorage 键持久化，下次启动延续。
+  @AppStorage("toolbarLabelStyle") private var toolbarLabelStyle: ToolbarLabelStyle = .titleAndIcon
+  /// 启动呈现行为在进程内一次性定格（ADR 0017）：静默启动偏好关闭（默认）
+  /// 时 presented，开启时 suppressed。切换偏好当次会话无影响，下次启动生效。
+  private let launchPresentation: SceneLaunchBehavior
+
+  init() {
+    let composition = AppComposition.make()
+    connectivityLifecycle = composition.connectivityLifecycle
+    proxyController = composition.controller
+    statusDisplay = composition.statusDisplay
+    _catalogWorkflow = StateObject(wrappedValue: composition.catalogWorkflow)
+    _proxyControl = StateObject(wrappedValue: composition.proxyControl)
+    _loginController = StateObject(wrappedValue: composition.loginController)
+    _settingsWorkflow = StateObject(wrappedValue: composition.settingsWorkflow)
+    _diagnosticsWorkflow = StateObject(wrappedValue: composition.diagnosticsWorkflow)
+    _workspaceRoute = StateObject(wrappedValue: composition.workspaceRoute)
+    _silentLaunch = StateObject(wrappedValue: composition.silentLaunch)
+    _rulesWorkflow = StateObject(wrappedValue: composition.rulesWorkflow)
+    _windowActivation = StateObject(
+      wrappedValue: WindowActivationPolicyCoordinator(applying: NSAppWindowActivationApplier()))
+    textClipboard = composition.textClipboard
+    diagnosticReportExporter = composition.diagnosticReportExporter
+    workspaceContent = composition.workspaceContent
+    launchPresentation = composition.silentLaunch.isEnabled ? .suppressed : .presented
+    // GUI 事件接入内存环形缓冲：独立诊断窗口日志查看器与
+    // 诊断导出的来源；wrapper 侧不注册，仍走 stderr → agent.log 收敛。
+    RuntimeLog.setSink(RuntimeEventStore.shared)
+    appDelegate.lifecycle = connectivityLifecycle
+    appDelegate.catalogWorkflow = composition.catalogWorkflow
+  }
+
+  var body: some Scene {
+    MenuBarExtra {
+      ProxyStatusMenu()
+    } label: {
+      StatusMenuLabel(control: proxyControl, statusDisplay: statusDisplay)
+    }
+    //    .menuBarExtraStyle(.window)
+
+    // 主 workspace 窗口（ADR 0016/0017）：SwiftUI `Window` scene。启动呈现由
+    // defaultLaunchBehavior 决定：静默启动关闭（默认）时 presented 启动即呈现
+    // （scene 方式启动开窗，LSUIElement 下实测生效），开启时 suppressed 直接
+    // 进菜单栏形态。窗口开着期间 app 为 regular（Dock 图标/Cmd-Tab/默认菜单
+    // 栏），最后一个窗口关闭回 accessory 菜单栏形态——随窗激活策略由窗口 NSWindow 生命
+    // 周期通知驱动（WindowActivationPolicy，scenePhase 在 macOS 跟随应用而非
+    // 窗口、关窗无事件，实测不可用）；关窗后由状态菜单首项（打开主窗口）经
+    // openWindow 重开。
+    // 关窗不退进程（MenuBarExtra 持进程）。
+    Window("ShadowsocksX-NG2", id: WorkspaceRoute.workspaceSceneID) {
+      workspaceContent
+        .modifier(WindowActivationPolicy(coordinator: windowActivation))
+    }
+    .commands {
+      AboutCommands()
+      DiagnosticsCommands()
+    }
+    .defaultLaunchBehavior(launchPresentation)
+    .defaultSize(width: 960, height: 640)
+    .windowToolbarLabelStyle($toolbarLabelStyle)
+
+    rulesReportScene
+    diagnosticsScene
+    AboutScenes(windowActivation: windowActivation)
+  }
+
+  private var diagnosticsScene: some Scene {
+    Window("诊断", id: DiagnosticsWindowState.sceneID) {
+      DiagnosticsView(
+        diagnostics: diagnosticsWorkflow,
+        windowState: diagnosticsWindow,
+        clipboard: textClipboard,
+        exporter: diagnosticReportExporter
+      )
+      .modifier(WindowActivationPolicy(coordinator: windowActivation))
+    }
+    .defaultLaunchBehavior(.suppressed)
+    .restorationBehavior(.disabled)
+    .commandsRemoved()
+    .defaultSize(width: 1200, height: 600)
+    .windowToolbarLabelStyle($toolbarLabelStyle)
+  }
+
+  private var rulesReportScene: some Scene {
+    Window(RulesCopy.text("快照制作时的转换报告"), id: RulesReportView.sceneID) {
+      RulesReportView(workflow: rulesWorkflow)
+        .modifier(WindowActivationPolicy(coordinator: windowActivation))
+    }
+    .defaultLaunchBehavior(.suppressed)
+    .restorationBehavior(.disabled)
+    .commandsRemoved()
+    .defaultSize(width: 680, height: 480)
+    .windowToolbarLabelStyle($toolbarLabelStyle)
+  }
+}
+
+/// 随窗激活策略与激活重试的真实 NSApp 落点。
+@MainActor
+private final class NSAppWindowActivationApplier: WindowActivationPolicyApplying {
+  func apply(_ policy: NSApplication.ActivationPolicy) {
+    guard NSApp.activationPolicy() != policy else { return }
+    NSApp.setActivationPolicy(policy)
+    if policy == .regular {
+      // Window scene 会呈现窗口，但 LSUIElement 进程仍需显式激活才能置前。
+      NSApp.activate(ignoringOtherApps: true)
+    }
+  }
+
+  var isAppActive: Bool { NSApp.isActive }
+
+  var ownsMenuBar: Bool {
+    NSWorkspace.shared.menuBarOwningApplication?.bundleIdentifier
+      == Bundle.main.bundleIdentifier
+  }
+
+  var isPolicyRegular: Bool { NSApp.activationPolicy() == .regular }
+
+  func activateApp() {
+    NSApp.activate(ignoringOtherApps: true)
+  }
+}
+
+/// 组合根装配：目录提交协调器与全部生产运行时适配器只在此接线一次，各 scene
+/// 不再重复设置提交回调；目录工作流的实现依赖经 CatalogWorkflowDependencies
+/// 显式装配（workflow 不自行创建生产默认实现）；Legacy 导入后的 2.0 运行时
+/// 边界同为一次性注入。主窗口是 SwiftUI `Window` scene（MainApp body 声明），
+/// 内容视图在组合根构造一次；MainWindowView 值廉价且只捕获工作流对象，其
+/// StateObject 状态与 onAppear 副作用在窗口首次打开时才发生。
+@MainActor
+private struct AppComposition {
+  let connectivityLifecycle: ConnectivityLifecycle
+  let controller: ProxyRuntimeController
+  let catalogWorkflow: CatalogWorkflow
+  let proxyControl: ProxyControlWorkflow
+  let statusDisplay: StatusDisplayModel
+  let loginController: LaunchAtLoginController
+  let settingsWorkflow: SettingsWorkflow
+  let diagnosticsWorkflow: DiagnosticsWorkflow
+  let workspaceRoute: WorkspaceRoute
+  let silentLaunch: SilentLaunchController
+  let expansion: CatalogExpansionState
+  let textClipboard: any TextClipboard
+  let diagnosticReportExporter: any DiagnosticReportExporter
+  let imageClipboard: any ImageClipboard
+  let rulesWorkflow: RulesWorkspaces
+  let workspaceContent: MainWindowView
+
+  static func make() -> AppComposition {
+    let dependencies = ApplicationDependencies.make()
+    let textClipboard = dependencies.textClipboard
+    // The catalog document is read exactly once at startup. The coordinator
+    // publishes later committed snapshots; the controller receives read-only
+    // access to this same in-process source.
+    let catalogBootstrap = CatalogCommitCoordinator.bootstrap(
+      fileStore: dependencies.catalogFileStore)
+    let plugins = PluginCatalog()
+    let controller = makeRuntimeController(
+      dependencies: dependencies, bootstrap: catalogBootstrap, plugins: plugins)
+    let loginController = LaunchAtLoginController(service: dependencies.loginService)
+    let catalogWorkflow = makeCatalogWorkflow(
+      dependencies: dependencies,
+      controller: controller,
+      bootstrap: catalogBootstrap, plugins: plugins)
+    connectPluginCatalog(plugins, controller: controller, workflow: catalogWorkflow)
+    // 代理控制工作流 module：状态菜单等 UI 表面的唯一代理控制
+    // seam，组合根接线一次。生产 runtime adapter 包装既有控制器（不复制运行
+    // 时语义）；目录目标事实经窄缝从目录工作流读取；本机接口事实经独立缝
+    // 提供命令地址候选。
+    let proxyControl = ProxyControlWorkflow(
+      runtime: ControllerProxyRuntimeAdapter(controller: controller),
+      targetFacts: catalogWorkflow,
+      interfaceFacts: SystemInterfaceFactsProvider())
+    // 状态显示 debounce 模型：订阅代理控制工作流 snapshot，组合根接线一次，
+    // 首页运行控制卡与菜单栏状态卡共享同一门控状态机。
+    let statusDisplay = StatusDisplayModel(control: proxyControl)
+    // 设置工作流 module（Candidate 02）：设置窗口的唯一 seam，组合根接线一次；
+    // 写入侧经窄缝 SettingsCommitting，运行时控制器薄扩展即生产实现。
+    let settingsWorkflow = SettingsWorkflow(
+      committing: controller)
+    let (connectivity, connectivityLifecycle) = makeConnectivity(
+      workflow: catalogWorkflow, settings: settingsWorkflow)
+    catalogWorkflow.connectivity = connectivity
+    let diagnosticsWorkflow = makeDiagnosticsWorkflow(
+      controller: controller, workflow: catalogWorkflow, plugins: plugins)
+    let workspace = makeWorkspace(
+      WorkspaceCompositionContext(
+        dependencies: dependencies, controller: controller, workflow: catalogWorkflow,
+        control: proxyControl, statusDisplay: statusDisplay, plugins: plugins,
+        settings: settingsWorkflow,
+        login: loginController, clipboard: textClipboard))
+    return AppComposition(
+      connectivityLifecycle: connectivityLifecycle,
+      controller: controller,
+      catalogWorkflow: catalogWorkflow,
+      proxyControl: proxyControl,
+      statusDisplay: statusDisplay,
+      loginController: loginController,
+      settingsWorkflow: settingsWorkflow,
+      diagnosticsWorkflow: diagnosticsWorkflow,
+      workspaceRoute: workspace.route,
+      silentLaunch: workspace.silentLaunch,
+      expansion: workspace.expansion,
+      textClipboard: textClipboard,
+      diagnosticReportExporter: dependencies.diagnosticReportExporter,
+      imageClipboard: dependencies.imageClipboard,
+      rulesWorkflow: workspace.rulesWorkflow,
+      workspaceContent: workspace.content)
+  }
+
+  private static func connectPluginCatalog(
+    _ plugins: PluginCatalog, controller: ProxyRuntimeController, workflow: CatalogWorkflow
+  ) {
+    plugins.connect(
+      invalidateRuntime: { [weak controller] in controller?.pluginMappingsDidPublish() },
+      revalidate: { [weak workflow] in workflow?.republishCommittedState() },
+      converge: { [weak controller] in
+        guard let controller else { return }
+        _ = await controller.catalogDidCommit(
+          snapshot: controller.catalogSnapshotReader.catalogSnapshot)
+      })
+  }
+
+  private static func makeConnectivity(
+    workflow: CatalogWorkflow, settings: SettingsWorkflow
+  ) -> (module: ServerConnectivity, lifecycle: ConnectivityLifecycle) {
+    let testRuntime = ConnectivityRuntime(
+      executable: Bundle.main.bundleURL.appendingPathComponent("Contents/Helpers/sslocal"))
+    let connectivity = ServerConnectivity(
+      configuration: { [weak workflow] id in
+        guard let workflow else { throw ServerFormLoadError.notFound }
+        return try workflow.connectivityConfiguration(for: id)
+      },
+      revision: { [weak workflow] in workflow?.connectivityRevision(for: $0) ?? "missing" },
+      measure: testRuntime.measure)
+    connectivity.setURL(ServerConnectivity.validURL(settings.beginConnectivityURLEditing()))
+    settings.connectivityURLDidChange = { [weak connectivity] in connectivity?.setURL($0) }
+    return (connectivity, ConnectivityLifecycle(module: connectivity))
+  }
+
+  private static func makeDiagnosticsWorkflow(
+    controller: ProxyRuntimeController, workflow: CatalogWorkflow, plugins: PluginCatalog
+  ) -> DiagnosticsWorkflow {
+    DiagnosticsWorkflow(
+      runtimeFacts: controller,
+      catalogFacts: { workflow.diagnosticCatalogFacts },
+      managedPlugins: {
+        plugins.catalogSnapshot().entries.map { entry in
+          DiagnosticPluginFacts(
+            program: entry.program, version: entry.managedInfo?.dependency?.version ?? "",
+            present: entry.availability == .available, source: entry.source)
+        }
+      })
+  }
+
+  private static func makeWorkspace(_ context: WorkspaceCompositionContext) -> WorkspaceComposition
+  {
+    let route = WorkspaceRoute()
+    let silentLaunch = SilentLaunchController(store: context.dependencies.silentLaunchStore)
+    let expansion = CatalogExpansionState()
+    let rulesWorkflow = RulesWorkspaces { preset in
+      RulesWorkflow(
+        preset: preset,
+        loadDocument: { try context.controller.documents(for: preset).load() },
+        commitDocument: { await context.controller.commitRuleDocument($0, preset: preset) },
+        builtinSnapshots: context.controller.ruleSnapshots)
+    }
+    let content = MainWindowView(
+      rulesWorkflow: rulesWorkflow,
+      route: route,
+      workflow: context.workflow,
+      control: context.control,
+      statusDisplay: context.statusDisplay,
+      plugins: PluginManagementModel(catalog: context.plugins),
+      settingsWorkflow: context.settings,
+      loginController: context.login,
+      silentLaunch: silentLaunch,
+      expansion: expansion,
+      clipboard: context.clipboard,
+      imageClipboard: context.dependencies.imageClipboard,
+      configurationGroupFileExporter: context.dependencies.configurationGroupFileExporter,
+      qrImageSaver: context.dependencies.qrImageSaver)
+    return WorkspaceComposition(
+      route: route, silentLaunch: silentLaunch, expansion: expansion,
+      rulesWorkflow: rulesWorkflow, content: content)
+  }
+
+  /// 运行时控制器接线：读侧接目录提交协调器快照，写侧接各持久化 seam 与
+  /// 系统服务适配器。
+  private static func makeRuntimeController(
+    dependencies: ApplicationDependencies,
+    bootstrap: CatalogCommitBootstrap,
+    plugins: PluginCatalog
+  ) -> ProxyRuntimeController {
+    ProxyRuntimeController(
+      catalogSnapshotReader: bootstrap.catalogSnapshotReader,
+      activationFileStore: dependencies.activationFileStore,
+      runtimeFileStore: dependencies.runtimeFileStore,
+      plugins: plugins,
+      refreshPluginSecurityFacts: { [weak plugins] in _ = plugins?.refreshSecurityFacts() },
+      listeningStore: dependencies.listeningStore,
+      settingsRestore: dependencies.settingsRestore,
+      agent: dependencies.launchAgent,
+      systemProxyNetworkChangeMonitor: SystemProxyNetworkChangeMonitor())
+  }
+
+  /// 目录工作流接线：提交协调器与生产运行时适配器在此
+  /// 一次性装配；Legacy 导入后的 2.0 运行时边界同为一次性注入。
+  private static func makeCatalogWorkflow(
+    dependencies: ApplicationDependencies,
+    controller: ProxyRuntimeController,
+    bootstrap: CatalogCommitBootstrap,
+    plugins: PluginCatalog
+  ) -> CatalogWorkflow {
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: dependencies.catalogFileStore,
+      runtime: ProxyRuntimeSyncAdapter(controller: controller),
+      bootstrap: bootstrap)
+    return CatalogWorkflow(
+      dependencies: CatalogWorkflowDependencies(
+        coordinator: coordinator,
+        plugins: plugins,
+        subscriptionFetcher: HTTPSSubscriptionFetcher(),
+        legacyImportService: dependencies.legacyImportService,
+        postLegacyImport: { _ in
+          await controller.legacyImportDidCommit()
+        },
+        activator: controller))
+  }
+}
+
+private struct WorkspaceCompositionContext {
+  let dependencies: ApplicationDependencies
+  let controller: ProxyRuntimeController
+  let workflow: CatalogWorkflow
+  let control: ProxyControlWorkflow
+  let statusDisplay: StatusDisplayModel
+  let plugins: PluginCatalog
+  let settings: SettingsWorkflow
+  let login: LaunchAtLoginController
+  let clipboard: any TextClipboard
+}
+
+private struct WorkspaceComposition {
+  let route: WorkspaceRoute
+  let silentLaunch: SilentLaunchController
+  let expansion: CatalogExpansionState
+  let rulesWorkflow: RulesWorkspaces
+  let content: MainWindowView
+}
diff --git a/ShadowsocksX-NG2/App/Composition/SilentLaunchController.swift b/ShadowsocksX-NG2/App/Composition/SilentLaunchController.swift
new file mode 100644
index 000000000..572ad8ddb
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Composition/SilentLaunchController.swift
@@ -0,0 +1,23 @@
+import SwiftUI
+
+/// 静默启动偏好（ADR 0017）：启动时不呈现主窗口，直接以菜单栏形态后台运行。
+/// 默认关；切换即持久化，当次会话无影响，下次启动生效。代理运行时恢复与
+/// 登录项注册都不依赖它。持久化走应用 defaults 域，与监听文件分别管理。
+@MainActor
+final class SilentLaunchController: ObservableObject {
+  @Published private(set) var isEnabled: Bool
+
+  private let store: SilentLaunchStore
+
+  init(store: SilentLaunchStore) {
+    self.store = store
+    isEnabled = store.loadSilentLaunchEnabled()
+  }
+
+  /// 先落盘后翻转内存态：开关呈现不得与下次启动的实际行为脱节。UserDefaults
+  /// 无失败信号（cfprefsd 尽力而为），文件版的失败点名路径随迁移移除。
+  func setEnabled(_ enabled: Bool) {
+    store.save(silentLaunchEnabled: enabled)
+    isEnabled = enabled
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Composition/WindowActivationPolicy.swift b/ShadowsocksX-NG2/App/Composition/WindowActivationPolicy.swift
new file mode 100644
index 000000000..481263fc3
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Composition/WindowActivationPolicy.swift
@@ -0,0 +1,258 @@
+import AppKit
+import SwiftUI
+
+/// All explicitly anchored application windows share one coordinator. Sheets and
+/// unrelated windows do not participate. Hiding does not count as closing.
+@MainActor
+protocol WindowActivationPolicyApplying: AnyObject {
+  func apply(_ policy: NSApplication.ActivationPolicy)
+
+  /// 应用是否已激活（NSApp.isActive 的可注入口径）。
+  var isAppActive: Bool { get }
+
+  /// 菜单栏是否实际归属本应用（NSWorkspace.menuBarOwningApplication 的
+  /// 可注入口径）。激活自检第二信号：失败场景实测 isActive 与 frontmost
+  /// 均指向本应用、重试即停，但 Dock 图标缺失、窗口在后——单看 isActive
+  /// 无法分辨这种系统侧注册滞后，菜单栏归属仍指此前台应用才是真相。
+  var ownsMenuBar: Bool { get }
+
+  /// 进程本地激活策略是否已为 regular 的可注入口径。注意本地值可能已
+  /// regular 而系统侧注册仍滞后——Dock 图标缺失即此态，故仅作诊断事实。
+  var isPolicyRegular: Bool { get }
+
+  /// 请求激活应用（NSApp.activate 的可注入口径）。
+  func activateApp()
+}
+
+/// 启动激活重试的节拍调度口。生产经 Task+sleep 延迟执行；测试实现收集
+/// 回调手动驱动，获得与墙钟无关的确定性节奏。
+@MainActor
+protocol ActivationTickScheduling: AnyObject {
+  func scheduleTick(after interval: TimeInterval, _ tick: @escaping @MainActor @Sendable () -> Void)
+}
+
+@MainActor
+private final class TaskActivationTickScheduler: ActivationTickScheduling {
+  func scheduleTick(after interval: TimeInterval, _ tick: @escaping @MainActor @Sendable () -> Void)
+  {
+    Task {
+      try? await Task.sleep(for: .seconds(interval))
+      tick()
+    }
+  }
+}
+
+@MainActor
+final class WindowActivationPolicyCoordinator: ObservableObject {
+  private let anchoredWindows = NSHashTable<NSWindow>.weakObjects()
+  private var openWindows: Set<ObjectIdentifier> = []
+  private let applier: any WindowActivationPolicyApplying
+  private let activationRetryInterval: TimeInterval
+  private let activationRetryLimit: Int
+  private var activationAttemptsLeft: Int
+  private let launchRescanInterval: TimeInterval
+  private let tickScheduler: any ActivationTickScheduling
+  /// 激活收敛或预算用尽后永久停止，避免窗口事件重启重试并抢焦点。
+  private var activationFinished = false
+  /// 重试链是否在调度中。链可能在窗口尚未可见时静默终结（key 先于可见的
+  /// 呈现次序），未收敛前由参与事件重新拉起（re-arm）。
+  private var isRetryChainActive = false
+
+  /// `applier` 与 `tickScheduler` 注入以便 hermetic 单测；生产实现里单测
+  /// host 不触碰真实 NSApp、不依赖墙钟。
+  init(
+    applying applier: any WindowActivationPolicyApplying,
+    activationRetryInterval: TimeInterval = 0.2,
+    activationRetryLimit: Int = 5,
+    launchRescanInterval: TimeInterval = 0.5,
+    tickScheduler: (any ActivationTickScheduling)? = nil
+  ) {
+    self.applier = applier
+    self.activationRetryInterval = activationRetryInterval
+    self.activationRetryLimit = activationRetryLimit
+    self.activationAttemptsLeft = activationRetryLimit
+    self.launchRescanInterval = launchRescanInterval
+    self.tickScheduler = tickScheduler ?? TaskActivationTickScheduler()
+    let center = NotificationCenter.default
+    center.addObserver(
+      self, selector: #selector(windowDidBecomeKey(_:)),
+      name: NSWindow.didBecomeKeyNotification, object: nil)
+    center.addObserver(
+      self, selector: #selector(windowWillClose(_:)),
+      name: NSWindow.willCloseNotification, object: nil)
+    center.addObserver(
+      self, selector: #selector(windowVisibilityChanged(_:)),
+      name: NSWindow.didChangeOcclusionStateNotification, object: nil)
+  }
+
+  deinit {
+    NotificationCenter.default.removeObserver(self)
+  }
+
+  /// 锚点视图捕获到宿主窗口时上交（幂等）。窗口已可见才立刻收敛（覆盖不走
+  /// key 事件的可见路径）；尚未可见则安排一次延迟重扫兜底——可见化通知可能
+  /// 早于锚点附着被错过（实测失败场景启动期无任何事件即此序）。
+  func anchorDidAttach(to window: NSWindow) {
+    if !anchoredWindows.contains(window) {
+      anchoredWindows.add(window)
+      RuntimeLog.emit(
+        .windowAnchorAttached(visible: window.isVisible, key: window.isKeyWindow))
+    }
+    if window.isVisible {
+      openWindows.insert(ObjectIdentifier(window))
+      applier.apply(.regular)
+      // 键盘启动器（Raycast/Spotlight 回车启动）无关联点击，启动瞬间的
+      // activate 请求可能被焦点抢占保护忽略，窗口可见但不成为 key；
+      // 补一次置前成 key，激活被采纳时窗口即在前台。
+      window.makeKeyAndOrderFront(nil)
+      startLaunchActivationRetry(for: window)
+    } else {
+      scheduleLaunchVisibilityRescan()
+    }
+  }
+
+  /// 锚点附着后的一次性兜底重扫：附着时窗口尚未可见、其可见化通知又早于
+  /// 附着被错过时，这里补上参与与激活重试。静默启动的窗口届时仍不可见，
+  /// 自然不触发。
+  private func scheduleLaunchVisibilityRescan() {
+    tickScheduler.scheduleTick(after: launchRescanInterval) { [weak self] in
+      guard let self, !self.activationFinished, !self.isRetryChainActive else { return }
+      guard let window = self.anchoredWindows.allObjects.first(where: { $0.isVisible })
+      else { return }
+      if self.openWindows.insert(ObjectIdentifier(window)).inserted {
+        self.applier.apply(.regular)
+        window.makeKeyAndOrderFront(nil)
+      }
+      self.startLaunchActivationRetry(for: window)
+    }
+  }
+
+  @objc private func windowDidBecomeKey(_ notification: Notification) {
+    guard let window = trackedWindow(in: notification) else { return }
+    openWindows.insert(ObjectIdentifier(window))
+    applier.apply(.regular)
+    // 窗口可能在 attach/可见化通知之前先成为 key（SwiftUI 呈现次序不同）：
+    // 该路径同样要启动启动激活重试，否则失败场景下弹跳序列永不执行。
+    startLaunchActivationRetry(for: window)
+  }
+
+  @objc private func windowWillClose(_ notification: Notification) {
+    guard let window = trackedWindow(in: notification) else { return }
+    // A background window can be presented without ever becoming key. Include
+    // visible siblings even if their initial visibility notification was missed.
+    for sibling in anchoredWindows.allObjects where sibling !== window && sibling.isVisible {
+      openWindows.insert(ObjectIdentifier(sibling))
+    }
+    openWindows.remove(ObjectIdentifier(window))
+    if openWindows.isEmpty { applier.apply(.accessory) }
+  }
+
+  @objc private func windowVisibilityChanged(_ notification: Notification) {
+    guard let window = trackedWindow(in: notification), window.isVisible else { return }
+    let inserted = openWindows.insert(ObjectIdentifier(window)).inserted
+    if inserted {
+      applier.apply(.regular)
+      // 不走 key 事件的首次可见化同样补置前，缘由见 anchorDidAttach。
+      window.makeKeyAndOrderFront(nil)
+    }
+    // 可见化无论是否首次插入都尝试拉起重试：链可能在窗口尚未可见时
+    // 静默终结过（key 先行的呈现次序），未收敛前由此 re-arm。
+    startLaunchActivationRetry(for: window)
+  }
+
+  /// 预算在进程内共享；窗口尚未可见时允许后续事件续排，但不重置预算。
+  /// 重试仅激活并置前，不切换策略，避免反复向 Dock 注册应用。
+  private func startLaunchActivationRetry(for window: NSWindow) {
+    guard !activationFinished, !isRetryChainActive else { return }
+    isRetryChainActive = true
+    scheduleActivationRetryTick(for: window)
+  }
+
+  private func endRetryChain() {
+    isRetryChainActive = false
+  }
+
+  private func scheduleActivationRetryTick(for window: NSWindow) {
+    tickScheduler.scheduleTick(after: activationRetryInterval) { [weak self] in
+      self?.runActivationRetryTick(for: window)
+    }
+  }
+
+  private func runActivationRetryTick(for window: NSWindow) {
+    let visible = window.isVisible
+    let attempt = activationRetryLimit - activationAttemptsLeft + 1
+    let menuBarOwner = NSWorkspace.shared.menuBarOwningApplication?.bundleIdentifier ?? "-"
+    let active = applier.isAppActive
+    RuntimeLog.emit(
+      .launchActivationRetry(
+        attempt: attempt, active: active, policyRegular: applier.isPolicyRegular,
+        frontmost: NSWorkspace.shared.frontmostApplication?.bundleIdentifier ?? "-",
+        menuBarOwner: menuBarOwner, onActiveSpace: window.isOnActiveSpace,
+        windowVisible: visible))
+    guard visible else {
+      endRetryChain()
+      return
+    }
+    if (applier.isAppActive && applier.ownsMenuBar) || activationAttemptsLeft == 0 {
+      activationFinished = true
+      endRetryChain()
+      return
+    }
+    activationAttemptsLeft -= 1
+    applier.activateApp()
+    window.makeKeyAndOrderFront(nil)
+    window.orderFrontRegardless()
+    scheduleActivationRetryTick(for: window)
+  }
+
+  private func trackedWindow(in notification: Notification) -> NSWindow? {
+    guard let window = notification.object as? NSWindow, anchoredWindows.contains(window)
+    else { return nil }
+    return window
+  }
+}
+
+/// 挂在 Window scene 内容上的壳修饰器：零尺寸锚点视图捕获宿主 NSWindow，
+/// 协调器据其生命周期收敛 app 激活策略。NSApp 侧 applier 由 MainApp 注入
+/// （hermetic 判定 `ApplicationDependencies` 是组合根的 private 类型）。
+struct WindowActivationPolicy: ViewModifier {
+  @ObservedObject var coordinator: WindowActivationPolicyCoordinator
+
+  func body(content: Content) -> some View {
+    content.background(WindowActivationAnchor(onAttach: coordinator.anchorDidAttach))
+  }
+}
+
+/// 锚点视图：随内容装进宿主窗口，`viewDidMoveToWindow` 上交宿主。
+private struct WindowActivationAnchor: NSViewRepresentable {
+  let onAttach: (NSWindow) -> Void
+
+  func makeNSView(context: Context) -> AnchorView {
+    AnchorView(onAttach: onAttach)
+  }
+
+  func updateNSView(_ nsView: AnchorView, context: Context) {}
+
+  final class AnchorView: NSView {
+    private let onAttach: (NSWindow) -> Void
+
+    init(onAttach: @escaping (NSWindow) -> Void) {
+      self.onAttach = onAttach
+      super.init(frame: .zero)
+    }
+
+    @available(*, unavailable)
+    required init?(coder: NSCoder) {
+      fatalError("NSView 不走 storyboard 初始化")
+    }
+
+    override func viewDidMoveToWindow() {
+      super.viewDidMoveToWindow()
+      // 关窗时 SwiftUI 可能置 nil（复用窗口语义下内容也可能保留）；nil 不回写，
+      // 已捕获引用留给 willClose 匹配，重开由重新 attach 或 key 事件覆盖。
+      if let window {
+        onAttach(window)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/AppKitDiagnosticReportExporter.swift b/ShadowsocksX-NG2/App/PlatformEffects/AppKitDiagnosticReportExporter.swift
new file mode 100644
index 000000000..da9d03cbe
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/AppKitDiagnosticReportExporter.swift
@@ -0,0 +1,23 @@
+import AppKit
+import UniformTypeIdentifiers
+
+/// 生产诊断报告 exporter：只接收已由 DiagnosticsWorkflow 脱敏完成的草稿，负责
+/// 保存面板与用户选定 URL 的文件写入。原始 NSError 不跨过此 adapter。
+@MainActor
+final class AppKitDiagnosticReportExporter: DiagnosticReportExporter {
+  func export(draft: DiagnosticReportDraft) -> DiagnosticReportExportResult {
+    let panel = NSSavePanel()
+    panel.allowedContentTypes = [.plainText]
+    panel.nameFieldStringValue = draft.suggestedFileName
+    guard panel.runModal() == .OK, let url = panel.url else {
+      return .cancelled
+    }
+
+    do {
+      try draft.data.write(to: url)
+      return .saved(url)
+    } catch {
+      return .failed(.writeFailed)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/AppKitImageClipboard.swift b/ShadowsocksX-NG2/App/PlatformEffects/AppKitImageClipboard.swift
new file mode 100644
index 000000000..522f6223b
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/AppKitImageClipboard.swift
@@ -0,0 +1,22 @@
+import AppKit
+
+/// 生产 AppKit image clipboard adapter，与 AppKitTextClipboard 同为 pasteboard
+/// replacement 语义的集中点。PNG 为规范类型，另附 TIFF 兼容类型（部分接收方
+/// 如聊天应用只认 TIFF）；TIFF 附加失败不影响 PNG 已写入这一结果。
+@MainActor
+final class AppKitImageClipboard: ImageClipboard {
+  private let pasteboard: NSPasteboard
+
+  init(pasteboard: NSPasteboard = .general) {
+    self.pasteboard = pasteboard
+  }
+
+  func write(_ pngData: Data) throws {
+    guard pasteboard.clearContents() != 0, pasteboard.setData(pngData, forType: .png) else {
+      throw ImageClipboardFailure.writeFailed
+    }
+    if let image = NSImage(data: pngData), let tiff = image.tiffRepresentation {
+      _ = pasteboard.setData(tiff, forType: .tiff)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/AppKitTextClipboard.swift b/ShadowsocksX-NG2/App/PlatformEffects/AppKitTextClipboard.swift
new file mode 100644
index 000000000..9a7da1f7b
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/AppKitTextClipboard.swift
@@ -0,0 +1,22 @@
+import AppKit
+
+/// 生产 AppKit clipboard adapter。所有 NSPasteboard 访问集中在此文件，避免
+/// 每个 UI surface 重复 pasteboard replacement 语义。
+@MainActor
+final class AppKitTextClipboard: TextClipboard {
+  private let pasteboard: NSPasteboard
+
+  init(pasteboard: NSPasteboard = .general) {
+    self.pasteboard = pasteboard
+  }
+
+  func read() -> String? {
+    pasteboard.string(forType: .string)
+  }
+
+  func write(_ text: String) throws {
+    guard pasteboard.clearContents() != 0, pasteboard.setString(text, forType: .string) else {
+      throw TextClipboardFailure.writeFailed
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/ConfigurationGroupFileExporter.swift b/ShadowsocksX-NG2/App/PlatformEffects/ConfigurationGroupFileExporter.swift
new file mode 100644
index 000000000..ee00faa45
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/ConfigurationGroupFileExporter.swift
@@ -0,0 +1,74 @@
+import AppKit
+import Foundation
+import UniformTypeIdentifiers
+
+/// 配置组 JSON / URI 列表草稿的文件写入边界；内容准备由 CatalogWorkflow 拥有。
+@MainActor
+protocol ConfigurationGroupFileExporter {
+  func export(draft: ConfigurationGroupExportDraft) -> ConfigurationGroupFileExportResult
+}
+
+enum ConfigurationGroupFileExportFailure: Equatable, Error {
+  case writeFailed
+  case uriListWriteFailed
+}
+
+enum ConfigurationGroupFileExportResult: Equatable {
+  case cancelled
+  case saved(URL)
+  case failed(ConfigurationGroupFileExportFailure)
+}
+
+enum ConfigurationGroupExportOutcome: Equatable {
+  case preparationFailed(ConfigurationGroupExportFailure)
+  case cancelled
+  case saved(URL)
+  case exportFailed(ConfigurationGroupFileExportFailure)
+}
+
+/// 先准备完整文档，再调用 exporter；准备失败时不会打开面板或接触文件效果。
+@MainActor
+struct ConfigurationGroupExportAction {
+  let workflow: CatalogWorkflow
+  let exporter: any ConfigurationGroupFileExporter
+
+  func perform(for groupID: NodeID) -> ConfigurationGroupExportOutcome {
+    let draft: ConfigurationGroupExportDraft
+    do {
+      draft = try workflow.configurationGroupExportDraft(for: groupID)
+    } catch let failure as ConfigurationGroupExportFailure {
+      return .preparationFailed(failure)
+    } catch {
+      return .preparationFailed(.documentEncodingFailed)
+    }
+
+    switch exporter.export(draft: draft) {
+    case .cancelled:
+      return .cancelled
+    case .saved(let url):
+      return .saved(url)
+    case .failed(let failure):
+      return .exportFailed(failure)
+    }
+  }
+}
+
+/// 生产文件边界：JSON / UTF-8 文本保存面板与原子文件写入集中在 AppKit adapter。
+@MainActor
+final class AppKitConfigurationGroupFileExporter: ConfigurationGroupFileExporter {
+  func export(draft: ConfigurationGroupExportDraft) -> ConfigurationGroupFileExportResult {
+    let panel = NSSavePanel()
+    panel.allowedContentTypes = draft.format == .json ? [.json] : [.plainText]
+    panel.nameFieldStringValue = draft.suggestedFileName
+    guard panel.runModal() == .OK, let url = panel.url else {
+      return .cancelled
+    }
+
+    do {
+      try draft.data.write(to: url, options: .atomic)
+      return .saved(url)
+    } catch {
+      return .failed(draft.format == .json ? .writeFailed : .uriListWriteFailed)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/DiagnosticReportExporter.swift b/ShadowsocksX-NG2/App/PlatformEffects/DiagnosticReportExporter.swift
new file mode 100644
index 000000000..a02e5ce05
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/DiagnosticReportExporter.swift
@@ -0,0 +1,49 @@
+import Foundation
+
+/// 脱敏报告草稿离开 DiagnosticsWorkflow 后的用户选择与写入 seam。报告内容、
+/// 脱敏策略与导出完成事件仍由诊断工作流/呈现层拥有。
+@MainActor
+protocol DiagnosticReportExporter {
+  func export(draft: DiagnosticReportDraft) -> DiagnosticReportExportResult
+}
+
+enum DiagnosticReportExportFailure: Equatable, Error {
+  case writeFailed
+}
+
+enum DiagnosticReportExportResult: Equatable {
+  case cancelled
+  case saved(URL)
+  case failed(DiagnosticReportExportFailure)
+}
+
+/// 诊断导出动作只编排阶段，不拥有 AppKit 文件效果，也不登记完成事件。调用方
+/// 必须只在 `.saved` 后调用 `DiagnosticsWorkflow.noteExportCompleted`。
+enum DiagnosticReportExportOutcome: Equatable {
+  case preparationFailed(DiagnosticReportFailure)
+  case cancelled
+  case saved(URL)
+  case exportFailed(DiagnosticReportExportFailure)
+}
+
+@MainActor
+struct DiagnosticReportExportAction {
+  let diagnostics: DiagnosticsWorkflow
+  let exporter: any DiagnosticReportExporter
+
+  func perform() -> DiagnosticReportExportOutcome {
+    switch diagnostics.prepareReport() {
+    case .failed(let failure):
+      return .preparationFailed(failure)
+    case .ready(let draft):
+      switch exporter.export(draft: draft) {
+      case .cancelled:
+        return .cancelled
+      case .saved(let url):
+        return .saved(url)
+      case .failed(let failure):
+        return .exportFailed(failure)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/ImageClipboard.swift b/ShadowsocksX-NG2/App/PlatformEffects/ImageClipboard.swift
new file mode 100644
index 000000000..6398bbf1d
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/ImageClipboard.swift
@@ -0,0 +1,13 @@
+import Foundation
+
+/// 用户主动触发的图片剪贴板 seam：以 PNG 数据为规范输入写入剪贴板。生产
+/// adapter 负责平台类型映射（PNG 之外附加哪些兼容类型），协议不感知；读取
+/// 侧暂无消费者，协议不设 read。分享策略与二维码生成不属于此协议。
+@MainActor
+protocol ImageClipboard {
+  func write(_ pngData: Data) throws
+}
+
+enum ImageClipboardFailure: Equatable, Error {
+  case writeFailed
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/ProxyListeningResetAlert.swift b/ShadowsocksX-NG2/App/PlatformEffects/ProxyListeningResetAlert.swift
new file mode 100644
index 000000000..67cfa9a6f
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/ProxyListeningResetAlert.swift
@@ -0,0 +1,18 @@
+import AppKit
+
+/// 启动门禁尚无工作区窗口；使用应用级模态提示，静默启动也能完成确认。
+@MainActor
+enum ProxyListeningResetAlert {
+  static func present(_ error: ProxyListeningStoreError) {
+    let alert = NSAlert()
+    alert.alertStyle = .warning
+    alert.messageText = String(localized: "无法读取监听配置")
+    alert.informativeText =
+      AppPresentation.message(for: error) + "\n\n"
+      + String(
+        localized: "重置会丢弃原有监听配置，包括端口和局域网认证设置，并关闭局域网监听。服务器库和其他偏好设置保持不变。重置成功后应用才能继续启动。")
+    alert.addButton(withTitle: String(localized: "重置监听配置"))
+    NSApplication.shared.activate()
+    alert.runModal()
+  }
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/QrCodeCodec.swift b/ShadowsocksX-NG2/App/PlatformEffects/QrCodeCodec.swift
new file mode 100644
index 000000000..78ca98ba4
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/QrCodeCodec.swift
@@ -0,0 +1,48 @@
+import AppKit
+import CoreImage
+import Foundation
+import Vision
+
+/// 二维码编解码（分享生成二维码、识别二维码图片导入）。生成走
+/// CoreImage `CIQRCodeGenerator`（纠错级 M），识别走 Vision 条码检测，返回
+/// 全部文本负载。屏幕扫码明确不做，此处只处理静态图片。
+enum QrCodeCodec {
+  enum QrCodeError: Error, Equatable {
+    /// 系统二维码滤镜产出为空（理论不可达，防御位）。
+    case generationFailed
+    /// 输入不是可解码的位图。
+    case undecodableImage
+  }
+
+  /// 生成二维码 PNG 数据；`scale` 控制输出像素密度（每个模块的像素数）。
+  static func generatePNG(for payload: String, scale: CGFloat = 8) throws -> Data {
+    guard let filter = CIFilter(name: "CIQRCodeGenerator") else {
+      throw QrCodeError.generationFailed
+    }
+    filter.setValue(Data(payload.utf8), forKey: "inputMessage")
+    filter.setValue("M", forKey: "inputCorrectionLevel")
+    guard let output = filter.outputImage else { throw QrCodeError.generationFailed }
+    let scaled = output.transformed(by: CGAffineTransform(scaleX: scale, y: scale))
+    let context = CIContext()
+    guard let cgImage = context.createCGImage(scaled, from: scaled.extent) else {
+      throw QrCodeError.generationFailed
+    }
+    let rep = NSBitmapImageRep(cgImage: cgImage)
+    guard let png = rep.representation(using: .png, properties: [:]) else {
+      throw QrCodeError.generationFailed
+    }
+    return png
+  }
+
+  /// 识别静态图片中的全部二维码/条码文本负载。
+  static func detectPayloads(in imageData: Data) throws -> [String] {
+    let request = VNDetectBarcodesRequest()
+    let handler = VNImageRequestHandler(data: imageData, options: [:])
+    do {
+      try handler.perform([request])
+    } catch {
+      throw QrCodeError.undecodableImage
+    }
+    return request.results?.compactMap(\.payloadStringValue) ?? []
+  }
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/QrImageSaver.swift b/ShadowsocksX-NG2/App/PlatformEffects/QrImageSaver.swift
new file mode 100644
index 000000000..189b13f38
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/QrImageSaver.swift
@@ -0,0 +1,60 @@
+import AppKit
+import Foundation
+import UniformTypeIdentifiers
+
+/// 二维码图片保存的用户选择与文件写入边界；PNG 数据与建议文件名由 UI 准备。
+/// 命名用「保存/ saver」而不用导出（导出术语保留给配置组与诊断报告文件快照，
+/// GLOSSARY.md）。
+@MainActor
+protocol QrImageSaver {
+  func save(_ draft: QrImageSaveDraft) -> QrImageSaveResult
+}
+
+struct QrImageSaveDraft: Equatable {
+  /// 二维码 PNG 数据；字段名与 ConfigurationGroupExportDraft.data 同法，
+  /// 使文件写入调用命中架构守卫的 `.data.write(to:` 聚焦 token。
+  let data: Data
+  let suggestedFileName: String
+
+  /// 保存面板默认文件名：显示名中的路径非法字符（/ 与 :）替换为空格并去首尾
+  /// 空白，清洗后为空回退固定名，保证面板总有可编辑的初始名。
+  static func suggestedFileName(from displayName: String) -> String {
+    let cleaned =
+      displayName
+      .replacingOccurrences(of: "/", with: " ")
+      .replacingOccurrences(of: ":", with: " ")
+      .trimmingCharacters(in: .whitespacesAndNewlines)
+    let base = cleaned.isEmpty ? "ss-qrcode" : cleaned
+    return "\(base).png"
+  }
+}
+
+enum QrImageSaveFailure: Equatable, Error {
+  case writeFailed
+}
+
+enum QrImageSaveResult: Equatable {
+  case cancelled
+  case saved(URL)
+  case failed(QrImageSaveFailure)
+}
+
+/// 生产文件边界：PNG 保存面板与原子文件写入集中在此 AppKit adapter。
+@MainActor
+final class AppKitQrImageSaver: QrImageSaver {
+  func save(_ draft: QrImageSaveDraft) -> QrImageSaveResult {
+    let panel = NSSavePanel()
+    panel.allowedContentTypes = [.png]
+    panel.nameFieldStringValue = draft.suggestedFileName
+    guard panel.runModal() == .OK, let url = panel.url else {
+      return .cancelled
+    }
+
+    do {
+      try draft.data.write(to: url, options: .atomic)
+      return .saved(url)
+    } catch {
+      return .failed(.writeFailed)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/PlatformEffects/TextClipboard.swift b/ShadowsocksX-NG2/App/PlatformEffects/TextClipboard.swift
new file mode 100644
index 000000000..14df026eb
--- /dev/null
+++ b/ShadowsocksX-NG2/App/PlatformEffects/TextClipboard.swift
@@ -0,0 +1,13 @@
+import Foundation
+
+/// 用户主动触发的纯文本剪贴板 seam。读取不到文本是正常的空状态；只有写入
+/// 失败才产生 typed failure。URI 解析、分享策略与敏感信息判断不属于此协议。
+@MainActor
+protocol TextClipboard {
+  func read() -> String?
+  func write(_ text: String) throws
+}
+
+enum TextClipboardFailure: Equatable, Error {
+  case writeFailed
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/ActivationFeedbackState.swift b/ShadowsocksX-NG2/App/Presentation/ActivationFeedbackState.swift
new file mode 100644
index 000000000..553511dd5
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/ActivationFeedbackState.swift
@@ -0,0 +1,68 @@
+import Combine
+import Foundation
+
+/// 激活命令的会话级反馈状态：pending 与最近一次命令反馈的单一持有者，
+/// 首页目标树、侧栏右键与分组详情三个激活入口共用。单飞——pending 中忽略
+/// 新命令，激活=切换目标，并发双击无语义。命令经目录工作流 seam 发出；
+/// 意外错误记录 `.failed` 后原样上抛，内联/弹窗的呈现方式由各面自决。
+/// 反馈事实类型化，文案只在呈现边经 AppPresentation 生成（`.failed` 的
+/// message 同理，为呈现值而非事实值）。
+@MainActor
+final class ActivationFeedbackState: ObservableObject {
+  /// 最近一次命令的反馈；新命令开始时清空，完成后保留至下一次命令。
+  enum Feedback: Equatable {
+    case activated(skippedInvalid: Int)
+    case rejected(ActivationFailure)
+    /// 意外错误的呈现文案（AppPresentation 边缘生成）。
+    case failed(message: String)
+
+    var isSuccess: Bool {
+      if case .activated = self { return true }
+      return false
+    }
+  }
+
+  struct Completion: Equatable {
+    let id = UUID()
+    let targetID: NodeID
+    let feedback: Feedback
+    let completedAt: Date
+  }
+
+  @Published private(set) var completion: Completion?
+  @Published private(set) var pendingTargetID: NodeID?
+  @Published private(set) var feedback: Feedback?
+  @Published private(set) var feedbackTargetID: NodeID?
+
+  var isPending: Bool { pendingTargetID != nil }
+
+  /// 唯一命令入口。返回命令 outcome，单飞忽略时返回 nil；意外错误记录
+  /// `.failed` 后原样上抛（弹窗呈现的调用面在 call site catch）。
+  @discardableResult
+  func activate(
+    _ id: NodeID, via workflow: CatalogWorkflow
+  ) async throws -> ActivationCommandOutcome? {
+    guard pendingTargetID == nil else { return nil }
+    pendingTargetID = id
+    feedbackTargetID = id
+    feedback = nil
+    completion = nil
+    defer {
+      completion = feedback.map { Completion(targetID: id, feedback: $0, completedAt: Date()) }
+      pendingTargetID = nil
+    }
+    do {
+      let outcome = try await workflow.activate(id)
+      switch outcome {
+      case .activated(let skippedInvalid):
+        feedback = .activated(skippedInvalid: skippedInvalid)
+      case .rejectedActivation(let failure):
+        feedback = .rejected(failure)
+      }
+      return outcome
+    } catch {
+      feedback = .failed(message: AppPresentation.message(for: error))
+      throw error
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/AppLanguage.swift b/ShadowsocksX-NG2/App/Presentation/AppLanguage.swift
new file mode 100644
index 000000000..1dbb9689c
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/AppLanguage.swift
@@ -0,0 +1,31 @@
+import Foundation
+
+enum AppLanguage: String, CaseIterable {
+  case automatic
+  case simplifiedChinese = "zh-Hans"
+  case english = "en"
+
+  func currentValueTitle(in bundle: Bundle = .main) -> String {
+    self == .automatic ? localizedName(in: bundle) : nativeName
+  }
+
+  func menuTitle(in bundle: Bundle = .main) -> String {
+    "\(nativeName) · \(localizedName(in: bundle))"
+  }
+
+  private var nativeName: String {
+    switch self {
+    case .automatic: "Auto Detect"
+    case .simplifiedChinese: "简体中文"
+    case .english: "English"
+    }
+  }
+
+  private func localizedName(in bundle: Bundle) -> String {
+    switch self {
+    case .automatic: String(localized: "自动检测", bundle: bundle)
+    case .simplifiedChinese: String(localized: "简体中文", bundle: bundle)
+    case .english: String(localized: "英文", bundle: bundle)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/DetailFeedbackState.swift b/ShadowsocksX-NG2/App/Presentation/DetailFeedbackState.swift
new file mode 100644
index 000000000..dd9d4b2f8
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/DetailFeedbackState.swift
@@ -0,0 +1,52 @@
+import Foundation
+import Observation
+
+/// 结果身份和完成时间来自命令；业务内容留在各自的呈现入口。
+protocol DetailFeedbackResult: Identifiable where ID == UUID {
+  var completedAt: Date { get }
+  var isSuccess: Bool { get }
+}
+
+extension ActivationFeedbackState.Completion: DetailFeedbackResult {
+  var isSuccess: Bool { feedback.isSuccess }
+}
+
+extension SubscriptionRefreshCompletion: DetailFeedbackResult {
+  var isSuccess: Bool { failure == nil }
+}
+
+/// 详情会话持有展示寿命；命令结果仍由原工作流保留。
+@Observable
+@MainActor
+final class DetailFeedbackState<Result: DetailFeedbackResult> {
+  private(set) var completion: Result?
+  private var generation = 0
+  private let now: () -> Date
+  private let sleep: (TimeInterval) async throws -> Void
+
+  init(
+    now: @escaping () -> Date = Date.init,
+    sleep: @escaping (TimeInterval) async throws -> Void = {
+      try await Task.sleep(for: .seconds($0))
+    }
+  ) {
+    self.now = now
+    self.sleep = sleep
+  }
+
+  func present(_ result: Result?) async {
+    guard !Task.isCancelled else { return }
+    generation += 1
+    let currentGeneration = generation
+    completion = nil
+    guard let result else { return }
+    let remaining = result.completedAt.addingTimeInterval(result.isSuccess ? 3 : 10)
+      .timeIntervalSince(now())
+    guard remaining > 0 else { return }
+    completion = result
+    defer {
+      if generation == currentGeneration { completion = nil }
+    }
+    try? await sleep(remaining)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/ErrorPresentation+Runtime.swift b/ShadowsocksX-NG2/App/Presentation/ErrorPresentation+Runtime.swift
new file mode 100644
index 000000000..e5b05f18c
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/ErrorPresentation+Runtime.swift
@@ -0,0 +1,117 @@
+import Foundation
+
+// MARK: - 运行时失败事实的呈现（RuntimeFailureFacts / 系统代理应用态）
+
+extension AppPresentation {
+  /// 系统代理暂停的统一文案：状态菜单、运行控制卡与错误呈现边三面共用。
+  static let systemProxyPausedNotice = String(localized: "后台代理不可用，已清除系统代理配置。恢复后将自动应用。")
+
+  /// 系统代理配置不可读的统一前缀：状态菜单与运行控制卡差异区共用。
+  static let systemProxyUnreadablePrefix = String(localized: "无法读取网络接口的代理配置：")
+
+  static func message(for failure: RuntimeFailureFacts) -> String {
+    switch failure {
+    case .firewallBlocked(let facts):
+      return
+        String(localized: "macOS 防火墙已阻止 \(facts.executableName) 接受传入连接。请在系统设置中允许传入连接。")
+    case .launch(let facts): return launchFailure(facts)
+    case .service(let facts): return serviceFailure(facts)
+    case .activation(let error): return activation(error)
+    case .requiresApproval: return String(localized: "请在系统设置的登录项中允许代理后台服务")
+    case .systemProxy(let facts): return systemProxyFailure(facts)
+    }
+  }
+
+  static func message(for application: SystemProxyApplicationFacts) -> String {
+    switch application {
+    case .idle: return String(localized: "系统代理未应用")
+    case .pending: return String(localized: "系统代理待应用：等待代理就绪或可用出口")
+    case .applied: return String(localized: "系统代理已应用")
+    case .failed(let facts), .repairFailed(let facts), .clearFailed(let facts),
+      .unreadable(let facts):
+      return systemProxyFailure(facts)
+    case .changed: return String(localized: "系统代理配置已改变")
+    case .applying: return String(localized: "系统代理应用中")
+    case .repairing: return String(localized: "系统代理修复中")
+    case .paused: return systemProxyPausedNotice
+    }
+  }
+
+  private static func launchFailure(_ facts: LaunchFailureFacts) -> String {
+    switch facts {
+    case .missingRuntimeDocument: return String(localized: "缺少运行时文档")
+    case .localEndpoint(let endpoint, let host, let port, let cause):
+      let endpointName = endpoint.uppercased()
+      let portText = port.formatted(.number.grouping(.never))
+      let failureText = endpointFailure(cause)
+      return String(
+        localized:
+          "本地代理 \(endpointName) 端点 \(host):\(portText) 未就绪（\(failureText)）"
+      )
+    case .unreadableSettings: return String(localized: "本地代理配置无法读取，未应用新的代理配置")
+    }
+  }
+
+  private static func serviceFailure(_ facts: ServiceFailureFacts) -> String {
+    switch facts {
+    case .runtimeFile: return String(localized: "运行时文件读写失败")
+    case .agent: return String(localized: "代理后台服务管理失败")
+    case .missingDocument: return String(localized: "缺少运行时文档")
+    case .persistence: return String(localized: "代理运行状态保存失败")
+    case .unknown: return unknownError
+    }
+  }
+
+  private static func systemProxyFailure(_ facts: SystemProxyFailureFacts) -> String {
+    switch facts {
+    case .operation(let failure): return systemProxy(failure)
+    case .unknown: return String(localized: "系统代理未能应用")
+    }
+  }
+
+  // 系统代理操作失败的唯一文案映射（ErrorPresentation 的 SystemProxyError
+  // 分支经 SystemProxyOperationFailure(error) 桥接到这里）。
+  // swiftlint:disable:next cyclomatic_complexity
+  static func systemProxy(_ failure: SystemProxyOperationFailure) -> String {
+    switch failure {
+    case .preferencesUnavailable: return String(localized: "系统网络配置不可用")
+    case .preferencesBusy: return String(localized: "系统网络配置正被其他设置操作占用")
+    case .noCurrentNetworkSet: return String(localized: "没有当前网络位置")
+    case .noNetworkLocations: return String(localized: "没有可检查的网络位置")
+    case .noProxyServices: return String(localized: "当前网络位置没有可写入的网络服务")
+    case .unreadableService: return String(localized: "无法读取网络服务的代理配置")
+    case .invalidStoredConfiguration: return String(localized: "保存的系统代理配置无效")
+    case .cannotWriteService: return String(localized: "无法写入网络服务的代理配置")
+    case .commitFailed: return String(localized: "系统代理提交失败")
+    case .applyFailed: return String(localized: "系统代理应用失败")
+    case .invalidRequest: return String(localized: "系统代理助手收到了无效请求")
+    case .helperUnavailable: return String(localized: "系统代理助手不可用；请确认已在登录项中允许")
+    }
+  }
+
+  private static func endpointFailure(_ outcome: RuntimeEndpointFailure) -> String {
+    switch outcome {
+    case .refused: return String(localized: "连接被拒绝")
+    case .timedOut: return String(localized: "连接超时")
+    case .invalidResponse: return String(localized: "响应无效")
+    case .unknown: return String(localized: "状态无法确定")
+    }
+  }
+}
+
+extension AppPresentation {
+  /// The diagnostic window localizes status without changing exported report text.
+  static func diagnosticStatus(_ state: DiagnosticProxyState) -> String {
+    switch state {
+    case .off: String(localized: "已停止")
+    case .starting: String(localized: "启动中")
+    case .running: String(localized: "运行中")
+    case .firewallBlocked: String(localized: "已被 macOS 应用防火墙拦截（主机地址态）")
+    case .launchFailed: String(localized: "启动失败（本地代理端点未就绪）")
+    case .activationFailed(let reason): String(localized: "激活失败：\(reason)")
+    case .requiresApproval: String(localized: "等待在系统设置-登录项中批准")
+    case .serviceFailed: String(localized: "服务管理失败")
+    case .systemProxyFailed: String(localized: "系统代理未应用")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/ErrorPresentation.swift b/ShadowsocksX-NG2/App/Presentation/ErrorPresentation.swift
new file mode 100644
index 000000000..61a3d2ac7
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/ErrorPresentation.swift
@@ -0,0 +1,347 @@
+import Foundation
+
+/// The single application presentation edge. Domain and workflow modules expose
+/// typed errors/facts; this file is the only place that turns them into text.
+extension Error {
+  var presentableMessage: String {
+    AppPresentation.message(for: self)
+  }
+}
+
+enum AppPresentation {
+  static let unknownError = String(localized: "操作失败，请重试或检查设置")
+}
+
+extension AppPresentation {
+  // The presentation edge deliberately dispatches across the app's typed
+  // failure families; keeping this switch explicit makes the whitelist auditable.
+  // swiftlint:disable:next cyclomatic_complexity function_body_length
+  static func message(for error: Error) -> String {
+    switch error {
+    case let error as CatalogError:
+      return catalog(error)
+    case let error as ActivationFailure:
+      return activation(error)
+    case let error as ServerFormError:
+      return serverForm(error)
+    case let error as SsUriError:
+      return ssURI(error)
+    case let error as CredentialKeyStoreError:
+      return credential(error)
+    case let error as SubscriptionFormError:
+      return subscriptionForm(error)
+    case let error as SubscriptionFetchError:
+      return subscriptionFetch(error)
+    case let error as SubscriptionParseError:
+      return subscriptionParse(error)
+    case let error as SettingsWorkflowFailure:
+      return message(for: error)
+    case let error as RuntimeFailureFacts:
+      return message(for: error)
+    case let error as ImportLineFailureReason:
+      return importLine(error)
+    case let error as ImportSourceFailure:
+      return importSource(error)
+    case let error as LegacySkippedRecord.Reason:
+      return reason(error)
+    case let error as PortSettingError:
+      return port(error)
+    case let error as ProxyListeningStoreError:
+      return listeningStore(error)
+    case let error as LegacyImportError:
+      return legacyImport(error)
+    case let error as SystemProxyError:
+      return systemProxy(SystemProxyOperationFailure(error))
+    case let error as TextClipboardFailure:
+      return textClipboard(error)
+    case let error as TerminalCommandFailure:
+      switch error {
+      case .credentialUnreadable: return String(localized: "局域网身份验证密码不可读，请重试。")
+      case .addressUnavailable: return String(localized: "命令地址已失效，请重新选择 IP。")
+      }
+    case let error as ImageClipboardFailure:
+      return imageClipboard(error)
+    case let error as QrImageSaveFailure:
+      return qrImageSave(error)
+    case let error as DiagnosticReportFailure:
+      return diagnosticReport(error)
+    case let error as DiagnosticReportExportFailure:
+      return diagnosticReportExport(error)
+    case let error as ConfigurationGroupExportFailure:
+      return configurationGroupExport(error)
+    case let error as ConfigurationGroupFileExportFailure:
+      return error == .writeFailed
+        ? String(localized: "SIP-008 文件写入失败") : String(localized: "URI 链接列表文本文件写入失败")
+    default:
+      return unknownError
+    }
+  }
+
+  // swiftlint:disable:next cyclomatic_complexity
+  static func message(for failure: SubscriptionRefreshFailure) -> String {
+    switch failure {
+    case .invalidURL:
+      return String(localized: "订阅地址无效")
+    case .unsupportedScheme:
+      return String(localized: "订阅地址必须是 HTTPS")
+    case .insecureRedirect:
+      return String(localized: "订阅地址重定向到了非 HTTPS 站点，已拒绝")
+    case .transport(let category):
+      switch category {
+      case .timedOut: return String(localized: "订阅获取超时")
+      case .tls: return String(localized: "订阅安全连接失败")
+      case .connection: return String(localized: "订阅连接失败")
+      case .unknown: return String(localized: "订阅获取失败")
+      }
+    case .httpStatus(let code):
+      return String(localized: "订阅服务器返回 HTTP \(code)")
+    case .contentType(let category):
+      return category == .missing
+        ? String(localized: "订阅响应缺少 JSON Content-Type")
+        : String(localized: "订阅响应类型不是 JSON")
+    case .decodingFailure:
+      return String(localized: "订阅内容不是合法的 SIP-008 JSON 文档")
+    case .unsupportedSchemaVersion:
+      return String(localized: "订阅文档版本不受支持")
+    case .missingServers:
+      return String(localized: "订阅文档缺少 servers 列表")
+    case .recordValidation(let index, let field):
+      return String(localized: "订阅第 \(index + 1) 条服务器记录的\(recordFieldName(field))无效")
+    case .duplicateIdentity:
+      return String(localized: "订阅包含重复的服务器身份")
+    case .commit:
+      return String(localized: "订阅快照保存失败")
+    case .unknown:
+      return unknownError
+    }
+  }
+
+  static func message(for issue: SettingsFieldIssue) -> String {
+    switch issue {
+    case .port(_, let error):
+      return message(for: error)
+    }
+  }
+
+  static func message(for failure: SettingsWorkflowFailure) -> String {
+    switch failure {
+    case .store(let error): return listeningStore(error)
+    case .unknown: return unknownError
+    }
+  }
+
+  // 显式白名单 switch，与 message(for:) 同一可审计惯例。
+  // swiftlint:disable:next cyclomatic_complexity
+  private static func catalog(_ error: CatalogError) -> String {
+    switch error {
+    case .nodeNotFound: return String(localized: "节点不存在（可能已被删除）")
+    case .parentNotFound: return String(localized: "目标分组不存在")
+    case .parentNotAGroup: return String(localized: "目标位置不是分组")
+    case .notAServer: return String(localized: "该节点不是服务器")
+    case .notAGroup: return String(localized: "该节点不是分组")
+    case .duplicateID: return String(localized: "节点身份冲突")
+    case .crossSourcePlacement(_, let container):
+      return container == .subscription
+        ? String(localized: "不能把手动节点移入订阅子树") : String(localized: "不能把订阅节点移入手动子树")
+    case .subscriptionNodeImmutable: return String(localized: "订阅节点由远端管理：结构、连接字段与名称只读")
+    case .subscriptionServerAtRoot: return String(localized: "订阅服务器不能移出其订阅分组")
+    case .cycleDetected: return String(localized: "不能把分组移动进它自己的子树")
+    case .indexOutOfRange: return String(localized: "插入位置超出范围")
+    case .invalidStructure: return String(localized: "配置目录结构不一致")
+    }
+  }
+
+  static func activation(_ error: ActivationFailure) -> String {
+    switch error {
+    case .noActiveTarget: return String(localized: "尚未激活任何服务器或分组，请先选择一个目标")
+    case .targetNotFound: return String(localized: "活动目标不存在，已清除目标；本地监听不受影响")
+    case .targetExpandsToNothing: return String(localized: "目标没有可激活的服务器")
+    case .invalidLeaf(let node, let reason):
+      return String(localized: "服务器不可用：\(leaf(reason))（\(shortNodeID(node))）")
+    }
+  }
+
+  private static func leaf(_ reason: LeafInvalidationReason) -> String {
+    switch reason {
+    case .invalidAddress: return String(localized: "地址无效")
+    case .invalidPort: return String(localized: "端口无效")
+    case .missingEncryptionMethod: return String(localized: "缺少加密方法")
+    case .unsupportedEncryptionMethod: return String(localized: "加密方法不受支持")
+    case .pluginNotProvided: return String(localized: "插件未提供")
+    case .missingPassword: return String(localized: "密码缺失或为空")
+    }
+  }
+
+  private static func serverForm(_ error: ServerFormError) -> String {
+    switch error {
+    case .invalidAddress: return String(localized: "服务器地址不能为空")
+    case .invalidPort: return String(localized: "端口必须是 1–65535 之间的整数")
+    case .missingEncryptionMethod: return String(localized: "必须选择加密方法")
+    case .unsupportedEncryptionMethod: return String(localized: "当前 sslocal 不支持该加密方法")
+    case .invalidPassword: return String(localized: "密码不能为空")
+    case .emptyName: return String(localized: "名称不能为空")
+    case .pluginUnknown: return String(localized: "本版本未提供所选插件")
+    }
+  }
+
+  private static func ssURI(_ error: SsUriError) -> String {
+    switch error {
+    case .notSsUri: return String(localized: "不是 ss:// 链接")
+    case .malformed: return String(localized: "无法解析 ss:// 链接")
+    }
+  }
+
+  private static func credential(_ error: CredentialKeyStoreError) -> String {
+    switch error {
+    case .keychainStatus: return String(localized: "钥匙串操作失败")
+    }
+  }
+
+  private static func subscriptionForm(_ error: SubscriptionFormError) -> String {
+    switch error {
+    case .invalidURL: return String(localized: "订阅地址必须是有效的 HTTPS URL")
+    case .notFound: return String(localized: "订阅不存在（可能已被删除）")
+    }
+  }
+
+  private static func subscriptionFetch(_ error: SubscriptionFetchError) -> String {
+    message(for: SubscriptionRefreshFailure.from(fetchError: error))
+  }
+
+  private static func subscriptionParse(_ error: SubscriptionParseError) -> String {
+    message(for: SubscriptionRefreshFailure.from(parseError: error))
+  }
+
+  private static func importLine(_ error: ImportLineFailureReason) -> String {
+    switch error {
+    case .decode(let error): return ssURI(error)
+    }
+  }
+
+  /// 统一导入的来源级失败：解析失败复用订阅解析文案族，提交失败复用
+  /// 提交错误经过统一呈现，其余点名具体原因。
+  private static func importSource(_ error: ImportSourceFailure) -> String {
+    switch error {
+    case .parse(let error): return subscriptionParse(error)
+    case .undecodableImage: return String(localized: "图片无法识别，请使用常见图片格式")
+    case .qrPayloadNotFound: return String(localized: "未识别到 ss:// 二维码")
+    case .noImportableLines: return String(localized: "没有可导入的 ss:// 链接")
+    case .commit(let error): return message(for: error)
+    }
+  }
+
+  private static func reason(_ error: LegacySkippedRecord.Reason) -> String {
+    switch error {
+    case .notDictionary: return String(localized: "记录不是字典")
+    case .invalidAddress: return String(localized: "服务器地址缺失或无效")
+    case .invalidPort: return String(localized: "服务器端口缺失或无效")
+    case .invalidEncryptionMethod: return String(localized: "加密方式缺失或无效")
+    case .missingPassword: return String(localized: "密码缺失或为空")
+    }
+  }
+
+  private static func port(_ error: PortSettingError) -> String {
+    switch error {
+    case .portOutOfRange(let endpoint, let portNumber):
+      let port = portNumber.formatted(.number.grouping(.never))
+      return String(
+        localized:
+          "\(endpoint.displayName) 端口 \(port) 无效，必须是 1025–65535 之间的整数"
+      )
+    case .duplicatePort(let endpoint, let otherEndpoint, let portNumber):
+      let port = portNumber.formatted(.number.grouping(.never))
+      return
+        String(
+          localized:
+            "\(endpoint.displayName) 端口与 \(otherEndpoint.displayName) 端口冲突（都是 \(port)），请为每个端点配置不同的端口"
+        )
+    }
+  }
+
+  private static func listeningStore(_ error: ProxyListeningStoreError) -> String {
+    switch error {
+    case .corrupt: return String(localized: "偏好文件损坏")
+    case .invalid(let errors): return errors.map(port).joined(separator: "；")
+    case .ioFailure: return String(localized: "偏好文件读写失败")
+    case .credentialFailure(let detail): return String(localized: "凭据操作失败：\(detail)")
+    case .encryptedFile: return String(localized: "监听配置无法解密或格式不受支持")
+    }
+  }
+
+  private static func legacyImport(_ error: LegacyImportError) -> String {
+    switch error {
+    case .noSnapshot: return String(localized: "没有发现可导入的 Legacy 配置")
+    case .alreadyCompleted: return String(localized: "Legacy 配置已经导入；如需再次导入，请明确选择再次导入")
+    case .malformedSnapshot: return String(localized: "Legacy 快照无效")
+    case .commitFailed: return String(localized: "Legacy 导入未完成，2.0 写入未完成")
+    }
+  }
+
+  private static func textClipboard(_ error: TextClipboardFailure) -> String {
+    switch error {
+    case .writeFailed: return String(localized: "剪贴板写入失败，请重试")
+    }
+  }
+
+  private static func imageClipboard(_ error: ImageClipboardFailure) -> String {
+    switch error {
+    case .writeFailed: return String(localized: "剪贴板写入失败，请重试")
+    }
+  }
+
+  private static func qrImageSave(_ error: QrImageSaveFailure) -> String {
+    switch error {
+    case .writeFailed: return String(localized: "二维码图片写入失败，请选择其他位置或重试")
+    }
+  }
+
+  private static func diagnosticReport(_ error: DiagnosticReportFailure) -> String {
+    switch error {
+    case .encodingFailed: return String(localized: "诊断报告无法安全构造，请重试")
+    }
+  }
+
+  private static func diagnosticReportExport(_ error: DiagnosticReportExportFailure) -> String {
+    switch error {
+    case .writeFailed: return String(localized: "诊断报告写入失败，请选择其他位置或重试")
+    }
+  }
+
+  private static func configurationGroupExport(_ error: ConfigurationGroupExportFailure) -> String {
+    switch error {
+    case .groupNotFound: return String(localized: "分组不存在（可能已被删除）")
+    case .targetIsNotGroup: return String(localized: "所选节点不是分组")
+    case .noServers: return String(localized: "分组中没有服务器配置")
+    case .invalidServer(_, let problem): return invalidServerExport(problem)
+    case .pluginOptionsWithoutProgram:
+      return String(localized: "服务器配置了插件参数但没有插件名称，无法导出 SIP-008 文件")
+    case .documentEncodingFailed:
+      return String(localized: "SIP-008 文档生成失败")
+    }
+  }
+
+  private static func invalidServerExport(_ problem: ConfigurationGroupExportFailure.RecordProblem)
+    -> String
+  {
+    switch problem {
+    case .invalidAddress: return String(localized: "服务器地址为空，无法导出 SIP-008 文件")
+    case .invalidPort: return String(localized: "服务器端口无效，无法导出 SIP-008 文件")
+    case .missingEncryptionMethod: return String(localized: "服务器缺少加密方式，无法导出 SIP-008 文件")
+    case .missingPassword: return String(localized: "服务器密码为空，无法导出 SIP-008 文件")
+    }
+  }
+
+  private static func recordFieldName(_ field: SubscriptionRefreshFailure.RecordField) -> String {
+    switch field {
+    case .address: return String(localized: "服务器地址")
+    case .port: return String(localized: "服务器端口")
+    case .method: return String(localized: "加密方法")
+    case .password: return String(localized: "密码")
+    case .identity: return String(localized: "身份")
+    }
+  }
+
+  private static func shortNodeID(_ id: NodeID) -> String {
+    String(id.rawValue.suffix(8))
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/NodeDetailPresentation.swift b/ShadowsocksX-NG2/App/Presentation/NodeDetailPresentation.swift
new file mode 100644
index 000000000..26ceb4a77
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/NodeDetailPresentation.swift
@@ -0,0 +1,297 @@
+import Foundation
+
+extension CatalogTreeNode {
+  var isRootSubscriptionGroup: Bool {
+    isGroup && source == .subscription && parentID == nil
+  }
+}
+
+/// 详情会话的展示值；包含参数明文，不进入目录工作流的非秘密投影或持久快照。
+@MainActor
+struct NodeDetailPresentation {
+  struct Property: Equatable {
+    let label: String
+    let value: String
+  }
+
+  enum PropertiesID: Hashable {
+    case subscription
+    case information
+    case connection
+    case pluginParameters
+    case connectivity
+  }
+
+  struct Properties: Equatable, Identifiable {
+    let id: PropertiesID
+    let title: String
+    let items: [Property]
+  }
+
+  let title: String
+  let subtitle: String
+  let activationMessages: [String]
+  let secondarySubtitle: String?
+  var properties: [Properties]
+
+  init(
+    node: CatalogTreeNode, server: ServerDetailPresentation?,
+    eligibility: ActivationEligibility?, isActiveTarget: Bool,
+    containsActiveTarget: Bool = false,
+    subscription: SubscriptionSummary? = nil,
+    locale: Locale = .current, timeZone: TimeZone = .current
+  ) {
+    title = node.name
+    let isRootSubscriptionGroup = node.isRootSubscriptionGroup
+    secondarySubtitle =
+      isRootSubscriptionGroup
+      ? String(localized: "配置由远端管理，本地不能修改。", table: "ServerDetails")
+      : nil
+    var descriptions = [
+      node.isGroup
+        ? (node.isManual
+          ? String(localized: "本地", table: "ServerDetails")
+          : String(localized: "订阅", table: "ServerDetails"))
+        : (node.isManual
+          ? String(localized: "本地配置", table: "ServerDetails")
+          : String(localized: "订阅配置", table: "ServerDetails"))
+    ]
+    if isActiveTarget {
+      descriptions.append(String(localized: "活动目标", table: "ServerDetails"))
+    } else if containsActiveTarget {
+      // 与行级空心闪电同语义：子树内含活动目标，自身不是活动目标。
+      descriptions.append(String(localized: "含活动目标", table: "ServerDetails"))
+    }
+    subtitle = descriptions.joined(separator: " · ")
+    activationMessages = Self.activationMessages(
+      for: node, server: server, eligibility: eligibility)
+    properties = []
+    if isRootSubscriptionGroup,
+      let subscriptionProperties = Self.subscriptionInformation(
+        summary: subscription, locale: locale, timeZone: timeZone)
+    {
+      properties.append(subscriptionProperties)
+    }
+    properties.append(Self.information(for: node, eligibility: eligibility))
+    if let server { properties.append(Self.connection(for: server)) }
+  }
+
+  private static func activationMessages(
+    for node: CatalogTreeNode, server: ServerDetailPresentation?,
+    eligibility: ActivationEligibility?
+  ) -> [String] {
+    var messages: [String] = []
+    if node.isGroup {
+      if let reason = eligibility?.ineligibility {
+        switch reason {
+        case .emptyGroup:
+          messages.append(String(localized: "空分组，暂无子节点，不能激活。", table: "ServerDetails"))
+        case .noCandidates:
+          messages.append(String(localized: "分组中没有可激活的有效服务器。", table: "ServerDetails"))
+        }
+      }
+      if let count = eligibility?.skippedInvalidCount, count > 0, eligibility?.canActivate == true {
+        messages.append(
+          String(localized: "激活时将跳过 \(count) 个存在已知阻塞问题的服务器。", table: "ServerDetails"))
+      }
+    } else {
+      messages += node.invalidReasons.map { reason in
+        if case .pluginNotProvided(let program) = reason,
+          let warning = server?.plugin.availabilityWarning(for: program)
+        {
+          return warning
+        }
+        return AppPresentation.message(
+          for: ActivationFailure.invalidLeaf(node: node.id, reason: reason))
+      }
+    }
+    return messages
+  }
+
+  private static func subscriptionInformation(
+    summary: SubscriptionSummary?, locale: Locale, timeZone: TimeZone
+  ) -> Properties? {
+    guard let summary else { return nil }
+    var items: [Property] = []
+    if let date = summary.lastSucceededAt {
+      items.append(
+        Property(
+          label: String(localized: "最后更新时间", table: "ServerDetails"),
+          value: subscriptionTimestamp(date, locale: locale, timeZone: timeZone)))
+    }
+    items.append(
+      Property(
+        label: String(localized: "自动更新", table: "ServerDetails"),
+        value: summary.autoUpdate.effectiveMode.displayName))
+    if !summary.autoUpdate.allowsUserOverride {
+      items.append(
+        Property(
+          label: String(localized: "配置限制", table: "ServerDetails"),
+          value: String(localized: "供应商禁止覆盖自动更新设置", table: "ServerDetails")))
+    }
+    if summary.autoUpdate.effectiveMode != .off, let date = summary.autoUpdate.nextUpdateAt {
+      items.append(
+        Property(
+          label: String(localized: "下次更新时间", table: "ServerDetails"),
+          value: subscriptionTimestamp(date, locale: locale, timeZone: timeZone)))
+    }
+    if let used = summary.information?.bytesUsed {
+      items.append(
+        Property(
+          label: String(localized: "已用流量", table: "ServerDetails"),
+          value: SubscriptionInformation.byteCountText(used, locale: locale)))
+    }
+    if let remaining = summary.information?.bytesRemaining {
+      items.append(
+        Property(
+          label: String(localized: "剩余流量", table: "ServerDetails"),
+          value: SubscriptionInformation.byteCountText(remaining, locale: locale)))
+    }
+    if let date = summary.information?.expiresAt {
+      items.append(
+        Property(
+          label: String(localized: "到期时间", table: "ServerDetails"),
+          value: subscriptionTimestamp(date, locale: locale, timeZone: timeZone)))
+    }
+    if let date = summary.information?.trafficResetAt {
+      items.append(
+        Property(
+          label: String(localized: "重置时间", table: "ServerDetails"),
+          value: subscriptionTimestamp(date, locale: locale, timeZone: timeZone)))
+    }
+    return Properties(
+      id: .subscription, title: String(localized: "订阅", table: "ServerDetails"), items: items)
+  }
+
+  private static func subscriptionTimestamp(
+    _ date: Date, locale: Locale, timeZone: TimeZone
+  ) -> String {
+    date.formatted(
+      Date.FormatStyle(date: .abbreviated, time: .shortened, locale: locale, timeZone: timeZone))
+  }
+
+  private static func connection(for server: ServerDetailPresentation) -> Properties {
+    let program: String
+    switch server.plugin.selection {
+    case .none: program = String(localized: "无", table: "ServerDetails")
+    case .named(let name), .unknown(let name): program = name
+    }
+    return Properties(
+      id: .connection, title: String(localized: "连接信息", table: "ServerDetails"),
+      items: [
+        Property(label: String(localized: "地址", table: "ServerDetails"), value: server.address),
+        Property(
+          label: String(localized: "端口", table: "ServerDetails"), value: String(server.port)),
+        Property(
+          label: String(localized: "加密方式", table: "ServerDetails"), value: server.encryptionMethod),
+        Property(label: String(localized: "插件", table: "ServerDetails"), value: program),
+      ])
+  }
+
+  private static func information(
+    for node: CatalogTreeNode, eligibility: ActivationEligibility?
+  ) -> Properties {
+    var information = [Property(label: "ID", value: node.id.rawValue)]
+    if node.isGroup {
+      information += [
+        Property(
+          label: String(localized: "有效服务器", table: "ServerDetails"),
+          value: String(eligibility?.candidateCount ?? 0)),
+        Property(
+          label: String(localized: "无效服务器", table: "ServerDetails"),
+          value: String(eligibility?.skippedInvalidCount ?? 0)),
+      ]
+    }
+    information += [
+      Property(
+        label: String(localized: "创建时间", table: "ServerDetails"),
+        value: Self.timestamp(node.createdAt)),
+      Property(
+        label: String(localized: "修改时间", table: "ServerDetails"),
+        value: Self.timestamp(node.updatedAt)),
+    ]
+    return Properties(
+      id: .information, title: String(localized: "信息", table: "ServerDetails"), items: information)
+  }
+
+  mutating func appendPluginParameters(_ raw: String) {
+    guard !raw.isEmpty else { return }
+    let items: [Property]
+    if let parsed = PluginOptionsDraft.parse(raw) {
+      items = parsed.items.map { item in
+        Property(
+          label: item.key,
+          value: item.hasValue
+            ? (item.value.isEmpty ? String(localized: "空值", table: "ServerDetails") : item.value)
+            : String(localized: "开关", table: "ServerDetails"))
+      }
+    } else {
+      items = [Property(label: String(localized: "原始文本", table: "ServerDetails"), value: raw)]
+    }
+    properties.append(
+      Properties(
+        id: .pluginParameters, title: String(localized: "插件参数", table: "ServerDetails"),
+        items: items))
+  }
+
+  mutating func appendPluginParameterFailure() {
+    properties.append(
+      Properties(
+        id: .pluginParameters, title: String(localized: "插件参数", table: "ServerDetails"),
+        items: [
+          Property(
+            label: String(localized: "插件参数", table: "ServerDetails"),
+            value: String(localized: "无法读取插件参数", table: "ServerDetails"))
+        ]))
+  }
+
+  private static func timestamp(_ date: Date?) -> String {
+    guard let date else { return "—" }
+    return date.formatted(date: .numeric, time: .shortened)
+  }
+}
+
+extension NodeDetailPresentation {
+  static func connectivityHistory(
+    _ records: [ServerConnectivity.Record], locale: Locale, timeZone: TimeZone
+  ) -> Properties {
+    Properties(
+      id: .connectivity, title: ConnectivityCopy.text("连通性测试"),
+      items: records.isEmpty
+        ? [Property(label: ConnectivityCopy.text("状态"), value: ConnectivityCopy.text("尚未测试"))]
+        : records.map { record in
+          Property(
+            label: connectivityTime(record.finishedAt, locale: locale, timeZone: timeZone),
+            value: ConnectivityCopy.outcome(record.outcome))
+        })
+  }
+
+  static func connectivitySummary(
+    _ summary: ServerConnectivity.Summary, serverName: (NodeID) -> String,
+    locale: Locale, timeZone: TimeZone
+  ) -> Properties {
+    let items: [Property]
+    if let id = summary.serverID, let record = summary.record {
+      items = [
+        Property(
+          label: ConnectivityCopy.text("响应延迟"), value: ConnectivityCopy.outcome(record.outcome)),
+        Property(label: ConnectivityCopy.text("服务器"), value: serverName(id)),
+        Property(
+          label: ConnectivityCopy.text("测试时间"),
+          value: connectivityTime(record.finishedAt, locale: locale, timeZone: timeZone)),
+      ]
+    } else {
+      items = [
+        Property(
+          label: ConnectivityCopy.text("状态"),
+          value: ConnectivityCopy.text(summary.hasResults ? "无成功结果" : "尚未测试"))
+      ]
+    }
+    return Properties(id: .connectivity, title: ConnectivityCopy.text("最快响应延迟"), items: items)
+  }
+
+  private static func connectivityTime(_ date: Date, locale: Locale, timeZone: TimeZone) -> String {
+    date.formatted(
+      Date.FormatStyle(date: .omitted, time: .standard, locale: locale, timeZone: timeZone))
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/PluginAvailabilityPresentation.swift b/ShadowsocksX-NG2/App/Presentation/PluginAvailabilityPresentation.swift
new file mode 100644
index 000000000..8f640367e
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/PluginAvailabilityPresentation.swift
@@ -0,0 +1,15 @@
+extension PluginSectionState {
+  /// 详情和编辑表单共用可用性解释；未知引用的操作建议由各视图呈现。
+  func availabilityWarning(for program: String) -> String? {
+    if mappingsUnreadable {
+      return String(localized: "无法读取用户插件映射，插件暂不可用。请修复映射后重试。")
+    }
+    guard let facts = programs.first(where: { $0.program == program }) else { return nil }
+    switch facts.availability {
+    case .available: return nil
+    case .missing: return String(localized: "插件文件不存在，请检查用户插件路径或应用安装。")
+    case .notExecutable: return String(localized: "插件文件不可执行，请检查文件类型和执行权限。")
+    case .unreadable: return String(localized: "无法读取插件文件信息，请检查路径和访问权限。")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/StatusMenuModel.swift b/ShadowsocksX-NG2/App/Presentation/StatusMenuModel.swift
new file mode 100644
index 000000000..0927c2818
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/StatusMenuModel.swift
@@ -0,0 +1,137 @@
+import Foundation
+
+/// 状态菜单的呈现模型：从代理控制工作流
+/// 的整体 snapshot 派生菜单数据。agent 与系统代理是两个独立状态面；不持有
+/// AppKit 类型，纯逻辑可测；视觉与交互细节（勾选标记、禁用态）在
+/// ProxyStatusMenu 呈现，不建自动测试。
+enum StatusMenuModel {
+  /// 头部状态摘要：agent 运行状态、当前模式、活动目标（含点名失败细节）与
+  /// 系统代理实际应用状态。
+  struct Summary: Equatable {
+    /// Agent 开关意图（开关勾选态的绑定来源）。
+    let agentIntentEnabled: Bool
+    /// Agent 运行状态的「在跑」投影。
+    let isOn: Bool
+    /// Agent 运行状态文本。
+    let status: String
+    /// Agent 侧点名原因：运行失败或激活拒绝/目标清除（独立于运行状态）。
+    let detail: String?
+    /// 系统代理开关意图（开关勾选态的绑定来源）。
+    let systemProxyIntentEnabled: Bool
+    /// 系统代理实际应用状态文本（与 agent 运行状态分开呈现）。
+    let systemProxyStatus: String
+    /// 同上但不带「系统代理：」前缀（首页等已有上下文的呈现面用）。
+    let systemProxyStateLabel: String
+    /// 系统代理写入/清理失败的点名原因；非失败态为 nil。
+    let systemProxyDetail: String?
+    let modeLabel: String
+    /// 活动目标从根到节点的显示名路径；未激活为 nil。
+    let targetPath: String?
+  }
+
+  /// 运行状态 → 摘要映射（与主窗口诊断区口径一致）：输入是代理控制工作流
+  /// 的整体 snapshot，菜单不再拆装控制器或运行时字段。
+  static func summary(from snapshot: ProxyControlSnapshot) -> Summary {
+    let agentDetail =
+      snapshot.runtime.failure.map { AppPresentation.message(for: $0) }
+      ?? snapshot.activationFailure.map { AppPresentation.message(for: $0) }
+    let systemProxy = systemProxyPresentation(
+      for: snapshot.systemProxyApplication,
+      approvalRequired: snapshot.systemProxyApprovalRequired,
+      backgroundUnavailable: snapshot.systemProxyInspection.backgroundUnavailable)
+    return Summary(
+      agentIntentEnabled: snapshot.agentIntentEnabled,
+      isOn: snapshot.runtime.isOn,
+      status: statusText(for: snapshot.runtime.status),
+      detail: agentDetail,
+      systemProxyIntentEnabled: snapshot.systemProxyIntentEnabled,
+      systemProxyStatus: String(localized: "系统代理：\(systemProxy.label)"),
+      systemProxyStateLabel: systemProxy.label,
+      systemProxyDetail: systemProxy.detail,
+      modeLabel: modeLabel(for: snapshot),
+      targetPath: snapshot.activeTarget?.pathSummary)
+  }
+
+  /// 模式标签：规则模式带上子选项。
+  private static func modeLabel(for snapshot: ProxyControlSnapshot) -> String {
+    let mode = snapshot.proxyMode
+    if mode == .rule {
+      return "\(mode.label) · \(snapshot.rulePreset.label)"
+    }
+    return mode.label
+  }
+
+  private static func statusText(for status: ProxyRuntimeStatus) -> String {
+    switch status {
+    case .off:
+      return String(localized: "代理客户端未运行")
+    case .starting:
+      return String(localized: "正在启动代理客户端…")
+    case .running:
+      return String(localized: "代理客户端运行中")
+    case .firewallBlocked:
+      return String(localized: "代理客户端运行中（局域网受阻）")
+    case .launchFailed:
+      return String(localized: "启动失败")
+    case .requiresApproval:
+      return String(localized: "等待用户批准代理客户端后台运行")
+    case .serviceFailed:
+      return String(localized: "服务管理失败")
+    }
+  }
+
+  // 系统代理应用状态 → 菜单文本；批准阻塞独立于操作结果。
+  // Exhaustive presentation mapping for the closed state family.
+  // swiftlint:disable:next cyclomatic_complexity
+  private static func systemProxyPresentation(
+    for application: SystemProxyApplicationFacts,
+    approvalRequired: Bool,
+    backgroundUnavailable: Bool
+  ) -> (label: String, detail: String?) {
+    switch application {
+    case .idle:
+      return (String(localized: "未应用"), nil)
+    case .pending:
+      return approvalRequired ? (String(localized: "待批准"), nil) : (String(localized: "待应用"), nil)
+    case .changed: return (String(localized: "配置已改变"), nil)
+    case .applying: return (String(localized: "应用中"), nil)
+    case .repairing: return (String(localized: "修复中"), nil)
+    case .paused:
+      return (String(localized: "已暂停"), AppPresentation.systemProxyPausedNotice)
+    case .unreadable(let facts):
+      return (
+        String(localized: "无法检查"),
+        AppPresentation.systemProxyUnreadablePrefix
+          + AppPresentation.message(for: RuntimeFailureFacts.systemProxy(facts))
+      )
+    case .repairFailed(let facts):
+      return (
+        String(localized: "修复失败"),
+        failureDetail(
+          facts, prefix: String(localized: "无法修复系统代理配置："), approvalRequired: approvalRequired)
+      )
+    case .clearFailed(let facts):
+      return (
+        String(localized: "清除失败"),
+        failureDetail(
+          facts,
+          prefix: backgroundUnavailable
+            ? String(localized: "后台代理不可用，系统代理配置未能清除。\n") : String(localized: "系统代理配置未能清除："),
+          approvalRequired: approvalRequired)
+      )
+    case .applied:
+      return (String(localized: "已应用"), nil)
+    case .failed(let facts):
+      return (
+        String(localized: "应用失败"),
+        failureDetail(facts, prefix: "", approvalRequired: approvalRequired)
+      )
+    }
+  }
+  private static func failureDetail(
+    _ facts: SystemProxyFailureFacts, prefix: String, approvalRequired: Bool
+  ) -> String? {
+    if approvalRequired && facts == .operation(.helperUnavailable) { return nil }
+    return prefix + AppPresentation.message(for: RuntimeFailureFacts.systemProxy(facts))
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/ThirdPartyComponents.swift b/ShadowsocksX-NG2/App/Presentation/ThirdPartyComponents.swift
new file mode 100644
index 000000000..0019be837
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/ThirdPartyComponents.swift
@@ -0,0 +1,45 @@
+import Foundation
+
+/// Read every document before presenting the catalog so failures never leave partial information.
+struct ThirdPartyComponents {
+  struct Document: Identifiable {
+    let reference: String
+    let text: String
+    var id: String { reference }
+    var name: String { URL(fileURLWithPath: reference).lastPathComponent }
+  }
+
+  struct Component: Identifiable {
+    let metadata: BundledDependency
+    let licenses: [Document]
+    let notices: [Document]
+    let sharedLicenses: [Document]
+    var id: String { metadata.id }
+  }
+
+  let components: [Component]
+
+  init(bundleURL: URL = Bundle.main.bundleURL) throws {
+    let catalog = try BundledDependencyCatalog(bundleURL: bundleURL)
+    components = try catalog.dependencies.sorted {
+      $0.name.localizedStandardCompare($1.name) == .orderedAscending
+    }.map { dependency in
+      var seen: Set<String> = []
+      func documents(_ references: [String]) throws -> [Document] {
+        try references.filter { seen.insert($0).inserted }.map {
+          Document(reference: $0, text: try catalog.text(at: $0))
+        }
+      }
+      let licenses = try documents(dependency.licenses)
+      let associated = try documents(dependency.notices)
+      func isSharedLicense(_ document: Document) -> Bool {
+        document.reference.hasPrefix("third-party-licenses/")
+          && document.reference.split(separator: "/").count == 2
+      }
+      return Component(
+        metadata: dependency, licenses: licenses,
+        notices: associated.filter { !isSharedLicense($0) },
+        sharedLicenses: associated.filter(isSharedLicense))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Presentation/UIErrorAlert.swift b/ShadowsocksX-NG2/App/Presentation/UIErrorAlert.swift
new file mode 100644
index 000000000..a5b466c23
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Presentation/UIErrorAlert.swift
@@ -0,0 +1,50 @@
+import SwiftUI
+
+/// 主窗口共享的错误弹窗呈现状态（UI 持有的窗口状态）：目录工作流
+/// module 以 typed error 上抛且不生成本地化文案，这里在呈现边缘统一转换。
+@MainActor
+final class ErrorAlertPresenter: ObservableObject {
+  @Published var message: String?
+
+  var isPresented: Bool { message != nil }
+
+  func present(_ error: Error) {
+    message = error.presentableMessage
+  }
+
+  func present(text: String) {
+    message = text
+  }
+
+  func dismiss() {
+    message = nil
+  }
+}
+
+/// `ErrorAlertPresenter` 的唯一 alert 挂载边缘：标题固定「操作失败」，文案取
+/// presenter 当前消息。此前这段 10 行样板复制在窗口壳、destination 包装与
+/// 服务器分区共五处；挂载点各自独立呈现，互不冲突。
+private struct PresentingErrors: ViewModifier {
+  @ObservedObject var presenter: ErrorAlertPresenter
+
+  func body(content: Content) -> some View {
+    content
+      .alert(
+        "操作失败",
+        isPresented: Binding(
+          get: { presenter.isPresented },
+          set: { if !$0 { presenter.dismiss() } })
+      ) {
+        Button("好", role: .cancel) {}
+      } message: {
+        Text(presenter.message ?? "")
+      }
+  }
+}
+
+extension View {
+  /// 挂载共享错误弹窗：present 进 `presenter` 的失败由此统一弹出。
+  func presentingErrors(_ presenter: ErrorAlertPresenter) -> some View {
+    modifier(PresentingErrors(presenter: presenter))
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Contents.json b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Contents.json
new file mode 100644
index 000000000..42204b41e
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Contents.json
@@ -0,0 +1,68 @@
+{
+  "images" : [
+    {
+      "size" : "16x16",
+      "idiom" : "mac",
+      "filename" : "Icon_16x16.png",
+      "scale" : "1x"
+    },
+    {
+      "size" : "16x16",
+      "idiom" : "mac",
+      "filename" : "Icon_16x16@2x.png",
+      "scale" : "2x"
+    },
+    {
+      "size" : "32x32",
+      "idiom" : "mac",
+      "filename" : "Icon_32x32.png",
+      "scale" : "1x"
+    },
+    {
+      "size" : "32x32",
+      "idiom" : "mac",
+      "filename" : "Icon_32x32@2x.png",
+      "scale" : "2x"
+    },
+    {
+      "size" : "128x128",
+      "idiom" : "mac",
+      "filename" : "Icon_128x128.png",
+      "scale" : "1x"
+    },
+    {
+      "size" : "128x128",
+      "idiom" : "mac",
+      "filename" : "Icon_128x128@2x.png",
+      "scale" : "2x"
+    },
+    {
+      "size" : "256x256",
+      "idiom" : "mac",
+      "filename" : "Icon_256x256.png",
+      "scale" : "1x"
+    },
+    {
+      "size" : "256x256",
+      "idiom" : "mac",
+      "filename" : "Icon_256x256@2x.png",
+      "scale" : "2x"
+    },
+    {
+      "size" : "512x512",
+      "idiom" : "mac",
+      "filename" : "Icon_512x512.png",
+      "scale" : "1x"
+    },
+    {
+      "size" : "512x512",
+      "idiom" : "mac",
+      "filename" : "Icon_512x512@2x.png",
+      "scale" : "2x"
+    }
+  ],
+  "info" : {
+    "version" : 1,
+    "author" : "xcode"
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_128x128.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_128x128.png
new file mode 100644
index 000000000..801fb3e47
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_128x128.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_128x128@2x.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_128x128@2x.png
new file mode 100644
index 000000000..3c18b8698
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_128x128@2x.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_16x16.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_16x16.png
new file mode 100644
index 000000000..2caa4aa00
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_16x16.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_16x16@2x.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_16x16@2x.png
new file mode 100644
index 000000000..93d5226d2
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_16x16@2x.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_256x256.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_256x256.png
new file mode 100644
index 000000000..3c18b8698
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_256x256.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_256x256@2x.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_256x256@2x.png
new file mode 100644
index 000000000..e5a0e752c
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_256x256@2x.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_32x32.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_32x32.png
new file mode 100644
index 000000000..93d5226d2
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_32x32.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_32x32@2x.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_32x32@2x.png
new file mode 100644
index 000000000..b595230a4
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_32x32@2x.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_512x512.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_512x512.png
new file mode 100644
index 000000000..e5a0e752c
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_512x512.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_512x512@2x.png b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_512x512@2x.png
new file mode 100644
index 000000000..337b21826
Binary files /dev/null and b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/AppIcon.appiconset/Icon_512x512@2x.png differ
diff --git a/ShadowsocksX-NG2/App/Resources/Assets.xcassets/Contents.json b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/Contents.json
new file mode 100644
index 000000000..73c00596a
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Resources/Assets.xcassets/Contents.json
@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/ShadowsocksX-NG2/App/Resources/Connectivity.xcstrings b/ShadowsocksX-NG2/App/Resources/Connectivity.xcstrings
new file mode 100644
index 000000000..1d2368993
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Resources/Connectivity.xcstrings
@@ -0,0 +1,397 @@
+{
+  "sourceLanguage": "zh-Hans",
+  "strings": {
+    "响应延迟": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Response latency"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "响应延迟"
+          }
+        }
+      }
+    },
+    "测试中...": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Testing..."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "测试中..."
+          }
+        }
+      }
+    },
+    "测试中": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Testing"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "测试中"
+          }
+        }
+      }
+    },
+    "无成功结果": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No successful result"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无成功结果"
+          }
+        }
+      }
+    },
+    "延迟测试": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Latency Test"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "延迟测试"
+          }
+        }
+      }
+    },
+    "配置不支持": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unsupported configuration"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "配置不支持"
+          }
+        }
+      }
+    },
+    "准备超时": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Preparation timed out"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "准备超时"
+          }
+        }
+      }
+    },
+    "请求超时": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Request timed out"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请求超时"
+          }
+        }
+      }
+    },
+    "配置错误": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Configuration error"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "配置错误"
+          }
+        }
+      }
+    },
+    "启动错误": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Startup error"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "启动错误"
+          }
+        }
+      }
+    },
+    "网络错误": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Network error"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "网络错误"
+          }
+        }
+      }
+    },
+    "最快响应延迟": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Fastest response latency"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "最快响应延迟"
+          }
+        }
+      }
+    },
+    "连通性测试": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Connectivity Test"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "连通性测试"
+          }
+        }
+      }
+    },
+    "测试链接": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Test URL"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "测试链接"
+          }
+        }
+      }
+    },
+    "无法保存测试 URL": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to save the test URL"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法保存测试 URL"
+          }
+        }
+      }
+    },
+    "恢复默认": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Restore Default"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "恢复默认"
+          }
+        }
+      }
+    },
+    "取消": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cancel"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "取消"
+          }
+        }
+      }
+    },
+    "保存": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Save"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存"
+          }
+        }
+      }
+    },
+    "尚未测试": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Not tested yet"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "尚未测试"
+          }
+        }
+      }
+    },
+    "仅支持 HTTP。预热后采样 3 次，至少成功 2 次；显示成功样本的中位数。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "HTTP only. After warm-up, take 3 samples; at least 2 must succeed. Shows the median of successful samples."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "仅支持 HTTP。预热后采样 3 次，至少成功 2 次；显示成功样本的中位数。"
+          }
+        }
+      }
+    },
+    "状态": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Status"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "状态"
+          }
+        }
+      }
+    },
+    "服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Server"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器"
+          }
+        }
+      }
+    },
+    "测试时间": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Test time"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "测试时间"
+          }
+        }
+      }
+    }
+  },
+  "version": "1.0"
+}
diff --git a/ShadowsocksX-NG2/App/Resources/HomeTargets.xcstrings b/ShadowsocksX-NG2/App/Resources/HomeTargets.xcstrings
new file mode 100644
index 000000000..d023f89f0
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Resources/HomeTargets.xcstrings
@@ -0,0 +1,346 @@
+{
+  "sourceLanguage": "zh-Hans",
+  "strings": {
+    "定位当前": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Locate Current"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "定位当前"
+          }
+        }
+      }
+    },
+    "未选择活动目标": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No active target"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未选择活动目标"
+          }
+        }
+      }
+    },
+    "目录视图": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Catalog view"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "目录视图"
+          }
+        }
+      }
+    },
+    "全部": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "All"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "全部"
+          }
+        }
+      }
+    },
+    "收藏": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Favorites"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "收藏"
+          }
+        }
+      }
+    },
+    "名称": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Name"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "名称"
+          }
+        }
+      }
+    },
+    "目录为空，请到服务器页添加配置。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The catalog is empty. Add configurations on the Servers page."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "目录为空，请到服务器页添加配置。"
+          }
+        }
+      }
+    },
+    "暂无收藏，请到服务器页收藏配置或分组。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No favorites. Favorite configurations or groups on the Servers page."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "暂无收藏，请到服务器页收藏配置或分组。"
+          }
+        }
+      }
+    },
+    "前往服务器页": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Go to Servers"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "前往服务器页"
+          }
+        }
+      }
+    },
+    "可激活 %lld 个配置，将跳过 %lld 个已知无效配置。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%lld configurations can be activated; %lld known invalid configurations will be skipped."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "可激活 %lld 个配置，将跳过 %lld 个已知无效配置。"
+          }
+        }
+      }
+    },
+    "请选择服务器或分组": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Select a server or group"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请选择服务器或分组"
+          }
+        }
+      }
+    },
+    "激活中…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Activating…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "激活中…"
+          }
+        }
+      }
+    },
+    "激活": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Activate"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "激活"
+          }
+        }
+      }
+    },
+    "激活所选目标": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Activate the selected target"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "激活所选目标"
+          }
+        }
+      }
+    },
+    "尚未选择目标": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No target selected"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "尚未选择目标"
+          }
+        }
+      }
+    },
+    "当前项已激活": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This target is already active"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "当前项已激活"
+          }
+        }
+      }
+    },
+    "配置不满足本地激活条件": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This configuration does not meet local activation requirements"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "配置不满足本地激活条件"
+          }
+        }
+      }
+    },
+    "收起 %@": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Collapse %@"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "收起 %@"
+          }
+        }
+      }
+    },
+    "展开 %@": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Expand %@"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "展开 %@"
+          }
+        }
+      }
+    },
+    "定位": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "定位"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Locate"
+          }
+        }
+      }
+    }
+  },
+  "version": "1.0"
+}
diff --git a/ShadowsocksX-NG2/App/Resources/Localizable.xcstrings b/ShadowsocksX-NG2/App/Resources/Localizable.xcstrings
new file mode 100644
index 000000000..11efee4ff
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Resources/Localizable.xcstrings
@@ -0,0 +1,9459 @@
+{
+  "sourceLanguage": "zh-Hans",
+  "strings": {
+    "显示状态栏运行状态圆点": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Show runtime status dots in the menu bar"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "显示状态栏运行状态圆点"
+          }
+        }
+      }
+    },
+    "服务器库无法读取": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cannot Read Server Library"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器库无法读取"
+          }
+        }
+      }
+    },
+    "原配置文件和正在运行的代理保持不变。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Your existing configuration file and running proxy remain unchanged."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "原配置文件和正在运行的代理保持不变。"
+          }
+        }
+      }
+    },
+    "钥匙串状态码：%lld": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Keychain status: %lld"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "钥匙串状态码：%lld"
+          }
+        }
+      }
+    },
+    "重试并解锁": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Retry and Unlock"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重试并解锁"
+          }
+        }
+      }
+    },
+    "放弃原配置…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Discard Existing Configuration…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "放弃原配置…"
+          }
+        }
+      }
+    },
+    "放弃原配置并创建空库？": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Discard the existing configuration and create an empty library?"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "放弃原配置并创建空库？"
+          }
+        }
+      }
+    },
+    "放弃原配置并创建空库": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Discard Configuration and Create Empty Library"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "放弃原配置并创建空库"
+          }
+        }
+      }
+    },
+    "新空库将覆盖原服务器库，并撤下原代理出口。未另存的原配置将无法恢复。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The empty library will replace your existing server library and remove the current proxy server. Configuration without another copy cannot be recovered."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "新空库将覆盖原服务器库，并撤下原代理出口。未另存的原配置将无法恢复。"
+          }
+        }
+      }
+    },
+    "钥匙串访问需要授权，或用户取消了授权。请重试并解锁。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Keychain access requires authorization, or authorization was canceled. Retry and unlock the library."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "钥匙串访问需要授权，或用户取消了授权。请重试并解锁。"
+          }
+        }
+      }
+    },
+    "找不到服务器库的主密钥。请恢复原钥匙串后重试。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server library master key is missing. Restore the original keychain and retry."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "找不到服务器库的主密钥。请恢复原钥匙串后重试。"
+          }
+        }
+      }
+    },
+    "服务器库认证失败，文件或密钥不匹配。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Server library authentication failed. The file or key does not match."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器库认证失败，文件或密钥不匹配。"
+          }
+        }
+      }
+    },
+    "此版本无法读取服务器库格式。请使用兼容的应用版本。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This app version cannot read the server library format. Use a compatible version."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "此版本无法读取服务器库格式。请使用兼容的应用版本。"
+          }
+        }
+      }
+    },
+    "服务器库文件损坏或格式无效。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server library file is damaged or has an invalid format."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器库文件损坏或格式无效。"
+          }
+        }
+      }
+    },
+    "原配置缺少所需凭据，迁移未完成。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Migration could not finish because required credentials are missing."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "原配置缺少所需凭据，迁移未完成。"
+          }
+        }
+      }
+    },
+    "服务器库读取或保存失败。请检查存储权限后重试。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server library could not be read or saved. Check storage permissions and retry."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器库读取或保存失败。请检查存储权限后重试。"
+          }
+        }
+      }
+    },
+    "旧配置清理失败。新服务器库可以使用，但旧文件或凭据仍有残留。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Old configuration cleanup failed. The new library is usable, but old files or credentials remain."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "旧配置清理失败。新服务器库可以使用，但旧文件或凭据仍有残留。"
+          }
+        }
+      }
+    },
+    "添加订阅": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Add Subscription"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "添加订阅"
+          }
+        }
+      }
+    },
+    "用工具栏的「添加订阅」按钮添加 HTTPS 订阅地址（SIP-008 JSON）": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Use Add Subscription in the toolbar to add an HTTPS subscription URL (SIP-008 JSON)."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "用工具栏的「添加订阅」按钮添加 HTTPS 订阅地址（SIP-008 JSON）"
+          }
+        }
+      }
+    },
+    "位置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Where"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "位置"
+          }
+        }
+      }
+    },
+    "所有服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "All Servers"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "所有服务器"
+          }
+        }
+      }
+    },
+    "复制": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Duplicate"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "复制"
+          }
+        }
+      }
+    },
+    "副本": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Copy"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "副本"
+          }
+        }
+      }
+    },
+    "无法加载服务器资料": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to Load Server Details"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法加载服务器资料"
+          }
+        }
+      }
+    },
+    "无法读取服务器凭据。请重新加载后再试。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read the server credentials. Reload the server details and try again."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法读取服务器凭据。请重新加载后再试。"
+          }
+        }
+      }
+    },
+    "重新加载失败。当前草稿已保留，重新加载成功后才能保存。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Reload failed. Your draft has been kept. Reload successfully before saving."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重新加载失败。当前草稿已保留，重新加载成功后才能保存。"
+          }
+        }
+      }
+    },
+    "重新加载": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Reload"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重新加载"
+          }
+        }
+      }
+    },
+    "例如：香港服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "e.g. Hong Kong server"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "例如：香港服务器"
+          }
+        }
+      }
+    },
+    "值": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Value"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "值"
+          }
+        }
+      }
+    },
+    "删除": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "删除"
+          }
+        }
+      }
+    },
+    "原始文本": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Raw Text"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "原始文本"
+          }
+        }
+      }
+    },
+    "参数列表": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Parameters"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "参数列表"
+          }
+        }
+      }
+    },
+    "参数名": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Key"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "参数名"
+          }
+        }
+      }
+    },
+    "名称最多 %lld 个字符": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Name must be at most %lld characters"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "名称最多 %lld 个字符"
+          }
+        }
+      }
+    },
+    "存在未完成的参数行：请补全参数名、清空该行或删除它": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "An unfinished parameter row exists: complete its key, clear the row, or delete it"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "存在未完成的参数行：请补全参数名、清空该行或删除它"
+          }
+        }
+      }
+    },
+    "密码最多 %lld 个字符": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Password must be at most %lld characters"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "密码最多 %lld 个字符"
+          }
+        }
+      }
+    },
+    "开关": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Flag"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "开关"
+          }
+        }
+      }
+    },
+    "插件参数最多 %lld 个字节": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin options must be at most %lld bytes"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件参数最多 %lld 个字节"
+          }
+        }
+      }
+    },
+    "操作": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Actions"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "操作"
+          }
+        }
+      }
+    },
+    "服务器地址最多 %lld 个字符": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Server address must be at most %lld characters"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器地址最多 %lld 个字符"
+          }
+        }
+      }
+    },
+    "查看模式": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "View Mode"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "查看模式"
+          }
+        }
+      }
+    },
+    "确认": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Confirm"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "确认"
+          }
+        }
+      }
+    },
+    "端口必须是 1–65535 的数字（最多 %lld 位）": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Port must be a number from 1 to 65535 (at most %lld digits)"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "端口必须是 1–65535 的数字（最多 %lld 位）"
+          }
+        }
+      }
+    },
+    "类型": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Kind"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "类型"
+          }
+        }
+      }
+    },
+    "编辑值…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Edit Value…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "编辑值…"
+          }
+        }
+      }
+    },
+    "缺少参数名": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Missing key"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "缺少参数名"
+          }
+        }
+      }
+    },
+    "请输入服务器名称": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter a server name"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请输入服务器名称"
+          }
+        }
+      }
+    },
+    "重置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Reset"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重置"
+          }
+        }
+      }
+    },
+    "已用流量": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Used Data"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已用流量"
+          }
+        }
+      }
+    },
+    "剩余流量": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Remaining Data"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "剩余流量"
+          }
+        }
+      }
+    },
+    "到期时间": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Expiration"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "到期时间"
+          }
+        }
+      }
+    },
+    "重置时间": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Traffic Reset"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重置时间"
+          }
+        }
+      }
+    },
+    "流量消耗": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Data Usage"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "流量消耗"
+          }
+        }
+      }
+    },
+    "上次成功刷新": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Last Successful Refresh"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "上次成功刷新"
+          }
+        }
+      }
+    },
+    "未找到插件“%@”。引用和已保存参数将保留；可添加同名用户插件，或改选其他插件或“无”。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin “%@” was not found. Its reference and saved options will be preserved. Add a user plugin with the same name, select another plugin, or select None."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未找到插件“%@”。引用和已保存参数将保留；可添加同名用户插件，或改选其他插件或“无”。"
+          }
+        }
+      }
+    },
+    "插件文件不存在，请检查用户插件路径或应用安装。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The plugin file is missing. Check the user plugin path or the app installation."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件文件不存在，请检查用户插件路径或应用安装。"
+          }
+        }
+      }
+    },
+    "插件文件不可执行，请检查文件类型和执行权限。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The plugin file is not executable. Check its file type and execute permissions."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件文件不可执行，请检查文件类型和执行权限。"
+          }
+        }
+      }
+    },
+    "无法读取插件文件信息，请检查路径和访问权限。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin file information could not be read. Check the path and access permissions."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法读取插件文件信息，请检查路径和访问权限。"
+          }
+        }
+      }
+    },
+    "无法读取用户插件映射，插件暂不可用。请修复映射后重试。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "User plugin mappings could not be read. Plugins are unavailable until the mappings are repaired."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法读取用户插件映射，插件暂不可用。请修复映射后重试。"
+          }
+        }
+      }
+    },
+    "插件": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugins"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件"
+          }
+        }
+      }
+    },
+    "新增插件…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Add Plugin…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "新增插件…"
+          }
+        }
+      }
+    },
+    "编辑": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Edit"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "编辑"
+          }
+        }
+      }
+    },
+    "编辑…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Edit…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "编辑…"
+          }
+        }
+      }
+    },
+    "覆盖…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Override…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "覆盖…"
+          }
+        }
+      }
+    },
+    "删除…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "删除…"
+          }
+        }
+      }
+    },
+    "恢复内置…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Restore Built-in…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "恢复内置…"
+          }
+        }
+      }
+    },
+    "恢复内置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Restore Built-in"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "恢复内置"
+          }
+        }
+      }
+    },
+    "重试读取": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Retry"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重试读取"
+          }
+        }
+      }
+    },
+    "刷新": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Refresh"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "刷新"
+          }
+        }
+      }
+    },
+    "插件名称": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin name"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件名称"
+          }
+        }
+      }
+    },
+    "可执行文件路径": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Executable path"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "可执行文件路径"
+          }
+        }
+      }
+    },
+    "选择文件…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Choose File…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "选择文件…"
+          }
+        }
+      }
+    },
+    "取消": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cancel"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "取消"
+          }
+        }
+      }
+    },
+    "保存": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Save"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存"
+          }
+        }
+      }
+    },
+    "确定": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "OK"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "确定"
+          }
+        }
+      }
+    },
+    "新增插件": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Add Plugin"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "新增插件"
+          }
+        }
+      }
+    },
+    "编辑插件": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Edit Plugin"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "编辑插件"
+          }
+        }
+      }
+    },
+    "覆盖内置插件": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Override Built-in Plugin"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "覆盖内置插件"
+          }
+        }
+      }
+    },
+    "内置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Built-in"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "内置"
+          }
+        }
+      }
+    },
+    "用户添加": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "User-added"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "用户添加"
+          }
+        }
+      }
+    },
+    "用户覆盖": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "User override"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "用户覆盖"
+          }
+        }
+      }
+    },
+    "恢复内置插件？": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Restore Built-in Plugin?"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "恢复内置插件？"
+          }
+        }
+      }
+    },
+    "删除用户插件？": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete User Plugin?"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "删除用户插件？"
+          }
+        }
+      }
+    },
+    "服务器配置将保留，后续连接使用同名内置插件。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Server configurations will be kept. Future connections will use the built-in plugin with this name."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器配置将保留，后续连接使用同名内置插件。"
+          }
+        }
+      }
+    },
+    "服务器配置将保留，使用此名称的服务器可能无法连接。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Server configurations will be kept. Servers using this name may be unable to connect."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器配置将保留，使用此名称的服务器可能无法连接。"
+          }
+        }
+      }
+    },
+    "插件配置操作失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin Configuration Failed"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件配置操作失败"
+          }
+        }
+      }
+    },
+    "无法保存插件配置，请检查配置文件的访问权限后重试。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to save plugin configuration. Check access permissions for the configuration file and try again."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法保存插件配置，请检查配置文件的访问权限后重试。"
+          }
+        }
+      }
+    },
+    "无法读取插件配置。请修复配置文件后重试读取。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read plugin configuration. Repair the configuration file and retry."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法读取插件配置。请修复配置文件后重试读取。"
+          }
+        }
+      }
+    },
+    "请输入插件名称；已保存的名称不能修改。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter a plugin name. Saved names cannot be changed."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请输入插件名称；已保存的名称不能修改。"
+          }
+        }
+      }
+    },
+    "已有同名用户插件，请编辑现有条目或使用其他名称。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "A user plugin already has this name. Edit the existing entry or choose another name."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已有同名用户插件，请编辑现有条目或使用其他名称。"
+          }
+        }
+      }
+    },
+    "请输入可执行文件的绝对路径。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter an absolute path to the executable file."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请输入可执行文件的绝对路径。"
+          }
+        }
+      }
+    },
+    "文件不存在或不可执行，请选择可执行文件。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The file is missing or is not executable. Choose an executable file."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "文件不存在或不可执行，请选择可执行文件。"
+          }
+        }
+      }
+    },
+    "该用户插件已不存在，请关闭表单后重试。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This user plugin no longer exists. Close the form and try again."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "该用户插件已不存在，请关闭表单后重试。"
+          }
+        }
+      }
+    },
+    "插件文件不存在。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The plugin file is missing."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件文件不存在。"
+          }
+        }
+      }
+    },
+    "插件文件不可执行。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The plugin file is not executable."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件文件不可执行。"
+          }
+        }
+      }
+    },
+    "无法读取插件文件。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read the plugin file."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法读取插件文件。"
+          }
+        }
+      }
+    },
+    "macOS 安全策略检查未通过，运行可能受到限制。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The macOS security policy assessment failed. Execution may be restricted."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "macOS 安全策略检查未通过，运行可能受到限制。"
+          }
+        }
+      }
+    },
+    "文件带有下载隔离标记，运行时可能需要 macOS 授权。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The file has a download quarantine flag. Execution may require macOS approval."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "文件带有下载隔离标记，运行时可能需要 macOS 授权。"
+          }
+        }
+      }
+    },
+    "文件签名无效，运行可能受到 macOS 限制。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The file signature is invalid. macOS may restrict execution."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "文件签名无效，运行可能受到 macOS 限制。"
+          }
+        }
+      }
+    },
+    "文件未签名，运行可能受到 macOS 限制。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The file is unsigned. macOS may restrict execution."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "文件未签名，运行可能受到 macOS 限制。"
+          }
+        }
+      }
+    },
+    "无法完成安全检查。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to complete the security check."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法完成安全检查。"
+          }
+        }
+      }
+    },
+    "隔离标记：存在": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Quarantine flag: present"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "隔离标记：存在"
+          }
+        }
+      }
+    },
+    "隔离标记：无": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Quarantine flag: absent"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "隔离标记：无"
+          }
+        }
+      }
+    },
+    "隔离标记：无法判断": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Quarantine flag: unknown"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "隔离标记：无法判断"
+          }
+        }
+      }
+    },
+    "签名：有效": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Signature: valid"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "签名：有效"
+          }
+        }
+      }
+    },
+    "签名：未签名": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Signature: unsigned"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "签名：未签名"
+          }
+        }
+      }
+    },
+    "签名：无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Signature: invalid"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "签名：无效"
+          }
+        }
+      }
+    },
+    "签名：不适用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Signature: not applicable"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "签名：不适用"
+          }
+        }
+      }
+    },
+    "签名：无法判断": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Signature: unknown"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "签名：无法判断"
+          }
+        }
+      }
+    },
+    "安全策略：检查通过": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Security policy: assessment passed"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "安全策略：检查通过"
+          }
+        }
+      }
+    },
+    "安全策略：检查未通过": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Security policy: assessment failed"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "安全策略：检查未通过"
+          }
+        }
+      }
+    },
+    "安全策略：不适用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Security policy: not applicable"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "安全策略：不适用"
+          }
+        }
+      }
+    },
+    "安全策略：无法判断": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Security policy: unknown"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "安全策略：无法判断"
+          }
+        }
+      }
+    },
+    "安全检查详情": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Security Check Details"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "安全检查详情"
+          }
+        }
+      }
+    },
+    "检查结果仅供参考，不能保证 macOS 允许或禁止运行。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "These results are advisory and do not guarantee whether macOS will allow or block execution."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "检查结果仅供参考，不能保证 macOS 允许或禁止运行。"
+          }
+        }
+      }
+    },
+    "正在检查安全信息…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Checking security information…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "正在检查安全信息…"
+          }
+        }
+      }
+    },
+    "保存后将覆盖同名内置插件。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Saving will override the built-in plugin with this name."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存后将覆盖同名内置插件。"
+          }
+        }
+      }
+    },
+    "无法选择文件，请重试。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to choose a file. Try again."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法选择文件，请重试。"
+          }
+        }
+      }
+    },
+    "诊断": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Diagnostics"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "诊断"
+          }
+        }
+      }
+    },
+    "反馈…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Feedback…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "反馈…"
+          }
+        }
+      }
+    },
+    "诊断…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Diagnostics…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "诊断…"
+          }
+        }
+      }
+    },
+    "名称": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Name"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "名称"
+          }
+        }
+      }
+    },
+    "重命名分组": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rename Group"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重命名分组"
+          }
+        }
+      }
+    },
+    "本地": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Local"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本地"
+          }
+        }
+      }
+    },
+    "订阅": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscriptions"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅"
+          }
+        }
+      }
+    },
+    "无": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "None"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无"
+          }
+        }
+      }
+    },
+    "收藏": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Favorites"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "收藏"
+          }
+        }
+      }
+    },
+    "路径": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Path"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "路径"
+          }
+        }
+      }
+    },
+    "请至少填写一个非空插件名称。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter at least one nonempty plugin name."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请至少填写一个非空插件名称。"
+          }
+        }
+      }
+    },
+    "启动参数不能包含空字符（NUL）。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Startup arguments cannot contain NUL characters."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "启动参数不能包含空字符（NUL）。"
+          }
+        }
+      }
+    },
+    "保存后将覆盖所列名称对应的内置插件。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Saving overrides the built-in plugin for the listed names."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存后将覆盖所列名称对应的内置插件。"
+          }
+        }
+      }
+    },
+    "本地启动参数": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Local Startup Arguments"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本地启动参数"
+          }
+        }
+      }
+    },
+    "参数": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Argument"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "参数"
+          }
+        }
+      }
+    },
+    "每项作为一个完整参数传递，无需 shell 引号。仅在本机生效。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Each item is passed as one complete argument, without shell quoting. Applies only on this Mac."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "每项作为一个完整参数传递，无需 shell 引号。仅在本机生效。"
+          }
+        }
+      }
+    },
+    "内置插件启动参数": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Built-in Plugin Startup Arguments"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "内置插件启动参数"
+          }
+        }
+      }
+    },
+    "上移": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Move Up"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "上移"
+          }
+        }
+      }
+    },
+    "下移": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Move Down"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "下移"
+          }
+        }
+      }
+    },
+    "删除此项": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Remove Item"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "删除此项"
+          }
+        }
+      }
+    },
+    "添加一项": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Add Item"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "添加一项"
+          }
+        }
+      }
+    },
+    "启动参数": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Startup Arguments"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "启动参数"
+          }
+        }
+      }
+    },
+    "清空参数": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Clear Arguments"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "清空参数"
+          }
+        }
+      }
+    },
+    "覆盖名称": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Override Name"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "覆盖名称"
+          }
+        }
+      }
+    },
+    "已被用户覆盖：": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Overridden by user: "
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已被用户覆盖："
+          }
+        }
+      }
+    },
+    "删除此记录的全部名称。服务器引用保留，同名内置插件恢复；其他名称可能无法连接。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Remove all names in this record. Server references are kept. Built-in plugins with matching names are restored; other names may no longer connect."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "删除此记录的全部名称。服务器引用保留，同名内置插件恢复；其他名称可能无法连接。"
+          }
+        }
+      }
+    },
+    "设置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Settings"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "设置"
+          }
+        }
+      }
+    },
+    "插件传输模式": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin Transport Mode"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件传输模式"
+          }
+        }
+      }
+    },
+    "内置插件设置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Built-in Plugin Settings"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "内置插件设置"
+          }
+        }
+      }
+    },
+    "本地监听": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本地监听"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Local Listeners"
+          }
+        }
+      }
+    },
+    "启用局域网监听": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "启用局域网监听"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enable LAN Listeners"
+          }
+        }
+      }
+    },
+    "局域网监听": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "局域网监听"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "LAN Listeners"
+          }
+        }
+      }
+    },
+    "本机 SOCKS %lld / HTTP %lld": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本机 SOCKS %lld / HTTP %lld"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Local SOCKS %lld / HTTP %lld"
+          }
+        }
+      }
+    },
+    "%@ SOCKS %lld / HTTP %lld": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@ SOCKS %lld / HTTP %lld"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@ SOCKS %lld / HTTP %lld"
+          }
+        }
+      }
+    },
+    "SOCKS 与 HTTP 代理在本地回环地址 127.0.0.1 监听": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS 与 HTTP 代理在本地回环地址 127.0.0.1 监听"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS and HTTP proxies listen on the loopback address 127.0.0.1"
+          }
+        }
+      }
+    },
+    "端口范围为 1025–65535，SOCKS 与 HTTP 代理端口必须不同": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "端口范围为 1025–65535，SOCKS 与 HTTP 代理端口必须不同"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Ports must be between 1025 and 65535. SOCKS and HTTP ports must differ."
+          }
+        }
+      }
+    },
+    "端口范围为 1025–65535，四个代理端口必须不同": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "端口范围为 1025–65535，四个代理端口必须不同"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Ports must be between 1025 and 65535. All four proxy ports must differ."
+          }
+        }
+      }
+    },
+    "UDP 中继启用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "UDP 中继启用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "UDP relay enabled"
+          }
+        }
+      }
+    },
+    "UDP 中继禁用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "UDP 中继禁用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "UDP relay disabled"
+          }
+        }
+      }
+    },
+    "身份验证已启用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "身份验证已启用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Authentication enabled"
+          }
+        }
+      }
+    },
+    "身份验证已禁用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "身份验证已禁用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Authentication disabled"
+          }
+        }
+      }
+    },
+    "SOCKS UDP 中继": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS UDP 中继"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS UDP Relay"
+          }
+        }
+      }
+    },
+    "身份验证": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "身份验证"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Authentication"
+          }
+        }
+      }
+    },
+    "当前实现的身份验证无法可靠保护 UDP 中继。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "当前实现的身份验证无法可靠保护 UDP 中继。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Authentication cannot reliably protect the UDP relay in the current implementation."
+          }
+        }
+      }
+    },
+    "SOCKS 与 HTTP 共用一组凭据。用户名和密码为 1–255 个可打印 ASCII 字符，用户名不得包含冒号。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS 与 HTTP 共用一组凭据。用户名和密码为 1–255 个可打印 ASCII 字符，用户名不得包含冒号。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS and HTTP share credentials. Use 1–255 printable ASCII characters for each field. The username must not contain a colon."
+          }
+        }
+      }
+    },
+    "用户名或密码无效。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "用户名或密码无效。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid username or password."
+          }
+        }
+      }
+    },
+    "局域网身份验证密码不可读，请重试。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "局域网身份验证密码不可读，请重试。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The LAN authentication password could not be read. Try again."
+          }
+        }
+      }
+    },
+    "端口已占用，未保存局域网监听。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "端口已占用，未保存局域网监听。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "A port is in use. LAN listener settings were not saved."
+          }
+        }
+      }
+    },
+    "配置发生变化或校验未完成，请重试。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "配置发生变化或校验未完成，请重试。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The configuration changed or validation is incomplete. Try again."
+          }
+        }
+      }
+    },
+    "局域网监听保存失败。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "局域网监听保存失败。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "LAN listener settings could not be saved."
+          }
+        }
+      }
+    },
+    "所有 IPv6 接口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "所有 IPv6 接口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "All IPv6 Interfaces"
+          }
+        }
+      }
+    },
+    "所有 IPv4 接口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "所有 IPv4 接口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "All IPv4 Interfaces"
+          }
+        }
+      }
+    },
+    "所有 IPv4 与 IPv6 接口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "所有 IPv4 与 IPv6 接口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "All IPv4 and IPv6 Interfaces"
+          }
+        }
+      }
+    },
+    "SOCKS 代理端口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS 代理端口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS Proxy Port"
+          }
+        }
+      }
+    },
+    "HTTP 代理端口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "HTTP 代理端口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "HTTP Proxy Port"
+          }
+        }
+      }
+    },
+    "用户名": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "用户名"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Username"
+          }
+        }
+      }
+    },
+    "密码": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "密码"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Password"
+          }
+        }
+      }
+    },
+    "关闭": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Off"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "关闭"
+          }
+        }
+      }
+    },
+    "语言": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Language"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "语言"
+          }
+        }
+      }
+    },
+    "下次启动生效": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Takes effect next launch"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "下次启动生效"
+          }
+        }
+      }
+    },
+    "自动检测": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Auto Detect"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "自动检测"
+          }
+        }
+      }
+    },
+    "简体中文": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Simplified Chinese"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "简体中文"
+          }
+        }
+      }
+    },
+    "英文": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "English"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "英文"
+          }
+        }
+      }
+    },
+    "后台代理客户端": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "后台代理客户端"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Background proxy client"
+          }
+        }
+      }
+    },
+    "目标分组不存在": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "目标分组不存在"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The destination group does not exist"
+          }
+        }
+      }
+    },
+    "%@，凭据恢复不完整；最后一次成功快照仍保留": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@，凭据恢复不完整；最后一次成功快照仍保留"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@; credential recovery is incomplete. The last successful snapshot is preserved."
+          }
+        }
+      }
+    },
+    "%@，旧凭据已恢复": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@，旧凭据已恢复"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@; previous credentials restored"
+          }
+        }
+      }
+    },
+    "%@；凭据恢复不完整，请检查配置后重试": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@；凭据恢复不完整，请检查配置后重试"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@; credential recovery is incomplete. Check the configuration and try again."
+          }
+        }
+      }
+    },
+    "%lld 个服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%lld 个服务器"
+          }
+        },
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "%lld server"
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "%lld servers"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "%lld 项": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%lld 项"
+          }
+        },
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "%lld item"
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "%lld items"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "GUI 事件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "GUI 事件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "GUI events"
+          }
+        }
+      }
+    },
+    "Legacy 导入": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Legacy 导入"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Legacy Import"
+          }
+        }
+      }
+    },
+    "Legacy 导入未完成，2.0 写入未完成": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Legacy 导入未完成，2.0 写入未完成"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Legacy import was not completed. Writing to 2.0 was not completed."
+          }
+        }
+      }
+    },
+    "Legacy 快照无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Legacy 快照无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid Legacy snapshot"
+          }
+        }
+      }
+    },
+    "Legacy 配置已经导入；如需再次导入，请明确选择再次导入": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Legacy 配置已经导入；如需再次导入，请明确选择再次导入"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Legacy configuration has already been imported. Choose to import again to repeat the import."
+          }
+        }
+      }
+    },
+    "SIP-008 文件写入失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SIP-008 文件写入失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to write the SIP-008 file"
+          }
+        }
+      }
+    },
+    "SIP-008 文档生成失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SIP-008 文档生成失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to create the SIP-008 document"
+          }
+        }
+      }
+    },
+    "URI 链接列表文本文件写入失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "URI 链接列表文本文件写入失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to write the URI link list text file"
+          }
+        }
+      }
+    },
+    "macOS 防火墙已阻止 %@ 接受传入连接。请在系统设置中允许传入连接。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "macOS 防火墙已阻止 %@ 接受传入连接。请在系统设置中允许传入连接。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The macOS firewall has blocked %@ from accepting incoming connections. Allow incoming connections in System Settings."
+          }
+        }
+      }
+    },
+    "不可用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "不可用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unavailable"
+          }
+        }
+      }
+    },
+    "不是 ss:// 链接": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "不是 ss:// 链接"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Not an ss:// link"
+          }
+        }
+      }
+    },
+    "不能把分组移动进它自己的子树": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "不能把分组移动进它自己的子树"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "A group cannot be moved into its own subtree"
+          }
+        }
+      }
+    },
+    "不能把手动节点移入订阅子树": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "不能把手动节点移入订阅子树"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Manual nodes cannot be moved into a subscription tree"
+          }
+        }
+      }
+    },
+    "不能把订阅节点移入手动子树": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "不能把订阅节点移入手动子树"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscription nodes cannot be moved into a manual tree"
+          }
+        }
+      }
+    },
+    "二维码图片\nSIP008 JSON 文件\n包含 ss:// 链接的 txt 文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "二维码图片\nSIP008 JSON 文件\n包含 ss:// 链接的 txt 文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "QR code images\nSIP-008 JSON files\nText files containing ss:// links"
+          }
+        }
+      }
+    },
+    "二维码图片写入失败，请选择其他位置或重试": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "二维码图片写入失败，请选择其他位置或重试"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to save the QR code image. Choose another location or try again."
+          }
+        }
+      }
+    },
+    "从剪贴板中导入 ss:// 链接": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "从剪贴板中导入 ss:// 链接"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Import ss:// Links from Clipboard"
+          }
+        }
+      }
+    },
+    "从旧版本 ShadowsocksX-NG 导入": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "从旧版本 ShadowsocksX-NG 导入"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Import from Legacy ShadowsocksX-NG"
+          }
+        }
+      }
+    },
+    "代理后台服务管理失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "代理后台服务管理失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to manage the proxy background service"
+          }
+        }
+      }
+    },
+    "代理客户端未运行": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "代理客户端未运行"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy client not running"
+          }
+        }
+      }
+    },
+    "代理客户端运行中": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "代理客户端运行中"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy client running"
+          }
+        }
+      }
+    },
+    "代理客户端运行中（局域网受阻）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "代理客户端运行中（局域网受阻）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy client running (LAN blocked)"
+          }
+        }
+      }
+    },
+    "代理模式": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "代理模式"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy mode"
+          }
+        }
+      }
+    },
+    "代理状态": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "代理状态"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy status"
+          }
+        }
+      }
+    },
+    "代理路由模式": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "代理路由模式"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy routing mode"
+          }
+        }
+      }
+    },
+    "代理运行状态保存失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "代理运行状态保存失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to save proxy runtime state"
+          }
+        }
+      }
+    },
+    "以下网络接口尚未应用当前系统代理配置：": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "以下网络接口尚未应用当前系统代理配置："
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Current system proxy settings have not been applied to these network interfaces:"
+          }
+        }
+      }
+    },
+    "以下网络接口的代理配置仍有差异：": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "以下网络接口的代理配置仍有差异："
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy settings still differ on these network interfaces:"
+          }
+        }
+      }
+    },
+    "以下网络接口的代理配置已被改变：": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "以下网络接口的代理配置已被改变："
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy settings have changed on these network interfaces:"
+          }
+        }
+      }
+    },
+    "保存 SIP008 JSON 文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存 SIP008 JSON 文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Save SIP-008 JSON File"
+          }
+        }
+      }
+    },
+    "保存 URI 链接列表文本文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存 URI 链接列表文本文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Save URI Link List Text File"
+          }
+        }
+      }
+    },
+    "保存中…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存中…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Saving…"
+          }
+        }
+      }
+    },
+    "保存二维码图片": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存二维码图片"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Save QR Code Image"
+          }
+        }
+      }
+    },
+    "保存并刷新": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存并刷新"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Save and Refresh"
+          }
+        }
+      }
+    },
+    "保存的系统代理配置无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "保存的系统代理配置无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The saved system proxy configuration is invalid"
+          }
+        }
+      }
+    },
+    "修复": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "修复"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Repair"
+          }
+        }
+      }
+    },
+    "修复中": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "修复中"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Repairing"
+          }
+        }
+      }
+    },
+    "修复中…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "修复中…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Repairing…"
+          }
+        }
+      }
+    },
+    "修复失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "修复失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Repair failed"
+          }
+        }
+      }
+    },
+    "偏好文件损坏": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "偏好文件损坏"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The preferences file is corrupt"
+          }
+        }
+      }
+    },
+    "偏好文件读写失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "偏好文件读写失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read or write preferences"
+          }
+        }
+      }
+    },
+    "规则/全局模式需要可用的活动服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "规则/全局模式需要可用的活动服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rule/Global modes require an available active server"
+          }
+        }
+      }
+    },
+    "再次导入旧版本服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "再次导入旧版本服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Import Legacy Servers Again"
+          }
+        }
+      }
+    },
+    "凭据不存在": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "凭据不存在"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Credentials missing"
+          }
+        }
+      }
+    },
+    "凭据保存失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "凭据保存失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to save credentials"
+          }
+        }
+      }
+    },
+    "凭据回滚失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "凭据回滚失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Credential rollback failed"
+          }
+        }
+      }
+    },
+    "凭据操作失败：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "凭据操作失败：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Credential operation failed: %@"
+          }
+        }
+      }
+    },
+    "凭据读取失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "凭据读取失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read credentials"
+          }
+        }
+      }
+    },
+    "分享": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "分享"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Share"
+          }
+        }
+      }
+    },
+    "分组不存在（可能已被删除）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "分组不存在（可能已被删除）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The group does not exist (it may have been deleted)"
+          }
+        }
+      }
+    },
+    "分组中没有服务器配置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "分组中没有服务器配置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The group has no server configurations"
+          }
+        }
+      }
+    },
+    "创建": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "创建"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Create"
+          }
+        }
+      }
+    },
+    "删除「%@」？": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "删除「%@」？"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete “%@”?"
+          }
+        }
+      }
+    },
+    "删除分组「%@」及其整棵子树？": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "删除分组「%@」及其整棵子树？"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete group “%@” and its entire subtree?"
+          }
+        }
+      }
+    },
+    "删除订阅": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "删除订阅"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete Subscription"
+          }
+        }
+      }
+    },
+    "删除订阅「%@」及其整棵子树？": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "删除订阅「%@」及其整棵子树？"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete subscription “%@” and its entire subtree?"
+          }
+        }
+      }
+    },
+    "剪贴板": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "剪贴板"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Clipboard"
+          }
+        }
+      }
+    },
+    "剪贴板写入失败，请重试": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "剪贴板写入失败，请重试"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to write to the clipboard. Try again."
+          }
+        }
+      }
+    },
+    "加密方式": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "加密方式"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Encryption method"
+          }
+        }
+      }
+    },
+    "加密方式缺失或无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "加密方式缺失或无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The encryption method is missing or invalid"
+          }
+        }
+      }
+    },
+    "加密方式：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "加密方式：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Encryption method: %@"
+          }
+        }
+      }
+    },
+    "加密方法": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "加密方法"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Encryption method"
+          }
+        }
+      }
+    },
+    "加密方法不受支持": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "加密方法不受支持"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unsupported encryption method"
+          }
+        }
+      }
+    },
+    "包含 %lld 个存在已知阻塞问题的服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "包含 %lld 个存在已知阻塞问题的服务器"
+          }
+        },
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Contains %lld server with known blocking issues"
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Contains %lld servers with known blocking issues"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "参数类型": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "参数类型"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Parameter type"
+          }
+        }
+      }
+    },
+    "只追加到系统代理；应用固定绕过规则仍生效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "只追加到系统代理；应用固定绕过规则仍生效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Only added to the system proxy. The app's fixed bypass rules still apply."
+          }
+        }
+      }
+    },
+    "名称不能为空": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "名称不能为空"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The name must not be empty"
+          }
+        }
+      }
+    },
+    "后台代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "后台代理"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Background proxy"
+          }
+        }
+      }
+    },
+    "后台代理不可用，已清除系统代理配置。恢复后将自动应用。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "后台代理不可用，已清除系统代理配置。恢复后将自动应用。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The background proxy is unavailable. System proxy settings have been cleared and will be reapplied after recovery."
+          }
+        }
+      }
+    },
+    "后台代理不可用，系统代理配置未能清除。\n": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "后台代理不可用，系统代理配置未能清除。\n"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The background proxy is unavailable. Unable to clear system proxy settings.\n"
+          }
+        }
+      }
+    },
+    "启动失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "启动失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Startup failed"
+          }
+        }
+      }
+    },
+    "启动时后台运行，不显示主窗口；下次启动生效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "启动时后台运行，不显示主窗口；下次启动生效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Run in the background without opening the main window. Takes effect on next launch."
+          }
+        }
+      }
+    },
+    "启动菜单栏应用，不会自动开启代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "启动菜单栏应用，不会自动开启代理"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Launch the menu bar app without automatically enabling the proxy"
+          }
+        }
+      }
+    },
+    "命令地址已失效，请重新选择 IP。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "命令地址已失效，请重新选择 IP。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The command address is no longer available. Select an IP address again."
+          }
+        }
+      }
+    },
+    "响应无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "响应无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid response"
+          }
+        }
+      }
+    },
+    "图片无法识别，请使用常见图片格式": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "图片无法识别，请使用常见图片格式"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to recognize the image. Use a common image format."
+          }
+        }
+      }
+    },
+    "在左侧选择服务器或分组查看详情": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "在左侧选择服务器或分组查看详情"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Select a server or group on the left to view its details"
+          }
+        }
+      }
+    },
+    "在登录项中批准…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "在登录项中批准…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Approve in Login Items…"
+          }
+        }
+      }
+    },
+    "地址无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "地址无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid address"
+          }
+        }
+      }
+    },
+    "地址类型：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "地址类型：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Address type: %@"
+          }
+        }
+      }
+    },
+    "拷贝终端代理命令": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "拷贝终端代理命令"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Copy Terminal Proxy Commands"
+          }
+        }
+      }
+    },
+    "好": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "好"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "OK"
+          }
+        }
+      }
+    },
+    "密码不能为空": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "密码不能为空"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The password must not be empty"
+          }
+        }
+      }
+    },
+    "密码缺失或为空": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "密码缺失或为空"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The password is missing or empty"
+          }
+        }
+      }
+    },
+    "导入": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "导入"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Import"
+          }
+        }
+      }
+    },
+    "导入Shadowsocks服务器配置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "导入Shadowsocks服务器配置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Import Shadowsocks Server Configurations"
+          }
+        }
+      }
+    },
+    "导入的服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "导入的服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Imported Servers"
+          }
+        }
+      }
+    },
+    "导出为 SIP-008 JSON…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "导出为 SIP-008 JSON…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Export as SIP-008 JSON…"
+          }
+        }
+      }
+    },
+    "导出诊断…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "导出诊断…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Export Diagnostics…"
+          }
+        }
+      }
+    },
+    "将导入到：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "将导入到：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Import into: %@"
+          }
+        }
+      }
+    },
+    "将移除订阅源、固定分组与全部远端成员；若代理正走此订阅，代理会停止。此操作不可撤销。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "将移除订阅源、固定分组与全部远端成员；若代理正走此订阅，代理会停止。此操作不可撤销。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This removes the subscription, its group, and all remote members. If the proxy is using this subscription, it will stop. This cannot be undone."
+          }
+        }
+      }
+    },
+    "将递归删除 %lld 个节点（含其中的服务器与凭据），此操作不可撤销。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "将递归删除 %lld 个节点（含其中的服务器与凭据），此操作不可撤销。"
+          }
+        },
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "This will recursively delete %lld node, including its servers and credentials. This cannot be undone."
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "This will recursively delete %lld nodes, including their servers and credentials. This cannot be undone."
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "将递归删除 %lld 个节点，此操作不可撤销。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "将递归删除 %lld 个节点，此操作不可撤销。"
+          }
+        },
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "This will recursively delete %lld node. This cannot be undone."
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "This will recursively delete %lld nodes. This cannot be undone."
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "尚未激活任何服务器或分组，请先选择一个目标": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "尚未激活任何服务器或分组，请先选择一个目标"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No server or group is active. Select a target first."
+          }
+        }
+      }
+    },
+    "局域网 HTTP 代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "局域网 HTTP 代理"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "LAN HTTP proxy"
+          }
+        }
+      }
+    },
+    "局域网 SOCKS 代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "局域网 SOCKS 代理"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "LAN SOCKS proxy"
+          }
+        }
+      }
+    },
+    "局域网身份验证凭据无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "局域网身份验证凭据无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid LAN authentication credentials"
+          }
+        }
+      }
+    },
+    "局域网身份验证密码不可读": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "局域网身份验证密码不可读"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read the LAN authentication password"
+          }
+        }
+      }
+    },
+    "展开": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "展开"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Expand"
+          }
+        }
+      }
+    },
+    "已复制": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已复制"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Copied"
+          }
+        }
+      }
+    },
+    "已导入 %lld 台服务器到「%@」": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已导入 %lld 台服务器到「%@」"
+          }
+        },
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Imported %lld server into “%@”"
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Imported %lld servers into “%@”"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "已应用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已应用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Applied"
+          }
+        }
+      }
+    },
+    "已暂停": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已暂停"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Paused"
+          }
+        }
+      }
+    },
+    "已添加 %lld 台服务器；以下条目无法解析": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已添加 %lld 台服务器；以下条目无法解析"
+          }
+        },
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Added %lld server; the following entries could not be parsed"
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Added %lld servers; the following entries could not be parsed"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "已设置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已设置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Set"
+          }
+        }
+      }
+    },
+    "已请求应用系统代理，等待本地入口就绪；%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已请求应用系统代理，等待本地入口就绪；%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System proxy requested; waiting for local listeners; %@"
+          }
+        }
+      }
+    },
+    "常规": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "常规"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "General"
+          }
+        }
+      }
+    },
+    "应用中": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "应用中"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Applying"
+          }
+        }
+      }
+    },
+    "应用固定的 ACL 绕过规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "应用固定的 ACL 绕过规则"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Fixed ACL bypass rules"
+          }
+        }
+      }
+    },
+    "应用固定的系统代理例外": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "应用固定的系统代理例外"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Fixed system proxy exceptions"
+          }
+        }
+      }
+    },
+    "应用失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "应用失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Apply failed"
+          }
+        }
+      }
+    },
+    "应用系统代理配置时，还会固定开启“不包括简单主机名（Exclude simple hostnames）”。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "应用系统代理配置时，还会固定开启“不包括简单主机名（Exclude simple hostnames）”。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Applying system proxy settings also enables “Exclude simple hostnames”."
+          }
+        }
+      }
+    },
+    "建议空闲端口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "建议空闲端口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Suggest Free Port"
+          }
+        }
+      }
+    },
+    "开启后让 macOS 系统代理指向本地入口；%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "开启后让 macOS 系统代理指向本地入口；%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Point the macOS system proxy to local listeners when enabled; %@"
+          }
+        }
+      }
+    },
+    "当前 sslocal 不支持该加密方法": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "当前 sslocal 不支持该加密方法"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The bundled sslocal does not support this encryption method"
+          }
+        }
+      }
+    },
+    "当前代理正在使用此端口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "当前代理正在使用此端口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The current proxy is using this port"
+          }
+        }
+      }
+    },
+    "当前的身份验证实现无法可靠保护 UDP 中继。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "当前的身份验证实现无法可靠保护 UDP 中继。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The current authentication implementation cannot reliably protect UDP relay."
+          }
+        }
+      }
+    },
+    "当前端口已占用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "当前端口已占用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This port is occupied"
+          }
+        }
+      }
+    },
+    "当前系统代理配置与预期存在差异": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "当前系统代理配置与预期存在差异"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Current system proxy settings differ from the expected settings"
+          }
+        }
+      }
+    },
+    "当前网络位置没有可写入的网络服务": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "当前网络位置没有可写入的网络服务"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No writable network services in the current location"
+          }
+        }
+      }
+    },
+    "待应用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "待应用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Pending"
+          }
+        }
+      }
+    },
+    "待批准": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "待批准"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Awaiting approval"
+          }
+        }
+      }
+    },
+    "必须选择加密方法": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "必须选择加密方法"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Select an encryption method"
+          }
+        }
+      }
+    },
+    "所有系统代理流量通过本地 SOCKS 与 HTTP 入口转发，不使用规则分流。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "所有系统代理流量通过本地 SOCKS 与 HTTP 入口转发，不使用规则分流。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Forward all system proxy traffic through the local SOCKS and HTTP listeners without rule-based routing."
+          }
+        }
+      }
+    },
+    "所选节点不是分组": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "所选节点不是分组"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The selected node is not a group"
+          }
+        }
+      }
+    },
+    "打开主窗口…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "打开主窗口…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Open Main Window…"
+          }
+        }
+      }
+    },
+    "拖动文件到这里": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "拖动文件到这里"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Drop files here"
+          }
+        }
+      }
+    },
+    "拷贝 URI 链接": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "拷贝 URI 链接"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Copy URI Link"
+          }
+        }
+      }
+    },
+    "拷贝 URI 链接列表文本": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "拷贝 URI 链接列表文本"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Copy URI Link List Text"
+          }
+        }
+      }
+    },
+    "拷贝二维码图片": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "拷贝二维码图片"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Copy QR Code Image"
+          }
+        }
+      }
+    },
+    "按内置规则在代理与直连间选择；未匹配目标走默认动作。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "按内置规则在代理与直连间选择；未匹配目标走默认动作。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Choose proxy or direct using built-in rules. Unmatched targets use the default action."
+          }
+        }
+      }
+    },
+    "接口：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "接口：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Interface: %@"
+          }
+        }
+      }
+    },
+    "插件参数": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件参数"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin options"
+          }
+        }
+      }
+    },
+    "插件参数已配置（存于钥匙串，原样保留）。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件参数已配置（存于钥匙串，原样保留）。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin options are configured (stored in Keychain and preserved unchanged)."
+          }
+        }
+      }
+    },
+    "插件参数无法读取，无法导出 SIP-008 文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件参数无法读取，无法导出 SIP-008 文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read plugin options. The SIP-008 file cannot be exported."
+          }
+        }
+      }
+    },
+    "插件未提供": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件未提供"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin not provided"
+          }
+        }
+      }
+    },
+    "插件：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插件：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin: %@"
+          }
+        }
+      }
+    },
+    "插入位置超出范围": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "插入位置超出范围"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Insertion position is out of range"
+          }
+        }
+      }
+    },
+    "操作失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "操作失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Operation failed"
+          }
+        }
+      }
+    },
+    "操作失败，原因见下方": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "操作失败，原因见下方"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Operation failed. See the reason below."
+          }
+        }
+      }
+    },
+    "操作失败，请重试或检查设置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "操作失败，请重试或检查设置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Operation failed. Try again or check the settings."
+          }
+        }
+      }
+    },
+    "收起": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "收起"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Collapse"
+          }
+        }
+      }
+    },
+    "放弃更改": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "放弃更改"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Discard Changes"
+          }
+        }
+      }
+    },
+    "放弃更改？": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "放弃更改？"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Discard Changes?"
+          }
+        }
+      }
+    },
+    "文件无法读取": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "文件无法读取"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read the file"
+          }
+        }
+      }
+    },
+    "新建分组": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "新建分组"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "New Group"
+          }
+        }
+      }
+    },
+    "新建分组…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "新建分组…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "New Group…"
+          }
+        }
+      }
+    },
+    "新建服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "新建服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "New Server"
+          }
+        }
+      }
+    },
+    "无法修复系统代理配置：": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法修复系统代理配置："
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to repair system proxy settings: "
+          }
+        }
+      }
+    },
+    "无法写入网络服务的代理配置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法写入网络服务的代理配置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to write proxy settings for the network service"
+          }
+        }
+      }
+    },
+    "无法检查": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法检查"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to inspect"
+          }
+        }
+      }
+    },
+    "无法检查当前系统代理配置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法检查当前系统代理配置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to inspect current system proxy settings"
+          }
+        }
+      }
+    },
+    "无法解析 ss:// 链接": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法解析 ss:// 链接"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to parse the ss:// link"
+          }
+        }
+      }
+    },
+    "无法读取网络接口的代理配置：": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法读取网络接口的代理配置："
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read proxy settings for network interfaces: "
+          }
+        }
+      }
+    },
+    "无法读取网络服务的代理配置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法读取网络服务的代理配置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read proxy settings for the network service"
+          }
+        }
+      }
+    },
+    "日志来源": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "日志来源"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Log source"
+          }
+        }
+      }
+    },
+    "旧版本 ShadowsocksX-NG": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "旧版本 ShadowsocksX-NG"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Legacy ShadowsocksX-NG"
+          }
+        }
+      }
+    },
+    "显示密码": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "显示密码"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Show password"
+          }
+        }
+      }
+    },
+    "暂无 GUI 事件；开关代理或激活服务器后，运行事件会实时出现在这里。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "暂无 GUI 事件；开关代理或激活服务器后，运行事件会实时出现在这里。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No GUI events yet. Toggle the proxy or activate a server to see runtime events here."
+          }
+        }
+      }
+    },
+    "暂无服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "暂无服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No Servers"
+          }
+        }
+      }
+    },
+    "暂无运行日志；代理运行时（wrapper）启动后，它与 sslocal 的输出会收敛到 agent.log 并在此呈现。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "暂无运行日志；代理运行时（wrapper）启动后，它与 sslocal 的输出会收敛到 agent.log 并在此呈现。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No runtime log yet. After the proxy runtime (wrapper) starts, its output and sslocal output appear here from agent.log."
+          }
+        }
+      }
+    },
+    "有 %lld 台服务器因 UUID 缺失、无效、重复或冲突而生成了新身份。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "有 %lld 台服务器因 UUID 缺失、无效、重复或冲突而生成了新身份。"
+          }
+        },
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "%lld server received a new identity because its UUID was missing, invalid, duplicated, or conflicting."
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "%lld servers received new identities because their UUIDs were missing, invalid, duplicated, or conflicting."
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Servers"
+          }
+        }
+      }
+    },
+    "服务器不可用：%@（%@）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器不可用：%@（%@）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Server unavailable: %@ (%@)"
+          }
+        }
+      }
+    },
+    "服务器地址": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器地址"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Server address"
+          }
+        }
+      }
+    },
+    "服务器地址不能为空": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器地址不能为空"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server address must not be empty"
+          }
+        }
+      }
+    },
+    "服务器地址为空，无法导出 SIP-008 文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器地址为空，无法导出 SIP-008 文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server address is empty. The SIP-008 file cannot be exported."
+          }
+        }
+      }
+    },
+    "服务器地址缺失或无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器地址缺失或无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server address is missing or invalid"
+          }
+        }
+      }
+    },
+    "服务器存在已知阻塞问题": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器存在已知阻塞问题"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server has known blocking issues"
+          }
+        }
+      }
+    },
+    "服务器密码为空，无法导出 SIP-008 文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器密码为空，无法导出 SIP-008 文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server password is empty. The SIP-008 file cannot be exported."
+          }
+        }
+      }
+    },
+    "服务器密码无法读取，无法导出 SIP-008 文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器密码无法读取，无法导出 SIP-008 文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read the server password. The SIP-008 file cannot be exported."
+          }
+        }
+      }
+    },
+    "服务器已不存在，无法保存。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器已不存在，无法保存。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server no longer exists and cannot be saved."
+          }
+        }
+      }
+    },
+    "服务器端口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器端口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Server port"
+          }
+        }
+      }
+    },
+    "服务器端口无效，无法导出 SIP-008 文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器端口无效，无法导出 SIP-008 文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server port is invalid. The SIP-008 file cannot be exported."
+          }
+        }
+      }
+    },
+    "服务器端口缺失或无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器端口缺失或无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server port is missing or invalid"
+          }
+        }
+      }
+    },
+    "服务器缺少加密方式，无法导出 SIP-008 文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器缺少加密方式，无法导出 SIP-008 文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server has no encryption method. The SIP-008 file cannot be exported."
+          }
+        }
+      }
+    },
+    "服务器配置了插件参数但没有插件名称，无法导出 SIP-008 文件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务器配置了插件参数但没有插件名称，无法导出 SIP-008 文件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The server has plugin options but no plugin name. The SIP-008 file cannot be exported."
+          }
+        }
+      }
+    },
+    "服务管理失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "服务管理失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Service management failed"
+          }
+        }
+      }
+    },
+    "未匹配规则时": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未匹配规则时"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "When no rule matches"
+          }
+        }
+      }
+    },
+    "未命名分组": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未命名分组"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Untitled Group"
+          }
+        }
+      }
+    },
+    "未应用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未应用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Not applied"
+          }
+        }
+      }
+    },
+    "未激活": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未激活"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Inactive"
+          }
+        }
+      }
+    },
+    "未设置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未设置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Not set"
+          }
+        }
+      }
+    },
+    "未设置活动目标；在首页或服务器目录中激活": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未设置活动目标；在首页或服务器目录中激活"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No active target. Activate one on Home or in the server catalog."
+          }
+        }
+      }
+    },
+    "未识别到 ss:// 二维码": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未识别到 ss:// 二维码"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No ss:// QR code found"
+          }
+        }
+      }
+    },
+    "未选择节点": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未选择节点"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No Node Selected"
+          }
+        }
+      }
+    },
+    "本地 HTTP 代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本地 HTTP 代理"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Local HTTP proxy"
+          }
+        }
+      }
+    },
+    "本地 SOCKS5 代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本地 SOCKS5 代理"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Local SOCKS5 proxy"
+          }
+        }
+      }
+    },
+    "本地代理配置无法读取，已停止代理以避免静默改用出厂端口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本地代理配置无法读取，已停止代理以避免静默改用出厂端口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read local proxy settings. The proxy was stopped to prevent silently using factory ports."
+          }
+        }
+      }
+    },
+    "本版本未提供所选插件": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本版本未提供所选插件"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This version does not provide the selected plugin"
+          }
+        }
+      }
+    },
+    "格式：域名、主机名或 IP/CIDR，以逗号、顿号、空格或换行分隔。示例：127.0.0.1, 192.168.0.0/16, localhost。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "格式：域名、主机名或 IP/CIDR，以逗号、顿号、空格或换行分隔。示例：127.0.0.1, 192.168.0.0/16, localhost。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Format: domains, hostnames, IP addresses, or CIDR ranges separated by commas, spaces, or newlines. Example: 127.0.0.1, 192.168.0.0/16, localhost."
+          }
+        }
+      }
+    },
+    "模式：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "模式：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Mode: %@"
+          }
+        }
+      }
+    },
+    "正在修复系统代理配置…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "正在修复系统代理配置…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Repairing system proxy settings…"
+          }
+        }
+      }
+    },
+    "正在启动代理客户端…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "正在启动代理客户端…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Starting proxy client…"
+          }
+        }
+      }
+    },
+    "正在应用系统代理配置…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "正在应用系统代理配置…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Applying system proxy settings…"
+          }
+        }
+      }
+    },
+    "此操作不可撤销。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "此操作不可撤销。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This cannot be undone."
+          }
+        }
+      }
+    },
+    "没有发现可导入的 Legacy 配置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "没有发现可导入的 Legacy 配置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No importable Legacy configuration found"
+          }
+        }
+      }
+    },
+    "没有可导入的 ss:// 链接": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "没有可导入的 ss:// 链接"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No importable ss:// links found"
+          }
+        }
+      }
+    },
+    "没有可检查的网络位置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "没有可检查的网络位置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No network locations to inspect"
+          }
+        }
+      }
+    },
+    "没有当前网络位置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "没有当前网络位置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No current network location"
+          }
+        }
+      }
+    },
+    "活动目标": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "活动目标"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Active target"
+          }
+        }
+      }
+    },
+    "组内含活动目标": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "组内含活动目标"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Contains active target"
+          }
+        }
+      }
+    },
+    "活动目标不存在，已清除目标；本地监听不受影响": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "活动目标不存在，已清除目标；本地监听不受影响"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The active target no longer exists and has been cleared. Local listeners are unaffected."
+          }
+        }
+      }
+    },
+    "活动目标：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "活动目标：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Active target: %@"
+          }
+        }
+      }
+    },
+    "添加希望 macOS 系统代理跳过的主机名、域名或 IP/CIDR。留空并确定会清除用户添加的条目。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "添加希望 macOS 系统代理跳过的主机名、域名或 IP/CIDR。留空并确定会清除用户添加的条目。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter hostnames, domains, IP addresses, or CIDR ranges for the macOS system proxy to bypass. Leave empty and confirm to clear user-added entries."
+          }
+        }
+      }
+    },
+    "添加并刷新": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "添加并刷新"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Add and Refresh"
+          }
+        }
+      }
+    },
+    "清除失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "清除失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Clear failed"
+          }
+        }
+      }
+    },
+    "激活": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "激活"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Activate"
+          }
+        }
+      }
+    },
+    "状态无法确定": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "状态无法确定"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to determine status"
+          }
+        }
+      }
+    },
+    "用工具栏的「新建服务器」按钮手动录入，或用「导入」菜单导入": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "用工具栏的「新建服务器」按钮手动录入，或用「导入」菜单导入"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Use New Server in the toolbar to enter a server manually, or use Import to import servers"
+          }
+        }
+      }
+    },
+    "登录时启动 ShadowsocksX-NG2": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "登录时启动 ShadowsocksX-NG2"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Launch ShadowsocksX-NG2 at login"
+          }
+        }
+      }
+    },
+    "监听地址无法解析": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "监听地址无法解析"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to resolve the listener address"
+          }
+        }
+      }
+    },
+    "监听方式": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "监听方式"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Listen on"
+          }
+        }
+      }
+    },
+    "目录根": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "目录根"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Catalog root"
+          }
+        }
+      }
+    },
+    "目标位置不是分组": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "目标位置不是分组"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The destination is not a group"
+          }
+        }
+      }
+    },
+    "目标没有可激活的服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "目标没有可激活的服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The target has no servers eligible for activation"
+          }
+        }
+      }
+    },
+    "直连模式不依赖活动服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "直连模式不依赖活动服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Direct mode does not require an active server"
+          }
+        }
+      }
+    },
+    "直连模式无需选择活动目标": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "直连模式无需选择活动目标"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Direct mode does not require an active target"
+          }
+        }
+      }
+    },
+    "直连模式（无需服务器）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "直连模式（无需服务器）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Direct mode (no server required)"
+          }
+        }
+      }
+    },
+    "端口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "端口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Port"
+          }
+        }
+      }
+    },
+    "端口必须是 1–65535 之间的整数": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "端口必须是 1–65535 之间的整数"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The port must be an integer between 1 and 65535"
+          }
+        }
+      }
+    },
+    "端口无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "端口无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid port"
+          }
+        }
+      }
+    },
+    "端口范围为 1025–65535": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "端口范围为 1025–65535"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Port range: 1025–65535"
+          }
+        }
+      }
+    },
+    "第 %lld 条（%@）：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "第 %lld 条（%@）：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Record %lld (%@): %@"
+          }
+        }
+      }
+    },
+    "第 %lld 行：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "第 %lld 行：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Line %lld: %@"
+          }
+        }
+      }
+    },
+    "粘贴订阅地址（必须 HTTPS，返回 SIP-008 JSON；Content-Type 需为 application/json; charset=utf-8）。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "粘贴订阅地址（必须 HTTPS，返回 SIP-008 JSON；Content-Type 需为 application/json; charset=utf-8）。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Paste a subscription URL (HTTPS required, returning SIP-008 JSON with Content-Type: application/json; charset=utf-8)."
+          }
+        }
+      }
+    },
+    "系统代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System proxy"
+          }
+        }
+      }
+    },
+    "系统代理修复中": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理修复中"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Repairing system proxy"
+          }
+        }
+      }
+    },
+    "系统代理助手不可用；请确认已在登录项中允许": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理助手不可用；请确认已在登录项中允许"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The system proxy helper is unavailable. Allow it in Login Items."
+          }
+        }
+      }
+    },
+    "系统代理助手收到了无效请求": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理助手收到了无效请求"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The system proxy helper received an invalid request"
+          }
+        }
+      }
+    },
+    "系统代理助手等待批准。请在系统设置 → 登录项与扩展中允许。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理助手等待批准。请在系统设置 → 登录项与扩展中允许。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The system proxy helper is awaiting approval. Allow it in System Settings → Login Items & Extensions."
+          }
+        }
+      }
+    },
+    "系统代理已应用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理已应用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System proxy applied"
+          }
+        }
+      }
+    },
+    "系统代理已指向本地入口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理已指向本地入口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System proxy points to local listeners"
+          }
+        }
+      }
+    },
+    "系统代理应用中": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理应用中"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Applying system proxy"
+          }
+        }
+      }
+    },
+    "系统代理应用失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理应用失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to apply system proxy settings"
+          }
+        }
+      }
+    },
+    "系统代理待应用：等待代理就绪或可用出口": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理待应用：等待代理就绪或可用出口"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System proxy pending: waiting for the proxy or an available route"
+          }
+        }
+      }
+    },
+    "系统代理提交失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理提交失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to commit system proxy settings"
+          }
+        }
+      }
+    },
+    "系统代理未应用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理未应用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System proxy not applied"
+          }
+        }
+      }
+    },
+    "系统代理未能应用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理未能应用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to apply system proxy"
+          }
+        }
+      }
+    },
+    "系统代理设置": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理设置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System proxy settings"
+          }
+        }
+      }
+    },
+    "系统代理配置已改变": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理配置已改变"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System proxy settings changed"
+          }
+        }
+      }
+    },
+    "系统代理配置未能清除：": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理配置未能清除："
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to clear system proxy settings: "
+          }
+        }
+      }
+    },
+    "系统代理：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统代理：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System proxy: %@"
+          }
+        }
+      }
+    },
+    "系统网络配置不可用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统网络配置不可用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "System network configuration is unavailable"
+          }
+        }
+      }
+    },
+    "系统网络配置正被其他设置操作占用": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "系统网络配置正被其他设置操作占用"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Another settings operation is using the system network configuration"
+          }
+        }
+      }
+    },
+    "统计：导入 %lld 台，跳过 %lld 条，身份重生成 %lld 个。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "统计：导入 %lld 台，跳过 %lld 条，身份重生成 %lld 个。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Totals: %lld imported, %lld skipped, %lld identities regenerated."
+          }
+        }
+      }
+    },
+    "继续编辑": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "继续编辑"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Keep Editing"
+          }
+        }
+      }
+    },
+    "编辑 URL…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "编辑 URL…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Edit URL…"
+          }
+        }
+      }
+    },
+    "编辑并保存额外的系统代理例外": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "编辑并保存额外的系统代理例外"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Edit and save additional system proxy exceptions"
+          }
+        }
+      }
+    },
+    "编辑服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "编辑服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Edit Server"
+          }
+        }
+      }
+    },
+    "编辑订阅地址。订阅身份与固定分组全部保留；新地址刷新成功前保留最后一次成功内容。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "编辑订阅地址。订阅身份与固定分组全部保留；新地址刷新成功前保留最后一次成功内容。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Edit the subscription URL. The subscription identity and group are preserved. The last successful content is preserved until a refresh from the new URL succeeds."
+          }
+        }
+      }
+    },
+    "缺少加密方法": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "缺少加密方法"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Encryption method missing"
+          }
+        }
+      }
+    },
+    "缺少运行时文档": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "缺少运行时文档"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Runtime document missing"
+          }
+        }
+      }
+    },
+    "节点不存在（可能已被删除）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "节点不存在（可能已被删除）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The node does not exist (it may have been deleted)"
+          }
+        }
+      }
+    },
+    "节点身份冲突": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "节点身份冲突"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Node identity conflict"
+          }
+        }
+      }
+    },
+    "订阅不存在（可能已被删除）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅不存在（可能已被删除）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The subscription does not exist (it may have been deleted)"
+          }
+        }
+      }
+    },
+    "订阅内容不是合法的 SIP-008 JSON 文档": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅内容不是合法的 SIP-008 JSON 文档"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The subscription is not a valid SIP-008 JSON document"
+          }
+        }
+      }
+    },
+    "订阅凭据不存在": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅凭据不存在"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscription credentials are missing"
+          }
+        }
+      }
+    },
+    "订阅凭据写入失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅凭据写入失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to write subscription credentials"
+          }
+        }
+      }
+    },
+    "订阅凭据提交失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅凭据提交失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to commit subscription credentials"
+          }
+        }
+      }
+    },
+    "订阅凭据读取失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅凭据读取失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read subscription credentials"
+          }
+        }
+      }
+    },
+    "订阅刷新失败（旧版失败记录）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅刷新失败（旧版失败记录）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscription refresh failed (legacy failure record)"
+          }
+        }
+      }
+    },
+    "订阅包含重复的服务器身份": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅包含重复的服务器身份"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The subscription contains duplicate server identities"
+          }
+        }
+      }
+    },
+    "订阅响应类型不是 JSON": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅响应类型不是 JSON"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The subscription response is not JSON"
+          }
+        }
+      }
+    },
+    "订阅响应缺少 JSON Content-Type": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅响应缺少 JSON Content-Type"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The subscription response has no JSON Content-Type"
+          }
+        }
+      }
+    },
+    "订阅地址必须是 HTTPS": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅地址必须是 HTTPS"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The subscription URL must use HTTPS"
+          }
+        }
+      }
+    },
+    "订阅地址必须是有效的 HTTPS URL": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅地址必须是有效的 HTTPS URL"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter a valid HTTPS subscription URL"
+          }
+        }
+      }
+    },
+    "订阅地址无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅地址无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid subscription URL"
+          }
+        }
+      }
+    },
+    "订阅地址重定向到了非 HTTPS 站点，已拒绝": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅地址重定向到了非 HTTPS 站点，已拒绝"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The subscription redirected to a non-HTTPS site and was rejected"
+          }
+        }
+      }
+    },
+    "订阅安全连接失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅安全连接失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to establish a secure subscription connection"
+          }
+        }
+      }
+    },
+    "订阅快照保存失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅快照保存失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to save the subscription snapshot"
+          }
+        }
+      }
+    },
+    "订阅文档版本不受支持": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅文档版本不受支持"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unsupported subscription document version"
+          }
+        }
+      }
+    },
+    "订阅文档缺少 servers 列表": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅文档缺少 servers 列表"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The subscription document has no servers list"
+          }
+        }
+      }
+    },
+    "订阅服务器不能移出其订阅分组": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅服务器不能移出其订阅分组"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "A subscription server cannot be moved out of its subscription group"
+          }
+        }
+      }
+    },
+    "订阅服务器返回 HTTP %lld": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅服务器返回 HTTP %lld"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The subscription server returned HTTP %lld"
+          }
+        }
+      }
+    },
+    "订阅第 %lld 条服务器记录的%@无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅第 %lld 条服务器记录的%@无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid %2$@ in subscription server record %1$lld"
+          }
+        }
+      }
+    },
+    "订阅节点由远端管理：结构、连接字段与名称只读": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅节点由远端管理：结构、连接字段与名称只读"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscription nodes are managed remotely. Structure, connection fields, and names are read-only."
+          }
+        }
+      }
+    },
+    "订阅获取失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅获取失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to fetch the subscription"
+          }
+        }
+      }
+    },
+    "订阅获取超时": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅获取超时"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscription request timed out"
+          }
+        }
+      }
+    },
+    "订阅连接失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "订阅连接失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to connect to the subscription"
+          }
+        }
+      }
+    },
+    "记录不是字典": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "记录不是字典"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The record is not a dictionary"
+          }
+        }
+      }
+    },
+    "设置系统代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "设置系统代理"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Set system proxy"
+          }
+        }
+      }
+    },
+    "诊断导出只包含状态、存在性、权限和脱敏元数据，不包含密码、插件参数、订阅 URL 或运行时 JSON。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "诊断导出只包含状态、存在性、权限和脱敏元数据，不包含密码、插件参数、订阅 URL 或运行时 JSON。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Diagnostic exports contain only status, presence, permissions, and redacted metadata. They exclude passwords, plugin options, subscription URLs, and runtime JSON."
+          }
+        }
+      }
+    },
+    "诊断已导出": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "诊断已导出"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Diagnostics Exported"
+          }
+        }
+      }
+    },
+    "诊断报告写入失败，请选择其他位置或重试": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "诊断报告写入失败，请选择其他位置或重试"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to save the diagnostic report. Choose another location or try again."
+          }
+        }
+      }
+    },
+    "诊断报告无法安全构造，请重试": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "诊断报告无法安全构造，请重试"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to safely create the diagnostic report. Try again."
+          }
+        }
+      }
+    },
+    "该节点不是分组": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "该节点不是分组"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This node is not a group"
+          }
+        }
+      }
+    },
+    "该节点不是服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "该节点不是服务器"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This node is not a server"
+          }
+        }
+      }
+    },
+    "请在系统设置 → 登录项 → 允许在后台运行中批准 ShadowsocksX-NG2。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请在系统设置 → 登录项 → 允许在后台运行中批准 ShadowsocksX-NG2。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Approve ShadowsocksX-NG2 in System Settings → Login Items → Allow in the Background."
+          }
+        }
+      }
+    },
+    "请在系统设置的登录项中允许代理后台服务": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请在系统设置的登录项中允许代理后台服务"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Allow the proxy background service in Login Items in System Settings"
+          }
+        }
+      }
+    },
+    "请检查规则数据后再操作。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请检查规则数据后再操作。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Check the rule data before trying again."
+          }
+        }
+      }
+    },
+    "请重试规则操作。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请重试规则操作。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Try the rule operation again."
+          }
+        }
+      }
+    },
+    "身份": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "身份"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Identity"
+          }
+        }
+      }
+    },
+    "运行控制": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "运行控制"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Runtime controls"
+          }
+        }
+      }
+    },
+    "运行日志（wrapper）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "运行日志（wrapper）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Runtime log (wrapper)"
+          }
+        }
+      }
+    },
+    "运行时文件读写失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "运行时文件读写失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read or write runtime files"
+          }
+        }
+      }
+    },
+    "这些规则用于本机 SOCKS/HTTP 入站；上方输入只追加到系统代理例外，不会修改 ACL。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "这些规则用于本机 SOCKS/HTTP 入站；上方输入只追加到系统代理例外，不会修改 ACL。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "These rules apply to local SOCKS/HTTP listeners. The input above only adds system proxy exceptions and does not change the ACL."
+          }
+        }
+      }
+    },
+    "连接被拒绝": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "连接被拒绝"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Connection refused"
+          }
+        }
+      }
+    },
+    "连接超时": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "连接超时"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Connection timed out"
+          }
+        }
+      }
+    },
+    "退出 ShadowsocksX-NG2（代理仍在后台运行）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "退出 ShadowsocksX-NG2（代理仍在后台运行）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Quit ShadowsocksX-NG2 (Proxy Keeps Running)"
+          }
+        }
+      }
+    },
+    "通过本地 SOCKS 与 HTTP 入口直连，不使用 Shadowsocks 服务器。": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "通过本地 SOCKS 与 HTTP 入口直连，不使用 Shadowsocks 服务器。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Connect directly through the local SOCKS and HTTP listeners without using a Shadowsocks server."
+          }
+        }
+      }
+    },
+    "配置已改变": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "配置已改变"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Settings changed"
+          }
+        }
+      }
+    },
+    "配置目录结构不一致": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "配置目录结构不一致"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The configuration catalog structure is inconsistent"
+          }
+        }
+      }
+    },
+    "重命名…": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重命名…"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rename…"
+          }
+        }
+      }
+    },
+    "重新检查": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重新检查"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Check Again"
+          }
+        }
+      }
+    },
+    "重试清除": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重试清除"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Retry Clearing"
+          }
+        }
+      }
+    },
+    "钥匙串中的凭据不是文本": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "钥匙串中的凭据不是文本"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The Keychain credential is not text"
+          }
+        }
+      }
+    },
+    "钥匙串操作失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "钥匙串操作失败"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Keychain operation failed"
+          }
+        }
+      }
+    },
+    "隐藏密码": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "隐藏密码"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Hide password"
+          }
+        }
+      }
+    },
+    "静默启动": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "静默启动"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Silent launch"
+          }
+        }
+      }
+    },
+    "额外系统代理例外": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "额外系统代理例外"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Additional system proxy exceptions"
+          }
+        }
+      }
+    },
+    "首页": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "首页"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Home"
+          }
+        }
+      }
+    },
+    "代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "代理"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy"
+          }
+        }
+      }
+    },
+    "直连": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "直连"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Direct"
+          }
+        }
+      }
+    },
+    "用户名或密码无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "用户名或密码无效"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid username or password."
+          }
+        }
+      }
+    },
+    "第 %lld 条记录": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "第 %lld 条记录"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Record %lld"
+          }
+        }
+      }
+    },
+    "规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "规则"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rules"
+          }
+        }
+      }
+    },
+    "全局": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "全局"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Global"
+          }
+        }
+      }
+    },
+    "已停止": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已停止"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Stopped"
+          }
+        }
+      }
+    },
+    "启动中": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "启动中"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Starting"
+          }
+        }
+      }
+    },
+    "运行中": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "运行中"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Running"
+          }
+        }
+      }
+    },
+    "已被 macOS 应用防火墙拦截（主机地址态）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "已被 macOS 应用防火墙拦截（主机地址态）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Blocked by the macOS application firewall (host status)"
+          }
+        }
+      }
+    },
+    "启动失败（本地代理端点未就绪）": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "启动失败（本地代理端点未就绪）"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Startup failed (local proxy endpoint not ready)"
+          }
+        }
+      }
+    },
+    "激活失败：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "激活失败：%@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Activation failed: %@"
+          }
+        }
+      }
+    },
+    "等待在系统设置-登录项中批准": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "等待在系统设置-登录项中批准"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Awaiting approval in System Settings → Login Items"
+          }
+        }
+      }
+    },
+    "SOCKS %@，HTTP 代理 %@": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS %@，HTTP 代理 %@"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "SOCKS %@, HTTP proxy %@"
+          }
+        }
+      }
+    },
+    "%@ 端口 %@ 无效，必须是 1025–65535 之间的整数": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid %@ port %@. Enter an integer between 1025 and 65535."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@ 端口 %@ 无效，必须是 1025–65535 之间的整数"
+          }
+        }
+      }
+    },
+    "%@ 端口与 %@ 端口冲突（都是 %@），请为每个端点配置不同的端口": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The %@ and %@ ports conflict (both are %@). Assign a different port to each endpoint."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@ 端口与 %@ 端口冲突（都是 %@），请为每个端点配置不同的端口"
+          }
+        }
+      }
+    },
+    "本地代理 %@ 端点 %@:%@ 未就绪（%@）": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Local proxy %@ endpoint %@:%@ is not ready (%@)"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本地代理 %@ 端点 %@:%@ 未就绪（%@）"
+          }
+        }
+      }
+    },
+    "端口状态无法确定：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to determine port status: %@"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "端口状态无法确定：%@"
+          }
+        }
+      }
+    },
+    "当前端口已占用（%@）": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This port is occupied (%@)"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "当前端口已占用（%@）"
+          }
+        }
+      }
+    },
+    "%@：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@: %@"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@：%@"
+          }
+        }
+      }
+    },
+    "等待用户批准代理客户端后台运行": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "等待用户批准代理客户端后台运行"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Waiting for approval to run the proxy client in the background"
+          }
+        }
+      }
+    },
+    "运行后台代理客户端": {
+      "extractionState": "manual",
+      "comment": "首页运行控制卡片中用于启动或停止后台代理客户端的开关标题。",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "运行后台代理客户端"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Run background proxy client"
+          }
+        }
+      }
+    },
+    "无法读取监听配置": {
+      "extractionState": "manual",
+      "comment": "Startup alert title when proxy listening configuration cannot be loaded.",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法读取监听配置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to Read Listening Configuration"
+          }
+        }
+      }
+    },
+    "重置监听配置": {
+      "extractionState": "manual",
+      "comment": "The only startup recovery alert action. Confirms discarding proxy listening settings.",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重置监听配置"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Reset Listening Configuration"
+          }
+        }
+      }
+    },
+    "重置会丢弃原有监听配置，包括端口和局域网认证设置，并关闭局域网监听。服务器库和其他偏好设置保持不变。重置成功后应用才能继续启动。": {
+      "extractionState": "manual",
+      "comment": "Explains the scope and consequences before the user confirms resetting listening configuration.",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "重置会丢弃原有监听配置，包括端口和局域网认证设置，并关闭局域网监听。服务器库和其他偏好设置保持不变。重置成功后应用才能继续启动。"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Resetting discards the previous listening configuration, including ports and LAN authentication settings, and disables LAN listening. The server library and other preferences remain unchanged. The app can start only after the reset succeeds."
+          }
+        }
+      }
+    },
+    "无法访问监听配置主密钥": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "无法访问监听配置主密钥"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to access the listening configuration master key."
+          }
+        }
+      }
+    },
+    "监听配置无法解密或格式不受支持": {
+      "extractionState": "manual",
+      "localizations": {
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "监听配置无法解密或格式不受支持"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The listening configuration cannot be decrypted or its format is unsupported."
+          }
+        }
+      }
+    },
+    "本地代理配置无法读取，未应用新的代理配置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The local proxy configuration cannot be read. No new proxy configuration was applied."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "本地代理配置无法读取，未应用新的代理配置"
+          }
+        }
+      }
+    },
+    "中国大陆目标直连": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Direct for Mainland China"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "中国大陆目标直连"
+          }
+        }
+      }
+    },
+    "仅GFW列表内目标代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy GFWList Targets Only"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "仅GFW列表内目标代理"
+          }
+        }
+      }
+    },
+    "中国大陆目标代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy Mainland China Targets"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "中国大陆目标代理"
+          }
+        }
+      }
+    },
+    "规则方案": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rule Preset"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "规则方案"
+          }
+        }
+      }
+    },
+    "自动更新": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Automatic updates"
+          }
+        }
+      }
+    },
+    "设置来源": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Settings source"
+          }
+        }
+      }
+    },
+    "跟随供应商": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Follow provider"
+          }
+        }
+      }
+    },
+    "自定义": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Custom"
+          }
+        }
+      }
+    },
+    "启用自动更新": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enable automatic updates"
+          }
+        }
+      }
+    },
+    "更新间隔": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Update interval"
+          }
+        }
+      }
+    },
+    "供应商设置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Provider settings"
+          }
+        }
+      }
+    },
+    "供应商禁止覆盖自动更新设置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The provider does not allow overriding automatic update settings"
+          }
+        }
+      }
+    },
+    "版本信息不可用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Version information unavailable"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "版本信息不可用"
+          }
+        }
+      }
+    },
+    "关于 ShadowsocksX-NG2": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "About ShadowsocksX-NG2"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "关于 ShadowsocksX-NG2"
+          }
+        }
+      }
+    },
+    "第三方组件与许可证": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Third-Party Components and Licenses"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "第三方组件与许可证"
+          }
+        }
+      }
+    },
+    "第三方组件与许可证…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Third-Party Components and Licenses…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "第三方组件与许可证…"
+          }
+        }
+      }
+    },
+    "第三方组件信息不可用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Third-Party Component Information Unavailable"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "第三方组件信息不可用"
+          }
+        }
+      }
+    },
+    "组件": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Components"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "组件"
+          }
+        }
+      }
+    },
+    "版本": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Version"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "版本"
+          }
+        }
+      }
+    },
+    "项目": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Project"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "项目"
+          }
+        }
+      }
+    },
+    "源码来源": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Source Code"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "源码来源"
+          }
+        }
+      }
+    },
+    "分发来源": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Distribution"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "分发来源"
+          }
+        }
+      }
+    },
+    "许可证": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Licenses"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "许可证"
+          }
+        }
+      }
+    },
+    "附加声明": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Additional Notices"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "附加声明"
+          }
+        }
+      }
+    },
+    "引用的公共许可证": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Referenced Shared Licenses"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "引用的公共许可证"
+          }
+        }
+      }
+    }
+  },
+  "version": "1.0"
+}
diff --git a/ShadowsocksX-NG2/App/Resources/Rules.xcstrings b/ShadowsocksX-NG2/App/Resources/Rules.xcstrings
new file mode 100644
index 000000000..d5aa0b599
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Resources/Rules.xcstrings
@@ -0,0 +1,1291 @@
+{
+  "sourceLanguage": "zh-Hans",
+  "strings": {
+    "代理规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy Rules"
+          }
+        }
+      }
+    },
+    "全部规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "All Rules"
+          }
+        }
+      }
+    },
+    "自定义规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Custom Rules"
+          }
+        }
+      }
+    },
+    "固定本地策略": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Fixed Local Policy"
+          }
+        }
+      }
+    },
+    "搜索规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Search Rules"
+          }
+        }
+      }
+    },
+    "全部行动": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "All Actions"
+          }
+        }
+      }
+    },
+    "直连": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Direct"
+          }
+        }
+      }
+    },
+    "代理": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy"
+          }
+        }
+      }
+    },
+    "匹配内容": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Match"
+          }
+        }
+      }
+    },
+    "类型": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Type"
+          }
+        }
+      }
+    },
+    "行动": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Action"
+          }
+        }
+      }
+    },
+    "来源": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Sources"
+          }
+        }
+      }
+    },
+    "状态": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Status"
+          }
+        }
+      }
+    },
+    "集合不完整": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Incomplete Collection"
+          }
+        }
+      }
+    },
+    "没有符合条件的规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No Matching Rules"
+          }
+        }
+      }
+    },
+    "加载规则…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Loading Rules…"
+          }
+        }
+      }
+    },
+    "刷新": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Refresh"
+          }
+        }
+      }
+    },
+    "覆盖详情": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Coverage Details"
+          }
+        }
+      }
+    },
+    "被同行动规则覆盖": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Covered by Same-Action Rules"
+          }
+        }
+      }
+    },
+    "被相反行动规则遮蔽": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Shadowed by Opposite-Action Rules"
+          }
+        }
+      }
+    },
+    "部分重叠": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Partial Overlap"
+          }
+        }
+      }
+    },
+    "独立候选": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Independent Candidate"
+          }
+        }
+      }
+    },
+    "快照制作时的转换报告": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Conversion Report at Snapshot Creation"
+          }
+        }
+      }
+    },
+    "精确域名": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Exact Domain"
+          }
+        }
+      }
+    },
+    "域名后缀": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Domain Suffix"
+          }
+        }
+      }
+    },
+    "简单主机名": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Simple Hostname"
+          }
+        }
+      }
+    },
+    "固定策略优先，以下范围始终直连。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Fixed policy takes precedence; these targets always connect directly."
+          }
+        }
+      }
+    },
+    "覆盖分析仅描述当前规则集合，不表示运行时已生效。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Coverage analysis describes this rule collection; it does not indicate runtime activation."
+          }
+        }
+      }
+    },
+    "集合不完整时，覆盖解释仅基于已加载来源。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "When the collection is incomplete, coverage explanations use only loaded sources."
+          }
+        }
+      }
+    },
+    "已转换": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Converted"
+          }
+        }
+      }
+    },
+    "已吸收": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Absorbed"
+          }
+        }
+      }
+    },
+    "已跳过": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Skipped"
+          }
+        }
+      }
+    },
+    "已拒绝": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rejected"
+          }
+        }
+      }
+    },
+    "IP 同时命中两种行动时，直连优先。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Direct wins when an IP matches both actions."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "IP 同时命中两种行动时，直连优先。"
+          }
+        }
+      }
+    },
+    "其他命中规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Other matching rules"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "其他命中规则"
+          }
+        }
+      }
+    },
+    "决定结果的规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rules determining the result"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "决定结果的规则"
+          }
+        }
+      }
+    },
+    "固定本地策略优先。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Fixed local policy takes precedence."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "固定本地策略优先。"
+          }
+        }
+      }
+    },
+    "地址（域名、IP 或 URL）": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Address (domain, IP or URL)"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "地址（域名、IP 或 URL）"
+          }
+        }
+      }
+    },
+    "域名同时命中两种行动时，代理优先。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Proxy wins when a domain matches both actions."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "域名同时命中两种行动时，代理优先。"
+          }
+        }
+      }
+    },
+    "显示顺序不代表路由优先级。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Display order does not indicate routing priority."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "显示顺序不代表路由优先级。"
+          }
+        }
+      }
+    },
+    "未匹配规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No matching rule"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未匹配规则"
+          }
+        }
+      }
+    },
+    "未经 DNS 解析，未测试 IP 规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No DNS lookup was performed; IP rules were not tested."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未经 DNS 解析，未测试 IP 规则"
+          }
+        }
+      }
+    },
+    "测试": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Test"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "测试"
+          }
+        }
+      }
+    },
+    "测试中…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Testing…"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "测试中…"
+          }
+        }
+      }
+    },
+    "请输入有效的域名、IP 或带主机的 URL。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter a valid domain, IP or URL with a host."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "请输入有效的域名、IP 或带主机的 URL。"
+          }
+        }
+      }
+    },
+    "集合不完整，无法测试地址。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The collection is incomplete; address testing is unavailable."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "集合不完整，无法测试地址。"
+          }
+        }
+      }
+    },
+    "启用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enable"
+          }
+        }
+      }
+    },
+    "禁用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Disable"
+          }
+        }
+      }
+    },
+    "全部": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "All"
+          }
+        }
+      }
+    },
+    "已启用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enabled"
+          }
+        }
+      }
+    },
+    "已禁用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Disabled"
+          }
+        }
+      }
+    },
+    "无当前来源": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No current source"
+          }
+        }
+      }
+    },
+    "正在保存并应用…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Saving and applying…"
+          }
+        }
+      }
+    },
+    "恢复失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Recovery failed"
+          }
+        }
+      }
+    },
+    "已保存": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Saved"
+          }
+        }
+      }
+    },
+    "保存失败": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Save failed"
+          }
+        }
+      }
+    },
+    "部署失败，已恢复": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Deployment failed; restored"
+          }
+        }
+      }
+    },
+    "版本已变化，请刷新后重试": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rules changed; refresh and retry"
+          }
+        }
+      }
+    },
+    "规则文档无效": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid rule document"
+          }
+        }
+      }
+    },
+    "正在更新规则…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Updating rules…"
+          }
+        }
+      }
+    },
+    "正在加载规则…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Loading rules…"
+          }
+        }
+      }
+    },
+    "已应用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Applied"
+          }
+        }
+      }
+    },
+    "无需重新应用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No runtime update needed"
+          }
+        }
+      }
+    },
+    "运行规则模式时应用": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Applies when running in Rules mode"
+          }
+        }
+      }
+    },
+    "保存失败，规则未更改": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Couldn't save; rules unchanged"
+          }
+        }
+      }
+    },
+    "应用失败，已恢复原规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Couldn't apply; previous rules restored"
+          }
+        }
+      }
+    },
+    "恢复失败，请检查运行状态": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Recovery failed; check runtime status"
+          }
+        }
+      }
+    },
+    "运行状态已变化，请检查当前状态": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Runtime state changed; check current status"
+          }
+        }
+      }
+    },
+    "规则已变化，请刷新后重试": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rules changed; refresh and try again"
+          }
+        }
+      }
+    },
+    "无法更新规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Couldn't update rules"
+          }
+        }
+      }
+    },
+    "查看详情": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "View Details"
+          }
+        }
+      }
+    },
+    "关闭": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Dismiss"
+          }
+        }
+      }
+    },
+    "刷新规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Refresh Rules"
+          }
+        }
+      }
+    },
+    "查看运行状态": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "View Runtime Status"
+          }
+        }
+      }
+    },
+    "已恢复原规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Previous rules restored"
+          }
+        }
+      }
+    },
+    "已启用 %lld 条规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Enabled %lld rule"
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Enabled %lld rules"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "已禁用 %lld 条规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "variations": {
+            "plural": {
+              "one": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Disabled %lld rule"
+                }
+              },
+              "other": {
+                "stringUnit": {
+                  "state": "translated",
+                  "value": "Disabled %lld rules"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "规则列表未更新，请刷新规则。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Couldn't update the rule list. Refresh rules."
+          }
+        }
+      }
+    },
+    "请重新执行启用或禁用操作。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Try enabling or disabling the rules again."
+          }
+        }
+      }
+    },
+    "请刷新规则，重新选择后再操作。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Refresh rules, then select the rules again."
+          }
+        }
+      }
+    },
+    "请在首页检查当前代理运行状态。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Check the current proxy runtime status on Home."
+          }
+        }
+      }
+    },
+    "请检查规则数据后再操作。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Check the rule data before trying again."
+          }
+        }
+      }
+    },
+    "新增规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Add Rule"
+          }
+        }
+      }
+    },
+    "编辑规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Edit Rule"
+          }
+        }
+      }
+    },
+    "IP 地址": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "IP Address"
+          }
+        }
+      }
+    },
+    "CIDR 范围": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "CIDR Range"
+          }
+        }
+      }
+    },
+    "规范化预览": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Normalized Preview"
+          }
+        }
+      }
+    },
+    "请输入有效的 IPv4 或 IPv6 地址。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter a valid IPv4 or IPv6 address."
+          }
+        }
+      }
+    },
+    "请输入有效的 IPv4 或 IPv6 CIDR 范围。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter a valid IPv4 or IPv6 CIDR range."
+          }
+        }
+      }
+    },
+    "请输入有效的 ASCII 域名；不支持通配符、URL 或路径。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enter a valid ASCII domain; wildcards, URLs, and paths are not supported."
+          }
+        }
+      }
+    },
+    "相同匹配条件和行动的自定义规则已存在。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "A custom rule with the same match and action already exists."
+          }
+        }
+      }
+    },
+    "代理规则与固定本地策略冲突，无法保存。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This proxy rule conflicts with the fixed local policy and cannot be saved."
+          }
+        }
+      }
+    },
+    "将与已有来源合并显示。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This rule will appear with its existing sources."
+          }
+        }
+      }
+    },
+    "此身份已禁用；保存不会重新启用。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This identity is disabled; saving will not enable it."
+          }
+        }
+      }
+    },
+    "新身份将继承禁用状态；旧禁用记录保留。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The new identity will remain disabled; the previous disabled record will be kept."
+          }
+        }
+      }
+    },
+    "覆盖关系仅解释已启用规则之间的关系，不代表当前流量行为。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Coverage describes relationships among enabled rules; it does not predict current traffic."
+          }
+        }
+      }
+    },
+    "规则集合已变化，请重新打开编辑器。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The rule collection has changed. Reopen the editor."
+          }
+        }
+      }
+    },
+    "已新增规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rule added"
+          }
+        }
+      }
+    },
+    "已编辑规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Rule edited"
+          }
+        }
+      }
+    },
+    "请重试规则操作。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Try the rule operation again."
+          }
+        }
+      }
+    },
+    "删除 %lld 条自定义规则？": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete %lld Custom Rules?"
+          }
+        }
+      }
+    },
+    "只删除所选自定义条目。其他来源的规则和已有禁用记录将保留。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Only the selected custom entries will be deleted. Rules from other sources and existing disablement records will be kept."
+          }
+        }
+      }
+    },
+    "删除": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete"
+          }
+        }
+      }
+    },
+    "删除规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Delete Rules"
+          }
+        }
+      }
+    },
+    "已删除 %lld 条自定义规则": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Deleted %lld Custom Rules"
+          }
+        }
+      }
+    },
+    "规则集合已变化，请重新确认删除。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The rule collection has changed. Confirm the deletion again."
+          }
+        }
+      }
+    },
+    "未命中规则，采用方案默认动作。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "No rule matched. Using the rule scheme’s default action."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "未命中规则，采用方案默认动作。"
+          }
+        }
+      }
+    }
+  },
+  "version": "1.0"
+}
diff --git a/ShadowsocksX-NG2/App/Resources/ServerDetails.xcstrings b/ShadowsocksX-NG2/App/Resources/ServerDetails.xcstrings
new file mode 100644
index 000000000..65daaaced
--- /dev/null
+++ b/ShadowsocksX-NG2/App/Resources/ServerDetails.xcstrings
@@ -0,0 +1,568 @@
+{
+  "sourceLanguage": "zh-Hans",
+  "strings": {
+    "激活成功": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Activation succeeded"
+          }
+        }
+      }
+    },
+    "信息": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Information"
+          }
+        }
+      }
+    },
+    "ID": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "ID"
+          }
+        }
+      }
+    },
+    "有效服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Valid servers"
+          }
+        }
+      }
+    },
+    "无效服务器": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Invalid servers"
+          }
+        }
+      }
+    },
+    "创建时间": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Created"
+          }
+        }
+      }
+    },
+    "修改时间": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Modified"
+          }
+        }
+      }
+    },
+    "连接信息": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Connection"
+          }
+        }
+      }
+    },
+    "插件参数": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin parameters"
+          }
+        }
+      }
+    },
+    "本地配置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Local configuration"
+          }
+        }
+      }
+    },
+    "订阅配置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscription configuration"
+          }
+        }
+      }
+    },
+    "本地": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Local"
+          }
+        }
+      }
+    },
+    "订阅": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscription"
+          }
+        }
+      }
+    },
+    "活动目标": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Active target"
+          }
+        }
+      }
+    },
+    "含活动目标": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Contains active target"
+          }
+        }
+      }
+    },
+    "开关": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Flag"
+          }
+        }
+      }
+    },
+    "空值": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Empty value"
+          }
+        }
+      }
+    },
+    "原始文本": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Raw text"
+          }
+        }
+      }
+    },
+    "无法读取插件参数": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unable to read plugin parameters"
+          }
+        }
+      }
+    },
+    "激活": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Activate"
+          }
+        }
+      }
+    },
+    "激活中…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Activating…"
+          }
+        }
+      }
+    },
+    "重新加载": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Reload"
+          }
+        }
+      }
+    },
+    "地址": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Address"
+          }
+        }
+      }
+    },
+    "端口": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Port"
+          }
+        }
+      }
+    },
+    "加密方式": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Encryption"
+          }
+        }
+      }
+    },
+    "插件": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Plugin"
+          }
+        }
+      }
+    },
+    "无": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "None"
+          }
+        }
+      }
+    },
+    "空分组，暂无子节点，不能激活。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This group is empty and cannot be activated."
+          }
+        }
+      }
+    },
+    "分组中没有可激活的有效服务器。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This group has no valid servers to activate."
+          }
+        }
+      }
+    },
+    "激活时将跳过 %lld 个存在已知阻塞问题的服务器。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Activation will skip %lld servers with known blocking issues."
+          }
+        }
+      }
+    },
+    "已跳过 %lld 个存在已知阻塞问题的服务器。": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Skipped %lld servers with known blocking issues."
+          }
+        }
+      }
+    },
+    "收藏": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Favorite"
+          }
+        }
+      }
+    },
+    "取消收藏": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Unfavorite"
+          }
+        }
+      }
+    },
+    "配置由远端管理，本地不能修改。": {
+      "extractionState": "manual",
+      "comment": "Second subtitle line for the root group of a subscription.",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Managed remotely; cannot be modified locally."
+          }
+        }
+      }
+    },
+    "最后更新时间": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Last Update"
+          }
+        }
+      }
+    },
+    "已用流量": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Used Data"
+          }
+        }
+      }
+    },
+    "剩余流量": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Remaining Data"
+          }
+        }
+      }
+    },
+    "到期时间": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Expiration"
+          }
+        }
+      }
+    },
+    "重置时间": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Traffic Reset"
+          }
+        }
+      }
+    },
+    "更新": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Update"
+          }
+        }
+      }
+    },
+    "更新中…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Updating…"
+          }
+        }
+      }
+    },
+    "正在更新订阅…": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Updating subscription…"
+          }
+        }
+      }
+    },
+    "订阅更新成功": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscription updated successfully"
+          }
+        }
+      }
+    },
+    "订阅更新失败：%@": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Subscription update failed: %@"
+          }
+        }
+      }
+    },
+    "关闭": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Off"
+          }
+        }
+      }
+    },
+    "每天": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Daily"
+          }
+        }
+      }
+    },
+    "每周": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Weekly"
+          }
+        }
+      }
+    },
+    "自动更新": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Automatic updates"
+          }
+        }
+      }
+    },
+    "配置限制": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Configuration restrictions"
+          }
+        }
+      }
+    },
+    "供应商禁止覆盖自动更新设置": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The provider does not allow overriding automatic update settings"
+          }
+        }
+      }
+    },
+    "下次更新时间": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Next update"
+          }
+        }
+      }
+    }
+  },
+  "version": "1.0"
+}
diff --git a/ShadowsocksX-NG2/App/UI/About/AboutView.swift b/ShadowsocksX-NG2/App/UI/About/AboutView.swift
new file mode 100644
index 000000000..e0d18b71b
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/About/AboutView.swift
@@ -0,0 +1,55 @@
+import AppKit
+import SwiftUI
+
+struct AboutCommands: Commands {
+  @Environment(\.openWindow) private var openWindow
+
+  var body: some Commands {
+    CommandGroup(replacing: .appInfo) {
+      Button("关于 ShadowsocksX-NG2") {
+        openWindow(id: AboutView.sceneID)
+      }
+    }
+  }
+}
+
+struct AboutView: View {
+  static let sceneID = "about"
+  @Environment(\.openWindow) private var openWindow
+
+  var body: some View {
+    VStack(spacing: 16) {
+      Image(nsImage: NSApplication.shared.applicationIconImage)
+        .resizable()
+        .frame(width: 96, height: 96)
+        .accessibilityHidden(true)
+      Text(
+        verbatim: Bundle.main.object(forInfoDictionaryKey: "CFBundleName") as? String
+          ?? "ShadowsocksX-NG2"
+      )
+      .font(.title2.bold())
+      HStack {
+        Text("版本")
+        Text(verbatim: version)
+      }
+      Text(
+        verbatim: Bundle.main.object(forInfoDictionaryKey: "NSHumanReadableCopyright") as? String
+          ?? ""
+      )
+      .font(.footnote)
+      .foregroundStyle(.secondary)
+      Button("第三方组件与许可证…") {
+        openWindow(id: ThirdPartyComponentsView.sceneID)
+      }
+    }
+    .textSelection(.enabled)
+    .padding(32)
+    .frame(width: 380)
+  }
+
+  private var version: String {
+    let version = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String
+    let build = Bundle.main.object(forInfoDictionaryKey: "CFBundleVersion") as? String
+    return [version, build.map { "(\($0))" }].compactMap { $0 }.joined(separator: " ")
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/About/ThirdPartyComponentsView.swift b/ShadowsocksX-NG2/App/UI/About/ThirdPartyComponentsView.swift
new file mode 100644
index 000000000..c098b8efa
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/About/ThirdPartyComponentsView.swift
@@ -0,0 +1,119 @@
+import SwiftUI
+
+struct ThirdPartyComponentsView: View {
+  static let sceneID = "third-party-components"
+  @State private var contents: ThirdPartyComponents?
+  @State private var failed = false
+
+  var body: some View {
+    Group {
+      if let contents {
+        ThirdPartyComponentsBrowser(contents: contents)
+      } else if failed {
+        ContentUnavailableView("第三方组件信息不可用", systemImage: "exclamationmark.triangle")
+      } else {
+        ProgressView()
+      }
+    }
+    .frame(minWidth: 760, minHeight: 460)
+    .task {
+      contents = nil
+      failed = false
+      do {
+        contents = try ThirdPartyComponents()
+      } catch {
+        failed = true
+      }
+    }
+  }
+}
+
+private struct ThirdPartyComponentsBrowser: View {
+  let contents: ThirdPartyComponents
+  @State private var selection: String?
+
+  var body: some View {
+    HSplitView {
+      List(contents.components, selection: $selection) { component in
+        VStack(alignment: .leading, spacing: 4) {
+          Text(verbatim: component.metadata.name)
+            .font(.headline)
+          Text(verbatim: component.metadata.version)
+            .font(.caption)
+            .foregroundStyle(.secondary)
+            .fixedSize(horizontal: false, vertical: true)
+        }
+        .padding(.vertical, 4)
+        .tag(component.id)
+      }
+      .accessibilityLabel("组件")
+      .frame(minWidth: 200, idealWidth: 240, maxWidth: 320)
+      if let component = contents.components.first(where: { $0.id == selection }) {
+        ThirdPartyComponentDetail(component: component)
+          .id(component.id)
+          .frame(minWidth: 440, maxWidth: .infinity, maxHeight: .infinity)
+      }
+    }
+    .onAppear {
+      if selection == nil { selection = contents.components.first?.id }
+    }
+  }
+}
+
+private struct ThirdPartyComponentDetail: View {
+  let component: ThirdPartyComponents.Component
+
+  var body: some View {
+    ScrollView {
+      VStack(alignment: .leading, spacing: 24) {
+        Text(verbatim: component.metadata.name)
+          .font(.title.bold())
+        VStack(alignment: .leading, spacing: 12) {
+          LabeledContent("版本") {
+            Text(verbatim: component.metadata.version)
+          }
+          sourceLink("项目", address: component.metadata.projectURL)
+          sourceLink("源码来源", address: component.metadata.sourceURL)
+          sourceLink("分发来源", address: component.metadata.distributionURL)
+        }
+        documents("许可证", component.licenses)
+        documents("附加声明", component.notices)
+        documents("引用的公共许可证", component.sharedLicenses)
+      }
+      .textSelection(.enabled)
+      .frame(maxWidth: .infinity, alignment: .leading)
+      .padding(24)
+    }
+  }
+
+  private func sourceLink(_ title: LocalizedStringKey, address: String) -> some View {
+    VStack(alignment: .leading, spacing: 4) {
+      Text(title).foregroundStyle(.secondary)
+      if let url = URL(string: address) {
+        Link(destination: url) {
+          Text(verbatim: address)
+            .multilineTextAlignment(.leading)
+        }
+      }
+    }
+  }
+
+  @ViewBuilder
+  private func documents(
+    _ title: LocalizedStringKey, _ documents: [ThirdPartyComponents.Document]
+  ) -> some View {
+    if !documents.isEmpty {
+      VStack(alignment: .leading, spacing: 16) {
+        Text(title).font(.title2.bold())
+        ForEach(documents) { document in
+          VStack(alignment: .leading, spacing: 8) {
+            Text(verbatim: document.name).font(.headline)
+            Text(verbatim: document.text)
+              .font(.system(.body, design: .monospaced))
+              .fixedSize(horizontal: false, vertical: true)
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsCommands.swift b/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsCommands.swift
new file mode 100644
index 000000000..6cbf961cc
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsCommands.swift
@@ -0,0 +1,15 @@
+import SwiftUI
+
+/// 应用名称菜单中的诊断窗口入口：与状态菜单入口同开唯一诊断窗口，
+/// 仅随 regular 形态的应用菜单栏出现（accessory 形态无此菜单栏）。
+struct DiagnosticsCommands: Commands {
+  @Environment(\.openWindow) private var openWindow
+
+  var body: some Commands {
+    CommandGroup(after: .appInfo) {
+      Button("诊断…") {
+        openWindow(id: DiagnosticsWindowState.sceneID)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsLogSplitView.swift b/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsLogSplitView.swift
new file mode 100644
index 000000000..aa764d790
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsLogSplitView.swift
@@ -0,0 +1,67 @@
+import AppKit
+import SwiftUI
+
+/// 原生分栏只设置一次初始宽度，后续更新保留用户拖动的位置。
+struct DiagnosticsLogSplitView<Logs: View, Details: View>: NSViewControllerRepresentable {
+  @ViewBuilder let logs: Logs
+  @ViewBuilder let details: Details
+
+  func makeNSViewController(context: Context) -> Controller {
+    Controller(logs: logs, details: details)
+  }
+
+  func updateNSViewController(_ controller: Controller, context: Context) {
+    controller.logs.rootView = logs
+    controller.details.rootView = details
+    // 离开 SwiftUI 的尺寸试算与更新事务后，按实际分栏宽度定位。
+    DispatchQueue.main.async { [weak controller] in
+      controller?.initializeWidth()
+    }
+  }
+
+  func sizeThatFits(
+    _ proposal: ProposedViewSize, nsViewController: Controller, context: Context
+  ) -> CGSize? {
+    proposal.replacingUnspecifiedDimensions(by: CGSize(width: 740, height: 300))
+  }
+
+  final class Controller: NSSplitViewController {
+    let logs: NSHostingController<Logs>
+    let details: NSHostingController<Details>
+    private var initializedWidth = false
+
+    init(logs: Logs, details: Details) {
+      self.logs = NSHostingController(rootView: logs)
+      self.details = NSHostingController(rootView: details)
+      super.init(nibName: nil, bundle: nil)
+    }
+
+    @available(*, unavailable)
+    required init?(coder: NSCoder) { fatalError("NSViewController 不走 storyboard 初始化") }
+
+    override func viewDidLoad() {
+      super.viewDidLoad()
+      splitView.isVertical = true
+      splitView.dividerStyle = .thin
+      let logItem = NSSplitViewItem(viewController: logs)
+      logItem.minimumThickness = 520
+      let detailItem = NSSplitViewItem(viewController: details)
+      detailItem.minimumThickness = 180
+      // 高于日志栏默认的 250、低于拖动的 490，窗口缩放优先调整日志栏。
+      detailItem.holdingPriority = NSLayoutConstraint.Priority(260)
+      addSplitViewItem(logItem)
+      addSplitViewItem(detailItem)
+    }
+
+    func initializeWidth() {
+      guard !initializedWidth, view.window != nil,
+        splitView.bounds.width >= 700 + splitView.dividerThickness
+      else { return }
+      initializedWidth = true
+      splitView.layoutSubtreeIfNeeded()
+      splitView.setPosition(
+        splitView.bounds.width - splitView.dividerThickness - 220, ofDividerAt: 0)
+      splitView.layoutSubtreeIfNeeded()
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsView.swift b/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsView.swift
new file mode 100644
index 000000000..5f6c7e485
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsView.swift
@@ -0,0 +1,248 @@
+import SwiftUI
+
+/// 独立诊断窗口：可筛选的日志表格与选中行详情。
+/// 日志只在查看器中呈现；诊断导出继续通过 DiagnosticsWorkflow 准备脱敏报告。
+struct DiagnosticsView: View {
+  @ObservedObject var diagnostics: DiagnosticsWorkflow
+  @ObservedObject var windowState: DiagnosticsWindowState
+  let clipboard: any TextClipboard
+  let exporter: any DiagnosticReportExporter
+
+  @State private var selection: Set<DiagnosticLogEntry.ID> = []
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 20) {
+      logCard
+      Text(
+        "诊断导出只包含状态、存在性、权限和脱敏元数据，不包含密码、插件参数、订阅 URL 或运行时 JSON。"
+      )
+      .font(.footnote)
+      .foregroundStyle(.secondary)
+    }
+    .frame(maxWidth: .infinity, alignment: .leading)
+    .padding(.leading, 28)
+    .padding(.trailing, 32)
+    .padding(.top, 24)
+    .padding(.bottom, 36)
+    .frame(minWidth: 800, minHeight: 520)
+    .background(DiagnosticsWindowAnchor(state: windowState).frame(width: 0, height: 0))
+    .task(id: windowState.isOpen) {
+      if windowState.isOpen { await diagnostics.readWhileActive() }
+    }
+    .presentingErrors(windowState.errors)
+    .toolbar {
+      ToolbarItem(placement: .primaryAction) {
+        Button("导出诊断…", systemImage: "square.and.arrow.up") {
+          exportDiagnostics()
+        }
+      }
+    }
+    .alert(
+      "诊断已导出",
+      isPresented: Binding(
+        get: { windowState.exportedDiagnosticsPath != nil },
+        set: { if !$0 { windowState.exportedDiagnosticsPath = nil } })
+    ) {
+      Button("好", role: .cancel) {}
+    } message: {
+      Text(windowState.exportedDiagnosticsPath ?? "")
+    }
+  }
+
+  /// 诊断导出：沿用 DiagnosticReportExportAction 既有入口；文件写
+  /// 入成功后才登记导出完成事件。
+  private func exportDiagnostics() {
+    switch DiagnosticReportExportAction(
+      diagnostics: diagnostics, exporter: exporter
+    ).perform()
+    {
+    case .preparationFailed(let failure):
+      windowState.errors.present(failure)
+    case .cancelled:
+      break
+    case .saved(let url):
+      diagnostics.noteExportCompleted()
+      windowState.exportedDiagnosticsPath = url.path
+    case .exportFailed(let failure):
+      windowState.errors.present(failure)
+    }
+  }
+
+  // MARK: - 日志卡
+
+  private var logCard: some View {
+    VStack(alignment: .leading, spacing: 0) {
+      HStack(spacing: 12) {
+        Picker("日志级别", selection: $windowState.filter.level) {
+          Text("全部").tag(DiagnosticLogFilter.Level.all)
+          Text("警告+错误").tag(DiagnosticLogFilter.Level.warnings)
+          Text("仅错误").tag(DiagnosticLogFilter.Level.errors)
+        }
+        .pickerStyle(.segmented)
+        .labelsHidden()
+        .fixedSize()
+        Picker("日志来源", selection: $windowState.filter.source) {
+          Text("全部").tag(DiagnosticLogFilter.Source.all)
+          Text("GUI").tag(DiagnosticLogFilter.Source.gui)
+          Text("wrapper").tag(DiagnosticLogFilter.Source.wrapper)
+          Text("sslocal").tag(DiagnosticLogFilter.Source.sslocal)
+        }
+        .pickerStyle(.segmented)
+        .labelsHidden()
+        .fixedSize()
+        Spacer(minLength: 12)
+      }
+      .padding(.horizontal, 16)
+      .padding(.vertical, 12)
+      Divider()
+      DiagnosticsLogSplitView {
+        logTable
+      } details: {
+        logDetails
+      }
+      .frame(minHeight: 300, maxHeight: .infinity)
+    }
+    .frame(maxWidth: .infinity, alignment: .leading)
+    .background(
+      .background.secondary,
+      in: RoundedRectangle(cornerRadius: 12, style: .continuous)
+    )
+    .overlay(
+      RoundedRectangle(cornerRadius: 12, style: .continuous)
+        .strokeBorder(.quaternary)
+    )
+  }
+
+  private var visibleRows: [DiagnosticLogEntry] {
+    diagnostics.logView.entries.filter { windowState.filter.admits($0.line) }
+  }
+
+  private var selectedRows: [DiagnosticLogEntry] {
+    visibleRows.filter { selection.contains($0.id) }
+  }
+
+  /// 空态提示：无过滤时提示如何产生日志；过滤后只提示过滤条件。
+  private var emptyMessage: String {
+    if windowState.filter == DiagnosticLogFilter() {
+      return String(
+        localized: "暂无日志；开关代理或激活服务器后，GUI 事件、wrapper 与 sslocal 的日志行会实时出现在这里。")
+    }
+    return String(localized: "当前过滤条件下没有日志行。")
+  }
+
+  private var logTable: some View {
+    let rows = visibleRows
+    let selected = selectedRows
+    return Table(rows, selection: $selection) {
+      TableColumn("时间") { row in
+        Text(row.tableTimestampText)
+          .help(row.timestampText)
+      }
+      .width(min: 90, ideal: 105)
+      TableColumn("日志级别") { row in
+        Text(row.line.level.rawValue)
+      }
+      .width(min: 60, ideal: 70)
+      TableColumn("分类") { row in
+        Text(row.sourceText)
+      }
+      .width(min: 60, ideal: 70)
+      TableColumn("消息") { row in
+        Text(row.line.text)
+      }
+      .width(min: 160, ideal: 520)
+    }
+    .font(.system(size: 11, design: .monospaced))
+    .lineLimit(1)
+    .truncationMode(.tail)
+    .onCopyCommand(
+      perform: selected.isEmpty
+        ? nil
+        : {
+          [
+            NSItemProvider(
+              object: selected.map(\.line.rendered).joined(separator: "\n") as NSString)
+          ]
+        }
+    )
+    .contextMenu(forSelectionType: DiagnosticLogEntry.ID.self) { ids in
+      Button("复制") {
+        copyToClipboard(
+          rows.filter { ids.contains($0.id) }.map(\.line.rendered).joined(separator: "\n"))
+      }
+      .disabled(ids.isEmpty)
+    }
+    .onChange(of: rows.map(\.id)) { _, ids in
+      selection.formIntersection(ids)
+    }
+    .overlay {
+      if rows.isEmpty {
+        Text(emptyMessage)
+          .font(.callout)
+          .foregroundStyle(.secondary)
+          .padding(16)
+          .allowsHitTesting(false)
+      }
+    }
+  }
+
+  private var logDetails: some View {
+    let selected = selectedRows
+    return ScrollView {
+      if selected.count == 1, let row = selected.first {
+        VStack(alignment: .leading, spacing: 12) {
+          LabeledContent("时间", value: row.timestampText)
+          LabeledContent("日志级别", value: row.line.level.rawValue)
+          LabeledContent("分类", value: row.sourceText)
+          Divider()
+          Text("消息")
+            .font(.headline)
+          Text(row.line.text)
+            .font(.system(size: 11, design: .monospaced))
+            .frame(maxWidth: .infinity, alignment: .leading)
+            .fixedSize(horizontal: false, vertical: true)
+        }
+        .textSelection(.enabled)
+        .padding(16)
+      } else {
+        Group {
+          if selected.isEmpty {
+            Text("选择日志查看详情")
+          } else {
+            Text("已选择 \(selected.count) 条日志")
+          }
+        }
+        .foregroundStyle(.secondary)
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .padding(16)
+      }
+    }
+  }
+
+  private func copyToClipboard(_ text: String) {
+    do {
+      try clipboard.write(text)
+    } catch {
+      windowState.errors.present(error)
+    }
+  }
+}
+
+extension DiagnosticLogEntry {
+  private static let tableTimestampFormatter: DateFormatter = {
+    let formatter = DateFormatter()
+    formatter.locale = Locale(identifier: "en_US_POSIX")
+    formatter.dateFormat = "HH:mm:ss.SSS"
+    return formatter
+  }()
+
+  var tableTimestampText: String {
+    line.timestamp.map { Self.tableTimestampFormatter.string(from: $0) } ?? "—"
+  }
+
+  var timestampText: String {
+    line.timestamp.map { LogLine.timestampFormatter.string(from: $0) } ?? "—"
+  }
+
+  var sourceText: String { line.source == .gui ? "GUI" : line.source.rawValue }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsWindowState.swift b/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsWindowState.swift
new file mode 100644
index 000000000..d504c356d
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Diagnostics/DiagnosticsWindowState.swift
@@ -0,0 +1,78 @@
+import AppKit
+import SwiftUI
+
+/// 进程内保留日志来源；轮询只跟随这一个窗口的真实开关状态。
+@MainActor
+final class DiagnosticsWindowState: ObservableObject {
+  static let sceneID = "diagnostics"
+
+  @Published private(set) var isOpen = false
+  @Published var filter = DiagnosticLogFilter()
+  @Published var exportedDiagnosticsPath: String?
+  let errors = ErrorAlertPresenter()
+  private weak var window: NSWindow?
+
+  init() {
+    let center = NotificationCenter.default
+    center.addObserver(
+      self, selector: #selector(windowPresented(_:)),
+      name: NSWindow.didBecomeKeyNotification, object: nil)
+    center.addObserver(
+      self, selector: #selector(windowPresented(_:)),
+      name: NSWindow.didChangeOcclusionStateNotification, object: nil)
+    center.addObserver(
+      self, selector: #selector(windowClosed(_:)),
+      name: NSWindow.willCloseNotification, object: nil)
+  }
+
+  deinit { NotificationCenter.default.removeObserver(self) }
+
+  func attach(to window: NSWindow) {
+    self.window = window
+    if window.isVisible { isOpen = true }
+  }
+
+  @objc private func windowPresented(_ notification: Notification) {
+    guard let candidate = notification.object as? NSWindow,
+      candidate === window, candidate.isVisible, !isOpen
+    else { return }
+    isOpen = true
+  }
+
+  @objc private func windowClosed(_ notification: Notification) {
+    guard let candidate = notification.object as? NSWindow, candidate === window else { return }
+    isOpen = false
+    exportedDiagnosticsPath = nil
+    errors.dismiss()
+  }
+}
+
+/// 只上交宿主窗口；不拥有窗口、不改变 delegate，也不把隐藏误当关闭。
+struct DiagnosticsWindowAnchor: NSViewRepresentable {
+  let state: DiagnosticsWindowState
+
+  func makeNSView(context: Context) -> AnchorView { AnchorView(state: state) }
+  func updateNSView(_ nsView: AnchorView, context: Context) {}
+
+  final class AnchorView: NSView {
+    private let state: DiagnosticsWindowState
+
+    init(state: DiagnosticsWindowState) {
+      self.state = state
+      super.init(frame: .zero)
+    }
+
+    @available(*, unavailable)
+    required init?(coder: NSCoder) { fatalError("NSView 不走 storyboard 初始化") }
+
+    override func viewDidMoveToWindow() {
+      super.viewDidMoveToWindow()
+      guard let window else { return }
+      // attach 发生于视图更新中；延迟发布，避免在 SwiftUI 更新中发布状态。
+      Task { @MainActor [weak self, weak window] in
+        guard let self, let window, self.window === window else { return }
+        state.attach(to: window)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Home/HomeComponents.swift b/ShadowsocksX-NG2/App/UI/Home/HomeComponents.swift
new file mode 100644
index 000000000..c6d0a74c8
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Home/HomeComponents.swift
@@ -0,0 +1,38 @@
+import SwiftUI
+
+/// 首页卡片容器：标题、副题、头部尾随内容与正文；圆角描边卡片供各分区复用。
+struct HomeCard<Trailing: View, Content: View>: View {
+  let title: String
+  let subtitle: String?
+  @ViewBuilder var trailing: () -> Trailing
+  @ViewBuilder var content: () -> Content
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 8) {
+      HStack(alignment: .firstTextBaseline) {
+        VStack(alignment: .leading, spacing: 2) {
+          Text(title)
+            .font(.title2.weight(.semibold))
+          if let subtitle {
+            Text(subtitle)
+              .font(.subheadline)
+              .foregroundStyle(.secondary)
+          }
+        }
+        Spacer(minLength: 16)
+        trailing()
+      }
+      content()
+    }
+    .padding(20)
+    .frame(maxWidth: .infinity, alignment: .leading)
+    .background(
+      .background.secondary,
+      in: RoundedRectangle(cornerRadius: 12, style: .continuous)
+    )
+    .overlay(
+      RoundedRectangle(cornerRadius: 12, style: .continuous)
+        .strokeBorder(.quaternary)
+    )
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Home/HomeTargetBrowser.swift b/ShadowsocksX-NG2/App/UI/Home/HomeTargetBrowser.swift
new file mode 100644
index 000000000..f8cc9bbc5
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Home/HomeTargetBrowser.swift
@@ -0,0 +1,95 @@
+import Combine
+import Foundation
+
+/// 首页专用的窗口浏览状态。只持久化模式与展开身份，选择及首次定位属于窗口会话。
+@MainActor
+final class HomeTargetBrowser: ObservableObject {
+  enum Mode: String { case all, favorites }
+
+  @Published private(set) var selection: NodeID?
+  @Published private(set) var expandedGroupIDs: Set<NodeID>
+  @Published private(set) var mode: Mode
+  private var enteredHome = false
+  private let defaults: UserDefaults
+  private static let expansionKey = "homeTarget.expandedGroups"
+  private static let modeKey = "homeTarget.mode"
+
+  init(defaults: UserDefaults = .standard) {
+    self.defaults = defaults
+    expandedGroupIDs = Set(
+      (defaults.stringArray(forKey: Self.expansionKey) ?? []).map { NodeID(rawValue: $0) })
+    mode = Mode(rawValue: defaults.string(forKey: Self.modeKey) ?? "") ?? .all
+  }
+
+  func rows(in tree: CatalogTreeSnapshot, favorites: [CatalogTreeNode]) -> [CatalogTreeRow] {
+    if mode == .favorites {
+      return favorites.map { CatalogTreeRow(node: $0, depth: 0) }
+    }
+    let groups = Set(tree.visibleRows(collapsed: []).filter(\.node.isGroup).map(\.id))
+    return tree.visibleRows(collapsed: groups.subtracting(expandedGroupIDs))
+  }
+
+  func select(_ id: NodeID?) { selection = id }
+
+  func reconcile(in tree: CatalogTreeSnapshot, favorites: [CatalogTreeNode]) {
+    let groups = Set(tree.visibleRows(collapsed: []).filter(\.node.isGroup).map(\.id))
+    expandedGroupIDs.formIntersection(groups)
+    persistExpansion()
+    clearHiddenSelection(in: tree, favorites: favorites)
+  }
+
+  func setMode(_ mode: Mode, in tree: CatalogTreeSnapshot, favorites: [CatalogTreeNode]) {
+    self.mode = mode
+    defaults.set(mode.rawValue, forKey: Self.modeKey)
+    clearHiddenSelection(in: tree, favorites: favorites)
+  }
+
+  func toggleGroup(_ id: NodeID, in tree: CatalogTreeSnapshot) {
+    guard let group = tree.node(withID: id), group.isGroup else { return }
+    if expandedGroupIDs.remove(id) == nil {
+      expandedGroupIDs.insert(id)
+    } else if let selection, selection != id, group.find(selection) != nil {
+      self.selection = id
+    }
+    persistExpansion()
+  }
+
+  /// 仅首次进入自动定位；返回滚动目标，后续切页不改变浏览位置。
+  @discardableResult
+  func enterHome(
+    current: NodeID?, in tree: CatalogTreeSnapshot, favorites: [CatalogTreeNode]
+  ) -> NodeID? {
+    guard !enteredHome else { return nil }
+    enteredHome = true
+    return locate(current, in: tree, favorites: favorites)
+  }
+
+  @discardableResult
+  func locate(
+    _ current: NodeID?, in tree: CatalogTreeSnapshot, favorites: [CatalogTreeNode]
+  ) -> NodeID? {
+    guard let current, tree.containsNode(current) else { return nil }
+    if mode == .favorites, !favorites.contains(where: { $0.id == current }) {
+      setMode(.all, in: tree, favorites: favorites)
+    }
+    selection = current
+    var parent = tree.node(withID: current)?.parentID
+    while let id = parent {
+      expandedGroupIDs.insert(id)
+      parent = tree.node(withID: id)?.parentID
+    }
+    persistExpansion()
+    return current
+  }
+
+  private func clearHiddenSelection(in tree: CatalogTreeSnapshot, favorites: [CatalogTreeNode]) {
+    if let selection, !rows(in: tree, favorites: favorites).contains(where: { $0.id == selection })
+    {
+      self.selection = nil
+    }
+  }
+
+  private func persistExpansion() {
+    defaults.set(expandedGroupIDs.map(\.rawValue).sorted(), forKey: Self.expansionKey)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Home/HomeTargetCard.swift b/ShadowsocksX-NG2/App/UI/Home/HomeTargetCard.swift
new file mode 100644
index 000000000..ac79c2307
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Home/HomeTargetCard.swift
@@ -0,0 +1,223 @@
+import SwiftUI
+
+/// 浏览操作留在首页，测试与激活始终经过两页共享的 module。
+struct HomeTargetCard: View {
+  @ObservedObject var workflow: CatalogWorkflow
+  @ObservedObject var browser: HomeTargetBrowser
+  @ObservedObject var activation: ActivationFeedbackState
+  let activeTargetID: NodeID?
+  let showServers: () -> Void
+  @State private var revealID: NodeID?
+  @State private var revealRevision = 0
+
+  private var rows: [CatalogTreeRow] {
+    browser.rows(in: workflow.tree, favorites: workflow.favorites)
+  }
+
+  /// 子树含活动目标的分组集合（空心闪电候选）。
+  private var activeAncestors: Set<NodeID> {
+    workflow.tree.ancestors(of: activeTargetID)
+  }
+
+  private var selected: CatalogTreeNode? {
+    browser.selection.flatMap { workflow.tree.node(withID: $0) }
+  }
+
+  var body: some View {
+    ScrollViewReader { proxy in
+      HomeCard(
+        title: activeName,
+        subtitle: activeTargetID.map { path(for: $0) },
+        trailing: {
+          Button(String(localized: "定位", table: "HomeTargets")) {
+            requestReveal(
+              browser.locate(activeTargetID, in: workflow.tree, favorites: workflow.favorites))
+          }
+          .disabled(activeTargetID == nil)
+        },
+        content: {
+          VStack(alignment: .leading, spacing: 12) {
+            toolbar
+            directory
+            Divider()
+            selectionSummary
+          }
+          .padding(.top, 14)
+        }
+      )
+      .disabled(activation.isPending)
+      .onAppear {
+        browser.reconcile(in: workflow.tree, favorites: workflow.favorites)
+        requestReveal(
+          browser.enterHome(
+            current: activeTargetID, in: workflow.tree, favorites: workflow.favorites))
+      }
+      .task(id: revealRevision) {
+        guard let revealID else { return }
+        await Task.yield()
+        guard !Task.isCancelled else { return }
+        proxy.scrollTo(revealID, anchor: .center)
+      }
+    }
+  }
+
+  private var activeName: String {
+    activeTargetID.flatMap { workflow.tree.node(withID: $0)?.name }
+      ?? String(localized: "未选择活动目标", table: "HomeTargets")
+  }
+
+  private var toolbar: some View {
+    HStack {
+      Picker(
+        String(localized: "目录视图", table: "HomeTargets"),
+        selection: Binding(
+          get: { browser.mode },
+          set: { browser.setMode($0, in: workflow.tree, favorites: workflow.favorites) })
+      ) {
+        Text(String(localized: "全部", table: "HomeTargets")).tag(HomeTargetBrowser.Mode.all)
+        Text(String(localized: "收藏", table: "HomeTargets")).tag(HomeTargetBrowser.Mode.favorites)
+      }
+      .pickerStyle(.segmented)
+      .labelsHidden()
+      Spacer(minLength: 0)
+    }
+    .frame(maxWidth: .infinity, alignment: .leading)
+  }
+
+  private var directory: some View {
+    VStack(spacing: 4) {
+      HStack {
+        Text(String(localized: "名称", table: "HomeTargets"))
+        Spacer()
+        Text(ConnectivityCopy.text("响应延迟"))
+      }
+      .font(.caption)
+      .foregroundStyle(.secondary)
+      .padding(.horizontal, 8)
+      if rows.isEmpty {
+        emptyDirectory
+      } else {
+        ScrollView {
+          LazyVStack(spacing: 0) {
+            ForEach(rows) { row in
+              HomeTargetRow(
+                row: row, workflow: workflow,
+                selected: browser.selection == row.id, active: activeTargetID == row.id,
+                containsActiveTarget: activeAncestors.contains(row.id),
+                expandable: browser.mode == .all && row.node.isGroup,
+                expanded: browser.expandedGroupIDs.contains(row.id),
+                path: path(for: row.id),
+                select: { browser.select(row.id) },
+                toggle: { browser.toggleGroup(row.id, in: workflow.tree) }
+              )
+              .id(row.id)
+            }
+          }
+        }
+        .frame(height: min(CGFloat(rows.count) * HomeTargetRow.height, 360))
+      }
+    }
+  }
+
+  private var emptyDirectory: some View {
+    VStack(alignment: .leading, spacing: 8) {
+      Text(
+        browser.mode == .all
+          ? String(localized: "目录为空，请到服务器页添加配置。", table: "HomeTargets")
+          : String(localized: "暂无收藏，请到服务器页收藏配置或分组。", table: "HomeTargets")
+      )
+      .foregroundStyle(.secondary)
+      Button(String(localized: "前往服务器页", table: "HomeTargets"), action: showServers)
+    }
+    .font(.callout)
+    .frame(maxWidth: .infinity, alignment: .leading)
+    .padding(.vertical, 12)
+  }
+
+  private var selectionSummary: some View {
+    HStack(alignment: .top, spacing: 4) {
+      VStack(alignment: .leading, spacing: 4) {
+        if let selected {
+          Text(selected.name).font(.callout.weight(.medium))
+            .lineLimit(1).help(path(for: selected.id))
+          Text(path(for: selected.id)).font(.caption).foregroundStyle(.secondary)
+            .lineLimit(2).help(path(for: selected.id))
+          if selected.isGroup, let eligibility = workflow.activationEligibility(for: selected.id) {
+            Text(
+              String(
+                localized:
+                  "可激活 \(eligibility.candidateCount) 个配置，将跳过 \(eligibility.skippedInvalidCount) 个已知无效配置。",
+                table: "HomeTargets")
+            )
+            .font(.caption).foregroundStyle(.secondary)
+          }
+        } else {
+          Text(String(localized: "请选择服务器或分组", table: "HomeTargets"))
+            .font(.callout).foregroundStyle(.secondary)
+        }
+      }
+      .frame(maxWidth: .infinity, alignment: .leading)
+      Spacer()
+      actions
+    }
+  }
+
+  private var actions: some View {
+    VStack(alignment: .trailing, spacing: 8) {
+      HStack(alignment: .center, spacing: 8) {
+        if let module = workflow.connectivity, let selected {
+          ConnectivityTestButton(module: module, node: selected)
+        } else {
+          Button(ConnectivityCopy.text("延迟测试")) {}.disabled(true)
+        }
+        Button(
+          activation.isPending
+            ? String(localized: "激活中…", table: "HomeTargets")
+            : String(localized: "激活", table: "HomeTargets"),
+          systemImage: "bolt.fill"
+        ) {
+          guard let selected else { return }
+          Task { @MainActor in
+            // 现有运行状态卡片呈现失败；这里不重复弹窗或增加内联错误。
+            _ = try? await activation.activate(selected.id, via: workflow)
+          }
+        }
+        .buttonStyle(.borderedProminent)
+        .disabled(activationDisabledReason != nil)
+        .help(activationDisabledReason ?? String(localized: "激活所选目标", table: "HomeTargets"))
+      }
+      Text(activationDisabledReason ?? "")
+        .font(.caption).foregroundStyle(.secondary)
+        .fixedSize(horizontal: false, vertical: true)
+    }
+  }
+
+  private var activationDisabledReason: String? {
+    if activation.isPending { return String(localized: "激活中…", table: "HomeTargets") }
+    guard let selected else { return String(localized: "尚未选择目标", table: "HomeTargets") }
+    if selected.id == activeTargetID { return String(localized: "当前项已激活", table: "HomeTargets") }
+    guard let eligibility = workflow.activationEligibility(for: selected.id),
+      eligibility.canActivate
+    else {
+      if selected.isGroup {
+        return String(localized: "分组中没有可激活的有效服务器。", table: "ServerDetails")
+      }
+      return selected.invalidReasons.first.map {
+        AppPresentation.message(for: ActivationFailure.invalidLeaf(node: selected.id, reason: $0))
+      } ?? String(localized: "配置不满足本地激活条件", table: "HomeTargets")
+    }
+    return nil
+  }
+
+  private func path(for id: NodeID) -> String {
+    guard let node = workflow.tree.node(withID: id) else { return "" }
+    let source = node.isManual ? String(localized: "本地") : String(localized: "订阅")
+    return ([source] + (workflow.tree.pathComponents(for: id) ?? [])).joined(separator: " / ")
+  }
+
+  private func requestReveal(_ id: NodeID?) {
+    guard let id else { return }
+    revealID = id
+    revealRevision += 1
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Home/HomeTargetRow.swift b/ShadowsocksX-NG2/App/UI/Home/HomeTargetRow.swift
new file mode 100644
index 000000000..e22fe6cf7
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Home/HomeTargetRow.swift
@@ -0,0 +1,76 @@
+import SwiftUI
+
+struct HomeTargetRow: View {
+  static let height: CGFloat = 34
+  let row: CatalogTreeRow
+  let workflow: CatalogWorkflow
+  let selected: Bool
+  let active: Bool
+  /// 子树含活动目标（严格后代）：空心闪电，与实心的"本行即活动目标"区分。
+  let containsActiveTarget: Bool
+  let expandable: Bool
+  let expanded: Bool
+  let path: String
+  let select: () -> Void
+  let toggle: () -> Void
+
+  var body: some View {
+    HStack(spacing: 0) {
+      if expandable {
+        Button(action: toggle) {
+          Image(systemName: expanded ? "chevron.down" : "chevron.right")
+            .font(.caption.weight(.semibold))
+            .frame(width: 22, height: Self.height)
+            .contentShape(Rectangle())
+        }
+        .buttonStyle(.plain)
+        .accessibilityLabel(
+          expanded
+            ? String(localized: "收起 \(row.node.name)", table: "HomeTargets")
+            : String(localized: "展开 \(row.node.name)", table: "HomeTargets"))
+      } else {
+        Color.clear.frame(width: 22)
+      }
+      Button(action: select) {
+        HStack(spacing: 6) {
+          Image(systemName: row.node.isGroup ? "folder" : "server.rack")
+          Text(row.node.name).lineLimit(1).truncationMode(.tail)
+          if active {
+            Image(systemName: "bolt.fill")
+              .foregroundStyle(
+                selected ? Color(nsColor: .alternateSelectedControlTextColor) : .orange
+              )
+              .help(String(localized: "活动目标"))
+          } else if containsActiveTarget {
+            Image(systemName: "bolt")
+              .foregroundStyle(
+                selected ? Color(nsColor: .alternateSelectedControlTextColor) : .orange
+              )
+              .help(String(localized: "组内含活动目标"))
+          }
+          Spacer(minLength: 4)
+          if let module = workflow.connectivity {
+            ConnectivityCell(module: module, node: row.node, workflow: workflow, selected: selected)
+              .monospacedDigit()
+              .frame(width: 130, alignment: .trailing)
+          }
+        }
+        .font(.callout)
+        .frame(maxWidth: .infinity)
+        .frame(height: Self.height)
+        .contentShape(Rectangle())
+      }
+      .buttonStyle(.plain)
+      .help(path)
+      .accessibilityAddTraits(selected ? .isSelected : [])
+    }
+    .padding(.leading, CGFloat(row.depth) * 16 + 2)
+    .padding(.trailing, 8)
+    .foregroundStyle(selected ? Color(nsColor: .alternateSelectedControlTextColor) : .primary)
+    .background(
+      selected ? Color(nsColor: .selectedContentBackgroundColor) : .clear,
+      in: RoundedRectangle(cornerRadius: 5)
+    )
+    .frame(height: Self.height)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Home/HomeView.swift b/ShadowsocksX-NG2/App/UI/Home/HomeView.swift
new file mode 100644
index 000000000..079f33685
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Home/HomeView.swift
@@ -0,0 +1,40 @@
+import SwiftUI
+
+/// 首页分区：代理模式切换、运行控制、终端代理环境变量命令。
+/// 模式与两个开关（agent/系统代理）走代理控制
+/// 工作流的整体 snapshot；运行控制卡的状态行走 statusDisplay 的瞬态门控
+/// 呈现；命令复制是 UI 副作用。三种模式（规则/全局/直连）
+/// 与规则子选项共用同一快照。
+struct HomeView: View {
+  @ObservedObject var workflow: CatalogWorkflow
+  @ObservedObject var control: ProxyControlWorkflow
+  let statusDisplay: StatusDisplayModel
+  let browser: HomeTargetBrowser
+  let activation: ActivationFeedbackState
+  let showServers: () -> Void
+  let clipboard: any TextClipboard
+  let errors: ErrorAlertPresenter
+
+  var body: some View {
+    ScrollView {
+      HStack(alignment: .top, spacing: 20) {
+        VStack(spacing: 16) {
+          HomeTargetCard(
+            workflow: workflow, browser: browser, activation: activation,
+            activeTargetID: control.snapshot.activeTarget?.id, showServers: showServers)
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        VStack(spacing: 16) {
+          RuntimeControlCard(control: control, statusDisplay: statusDisplay)
+          ModeCard(control: control)
+          TerminalProxyEnvironmentCard(control: control, clipboard: clipboard, errors: errors)
+        }
+        .frame(width: 400)
+      }
+      .padding(.leading, 28)
+      .padding(.trailing, 32)
+      .padding(.top, 24)
+      .padding(.bottom, 36)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Home/ModeCard.swift b/ShadowsocksX-NG2/App/UI/Home/ModeCard.swift
new file mode 100644
index 000000000..c7544e8cb
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Home/ModeCard.swift
@@ -0,0 +1,69 @@
+import SwiftUI
+
+/// 「代理模式」卡：可用模式切换（Domain 单点策略投影）+ 规则子选项 + 模式说明。
+struct ModeCard: View {
+  @ObservedObject var control: ProxyControlWorkflow
+
+  var body: some View {
+    HomeCard(
+      title: String(localized: "代理路由模式"),
+      subtitle: nil,
+      trailing: { EmptyView() },
+      content: {
+        VStack(alignment: .leading, spacing: 14) {
+          Picker("代理模式", selection: modeBinding) {
+            ForEach(control.snapshot.availableModes, id: \.self) { mode in
+              Text(mode.label).tag(mode)
+            }
+          }
+          .pickerStyle(.segmented)
+          .labelsHidden()
+          .frame(maxWidth: 480, alignment: .leading)
+          if control.snapshot.proxyMode == .rule {
+            HStack(spacing: 8) {
+              Text("规则方案")
+              Picker("规则方案", selection: rulePresetBinding) {
+                ForEach(RulePreset.allCases, id: \.self) { action in
+                  Text(action.label).tag(action)
+                }
+              }
+              .labelsHidden()
+              .frame(maxWidth: .infinity, alignment: .leading)
+            }
+          }
+          Text(modeDescription(control.snapshot.proxyMode))
+            .font(.callout)
+            .foregroundStyle(.secondary)
+            .fixedSize(horizontal: false, vertical: true)
+        }
+        .padding(.top, 6)
+      })
+  }
+
+  private var modeBinding: Binding<ProxyMode> {
+    Binding(
+      get: { control.snapshot.proxyMode },
+      set: { mode in
+        Task { await control.setProxyMode(mode) }
+      })
+  }
+
+  private var rulePresetBinding: Binding<RulePreset> {
+    Binding(
+      get: { control.snapshot.rulePreset },
+      set: { action in
+        Task { await control.setRulePreset(action) }
+      })
+  }
+
+  private func modeDescription(_ mode: ProxyMode) -> String {
+    switch mode {
+    case .rule:
+      String(localized: "按内置规则在代理与直连间选择；未匹配目标走默认动作。")
+    case .global:
+      String(localized: "所有系统代理流量通过本地 SOCKS 与 HTTP 入口转发，不使用规则分流。")
+    case .direct:
+      String(localized: "通过本地 SOCKS 与 HTTP 入口直连，不使用 Shadowsocks 服务器。")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Home/RuntimeControlCard.swift b/ShadowsocksX-NG2/App/UI/Home/RuntimeControlCard.swift
new file mode 100644
index 000000000..8c94154ae
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Home/RuntimeControlCard.swift
@@ -0,0 +1,149 @@
+import SwiftUI
+
+/// 「运行控制」卡：agent 与系统代理两个开关并排，绑定同一
+/// snapshot 的持久化意图；状态行经 StatusDisplayModel 的瞬态门控呈现——
+/// 快速切换模式这类瞬间成功的操作不再闪「应用中」等中间态。两个开关
+/// 互不代替：关闭系统代理清除全部系统代理配置，关闭 agent 会级联关闭仍开启
+/// 的系统代理意图并先清理再停止监听；helper 待批准时呈现登录项批准路径。
+struct RuntimeControlCard: View {
+  @ObservedObject var control: ProxyControlWorkflow
+  let statusDisplay: StatusDisplayModel
+
+  var body: some View {
+    HomeCard(
+      title: String(localized: "运行控制"),
+      subtitle: nil,
+      trailing: { EmptyView() },
+      content: {
+        VStack(alignment: .leading, spacing: 6) {
+          Toggle(isOn: agentBinding) {
+            Text("运行后台代理客户端")
+              .font(.title3)
+              .frame(maxWidth: .infinity, alignment: .leading)
+          }
+          .toggleStyle(.switch)
+          statusRow(statusDisplay.agent.row)
+          if let detail = statusDisplay.agent.detail {
+            Text(detail.text)
+              .font(.caption)
+              .foregroundStyle(.orange)
+              .fixedSize(horizontal: false, vertical: true)
+          }
+        }
+        Divider()
+        VStack(alignment: .leading, spacing: 6) {
+          Toggle(isOn: systemProxyBinding) {
+            Text("设置系统代理")
+              .font(.title3)
+              .frame(maxWidth: .infinity, alignment: .leading)
+          }
+          .toggleStyle(.switch)
+          statusRow(statusDisplay.systemProxy.row)
+          Text(statusDisplay.systemProxy.hint)
+            .font(.caption)
+            .foregroundStyle(.secondary)
+            .fixedSize(horizontal: false, vertical: true)
+          if systemProxyApprovalNeeded {
+            Button("在登录项中批准…") {
+              Task { await control.openSystemProxyHelperApproval() }
+            }
+            .controlSize(.small)
+          }
+          SystemProxyDifferenceView(control: control)
+          if let systemProxyDetail = statusDisplay.systemProxy.detail,
+            !statusDisplay.systemProxy.isPaused
+          {
+            Text(systemProxyDetail.text)
+              .font(.caption)
+              .foregroundStyle(.orange)
+              .fixedSize(horizontal: false, vertical: true)
+          }
+        }
+      })
+  }
+
+  private func statusRow(_ row: StatusCardModel.Row) -> some View {
+    HStack(spacing: 6) {
+      RuntimeStatusDot(tone: row.tone, diameter: 8)
+      Text(row.text)
+        .font(.body.weight(.medium))
+        .foregroundStyle(.secondary)
+        .lineLimit(1)
+    }
+  }
+
+  private var agentBinding: Binding<Bool> {
+    Binding(
+      get: { control.snapshot.agentIntentEnabled },
+      set: { enabled in Task { await control.setAgentEnabled(enabled) } })
+  }
+
+  private var systemProxyBinding: Binding<Bool> {
+    Binding(
+      get: { control.snapshot.systemProxyIntentEnabled },
+      set: { enabled in Task { await control.setSystemProxyEnabled(enabled) } })
+  }
+
+  private var systemProxyApprovalNeeded: Bool {
+    control.snapshot.systemProxyApprovalRequired
+  }
+}
+
+/// Names and commands come from current workflow facts; no configuration decisions in SwiftUI.
+private struct SystemProxyDifferenceView: View {
+  @ObservedObject var control: ProxyControlWorkflow
+
+  var body: some View {
+    let facts = control.snapshot.systemProxyInspection
+    VStack(alignment: .leading, spacing: 6) {
+      ForEach([SystemProxyDifference.Kind.changed, .notApplied, .remaining], id: \.self) { kind in
+        let names = facts.differences.filter { $0.kind == kind }.map(\.name)
+        if !names.isEmpty {
+          Label {
+            Text(differenceMessage(kind) + "\n" + names.joined(separator: "\n"))
+              .fixedSize(horizontal: false, vertical: true)
+          } icon: {
+            Image(systemName: "exclamationmark.triangle")
+          }
+          .font(.caption)
+          .foregroundStyle(.orange)
+        }
+      }
+      if control.snapshot.systemProxyApplication == .repairing {
+        HStack {
+          ProgressView().controlSize(.small)
+          Text("修复中…").font(.caption)
+        }
+      }
+      if let failure = facts.readFailure,
+        control.snapshot.systemProxyApplication != .unreadable(failure)
+      {
+        Text(
+          AppPresentation.systemProxyUnreadablePrefix
+            + AppPresentation.message(for: RuntimeFailureFacts.systemProxy(failure))
+        )
+        .font(.caption)
+        .foregroundStyle(.orange)
+        .fixedSize(horizontal: false, vertical: true)
+      }
+      if facts.canRepair {
+        Button("修复") { Task { await control.repairSystemProxy() } }
+      }
+      if facts.canRetryClear {
+        Button("重试清除") { Task { await control.retrySystemProxyClear() } }
+      }
+      if facts.readFailure != nil && !facts.isBusy {
+        Button("重新检查") { Task { await control.recheckSystemProxy() } }
+      }
+    }
+    .buttonStyle(.borderedProminent)
+  }
+
+  private func differenceMessage(_ kind: SystemProxyDifference.Kind) -> String {
+    switch kind {
+    case .changed: String(localized: "以下网络接口的代理配置已被改变：")
+    case .notApplied: String(localized: "以下网络接口尚未应用当前系统代理配置：")
+    case .remaining: String(localized: "以下网络接口的代理配置仍有差异：")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Home/TerminalProxyEnvironmentCard.swift b/ShadowsocksX-NG2/App/UI/Home/TerminalProxyEnvironmentCard.swift
new file mode 100644
index 000000000..aafa488cd
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Home/TerminalProxyEnvironmentCard.swift
@@ -0,0 +1,146 @@
+import SwiftUI
+
+/// 「拷贝终端代理命令」卡：按所选 shell 格式复制 HTTP 与 SOCKS 环境变量。
+/// 局域网开启时以单选下拉框选择命令地址，各种 shell
+/// 的全部代理端点共用该选择；局域网关闭时隐藏下拉框并使用本地入口。
+struct TerminalProxyEnvironmentCard: View {
+  @ObservedObject var control: ProxyControlWorkflow
+  let clipboard: any TextClipboard
+  let errors: ErrorAlertPresenter
+
+  @State private var copiedShell: TerminalCommandShell?
+  @State private var feedbackTask: Task<Void, Never>?
+
+  var body: some View {
+    HomeCard(
+      title: String(localized: "拷贝终端代理命令"),
+      subtitle: nil,
+      trailing: { EmptyView() },
+      content: {
+        VStack(spacing: 10) {
+          if control.snapshot.commandAddressPicker.isVisible {
+            // Menu（而非 Picker）：菜单项经 adaptive-controls 机制桥接，
+            // 两个 Text 映射为 NSMenuItem 的原生 title/subtitle；Picker 的
+            // 选项桥接会把多 Text 压平成独立菜单项。
+            Menu {
+              ForEach(
+                control.snapshot.commandAddressPicker.candidates, id: \.identity
+              ) { candidate in
+                Button {
+                  control.selectCommandAddress(candidate)
+                } label: {
+                  Text(candidate.address)
+                  Text(menuSubtitle(for: candidate))
+                }
+              }
+            } label: {
+              Text(control.snapshot.commandAddressPicker.selected.address)
+                .lineLimit(1)
+            }
+            .menuStyle(.borderedButton)
+            .frame(maxWidth: .infinity, alignment: .leading)
+            // 收起状态详情：接口名称与地址类型以说明行展示在按钮下方。
+            HStack(spacing: 4) {
+              Text("接口：\(control.snapshot.commandAddressPicker.selected.displayName)")
+                .font(.caption)
+                .foregroundStyle(.secondary)
+              if let annotation = control.snapshot.commandAddressPicker.selected.annotation {
+                Text("·")
+                  .font(.caption)
+                  .foregroundStyle(.secondary)
+                Text("地址类型：\(annotation)")
+                  .font(.caption)
+                  .foregroundStyle(.secondary)
+              }
+            }
+            .frame(maxWidth: .infinity, alignment: .leading)
+          }
+          if control.snapshot.terminalProxyEnvironmentCommands.failure != nil {
+            Text("局域网身份验证密码不可读，请重试。")
+              .font(.caption).foregroundStyle(.red)
+          }
+          ForEach(control.snapshot.terminalCommandShells, id: \.self) { shell in
+            commandButton(for: shell)
+          }
+        }
+        .padding(.top, 6)
+      }
+    )
+    .onAppear {
+      control.refreshTerminalCommands()
+    }
+    .onDisappear {
+      feedbackTask?.cancel()
+      feedbackTask = nil
+      copiedShell = nil
+    }
+  }
+
+  /// 菜单项副标题：接口名称 + IPv6 类型注记（ifconfig 同源），注记在前便于
+  /// 先辨认地址类型；无注记时仅接口名称。
+  private func menuSubtitle(for candidate: TerminalCommandAddress) -> String {
+    guard let annotation = candidate.annotation else { return candidate.displayName }
+    return "\(annotation) - \(candidate.displayName)"
+  }
+
+  private func commandButton(for shell: TerminalCommandShell) -> some View {
+    let isCopied = copiedShell == shell
+    let expectedAddress = control.snapshot.commandAddressPicker.selected.identity
+    return Button {
+      copy(shell, expectedAddress: expectedAddress)
+    } label: {
+      HStack(spacing: 10) {
+        Image(systemName: isCopied ? "checkmark" : "doc.on.doc")
+          .foregroundStyle(isCopied ? Color.green : Color.accentColor)
+        Text(isCopied ? String(localized: "已复制") : shell.title)
+          .font(.body.weight(.medium).monospaced())
+          .foregroundStyle(.primary)
+          .lineLimit(1)
+        Spacer(minLength: 0)
+      }
+      .padding(.horizontal, 12)
+      .padding(.vertical, 10)
+      .frame(maxWidth: .infinity, minHeight: 40, alignment: .leading)
+      .contentShape(Rectangle())
+    }
+    .buttonStyle(.plain)
+    .background(
+      .quaternary.opacity(0.5), in: RoundedRectangle(cornerRadius: 8, style: .continuous)
+    )
+    .disabled(control.snapshot.terminalProxyEnvironmentCommands.failure != nil)
+    .help(shell.command(from: control.snapshot.terminalProxyEnvironmentCommands))
+  }
+
+  private func copy(_ shell: TerminalCommandShell, expectedAddress: TerminalCommandAddressIdentity)
+  {
+    do {
+      let commands = try control.prepareTerminalCommandsForCopy(expectedAddress: expectedAddress)
+      try clipboard.write(shell.command(from: commands))
+      feedbackTask?.cancel()
+      copiedShell = shell
+      feedbackTask = Task { @MainActor in
+        try? await Task.sleep(nanoseconds: 1_500_000_000)
+        guard !Task.isCancelled, copiedShell == shell else { return }
+        copiedShell = nil
+        feedbackTask = nil
+      }
+    } catch {
+      feedbackTask?.cancel()
+      feedbackTask = nil
+      copiedShell = nil
+      errors.present(error)
+    }
+  }
+}
+
+extension TerminalCommandShell {
+  fileprivate var title: String {
+    switch self {
+    case .zshBash: "zsh / bash"
+    case .fish: "fish"
+    case .nushell: "Nushell"
+    case .windowsCMD: "Windows：CMD"
+    case .windowsPowerShell: "Windows：PowerShell"
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Rules/CustomRuleEditorSheet.swift b/ShadowsocksX-NG2/App/UI/Rules/CustomRuleEditorSheet.swift
new file mode 100644
index 000000000..c2d181c59
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Rules/CustomRuleEditorSheet.swift
@@ -0,0 +1,162 @@
+import SwiftUI
+
+/// The draft belongs to this presentation; only an explicit save enters the Workflow.
+struct CustomRuleEditorSheet: View {
+  @ObservedObject var workflow: RulesWorkflow
+  @Environment(\.dismiss) private var dismiss
+  @State private var draft: CustomRuleDraft
+  @State private var preview: CustomRulePreview?
+  @State private var isSaving = false
+  @State private var saveFailure: CustomRuleUpdateOutcome?
+
+  init(workflow: RulesWorkflow, draft: CustomRuleDraft) {
+    self.workflow = workflow
+    _draft = State(initialValue: draft)
+  }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 16) {
+      Text(RulesCopy.text(draft.editingID == nil ? "新增规则" : "编辑规则"))
+        .font(.title2)
+      Form {
+        VStack(alignment: .leading, spacing: 10) {
+          Picker(RulesCopy.text("类型"), selection: $draft.kind) {
+            ForEach(CustomRuleDraft.Kind.allCases, id: \.self) { kind in
+              Text(verbatim: kind.label).tag(kind)
+            }
+          }
+          .pickerStyle(.segmented)
+          TextField(RulesCopy.text("匹配内容"), text: $draft.content)
+            .autocorrectionDisabled()
+          LabeledContent(RulesCopy.text("行动")) {
+            Text(RulesCopy.text(draft.action == .proxy ? "代理" : "直连"))
+          }
+        }
+      }.disabled(isSaving || workflow.snapshot.isCommitting)
+      ScrollView {
+        VStack(alignment: .leading, spacing: 10) {
+          if let preview {
+            if let content = preview.displayContent {
+              LabeledContent(RulesCopy.text("规范化预览")) {
+                Text(verbatim: content).textSelection(.enabled)
+              }
+            }
+            if let failure = preview.failure {
+              Text(verbatim: failure.message).foregroundStyle(.orange)
+            } else if let row = preview.row {
+              if !row.sources.subtracting([.custom]).isEmpty {
+                Text(RulesCopy.text("将与已有来源合并显示。"))
+                Text(verbatim: row.sourceLabels).foregroundStyle(.secondary)
+              }
+              if preview.inheritsDisablement {
+                Text(RulesCopy.text("新身份将继承禁用状态；旧禁用记录保留。"))
+              } else if !row.isEnabled {
+                Text(RulesCopy.text("此身份已禁用；保存不会重新启用。"))
+              }
+              RulesRelationshipsContent(row: row)
+              Text(RulesCopy.text("覆盖关系仅解释已启用规则之间的关系，不代表当前流量行为。"))
+                .font(.caption).foregroundStyle(.secondary)
+            }
+          } else {
+            ProgressView().controlSize(.small)
+          }
+          if let saveFailure {
+            Label(saveFailure.rulesMessage, systemImage: "exclamationmark.triangle")
+              .foregroundStyle(.orange)
+            if let detail = saveFailure.failureDetail {
+              Text(verbatim: detail).textSelection(.enabled)
+            }
+            if let nextStep = saveFailure.nextStep { Text(RulesCopy.text(nextStep)) }
+          }
+        }.frame(maxWidth: .infinity, alignment: .leading)
+      }
+      // 预览区随内容伸缩，上限封顶，避免初始 ProgressView 阶段撑出大片空白、
+      // 长预览把 sheet 无限拉高。
+      .frame(maxHeight: 210)
+      HStack {
+        if isSaving || workflow.snapshot.isCommitting {
+          ProgressView().controlSize(.small)
+          Text(RulesCopy.text("正在更新规则…")).font(.caption)
+        }
+        Spacer()
+        Button("取消", role: .cancel) { dismiss() }
+          .keyboardShortcut(.cancelAction)
+          .disabled(isSaving || workflow.snapshot.isCommitting)
+        Button("保存") { save() }
+          .keyboardShortcut(.defaultAction)
+          .disabled(preview?.document == nil || isSaving || !workflow.snapshot.isComplete)
+      }
+    }
+    .onChange(of: draft) { _, _ in saveFailure = nil }
+    // 预览内容高度天然波动（失败提示一两行，合法预览可达上限），尺寸变化
+    // 只发生在合法↔失败、关系行增减这类语义边界；平缓过渡避免 sheet 跳动。
+    .animation(.snappy(duration: 0.2), value: preview)
+    .animation(.snappy(duration: 0.2), value: saveFailure)
+    .padding(20)
+    .frame(width: 530)
+    .interactiveDismissDisabled(isSaving || workflow.snapshot.isCommitting)
+    .task(
+      id: PreviewRequest(
+        draft: draft, version: workflow.snapshot.version, isComplete: workflow.snapshot.isComplete)
+    ) {
+      // 重算期间保留上一次预览：清空会让预览区塌缩成进度条，sheet 随
+      // 每个按键先缩后胀；新结果就绪后原位替换（旧任务由 task(id:) 取消）。
+      let result = await workflow.previewCustomRule(draft)
+      guard !Task.isCancelled else { return }
+      preview = result
+    }
+  }
+
+  private func save() {
+    guard !isSaving, workflow.snapshot.isComplete else { return }
+    isSaving = true
+    saveFailure = nil
+    Task {
+      let result = await workflow.saveCustomRule(draft)
+      isSaving = false
+      switch result {
+      case .unavailable(let failure): preview = CustomRulePreview(failure: failure)
+      case .committed(let outcome):
+        if outcome.isSuccess { dismiss() } else { saveFailure = outcome }
+      }
+    }
+  }
+
+  private struct PreviewRequest: Equatable {
+    let draft: CustomRuleDraft
+    let version: String
+    let isComplete: Bool
+  }
+}
+
+extension CustomRuleDraft.Kind {
+  var label: String {
+    switch self {
+    case .ipAddress: RulesCopy.text("IP 地址")
+    case .cidr: RulesCopy.text("CIDR 范围")
+    case .domainSuffix: RulesCopy.text("域名后缀")
+    case .domainExact: RulesCopy.text("精确域名")
+    }
+  }
+}
+
+extension CustomRulePreview.Failure {
+  var message: String {
+    switch self {
+    case .incompleteCollection: RulesCopy.text("集合不完整")
+    case .busy: RulesCopy.text("正在更新规则…")
+    case .staleDraft: RulesCopy.text("规则集合已变化，请重新打开编辑器。")
+    case .duplicate: RulesCopy.text("相同匹配条件和行动的自定义规则已存在。")
+    case .fixedPolicyDisablement:
+      RulesCopy.text("无法更新规则") + " · " + RulesCopy.text("固定策略优先，以下范围始终直连。")
+    case .fixedLocalConflict: RulesCopy.text("代理规则与固定本地策略冲突，无法保存。")
+    case .invalidInput(let kind):
+      switch kind {
+      case .ipAddress: RulesCopy.text("请输入有效的 IPv4 或 IPv6 地址。")
+      case .cidr: RulesCopy.text("请输入有效的 IPv4 或 IPv6 CIDR 范围。")
+      case .domainExact, .domainSuffix:
+        RulesCopy.text("请输入有效的 ASCII 域名；不支持通配符、URL 或路径。")
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Rules/RulesAddressTestView.swift b/ShadowsocksX-NG2/App/UI/Rules/RulesAddressTestView.swift
new file mode 100644
index 000000000..81198eaf5
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Rules/RulesAddressTestView.swift
@@ -0,0 +1,106 @@
+import SwiftUI
+
+struct RulesAddressTestView: View {
+  @ObservedObject var workflow: RulesWorkflow
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 8) {
+      HStack {
+        TextField(
+          RulesCopy.text("地址（域名、IP 或 URL）"),
+          text: Binding(
+            get: { workflow.snapshot.addressTest.target },
+            set: { workflow.setTestTarget($0) })
+        )
+        .textFieldStyle(.roundedBorder)
+        .autocorrectionDisabled()
+        .onSubmit { submit() }
+        Button(RulesCopy.text("测试")) { submit() }
+          .disabled(
+            workflow.snapshot.isLoading || workflow.snapshot.isCommitting
+              || workflow.snapshot.addressTest.isTesting)
+      }
+      if workflow.snapshot.addressTest.isTesting {
+        ProgressView(RulesCopy.text("测试中…")).controlSize(.small)
+      }
+      if let failure = workflow.snapshot.addressTest.failure {
+        Label(
+          RulesCopy.text(
+            failure == .invalidTarget
+              ? "请输入有效的域名、IP 或带主机的 URL。" : "集合不完整，无法测试地址。"),
+          systemImage: "exclamationmark.triangle")
+      }
+      if let result = workflow.snapshot.addressTest.result {
+        resultSummary(result)
+        ScrollView {
+          VStack(alignment: .leading, spacing: 6) {
+            evidence(result.deciding, title: "决定结果的规则", explanation: nil)
+            evidence(
+              result.otherMatches, title: "其他命中规则",
+              explanation: result.explanation == .fixedLocal
+                ? "固定本地策略优先。" : result.explanation.label)
+          }.frame(maxWidth: .infinity, alignment: .leading)
+        }.frame(maxHeight: 140)
+      }
+    }.padding()
+  }
+
+  private func submit() {
+    guard !workflow.snapshot.isLoading, !workflow.snapshot.isCommitting,
+      !workflow.snapshot.addressTest.isTesting
+    else { return }
+    Task { await workflow.testAddress() }
+  }
+
+  private func resultSummary(_ result: OfflineRuleMatcher.Result) -> some View {
+    VStack(alignment: .leading, spacing: 4) {
+      HStack {
+        Text(result.outcome.label).font(.headline)
+        Text(verbatim: result.target).textSelection(.enabled)
+      }
+      if result.domainWithoutDNS {
+        Text(RulesCopy.text("未经 DNS 解析，未测试 IP 规则")).font(.caption)
+      }
+      if let explanation = result.explanation.label {
+        Text(RulesCopy.text(explanation)).font(.caption)
+      }
+      Text(RulesCopy.text("显示顺序不代表路由优先级。"))
+        .font(.caption).foregroundStyle(.secondary)
+    }
+  }
+
+  @ViewBuilder
+  private func evidence(_ rows: [RulesRow], title: String, explanation: String?) -> some View {
+    if !rows.isEmpty {
+      Text(RulesCopy.text(title)).font(.subheadline.bold())
+      ForEach(rows) { row in
+        VStack(alignment: .leading, spacing: 2) {
+          Text(verbatim: "\(row.displayContent) · \(row.matchType) · \(row.actionLabel)")
+          Text(verbatim: row.sourceLabels).foregroundStyle(.secondary)
+          if let explanation { Text(RulesCopy.text(explanation)) }
+        }.font(.caption).textSelection(.enabled)
+      }
+    }
+  }
+}
+
+extension OfflineRuleMatcher.Outcome {
+  var label: String {
+    switch self {
+    case .proxy: RulesCopy.text("代理")
+    case .direct: RulesCopy.text("直连")
+    }
+  }
+}
+
+extension OfflineRuleMatcher.Explanation {
+  var label: String? {
+    switch self {
+    case .fixedLocal: "固定本地策略优先。"
+    case .domainProxy: "域名同时命中两种行动时，代理优先。"
+    case .ipDirect: "IP 同时命中两种行动时，直连优先。"
+    case .defaultAction: "未命中规则，采用方案默认动作。"
+    case .singleAction: nil
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Rules/RulesOperationStatusView.swift b/ShadowsocksX-NG2/App/UI/Rules/RulesOperationStatusView.swift
new file mode 100644
index 000000000..05eea10b4
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Rules/RulesOperationStatusView.swift
@@ -0,0 +1,105 @@
+import SwiftUI
+
+/// A reserved toolbar row keeps feedback from resizing or replacing the rule table.
+struct RulesOperationStatusView: View {
+  @ObservedObject var workflow: RulesWorkflow
+  @State private var showsDetails = false
+
+  var body: some View {
+    HStack(spacing: 8) {
+      Spacer(minLength: 0)
+      switch workflow.snapshot.operationStatus {
+      case .idle, .initialLoading:
+        EmptyView()
+      case .updating:
+        progress("正在更新规则…")
+      case .refreshing:
+        progress("正在加载规则…")
+      case .collectionIncomplete:
+        Label(RulesCopy.text("集合不完整"), systemImage: "exclamationmark.triangle")
+          .foregroundStyle(.orange)
+        detailsButton
+        refreshButton
+      case .feedback(let feedback):
+        Label {
+          Text(verbatim: feedback.summary).lineLimit(1).truncationMode(.middle)
+        } icon: {
+          Image(
+            systemName: feedback.outcome.isSuccess ? "checkmark.circle" : "exclamationmark.triangle"
+          )
+          .foregroundStyle(feedback.outcome.isSuccess ? Color.secondary : Color.orange)
+        }
+        .help(feedback.summary)
+        if !feedback.outcome.isSuccess {
+          detailsButton
+          Button(RulesCopy.text("关闭"), systemImage: "xmark") {
+            workflow.dismissFeedback()
+          }.labelStyle(.iconOnly)
+        }
+      }
+    }
+    .font(.caption)
+    .controlSize(.small)
+    .frame(maxWidth: .infinity, minHeight: 22, maxHeight: 22)
+    .onChange(of: workflow.snapshot.operationStatus) { _, _ in showsDetails = false }
+  }
+
+  private func progress(_ key: String) -> some View {
+    HStack(spacing: 6) {
+      ProgressView().controlSize(.mini)
+      Text(RulesCopy.text(key))
+    }.accessibilityElement(children: .combine)
+  }
+
+  private var detailsButton: some View {
+    Button(RulesCopy.text("查看详情")) { showsDetails = true }
+      .popover(isPresented: $showsDetails) { details }
+  }
+
+  private var refreshButton: some View {
+    Button(RulesCopy.text("刷新规则")) {
+      showsDetails = false
+      Task { await workflow.refresh(retryFailedSources: true) }
+    }
+  }
+
+  private var details: some View {
+    ScrollView {
+      VStack(alignment: .leading, spacing: 10) {
+        if let feedback = workflow.snapshot.commitFeedback {
+          Text(verbatim: feedback.summary).font(.headline)
+          if let detail = feedback.outcome.failureDetail {
+            Text(verbatim: detail).textSelection(.enabled)
+          }
+          if let nextStep = feedback.outcome.nextStep {
+            Text(RulesCopy.text(nextStep))
+          }
+        }
+        if !workflow.snapshot.issues.isEmpty {
+          Text(RulesCopy.text("规则列表未更新，请刷新规则。"))
+          RulesCollectionIssuesView(issues: workflow.snapshot.issues)
+        }
+      }.frame(maxWidth: .infinity, alignment: .leading).padding()
+    }.frame(width: 380).frame(maxHeight: 300)
+  }
+}
+
+struct RulesCollectionIssuesView: View {
+  let issues: [RulesPageSnapshot.Issue]
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 6) {
+      Text(RulesCopy.text("集合不完整时，覆盖解释仅基于已加载来源。"))
+      ForEach(issues, id: \.self) { issue in
+        Text(verbatim: description(issue)).textSelection(.enabled)
+      }
+    }.font(.caption)
+  }
+
+  private func description(_ issue: RulesPageSnapshot.Issue) -> String {
+    switch issue {
+    case .userDocument(let detail): "\(RulesCopy.text("自定义规则")): \(detail)"
+    case .builtin(let source, let detail): "\(source.label): \(detail)"
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Rules/RulesPresetView.swift b/ShadowsocksX-NG2/App/UI/Rules/RulesPresetView.swift
new file mode 100644
index 000000000..8efc082c7
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Rules/RulesPresetView.swift
@@ -0,0 +1,19 @@
+import SwiftUI
+
+struct RulesPresetView: View {
+  @ObservedObject var workspaces: RulesWorkspaces
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 0) {
+      Picker("规则方案", selection: $workspaces.selectedPreset) {
+        ForEach(RulePreset.allCases, id: \.self) { preset in
+          Text(preset.label).tag(preset)
+        }
+      }
+      .pickerStyle(.segmented)
+      .padding(.top)
+      .padding(.horizontal)
+      RulesView(workflow: workspaces.current).id(workspaces.selectedPreset)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Rules/RulesSourceDetailsView.swift b/ShadowsocksX-NG2/App/UI/Rules/RulesSourceDetailsView.swift
new file mode 100644
index 000000000..45effb74d
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Rules/RulesSourceDetailsView.swift
@@ -0,0 +1,64 @@
+import SwiftUI
+
+struct RulesSourceSummaryView: View {
+  let source: RulesSourceSnapshot
+  let openReport: () -> Void
+
+  var body: some View {
+    if let metadata = source.metadata {
+      VStack(alignment: .leading, spacing: 6) {
+        Text(verbatim: String(metadata.source.upstreamVersion.prefix(12)))
+          .help(metadata.source.upstreamVersion)
+        Text(verbatim: metadata.license)
+        if source.conversionReport != nil {
+          Button(RulesCopy.text("快照制作时的转换报告"), action: openReport)
+            .fixedSize(horizontal: false, vertical: true)
+        }
+      }
+      .font(.caption)
+      .frame(maxWidth: .infinity, alignment: .leading)
+      .textSelection(.enabled)
+    }
+  }
+}
+
+struct RulesReportView: View {
+  static let sceneID = "rules-conversion-report"
+  @ObservedObject var workflow: RulesWorkspaces
+
+  var body: some View {
+    ScrollView {
+      if let source = workflow.reportSource, let metadata = source.metadata {
+        VStack(alignment: .leading, spacing: 12) {
+          Text(verbatim: "\(source.id.label) · \(metadata.source.upstreamVersion)")
+          Text(verbatim: metadata.upstreamReference)
+          Text(verbatim: "\(metadata.license) · \(metadata.attribution)")
+          if let report = source.conversionReport {
+            Divider()
+            Text(verbatim: "\(RulesCopy.text("已转换")): \(report.convertedCount)")
+            Text(verbatim: "\(RulesCopy.text("已吸收")): \(report.absorbedCount)")
+            counts(report.skipped, label: RulesCopy.text("已跳过"))
+            counts(report.rejected, label: RulesCopy.text("已拒绝"))
+          }
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .padding()
+        .textSelection(.enabled)
+      }
+    }
+    .navigationTitle(
+      (workflow.reportSource?.id.label ?? "") + " · " + RulesCopy.text("快照制作时的转换报告")
+    )
+    .frame(minWidth: 480, minHeight: 320)
+  }
+
+  private func counts(_ values: [String: Int], label: String) -> some View {
+    VStack(alignment: .leading, spacing: 4) {
+      Text(verbatim: label)
+      ForEach(values.keys.sorted(), id: \.self) { key in
+        Text(verbatim: "\(key): \(values[key, default: 0])")
+      }
+      if values.isEmpty { Text(verbatim: "0") }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Rules/RulesView.swift b/ShadowsocksX-NG2/App/UI/Rules/RulesView.swift
new file mode 100644
index 000000000..9d78939e7
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Rules/RulesView.swift
@@ -0,0 +1,384 @@
+import SwiftUI
+
+/// Browsing and offline testing go through the workflow.
+struct RulesView: View {
+  @ObservedObject var workflow: RulesWorkflow
+  @Environment(\.openWindow) private var openWindow
+  /// 规则编辑草稿与编辑 sheet 由本页自持：@State 生命周期绑定在 rules
+  /// destination 分支上，离开分区即丢弃（与壳级清稿等价）。
+  @State private var ruleDraft: CustomRuleDraft?
+  /// 删除确认由本页自持，工具栏按钮与右键菜单共用同一确认弹窗。
+  @State private var deletionConfirmation: CustomRuleDeletion?
+
+  var body: some View {
+    VStack(spacing: 0) {
+      RulesAddressTestView(workflow: workflow)
+      Divider()
+      HStack(spacing: 0) {
+        VStack(spacing: 0) {
+          sourceList
+          if let source = workflow.snapshot.sources.first(where: {
+            $0.id == workflow.snapshot.query.source && $0.metadata != nil
+          }) {
+            Divider()
+            RulesSourceSummaryView(source: source) {
+              if workflow.openSourceReport(source.id) {
+                openWindow(id: RulesReportView.sceneID)
+              }
+            }.padding(10)
+          }
+        }.frame(width: 180)
+        Divider()
+        VStack(spacing: 8) {
+          filters
+          ruleTable.overlay { emptyState }
+          if let row = workflow.selectedRelationshipRow {
+            Divider()
+            RulesRelationshipsView(row: row)
+              .frame(maxHeight: 180)
+          }
+        }.frame(minWidth: 400, maxWidth: .infinity)
+      }
+    }
+    .task {
+      if workflow.snapshot.version.isEmpty { await workflow.refresh() }
+    }
+    .toolbar {
+      ToolbarItem(placement: .primaryAction) {
+        Button(RulesCopy.text("新增规则"), systemImage: "plus") {
+          ruleDraft = workflow.makeCustomRuleDraft()
+        }
+        .disabled(!workflow.snapshot.isComplete)
+      }
+      ToolbarItem(placement: .primaryAction) {
+        Button(RulesCopy.text("删除规则"), systemImage: "trash") {
+          deletionConfirmation = workflow.prepareCustomRuleDeletion()
+        }
+        .disabled(!canDeleteSelection)
+      }
+    }
+    .sheet(item: $ruleDraft) { draft in
+      CustomRuleEditorSheet(workflow: workflow, draft: draft)
+    }
+    .alert(
+      countText("删除 %lld 条自定义规则？", deletionConfirmation?.customIDs.count ?? 0),
+      isPresented: Binding(
+        get: { deletionConfirmation != nil }, set: { if !$0 { deletionConfirmation = nil } }),
+      presenting: deletionConfirmation
+    ) { captured in
+      Button(RulesCopy.text("删除"), role: .destructive) {
+        deletionConfirmation = nil
+        Task { await workflow.deleteCustomRules(captured) }
+      }
+      Button(RulesCopy.text("取消"), role: .cancel) { deletionConfirmation = nil }
+    } message: { _ in
+      Text(RulesCopy.text("只删除所选自定义条目。其他来源的规则和已有禁用记录将保留。"))
+    }
+  }
+
+  @ViewBuilder
+  private var emptyState: some View {
+    if workflow.snapshot.operationStatus == .initialLoading {
+      ProgressView(RulesCopy.text("正在加载规则…"))
+    } else if workflow.snapshot.rows.isEmpty && !workflow.snapshot.isLoading {
+      if workflow.snapshot.issues.isEmpty {
+        ContentUnavailableView(
+          RulesCopy.text("没有符合条件的规则"), systemImage: "line.3.horizontal.decrease.circle")
+      } else {
+        VStack(spacing: 10) {
+          Label(RulesCopy.text("集合不完整"), systemImage: "exclamationmark.triangle")
+          RulesCollectionIssuesView(issues: workflow.snapshot.issues)
+          Button(RulesCopy.text("刷新规则")) {
+            Task { await workflow.refresh(retryFailedSources: true) }
+          }
+          .disabled(workflow.snapshot.isCommitting)
+        }.padding()
+      }
+    }
+  }
+
+  private var sourceList: some View {
+    List(selection: sourceBinding) {
+      ForEach([RulesSource.custom] + workflow.preset.sources + [.fixed]) { source in
+        HStack {
+          Text(source.label)
+          Spacer()
+          if let metadata = workflow.snapshot.sources.first(where: { $0.id == source }) {
+            Text(metadata.count, format: .number).foregroundStyle(.secondary)
+          } else if !workflow.snapshot.isLoading && !workflow.snapshot.version.isEmpty {
+            Image(systemName: "exclamationmark.triangle").foregroundStyle(.secondary)
+          }
+        }.tag(source)
+      }
+    }
+  }
+
+  private var filters: some View {
+    VStack(spacing: 8) {
+      HStack {
+        actionFilter
+          .fixedSize()
+        enabledFilter
+          .fixedSize()
+        RulesOperationStatusView(workflow: workflow)
+      }
+      .frame(maxWidth: .infinity, alignment: .leading)
+      TextField(
+        RulesCopy.text("搜索规则"),
+        text: Binding(
+          get: { workflow.snapshot.query.search },
+          set: { value in updateQuery { $0.search = value } })
+      )
+      .textFieldStyle(.roundedBorder)
+    }
+    .padding(8)
+  }
+
+  private var actionFilter: some View {
+    Picker(
+      RulesCopy.text("行动"),
+      selection: Binding(
+        get: { workflow.snapshot.query.action },
+        set: { value in updateQuery { $0.action = value } })
+    ) {
+      Text(RulesCopy.text("全部行动")).tag(Optional<RuleAction>.none)
+      Text(RulesCopy.text("直连")).tag(Optional(RuleAction.direct))
+      Text(RulesCopy.text("代理")).tag(Optional(RuleAction.proxy))
+    }
+    .pickerStyle(.segmented)
+    .labelsHidden()
+  }
+
+  private var enabledFilter: some View {
+    Picker(
+      RulesCopy.text("启用"),
+      selection: Binding(
+        get: { workflow.snapshot.query.enabled },
+        set: { value in updateQuery { $0.enabled = value } })
+    ) {
+      Text(RulesCopy.text("全部")).tag(Optional<Bool>.none)
+      Text(RulesCopy.text("已启用")).tag(Optional(true))
+      Text(RulesCopy.text("已禁用")).tag(Optional(false))
+    }
+    .pickerStyle(.segmented)
+    .labelsHidden()
+  }
+
+  private var ruleTable: some View {
+    Table(
+      workflow.snapshot.rows,
+      selection: Binding(
+        get: { workflow.snapshot.selection },
+        set: { ids in DispatchQueue.main.async { workflow.select(ids) } })
+    ) {
+      TableColumn(RulesCopy.text("启用")) { row in
+        Toggle(
+          RulesCopy.text("启用"),
+          isOn: Binding(
+            get: { row.isEnabled },
+            set: { enabled in
+              guard let identity = row.identity else { return }
+              Task { await workflow.setEnabled(enabled, identities: [identity]) }
+            })
+        )
+        .labelsHidden()
+        .disabled(row.isFixed || !workflow.snapshot.isComplete || workflow.snapshot.isCommitting)
+      }.width(45)
+      TableColumn(RulesCopy.text("匹配内容")) { row in Text(verbatim: row.displayContent) }
+        .width(min: 120, ideal: 170)
+      TableColumn(RulesCopy.text("类型")) { row in Text(verbatim: row.matchType) }
+        .width(min: 70, ideal: 80)
+      TableColumn(RulesCopy.text("行动")) { row in Text(row.actionLabel) }
+        .width(50)
+      TableColumn(RulesCopy.text("来源")) { row in Text(row.sourceLabels) }
+        .width(min: 75, ideal: 90)
+      TableColumn(RulesCopy.text("状态")) { row in Text(row.statusLabel) }
+        .width(min: 80, ideal: 110)
+      TableColumn("") { row in
+        if let id = row.customIDs.first {
+          Button(RulesCopy.text("编辑规则"), systemImage: "pencil") {
+            ruleDraft = workflow.makeCustomRuleDraft(editing: id)
+          }
+          .labelStyle(.iconOnly)
+          .help(RulesCopy.text("编辑规则"))
+          .disabled(!workflow.snapshot.isComplete)
+        }
+      }.width(30)
+    }.frame(minWidth: 0, maxWidth: .infinity)
+      .contextMenu {
+        ForEach([true, false], id: \.self) { enabled in
+          Button {
+            let identities = workflow.actionableSelection
+            Task { await workflow.setEnabled(enabled, identities: identities) }
+          } label: {
+            Text(
+              RulesCopy.text(enabled ? "启用" : "禁用") + " ("
+                + String(workflow.actionableSelection.count) + ")")
+          }
+          .disabled(
+            workflow.actionableSelection.isEmpty || !workflow.snapshot.isComplete
+              || workflow.snapshot.isCommitting)
+        }
+        if workflow.snapshot.query.source == .custom {
+          Divider()
+          Button(role: .destructive) {
+            deletionConfirmation = workflow.prepareCustomRuleDeletion()
+          } label: {
+            Text(
+              RulesCopy.text("删除") + " ("
+                + String(workflow.deletableSelection.count) + ")")
+          }
+          .disabled(!canDeleteSelection)
+        }
+      }
+  }
+
+  private var sourceBinding: Binding<RulesSource?> {
+    Binding(
+      get: {
+        workflow.snapshot.query.source ?? .custom
+      },
+      set: { choice in
+        guard let choice else { return }
+        updateQuery {
+          $0.source = choice
+        }
+      })
+  }
+
+  /// 删除只针对自定义条目：左侧须选“自定义规则”，且所选行含自定义规则、页完整。
+  private var canDeleteSelection: Bool {
+    workflow.snapshot.query.source == .custom && workflow.snapshot.isComplete
+      && !workflow.deletableSelection.isEmpty
+  }
+
+  private func countText(_ key: String, _ count: Int) -> String {
+    String.localizedStringWithFormat(RulesCopy.text(key), Int64(count))
+  }
+
+  // Native controls can write their bindings during a SwiftUI update. Publish
+  // after that pass, and merge each edit into the latest query so queued edits
+  // to different filters do not overwrite one another.
+  private func updateQuery(_ update: @escaping @MainActor (inout RulesQuery) -> Void) {
+    DispatchQueue.main.async {
+      var query = workflow.snapshot.query
+      update(&query)
+      workflow.query(query)
+    }
+  }
+
+}
+
+struct RulesRelationshipsView: View {
+  let row: RulesRow
+
+  var body: some View {
+    ScrollView { RulesRelationshipsContent(row: row).padding() }
+  }
+}
+
+struct RulesRelationshipsContent: View {
+  let row: RulesRow
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 10) {
+      ForEach([RuleRelationship.Kind.absorption, .shadowing], id: \.self) { kind in
+        let relationships = row.relationships.filter { $0.kind == kind }
+        let fixed = row.fixedCoverage.flatMap { coverage in
+          row.action == (kind == .absorption ? .direct : .proxy) ? coverage : nil
+        }
+        if !relationships.isEmpty || fixed != nil {
+          VStack(alignment: .leading, spacing: 4) {
+            Text(RulesCopy.text(kind == .absorption ? "被同行动规则覆盖" : "被相反行动规则遮蔽"))
+            ForEach(relationships, id: \.kind) { relationship in
+              let covering = relationship.covering.filter { identity in
+                !(identity.action == .direct
+                  && (fixed?.matches.contains(identity.match) ?? false))
+              }
+              if !covering.isEmpty && relationship.extent == .partial {
+                Text(RulesCopy.text("部分重叠"))
+              }
+              ForEach(covering, id: \.self) { identity in
+                Text(
+                  verbatim: identity.match.browsingContent + " · "
+                    + identity.match.browsingType + " · "
+                    + RulesCopy.text(identity.action == .direct ? "直连" : "代理"))
+              }
+            }
+            if let fixed {
+              Text(
+                RulesCopy.text("固定本地策略")
+                  + (fixed.extent == .partial ? " · " + RulesCopy.text("部分重叠") : ""))
+              ForEach(fixed.matches, id: \.self) { match in
+                Text(verbatim: match.browsingContent)
+              }
+              if fixed.includesSimpleHostname { Text(RulesCopy.text("简单主机名")) }
+            }
+          }
+        }
+      }
+    }
+    .frame(maxWidth: .infinity, alignment: .leading)
+    .textSelection(.enabled)
+  }
+}
+
+enum RulesCopy {
+  static func text(_ key: String) -> String {
+    NSLocalizedString(key, tableName: "Rules", bundle: .main, value: key, comment: "")
+  }
+}
+
+extension RulesSource {
+  var label: String {
+    switch self {
+    case .custom: RulesCopy.text("自定义规则")
+    case .fixed: RulesCopy.text("固定本地策略")
+    case .geolocationCN: "geolocation-cn"
+    case .chinaIPv4: "china-ipv4"
+    case .gfwlist: "GFWList"
+    }
+  }
+}
+
+extension RulesRow {
+  var displayContent: String { identity?.match.editingContent ?? RulesCopy.text("简单主机名") }
+  var sourceLabels: String {
+    guard hasCurrentSource else { return RulesCopy.text("无当前来源") }
+    return RulesSource.allCases.filter { sources.contains($0) }.map(\.label).joined(separator: ", ")
+  }
+  var actionLabel: String { RulesCopy.text(action == .direct ? "直连" : "代理") }
+  var matchType: String { identity?.match.browsingType ?? RulesCopy.text("简单主机名") }
+  var statusLabel: String {
+    if isFixed { return RulesCopy.text("固定本地策略") }
+    if !isEnabled { return RulesCopy.text("已禁用") }
+    var labels = relationships.map(\.browsingLabel)
+    if let fixedCoverage {
+      let label =
+        RulesCopy.text(action == .direct ? "被同行动规则覆盖" : "被相反行动规则遮蔽")
+        + " · " + RulesCopy.text("固定本地策略")
+      labels.append(
+        fixedCoverage.extent == .partial ? label + " · " + RulesCopy.text("部分重叠") : label)
+    }
+    return labels.isEmpty ? RulesCopy.text("独立候选") : labels.joined(separator: "; ")
+  }
+}
+
+extension RuleRelationship {
+  var browsingLabel: String {
+    let label = RulesCopy.text(kind == .absorption ? "被同行动规则覆盖" : "被相反行动规则遮蔽")
+    return extent == .partial ? label + " · " + RulesCopy.text("部分重叠") : label
+  }
+}
+
+extension RuleMatch {
+  var browsingType: String {
+    if editingKind == .ipAddress { return RulesCopy.text("IP 地址") }
+    return switch pattern {
+    case .domainExact: RulesCopy.text("精确域名")
+    case .domainSuffix: RulesCopy.text("域名后缀")
+    case .ipv4CIDR: "IPv4 CIDR"
+    case .ipv6CIDR: "IPv6 CIDR"
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ActivationDetailFeedbackView.swift b/ShadowsocksX-NG2/App/UI/Servers/ActivationDetailFeedbackView.swift
new file mode 100644
index 000000000..85093338d
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ActivationDetailFeedbackView.swift
@@ -0,0 +1,51 @@
+import SwiftUI
+
+/// 激活条件常驻，命令结果计时；调用方仅传入展示值。
+struct ActivationDetailFeedbackView: View {
+  let messages: [String]
+  let completion: ActivationFeedbackState.Completion?
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 0) {
+      VStack(alignment: .leading, spacing: 8) {
+        ForEach(messages, id: \.self) { message in
+          feedbackRow(message, symbol: "exclamationmark.triangle.fill", color: .orange)
+        }
+      }
+      DetailFeedback(completion: completion) { result in
+        feedbackRow(
+          message(for: result.feedback),
+          symbol: result.feedback.isSuccess
+            ? "checkmark.circle.fill" : "exclamationmark.triangle.fill",
+          color: result.feedback.isSuccess ? .green : .red
+        )
+        .padding(.top, messages.isEmpty ? 0 : 8)
+      }
+    }
+    .font(.callout)
+  }
+
+  private func feedbackRow(_ message: String, symbol: String, color: Color) -> some View {
+    HStack(alignment: .top, spacing: 8) {
+      Image(systemName: symbol).foregroundStyle(color)
+      Text(message)
+        .textSelection(.enabled)
+        .fixedSize(horizontal: false, vertical: true)
+        .frame(maxWidth: .infinity, alignment: .leading)
+    }
+    .accessibilityElement(children: .combine)
+  }
+
+  private func message(for result: ActivationFeedbackState.Feedback) -> String {
+    switch result {
+    case .activated(let skipped) where skipped > 0:
+      return String(localized: "已跳过 \(skipped) 个存在已知阻塞问题的服务器。", table: "ServerDetails")
+    case .activated:
+      return String(localized: "激活成功", table: "ServerDetails")
+    case .rejected(let failure):
+      return AppPresentation.message(for: failure)
+    case .failed(let message):
+      return message
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/CatalogExpansionState.swift b/ShadowsocksX-NG2/App/UI/Servers/CatalogExpansionState.swift
new file mode 100644
index 000000000..d2c393cf9
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/CatalogExpansionState.swift
@@ -0,0 +1,44 @@
+import Combine
+
+/// 目录树折叠状态（纯窗口呈现状态）：组合根持有的长寿命对象。destination 切换
+/// 会销毁分区子树里的 `@State`，折叠状态因此必须活在视图层级之外；服务器管理分区
+/// 侧栏专用，首页另行持久化自己的状态。语义=收起的分组身份集合，
+/// 缺省全部展开；不落盘，进程重启回全展开基线。
+@MainActor
+final class CatalogExpansionState: ObservableObject {
+  @Published private(set) var collapsedGroupIDs: Set<NodeID> = []
+
+  func isCollapsed(_ id: NodeID) -> Bool {
+    collapsedGroupIDs.contains(id)
+  }
+
+  func toggleCollapsed(_ id: NodeID) {
+    if collapsedGroupIDs.contains(id) {
+      collapsedGroupIDs.remove(id)
+    } else {
+      collapsedGroupIDs.insert(id)
+    }
+  }
+
+  /// 收起包含选中节点的组时，选择该组，避免详情指向隐藏的后代。
+  func setExpanded(_ expanded: Bool, for group: CatalogTreeNode, selection: NodeID?) -> NodeID? {
+    if expanded {
+      collapsedGroupIDs.remove(group.id)
+    } else {
+      collapsedGroupIDs.insert(group.id)
+      if let selection, selection != group.id, group.find(selection) != nil {
+        return group.id
+      }
+    }
+    return selection
+  }
+
+  /// 创建成功后仅展开祖先，保留其他分组的折叠状态。
+  func reveal(_ id: NodeID, in tree: CatalogTreeSnapshot) {
+    var parent = tree.node(withID: id)?.parentID
+    while let current = parent {
+      collapsedGroupIDs.remove(current)
+      parent = tree.node(withID: current)?.parentID
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/CatalogNodeDetailView.swift b/ShadowsocksX-NG2/App/UI/Servers/CatalogNodeDetailView.swift
new file mode 100644
index 000000000..2eb3fe06b
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/CatalogNodeDetailView.swift
@@ -0,0 +1,172 @@
+import SwiftUI
+
+/// 装配当前节点的详情会话；查询、参数装载与命令均留在共用视图之外。
+struct CatalogNodeDetailView: View {
+  @Environment(\.locale) private var locale
+  @Environment(\.timeZone) private var timeZone
+  @ObservedObject var workflow: CatalogWorkflow
+  @ObservedObject var activation: ActivationFeedbackState
+  let nodeID: NodeID
+  let isActiveTarget: Bool
+  /// 子树含活动目标（严格后代），与行级空心闪电同源判定。
+  let containsActiveTarget: Bool
+  let errors: ErrorAlertPresenter
+  @StateObject private var parameters = ServerDetailParameters()
+
+  private var node: CatalogTreeNode? { workflow.tree.node(withID: nodeID) }
+  private var eligibility: ActivationEligibility? { workflow.activationEligibility(for: nodeID) }
+
+  var body: some View {
+    if let node {
+      Group {
+        if let module = workflow.connectivity {
+          ObservedConnectivityProperties(
+            module: module, node: node, serverName: workflow.displayName(for:)
+          ) { properties in
+            detailView(for: node, connectivity: properties)
+          }
+        } else {
+          detailView(for: node)
+        }
+      }
+      .onAppear {
+        if !node.isGroup {
+          parameters.showServer(nodeID, load: workflow.serverDetailPluginOptions)
+        }
+      }
+      .onReceive(workflow.serverDetailChanges) { affected in
+        parameters.didRefresh(affectedServers: affected, load: workflow.serverDetailPluginOptions)
+      }
+    }
+  }
+
+  private func detailView(
+    for node: CatalogTreeNode, connectivity: NodeDetailPresentation.Properties? = nil
+  ) -> some View {
+    var detail = presentation(for: node)
+    if let connectivity { detail.properties.append(connectivity) }
+    return NodeDetailView(detail: detail) {
+      primaryActions(for: node)
+    } secondaryActions: {
+      if let module = workflow.connectivity {
+        ConnectivityTestButton(module: module, node: node)
+      }
+      Button(
+        workflow.isFavorite(nodeID)
+          ? String(localized: "取消收藏", table: "ServerDetails")
+          : String(localized: "收藏", table: "ServerDetails")
+      ) {
+        do {
+          try workflow.setFavorite(nodeID, isFavorite: !workflow.isFavorite(nodeID))
+        } catch {
+          errors.present(error)
+        }
+      }
+      if !node.isGroup && parameters.failure != nil {
+        Button(String(localized: "重新加载", table: "ServerDetails")) {
+          parameters.reload(load: workflow.serverDetailPluginOptions)
+        }
+      }
+    } feedback: {
+      ActivationDetailFeedbackView(
+        messages: detail.activationMessages,
+        completion: activation.completion?.targetID == nodeID ? activation.completion : nil)
+      if let subscription = subscriptionSummary(for: node) {
+        SubscriptionRefreshFeedbackView(
+          isRefreshing: workflow.refreshingSubscriptionIDs.contains(subscription.id),
+          completion: workflow.subscriptionRefreshCompletions[subscription.id]
+        )
+        .id(subscription.id)
+      }
+    } propertiesFooter: { group in
+      if group.id == .subscription,
+        let fraction = subscriptionSummary(for: node)?.information?.usedFraction
+      {
+        ProgressView(value: fraction) {
+          Text("流量消耗")
+        } currentValueLabel: {
+          Text(fraction, format: .percent.precision(.fractionLength(0)))
+        }
+        .progressViewStyle(.linear)
+        .tint(.accentColor)
+      } else {
+        nil
+      }
+    }
+  }
+
+  @ViewBuilder
+  private func primaryActions(for node: CatalogTreeNode) -> some View {
+    Button(
+      activation.pendingTargetID == nodeID
+        ? String(localized: "激活中…", table: "ServerDetails")
+        : String(localized: "激活", table: "ServerDetails"),
+      systemImage: "bolt.fill"
+    ) {
+      Task { @MainActor in
+        do {
+          _ = try await activation.activate(nodeID, via: workflow)
+        } catch {
+          // 激活状态记录失败，详情在 feedback 区域显示结果。
+        }
+      }
+    }
+    .disabled(!(eligibility?.canActivate ?? false) || activation.isPending)
+    if let subscription = subscriptionSummary(for: node) {
+      Button(
+        workflow.refreshingSubscriptionIDs.contains(subscription.id)
+          ? String(localized: "更新中…", table: "ServerDetails")
+          : String(localized: "更新", table: "ServerDetails"),
+        systemImage: "arrow.clockwise"
+      ) {
+        Task { await workflow.refreshSubscription(subscription.id) }
+      }
+      .disabled(workflow.refreshingSubscriptionIDs.contains(subscription.id))
+    }
+  }
+
+  private func presentation(for node: CatalogTreeNode) -> NodeDetailPresentation {
+    let server = node.isGroup ? nil : workflow.serverDetailPresentation(for: nodeID)
+    let subscription = subscriptionSummary(for: node)
+    var detail = NodeDetailPresentation(
+      node: node, server: server, eligibility: eligibility, isActiveTarget: isActiveTarget,
+      containsActiveTarget: containsActiveTarget,
+      subscription: subscription, locale: locale, timeZone: timeZone)
+    if let server, server.plugin.selection != .none {
+      if parameters.failure != nil {
+        detail.appendPluginParameterFailure()
+      } else {
+        detail.appendPluginParameters(parameters.options.rawText)
+      }
+    }
+    return detail
+  }
+
+  private func subscriptionSummary(for node: CatalogTreeNode) -> SubscriptionSummary? {
+    guard node.isRootSubscriptionGroup else { return nil }
+    return workflow.subscriptions.first { $0.groupID == node.id }
+  }
+}
+
+/// 只观察测试资料并生成属性；布局由通用节点详情负责。
+private struct ObservedConnectivityProperties<Content: View>: View {
+  @Environment(\.locale) private var locale
+  @Environment(\.timeZone) private var timeZone
+  @ObservedObject var module: ServerConnectivity
+  let node: CatalogTreeNode
+  let serverName: (NodeID) -> String
+  @ViewBuilder let content: (NodeDetailPresentation.Properties) -> Content
+
+  var body: some View {
+    if node.isGroup {
+      content(
+        NodeDetailPresentation.connectivitySummary(
+          module.summary(for: node.connectivityServerIDs),
+          serverName: serverName, locale: locale, timeZone: timeZone))
+    } else {
+      content(
+        NodeDetailPresentation.connectivityHistory(
+          module.history(for: node.id), locale: locale, timeZone: timeZone))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ConnectivityViews.swift b/ShadowsocksX-NG2/App/UI/Servers/ConnectivityViews.swift
new file mode 100644
index 000000000..560e643d0
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ConnectivityViews.swift
@@ -0,0 +1,92 @@
+import SwiftUI
+
+/// Observes the latest connectivity measurements and testing progress.
+struct ConnectivityCell: View {
+  @ObservedObject var module: ServerConnectivity
+  let node: CatalogTreeNode
+  let workflow: CatalogWorkflow
+  var selected = false
+
+  var body: some View {
+    let value = presentation()
+    HStack(spacing: 5) {
+      Text(value.text)
+        .foregroundStyle(
+          selected
+            ? AnyShapeStyle(Color(nsColor: .alternateSelectedControlTextColor))
+            : AnyShapeStyle(.primary))
+      if value.testing {
+        ProgressView().controlSize(.mini)
+          .tint(selected ? Color(nsColor: .alternateSelectedControlTextColor) : nil)
+      }
+    }
+    .help(value.help)
+    .accessibilityElement(children: .ignore)
+    .accessibilityLabel(Text(ConnectivityCopy.text("响应延迟")))
+    .accessibilityValue(
+      Text(
+        value.text + " " + value.help + (value.testing ? " " + ConnectivityCopy.text("测试中") : ""))
+    )
+  }
+
+  private struct Presentation {
+    let text: String
+    let help: String
+    let testing: Bool
+  }
+
+  private func presentation() -> Presentation {
+    let record: ServerConnectivity.Record?
+    let text: String
+    var prefix = ""
+    let summary = module.summary(for: node.connectivityServerIDs)
+    if node.isGroup {
+      record = summary.record
+      text = record.map { ConnectivityCopy.outcome($0.outcome) } ?? (summary.hasResults ? "—" : "")
+      if let id = summary.serverID { prefix = workflow.displayName(for: id) + " · " }
+    } else {
+      record = module.history(for: node.id).first
+      text = record.map { ConnectivityCopy.outcome($0.outcome) } ?? ""
+    }
+    let help =
+      record.map {
+        prefix + $0.finishedAt.formatted(date: .numeric, time: .standard)
+      }
+      ?? (summary.hasResults && node.isGroup
+        ? ConnectivityCopy.text("无成功结果") : ConnectivityCopy.text("尚未测试"))
+    return Presentation(text: text, help: help, testing: summary.isTesting)
+  }
+}
+
+struct ConnectivityTestButton: View {
+  @ObservedObject var module: ServerConnectivity
+  let node: CatalogTreeNode
+  var body: some View {
+    let isTesting = node.connectivityServerIDs.contains { module.testing.contains($0) }
+    Button(ConnectivityCopy.text(isTesting ? "测试中..." : "延迟测试")) {
+      module.test(node.connectivityServerIDs)
+    }
+    .disabled(
+      isTesting || !node.containsServerConfiguration || (!node.isGroup && module.isCooling(node.id))
+    )
+  }
+}
+
+/// Copy is kept at the presentation edge; failures never render raw errors or URLs.
+enum ConnectivityCopy {
+  static func text(_ key: String) -> String {
+    NSLocalizedString(key, tableName: "Connectivity", bundle: .main, comment: "")
+  }
+  static func outcome(_ value: ServerConnectivity.Outcome) -> String {
+    switch value {
+    case .success(let milliseconds): "\(milliseconds) ms"
+    case .unsupported: text("配置不支持")
+    case .preparationTimeout: text("准备超时")
+    case .requestTimeout: text("请求超时")
+    case .configuration: text("配置错误")
+    case .startup: text("启动错误")
+    case .network: text("网络错误")
+    case .http(let status): "HTTP \(status)"
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/CreationLocationField.swift b/ShadowsocksX-NG2/App/UI/Servers/CreationLocationField.swift
new file mode 100644
index 000000000..53d080648
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/CreationLocationField.swift
@@ -0,0 +1,34 @@
+import SwiftUI
+
+/// 新建位置只允许从当前组逐级上移；选中祖先后，以新位置重建菜单。
+struct CreationLocationField: View {
+  let tree: CatalogTreeSnapshot
+  @Binding var parent: NodeID?
+
+  private var ancestors: [CatalogTreeNode] {
+    var nodes: [CatalogTreeNode] = []
+    var id = parent
+    while let currentID = id, let node = tree.node(withID: currentID) {
+      nodes.append(node)
+      id = node.parentID
+    }
+    return nodes
+  }
+
+  var body: some View {
+    Picker("位置", selection: $parent) {
+      ForEach(ancestors) { node in
+        Text(verbatim: node.name)
+          .lineLimit(1)
+          .truncationMode(.tail)
+          .tag(Optional(node.id))
+      }
+      Text("所有服务器")
+        .tag(nil as NodeID?)
+    }
+    .pickerStyle(.menu)
+    .lineLimit(1)
+    .truncationMode(.tail)
+    .frame(maxWidth: .infinity, alignment: .leading)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/DetailFeedback.swift b/ShadowsocksX-NG2/App/UI/Servers/DetailFeedback.swift
new file mode 100644
index 000000000..8dcaf56aa
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/DetailFeedback.swift
@@ -0,0 +1,25 @@
+import SwiftUI
+
+/// 稳定容器持有详情计时会话，即使暂时没有结果也能接收后续完成事件。
+struct DetailFeedback<Result: DetailFeedbackResult, Content: View>: View {
+  let completion: Result?
+  @ViewBuilder let content: (Result) -> Content
+  @State private var feedback: DetailFeedbackState<Result>
+
+  init(completion: Result?, @ViewBuilder content: @escaping (Result) -> Content) {
+    self.completion = completion
+    self.content = content
+    self._feedback = State(initialValue: DetailFeedbackState<Result>())
+  }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 0) {
+      if let result = feedback.completion, result.id == completion?.id {
+        content(result)
+      }
+    }
+    .task(id: completion?.id) {
+      await feedback.present(completion)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/FavoriteServersTable.swift b/ShadowsocksX-NG2/App/UI/Servers/FavoriteServersTable.swift
new file mode 100644
index 000000000..b9204ee8f
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/FavoriteServersTable.swift
@@ -0,0 +1,110 @@
+import SwiftUI
+import UniformTypeIdentifiers
+
+/// 浏览位置与节点来源分别表达；收藏可以同时包含两种来源。
+enum ServerListSection: Hashable {
+  case favorites
+  case manual
+  case subscription
+
+  init(source: NodeSource) {
+    self = source == .manual ? .manual : .subscription
+  }
+
+  var source: NodeSource? {
+    switch self {
+    case .favorites: nil
+    case .manual: .manual
+    case .subscription: .subscription
+    }
+  }
+}
+
+/// 平面收藏表只重排收藏；详情及节点命令仍使用原目录身份。
+struct FavoriteServersTable<MenuContent: View>: View {
+  @ObservedObject var workflow: CatalogWorkflow
+  let activeTargetID: NodeID?
+  @Binding var selection: NodeID?
+  let errors: ErrorAlertPresenter
+  @ViewBuilder let contextMenu: (Set<NodeID>) -> MenuContent
+  @State private var dropState = ServerTableDropState()
+  @FocusState private var isTableFocused: Bool
+
+  var body: some View {
+    let rows = workflow.favorites
+    let activeAncestors = workflow.tree.ancestors(of: activeTargetID)
+    Table(of: CatalogTreeNode.self, selection: $selection) {
+      TableColumn("名称") { node in
+        ServerTableNameCell(
+          node: node, activeTargetID: activeTargetID,
+          containsActiveTarget: activeAncestors.contains(node.id))
+      }
+      .width(min: 140, ideal: 160)
+      TableColumn(ConnectivityCopy.text("响应延迟")) { node in
+        if let module = workflow.connectivity {
+          ConnectivityCell(module: module, node: node, workflow: workflow)
+        }
+      }
+      .width(min: 50, ideal: 60)
+      TableColumn("路径") { node in
+        let path = path(for: node)
+        Text(path)
+          .lineLimit(1)
+          .truncationMode(.tail)
+          .help(path)
+      }
+      .width(min: 160, ideal: 300)
+    } rows: {
+      ForEach(rows) { node in
+        TableRow(node)
+          .itemProvider {
+            dropState.provider(for: node.id, payload: node.id.rawValue)
+          }
+      }
+      .onInsert(of: [.plainText]) { index, providers in
+        insert(providers, at: index, in: rows.map(\.id))
+      }
+    }
+    .focused($isTableFocused)
+    .simultaneousGesture(TapGesture().onEnded { isTableFocused = true })
+    .contextMenu(forSelectionType: NodeID.self, menu: contextMenu)
+    .onKeyPress(.escape) {
+      guard selection != nil else { return .ignored }
+      selection = nil
+      return .handled
+    }
+    .overlay {
+      if rows.isEmpty {
+        ContentUnavailableView("收藏", systemImage: "star")
+          .allowsHitTesting(false)
+      }
+    }
+
+  }
+
+  private func path(for node: CatalogTreeNode) -> String {
+    let source = node.source == .manual ? String(localized: "本地") : String(localized: "订阅")
+    return ([source] + (workflow.tree.pathComponents(for: node.id) ?? [node.name]))
+      .joined(separator: "/")
+  }
+
+  /// 原生 Table 的行间插入回调；仅接受本表发起的单节点拖动。
+  private func insert(_ providers: [NSItemProvider], at index: Int, in ids: [NodeID]) {
+    guard providers.count == 1, let provider = providers.first,
+      let id = dropState.draggedID, ids.contains(id), (0...ids.count).contains(index)
+    else { return }
+    let target = ids.indices.contains(index) ? ids[index] : nil
+    dropState.finishDrop()
+    let typeIdentifier = UTType.plainText.identifier
+    provider.loadDataRepresentation(forTypeIdentifier: typeIdentifier) { data, _ in
+      guard let data, String(data: data, encoding: .utf8) == id.rawValue else { return }
+      Task { @MainActor in
+        do {
+          try workflow.moveFavorite(id, before: target)
+        } catch {
+          errors.present(error)
+        }
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ImportOutcomePresentation.swift b/ShadowsocksX-NG2/App/UI/Servers/ImportOutcomePresentation.swift
new file mode 100644
index 000000000..471c55b73
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ImportOutcomePresentation.swift
@@ -0,0 +1,103 @@
+import Foundation
+
+/// 统一导入的逐来源结果 → 呈现行（本地化在呈现边缘
+/// 完成）。失败明细不回显原始行内容（ss:// 行内嵌 base64 密码），
+/// 文本来源以行号定位；原始文本就在剪贴板/文件里，行号足以定位。
+enum ImportOutcomePresentation {
+  static func row(for outcome: ImportSourceOutcome, targetName: String) -> ImportResultRow {
+    let sourceName = sourceDisplayName(outcome.source)
+    switch outcome.result {
+    case .imported(let count, _):
+      return ImportResultRow(
+        sourceName: sourceName,
+        title: String(localized: "已导入 \(count) 台服务器到「\(targetName)」"),
+        details: [],
+        style: .success)
+    case .partial(let addedCount, let failures):
+      return ImportResultRow(
+        sourceName: sourceName,
+        title: String(localized: "已添加 \(addedCount) 台服务器；以下条目无法解析"),
+        details: failures.map {
+          String(localized: "第 \($0.lineIndex + 1) 行：\($0.reason.presentableMessage)")
+        },
+        style: .partial)
+    case .failed(let failure):
+      return ImportResultRow(
+        sourceName: sourceName,
+        title: failure.presentableMessage,
+        details: [],
+        style: .failure)
+    }
+  }
+
+  /// Legacy 导入报告 → 结果行（与 Legacy 专属表单时代的报告同口径）。
+  static func row(for report: LegacyImportReport) -> ImportResultRow {
+    let imported = report.importedServerCount
+    let skipped = report.skippedRecords.count
+    let regenerated = report.regeneratedIdentityCount
+    var details = [
+      String(
+        localized:
+          "统计：导入 \(imported) 台，跳过 \(skipped) 条，身份重生成 \(regenerated) 个。"
+      )
+    ]
+    if report.regeneratedIdentityCount > 0 {
+      let count = report.regeneratedIdentityCount
+      details.append(
+        String(localized: "有 \(count) 台服务器因 UUID 缺失、无效、重复或冲突而生成了新身份。"))
+    }
+    details.append(
+      contentsOf: report.skippedRecords.map { record in
+        String(
+          localized:
+            "第 \(record.index + 1) 条（\(record.description)）：\(record.reason.presentableMessage)")
+      })
+    return ImportResultRow(
+      sourceName: legacySourceName,
+      title: String(localized: "已导入 \(report.importedServerCount) 台服务器到「\(report.groupName)」"),
+      details: details,
+      style: report.skippedRecords.isEmpty ? .success : .partial)
+  }
+
+  /// Legacy 导入抛错（无快照、提交失败等）→ 失败结果行。
+  static func failureRow(_ error: Error, sourceName: String? = nil) -> ImportResultRow {
+    ImportResultRow(
+      sourceName: sourceName ?? legacySourceName,
+      title: error.presentableMessage,
+      details: [],
+      style: .failure)
+  }
+
+  /// 文件内容读取失败（面板读盘早于管线）→ 失败结果行。
+  static func unreadableFileRow(fileName: String) -> ImportResultRow {
+    ImportResultRow(
+      sourceName: fileName,
+      title: String(localized: "文件无法读取"),
+      details: [],
+      style: .failure)
+  }
+
+  static var legacySourceName: String { String(localized: "旧版本 ShadowsocksX-NG") }
+
+  static func sourceDisplayName(_ source: ImportSource) -> String {
+    switch source {
+    case .clipboardText: return String(localized: "剪贴板")
+    case .file(let name, _): return name
+    }
+  }
+}
+
+/// 统一导入面板的逐来源结果行（非敏感；明细为行号/统计与 typed 文案）。
+struct ImportResultRow: Identifiable, Equatable {
+  enum Style: Equatable {
+    case success
+    case partial
+    case failure
+  }
+
+  let id = UUID()
+  let sourceName: String
+  let title: String
+  let details: [String]
+  let style: Style
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ImportServersSheet.swift b/ShadowsocksX-NG2/App/UI/Servers/ImportServersSheet.swift
new file mode 100644
index 000000000..6504ad16c
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ImportServersSheet.swift
@@ -0,0 +1,212 @@
+import SwiftUI
+import UniformTypeIdentifiers
+
+/// 统一导入面板（docs/design/unified-server-import.md）：拖放多文件（二维码
+/// 图片 / SIP-008 JSON / ss:// 文本）、剪贴板 ss:// 一键导入与旧版直接导入
+/// 共用同一落点（随侧栏选中）与逐来源结果区。来源独立解码、独立提交；
+/// 成功与失败同位呈现，面板不自动关闭。
+struct ImportServersSheet: View {
+  let workflow: CatalogWorkflow
+  let clipboard: any TextClipboard
+  @Binding var selection: NodeID?
+  var selectNewNodes = false
+  @Environment(\.dismiss) private var dismiss
+
+  @State private var resultRows: [ImportResultRow] = []
+  @State private var isImporting = false
+  @State private var showFileImporter = false
+  @State private var hovering = false
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 14) {
+      HStack {
+        Text("导入Shadowsocks服务器配置")
+          .font(.title2.weight(.semibold))
+        Spacer()
+        Button {
+          dismiss()
+        } label: {
+          Image(systemName: "xmark.circle.fill")
+            .font(.title3)
+            .foregroundStyle(.secondary)
+        }
+        .buttonStyle(.plain)
+        .help("关闭")
+      }
+      targetHint
+      dropZone
+      if !resultRows.isEmpty {
+        resultList
+      }
+      HStack {
+        Button("从剪贴板中导入 ss:// 链接") { importClipboard() }
+          .disabled(isImporting)
+        if workflow.legacyImportState.snapshotFound {
+          Button(legacyButtonTitle) { importLegacy() }
+            .disabled(isImporting)
+        }
+      }
+    }
+    .padding(24)
+    .frame(minWidth: 520)
+    .fileImporter(
+      isPresented: $showFileImporter,
+      allowedContentTypes: [.image, .json, .plainText],
+      allowsMultipleSelection: true
+    ) { result in
+      importFiles((try? result.get()) ?? [])
+    }
+  }
+
+  /// 落点提示随侧栏选中实时变化（选中手动组→组内；选中服务器→其父组；
+  /// 其余→目录根）。
+  private var targetHint: some View {
+    let parent = workflow.importTargetParent(for: selection)
+    let path = parent.flatMap { workflow.tree.pathSummary(for: $0) } ?? String(localized: "目录根")
+    return Text("将导入到：\(path)")
+      .font(.callout)
+      .foregroundStyle(.secondary)
+  }
+
+  private var dropZone: some View {
+    VStack(spacing: 8) {
+      Image(systemName: "tray.and.arrow.down")
+        .font(.system(size: 34))
+        .foregroundStyle(hovering ? .orange : .secondary)
+      Text("拖动文件到这里")
+        .font(.headline)
+      Text("二维码图片\nSIP008 JSON 文件\n包含 ss:// 链接的 txt 文件")
+        .font(.callout)
+        .foregroundStyle(.secondary)
+        .multilineTextAlignment(.center)
+    }
+    .frame(maxWidth: .infinity)
+    .frame(height: 170)
+    .background(
+      RoundedRectangle(cornerRadius: 10)
+        .fill(hovering ? Color.orange.opacity(0.08) : Color.primary.opacity(0.03))
+    )
+    .overlay(
+      RoundedRectangle(cornerRadius: 10)
+        .strokeBorder(style: StrokeStyle(lineWidth: 1, dash: [5]))
+        .foregroundStyle(hovering ? AnyShapeStyle(Color.orange) : AnyShapeStyle(.separator))
+    )
+    .contentShape(Rectangle())
+    .onTapGesture { showFileImporter = true }
+    .dropDestination(for: URL.self) { urls, _ in
+      importFiles(urls)
+      return !urls.isEmpty
+    } isTargeted: {
+      hovering = $0
+    }
+    .help("选择文件…")
+  }
+
+  private var resultList: some View {
+    ScrollView {
+      VStack(alignment: .leading, spacing: 12) {
+        ForEach(resultRows) { row in
+          VStack(alignment: .leading, spacing: 4) {
+            Label("\(row.sourceName)：\(row.title)", systemImage: iconName(row.style))
+              .foregroundStyle(iconColor(row.style))
+            ForEach(row.details, id: \.self) { detail in
+              Text(detail)
+                .font(.callout)
+                .foregroundStyle(.secondary)
+            }
+          }
+        }
+      }
+      .frame(maxWidth: .infinity, alignment: .leading)
+    }
+    .frame(maxHeight: 200)
+  }
+
+  private var legacyButtonTitle: String {
+    workflow.legacyImportState.completed
+      ? String(localized: "再次导入旧版本服务器") : String(localized: "从旧版本 ShadowsocksX-NG 导入")
+  }
+
+  // MARK: - 导入动作
+
+  private func importFiles(_ urls: [URL]) {
+    var sources: [ImportSource] = []
+    for url in urls {
+      guard let data = try? Data(contentsOf: url) else {
+        resultRows.append(
+          ImportOutcomePresentation.unreadableFileRow(fileName: url.lastPathComponent))
+        continue
+      }
+      sources.append(.file(name: url.lastPathComponent, data: data))
+    }
+    guard !sources.isEmpty else { return }
+    run(sources)
+  }
+
+  private func importClipboard() {
+    // 空剪贴板也走统一管线：来源级失败「没有可导入的 ss:// 链接」入结果区。
+    run([.clipboardText(clipboard.read() ?? "")])
+  }
+
+  /// 统一入口：来源独立提交；成功来源切换侧栏选中到其落点/新建分组。
+  private func run(_ sources: [ImportSource]) {
+    guard !isImporting else { return }
+    isImporting = true
+    let parent = workflow.importTargetParent(for: selection)
+    Task {
+      let outcome = await workflow.importServers(from: sources, into: parent)
+      resultRows.append(
+        contentsOf: outcome.sources.map { sourceOutcome in
+          ImportOutcomePresentation.row(
+            for: sourceOutcome, targetName: targetDisplayName(for: sourceOutcome.result))
+        })
+      if let candidate = selectNewNodes
+        ? outcome.newNodeSelectionCandidate : outcome.selectionCandidate
+      {
+        selection = candidate
+      }
+      isImporting = false
+    }
+  }
+
+  private func importLegacy() {
+    guard !isImporting else { return }
+    isImporting = true
+    let reimport = workflow.legacyImportState.completed
+    Task {
+      do {
+        let outcome = try await workflow.importLegacy(reimport: reimport)
+        resultRows.append(ImportOutcomePresentation.row(for: outcome.report))
+        selection = outcome.groupID
+      } catch {
+        resultRows.append(ImportOutcomePresentation.failureRow(error))
+      }
+      isImporting = false
+    }
+  }
+
+  private func targetDisplayName(for result: ImportSourceResult) -> String {
+    guard case .imported(_, let groupID) = result else { return "" }
+    guard let groupID else { return String(localized: "目录根") }
+    let name = workflow.displayName(for: groupID)
+    return name.isEmpty ? String(localized: "目录根") : name
+  }
+
+  // MARK: - 结果行样式
+
+  private func iconName(_ style: ImportResultRow.Style) -> String {
+    switch style {
+    case .success: return "checkmark.circle.fill"
+    case .partial: return "exclamationmark.triangle.fill"
+    case .failure: return "xmark.circle.fill"
+    }
+  }
+
+  private func iconColor(_ style: ImportResultRow.Style) -> Color {
+    switch style {
+    case .success: return .green
+    case .partial: return .orange
+    case .failure: return .red
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/NewGroupSheet.swift b/ShadowsocksX-NG2/App/UI/Servers/NewGroupSheet.swift
new file mode 100644
index 000000000..de8976fe9
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/NewGroupSheet.swift
@@ -0,0 +1,59 @@
+import SwiftUI
+
+/// 失败保留名称和所选位置；创建成功才关闭表单。
+struct NewGroupSheet: View {
+  let workflow: CatalogWorkflow
+  let errors: ErrorAlertPresenter
+  let onCreated: (NodeID) -> Void
+  @Environment(\.dismiss) private var dismiss
+  @State private var name = ""
+  @State private var parent: NodeID?
+  @State private var isSubmitting = false
+  @FocusState private var nameFocused: Bool
+
+  init(
+    workflow: CatalogWorkflow, errors: ErrorAlertPresenter, parent: NodeID?,
+    onCreated: @escaping (NodeID) -> Void
+  ) {
+    self.workflow = workflow
+    self.errors = errors
+    self.onCreated = onCreated
+    // 打开时的父组仅作为初值，后续位置由本表单持有。
+    _parent = State(initialValue: parent)
+  }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 16) {
+      Text("新建分组").font(.title2)
+      TextField("名称", text: $name)
+        .focused($nameFocused)
+      CreationLocationField(tree: workflow.tree, parent: $parent)
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel) { dismiss() }
+        Button("创建") { create() }
+          .keyboardShortcut(.defaultAction)
+      }
+    }
+    .padding(20)
+    .frame(width: 360)
+    .disabled(isSubmitting)
+    .interactiveDismissDisabled(isSubmitting)
+    .defaultFocus($nameFocused, true)
+  }
+
+  private func create() {
+    guard !isSubmitting else { return }
+    isSubmitting = true
+    Task {
+      defer { isSubmitting = false }
+      do {
+        let id = try await workflow.createGroup(named: name, into: parent)
+        onCreated(id)
+        dismiss()
+      } catch {
+        errors.present(error)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/NodeDetailView.swift b/ShadowsocksX-NG2/App/UI/Servers/NodeDetailView.swift
new file mode 100644
index 000000000..dc50487fc
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/NodeDetailView.swift
@@ -0,0 +1,85 @@
+import SwiftUI
+
+/// 只接受展示值与外部动作；不查询节点类型、工作流或凭据。
+struct NodeDetailView<
+  PrimaryActions: View, SecondaryActions: View, Feedback: View, PropertiesFooter: View
+>: View {
+  let detail: NodeDetailPresentation
+  @ViewBuilder let primaryActions: PrimaryActions
+  @ViewBuilder let secondaryActions: SecondaryActions
+  @ViewBuilder let feedback: Feedback
+  let propertiesFooter: (NodeDetailPresentation.Properties) -> PropertiesFooter?
+
+  var body: some View {
+    ScrollView {
+      VStack(alignment: .leading, spacing: 20) {
+        VStack(alignment: .leading, spacing: 8) {
+          Text(detail.title)
+            .font(.title2.weight(.semibold))
+            .textSelection(.enabled)
+          VStack(alignment: .leading, spacing: 4) {
+            Text(detail.subtitle)
+              .font(.subheadline)
+              .foregroundStyle(.secondary)
+              .textSelection(.enabled)
+            if let secondarySubtitle = detail.secondarySubtitle {
+              Text(secondarySubtitle)
+                .font(.subheadline)
+                .foregroundStyle(.secondary)
+                .textSelection(.enabled)
+            }
+          }
+          VStack(alignment: .leading, spacing: 8) {
+            HStack(spacing: 12) { primaryActions }
+              .buttonStyle(.borderedProminent)
+            HStack(spacing: 12) { secondaryActions }
+              .buttonStyle(.bordered)
+          }
+          .fixedSize(horizontal: true, vertical: true)
+          .background {
+            GeometryReader { geometry in
+              Color.clear.preference(
+                key: NodeDetailMinimumWidth.self, value: geometry.size.width + 32)
+            }
+          }
+          feedback
+        }
+        Divider()
+        ForEach(detail.properties) { group in
+          let footer = propertiesFooter(group)
+          if !group.items.isEmpty || footer != nil {
+            VStack(alignment: .leading, spacing: 10) {
+              Text(group.title).font(.headline)
+              Grid(alignment: .leading, horizontalSpacing: 16, verticalSpacing: 8) {
+                ForEach(Array(group.items.enumerated()), id: \.offset) { _, property in
+                  GridRow(alignment: .top) {
+                    Text(property.label)
+                      .foregroundStyle(.secondary)
+                      .multilineTextAlignment(.trailing)
+                      .gridColumnAlignment(.trailing)
+                    Text(property.value)
+                      .textSelection(.enabled)
+                      .frame(maxWidth: .infinity, alignment: .leading)
+                  }
+                }
+              }
+              footer
+            }
+          }
+        }
+      }
+      .frame(maxWidth: .infinity, alignment: .leading)
+      .padding(.horizontal, 16)
+      .padding(.vertical, 16)
+    }
+  }
+}
+
+/// 操作区按完整文字测量；包含详情的左右内边距，供外层分栏限制拖动宽度。
+struct NodeDetailMinimumWidth: PreferenceKey {
+  static let defaultValue: CGFloat = 320
+
+  static func reduce(value: inout CGFloat, nextValue: () -> CGFloat) {
+    value = max(value, nextValue())
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/PasswordAutofillOptOut.swift b/ShadowsocksX-NG2/App/UI/Servers/PasswordAutofillOptOut.swift
new file mode 100644
index 000000000..ca5e6e95c
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/PasswordAutofillOptOut.swift
@@ -0,0 +1,91 @@
+import AppKit
+import SwiftUI
+
+/// 关掉系统给密码输入框的「密码自动填充」入口。
+///
+/// SwiftUI 的 `SecureField` 在 macOS 上由 `NSSecureTextField` 承载；系统对安全
+/// 输入框默认提供钥匙串/密码 App 的自动填充入口。`textContentType(nil)` 只清掉
+/// 字段语义（实测底层字段 `contentType` 已是 nil），关不掉入口；AppKit 没有公开
+/// 开关，唯一开关是字段级的私有 `_setPasswordAutofillEnabled:`（默认开）。这里在
+/// 探针认领到的文本框上按需调用它：方法不存在（系统换实现）时保持系统默认
+/// 行为，不做替代实现，也不让 KVC 抛异常。
+///
+/// 用法：贴在密码控件（`Group { TextField / SecureField }`）的 `.background(...)`
+/// 上。探针与控件同帧，据此在祖先里认领同帧的文本框，因此同一表单里的其他
+/// 输入框不会被误伤。
+struct PasswordAutofillOptOut: NSViewRepresentable {
+  func makeNSView(context: Context) -> ProbeView {
+    ProbeView()
+  }
+
+  func updateNSView(_ view: ProbeView, context: Context) {
+    view.disablePasswordAutofill()
+  }
+
+  /// 背景探针：由 `.background` 撑满密码控件，据此认领承载控件的文本框。
+  final class ProbeView: NSView {
+    /// 已处理过的文本框：明文/密文切换会换成新实例，换实例即重新处理。
+    private weak var claimedField: NSTextField?
+
+    private static let setterSelector = NSSelectorFromString("_setPasswordAutofillEnabled:")
+
+    override func viewDidMoveToWindow() {
+      super.viewDidMoveToWindow()
+      disablePasswordAutofill()
+    }
+
+    override func setFrameSize(_ newSize: NSSize) {
+      super.setFrameSize(newSize)
+      disablePasswordAutofill()
+    }
+
+    override func setFrameOrigin(_ newOrigin: NSPoint) {
+      super.setFrameOrigin(newOrigin)
+      disablePasswordAutofill()
+    }
+
+    func disablePasswordAutofill() {
+      let target = convert(bounds, to: nil)
+      guard window != nil, !target.isEmpty else { return }
+      guard let field = Self.field(overlapping: target, from: superview) else { return }
+      guard field !== claimedField else { return }
+      claimedField = field
+      guard field.responds(to: Self.setterSelector) else { return }
+      field.setValue(false, forKey: "passwordAutofillEnabled")
+    }
+
+    /// 逐层向上找第一个含候选文本框的祖先视图。按交叠面积认领而不是逐边
+    /// 相等：探针与控件同帧，取整差异不应该让认领落空。
+    private static func field(overlapping target: NSRect, from view: NSView?) -> NSTextField? {
+      var ancestor = view
+      while let current = ancestor {
+        if let match = bestMatch(in: current, target: target) { return match.field }
+        ancestor = current.superview
+      }
+      return nil
+    }
+
+    private static func bestMatch(
+      in view: NSView, target: NSRect
+    ) -> (field: NSTextField, area: CGFloat)? {
+      var best: (field: NSTextField, area: CGFloat)?
+      if let field = view as? NSTextField, field.window != nil,
+        let area = intersectionArea(of: field, with: target), area > 0
+      {
+        best = (field, area)
+      }
+      for subview in view.subviews {
+        guard let candidate = bestMatch(in: subview, target: target) else { continue }
+        if candidate.area > (best?.area ?? 0) { best = candidate }
+      }
+      return best
+    }
+
+    private static func intersectionArea(of field: NSTextField, with target: NSRect) -> CGFloat? {
+      let rect = field.convert(field.bounds, to: nil)
+      let intersection = rect.intersection(target)
+      guard !intersection.isNull else { return nil }
+      return intersection.width * intersection.height
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginEditorSheet.swift b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginEditorSheet.swift
new file mode 100644
index 000000000..9ceb63af5
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginEditorSheet.swift
@@ -0,0 +1,176 @@
+import SwiftUI
+import UniformTypeIdentifiers
+
+private struct PluginTextDraft: Identifiable {
+  let id = UUID()
+  var value: String
+}
+
+struct PluginEditorSheet: View {
+  @ObservedObject var model: PluginManagementModel
+  let session: PluginEditorSession
+  @Environment(\.dismiss) private var dismiss
+  /// Each presentation seeds fresh drafts; row identities survive edits and moves.
+  @State private var names: [PluginTextDraft]
+  @State private var arguments: [PluginTextDraft]
+  @State private var mode: PluginTransportMode
+  @State private var path: String
+  @State private var failure: String?
+  @State private var showFilePicker = false
+
+  init(model: PluginManagementModel, session: PluginEditorSession) {
+    self.model = model
+    self.session = session
+    _names = State(initialValue: session.initialNames.map { PluginTextDraft(value: $0) })
+    _arguments = State(initialValue: session.initialArguments.map { PluginTextDraft(value: $0) })
+    _path = State(initialValue: session.initialPath)
+    _mode = State(initialValue: session.initialMode)
+  }
+
+  private var nameValues: [String] { names.map(\.value) }
+  private var isManaged: Bool { session.managedProgram != nil }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 16) {
+      Text(title).font(.title2)
+      ScrollView {
+        VStack(alignment: .leading, spacing: 16) {
+          VStack(alignment: .leading, spacing: 8) {
+            Text("插件名称")
+            if isManaged {
+              Text(nameValues.joined(separator: ", ")).textSelection(.enabled)
+            } else {
+              PluginValueList(values: $names, placeholder: "插件名称", allowsReordering: false)
+              if let issue = model.namesIssue(nameValues, session: session) { fieldError(issue) }
+            }
+          }
+          if !isManaged {
+            VStack(alignment: .leading, spacing: 8) {
+              Text("可执行文件路径")
+              HStack {
+                TextField("可执行文件路径", text: $path).textFieldStyle(.roundedBorder)
+                Button("选择文件…") { showFilePicker = true }
+              }
+              .padding(.all, 4)
+              if let issue = model.pathIssue(path) { fieldError(issue) }
+            }
+            if nameValues.contains(where: {
+              ManagedPluginCatalog.info(
+                forProgram: $0.trimmingCharacters(in: .whitespacesAndNewlines)) != nil
+            }) {
+              Text("保存后将覆盖所列名称对应的内置插件。")
+                .font(.caption).foregroundStyle(.secondary)
+            }
+          }
+          Picker("插件传输模式", selection: $mode) {
+            ForEach(PluginTransportMode.allCases, id: \.self) { mode in
+              Text(verbatim: mode.rawValue).tag(mode)
+            }
+          }
+          .pickerStyle(.menu)
+          VStack(alignment: .leading, spacing: 8) {
+            HStack {
+              Text("本地启动参数")
+              Spacer()
+              if isManaged {
+                Button("清空参数") { arguments.removeAll() }.disabled(arguments.isEmpty)
+              }
+            }
+            PluginValueList(values: $arguments, placeholder: "参数", allowsReordering: true)
+            Text("每项作为一个完整参数传递，无需 shell 引号。仅在本机生效。")
+              .font(.caption).foregroundStyle(.secondary)
+          }
+        }
+      }
+      if let failure {
+        Label(failure, systemImage: "exclamationmark.triangle.fill")
+          .font(.footnote).foregroundStyle(.red)
+      }
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel) { dismiss() }.keyboardShortcut(.cancelAction)
+        Button("保存") {
+          do {
+            try model.save(
+              session, names: nameValues, path: path, arguments: arguments.map(\.value), mode: mode)
+            dismiss()
+          } catch { failure = PluginManagementCopy.error(error) }
+        }
+        .keyboardShortcut(.defaultAction)
+        .disabled(
+          model.snapshot.mappingsUnreadable
+            || (!isManaged
+              && (model.namesIssue(nameValues, session: session) != nil
+                || model.pathIssue(path) != nil))
+        )
+      }
+    }
+    .padding(24)
+    .frame(width: 600, height: 520)
+    .fileImporter(isPresented: $showFilePicker, allowedContentTypes: [.item]) { result in
+      switch result {
+      case .success(let url): path = url.path
+      case .failure: failure = String(localized: "无法选择文件，请重试。")
+      }
+    }
+  }
+
+  private var title: String {
+    if isManaged { return String(localized: "内置插件设置") }
+    return session.isEditing ? String(localized: "编辑插件") : String(localized: "新增插件")
+  }
+
+  private func fieldError(_ error: PluginMappingError) -> some View {
+    Text(PluginManagementCopy.error(error)).font(.caption).foregroundStyle(.red)
+  }
+}
+
+private struct PluginValueList: View {
+  @Binding var values: [PluginTextDraft]
+  let placeholder: LocalizedStringKey
+  let allowsReordering: Bool
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 8) {
+      ForEach($values) { $item in
+        HStack {
+          TextField(placeholder, text: $item.value).textFieldStyle(.roundedBorder)
+          if allowsReordering {
+            Button {
+              move(item.id, by: -1)
+            } label: {
+              Image(systemName: "arrow.up")
+                .frame(width: 16, height: 16)
+            }
+            .help("上移").accessibilityLabel("上移")
+            .disabled(values.first?.id == item.id)
+            Button {
+              move(item.id, by: 1)
+            } label: {
+              Image(systemName: "arrow.down")
+                .frame(width: 16, height: 16)
+            }
+            .help("下移").accessibilityLabel("下移")
+            .disabled(values.last?.id == item.id)
+          }
+          Button {
+            values.removeAll { $0.id == item.id }
+          } label: {
+            Image(systemName: "minus")
+              .frame(width: 16, height: 16)
+          }
+          .help("删除此项").accessibilityLabel("删除此项")
+        }
+      }
+      Button("添加一项") { values.append(PluginTextDraft(value: "")) }
+    }
+    .padding(.all, 4)
+  }
+
+  private func move(_ id: UUID, by offset: Int) {
+    guard let index = values.firstIndex(where: { $0.id == id }),
+      values.indices.contains(index + offset)
+    else { return }
+    values.swapAt(index, index + offset)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginManagementCopy.swift b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginManagementCopy.swift
new file mode 100644
index 000000000..eecae16db
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginManagementCopy.swift
@@ -0,0 +1,87 @@
+import Foundation
+
+/// Localized management feedback shared by the list and editor.
+enum PluginManagementCopy {
+  static func error(_ error: Error) -> String {
+    guard let issue = error as? PluginMappingError else {
+      return String(localized: "无法保存插件配置，请检查配置文件的访问权限后重试。")
+    }
+    switch issue {
+    case .unreadable, .unsupportedVersion:
+      return String(localized: "无法读取插件配置。请修复配置文件后重试读取。")
+    case .invalidName:
+      return String(localized: "请至少填写一个非空插件名称。")
+    case .nameExists:
+      return String(localized: "已有同名用户插件，请编辑现有条目或使用其他名称。")
+    case .invalidPath:
+      return String(localized: "请输入可执行文件的绝对路径。")
+    case .invalidArguments:
+      return String(localized: "启动参数不能包含空字符（NUL）。")
+    case .unavailableFile:
+      return String(localized: "文件不存在或不可执行，请选择可执行文件。")
+    case .nameMissing:
+      return String(localized: "该用户插件已不存在，请关闭表单后重试。")
+    }
+  }
+
+  static func source(_ entry: PluginCatalogSnapshot.Entry) -> String {
+    if entry.source == .managed { return String(localized: "内置") }
+    return ManagedPluginCatalog.info(forProgram: entry.program) == nil
+      ? String(localized: "用户添加") : String(localized: "用户覆盖")
+  }
+
+  static func availability(_ value: PluginCatalogSnapshot.Availability) -> String? {
+    switch value {
+    case .available: nil
+    case .missing: String(localized: "插件文件不存在。")
+    case .notExecutable: String(localized: "插件文件不可执行。")
+    case .unreadable: String(localized: "无法读取插件文件。")
+    }
+  }
+
+  static func securitySummary(_ facts: PluginSecurityFacts) -> String? {
+    if facts.policy == .rejected {
+      return String(localized: "macOS 安全策略检查未通过，运行可能受到限制。")
+    }
+    if facts.quarantine == .present {
+      return String(localized: "文件带有下载隔离标记，运行时可能需要 macOS 授权。")
+    }
+    if facts.signature == .invalid {
+      return String(localized: "文件签名无效，运行可能受到 macOS 限制。")
+    }
+    if facts.signature == .unsigned {
+      return String(localized: "文件未签名，运行可能受到 macOS 限制。")
+    }
+    if facts.quarantine == .unknown || facts.signature == .unknown || facts.policy == .unknown {
+      return String(localized: "无法完成安全检查。")
+    }
+    return nil
+  }
+
+  static func quarantine(_ value: PluginSecurityFacts.Quarantine) -> String {
+    switch value {
+    case .present: String(localized: "隔离标记：存在")
+    case .absent: String(localized: "隔离标记：无")
+    case .unknown: String(localized: "隔离标记：无法判断")
+    }
+  }
+
+  static func signature(_ value: PluginSecurityFacts.Signature) -> String {
+    switch value {
+    case .valid: String(localized: "签名：有效")
+    case .unsigned: String(localized: "签名：未签名")
+    case .invalid: String(localized: "签名：无效")
+    case .notApplicable: String(localized: "签名：不适用")
+    case .unknown: String(localized: "签名：无法判断")
+    }
+  }
+
+  static func policy(_ value: PluginSecurityFacts.Policy) -> String {
+    switch value {
+    case .accepted: String(localized: "安全策略：检查通过")
+    case .rejected: String(localized: "安全策略：检查未通过")
+    case .notApplicable: String(localized: "安全策略：不适用")
+    case .unknown: String(localized: "安全策略：无法判断")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginManagementRowView.swift b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginManagementRowView.swift
new file mode 100644
index 000000000..2fb9c7b7a
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginManagementRowView.swift
@@ -0,0 +1,154 @@
+import SwiftUI
+
+struct PluginManagementRowView: View {
+  let entry: PluginManagementRow
+  @ObservedObject var catalog: PluginCatalog
+  let beginManagedSettings: (String) -> Void
+  let beginOverriding: (String) -> Void
+  let beginEditing: (UUID) -> Void
+  let remove: () -> Void
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 6) {
+      VStack(alignment: .leading, spacing: 3) {
+        HStack(alignment: .top, spacing: 16) {
+          pluginIdentity
+            .frame(maxWidth: .infinity, alignment: .leading)
+          actionButtons
+        }
+        if let path = entry.path {
+          Text(path).font(.caption).foregroundStyle(.secondary)
+            .lineLimit(1).truncationMode(.middle).help(path).textSelection(.enabled)
+        }
+      }
+      if !entry.overriddenNames.isEmpty {
+        Text("已被用户覆盖：" + entry.overriddenNames.joined(separator: ", "))
+          .font(.caption).foregroundStyle(.secondary)
+      }
+      availabilityNotice
+      if let program = entry.securityProgram, entry.availability == .available {
+        PluginSecurityDetails(facts: catalog.securityFacts[program])
+      }
+    }
+    .padding(.vertical, 4)
+  }
+
+  @ViewBuilder
+  private var pluginIdentity: some View {
+    VStack(alignment: .leading, spacing: 3) {
+      Text(entry.names.joined(separator: ", ")).font(.body)
+      if let program = entry.managedProgram,
+        let info = ManagedPluginCatalog.plugins.first(where: { $0.program == program })
+      {
+        managedIdentity(info)
+      } else {
+        Text(identityKind)
+          .font(.caption).foregroundStyle(.secondary)
+      }
+    }
+  }
+
+  private func managedIdentity(_ info: ManagedPluginInfo) -> some View {
+    HStack(alignment: .firstTextBaseline, spacing: 8) {
+      Text("内置").foregroundStyle(.secondary)
+      if let dependency = info.dependency {
+        Text(verbatim: dependency.version).foregroundStyle(.secondary)
+        if let projectURL = URL(string: dependency.projectURL) {
+          Link(destination: projectURL) {
+            projectLink(dependency.projectURL)
+          }
+          .frame(maxWidth: .infinity, alignment: .leading)
+        }
+      } else {
+        Text("版本信息不可用").foregroundStyle(.secondary)
+      }
+    }
+    .font(.caption)
+  }
+
+  private func projectLink(_ url: String) -> some View {
+    Text(verbatim: url)
+      .textSelection(.enabled)
+      .fixedSize(horizontal: false, vertical: true)
+  }
+
+  private var identityKind: String {
+    if entry.managedProgram != nil { return String(localized: "内置") }
+    return entry.overridesManaged ? String(localized: "用户覆盖") : String(localized: "用户添加")
+  }
+
+  @ViewBuilder
+  private var actionButtons: some View {
+    if let program = entry.managedProgram {
+      Button {
+        beginManagedSettings(program)
+      } label: {
+        HStack(spacing: 8) {
+          Text("设置")
+          Image(systemName: "chevron.right").font(.caption.weight(.semibold))
+        }
+      }
+      .buttonStyle(.bordered)
+      Menu(String(localized: "覆盖名称")) {
+        ForEach(entry.names, id: \.self) { name in
+          Button(name) { beginOverriding(name) }
+            .disabled(entry.overriddenNames.contains(name))
+        }
+      }
+    } else if let id = entry.recordID {
+      Button {
+        beginEditing(id)
+      } label: {
+        HStack(spacing: 8) {
+          Text("编辑")
+          Image(systemName: "chevron.right").font(.caption.weight(.semibold))
+        }
+      }
+      .buttonStyle(.bordered)
+      Button("删除", action: remove)
+    }
+  }
+
+  @ViewBuilder
+  private var availabilityNotice: some View {
+    if let availability = entry.availability,
+      let issue = PluginManagementCopy.availability(availability)
+    {
+      Label(issue, systemImage: "exclamationmark.triangle.fill")
+        .font(.caption).foregroundStyle(.red)
+    }
+  }
+}
+
+private struct PluginSecurityDetails: View {
+  let facts: PluginSecurityFacts?
+  @State private var isExpanded = false
+
+  var body: some View {
+    if let facts {
+      if let warning = PluginManagementCopy.securitySummary(facts) {
+        Label(warning, systemImage: "exclamationmark.triangle")
+          .font(.caption).foregroundStyle(.orange)
+      }
+      DisclosureGroup(isExpanded: $isExpanded) {
+        VStack(alignment: .leading, spacing: 3) {
+          Text(PluginManagementCopy.quarantine(facts.quarantine))
+          Text(PluginManagementCopy.signature(facts.signature))
+          Text(PluginManagementCopy.policy(facts.policy))
+          Text("检查结果仅供参考，不能保证 macOS 允许或禁止运行。")
+            .foregroundStyle(.secondary)
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+      } label: {
+        // macOS 上 DisclosureGroup 默认仅三角图标可点，整行铺开让文字也响应点击。
+        Text("安全检查详情")
+          .frame(maxWidth: .infinity, alignment: .leading)
+          .contentShape(Rectangle())
+          .onTapGesture { withAnimation { isExpanded.toggle() } }
+      }
+      .font(.caption)
+    } else {
+      Text("正在检查安全信息…").font(.caption).foregroundStyle(.secondary)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginManagementSection.swift b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginManagementSection.swift
new file mode 100644
index 000000000..3b26f29ae
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginManagementSection.swift
@@ -0,0 +1,90 @@
+import AppKit
+import SwiftUI
+
+struct PluginManagementSection: View {
+  @ObservedObject var model: PluginManagementModel
+  @ObservedObject private var catalog: PluginCatalog
+  @State private var editor: PluginEditorSession?
+  @State private var removal: PluginManagementRow?
+  @State private var failure: String?
+
+  init(model: PluginManagementModel) {
+    self.model = model
+    catalog = model.catalog
+  }
+
+  var body: some View {
+    Section {
+      if model.snapshot.mappingsUnreadable {
+        Text(PluginManagementCopy.error(PluginMappingError.unreadable))
+          .foregroundStyle(.red)
+        Button("重试读取") {
+          do { try model.retryReading() } catch { failure = PluginManagementCopy.error(error) }
+        }
+      } else {
+        ForEach(model.rows) { entry in
+          pluginRow(entry)
+        }
+        HStack {
+          Button {
+            editor = model.beginAdding()
+          } label: {
+            HStack(spacing: 8) {
+              Text("新增插件")
+              Image(systemName: "chevron.right")
+                .font(.caption.weight(.semibold))
+            }
+          }
+          .buttonStyle(.bordered)
+          Spacer()
+          Button("刷新") { model.refresh() }
+        }
+      }
+    } header: {
+      Text("插件").font(.headline).padding(.vertical, 2)
+    }
+    .onAppear { model.refresh() }
+    .onReceive(
+      NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)
+    ) { _ in
+      model.refresh()
+    }
+    .sheet(item: $editor) { session in
+      PluginEditorSheet(model: model, session: session)
+    }
+    .confirmationDialog(
+      "删除用户插件？",
+      isPresented: Binding(get: { removal != nil }, set: { if !$0 { removal = nil } }),
+      titleVisibility: .visible, presenting: removal
+    ) { entry in
+      Button("删除", role: .destructive) {
+        guard let id = entry.recordID else { return }
+        do { try model.remove(id) } catch { failure = PluginManagementCopy.error(error) }
+      }
+      Button("取消", role: .cancel) {}
+    } message: { entry in
+      Text(
+        entry.names.joined(separator: ", ") + "\n\n"
+          + String(localized: "删除此记录的全部名称。服务器引用保留，同名内置插件恢复；其他名称可能无法连接。"))
+    }
+    .alert(
+      "插件配置操作失败",
+      isPresented: Binding(
+        get: { failure != nil }, set: { if !$0 { failure = nil } }
+      )
+    ) {
+      Button("确定", role: .cancel) { failure = nil }
+    } message: {
+      Text(failure ?? "")
+    }
+  }
+
+  private func pluginRow(_ entry: PluginManagementRow) -> some View {
+    PluginManagementRowView(
+      entry: entry, catalog: catalog,
+      beginManagedSettings: { editor = model.beginManagedSettings($0) },
+      beginOverriding: { editor = model.beginOverriding($0) },
+      beginEditing: { editor = model.beginEditing($0) },
+      remove: { removal = entry })
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginOptionsEditor.swift b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginOptionsEditor.swift
new file mode 100644
index 000000000..fc8b6ed7a
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/Plugin/PluginOptionsEditor.swift
@@ -0,0 +1,274 @@
+import SwiftUI
+
+struct PluginOptionsEditor: View {
+  @ObservedObject var draft: PluginOptionsDraft
+  let fieldError: ServerFormFieldError?
+  let fieldFocus: FocusState<ServerFormField?>.Binding
+
+  struct EditingValue: Identifiable {
+    let id: UUID
+    let text: String
+  }
+
+  @State private var editingValue: EditingValue?
+  @FocusState private var focusedRowID: UUID?
+  @FocusState private var focusedValueRowID: UUID?
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 8) {
+      PluginOptionsModePicker(draft: draft)
+      switch draft.mode {
+      case .table:
+        tableView
+      case .rawText:
+        rawTextView
+      }
+      fieldErrorLabel
+    }
+    .onChange(of: fieldError) { _, error in
+      // 首错定位：未完成行时聚焦第一行的参数名。
+      if case .unfinishedPluginOptionRow = error,
+        let first = draft.rows.first(where: \.isUnfinished)
+      {
+        focusedRowID = first.id
+      }
+    }
+    .sheet(item: $editingValue) { value in
+      PluginOptionValueEditorSheet(initialText: value.text) { newValue in
+        draft.updateValue(newValue, of: value.id)
+      }
+    }
+  }
+
+  // MARK: - 参数列表（Table 布局）
+
+  private var tableView: some View {
+    // 无排序 Table 的列泛型固定为 Never，TableColumn 初值的 width:/value:
+    // 参数接不上（实测 macOS 15 SDK）；列宽经实例方法 width(min:ideal:max:)
+    // 表达：类型/操作列定宽、参数名列限宽、值列无约束弹性吸收剩余宽度。
+    Table(draft.rows) {
+      TableColumn("类型") { row in
+        Picker(
+          "参数类型",
+          selection: Binding(
+            get: { row.kind },
+            set: { draft.setKind($0, of: row.id) })
+        ) {
+          Text("值").tag(PluginOptionsDraft.Kind.keyValue)
+          Text("开关").tag(PluginOptionsDraft.Kind.flag)
+        }
+        .labelsHidden()
+        .pickerStyle(.segmented)
+        .controlSize(.small)
+      }
+      .width(min: 96, ideal: 96, max: 96)
+      TableColumn("参数名") { row in
+        HStack(spacing: 4) {
+          TextField(
+            "参数名",
+            text: Binding(
+              get: { row.keyText },
+              set: { draft.updateKey($0, of: row.id) })
+          )
+          .textFieldStyle(.plain)
+          .focused($focusedRowID, equals: row.id)
+          if row.isUnfinished {
+            Image(systemName: "exclamationmark.circle.fill")
+              .font(.caption)
+              .foregroundStyle(.red)
+              .help("缺少参数名")
+          }
+        }
+      }
+      .width(min: 72, ideal: 96, max: 140)
+      TableColumn("值") { row in
+        TextField(
+          "值",
+          text: Binding(
+            get: { row.valueText },
+            set: { draft.updateValue($0, of: row.id) })
+        )
+        .textFieldStyle(.plain)
+        .lineLimit(1)
+        .truncationMode(.tail)
+        .disabled(row.kind == .flag)
+        .focused($focusedValueRowID, equals: row.id)
+      }
+      TableColumn("操作") { row in
+        HStack(spacing: 8) {
+          Button {
+            draft.moveRow(row.id, by: -1)
+          } label: {
+            Image(systemName: "chevron.up")
+          }
+          .buttonStyle(.borderless)
+          .help("上移")
+          .disabled(!draft.canMoveRow(row.id, by: -1))
+
+          Button {
+            draft.moveRow(row.id, by: 1)
+          } label: {
+            Image(systemName: "chevron.down")
+          }
+          .buttonStyle(.borderless)
+          .help("下移")
+          .disabled(!draft.canMoveRow(row.id, by: 1))
+
+          Button {
+            editingValue = EditingValue(id: row.id, text: row.valueText)
+          } label: {
+            Label("编辑值…", systemImage: "square.and.pencil")
+          }
+          .buttonStyle(.borderless)
+          .disabled(row.kind == .flag)
+
+          Button {
+            draft.deleteRow(row.id)
+          } label: {
+            Label("删除", systemImage: "trash")
+          }
+          .buttonStyle(.borderless)
+        }
+      }
+      .width(min: 196, ideal: 208, max: 224)
+    }
+    .tableStyle(.inset)
+    .frame(height: editTableHeight)
+  }
+
+  /// 行数驱动的表格高度：单行约 30pt，夹在上下限之间。
+  private var editTableHeight: CGFloat {
+    max(min(52 + CGFloat(draft.rows.count) * 30, 440), 112)
+  }
+
+  // MARK: - 原始文本
+
+  private var rawTextView: some View {
+    TextEditor(text: $draft.rawText)
+      .font(.system(.body, design: .monospaced))
+      .frame(minHeight: 76, maxHeight: 152)
+      .autocorrectionDisabled()
+      .focused(fieldFocus, equals: .pluginOptions)
+      .overlay(
+        RoundedRectangle(cornerRadius: 6)
+          .stroke(Color(nsColor: .separatorColor))
+      )
+  }
+
+  // MARK: - 字段错误
+
+  @ViewBuilder
+  private var fieldErrorLabel: some View {
+    switch fieldError {
+    case .tooManyBytes(let limit):
+      Text("插件参数最多 \(limit) 个字节")
+        .font(.footnote)
+        .foregroundStyle(.red)
+    case .unfinishedPluginOptionRow:
+      Text("存在未完成的参数行：请补全参数名、清空该行或删除它")
+        .font(.footnote)
+        .foregroundStyle(.red)
+    case .missingName, .tooManyCharacters, .invalidPort, nil:
+      EmptyView()
+    }
+  }
+}
+
+/// 订阅节点的参数只读呈现：Table 控件的表格展现与原始文本
+/// 只读，可切换查看模式，无任何编辑入口。
+struct PluginOptionsReadOnlyEditor: View {
+  @ObservedObject var draft: PluginOptionsDraft
+
+  private var visibleRows: [PluginOptionsDraft.Row] {
+    draft.rows.filter { !$0.isBlank }
+  }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 8) {
+      PluginOptionsModePicker(draft: draft)
+      switch draft.mode {
+      case .table:
+        Table(visibleRows) {
+          TableColumn("参数名") { row in
+            Text(row.keyText)
+              .lineLimit(1)
+              .truncationMode(.tail)
+              .textSelection(.enabled)
+          }
+          .width(min: 72, ideal: 120, max: 220)
+          TableColumn("值") { row in
+            // 值单元格单行展示、尾部省略；完整内容保留在草稿与无障碍读取中。
+            Text(row.valueText)
+              .lineLimit(1)
+              .truncationMode(.tail)
+              .textSelection(.enabled)
+          }
+          TableColumn("类型") { row in
+            Text(row.kind == .flag ? String(localized: "开关") : String(localized: "值"))
+              .foregroundStyle(.secondary)
+          }
+          .width(min: 48, ideal: 56, max: 64)
+        }
+        .tableStyle(.inset)
+        .frame(height: readOnlyTableHeight)
+      case .rawText:
+        ScrollView {
+          Text(draft.rawText)
+            .font(.system(.body, design: .monospaced))
+            .frame(maxWidth: .infinity, alignment: .leading)
+            .textSelection(.enabled)
+        }
+        .frame(minHeight: 76, maxHeight: 152)
+        .overlay(
+          RoundedRectangle(cornerRadius: 6)
+            .stroke(Color(nsColor: .separatorColor))
+        )
+      }
+    }
+  }
+
+  private var readOnlyTableHeight: CGFloat {
+    max(min(48 + CGFloat(visibleRows.count) * 28, 400), 96)
+  }
+}
+
+/// 长值独立编辑：等宽多行、初始约四行最多约八行后内部纵向
+/// 滚动；只有「确认」写回父表单草稿，取消保留之前的值。
+private struct PluginOptionValueEditorSheet: View {
+  let initialText: String
+  let onConfirm: (String) -> Void
+  @Environment(\.dismiss) private var dismiss
+  @State private var text: String
+
+  init(initialText: String, onConfirm: @escaping (String) -> Void) {
+    self.initialText = initialText
+    self.onConfirm = onConfirm
+    _text = State(initialValue: initialText)
+  }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 12) {
+      Text("值")
+        .font(.headline)
+      TextEditor(text: $text)
+        .font(.system(.body, design: .monospaced))
+        .frame(minHeight: 76, maxHeight: 152)
+        .autocorrectionDisabled()
+        .overlay(
+          RoundedRectangle(cornerRadius: 6)
+            .stroke(Color(nsColor: .separatorColor))
+        )
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel) { dismiss() }
+        Button("确认") {
+          onConfirm(text)
+          dismiss()
+        }
+        .keyboardShortcut(.defaultAction)
+      }
+    }
+    .padding(16)
+    .frame(minWidth: 380, minHeight: 220)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/Plugin/ServerPluginSection.swift b/ShadowsocksX-NG2/App/UI/Servers/Plugin/ServerPluginSection.swift
new file mode 100644
index 000000000..796916beb
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/Plugin/ServerPluginSection.swift
@@ -0,0 +1,152 @@
+import SwiftUI
+
+/// 服务器表单通过目录事实解释名称引用；参数草稿独立于插件来源。
+struct ServerPluginSection: View {
+  @Binding var selection: PluginSelection
+  @ObservedObject var options: PluginOptionsDraft
+  let plugin: PluginSectionState?
+  let isEditable: Bool
+  /// 参数字段的行内校验错误（字节超限或未完成行）。
+  let optionsError: ServerFormFieldError?
+  let optionsFocus: FocusState<ServerFormField?>.Binding
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 6) {
+      picker
+      detail
+    }
+  }
+
+  @ViewBuilder
+  private var picker: some View {
+    if let plugin {
+      Picker("插件", selection: $selection) {
+        Text("无").tag(PluginSelection.none)
+        ForEach(plugin.programs.map(\.program), id: \.self) { program in
+          Text(program).tag(
+            selection == .unknown(program: program)
+              ? selection : PluginSelection.named(program: program))
+        }
+        if let program = plugin.unresolvedProgram(for: selection) {
+          Text(program).tag(selection)
+        }
+        if plugin.selection != selection,
+          let program = plugin.unresolvedProgram(for: plugin.selection)
+        {
+          Text(program).tag(plugin.selection)
+        }
+      }
+      .disabled(!isEditable)
+    } else {
+      LabeledContent("插件") {
+        Text("不可用").foregroundStyle(.secondary)
+      }
+    }
+  }
+
+  @ViewBuilder
+  private var detail: some View {
+    if let plugin {
+      switch selection {
+      case .none:
+        EmptyView()
+      case .named(let program), .unknown(let program):
+        if plugin.unresolvedProgram(for: selection) != nil {
+          unknownNotice(program: program, plugin: plugin)
+        } else {
+          namedPluginDetails(program: program, plugin: plugin)
+        }
+      }
+    }
+  }
+
+  /// 目录中的名称引用：参数编辑区与可用性警告；订阅只读走独立只读视图。
+  @ViewBuilder
+  private func namedPluginDetails(program: String, plugin: PluginSectionState) -> some View {
+    VStack(alignment: .leading, spacing: 8) {
+      availabilityNotice(program: program, plugin: plugin)
+      Text("插件参数")
+        .font(.callout.weight(.medium))
+        .foregroundStyle(.secondary)
+      if isEditable {
+        PluginOptionsEditor(
+          draft: options,
+          fieldError: optionsError,
+          fieldFocus: optionsFocus)
+      } else {
+        PluginOptionsReadOnlyEditor(draft: options)
+      }
+    }
+  }
+
+  /// 集外引用：原样保留并明确指出当前 app 无法提供该插件。
+  @ViewBuilder
+  private func unknownNotice(program: String, plugin: PluginSectionState) -> some View {
+    VStack(alignment: .leading, spacing: 8) {
+      if plugin.mappingsUnreadable {
+        availabilityNotice(program: program, plugin: plugin)
+      } else {
+        warning(Text("未找到插件“\(program)”。引用和已保存参数将保留；可添加同名用户插件，或改选其他插件或“无”。"))
+      }
+      if plugin.optionsPresent {
+        Text("插件参数已配置（存于钥匙串，原样保留）。")
+          .font(.footnote)
+          .foregroundStyle(.secondary)
+      }
+    }
+  }
+
+  @ViewBuilder
+  private func availabilityNotice(program: String, plugin: PluginSectionState) -> some View {
+    if let message = plugin.availabilityWarning(for: program) {
+      warning(Text(message))
+    }
+  }
+
+  private func warning(_ text: Text) -> some View {
+    Label {
+      text
+    } icon: {
+      Image(systemName: "exclamationmark.triangle.fill")
+    }
+    .font(.footnote)
+    .foregroundStyle(.orange)
+  }
+}
+
+/// 查看模式切换（参数列表 ⇄ 原始文本）；被未完成行拒绝时回弹到当前模式。
+struct PluginOptionsModePicker: View {
+  @ObservedObject var draft: PluginOptionsDraft
+  @State private var displayedMode = PluginOptionsDraft.Mode.table
+
+  var body: some View {
+    Picker("查看模式", selection: modeBinding) {
+      Text("参数列表").tag(PluginOptionsDraft.Mode.table)
+      Text("原始文本").tag(PluginOptionsDraft.Mode.rawText)
+    }
+    .pickerStyle(.segmented)
+    .labelsHidden()
+    .onChange(of: draft.mode) { _, mode in
+      displayedMode = mode
+    }
+  }
+
+  private var modeBinding: Binding<PluginOptionsDraft.Mode> {
+    Binding(
+      get: { displayedMode },
+      set: { requested in
+        displayedMode = requested
+        // macOS 分段 Picker 在 SwiftUI 更新事务内调用绑定 setter；草稿的
+        // @Published 更新须离开该事务，避免向观察视图同步发布变更。
+        Task { @MainActor in
+          let succeeded =
+            requested == .rawText ? draft.switchToRawText() : draft.switchToTable()
+          displayedMode = succeeded ? requested : draft.mode
+        }
+      })
+  }
+}
+
+/// 插件参数编辑区：Table 布局的无边框输入行——行首「值/开关」
+/// 分段选择器决定行的值形态，底部空行即快速添加入口，长值经「编辑值…」
+/// 独立编辑；切换查看模式不触发表单变更检测。
diff --git a/ShadowsocksX-NG2/App/UI/Servers/RenameGroupSheet.swift b/ShadowsocksX-NG2/App/UI/Servers/RenameGroupSheet.swift
new file mode 100644
index 000000000..ab3466f95
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/RenameGroupSheet.swift
@@ -0,0 +1,53 @@
+import SwiftUI
+
+/// 重命名分组表单：名称初值取现名；失败保留名称，成功才关闭。
+struct RenameGroupSheet: View {
+  let workflow: CatalogWorkflow
+  let errors: ErrorAlertPresenter
+  let nodeID: NodeID
+  @Environment(\.dismiss) private var dismiss
+  @State private var name: String
+  @State private var isSubmitting = false
+  @FocusState private var nameFocused: Bool
+
+  init(workflow: CatalogWorkflow, errors: ErrorAlertPresenter, nodeID: NodeID) {
+    self.workflow = workflow
+    self.errors = errors
+    self.nodeID = nodeID
+    // 打开时的现名仅作为初值，后续编辑由本表单持有。
+    _name = State(initialValue: workflow.displayName(for: nodeID))
+  }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 16) {
+      Text("重命名分组").font(.title2)
+      TextField("名称", text: $name)
+        .focused($nameFocused)
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel) { dismiss() }
+        Button("保存") { rename() }
+          .keyboardShortcut(.defaultAction)
+      }
+    }
+    .padding(20)
+    .frame(width: 360)
+    .disabled(isSubmitting)
+    .interactiveDismissDisabled(isSubmitting)
+    .defaultFocus($nameFocused, true)
+  }
+
+  private func rename() {
+    guard !isSubmitting else { return }
+    isSubmitting = true
+    Task {
+      defer { isSubmitting = false }
+      do {
+        try await workflow.renameGroup(nodeID, to: name)
+        dismiss()
+      } catch {
+        errors.present(error)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServerDetailParameters.swift b/ShadowsocksX-NG2/App/UI/Servers/ServerDetailParameters.swift
new file mode 100644
index 000000000..7f0c374d7
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServerDetailParameters.swift
@@ -0,0 +1,30 @@
+import Combine
+
+/// 只读详情的参数会话：切换身份清空旧值，刷新失败不展示过时参数。
+@MainActor
+final class ServerDetailParameters: ObservableObject {
+  let options = PluginOptionsDraft()
+  @Published private(set) var failure: ServerFormLoadError?
+  private var serverID: NodeID?
+
+  func showServer(_ id: NodeID, load: (NodeID) throws -> String) {
+    serverID = id
+    reload(load: load)
+  }
+
+  func reload(load: (NodeID) throws -> String) {
+    guard let serverID else { return }
+    options.load("")
+    do {
+      options.load(try load(serverID))
+      failure = nil
+    } catch {
+      failure = (error as? ServerFormLoadError) ?? .credentialsUnavailable
+    }
+  }
+
+  func didRefresh(affectedServers: Set<NodeID>, load: (NodeID) throws -> String) {
+    guard let serverID, affectedServers.contains(serverID) else { return }
+    reload(load: load)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServerFormFields.swift b/ShadowsocksX-NG2/App/UI/Servers/ServerFormFields.swift
new file mode 100644
index 000000000..a62355dc3
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServerFormFields.swift
@@ -0,0 +1,334 @@
+import Combine
+import SwiftUI
+
+/// 表单字段标识：字段级校验错误的挂靠位与首错定位序（表单栅格顺序）。
+enum ServerFormField: Hashable {
+  case name
+  case address
+  case port
+  case password
+  case pluginOptions
+
+  static let focusOrder: [ServerFormField] = [.name, .address, .port, .password, .pluginOptions]
+}
+
+/// 字段级校验错误：只携带字段、原因与上限，不回显字段内容；
+/// 文案归呈现层（`ServerFormFieldsGrid`）。
+enum ServerFormFieldError: Equatable {
+  /// 名称必填（原有规则并入统一校验入口）。
+  case missingName
+  /// 用户可见字符（Swift `Character`）超上限。
+  case tooManyCharacters(limit: Int)
+  /// UTF-8 字节超上限（插件参数按最终字符串的字节数计量）。
+  case tooManyBytes(limit: Int)
+  /// 端口草稿为空、含非十进制数字、超过五位或落在 1–65535 之外。
+  case invalidPort
+  /// 参数列表存在未完成行（有值或开关形态却没有参数名）。
+  case unfinishedPluginOptionRow
+}
+
+/// 服务器表单草稿（UI 持有）：连接字段草稿状态与「字段 ↔ ServerEditForm/
+/// ServerEditDraft 命令」的映射只在此写一次；新建与编辑两个表单面各自
+/// `@StateObject` 持有一份，经 `load(from:)` 装载、`draft` 提交，第三个表单
+/// 面接入只需学这一对方法。栅格渲染见 `ServerFormFieldsGrid`；编辑资格
+/// 与插件区 facts 由 caller 注入。
+@MainActor
+final class ServerFormFields: ObservableObject {
+  /// 手动表单的产品输入上限：不宣称是 DNS、Shadowsocks 或
+  /// SIP003 协议的最大长度；导入、订阅刷新与既有保存数据不执行这些上限。
+  static let nameCharacterLimit = 128
+  static let addressCharacterLimit = 255
+  static let portDigitLimit = 5
+  static let passwordCharacterLimit = 1_024
+  static let pluginOptionsUTF8Limit = 65_536
+
+  @Published var address = "" { didSet { clearError(.address) } }
+  /// 端口十进制编辑草稿：提交前经 `validateForSubmit` 验证，不用数值绑定
+  /// 以免转换失败时悄悄提交旧绑定值。
+  @Published var portText = "" { didSet { clearError(.port) } }
+  @Published var encryptionMethod = ""
+  @Published var password = "" { didSet { clearError(.password) } }
+  @Published var remark = "" {
+    didSet {
+      if !nameIsEmpty { clearError(.name) }
+    }
+  }
+  @Published var pluginChoice: PluginSelection = .none
+  /// 插件参数会话草稿：行/模式/原文收在模块内，提交串取
+  /// `composedString`；编辑参数即清除参数字段错误，变更通知转发给本类
+  /// 观察者（视图只观察 ServerFormFields）。
+  let pluginOptions = PluginOptionsDraft()
+  private var pluginOptionsChanges: AnyCancellable?
+  @Published var showPassword = false
+  @Published private(set) var fieldErrors: [ServerFormField: ServerFormFieldError] = [:]
+  @Published private var savedDraft: ServerEditDraft?
+
+  @Published private(set) var serverID: NodeID?
+  @Published private(set) var presentation: ServerFormPresentation?
+  @Published private(set) var loadFailure: ServerFormLoadError?
+  @Published private(set) var hasLoadedServer = false
+
+  var canSaveServer: Bool {
+    hasLoadedServer && loadFailure == nil && presentation?.isEditable == true
+  }
+
+  init() {
+    pluginOptionsChanges = pluginOptions.objectWillChange.sink { [weak self] _ in
+      guard let self else { return }
+      self.clearError(.pluginOptions)
+      self.objectWillChange.send()
+    }
+  }
+
+  /// 变更检测按提交草稿比较；端口在草稿可解析时按数值比较（如前导零改写
+  /// 不算变更），不可解析视为已变更，保证非法输入后保存入口仍可点击并在
+  /// 提交时得到行内错误，而不是按钮死锁。
+  var hasChanges: Bool {
+    draft != savedDraft
+  }
+
+  private var nameIsEmpty: Bool {
+    remark.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
+  }
+
+  /// 提交前的全量校验：名称必填与五字段输入上限；与装载基线
+  /// 逐字相同的超限字段放行（未修改的历史超长值不阻塞其他变更保存）。
+  /// 错误逐字段发布，重新编辑对应字段即清除；首次装载不显示。
+  @discardableResult
+  func validateForSubmit() -> Bool {
+    var errors: [ServerFormField: ServerFormFieldError] = [:]
+    if nameIsEmpty {
+      errors[.name] = .missingName
+    } else {
+      errors[.name] = characterLimitError(
+        raw: remark, measured: remark.trimmingCharacters(in: .whitespacesAndNewlines),
+        baseline: savedDraft?.remark, limit: Self.nameCharacterLimit)
+    }
+    errors[.address] = characterLimitError(
+      raw: address, measured: address.trimmingCharacters(in: .whitespaces),
+      baseline: savedDraft?.address, limit: Self.addressCharacterLimit)
+    if submittablePort == nil {
+      errors[.port] = .invalidPort
+    }
+    errors[.password] = characterLimitError(
+      raw: password, measured: password,
+      baseline: savedDraft?.password, limit: Self.passwordCharacterLimit)
+    if pluginChoice != .none {
+      if pluginOptions.hasUnfinishedRows {
+        errors[.pluginOptions] = .unfinishedPluginOptionRow
+      } else if let options = pluginOptions.composedString {
+        errors[.pluginOptions] = utf8LimitError(
+          raw: options, baseline: savedDraft?.pluginOptions,
+          limit: Self.pluginOptionsUTF8Limit)
+      }
+    }
+    fieldErrors = errors
+    return errors.isEmpty
+  }
+
+  /// 首个待修正字段（首错定位用）；无错误时为 nil。
+  var firstErrorField: ServerFormField? {
+    ServerFormField.focusOrder.first { fieldErrors[$0] != nil }
+  }
+
+  /// 新建表单的默认字段：端口 8388、加密 aes-256-gcm、插件「无」。
+  static func newForm() -> ServerFormFields {
+    let fields = ServerFormFields()
+    fields.portText = "8388"
+    fields.encryptionMethod = "aes-256-gcm"
+    fields.savedDraft = fields.draft
+    return fields
+  }
+
+  /// 当前 sslocal 能力目录；目录中既有的未知方法原样追加显示，便于用户修复。
+  /// 新建面初值恒在集内，追加分支不会触发，与仅列集内值行为一致。
+  var methodChoices: [String] {
+    var choices = EncryptionMethodCatalog.supported.sorted()
+    if !encryptionMethod.isEmpty && !choices.contains(encryptionMethod) {
+      choices.append(encryptionMethod)
+    }
+    return choices
+  }
+
+  /// 从编辑面状态装载（凭据明文只在编辑命令中出现）；重置密码
+  /// 明文显示。
+  func load(from state: ServerEditForm) {
+    address = state.address
+    portText = String(state.port)
+    encryptionMethod = state.encryptionMethod
+    password = state.password
+    remark = state.remark
+    pluginChoice = state.plugin.selection
+    pluginOptions.load(state.plugin.options)
+    showPassword = false
+    fieldErrors = [:]
+    savedDraft = draft
+  }
+
+  /// 提交载荷：配置与凭据字段作为一个逻辑变更。端口取自十进制
+  /// 草稿、插件参数取自会话草稿拼装串；任一不能作为提交值（无效端口或
+  /// 未完成参数行）时为 nil——本 getter 仅在 `validateForSubmit` 通过后
+  /// 消费，无效输入不得悄悄回落到旧值。
+  var draft: ServerEditDraft? {
+    guard let port = submittablePort, let options = pluginOptions.composedString else { return nil }
+    return ServerEditDraft(
+      address: address,
+      port: port,
+      encryptionMethod: encryptionMethod,
+      password: password,
+      remark: remark,
+      plugin: pluginChoice,
+      pluginOptions: options)
+  }
+
+  // MARK: - Explicit server loading
+
+  /// Reappearing with the same selection preserves the loaded draft, including failures.
+  func showServer(_ id: NodeID, load: (NodeID) throws -> ServerEditForm?) {
+    guard serverID != id else { return }
+    serverID = id
+    clearLoadedServer()
+    reloadServer(load: load)
+  }
+
+  func updatePresentation(
+    _ facts: ServerFormPresentation?,
+    preservingDraft: Bool = false,
+    load: ((NodeID) throws -> ServerEditForm?)? = nil
+  ) {
+    if preservingDraft {
+      updatePresentationFacts(facts)
+      return
+    }
+    updatePluginSelection(from: facts, load: load)
+    updatePresentationFacts(facts)
+  }
+
+  private func updatePresentationFacts(_ facts: ServerFormPresentation?) {
+    if presentation != facts { presentation = facts }
+  }
+
+  private func updatePluginSelection(
+    from facts: ServerFormPresentation?, load: ((NodeID) throws -> ServerEditForm?)?
+  ) {
+    guard let selection = facts?.plugin.selection,
+      presentation?.plugin.selection != selection,
+      pluginProgram(pluginChoice) != nil,
+      pluginProgram(pluginChoice) == pluginProgram(selection),
+      savedDraft?.plugin == pluginChoice
+    else { return }
+    refreshUnknownPluginOptions(for: selection, load: load)
+    pluginChoice = selection
+    savedDraft?.plugin = selection
+  }
+
+  private func refreshUnknownPluginOptions(
+    for selection: PluginSelection, load: ((NodeID) throws -> ServerEditForm?)?
+  ) {
+    guard case .unknown = pluginChoice, case .named = selection,
+      let serverID, let load,
+      pluginOptions.composedString == savedDraft?.pluginOptions
+    else { return }
+    do {
+      if let form = try load(serverID) {
+        pluginOptions.load(form.plugin.options)
+        savedDraft?.pluginOptions = pluginOptions.composedString
+      }
+    } catch {
+      loadFailure = .credentialsUnavailable
+    }
+  }
+
+  private func pluginProgram(_ selection: PluginSelection) -> String? {
+    switch selection {
+    case .named(let program), .unknown(let program): return program
+    case .none: return nil
+    }
+  }
+
+  /// Only a manual reset failure may retain a successfully loaded draft.
+  func reloadServer(load: (NodeID) throws -> ServerEditForm?) {
+    guard let serverID else { return }
+    let preserveDraft = hasLoadedServer && presentation?.isEditable == true
+    do {
+      guard let form = try load(serverID) else { throw ServerFormLoadError.notFound }
+      self.load(from: form)
+      presentation = ServerFormPresentation(isEditable: form.isEditable, plugin: form.plugin)
+      hasLoadedServer = true
+      loadFailure = nil
+    } catch {
+      if !preserveDraft { clearLoadedServer() }
+      loadFailure = (error as? ServerFormLoadError) ?? .credentialsUnavailable
+    }
+  }
+
+  /// A late save completion must not reset a different server's draft.
+  func didSaveServer(_ id: NodeID, load: (NodeID) throws -> ServerEditForm?) {
+    guard serverID == id else { return }
+    reloadServer(load: load)
+  }
+
+  /// Only successful refreshes of the displayed read-only server trigger a reload.
+  func subscriptionDidRefresh(
+    affectedServers: Set<NodeID>, load: (NodeID) throws -> ServerEditForm?
+  ) {
+    guard let serverID, affectedServers.contains(serverID),
+      presentation?.isEditable == false
+    else { return }
+    reloadServer(load: load)
+  }
+
+  private func clearLoadedServer() {
+    address = ""
+    portText = ""
+    encryptionMethod = ""
+    password = ""
+    remark = ""
+    pluginChoice = .none
+    pluginOptions.load("")
+    showPassword = false
+    fieldErrors = [:]
+    savedDraft = nil
+    presentation = nil
+    hasLoadedServer = false
+    loadFailure = nil
+  }
+
+  // MARK: - 校验实现
+
+  /// 端口草稿可否作为提交端口：非空、纯 ASCII 十进制数字、不超过五位且
+  /// 落在 1–65535。
+  private var submittablePort: Int? {
+    guard !portText.isEmpty, portText.count <= Self.portDigitLimit,
+      portText.allSatisfy({ ("0"..."9").contains($0) }),
+      let port = Int(portText)
+    else { return nil }
+    return (1...65_535).contains(port) ? port : nil
+  }
+
+  /// 字符上限：与基线逐字相同（未修改）的历史超长值放行；名称与地址按
+  /// 提交值（现行首尾空白处理后）计量，密码不 trim、不 Unicode 归一化。
+  private func characterLimitError(
+    raw: String, measured: String, baseline: String?, limit: Int
+  ) -> ServerFormFieldError? {
+    guard baseline == nil || raw != baseline else { return nil }
+    return measured.count > limit ? .tooManyCharacters(limit: limit) : nil
+  }
+
+  /// 插件参数字节上限：按最终参数字符串的 UTF-8 字节数计量（含分隔符与
+  /// 转义），与基线逐字相同的未修改值放行。
+  private func utf8LimitError(
+    raw: String, baseline: String?, limit: Int
+  ) -> ServerFormFieldError? {
+    guard baseline == nil || raw != baseline else { return nil }
+    return raw.utf8.count > limit ? .tooManyBytes(limit: limit) : nil
+  }
+
+  private func clearError(_ field: ServerFormField) {
+    guard fieldErrors[field] != nil else { return }
+    fieldErrors[field] = nil
+  }
+}
+
+/// 新建与编辑共享的名称优先表单；焦点由提交入口持有，校验失败时定位首个
+/// 待修正字段。
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServerFormFieldsGrid.swift b/ShadowsocksX-NG2/App/UI/Servers/ServerFormFieldsGrid.swift
new file mode 100644
index 000000000..08b70d335
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServerFormFieldsGrid.swift
@@ -0,0 +1,149 @@
+import SwiftUI
+
+struct ServerFormFieldsGrid: View {
+  @ObservedObject var fields: ServerFormFields
+  let plugin: PluginSectionState?
+  let isEditable: Bool
+  let fieldFocus: FocusState<ServerFormField?>.Binding
+  var location: CreationLocationField?
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 18) {
+      row("名称") {
+        TextField("名称", text: $fields.remark, prompt: Text("例如：香港服务器"))
+          .textFieldStyle(.roundedBorder)
+          .focused(fieldFocus, equals: .name)
+          .disabled(!isEditable)
+        fieldErrorLabel(.name)
+      }
+      if let location { location }
+      ServerEndpointLayout {
+        row("服务器地址") {
+          TextField("服务器地址", text: $fields.address)
+            .textFieldStyle(.roundedBorder)
+            .focused(fieldFocus, equals: .address)
+            .disabled(!isEditable)
+          fieldErrorLabel(.address)
+        }
+        row("端口") {
+          TextField("端口", text: $fields.portText)
+            .textFieldStyle(.roundedBorder)
+            .focused(fieldFocus, equals: .port)
+            .disabled(!isEditable)
+          fieldErrorLabel(.port)
+        }
+      }
+      Picker("加密方式", selection: $fields.encryptionMethod) {
+        ForEach(fields.methodChoices, id: \.self) { Text($0).tag($0) }
+      }
+      .disabled(!isEditable)
+      row("密码") {
+        HStack(spacing: 8) {
+          Group {
+            if fields.showPassword {
+              TextField("密码", text: $fields.password)
+                .background(PasswordAutofillOptOut())
+            } else {
+              SecureField("密码", text: $fields.password)
+                .background(PasswordAutofillOptOut())
+            }
+          }
+          .textFieldStyle(.roundedBorder)
+          .textContentType(nil)
+          .autocorrectionDisabled()
+          .focused(fieldFocus, equals: .password)
+          .disabled(!isEditable)
+          Button {
+            fields.showPassword.toggle()
+          } label: {
+            Image(systemName: fields.showPassword ? "eye.slash" : "eye")
+          }
+          .buttonStyle(.borderless)
+          .help(fields.showPassword ? String(localized: "隐藏密码") : String(localized: "显示密码"))
+          .accessibilityLabel(
+            fields.showPassword ? String(localized: "隐藏密码") : String(localized: "显示密码"))
+        }
+        fieldErrorLabel(.password)
+      }
+      ServerPluginSection(
+        selection: $fields.pluginChoice,
+        options: fields.pluginOptions,
+        plugin: plugin,
+        isEditable: isEditable,
+        optionsError: fields.fieldErrors[.pluginOptions],
+        optionsFocus: fieldFocus)
+    }
+  }
+
+  private func row<Content: View>(
+    _ label: LocalizedStringKey, @ViewBuilder content: () -> Content
+  ) -> some View {
+    HStack(alignment: .firstTextBaseline, spacing: 8) {
+      Text(label)
+        .fixedSize()
+      VStack(alignment: .leading, spacing: 6) {
+        content()
+      }
+      .frame(maxWidth: .infinity, alignment: .leading)
+    }
+  }
+
+  /// 字段行内错误：只呈现字段、原因与上限，不回显字段内容。
+  @ViewBuilder
+  private func fieldErrorLabel(_ field: ServerFormField) -> some View {
+    if let error = fields.fieldErrors[field] {
+      Text(errorText(error, field: field))
+        .font(.footnote)
+        .foregroundStyle(.red)
+    }
+  }
+
+  private func errorText(_ error: ServerFormFieldError, field: ServerFormField)
+    -> LocalizedStringKey
+  {
+    switch error {
+    case .missingName:
+      return "请输入服务器名称"
+    case .tooManyCharacters(let limit):
+      switch field {
+      case .name: return "名称最多 \(limit) 个字符"
+      case .address: return "服务器地址最多 \(limit) 个字符"
+      case .password: return "密码最多 \(limit) 个字符"
+      case .port, .pluginOptions: return ""
+      }
+    case .tooManyBytes(let limit):
+      return "插件参数最多 \(limit) 个字节"
+    case .invalidPort:
+      return "端口必须是 1–65535 的数字（最多 \(ServerFormFields.portDigitLimit) 位）"
+    case .unfinishedPluginOptionRow:
+      return ""
+    }
+  }
+}
+
+/// 扣除间距后按 4:1 分配地址和端口宽度，高度由字段自身决定。
+private struct ServerEndpointLayout: Layout {
+  private let spacing: CGFloat = 20
+
+  func sizeThatFits(proposal: ProposedViewSize, subviews: Subviews, cache: inout ()) -> CGSize {
+    let width = proposal.width ?? 480
+    let unit = max(0, width - spacing) / 5
+    let height =
+      subviews.enumerated().map { index, view in
+        view.sizeThatFits(ProposedViewSize(width: unit * (index == 0 ? 4 : 1), height: nil)).height
+      }.max() ?? 0
+    return CGSize(width: width, height: height)
+  }
+
+  func placeSubviews(
+    in bounds: CGRect, proposal: ProposedViewSize, subviews: Subviews, cache: inout ()
+  ) {
+    let unit = max(0, bounds.width - spacing) / 5
+    for (index, view) in subviews.enumerated() {
+      view.place(
+        at: CGPoint(x: bounds.minX + (index == 0 ? 0 : unit * 4 + spacing), y: bounds.minY),
+        anchor: .topLeading,
+        proposal: ProposedViewSize(width: unit * (index == 0 ? 4 : 1), height: nil))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServerFormSheet.swift b/ShadowsocksX-NG2/App/UI/Servers/ServerFormSheet.swift
new file mode 100644
index 000000000..6b8eb243a
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServerFormSheet.swift
@@ -0,0 +1,163 @@
+import SwiftUI
+
+/// 新建与编辑共用表单生命周期；编辑身份固定，新建位置可逐级上移。
+struct ServerFormSheet: View {
+  enum Operation: Identifiable {
+    case create(parent: NodeID?)
+    case edit(NodeID)
+
+    var id: String {
+      switch self {
+      case .create: return "create"
+      case .edit(let id): return "edit-\(id.rawValue)"
+      }
+    }
+  }
+
+  @ObservedObject var workflow: CatalogWorkflow
+  @StateObject private var errors = ErrorAlertPresenter()
+  let operation: Operation
+  let onCreated: (NodeID) -> Void
+  @Environment(\.dismiss) private var dismiss
+  @StateObject private var fields: ServerFormFields
+  @State private var parent: NodeID?
+  @State private var isSubmitting = false
+  @State private var isConfirmingDiscard = false
+  @FocusState private var fieldFocus: ServerFormField?
+
+  init(
+    workflow: CatalogWorkflow, operation: Operation,
+    onCreated: @escaping (NodeID) -> Void
+  ) {
+    self.workflow = workflow
+    self.operation = operation
+    self.onCreated = onCreated
+    // 独立草稿和位置只在 sheet 打开时初始化，父视图更新不重建。
+    switch operation {
+    case .create(let parent):
+      _fields = StateObject(wrappedValue: ServerFormFields.newForm())
+      _parent = State(initialValue: parent)
+    case .edit:
+      _fields = StateObject(wrappedValue: ServerFormFields())
+      _parent = State(initialValue: nil)
+    }
+  }
+
+  private var editID: NodeID? {
+    if case .edit(let id) = operation { return id }
+    return nil
+  }
+
+  private var canSubmit: Bool {
+    if editID != nil { return fields.hasChanges && fields.canSaveServer }
+    return true
+  }
+
+  private var plugin: PluginSectionState? {
+    if editID != nil { return fields.presentation?.plugin }
+    return workflow.newFormPluginSection(selection: fields.pluginChoice)
+  }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 14) {
+      Text(editID == nil ? String(localized: "新建服务器") : String(localized: "编辑服务器"))
+        .font(.title2)
+      ScrollView {
+        VStack(alignment: .leading, spacing: 14) {
+          if editID != nil, fields.hasLoadedServer, fields.presentation == nil {
+            Label("服务器已不存在，无法保存。", systemImage: "exclamationmark.triangle")
+          }
+          if let failure = fields.loadFailure {
+            loadFailureNotice(failure)
+          }
+          if editID == nil || fields.hasLoadedServer {
+            ServerFormFieldsGrid(
+              fields: fields, plugin: plugin, isEditable: true,
+              fieldFocus: $fieldFocus,
+              location: editID == nil
+                ? CreationLocationField(tree: workflow.tree, parent: $parent) : nil)
+          }
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        // 焦点框绘制在控件边界外，需在滚动区内部预留空间。
+        .padding(8)
+      }
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel, action: requestDismiss)
+          .keyboardShortcut(.cancelAction)
+        if editID != nil {
+          Button("重置") { fields.reloadServer(load: workflow.serverEditForm) }
+            .disabled(!fields.hasChanges || fields.presentation?.isEditable != true)
+        }
+        Button(editID == nil ? String(localized: "创建") : String(localized: "保存"), action: submit)
+          .keyboardShortcut(.defaultAction)
+          .disabled(!canSubmit)
+      }
+    }
+    .disabled(isSubmitting)
+    .interactiveDismissDisabled(isSubmitting || fields.hasChanges)
+    .onExitCommand(perform: requestDismiss)
+    .alert("放弃更改？", isPresented: $isConfirmingDiscard) {
+      Button("继续编辑", role: .cancel) {}
+      Button("放弃更改", role: .destructive) { dismiss() }
+    }
+    .presentingErrors(errors)
+    .defaultFocus($fieldFocus, .name)
+    .padding(20)
+    .frame(minWidth: 600, idealWidth: 640, minHeight: 400, idealHeight: 620)
+    .onAppear {
+      if let editID { fields.showServer(editID, load: workflow.serverEditForm) }
+    }
+    .onReceive(workflow.$tree) { _ in
+      if let editID {
+        fields.updatePresentation(
+          workflow.serverFormPresentation(for: editID), preservingDraft: true)
+      }
+    }
+  }
+
+  private func loadFailureNotice(_ failure: ServerFormLoadError) -> some View {
+    VStack(alignment: .leading, spacing: 8) {
+      Label("无法加载服务器资料", systemImage: "exclamationmark.triangle")
+        .font(.headline)
+      if fields.hasLoadedServer {
+        Text("重新加载失败。当前草稿已保留，重新加载成功后才能保存。")
+      } else if failure == .notFound {
+        Text("服务器已不存在，无法保存。")
+      } else {
+        Text("无法读取服务器凭据。请重新加载后再试。")
+      }
+      Button("重新加载") { fields.reloadServer(load: workflow.serverEditForm) }
+    }
+    .font(.callout)
+  }
+
+  private func requestDismiss() {
+    guard !isSubmitting else { return }
+    if fields.hasChanges { isConfirmingDiscard = true } else { dismiss() }
+  }
+
+  private func submit() {
+    guard !isSubmitting, canSubmit else { return }
+    guard fields.validateForSubmit(), let draft = fields.draft else {
+      fieldFocus = fields.firstErrorField
+      return
+    }
+    isSubmitting = true
+    Task {
+      defer { isSubmitting = false }
+      do {
+        switch operation {
+        case .create:
+          onCreated(try await workflow.createServer(draft, into: parent))
+        case .edit(let id):
+          try await workflow.updateServer(id, draft: draft)
+        }
+        dismiss()
+      } catch {
+        errors.present(error)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServerLibraryRecoveryView.swift b/ShadowsocksX-NG2/App/UI/Servers/ServerLibraryRecoveryView.swift
new file mode 100644
index 000000000..2db37a6f0
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServerLibraryRecoveryView.swift
@@ -0,0 +1,40 @@
+import SwiftUI
+
+struct ServerLibraryRecoveryView: View {
+  @ObservedObject var workflow: CatalogWorkflow
+  let failure: ServerLibraryFailure
+  @State private var confirmsReset = false
+
+  var body: some View {
+    ContentUnavailableView {
+      Label("服务器库无法读取", systemImage: "lock.doc")
+    } description: {
+      Text(message)
+      Text("原配置文件和正在运行的代理保持不变。")
+      if case .authorization(let status) = failure {
+        Text("钥匙串状态码：\(Int(status))")
+      }
+    } actions: {
+      Button("重试并解锁") { workflow.unlockLibrary() }
+        .buttonStyle(.borderedProminent)
+      Button("放弃原配置…", role: .destructive) { confirmsReset = true }
+    }
+    .confirmationDialog("放弃原配置并创建空库？", isPresented: $confirmsReset) {
+      Button("放弃原配置并创建空库", role: .destructive) { workflow.resetLibrary() }
+      Button("取消", role: .cancel) {}
+    } message: {
+      Text("新空库将覆盖原服务器库，并撤下原代理出口。未另存的原配置将无法恢复。")
+    }
+  }
+
+  private var message: String {
+    switch failure {
+    case .authorization: String(localized: "钥匙串访问需要授权，或用户取消了授权。请重试并解锁。")
+    case .keyUnavailable: String(localized: "找不到服务器库的主密钥。请恢复原钥匙串后重试。")
+    case .authenticationFailed: String(localized: "服务器库认证失败，文件或密钥不匹配。")
+    case .unsupportedVersion: String(localized: "此版本无法读取服务器库格式。请使用兼容的应用版本。")
+    case .malformedFile: String(localized: "服务器库文件损坏或格式无效。")
+    case .storage: String(localized: "服务器库读取或保存失败。请检查存储权限后重试。")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServerTableDrop.swift b/ShadowsocksX-NG2/App/UI/Servers/ServerTableDrop.swift
new file mode 100644
index 000000000..a8c37b233
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServerTableDrop.swift
@@ -0,0 +1,39 @@
+import AppKit
+import UniformTypeIdentifiers
+
+/// 原生 Table 拖放使用系统字符串表示；接收方仍校验本表拖动的节点身份。
+@MainActor
+final class ServerTableDropState {
+  private(set) var draggedID: NodeID?
+
+  func provider(for id: NodeID, payload: String) -> NSItemProvider {
+    draggedID = id
+    return NSItemProvider(object: payload as NSString)
+  }
+
+  func loadPayload(_ providers: [NSItemProvider], action: @escaping @MainActor ([String]) -> Void) {
+    guard providers.count == 1, let provider = providers.first, let expected = draggedID else {
+      return
+    }
+    provider.loadDataRepresentation(forTypeIdentifier: UTType.plainText.identifier) { data, _ in
+      guard let data, String(data: data, encoding: .utf8) == expected.rawValue else { return }
+      Task { @MainActor in
+        guard self.draggedID == expected else { return }
+        action([expected.rawValue])
+      }
+    }
+  }
+
+  /// 分组行接收到自身；服务器行接收到其所属分组（根层服务器对应根层）。
+  static func rowParent(for node: CatalogTreeNode) -> NodeID? {
+    node.isGroup ? node.id : node.parentID
+  }
+
+  /// 插入线位于下一行的同级容器内；顶部和表尾空白表示根层。
+  static func insertionParent(at index: Int, in rows: [CatalogTreeRow]) -> NodeID? {
+    guard rows.indices.contains(index) else { return nil }
+    return rows[index].node.parentID
+  }
+
+  func finishDrop() { draggedID = nil }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServerTableNameCell.swift b/ShadowsocksX-NG2/App/UI/Servers/ServerTableNameCell.swift
new file mode 100644
index 000000000..f275c6887
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServerTableNameCell.swift
@@ -0,0 +1,113 @@
+import SwiftUI
+
+/// Table 名称列：名称占剩余宽度，活动目标在列尾。实心闪电标记活动目标
+/// 自身，空心闪电标记子树含活动目标的分组（严格祖先）。
+struct ServerTableNameCell: View {
+  let node: CatalogTreeNode
+  let activeTargetID: NodeID?
+  let containsActiveTarget: Bool
+
+  var body: some View {
+    HStack(spacing: 6) {
+      Image(systemName: node.isGroup ? "folder" : "server.rack")
+      Text(node.name)
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .foregroundStyle(node.isInvalid ? .secondary : .primary)
+      if node.isInvalid {
+        Image(systemName: "exclamationmark.triangle.fill")
+          .foregroundStyle(.orange)
+          .help(
+            node.invalidReasons.first.map {
+              AppPresentation.message(
+                for: ActivationFailure.invalidLeaf(node: node.id, reason: $0))
+            } ?? String(localized: "服务器存在已知阻塞问题"))
+      } else if node.invalidDescendantCount > 0 {
+        Image(systemName: "exclamationmark.triangle")
+          .foregroundStyle(.orange)
+          .help("包含 \(node.invalidDescendantCount) 个存在已知阻塞问题的服务器")
+      }
+      if activeTargetID == node.id {
+        Image(systemName: "bolt.fill")
+          .foregroundStyle(.orange)
+          .help("活动目标")
+      } else if containsActiveTarget {
+        Image(systemName: "bolt")
+          .foregroundStyle(.orange)
+          .help("组内含活动目标")
+      }
+    }
+    .frame(minHeight: 28)
+  }
+
+}
+
+/// 行级右键菜单沿用目录工作流的命令与资格事实。
+struct ServerNodeContextMenu: View {
+  let node: CatalogTreeNode
+  let workflow: CatalogWorkflow
+  let allowsSubscriptionManagement: Bool
+  /// 激活反馈共享状态：命令经它发出（单飞互斥、结果记录在会话反馈里）。
+  let activation: ActivationFeedbackState
+  let errors: ErrorAlertPresenter
+  let onEdit: (NodeID) -> Void
+  let onRename: (NodeID) -> Void
+  let onNewGroup: (NodeID?) -> Void
+  let onDuplicate: (NodeID) -> Void
+  let onDelete: (NodeID) -> Void
+  let onExport: (NodeID) -> Void
+
+  private var isSubscription: Bool { node.source == .subscription }
+
+  @ViewBuilder
+  var body: some View {
+    Button("激活") {
+      Task { @MainActor in
+        do {
+          let outcome = try await activation.activate(node.id, via: workflow)
+          // 右键菜单即关、无内联反馈面：原子拒绝点名弹窗（typed 原因随
+          // 结果返回）；单飞忽略（nil）不呈现。
+          if case .rejectedActivation(let failure)? = outcome {
+            errors.present(failure)
+          }
+        } catch {
+          errors.present(error)
+        }
+      }
+    }
+    if let module = workflow.connectivity {
+      ConnectivityTestButton(module: module, node: node)
+    }
+    Divider()
+    if !isSubscription {
+      if node.isGroup {
+        Button("重命名…") { onRename(node.id) }
+      } else {
+        Button("编辑…") { onEdit(node.id) }
+      }
+    } else if allowsSubscriptionManagement, node.isRootSubscriptionGroup {
+      Button("编辑 URL…") { onEdit(node.id) }
+    }
+    Button {
+      onDuplicate(node.id)
+    } label: {
+      Label("复制", systemImage: "plus.square.on.square")
+    }
+    .disabled(!workflow.canDuplicate(node.id))
+    if !isSubscription {
+      Button("新建分组…") {
+        onNewGroup(node.isGroup ? node.id : node.parentID)
+      }
+    }
+    if node.isGroup {
+      Divider()
+      Button("导出为 SIP-008 JSON…") { onExport(node.id) }
+        .disabled(!node.containsServerConfiguration)
+    }
+    if !isSubscription || (allowsSubscriptionManagement && node.isRootSubscriptionGroup) {
+      Divider()
+      Button("删除…", role: .destructive) {
+        onDelete(node.id)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServersView+Details.swift b/ShadowsocksX-NG2/App/UI/Servers/ServersView+Details.swift
new file mode 100644
index 000000000..5c2767fb4
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServersView+Details.swift
@@ -0,0 +1,259 @@
+import SwiftUI
+
+extension ServersView {
+  // MARK: - 详情区
+
+  @ViewBuilder
+  var serverDetailPane: some View {
+    if let id = selection, let node = workflow.tree.node(withID: id) {
+      CatalogNodeDetailView(
+        workflow: workflow, activation: activation, nodeID: node.id,
+        isActiveTarget: activeTargetID == id,
+        containsActiveTarget: activeAncestorIDs.contains(id),
+        errors: errors
+      )
+      .id(id)
+    } else {
+      ContentUnavailableView(
+        "未选择节点", systemImage: "sidebar.left",
+        description: Text("在左侧选择服务器或分组查看详情"))
+    }
+  }
+
+  // MARK: - 工具栏（新建服务器 / 新建分组 / 分享）
+
+  @ToolbarContentBuilder
+  var toolbarContent: some ToolbarContent {
+    if section == .manual {
+      ToolbarItem(placement: .primaryAction) {
+        Button {
+          presentNewServer(in: workflow.importTargetParent(for: selection))
+        } label: {
+          Label("新建服务器", systemImage: "plus")
+        }
+        .help("新建服务器")
+      }
+      ToolbarItem(placement: .primaryAction) {
+        Button {
+          presentNewGroup(in: workflow.importTargetParent(for: selection))
+        } label: {
+          Label("新建分组", systemImage: "folder.badge.plus")
+        }
+        .help("新建分组")
+      }
+    } else if section == .subscription {
+      ToolbarItem(placement: .primaryAction) {
+        Button("添加订阅", systemImage: "plus") {
+          isPresentingAddSubscription = true
+        }
+        .help("添加订阅")
+      }
+    }
+    ToolbarItem(placement: .primaryAction) {
+      Button {
+        if let selection { presentEditNode(selection) }
+      } label: {
+        Label(toolbarEditTitle, systemImage: "pencil")
+      }
+      .labelStyle(.iconOnly)
+      .help(toolbarEditTitle)
+      .disabled(!canEditSelection)
+    }
+    ToolbarItem(placement: .primaryAction) {
+      Button {
+        if let selection { duplicateNode(selection) }
+      } label: {
+        Label("复制", systemImage: "plus.square.on.square")
+      }
+      .help("复制")
+      .disabled(selection.map(workflow.canDuplicate) != true)
+    }
+    // 删除：手动节点走目录政策；订阅根组走订阅管理。
+    ToolbarItem(placement: .primaryAction) {
+      Button {
+        if let selection {
+          requestDelete(selection, allowsSubscriptionManagement: section == .subscription)
+        }
+      } label: {
+        Label("删除", systemImage: "trash")
+      }
+      .help("删除")
+      .disabled(!canDeleteSelection)
+    }
+    // 分享选中的服务器或非空配置组，分别显示二维码或文件/URI 列表操作。
+    ToolbarItem(placement: .primaryAction) {
+      Button {
+        presentShare()
+      } label: {
+        Label("分享", systemImage: "square.and.arrow.up")
+      }
+      .help("分享")
+      .disabled(!canShareSelection)
+      .popover(item: $shareContext, arrowEdge: .top) { context in
+        switch context {
+        case .server(let server):
+          ShareServerPopover(
+            payload: server.payload,
+            presentation: server.presentation,
+            suggestedFileName: server.suggestedFileName,
+            imageClipboard: imageClipboard,
+            textClipboard: clipboard,
+            saver: qrImageSaver,
+            errors: errors)
+        case .group(let group):
+          ShareGroupPopover(
+            context: group, exporter: configurationGroupFileExporter,
+            clipboard: clipboard, errors: errors)
+        }
+      }
+    }
+  }
+
+  // MARK: - 告警动作
+
+  /// 工具栏删除钮仅对手动节点和订阅根组启用。
+  var canDeleteSelection: Bool {
+    guard let selection, let node = workflow.tree.node(withID: selection) else { return false }
+    if section == .subscription, node.isRootSubscriptionGroup {
+      return subscriptionSummary(forRootGroup: selection) != nil
+    }
+    return workflow.canDelete(selection)
+  }
+
+  var canEditSelection: Bool {
+    guard let selection, let node = workflow.tree.node(withID: selection) else { return false }
+    if section == .subscription, node.isRootSubscriptionGroup {
+      return subscriptionSummary(forRootGroup: selection) != nil
+    }
+    return workflow.serverFormPresentation(for: selection)?.isEditable == true
+  }
+
+  var toolbarEditTitle: String {
+    guard section == .subscription, let selection,
+      workflow.tree.node(withID: selection)?.isRootSubscriptionGroup == true
+    else { return String(localized: "编辑服务器") }
+    return String(localized: "编辑 URL…")
+  }
+
+  func subscriptionSummary(forRootGroup id: NodeID) -> SubscriptionSummary? {
+    workflow.subscriptions.first { $0.groupID == id }
+  }
+
+  func requestDelete(_ id: NodeID, allowsSubscriptionManagement: Bool) {
+    guard let node = workflow.tree.node(withID: id) else { return }
+    if allowsSubscriptionManagement, node.isRootSubscriptionGroup,
+      let summary = subscriptionSummary(forRootGroup: id)
+    {
+      deleteTarget = .subscription(summary)
+    } else if workflow.canDelete(id) {
+      deleteTarget = .node(id)
+    }
+  }
+
+  func presentNewGroup(in parent: NodeID?) {
+    newGroupParent = parent
+    isPresentingNewGroup = true
+  }
+
+  func presentNewServer(in parent: NodeID?) {
+    serverFormOperation = .create(parent: parent)
+  }
+
+  func presentEditServer(_ id: NodeID) {
+    guard workflow.serverFormPresentation(for: id)?.isEditable == true else { return }
+    serverFormOperation = .edit(id)
+  }
+
+  func presentEditNode(_ id: NodeID) {
+    guard let node = workflow.tree.node(withID: id) else { return }
+    if node.isRootSubscriptionGroup,
+      let summary = subscriptionSummary(forRootGroup: id)
+    {
+      subscriptionEditTarget = summary
+    } else {
+      presentEditServer(id)
+    }
+  }
+
+  func selectCreatedNode(_ id: NodeID) {
+    section = .manual
+    expansion.reveal(id, in: workflow.tree)
+    selection = id
+  }
+
+  func duplicateNode(_ id: NodeID) {
+    Task {
+      do {
+        let copy = try await workflow.duplicate(id, nameSuffix: String(localized: "副本"))
+        selectCreatedNode(copy)
+      } catch {
+        errors.present(error)
+      }
+    }
+  }
+
+  /// 删除确认文案：档位与规模事实来自 seam；句子由 UI 拼（Q3-A）。
+  var deleteTitle: String {
+    switch deleteTarget {
+    case .some(.subscription(let summary)):
+      return SubscriptionDeletionConfirmation.title(for: summary.name)
+    case .some(.node(let id)):
+      let name = workflow.displayName(for: id)
+      switch workflow.deleteFacts(for: id) {
+      case .subtree:
+        return String(localized: "删除分组「\(name)」及其整棵子树？")
+      case .leaf, .emptyGroup, nil:
+        return String(localized: "删除「\(name)」？")
+      }
+    case .none:
+      return ""
+    }
+  }
+
+  var deleteMessage: String {
+    switch deleteTarget {
+    case .some(.subscription):
+      return SubscriptionDeletionConfirmation.message
+    case .some(.node(let id)):
+      switch workflow.deleteFacts(for: id) {
+      case .subtree(let count, let includesCredentials):
+        if includesCredentials {
+          return String(localized: "将递归删除 \(count) 个节点（含其中的服务器与凭据），此操作不可撤销。")
+        }
+        return String(localized: "将递归删除 \(count) 个节点，此操作不可撤销。")
+      case .leaf, .emptyGroup, nil:
+        return String(localized: "此操作不可撤销。")
+      }
+    case .none:
+      return ""
+    }
+  }
+
+  var deleteConfirmationActionTitle: String {
+    if case .some(.subscription) = deleteTarget {
+      return SubscriptionDeletionConfirmation.actionTitle
+    }
+    return String(localized: "删除")
+  }
+
+  func commitDelete() {
+    guard let target = deleteTarget else { return }
+    deleteTarget = nil
+    Task {
+      do {
+        let outcome: RemovalOutcome
+        switch target {
+        case .node(let id):
+          outcome = try await workflow.remove(id)
+        case .subscription(let summary):
+          outcome = try await workflow.removeSubscription(summary.id)
+        }
+        clearSelectionIfInvalidated(outcome.removedNodeIDs)
+      } catch {
+        errors.present(error)
+      }
+    }
+  }
+}
+
+/// renameTarget 的 sheet(item:) 适配壳。
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServersView+Share.swift b/ShadowsocksX-NG2/App/UI/Servers/ServersView+Share.swift
new file mode 100644
index 000000000..70c349cab
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServersView+Share.swift
@@ -0,0 +1,326 @@
+import SwiftUI
+
+/// 服务器分享由工具栏按钮旁的 popover 呈现；打开时冻结已保存资料和载荷。
+extension ServersView {
+  enum ShareContext: Identifiable {
+    case server(ServerShareContext)
+    case group(GroupShareContext)
+
+    var id: NodeID {
+      switch self {
+      case .server(let context): context.id
+      case .group(let context): context.id
+      }
+    }
+  }
+
+  struct ServerShareContext {
+    let id: NodeID
+    let payload: String
+    let presentation: ServerSharePresentation
+    let suggestedFileName: String
+  }
+
+  struct GroupShareContext {
+    let id: NodeID
+    let name: String
+    let serverCount: Int
+    let draft: Result<ConfigurationGroupShareDraft, Error>
+  }
+
+  var canShareSelection: Bool {
+    guard let selection, let node = workflow.tree.node(withID: selection) else { return false }
+    if node.isGroup { return node.containsServerConfiguration }
+    return (try? workflow.shareURI(for: selection)) != nil
+  }
+
+  func presentShare() {
+    guard let selection, let node = workflow.tree.node(withID: selection) else { return }
+    if node.isGroup {
+      guard node.containsServerConfiguration else { return }
+      shareContext = .group(
+        GroupShareContext(
+          id: selection, name: node.name, serverCount: node.serverConfigurationCount,
+          draft: Result { try workflow.configurationGroupShareDraft(for: selection) }))
+    } else {
+      guard let presentation = workflow.serverSharePresentation(for: selection),
+        let payload = try? workflow.shareURI(for: selection)
+      else { return }
+      shareContext = .server(
+        ServerShareContext(
+          id: selection, payload: payload, presentation: presentation,
+          suggestedFileName: QrImageSaveDraft.suggestedFileName(from: presentation.name)))
+    }
+  }
+}
+
+/// 系统分享菜单式分区：服务器资料、二维码、带图标的操作行。
+struct ShareServerPopover: View {
+  let payload: String
+  let presentation: ServerSharePresentation
+  let suggestedFileName: String
+  let imageClipboard: any ImageClipboard
+  let textClipboard: any TextClipboard
+  let saver: any QrImageSaver
+  let errors: ErrorAlertPresenter
+
+  @State private var png: Data?
+  @State private var copyFeedback: CopyFeedback = .none
+  @State private var feedbackResetTask: Task<Void, Never>?
+
+  enum CopyFeedback: Equatable {
+    case none
+    case image
+    case link
+  }
+
+  var body: some View {
+    VStack(spacing: 12) {
+      serverSummary
+        .padding(.horizontal, 8)
+      Divider()
+      qrDisplay
+      Divider()
+      VStack(spacing: 2) {
+        shareButton(
+          String(localized: "保存二维码图片"), symbol: "square.and.arrow.down", feedback: nil,
+          disabled: png == nil
+        ) {
+          saveImage()
+        }
+        shareButton(
+          String(localized: "拷贝二维码图片"), symbol: "doc.on.doc", feedback: .image,
+          disabled: png == nil
+        ) {
+          copyImage()
+        }
+        shareButton(
+          String(localized: "拷贝 URI 链接"), symbol: "link", feedback: .link, disabled: false
+        ) {
+          copySsUri()
+        }
+      }
+    }
+    .padding(12)
+    .frame(width: 324)
+    .task { await generate() }
+    .onDisappear { feedbackResetTask?.cancel() }
+  }
+
+  private var serverSummary: some View {
+    VStack(alignment: .leading, spacing: 6) {
+      Text(verbatim: presentation.name)
+        .font(.headline)
+      Text(verbatim: endpoint)
+        .foregroundStyle(.secondary)
+      Text("加密方式：\(presentation.encryptionMethod)")
+      if let plugin = presentation.pluginProgram, !plugin.isEmpty {
+        Text("插件：\(plugin)")
+      }
+    }
+    .lineLimit(1)
+    .truncationMode(.tail)
+    .frame(maxWidth: .infinity, alignment: .leading)
+  }
+
+  private var endpoint: String {
+    let address = presentation.address
+    let host = address.contains(":") && !address.hasPrefix("[") ? "[\(address)]" : address
+    return "\(host):\(presentation.port)"
+  }
+
+  private var qrDisplay: some View {
+    Group {
+      if let png, let image = NSImage(data: png) {
+        Image(nsImage: image)
+          .interpolation(.none)
+          .resizable()
+          .scaledToFit()
+          .frame(width: 280, height: 280)
+      } else {
+        ProgressView()
+          .frame(width: 280, height: 280)
+      }
+    }
+    // 白底衬底保证深色外观下的扫码对比度；阴影让浅色外观下也有边界。
+    .padding(10)
+    .background(
+      RoundedRectangle(cornerRadius: 10, style: .continuous)
+        .fill(Color.white)
+        .shadow(color: .black.opacity(0.15), radius: 2, y: 1)
+    )
+  }
+
+  private func shareButton(
+    _ title: String,
+    symbol: String,
+    feedback: CopyFeedback?,
+    disabled: Bool,
+    action: @escaping () -> Void
+  ) -> some View {
+    Button(action: action) {
+      HStack(spacing: 12) {
+        Image(systemName: copyFeedback == feedback ? "checkmark" : symbol)
+          .frame(width: 20)
+        Text(copyFeedback == feedback ? String(localized: "已复制") : title)
+        Spacer(minLength: 0)
+      }
+      .padding(.horizontal, 8)
+      .padding(.vertical, 7)
+      .contentShape(Rectangle())
+    }
+    .buttonStyle(ShareActionButtonStyle())
+    .disabled(disabled)
+  }
+
+  /// 二维码在后台线程生成（重置即先呈进度，不闪现上一台服务器的码）。
+  private func generate() async {
+    let payload = payload
+    let data = await Task.detached(priority: .userInitiated) {
+      try? QrCodeCodec.generatePNG(for: payload)
+    }.value
+    png = data
+  }
+
+  private func copyImage() {
+    guard let png else { return }
+    do {
+      try imageClipboard.write(png)
+      flash(.image)
+    } catch {
+      errors.present(error)
+    }
+  }
+
+  private func saveImage() {
+    guard let png else { return }
+    switch saver.save(QrImageSaveDraft(data: png, suggestedFileName: suggestedFileName)) {
+    case .cancelled, .saved:
+      break  // 保存与取消都由系统面板给出反馈
+    case .failed(let failure):
+      errors.present(failure)
+    }
+  }
+
+  private func copySsUri() {
+    do {
+      try textClipboard.write(payload)
+      flash(.link)
+    } catch {
+      errors.present(error)
+    }
+  }
+
+  /// 复制成功反馈：标签短暂换成「已复制」，重复点击重置计时。
+  private func flash(_ feedback: CopyFeedback) {
+    copyFeedback = feedback
+    feedbackResetTask?.cancel()
+    feedbackResetTask = Task {
+      try? await Task.sleep(for: .seconds(2))
+      guard !Task.isCancelled else { return }
+      copyFeedback = .none
+    }
+  }
+}
+
+/// 保留原生 Button 的键盘与辅助功能，悬停时绘制系统菜单式行底色。
+struct ShareActionButtonStyle: ButtonStyle {
+  @Environment(\.isEnabled) private var isEnabled
+  @State private var isHovering = false
+
+  func makeBody(configuration: Configuration) -> some View {
+    configuration.label
+      .background {
+        RoundedRectangle(cornerRadius: 6)
+          .fill(
+            Color.primary.opacity(isEnabled && (isHovering || configuration.isPressed) ? 0.1 : 0))
+      }
+      .opacity(isEnabled ? 1 : 0.4)
+      .onHover { isHovering = $0 }
+  }
+}
+
+/// 配置组使用同款操作行，分享内容固定为打开时的已保存快照。
+struct ShareGroupPopover: View {
+  let context: ServersView.GroupShareContext
+  let exporter: any ConfigurationGroupFileExporter
+  let clipboard: any TextClipboard
+  let errors: ErrorAlertPresenter
+
+  @State private var copied = false
+  @State private var feedbackResetTask: Task<Void, Never>?
+
+  var body: some View {
+    VStack(spacing: 12) {
+      VStack(alignment: .leading, spacing: 6) {
+        Text(verbatim: context.name)
+          .font(.headline)
+          .lineLimit(1)
+          .truncationMode(.tail)
+        Text("\(context.serverCount) 个服务器")
+          .foregroundStyle(.secondary)
+      }
+      .frame(maxWidth: .infinity, alignment: .leading)
+      .padding(.horizontal, 8)
+      Divider()
+      VStack(spacing: 2) {
+        action(String(localized: "保存 SIP008 JSON 文件"), symbol: "square.and.arrow.down") {
+          save(.json)
+        }
+        action(String(localized: "保存 URI 链接列表文本文件"), symbol: "doc.text") {
+          save(.uriList)
+        }
+        action(
+          copied ? String(localized: "已复制") : String(localized: "拷贝 URI 链接列表文本"),
+          symbol: copied ? "checkmark" : "doc.on.doc"
+        ) {
+          copyURIList()
+        }
+      }
+    }
+    .padding(12)
+    .frame(width: 324)
+    .onDisappear { feedbackResetTask?.cancel() }
+  }
+
+  private func action(_ title: String, symbol: String, perform: @escaping () -> Void) -> some View {
+    Button(action: perform) {
+      HStack(spacing: 12) {
+        Image(systemName: symbol).frame(width: 20)
+        Text(title)
+        Spacer(minLength: 0)
+      }
+      .padding(.horizontal, 8)
+      .padding(.vertical, 7)
+      .contentShape(Rectangle())
+    }
+    .buttonStyle(ShareActionButtonStyle())
+  }
+
+  private func save(_ format: ConfigurationGroupExportDraft.Format) {
+    do {
+      let draft = try context.draft.get()
+      switch exporter.export(draft: format == .json ? draft.json : draft.uriList) {
+      case .cancelled, .saved: break
+      case .failed(let failure): errors.present(failure)
+      }
+    } catch {
+      errors.present(error)
+    }
+  }
+
+  private func copyURIList() {
+    do {
+      try clipboard.write(context.draft.get().uriText)
+      copied = true
+      feedbackResetTask?.cancel()
+      feedbackResetTask = Task {
+        try? await Task.sleep(for: .seconds(2))
+        guard !Task.isCancelled else { return }
+        copied = false
+      }
+    } catch {
+      errors.present(error)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServersView+Tables.swift b/ShadowsocksX-NG2/App/UI/Servers/ServersView+Tables.swift
new file mode 100644
index 000000000..93e8fbb1a
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServersView+Tables.swift
@@ -0,0 +1,172 @@
+import SwiftUI
+
+extension ServersView {
+  var sourceSidebar: some View {
+    List(
+      selection: Binding<ServerListSection?>(
+        get: { section },
+        set: { value in
+          guard let value, value != section else { return }
+          selection = nil
+          section = value
+        })
+    ) {
+      Label("收藏", systemImage: "star").tag(ServerListSection.favorites)
+      Label("本地", systemImage: "internaldrive").tag(ServerListSection.manual)
+      Label("订阅", systemImage: "arrow.triangle.2.circlepath").tag(ServerListSection.subscription)
+    }
+    .listStyle(.sidebar)
+  }
+
+  var serverTable: some View {
+    let rows = workflow.tree.visibleRows(
+      source: section.source ?? .manual, collapsed: expansion.collapsedGroupIDs
+    )
+    let depths = Dictionary(uniqueKeysWithValues: rows.map { ($0.id, $0.depth) })
+    let activeAncestors = activeAncestorIDs
+    return Table(
+      of: CatalogTreeNode.self, selection: $selection
+    ) {
+      TableColumn("名称") { node in
+        HStack(spacing: 4) {
+          if node.isGroup && !node.childNodes.isEmpty {
+            Button {
+              selection = expansion.setExpanded(
+                expansion.isCollapsed(node.id), for: node, selection: selection)
+            } label: {
+              Image(systemName: "chevron.right")
+                .font(.caption2.weight(.semibold))
+                .rotationEffect(.degrees(expansion.isCollapsed(node.id) ? 0 : 90))
+                .frame(minWidth: 24, minHeight: 28)
+                .contentShape(Rectangle())
+            }
+            .buttonStyle(.plain)
+            .help(Text(expansion.isCollapsed(node.id) ? LocalizedStringKey("展开") : "收起"))
+          } else {
+            Color.clear.frame(width: 24, height: 28)
+          }
+          ServerTableNameCell(
+            node: node, activeTargetID: activeTargetID,
+            containsActiveTarget: activeAncestors.contains(node.id))
+        }
+        .padding(.leading, CGFloat(depths[node.id] ?? 0) * 14)
+      }
+      .width(min: 160, ideal: 180)
+      TableColumn("收藏") { node in
+        Image(systemName: workflow.isFavorite(node.id) ? "star.fill" : "star")
+          .accessibilityLabel(Text("收藏"))
+          .accessibilityValue(Text(workflow.isFavorite(node.id) ? String(localized: "收藏") : "—"))
+      }
+      .width(36)
+      TableColumn(ConnectivityCopy.text("响应延迟")) { node in
+        if let module = workflow.connectivity {
+          ConnectivityCell(module: module, node: node, workflow: workflow)
+        }
+      }
+      .width(min: 50, ideal: 60)
+    } rows: {
+      ForEach(rows) { row in
+        TableRow(row.node)
+          .contextMenu {
+            nodeContextMenu(for: row.node, allowsSubscriptionManagement: section == .subscription)
+          }
+          .itemProvider {
+            guard let payload = workflow.dragPayload(for: row.id) else { return nil }
+            return dropState.provider(for: row.id, payload: payload)
+          }
+          .dropDestination(for: String.self) { payload in
+            _ = handleDrop(payload, onto: ServerTableDropState.rowParent(for: row.node))
+          }
+      }
+      .onInsert(of: [.plainText]) { index, providers in
+        guard section == .manual, (0...rows.count).contains(index) else { return }
+        let parent = ServerTableDropState.insertionParent(at: index, in: rows)
+        dropState.loadPayload(providers) { _ = handleDrop($0, onto: parent) }
+      }
+    }
+    .focused($isServerTableFocused)
+    .simultaneousGesture(
+      TapGesture().onEnded {
+        if !isServerTableFocused { isServerTableFocused = true }
+      }
+    )
+    .onKeyPress(.escape) {
+      guard selection != nil else { return .ignored }
+      selection = nil
+      return .handled
+    }
+    .overlay {
+      if rows.isEmpty {
+        ContentUnavailableView(
+          "暂无服务器", systemImage: "server.rack",
+          description: section == .subscription
+            ? Text("用工具栏的「添加订阅」按钮添加 HTTPS 订阅地址（SIP-008 JSON）")
+            : Text("用工具栏的「新建服务器」按钮手动录入，或用「导入」菜单导入")
+        )
+        .allowsHitTesting(false)
+      }
+    }
+  }
+
+  @ViewBuilder
+  func nodeContextMenu(_ ids: Set<NodeID>) -> some View {
+    if let id = ids.first, let node = workflow.tree.node(withID: id) {
+      nodeContextMenu(for: node, allowsSubscriptionManagement: false)
+    }
+  }
+
+  @ViewBuilder
+  func nodeContextMenu(
+    for node: CatalogTreeNode, allowsSubscriptionManagement: Bool
+  ) -> some View {
+    ServerNodeContextMenu(
+      node: node, workflow: workflow, allowsSubscriptionManagement: allowsSubscriptionManagement,
+      activation: activation, errors: errors,
+      onEdit: presentEditNode, onRename: { renameTarget = $0 },
+      onNewGroup: presentNewGroup, onDuplicate: duplicateNode,
+      onDelete: {
+        requestDelete($0, allowsSubscriptionManagement: allowsSubscriptionManagement)
+      }, onExport: exportConfigurationGroup)
+  }
+
+  /// 删除结果 → selection invalidation：仅清除失效选择，不自动
+  /// 改选相邻节点。
+  func clearSelectionIfInvalidated(_ removed: Set<NodeID>) {
+    if let selection, removed.contains(selection) {
+      self.selection = nil
+    }
+  }
+
+  /// 落点语义：分组行接收到自身，服务器行接收到所属组；行间接收到下一行所属组。
+  /// 顶部/表尾空白接收到根。
+  /// 资格事实由 seam 提供；跨来源/成环仍由领域拒绝（不变量防线）。
+  func handleDrop(_ payload: [String], onto target: NodeID?) -> Bool {
+    guard section == .manual, payload.count == 1, let raw = payload.first,
+      let dragged = dropState.draggedID, raw == dragged.rawValue,
+      workflow.canMove(dragged, to: target)
+    else { return false }
+    dropState.finishDrop()
+    Task {
+      do {
+        try await workflow.move(dragged, to: target)
+        selectCreatedNode(dragged)
+      } catch {
+        errors.present(error)
+      }
+    }
+    return true
+  }
+
+  func exportConfigurationGroup(_ id: NodeID) {
+    switch ConfigurationGroupExportAction(
+      workflow: workflow, exporter: configurationGroupFileExporter
+    ).perform(for: id) {
+    case .preparationFailed(let failure):
+      errors.present(failure)
+    case .cancelled, .saved:
+      break
+    case .exportFailed(let failure):
+      errors.present(failure)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/ServersView.swift b/ShadowsocksX-NG2/App/UI/Servers/ServersView.swift
new file mode 100644
index 000000000..495433689
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/ServersView.swift
@@ -0,0 +1,134 @@
+import SwiftUI
+
+/// 服务器目录、只读详情与分组命令；本视图持有新建／编辑 sheet 和确认弹窗。
+/// selection 由主窗口绑定，订阅删除可清除失效选择。
+struct ServersView: View {
+
+  @ObservedObject var workflow: CatalogWorkflow
+  /// 激活反馈共享状态（三激活入口共用，单飞互斥）：侧栏右键与分组详情的
+  /// 激活命令都经它发出。
+  let activation: ActivationFeedbackState
+  /// 活动目标标记：父视图传入的运行时事实，不进目录 projection（与
+  /// ServerTableNameCell/ServerDetailView 的传参先例同法）。
+  let activeTargetID: NodeID?
+  @Binding var selection: NodeID?
+  @Binding var section: ServerListSection
+  /// 服务器管理的展开状态跨工作区页面切换保留，不落盘。
+  @ObservedObject var expansion: CatalogExpansionState
+  let clipboard: any TextClipboard
+  let imageClipboard: any ImageClipboard
+  let configurationGroupFileExporter: any ConfigurationGroupFileExporter
+  let qrImageSaver: any QrImageSaver
+
+  /// 共享错误弹窗呈现（UI 持有；typed error → 本地化文案的呈现边缘）。
+  /// 非 private：ServersView+Share.swift 扩展经它呈现分享失败。
+  @StateObject var errors = ErrorAlertPresenter()
+
+  /// 子树含活动目标的分组集合（空心闪电候选）；表格与详情共用一次推导。
+  var activeAncestorIDs: Set<NodeID> {
+    workflow.tree.ancestors(of: activeTargetID)
+  }
+
+  // 纯窗口状态：selection/sheet/alert 不进目录 module。
+  @State var renameTarget: NodeID?
+  @State var newGroupParent: NodeID?
+  @State var isPresentingNewGroup = false
+  @State var isPresentingAddSubscription = false
+  @State var serverFormOperation: ServerFormSheet.Operation?
+  @State var subscriptionEditTarget: SubscriptionSummary?
+  @State var deleteTarget: DeleteTarget?
+  @State var dropState = ServerTableDropState()
+  @State private var detailMinimumWidth: CGFloat = NodeDetailMinimumWidth.defaultValue
+  @FocusState var isServerTableFocused: Bool
+  // 分享 popover 打开时冻结载荷、顶部资料与建议文件名。
+  @State var shareContext: ShareContext?
+
+  var body: some View {
+    HSplitView {
+      sourceSidebar
+        .frame(minWidth: 120, idealWidth: 150, maxWidth: 200)
+      // 保持分栏容器身份稳定，切换来源时只替换内部表格。
+      ZStack(alignment: .topLeading) {
+        if section == .favorites {
+          FavoriteServersTable(
+            workflow: workflow, activeTargetID: activeTargetID,
+            selection: $selection, errors: errors, contextMenu: nodeContextMenu)
+        } else {
+          serverTable
+        }
+      }
+      .toolbar { toolbarContent }
+      .frame(minWidth: 380, idealWidth: 520, maxWidth: .infinity)
+      // 分栏身份必须稳定；节点身份只重建内部详情会话，保留用户拖动后的宽度。
+      ZStack(alignment: .topLeading) {
+        serverDetailPane
+      }
+      .frame(minWidth: detailMinimumWidth, maxWidth: .infinity, maxHeight: .infinity)
+      .onPreferenceChange(NodeDetailMinimumWidth.self) {
+        detailMinimumWidth = max(NodeDetailMinimumWidth.defaultValue, $0)
+      }
+    }
+    .frame(minHeight: 420)
+    .sheet(
+      item: Binding(
+        get: { renameTarget.map(NodeContext.init) },
+        set: { renameTarget = $0?.nodeID })
+    ) { context in
+      RenameGroupSheet(workflow: workflow, errors: errors, nodeID: context.nodeID)
+    }
+    .sheet(isPresented: $isPresentingNewGroup) {
+      NewGroupSheet(
+        workflow: workflow, errors: errors, parent: newGroupParent,
+        onCreated: selectCreatedNode)
+    }
+    .sheet(item: $subscriptionEditTarget) { summary in
+      EditSubscriptionSheet(workflow: workflow, errors: errors, summary: summary)
+    }
+    .sheet(isPresented: $isPresentingAddSubscription) {
+      AddSubscriptionSheet(workflow: workflow, errors: errors)
+    }
+    .presentingErrors(errors)
+    .confirmationDialog(
+      deleteTitle,
+      isPresented: Binding(
+        get: { deleteTarget != nil },
+        set: { if !$0 { deleteTarget = nil } }),
+      titleVisibility: .visible
+    ) {
+      Button(deleteConfirmationActionTitle, role: .destructive) { commitDelete() }
+      Button("取消", role: .cancel) { deleteTarget = nil }
+    } message: {
+      Text(deleteMessage)
+    }
+    .sheet(item: $serverFormOperation) { operation in
+      ServerFormSheet(
+        workflow: workflow, operation: operation,
+        onCreated: selectCreatedNode)
+    }
+    // 切换选中项时立即收起分享，避免显示旧服务器。
+    .onChange(of: selection) {
+      shareContext = nil
+    }
+    .onChange(of: workflow.favoriteIDs) {
+      if section == .favorites, let selection, !workflow.isFavorite(selection) {
+        self.selection = nil
+      }
+    }
+    .onChange(of: workflow.tree) {
+      if let selection, !workflow.tree.containsNode(selection) {
+        self.selection = nil
+      }
+    }
+  }
+
+}
+
+struct NodeContext: Identifiable {
+  let nodeID: NodeID
+  var id: NodeID { nodeID }
+}
+
+enum DeleteTarget {
+  case node(NodeID)
+  case subscription(SubscriptionSummary)
+}
diff --git a/ShadowsocksX-NG2/App/UI/Servers/SubscriptionRefreshFeedbackView.swift b/ShadowsocksX-NG2/App/UI/Servers/SubscriptionRefreshFeedbackView.swift
new file mode 100644
index 000000000..6a65e9b1e
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Servers/SubscriptionRefreshFeedbackView.swift
@@ -0,0 +1,44 @@
+import SwiftUI
+
+/// 调用方提供给通用详情插槽的订阅提示；计时任务随视图退出取消。
+struct SubscriptionRefreshFeedbackView: View {
+  let isRefreshing: Bool
+  let completion: SubscriptionRefreshCompletion?
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 0) {
+      if isRefreshing {
+        HStack(spacing: 8) {
+          ProgressView().controlSize(.small)
+          Text(String(localized: "正在更新订阅…", table: "ServerDetails"))
+        }
+        .foregroundStyle(.secondary)
+      }
+      DetailFeedback(completion: completion) { result in
+        if !isRefreshing {
+          HStack(alignment: .top, spacing: 8) {
+            Image(
+              systemName: result.failure == nil
+                ? "checkmark.circle.fill" : "exclamationmark.triangle.fill"
+            )
+            .foregroundStyle(result.failure == nil ? Color.green : Color.red)
+            Text(message(for: result))
+              .textSelection(.enabled)
+              .fixedSize(horizontal: false, vertical: true)
+              .frame(maxWidth: .infinity, alignment: .leading)
+          }
+          .accessibilityElement(children: .combine)
+        }
+      }
+    }
+    .font(.callout)
+  }
+
+  private func message(for result: SubscriptionRefreshCompletion) -> String {
+    if let failure = result.failure {
+      let reason = AppPresentation.message(for: failure)
+      return String(localized: "订阅更新失败：\(reason)", table: "ServerDetails")
+    }
+    return String(localized: "订阅更新成功", table: "ServerDetails")
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Settings/ConnectivityURLSettings.swift b/ShadowsocksX-NG2/App/UI/Settings/ConnectivityURLSettings.swift
new file mode 100644
index 000000000..30f95be30
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Settings/ConnectivityURLSettings.swift
@@ -0,0 +1,88 @@
+import SwiftUI
+
+struct ConnectivityURLSettings: View {
+  @ObservedObject var workflow: SettingsWorkflow
+  @State private var editing = false
+  @State private var value = ""
+  @State private var displayedURL = ""
+  @State private var failure = false
+
+  var body: some View {
+    Section {
+      HStack(spacing: 12) {
+        VStack(alignment: .leading, spacing: 4) {
+          Text(ConnectivityCopy.text("测试链接")).font(.headline)
+          Text(displayedURL)
+            .font(.caption)
+            .foregroundStyle(.secondary)
+            .lineLimit(1)
+            .truncationMode(.middle)
+            .textSelection(.enabled)
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+
+        Button(action: beginEditing) {
+          HStack(spacing: 6) {
+            Text(String(localized: "编辑"))
+            Image(systemName: "chevron.right")
+              .font(.caption.weight(.semibold))
+              .accessibilityHidden(true)
+          }
+        }
+        .buttonStyle(.bordered)
+      }
+
+      if failure {
+        Text(ConnectivityCopy.text("无法保存测试 URL"))
+          .font(.caption)
+          .foregroundStyle(.red)
+      }
+    } header: {
+      Text(ConnectivityCopy.text("延迟测试"))
+    }
+    .onAppear(perform: refreshDisplayedURL)
+    .sheet(isPresented: $editing) {
+      VStack(alignment: .leading, spacing: 16) {
+        Text(ConnectivityCopy.text("测试链接")).font(.headline)
+        TextField("HTTP", text: $value).textFieldStyle(.roundedBorder)
+        Text(ConnectivityCopy.text("仅支持 HTTP。预热后采样 3 次，至少成功 2 次；显示成功样本的中位数。"))
+          .font(.caption).foregroundStyle(.secondary)
+        if failure { Text(ConnectivityCopy.text("无法保存测试 URL")).foregroundStyle(.red) }
+        HStack {
+          Button(ConnectivityCopy.text("恢复默认")) {
+            value = ServerConnectivity.defaultURL.absoluteString
+          }
+          Spacer()
+          Button(ConnectivityCopy.text("取消")) { editing = false }.keyboardShortcut(.cancelAction)
+          Button(ConnectivityCopy.text("保存")) {
+            Task {
+              if await workflow.saveConnectivityURL(value) {
+                displayedURL = ServerConnectivity.validURL(value)?.absoluteString ?? value
+                editing = false
+                failure = false
+              } else {
+                failure = true
+              }
+            }
+          }
+          .keyboardShortcut(.defaultAction)
+          .disabled(ServerConnectivity.validURL(value) == nil || workflow.isCommitting)
+        }
+      }
+      .padding(24).frame(width: 520)
+      .interactiveDismissDisabled(workflow.isCommitting)
+    }
+  }
+
+  private func refreshDisplayedURL() {
+    displayedURL = workflow.beginConnectivityURLEditing()
+    failure = false
+  }
+
+  private func beginEditing() {
+    value = workflow.beginConnectivityURLEditing()
+    displayedURL = value
+    failure = false
+    editing = true
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Settings/LANListeningEditorSheet.swift b/ShadowsocksX-NG2/App/UI/Settings/LANListeningEditorSheet.swift
new file mode 100644
index 000000000..746868154
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Settings/LANListeningEditorSheet.swift
@@ -0,0 +1,139 @@
+import SwiftUI
+
+struct LANListeningEditorSession: Identifiable {
+  let id = UUID()
+  let initialDraft: LANListeningDraft
+}
+
+struct LANListeningEditorSheet: View {
+  @ObservedObject var workflow: SettingsWorkflow
+  @Environment(\.dismiss) private var dismiss
+  @State private var draft: LANListeningDraft
+  @State private var saveError: String?
+  @State private var showPassword = false
+
+  init(workflow: SettingsWorkflow, initialDraft: LANListeningDraft) {
+    self.workflow = workflow
+    _draft = State(initialValue: initialDraft)
+  }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 18) {
+      Text("局域网监听").font(.title2)
+      ScrollView {
+        Form {
+          Toggle("启用局域网监听", isOn: $draft.isEnabled)
+
+          Group {
+            Picker("监听方式", selection: $draft.mode) {
+              ForEach(LANListenerMode.allCases, id: \.self) { mode in
+                VStack(alignment: .leading, spacing: 2) {
+                  Text(mode.displayName)
+                  Text(mode.bindingHint).font(.caption).foregroundStyle(.secondary)
+                }.tag(mode)
+              }
+            }
+            .pickerStyle(.radioGroup)
+
+            Divider()
+
+            Section {
+              ListenerPortFields(workflow: workflow, draft: $draft.ports)
+            } footer: {
+              Text("端口范围为 1025–65535")
+                .font(.caption).foregroundStyle(.secondary)
+            }
+
+            Divider()
+
+            Toggle("SOCKS UDP 中继", isOn: $draft.udpRelayEnabled)
+            Text("当前的身份验证实现无法可靠保护 UDP 中继。")
+              .font(.caption).foregroundStyle(.secondary)
+
+            Divider()
+
+            authenticationFields
+          }
+          .disabled(!draft.isEnabled)
+        }
+        .padding(4)
+      }
+      .frame(maxHeight: 620)
+      if let saveError {
+        Text(saveError).font(.caption).foregroundStyle(.red)
+      }
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel) { dismiss() }
+          .keyboardShortcut(.cancelAction)
+        Button(workflow.isCommitting ? String(localized: "保存中…") : String(localized: "保存")) {
+          Task { await save() }
+        }
+        .keyboardShortcut(.defaultAction)
+        .disabled(!workflow.canSaveLANListening(draft))
+      }
+    }
+    .disabled(workflow.isCommitting)
+    .padding(24)
+    .frame(width: 500)
+    .interactiveDismissDisabled(workflow.isCommitting)
+    .task(id: draft.ports) { workflow.refreshPortEditorOccupancy(for: draft.ports) }
+  }
+
+  private var authenticationFields: some View {
+    Group {
+      Toggle("身份验证", isOn: $draft.authenticationEnabled)
+      Section {
+        TextField("用户名", text: $draft.username)
+          .autocorrectionDisabled()
+
+        let showBtn = Button {
+          showPassword.toggle()
+        } label: {
+          Image(systemName: showPassword ? "eye.slash" : "eye")
+        }
+        .buttonStyle(.borderless)
+        .help(showPassword ? String(localized: "隐藏密码") : String(localized: "显示密码"))
+        .accessibilityLabel(showPassword ? String(localized: "隐藏密码") : String(localized: "显示密码"))
+
+        if showPassword {
+          TextField(text: $draft.password) {
+            showBtn
+            Text("密码")
+          }
+          .background(PasswordAutofillOptOut())
+        } else {
+          SecureField(text: $draft.password) {
+            showBtn
+            Text("密码")
+          }
+          .background(PasswordAutofillOptOut())
+        }
+
+        Text("SOCKS 与 HTTP 共用一组凭据。用户名和密码为 1–255 个可打印 ASCII 字符，用户名不得包含冒号。")
+          .font(.caption).foregroundStyle(.secondary)
+        if !draft.hasValidCredentials {
+          Text("用户名或密码无效。")
+            .font(.caption).foregroundStyle(.red)
+        }
+      }
+      .disabled(!draft.authenticationEnabled)
+
+    }
+  }
+
+  private func save() async {
+    saveError = nil
+    switch await workflow.saveLANListening(draft) {
+    case .persisted: dismiss()
+    case .rejected(.occupied): saveError = String(localized: "端口已占用，未保存局域网监听。")
+    case .rejected: saveError = String(localized: "配置发生变化或校验未完成，请重试。")
+    case .commitFailed(let failure):
+      switch failure {
+      case .store(let error): saveError = AppPresentation.message(for: error)
+      case .unknown: saveError = String(localized: "局域网监听保存失败。")
+      }
+    case .suggestedPort: break
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Settings/LanguageSettingsRow.swift b/ShadowsocksX-NG2/App/UI/Settings/LanguageSettingsRow.swift
new file mode 100644
index 000000000..284b35ff4
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Settings/LanguageSettingsRow.swift
@@ -0,0 +1,36 @@
+import SwiftUI
+
+struct LanguageSettingsRow: View {
+  @StateObject private var preferences = AppLanguagePreferences()
+
+  var body: some View {
+    HStack(spacing: 16) {
+      VStack(alignment: .leading, spacing: 2) {
+        Text("语言")
+        Text("下次启动生效")
+          .font(.caption)
+          .foregroundStyle(.secondary)
+      }
+      Spacer(minLength: 16)
+      Picker(
+        "语言",
+        selection: Binding(
+          get: { preferences.selection },
+          set: { preferences.select($0) }),
+        content: {
+          ForEach(AppLanguage.allCases, id: \.self) { language in
+            Text(verbatim: language.menuTitle()).tag(language)
+          }
+        },
+        currentValueLabel: {
+          Text(verbatim: preferences.selection.currentValueTitle())
+        }
+      )
+      .pickerStyle(.menu)
+      .labelsHidden()
+      .fixedSize()
+      .accessibilityIdentifier("appLanguagePicker")
+    }
+    .padding(.vertical, 4)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Settings/ListenerPortFields.swift b/ShadowsocksX-NG2/App/UI/Settings/ListenerPortFields.swift
new file mode 100644
index 000000000..aa08c9f6d
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Settings/ListenerPortFields.swift
@@ -0,0 +1,84 @@
+import SwiftUI
+
+struct ListenerPortFields: View {
+  @ObservedObject var workflow: SettingsWorkflow
+  @Binding var draft: SettingsPortDraft
+
+  var body: some View {
+    Group {
+      portField2(.socks, title: String(localized: "SOCKS 代理端口"))
+      portField2(.http, title: String(localized: "HTTP 代理端口"))
+    }
+  }
+
+  private func portField2(_ id: SettingsPortID, title: String) -> some View {
+    let state = workflow.portFieldState(for: id, editorDraft: draft)
+    return Group {
+      TextField(title, value: portBinding(for: id), format: .number.grouping(.never))
+        .textFieldStyle(.roundedBorder)
+        .monospacedDigit()
+        .disabled(workflow.isCommitting)
+      ForEach(state.issues, id: \.self) { issue in
+        Text(AppPresentation.message(for: issue))
+          .font(.caption)
+          .foregroundStyle(.red)
+          .multilineTextAlignment(.leading)
+          .frame(maxWidth: .infinity, alignment: .leading)
+      }
+
+      if let occupancy = occupancyMessage(for: state) {
+        Text(occupancy)
+          .font(.caption)
+          .foregroundStyle(occupancyColor(for: state))
+          .multilineTextAlignment(.leading)
+          .frame(maxWidth: .infinity, alignment: .leading)
+      }
+
+      if state.canSuggestFreePort {
+        Button("建议空闲端口") {
+          Task {
+            let outcome = await workflow.suggestFreePort(for: id, from: draft)
+            if case .suggestedPort(let port, let value) = outcome {
+              draft.setPortValue(value, for: port)
+            }
+          }
+        }
+        .font(.caption)
+        .disabled(workflow.isCommitting)
+      }
+
+    }
+  }
+
+  private func portBinding(for id: SettingsPortID) -> Binding<Int> {
+    Binding(
+      get: { draft.portValue(for: id) },
+      set: { draft.setPortValue($0, for: id) })
+  }
+
+  private func occupancyMessage(for state: SettingsPortFieldState) -> String? {
+    guard let occupancy = state.occupancy else { return nil }
+    switch occupancy {
+    case .free:
+      return nil
+    case .occupied(let occupier):
+      if state.isRuntimePortException {
+        return String(localized: "当前代理正在使用此端口")
+      }
+      if let occupier { return String(localized: "当前端口已占用（\(occupier)）") }
+      return String(localized: "当前端口已占用")
+    case .unknown(let detail):
+      return String(localized: "端口状态无法确定：\(detail)")
+    }
+  }
+
+  private func occupancyColor(for state: SettingsPortFieldState) -> Color {
+    guard let occupancy = state.occupancy else { return .secondary }
+    switch occupancy {
+    case .free, .unknown:
+      return .secondary
+    case .occupied:
+      return state.isRuntimePortException ? .secondary : .orange
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Settings/LocalhostListeningEditorSheet.swift b/ShadowsocksX-NG2/App/UI/Settings/LocalhostListeningEditorSheet.swift
new file mode 100644
index 000000000..1b3d7fc38
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Settings/LocalhostListeningEditorSheet.swift
@@ -0,0 +1,60 @@
+import SwiftUI
+
+struct LocalhostListeningEditorSheet: View {
+  @ObservedObject var workflow: SettingsWorkflow
+  @Environment(\.dismiss) private var dismiss
+  @State private var draft: SettingsPortDraft
+
+  init(workflow: SettingsWorkflow, initialDraft: SettingsPortDraft) {
+    self.workflow = workflow
+    _draft = State(initialValue: initialDraft)
+  }
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 16) {
+      Text("本地监听")
+        .font(.title2)
+      Text("SOCKS 与 HTTP 代理在本地回环地址 127.0.0.1 监听")
+        .font(.caption).foregroundStyle(.secondary)
+      Text("端口范围为 1025–65535，SOCKS 与 HTTP 代理端口必须不同")
+        .font(.caption)
+        .foregroundStyle(.secondary)
+
+      Form {
+        ListenerPortFields(workflow: workflow, draft: $draft)
+
+        if let failure = workflow.lastFailure {
+          Label(failure.presentableMessage, systemImage: "exclamationmark.triangle.fill")
+            .font(.footnote)
+            .foregroundStyle(.red)
+        }
+      }
+
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel) {
+          dismiss()
+        }
+        .keyboardShortcut(.cancelAction)
+        .disabled(workflow.isCommitting)
+
+        Button(workflow.isCommitting ? String(localized: "保存中…") : String(localized: "保存")) {
+          Task {
+            if case .persisted = await workflow.savePortSettings(draft) {
+              dismiss()
+            }
+          }
+        }
+        .keyboardShortcut(.defaultAction)
+        .disabled(!workflow.canSavePortSettings(draft))
+      }
+    }
+    .padding(24)
+    .frame(width: 400)
+    .interactiveDismissDisabled(workflow.isCommitting)
+    .task(id: draft) {
+      workflow.refreshPortEditorOccupancy(for: draft)
+    }
+  }
+
+}
diff --git a/ShadowsocksX-NG2/App/UI/Settings/SettingsView.swift b/ShadowsocksX-NG2/App/UI/Settings/SettingsView.swift
new file mode 100644
index 000000000..355f6426f
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Settings/SettingsView.swift
@@ -0,0 +1,338 @@
+import SwiftUI
+
+/// 设置分区：常规、后台代理客户端、系统代理与插件管理，采用
+/// 分组卡，行式呈现（主文案 + 次说明 + 行尾控件）。设置项由各自编辑器独立保存；
+/// 登录项与静默启动开关绑定独立控制器。
+struct SettingsView: View {
+  let plugins: PluginManagementModel
+  @ObservedObject var workflow: SettingsWorkflow
+  @ObservedObject var loginController: LaunchAtLoginController
+  @ObservedObject var silentLaunch: SilentLaunchController
+  @State private var presentedEditor: SettingsEditorSheet?
+  @AppStorage("showStatusBarRuntimeDots") private var showStatusBarRuntimeDots = true
+
+  var body: some View {
+    Form {
+      generalSection
+      endpointSection
+      ConnectivityURLSettings(workflow: workflow)
+      systemProxySection
+      PluginManagementSection(model: plugins)
+    }
+    .formStyle(.grouped)
+    .sheet(item: $presentedEditor) { editor in
+      switch editor {
+      case .ports(let session):
+        LocalhostListeningEditorSheet(workflow: workflow, initialDraft: session.initialDraft)
+      case .lan(let session):
+        LANListeningEditorSheet(workflow: workflow, initialDraft: session.initialDraft)
+      case .proxyExceptions(let session):
+        ProxyExceptionsEditorSheet(workflow: workflow, initialValue: session.initialValue)
+      }
+    }
+  }
+
+  // MARK: - 常规
+
+  private var generalSection: some View {
+    Section {
+      VStack(alignment: .leading, spacing: 4) {
+        Toggle(
+          isOn: Binding(
+            get: { loginController.isEnabled },
+            set: { loginController.setEnabled($0) })
+        ) {
+          settingCopy(
+            String(localized: "登录时启动 ShadowsocksX-NG2"), note: String(localized: "启动菜单栏应用，不会自动开启代理")
+          )
+        }
+        .toggleStyle(.switch)
+        if loginController.requiresApproval {
+          Text("请在系统设置 → 登录项 → 允许在后台运行中批准 ShadowsocksX-NG2。")
+            .font(.caption)
+            .foregroundStyle(.secondary)
+        }
+        if let loginError = loginController.errorMessage {
+          Text(loginError)
+            .font(.caption)
+            .foregroundStyle(.red)
+        }
+      }
+      .padding(.vertical, 4)
+      VStack(alignment: .leading, spacing: 4) {
+        Toggle(
+          isOn: Binding(
+            get: { silentLaunch.isEnabled },
+            set: { silentLaunch.setEnabled($0) })
+        ) {
+          settingCopy(String(localized: "静默启动"), note: String(localized: "启动时后台运行，不显示主窗口；下次启动生效"))
+        }
+        .toggleStyle(.switch)
+      }
+      .padding(.vertical, 4)
+      Toggle("显示状态栏运行状态圆点", isOn: $showStatusBarRuntimeDots)
+        .toggleStyle(.switch)
+        .padding(.vertical, 4)
+      LanguageSettingsRow()
+    } header: {
+      sectionHeader(String(localized: "常规"))
+    }
+  }
+
+  // MARK: - 后台代理客户端
+
+  private var endpointSection: some View {
+    Section {
+      if let failure = workflow.lastFailure {
+        Label(failure.presentableMessage, systemImage: "exclamationmark.triangle.fill")
+          .font(.footnote)
+          .foregroundStyle(.red)
+      }
+      portSettingsRow
+      settingRow(String(localized: "局域网监听")) {
+        Button {
+          presentedEditor = .lan(
+            LANListeningEditorSession(initialDraft: workflow.beginLANListeningEditing()))
+        } label: {
+          HStack(spacing: 8) {
+            VStack(alignment: .trailing, spacing: 3) {
+              let lan = workflow.committedLANListening
+              if lan.isEnabled {
+                Text("\(lan.mode.displayName) SOCKS \(lan.socksPort) / HTTP \(lan.httpPort)")
+                Text(lanSummary)
+                  .font(.caption)
+                  .foregroundStyle(.secondary)
+              } else {
+                Text("关闭")
+              }
+            }
+            Image(systemName: "chevron.right").font(.caption.weight(.semibold))
+          }
+        }
+        .buttonStyle(.bordered)
+        .accessibilityLabel("局域网监听")
+      }
+    } header: {
+      sectionHeader(String(localized: "后台代理客户端"))
+    }
+  }
+
+  private var lanSummary: String {
+    let lan = workflow.committedLANListening
+    let udp = lan.udpRelayEnabled ? String(localized: "UDP 中继启用") : String(localized: "UDP 中继禁用")
+    let auth =
+      lan.authenticationEnabled ? String(localized: "身份验证已启用") : String(localized: "身份验证已禁用")
+    return "\(udp) / \(auth)"
+  }
+
+  // MARK: - 系统代理
+
+  private var systemProxySection: some View {
+    Section {
+      settingRow(
+        String(localized: "额外系统代理例外"),
+        note: String(localized: "只追加到系统代理；应用固定绕过规则仍生效")
+      ) {
+        Button {
+          presentedEditor = .proxyExceptions(
+            ProxyExceptionsEditorSession(initialValue: workflow.beginProxyExceptionsEditing()))
+        } label: {
+          HStack(spacing: 8) {
+            Text("\(workflow.committedProxyExceptionCount) 项")
+            Image(systemName: "chevron.right")
+              .font(.caption.weight(.semibold))
+          }
+        }
+        .buttonStyle(.bordered)
+        .accessibilityLabel("额外系统代理例外")
+        .accessibilityValue("\(workflow.committedProxyExceptionCount) 项")
+        .accessibilityHint("编辑并保存额外的系统代理例外")
+      }
+    } header: {
+      sectionHeader(String(localized: "系统代理"))
+    }
+  }
+
+  // MARK: - 呈现组件
+
+  /// 分组卡标题行。
+  private func sectionHeader(_ title: String) -> some View {
+    Text(title)
+      .font(.headline)
+      .padding(.vertical, 2)
+  }
+
+  /// 主文案 + 可选次说明（原型行式；后台代理客户端区不配次说明）。
+  private func settingCopy(_ title: String, note: String? = nil) -> some View {
+    VStack(alignment: .leading, spacing: 2) {
+      Text(title)
+        .font(.body)
+      if let note {
+        Text(note)
+          .font(.caption)
+          .foregroundStyle(.secondary)
+      }
+    }
+  }
+
+  /// 行式布局：左侧文案，右侧控件。
+  private func settingRow<Control: View>(
+    _ title: String, note: String? = nil, @ViewBuilder control: () -> Control
+  ) -> some View {
+    HStack(spacing: 16) {
+      settingCopy(title, note: note)
+      Spacer(minLength: 16)
+      control()
+    }
+  }
+}
+
+// MARK: - 端口设置摘要与编辑框
+
+extension SettingsView {
+  fileprivate var portSettingsRow: some View {
+    let ports = workflow.committedPortDraft
+    let socksPort = ports.socksPort.formatted(.number.grouping(.never))
+    let httpPort = ports.httpPort.formatted(.number.grouping(.never))
+    return settingRow(String(localized: "本地监听")) {
+      Button {
+        presentedEditor = .ports(
+          PortSettingsEditorSession(initialDraft: workflow.beginPortSettingsEditing()))
+      } label: {
+        HStack(spacing: 8) {
+          Text("SOCKS \(socksPort) / HTTP \(httpPort)")
+            .monospacedDigit()
+          Image(systemName: "chevron.right")
+            .font(.caption.weight(.semibold))
+        }
+      }
+      .buttonStyle(.bordered)
+      .accessibilityLabel("本地监听")
+      .accessibilityValue("SOCKS \(socksPort)，HTTP 代理 \(httpPort)")
+    }
+  }
+
+}
+
+private enum SettingsEditorSheet: Identifiable {
+  case ports(PortSettingsEditorSession)
+  case lan(LANListeningEditorSession)
+  case proxyExceptions(ProxyExceptionsEditorSession)
+
+  var id: UUID {
+    switch self {
+    case .ports(let session): session.id
+    case .lan(let session): session.id
+    case .proxyExceptions(let session): session.id
+    }
+  }
+}
+
+private struct PortSettingsEditorSession: Identifiable {
+  let id = UUID()
+  let initialDraft: SettingsPortDraft
+}
+
+private struct ProxyExceptionsEditorSession: Identifiable {
+  let id = UUID()
+  let initialValue: String
+}
+
+private struct ProxyExceptionsEditorSheet: View {
+  @ObservedObject var workflow: SettingsWorkflow
+  @Environment(\.dismiss) private var dismiss
+  @State private var draft: String
+
+  init(workflow: SettingsWorkflow, initialValue: String) {
+    self.workflow = workflow
+    _draft = State(initialValue: initialValue)
+  }
+
+  var body: some View {
+    VStack(spacing: 0) {
+      ScrollView {
+        VStack(alignment: .leading, spacing: 14) {
+          Text("额外系统代理例外")
+            .font(.title2)
+          Text("添加希望 macOS 系统代理跳过的主机名、域名或 IP/CIDR。留空并确定会清除用户添加的条目。")
+            .font(.caption)
+            .foregroundStyle(.secondary)
+
+          TextEditor(text: $draft)
+            .font(.system(.body, design: .monospaced))
+            .scrollContentBackground(.hidden)
+            .padding(6)
+            .frame(height: 112)
+            .background(.background, in: RoundedRectangle(cornerRadius: 8))
+            .overlay {
+              RoundedRectangle(cornerRadius: 8)
+                .stroke(.quaternary, lineWidth: 1)
+            }
+            .disabled(workflow.isCommitting)
+            .accessibilityLabel("额外系统代理例外")
+
+          Text(
+            "格式：域名、主机名或 IP/CIDR，以逗号、顿号、空格或换行分隔。示例：127.0.0.1, 192.168.0.0/16, localhost。"
+          )
+          .font(.caption)
+          .foregroundStyle(.secondary)
+
+          Divider()
+
+          VStack(alignment: .leading, spacing: 6) {
+            Text("应用固定的系统代理例外")
+              .font(.headline)
+            Text(FixedLocalProxyRanges.systemProxyExceptions.joined(separator: "\n"))
+              .font(.system(.caption, design: .monospaced))
+              .textSelection(.enabled)
+            Text("应用系统代理配置时，还会固定开启“不包括简单主机名（Exclude simple hostnames）”。")
+              .font(.caption)
+              .foregroundStyle(.secondary)
+          }
+
+          VStack(alignment: .leading, spacing: 6) {
+            Text("应用固定的 ACL 绕过规则")
+              .font(.headline)
+            Text(FixedLocalProxyRanges.aclBypassRules.joined(separator: "\n"))
+              .font(.system(.caption, design: .monospaced))
+              .textSelection(.enabled)
+            Text("这些规则用于本机 SOCKS/HTTP 入站；上方输入只追加到系统代理例外，不会修改 ACL。")
+              .font(.caption)
+              .foregroundStyle(.secondary)
+          }
+
+          if let failure = workflow.lastFailure {
+            Label(failure.presentableMessage, systemImage: "exclamationmark.triangle.fill")
+              .font(.footnote)
+              .foregroundStyle(.red)
+          }
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .padding(.bottom, 16)
+      }
+
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel) {
+          dismiss()
+        }
+        .keyboardShortcut(.cancelAction)
+        .disabled(workflow.isCommitting)
+
+        Button(workflow.isCommitting ? String(localized: "保存中…") : String(localized: "确定")) {
+          Task {
+            if case .persisted = await workflow.saveProxyExceptions(draft) {
+              dismiss()
+            }
+          }
+        }
+        .keyboardShortcut(.defaultAction)
+        .disabled(workflow.isCommitting)
+      }
+      .padding(.top, 12)
+    }
+    .padding(24)
+    .frame(width: 560, height: 640)
+    .interactiveDismissDisabled(workflow.isCommitting)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/StatusMenu/ProxyStatusMenu.swift b/ShadowsocksX-NG2/App/UI/StatusMenu/ProxyStatusMenu.swift
new file mode 100644
index 000000000..a2eba5fb4
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/StatusMenu/ProxyStatusMenu.swift
@@ -0,0 +1,61 @@
+import AppKit
+import SwiftUI
+
+/// 菜单栏面板：窗口入口、反馈与退出。
+struct ProxyStatusMenu: View {
+  @Environment(\.openWindow) private var openWindow
+  @Environment(\.openURL) private var openURL
+  /// 只捕获本面板的宿主窗口，打开主窗口时不会误关其他窗口。
+  @State private var windowAnchor = NSView(frame: .zero)
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 0) {
+      Button("打开主窗口…") {
+        windowAnchor.window?.orderOut(nil)
+        NSApp.activate(ignoringOtherApps: true)
+        openWindow(id: WorkspaceRoute.workspaceSceneID)
+      }
+      .padding(12)
+
+      Button("诊断…") {
+        windowAnchor.window?.orderOut(nil)
+        NSApp.activate(ignoringOtherApps: true)
+        openWindow(id: DiagnosticsWindowState.sceneID)
+      }
+      .padding(12)
+
+      Divider()
+
+      Button("反馈…") {
+        windowAnchor.window?.orderOut(nil)
+        if let url = URL(string: "https://github.com/shadowsocks/ShadowsocksX-NG/discussions") {
+          openURL(url)
+        }
+      }
+      .padding(12)
+
+      Button("关于 ShadowsocksX-NG2") {
+        windowAnchor.window?.orderOut(nil)
+        NSApp.activate(ignoringOtherApps: true)
+        openWindow(id: AboutView.sceneID)
+      }
+      .padding(12)
+
+      Divider()
+      Button("退出 ShadowsocksX-NG2（代理仍在后台运行）") {
+        NSApp.terminate(nil)
+      }
+      .padding(12)
+    }
+    .frame(width: 320, alignment: .leading)
+    .background(StatusPanelWindowAnchor(view: windowAnchor).frame(width: 0, height: 0))
+  }
+}
+
+/// MenuBarExtra 没有关闭弹出面板的绑定；零尺寸视图定位当前面板的窗口。
+private struct StatusPanelWindowAnchor: NSViewRepresentable {
+  let view: NSView
+
+  func makeNSView(context: Context) -> NSView { view }
+  func updateNSView(_ nsView: NSView, context: Context) {}
+}
diff --git a/ShadowsocksX-NG2/App/UI/Subscriptions/SubscriptionInformationPresentation.swift b/ShadowsocksX-NG2/App/UI/Subscriptions/SubscriptionInformationPresentation.swift
new file mode 100644
index 000000000..7e3e51d4b
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Subscriptions/SubscriptionInformationPresentation.swift
@@ -0,0 +1,28 @@
+import Foundation
+
+extension SubscriptionInformation {
+  /// 只在两项都有效且总量非零时给出进度；先转浮点避免 UInt64 相加溢出。
+  var usedFraction: Double? {
+    guard let bytesUsed, let bytesRemaining, bytesUsed != 0 || bytesRemaining != 0 else {
+      return nil
+    }
+    let used = Double(bytesUsed)
+    return used / (used + Double(bytesRemaining))
+  }
+
+  static func byteCountText(_ count: UInt64, locale: Locale) -> String {
+    // Measurement 的浮点输入覆盖完整 UInt64 范围，不经 Int64 截断。
+    Measurement(value: Double(count), unit: UnitInformationStorage.bytes)
+      .formatted(.byteCount(style: .binary, spellsOutZero: false).locale(locale))
+  }
+}
+
+extension SubscriptionUpdateMode {
+  var displayName: String {
+    switch self {
+    case .off: String(localized: "关闭", table: "ServerDetails")
+    case .daily: String(localized: "每天", table: "ServerDetails")
+    case .weekly: String(localized: "每周", table: "ServerDetails")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Subscriptions/SubscriptionsView.swift b/ShadowsocksX-NG2/App/UI/Subscriptions/SubscriptionsView.swift
new file mode 100644
index 000000000..1b0502187
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Subscriptions/SubscriptionsView.swift
@@ -0,0 +1,165 @@
+import SwiftUI
+
+enum SubscriptionDeletionConfirmation {
+  static func title(for name: String) -> String {
+    String(localized: "删除订阅「\(name)」及其整棵子树？")
+  }
+
+  static let actionTitle = String(localized: "删除订阅")
+  static let message =
+    String(localized: "将移除订阅源、固定分组与全部远端成员；若代理正走此订阅，代理会停止。此操作不可撤销。")
+}
+
+/// 「添加订阅」表单（工具栏入口）：粘贴 HTTPS 订阅地址；创建后立即首次刷新。
+struct AddSubscriptionSheet: View {
+  let workflow: CatalogWorkflow
+  let errors: ErrorAlertPresenter
+  @Environment(\.dismiss) private var dismiss
+
+  @State private var urlString = ""
+  @State private var autoUpdate = SubscriptionAutoUpdateSettings()
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 16) {
+      Text("添加订阅").font(.title2)
+      Text("粘贴订阅地址（必须 HTTPS，返回 SIP-008 JSON；Content-Type 需为 application/json; charset=utf-8）。")
+        .font(.callout)
+        .foregroundStyle(.secondary)
+      TextField(
+        "订阅地址", text: $urlString,
+        prompt: Text(verbatim: "https://example.com/subscription.json")
+          .foregroundStyle(.placeholder)
+      )
+      SubscriptionAutoUpdateForm(settings: $autoUpdate)
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel) { dismiss() }
+        Button("添加并刷新") { create() }
+          .keyboardShortcut(.defaultAction)
+          .disabled(urlString.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
+      }
+    }
+    .padding(20)
+    .frame(minWidth: 480)
+  }
+
+  private func create() {
+    Task {
+      do {
+        _ = try await workflow.createSubscription(urlString: urlString, autoUpdate: autoUpdate)
+        dismiss()
+      } catch {
+        errors.present(error)
+      }
+    }
+  }
+}
+
+/// 订阅编辑表单（保留订阅与固定分组身份）；仅地址变化时立即刷新。
+/// URL 明文经显式命令读取。
+struct EditSubscriptionSheet: View {
+  let workflow: CatalogWorkflow
+  let errors: ErrorAlertPresenter
+  let summary: SubscriptionSummary
+  @Environment(\.dismiss) private var dismiss
+
+  @State private var urlString = ""
+  @State private var autoUpdate = SubscriptionAutoUpdateSettings()
+  @State private var loaded = false
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 16) {
+      Text("编辑订阅").font(.title2)
+      Text("编辑订阅地址。订阅身份与固定分组全部保留；新地址刷新成功前保留最后一次成功内容。")
+        .font(.callout)
+        .foregroundStyle(.secondary)
+      TextField(
+        "订阅地址", text: $urlString,
+        prompt: Text(verbatim: "https://example.com/subscription.json")
+          .foregroundStyle(.placeholder)
+      )
+      SubscriptionAutoUpdateForm(settings: $autoUpdate, provider: summary.autoUpdate.provider)
+      HStack {
+        Spacer()
+        Button("取消", role: .cancel) { dismiss() }
+        Button("保存") { save() }
+          .keyboardShortcut(.defaultAction)
+          .disabled(urlString.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
+      }
+    }
+    .padding(20)
+    .frame(minWidth: 480)
+    .onAppear {
+      guard !loaded else { return }
+      loaded = true
+      do {
+        urlString = try workflow.subscriptionURL(for: summary.id)
+        autoUpdate = summary.autoUpdate.settings
+      } catch {
+        errors.present(error)
+      }
+    }
+  }
+
+  private func save() {
+    Task {
+      do {
+        try await workflow.saveSubscription(
+          summary.id, urlString: urlString, autoUpdate: autoUpdate)
+        dismiss()
+      } catch {
+        errors.present(error)
+      }
+    }
+  }
+}
+
+private struct SubscriptionAutoUpdateForm: View {
+  @Binding var settings: SubscriptionAutoUpdateSettings
+  var provider: SubscriptionUpdatePolicy?
+
+  private var providerMode: SubscriptionUpdateMode { provider?.mode ?? .off }
+
+  var body: some View {
+    GroupBox("自动更新") {
+      VStack(alignment: .leading, spacing: 10) {
+        if provider?.allowUserOverride != false {
+          Picker(
+            "设置来源",
+            selection: Binding(
+              get: { settings.userOverride != nil },
+              set: { settings.userOverride = $0 ? .off : nil }
+            )
+          ) {
+            Text("跟随供应商").tag(false)
+            Text("自定义").tag(true)
+          }
+          if settings.userOverride != nil {
+            Toggle(
+              "启用自动更新",
+              isOn: Binding(
+                get: { settings.userOverride != .off },
+                set: { settings.userOverride = $0 ? settings.interval : .off }
+              ))
+            Picker("更新间隔", selection: $settings.interval) {
+              Text(SubscriptionUpdateMode.daily.displayName).tag(SubscriptionUpdateMode.daily)
+              Text(SubscriptionUpdateMode.weekly.displayName).tag(SubscriptionUpdateMode.weekly)
+            }
+            .onChange(of: settings.interval) { _, interval in
+              if settings.userOverride != .off { settings.userOverride = interval }
+            }
+          } else {
+            Text(providerMode.displayName).foregroundStyle(.secondary)
+          }
+        } else {
+          LabeledContent("供应商设置", value: providerMode.displayName)
+          Text("供应商禁止覆盖自动更新设置")
+            .font(.callout).foregroundStyle(.secondary)
+        }
+      }
+      .pickerStyle(.segmented)
+      .frame(maxWidth: .infinity, alignment: .leading)
+      .padding(6)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Workspace/MainWindowView.swift b/ShadowsocksX-NG2/App/UI/Workspace/MainWindowView.swift
new file mode 100644
index 000000000..2b176dbd6
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Workspace/MainWindowView.swift
@@ -0,0 +1,210 @@
+import SwiftUI
+
+/// 服务器导入面板：由窗口工具栏「导入服务器配置」按钮打开，窗口壳统一持有
+/// 呈现；添加订阅表单由服务器分区自持（ServersView）。
+private enum WorkspaceSheet: String, Identifiable {
+  case importServers
+
+  var id: String { rawValue }
+}
+
+/// 主窗口标签页外壳：WorkspaceRoute 持有导航位置；各分区持有页级动作。
+/// 仅当前 destination 挂载内容，延续切页清理草稿与取消页面任务的生命周期；
+/// 激活反馈仍由窗口壳持有，跨标签切换存续。
+struct MainWindowView: View {
+  /// 纯转发的分区工作流与控制器：壳 body 不读它们（分区视图自行观察），
+  /// 用 let 转发，壳不重复订阅它们的发布。
+  let rulesWorkflow: RulesWorkspaces
+  @ObservedObject var route: WorkspaceRoute
+  @ObservedObject var workflow: CatalogWorkflow
+  @ObservedObject var control: ProxyControlWorkflow
+  /// 首页运行控制卡与菜单栏状态卡共享的状态显示 debounce 模型；壳 body
+  /// 不读它（分区视图自行观察），用 let 转发。
+  let statusDisplay: StatusDisplayModel
+  let plugins: PluginManagementModel
+  let settingsWorkflow: SettingsWorkflow
+  let loginController: LaunchAtLoginController
+  let silentLaunch: SilentLaunchController
+  /// 目录树折叠状态：组合根持有的长寿命对象，跨 destination 切换存续；服务器
+  /// 侧栏使用（见 CatalogExpansionState）。
+  let expansion: CatalogExpansionState
+  let clipboard: any TextClipboard
+  let imageClipboard: any ImageClipboard
+  let configurationGroupFileExporter: any ConfigurationGroupFileExporter
+  let qrImageSaver: any QrImageSaver
+
+  /// 激活反馈由首页、侧栏右键与分组详情共用。
+  @StateObject private var activationFeedback = ActivationFeedbackState()
+  @StateObject private var homeBrowser = HomeTargetBrowser()
+  /// 系统标签选择先落在 SwiftUI 自管状态，再同步到 route，避免在视图
+  /// 更新期间发布；外部导航反向同步，route 仍是导航位置的唯一来源。
+  @State private var tabSelection: WorkspaceDestination = WorkspaceRoute.initialDestination
+  @State private var selection: NodeID?
+  @State private var serverSection: ServerListSection = .manual
+  /// 全局导入面板由窗口壳持有。
+  @State private var presentedWorkspaceSheet: WorkspaceSheet?
+
+  var body: some View {
+    TabView(selection: $tabSelection) {
+      ForEach(WorkspaceDestination.allCases) { destination in
+        Tab(destination.label, systemImage: destination.systemImage, value: destination) {
+          if route.destination == destination {
+            if let failure = workflow.libraryFailure,
+              destination == .home || destination == .servers
+            {
+              ServerLibraryRecoveryView(workflow: workflow, failure: failure)
+            } else {
+              destinationView(destination)
+            }
+          }
+        }
+      }
+    }
+    .tabViewStyle(.automatic)
+    .toolbar {
+      ToolbarItem(placement: .navigation) {
+        importButton
+      }
+    }
+    .onChange(of: tabSelection) { _, destination in
+      route.navigate(to: destination)
+    }
+    .onChange(of: route.destination, initial: true) { _, destination in
+      if tabSelection != destination {
+        tabSelection = destination
+      }
+    }
+    .onChange(of: workflow.tree) {
+      homeBrowser.reconcile(in: workflow.tree, favorites: workflow.favorites)
+    }
+    .onChange(of: workflow.favoriteIDs) {
+      homeBrowser.reconcile(in: workflow.tree, favorites: workflow.favorites)
+    }
+    .onChange(of: selection) {
+      guard let selection, let node = workflow.tree.node(withID: selection) else { return }
+      guard serverSection != .favorites else { return }
+      serverSection = ServerListSection(source: node.source)
+      expansion.reveal(selection, in: workflow.tree)
+    }
+    .navigationTitle(route.destination.label)
+    .frame(minWidth: 920, minHeight: 580)
+    .sheet(item: $presentedWorkspaceSheet) { sheet in
+      switch sheet {
+      case .importServers:
+        ImportServersSheet(
+          workflow: workflow, clipboard: clipboard,
+          selection: Binding(
+            get: { selection },
+            set: { id in
+              if id != nil { serverSection = .manual }
+              selection = id
+            }),
+          selectNewNodes: serverSection == .favorites)
+      }
+    }
+  }
+
+  // MARK: - 全局导入入口
+
+  private var importButton: some View {
+    Button {
+      presentWorkspaceSheet(.importServers)
+    } label: {
+      Label("导入", systemImage: "square.and.arrow.down")
+    }
+    .help("导入")
+    .disabled(workflow.libraryFailure != nil)
+  }
+
+  private func presentWorkspaceSheet(_ sheet: WorkspaceSheet) {
+    route.navigate(to: .servers)
+    presentedWorkspaceSheet = sheet
+  }
+
+  // MARK: - 分区承载
+
+  @ViewBuilder
+  private func destinationView(_ destination: WorkspaceDestination) -> some View {
+    switch destination {
+    case .home:
+      WorkspaceHomeView(
+        workflow: workflow,
+        control: control,
+        statusDisplay: statusDisplay,
+        browser: homeBrowser,
+        activation: activationFeedback,
+        showServers: { route.navigate(to: .servers) },
+        clipboard: clipboard)
+    case .servers:
+      ServersView(
+        workflow: workflow,
+        activation: activationFeedback,
+        activeTargetID: control.snapshot.activeTarget?.id,
+        selection: $selection,
+        section: $serverSection,
+        expansion: expansion,
+        clipboard: clipboard,
+        imageClipboard: imageClipboard,
+        configurationGroupFileExporter: configurationGroupFileExporter,
+        qrImageSaver: qrImageSaver)
+    case .rules:
+      RulesPresetView(workspaces: rulesWorkflow)
+    case .settings:
+      SettingsView(
+        plugins: plugins, workflow: settingsWorkflow, loginController: loginController,
+        silentLaunch: silentLaunch
+      )
+      .frame(maxWidth: .infinity, maxHeight: .infinity)
+    }
+  }
+}
+
+extension WorkspaceDestination {
+  var label: String {
+    switch self {
+    case .home: String(localized: "首页")
+    case .servers: String(localized: "服务器")
+    case .rules: RulesCopy.text("代理规则")
+    case .settings: String(localized: "设置")
+    }
+  }
+
+  var systemImage: String {
+    switch self {
+    case .home: "house"
+    case .servers: "server.rack"
+    case .rules: "list.bullet.rectangle"
+    case .settings: "gearshape"
+    }
+  }
+}
+
+// MARK: - 首页 destination 包装壳
+
+/// 首页 destination 的包装视图：承载共享错误弹窗挂载，行为
+/// 委托给 HomeView。旧版导入的主动弹窗已移除（docs/design/unified-server-
+/// import.md），发现状态仅供统一导入面板的 Legacy 入口显隐。
+private struct WorkspaceHomeView: View {
+  @ObservedObject var workflow: CatalogWorkflow
+  @ObservedObject var control: ProxyControlWorkflow
+  let statusDisplay: StatusDisplayModel
+  let browser: HomeTargetBrowser
+  let activation: ActivationFeedbackState
+  let showServers: () -> Void
+  let clipboard: any TextClipboard
+  @StateObject private var errors = ErrorAlertPresenter()
+
+  var body: some View {
+    HomeView(
+      workflow: workflow,
+      control: control,
+      statusDisplay: statusDisplay,
+      browser: browser,
+      activation: activation,
+      showServers: showServers,
+      clipboard: clipboard,
+      errors: errors
+    )
+    .presentingErrors(errors)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Workspace/StatusCardModel.swift b/ShadowsocksX-NG2/App/UI/Workspace/StatusCardModel.swift
new file mode 100644
index 000000000..b78f90496
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Workspace/StatusCardModel.swift
@@ -0,0 +1,108 @@
+import Foundation
+
+/// 菜单栏面板代理状态卡的呈现模型：从代理控制
+/// 工作流的整体 snapshot 派生卡片数据——行结构（哪些行、条件 detail、顺序）、
+/// 活动目标回退文案与语义色调政策全部在此决定；文本复用 StatusMenuModel 的
+/// 同一映射（配色与文本同源）。不持有 SwiftUI/AppKit 类型，纯逻辑可测；视觉
+/// 细节（tone→语义色、排版）在 StatusCardView 呈现，不建自动测试。
+enum StatusCardModel {
+  /// 语义色调：呈现层映射为系统语义色（positive=green、attention=orange、
+  /// failure=red、neutral=secondary）。
+  enum Tone: Equatable {
+    case positive
+    case attention
+    case failure
+    case neutral
+  }
+
+  struct Row: Equatable {
+    let label: String
+    let text: String
+    let tone: Tone
+  }
+
+  struct DetailLine: Equatable {
+    let text: String
+    let tone: Tone
+  }
+
+  /// 活动目标行：正文与悬停/辅助说明（未激活时按模式区分回退文案）。
+  struct TargetPresentation: Equatable {
+    let text: String
+    let help: String
+  }
+
+  struct Card: Equatable {
+    let runtimeRow: Row
+    /// agent 侧点名原因（运行失败或激活拒绝）；无则 nil。
+    let runtimeDetail: DetailLine?
+    let systemProxyRow: Row
+    /// 系统代理写入/清理失败点名；非失败态为 nil。
+    let systemProxyDetail: DetailLine?
+    let target: TargetPresentation
+    /// 模式行文本（规则模式带子选项，与状态菜单同口径）。
+    let modeText: String
+  }
+
+  static func card(from snapshot: ProxyControlSnapshot) -> Card {
+    let summary = StatusMenuModel.summary(from: snapshot)
+    let runtimeTone = runtimeTone(for: snapshot.runtime.status)
+    return Card(
+      runtimeRow: Row(label: String(localized: "后台代理"), text: summary.status, tone: runtimeTone),
+      runtimeDetail: summary.detail.map {
+        DetailLine(text: $0, tone: runtimeDetailTone(snapshot: snapshot, runtimeTone: runtimeTone))
+      },
+      systemProxyRow: Row(
+        label: String(localized: "系统代理设置"),
+        text: summary.systemProxyStateLabel,
+        tone: systemProxyTone(for: snapshot.systemProxyApplication)),
+      systemProxyDetail: summary.systemProxyDetail.map {
+        DetailLine(text: $0, tone: .failure)
+      },
+      target: targetPresentation(summary: summary, proxyMode: snapshot.proxyMode),
+      modeText: summary.modeLabel)
+  }
+
+  private static func runtimeTone(for status: ProxyRuntimeStatus) -> Tone {
+    switch status {
+    case .running: .positive
+    case .starting, .off: .neutral
+    case .firewallBlocked, .requiresApproval: .attention
+    case .launchFailed, .serviceFailed: .failure
+    }
+  }
+
+  /// agent 点名原因色调：运行失败跟随运行状态色调；激活点名失败独立显红；
+  /// 其余中性。
+  private static func runtimeDetailTone(snapshot: ProxyControlSnapshot, runtimeTone: Tone) -> Tone {
+    if snapshot.runtime.failure != nil {
+      return runtimeTone
+    }
+    return snapshot.activationFailure == nil ? .neutral : .failure
+  }
+
+  private static func systemProxyTone(for application: SystemProxyApplicationFacts) -> Tone {
+    switch application {
+    case .idle: .neutral
+    case .pending, .changed, .applying, .repairing, .paused: .attention
+    case .applied: .positive
+    case .failed, .repairFailed, .clearFailed, .unreadable: .failure
+    }
+  }
+
+  /// 活动目标回退：有目标用路径；未激活时直连模式无需目标，其余模式提示
+  /// 未激活。
+  private static func targetPresentation(
+    summary: StatusMenuModel.Summary, proxyMode: ProxyMode
+  ) -> TargetPresentation {
+    if let targetPath = summary.targetPath {
+      return TargetPresentation(text: targetPath, help: String(localized: "活动目标：\(targetPath)"))
+    }
+    if proxyMode == .direct {
+      return TargetPresentation(
+        text: String(localized: "直连模式（无需服务器）"), help: String(localized: "直连模式无需选择活动目标"))
+    }
+    return TargetPresentation(
+      text: String(localized: "未激活"), help: String(localized: "未设置活动目标；在首页或服务器目录中激活"))
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Workspace/StatusCardView.swift b/ShadowsocksX-NG2/App/UI/Workspace/StatusCardView.swift
new file mode 100644
index 000000000..5ea1ba0ce
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Workspace/StatusCardView.swift
@@ -0,0 +1,101 @@
+import AppKit
+import SwiftUI
+
+/// 菜单栏面板代理状态卡。状态行经 StatusDisplayModel 的瞬态门控呈现
+/// （与首页运行控制卡同一 debounce 口径）；活动目标与模式行仍从 control
+/// 的整体 snapshot 直接派生。
+struct StatusCardView: View {
+  @ObservedObject var control: ProxyControlWorkflow
+  let statusDisplay: StatusDisplayModel
+
+  var body: some View {
+    let card = StatusCardModel.card(from: control.snapshot)
+    row(statusDisplay.agent.row)
+    if let detail = statusDisplay.agent.detail {
+      detailLine(detail)
+    }
+    row(statusDisplay.systemProxy.row)
+    if let detail = statusDisplay.systemProxy.detail {
+      detailLine(detail)
+    }
+
+    Text(card.target.text)
+      .truncationMode(.middle)
+      .help(card.target.help)
+      .accessibilityElement(children: .ignore)
+      .accessibilityLabel("活动目标：\(card.target.text)")
+
+    Text("模式：\(card.modeText)").accessibilityElement(children: .combine)
+  }
+
+  private func row(_ row: StatusCardModel.Row) -> some View {
+    Text("\(row.label)：\(row.text)").accessibilityElement(children: .combine)
+  }
+
+  private func detailLine(_ detail: StatusCardModel.DetailLine) -> some View {
+    Text(detail.text)
+      .lineLimit(2)
+      .help(detail.text)
+  }
+}
+
+/// 首页与状态栏共用圆点及色调映射，尺寸由显示位置决定。
+struct RuntimeStatusDot: View {
+  let tone: StatusCardModel.Tone
+  let diameter: CGFloat
+
+  var body: some View {
+    Circle()
+      .fill(color)
+      .frame(width: diameter, height: diameter)
+      .accessibilityHidden(true)
+  }
+
+  private var color: Color {
+    switch tone {
+    case .positive: .green
+    case .attention: .orange
+    case .failure: .red
+    case .neutral: .secondary
+    }
+  }
+}
+
+/// 标签在启动时即挂载；启动 resync 必须留在此处，不能移入首次点开才创建的菜单内容。
+struct StatusMenuLabel: View {
+  let control: ProxyControlWorkflow
+  let statusDisplay: StatusDisplayModel
+  @Environment(\.colorScheme) private var colorScheme
+  @Environment(\.displayScale) private var displayScale
+  @AppStorage("showStatusBarRuntimeDots") private var showStatusBarRuntimeDots = true
+
+  var body: some View {
+    Image(nsImage: statusImage)
+      .renderingMode(.original)
+      .accessibilityLabel("ShadowsocksX-NG2")
+      .task {
+        await control.resyncOnLaunch()
+      }
+  }
+
+  /// MenuBarExtra 使用单张图像承载主图标和圆点，保留圆点的原始颜色。
+  private var statusImage: NSImage {
+    let renderer = ImageRenderer(
+      content: HStack(spacing: 2) {
+        Image(systemName: "paperplane.fill")
+          .font(.system(size: 16))
+          .foregroundStyle(.primary)
+          .frame(width: 18, height: 18)
+        if showStatusBarRuntimeDots {
+          VStack(spacing: 5) {
+            RuntimeStatusDot(tone: statusDisplay.agent.row.tone, diameter: 4)
+            RuntimeStatusDot(tone: statusDisplay.systemProxy.row.tone, diameter: 4)
+          }
+        }
+      }
+      .environment(\.colorScheme, colorScheme))
+    renderer.scale = displayScale
+    return renderer.nsImage ?? NSImage(
+      systemSymbolName: "paperplane.fill", accessibilityDescription: nil) ?? NSImage(size: .zero)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Workspace/StatusDisplayModel.swift b/ShadowsocksX-NG2/App/UI/Workspace/StatusDisplayModel.swift
new file mode 100644
index 000000000..12d07ffc8
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Workspace/StatusDisplayModel.swift
@@ -0,0 +1,142 @@
+import Combine
+import Foundation
+import Observation
+
+/// 状态显示 debounce 呈现模型：首页运行控制卡与菜单栏状态卡共用的两个意图
+/// （代理服务、系统代理）状态呈现，从代理控制工作流的整体 snapshot 派生
+/// payload 后经瞬态门控发布。稳定态（已应用/失败/待批准等）立即可见；瞬态
+/// （启动中/应用中/修复中）延迟上屏、短命即被吞掉，已上屏瞬态保持最短时
+/// 长——快速切换代理模式这类多数瞬间成功的操作不再让状态行闪中间态。
+/// 行、色调与点名 detail 复用 StatusCardModel 的既有口径，此处只做派生
+/// 捆绑（hint 一并随系统代理流更新，行与说明文案不会短暂不一致）。
+@Observable
+@MainActor
+final class StatusDisplayModel {
+  /// 代理服务意图的状态呈现：状态行与点名原因。
+  struct AgentStatus: Equatable {
+    let row: StatusCardModel.Row
+    let detail: StatusCardModel.DetailLine?
+  }
+
+  /// 系统代理意图的状态呈现：状态行、点名原因与运行控制卡说明文案。
+  struct SystemProxyStatus: Equatable {
+    let row: StatusCardModel.Row
+    /// 点名原因不在此抑制：面板把它作为暂停说明行渲染，首页按 isPaused
+    /// 抑制（沿两侧原有口径）。
+    let detail: StatusCardModel.DetailLine?
+    let hint: String
+    /// 已暂停时详情与提示文案重复（hint 已是暂停说明），首页据此不渲染
+    /// detail；面板无 hint，仍渲染 detail 作为暂停说明。
+    let isPaused: Bool
+  }
+
+  private(set) var agent: AgentStatus
+  private(set) var systemProxy: SystemProxyStatus
+
+  private let agentGate: TransientDelayGate<AgentStatus>
+  private let systemProxyGate: TransientDelayGate<SystemProxyStatus>
+  private var cancellables: Set<AnyCancellable> = []
+
+  /// 当前排队的迟显任务；无排队为 nil。供测试等待迟显完成。
+  var scheduledAgentDisplayTask: Task<Void, Never>? { agentGate.scheduledDisplayTask }
+  var scheduledSystemProxyDisplayTask: Task<Void, Never>? {
+    systemProxyGate.scheduledDisplayTask
+  }
+
+  /// 生产接线：订阅代理控制工作流的整体 snapshot 发布。
+  convenience init(
+    control: ProxyControlWorkflow,
+    interval: TimeInterval = 0.4,
+    now: @escaping () -> TimeInterval = { Date().timeIntervalSinceReferenceDate },
+    sleep: @escaping (TimeInterval) async throws -> Void = {
+      try await Task.sleep(for: .seconds($0))
+    }
+  ) {
+    self.init(snapshots: control.$snapshot, interval: interval, now: now, sleep: sleep)
+  }
+
+  /// 测试缝：直接注入 snapshot 流（订阅即送达当前值，两流首值立即上屏）。
+  init<Snapshots: Publisher>(
+    snapshots: Snapshots,
+    interval: TimeInterval = 0.4,
+    now: @escaping () -> TimeInterval = { Date().timeIntervalSinceReferenceDate },
+    sleep: @escaping (TimeInterval) async throws -> Void = {
+      try await Task.sleep(for: .seconds($0))
+    }
+  ) where Snapshots.Output == ProxyControlSnapshot, Snapshots.Failure == Never {
+    agent = AgentStatus(row: .init(label: "", text: "", tone: .neutral), detail: nil)
+    systemProxy = SystemProxyStatus(
+      row: .init(label: "", text: "", tone: .neutral), detail: nil, hint: "", isPaused: false)
+    agentGate = TransientDelayGate(interval: interval, now: now, sleep: sleep)
+    systemProxyGate = TransientDelayGate(interval: interval, now: now, sleep: sleep)
+    // 存储属性至此完整初始化，显示回调才可捕获 self。
+    agentGate.display = { [weak self] in self?.agent = $0 }
+    systemProxyGate.display = { [weak self] in self?.systemProxy = $0 }
+    // 订阅即送达当前 snapshot：两流首值立即上屏（门控首值语义）。
+    snapshots
+      .sink { [weak self] snapshot in self?.handle(snapshot) }
+      .store(in: &cancellables)
+  }
+
+  private func handle(_ snapshot: ProxyControlSnapshot) {
+    agentGate.update(
+      Self.agentStatus(from: snapshot),
+      isTransient: snapshot.runtime.status == .starting)
+    systemProxyGate.update(
+      Self.systemProxyStatus(from: snapshot),
+      isTransient: Self.isSystemProxyTransient(snapshot.systemProxyApplication))
+  }
+
+  // MARK: - payload 派生
+
+  static func agentStatus(from snapshot: ProxyControlSnapshot) -> AgentStatus {
+    let card = StatusCardModel.card(from: snapshot)
+    return AgentStatus(row: card.runtimeRow, detail: card.runtimeDetail)
+  }
+
+  static func systemProxyStatus(from snapshot: ProxyControlSnapshot) -> SystemProxyStatus {
+    let card = StatusCardModel.card(from: snapshot)
+    return SystemProxyStatus(
+      row: card.systemProxyRow,
+      detail: card.systemProxyDetail,
+      hint: systemProxyHint(from: snapshot),
+      isPaused: snapshot.systemProxyApplication == .paused)
+  }
+
+  /// 系统代理侧瞬态 = 正在写入/修复系统代理配置；pending（待批准/待应用）是
+  /// 需要用户行动的 resting 态，不算瞬态。
+  static func isSystemProxyTransient(_ application: SystemProxyApplicationFacts) -> Bool {
+    application == .applying || application == .repairing
+  }
+
+  /// 运行控制卡的说明文案（原视图内派生移入，随系统代理流一起门控/去重）。
+  private static func systemProxyHint(from snapshot: ProxyControlSnapshot) -> String {
+    let exitRequirement =
+      snapshot.proxyMode == .direct
+      ? String(localized: "直连模式不依赖活动服务器")
+      : String(localized: "规则/全局模式需要可用的活动服务器")
+    if snapshot.systemProxyApprovalRequired {
+      return String(localized: "系统代理助手等待批准。请在系统设置 → 登录项与扩展中允许。")
+    }
+    return switch snapshot.systemProxyApplication {
+    case .idle:
+      String(localized: "开启后让 macOS 系统代理指向本地入口；\(exitRequirement)")
+    case .pending:
+      String(localized: "已请求应用系统代理，等待本地入口就绪；\(exitRequirement)")
+    case .applied:
+      String(localized: "系统代理已指向本地入口")
+    case .failed, .repairFailed, .clearFailed:
+      String(localized: "操作失败，原因见下方")
+    case .paused:
+      AppPresentation.systemProxyPausedNotice
+    case .changed:
+      String(localized: "当前系统代理配置与预期存在差异")
+    case .unreadable:
+      String(localized: "无法检查当前系统代理配置")
+    case .applying:
+      String(localized: "正在应用系统代理配置…")
+    case .repairing:
+      String(localized: "正在修复系统代理配置…")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Workspace/TransientDelayGate.swift b/ShadowsocksX-NG2/App/UI/Workspace/TransientDelayGate.swift
new file mode 100644
index 000000000..8cc4b094f
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Workspace/TransientDelayGate.swift
@@ -0,0 +1,90 @@
+import Foundation
+
+/// 单条状态显示流的瞬态延迟门控：稳定值立即上屏；瞬态值（启动中/应用中/
+/// 修复中等短命中间态）延迟一个 interval 后才上屏，期间被新值取代则按新值
+/// 重新裁定；已上屏的瞬态至少保持一个 interval，避免「应用中」只闪一瞬又跳
+/// 终态的二次闪烁。首值直接上屏——初始绘制没有可被闪烁的上一状态。
+///
+/// 时间经 now/sleep 注入，测试用虚拟时钟驱动；不持有 SwiftUI 类型。
+@MainActor
+final class TransientDelayGate<Value: Equatable> {
+  private let interval: TimeInterval
+  private let now: () -> TimeInterval
+  private let sleep: (TimeInterval) async throws -> Void
+
+  /// 显示回调；构造后立即接线。持有方须在自身完成初始化后才能捕获 self，
+  /// 故不入构造参数。nil 时门控照常裁决但不外发。
+  var display: ((Value) -> Void)?
+
+  private var displayed: Value?
+  private var pending: (value: Value, isTransient: Bool)?
+  /// 已上屏瞬态的保持截止时刻；稳定值上屏时清除。窗口内的替换被排迟到
+  /// 截止时刻，防止瞬态只闪一瞬。
+  private var holdUntil: TimeInterval?
+  private var scheduleGeneration = 0
+  private var pendingTask: Task<Void, Never>?
+
+  /// 当前排队显示任务；无排队（已上屏或无待显值）为 nil。供测试等待迟显完成。
+  var scheduledDisplayTask: Task<Void, Never>? { pendingTask }
+
+  init(
+    interval: TimeInterval,
+    now: @escaping () -> TimeInterval = { Date().timeIntervalSinceReferenceDate },
+    sleep: @escaping (TimeInterval) async throws -> Void = {
+      try await Task.sleep(for: .seconds($0))
+    }
+  ) {
+    self.interval = interval
+    self.now = now
+    self.sleep = sleep
+  }
+
+  func update(_ value: Value, isTransient: Bool) {
+    if displayed == nil {
+      pending = (value, isTransient)
+      displayPending()
+      return
+    }
+    if displayed == value {
+      pending = nil
+      pendingTask?.cancel()
+      return
+    }
+    // 重复 payload 不重排：沿用原定时刻，避免连续重发把瞬态无限推后。
+    if pending?.value == value, pending?.isTransient == isTransient { return }
+    pending = (value, isTransient)
+    pendingTask?.cancel()
+    let arrival = now()
+    // 无保持窗口时用负无穷做中性值：稳定值的最早上屏时刻就是到达时刻，
+    // 立即同步上屏（不能用正的极小值——虚拟时钟 0 会被顶成 epsilon 延迟）。
+    let earliest = max(
+      isTransient ? arrival + interval : arrival,
+      holdUntil ?? -.greatestFiniteMagnitude)
+    let delay = max(0, earliest - arrival)
+    if delay <= 0 {
+      displayPending()
+      return
+    }
+    scheduleGeneration += 1
+    let generation = scheduleGeneration
+    pendingTask = Task { [weak self] in
+      await self?.displayPendingIfCurrent(generation, after: delay)
+    }
+  }
+
+  private func displayPendingIfCurrent(_ generation: Int, after delay: TimeInterval) async {
+    guard generation == scheduleGeneration else { return }
+    try? await sleep(delay)
+    guard generation == scheduleGeneration else { return }
+    displayPending()
+  }
+
+  private func displayPending() {
+    guard let current = pending else { return }
+    displayed = current.value
+    holdUntil = current.isTransient ? now() + interval : nil
+    pending = nil
+    pendingTask = nil
+    display?(current.value)
+  }
+}
diff --git a/ShadowsocksX-NG2/App/UI/Workspace/WorkspaceRoute.swift b/ShadowsocksX-NG2/App/UI/Workspace/WorkspaceRoute.swift
new file mode 100644
index 000000000..ac64b0a7e
--- /dev/null
+++ b/ShadowsocksX-NG2/App/UI/Workspace/WorkspaceRoute.swift
@@ -0,0 +1,41 @@
+import Combine
+
+/// 单一主 workspace 的有限 destination 词汇。它只描述导航位置，不携带功能区
+/// 的选择、sheet、alert 或编辑草稿。
+enum WorkspaceDestination: String, CaseIterable, Hashable, Identifiable, Sendable {
+  case home
+  case servers
+  case rules
+  case settings
+
+  var id: Self { self }
+}
+
+/// workspace route module：集中 destination 与 workspace 内部导航。路由状态
+/// 只存在于进程内，新实例始终从 home 开始。主窗口的呈现：启动由 Window
+/// scene 的 defaultLaunchBehavior(.presented) 自动呈现，关窗后由状态菜单经
+/// SwiftUI `openWindow` 重开（scene id 单点定义见 workspaceSceneID）；本
+/// module 不依赖任何 UI framework，也不持有开窗 effect。
+@MainActor
+final class WorkspaceRoute: ObservableObject {
+  /// 主 workspace 的 SwiftUI `Window` scene id：scene 在组合根（MainApp）
+  /// 以此常量声明，状态菜单是关窗后的重开入口。字面量单点定义在此，防
+  /// scene id 散落（架构测试锚定）。
+  static let workspaceSceneID = "workspace"
+
+  /// 实例初始 destination。MainWindowView 标签页 @State 选中项的初值须与此
+  /// 对齐，否则首帧选中标签不一致。
+  static let initialDestination: WorkspaceDestination = .home
+
+  @Published private(set) var destination: WorkspaceDestination = initialDestination
+
+  /// workspace 内部导航只改变 route destination；开窗不由 route 驱动。
+  /// 同值导航必须是无操作：外部导航经 onChange 回填标签选中项后会再触发
+  /// 一次 selection onChange（导航回声），由同值短路变成无操作；publish
+  /// 一旦发生在视图更新期间（系统控件的选择同步回写）
+  /// 会触发 "Publishing changes from within view updates" 运行时警告。
+  func navigate(to destination: WorkspaceDestination) {
+    guard destination != self.destination else { return }
+    self.destination = destination
+  }
+}
diff --git a/ShadowsocksX-NG2/Configs/Signing-Debug.xcconfig b/ShadowsocksX-NG2/Configs/Signing-Debug.xcconfig
new file mode 100644
index 000000000..2de281c7e
--- /dev/null
+++ b/ShadowsocksX-NG2/Configs/Signing-Debug.xcconfig
@@ -0,0 +1,17 @@
+// Debug 签名基线：无证书即可构建（贡献者与 CI）。
+//
+// 基线是 ad-hoc（`-`）。arm64 上代码至少要有一层有效签名才会被加载，所以「免证书」
+// 不能靠不签名，只能靠 ad-hoc。ad-hoc 产物可以构建、可以跑 app、可以跑全部单测，
+// 但过不了 Scripts/packaging-gate.sh —— 那是有证书的发布门槛。
+//
+// 有证书的人（含维护者）在 Configs/Signing.local.xcconfig 里显式升级，例如：
+//
+//     DEVELOPMENT_TEAM = <10 位 Apple Developer Team ID>
+//     CODE_SIGN_IDENTITY = Developer ID Application
+//
+// 该本机文件在 .gitignore 中，不入库；CI 不需要它。
+//
+// `#include?` 必须留在最后一行：xcconfig 中后出现的赋值优先，本机文件才能盖掉
+// 上面的 ad-hoc 基线。
+CODE_SIGN_IDENTITY = -
+#include? "Signing.local.xcconfig"
diff --git a/ShadowsocksX-NG2/Configs/Signing-Release.xcconfig b/ShadowsocksX-NG2/Configs/Signing-Release.xcconfig
new file mode 100644
index 000000000..66485555f
--- /dev/null
+++ b/ShadowsocksX-NG2/Configs/Signing-Release.xcconfig
@@ -0,0 +1,14 @@
+// Release 签名基线：发布产物必须是 Developer ID 真签名（Hardened Runtime、公证与
+// Gatekeeper 的前提），因此这里不给免证书路径。
+//
+// Team 只能来自本机注入的 Configs/Signing.local.xcconfig（gitignore）。缺失时
+// DEVELOPMENT_TEAM 为空，Xcode 以「Signing for ... requires selecting either a
+// development team or a provisioning profile」使构建明确失败，不会静默降级成
+// ad-hoc。
+//
+// `#include?` 放在 Developer ID 之前：本机文件可以补 Team（另一个键），但不能把
+// 发布身份改成 ad-hoc 或开发证书——Release 基线在这里是硬约束，后赋值者胜。
+#include? "Signing.local.xcconfig"
+CODE_SIGN_IDENTITY = Developer ID Application
+// 普通 Release build 也必须为主程序和两个原生工具请求公证所需的安全时间戳。
+OTHER_CODE_SIGN_FLAGS = $(inherited) --timestamp
diff --git a/ShadowsocksX-NG2/Domain/Activation/ActivationFailure.swift b/ShadowsocksX-NG2/Domain/Activation/ActivationFailure.swift
new file mode 100644
index 000000000..b94a58766
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Activation/ActivationFailure.swift
@@ -0,0 +1,28 @@
+/// 激活失败的点名原因：激活被拒与活动目标清除
+/// 停止共用同一套原因：前者状态完全不动，后者清除目标并发出停止意图。
+enum ActivationFailure: Error, Equatable, Sendable {
+  /// Enable was requested without a selected target.
+  case noActiveTarget
+  /// 活动目标已被删除（或从未存在）。
+  case targetNotFound(NodeID)
+  /// 组目标展开后没有可激活的服务器叶子（空组或全部候选无效）。
+  case targetExpandsToNothing(NodeID)
+  /// 展开结果包含无效叶子；携带叶节点与具体原因，激活整体原子拒绝。
+  case invalidLeaf(node: NodeID, reason: LeafInvalidationReason)
+}
+
+/// 服务器叶子无效的具体原因（点名到可行动的事实）。
+enum LeafInvalidationReason: Error, Equatable, Sendable {
+  /// 地址为空或只有空白。
+  case invalidAddress
+  /// 端口不在 1–65535 范围内。
+  case invalidPort(Int)
+  /// 加密方式为空。
+  case missingEncryptionMethod
+  /// 加密方式非空但不在当前 sslocal 能力目录中。
+  case unsupportedEncryptionMethod(String)
+  /// 引用本版本未提供的插件程序；受管插件集合来自供应链清单。
+  case pluginNotProvided(program: String)
+  /// 服务器密码为空。
+  case missingPassword
+}
diff --git a/ShadowsocksX-NG2/Domain/Activation/ActivationStateFileStore.swift b/ShadowsocksX-NG2/Domain/Activation/ActivationStateFileStore.swift
new file mode 100644
index 000000000..f13b93914
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Activation/ActivationStateFileStore.swift
@@ -0,0 +1,62 @@
+import Foundation
+
+/// 活动目标持久化：落盘 `~/Library/Application Support/
+/// ShadowsocksX-NG2/configuration/activation.json`，权限与原子替换基线同 catalog.age。
+/// 只含目标身份，永不落秘密明文。损坏或版本未知按安全侧恢复为「无活动目标」
+/// （代理保持停止，由状态机重校验同步）；文件系统级错误仍抛出。
+struct ActivationStateFileStore {
+  enum PersistenceError: Error, Equatable {
+    /// 读取或写入时的文件系统错误。
+    case ioFailure(detail: String)
+  }
+
+  private static let currentVersion = 1
+  private static let jsonEncoder: JSONEncoder = {
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
+    return encoder
+  }()
+
+  let fileURL: URL
+
+  /// 默认位置：`~/Library/Application Support/ShadowsocksX-NG2/configuration/activation.json`。
+  static func defaultFileURL() -> URL {
+    ApplicationSupportPaths.current.activationStateFileURL
+  }
+
+  /// 文件缺失/损坏/版本未知 → `nil`（安全侧：无活动目标）。
+  func loadActiveTargetID() throws -> NodeID? {
+    guard FileManager.default.fileExists(atPath: fileURL.path) else { return nil }
+    let data: Data
+    do {
+      data = try Data(contentsOf: fileURL)
+    } catch {
+      throw PersistenceError.ioFailure(detail: String(describing: error))
+    }
+    let payload = try? JSONDecoder().decode(ActivationStatePayload.self, from: data)
+    guard let payload, payload.version == Self.currentVersion else { return nil }
+    return payload.activeTargetID
+  }
+
+  /// 整体重写并原子替换；失败时保留原文件。目录权限强制为 0700（含自愈）。
+  func save(activeTargetID: NodeID?) throws {
+    let data: Data
+    do {
+      data = try Self.jsonEncoder.encode(
+        ActivationStatePayload(version: Self.currentVersion, activeTargetID: activeTargetID))
+    } catch {
+      throw PersistenceError.ioFailure(detail: String(describing: error))
+    }
+    do {
+      try AtomicFileWriter.write(data, to: fileURL)
+    } catch {
+      throw PersistenceError.ioFailure(detail: String(describing: error))
+    }
+  }
+}
+
+/// 落盘文档形态：版本号 + 活动目标身份（可为 null）。
+private struct ActivationStatePayload: Codable {
+  var version: Int
+  var activeTargetID: NodeID?
+}
diff --git a/ShadowsocksX-NG2/Domain/Activation/ActivationStateMachine.swift b/ShadowsocksX-NG2/Domain/Activation/ActivationStateMachine.swift
new file mode 100644
index 000000000..e91a188d7
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Activation/ActivationStateMachine.swift
@@ -0,0 +1,190 @@
+/// 状态机产出的效应由运行时接线消费。
+enum ActivationEffect: Equatable, Sendable {
+  /// 原子更新运行时（首次激活、重激活或子树编辑重展开成功）。
+  case deployed(RuntimeConfiguration)
+  /// 清除活动目标并停止代理（点名原因，无静默回退）。
+  case clearedAndStopped(ActivationFailure)
+}
+
+/// 派生运行时文档的监听与行为设置；聚合状态机接口的传参。
+struct RuntimeDocumentOptions: Equatable, Sendable {
+  var listen: ProxyListeningConfiguration
+}
+
+extension ProxyRuntimeSettings {
+  /// 激活派生所用的监听配置。
+  var runtimeDocumentOptions: RuntimeDocumentOptions {
+    RuntimeDocumentOptions(listen: listen)
+  }
+}
+
+/// 激活状态机持久化活动目标（服务器或分组的节点身份）。
+/// 激活是单缝原子操作——成功替换目标并产出派生文档，失败点名原因且状态不动；
+/// 目录提交后立即重展开，目标失效即清除并发出停止意图。运行时文件写入与
+/// 运行时接线消费本层产出，以控制进程启停。
+struct ActivationStateMachine: Equatable, Sendable {
+  /// 当前活动目标；`nil` 即无目标（代理不应运行）。
+  private(set) var activeTargetID: NodeID?
+
+  /// 从持久化恢复（`ActivationStateFileStore`）；恢复后的有效性由下一次
+  /// `catalogDidCommit` 重校验同步（「GUI 下次启动重新校验同步」）。
+  init(activeTargetID: NodeID? = nil) {
+    self.activeTargetID = activeTargetID
+  }
+
+  /// 显式激活。成功：目标替换、返回派生文档；失败：抛点名原因，状态完全不动
+  /// （保留原目标与运行状态，无静默回退）。
+  mutating func activate(
+    _ target: NodeID,
+    in catalog: ConfigurationCatalog,
+    plugins: PluginExecutableResolving,
+    options: RuntimeDocumentOptions
+  ) throws -> RuntimeConfiguration {
+    let outcome = derive(
+      target: target, in: catalog, plugins: plugins, options: options)
+    switch outcome {
+    case .success(let configuration):
+      activeTargetID = target
+      return configuration
+    case .failure(let failure):
+      throw failure
+    }
+  }
+
+  /// 目录已提交变更后的立即重展开。返回 `nil` 表示无事可做（无活动目标）；
+  /// 有效非空 → `.deployed`（原子更新）；目标被删除/变空/无有效叶子 →
+  /// 清除目标并返回 `.clearedAndStopped`（点名原因）。任何目录提交（含与活动
+  /// 目标无关的编辑）都整体重校验重展开：产出对相同输入幂等；运行时接线决定是否
+  /// 跳过相同内容的运行时写入。
+  mutating func catalogDidCommit(
+    _ catalog: ConfigurationCatalog,
+    plugins: PluginExecutableResolving,
+    options: RuntimeDocumentOptions
+  ) -> ActivationEffect? {
+    guard let target = activeTargetID else { return nil }
+    let outcome = derive(
+      target: target, in: catalog, plugins: plugins, options: options)
+    switch outcome {
+    case .success(let configuration):
+      return .deployed(configuration)
+    case .failure(let failure):
+      activeTargetID = nil
+      return .clearedAndStopped(failure)
+    }
+  }
+
+  // MARK: - 展开、校验与派生
+
+  /// 单缝派生：目标存在 → 显式子序深度优先展开全部叶子 → 逐叶进行 app
+  /// 可知的激活预检 → 解析凭据。单个服务器目标遇到阻塞原因时整体拒绝；
+  /// 分组目标则跳过已知无效叶子，至少保留一台服务器才产出运行时文档。
+  private func derive(
+    target: NodeID,
+    in catalog: ConfigurationCatalog,
+    plugins: PluginExecutableResolving,
+    options: RuntimeDocumentOptions
+  ) -> Result<RuntimeConfiguration, ActivationFailure> {
+    guard catalog.contains(target) else { return .failure(.targetNotFound(target)) }
+    let plugins = plugins.catalogSnapshot()
+    let isGroup = isGroupTarget(target, in: catalog)
+    var leaves: [NodeID] = []
+    if isGroup {
+      collectServerLeaves(of: target, in: catalog, into: &leaves)
+    } else {
+      leaves = [target]
+    }
+    guard !leaves.isEmpty else { return .failure(.targetExpandsToNothing(target)) }
+
+    var servers: [SslocalServerDocument] = []
+    var skippedServers: [SkippedServer] = []
+    for leafID in leaves {
+      switch deriveLeaf(leafID, in: catalog, plugins: plugins) {
+      case .server(let server):
+        servers.append(server)
+      case .skippedCandidate(let skipped):
+        // 分组目标跳过已知无效叶子；单服务器目标整体拒绝且状态不动。
+        if isGroup {
+          skippedServers.append(skipped)
+        } else {
+          return .failure(.invalidLeaf(node: skipped.id, reason: skipped.reason))
+        }
+      }
+    }
+    guard !servers.isEmpty else { return .failure(.targetExpandsToNothing(target)) }
+    return .success(
+      RuntimeConfiguration(
+        targetID: target,
+        document: SslocalRuntimeDocument(
+          servers: servers,
+          listen: options.listen),
+        skippedServers: skippedServers))
+  }
+
+  private func isGroupTarget(_ target: NodeID, in catalog: ConfigurationCatalog) -> Bool {
+    guard let entry = catalog.entry(for: target) else { return false }
+    if case .group = entry.kind { return true }
+    return false
+  }
+
+  /// 单叶派生结果。`.skippedCandidate` 携带点名原因，分组语义下可跳过，
+  /// 单服务器目标由调用方转成整体拒绝。预检已消化全部已知阻塞原因，
+  /// 不再有派生期折回。
+  private enum LeafDerivation {
+    case server(SslocalServerDocument)
+    case skippedCandidate(SkippedServer)
+  }
+
+  private func deriveLeaf(
+    _ leafID: NodeID,
+    in catalog: ConfigurationCatalog,
+    plugins: PluginExecutableResolving
+  ) -> LeafDerivation {
+    guard let entry = catalog.entry(for: leafID), case .server(let fields) = entry.kind else {
+      preconditionFailure("展开结果只含服务器叶子")
+    }
+    let preparation = LeafPreparation.prepare(
+      fields, plugins: plugins)
+    if let issue = preparation.issues.first {
+      return .skippedCandidate(SkippedServer(id: leafID, reason: issue))
+    }
+    // 预检通过 ⇒ 密码已解析；插件事实与选项引用同理由预检给出。
+    guard let password = preparation.password else {
+      preconditionFailure("预检通过则密码必已解析")
+    }
+    return .server(
+      SslocalServerDocument(
+        id: leafID.rawValue,
+        server: fields.address.trimmingCharacters(in: .whitespacesAndNewlines),
+        serverPort: fields.port,
+        password: password,
+        method: fields.encryptionMethod.trimmingCharacters(in: .whitespacesAndNewlines),
+        plugin: preparation.plugin?.path,
+        pluginOpts: preparation.pluginOptions,
+        pluginArgs: preparation.plugin?.arguments.isEmpty == true
+          ? nil : preparation.plugin?.arguments,
+        pluginMode: preparation.plugin?.mode == .tcpOnly ? nil : preparation.plugin?.mode))
+  }
+
+  /// 按显式子序深度优先收集全部服务器叶子；有效性在派生阶段统一预检。
+  /// 目录结构不变量（子引用必存在、目标必为分组）由构造校验保证，失约即程序错误。
+  private func collectServerLeaves(
+    of groupID: NodeID,
+    in catalog: ConfigurationCatalog,
+    into leaves: inout [NodeID]
+  ) {
+    guard case .group(let fields) = catalog.entry(for: groupID)?.kind else {
+      preconditionFailure("展开目标已先行校验为分组")
+    }
+    for child in fields.children {
+      guard let entry = catalog.entry(for: child) else {
+        preconditionFailure("目录结构不变量：子引用必存在")
+      }
+      switch entry.kind {
+      case .server:
+        leaves.append(child)
+      case .group:
+        collectServerLeaves(of: child, in: catalog, into: &leaves)
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Activation/EncryptionMethodCatalog.swift b/ShadowsocksX-NG2/Domain/Activation/EncryptionMethodCatalog.swift
new file mode 100644
index 000000000..e39ef19e5
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Activation/EncryptionMethodCatalog.swift
@@ -0,0 +1,19 @@
+import Foundation
+
+/// 加密方式能力目录（与当前随 app 打包的 sslocal 版本保持一致）。
+/// 目录值是本地可验证的能力事实，不代表远端服务器一定可达。
+enum EncryptionMethodCatalog {
+  static let supported: Set<String> = [
+    "aes-128-gcm",
+    "aes-256-gcm",
+    "chacha20-ietf-poly1305",
+    "2022-blake3-aes-128-gcm",
+    "2022-blake3-aes-256-gcm",
+    "2022-blake3-chacha20-poly1305",
+    "none",
+  ]
+
+  static func isSupported(_ method: String) -> Bool {
+    supported.contains(method)
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Activation/LeafPreparation.swift b/ShadowsocksX-NG2/Domain/Activation/LeafPreparation.swift
new file mode 100644
index 000000000..a8d23e7ea
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Activation/LeafPreparation.swift
@@ -0,0 +1,73 @@
+import Foundation
+
+/// 叶子预检：一次完成激活阻塞判定与凭据/插件解析。插件参数保持 opaque，不
+/// 在此判断其语法或远端握手；空 issues 只表示没有已知的本地激活阻塞原因。
+/// 已解析事实供运行时文档装配复用，目录树只取 `invalidReasons`。
+///
+/// 不变量：`issues` 为空 ⇒ `password` 非空；`pluginProgram` 存在且无
+/// `pluginNotProvided` ⇒ `plugin` 非空。
+struct LeafPreparation: Equatable, Sendable {
+  let issues: [LeafInvalidationReason]
+  let password: String?
+  let plugin: ResolvedPlugin?
+  let pluginOptions: String?
+
+  /// 运行时装配入口：一次解析并给出全部阻塞原因与已解析事实。
+  static func prepare(
+    _ fields: ServerFields,
+    plugins: PluginExecutableResolving
+  ) -> LeafPreparation {
+    var issues: [LeafInvalidationReason] = []
+    appendAddressIssue(fields.address, to: &issues)
+    appendPortIssue(fields.port, to: &issues)
+    appendMethodIssue(fields.encryptionMethod, to: &issues)
+
+    let password = fields.password.isEmpty ? nil : fields.password
+    if password == nil { issues.append(.missingPassword) }
+    var plugin: ResolvedPlugin?
+    var pluginOptions: String?
+    if let program = fields.pluginProgram {
+      if let resolved = plugins.resolve(program: program) {
+        plugin = resolved
+      } else {
+        issues.append(.pluginNotProvided(program: program))
+      }
+      pluginOptions = fields.pluginOptions
+    }
+    return LeafPreparation(
+      issues: issues, password: password, plugin: plugin, pluginOptions: pluginOptions)
+  }
+
+  /// validation-only 入口：目录树等只读呈现取全部阻塞原因，不组装运行时文档。
+  static func invalidReasons(
+    _ fields: ServerFields,
+    plugins: PluginExecutableResolving
+  ) -> [LeafInvalidationReason] {
+    prepare(fields, plugins: plugins).issues
+  }
+
+  private static func appendAddressIssue(
+    _ address: String, to issues: inout [LeafInvalidationReason]
+  ) {
+    if address.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
+      issues.append(.invalidAddress)
+    }
+  }
+
+  private static func appendPortIssue(
+    _ port: Int, to issues: inout [LeafInvalidationReason]
+  ) {
+    if !(1...65_535).contains(port) { issues.append(.invalidPort(port)) }
+  }
+
+  private static func appendMethodIssue(
+    _ method: String, to issues: inout [LeafInvalidationReason]
+  ) {
+    let trimmed = method.trimmingCharacters(in: .whitespacesAndNewlines)
+    if trimmed.isEmpty {
+      issues.append(.missingEncryptionMethod)
+    } else if !EncryptionMethodCatalog.isSupported(trimmed) {
+      issues.append(.unsupportedEncryptionMethod(trimmed))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Activation/RuntimeConfiguration.swift b/ShadowsocksX-NG2/Domain/Activation/RuntimeConfiguration.swift
new file mode 100644
index 000000000..5ca3e9b43
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Activation/RuntimeConfiguration.swift
@@ -0,0 +1,23 @@
+/// 组激活时因已知本地阻塞问题被跳过的服务器。
+struct SkippedServer: Equatable, Sendable {
+  let id: NodeID
+  let reason: LeafInvalidationReason
+}
+
+/// 激活产出：活动目标身份 + 完整派生文档。组目标保持组 UUID（GLOSSARY.md
+/// 「Active target」），不被 sslocal 实际选中的后代替换。
+struct RuntimeConfiguration: Equatable, Sendable {
+  let targetID: NodeID
+  let document: SslocalRuntimeDocument
+  let skippedServers: [SkippedServer]
+
+  init(
+    targetID: NodeID,
+    document: SslocalRuntimeDocument,
+    skippedServers: [SkippedServer] = []
+  ) {
+    self.targetID = targetID
+    self.document = document
+    self.skippedServers = skippedServers
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Catalog/CatalogError.swift b/ShadowsocksX-NG2/Domain/Catalog/CatalogError.swift
new file mode 100644
index 000000000..710ab5438
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Catalog/CatalogError.swift
@@ -0,0 +1,30 @@
+/// 目录操作失败原因，逐项对应 GLOSSARY.md 的结构不变量（单父、显子序、
+/// 无环、手动/订阅严格分离）。
+enum CatalogError: Error, Equatable, Sendable {
+  /// 目标节点不存在。
+  case nodeNotFound(NodeID)
+  /// 指定的父容器不存在。
+  case parentNotFound(NodeID)
+  /// 指定的父容器不是分组（例如把服务器叶子当容器）。
+  case parentNotAGroup(NodeID)
+  /// 操作目标不是服务器叶子。
+  case notAServer(NodeID)
+  /// 操作目标不是分组。
+  case notAGroup(NodeID)
+  /// 目标身份已被挂载的节点占用：身份不复用于另一逻辑节点，否则即共享父。
+  case duplicateID(NodeID)
+  /// 手动与订阅来源严格分离：不允许把节点放进另一来源的子树。
+  case crossSourcePlacement(node: NodeSource, container: NodeSource)
+  /// 订阅子树由远端权威所有：本地结构操作（移动/删除/改连接字段/改名）一律拒绝；
+  /// 整棵订阅子树只能通过移除订阅源清理。
+  case subscriptionNodeImmutable(NodeID)
+  /// 订阅服务器叶子必须位于其订阅固定分组内，不得直挂目录根（GLOSSARY.md
+  /// 「Subscription group」：根层只允许订阅固定分组本身）。
+  case subscriptionServerAtRoot(NodeID)
+  /// 把分组移动进它自己的子树会成环。
+  case cycleDetected(NodeID)
+  /// 插入位置超出目标容器允许范围（0…=子节点数；以摘除移动节点后的子序计）。
+  case indexOutOfRange(parent: NodeID?, index: Int?, childCount: Int)
+  /// 外部载荷（持久化文件）结构不一致：悬空子引用、共享父、成环或不可达节点。
+  case invalidStructure(String)
+}
diff --git a/ShadowsocksX-NG2/Domain/Catalog/CatalogFileStore.swift b/ShadowsocksX-NG2/Domain/Catalog/CatalogFileStore.swift
new file mode 100644
index 000000000..d8acf04b5
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Catalog/CatalogFileStore.swift
@@ -0,0 +1,131 @@
+import Foundation
+
+/// 服务器库文件存储；生产和测试均通过整体加密存储写盘。
+struct CatalogFileStore {
+  enum PersistenceError: Error, Equatable {
+    /// 文件存在但不是本模型可接受的目录文档：JSON 损坏、版本未知、结构不一致。
+    case corrupt(detail: String)
+    /// 读取或写入时的文件系统错误。
+    case ioFailure(detail: String)
+  }
+
+  private static let currentVersion = 7
+  private static let jsonEncoder: JSONEncoder = {
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
+    return encoder
+  }()
+
+  let fileURL: URL
+  private let library: ServerLibraryStorage
+
+  init(fileURL: URL, library: ServerLibraryStorage = ServerLibraryStorage()) {
+    self.fileURL = fileURL
+    self.library = library
+  }
+
+  func reset() throws -> CatalogDocument {
+    try library.reset(at: fileURL)
+  }
+
+  /// 默认密文位置：`~/Library/Application Support/ShadowsocksX-NG2/configuration/catalog.age`。
+  static func defaultFileURL() -> URL {
+    ApplicationSupportPaths.current.catalogFileURL
+  }
+
+  /// 文件缺失 → 全新空文档；存在但损坏/版本未知/结构不一致 → `.corrupt`。
+  func load() throws -> CatalogDocument {
+    try load(allowingInteraction: false)
+  }
+
+  func load(allowingInteraction: Bool) throws -> CatalogDocument {
+    try library.load(at: fileURL, allowingInteraction: allowingInteraction)
+  }
+
+  /// 整体加密后原子替换，失败时保留原文件。
+  func save(_ document: CatalogDocument) throws {
+    try library.save(document, at: fileURL)
+  }
+
+  static func encode(_ document: CatalogDocument) throws -> Data {
+    try Self.validateFavorites(document.favoriteIDs, in: document.catalog)
+    let payload = CatalogFilePayload(
+      version: Self.currentVersion,
+      rootChildren: document.catalog.rootChildren,
+      entries: document.catalog.entries.values.sorted { $0.id.rawValue < $1.id.rawValue },
+      subscriptions: document.subscriptions, favoriteIDs: document.favoriteIDs)
+    let data: Data
+    do {
+      data = try Self.jsonEncoder.encode(payload)
+    } catch {
+      throw PersistenceError.ioFailure(detail: String(describing: error))
+    }
+    return data
+  }
+
+  static func decode(_ data: Data) throws -> CatalogDocument {
+    let payload: CatalogFilePayload
+    do {
+      payload = try JSONDecoder().decode(CatalogFilePayload.self, from: data)
+    } catch {
+      throw PersistenceError.corrupt(detail: String(describing: error))
+    }
+    guard payload.version == Self.currentVersion else {
+      throw PersistenceError.corrupt(detail: "unsupported version \(payload.version)")
+    }
+    var entries: [NodeID: CatalogEntry] = [:]
+    for entry in payload.entries {
+      guard entries[entry.id] == nil else {
+        throw PersistenceError.corrupt(detail: "duplicate node id \(entry.id.rawValue)")
+      }
+      entries[entry.id] = entry
+    }
+    let catalog: ConfigurationCatalog
+    do {
+      catalog = try ConfigurationCatalog.validated(
+        rootChildren: payload.rootChildren, entries: entries)
+    } catch let error as CatalogError {
+      throw PersistenceError.corrupt(detail: String(describing: error))
+    }
+    let subscriptions = payload.subscriptions
+    var seen = Set<NodeID>()
+    for record in subscriptions {
+      guard seen.insert(record.id).inserted else {
+        throw PersistenceError.corrupt(detail: "duplicate subscription \(record.id.rawValue)")
+      }
+    }
+    // 订阅固定分组必须存在于目录且来源正确；缺失即文档不一致。
+    for record in subscriptions {
+      guard
+        let entry = catalog.entry(for: record.groupID), case .group = entry.kind,
+        entry.source == .subscription
+      else {
+        throw PersistenceError.corrupt(
+          detail: "subscription group missing \(record.groupID.rawValue)")
+      }
+    }
+    let favoriteIDs = payload.favoriteIDs
+    try validateFavorites(favoriteIDs, in: catalog)
+    return CatalogDocument(
+      catalog: catalog, subscriptions: subscriptions, favoriteIDs: favoriteIDs)
+  }
+
+  private static func validateFavorites(_ ids: [NodeID], in catalog: ConfigurationCatalog) throws {
+    var seen = Set<NodeID>()
+    for id in ids {
+      guard seen.insert(id).inserted, catalog.entry(for: id) != nil else {
+        throw PersistenceError.corrupt(detail: "duplicate or missing favorite node \(id.rawValue)")
+      }
+    }
+  }
+
+}
+
+/// 当前服务器库明文载荷；只能在内存中编解码，由整体加密存储写盘。
+private struct CatalogFilePayload: Codable {
+  var version: Int
+  var rootChildren: [NodeID]
+  var entries: [CatalogEntry]
+  var subscriptions: [SubscriptionRecord]
+  var favoriteIDs: [NodeID]
+}
diff --git a/ShadowsocksX-NG2/Domain/Catalog/CatalogModels.swift b/ShadowsocksX-NG2/Domain/Catalog/CatalogModels.swift
new file mode 100644
index 000000000..0ac8d4e23
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Catalog/CatalogModels.swift
@@ -0,0 +1,84 @@
+import Foundation
+
+/// 服务器叶子字段。密码与插件参数由记录持有，随服务器库整体加密；
+/// 插件程序引用原样保留，是否可用由激活校验判定。
+struct ServerFields: Codable, Equatable, Sendable {
+  var address: String
+  var port: Int
+  var encryptionMethod: String
+  var password: String
+  var remark: String
+  var pluginProgram: String?
+  var pluginOptions: String?
+
+  init(
+    address: String,
+    port: Int,
+    encryptionMethod: String,
+    password: String,
+    remark: String = "",
+    pluginProgram: String? = nil,
+    pluginOptions: String? = nil
+  ) {
+    self.address = address
+    self.port = port
+    self.encryptionMethod = encryptionMethod
+    self.password = password
+    self.remark = Self.name(remark, address: address, port: port)
+    self.pluginProgram = pluginProgram
+    self.pluginOptions = pluginOptions
+  }
+
+  /// 导入与字段构造共用名称规则；非空名称原样保留，缺名时生成并保存端点名。
+  /// 后续修改地址或端口不改变已经保存的名称。`remark` 保留既有存储字段名。
+  private static func name(_ supplied: String, address: String, port: Int) -> String {
+    guard supplied.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
+      return supplied
+    }
+    let host =
+      address.hasPrefix("[") && address.hasSuffix("]")
+      ? String(address.dropFirst().dropLast()) : address
+    return host.contains(":") ? "[\(host)]:\(port)" : "\(host):\(port)"
+  }
+}
+
+/// 分组：命名的有序容器，显式持有子节点顺序（GLOSSARY.md「Configuration group」）。
+struct GroupFields: Codable, Equatable, Sendable {
+  var name: String
+  var children: [NodeID]
+
+  init(name: String, children: [NodeID] = []) {
+    self.name = name
+    self.children = children
+  }
+}
+
+/// 目录树节点：公共字段（身份、来源、节点时间戳）+ 服务器叶子/分组形态。
+struct CatalogEntry: Codable, Equatable, Sendable {
+  enum Kind: Codable, Equatable, Sendable {
+    case server(ServerFields)
+    case group(GroupFields)
+  }
+
+  let id: NodeID
+  var source: NodeSource
+  var kind: Kind
+  /// 节点进入目录的时刻；历史文档未记录时为 nil（未知，不回填，ADR-0031）。
+  let createdAt: Date?
+  /// 节点自身资料、或分组的直接子节点集合与顺序最后一次变化的时刻；未知为 nil。
+  var updatedAt: Date?
+
+}
+
+extension CatalogEntry {
+  /// 行显示名（主窗口侧栏与菜单栏级联共用口径）：服务器使用已保存的名称，
+  /// 导入缺名已在字段构造时补全；分组用名称。
+  var displayName: String {
+    switch kind {
+    case .group(let fields):
+      return fields.name
+    case .server(let fields):
+      return fields.remark
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Catalog/ConfigurationCatalog.swift b/ShadowsocksX-NG2/Domain/Catalog/ConfigurationCatalog.swift
new file mode 100644
index 000000000..c799063c8
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Catalog/ConfigurationCatalog.swift
@@ -0,0 +1,395 @@
+import Foundation
+
+/// 配置目录：不可见的配置树根（GLOSSARY.md「Configuration catalog」）。有序顶层
+/// 子节点为服务器配置或配置组。存储形态：全量节点表 + 根序 + 各分组显子序；
+/// 单父由「一个身份只出现在一条子序里」构造保证，无环与来源分离由操作校验。
+///
+/// 插入位置的统一语义：`index` 以摘除移动节点后的目标子序为准（重排同父节点时
+/// 即「先取出再插入」的直觉顺序），`nil` 表示追加到末尾；失败的操作不产生任何变更。
+struct ConfigurationCatalog: Equatable, Sendable {
+  private(set) var rootChildren: [NodeID] = []
+  private(set) var entries: [NodeID: CatalogEntry] = [:]
+
+  init() {}
+
+  /// 从持久化载荷重建目录（private；外部入口走 `validated(rootChildren:entries:)`）。
+  private init(rootChildren: [NodeID], entries: [NodeID: CatalogEntry]) {
+    self.rootChildren = rootChildren
+    self.entries = entries
+  }
+
+  /// 外部载荷（持久化文件）的唯一重建入口：结构不一致（悬空子引用、共享父、
+  /// 成环、不可达节点）即抛 `invalidStructure`。从根出发的一次遍历同时覆盖
+  /// 全部四类检查——重复到达即共享父或成环，未到达即不可达或根外孤环。
+  static func validated(
+    rootChildren: [NodeID],
+    entries: [NodeID: CatalogEntry]
+  ) throws -> ConfigurationCatalog {
+    var visited = Set<NodeID>()
+    var pending = rootChildren
+    while let current = pending.popLast() {
+      guard visited.insert(current).inserted else {
+        throw CatalogError.invalidStructure(
+          "node \(current.rawValue) reached twice (shared parent or cycle)")
+      }
+      guard let entry = entries[current] else {
+        throw CatalogError.invalidStructure("dangling child \(current.rawValue)")
+      }
+      if case .group(let fields) = entry.kind { pending.append(contentsOf: fields.children) }
+    }
+    guard visited.count == entries.count else {
+      throw CatalogError.invalidStructure("unreachable or disconnected-cycle nodes present")
+    }
+    return ConfigurationCatalog(rootChildren: rootChildren, entries: entries)
+  }
+}
+
+// MARK: - 查询
+
+extension ConfigurationCatalog {
+  var isEmpty: Bool { entries.isEmpty }
+
+  func contains(_ id: NodeID) -> Bool { entries[id] != nil }
+
+  func entry(for id: NodeID) -> CatalogEntry? { entries[id] }
+
+  /// 子节点序；`nil` 表示目录根。
+  func children(of parent: NodeID?) throws -> [NodeID] {
+    guard let parent else { return rootChildren }
+    guard let entry = entries[parent] else { throw CatalogError.parentNotFound(parent) }
+    guard case .group(let fields) = entry.kind else { throw CatalogError.parentNotAGroup(parent) }
+    return fields.children
+  }
+
+  /// 直接父节点；根层节点返回 `nil`。节点必须存在，否则抛错。
+  func parentID(of id: NodeID) throws -> NodeID? {
+    guard entries[id] != nil else { throw CatalogError.nodeNotFound(id) }
+    return parentIndex()[id]
+  }
+
+  /// 从父到根的祖先链（不含自身）。根层节点返回空。
+  func ancestors(of id: NodeID) -> [NodeID] {
+    let parents = parentIndex()
+    var chain: [NodeID] = []
+    var current = parents[id]
+    while let parent = current {
+      chain.append(parent)
+      current = parents[parent]
+    }
+    return chain
+  }
+
+  /// 全量父索引（根层节点不在其中）。
+  func parentIndex() -> [NodeID: NodeID] {
+    var parents: [NodeID: NodeID] = [:]
+    for entry in entries.values {
+      guard case .group(let fields) = entry.kind else { continue }
+      for child in fields.children { parents[child] = entry.id }
+    }
+    return parents
+  }
+
+}
+
+// MARK: - 变更
+
+extension ConfigurationCatalog {
+  /// 新建节点：创建时间与修改时间都是写入时刻（ADR-0031）；落点分组的
+  /// 直接子节点集合变化，按结构敏感语义更新该分组的修改时间。
+  @discardableResult
+  mutating func addServer(
+    _ fields: ServerFields,
+    source: NodeSource = .manual,
+    id proposedID: NodeID? = nil,
+    to parent: NodeID? = nil,
+    index: Int? = nil,
+    now: Date = Date()
+  ) throws -> NodeID {
+    let id = proposedID ?? .fresh()
+    guard entries[id] == nil else { throw CatalogError.duplicateID(id) }
+    if source == .subscription && parent == nil {
+      throw CatalogError.subscriptionServerAtRoot(id)
+    }
+    try place(id, source: source, parent: parent, index: index, excluding: nil)
+    entries[id] = CatalogEntry(
+      id: id, source: source, kind: .server(fields), createdAt: now, updatedAt: now)
+    touchParent(of: id, at: now)
+    return id
+  }
+
+  @discardableResult
+  mutating func addGroup(
+    _ name: String,
+    source: NodeSource = .manual,
+    id proposedID: NodeID? = nil,
+    to parent: NodeID? = nil,
+    index: Int? = nil,
+    now: Date = Date()
+  ) throws -> NodeID {
+    let id = proposedID ?? .fresh()
+    guard entries[id] == nil else { throw CatalogError.duplicateID(id) }
+    try place(id, source: source, parent: parent, index: index, excluding: nil)
+    entries[id] = CatalogEntry(
+      id: id, source: source, kind: .group(GroupFields(name: name)),
+      createdAt: now, updatedAt: now)
+    touchParent(of: id, at: now)
+    return id
+  }
+
+  /// 重命名分组：内容未变（同名）不更新修改时间。
+  mutating func renameGroup(_ id: NodeID, to name: String, now: Date = Date()) throws {
+    guard var entry = entries[id] else { throw CatalogError.nodeNotFound(id) }
+    guard entry.source == .manual else { throw CatalogError.subscriptionNodeImmutable(id) }
+    guard case .group(var fields) = entry.kind else { throw CatalogError.notAGroup(id) }
+    guard fields.name != name else { return }
+    fields.name = name
+    entry.kind = .group(fields)
+    entry.updatedAt = now
+    entries[id] = entry
+  }
+
+  /// 更新服务器连接字段：内容未变不更新修改时间。
+  mutating func updateServer(_ id: NodeID, with fields: ServerFields, now: Date = Date()) throws {
+    guard var entry = entries[id] else { throw CatalogError.nodeNotFound(id) }
+    guard entry.source == .manual else { throw CatalogError.subscriptionNodeImmutable(id) }
+    guard case .server = entry.kind else { throw CatalogError.notAServer(id) }
+    let kind = CatalogEntry.Kind.server(fields)
+    guard entry.kind != kind else { return }
+    entry.kind = kind
+    entry.updatedAt = now
+    entries[id] = entry
+  }
+
+  /// 移动节点（携带整棵子树）：目录根与手动组之间、手动组相互之间。
+  /// 同父移动即重排。跨来源、共享父、成环一律拒绝。被移动节点自身内容不变、
+  /// 修改时间不动；新旧落点分组的子节点集合/顺序变化，按结构敏感语义更新
+  /// （根层无分组，静默）。
+  mutating func move(_ id: NodeID, to parent: NodeID?, index: Int? = nil, now: Date = Date())
+    throws
+  {
+    guard let entry = entries[id] else { throw CatalogError.nodeNotFound(id) }
+    guard entry.source == .manual else { throw CatalogError.subscriptionNodeImmutable(id) }
+    if let parent, parent == id || ancestors(of: parent).contains(id) {
+      throw CatalogError.cycleDetected(id)
+    }
+    let oldParent = parentIndex()[id]
+    try place(id, source: entry.source, parent: parent, index: index, excluding: id)
+    if oldParent != parent { touch(oldParent, at: now) }
+    touch(parent, at: now)
+  }
+
+  /// 删除节点；手动分组递归删除整棵子树。返回被删除的完整记录。空组允许显式删除；空组本身持久保留。
+  /// 原落点分组失去子节点，按结构敏感语义更新其修改时间。
+  @discardableResult
+  mutating func remove(_ id: NodeID, now: Date = Date()) throws -> [CatalogEntry] {
+    guard let root = entries[id] else { throw CatalogError.nodeNotFound(id) }
+    guard root.source == .manual else { throw CatalogError.subscriptionNodeImmutable(id) }
+
+    var removed: [CatalogEntry] = []
+    var pending = [id]
+    while let current = pending.popLast() {
+      guard let entry = entries[current] else { continue }
+      if case .group(let fields) = entry.kind { pending.append(contentsOf: fields.children) }
+      removed.append(entry)
+      entries[current] = nil
+    }
+    let oldParent = parentIndex()[id]
+    removeFromSiblings(id)
+    touch(oldParent, at: now)
+    return removed
+  }
+
+  /// 校验目标容器（存在、是分组、来源一致）与插入位置，返回放入 id 后的完整子序。
+  /// 全部校验先于任何变更，失败抛错时状态不动。`excluding` 为移动语义下先摘除的节点自身。
+  private mutating func place(
+    _ id: NodeID,
+    source: NodeSource,
+    parent: NodeID?,
+    index: Int?,
+    excluding excludeID: NodeID?
+  ) throws {
+    let siblings: [NodeID]
+    if let parent {
+      guard let container = entries[parent] else { throw CatalogError.parentNotFound(parent) }
+      guard case .group(let fields) = container.kind else {
+        throw CatalogError.parentNotAGroup(parent)
+      }
+      guard container.source == source else {
+        throw CatalogError.crossSourcePlacement(node: source, container: container.source)
+      }
+      siblings = fields.children
+    } else {
+      siblings = rootChildren
+    }
+    var children = siblings
+    if let excludeID { children.removeAll { $0 == excludeID } }
+    let position = index ?? children.count
+    guard (0...children.count).contains(position) else {
+      throw CatalogError.indexOutOfRange(parent: parent, index: index, childCount: children.count)
+    }
+    children.insert(id, at: position)
+
+    removeFromSiblings(id)
+    if let parent {
+      setChildren(children, of: parent)
+    } else {
+      rootChildren = children
+    }
+  }
+
+  /// 把节点从其现所在子序（父分组或根）摘除；根层节点静默摘除。
+  private mutating func removeFromSiblings(_ id: NodeID) {
+    if let oldParent = parentIndex()[id] {
+      guard case .group(let fields) = entries[oldParent]?.kind else {
+        preconditionFailure("父索引与节点表不一致")
+      }
+      setChildren(fields.children.filter { $0 != id }, of: oldParent)
+    } else {
+      rootChildren.removeAll { $0 == id }
+    }
+  }
+
+  private mutating func setChildren(_ children: [NodeID], of parent: NodeID) {
+    precondition(entries[parent] != nil, "父容器已先行校验存在")
+    guard case .group(var fields) = entries[parent]?.kind else {
+      preconditionFailure("父容器已先行校验为分组")
+    }
+    fields.children = children
+    entries[parent]?.kind = .group(fields)
+  }
+}
+
+// MARK: - 订阅子树（快照原子提交与递归清除）
+
+extension ConfigurationCatalog {
+  /// 订阅固定分组子树的全量条目（含固定分组自身）；不存在或不是分组即抛错。
+  func subscriptionSubtree(of groupID: NodeID) throws -> [CatalogEntry] {
+    guard let entry = entries[groupID], case .group = entry.kind else {
+      throw CatalogError.notAGroup(groupID)
+    }
+    var collected: [CatalogEntry] = []
+    var pending = [groupID]
+    while let current = pending.popLast() {
+      guard let currentEntry = entries[current] else { continue }
+      if case .group(let fields) = currentEntry.kind {
+        pending.append(contentsOf: fields.children)
+      }
+      collected.append(currentEntry)
+    }
+    return collected
+  }
+
+  /// 订阅快照原子应用（GLOSSARY.md 刷新契约）：以快照整体重建固定分组子树；
+  /// 名称、结构、顺序和连接字段全部跟随远端（扩展缺失时由调用方给 URL host
+  /// 兜底）。返回被移除的旧服务器叶子（供调用方清理凭据）。延续节点按内容
+  /// 比较决定时间戳：内容未变保留双时间戳，变化保留创建时间、更新修改时间；
+  /// 新节点两个时间戳都是写入时刻（ADR-0031）。
+  @discardableResult
+  mutating func applySubscriptionSnapshot(
+    _ snapshot: CatalogSubscriptionSnapshot, into groupID: NodeID, now: Date = Date()
+  ) throws -> [CatalogEntry] {
+    guard let fixed = entries[groupID], case .group = fixed.kind else {
+      throw CatalogError.notAGroup(groupID)
+    }
+    guard fixed.source == .subscription else {
+      throw CatalogError.crossSourcePlacement(node: .subscription, container: fixed.source)
+    }
+
+    // 先整树摘除旧成员（固定分组本身保留），收集被移除的服务器；旧时间戳
+    // 以条目载荷整体留底，重建时逐节点比较。
+    var removedServers: [CatalogEntry] = []
+    let oldSubtree = try subscriptionSubtree(of: groupID)
+    let previous = Dictionary(uniqueKeysWithValues: oldSubtree.map { ($0.id, $0) })
+    for entry in oldSubtree {
+      if case .server = entry.kind { removedServers.append(entry) }
+    }
+    for entry in oldSubtree where entry.id != groupID {
+      entries[entry.id] = nil
+    }
+    setChildren([], of: groupID)
+
+    // 远端权威重建：名称、结构、顺序、字段全按快照。
+    var fixedFields = GroupFields(name: snapshot.name, children: [])
+    try insertSnapshotChildren(of: snapshot.root, into: &fixedFields, previous: previous, now: now)
+    entries[groupID] = Self.stampedEntry(
+      id: groupID, source: .subscription, kind: .group(fixedFields),
+      previous: previous, now: now)
+    return removedServers
+  }
+
+  /// 递归挂载快照分组：嵌套分组与服务器叶子以快照身份按序重建，并产出父
+  /// 分组的显子序。身份已由解析器按订阅作用域限定，与既有节点冲突即程序错误。
+  private mutating func insertSnapshotChildren(
+    of group: CatalogSubscriptionSnapshot.Group,
+    into fields: inout GroupFields,
+    previous: [NodeID: CatalogEntry],
+    now: Date
+  ) throws {
+    var childIDs: [NodeID] = []
+    for child in group.children {
+      switch child {
+      case .server(let leaf):
+        guard entries[leaf.id] == nil else { throw CatalogError.duplicateID(leaf.id) }
+        entries[leaf.id] = Self.stampedEntry(
+          id: leaf.id, source: .subscription, kind: .server(leaf.fields),
+          previous: previous, now: now)
+        childIDs.append(leaf.id)
+      case .group(let nested):
+        guard entries[nested.id] == nil else { throw CatalogError.duplicateID(nested.id) }
+        var nestedFields = GroupFields(name: nested.name, children: [])
+        try insertSnapshotChildren(
+          of: nested, into: &nestedFields, previous: previous, now: now)
+        entries[nested.id] = Self.stampedEntry(
+          id: nested.id, source: .subscription, kind: .group(nestedFields),
+          previous: previous, now: now)
+        childIDs.append(nested.id)
+      }
+    }
+    fields.children = childIDs
+  }
+
+  /// 删除订阅：固定分组整棵子树连同固定分组本身一并移除（递归清除，不留
+  /// 墓碑）。返回被删完整记录。
+  /// 固定分组的原落点（目录根）无分组形态，无修改时间可更新。
+  @discardableResult
+  mutating func removeSubscriptionSubtree(of groupID: NodeID) throws -> [CatalogEntry] {
+    let subtree = try subscriptionSubtree(of: groupID)
+    for entry in subtree {
+      entries[entry.id] = nil
+    }
+    removeFromSiblings(groupID)
+    return subtree
+  }
+
+  /// 按内容比较决定时间戳的条目构造（ADR-0031）：延续节点内容未变保留双
+  /// 时间戳，变化保留创建时间、更新修改时间；新节点双时间戳为写入时刻。
+  private static func stampedEntry(
+    id: NodeID,
+    source: NodeSource,
+    kind: CatalogEntry.Kind,
+    previous: [NodeID: CatalogEntry],
+    now: Date
+  ) -> CatalogEntry {
+    guard let old = previous[id] else {
+      return CatalogEntry(id: id, source: source, kind: kind, createdAt: now, updatedAt: now)
+    }
+    let updatedAt = old.kind == kind ? old.updatedAt : now
+    return CatalogEntry(
+      id: id, source: source, kind: kind, createdAt: old.createdAt, updatedAt: updatedAt)
+  }
+}
+
+// MARK: - 节点时间戳（ADR-0031）
+
+extension ConfigurationCatalog {
+  /// 更新节点修改时间；节点不存在或根层（nil）静默无操作。
+  private mutating func touch(_ id: NodeID?, at now: Date) {
+    guard let id, entries[id] != nil else { return }
+    entries[id]?.updatedAt = now
+  }
+
+  /// 子节点集合或顺序变化后更新其所在分组（类目录修改时间语义）；根层无分组。
+  private mutating func touchParent(of child: NodeID, at now: Date) {
+    touch(parentIndex()[child], at: now)
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Catalog/NodeIdentity.swift b/ShadowsocksX-NG2/Domain/Catalog/NodeIdentity.swift
new file mode 100644
index 000000000..23efcc00a
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Catalog/NodeIdentity.swift
@@ -0,0 +1,28 @@
+import Foundation
+
+/// 节点来源：手动子树与订阅子树严格分离（GLOSSARY.md「Relationships and invariants」）。
+enum NodeSource: String, Codable, Equatable, Sendable {
+  case manual
+  case subscription
+}
+
+/// 节点持久身份：不透明字符串。手动节点每次新建生成全新 UUID，身份不随
+/// 显示名、位置或父节点变化，也不复用于其他逻辑节点；订阅节点使用供应商
+/// 稳定 ID（作用域限本订阅，由订阅数据保证唯一），此处仅供夹具使用。
+struct NodeID: Hashable, Codable, Sendable {
+  let rawValue: String
+
+  init(rawValue: String) { self.rawValue = rawValue }
+
+  /// 手动新建节点身份。
+  static func fresh() -> NodeID { NodeID(rawValue: UUID().uuidString.lowercased()) }
+
+  init(from decoder: Decoder) throws {
+    rawValue = try decoder.singleValueContainer().decode(String.self)
+  }
+
+  func encode(to encoder: Encoder) throws {
+    var container = encoder.singleValueContainer()
+    try container.encode(rawValue)
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Catalog/ServerLibraryStorage.swift b/ShadowsocksX-NG2/Domain/Catalog/ServerLibraryStorage.swift
new file mode 100644
index 000000000..44e0ba1f5
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Catalog/ServerLibraryStorage.swift
@@ -0,0 +1,27 @@
+import Foundation
+
+typealias ServerLibraryError = EncryptedFileError
+
+/// 服务器库专用载荷与密钥空间；使用标准 age 文件。
+final class ServerLibraryStorage {
+  private let encrypted: EncryptedFileStorage<CatalogDocument>
+
+  init(keys: CredentialKeyStoring = KeychainCredentialKeyStore(namespace: "server-library.age")) {
+    encrypted = EncryptedFileStorage(
+      keys: keys, maximumSize: 64 * 1024 * 1024,
+      legacyFileNames: ["catalog.enc", "catalog.json"], makeDefault: { CatalogDocument() },
+      encode: CatalogFileStore.encode, decode: CatalogFileStore.decode)
+  }
+
+  func load(at url: URL, allowingInteraction: Bool) throws -> CatalogDocument {
+    try encrypted.load(at: url, allowingInteraction: allowingInteraction)
+  }
+
+  func save(_ document: CatalogDocument, at url: URL) throws {
+    try encrypted.save(document, at: url)
+  }
+
+  func reset(at url: URL) throws -> CatalogDocument {
+    try encrypted.reset(at: url)
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Catalog/SsUri.swift b/ShadowsocksX-NG2/Domain/Catalog/SsUri.swift
new file mode 100644
index 000000000..a76f912cd
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Catalog/SsUri.swift
@@ -0,0 +1,279 @@
+import Foundation
+
+/// SIP002 `ss://` URI 模型（https://shadowsocks.org/doc/sip002.html）。
+/// 插件字段持 SIP003 `SS_PLUGIN_OPTIONS` 形态的原样字符串（如
+/// `mode=websocket;host=example.com`）：URI 编解码只做 RFC 3986 百分号编码层，
+/// 反斜杠转义按原样透传（插件自解），往返保持 `plugin=name;opts` 逐字节同构。
+struct SsUri: Equatable, Sendable {
+  var method: String
+  var password: String
+  var host: String
+  var port: Int
+  /// 插件程序名；无插件为 `nil`。
+  var pluginProgram: String?
+  /// 插件参数（SS_PLUGIN_OPTIONS 原样形态）；无插件或仅有程序名为 `nil`。
+  var pluginOptions: String?
+  /// 备注（URI fragment）；缺失或空为 `nil`。
+  var remark: String?
+
+  init(
+    method: String,
+    password: String,
+    host: String,
+    port: Int,
+    pluginProgram: String? = nil,
+    pluginOptions: String? = nil,
+    remark: String? = nil
+  ) {
+    self.method = method
+    self.password = password
+    self.host = host
+    self.port = port
+    self.pluginProgram = pluginProgram
+    self.pluginOptions = pluginOptions
+    self.remark = remark
+  }
+}
+
+/// 解码失败原因：输入不是可解析的 `ss://` URI。
+enum SsUriError: Error, Equatable {
+  /// 不以 `ss://` 开头。
+  case notSsUri
+  /// scheme 正确但结构或字段非法（缺端口、base64 解不开、端口越界等）。
+  case malformed(detail: String)
+}
+
+// MARK: - 解码
+
+extension SsUri {
+  /// 解码单个 URI 行。同时接受：
+  /// - SIP002 形态：`ss://userinfo@host:port/?plugin=…#tag`（userinfo 为
+  /// base64url(`method:password`) 或百分号编码明文——AEAD-2022 规定明文）。
+  /// - Legacy 兼容形态：`ss://base64(method:password@host:port)#tag`（无 `@`，
+  /// 密码明文，非 RFC 3986）。
+  static func decode(_ rawInput: String) throws -> SsUri {
+    let input = rawInput.trimmingCharacters(in: .whitespacesAndNewlines)
+    let schemePrefix = "ss://"
+    guard input.lowercased().hasPrefix(schemePrefix) else { throw SsUriError.notSsUri }
+    var rest = String(input.dropFirst(schemePrefix.count))
+
+    // fragment（备注）：base64 字母表与百分号编码都不含裸 `#`，取首个裸 `#` 安全。
+    var remark: String?
+    if let hashIndex = rest.firstIndex(of: "#") {
+      remark = percentDecode(String(rest[rest.index(after: hashIndex)...]))
+      rest = String(rest[..<hashIndex])
+    }
+
+    if rest.contains("@") {
+      return try decodeSIP002(rest, remark: remark)
+    }
+    return try decodeLegacy(rest, remark: remark)
+  }
+
+  /// SIP002 形态：在最后一个 `@` 处分离 userinfo 与 host:port（+query）。
+  private static func decodeSIP002(_ rest: String, remark: String?) throws -> SsUri {
+    guard let atSign = rest.lastIndex(of: "@") else {
+      throw SsUriError.malformed(detail: "missing userinfo separator")
+    }
+    let userInfo = String(rest[..<atSign])
+    var hostPort = String(rest[rest.index(after: atSign)...])
+
+    var query: String?
+    if let queryIndex = hostPort.firstIndex(of: "?") {
+      query = String(hostPort[hostPort.index(after: queryIndex)...])
+      hostPort = String(hostPort[..<queryIndex])
+    }
+    hostPort = hostPort.trimmingCharacters(in: CharacterSet(charactersIn: "/"))
+    let (host, port) = try parseHostPort(hostPort)
+    let (method, password) = try parseUserInfo(userInfo)
+    let plugin = parsePluginQuery(query)
+
+    return SsUri(
+      method: method, password: password, host: host, port: port,
+      pluginProgram: plugin?.program, pluginOptions: plugin?.options, remark: remark)
+  }
+
+  /// userinfo 解析：先按 base64url（补齐 padding、兼容两种字母表）；解不出或
+  /// 不含分隔冒号时回退百分号编码明文（SIP022 形态）。
+  private static func parseUserInfo(_ userInfo: String) throws -> (String, String) {
+    if let decoded = base64FlexibleDecode(userInfo), let separator = decoded.firstIndex(of: ":") {
+      let method = String(decoded[..<separator])
+      let password = String(decoded[decoded.index(after: separator)...])
+      guard !method.isEmpty, !password.isEmpty else {
+        throw SsUriError.malformed(detail: "method or password is empty")
+      }
+      return (method, password)
+    }
+    guard let plain = percentDecode(userInfo), let separator = plain.firstIndex(of: ":") else {
+      throw SsUriError.malformed(
+        detail: "userinfo is neither base64 nor percent-encoded method:password")
+    }
+    let method = String(plain[..<separator])
+    let password = String(plain[plain.index(after: separator)...])
+    guard !method.isEmpty, !password.isEmpty else {
+      throw SsUriError.malformed(detail: "method or password is empty")
+    }
+    return (method, password)
+  }
+
+  /// Legacy 形态：整体 base64 → `method:password@host:port`。密码为明文
+  /// （可能含 `@` 与 `:`），故 host:port 侧用「最后一个 @」切分。
+  private static func decodeLegacy(_ rest: String, remark: String?) throws -> SsUri {
+    let trimmed = rest.trimmingCharacters(in: CharacterSet(charactersIn: "/"))
+    guard let decoded = base64FlexibleDecode(trimmed) else {
+      throw SsUriError.malformed(detail: "legacy payload is not valid base64")
+    }
+    guard let atSign = decoded.lastIndex(of: "@") else {
+      throw SsUriError.malformed(detail: "legacy payload missing @")
+    }
+    let credentials = String(decoded[..<atSign])
+    let hostPort = String(decoded[decoded.index(after: atSign)...])
+    guard let colon = credentials.firstIndex(of: ":") else {
+      throw SsUriError.malformed(detail: "legacy payload missing method separator")
+    }
+    let (host, port) = try parseHostPort(hostPort)
+    let method = String(credentials[..<colon])
+    let password = String(credentials[credentials.index(after: colon)...])
+    guard !method.isEmpty, !password.isEmpty else {
+      throw SsUriError.malformed(detail: "method or password is empty")
+    }
+    return SsUri(
+      method: method,
+      password: password,
+      host: host, port: port, remark: remark)
+  }
+
+  /// host:port 解析：IPv6 必须为方括号形态；否则以最后一个冒号分离端口。
+  private static func parseHostPort(_ hostPort: String) throws -> (String, Int) {
+    let host: String
+    let portText: String
+    if hostPort.hasPrefix("[") {
+      guard let closing = hostPort.firstIndex(of: "]") else {
+        throw SsUriError.malformed(detail: "unclosed IPv6 bracket")
+      }
+      host = String(hostPort[hostPort.index(hostPort.startIndex, offsetBy: 1)..<closing])
+      let remainder = hostPort[hostPort.index(after: closing)...]
+      guard remainder.hasPrefix(":") else {
+        throw SsUriError.malformed(detail: "missing port after IPv6 bracket")
+      }
+      portText = String(remainder.dropFirst())
+    } else {
+      guard let colon = hostPort.lastIndex(of: ":") else {
+        throw SsUriError.malformed(detail: "missing port")
+      }
+      host = String(hostPort[..<colon])
+      portText = String(hostPort[hostPort.index(after: colon)...])
+    }
+    guard let port = Int(portText), (1...65_535).contains(port) else {
+      throw SsUriError.malformed(detail: "invalid port \(portText)")
+    }
+    guard !host.isEmpty else { throw SsUriError.malformed(detail: "empty host") }
+    return (host, port)
+  }
+
+  /// query 中的 `plugin` 参数：百分号解码后为 `name;opts`，首个 `;` 切分；
+  /// opts 原样保留。`plugin=` 空值视为无插件。
+  private static func parsePluginQuery(
+    _ query: String?
+  ) -> (program: String, options: String?)? {
+    guard let query else { return nil }
+    var pluginValue: String?
+    for pair in query.split(separator: "&") {
+      let name: String
+      let value: String
+      if let equals = pair.firstIndex(of: "=") {
+        name = String(pair[..<equals])
+        value = String(pair[pair.index(after: equals)...])
+      } else {
+        name = String(pair)
+        value = ""
+      }
+      if percentDecode(name) == "plugin" { pluginValue = percentDecode(value) }
+    }
+    guard let pluginValue, !pluginValue.isEmpty else { return nil }
+    let program: String
+    let options: String?
+    if let semicolon = pluginValue.firstIndex(of: ";") {
+      program = String(pluginValue[..<semicolon])
+      let rest = String(pluginValue[pluginValue.index(after: semicolon)...])
+      options = rest.isEmpty ? nil : rest
+    } else {
+      program = pluginValue
+      options = nil
+    }
+    guard !program.isEmpty else { return nil }
+    return (program, options)
+  }
+}
+
+// MARK: - 编码
+
+extension SsUri {
+  /// 规范 SIP002 形态：`ss://userinfo@host:port[/?plugin=…][#remark]`。
+  /// AEAD-2022（SIP022，`2022-blake3-*`）按规范用百分号编码明文 userinfo，
+  /// 其余用 base64url（无 padding）。
+  func encode() -> String {
+    let userInfo: String
+    if method.hasPrefix("2022-blake3-") {
+      userInfo = "\(Self.percentEncode(method)):\(Self.percentEncode(password))"
+    } else {
+      userInfo = Self.base64URLEncodeNoPadding("\(method):\(password)")
+    }
+    var uri = "ss://\(userInfo)@\(encodedHost):\(port)"
+    if let program = pluginProgram {
+      let pluginValue = pluginOptions.map { "\(program);\($0)" } ?? program
+      uri += "/?plugin=\(Self.percentEncode(pluginValue))"
+    }
+    if let remark, !remark.isEmpty {
+      uri += "#\(Self.percentEncode(remark))"
+    }
+    return uri
+  }
+
+  /// 解码得到的 IPv6（裸冒号形态）编码时重新加方括号。
+  private var encodedHost: String {
+    host.contains(":") ? "[\(host)]" : host
+  }
+}
+
+// MARK: - base64 与百分号编码工具
+
+extension SsUri {
+  /// base64url 无 padding（SIP002 userinfo 的规范形态）。
+  static func base64URLEncodeNoPadding(_ text: String) -> String {
+    Data(text.utf8)
+      .base64EncodedString()
+      .replacingOccurrences(of: "+", with: "-")
+      .replacingOccurrences(of: "/", with: "_")
+      .replacingOccurrences(of: "=", with: "")
+  }
+
+  /// 宽容 base64 解码：兼容标准/url-safe 两种字母表与缺失 padding
+  /// （社区分享链接普遍省略 padding）。
+  static func base64FlexibleDecode(_ text: String) -> String? {
+    var normalized =
+      text
+      .replacingOccurrences(of: "-", with: "+")
+      .replacingOccurrences(of: "_", with: "/")
+      .replacingOccurrences(of: "\n", with: "")
+      .replacingOccurrences(of: "\r", with: "")
+      .trimmingCharacters(in: .whitespaces)
+    let remainder = normalized.count % 4
+    if remainder == 1 { return nil }  // 不可能是合法 base64 长度
+    if remainder > 0 { normalized.append(String(repeating: "=", count: 4 - remainder)) }
+    guard let data = Data(base64Encoded: normalized) else { return nil }
+    return String(data: data, encoding: .utf8)
+  }
+
+  /// 百分号编码：仅保留 RFC 3986 unreserved（字母数字与 `-._~`），其余全部
+  /// 转义——与官方示例的 `obfs-local%3Bobfs%3Dhttp` 形态一致。
+  static func percentEncode(_ text: String) -> String {
+    let allowed = CharacterSet(
+      charactersIn: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~")
+    return text.addingPercentEncoding(withAllowedCharacters: allowed) ?? text
+  }
+
+  private static func percentDecode(_ text: String) -> String? {
+    text.removingPercentEncoding
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Credentials/EncryptedFileStorage.swift b/ShadowsocksX-NG2/Domain/Credentials/EncryptedFileStorage.swift
new file mode 100644
index 000000000..741aa1e1d
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Credentials/EncryptedFileStorage.swift
@@ -0,0 +1,169 @@
+import AgeSwift
+import Foundation
+
+enum EncryptedFileError: Error, Equatable {
+  case malformedFile
+  case unsupportedVersion
+  case authenticationFailed
+  case keyUnavailable
+  case notLoaded
+}
+
+/// age 文件的密钥选择与原子提交；每个实例独立持有已匹配的 identity。
+final class EncryptedFileStorage<Value> {
+  private let keys: CredentialKeyStoring
+  private var currentIdentity: AgeIdentity?
+  private var loaded = false
+  private let maximumSize: Int
+  private let legacyFileNames: [String]
+  private let makeDefault: () -> Value
+  private let encode: (Value) throws -> Data
+  private let decode: (Data) throws -> Value
+  var isLoaded: Bool { loaded }
+
+  // 为 age 分块标签、文件头和 armor 换行预留空间；明文仍单独检查原有上限。
+  private var maximumFileSize: Int {
+    let binary = maximumSize + (maximumSize / 65536 + 1) * 16 + 16384
+    let base64 = (binary + 2) / 3 * 4
+    return base64 + base64 / 64 * 2 + 1024
+  }
+
+  init(
+    keys: CredentialKeyStoring, maximumSize: Int,
+    legacyFileNames: [String], makeDefault: @escaping () -> Value,
+    encode: @escaping (Value) throws -> Data, decode: @escaping (Data) throws -> Value
+  ) {
+    self.keys = keys
+    self.maximumSize = maximumSize
+    self.legacyFileNames = legacyFileNames
+    self.makeDefault = makeDefault
+    self.encode = encode
+    self.decode = decode
+  }
+
+  func load(at url: URL, allowingInteraction: Bool) throws -> Value {
+    if loaded, !FileManager.default.fileExists(atPath: url.path) {
+      throw EncryptedFileError.notLoaded
+    }
+    if FileManager.default.fileExists(atPath: url.path) {
+      let (document, identity) = try read(at: url, allowingInteraction: allowingInteraction)
+      currentIdentity = identity
+      loaded = true
+      return document
+    }
+    let directory = url.deletingLastPathComponent()
+    guard
+      !legacyFileNames.contains(where: {
+        FileManager.default.fileExists(atPath: directory.appendingPathComponent($0).path)
+      })
+    else { throw EncryptedFileError.unsupportedVersion }
+    let document = makeDefault()
+    let identity = try createIdentity(allowingInteraction: allowingInteraction)
+    try write(document, identity: identity, to: url)
+    currentIdentity = identity
+    loaded = true
+    return document
+  }
+
+  func save(_ document: Value, at url: URL) throws {
+    guard loaded, let identity = currentIdentity else { throw EncryptedFileError.notLoaded }
+    try write(document, identity: identity, to: url)
+  }
+
+  /// 调用方先取得用户的破坏性操作确认；成功写盘前不发布新状态。
+  func reset(at url: URL) throws -> Value {
+    let identity = try createIdentity(allowingInteraction: true)
+    let document = makeDefault()
+    try write(document, identity: identity, to: url)
+    currentIdentity = identity
+    loaded = true
+    return document
+  }
+
+  private func createIdentity(allowingInteraction: Bool) throws -> AgeIdentity {
+    let id = UUID()
+    let identity = try AgeIdentity.generate()
+    let data = Data(identity.serialized.utf8)
+    try keys.create(data, id: id, allowingInteraction: allowingInteraction)
+    guard try keys.read(id, allowingInteraction: allowingInteraction) == data else {
+      throw EncryptedFileError.keyUnavailable
+    }
+    return identity
+  }
+
+  private func write(_ document: Value, identity: AgeIdentity, to url: URL) throws {
+    let payload = try encode(document)
+    guard payload.count <= maximumSize else { throw EncryptedFileError.malformedFile }
+    let ciphertext = try Age.encrypt(payload, recipients: [identity.recipient])
+    try AtomicFileWriter.write(ciphertext, to: url)
+  }
+
+  private func read(at url: URL, allowingInteraction: Bool) throws -> (Value, AgeIdentity) {
+    let data = try readBoundedFile(at: url)
+    if data.starts(with: Data("SSXNG2".utf8)) {
+      throw EncryptedFileError.unsupportedVersion
+    }
+    if let identity = currentIdentity {
+      return (try decodePayload(data, identity: identity), identity)
+    }
+    var accessError: (any Error)?
+    var triedIdentity = false
+    for id in try keys.ids() {
+      let identity: AgeIdentity
+      do {
+        guard let keyData = try keys.read(id, allowingInteraction: allowingInteraction),
+          let text = String(data: keyData, encoding: .utf8)
+        else { continue }
+        identity = try AgeIdentity(string: text)
+      } catch {
+        if accessError == nil { accessError = error }
+        continue
+      }
+      triedIdentity = true
+      let plain: Data
+      do {
+        plain = try Age.decrypt(data, identities: [identity])
+      } catch AgeError.noMatchingKey {
+        continue
+      } catch AgeError.invalidFormat {
+        throw EncryptedFileError.malformedFile
+      } catch {
+        throw EncryptedFileError.authenticationFailed
+      }
+      return (try decodeCheckedPayload(plain), identity)
+    }
+    if let accessError { throw accessError }
+    throw triedIdentity ? EncryptedFileError.authenticationFailed : .keyUnavailable
+  }
+
+  private func decodePayload(_ data: Data, identity: AgeIdentity) throws -> Value {
+    let plain: Data
+    do {
+      plain = try Age.decrypt(data, identities: [identity])
+    } catch AgeError.invalidFormat {
+      throw EncryptedFileError.malformedFile
+    } catch {
+      throw EncryptedFileError.authenticationFailed
+    }
+    return try decodeCheckedPayload(plain)
+  }
+
+  private func decodeCheckedPayload(_ plain: Data) throws -> Value {
+    guard plain.count <= maximumSize else { throw EncryptedFileError.malformedFile }
+    return try decode(plain)
+  }
+
+  private func readBoundedFile(at url: URL) throws -> Data {
+    let handle = try FileHandle(forReadingFrom: url)
+    defer { try? handle.close() }
+    var data = Data()
+    while let chunk = try handle.read(upToCount: min(65536, maximumFileSize + 1 - data.count)),
+      !chunk.isEmpty
+    {
+      data.append(chunk)
+      guard data.count <= maximumFileSize else { throw EncryptedFileError.malformedFile }
+    }
+    guard !data.isEmpty else { throw EncryptedFileError.malformedFile }
+    return data
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Credentials/MasterKeyStore.swift b/ShadowsocksX-NG2/Domain/Credentials/MasterKeyStore.swift
new file mode 100644
index 000000000..559ead515
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Credentials/MasterKeyStore.swift
@@ -0,0 +1,115 @@
+import Foundation
+import Security
+
+enum CredentialKeyStoreError: Error, Equatable {
+  case keychainStatus(OSStatus)
+}
+
+/// 主密钥的二进制存储；交互只由显式解锁或重置命令开启。
+protocol CredentialKeyStoring {
+  func ids() throws -> [UUID]
+  func read(_ id: UUID, allowingInteraction: Bool) throws -> Data?
+  func create(_ data: Data, id: UUID, allowingInteraction: Bool) throws
+}
+
+struct KeychainCredentialKeyStore: CredentialKeyStoring {
+  let service: String
+
+  init(namespace: String) {
+    self.service = "com.qiuyuzhou.ShadowsocksX-NG2.\(namespace)"
+  }
+
+  func ids() throws -> [UUID] {
+    try withClassicKeychainInteraction(false) {
+      var query = baseQuery
+      query[kSecReturnAttributes as String] = true
+      query[kSecMatchLimit as String] = kSecMatchLimitAll
+      var result: AnyObject?
+      let status = SecItemCopyMatching(query as CFDictionary, &result)
+      if status == errSecItemNotFound { return [] }
+      guard status == errSecSuccess, let items = result as? [[String: Any]] else {
+        throw CredentialKeyStoreError.keychainStatus(status)
+      }
+      return items.compactMap { item in
+        (item[kSecAttrAccount as String] as? String).flatMap(UUID.init(uuidString:))
+      }.sorted { $0.uuidString < $1.uuidString }
+    }
+  }
+
+  func read(_ id: UUID, allowingInteraction: Bool) throws -> Data? {
+    try withClassicKeychainInteraction(allowingInteraction) {
+      var query = query(id)
+      query[kSecReturnData as String] = true
+      query[kSecMatchLimit as String] = kSecMatchLimitOne
+      var result: AnyObject?
+      let status = SecItemCopyMatching(query as CFDictionary, &result)
+      if status == errSecItemNotFound { return nil }
+      guard status == errSecSuccess, let data = result as? Data else {
+        throw CredentialKeyStoreError.keychainStatus(status)
+      }
+      return data
+    }
+  }
+
+  #if compiler(>=6.4)
+    @diagnose(
+      DeprecatedDeclaration, as: ignored,
+      reason: "经典登录钥匙串使用 SecAccess ACL 限制获准应用访问"
+    )
+  #endif
+  func create(_ data: Data, id: UUID, allowingInteraction: Bool) throws {
+    try withClassicKeychainInteraction(allowingInteraction) {
+      var application: SecTrustedApplication?
+      try check(SecTrustedApplicationCreateFromPath(nil, &application))
+      guard let application else { throw CredentialKeyStoreError.keychainStatus(errSecParam) }
+      var access: SecAccess?
+      try check(
+        SecAccessCreate(
+          "ShadowsocksX-NG2 encrypted configuration" as CFString,
+          [application] as CFArray, &access))
+      guard let access else { throw CredentialKeyStoreError.keychainStatus(errSecParam) }
+      var item = query(id)
+      item[kSecValueData as String] = data
+      item[kSecAttrAccess as String] = access
+      try check(SecItemAdd(item as CFDictionary, nil))
+    }
+  }
+
+  private func query(_ id: UUID) -> [String: Any] {
+    var query = baseQuery
+    query[kSecAttrAccount as String] = id.uuidString
+    return query
+  }
+
+  private var baseQuery: [String: Any] {
+    [
+      kSecClass as String: kSecClassGenericPassword,
+      kSecAttrService as String: service,
+      kSecAttrSynchronizable as String: false,
+      kSecUseDataProtectionKeychain as String: false,
+    ]
+  }
+
+  private func check(_ status: OSStatus) throws {
+    guard status == errSecSuccess else { throw CredentialKeyStoreError.keychainStatus(status) }
+  }
+}
+
+/// 经典钥匙串使用进程级交互开关。同步调用结束后恢复原值，不把交互许可留给后台操作。
+#if compiler(>=6.4)
+  @diagnose(
+    DeprecatedDeclaration, as: ignored,
+    reason: "经典登录钥匙串需要显式控制交互许可，并在同步操作结束后恢复原值"
+  )
+#endif
+private func withClassicKeychainInteraction<T>(_ allowed: Bool, _ operation: () throws -> T) throws
+  -> T
+{
+  var previous: DarwinBoolean = false
+  let getStatus = SecKeychainGetUserInteractionAllowed(&previous)
+  guard getStatus == errSecSuccess else { throw CredentialKeyStoreError.keychainStatus(getStatus) }
+  let setStatus = SecKeychainSetUserInteractionAllowed(allowed)
+  guard setStatus == errSecSuccess else { throw CredentialKeyStoreError.keychainStatus(setStatus) }
+  defer { SecKeychainSetUserInteractionAllowed(previous.boolValue) }
+  return try operation()
+}
diff --git a/ShadowsocksX-NG2/Domain/Diagnostics/DiagnosticReport.swift b/ShadowsocksX-NG2/Domain/Diagnostics/DiagnosticReport.swift
new file mode 100644
index 000000000..415f71c7e
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Diagnostics/DiagnosticReport.swift
@@ -0,0 +1,296 @@
+import Foundation
+
+// MARK: - 事实输入
+
+/// 单个文件的存在性/权限/大小/时间事实（导出允许的元数据类目；只读元数据，
+/// 永不读文件内容）。
+struct DiagnosticFileFacts: Equatable, Sendable {
+  let label: String
+  let exists: Bool
+  let isDirectory: Bool
+  /// POSIX 权限八进制文本（如 "0600"）；文件不存在时为 nil。
+  let permissionsOctal: String?
+  let sizeBytes: Int?
+  let modifiedAt: Date?
+}
+
+/// 文件事实收集：只取存在性/权限/大小/修改时间。
+enum DiagnosticFileCollector {
+  static func collect(
+    label: String, url: URL, fileManager: FileManager = .default
+  ) -> DiagnosticFileFacts {
+    let missing = DiagnosticFileFacts(
+      label: label, exists: false, isDirectory: false,
+      permissionsOctal: nil, sizeBytes: nil, modifiedAt: nil)
+    guard let attributes = try? fileManager.attributesOfItem(atPath: url.path) else {
+      return missing
+    }
+    let isDirectory = (attributes[.type] as? FileAttributeType) == .typeDirectory
+    let permissions = (attributes[.posixPermissions] as? NSNumber).map {
+      String(format: "%04o", $0.int32Value)
+    }
+    return DiagnosticFileFacts(
+      label: label,
+      exists: true,
+      isDirectory: isDirectory,
+      permissionsOctal: permissions,
+      sizeBytes: (attributes[.size] as? NSNumber)?.intValue,
+      modifiedAt: attributes[.modificationDate] as? Date)
+  }
+}
+
+/// 代理状态的安全呈现：控制器状态收敛为固定文案，不透传任意
+/// 错误 detail（导出只含白名单类目，原始错误文本一律丢弃）；激活失败
+/// 原因来自领域的点名文案（短节点片段 + 固定文本，无秘密）。
+enum DiagnosticProxyState: Equatable, Sendable {
+  case off
+  case starting
+  case running
+  case firewallBlocked
+  case launchFailed
+  case activationFailed(reason: String)
+  case requiresApproval
+  case serviceFailed
+  case systemProxyFailed
+
+  var label: String {
+    switch self {
+    case .off:
+      return "已停止"
+    case .starting:
+      return "启动中"
+    case .running:
+      return "运行中"
+    case .firewallBlocked:
+      return "已被 macOS 应用防火墙拦截（主机地址态）"
+    case .launchFailed:
+      return "启动失败（本地代理端点未就绪）"
+    case .activationFailed(let reason):
+      return "激活失败：\(reason)"
+    case .requiresApproval:
+      return "等待在系统设置-登录项中批准"
+    case .serviceFailed:
+      return "服务管理失败"
+    case .systemProxyFailed:
+      return "系统代理未应用"
+    }
+  }
+}
+
+// MARK: - 快照与构建器
+
+/// 目录聚合诊断事实：数量元数据与已知无效数。原始
+/// 目录、目录条目、服务器地址、备注与凭据引用不进入本类型——构造它的唯一
+/// 生产入口是目录 workflow 的 domain-neutral 事实缝，报告 builder 只接受
+/// 已经裁剪的聚合事实。
+struct DiagnosticCatalogFacts: Equatable, Sendable {
+  var counts = DiagnosticReportBuilder.CatalogCounts()
+  /// 已知无效服务器数（应用层以当前凭据与插件供应事实计算；nil = 未知）。
+  var knownInvalidServerCount: Int?
+}
+
+/// 诊断快照：导出报告的全部输入。字段要么是数量/布尔/时间等
+/// 元数据，要么是已脱敏文本（由夹具测试验证），构建器不再接触任何秘密来源
+/// ——不读 Keychain、不读契约与目录的文件内容；目录事实只以聚合计数进入快照。
+struct DiagnosticSnapshot: Sendable {
+  var generatedAt = Date()
+  var appVersion: String?
+  var systemSummary: String?
+  var proxyState = DiagnosticProxyState.off
+  var hasActiveTarget = false
+  var listen: RuntimeListenFacts?
+  /// `Redactor.documentSummary` 产出的契约脱敏摘要（数量与模式）。
+  var runtimeDocumentSummary: String?
+  /// 自定义规则安全摘要：数量 + 内容版本，无原始域名。
+  var customRuleSummary: CustomRuleSummary?
+  /// 目录聚合事实；nil = 目录事实源不可用（报告中明确标注，不静默丢失）。
+  var catalogFacts: DiagnosticCatalogFacts?
+  var fileFacts: [DiagnosticFileFacts] = []
+  /// 渲染好的运行事件行（旧→新，调用方负责封顶；行文本必须来自白名单
+  /// 清洗投影。
+  var eventLines: [String] = []
+  /// bundle 内受管插件清单（名称/版本/存在性，不含参数与路径）。
+  var managedPlugins: [DiagnosticPluginFacts] = []
+  /// 长路径脱敏基准：文本中出现的该前缀一律改写为「~」。
+  var homePathForRedaction: String?
+}
+
+/// 受管插件事实：程序名、固定版本与二进制是否在位。存在性属
+/// 允许的导出类目；插件参数与文件路径不进导出。
+struct DiagnosticPluginFacts: Equatable, Sendable {
+  let program: String
+  let version: String
+  let present: Bool
+  var source: PluginCatalogSnapshot.Source = .managed
+}
+
+/// 诊断报告构建器：只输出状态、存在性、权限、
+/// 大小/时间、数量与脱敏元数据。测试夹具以投毒数据验证导出不含任何敏感
+/// 类目（密码、插件参数、Keychain 值、完整订阅 URL 及其 token、运行时
+/// JSON 内容、服务器地址与备注）。测试 URL 为非敏感信息，无需脱敏。
+enum DiagnosticReportBuilder {
+  /// 目录数量元数据（只含计数，不含名称/地址/备注）。
+  struct CatalogCounts: Equatable, Sendable {
+    var servers = 0
+    var groups = 0
+    var serversWithPlugin = 0
+    var manualServers = 0
+    var subscriptionServers = 0
+  }
+
+  static func counts(in catalog: ConfigurationCatalog) -> CatalogCounts {
+    var counts = CatalogCounts()
+    for entry in catalog.entries.values {
+      switch entry.kind {
+      case .server(let fields):
+        counts.servers += 1
+        if entry.source == .manual {
+          counts.manualServers += 1
+        } else {
+          counts.subscriptionServers += 1
+        }
+        if fields.pluginProgram != nil {
+          counts.serversWithPlugin += 1
+        }
+      case .group:
+        counts.groups += 1
+      }
+    }
+    return counts
+  }
+
+  static func markdown(from snapshot: DiagnosticSnapshot) -> String {
+    var lines: [String] = []
+    lines.append("# ShadowsocksX-NG2 诊断报告")
+    lines.append("")
+    lines.append("- 生成时间：\(timestamp(snapshot.generatedAt))")
+    lines.append("- 应用版本：\(snapshot.appVersion ?? "未提供")")
+    lines.append("- 系统：\(snapshot.systemSummary ?? "未提供")")
+    lines.append("")
+    lines.append("本报告仅含状态、存在性、权限、大小/时间、数量与脱敏元数据；不包含")
+    lines.append("密码、插件参数、钥匙串值、完整订阅 URL 及其 token、运行时 JSON")
+    lines.append("内容、服务器地址与备注。")
+    lines.append("")
+    lines.append(contentsOf: statusLines(snapshot))
+    lines.append(contentsOf: fileTableLines(snapshot))
+    lines.append("## 运行事件（最近 \(snapshot.eventLines.count) 条）")
+    lines.append("")
+    if snapshot.eventLines.isEmpty {
+      lines.append("（无事件）")
+    } else {
+      lines.append(contentsOf: snapshot.eventLines)
+    }
+    let text = lines.joined(separator: "\n") + "\n"
+    return redactingHomePaths(text, home: snapshot.homePathForRedaction)
+  }
+
+  /// 家目录前缀改写为「~」：错误 detail 可能携带文件路径，避免导出暴露
+  /// 用户目录名。
+  static func redactingHomePaths(_ text: String, home: String?) -> String {
+    guard let home, !home.isEmpty, home != "/" else { return text }
+    return text.replacingOccurrences(of: home, with: "~")
+  }
+
+  private static func statusLines(_ snapshot: DiagnosticSnapshot) -> [String] {
+    var lines: [String] = []
+    lines.append("## 代理状态")
+    lines.append("")
+    lines.append("- 代理状态：\(snapshot.proxyState.label)")
+    lines.append("- 活动目标：\(snapshot.hasActiveTarget ? "已设置" : "未设置")")
+    if let listen = snapshot.listen {
+      let binding = listen.lan.isEnabled ? "（\(listen.lan.mode.bindAddress)）" : ""
+      let lanMode = listen.lan.isEnabled ? listen.lan.mode.displayName : String(localized: "关闭")
+      lines.append(
+        "- 局域网监听：\(lanMode)\(binding)，SOCKS \(listen.lan.socksPort) / HTTP \(listen.lan.httpPort)"
+      )
+      lines.append("- 本地监听：\(listenDescription(listen))")
+    }
+    if let summary = snapshot.runtimeDocumentSummary {
+      lines.append("- 运行时契约摘要：\(summary)")
+    } else {
+      lines.append("- 运行时契约摘要：不可用")
+    }
+    if let rules = snapshot.customRuleSummary {
+      lines.append("- 自定义规则：\(rules.count) 条（版本 \(rules.contentVersion)）")
+    } else {
+      lines.append("- 自定义规则：不可用")
+    }
+    lines.append("")
+    lines.append("## 配置目录（数量）")
+    lines.append("")
+    if let facts = snapshot.catalogFacts {
+      lines.append(contentsOf: catalogCountLines(facts))
+    } else {
+      lines.append("- 配置目录不可用")
+    }
+    lines.append("")
+    lines.append("## 受管插件")
+    lines.append("")
+    if snapshot.managedPlugins.isEmpty {
+      lines.append("（本版本未打包任何插件）")
+    } else {
+      for plugin in snapshot.managedPlugins {
+        let version = plugin.source == .managed ? plugin.version : plugin.source.rawValue
+        lines.append(
+          "- \(plugin.program) \(version)：\(plugin.present ? "已提供" : "缺失")"
+        )
+      }
+    }
+    lines.append("")
+    return lines
+  }
+
+  private static func fileTableLines(_ snapshot: DiagnosticSnapshot) -> [String] {
+    var lines: [String] = []
+    lines.append("## 运行时文件（存在性 / 权限 / 大小 / 时间）")
+    lines.append("")
+    lines.append("| 文件 | 存在 | 权限 | 字节 | 修改时间 |")
+    lines.append("|---|---|---|---|---|")
+    for facts in snapshot.fileFacts {
+      lines.append(fileRow(facts))
+    }
+    lines.append("")
+    return lines
+  }
+
+  /// 目录行只呈现聚合事实：目录条目本身永不进入快照与渲染。
+  private static func catalogCountLines(_ facts: DiagnosticCatalogFacts) -> [String] {
+    let counts = facts.counts
+    let invalid = facts.knownInvalidServerCount.map { "已知无效 \($0)；" } ?? ""
+    return [
+      "- 服务器：\(counts.servers)（\(invalid)"
+        + "配置插件 \(counts.serversWithPlugin)；"
+        + "手动 \(counts.manualServers) / 订阅 \(counts.subscriptionServers)）",
+      "- 分组：\(counts.groups)",
+    ]
+  }
+
+  /// 本地端点只以端口事实呈现。
+  private static func listenDescription(_ listen: RuntimeListenFacts) -> String {
+    var parts = ["SOCKS5 端口 \(listen.socksPort)"]
+    parts.append("HTTP 端口 \(listen.httpPort)")
+    return parts.joined(separator: "；")
+  }
+
+  private static func fileRow(_ facts: DiagnosticFileFacts) -> String {
+    let size: String
+    if facts.isDirectory {
+      size = "—"
+    } else if let sizeBytes = facts.sizeBytes {
+      size = String(sizeBytes)
+    } else {
+      size = "—"
+    }
+    let modified = facts.modifiedAt.map(timestamp) ?? "—"
+    let permission = facts.permissionsOctal ?? "—"
+    let existence = facts.exists ? "是" : "否"
+    return "| \(facts.label) | \(existence) | \(permission) | \(size) | \(modified) |"
+  }
+
+  private static func timestamp(_ date: Date) -> String {
+    let formatter = DateFormatter()
+    formatter.locale = Locale(identifier: "en_US_POSIX")
+    formatter.dateFormat = "yyyy-MM-dd HH:mm:ss"
+    return formatter.string(from: date)
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/LegacyImport/LegacyImport.swift b/ShadowsocksX-NG2/Domain/LegacyImport/LegacyImport.swift
new file mode 100644
index 000000000..486ed49e7
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/LegacyImport/LegacyImport.swift
@@ -0,0 +1,365 @@
+import Darwin
+import Foundation
+
+/// One server record as it appeared in the Legacy `ServerProfiles` array.
+/// Optional fields are intentional: malformed records are reported and skipped
+/// by the planner instead of being force-cast like the historical app did.
+struct LegacyServerSnapshot: Equatable, Sendable {
+  let index: Int
+  let isDictionary: Bool
+  let id: String?
+  let address: String?
+  let port: Int?
+  let method: String?
+  let password: String?
+  let remark: String?
+  let plugin: String?
+  let pluginOptions: String?
+}
+
+/// Read-only snapshot of the persisted Legacy server records. Legacy
+/// preferences are deliberately not part of the import projection.
+struct LegacySnapshot: Equatable, Sendable {
+  let profiles: [LegacyServerSnapshot]
+  let hasServerRecords: Bool
+
+  init(propertyList: [String: Any]) throws {
+    if let rawProfiles = propertyList["ServerProfiles"] {
+      guard let profileValues = rawProfiles as? [Any] else {
+        throw LegacyImportError.malformedSnapshot
+      }
+      profiles = profileValues.enumerated().map { index, rawValue in
+        Self.profileSnapshot(index: index, rawValue: rawValue)
+      }
+    } else {
+      profiles = []
+    }
+    // An empty or preference-only Legacy domain is not an importable
+    // snapshot, so first launch does not offer a misleading empty migration.
+    hasServerRecords = !profiles.isEmpty
+  }
+}
+
+extension LegacySnapshot {
+  private static func profileSnapshot(index: Int, rawValue: Any) -> LegacyServerSnapshot {
+    guard let values = rawValue as? [String: Any] else {
+      return LegacyServerSnapshot(
+        index: index, isDictionary: false, id: nil, address: nil, port: nil,
+        method: nil, password: nil, remark: nil, plugin: nil, pluginOptions: nil)
+    }
+    return LegacyServerSnapshot(
+      index: index,
+      isDictionary: true,
+      id: stringValue(values["Id"]),
+      address: stringValue(values["ServerHost"]),
+      port: intValue(values["ServerPort"]),
+      method: stringValue(values["Method"]),
+      password: stringValue(values["Password"]),
+      remark: stringValue(values["Remark"]),
+      plugin: stringValue(values["Plugin"]),
+      pluginOptions: stringValue(values["PluginOptions"])
+    )
+  }
+
+  private static func stringValue(_ value: Any?) -> String? {
+    value as? String
+  }
+
+  private static func intValue(_ value: Any?) -> Int? {
+    guard let value = value as? NSNumber else { return nil }
+    return value.intValue
+  }
+}
+
+/// Source seam for discovery and fixture injection.
+protocol LegacySnapshotProviding {
+  func readSnapshot() throws -> LegacySnapshot?
+}
+
+/// Reads only the persisted application domain, not registered defaults. This
+/// prevents a fresh 2.0 process from mistaking registered Legacy defaults for a
+/// user-owned Legacy installation.
+struct UserDefaultsLegacySnapshotProvider: LegacySnapshotProviding {
+  static let legacyBundleIdentifier = "com.qiuyuzhou.ShadowsocksX-NG"
+
+  let defaults: UserDefaults
+  let bundleIdentifier: String
+
+  init(
+    defaults: UserDefaults = .standard,
+    bundleIdentifier: String = Self.legacyBundleIdentifier
+  ) {
+    self.defaults = defaults
+    self.bundleIdentifier = bundleIdentifier
+  }
+
+  func readSnapshot() throws -> LegacySnapshot? {
+    let values = defaults.persistentDomain(forName: bundleIdentifier) ?? [:]
+    let snapshot = try LegacySnapshot(propertyList: values)
+    return snapshot.hasServerRecords ? snapshot : nil
+  }
+}
+
+/// Completion marker seam. `false` removes the marker rather than persisting a
+/// false value, preserving the distinction between "skipped" and "completed".
+protocol LegacyImportMarkerStoring {
+  func isCompleted() throws -> Bool
+  func setCompleted(_ completed: Bool) throws
+}
+
+struct UserDefaultsLegacyImportMarkerStore: LegacyImportMarkerStoring {
+  static let key = "legacyImport.completed"
+
+  let defaults: UserDefaults
+
+  init(defaults: UserDefaults = .standard) {
+    self.defaults = defaults
+  }
+
+  func isCompleted() throws -> Bool {
+    defaults.bool(forKey: Self.key)
+  }
+
+  func setCompleted(_ completed: Bool) throws {
+    if completed {
+      defaults.set(true, forKey: Self.key)
+    } else {
+      defaults.removeObject(forKey: Self.key)
+    }
+  }
+}
+
+protocol LegacyCatalogStoring {
+  func load() throws -> CatalogDocument
+  func save(_ document: CatalogDocument) throws
+}
+
+extension CatalogFileStore: LegacyCatalogStoring {}
+
+struct LegacySkippedRecord: Equatable, Sendable {
+  /// 点名跳过原因（typed，无成句文案；呈现归 presentation edge）。
+  enum Reason: Error, Equatable, Sendable {
+    case notDictionary
+    case invalidAddress
+    case invalidPort
+    case invalidEncryptionMethod
+    case missingPassword
+  }
+
+  let index: Int
+  let description: String
+  let reason: Reason
+}
+
+struct LegacyImportReport: Equatable, Sendable {
+  let groupName: String
+  let importedServerCount: Int
+  let skippedRecords: [LegacySkippedRecord]
+  let regeneratedIdentityCount: Int
+}
+
+struct LegacyImportOutcome: Equatable, Sendable {
+  let groupID: NodeID
+  let report: LegacyImportReport
+}
+
+enum LegacyImportError: Error, Equatable {
+  case noSnapshot
+  case alreadyCompleted
+  case malformedSnapshot
+  case commitFailed
+}
+
+struct LegacyImportPlan {
+  let groupID: NodeID
+  let document: CatalogDocument
+  let report: LegacyImportReport
+}
+
+/// Pure planning seam: translates one immutable Legacy snapshot into a new
+/// manual subtree with credentials. No preferences or active target
+/// state enter the plan.
+struct LegacyImportPlanner {
+  static func makePlan(
+    snapshot: LegacySnapshot,
+    existingDocument: CatalogDocument
+  ) throws -> LegacyImportPlan {
+    var catalog = existingDocument.catalog
+    let now = Date()
+    let groupName = nextGroupName(in: catalog)
+    let groupID = try catalog.addGroup(groupName, now: now)
+    let serverImport = try importServers(
+      snapshot.profiles, into: &catalog, groupID: groupID, now: now)
+    let report = LegacyImportReport(
+      groupName: groupName,
+      importedServerCount: serverImport.importedServerCount,
+      skippedRecords: serverImport.skippedRecords,
+      regeneratedIdentityCount: serverImport.regeneratedIdentityCount)
+    return LegacyImportPlan(
+      groupID: groupID,
+      document: CatalogDocument(
+        catalog: catalog, subscriptions: existingDocument.subscriptions,
+        favoriteIDs: existingDocument.favoriteIDs),
+      report: report)
+  }
+}
+
+extension LegacyImportPlanner {
+  private struct ServerImportResult {
+    let skippedRecords: [LegacySkippedRecord]
+    let regeneratedIdentityCount: Int
+    let importedServerCount: Int
+  }
+
+  /// 通过逐字段校验的服务器数据（失败点由跳过记录承载）。
+  private struct ValidatedServer {
+    let address: String
+    let port: Int
+    let method: String
+    let password: String
+  }
+
+  /// 单条档案的校验结果：有效数据或点名跳过记录。
+  private enum ServerValidation {
+    case valid(ValidatedServer)
+    case skipped(LegacySkippedRecord)
+  }
+
+  private static func importServers(
+    _ profiles: [LegacyServerSnapshot],
+    into catalog: inout ConfigurationCatalog,
+    groupID: NodeID,
+    now: Date
+  ) throws -> ServerImportResult {
+    var skippedRecords: [LegacySkippedRecord] = []
+    var regeneratedIdentityCount = 0
+    var importedServerCount = 0
+    let usedLegacyIDs = legacyIDCounts(of: profiles)
+
+    for profile in profiles {
+      switch validatedServer(of: profile) {
+      case .skipped(let skipped):
+        skippedRecords.append(skipped)
+      case .valid(let server):
+        let nodeID: NodeID
+        if let reused = reusableLegacyID(
+          of: profile, usedLegacyIDs: usedLegacyIDs, in: catalog)
+        {
+          nodeID = reused
+        } else {
+          nodeID = .fresh()
+          regeneratedIdentityCount += 1
+        }
+        let fields = ServerFields(
+          address: server.address,
+          port: server.port,
+          encryptionMethod: server.method,
+          password: server.password,
+          remark: profile.remark ?? "",
+          pluginProgram: profile.plugin?.isEmpty == false ? profile.plugin : nil,
+          pluginOptions: profile.pluginOptions.flatMap { $0.isEmpty ? nil : $0 })
+        try catalog.addServer(fields, id: nodeID, to: groupID, now: now)
+        importedServerCount += 1
+      }
+    }
+
+    return ServerImportResult(
+      skippedRecords: skippedRecords,
+      regeneratedIdentityCount: regeneratedIdentityCount,
+      importedServerCount: importedServerCount)
+  }
+
+  /// 逐字段校验并点名失败原因：非字典、地址、端口、加密方式、密码。
+  private static func validatedServer(
+    of profile: LegacyServerSnapshot
+  ) -> ServerValidation {
+    guard profile.isDictionary else {
+      return .skipped(
+        LegacySkippedRecord(
+          index: profile.index, description: String(localized: "第 \(profile.index + 1) 条记录"),
+          reason: .notDictionary))
+    }
+    guard let address = profile.address?.trimmingCharacters(in: .whitespacesAndNewlines),
+      !address.isEmpty, isValidHost(address)
+    else {
+      return .skipped(
+        LegacySkippedRecord(
+          index: profile.index,
+          description: profile.address ?? String(localized: "第 \(profile.index + 1) 条记录"),
+          reason: .invalidAddress))
+    }
+    guard let port = profile.port, (1...65_535).contains(port) else {
+      return .skipped(
+        LegacySkippedRecord(index: profile.index, description: address, reason: .invalidPort))
+    }
+    guard let method = profile.method?.trimmingCharacters(in: .whitespacesAndNewlines),
+      !method.isEmpty
+    else {
+      return .skipped(
+        LegacySkippedRecord(
+          index: profile.index, description: address, reason: .invalidEncryptionMethod))
+    }
+    guard let password = profile.password, !password.isEmpty else {
+      return .skipped(
+        LegacySkippedRecord(index: profile.index, description: address, reason: .missingPassword))
+    }
+    return .valid(
+      ValidatedServer(address: address, port: port, method: method, password: password))
+  }
+
+  /// 旧 UUID 可复用仅当合法、全表唯一且不与目录现有节点等价；否则 nil（发新身份）。
+  private static func reusableLegacyID(
+    of profile: LegacyServerSnapshot, usedLegacyIDs: [String: Int],
+    in catalog: ConfigurationCatalog
+  ) -> NodeID? {
+    guard let rawID = profile.id, UUID(uuidString: rawID) != nil,
+      usedLegacyIDs[legacyIdentityKey(rawID)] == 1, !containsEquivalentNodeID(rawID, in: catalog)
+    else { return nil }
+    return NodeID(rawValue: rawID)
+  }
+
+  private static func legacyIDCounts(of profiles: [LegacyServerSnapshot]) -> [String: Int] {
+    var counts: [String: Int] = [:]
+    for profile in profiles {
+      if let id = profile.id { counts[legacyIdentityKey(id), default: 0] += 1 }
+    }
+    return counts
+  }
+
+  private static func legacyIdentityKey(_ rawID: String) -> String {
+    UUID(uuidString: rawID)?.uuidString.lowercased() ?? rawID
+  }
+
+  private static func containsEquivalentNodeID(
+    _ rawID: String,
+    in catalog: ConfigurationCatalog
+  ) -> Bool {
+    let identityKey = legacyIdentityKey(rawID)
+    return catalog.entries.keys.contains { existingID in
+      existingID.rawValue == rawID || legacyIdentityKey(existingID.rawValue) == identityKey
+    }
+  }
+
+  private static func nextGroupName(in catalog: ConfigurationCatalog) -> String {
+    let base = String(localized: "Legacy 导入")
+    let names = Set(
+      catalog.entries.values.compactMap { entry -> String? in
+        guard case .group(let fields) = entry.kind else { return nil }
+        return fields.name
+      })
+    guard names.contains(base) else { return base }
+    var suffix = 2
+    while names.contains("\(base) \(suffix)") { suffix += 1 }
+    return "\(base) \(suffix)"
+  }
+
+  private static func isValidHost(_ value: String) -> Bool {
+    var ipv4 = in_addr()
+    if value.withCString({ inet_pton(AF_INET, $0, &ipv4) }) == 1 { return true }
+    var ipv6 = in6_addr()
+    if value.withCString({ inet_pton(AF_INET6, $0, &ipv6) }) == 1 { return true }
+    let pattern =
+      "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][a-zA-Z0-9\\-]*[A-Za-z0-9])$"
+    return value.range(of: pattern, options: .regularExpression) != nil
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/LegacyImport/LegacyImportService.swift b/ShadowsocksX-NG2/Domain/LegacyImport/LegacyImportService.swift
new file mode 100644
index 000000000..1b7d983de
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/LegacyImport/LegacyImportService.swift
@@ -0,0 +1,81 @@
+import Foundation
+
+/// Coordinates the pure plan with the catalog, credential store, and import
+/// completion marker. Preferences and activation state are intentionally absent
+/// from this transaction.
+final class LegacyImportService {
+  private let source: LegacySnapshotProviding
+  private let catalogStore: LegacyCatalogStoring
+  private let marker: LegacyImportMarkerStoring
+
+  init(
+    source: LegacySnapshotProviding = UserDefaultsLegacySnapshotProvider(),
+    catalogStore: LegacyCatalogStoring,
+    marker: LegacyImportMarkerStoring = UserDefaultsLegacyImportMarkerStore()
+  ) {
+    self.source = source
+    self.catalogStore = catalogStore
+    self.marker = marker
+  }
+
+  func readSnapshot() throws -> LegacySnapshot? {
+    try source.readSnapshot()
+  }
+
+  func isCompleted() throws -> Bool {
+    try marker.isCompleted()
+  }
+
+  func importCurrentSnapshot(reimport: Bool = false) throws -> LegacyImportOutcome {
+    guard let snapshot = try source.readSnapshot() else {
+      throw LegacyImportError.noSnapshot
+    }
+    return try importSnapshot(snapshot, reimport: reimport)
+  }
+
+  func importSnapshot(_ snapshot: LegacySnapshot, reimport: Bool = false)
+    throws -> LegacyImportOutcome
+  {
+    let wasCompleted = try marker.isCompleted()
+    guard !wasCompleted || reimport else {
+      throw LegacyImportError.alreadyCompleted
+    }
+
+    let originalDocument = try catalogStore.load()
+    let plan = try LegacyImportPlanner.makePlan(
+      snapshot: snapshot, existingDocument: originalDocument)
+    do {
+      try catalogStore.save(plan.document)
+      try marker.setCompleted(true)
+    } catch {
+      _ = rollback(
+        originalDocument: originalDocument,
+        wasCompleted: wasCompleted)
+      throw LegacyImportError.commitFailed
+    }
+
+    return LegacyImportOutcome(
+      groupID: plan.groupID,
+      report: plan.report)
+  }
+}
+
+extension LegacyImportService {
+  fileprivate func rollback(
+    originalDocument: CatalogDocument,
+    wasCompleted: Bool
+  ) -> [String] {
+    var failures: [String] = []
+    do {
+      try marker.setCompleted(wasCompleted)
+    } catch {
+      failures.append("完成标记：\(error)")
+    }
+    do {
+      try catalogStore.save(originalDocument)
+    } catch {
+      failures.append("目录：\(error)")
+    }
+    return failures
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Plugin/BundledDependencyCatalog.swift b/ShadowsocksX-NG2/Domain/Plugin/BundledDependencyCatalog.swift
new file mode 100644
index 000000000..645f5c3ae
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Plugin/BundledDependencyCatalog.swift
@@ -0,0 +1,63 @@
+import Foundation
+
+/// Offline facts for shipped direct dependencies; executable selection does not depend on this data.
+struct BundledDependency: Codable, Equatable, Sendable {
+  let id: String
+  let name: String
+  let projectURL: String
+  let sourceURL: String
+  let distributionURL: String
+  let version: String
+  let licenses: [String]
+  let notices: [String]
+}
+
+struct BundledDependencyCatalog: Sendable {
+  let dependencies: [BundledDependency]
+  private let resourcesURL: URL
+
+  private struct Document: Decodable {
+    let schemaVersion: Int
+    let dependencies: [BundledDependency]
+  }
+
+  enum CatalogError: Error {
+    case invalidMetadata
+    case invalidTextReference(String)
+  }
+
+  init(bundleURL: URL = Bundle.main.bundleURL) throws {
+    resourcesURL = bundleURL.appendingPathComponent("Contents/Resources/ThirdParty")
+    let document = try JSONDecoder().decode(
+      Document.self, from: Data(contentsOf: resourcesURL.appendingPathComponent("catalog.json")))
+    guard document.schemaVersion == 1, !document.dependencies.isEmpty,
+      Set(document.dependencies.map(\.id)).count == document.dependencies.count
+    else { throw CatalogError.invalidMetadata }
+    dependencies = document.dependencies
+    for dependency in dependencies {
+      guard !dependency.id.isEmpty, !dependency.name.isEmpty, !dependency.version.isEmpty,
+        !dependency.licenses.isEmpty,
+        [dependency.projectURL, dependency.sourceURL, dependency.distributionURL].allSatisfy({
+          guard let url = URL(string: $0) else { return false }
+          return url.scheme == "https" && url.host != nil
+        })
+      else { throw CatalogError.invalidMetadata }
+      for reference in dependency.licenses + dependency.notices {
+        _ = try text(at: reference)
+      }
+    }
+  }
+
+  func text(at reference: String) throws -> String {
+    let root = resourcesURL.resolvingSymlinksInPath().standardizedFileURL
+    let url = root.appendingPathComponent(reference).resolvingSymlinksInPath().standardizedFileURL
+    guard !reference.isEmpty, url.path.hasPrefix(root.path + "/") else {
+      throw CatalogError.invalidTextReference(reference)
+    }
+    let text = try String(contentsOf: url, encoding: .utf8)
+    guard !text.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
+      throw CatalogError.invalidTextReference(reference)
+    }
+    return text
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Plugin/MacOSPluginInspection.swift b/ShadowsocksX-NG2/Domain/Plugin/MacOSPluginInspection.swift
new file mode 100644
index 000000000..b24f90b7c
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Plugin/MacOSPluginInspection.swift
@@ -0,0 +1,156 @@
+import Darwin
+import Foundation
+
+struct PluginSecurityFacts: Equatable, Sendable {
+  enum Quarantine: Sendable { case present, absent, unknown }
+  enum Signature: Sendable { case valid, unsigned, invalid, notApplicable, unknown }
+  enum Policy: Sendable { case accepted, rejected, notApplicable, unknown }
+  let quarantine: Quarantine
+  let signature: Signature
+  let policy: Policy
+}
+
+protocol PluginInspecting: Sendable {
+  func inspect(_ executable: URL) async -> PluginSecurityFacts
+}
+
+struct PluginInspectionCommandResult: Sendable {
+  let status: Int32
+  let output: String
+}
+
+/// Read-only evidence, not a prediction that exec will succeed or a security guarantee.
+struct MacOSPluginInspection: PluginInspecting {
+  typealias CommandRunner = @Sendable (URL, [String]) -> PluginInspectionCommandResult?
+  private let runCommand: CommandRunner
+
+  init(
+    runCommand: @escaping CommandRunner = { tool, arguments in Self.run(tool, arguments: arguments)
+    }
+  ) {
+    self.runCommand = runCommand
+  }
+
+  func inspect(_ executable: URL) async -> PluginSecurityFacts {
+    await Task.detached(priority: .utility) { inspectSynchronously(executable) }.value
+  }
+
+  private func inspectSynchronously(_ executable: URL) -> PluginSecurityFacts {
+    let attributeSize = getxattr(executable.path, "com.apple.quarantine", nil, 0, 0, 0)
+    let quarantine: PluginSecurityFacts.Quarantine =
+      attributeSize >= 0 ? .present : (errno == ENOATTR ? .absent : .unknown)
+    let signature: PluginSecurityFacts.Signature
+    let header: Data? = {
+      guard let handle = try? FileHandle(forReadingFrom: executable) else { return nil }
+      defer { try? handle.close() }
+      return try? handle.read(upToCount: 4)
+    }()
+    if header?.starts(with: [0x23, 0x21]) == true {
+      signature = .notApplicable
+    } else if let result = runCommand(
+      URL(fileURLWithPath: "/usr/bin/codesign"),
+      ["--verify", "--strict", "--verbose=2", executable.path])
+    {
+      if result.status == 0 {
+        signature = .valid
+      } else if result.output.contains("not signed at all") {
+        signature = .unsigned
+      } else if result.output.contains("invalid signature")
+        || result.output.contains("code or signature have been modified")
+      {
+        signature = .invalid
+      } else {
+        signature = .unknown
+      }
+    } else {
+      signature = .unknown
+    }
+    let policy: PluginSecurityFacts.Policy
+    if let result = runCommand(
+      URL(fileURLWithPath: "/usr/sbin/spctl"),
+      ["--assess", "--type", "execute", "--verbose=2", executable.path])
+    {
+      if result.status == 0 {
+        policy = .accepted
+      } else if result.output.contains("does not seem to be an app")
+        || result.output.contains("Insufficient Context")
+      {
+        policy = .notApplicable
+      } else if result.output.contains(": rejected") {
+        policy = .rejected
+      } else {
+        policy = .unknown
+      }
+    } else {
+      policy = .unknown
+    }
+    return PluginSecurityFacts(quarantine: quarantine, signature: signature, policy: policy)
+  }
+
+  /// Use a private output file to avoid pipe deadlocks; only read a bounded prefix.
+  /// Only fixed Apple tools run here. The plugin itself is never executed.
+  private static func run(_ tool: URL, arguments: [String]) -> PluginInspectionCommandResult? {
+    let directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("plugin-inspection-\(UUID().uuidString)")
+    guard
+      (try? FileManager.default.createDirectory(
+        at: directory, withIntermediateDirectories: false,
+        attributes: [.posixPermissions: 0o700])) != nil
+    else { return nil }
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let outputURL = directory.appendingPathComponent("output")
+    guard
+      FileManager.default.createFile(
+        atPath: outputURL.path, contents: nil, attributes: [.posixPermissions: 0o600]),
+      let output = try? FileHandle(forWritingTo: outputURL)
+    else { return nil }
+    defer { try? output.close() }
+    let process = Process()
+    process.executableURL = tool
+    process.arguments = arguments
+    process.standardOutput = output
+    process.standardError = output
+    let finished = DispatchSemaphore(value: 0)
+    process.terminationHandler = { _ in finished.signal() }
+    do { try process.run() } catch { return nil }
+    guard finished.wait(timeout: .now() + 3) == .success else {
+      // A timed-out assessment is unknown, never rejected.
+      kill(process.processIdentifier, SIGKILL)
+      _ = finished.wait(timeout: .now() + 1)
+      return nil
+    }
+    guard let input = try? FileHandle(forReadingFrom: outputURL) else { return nil }
+    defer { try? input.close() }
+    guard let data = try? input.read(upToCount: 16_384) else { return nil }
+    return PluginInspectionCommandResult(
+      status: process.terminationStatus, output: String(bytes: data, encoding: .utf8) ?? "")
+  }
+}
+
+/// Reject evidence for another file, including a changed symlink target.
+struct PluginFileIdentity: Equatable, Sendable {
+  let resolvedPath: String
+  let inode: UInt64
+  let device: Int32
+  let size: Int64
+  let modifiedSeconds: Int
+  let modifiedNanoseconds: Int
+  let changedSeconds: Int
+  let changedNanoseconds: Int
+  let permissions: UInt16
+
+  init?(path: String) {
+    let resolved = URL(fileURLWithPath: path).resolvingSymlinksInPath()
+    var facts = stat()
+    guard stat(resolved.path, &facts) == 0 else { return nil }
+    self.resolvedPath = resolved.path
+    self.inode = facts.st_ino
+    self.device = facts.st_dev
+    self.size = facts.st_size
+    self.modifiedSeconds = facts.st_mtimespec.tv_sec
+    self.modifiedNanoseconds = facts.st_mtimespec.tv_nsec
+    self.changedSeconds = facts.st_ctimespec.tv_sec
+    self.changedNanoseconds = facts.st_ctimespec.tv_nsec
+    self.permissions = facts.st_mode
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Plugin/ManagedPluginDefinitions.generated.swift b/ShadowsocksX-NG2/Domain/Plugin/ManagedPluginDefinitions.generated.swift
new file mode 100644
index 000000000..b381840a6
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Plugin/ManagedPluginDefinitions.generated.swift
@@ -0,0 +1,19 @@
+// Generated by Scripts/dependency-metadata.py. Do not edit.
+import Foundation
+
+extension ManagedPluginCatalog {
+  static let definitions: [ManagedPluginInfo] = [
+    ManagedPluginInfo(
+      program: "v2ray-plugin",
+      names: ["v2ray-plugin", "v2ray-plugin-v1"],
+      executableName: "v2ray-plugin",
+      signIdentifier: "com.qiuyuzhou.ShadowsocksX-NG2.plugin.v2ray-plugin",
+      defaultArguments: ["-disableAccessLog"]),
+    ManagedPluginInfo(
+      program: "ck-client",
+      names: ["cloak", "cloak-v2"],
+      executableName: "ck-client",
+      signIdentifier: "com.qiuyuzhou.ShadowsocksX-NG2.plugin.ck-client",
+      defaultArguments: []),
+  ]
+}
diff --git a/ShadowsocksX-NG2/Domain/Plugin/ManagedPluginProviding.swift b/ShadowsocksX-NG2/Domain/Plugin/ManagedPluginProviding.swift
new file mode 100644
index 000000000..d34deabc5
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Plugin/ManagedPluginProviding.swift
@@ -0,0 +1,82 @@
+import Foundation
+
+/// 插件解析 seam：路径、本地启动参数与传输模式，以及一次派生使用的只读目录快照。
+/// nil 表示本地不可用；托管与用户映射共用这一激活语义。
+struct ResolvedPlugin: Equatable, Sendable {
+  let path: String
+  let arguments: [String]
+  var mode: PluginTransportMode = .tcpOnly
+}
+
+protocol PluginExecutableResolving {
+  func resolve(program: String) -> ResolvedPlugin?
+  func catalogSnapshot() -> PluginCatalogSnapshot
+}
+
+extension PluginExecutableResolving {
+  func catalogSnapshot() -> PluginCatalogSnapshot {
+    PluginCatalogSnapshot(
+      entries: ManagedPluginCatalog.plugins.flatMap { info in
+        info.names.map { program in
+          let resolved = resolve(program: program)
+          return PluginCatalogSnapshot.Entry(
+            program: program, path: resolved?.path, source: .managed,
+            availability: resolved == nil ? .missing : .available, managedInfo: info,
+            arguments: resolved?.arguments ?? [], mode: resolved?.mode ?? .tcpOnly)
+        }
+      })
+  }
+}
+
+/// Executable contracts are generated from Vendor manifests, independently of display metadata.
+struct ManagedPluginInfo: Equatable, Sendable {
+  let program: String
+  let names: [String]
+  let executableName: String
+  let signIdentifier: String
+  let defaultArguments: [String]
+  var dependency: BundledDependency?
+}
+
+enum ManagedPluginCatalog {
+  static let plugins = plugins(in: Bundle.main.bundleURL)
+
+  static func plugins(in bundleURL: URL) -> [ManagedPluginInfo] {
+    let catalog = try? BundledDependencyCatalog(bundleURL: bundleURL)
+    return definitions.map { definition in
+      var info = definition
+      info.dependency = catalog?.dependencies.first { $0.id == info.program }
+      return info
+    }
+  }
+
+  static func info(forProgram program: String) -> ManagedPluginInfo? {
+    plugins.first { $0.names.contains(program) }
+  }
+}
+
+/// 生产实现：受管集内且 bundle 内可执行文件在位才返回绝对路径。GUI 仅在生成
+/// 配置时检查可执行文件是否存在，运行时不逐次哈希复验（bundle 签名 +
+/// 公证即信任边界）；受管集外引用一律视为「本版本未提供」，路径只从静态表
+/// 派生，不拼接任何用户输入。
+struct BundleManagedPluginProvider: PluginExecutableResolving {
+  /// 插件宿主 bundle 根；生产为应用 bundle，测试注入临时目录。
+  var bundleURL: URL = Bundle.main.bundleURL
+  var fileManager: FileManager = .default
+
+  func resolve(program: String) -> ResolvedPlugin? {
+    guard let info = ManagedPluginCatalog.info(forProgram: program) else { return nil }
+    let url =
+      bundleURL
+      .appendingPathComponent("Contents/Helpers/Plugins")
+      .appendingPathComponent(info.executableName)
+    guard fileManager.isExecutableFile(atPath: url.path) else { return nil }
+    return ResolvedPlugin(path: url.path, arguments: info.defaultArguments)
+  }
+}
+
+/// 显式「本版本什么都不提供」的实现（测试与不涉插件的场景注入用）：任何插件
+/// 引用都是无效激活候选（点名原因），不是静默失败。
+struct NoManagedPluginProvider: PluginExecutableResolving {
+  func resolve(program: String) -> ResolvedPlugin? { nil }
+}
diff --git a/ShadowsocksX-NG2/Domain/Plugin/PluginCatalog.swift b/ShadowsocksX-NG2/Domain/Plugin/PluginCatalog.swift
new file mode 100644
index 000000000..97ceddb62
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Plugin/PluginCatalog.swift
@@ -0,0 +1,226 @@
+import Combine
+import Foundation
+
+/// Owns mapping intent, publication and asynchronous post-commit work.
+/// File availability is captured anew for each derivation, not cached for the session.
+final class PluginCatalog: ObservableObject, PluginExecutableResolving {
+  enum Change {
+    case save(UserPluginRecord)
+    case remove(UUID)
+    case managedArguments(program: String, arguments: [String])
+    case managedMode(program: String, mode: PluginTransportMode)
+  }
+
+  private struct State {
+    var configuration: PluginConfiguration
+    var generation = 0
+    var unreadable: Bool
+  }
+
+  private let lock = NSLock()
+  private var state: State
+  private let store: any PluginMappingStoring
+  private let managed: BundleManagedPluginProvider
+  private let inspector: any PluginInspecting
+  @MainActor @Published private(set) var securityFacts: [String: PluginSecurityFacts] = [:]
+  @MainActor private var inspectionTasks: [String: Task<Void, Never>] = [:]
+  let didCommit = PassthroughSubject<Int, Never>()
+  @MainActor private var invalidateRuntime: (() -> Void)?
+  @MainActor private var revalidate: (() -> Void)?
+  @MainActor private var converge: (() async -> Void)?
+
+  /// Composition-only wiring. UI submits mapping intent rather than scheduling effects.
+  @MainActor
+  func connect(
+    invalidateRuntime: @escaping () -> Void,
+    revalidate: @escaping () -> Void,
+    converge: @escaping () async -> Void
+  ) {
+    self.invalidateRuntime = invalidateRuntime
+    self.revalidate = revalidate
+    self.converge = converge
+  }
+
+  init(
+    store: any PluginMappingStoring = PluginMappingFileStore(),
+    managed: BundleManagedPluginProvider = BundleManagedPluginProvider(),
+    inspector: any PluginInspecting = MacOSPluginInspection()
+  ) {
+    self.store = store
+    self.managed = managed
+    self.inspector = inspector
+    do {
+      state = State(configuration: try store.load(), unreadable: false)
+    } catch {
+      state = State(configuration: PluginConfiguration(), unreadable: true)
+    }
+  }
+
+  func catalogSnapshot() -> PluginCatalogSnapshot {
+    let captured = lock.withLock { state }
+    return PluginCatalogSnapshot(
+      configuration: captured.configuration, managed: managed, generation: captured.generation,
+      mappingsUnreadable: captured.unreadable)
+  }
+
+  func resolve(program: String) -> ResolvedPlugin? {
+    catalogSnapshot().resolve(program: program)
+  }
+
+  var userRecords: [UserPluginRecord] { lock.withLock { state.configuration.userPlugins } }
+
+  @MainActor
+  func commit(_ changes: [Change]) throws {
+    let captured = lock.withLock { state }
+    guard !captured.unreadable else { throw PluginMappingError.unreadable }
+    var proposed = captured.configuration
+    for change in changes { try apply(change, to: &proposed) }
+    try proposed.validate()
+    guard proposed != captured.configuration else { return }
+    try publishAfterSaving(proposed)
+  }
+
+  private func apply(_ change: Change, to configuration: inout PluginConfiguration) throws {
+    switch change {
+    case .save(let record): try save(record, to: &configuration)
+    case .remove(let id): try remove(id, from: &configuration)
+    case .managedMode(let program, let mode):
+      try set(mode, forManagedProgram: program, in: &configuration)
+    case .managedArguments(let program, let arguments):
+      try set(arguments, forManagedProgram: program, in: &configuration)
+    }
+  }
+
+  private func save(_ original: UserPluginRecord, to configuration: inout PluginConfiguration)
+    throws
+  {
+    var record = original
+    record.names = record.names.map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+    record.path = try validatedPath(record.path)
+    if let index = configuration.userPlugins.firstIndex(where: { $0.id == record.id }) {
+      configuration.userPlugins[index] = record
+    } else {
+      configuration.userPlugins.append(record)
+    }
+  }
+
+  private func remove(_ id: UUID, from configuration: inout PluginConfiguration) throws {
+    guard let index = configuration.userPlugins.firstIndex(where: { $0.id == id }) else {
+      throw PluginMappingError.nameMissing
+    }
+    configuration.userPlugins.remove(at: index)
+  }
+
+  private func set(
+    _ mode: PluginTransportMode, forManagedProgram program: String,
+    in configuration: inout PluginConfiguration
+  ) throws {
+    try requireManagedProgram(program)
+    if mode == .tcpOnly {
+      configuration.managedModes.removeValue(forKey: program)
+    } else {
+      configuration.managedModes[program] = mode
+    }
+  }
+
+  private func set(
+    _ arguments: [String], forManagedProgram program: String,
+    in configuration: inout PluginConfiguration
+  ) throws {
+    try requireManagedProgram(program)
+    if arguments.isEmpty {
+      configuration.managedArguments.removeValue(forKey: program)
+    } else {
+      configuration.managedArguments[program] = arguments
+    }
+  }
+
+  private func requireManagedProgram(_ program: String) throws {
+    guard ManagedPluginCatalog.plugins.contains(where: { $0.program == program }) else {
+      throw PluginMappingError.nameMissing
+    }
+  }
+
+  /// Explicit repair; a corrupt store never silently becomes empty user intent.
+  @MainActor
+  func replaceConfiguration(_ configuration: PluginConfiguration) throws {
+    try configuration.validate()
+    for record in configuration.userPlugins { _ = try validatedPath(record.path) }
+    try publishAfterSaving(configuration)
+  }
+
+  @MainActor
+  private func publishAfterSaving(_ proposed: PluginConfiguration) throws {
+    try store.save(proposed)
+    publish(proposed)
+  }
+
+  /// Retry a failed initial read without replacing or writing user intent.
+  @MainActor
+  func retryReadingMappings() throws {
+    guard lock.withLock({ state.unreadable }) else { return }
+    let mappings = try store.load()
+    publish(mappings)
+  }
+
+  @MainActor
+  private func publish(_ proposed: PluginConfiguration) {
+    objectWillChange.send()
+    let generation = lock.withLock {
+      state.configuration = proposed
+      state.unreadable = false
+      state.generation += 1
+      return state.generation
+    }
+    invalidateRuntime?()
+    revalidate?()
+    didCommit.send(generation)
+    refreshSecurityFacts()
+    if let converge {
+      Task { @MainActor [weak self] in
+        guard let self, self.catalogSnapshot().generation == generation else { return }
+        await converge()
+      }
+    }
+  }
+
+  /// Explicit refresh also serves activation and startup failure diagnostics.
+  @discardableResult
+  @MainActor
+  func refreshSecurityFacts() -> Task<Void, Never> {
+    for task in inspectionTasks.values { task.cancel() }
+    inspectionTasks.removeAll()
+    securityFacts.removeAll()
+    let snapshot = catalogSnapshot()
+    var inspected = Set<UUID>()
+    for entry in snapshot.entries where entry.source == .user {
+      guard let recordID = entry.recordID, inspected.insert(recordID).inserted else { continue }
+      let names = snapshot.entries.filter { $0.recordID == recordID }.map(\.program)
+      guard let path = entry.path, let identity = PluginFileIdentity(path: path) else { continue }
+      let inspector = inspector
+      inspectionTasks[entry.program] = Task { @MainActor [weak self] in
+        guard !Task.isCancelled else { return }
+        let facts = await inspector.inspect(URL(fileURLWithPath: path))
+        guard let self, !Task.isCancelled,
+          self.lock.withLock({ self.state.generation }) == snapshot.generation,
+          PluginFileIdentity(path: path) == identity
+        else { return }
+        for name in names { self.securityFacts[name] = facts }
+        self.inspectionTasks.removeValue(forKey: entry.program)
+      }
+    }
+    let tasks = Array(inspectionTasks.values)
+    return Task { @MainActor in
+      for task in tasks { await task.value }
+    }
+  }
+
+  private func validatedPath(_ path: String) throws -> String {
+    guard path.hasPrefix("/"), !path.contains("\0") else { throw PluginMappingError.invalidPath }
+    var isDirectory: ObjCBool = false
+    guard managed.fileManager.fileExists(atPath: path, isDirectory: &isDirectory),
+      !isDirectory.boolValue, managed.fileManager.isExecutableFile(atPath: path)
+    else { throw PluginMappingError.unavailableFile }
+    return path
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Plugin/PluginCatalogSnapshot.swift b/ShadowsocksX-NG2/Domain/Plugin/PluginCatalogSnapshot.swift
new file mode 100644
index 000000000..fa50d73e8
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Plugin/PluginCatalogSnapshot.swift
@@ -0,0 +1,139 @@
+import Darwin
+import Foundation
+
+/// One derivation uses captured executable facts, never a live mutable mapping.
+struct PluginCatalogSnapshot: PluginExecutableResolving, Equatable, Sendable {
+  enum Source: String, Codable, Sendable {
+    case managed
+    case user
+    case unknown
+  }
+
+  enum Availability: Equatable, Sendable {
+    case available
+    case missing
+    case notExecutable
+    case unreadable
+  }
+
+  struct Entry: Equatable, Sendable {
+    let program: String
+    let path: String?
+    let source: Source
+    let availability: Availability
+    let managedInfo: ManagedPluginInfo?
+    var arguments: [String] = []
+    var mode: PluginTransportMode = .tcpOnly
+    var recordID: UUID?
+  }
+
+  let entries: [Entry]
+  let generation: Int
+  let mappingsUnreadable: Bool
+  var managedRecords: [String: Entry] = [:]
+  var managedArguments: [String: [String]] = [:]
+
+  init(
+    configuration: PluginConfiguration,
+    managed: BundleManagedPluginProvider = BundleManagedPluginProvider(),
+    generation: Int = 0,
+    mappingsUnreadable: Bool = false
+  ) {
+    let managedPlugins = ManagedPluginCatalog.plugins(in: managed.bundleURL)
+    let managedNames = managedPlugins.flatMap(\.names)
+    let userByName = Dictionary(
+      uniqueKeysWithValues: configuration.userPlugins.flatMap { record in
+        record.names.map { ($0, record) }
+      })
+    let programs = Set(managedNames).union(userByName.keys).sorted()
+    self.entries = programs.map { program in
+      let info = managedPlugins.first { $0.names.contains(program) }
+      let user = userByName[program]
+      let source: Source = mappingsUnreadable ? .unknown : (user == nil ? .managed : .user)
+      let path =
+        user?.path
+        ?? managed.bundleURL
+        .appendingPathComponent("Contents/Helpers/Plugins")
+        .appendingPathComponent(info?.executableName ?? program).path
+      let arguments =
+        user?.arguments
+        ?? info.map {
+          $0.defaultArguments + (configuration.managedArguments[$0.program] ?? [])
+        } ?? []
+      return Entry(
+        program: program, path: path, source: source,
+        availability: mappingsUnreadable
+          ? .unreadable : Self.availability(at: path, fileManager: managed.fileManager),
+        managedInfo: source == .managed ? info : nil, arguments: arguments,
+        mode: user?.mode ?? info.flatMap { configuration.managedModes[$0.program] } ?? .tcpOnly,
+        recordID: user?.id)
+    }
+    self.managedRecords = Dictionary(
+      uniqueKeysWithValues: managedPlugins.map { info in
+        let path = managed.bundleURL.appendingPathComponent("Contents/Helpers/Plugins")
+          .appendingPathComponent(info.executableName).path
+        return (
+          info.program,
+          Entry(
+            program: info.program, path: path, source: .managed,
+            availability: mappingsUnreadable
+              ? .unreadable : Self.availability(at: path, fileManager: managed.fileManager),
+            managedInfo: info,
+            arguments: info.defaultArguments + (configuration.managedArguments[info.program] ?? []),
+            mode: configuration.managedModes[info.program] ?? .tcpOnly)
+        )
+      })
+    self.managedArguments = configuration.managedArguments
+    self.generation = generation
+    self.mappingsUnreadable = mappingsUnreadable
+  }
+
+  init(entries: [Entry], generation: Int = 0, mappingsUnreadable: Bool = false) {
+    self.entries = entries
+    self.generation = generation
+    self.mappingsUnreadable = mappingsUnreadable
+  }
+
+  private static func availability(at path: String, fileManager: FileManager) -> Availability {
+    do {
+      let target = URL(fileURLWithPath: path).resolvingSymlinksInPath().path
+      let attributes = try fileManager.attributesOfItem(atPath: target)
+      if attributes[.type] as? FileAttributeType == .typeSymbolicLink {
+        // Foundation leaves broken or unresolvable links unchanged. stat follows
+        // the target and preserves the distinction between absence and read failure.
+        var facts = stat()
+        if stat(path, &facts) != 0 {
+          return errno == ENOENT || errno == ENOTDIR ? .missing : .unreadable
+        } else {
+          return
+            (facts.st_mode & S_IFMT) == S_IFDIR
+            || !fileManager.isExecutableFile(atPath: path) ? .notExecutable : .available
+        }
+      } else if attributes[.type] as? FileAttributeType == .typeDirectory
+        || !fileManager.isExecutableFile(atPath: path)
+      {
+        return .notExecutable
+      } else {
+        return .available
+      }
+    } catch {
+      let failure = error as NSError
+      return
+        failure.domain == NSCocoaErrorDomain
+        && failure.code == NSFileReadNoSuchFileError ? .missing : .unreadable
+    }
+  }
+
+  func entry(for program: String) -> Entry? {
+    entries.first { $0.program == program }
+  }
+
+  func resolve(program: String) -> ResolvedPlugin? {
+    guard !mappingsUnreadable, let entry = entry(for: program),
+      entry.availability == .available, let path = entry.path
+    else { return nil }
+    return ResolvedPlugin(path: path, arguments: entry.arguments, mode: entry.mode)
+  }
+
+  func catalogSnapshot() -> PluginCatalogSnapshot { self }
+}
diff --git a/ShadowsocksX-NG2/Domain/Plugin/PluginMappingFileStore.swift b/ShadowsocksX-NG2/Domain/Plugin/PluginMappingFileStore.swift
new file mode 100644
index 000000000..4126448ab
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Plugin/PluginMappingFileStore.swift
@@ -0,0 +1,168 @@
+import Foundation
+
+struct UserPluginRecord: Codable, Equatable, Identifiable, Sendable {
+  var id: UUID = UUID()
+  var names: [String]
+  var path: String
+  var arguments: [String] = []
+  var mode: PluginTransportMode = .tcpOnly
+
+  enum CodingKeys: String, CodingKey {
+    case id, names, path, arguments
+    case mode = "plugin_mode"
+  }
+
+  init(
+    id: UUID = UUID(), names: [String], path: String, arguments: [String] = [],
+    mode: PluginTransportMode = .tcpOnly
+  ) {
+    self.id = id
+    self.names = names
+    self.path = path
+    self.arguments = arguments
+    self.mode = mode
+  }
+
+  init(from decoder: any Decoder) throws {
+    let values = try decoder.container(keyedBy: CodingKeys.self)
+    id = try values.decode(UUID.self, forKey: .id)
+    names = try values.decode([String].self, forKey: .names)
+    path = try values.decode(String.self, forKey: .path)
+    arguments = try values.decode([String].self, forKey: .arguments)
+    mode =
+      values.contains(.mode) ? try values.decode(PluginTransportMode.self, forKey: .mode) : .tcpOnly
+  }
+}
+
+struct PluginConfiguration: Codable, Equatable, Sendable {
+  var userPlugins: [UserPluginRecord] = []
+  /// Keys are fixed managed-record identities, independent of their aliases.
+  var managedArguments: [String: [String]] = [:]
+  var managedModes: [String: PluginTransportMode] = [:]
+
+  enum CodingKeys: String, CodingKey { case userPlugins, managedArguments, managedModes }
+
+  init(
+    userPlugins: [UserPluginRecord] = [], managedArguments: [String: [String]] = [:],
+    managedModes: [String: PluginTransportMode] = [:]
+  ) {
+    self.userPlugins = userPlugins
+    self.managedArguments = managedArguments
+    self.managedModes = managedModes
+  }
+
+  init(from decoder: any Decoder) throws {
+    let values = try decoder.container(keyedBy: CodingKeys.self)
+    userPlugins = try values.decode([UserPluginRecord].self, forKey: .userPlugins)
+    managedArguments = try values.decode([String: [String]].self, forKey: .managedArguments)
+    managedModes =
+      values.contains(.managedModes)
+      ? try values.decode([String: PluginTransportMode].self, forKey: .managedModes) : [:]
+  }
+
+  func validate() throws {
+    var names = Set<String>()
+    var identities = Set<UUID>()
+    for record in userPlugins {
+      guard identities.insert(record.id).inserted, !record.names.isEmpty else {
+        throw PluginMappingError.invalidName
+      }
+      for name in record.names {
+        guard !name.isEmpty, name == name.trimmingCharacters(in: .whitespacesAndNewlines),
+          !name.contains("\0")
+        else { throw PluginMappingError.invalidName }
+        guard names.insert(name).inserted else { throw PluginMappingError.nameExists }
+      }
+      guard record.path.hasPrefix("/"), !record.path.contains("\0") else {
+        throw PluginMappingError.invalidPath
+      }
+      try Self.validateArguments(record.arguments)
+    }
+    for program in managedModes.keys {
+      guard ManagedPluginCatalog.plugins.contains(where: { $0.program == program }) else {
+        throw PluginMappingError.nameMissing
+      }
+    }
+    for (program, arguments) in managedArguments {
+      guard ManagedPluginCatalog.plugins.contains(where: { $0.program == program }) else {
+        throw PluginMappingError.nameMissing
+      }
+      try Self.validateArguments(arguments)
+    }
+  }
+
+  static func validateArguments(_ arguments: [String]) throws {
+    guard !arguments.contains(where: { $0.contains("\0") }) else {
+      throw PluginMappingError.invalidArguments
+    }
+  }
+}
+
+protocol PluginMappingStoring {
+  func load() throws -> PluginConfiguration
+  func save(_ configuration: PluginConfiguration) throws
+}
+
+enum PluginMappingError: Error, Equatable {
+  case unreadable
+  case unsupportedVersion
+  case invalidName
+  case invalidPath
+  case invalidArguments
+  case unavailableFile
+  case nameExists
+  case nameMissing
+}
+
+struct PluginMappingFileStore: PluginMappingStoring {
+  var fileURL = ApplicationSupportPaths.current.pluginMappingFileURL
+
+  private struct Version: Decodable { let version: Int }
+  private struct LegacyRecord: Decodable {
+    let mappings: [String: String]
+  }
+  private struct Record: Codable {
+    let version: Int
+    let configuration: PluginConfiguration
+  }
+
+  func load() throws -> PluginConfiguration {
+    let data: Data
+    do {
+      data = try Data(contentsOf: fileURL)
+    } catch let error as CocoaError where error.code == .fileReadNoSuchFile {
+      return PluginConfiguration()
+    } catch {
+      throw PluginMappingError.unreadable
+    }
+    do {
+      let decoder = JSONDecoder()
+      let configuration: PluginConfiguration
+      switch try decoder.decode(Version.self, from: data).version {
+      case 1:
+        let legacy = try decoder.decode(LegacyRecord.self, from: data)
+        configuration = PluginConfiguration(
+          userPlugins: legacy.mappings.sorted { $0.key < $1.key }.map {
+            UserPluginRecord(names: [$0.key], path: $0.value)
+          })
+      case 2:
+        configuration = try decoder.decode(Record.self, from: data).configuration
+      default: throw PluginMappingError.unsupportedVersion
+      }
+      try configuration.validate()
+      return configuration
+    } catch PluginMappingError.unsupportedVersion {
+      throw PluginMappingError.unsupportedVersion
+    } catch {
+      throw PluginMappingError.unreadable
+    }
+  }
+
+  func save(_ configuration: PluginConfiguration) throws {
+    try configuration.validate()
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
+    try AtomicFileWriter.write(
+      try encoder.encode(Record(version: 2, configuration: configuration)), to: fileURL)
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Plugin/PluginTransportMode.swift b/ShadowsocksX-NG2/Domain/Plugin/PluginTransportMode.swift
new file mode 100644
index 000000000..59285f989
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Plugin/PluginTransportMode.swift
@@ -0,0 +1,4 @@
+enum PluginTransportMode: String, Codable, CaseIterable, Sendable {
+  case tcpOnly = "tcp_only"
+  case tcpAndUDP = "tcp_and_udp"
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/BuiltinRuleCatalog.swift b/ShadowsocksX-NG2/Domain/Rules/BuiltinRuleCatalog.swift
new file mode 100644
index 000000000..c0b52fa30
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/BuiltinRuleCatalog.swift
@@ -0,0 +1,152 @@
+import Foundation
+
+/// 内置规则目录：从 bundle 资源加载已固定的 geolocation-cn、
+/// china-ipv4 与 gfwlist 快照。普通构建只读本地快照，运行时不抓取或转换；
+/// 快照缺失/损坏/版本不匹配时加载失败，不生成空规则 ACL。
+struct BuiltinRuleCatalog {
+  /// 生产加载缝：bundle 内固定快照（`rules/<source>/snapshot.json`）。
+  static func loadGeolocationCN(from bundle: Bundle = .main) throws -> RuleSnapshot {
+    try loadSnapshot(named: "geolocation-cn", from: bundle)
+  }
+
+  /// china-operator-ip 中国 IPv4 CIDR 直连候选。
+  static func loadChinaIPv4(from bundle: Bundle = .main) throws -> RuleSnapshot {
+    try loadSnapshot(named: "china-ipv4", from: bundle)
+  }
+
+  /// GFWList 代理候选：仅含可准确表达且未被更宽代理规则遮蔽的规则。
+  static func loadGFWList(from bundle: Bundle = .main) throws -> RuleSnapshot {
+    try loadSnapshot(named: "gfwlist", from: bundle)
+  }
+
+  fileprivate static func loadSnapshot(named name: String, from bundle: Bundle) throws
+    -> RuleSnapshot
+  {
+    // folder reference 保留 `rules/<source>/snapshot.json` 目录结构。
+    guard
+      let url = bundle.url(
+        forResource: "snapshot", withExtension: "json", subdirectory: "rules/\(name)")
+    else {
+      throw RuleSnapshotError.missing
+    }
+    return try RuleSnapshotStore(fileURL: url).load()
+  }
+
+  /// 供 ACL 编译的中国直连候选（`.cn` 后缀 + geolocation-cn + china-ipv4）。
+  static func chinaDirectRules(from snapshot: RuleSnapshot) -> [ProxyRule] {
+    snapshot.rules.filter { $0.action == .direct }
+  }
+
+  /// 合并多份快照的直连候选；保持输入顺序（域名在前，CIDR 在后）。
+  static func chinaDirectRules(from snapshots: [RuleSnapshot]) -> [ProxyRule] {
+    snapshots.flatMap { chinaDirectRules(from: $0) }
+  }
+
+  /// 供 ACL 编译的 GFWList 候选：可准确表达且未被遮蔽的规则
+  /// （代理候选 + 未遮蔽例外），两种动作都参与编译。
+  static func gfwlistRules(from snapshot: RuleSnapshot) -> [ProxyRule] {
+    snapshot.rules
+  }
+}
+
+/// App-process source facts. Concurrent consumers share one attempt per source;
+/// successful bundled snapshots never expire, failed attempts require explicit retry.
+actor BuiltinRuleSnapshots {
+  typealias Loader = @Sendable (RulesSource) async throws -> RuleSnapshot
+  private struct Attempt {
+    let id: UUID
+    let task: Task<RuleSnapshot, Error>
+  }
+  private let loader: Loader
+  private var attempts: [RulesSource: Attempt] = [:]
+  private var failures: Set<RulesSource> = []
+
+  init(bundle: Bundle = .main, loader: Loader? = nil) {
+    self.loader =
+      loader ?? { source in
+        guard let kind = source.sourceKind, kind != .custom else {
+          throw RuleSnapshotError.missing
+        }
+        return try BuiltinRuleCatalog.loadSnapshot(named: kind.rawValue, from: bundle)
+      }
+  }
+
+  func load(_ source: RulesSource, retryFailure: Bool = false) async throws -> RuleSnapshot {
+    if retryFailure, failures.remove(source) != nil { attempts[source] = nil }
+    let attempt: Attempt
+    if let existing = attempts[source] {
+      attempt = existing
+    } else {
+      let loader = loader
+      attempt = Attempt(
+        id: UUID(),
+        task: Task.detached(priority: .userInitiated) {
+          let snapshot = try await loader(source)
+          guard let kind = source.sourceKind, kind != .custom else {
+            throw RuleSnapshotError.missing
+          }
+          guard snapshot.metadata.source.kind == kind
+          else { throw RuleSnapshotError.corrupt(detail: "Unexpected rule source") }
+          return snapshot
+        })
+      attempts[source] = attempt
+    }
+    do {
+      return try await attempt.task.value
+    } catch {
+      if attempts[source]?.id == attempt.id { failures.insert(source) }
+      throw error
+    }
+  }
+
+  func browsingSources(
+    sources: [RulesSource] = [.geolocationCN, .chinaIPv4, .gfwlist],
+    retryFailures: Bool = false
+  ) async -> [RulesSource: Result<
+    RuleSnapshot, Error
+  >] {
+    var results: [RulesSource: Result<RuleSnapshot, Error>] = [:]
+    for source in sources {
+      do { results[source] = .success(try await load(source, retryFailure: retryFailures)) } catch {
+        results[source] = .failure(error)
+      }
+    }
+    return results
+  }
+}
+
+/// The same policy supplies runtime candidates and the management collection.
+enum RulePreset: String, Codable, CaseIterable, Hashable, Sendable {
+  case gfwlist = "gfwlist"
+  case chinaDirect = "china-direct"
+  case chinaProxy = "china-proxy"
+
+  init(legacy action: RuleDefaultAction) {
+    self = action == .proxyWhenUnmatched ? .chinaDirect : .gfwlist
+  }
+
+  var defaultAction: RuleDefaultAction {
+    self == .chinaDirect ? .proxyWhenUnmatched : .directWhenUnmatched
+  }
+
+  var matchedAction: RuleAction { self == .chinaDirect ? .direct : .proxy }
+
+  var sources: [RulesSource] {
+    self == .gfwlist ? [.gfwlist] : [.geolocationCN, .chinaIPv4]
+  }
+
+  var label: String {
+    switch self {
+    case .chinaDirect: String(localized: "中国大陆目标直连")
+    case .gfwlist: String(localized: "仅GFW列表内目标代理")
+    case .chinaProxy: String(localized: "中国大陆目标代理")
+    }
+  }
+
+  func rules(from snapshot: RuleSnapshot) -> [ProxyRule] {
+    if self == .gfwlist { return snapshot.rules.filter { $0.action == matchedAction } }
+    return BuiltinRuleCatalog.chinaDirectRules(from: snapshot).map {
+      ProxyRule(action: matchedAction, match: $0.match)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRule.swift b/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRule.swift
new file mode 100644
index 000000000..96548727e
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRule.swift
@@ -0,0 +1,71 @@
+import Foundation
+
+// MARK: - 自定义规则
+
+/// 自定义条目的持久身份与规范化规则值；编辑身份独立于跨来源规则身份。
+struct CustomRule: Equatable, Hashable, Sendable, Identifiable {
+  let id: UUID
+  let rule: ProxyRule
+
+  init(id: UUID = UUID(), action: RuleAction, match: RuleMatch) {
+    self.id = id
+    rule = ProxyRule(action: action, match: match)
+  }
+
+  var action: RuleAction { rule.action }
+  var match: RuleMatch { rule.match }
+  var proxyRule: ProxyRule { rule }
+  var identity: ProxyRule { rule }
+
+  /// 稳定的内容身份（不含 UUID），用于去重与诊断摘要。
+  var contentToken: String {
+    identity.contentToken
+  }
+}
+
+// MARK: - 持久化集合
+
+/// 已保存的自定义条目与跨全部来源的规则停用意图。
+struct CustomRuleDocument: Equatable, Sendable {
+  let rules: [CustomRule]
+  let disabledIdentities: Set<ProxyRule>
+
+  init(rules: [CustomRule], disabledIdentities: Set<ProxyRule> = []) {
+    self.rules = rules
+    self.disabledIdentities = disabledIdentities
+  }
+}
+
+// MARK: - 诊断摘要
+
+/// 自定义规则的安全诊断摘要：只含数量与内容版本，
+/// 不导出原始自定义域名或来源内容。
+struct CustomRuleSummary: Equatable, Sendable {
+  /// 规则条数。
+  let count: Int
+  /// 内容版本：规则内容（动作+匹配）的稳定短摘要。
+  let contentVersion: String
+
+  static func summarizing(_ document: CustomRuleDocument) -> CustomRuleSummary {
+    let tokens =
+      document.rules.map(\.contentToken).sorted()
+      + document.disabledIdentities.map { "disabled:" + $0.contentToken }.sorted()
+    return CustomRuleSummary(
+      count: document.rules.count,
+      contentVersion: String(ProxyACLDocument.digest(tokens.joined(separator: "\n")).prefix(12)))
+  }
+
+  static func summarizing(_ rules: [CustomRule]) -> CustomRuleSummary {
+    CustomRuleSummary(count: rules.count, contentVersion: contentVersion(of: rules))
+  }
+
+  /// 内容版本按 (action, match) 排序后摘要；不含 UUID，重排不改版本。
+  static func contentVersion(of rules: [CustomRule]) -> String {
+    let payload =
+      rules
+      .map(\.contentToken)
+      .sorted()
+      .joined(separator: "\n")
+    return String(ProxyACLDocument.digest(payload).prefix(12))
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRuleEditing.swift b/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRuleEditing.swift
new file mode 100644
index 000000000..def946846
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRuleEditing.swift
@@ -0,0 +1,99 @@
+import Foundation
+
+/// A sheet-local draft bound to saved facts, never part of the browsing snapshot.
+struct CustomRuleDraft: Equatable, Sendable, Identifiable {
+  enum Kind: CaseIterable, Sendable { case ipAddress, cidr, domainSuffix, domainExact }
+  let id: UUID
+  let editingID: UUID?
+  let version: String
+  var kind: Kind = .domainSuffix
+  var content = ""
+  let action: RuleAction
+
+  func normalizedMatch() throws -> RuleMatch {
+    let value = content.trimmingCharacters(in: .whitespacesAndNewlines)
+    switch kind {
+    case .ipAddress, .cidr:
+      guard
+        kind == .ipAddress
+          ? !value.contains("/")
+          : value.split(separator: "/", omittingEmptySubsequences: false).count == 2,
+        !value.hasPrefix("/"), !value.hasSuffix("/")
+      else { throw RuleMatchError.invalidCIDR(value) }
+      return try value.contains(":") ? RuleMatch(ipv6CIDR: value) : RuleMatch(ipv4CIDR: value)
+    case .domainExact: return try RuleMatch(domainExact: value)
+    case .domainSuffix: return try RuleMatch(nationalDomainSuffix: value)
+    }
+  }
+}
+
+struct CustomRulePreview: Equatable, Sendable {
+  enum Failure: Equatable, Sendable {
+    case incompleteCollection, busy, staleDraft
+    case invalidInput(CustomRuleDraft.Kind)
+    case duplicate, fixedLocalConflict, fixedPolicyDisablement
+  }
+  var failure: Failure?
+  var rule: CustomRule?
+  var row: RulesRow?
+  var inheritsDisablement = false
+  var document: CustomRuleDocument?
+  var displayContent: String? { rule?.identity.match.editingContent }
+}
+
+enum CustomRuleSaveResult: Equatable, Sendable {
+  case unavailable(CustomRulePreview.Failure)
+  case committed(CustomRuleUpdateOutcome)
+}
+
+extension RuleMatch {
+  var editingKind: CustomRuleDraft.Kind {
+    switch pattern {
+    case .domainExact: .domainExact
+    case .domainSuffix: .domainSuffix
+    case .ipv4CIDR(let value): value.hasSuffix("/32") ? .ipAddress : .cidr
+    case .ipv6CIDR(let value): value.hasSuffix("/128") ? .ipAddress : .cidr
+    }
+  }
+
+  var editingContent: String {
+    if editingKind == .ipAddress { return String(browsingContent.split(separator: "/")[0]) }
+    return browsingContent
+  }
+}
+
+extension RulesCollection {
+  func previewCustomRule(_ draft: CustomRuleDraft) -> CustomRulePreview {
+    guard let document = userDocument else {
+      return CustomRulePreview(failure: .incompleteCollection)
+    }
+    let match: RuleMatch
+    do { match = try draft.normalizedMatch() } catch {
+      return CustomRulePreview(failure: .invalidInput(draft.kind))
+    }
+    let previous = document.rules.first { $0.id == draft.editingID }
+    guard draft.editingID == nil || previous != nil else {
+      return CustomRulePreview(failure: .staleDraft)
+    }
+    let rule = CustomRule(
+      id: draft.id, action: preset.matchedAction, match: match)
+    let others = document.rules.filter { $0.id != draft.editingID }
+    guard !others.contains(where: { $0.identity == rule.identity }) else {
+      return CustomRulePreview(failure: .duplicate, rule: rule)
+    }
+    guard CustomRuleValidator.fixedLocalRejection(for: rule) == nil else {
+      return CustomRulePreview(failure: .fixedLocalConflict, rule: rule)
+    }
+    var disabled = document.disabledIdentities
+    let inherits = previous.map { disabled.contains($0.identity) } ?? false
+    if inherits {
+      guard rule.action != .direct || !RuleCoverage.fixedLocalMatches.contains(rule.identity.match)
+      else { return CustomRulePreview(failure: .fixedPolicyDisablement, rule: rule) }
+      disabled.insert(rule.identity)
+    }
+    let updated = CustomRuleDocument(rules: others + [rule], disabledIdentities: disabled)
+    return CustomRulePreview(
+      rule: rule, row: previewRow(identity: rule.identity, document: updated),
+      inheritsDisablement: inherits && previous?.identity != rule.identity, document: updated)
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRuleStore.swift b/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRuleStore.swift
new file mode 100644
index 000000000..0f8a4c698
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRuleStore.swift
@@ -0,0 +1,177 @@
+import Foundation
+
+enum CustomRuleStoreError: Error, Equatable, Sendable {
+  case missing
+  case corrupt(detail: String)
+  case schemaVersionMismatch(found: Int, expected: Int)
+  case ioFailure(detail: String)
+}
+
+/// 自定义规则持久化：独立 JSON 文档，原子写盘。
+/// Saving intent is independent of subsequent ACL application and runtime recovery.
+struct CustomRuleStore {
+  static let currentSchemaVersion = 4
+
+  let fileURL: URL
+  let baseURL: URL
+  let preset: RulePreset?
+
+  init(fileURL: URL = CustomRuleStore.defaultFileURL()) {
+    self.fileURL = fileURL
+    self.baseURL = fileURL
+    self.preset = nil
+  }
+
+  init(preset: RulePreset, baseURL: URL = CustomRuleStore.defaultFileURL()) {
+    self.baseURL = baseURL
+    self.preset = preset
+    self.fileURL = baseURL.deletingLastPathComponent()
+      .appendingPathComponent("rule-presets", isDirectory: true)
+      .appendingPathComponent(preset.rawValue, isDirectory: true)
+      .appendingPathComponent(baseURL.lastPathComponent)
+  }
+
+  static func defaultFileURL() -> URL {
+    ApplicationSupportPaths.current.customRulesFileURL
+  }
+
+  /// 读取规则集合；文件不存在视为无自定义规则。
+  func load() throws -> [CustomRule] { try loadDocument().rules }
+
+  func loadDocument() throws -> CustomRuleDocument {
+    let data: Data
+    do {
+      data = try Data(contentsOf: fileURL)
+    } catch let error as CocoaError where error.code == .fileReadNoSuchFile {
+      return CustomRuleDocument(rules: [])
+    } catch {
+      throw CustomRuleStoreError.ioFailure(detail: String(describing: error))
+    }
+    let document: CustomRuleDocument
+    do {
+      let stored = try JSONDecoder().decode(StoredCustomRuleDocument.self, from: data)
+      let decoded = try stored.domain()
+      if let preset, stored.schemaVersion < Self.currentSchemaVersion {
+        document = CustomRuleDocument(
+          rules: decoded.rules.filter { $0.action == preset.matchedAction },
+          disabledIdentities: decoded.disabledIdentities)
+      } else {
+        try validateActions(decoded)
+        document = decoded
+      }
+    } catch let error as CustomRuleStoreError {
+      throw error
+    } catch {
+      throw CustomRuleStoreError.corrupt(detail: String(describing: error))
+    }
+    return document
+  }
+
+  /// 原子写入完整规则集合。
+  func save(_ rules: [CustomRule]) throws {
+    let old = try loadDocument()
+    try saveDocument(CustomRuleDocument(rules: rules, disabledIdentities: old.disabledIdentities))
+  }
+
+  func saveDocument(_ document: CustomRuleDocument) throws {
+    try validateActions(document)
+    let data = try Self.encode(document)
+    _ = try Self.decode(data)
+    do {
+      try AtomicFileWriter.write(data, to: fileURL)
+    } catch {
+      throw CustomRuleStoreError.ioFailure(detail: String(describing: error))
+    }
+  }
+
+  private func validateActions(_ document: CustomRuleDocument) throws {
+    guard let preset else { return }
+    guard document.rules.allSatisfy({ $0.action == preset.matchedAction }) else {
+      throw CustomRuleStoreError.corrupt(detail: "Custom rule action must match its rule scheme")
+    }
+  }
+
+  /// 安全摘要：数量 + 内容版本。
+  func summary() throws -> CustomRuleSummary {
+    CustomRuleSummary.summarizing(try loadDocument())
+  }
+
+  static func decode(_ data: Data) throws -> CustomRuleDocument {
+    try JSONDecoder().decode(StoredCustomRuleDocument.self, from: data).domain()
+  }
+
+  static func encode(_ document: CustomRuleDocument) throws -> Data {
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
+    return try encoder.encode(StoredCustomRuleDocument(document))
+  }
+}
+
+private struct StoredCustomRule: Codable {
+  let id: UUID
+  let rule: StoredProxyRule
+
+  init(_ custom: CustomRule) {
+    id = custom.id
+    rule = StoredProxyRule(custom.rule)
+  }
+
+  private enum CodingKeys: CodingKey { case id }
+
+  init(from decoder: Decoder) throws {
+    id = try decoder.container(keyedBy: CodingKeys.self).decode(UUID.self, forKey: .id)
+    rule = try StoredProxyRule(from: decoder)
+  }
+
+  func encode(to encoder: Encoder) throws {
+    var values = encoder.container(keyedBy: CodingKeys.self)
+    try values.encode(id, forKey: .id)
+    try rule.encode(to: encoder)
+  }
+
+  func domain() throws -> CustomRule {
+    let value = try rule.domain()
+    guard !value.match.isFixedLocalSuffix else {
+      throw CustomRuleStoreError.corrupt(detail: "Fixed local suffix is not a custom rule")
+    }
+    return CustomRule(id: id, action: value.action, match: value.match)
+  }
+}
+
+private struct StoredCustomRuleDocument: Codable {
+  let schemaVersion: Int
+  let rules: [StoredCustomRule]
+  let disabledIdentities: [StoredProxyRule]
+
+  init(_ document: CustomRuleDocument) {
+    schemaVersion = CustomRuleStore.currentSchemaVersion
+    rules = document.rules.map(StoredCustomRule.init)
+    disabledIdentities = document.disabledIdentities.sorted { $0.contentToken < $1.contentToken }
+      .map(StoredProxyRule.init)
+  }
+
+  private enum CodingKeys: CodingKey { case schemaVersion, rules, disabledIdentities }
+
+  init(from decoder: Decoder) throws {
+    let values = try decoder.container(keyedBy: CodingKeys.self)
+    schemaVersion = try values.decode(Int.self, forKey: .schemaVersion)
+    guard (1...CustomRuleStore.currentSchemaVersion).contains(schemaVersion) else {
+      throw CustomRuleStoreError.schemaVersionMismatch(
+        found: schemaVersion, expected: CustomRuleStore.currentSchemaVersion)
+    }
+    rules = try values.decode([StoredCustomRule].self, forKey: .rules)
+    disabledIdentities =
+      schemaVersion == 1
+      ? [] : try values.decode([StoredProxyRule].self, forKey: .disabledIdentities)
+  }
+
+  func domain() throws -> CustomRuleDocument {
+    let custom = try rules.map { try $0.domain() }
+    let disabled = try disabledIdentities.map { try $0.domain() }
+    guard Set(custom.map(\.id)).count == custom.count,
+      Set(custom.map(\.rule)).count == custom.count,
+      Set(disabled).count == disabled.count
+    else { throw CustomRuleStoreError.corrupt(detail: "Duplicate custom rule records") }
+    return CustomRuleDocument(rules: custom, disabledIdentities: Set(disabled))
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRuleValidator.swift b/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRuleValidator.swift
new file mode 100644
index 000000000..ba63728ee
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/Custom/CustomRuleValidator.swift
@@ -0,0 +1,371 @@
+import Darwin
+import Foundation
+
+// MARK: - CIDR 解析
+
+enum AddressFamily: Equatable, Sendable {
+  case ipv4
+  case ipv6
+}
+
+struct ParsedCIDR: Equatable, Sendable {
+  let family: AddressFamily
+  let bytes: [UInt8]
+  let prefixLength: Int
+}
+
+// MARK: - 拒绝原因
+
+/// Blocking custom-rule validation errors. Shadowing is a relationship, not an error.
+enum CustomRuleRejection: Equatable, Sendable {
+  /// 代理动作覆盖固定本地范围（回环/私有/链路本地/localhost/*.local/无点主机名）。
+  /// 应用固定的本地绕过规则始终优先于用户代理规则；冲突规则不会生效。
+  case conflictsWithFixedLocalScope
+  /// 同动作+同匹配条件重复。
+  case duplicate
+
+  var label: String {
+    switch self {
+    case .conflictsWithFixedLocalScope:
+      return "与固定本地范围冲突"
+    case .duplicate:
+      return "重复规则"
+    }
+  }
+}
+
+/// 被拒绝的自定义规则及其可解释原因。
+struct RejectedCustomRule: Equatable, Sendable {
+  let rule: CustomRule
+  let reason: CustomRuleRejection
+  /// 可解释说明：覆盖/遮蔽方的匹配条件描述，不含无关来源内容。
+  let explanation: String
+}
+
+/// Valid candidates, blocking errors, and nonblocking coverage explanations.
+struct CustomRuleValidationResult: Equatable, Sendable {
+  let accepted: [ProxyRule]
+  let rejected: [RejectedCustomRule]
+  var relationships: [RuleRelationship] = []
+}
+
+// MARK: - 覆盖判定
+
+/// 匹配条件的覆盖/相交判定：用于固定本地冲突与 ACL 优先级遮蔽检查。
+enum RuleCoverage {
+  // MARK: 域名
+
+  /// `covering` 的域名目标集合是否包含 `covered` 的域名目标集合。
+  static func domainCovers(_ covering: RuleMatch, _ covered: RuleMatch) -> Bool {
+    guard let coveringDomain = domainValue(covering), let coveredDomain = domainValue(covered)
+    else { return false }
+    let coveringIsSuffix = isDomainSuffix(covering)
+    let coveredIsSuffix = isDomainSuffix(covered)
+    switch (coveringIsSuffix, coveredIsSuffix) {
+    case (true, _):
+      // 后缀覆盖：目标域等于后缀，或是后缀的子域。
+      return coveredDomain == coveringDomain
+        || coveredDomain.hasSuffix("." + coveringDomain)
+    case (false, true):
+      // 精确规则无法覆盖后缀规则（后缀还含子域）。
+      return false
+    case (false, false):
+      return coveredDomain == coveringDomain
+    }
+  }
+
+  /// 域名目标集合是否相交（用于固定本地冲突）。
+  static func domainIntersects(_ lhs: RuleMatch, _ rhs: RuleMatch) -> Bool {
+    // 任一覆盖另一即相交；后缀的点分隔边界确保互不覆盖的两个后缀不相交。
+    domainCovers(lhs, rhs) || domainCovers(rhs, lhs)
+  }
+
+  /// 是否命中固定本地主机模式：`localhost`、`*.local`、无点主机名。
+  static func matchesFixedLocalHost(_ match: RuleMatch) -> Bool {
+    guard let domain = domainValue(match) else { return false }
+    let isSuffix = isDomainSuffix(match)
+    // 无点主机名（含 `local` 本身）。
+    if !domain.contains(".") {
+      return true
+    }
+    // `*.local` / `local` 后缀。
+    if isSuffix {
+      return domain == "local" || domain.hasSuffix(".local")
+    }
+    return domain == "localhost" || domain.hasSuffix(".local") || domain.hasSuffix(".localhost")
+  }
+
+  /// 代理动作的域名规则是否与固定本地主机范围冲突。
+  static func domainConflictsWithFixedLocal(_ match: RuleMatch) -> Bool {
+    // 固定本地 ACL 主机规则：||localhost、||local、^[^.]+$。
+    let fixedLocalHostMatches: [RuleMatch] = [
+      .localhostSuffix,
+      .localSuffix,
+    ]
+    if matchesFixedLocalHost(match) { return true }
+    for fixed in fixedLocalHostMatches where domainIntersects(match, fixed) {
+      return true
+    }
+    return false
+  }
+
+  // MARK: IP
+
+  /// `covering` 的 IP 目标集合是否包含 `covered` 的 IP 目标集合（含 mapped 跨家族匹配）。
+  static func ipCovers(_ covering: RuleMatch, _ covered: RuleMatch) -> Bool {
+    guard let outer = matchingCIDR(covering), let inner = matchingCIDR(covered)
+    else { return false }
+    return outer.prefixLength <= inner.prefixLength
+      && networkContains(outer: outer, inner: inner)
+  }
+
+  /// IP 目标集合是否相交。
+  static func ipIntersects(_ lhs: RuleMatch, _ rhs: RuleMatch) -> Bool {
+    guard let left = matchingCIDR(lhs), let right = matchingCIDR(rhs)
+    else { return false }
+    return networkContains(outer: left, inner: right) || networkContains(outer: right, inner: left)
+  }
+
+  /// 代理动作的 IP 规则是否与固定本地 IP 范围冲突。
+  static func ipConflictsWithFixedLocal(_ match: RuleMatch) -> Bool {
+    for range in FixedLocalProxyRanges.ipRanges {
+      if let fixed = parseFixedLocalCIDR(range), ipIntersects(match, fixed) {
+        return true
+      }
+    }
+    return false
+  }
+
+  static func winningAction(for match: RuleMatch) -> RuleAction {
+    switch match.pattern {
+    case .domainExact, .domainSuffix: .proxy
+    case .ipv4CIDR, .ipv6CIDR: .direct
+    }
+  }
+
+  static func intersects(_ lhs: RuleMatch, _ rhs: RuleMatch) -> Bool {
+    domainIntersects(lhs, rhs) || ipIntersects(lhs, rhs)
+  }
+
+  static func fullyCovered(_ target: RuleMatch, by matches: [RuleMatch]) -> Bool {
+    if matches.contains(where: { domainCovers($0, target) }) { return true }
+    guard let range = matchingCIDR(target) else { return false }
+    return fullyCovered(range, by: matches.compactMap { matchingCIDR($0) })
+  }
+
+  /// IPv4 and its mapped IPv6 image match the same addresses in sslocal v1.26.0.
+  /// Identity keeps the original family; coverage uses the common IPv6 space.
+  private static func matchingCIDR(_ match: RuleMatch) -> ParsedCIDR? {
+    guard let range = parseCIDR(match) else { return nil }
+    guard range.family == .ipv4 else { return range }
+    return ParsedCIDR(
+      family: .ipv6, bytes: Array(repeating: 0, count: 10) + [255, 255] + range.bytes,
+      prefixLength: 96 + range.prefixLength)
+  }
+
+  /// Several disjoint narrower CIDRs can together cover a whole range.
+  private static func fullyCovered(_ target: ParsedCIDR, by ranges: [ParsedCIDR]) -> Bool {
+    let overlapping = ranges.filter {
+      networkContains(outer: $0, inner: target) || networkContains(outer: target, inner: $0)
+    }
+    if overlapping.contains(where: {
+      $0.prefixLength <= target.prefixLength && networkContains(outer: $0, inner: target)
+    }) {
+      return true
+    }
+    guard !overlapping.isEmpty, target.prefixLength < 128 else { return false }
+    let nextPrefix = target.prefixLength + 1
+    var upperBytes = target.bytes
+    upperBytes[target.prefixLength / 8] |= UInt8(1) << (7 - target.prefixLength % 8)
+    let lower = ParsedCIDR(family: .ipv6, bytes: target.bytes, prefixLength: nextPrefix)
+    let upper = ParsedCIDR(family: .ipv6, bytes: upperBytes, prefixLength: nextPrefix)
+    return fullyCovered(lower, by: overlapping) && fullyCovered(upper, by: overlapping)
+  }
+
+  // MARK: 解析
+
+  static func parseCIDR(_ match: RuleMatch) -> ParsedCIDR? {
+    switch match.pattern {
+    case .ipv4CIDR(let cidr):
+      return parseCIDRString(cidr, family: .ipv4, maxPrefix: 32)
+    case .ipv6CIDR(let cidr):
+      return parseCIDRString(cidr, family: .ipv6, maxPrefix: 128)
+    case .domainExact, .domainSuffix:
+      return nil
+    }
+  }
+
+  private static func parseFixedLocalCIDR(_ raw: String) -> RuleMatch? {
+    if raw.contains(":") {
+      return try? RuleMatch(ipv6CIDR: raw)
+    }
+    return try? RuleMatch(ipv4CIDR: raw)
+  }
+
+  private static func parseCIDRString(
+    _ cidr: String, family: AddressFamily, maxPrefix: Int
+  ) -> ParsedCIDR? {
+    let parts = cidr.split(separator: "/", maxSplits: 1)
+    guard !parts.isEmpty else { return nil }
+    let addressPart = String(parts[0])
+    let prefixLength: Int
+    if parts.count == 2 {
+      guard let parsed = Int(parts[1]), (0...maxPrefix).contains(parsed) else { return nil }
+      prefixLength = parsed
+    } else {
+      prefixLength = maxPrefix
+    }
+    switch family {
+    case .ipv4:
+      var address = in_addr()
+      guard addressPart.withCString({ inet_pton(AF_INET, $0, &address) }) == 1 else { return nil }
+      let host = UInt32(bigEndian: address.s_addr)
+      let mask: UInt32 = prefixLength == 0 ? 0 : UInt32.max << (32 - prefixLength)
+      let network = host & mask
+      let bytes = withUnsafeBytes(of: network.bigEndian) { Array($0) }
+      return ParsedCIDR(family: .ipv4, bytes: bytes, prefixLength: prefixLength)
+    case .ipv6:
+      var address = in6_addr()
+      guard addressPart.withCString({ inet_pton(AF_INET6, $0, &address) }) == 1 else { return nil }
+      var bytes = withUnsafeBytes(of: address) { Array($0) }
+      for index in 0..<16 {
+        let bitStart = index * 8
+        if prefixLength >= bitStart + 8 { continue }
+        if prefixLength <= bitStart {
+          bytes[index] = 0
+        } else {
+          let keep = prefixLength - bitStart
+          bytes[index] &= UInt8.max << (8 - keep)
+        }
+      }
+      return ParsedCIDR(family: .ipv6, bytes: bytes, prefixLength: prefixLength)
+    }
+  }
+
+  private static func networkContains(outer: ParsedCIDR, inner: ParsedCIDR) -> Bool {
+    let fullBytes = outer.prefixLength / 8
+    let remainderBits = outer.prefixLength % 8
+    guard outer.bytes.count == inner.bytes.count else { return false }
+    for index in 0..<fullBytes where outer.bytes[index] != inner.bytes[index] {
+      return false
+    }
+    if remainderBits > 0 {
+      let mask = UInt8.max << (8 - remainderBits)
+      guard (outer.bytes[fullBytes] & mask) == (inner.bytes[fullBytes] & mask) else {
+        return false
+      }
+    }
+    return true
+  }
+
+  private static func domainValue(_ match: RuleMatch) -> String? {
+    switch match.pattern {
+    case .domainExact(let domain), .domainSuffix(let domain):
+      return domain
+    case .ipv4CIDR, .ipv6CIDR:
+      return nil
+    }
+  }
+
+  private static func isDomainSuffix(_ match: RuleMatch) -> Bool {
+    if case .domainSuffix = match.pattern { return true }
+    return false
+  }
+}
+
+// MARK: - 校验器
+
+/// Reject only duplicate custom identities and fixed-local conflicts. Analyze
+/// coverage against the complete valid set using the runtime's expressed actions.
+/// Accepted candidates retain saved intent; relationships never remove entries.
+enum CustomRuleValidator {
+  static func validate(
+    custom: [CustomRule],
+    builtIn: [ProxyRule] = [],
+    defaultAction: RuleDefaultAction
+  ) -> CustomRuleValidationResult {
+    let validated = hardValidation(custom: custom)
+    let candidates = builtIn + validated.accepted
+    let expressed = candidates.filter { defaultAction.expresses($0.action) }
+    let analysis = RuleAnalysis(rules: expressed, subjects: validated.accepted)
+    return CustomRuleValidationResult(
+      accepted: validated.accepted, rejected: validated.rejected,
+      relationships: analysis.relationships)
+  }
+
+  /// Persistence and ACL compilation need blocking validation, not browsing explanations.
+  static func hardValidation(custom: [CustomRule]) -> CustomRuleValidationResult {
+    var accepted: [ProxyRule] = []
+    var rejected: [RejectedCustomRule] = []
+    let counts = Dictionary(grouping: custom, by: \.contentToken).mapValues(\.count)
+    for rule in custom.sorted(by: {
+      ($0.contentToken, $0.id.uuidString) < ($1.contentToken, $1.id.uuidString)
+    }) {
+      if counts[rule.contentToken, default: 0] > 1 {
+        rejected.append(
+          RejectedCustomRule(
+            rule: rule, reason: .duplicate, explanation: "同动作同匹配条件的规则已存在"))
+      } else if let rejection = fixedLocalRejection(for: rule) {
+        rejected.append(rejection)
+      } else {
+        accepted.append(rule.proxyRule)
+      }
+    }
+    return CustomRuleValidationResult(accepted: accepted, rejected: rejected)
+  }
+
+  /// 单条规则的固定本地冲突检查（保存与编译共用）。
+  static func fixedLocalRejection(for rule: CustomRule) -> RejectedCustomRule? {
+    guard rule.action == .proxy else { return nil }
+    let conflicts: Bool
+    switch rule.identity.match.pattern {
+    case .domainExact, .domainSuffix:
+      conflicts = RuleCoverage.domainConflictsWithFixedLocal(rule.identity.match)
+    case .ipv4CIDR, .ipv6CIDR:
+      conflicts = RuleCoverage.ipConflictsWithFixedLocal(rule.identity.match)
+    }
+    guard conflicts else { return nil }
+    return RejectedCustomRule(
+      rule: rule,
+      reason: .conflictsWithFixedLocalScope,
+      explanation: "应用固定的本地绕过规则优先；这些本地目标不会经代理")
+  }
+
+}
+
+/// Pure runtime projection of the selected preset’s enabled candidates.
+enum RuleRuntimeCompiler {
+  struct Input: Sendable {
+    let source: SslocalRuntimeDocument
+    let mode: ProxyMode
+    let defaultAction: RuleDefaultAction
+    let document: CustomRuleDocument?
+    let builtIn: [ProxyRule]
+    let aclURL: URL
+  }
+
+  static func compile(_ input: Input) -> SslocalRuntimeDocument {
+    let source = input.source
+    let mode = input.mode
+    let defaultAction = input.defaultAction
+    let document = input.document
+    let builtIn = input.builtIn
+    let aclURL = input.aclURL
+    switch mode {
+    case .direct: return source.replacingACL(.direct(at: aclURL))
+    case .global: return source.replacingACL(.global(at: aclURL))
+    case .rule:
+      let document = document ?? CustomRuleDocument(rules: [])
+      let custom = document.rules.filter {
+        $0.action != defaultAction.fallbackAction
+          && !document.disabledIdentities.contains($0.identity)
+      }
+      let enabled = builtIn.filter { !document.disabledIdentities.contains($0) }
+      let validated = CustomRuleValidator.hardValidation(custom: custom)
+      let candidates = RuleAnalysis.runtimeCandidates(
+        enabled + validated.accepted, defaultAction: defaultAction)
+      return source.replacingACL(
+        .rule(at: aclURL, defaultAction: defaultAction, rules: candidates))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/Custom/RuleDocumentSession.swift b/ShadowsocksX-NG2/Domain/Rules/Custom/RuleDocumentSession.swift
new file mode 100644
index 000000000..528965248
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/Custom/RuleDocumentSession.swift
@@ -0,0 +1,86 @@
+import Foundation
+
+// MARK: - 自定义规则更新结果
+
+/// The result of accepting and saving a rule document, independent of runtime.
+/// `busy`/`superseded` are transaction-gate rejections: no save was attempted.
+enum CustomRuleUpdateOutcome: Equatable, Sendable {
+  /// 规则已保存；运行规则模式时应用。
+  case saved
+  /// 校验拒绝：整批不落地，旧规则保持不变；附可解释原因。
+  case rejected([RejectedCustomRule])
+  /// 持久化失败：旧规则保持不变。
+  case persistenceFailed
+  case busy
+  /// 事务门拒绝：意图捕获后事实已前进（集合版本/完整性变化），本次更新未尝试保存。
+  case superseded
+  case invalidDocument(detail: String)
+
+  var isSuccess: Bool {
+    switch self {
+    case .saved: true
+    default: false
+    }
+  }
+}
+
+/// Final persisted facts, independent of whether runtime application succeeded.
+struct RuleDocumentCommit: Sendable {
+  let outcome: CustomRuleUpdateOutcome
+  let document: CustomRuleDocument?
+}
+
+/// One saved-document owner per preset. Only successful atomic saves replace
+/// loaded facts; runtime recovery never restores an older rule document.
+@MainActor
+final class RuleDocumentSession {
+  private let store: CustomRuleStore
+  private(set) var current: CustomRuleDocument?
+  private(set) var revision = 0
+
+  init(store: CustomRuleStore) { self.store = store }
+
+  func load() throws -> CustomRuleDocument {
+    if let current { return current }
+    let loaded = try store.loadDocument()
+    current = loaded
+    return loaded
+  }
+
+  func commit(_ document: CustomRuleDocument) -> RuleDocumentCommit {
+    _ = try? load()
+    let rejected = CustomRuleValidator.hardValidation(custom: document.rules).rejected
+    guard rejected.isEmpty else {
+      return RuleDocumentCommit(outcome: .rejected(rejected), document: current)
+    }
+    if let preset = store.preset,
+      document.rules.contains(where: { $0.action != preset.matchedAction })
+    {
+      return RuleDocumentCommit(
+        outcome: .invalidDocument(detail: "Custom rule action must match its rule scheme"),
+        document: current)
+    }
+    guard
+      document.disabledIdentities.isDisjoint(
+        with: Set(RuleCoverage.fixedLocalMatches.map { ProxyRule(action: .direct, match: $0) }))
+    else {
+      return RuleDocumentCommit(
+        outcome: .invalidDocument(detail: "Fixed local policy cannot be disabled"),
+        document: current)
+    }
+    do {
+      _ = try load()
+      try save(document)
+      return RuleDocumentCommit(outcome: .saved, document: current)
+    } catch {
+      RuntimeLog.emit(.runtimePersistFailed(detail: String(describing: error)))
+      return RuleDocumentCommit(outcome: .persistenceFailed, document: current)
+    }
+  }
+
+  private func save(_ document: CustomRuleDocument) throws {
+    try store.saveDocument(document)
+    if current != document { revision += 1 }
+    current = document
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/OfflineRuleMatcher.swift b/ShadowsocksX-NG2/Domain/Rules/OfflineRuleMatcher.swift
new file mode 100644
index 000000000..e40b861cc
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/OfflineRuleMatcher.swift
@@ -0,0 +1,117 @@
+import Foundation
+
+/// The preset’s full saved collection is the context; no runtime or network dependencies.
+enum OfflineRuleMatcher {
+  enum Outcome: Equatable, Sendable { case proxy, direct }
+  enum Explanation: Equatable, Sendable {
+    case fixedLocal, domainProxy, ipDirect, singleAction, defaultAction
+  }
+  enum Failure: Error, Equatable, Sendable { case invalidTarget, incompleteCollection }
+
+  struct Result: Equatable, Sendable {
+    let version: String
+    let target: String
+    let outcome: Outcome
+    let domainWithoutDNS: Bool
+    let deciding: [RulesRow]
+    let otherMatches: [RulesRow]
+    let explanation: Explanation
+  }
+
+  static func test(collection: RulesCollection, address: String) throws -> Result {
+    guard collection.issues.isEmpty else { throw Failure.incompleteCollection }
+    let target = try OfflineRuleTarget(address)
+    let matches = collection.rows.filter { row in
+      guard row.isEnabled, collection.preset.defaultAction.expresses(row.action) else {
+        return false
+      }
+      guard let identity = row.identity else { return target.isSimpleHostname }
+      return RuleCoverage.domainCovers(identity.match, target.match)
+        || RuleCoverage.ipCovers(identity.match, target.match)
+    }
+    let fixed = matches.filter(\.isFixed)
+    let action: RuleAction?
+    let explanation: Explanation
+    if !fixed.isEmpty {
+      action = .direct
+      explanation = .fixedLocal
+    } else if Set(matches.map(\.action)).count > 1 {
+      action = RuleCoverage.winningAction(for: target.match)
+      explanation = target.isDomain ? .domainProxy : .ipDirect
+    } else {
+      action = matches.first?.action
+      explanation =
+        action == nil ? .defaultAction : .singleAction
+    }
+    let deciding = matches.filter {
+      fixed.isEmpty ? $0.action == action : $0.isFixed
+    }
+    let decidingIDs = Set(deciding.map(\.id))
+    return Result(
+      version: collection.version, target: target.display,
+      outcome: (action ?? collection.preset.defaultAction.fallbackAction) == .proxy
+        ? .proxy : .direct,
+      domainWithoutDNS: target.isDomain, deciding: deciding,
+      otherMatches: matches.filter { !decidingIDs.contains($0.id) }, explanation: explanation)
+  }
+}
+
+private struct OfflineRuleTarget {
+  let match: RuleMatch
+  let display: String
+  var isDomain: Bool {
+    if case .domainExact = match.pattern { return true }
+    return false
+  }
+  var isSimpleHostname: Bool { isDomain && !display.contains(".") }
+
+  init(_ address: String) throws {
+    let raw = address.trimmingCharacters(in: .whitespacesAndNewlines)
+    guard !raw.isEmpty else { throw OfflineRuleMatcher.Failure.invalidTarget }
+    var host = raw
+    if raw.contains("://") {
+      guard let url = URL(string: raw, encodingInvalidCharacters: false),
+        let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
+        components.scheme != nil, let value = components.host, !value.isEmpty,
+        components.percentEncodedHost?.contains("%") == false,
+        components.port.map({ (0...65535).contains($0) }) ?? true
+      else { throw OfflineRuleMatcher.Failure.invalidTarget }
+      host = value
+      if host.hasPrefix("["), host.hasSuffix("]") {
+        host = String(host.dropFirst().dropLast())
+      }
+    }
+    if let addressMatch = try? RuleMatch(ipv4CIDR: host), !host.contains("/") {
+      match = addressMatch
+      display = String(addressMatch.browsingContent.split(separator: "/")[0])
+      return
+    }
+    if let addressMatch = try? RuleMatch(ipv6CIDR: host), !host.contains("/") {
+      match = addressMatch
+      display = String(addressMatch.browsingContent.split(separator: "/")[0])
+      return
+    }
+    host = host.lowercased()
+    if host.hasSuffix(".") { host.removeLast() }
+    let labels = host.split(separator: ".", omittingEmptySubsequences: false)
+    guard !host.isEmpty, host.utf8.count <= 253,
+      !host.allSatisfy({ $0.isNumber || $0 == "." }),
+      labels.allSatisfy({ label in
+        !label.isEmpty && label.utf8.count <= 63
+          && label.first != "-" && label.last != "-"
+          && label.utf8.allSatisfy { byte in
+            (97...122).contains(byte) || (48...57).contains(byte) || byte == 45
+          }
+      })
+    else { throw OfflineRuleMatcher.Failure.invalidTarget }
+    match = try RuleMatch(domainExact: host)
+    display = host
+  }
+}
+
+struct RulesAddressTest: Equatable, Sendable {
+  var target = ""
+  var isTesting = false
+  var result: OfflineRuleMatcher.Result?
+  var failure: OfflineRuleMatcher.Failure?
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/ProxyMode.swift b/ShadowsocksX-NG2/Domain/Rules/ProxyMode.swift
new file mode 100644
index 000000000..4821ce9cc
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/ProxyMode.swift
@@ -0,0 +1,100 @@
+import Foundation
+
+/// Persisted identity of a proxy mode. PAC is gone: the product
+/// exposes rule / global / direct only.
+enum ProxyModeKind: String, Codable, CaseIterable, Equatable, Hashable, Sendable {
+  case rule
+  case global
+  case direct
+}
+
+/// The mutually exclusive ways in which 2.0 exposes the local proxy to macOS.
+/// Hashable 供菜单栏模式选择的勾选态 Picker 使用。
+/// 规则模式另持久化 `RulePreset` 子选项。
+enum ProxyMode: Codable, Equatable, Hashable, Sendable {
+  case rule
+  case global
+  case direct
+
+  private enum CodingKeys: String, CodingKey {
+    case kind
+  }
+
+  private enum Kind: String, Codable {
+    case rule
+    case global
+    case direct
+  }
+
+  init(from decoder: Decoder) throws {
+    let container = try decoder.container(keyedBy: CodingKeys.self)
+    switch try container.decode(Kind.self, forKey: .kind) {
+    case .rule:
+      self = .rule
+    case .global:
+      self = .global
+    case .direct:
+      self = .direct
+    }
+  }
+
+  func encode(to encoder: Encoder) throws {
+    var container = encoder.container(keyedBy: CodingKeys.self)
+    switch self {
+    case .rule:
+      try container.encode(Kind.rule, forKey: .kind)
+    case .global:
+      try container.encode(Kind.global, forKey: .kind)
+    case .direct:
+      try container.encode(Kind.direct, forKey: .kind)
+    }
+  }
+
+  var label: String {
+    switch self {
+    case .rule:
+      String(localized: "规则")
+    case .global:
+      String(localized: "全局")
+    case .direct:
+      String(localized: "直连")
+    }
+  }
+
+  var kind: ProxyModeKind {
+    switch self {
+    case .rule: .rule
+    case .global: .global
+    case .direct: .direct
+    }
+  }
+
+  /// Returns every mode supported by the product in stable selector order.
+  static var availableModes: [ProxyMode] { [.rule, .global, .direct] }
+
+  /// Derives the only system-proxy state that this mode is allowed to own.
+  /// All three modes are projected as the local SOCKS and HTTP inbounds
+  /// SOCKS 之外，系统 HTTP/HTTPS 代理指向恒开启的 HTTP 入站。
+  /// 投影即 closed typed 配置：HTTPS 显式赋值、PAC/自动发现显式
+  /// 关闭、简单主机名排除显式开启、例外列表全量给出。
+  /// 端口合法性由 settings store 与运行时文档派生保证，投影对任意
+  /// 文档都是全函数，保证期望系统代理配置不被静默跳过（ADR-0022）。
+  func systemProxyConfiguration(
+    for document: SslocalRuntimeDocument,
+    exceptions: [String] = []
+  ) -> SystemProxyConfiguration {
+    systemProxyConfiguration(for: RuntimeListenFacts(document: document), exceptions: exceptions)
+  }
+
+  func systemProxyConfiguration(
+    for listen: RuntimeListenFacts, exceptions: [String] = []
+  ) -> SystemProxyConfiguration {
+    let loopback = "127.0.0.1"
+    return SystemProxyConfiguration(
+      socks: .init(host: loopback, port: listen.socksPort),
+      http: .init(host: loopback, port: listen.httpPort),
+      https: .init(host: loopback, port: listen.httpPort),
+      excludeSimpleHostnames: true,
+      exceptions: FixedLocalProxyRanges.systemProxyExceptions(including: exceptions))
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/ProxyRule.swift b/ShadowsocksX-NG2/Domain/Rules/ProxyRule.swift
new file mode 100644
index 000000000..effa4f2dd
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/ProxyRule.swift
@@ -0,0 +1,279 @@
+import Darwin
+import Foundation
+
+// MARK: - 动作
+
+/// 规则动作：目标经 Shadowsocks 代理，或直连。独立于 PAC、ACL 文本与
+/// 系统代理设置。
+enum RuleAction: String, CaseIterable, Equatable, Hashable, Sendable {
+  case proxy
+  case direct
+}
+
+/// 规则模式的未匹配默认动作：未命中规则时走代理或直连。
+/// 出厂默认「未匹配时代理」。
+enum RuleDefaultAction: String, Codable, CaseIterable, Equatable, Hashable, Sendable {
+  case proxyWhenUnmatched = "proxy-when-unmatched"
+  case directWhenUnmatched = "direct-when-unmatched"
+
+  var label: String {
+    switch self {
+    case .proxyWhenUnmatched: String(localized: "代理")
+    case .directWhenUnmatched: String(localized: "直连")
+    }
+  }
+
+  func expresses(_ action: RuleAction) -> Bool {
+    self != .proxyWhenUnmatched || action == .direct
+  }
+
+  /// 域名优先匹配下，未命中时的默认动作。
+  var fallbackAction: RuleAction {
+    switch self {
+    case .proxyWhenUnmatched: .proxy
+    case .directWhenUnmatched: .direct
+    }
+  }
+}
+
+// MARK: - 匹配条件
+
+/// 规则匹配条件。完整域名、域名后缀与 IPv4/IPv6 CIDR 是可运行的统一类型；
+/// 不把 URL 路径、协议、关键字或正则纳入。
+struct RuleMatch: Equatable, Hashable, Sendable {
+  /// Read-only pattern; raw strings cannot be used to construct a RuleMatch.
+  enum Pattern: Equatable, Hashable, Sendable {
+    case domainExact(String)
+    case domainSuffix(String)
+    case ipv4CIDR(String)
+    case ipv6CIDR(String)
+  }
+
+  let pattern: Pattern
+
+  private init(pattern: Pattern) { self.pattern = pattern }
+
+  static let localSuffix = RuleMatch(pattern: .domainSuffix("local"))
+  static let localhostSuffix = RuleMatch(pattern: .domainSuffix("localhost"))
+
+  var isFixedLocalSuffix: Bool { self == Self.localSuffix || self == Self.localhostSuffix }
+
+  init(domainExact raw: String) throws {
+    let value = raw.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+    guard !value.isEmpty else { throw RuleMatchError.emptyDomain }
+    guard !value.hasPrefix("."), !value.hasPrefix("*") else {
+      throw RuleMatchError.invalidDomain(raw)
+    }
+    guard !value.hasSuffix(".") else { throw RuleMatchError.invalidDomain(raw) }
+    guard value.allSatisfy({ Self.isDomainLabelCharacter($0) || $0 == "." }) else {
+      throw RuleMatchError.invalidDomain(raw)
+    }
+    self.init(pattern: .domainExact(value))
+  }
+
+  init(domainSuffix raw: String) throws {
+    var value = raw.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+    while value.hasPrefix(".") { value.removeFirst() }
+    guard !value.isEmpty else { throw RuleMatchError.emptyDomain }
+    guard !value.hasPrefix("*"), !value.hasSuffix(".") else {
+      throw RuleMatchError.invalidDomain(raw)
+    }
+    guard value.allSatisfy({ Self.isDomainLabelCharacter($0) || $0 == "." }) else {
+      throw RuleMatchError.invalidDomain(raw)
+    }
+    // 单标签后缀（如 `com`）过宽；`cn` 作为国家后缀由吸收流程单独引入并显式允许。
+    let labels = value.split(separator: ".")
+    guard labels.count >= 2 else { throw RuleMatchError.invalidDomain(raw) }
+    self.init(pattern: .domainSuffix(value))
+  }
+
+  /// 允许 `cn` 作为显式引入的国家后缀。
+  init(nationalDomainSuffix raw: String) throws {
+    let value = raw.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+    guard value == "cn" else {
+      // 回退到普通后缀校验。
+      try self.init(domainSuffix: raw)
+      return
+    }
+    self.init(pattern: .domainSuffix(value))
+  }
+
+  init(ipv4CIDR raw: String) throws {
+    let normalized = try Self.normalizeIPv4CIDR(raw)
+    self.init(pattern: .ipv4CIDR(normalized))
+  }
+
+  init(ipv6CIDR raw: String) throws {
+    let normalized = try Self.normalizeIPv6CIDR(raw)
+    self.init(pattern: .ipv6CIDR(normalized))
+  }
+
+  private static func isDomainLabelCharacter(_ character: Character) -> Bool {
+    character.isASCII && (character.isLetter || character.isNumber || character == "-")
+  }
+
+  private static func normalizeIPv4CIDR(_ raw: String) throws -> String {
+    let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
+    guard !trimmed.isEmpty else { throw RuleMatchError.invalidCIDR(raw) }
+    let parts = trimmed.split(separator: "/", maxSplits: 1)
+    let addressPart = String(parts.first ?? "")
+    let prefixLength: Int
+    if parts.count == 2 {
+      guard let parsed = Int(parts[1]), (0...32).contains(parsed) else {
+        throw RuleMatchError.invalidCIDR(raw)
+      }
+      prefixLength = parsed
+    } else {
+      prefixLength = 32
+    }
+    var address = in_addr()
+    let converted = addressPart.withCString { inet_pton(AF_INET, $0, &address) }
+    guard converted == 1 else {
+      // 确认不是 IPv6。
+      var probe = in6_addr()
+      if addressPart.withCString({ inet_pton(AF_INET6, $0, &probe) }) == 1 {
+        throw RuleMatchError.invalidCIDR(raw)
+      }
+      throw RuleMatchError.invalidCIDR(raw)
+    }
+    let host = UInt32(bigEndian: address.s_addr)
+    let mask: UInt32 = prefixLength == 0 ? 0 : UInt32.max << (32 - prefixLength)
+    let network = host & mask
+    var networkAddress = in_addr(s_addr: network.bigEndian)
+    var buffer = [CChar](repeating: 0, count: Int(INET_ADDRSTRLEN))
+    guard inet_ntop(AF_INET, &networkAddress, &buffer, socklen_t(INET_ADDRSTRLEN)) != nil else {
+      throw RuleMatchError.invalidCIDR(raw)
+    }
+    guard let dotted = Self.string(from: buffer) else {
+      throw RuleMatchError.invalidCIDR(raw)
+    }
+    return "\(dotted)/\(prefixLength)"
+  }
+
+  private static func normalizeIPv6CIDR(_ raw: String) throws -> String {
+    let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
+    guard !trimmed.isEmpty else { throw RuleMatchError.invalidCIDR(raw) }
+    let parts = trimmed.split(separator: "/", maxSplits: 1)
+    let addressPart = String(parts.first ?? "")
+    let prefixLength: Int
+    if parts.count == 2 {
+      guard let parsed = Int(parts[1]), (0...128).contains(parsed) else {
+        throw RuleMatchError.invalidCIDR(raw)
+      }
+      prefixLength = parsed
+    } else {
+      prefixLength = 128
+    }
+    var address = in6_addr()
+    let converted = addressPart.withCString { inet_pton(AF_INET6, $0, &address) }
+    guard converted == 1 else {
+      var probe = in_addr()
+      if addressPart.withCString({ inet_pton(AF_INET, $0, &probe) }) == 1 {
+        throw RuleMatchError.invalidCIDR(raw)
+      }
+      throw RuleMatchError.invalidCIDR(raw)
+    }
+    // 按 16-bit 组掩码到前缀长度。
+    var bytes = withUnsafeBytes(of: address) { Array($0) }
+    for index in 0..<16 {
+      let bitStart = index * 8
+      if prefixLength >= bitStart + 8 { continue }
+      if prefixLength <= bitStart {
+        bytes[index] = 0
+      } else {
+        let keep = prefixLength - bitStart
+        let mask = UInt8.max << (8 - keep)
+        bytes[index] &= mask
+      }
+    }
+    var networkAddress = bytes.withUnsafeBytes { rawPointer in
+      rawPointer.load(as: in6_addr.self)
+    }
+    var buffer = [CChar](repeating: 0, count: Int(INET6_ADDRSTRLEN))
+    guard inet_ntop(AF_INET6, &networkAddress, &buffer, socklen_t(INET6_ADDRSTRLEN)) != nil else {
+      throw RuleMatchError.invalidCIDR(raw)
+    }
+    guard let address = Self.string(from: buffer) else {
+      throw RuleMatchError.invalidCIDR(raw)
+    }
+    return "\(address)/\(prefixLength)"
+  }
+
+  private static func string(from buffer: [CChar]) -> String? {
+    let bytes = buffer.prefix(while: { $0 != 0 }).map { UInt8(bitPattern: $0) }
+    return String(bytes: bytes, encoding: .utf8)
+  }
+}
+
+enum RuleMatchError: Error, Equatable, Sendable {
+  case emptyDomain
+  case invalidDomain(String)
+  case invalidCIDR(String)
+}
+
+// MARK: - 来源身份
+
+/// 内置规则来源身份。
+enum RuleSourceKind: String, CaseIterable, Equatable, Hashable, Sendable {
+  case geolocationCN = "geolocation-cn"
+  case chinaIPv4 = "china-ipv4"
+  case gfwlist = "gfwlist"
+  case custom = "custom"
+}
+
+/// 内置快照的来源类别、上游版本与展示标签。
+struct RuleSourceIdentity: Equatable, Hashable, Sendable {
+  let kind: RuleSourceKind
+  let upstreamVersion: String
+  let label: String
+
+  init(kind: RuleSourceKind, upstreamVersion: String, label: String) {
+    self.kind = kind
+    self.upstreamVersion = upstreamVersion
+    self.label = label
+  }
+
+  var id: String { kind.rawValue }
+}
+
+// MARK: - 规则
+
+/// 一条来源无关的代理规则。
+struct ProxyRule: Equatable, Hashable, Sendable {
+  let action: RuleAction
+  let match: RuleMatch
+
+  init(
+    action: RuleAction,
+    match: RuleMatch
+  ) {
+    self.action = action
+    self.match = match
+  }
+
+  /// Stable historical token, independent of Swift's debug representation.
+  var contentToken: String {
+    let kind: String
+    let value: String
+    switch match.pattern {
+    case .domainExact(let raw): (kind, value) = ("domainExact", raw)
+    case .domainSuffix(let raw): (kind, value) = ("domainSuffix", raw)
+    case .ipv4CIDR(let raw): (kind, value) = ("ipv4CIDR", raw)
+    case .ipv6CIDR(let raw): (kind, value) = ("ipv6CIDR", raw)
+    }
+    return "\(action.rawValue)|\(kind)(\(String(reflecting: value)))"
+  }
+
+  /// sslocal ACL 单行表示（ASCII）。域名后缀 `||host`、完整域名 `|host`、
+  /// CIDR 原样写入。
+  var aclLine: String {
+    switch match.pattern {
+    case .domainExact(let domain):
+      return "|\(domain)"
+    case .domainSuffix(let domain):
+      return "||\(domain)"
+    case .ipv4CIDR(let cidr), .ipv6CIDR(let cidr):
+      return cidr
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/RuleAnalysis.swift b/ShadowsocksX-NG2/Domain/Rules/RuleAnalysis.swift
new file mode 100644
index 000000000..a22110497
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/RuleAnalysis.swift
@@ -0,0 +1,111 @@
+import Foundation
+
+/// Coverage is explanatory, never a persistence rejection or a routing priority.
+struct RuleRelationship: Equatable, Sendable {
+  enum Kind: Hashable, Sendable { case absorption, shadowing }
+  enum Extent: Sendable { case full, partial }
+  let rule: ProxyRule
+  let kind: Kind
+  let extent: Extent
+  let covering: [ProxyRule]
+}
+
+/// Analyze the complete candidate set. Optional subjects limit explanation work
+/// to custom entries at the existing validation seam without narrowing context.
+struct RuleAnalysis: Equatable, Sendable {
+  let identities: [ProxyRule]
+  let relationships: [RuleRelationship]
+
+  var contentVersion: String {
+    String(
+      ProxyACLDocument.digest(identities.map(\.contentToken).joined(separator: "\n")).prefix(12))
+  }
+
+  init(rules: [ProxyRule], subjects: [ProxyRule]? = nil) {
+    let identities = Set(rules).map { ($0, $0.contentToken) }
+      .sorted { $0.1 < $1.1 }.map(\.0)
+    self.identities = identities
+    let targets = Set(subjects ?? rules)
+    relationships = identities.filter { targets.contains($0) }.flatMap { target in
+      [RuleRelationship.Kind.absorption, .shadowing].compactMap { kind in
+        let covering = identities.filter { other in
+          guard other != target else { return false }
+          switch kind {
+          case .absorption:
+            guard other.action == target.action else { return false }
+          case .shadowing:
+            guard other.action != target.action,
+              RuleCoverage.winningAction(for: target.match) == other.action
+            else { return false }
+          }
+          return RuleCoverage.intersects(other.match, target.match)
+        }
+        guard !covering.isEmpty else { return nil }
+        return RuleRelationship(
+          rule: target, kind: kind,
+          extent: RuleCoverage.fullyCovered(target.match, by: covering.map(\.match))
+            ? .full : .partial,
+          covering: covering)
+      }
+    }
+  }
+}
+
+/// Fixed policy includes a semantic simple-hostname condition, not an editable
+/// regex identity. Coverage keeps that condition separate from ordinary rules.
+struct FixedRuleCoverage: Equatable, Sendable {
+  let extent: RuleRelationship.Extent
+  let matches: [RuleMatch]
+  let includesSimpleHostname: Bool
+}
+
+extension RuleCoverage {
+  static let fixedLocalMatches: [RuleMatch] = {
+    FixedLocalProxyRanges.ipRanges.compactMap { value in
+      value.contains(":") ? try? RuleMatch(ipv6CIDR: value) : try? RuleMatch(ipv4CIDR: value)
+    } + [.localhostSuffix, .localSuffix]
+  }()
+
+  static func fixedLocalCoverage(of match: RuleMatch) -> FixedRuleCoverage? {
+    let matches = fixedLocalMatches.filter { intersects($0, match) }
+    let simple: Bool
+    let simpleIsFull: Bool
+    switch match.pattern {
+    case .domainExact(let value):
+      simple = !value.contains(".")
+      simpleIsFull = simple
+    case .domainSuffix(let value):
+      simple = !value.contains(".")
+      simpleIsFull = false
+    case .ipv4CIDR, .ipv6CIDR:
+      simple = false
+      simpleIsFull = false
+    }
+    guard simple || !matches.isEmpty else { return nil }
+    return FixedRuleCoverage(
+      extent: simpleIsFull || fullyCovered(match, by: matches) ? .full : .partial,
+      matches: matches, includesSimpleHostname: simple)
+  }
+}
+
+extension RuleAnalysis {
+  /// Select the actual ACL skeleton before calculating coverage.
+  static func runtimeCandidates(_ rules: [ProxyRule], defaultAction: RuleDefaultAction)
+    -> [ProxyRule]
+  {
+    let expressed = rules.filter { defaultAction.expresses($0.action) }
+    let index = RulesOverlapIndex(rules: expressed)
+    return expressed.filter { rule in
+      let analysis = RuleAnalysis(rules: index.overlapping(rule.match), subjects: [rule])
+      return !analysis.relationships.contains {
+        $0.extent == .full
+          && ($0.kind == .shadowing
+            || $0.covering.contains { other in
+              RuleCoverage.fullyCovered(rule.match, by: [other.match])
+                && (!RuleCoverage.fullyCovered(other.match, by: [rule.match])
+                  || other.contentToken < rule.contentToken)
+            })
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/RuleSnapshot.swift b/ShadowsocksX-NG2/Domain/Rules/RuleSnapshot.swift
new file mode 100644
index 000000000..d3e3bc5a2
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/RuleSnapshot.swift
@@ -0,0 +1,73 @@
+import Foundation
+
+// MARK: - 快照元数据
+
+/// 规则快照的来源元数据：上游版本、输入摘要、抓取时间、
+/// 转换器版本、许可证与归属。更新失败保留上一份有效快照。
+struct RuleSnapshotMetadata: Equatable, Sendable {
+  let source: RuleSourceIdentity
+  /// 上游仓库/产物标识（含固定 commit 或 release tag）。
+  let upstreamReference: String
+  /// 原始输入的 SHA-256（规范化前的字节摘要）。
+  let inputDigest: String
+  /// 抓取时间（ISO-8601）。
+  let fetchedAt: Date
+  let converterVersion: String
+  /// 许可证标识（SPDX 或上游声明）。
+  let license: String
+  /// 归属说明，随分发物保留。
+  let attribution: String
+}
+
+// MARK: - 转换损失报告
+
+/// 转换损失报告：已转换、已吸收、按类跳过与拒绝的分类计数。
+struct RuleConversionLossReport: Equatable, Sendable {
+  /// 成功进入规则模型的条目数。
+  var convertedCount: Int
+  /// 被吸收或遮蔽而不进入运行时规则的条目数（`.cn` 吸收、GFWList `@@` 遮蔽）。
+  var absorbedCount: Int
+  /// 按类型跳过的计数（keyword / regexp / attribute / include 等）。
+  var skipped: [String: Int]
+  /// 拒绝原因 → 计数。
+  var rejected: [String: Int]
+
+  init(
+    convertedCount: Int = 0,
+    absorbedCount: Int = 0,
+    skipped: [String: Int] = [:],
+    rejected: [String: Int] = [:]
+  ) {
+    self.convertedCount = convertedCount
+    self.absorbedCount = absorbedCount
+    self.skipped = skipped
+    self.rejected = rejected
+  }
+
+  mutating func incrementSkipped(_ category: String, by count: Int = 1) {
+    skipped[category, default: 0] += count
+  }
+
+  mutating func incrementRejected(_ reason: String, by count: Int = 1) {
+    rejected[reason, default: 0] += count
+  }
+}
+
+// MARK: - 规则快照
+
+/// 规范化规则快照：元数据 + 生效规则 + 纯计数损失报告。
+struct RuleSnapshot: Equatable, Sendable {
+  let metadata: RuleSnapshotMetadata
+  let rules: [ProxyRule]
+  let lossReport: RuleConversionLossReport
+
+  init(
+    metadata: RuleSnapshotMetadata,
+    rules: [ProxyRule],
+    lossReport: RuleConversionLossReport = RuleConversionLossReport()
+  ) {
+    self.metadata = metadata
+    self.rules = rules
+    self.lossReport = lossReport
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/RuleSnapshotStore.swift b/ShadowsocksX-NG2/Domain/Rules/RuleSnapshotStore.swift
new file mode 100644
index 000000000..aee7ae442
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/RuleSnapshotStore.swift
@@ -0,0 +1,163 @@
+import Foundation
+
+enum RuleSnapshotError: Error, Equatable, Sendable {
+  case missing
+  case abnormalRuleCount(found: Int, minimum: Int, maximum: Int)
+  case corrupt(detail: String)
+  case schemaVersionMismatch(found: Int, expected: Int)
+  case converterVersionMismatch(found: String, expected: String)
+}
+
+/// Offline file adapter for maintainer-generated built-in snapshots.
+struct RuleSnapshotStore {
+  static let currentSchemaVersion = 2
+  static let currentConverterVersion = "2.0.0"
+  let fileURL: URL
+
+  func load() throws -> RuleSnapshot {
+    guard FileManager.default.fileExists(atPath: fileURL.path) else {
+      throw RuleSnapshotError.missing
+    }
+    let snapshot: RuleSnapshot
+    do {
+      snapshot = try Self.decode(Data(contentsOf: fileURL))
+    } catch let error as RuleSnapshotError {
+      throw error
+    } catch {
+      throw RuleSnapshotError.corrupt(detail: String(describing: error))
+    }
+    guard snapshot.metadata.converterVersion == Self.currentConverterVersion else {
+      throw RuleSnapshotError.converterVersionMismatch(
+        found: snapshot.metadata.converterVersion, expected: Self.currentConverterVersion)
+    }
+    try Self.validateRuleCount(snapshot.rules.count, source: snapshot.metadata.source.kind)
+    return snapshot
+  }
+
+  static func validateRuleCount(_ count: Int, source: RuleSourceKind) throws {
+    let maximum = source == .geolocationCN ? 200_000 : 50_000
+    guard (100...maximum).contains(count) else {
+      throw RuleSnapshotError.abnormalRuleCount(found: count, minimum: 100, maximum: maximum)
+    }
+  }
+
+  func save(_ snapshot: RuleSnapshot) throws {
+    try AtomicFileWriter.write(Self.encode(snapshot), to: fileURL)
+  }
+
+  static func decode(_ data: Data) throws -> RuleSnapshot {
+    let decoder = JSONDecoder()
+    decoder.dateDecodingStrategy = .iso8601
+    let stored = try decoder.decode(StoredRuleSnapshot.self, from: data)
+    guard stored.schemaVersion == currentSchemaVersion else {
+      throw RuleSnapshotError.schemaVersionMismatch(
+        found: stored.schemaVersion, expected: currentSchemaVersion)
+    }
+    return try stored.domain()
+  }
+
+  static func encode(_ snapshot: RuleSnapshot) throws -> Data {
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.sortedKeys]
+    encoder.dateEncodingStrategy = .iso8601
+    return try encoder.encode(StoredRuleSnapshot(snapshot))
+  }
+
+  /// Preserve browsing's historical metadata fingerprints without making domain
+  /// models conform to the file format's encoding contract.
+  static func metadataTokens(for snapshot: RuleSnapshot) throws -> [String] {
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.sortedKeys]
+    return [
+      snapshot.metadata.source.kind.rawValue
+        + ProxyACLDocument.digest(try encoder.encode(StoredSnapshotMetadata(snapshot.metadata))),
+      ProxyACLDocument.digest(try encoder.encode(StoredConversionReport(snapshot.lossReport))),
+    ]
+  }
+}
+
+private struct StoredRuleSource: Codable {
+  let kind: String
+  let upstreamVersion: String
+  let label: String
+
+  init(_ source: RuleSourceIdentity) {
+    kind = source.kind.rawValue
+    upstreamVersion = source.upstreamVersion
+    label = source.label
+  }
+
+  func domain() throws -> RuleSourceIdentity {
+    guard let kind = RuleSourceKind(rawValue: kind) else {
+      throw RuleStorageDecodingError.invalidSource(kind)
+    }
+    return RuleSourceIdentity(kind: kind, upstreamVersion: upstreamVersion, label: label)
+  }
+}
+
+private struct StoredSnapshotMetadata: Codable {
+  let source: StoredRuleSource
+  let upstreamReference: String
+  let inputDigest: String
+  let fetchedAt: Date
+  let converterVersion: String
+  let license: String
+  let attribution: String
+
+  init(_ metadata: RuleSnapshotMetadata) {
+    source = StoredRuleSource(metadata.source)
+    upstreamReference = metadata.upstreamReference
+    inputDigest = metadata.inputDigest
+    fetchedAt = metadata.fetchedAt
+    converterVersion = metadata.converterVersion
+    license = metadata.license
+    attribution = metadata.attribution
+  }
+
+  func domain() throws -> RuleSnapshotMetadata {
+    RuleSnapshotMetadata(
+      source: try source.domain(), upstreamReference: upstreamReference, inputDigest: inputDigest,
+      fetchedAt: fetchedAt, converterVersion: converterVersion, license: license,
+      attribution: attribution)
+  }
+}
+
+private struct StoredConversionReport: Codable {
+  let convertedCount: Int
+  let absorbedCount: Int
+  let skipped: [String: Int]
+  let rejected: [String: Int]
+
+  init(_ report: RuleConversionLossReport) {
+    convertedCount = report.convertedCount
+    absorbedCount = report.absorbedCount
+    skipped = report.skipped
+    rejected = report.rejected
+  }
+
+  var domain: RuleConversionLossReport {
+    RuleConversionLossReport(
+      convertedCount: convertedCount, absorbedCount: absorbedCount, skipped: skipped,
+      rejected: rejected)
+  }
+}
+
+private struct StoredRuleSnapshot: Codable {
+  let schemaVersion: Int
+  let metadata: StoredSnapshotMetadata
+  let rules: [StoredProxyRule]
+  let lossReport: StoredConversionReport
+
+  init(_ snapshot: RuleSnapshot) {
+    schemaVersion = RuleSnapshotStore.currentSchemaVersion
+    metadata = StoredSnapshotMetadata(snapshot.metadata)
+    rules = snapshot.rules.map(StoredProxyRule.init)
+    lossReport = StoredConversionReport(snapshot.lossReport)
+  }
+
+  func domain() throws -> RuleSnapshot {
+    RuleSnapshot(
+      metadata: try metadata.domain(), rules: try rules.map { try $0.domain() },
+      lossReport: lossReport.domain)
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/RuleStorage.swift b/ShadowsocksX-NG2/Domain/Rules/RuleStorage.swift
new file mode 100644
index 000000000..15114bd49
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/RuleStorage.swift
@@ -0,0 +1,53 @@
+import Foundation
+
+/// Wire records are independent of domain values. Both file adapters convert
+/// through the validated RuleMatch constructors before publishing any rules.
+struct StoredProxyRule: Codable {
+  let action: String
+  let match: StoredRuleMatch
+
+  init(_ rule: ProxyRule) {
+    action = rule.action.rawValue
+    match = StoredRuleMatch(rule.match)
+  }
+
+  func domain() throws -> ProxyRule {
+    guard let action = RuleAction(rawValue: action) else {
+      throw RuleStorageDecodingError.invalidAction(action)
+    }
+    return ProxyRule(action: action, match: try match.domain())
+  }
+}
+
+struct StoredRuleMatch: Codable {
+  let kind: String
+  let value: String
+
+  init(_ match: RuleMatch) {
+    switch match.pattern {
+    case .domainExact(let raw): (kind, value) = ("domainExact", raw)
+    case .domainSuffix(let raw): (kind, value) = ("domainSuffix", raw)
+    case .ipv4CIDR(let raw): (kind, value) = ("ipv4CIDR", raw)
+    case .ipv6CIDR(let raw): (kind, value) = ("ipv6CIDR", raw)
+    }
+  }
+
+  func domain() throws -> RuleMatch {
+    switch kind {
+    case "domainExact": return try RuleMatch(domainExact: value)
+    case "domainSuffix":
+      if value == "local" { return .localSuffix }
+      if value == "localhost" { return .localhostSuffix }
+      return try RuleMatch(nationalDomainSuffix: value)
+    case "ipv4CIDR": return try RuleMatch(ipv4CIDR: value)
+    case "ipv6CIDR": return try RuleMatch(ipv6CIDR: value)
+    default: throw RuleStorageDecodingError.invalidMatchKind(kind)
+    }
+  }
+}
+
+enum RuleStorageDecodingError: Error {
+  case invalidAction(String)
+  case invalidMatchKind(String)
+  case invalidSource(String)
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/RulesBrowsing.swift b/ShadowsocksX-NG2/Domain/Rules/RulesBrowsing.swift
new file mode 100644
index 000000000..911cc569d
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/RulesBrowsing.swift
@@ -0,0 +1,94 @@
+import Foundation
+
+/// Session browsing state belongs to the workflow, so navigation never discards it.
+struct RulesQuery: Equatable, Sendable {
+  var search = ""
+  var action: RuleAction?
+  var source: RulesSource?
+  var enabled: Bool?
+}
+
+enum RulesSource: String, CaseIterable, Identifiable, Sendable {
+  case custom, geolocationCN, chinaIPv4, gfwlist, fixed
+  var id: Self { self }
+
+  /// Fixed policy has no snapshot metadata kind.
+  var sourceKind: RuleSourceKind? {
+    switch self {
+    case .custom: .custom
+    case .geolocationCN: .geolocationCN
+    case .chinaIPv4: .chinaIPv4
+    case .gfwlist: .gfwlist
+    case .fixed: nil
+    }
+  }
+}
+
+struct RulesSourceSnapshot: Equatable, Identifiable, Sendable {
+  let id: RulesSource
+  let count: Int
+  let metadata: RuleSnapshotMetadata?
+  let conversionReport: RuleConversionLossReport?
+}
+
+struct RulesRow: Equatable, Identifiable, Sendable {
+  enum SelectionID: Hashable, Sendable {
+    case rule(ProxyRule)
+    case noDotHostname
+  }
+  let id: SelectionID
+  let identity: ProxyRule?
+  let content: String
+  let sources: Set<RulesSource>
+  let customIDs: Set<UUID>
+  let relationships: [RuleRelationship]
+  let fixedCoverage: FixedRuleCoverage?
+  var isEnabled = true
+  var hasCurrentSource: Bool { !sources.isEmpty }
+  var isFixed: Bool { sources.contains(.fixed) }
+  var action: RuleAction { identity?.action ?? .direct }
+}
+
+struct RulesPageSnapshot: Equatable, Sendable {
+  enum Issue: Equatable, Hashable, Sendable {
+    case userDocument(String)
+    case builtin(RulesSource, String)
+  }
+  var version = ""
+  var isLoading = false
+  var isCommitting = false
+  var commitFeedback: RulesCommitFeedback?
+  var commitOutcome: CustomRuleUpdateOutcome? { commitFeedback?.outcome }
+  var issues: [Issue] = []
+  var sources: [RulesSourceSnapshot] = []
+  var rows: [RulesRow] = []
+  var selection: Set<RulesRow.SelectionID> = []
+  var query = RulesQuery()
+  var addressTest = RulesAddressTest()
+  var isComplete: Bool { !isLoading && !isCommitting && issues.isEmpty && !version.isEmpty }
+  var operationStatus: RulesOperationStatus {
+    if isCommitting { return .updating }
+    if isLoading { return version.isEmpty ? .initialLoading : .refreshing }
+    if !issues.isEmpty && commitFeedback?.outcome.isSuccess != false {
+      return .collectionIncomplete
+    }
+    if let commitFeedback { return .feedback(commitFeedback) }
+    return issues.isEmpty ? .idle : .collectionIncomplete
+  }
+}
+
+enum RulesOperationStatus: Equatable, Sendable {
+  case idle, initialLoading, refreshing, updating, collectionIncomplete
+  case feedback(RulesCommitFeedback)
+}
+
+struct RulesCommitFeedback: Equatable, Sendable, Identifiable {
+  enum Operation: Equatable, Sendable {
+    case enablement(Bool)
+    case add, edit, delete
+  }
+  let id = UUID()
+  let outcome: CustomRuleUpdateOutcome
+  let operation: Operation
+  let changedCount: Int
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/RulesCollection.swift b/ShadowsocksX-NG2/Domain/Rules/RulesCollection.swift
new file mode 100644
index 000000000..6bedabce2
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/RulesCollection.swift
@@ -0,0 +1,268 @@
+import Foundation
+
+/// Browsing uses the preset’s effective actions and saved custom entries.
+struct RulesCollection: Sendable {
+  let preset: RulePreset
+  let version: String
+  let rows: [RulesRow]
+  let sources: [RulesSourceSnapshot]
+  let issues: [RulesPageSnapshot.Issue]
+  let userDocument: CustomRuleDocument?
+  fileprivate let builtinInput: RulesCollectionInput
+  fileprivate let builtinVersion: String
+
+  static func load(
+    preset: RulePreset,
+    custom loadCustom: () throws -> [CustomRule],
+    builtin loadBuiltin: (RulesSource) throws -> RuleSnapshot,
+    document loadDocument: (() throws -> CustomRuleDocument)? = nil
+  ) -> RulesCollection {
+    var builtin = RulesCollectionInput(preset: preset)
+    for source in preset.sources {
+      builtin.readBuiltin(source, using: loadBuiltin)
+    }
+    var input = builtin
+    input.readCustom { try loadDocument?() ?? CustomRuleDocument(rules: loadCustom()) }
+    return input.collection(builtinInput: builtin, builtinVersion: builtin.contentVersion)
+  }
+
+  /// A single prospective row uses the same analysis as browsing without sorting
+  /// or recomputing every saved row on each editor keystroke.
+  func previewRow(identity: ProxyRule, document: CustomRuleDocument) -> RulesRow? {
+    var input = builtinInput
+    input.readCustom { document }
+    return input.previewRow(identity: identity)
+  }
+
+  func replacingUserDocument(
+    _ document: CustomRuleDocument, analyzing: Bool = true
+  ) -> RulesCollection {
+    var input = builtinInput
+    input.readCustom { document }
+    return input.collection(
+      builtinInput: builtinInput, builtinVersion: builtinVersion,
+      cachedRows: analyzing ? nil : Dictionary(uniqueKeysWithValues: rows.map { ($0.id, $0) }))
+  }
+}
+
+private struct RulesCandidate: Sendable {
+  let rule: ProxyRule
+  var identity: ProxyRule { rule }
+  let source: RulesSource
+  let customID: UUID?
+
+  init(rule: ProxyRule, source: RulesSource, customID: UUID?) {
+    self.rule = rule
+    self.source = source
+    self.customID = customID
+  }
+}
+
+private struct RulesCollectionInput: Sendable {
+  var preset: RulePreset
+  var userDocument: CustomRuleDocument?
+  var disabled: Set<ProxyRule> = []
+  var entries: [RulesCandidate] = []
+  var sources: [RulesSourceSnapshot] = []
+  var issues: [RulesPageSnapshot.Issue] = []
+  var metadataTokens: [String] = []
+
+  mutating func readCustom(_ loadCustom: () throws -> CustomRuleDocument) {
+    do {
+      let loaded = try loadCustom()
+      let validation = CustomRuleValidator.hardValidation(custom: loaded.rules)
+      guard validation.rejected.isEmpty else {
+        throw CustomRuleStoreError.corrupt(detail: "Invalid custom rule collection")
+      }
+      let custom = loaded.rules.filter { $0.action == preset.matchedAction }
+      let document = CustomRuleDocument(
+        rules: custom, disabledIdentities: loaded.disabledIdentities)
+      disabled = document.disabledIdentities
+      userDocument = document
+      entries += custom.map { RulesCandidate(rule: $0.proxyRule, source: .custom, customID: $0.id) }
+      sources.insert(
+        RulesSourceSnapshot(id: .custom, count: custom.count, metadata: nil, conversionReport: nil),
+        at: 0)
+    } catch {
+      issues.insert(.userDocument(String(describing: error)), at: 0)
+    }
+  }
+
+  mutating func readBuiltin(
+    _ source: RulesSource, using loadBuiltin: (RulesSource) throws -> RuleSnapshot
+  ) {
+    do {
+      let snapshot = try loadBuiltin(source)
+      guard let expected = source.sourceKind else { throw RuleSnapshotError.missing }
+      guard snapshot.metadata.source.kind == expected
+      else { throw RuleSnapshotError.corrupt(detail: "Unexpected rule source") }
+      let candidates = preset.rules(from: snapshot)
+      entries += candidates.map { RulesCandidate(rule: $0, source: source, customID: nil) }
+      sources.append(
+        RulesSourceSnapshot(
+          id: source, count: candidates.count,
+          metadata: snapshot.metadata, conversionReport: snapshot.lossReport))
+      // Metadata changes invalidate details even when rule content is unchanged.
+      metadataTokens += try RuleSnapshotStore.metadataTokens(for: snapshot)
+    } catch {
+      issues.append(.builtin(source, String(describing: error)))
+    }
+  }
+
+  private mutating func appendFixedPolicy() {
+    let fixedMatches = RuleCoverage.fixedLocalMatches
+    entries += fixedMatches.map {
+      RulesCandidate(
+        rule: ProxyRule(action: .direct, match: $0), source: .fixed,
+        customID: nil)
+    }
+    sources.append(
+      RulesSourceSnapshot(
+        id: .fixed, count: fixedMatches.count + 1, metadata: nil, conversionReport: nil))
+  }
+
+  mutating func previewRow(identity: ProxyRule) -> RulesRow? {
+    appendFixedPolicy()
+    let memberships = entries.filter { $0.identity == identity }
+    guard !memberships.isEmpty else { return nil }
+    let overlapping = entries.compactMap { candidate -> ProxyRule? in
+      let rule = candidate.rule
+      guard !disabled.contains(rule), preset.defaultAction.expresses(rule.action),
+        RuleCoverage.intersects(rule.match, identity.match),
+        rule.action != .proxy
+          || RuleCoverage.fixedLocalCoverage(of: rule.match)?.extent != .full
+      else { return nil }
+      return rule
+    }
+    return row(identity: identity, entries: memberships, overlapping: overlapping)
+  }
+
+  var contentVersion: String {
+    let tokens =
+      entries.map { $0.identity.contentToken + "|" + $0.source.rawValue }
+      + metadataTokens + issues.map { String(describing: $0) }
+    return ProxyACLDocument.digest(tokens.sorted().joined(separator: "\n"))
+  }
+
+  private func documentVersion(builtinVersion: String) -> String {
+    let tokens =
+      (userDocument?.rules ?? []).map { $0.identity.contentToken + "|" + $0.id.uuidString }
+      + disabled.map { "disabled:" + $0.contentToken }
+    return String(
+      ProxyACLDocument.digest(
+        preset.rawValue + builtinVersion + "\n" + tokens.sorted().joined(separator: "\n")
+      ).prefix(16))
+  }
+
+  mutating func collection(
+    builtinInput: RulesCollectionInput, builtinVersion: String,
+    cachedRows: [RulesRow.SelectionID: RulesRow]? = nil
+  ) -> RulesCollection {
+    appendFixedPolicy()
+    let grouped = Dictionary(grouping: entries, by: { $0.identity })
+    // Completely fixed-protected proxy candidates remain browsable but cannot
+    // cover or shadow another candidate in the effective collection.
+    let index =
+      cachedRows == nil
+      ? RulesOverlapIndex(
+        rules: grouped.values.compactMap { $0.first?.rule }.filter {
+          !disabled.contains($0) && preset.defaultAction.expresses($0.action)
+            && ($0.action != .proxy
+              || RuleCoverage.fixedLocalCoverage(of: $0.match)?.extent != .full)
+        }) : nil
+    var rows = orderedRows(grouped: grouped, index: index, cachedRows: cachedRows)
+    let orphans = disabled.filter { grouped[$0] == nil }.map { ($0, $0.contentToken) }
+      .sorted { $0.1 < $1.1 }.map(\.0)
+    for identity in orphans {
+      rows.append(
+        RulesRow(
+          id: .rule(identity), identity: identity,
+          content: identity.match.browsingContent, sources: [], customIDs: [],
+          relationships: [], fixedCoverage: nil, isEnabled: false))
+    }
+    rows.append(
+      RulesRow(
+        id: .noDotHostname, identity: nil, content: "^[^.]+$", sources: [.fixed], customIDs: [],
+        relationships: [], fixedCoverage: nil))
+    return RulesCollection(
+      preset: preset, version: documentVersion(builtinVersion: builtinVersion),
+      rows: rows, sources: sources, issues: issues, userDocument: userDocument,
+      builtinInput: builtinInput, builtinVersion: builtinVersion)
+  }
+  private func cachedCoverage(
+    identity: ProxyRule, old: RulesRow?, entries: [RulesCandidate]
+  ) -> FixedRuleCoverage? {
+    if let old { return old.fixedCoverage }
+    return entries.contains { $0.source == .fixed }
+      ? nil : RuleCoverage.fixedLocalCoverage(of: identity.match)
+  }
+
+  private func orderedRows(
+    grouped: [ProxyRule: [RulesCandidate]], index: RulesOverlapIndex?,
+    cachedRows: [RulesRow.SelectionID: RulesRow]?
+  ) -> [RulesRow] {
+    // Preserve the first source occurrence, rather than Dictionary iteration order.
+    var seen: Set<ProxyRule> = []
+    var rows: [RulesRow] = []
+    for entry in entries {
+      let identity = entry.identity
+      guard seen.insert(identity).inserted else { continue }
+      let memberships = grouped[identity, default: []]
+      if let cachedRows {
+        let old = cachedRows[.rule(identity)]
+        rows.append(
+          RulesRow(
+            id: .rule(identity), identity: identity, content: identity.match.browsingContent,
+            sources: Set(memberships.map(\.source)),
+            customIDs: Set(memberships.compactMap(\.customID)),
+            relationships: old?.relationships ?? [],
+            fixedCoverage: cachedCoverage(identity: identity, old: old, entries: memberships),
+            isEnabled: memberships.contains { $0.source == .fixed } || !disabled.contains(identity))
+        )
+      } else {
+        rows.append(
+          row(
+            identity: identity, entries: memberships,
+            overlapping: disabled.contains(identity) ? [] : index!.overlapping(identity.match)))
+      }
+    }
+    return rows
+  }
+
+  private func row(
+    identity: ProxyRule, entries: [RulesCandidate], overlapping: [ProxyRule]
+  ) -> RulesRow {
+    let memberships = Set(entries.map { $0.source })
+    let representative = entries[0].rule
+    var relationships =
+      memberships.contains(.fixed)
+      ? [] : RuleAnalysis(rules: overlapping, subjects: [representative]).relationships
+    let fixedCoverage =
+      memberships.contains(.fixed) ? nil : RuleCoverage.fixedLocalCoverage(of: identity.match)
+    if identity.action == .direct, let fixedCoverage {
+      relationships = relationships.compactMap { relationship in
+        guard relationship.kind == .shadowing else { return relationship }
+        guard fixedCoverage.extent == .partial else { return nil }
+        return RuleRelationship(
+          rule: identity, kind: .shadowing, extent: .partial,
+          covering: relationship.covering)
+      }
+    }
+    return RulesRow(
+      id: .rule(identity), identity: identity, content: identity.match.browsingContent,
+      sources: memberships, customIDs: Set(entries.compactMap { $0.customID }),
+      relationships: disabled.contains(identity) ? [] : relationships, fixedCoverage: fixedCoverage,
+      isEnabled: memberships.contains(.fixed) || !disabled.contains(identity))
+  }
+
+}
+
+extension RuleMatch {
+  var browsingContent: String {
+    switch pattern {
+    case .domainExact(let value), .domainSuffix(let value), .ipv4CIDR(let value),
+      .ipv6CIDR(let value):
+      value
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Rules/RulesOverlapIndex.swift b/ShadowsocksX-NG2/Domain/Rules/RulesOverlapIndex.swift
new file mode 100644
index 000000000..d42277b4d
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Rules/RulesOverlapIndex.swift
@@ -0,0 +1,55 @@
+import Foundation
+
+/// Prefix trees restrict explanatory analysis to intersecting rules. Domain
+/// labels and IP bits share the same tree mechanics; RuleCoverage remains the
+/// authority for intersection, containment, and mapped-address semantics.
+struct RulesOverlapIndex {
+  private final class Node {
+    var rules: [ProxyRule] = []
+    var children: [String: Node] = [:]
+    func descendants() -> [ProxyRule] { rules + children.values.flatMap { $0.descendants() } }
+  }
+  private let root = Node()
+
+  init(rules: [ProxyRule]) {
+    for rule in rules {
+      var node = root
+      for component in Self.path(rule.match) {
+        if node.children[component] == nil { node.children[component] = Node() }
+        node = node.children[component]!
+      }
+      node.rules.append(rule)
+    }
+  }
+
+  func overlapping(_ match: RuleMatch) -> [ProxyRule] {
+    var node = root
+    var candidates = node.rules
+    for component in Self.path(match) {
+      guard let next = node.children[component] else {
+        return candidates.filter { RuleCoverage.intersects($0.match, match) }
+      }
+      node = next
+      candidates += node.rules
+    }
+    candidates += node.children.values.flatMap { $0.descendants() }
+    return candidates.filter { RuleCoverage.intersects($0.match, match) }
+  }
+
+  private static func path(_ match: RuleMatch) -> [String] {
+    switch match.pattern {
+    case .domainExact(let value), .domainSuffix(let value):
+      return ["domain"] + value.split(separator: ".").reversed().map(String.init)
+    case .ipv4CIDR, .ipv6CIDR:
+      guard let cidr = RuleCoverage.parseCIDR(match) else { return [] }
+      let bytes =
+        cidr.family == .ipv4
+        ? Array(repeating: UInt8(0), count: 10) + [255, 255] + cidr.bytes : cidr.bytes
+      let prefix = cidr.prefixLength + (cidr.family == .ipv4 ? 96 : 0)
+      return ["ip"]
+        + (0..<prefix).map { bit in
+          bytes[bit / 8] & (UInt8(1) << (7 - bit % 8)) == 0 ? "0" : "1"
+        }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/AtomicFileWriter.swift b/ShadowsocksX-NG2/Domain/Runtime/AtomicFileWriter.swift
new file mode 100644
index 000000000..a221630f0
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/AtomicFileWriter.swift
@@ -0,0 +1,56 @@
+import Foundation
+
+/// 敏感配置文件的原子写盘基线：目录 0700（含自愈）、临时文件
+/// 创建即 0600、写全校验后原子替换；任一步失败保留原文件。catalog.age、
+/// activation.json 与其他运行时文件共用同一物理安全基线。
+enum AtomicFileWriter {
+  enum WriteError: Error, Equatable {
+    case failure(detail: String)
+  }
+
+  /// 隐藏暂存名约定 `.<name>.tmp-<uuid>` 的唯一出处：write 内部使用，同目录
+  /// 内的 symlink 暂存也由此派生，保证泄漏的暂存项能被 `isResidueName` 识别。
+  static func temporaryURL(for targetURL: URL) -> URL {
+    targetURL.deletingLastPathComponent()
+      .appendingPathComponent(".\(targetURL.lastPathComponent).tmp-\(UUID().uuidString)")
+  }
+
+  /// 目录项是否为本写入器的暂存残留（宽松匹配：0700 私有目录内过扫无害）。
+  static func isResidueName(_ name: String) -> Bool {
+    name.hasPrefix(".") && name.contains(".tmp-")
+  }
+
+  /// 新建的父目录同样使用 0700；已有目标目录修复权限后才允许写入。
+  static func prepareDirectory(at directory: URL) throws {
+    try FileManager.default.createDirectory(
+      at: directory, withIntermediateDirectories: true, attributes: [.posixPermissions: 0o700])
+    try FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: directory.path)
+  }
+
+  /// 把 `data` 原子写入 `fileURL`（含父目录创建与 0700 基线自愈）。
+  static func write(_ data: Data, to fileURL: URL) throws {
+    do {
+      try prepareDirectory(at: fileURL.deletingLastPathComponent())
+    } catch {
+      throw WriteError.failure(detail: String(describing: error))
+    }
+    let temporaryURL = temporaryURL(for: fileURL)
+    if !FileManager.default.createFile(
+      atPath: temporaryURL.path,
+      contents: data,
+      attributes: [.posixPermissions: 0o600]
+    ) {
+      throw WriteError.failure(detail: "无法创建临时文件 \(temporaryURL.path)")
+    }
+    do {
+      if FileManager.default.fileExists(atPath: fileURL.path) {
+        _ = try FileManager.default.replaceItemAt(fileURL, withItemAt: temporaryURL)
+      } else {
+        try FileManager.default.moveItem(at: temporaryURL, to: fileURL)
+      }
+    } catch {
+      try? FileManager.default.removeItem(at: temporaryURL)
+      throw WriteError.failure(detail: String(describing: error))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/EndpointHealthProbe.swift b/ShadowsocksX-NG2/Domain/Runtime/EndpointHealthProbe.swift
new file mode 100644
index 000000000..0536a1c35
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/EndpointHealthProbe.swift
@@ -0,0 +1,60 @@
+import Darwin
+import Foundation
+
+/// 本地端点健康探测：进程存在不等于代理可用——激活后以
+/// TCP 连接确认 sslocal 实际完成监听绑定。探测只做客户端 connect，不建立
+/// 带复用选项的监听 socket（Legacy 的 reuse-port 残留假成功在此构造上不可
+/// 复现）；失败详情供「启动失败」点名端点与端口。
+enum EndpointHealthProbe {
+  enum Outcome: Equatable {
+    case reachable
+    /// 立即失败（连接被拒、地址不可达等），携带系统层原因。
+    case refused(detail: String)
+    /// 超时内未完成连接。
+    case timedOut
+  }
+
+  static func probe(host: String, port: Int, timeout: TimeInterval) -> Outcome {
+    var hints = addrinfo()
+    hints.ai_family = AF_UNSPEC
+    hints.ai_socktype = SOCK_STREAM
+    hints.ai_protocol = IPPROTO_TCP
+    var info: UnsafeMutablePointer<addrinfo>?
+    guard getaddrinfo(host, String(port), &hints, &info) == 0, let first = info else {
+      return .refused(detail: "监听地址无法解析")
+    }
+    defer { freeaddrinfo(info) }
+
+    var lastFailure: Outcome?
+    for candidate in sequence(first: first, next: { $0.pointee.ai_next }) {
+      let descriptor = socket(
+        candidate.pointee.ai_family, candidate.pointee.ai_socktype, candidate.pointee.ai_protocol)
+      guard descriptor >= 0 else { continue }
+      defer { close(descriptor) }
+
+      let previousFlags = fcntl(descriptor, F_GETFL, 0)
+      _ = fcntl(descriptor, F_SETFL, previousFlags | O_NONBLOCK)
+      if connect(descriptor, candidate.pointee.ai_addr, candidate.pointee.ai_addrlen) == 0 {
+        return .reachable
+      }
+      guard errno == EINPROGRESS else {
+        lastFailure = .refused(detail: String(cString: strerror(errno)))
+        continue
+      }
+      var pollDescriptor = pollfd(fd: descriptor, events: Int16(POLLOUT), revents: 0)
+      let pollResult = poll(&pollDescriptor, 1, Int32(timeout * 1000))
+      guard pollResult > 0 else {
+        lastFailure = lastFailure ?? .timedOut
+        continue
+      }
+      var socketError: Int32 = 0
+      var length = socklen_t(MemoryLayout<Int32>.size)
+      getsockopt(descriptor, SOL_SOCKET, SO_ERROR, &socketError, &length)
+      if socketError == 0 {
+        return .reachable
+      }
+      lastFailure = .refused(detail: String(cString: strerror(socketError)))
+    }
+    return lastFailure ?? .refused(detail: "无法建立连接")
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/LogLine.swift b/ShadowsocksX-NG2/Domain/Runtime/LogLine.swift
new file mode 100644
index 000000000..3e6d9ecfe
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/LogLine.swift
@@ -0,0 +1,145 @@
+import Foundation
+import os
+
+/// 查看器口径的日志级别（经典三级）：error / warning / info。里程碑事件归
+/// info，上游 WARN/WARNING 归 warning。它与统一日志的五级投影是两个口径：
+/// 投影规则见 `OSLogType(_: LogLineLevel)`（warning 落持久 .default）。
+enum LogLineLevel: String, Sendable {
+  case error, warning, info
+
+  /// 上游自由文本的级别探测：按空白分隔 token 匹配级别名
+  /// （tracing/env_logger 文本格式的 ERROR/WARN/WARNING），忽略大小写，并支持
+  /// token 外的一对方括号。探测不到一律 `.info`；上游改格式时优雅退化，不丢行。
+  static func detect(in line: String) -> LogLineLevel {
+    for token in line.split(whereSeparator: \.isWhitespace) {
+      let levelToken =
+        token.hasPrefix("[") && token.hasSuffix("]")
+        ? token.dropFirst().dropLast()
+        : token[...]
+      switch levelToken.uppercased() {
+      case "ERROR": return .error
+      case "WARN", "WARNING": return .warning
+      default: continue
+      }
+    }
+    return .info
+  }
+}
+
+/// 日志行来源：GUI 事件、wrapper 事件与 sslocal 上游输出。查看器的来源
+/// 过滤按它区分；行格式里作为显式标记，报障粘贴自描述。
+enum LogLineSource: String, Sendable {
+  case gui, wrapper, sslocal
+}
+
+/// 统一日志行模型：「一行日志是什么」在本类型收口——写侧（agent.log 的
+/// stderr 通路）与读侧（诊断日志查看器）共用同一渲染与解析。行格式：
+/// `yyyy-MM-dd HH:mm:ss.SSS Z [error|warning|info] [gui|wrapper|sslocal] 正文`，
+/// 时间戳固定 POSIX locale，报障对照不随用户区域漂移。
+struct LogLine: Equatable, Sendable {
+  /// 写侧行必有时间戳；旧格式行（升级前落盘）无法解析时为 nil。
+  var timestamp: Date?
+  var level: LogLineLevel
+  var source: LogLineSource
+  /// 行正文：事件描述或上游原样文本（已脱敏）。
+  var text: String
+
+  init(timestamp: Date?, level: LogLineLevel, source: LogLineSource, text: String) {
+    self.timestamp = timestamp
+    self.level = level
+    self.source = source
+    self.text = text
+  }
+
+  /// 呈现行文本。无时间戳的旧格式行保留原文（raw capture 不改写）。
+  var rendered: String {
+    guard let timestamp else { return text }
+    return "\(Self.timestampFormatter.string(from: timestamp))"
+      + " [\(level.rawValue)] [\(source.rawValue)] \(text)"
+  }
+
+  /// 严格解析统一行格式；无法解析返回 nil，由调用方走 `legacy` 降级。
+  static func parse(_ raw: String) -> LogLine? {
+    guard let stampEnd = raw.range(of: " [")?.lowerBound else { return nil }
+    let stamp = String(raw[..<stampEnd])
+    guard
+      let timestamp = timestampFormatter.date(from: stamp)
+        ?? legacyTimestampFormatter.date(from: stamp)
+    else { return nil }
+    var rest = raw[stampEnd...]
+    guard let level = takeToken(&rest, as: LogLineLevel.self),
+      let source = takeToken(&rest, as: LogLineSource.self),
+      rest.hasPrefix(" ")
+    else { return nil }
+    rest = rest.dropFirst()
+    return LogLine(timestamp: timestamp, level: level, source: source, text: String(rest))
+  }
+
+  /// 旧格式行降级：原文保留显示，级别尽力探测，来源按旧 `ssxng:` 事件标记
+  /// 区分 wrapper 事件与上游输出；时间未知。
+  static func legacy(_ raw: String) -> LogLine {
+    LogLine(
+      timestamp: nil,
+      level: .detect(in: raw),
+      source: raw.hasPrefix("ssxng: ") ? .wrapper : .sslocal,
+      text: raw)
+  }
+
+  /// 从行首消费一个 ` [token]` 标记（含前导空格，不含尾随分隔空格）。
+  private static func takeToken<Value: RawRepresentable>(
+    _ line: inout Substring, as type: Value.Type
+  ) -> Value? where Value.RawValue == String {
+    guard line.hasPrefix(" [") else { return nil }
+    line = line.dropFirst(2)
+    guard let end = line.firstIndex(of: "]") else { return nil }
+    let value = Value(rawValue: String(line[line.startIndex..<end]))
+    line = line[line.index(after: end)...]
+    return value
+  }
+
+  /// DateFormatter 在现代 Foundation 中线程安全；本格式器只被读取。
+  static let timestampFormatter = makeTimestampFormatter("yyyy-MM-dd HH:mm:ss.SSS Z")
+
+  // 升级前的行没有时区，只能按本地时间读取；新行必须保留回拨前后的偏移量。
+  private static let legacyTimestampFormatter = makeTimestampFormatter("yyyy-MM-dd HH:mm:ss.SSS")
+
+  private static func makeTimestampFormatter(_ format: String) -> DateFormatter {
+    let formatter = DateFormatter()
+    formatter.locale = Locale(identifier: "en_US_POSIX")
+    formatter.dateFormat = format
+    return formatter
+  }
+}
+
+extension LogLine {
+  /// 事件行：级别取自事件的统一日志路由级别（失败类 error，其余归 info），
+  /// 正文为事件描述。stderr 行式输出与 GUI 查看面共用这一构造。
+  init(event: RuntimeLogEvent, timestamp: Date?, source: LogLineSource) {
+    self.init(
+      timestamp: timestamp,
+      level: LogLineLevel(os: event.systemLogRoute.level),
+      source: source,
+      text: event.description)
+  }
+}
+
+extension OSLogType {
+  /// 查看器三级级别 → 统一日志五级投影：warning 落持久的 `.default`
+  /// （统一日志没有 warning 级，与 error 可区分）；info 落 `.info`
+  /// （stream 可见、不落盘）。
+  init(_ level: LogLineLevel) {
+    switch level {
+    case .error: self = .error
+    case .warning: self = .default
+    case .info: self = .info
+    }
+  }
+}
+
+extension LogLineLevel {
+  /// 统一日志级别 → 查看器三级：失败类归 error，里程碑（default）与冗长
+  /// 测量（info/debug）归 info。
+  init(os level: OSLogType) {
+    self = (level == .error || level == .fault) ? .error : .info
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/PortOccupancyProbe.swift b/ShadowsocksX-NG2/Domain/Runtime/PortOccupancyProbe.swift
new file mode 100644
index 000000000..bb5042992
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/PortOccupancyProbe.swift
@@ -0,0 +1,340 @@
+import Darwin
+import Foundation
+
+/// 端口占用判定结果。空闲与占用之外还有「无法判定」：绑定测试自身失败
+/// （特权端口、socket 不可用等）时如实呈现，不冒充空闲。监听地址由
+/// `ListenerMode.bindAddress` 封闭集合保证可解析，属编程错误而非判定结果。
+enum PortOccupancy: Equatable, Sendable {
+  case free
+  /// 端口不可绑定；进程名/PID 尽力解析并按地址族记录。`unverifiedFamilyDetail`
+  /// 表示双栈另一地址族无法判定，但不抹去已确认的占用。
+  case occupied(PortOccupancyFacts)
+  case unknown(detail: String)
+}
+
+struct PortOccupancyFacts: Equatable, Sendable {
+  let occupier: String?
+  let processIDsByFamily: [PortOccupancyAddressFamily: Set<Int32>]
+  let occupiedFamilies: Set<PortOccupancyAddressFamily>
+  let verifiedFamilies: Set<PortOccupancyAddressFamily>
+  let unverifiedFamilyDetail: String?
+
+  init(
+    occupier: String?, ipv4ProcessIDs: Set<Int32> = [], ipv6ProcessIDs: Set<Int32> = [],
+    occupiedFamilies: Set<PortOccupancyAddressFamily> = [],
+    verifiedFamilies: Set<PortOccupancyAddressFamily> = [], unverifiedFamilyDetail: String? = nil
+  ) {
+    self.occupier = occupier
+    processIDsByFamily = [
+      .ipv4: ipv4ProcessIDs,
+      .ipv6: ipv6ProcessIDs,
+    ]
+    self.occupiedFamilies = occupiedFamilies
+    self.verifiedFamilies = verifiedFamilies
+    self.unverifiedFamilyDetail = unverifiedFamilyDetail
+  }
+
+  init(merging facts: [PortOccupancyFacts], unverifiedFamilyDetail: String?) {
+    occupier = facts.lazy.compactMap(\.occupier).first
+    processIDsByFamily = Dictionary(
+      uniqueKeysWithValues: PortOccupancyAddressFamily.allCases.map { family in
+        (family, facts.reduce(into: Set<Int32>()) { $0.formUnion($1.processIDs(for: family)) })
+      })
+    occupiedFamilies = facts.reduce(into: Set<PortOccupancyAddressFamily>()) {
+      $0.formUnion($1.occupiedFamilies)
+    }
+    verifiedFamilies = facts.reduce(into: Set<PortOccupancyAddressFamily>()) {
+      $0.formUnion($1.verifiedFamilies)
+    }
+    self.unverifiedFamilyDetail =
+      unverifiedFamilyDetail ?? facts.lazy.compactMap(\.unverifiedFamilyDetail).first
+  }
+
+  func processIDs(for family: PortOccupancyAddressFamily) -> Set<Int32> {
+    processIDsByFamily[family, default: []]
+  }
+
+  var occupiedProcessIDs: Set<Int32> {
+    occupiedFamilies.reduce(into: Set<Int32>()) { processIDs, family in
+      processIDs.formUnion(self.processIDs(for: family))
+    }
+  }
+}
+
+enum PortOccupancyAddressFamily: CaseIterable, Hashable, Sendable {
+  case ipv4
+  case ipv6
+
+  var lsofFilter: String {
+    switch self {
+    case .ipv4: "-i4TCP"
+    case .ipv6: "-i6TCP"
+    }
+  }
+}
+
+private struct PortOccupierFamilyFacts {
+  let name: String?
+  let processIDs: Set<Int32>
+  let isVerified: Bool
+}
+
+private struct PortOccupierFacts {
+  let ipv4: PortOccupierFamilyFacts
+  let ipv6: PortOccupierFamilyFacts
+
+  var verifiedFamilies: Set<PortOccupancyAddressFamily> {
+    var families: Set<PortOccupancyAddressFamily> = []
+    if ipv4.isVerified { families.insert(.ipv4) }
+    if ipv6.isVerified { families.insert(.ipv6) }
+    return families
+  }
+}
+
+extension RuntimeListenFacts {
+  func port(for endpoint: ProxyEndpointKind) -> Int {
+    switch endpoint {
+    case .socks: socksPort
+    case .http: httpPort
+    case .lanSocks: lan.socksPort
+    case .lanHTTP: lan.httpPort
+    }
+  }
+
+  func replacingPort(_ port: Int, for endpoint: ProxyEndpointKind) -> RuntimeListenFacts {
+    var result = self
+    switch endpoint {
+    case .socks:
+      result = RuntimeListenFacts(listenerMode: listenerMode, socksPort: port, httpPort: httpPort)
+      result.lan = lan
+    case .http:
+      result = RuntimeListenFacts(listenerMode: listenerMode, socksPort: socksPort, httpPort: port)
+      result.lan = lan
+    case .lanSocks: result.lan.socksPort = port
+    case .lanHTTP: result.lan.httpPort = port
+    }
+    return result
+  }
+}
+
+/// A port probe request carries the complete effective listener identity. The
+/// requested port may differ from `listen.port(for:)` only for a suggested
+/// candidate; the rest of the listener facts remain part of the request.
+struct PortOccupancyProbeRequest: Equatable, Sendable {
+  let endpoint: ProxyEndpointKind
+  let listen: RuntimeListenFacts
+  let port: Int
+
+  init(
+    endpoint: ProxyEndpointKind,
+    listen: RuntimeListenFacts,
+    port: Int? = nil
+  ) {
+    self.endpoint = endpoint
+    self.listen = listen
+    self.port = port ?? listen.port(for: endpoint)
+  }
+
+  var listenerMode: ListenerMode {
+    switch endpoint {
+    case .socks, .http: listen.listenerMode
+    case .lanSocks, .lanHTTP: listen.lan.effectiveMode
+    }
+  }
+
+  var bindAddress: String { listenerMode.bindAddress }
+}
+
+/// 端口占用探测缝：设置编辑期的即时占用校验。激活是否成功
+/// 仍以 runtime 实际绑定为准（健康门禁），本探测不构成权威判定。
+protocol PortOccupancyProbing: Sendable {
+  func occupancy(for request: PortOccupancyProbeRequest) async -> PortOccupancy
+}
+
+/// 系统实现：对 `bindAddress:port` 做一次不带复用选项的 TCP bind + listen，
+/// 能实际开始监听才算空闲；`EADDRINUSE` 即占用。部分地址族组合在 bind 阶段
+/// 允许共存，到 listen 阶段才报告冲突，因此两步都要覆盖。占用时尽力以
+/// `lsof` 解析监听进程名。探测不设置 SO_REUSEADDR/SO_REUSEPORT，避免假空闲。
+struct SystemPortOccupancyProbe: PortOccupancyProbing {
+  func occupancy(for request: PortOccupancyProbeRequest) async -> PortOccupancy {
+    occupancy(port: request.port, listenerMode: request.listenerMode)
+  }
+
+  func occupancy(port: Int, listenerMode: ListenerMode) -> PortOccupancy {
+    switch listenerMode {
+    case .disabled, .allIPv4Interfaces:
+      return ipv4Occupancy(port: port, listenerMode: listenerMode)
+    case .allIPv4AndIPv6Interfaces:
+      return dualStackOccupancy(port: port, listenerMode: listenerMode)
+    case .allIPv6Interfaces:
+      return ipv6Occupancy(port: port, listenerMode: listenerMode)
+    }
+  }
+
+  /// A dual-stack listener needs both families available. Some macOS versions
+  /// permit an IPv4 listener and a v6 socket with `IPV6_V6ONLY=false` to bind at
+  /// once, so probe IPv4 separately instead of relying on that socket conflict.
+  private func dualStackOccupancy(port: Int, listenerMode: ListenerMode) -> PortOccupancy {
+    let ipv6 = ipv6Occupancy(port: port, listenerMode: listenerMode)
+    let ipv4 = ipv4Occupancy(port: port, listenerMode: .allIPv4Interfaces)
+    var occupiedFacts: [PortOccupancyFacts] = []
+    for result in [ipv6, ipv4] {
+      guard case .occupied(let facts) = result else { continue }
+      occupiedFacts.append(facts)
+    }
+    if !occupiedFacts.isEmpty {
+      return .occupied(
+        PortOccupancyFacts(
+          merging: occupiedFacts, unverifiedFamilyDetail: Self.unknownDetail(in: [ipv6, ipv4])))
+    }
+    if case .unknown(let detail) = ipv6 { return .unknown(detail: detail) }
+    if case .unknown(let detail) = ipv4 { return .unknown(detail: detail) }
+    return .free
+  }
+
+  private static func unknownDetail(in results: [PortOccupancy]) -> String? {
+    for result in results {
+      if case .unknown(let detail) = result { return detail }
+      if case .occupied(let facts) = result, let detail = facts.unverifiedFamilyDetail {
+        return detail
+      }
+    }
+    return nil
+  }
+
+  private func ipv4Occupancy(port: Int, listenerMode: ListenerMode) -> PortOccupancy {
+    var address = sockaddr_in()
+    address.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_port = in_port_t(port).bigEndian
+    // 本函数只处理 IPv4 模式（disabled / allIPv4Interfaces），其 bindAddress
+    // 恒为 127.0.0.1 或 0.0.0.0；"::" 走 ipv6Occupancy，不经此路径。
+    let parsed = inet_pton(AF_INET, listenerMode.bindAddress, &address.sin_addr)
+    precondition(parsed == 1, "IPv4 探测的 ListenerMode.bindAddress 必须可解析")
+    let descriptor = socket(AF_INET, SOCK_STREAM, 0)
+    guard descriptor >= 0 else {
+      return .unknown(detail: String(cString: strerror(errno)))
+    }
+    defer { close(descriptor) }
+    return bindAndListen(descriptor: descriptor, port: port, addressFamily: .ipv4) {
+      withUnsafePointer(to: &address) { pointer in
+        pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+          bind(descriptor, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
+        }
+      }
+    }
+  }
+
+  private func ipv6Occupancy(port: Int, listenerMode: ListenerMode) -> PortOccupancy {
+    var address = sockaddr_in6()
+    address.sin6_len = UInt8(MemoryLayout<sockaddr_in6>.size)
+    address.sin6_family = sa_family_t(AF_INET6)
+    address.sin6_port = in_port_t(port).bigEndian
+    address.sin6_addr = in6addr_any
+    let descriptor = socket(AF_INET6, SOCK_STREAM, 0)
+    guard descriptor >= 0 else {
+      return .unknown(detail: String(cString: strerror(errno)))
+    }
+    defer { close(descriptor) }
+
+    var ipv6Only = Int32(listenerMode.ipv6Only == true ? 1 : 0)
+    let optionResult = withUnsafePointer(to: &ipv6Only) { pointer in
+      setsockopt(
+        descriptor, IPPROTO_IPV6, IPV6_V6ONLY, pointer,
+        socklen_t(MemoryLayout<Int32>.size))
+    }
+    guard optionResult == 0 else {
+      return .unknown(detail: String(cString: strerror(errno)))
+    }
+    return bindAndListen(descriptor: descriptor, port: port, addressFamily: .ipv6) {
+      withUnsafePointer(to: &address) { pointer in
+        pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+          bind(descriptor, $0, socklen_t(MemoryLayout<sockaddr_in6>.size))
+        }
+      }
+    }
+  }
+
+  private func bindAndListen(
+    descriptor: Int32, port: Int, addressFamily: PortOccupancyAddressFamily,
+    bind: () -> Int32
+  ) -> PortOccupancy {
+    guard bind() == 0 else { return socketFailure(errno, port: port, addressFamily: addressFamily) }
+    guard listen(descriptor, 1) == 0 else {
+      return socketFailure(errno, port: port, addressFamily: addressFamily)
+    }
+    return .free
+  }
+
+  private func socketFailure(
+    _ code: Int32, port: Int, addressFamily: PortOccupancyAddressFamily
+  ) -> PortOccupancy {
+    guard code == EADDRINUSE else { return .unknown(detail: String(cString: strerror(code))) }
+    let owner = Self.occupierFacts(port: port)
+    return .occupied(
+      PortOccupancyFacts(
+        occupier: owner.ipv4.name ?? owner.ipv6.name,
+        ipv4ProcessIDs: owner.ipv4.processIDs,
+        ipv6ProcessIDs: owner.ipv6.processIDs,
+        occupiedFamilies: [addressFamily],
+        verifiedFamilies: owner.verifiedFamilies))
+  }
+
+  /// `lsof` 尽力解析监听进程名：本产品代理进程与 GUI 同用户运行，无需特权；
+  /// lsof 缺失、失败或无匹配时返回 nil，不影响占用判定本身。
+  private static func occupierFacts(port: Int) -> PortOccupierFacts {
+    PortOccupierFacts(
+      ipv4: occupierFacts(port: port, addressFamily: .ipv4),
+      ipv6: occupierFacts(port: port, addressFamily: .ipv6))
+  }
+
+  private static func occupierFacts(
+    port: Int, addressFamily: PortOccupancyAddressFamily
+  ) -> PortOccupierFamilyFacts {
+    let process = Process()
+    process.executableURL = URL(fileURLWithPath: "/usr/sbin/lsof")
+    process.arguments = lsofArguments(port: port, addressFamily: addressFamily)
+    let pipe = Pipe()
+    process.standardOutput = pipe
+    process.standardError = Pipe()
+    do {
+      try process.run()
+    } catch {
+      return PortOccupierFamilyFacts(name: nil, processIDs: [], isVerified: false)
+    }
+    let data = pipe.fileHandleForReading.readDataToEndOfFile()
+    process.waitUntilExit()
+    let output = String(data: data, encoding: .utf8) ?? ""
+    let isVerified =
+      process.terminationStatus == 0 || (process.terminationStatus == 1 && output.isEmpty)
+    return PortOccupierFamilyFacts(
+      name: occupierProcessName(fromLsofOutput: output),
+      processIDs: occupierProcessIDs(fromLsofOutput: output),
+      isVerified: isVerified)
+  }
+
+  static func lsofArguments(port: Int, addressFamily: PortOccupancyAddressFamily) -> [String] {
+    ["-nP", "\(addressFamily.lsofFilter):\(port)", "-sTCP:LISTEN"]
+  }
+
+  /// 从 lsof 输出解析第一个数据行的进程名（首字段）；表头与空行跳过。
+  static func occupierProcessName(fromLsofOutput output: String) -> String? {
+    for line in output.split(whereSeparator: \.isNewline) {
+      let fields = line.split(
+        maxSplits: 1, omittingEmptySubsequences: true, whereSeparator: \.isWhitespace)
+      guard let name = fields.first, name != "COMMAND" else { continue }
+      return String(name)
+    }
+    return nil
+  }
+
+  static func occupierProcessIDs(fromLsofOutput output: String) -> Set<Int32> {
+    Set(
+      output.split(whereSeparator: \.isNewline).compactMap { line in
+        let fields = line.split(
+          maxSplits: 2, omittingEmptySubsequences: true, whereSeparator: \.isWhitespace)
+        guard fields.first != "COMMAND", fields.count > 1 else { return nil }
+        return Int32(fields[1])
+      })
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/ProxyACL.swift b/ShadowsocksX-NG2/Domain/Runtime/ProxyACL.swift
new file mode 100644
index 000000000..fc5dcdeed
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/ProxyACL.swift
@@ -0,0 +1,181 @@
+import CryptoKit
+import Foundation
+
+/// Fixed local targets bypass the system proxy. Their IP ranges and host rules
+/// also enter the sslocal ACL for requests reaching either inbound.
+enum FixedLocalProxyRanges {
+  static let ipRanges = [
+    "127.0.0.0/8",
+    "10.0.0.0/8",
+    "172.16.0.0/12",
+    "192.168.0.0/16",
+    "169.254.0.0/16",
+    "::1/128",
+    "fe80::/10",
+    "fc00::/7",
+  ]
+
+  static let systemProxyHostExceptions = ["localhost", "*.local"]
+
+  static var systemProxyExceptions: [String] {
+    ipRanges + systemProxyHostExceptions
+  }
+
+  static func systemProxyExceptions(including values: [String]?) -> [String] {
+    var result: [String] = []
+    var seen = Set<String>()
+    for value in systemProxyExceptions + (values ?? []) {
+      let identity = value.lowercased()
+      guard seen.insert(identity).inserted else { continue }
+      result.append(value)
+    }
+    return result
+  }
+
+  static let aclHostRules = ["||localhost", "||local", "^[^.]+$"]
+
+  static var aclBypassRules: [String] {
+    ipRanges + aclHostRules
+  }
+}
+
+/// GUI 生成的 ACL 与变体身份。正文仅用于准备 ACL 文件；私有意图编码
+/// 只包含 path/summary/sha256，上游配置只包含稳定 ACL 路径。
+/// 身份相等性忽略正文，避免把大规则文本带入比较。
+struct ProxyACLDocument: Codable, Equatable, Sendable {
+  let path: String
+  let summary: String
+  let content: String
+  let sha256: String
+
+  enum CodingKeys: String, CodingKey {
+    case path, summary, sha256
+  }
+
+  init(path: String, summary: String, content: String) {
+    self.init(path: path, summary: summary, content: content, sha256: Self.digest(content))
+  }
+
+  init(path: String, summary: String, content: String, sha256: String) {
+    self.path = path
+    self.summary = summary
+    self.content = content
+    self.sha256 = sha256
+  }
+
+  init(from decoder: Decoder) throws {
+    let container = try decoder.container(keyedBy: CodingKeys.self)
+    path = try container.decode(String.self, forKey: .path)
+    summary = try container.decode(String.self, forKey: .summary)
+    sha256 = try container.decode(String.self, forKey: .sha256)
+    content = ""
+  }
+
+  func encode(to encoder: Encoder) throws {
+    var container = encoder.container(keyedBy: CodingKeys.self)
+    try container.encode(path, forKey: .path)
+    try container.encode(summary, forKey: .summary)
+    try container.encode(sha256, forKey: .sha256)
+  }
+
+  static func == (lhs: ProxyACLDocument, rhs: ProxyACLDocument) -> Bool {
+    lhs.path == rhs.path && lhs.summary == rhs.summary && lhs.sha256 == rhs.sha256
+  }
+
+  /// Direct mode deliberately has no `proxy_list`: `bypass_all` supplies the
+  /// default, while the explicit fixed-local entries remain a safety policy
+  /// shared by SOCKS and HTTP and reusable by later routing modes.
+  static func direct(at fileURL: URL) -> ProxyACLDocument {
+    makeDocument(
+      at: fileURL, header: "[bypass_all]", summary: "direct")
+  }
+
+  /// 全局模式：公网目标默认走 Shadowsocks 代理，本地网络目标固定
+  /// 直连。ACL 只含固定本地安全绕过，不混入中国列表、GFWList 或自定义规则；
+  /// SOCKS、HTTP 入站与局域网共享客户端共用此策略。IPv6 系统例外不构成已验证
+  /// 的绕过保证，本 ACL 才是路由兜底。
+  static func global(at fileURL: URL) -> ProxyACLDocument {
+    makeDocument(
+      at: fileURL, header: "[proxy_all]", summary: "global")
+  }
+
+  /// 规则模式：默认动作决定 ACL 骨架，调用方按默认动作
+  /// 传入对应来源的候选（两种默认动作不把全部内置来源无条件并集）。
+  ///
+  /// - 「未匹配时代理」：`proxy_all` + 中国域名/CIDR 直连候选进 `bypass_list`。
+  /// - 「未匹配时直连」：`bypass_all` + GFWList 可生效代理规则进 `proxy_list`；
+  /// 未匹配目标与无可用规则命中的 IP 字面目标直连。
+  ///
+  /// 固定本地绕过优先；CIDR 判定可能触发本地 DNS 查询。
+  static func rule(
+    at fileURL: URL,
+    defaultAction: RuleDefaultAction,
+    rules: [ProxyRule]
+  ) -> ProxyACLDocument {
+    // Select expressed actions before any coverage analysis. Keep fixed policy
+    // first; equivalent source entries and array order never change ACL bytes.
+    let directLines = Array(Set(rules.filter { $0.action == .direct }.map(\.aclLine)))
+      .filter { !FixedLocalProxyRanges.aclBypassRules.contains($0) }.sorted()
+    let proxyLines = Array(Set(rules.filter { $0.action == .proxy }.map(\.aclLine))).sorted()
+    switch defaultAction {
+    case .proxyWhenUnmatched:
+      // proxy_all + 直连候选进 bypass_list（中国域名 / IPv4 CIDR）。
+      let bypass =
+        FixedLocalProxyRanges.aclBypassRules
+        + directLines
+      return makeDocument(
+        at: fileURL, header: "[proxy_all]", summary: "rule-proxy-default",
+        bypassRules: bypass, proxyRules: [])
+    case .directWhenUnmatched:
+      // bypass_all + GFWList 可生效规则：代理候选进 proxy_list，未遮蔽例外
+      // 进 bypass_list。两种默认动作不无条件并集中国来源。
+      let bypass =
+        FixedLocalProxyRanges.aclBypassRules
+        + directLines
+      let proxy = proxyLines
+      return makeDocument(
+        at: fileURL, header: "[bypass_all]", summary: "rule-direct-default",
+        bypassRules: bypass, proxyRules: proxy)
+    }
+  }
+
+  private static func makeDocument(
+    at fileURL: URL, header: String, summary: String,
+    bypassRules: [String] = FixedLocalProxyRanges.aclBypassRules,
+    proxyRules: [String] = []
+  ) -> ProxyACLDocument {
+    var lines = [header, "[bypass_list]"] + bypassRules
+    if !proxyRules.isEmpty {
+      lines.append("[proxy_list]")
+      lines.append(contentsOf: proxyRules)
+    }
+    return ProxyACLDocument(
+      path: fileURL.standardizedFileURL.path,
+      summary: summary,
+      content: lines.joined(separator: "\n") + "\n")
+  }
+
+  var isWellFormed: Bool {
+    guard
+      path.hasPrefix("/"),
+      !summary.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty,
+      sha256.count == 64,
+      sha256.allSatisfy({ $0.isHexDigit })
+    else { return false }
+    // 生成侧携带 content 时自证摘要；解码侧无 content，按身份形状收下
+    // （ADR-0011：Agent 不读 sidecar，摘要一致性由 GUI 写入序保证）。
+    if content.isEmpty { return true }
+    return content.utf8.allSatisfy { $0 < 128 }
+      && sha256 == Self.digest(content)
+  }
+
+  static func digest(_ content: String) -> String {
+    digest(Data(content.utf8))
+  }
+
+  static func digest(_ data: Data) -> String {
+    SHA256.hash(data: data)
+      .map { String(format: "%02x", $0) }
+      .joined()
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/ProxyListeningConfiguration.swift b/ShadowsocksX-NG2/Domain/Runtime/ProxyListeningConfiguration.swift
new file mode 100644
index 000000000..bdbbb0d0d
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/ProxyListeningConfiguration.swift
@@ -0,0 +1,187 @@
+import Foundation
+
+/// The allowed range for local proxy listener ports.
+enum ProxyPortRange {
+  static let valid = 1025...65_535
+}
+
+/// 本机入口始终开启，端口是独立保存的配置。
+struct LocalListeningSettings: Codable, Equatable, Sendable {
+  var socksPort = 11086
+  var httpPort = 11087
+}
+
+/// 网络共享入口与本机入口共存，凭据随配置整体加密保存。
+struct LANListeningSettings: Codable, Equatable, Sendable {
+  var isEnabled = false
+  var mode: LANListenerMode = .allIPv4Interfaces
+  var socksPort = 11088
+  var httpPort = 11089
+  var udpRelayEnabled = false
+  var authenticationEnabled = false
+  var username = "user"
+  var password: String?
+
+  var effectiveMode: ListenerMode { isEnabled ? mode.bindingMode : .disabled }
+}
+
+/// 不含认证密码的监听事实，供运行元数据、占用检查和界面投影使用。
+struct LANListeningFacts: Codable, Equatable, Sendable {
+  var isEnabled = false
+  var mode: LANListenerMode = .allIPv4Interfaces
+  var socksPort = 11088
+  var httpPort = 11089
+  var udpRelayEnabled = false
+  var authenticationEnabled = false
+  var username = "user"
+
+  init() {}
+
+  init(_ settings: LANListeningSettings) {
+    isEnabled = settings.isEnabled
+    mode = settings.mode
+    socksPort = settings.socksPort
+    httpPort = settings.httpPort
+    udpRelayEnabled = settings.udpRelayEnabled
+    authenticationEnabled = settings.authenticationEnabled
+    username = settings.username
+  }
+
+  var effectiveMode: ListenerMode { isEnabled ? mode.bindingMode : .disabled }
+
+  var configuration: LANListeningSettings {
+    var settings = LANListeningSettings()
+    settings.isEnabled = isEnabled
+    settings.mode = mode
+    settings.socksPort = socksPort
+    settings.httpPort = httpPort
+    settings.udpRelayEnabled = udpRelayEnabled
+    settings.authenticationEnabled = authenticationEnabled
+    settings.username = username
+    return settings
+  }
+}
+
+/// 局域网地址族配置；关闭时仍保留所选方式。
+enum LANListenerMode: String, Codable, CaseIterable, Equatable, Sendable {
+  case allIPv4Interfaces = "all_ipv4_interfaces"
+  case allIPv4AndIPv6Interfaces = "all_ipv4_and_ipv6_interfaces"
+  case allIPv6Interfaces = "all_ipv6_interfaces"
+
+  var bindingMode: ListenerMode {
+    switch self {
+    case .allIPv4Interfaces: .allIPv4Interfaces
+    case .allIPv4AndIPv6Interfaces: .allIPv4AndIPv6Interfaces
+    case .allIPv6Interfaces: .allIPv6Interfaces
+    }
+  }
+
+  var bindAddress: String { bindingMode.bindAddress }
+  var bindingHint: String { bindingMode.bindingHint }
+  var displayName: String { bindingMode.displayName }
+}
+
+struct ProxyListeningConfiguration: Codable, Equatable, Sendable {
+  static let defaultSocksPort = 11086
+  static let defaultHTTPPort = 11087
+
+  var local = LocalListeningSettings()
+  var lan = LANListeningSettings()
+
+  init(
+    listenerMode: ListenerMode = .disabled,
+    socksPort: Int = Self.defaultSocksPort, httpPort: Int = Self.defaultHTTPPort
+  ) {
+    local = LocalListeningSettings(socksPort: socksPort, httpPort: httpPort)
+    self.listenerMode = listenerMode
+  }
+
+  var listenerMode: ListenerMode {
+    get { lan.effectiveMode }
+    set {
+      lan.isEnabled = newValue != .disabled
+      if let mode = LANListenerMode(rawValue: newValue.rawValue) { lan.mode = mode }
+    }
+  }
+  var socksPort: Int {
+    get { local.socksPort }
+    set { local.socksPort = newValue }
+  }
+  var httpPort: Int {
+    get { local.httpPort }
+    set { local.httpPort = newValue }
+  }
+  var bindAddress: String { "127.0.0.1" }
+  var mode: String { "tcp_and_udp" }
+  var configuredPorts: [Int] { [socksPort, httpPort, lan.socksPort, lan.httpPort] }
+
+  var locals: [SslocalLocalDocument] {
+    var result = [
+      SslocalLocalDocument(
+        inboundProtocol: "socks", localAddress: bindAddress,
+        localPort: socksPort, mode: mode),
+      SslocalLocalDocument(
+        inboundProtocol: "http", localAddress: bindAddress,
+        localPort: httpPort, mode: "tcp_only"),
+    ]
+    if lan.isEnabled {
+      result += [
+        SslocalLocalDocument(
+          inboundProtocol: "socks", localAddress: lan.mode.bindAddress,
+          localPort: lan.socksPort, mode: lan.udpRelayEnabled ? "tcp_and_udp" : "tcp_only"),
+        SslocalLocalDocument(
+          inboundProtocol: "http", localAddress: lan.mode.bindAddress,
+          localPort: lan.httpPort, mode: "tcp_only"),
+      ]
+    }
+    return result
+  }
+}
+
+/// Typed effective listener facts exposed by the runtime boundary. This is the
+/// complete identity of the listeners that are actually intended to be bound.
+struct RuntimeListenFacts: Equatable, Sendable {
+  let listenerMode: ListenerMode
+  let socksPort: Int
+  let httpPort: Int
+  var lan = LANListeningFacts()
+
+  init(listen: ProxyListeningConfiguration) {
+    self.init(
+      listenerMode: .disabled,
+      socksPort: listen.socksPort,
+      httpPort: listen.httpPort)
+    lan = LANListeningFacts(listen.lan)
+  }
+
+  init(
+    listenerMode: ListenerMode,
+    socksPort: Int,
+    httpPort: Int
+  ) {
+    self.listenerMode = listenerMode
+    self.socksPort = socksPort
+    self.httpPort = httpPort
+  }
+
+  init(document: SslocalRuntimeDocument) {
+    let socks = document.locals.first { $0.inboundProtocol == "socks" }
+    let http = document.locals.first { $0.inboundProtocol == "http" }
+    self.init(
+      listenerMode: .disabled,
+      socksPort: socks?.localPort ?? 0,
+      httpPort: http?.localPort ?? ProxyListeningConfiguration.defaultHTTPPort)
+    lan = document.listen.lan
+  }
+
+  var bindAddress: String { listenerMode.bindAddress }
+}
+
+/// 监听指纹：服务器列表变化可热重载；任一本地入站、
+/// ACL 内容/路径/摘要变化都必须由 wrapper 完整重启 sslocal。
+struct SslocalListenFingerprint: Equatable, Sendable {
+  let locals: [SslocalLocalDocument]
+  let ipv6Only: Bool?
+  let acl: ProxyACLDocument?
+  var authentication: RuntimeListenerAuthentication?
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/ProxyPortSemantics.swift b/ShadowsocksX-NG2/Domain/Runtime/ProxyPortSemantics.swift
new file mode 100644
index 000000000..4569df226
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/ProxyPortSemantics.swift
@@ -0,0 +1,94 @@
+/// 本地代理端点的端口语义：端口是显式用户配置，
+/// 出厂默认与 Legacy 隔离（SOCKS5 11086 / HTTP 11087）；系统任何路径
+/// 都不静默改端口——建议端口只产出候选，必须经用户确认保存后才生效；激活
+/// 是否成功以 runtime 实际绑定为准（健康门禁），本层的占用校验只是设置编辑
+/// 期尽力而为的即时提示。
+
+/// 本地代理端点；显示名与诊断报告的措辞一致。PAC 端点已移除。
+enum ProxyEndpointKind: Hashable, Sendable, CaseIterable {
+  case socks
+  case http
+  case lanSocks
+  case lanHTTP
+
+  var displayName: String {
+    switch self {
+    case .socks: String(localized: "本地 SOCKS5 代理")
+    case .http: String(localized: "本地 HTTP 代理")
+    case .lanSocks: String(localized: "局域网 SOCKS 代理")
+    case .lanHTTP: String(localized: "局域网 HTTP 代理")
+    }
+  }
+}
+
+/// 端口配置校验错误：点名端点与端口（错误信息要求）。
+enum PortSettingError: Error, Hashable, Sendable {
+  case portOutOfRange(endpoint: ProxyEndpointKind, port: Int)
+  /// 两个端点的配置端口相同；`endpoint` 在枚举序（socks → http）中在前。
+  case duplicatePort(endpoint: ProxyEndpointKind, otherEndpoint: ProxyEndpointKind, port: Int)
+}
+
+/// 建议空闲端口算法：32768–65535 高位段升序扫描，跳过排除集合与不
+/// 空闲端口。空闲判定由调用方注入，保证主缝可测。
+enum PortSuggestion {
+  static let range = 32768...65535
+
+  static func firstFree(excluding excludedPorts: Set<Int>, isFree: (Int) -> Bool) -> Int? {
+    for candidate in range where !excludedPorts.contains(candidate) {
+      if isFree(candidate) { return candidate }
+    }
+    return nil
+  }
+
+  static func firstFreeAsync(
+    excluding excludedPorts: Set<Int>, isFree: (Int) async -> Bool
+  ) async -> Int? {
+    for candidate in range where !excludedPorts.contains(candidate) {
+      if await isFree(candidate) { return candidate }
+    }
+    return nil
+  }
+}
+
+extension ProxyListeningConfiguration {
+  /// 端点的配置端口。
+  func configuredPort(for endpoint: ProxyEndpointKind) -> Int {
+    switch endpoint {
+    case .socks: socksPort
+    case .http: httpPort
+    case .lanSocks: lan.socksPort
+    case .lanHTTP: lan.httpPort
+    }
+  }
+
+  /// 端口配置校验：范围 1025–65535、四端点配置值互异。错误按固定次序
+  /// （socks/http 范围检查，再 socks-http 冲突）。
+  func portValidationErrors() -> [PortSettingError] {
+    var errors: [PortSettingError] = []
+    for endpoint in ProxyEndpointKind.allCases {
+      let port = configuredPort(for: endpoint)
+      if !ProxyPortRange.valid.contains(port) {
+        errors.append(.portOutOfRange(endpoint: endpoint, port: port))
+      }
+    }
+    for pair in Self.endpointPairs {
+      let first = configuredPort(for: pair.0)
+      if first == configuredPort(for: pair.1) {
+        errors.append(.duplicatePort(endpoint: pair.0, otherEndpoint: pair.1, port: first))
+      }
+    }
+    return errors
+  }
+
+  /// 为 `endpoint` 建议一个空闲端口：高位段升序首个空闲且不等于另个端点
+  /// 配置值的候选；整段无可用返回 nil。只产出候选，绝不替用户改配置。
+  func suggestedPort(for endpoint: ProxyEndpointKind, isFree: (Int) -> Bool) -> Int? {
+    let others = Set(ProxyEndpointKind.allCases.filter { $0 != endpoint }.map(configuredPort))
+    return PortSuggestion.firstFree(excluding: others, isFree: isFree)
+  }
+
+  private static let endpointPairs: [(ProxyEndpointKind, ProxyEndpointKind)] = [
+    (.socks, .http), (.socks, .lanSocks), (.socks, .lanHTTP),
+    (.http, .lanSocks), (.http, .lanHTTP), (.lanSocks, .lanHTTP),
+  ]
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/ProxyRuntimePlan.swift b/ShadowsocksX-NG2/Domain/Runtime/ProxyRuntimePlan.swift
new file mode 100644
index 000000000..2145d9050
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/ProxyRuntimePlan.swift
@@ -0,0 +1,82 @@
+import Foundation
+
+/// LaunchAgent 注册态（GUI 视角）：SMAppService.Status 的纯域
+/// 映射。SMAppService 不暴露运行中 agent 的 pid，wrapper 活性另由
+/// `WrapperProcessState` 表达。
+enum LaunchAgentStatus: Equatable, Sendable {
+  case notRegistered
+  /// 已注册（无论 wrapper 进程当前是否在运行）。
+  case registered
+  /// 需要用户在系统设置的登录项中批准。
+  case requiresApproval
+  /// 注册清单缺失（bundle 内 plist 不在）。
+  case notFound
+}
+
+/// wrapper 进程活性：GUI 读 `agent.pid` 并以 `kill(pid, 0)` 判定。
+enum WrapperProcessState: Equatable, Sendable {
+  case notRunning
+  case running(pid: Int32)
+}
+
+/// GUI 对代理运行时的意图：运行给定义档，或停止并清理。
+enum RuntimeIntent: Equatable {
+  case run(SslocalRuntimeDocument)
+  case stop
+}
+
+/// 控制器按序执行的动作。
+enum RuntimeAction: Equatable, Sendable {
+  /// 原子写契约文件（权限与替换基线由 RuntimeFileStore 保证）。
+  case writeContract
+  /// 注册 LaunchAgent；launchd 随即拉起 wrapper，wrapper 启动时读契约。
+  case registerAgent
+  /// 注销 LaunchAgent：launchd 以 SIGTERM 结束 wrapper，触发显式停止协议
+  /// （wrapper 停 sslocal 并等待退出）。
+  case unregisterAgent
+  /// 通知运行中的 wrapper 重读契约；热重载或优雅重启由 wrapper 按监听
+  /// 指纹判定遵循变更协议。
+  case signalReload(pid: Int32)
+  /// 删除运行时文件（契约、pid 文件与残留临时文件）。
+  case deleteRuntimeFiles
+}
+
+/// 纯决策层：把「代理意图 + launchd 注册态 + wrapper 活性
+/// + 磁盘契约」推到有序动作序列。GUI 启动重同步、目录提交重展开与代理开关
+/// 共用同一决策；相同契约内容跳过写入，兑现激活状态机的幂等注记。
+enum ProxyRuntimePlan {
+  static func actions(
+    intent: RuntimeIntent,
+    agentStatus: LaunchAgentStatus,
+    wrapper: WrapperProcessState,
+    configurationIsCurrent: Bool
+  ) -> [RuntimeAction] {
+    switch intent {
+    case .run:
+      switch agentStatus {
+      case .notRegistered, .notFound, .requiresApproval:
+        // 首次启用或从未注册：写盘后注册，launchd 拉起的 wrapper 直接读新档。
+        return [.writeContract, .registerAgent]
+      case .registered:
+        switch wrapper {
+        case .running(let pid):
+          if configurationIsCurrent { return [] }
+          return [.writeContract, .signalReload(pid: pid)]
+        case .notRunning:
+          // 已注册但 wrapper 已干净退出（如契约曾被清理）：强制重新拉起。
+          // SMAppService 对已注册服务重复 register 不保证重跑，先注销再注册。
+          return [.writeContract, .unregisterAgent, .registerAgent]
+        }
+      }
+    case .stop:
+      switch agentStatus {
+      case .registered:
+        // 显式停止协议次序：注销即 SIGTERM wrapper → wrapper 停 sslocal
+        // 并等待 → 控制器确认 wrapper 退出后才删文件（执行侧保证次序）。
+        return [.unregisterAgent, .deleteRuntimeFiles]
+      case .notRegistered, .requiresApproval, .notFound:
+        return [.deleteRuntimeFiles]
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/RuntimeEventStore.swift b/ShadowsocksX-NG2/Domain/Runtime/RuntimeEventStore.swift
new file mode 100644
index 000000000..0e0b6658e
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/RuntimeEventStore.swift
@@ -0,0 +1,58 @@
+import Foundation
+
+/// GUI 侧运行事件环形缓冲：收集 `RuntimeLog.emit`
+/// 的事件供主窗口日志查看器实时呈现与诊断导出取用。事件文本来自封闭枚举的
+/// 渲染，构造上不含敏感值；容量封顶只留最近事件（够诊断即可，不做复杂轮转）。
+/// wrapper 进程不使用本存储（其 stderr 已收敛进 agent.log）。
+final class RuntimeEventStore: RuntimeEventSink, @unchecked Sendable {
+  struct Entry: Equatable, Identifiable {
+    let id: Int
+    let timestamp: Date
+    /// 事件原值（封闭枚举）：原始呈现与报告白名单投影共用同一事实。
+    let event: RuntimeLogEvent
+
+    /// 事件文本（查看器与原始行共用）。
+    var text: String { event.description }
+
+    /// 查看器共用的行格式；固定 POSIX locale 保证报障对照不随用户
+    /// 区域漂移。
+    var renderedLine: String {
+      renderedLine(eventText: text)
+    }
+
+    /// 指定事件文本的行格式；报告侧先经白名单清洗，再复用相同时间戳与间隔。
+    /// 时间戳格式与统一日志行（`LogLine`）共用同一 POSIX 格式器。
+    func renderedLine(eventText: String) -> String {
+      "\(LogLine.timestampFormatter.string(from: timestamp))  \(eventText)"
+    }
+  }
+
+  /// 进程级共享实例：GUI 启动时注册为 RuntimeLog 的接收缝。
+  static let shared = RuntimeEventStore()
+
+  private let lock = NSLock()
+  private var entries: [Entry] = []
+  private var nextID = 0
+  private let capacity: Int
+
+  init(capacity: Int = 500) {
+    self.capacity = max(1, capacity)
+  }
+
+  /// 当前缓冲快照（旧→新）。
+  var snapshot: [Entry] {
+    lock.lock()
+    defer { lock.unlock() }
+    return entries
+  }
+
+  func append(event: RuntimeLogEvent, timestamp: Date = Date()) {
+    lock.lock()
+    defer { lock.unlock() }
+    entries.append(Entry(id: nextID, timestamp: timestamp, event: event))
+    nextID += 1
+    if entries.count > capacity {
+      entries.removeFirst(entries.count - capacity)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/RuntimeFileStore.swift b/ShadowsocksX-NG2/Domain/Runtime/RuntimeFileStore.swift
new file mode 100644
index 000000000..436ccd817
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/RuntimeFileStore.swift
@@ -0,0 +1,357 @@
+import Foundation
+
+private typealias RuntimeFileCreator = (Data, String, String) throws -> String
+
+private struct PreparedAuthentication {
+  let document: SslocalRuntimeDocument
+  let id: String?
+  let files: [String]
+}
+
+/// GUI 独占配置准备与监管发布；Agent 独占稳定链接切换和退休文件回收。
+struct RuntimeFileStore {
+  enum PersistenceError: Error, Equatable {
+    case ioFailure(detail: String)
+    case rollbackFailed(detail: String)
+  }
+
+  private let paths: RuntimePaths
+  var fileURL: URL { paths.fileURL }
+  private let fileWriter: (Data, URL) throws -> Void
+
+  init(
+    fileURL: URL = ApplicationSupportPaths.current.runtime.fileURL,
+    fileWriter: @escaping (Data, URL) throws -> Void = { try AtomicFileWriter.write($0, to: $1) }
+  ) {
+    paths = RuntimePaths(fileURL: fileURL)
+    self.fileWriter = fileWriter
+  }
+
+  var directoryURL: URL { paths.directoryURL }
+  var supervisionFileURL: URL { paths.supervisionFileURL }
+  var failureFileURL: URL { paths.failureFileURL }
+  var pidFileURL: URL { paths.pidFileURL }
+  var aclFileURL: URL { paths.aclFileURL }
+  var runtimeStatusFileURL: URL { paths.runtimeStatusFileURL }
+
+  func write(_ document: SslocalRuntimeDocument) throws {
+    try write(PreparedRuntimeContract(document))
+  }
+
+  func write(_ contract: PreparedRuntimeContract) throws {
+    try RuntimePublication.withLock(in: directoryURL) {
+      try publishLocked(contract)
+    }
+  }
+
+  private func publishLocked(_ contract: PreparedRuntimeContract) throws {
+    var created: [URL] = []
+    var publicationID: String?
+    do {
+      guard contract.document.isWellFormed else { throw POSIXError(.EINVAL) }
+      let old = RuntimePublication.load(at: supervisionFileURL)
+      let generation = try reserveGeneration()
+      let prefix = String(format: "%020llu", generation)
+      func create(_ data: Data, kind: String, suffix: String) throws -> String {
+        let name = "\(kind)-\(prefix)-\(suffix)"
+        let url = directoryURL.appendingPathComponent(name)
+        guard !FileManager.default.fileExists(atPath: url.path) else { throw POSIXError(.EEXIST) }
+        // 先登记：注入的写入器即使在写后抛错，也由 GUI 清理本次未发布文件。
+        created.append(url)
+        try fileWriter(data, url)
+        guard RuntimePublication.isRegularFile(url), try Data(contentsOf: url) == data else {
+          throw POSIXError(.EIO)
+        }
+        return name
+      }
+      let snapshot = try makeSnapshot(
+        contract, old: old, generation: generation,
+        create: { try create($0, kind: $1, suffix: $2) })
+      // 唯一发布点。所有可引用资源已落盘且校验完成；不提前触碰任何活动链接。
+      publicationID = snapshot.deploymentID
+      try fileWriter(JSONEncoder().encode(snapshot), supervisionFileURL)
+    } catch {
+      try handlePublicationFailure(error, publicationID: publicationID, created: created)
+    }
+  }
+
+  private func makeSnapshot(
+    _ contract: PreparedRuntimeContract, old: RuntimeSupervision?, generation: UInt64,
+    create: RuntimeFileCreator
+  ) throws -> RuntimeSupervision {
+    var variants = old?.aclVariants ?? [:]
+    var selectedACL: RuntimeSupervision.ACL?
+    if let acl = contract.document.aclRuntime {
+      guard acl.path == aclFileURL.standardizedFileURL.path, acl.isWellFormed else {
+        throw POSIXError(.EINVAL)
+      }
+      selectedACL = try selectACL(acl, variants: &variants, create: create)
+    }
+    let authentication = try prepareAuthentication(contract.document, old: old, create: create)
+    let configurationData = try authentication.document.jsonData()
+    let configurationID =
+      reusableConfigurationID(
+        for: configurationData, previous: old) ?? UUID().uuidString
+    let configuration = try create(configurationData, "config", "sslocal.json")
+    let intent = PublishedRuntimeIntent(
+      sha256: contract.sha256, configurationSHA256: ProxyACLDocument.digest(configurationData),
+      summary: Redactor.documentSummary(contract.document))
+    let intentMetadata = try create(JSONEncoder().encode(intent), "config", "intent.json")
+    let snapshot = RuntimeSupervision(
+      version: 2, generation: generation, deploymentID: UUID().uuidString,
+      configuration: configuration, configurationID: configurationID,
+      intentMetadata: intentMetadata,
+      locals: authentication.document.locals.map {
+        .init(
+          inboundProtocol: $0.inboundProtocol, localAddress: $0.localAddress,
+          localPort: $0.localPort, mode: $0.mode)
+      }, ipv6Only: authentication.document.ipv6Only,
+      authenticationID: authentication.id, authenticationFiles: authentication.files,
+      acl: selectedACL, aclVariants: variants)
+    guard snapshot.validated(in: directoryURL) else { throw POSIXError(.EINVAL) }
+    return snapshot
+  }
+
+  private func selectACL(
+    _ acl: ProxyACLDocument, variants: inout [String: RuntimeSupervision.ACL],
+    create: RuntimeFileCreator
+  ) throws -> RuntimeSupervision.ACL {
+    if let cached = variants[acl.summary], cached.sha256 == acl.sha256 { return cached }
+    guard !acl.content.isEmpty else { throw POSIXError(.ENOENT) }
+    let data = Data(acl.content.utf8)
+    let name = try create(data, "acl", "\(acl.summary).ini")
+    let selected = RuntimeSupervision.ACL(file: name, sha256: acl.sha256, size: data.count)
+    variants[acl.summary] = selected
+    return selected
+  }
+
+  private func reusableConfigurationID(for data: Data, previous: RuntimeSupervision?) -> String? {
+    guard let previous, let identity = previous.configurationID,
+      publishedIntent(previous)?.configurationSHA256 == ProxyACLDocument.digest(data),
+      (try? Data(contentsOf: directoryURL.appendingPathComponent(previous.configuration))) == data
+    else { return nil }
+    return identity
+  }
+
+  private func handlePublicationFailure(
+    _ error: Error, publicationID: String?, created: [URL]
+  ) throws {
+    // 写入器在原子替换后报错时，发布已经发生；不得删除读者可见资源。
+    if let publicationID,
+      RuntimePublication.load(at: supervisionFileURL)?.deploymentID == publicationID
+    {
+      throw PersistenceError.ioFailure(detail: "Publication completed but writer reported failure")
+    }
+    var failures: [String] = []
+    for url in created {
+      do { try FileManager.default.removeItem(at: url) } catch {
+        if FileManager.default.fileExists(atPath: url.path) {
+          failures.append(url.lastPathComponent)
+        }
+      }
+    }
+    if !failures.isEmpty {
+      throw PersistenceError.rollbackFailed(
+        detail: "Unpublished cleanup: " + failures.joined(separator: ","))
+    }
+    throw PersistenceError.ioFailure(detail: String(describing: error))
+  }
+
+  private func prepareAuthentication(
+    _ document: SslocalRuntimeDocument,
+    old: RuntimeSupervision?,
+    create: RuntimeFileCreator
+  ) throws -> PreparedAuthentication {
+    var authenticationID: String?
+    var authenticationFiles: [String] = []
+    var encoded = document
+    if let auth = encoded.listen.authentication {
+      guard auth.directory == directoryURL.standardizedFileURL.path else {
+        throw POSIXError(.EINVAL)
+      }
+      let contents = try auth.fileContents()
+      let previousFiles = old?.authenticationFiles ?? []
+      let unchanged =
+        previousFiles.count == contents.count
+        && zip(previousFiles, contents).allSatisfy { name, content in
+          (try? Data(contentsOf: directoryURL.appendingPathComponent(name))) == content.1
+        }
+      if unchanged, let oldID = old?.authenticationID {
+        authenticationID = oldID
+        authenticationFiles = old?.authenticationFiles ?? []
+      } else {
+        authenticationID = UUID().uuidString
+        for (kind, data) in contents {
+          authenticationFiles.append(try create(data, "auth", "\(kind).json"))
+        }
+      }
+      for index in encoded.locals.indices
+      where encoded.locals[index].localAddress != "127.0.0.1" {
+        if encoded.locals[index].inboundProtocol == "socks" {
+          encoded.locals[index].socks5AuthConfigPath =
+            directoryURL
+            .appendingPathComponent(authenticationFiles[0]).path
+        } else {
+          encoded.locals[index].httpAuthConfigPath =
+            directoryURL
+            .appendingPathComponent(authenticationFiles[1]).path
+        }
+      }
+    }
+    return PreparedAuthentication(
+      document: encoded, id: authenticationID, files: authenticationFiles)
+  }
+
+  /// 代次高水位独立于部署文件持久保存。预留失败可留空号，溢出拒绝部署。
+  private func reserveGeneration() throws -> UInt64 {
+    let url = paths.generationFileURL
+    let current: UInt64
+    if FileManager.default.fileExists(atPath: url.path) {
+      guard let value = UInt64(try String(contentsOf: url, encoding: .utf8)) else {
+        throw POSIXError(.EINVAL)
+      }
+      current = value
+    } else {
+      current = 0
+    }
+    guard current < UInt64.max else { throw POSIXError(.EOVERFLOW) }
+    try AtomicFileWriter.write(Data(String(current + 1).utf8), to: url)
+    return current + 1
+  }
+
+}
+
+extension RuntimeFileStore {
+
+  /// 意图比较不解析输出正文；最终字节摘要保留原有磁盘漂移检查。
+  func contains(_ contract: PreparedRuntimeContract) -> Bool {
+    (try? RuntimePublication.withLock(in: directoryURL) {
+      guard let snapshot = RuntimePublication.load(at: supervisionFileURL),
+        let intent = publishedIntent(snapshot), intent.sha256 == contract.sha256,
+        let data = try? Data(
+          contentsOf: directoryURL.appendingPathComponent(snapshot.configuration))
+      else { return false }
+      return ProxyACLDocument.digest(data) == intent.configurationSHA256
+    }) ?? false
+  }
+
+  func publishedSummary() -> String? {
+    try? RuntimePublication.withLock(in: directoryURL) {
+      guard let snapshot = RuntimePublication.load(at: supervisionFileURL) else { return nil }
+      return publishedIntent(snapshot)?.summary
+    }
+  }
+
+  private func publishedIntent(_ snapshot: RuntimeSupervision) -> PublishedRuntimeIntent? {
+    guard
+      let data = try? Data(contentsOf: directoryURL.appendingPathComponent(snapshot.intentMetadata))
+    else { return nil }
+    return try? JSONDecoder().decode(PublishedRuntimeIntent.self, from: data)
+  }
+
+  func receiptIdentity(for document: SslocalRuntimeDocument) -> String? {
+    receiptIdentity(for: document.intentSHA256)
+  }
+
+  func receiptIdentity(for intentSHA256: String?) -> String? {
+    try? RuntimePublication.withLock(in: directoryURL) {
+      let snapshot = RuntimePublication.metadata(at: supervisionFileURL)
+      guard let snapshot,
+        let identity = publishedIntent(snapshot)?.sha256,
+        identity == intentSHA256
+      else { return nil }
+      return snapshot.deploymentID
+    }
+  }
+
+  func blocksDeployment(_ document: SslocalRuntimeDocument) -> Bool {
+    blocksDeployment(document.intentSHA256)
+  }
+
+  func blocksDeployment(_ intentSHA256: String?) -> Bool {
+    guard let failure = readFailure() else { return false }
+    guard let snapshot = RuntimePublication.metadata(at: supervisionFileURL) else { return true }
+    guard failure.deploymentID == snapshot.deploymentID else { return false }
+    // GUI 私有身份本身丢失时也不自动重试，用户可显式重试修复派生资源。
+    guard
+      let identity = publishedIntent(snapshot)?.sha256,
+      identity.count == 64
+    else { return true }
+    return identity == intentSHA256
+  }
+
+  func readRuntimeReceipt() -> RuntimeDeploymentReceipt? {
+    guard let data = try? Data(contentsOf: runtimeStatusFileURL) else { return nil }
+    return try? JSONDecoder().decode(RuntimeDeploymentReceipt.self, from: data)
+  }
+
+  func readFailure() -> RuntimeDeploymentFailure? {
+    guard let data = try? Data(contentsOf: failureFileURL) else { return nil }
+    return try? JSONDecoder().decode(RuntimeDeploymentFailure.self, from: data)
+  }
+
+  func recordFailure(reason: String) throws {
+    try RuntimePublication.withLock(in: directoryURL) {
+      guard let snapshot = RuntimePublication.metadata(at: supervisionFileURL) else {
+        throw POSIXError(.EINVAL)
+      }
+      try AtomicFileWriter.write(
+        JSONEncoder().encode(
+          RuntimeDeploymentFailure(
+            deploymentID: snapshot.deploymentID, reason: reason)), to: failureFileURL)
+    }
+  }
+
+  /// 只清除旧部署失败。Agent 对本代新确认的失败不得被 GUI 健康任务擦除。
+  func settleSuccessfulDeployment() throws {
+    try RuntimePublication.withLock(in: directoryURL) {
+      guard let snapshot = RuntimePublication.metadata(at: supervisionFileURL) else {
+        throw POSIXError(.EINVAL)
+      }
+      if let failure = readFailure(), failure.deploymentID == snapshot.deploymentID {
+        throw POSIXError(.EIO)
+      }
+      try clearFailure()
+    }
+  }
+
+  func clearFailure() throws {
+    if FileManager.default.fileExists(atPath: failureFileURL.path) {
+      try FileManager.default.removeItem(at: failureFileURL)
+    }
+  }
+
+  var hasUnconfirmedChild: Bool {
+    let url = paths.childPIDFileURL
+    guard FileManager.default.fileExists(atPath: url.path) else { return false }
+    guard let data = try? String(contentsOf: url, encoding: .utf8), let pid = Int32(data), pid > 0
+    else { return true }
+    return kill(pid, 0) == 0 || errno == EPERM
+  }
+
+  /// 仅在确认 wrapper 及其子进程退出后调用；高水位与锁跨停止保留。
+  func deleteRuntimeFiles() throws {
+    try RuntimePublication.withLock(in: directoryURL) {
+      guard !hasUnconfirmedChild else { throw POSIXError(.EBUSY) }
+      let manager = FileManager.default
+      let removableNames = paths.removableFileNames
+      for name in try manager.contentsOfDirectory(atPath: directoryURL.path) {
+        if RuntimePublication.generation(of: name) != nil
+          || removableNames.contains(name)
+          || name.hasPrefix("lan-auth-") || name == "acl-digests.json"
+          || (name.hasPrefix("acl-") && name.hasSuffix(".ini"))
+          || AtomicFileWriter.isResidueName(name)
+        {
+          try manager.removeItem(at: directoryURL.appendingPathComponent(name))
+        }
+      }
+    }
+  }
+}
+
+/// GUI 私有发布事实。意图摘要不进入 Agent 监管资料、回执或诊断。
+struct PublishedRuntimeIntent: Codable {
+  let sha256: String
+  let configurationSHA256: String
+  let summary: String
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/RuntimeListenerAuthentication.swift b/ShadowsocksX-NG2/Domain/Runtime/RuntimeListenerAuthentication.swift
new file mode 100644
index 000000000..e81c59964
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/RuntimeListenerAuthentication.swift
@@ -0,0 +1,53 @@
+import Foundation
+
+/// 已解析的运行时凭据只进入受保护的运行文件，不进入偏好或摘要。
+struct RuntimeListenerAuthentication: Codable, Equatable, Sendable {
+  let username: String
+  let password: String
+  let directory: String
+
+  static func validUsername(_ value: String) -> Bool {
+    validPassword(value) && !value.contains(":")
+  }
+
+  static func validPassword(_ value: String) -> Bool {
+    (1...255).contains(value.utf8.count) && value.utf8.allSatisfy { (32...126).contains($0) }
+  }
+
+  var isValid: Bool {
+    Self.validUsername(username) && Self.validPassword(password) && directory.hasPrefix("/")
+  }
+
+  var socksPath: String { path("socks") }
+  var httpPath: String { path("http") }
+
+  private func path(_ name: String) -> String {
+    URL(fileURLWithPath: directory).appendingPathComponent("lan-auth-\(name).pending.json").path
+  }
+
+  func fileContents() throws -> [(String, Data)] {
+    let user = ["user_name": username, "password": password]
+    return try [("socks", "password"), ("http", "basic")].map { kind, key in
+      (
+        kind,
+        try JSONSerialization.data(withJSONObject: [key: ["users": [user]]], options: [.sortedKeys])
+      )
+    }
+  }
+
+}
+
+extension SslocalRuntimeDocument {
+  func authenticatingLAN(_ authentication: RuntimeListenerAuthentication?) -> Self {
+    var result = self
+    result.listen.authentication = authentication
+    for index in result.locals.indices where result.locals[index].localAddress != "127.0.0.1" {
+      if result.locals[index].inboundProtocol == "socks" {
+        result.locals[index].socks5AuthConfigPath = authentication?.socksPath
+      } else {
+        result.locals[index].httpAuthConfigPath = authentication?.httpPath
+      }
+    }
+    return result
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/RuntimeLog.swift b/ShadowsocksX-NG2/Domain/Runtime/RuntimeLog.swift
new file mode 100644
index 000000000..aa7adc4bd
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/RuntimeLog.swift
@@ -0,0 +1,334 @@
+import Foundation
+import os
+
+/// 运行时日志基线：事件是封闭枚举，脱敏由构造保证——永不
+/// 携带密码、插件参数、Keychain 值、完整订阅 URL 及其 token 或运行时 JSON
+/// 内容；测试 URL 属于非敏感信息，可完整记录。服务器地址与备注默认不进
+/// 普通日志（端点探测失败点名的 host:port 是本机监听端点，属于需要呈现的
+/// 事实字段，不受此限）。日志查看与诊断导出均以本事件流为数据源。
+enum RuntimeLogEvent: Equatable, CustomStringConvertible, Sendable {
+  /// 契约文件已原子写入（只携带数量元数据，非内容）。
+  case contractWritten(serverCount: Int)
+  /// 契约内容与磁盘一致，跳过写入（幂等）。
+  case contractUnchanged
+  /// 系统代理期望值与系统当前应用值语义等价，跳过写入（零授权）。
+  case systemProxyUnchanged
+  /// 特权系统代理 helper 的 SMAppService 注册失败（不含内容）。
+  case systemProxyHelperRegisterFailed(detail: String)
+  /// 系统代理写入/清除请求失败（detail 为 XPC 或 helper 错误文本）。
+  case systemProxyWriteFailed(detail: String)
+  /// 运行时文件已清理。
+  case runtimeFilesDeleted
+  /// 激活状态等运行时元数据落盘失败（不含内容）。
+  case runtimePersistFailed(detail: String)
+  case agentRegistered
+  case agentRegisterFailed(detail: String)
+  case agentUnregistered
+  case agentUnregisterFailed(detail: String)
+  /// wrapper 侧 sslocal 监管事件。
+  case sslocalSpawned(pid: Int32)
+  case sslocalSpawnFailed
+  case sslocalExitedUnexpectedly(status: Int32)
+  case sslocalStopRequested
+  /// sslocal 拉起后限时内未完成本地监听绑定（「3 秒未建立监听 → error
+  /// 日志」；监管继续，GUI 健康门负责呈现，端点为本机监听端点不受脱敏限制）。
+  case listenNotEstablished(detail: String)
+  case contractMissing
+  case contractInvalid
+  case reloadForwarded
+  case reloadDeferred
+  case reloadRestarted
+  /// 本机代理端点启动后未就绪（点名端点与端口）。
+  case endpointProbeFailed(host: String, port: Int, detail: String)
+  /// 激活失败或活动目标清除（原因枚举已点名且不含秘密）。
+  case activationFailed(reason: String)
+  /// 用户显式触发的脱敏诊断导出已完成（不携带导出路径）。
+  case diagnosticsExported
+  /// 偏好设置持久化读取失败，已回落出厂默认（不静默改端口——事件进
+  /// 诊断日志由查看器呈现；完整日志查看器属于独立的诊断界面。
+  case settingsUnreadable(detail: String)
+
+  /// 启动激活重试事实（键盘启动器场景诊断）：attempt 从 1 起；active 为该拍
+  /// 检查时的应用激活状态；policyRegular 为进程本地策略是否已 regular（本地
+  /// 为真而 Dock 图标缺失说明系统侧注册滞后）；frontmost 为当时前台应用
+  /// bundle id（无则 "-"）；menuBarOwner 为菜单栏实际归属应用（active=true 而
+  /// menuBarOwner 非本应用即激活假象，重试继续）；onActiveSpace 为主窗口是否
+  /// 在当前空间；windowVisible 为该拍窗口是否可见（首拍 false 说明链在窗口
+  /// 呈现完成前启动、已终结待 re-arm）。正常启动只有 attempt=1 一条且各信号
+  /// 一致。
+  case launchActivationRetry(
+    attempt: Int, active: Bool, policyRegular: Bool, frontmost: String,
+    menuBarOwner: String, onActiveSpace: Bool, windowVisible: Bool)
+
+  /// 窗口锚点附着事实（ADR 0017 激活协调）：锚点上交宿主窗口时记录当时的
+  /// 可见/key 状态——用于定位启动呈现路径下附着与可见化的先后次序（失败
+  /// 场景启动期无任何激活事件时由此排查附着是否发生、时机如何）。
+  case windowAnchorAttached(visible: Bool, key: Bool)
+
+  case connectivityMeasurement(id: UUID, entry: ConnectivityTrace)
+
+  /// stderr 行式输出（统一行格式，见 `LogLine`）；wrapper 侧收敛进
+  /// agent.log。连通性测量内容只经应用内日志查看器显式查看，不落 stderr
+  /// 行与诊断报告。
+  func standardErrorLine(timestamp: Date = Date()) -> String? {
+    if case .connectivityMeasurement = self { return nil }
+    return LogLine(event: self, timestamp: timestamp, source: RuntimeLog.lineSource).rendered + "\n"
+  }
+
+  var description: String {
+    switch self {
+    case .connectivityMeasurement(let id, let entry):
+      return "connectivity \(id.uuidString) \(entry.description)"
+    case .contractWritten(let serverCount):
+      return "contract written (servers=\(serverCount))"
+    case .contractUnchanged:
+      return "contract unchanged, write skipped"
+    case .systemProxyUnchanged:
+      return "system proxy values unchanged, write skipped"
+    case .systemProxyHelperRegisterFailed(let detail):
+      return "system proxy helper register failed: \(detail)"
+    case .systemProxyWriteFailed(let detail):
+      return "system proxy write failed: \(detail)"
+    case .runtimeFilesDeleted:
+      return "runtime files deleted"
+    case .runtimePersistFailed(let detail):
+      return "runtime metadata persist failed: \(detail)"
+    case .agentRegistered:
+      return "launch agent registered"
+    case .agentRegisterFailed(let detail):
+      return "launch agent register failed: \(detail)"
+    case .agentUnregistered:
+      return "launch agent unregistered"
+    case .agentUnregisterFailed(let detail):
+      return "launch agent unregister failed: \(detail)"
+    case .sslocalSpawned(let pid):
+      return "sslocal spawned (pid=\(pid))"
+    case .sslocalSpawnFailed:
+      return "sslocal spawn failed"
+    case .sslocalExitedUnexpectedly(let status):
+      return "sslocal exited unexpectedly (status=\(status))"
+    case .sslocalStopRequested:
+      return "sslocal stop requested"
+    case .listenNotEstablished(let detail):
+      return "listen not established within deadline: \(detail)"
+    case .contractMissing:
+      return "contract missing"
+    case .contractInvalid:
+      return "supervision invalid, preserved"
+    case .reloadForwarded:
+      return "reload forwarded to sslocal"
+    case .reloadDeferred:
+      return "reload deferred until listeners are ready"
+    case .reloadRestarted:
+      return "reload: listen change, restarting sslocal"
+    case .endpointProbeFailed(let host, let port, let detail):
+      return "endpoint \(host):\(port) not ready: \(detail)"
+    case .activationFailed(let reason):
+      return "activation failed: \(reason)"
+    case .diagnosticsExported:
+      return "diagnostics report exported (redacted)"
+    case .settingsUnreadable(let detail):
+      return "settings unreadable, falling back to factory defaults: \(detail)"
+    case .launchActivationRetry(
+      let attempt, let active, let policyRegular, let frontmost, let menuBarOwner,
+      let onActiveSpace, let windowVisible):
+      return
+        "launch activation retry #\(attempt) active=\(active)"
+        + " policy=\(policyRegular ? "regular" : "accessory")"
+        + " frontmost=\(frontmost) menubar=\(menuBarOwner)"
+        + " space=\(onActiveSpace ? "on" : "off") visible=\(windowVisible)"
+    case .windowAnchorAttached(let visible, let key):
+      return "window anchor attached visible=\(visible) key=\(key)"
+    }
+  }
+}
+
+/// 系统日志路由（统一日志，Console.app 可按 subsystem/category 过滤）：
+/// level 三分（失败类 error、里程碑 default、冗长测量 info）、category 五分
+/// （runtime / supervision / system-proxy / connectivity / diagnostics；
+/// sslocal 输出 intake 的自由文本行走独立的 category `sslocal`，不经本枚举）。
+/// 去向、privacy 与第三方库取舍见 ADR-0045。
+/// 拆分规则：`text` + `privateDetail` == `description`；自由错误 detail 与
+/// 连通性测量内容（含探测目标 IP）拆出由发射缝标 private，公开文本由
+/// description 尾部裁切派生，不手抄前缀。穷举 switch：新事件漏路由无法编译。
+extension RuntimeLogEvent {
+  var systemLogRoute: SystemLogRoute {
+    switch self {
+    case .contractWritten, .contractUnchanged, .runtimeFilesDeleted:
+      return SystemLogRoute(
+        level: .default, category: "runtime", text: description, privateDetail: nil)
+    case .contractMissing, .contractInvalid, .activationFailed:
+      return SystemLogRoute(
+        level: .error, category: "runtime", text: description, privateDetail: nil)
+    case .runtimePersistFailed(let detail):
+      return SystemLogRoute(
+        level: .error, category: "runtime", text: String(description.dropLast(detail.count)),
+        privateDetail: detail)
+    case .settingsUnreadable(let detail):
+      return SystemLogRoute(
+        level: .error, category: "runtime",
+        text: String(description.dropLast(detail.count)), privateDetail: detail)
+    case .agentRegistered, .agentUnregistered, .sslocalSpawned, .sslocalStopRequested,
+      .reloadForwarded, .reloadDeferred, .reloadRestarted:
+      return SystemLogRoute(
+        level: .default, category: "supervision", text: description, privateDetail: nil)
+    case .sslocalSpawnFailed, .sslocalExitedUnexpectedly, .listenNotEstablished:
+      return SystemLogRoute(
+        level: .error, category: "supervision", text: description, privateDetail: nil)
+    case .agentRegisterFailed(let detail):
+      return SystemLogRoute(
+        level: .error, category: "supervision",
+        text: String(description.dropLast(detail.count)), privateDetail: detail)
+    case .agentUnregisterFailed(let detail):
+      return SystemLogRoute(
+        level: .error, category: "supervision",
+        text: String(description.dropLast(detail.count)), privateDetail: detail)
+    case .systemProxyUnchanged:
+      return SystemLogRoute(
+        level: .default, category: "system-proxy", text: description, privateDetail: nil)
+    case .systemProxyHelperRegisterFailed(let detail):
+      return SystemLogRoute(
+        level: .error, category: "system-proxy",
+        text: String(description.dropLast(detail.count)), privateDetail: detail)
+    case .systemProxyWriteFailed(let detail):
+      return SystemLogRoute(
+        level: .error, category: "system-proxy",
+        text: String(description.dropLast(detail.count)), privateDetail: detail)
+    case .endpointProbeFailed(_, _, let detail):
+      return SystemLogRoute(
+        level: .error, category: "connectivity",
+        text: String(description.dropLast(detail.count)), privateDetail: detail)
+    case .connectivityMeasurement(_, let entry):
+      // 测量内容含探测目标 IP，整段标 private（普通日志不进服务器地址）。
+      return SystemLogRoute(
+        level: .info, category: "connectivity",
+        text: String(description.dropLast(entry.description.count)),
+        privateDetail: entry.description)
+    case .diagnosticsExported:
+      return SystemLogRoute(
+        level: .default, category: "diagnostics", text: description, privateDetail: nil)
+    case .launchActivationRetry, .windowAnchorAttached:
+      // 前台应用 bundle id 等用户环境事实：进应用内日志查看器与统一日志，
+      // 不进共享诊断报告（白名单见诊断 module）。
+      return SystemLogRoute(
+        level: .default, category: "window", text: description, privateDetail: nil)
+    }
+  }
+}
+
+/// 事件接收缝：GUI 进程把事件接入 RuntimeEventStore（内存环形
+/// 缓冲），供主窗口日志查看器实时呈现与诊断导出取用；wrapper 进程不注册
+/// （stderr 收敛进 agent.log）。接收方拿到的是封闭枚举原值，渲染发生在
+/// 呈现边缘（诊断报告的白名单清洗只可能作用于原值）。
+protocol RuntimeEventSink: Sendable {
+  func append(event: RuntimeLogEvent, timestamp: Date)
+}
+
+/// 敏感信息脱敏工具（「敏感信息」定义的读取面）。
+enum Redactor {
+  /// 敏感远程 URL 只保留 scheme+host：路径、查询与片段全部略去，完整订阅
+  /// URL 与 URL token 永不入日志。解析失败一律归并为占位符。
+  /// 测试 URL 无需脱敏，不使用此方法。
+  static func remoteURL(_ url: String) -> String {
+    guard let parsed = URL(string: url), let host = parsed.host(), !host.isEmpty else {
+      return "<redacted-url>"
+    }
+    return "\(parsed.scheme ?? "https")://\(host)/…"
+  }
+
+}
+
+/// 事件发射缝：wrapper 与 GUI 共用 stderr 行式输出（wrapper 侧收敛进
+/// agent.log）与系统日志输出（统一 subsystem，Console.app 按 category 过滤，
+/// 拆出的 detail 段标 private）；GUI 启动时另注册接收缝接入事件缓冲。
+enum RuntimeLog {
+  private static let sinkHolder = SinkHolder()
+  private static let lineSourceLock = OSAllocatedUnfairLock(initialState: LogLineSource.gui)
+
+  /// stderr 行的来源标记：GUI 进程默认 `gui`，wrapper 启动时置 `wrapper`，
+  /// 同一枚举事件的两个进程由此在行内可分辨。启动期一次性设置。
+  static var lineSource: LogLineSource { lineSourceLock.withLock { $0 } }
+
+  static func setLineSource(_ source: LogLineSource) {
+    lineSourceLock.withLock { $0 = source }
+  }
+
+  /// 注册/替换事件接收缝；传 nil 移除接收缝（测试隔离用）。
+  static func setSink(_ sink: (any RuntimeEventSink)?) {
+    sinkHolder.set(sink)
+  }
+
+  static func emit(_ event: RuntimeLogEvent) {
+    let now = Date()
+    if let line = event.standardErrorLine(timestamp: now) {
+      FileHandle.standardError.write(Data(line.utf8))
+    }
+    SystemLog.emit(event.systemLogRoute)
+    sinkHolder.current?.append(event: event, timestamp: now)
+  }
+
+  /// 可变静态的锁保护持有者：emit 可能来自任意线程。
+  private final class SinkHolder: @unchecked Sendable {
+    private let lock = NSLock()
+    private var sink: (any RuntimeEventSink)?
+
+    var current: (any RuntimeEventSink)? {
+      lock.lock()
+      defer { lock.unlock() }
+      return sink
+    }
+
+    func set(_ value: (any RuntimeEventSink)?) {
+      lock.lock()
+      defer { lock.unlock() }
+      sink = value
+    }
+  }
+}
+
+/// Structured latency observations for explicit local log viewing. These events
+/// are excluded from shared diagnostic reports, including their target IPs.
+struct ConnectivityTrace: Equatable, Sendable, CustomStringConvertible {
+  enum Phase: String, Sendable {
+    case startup, google, cloudflare, candidate, selected, sample, summary
+  }
+  enum Status: String, Sendable {
+    case success, network, timeout, http, configuration, cancelled, insufficientSamples
+  }
+  enum FailureStage: String, Sendable {
+    case none, startup, dns, selection, request, send, headers
+    case localTCP = "local_tcp"
+    case firstByte = "first_byte"
+  }
+  var phase: Phase
+  var status: Status
+  var index: Int = 0
+  var address: String?
+  var milliseconds: Double?
+  var localTCPMilliseconds: Double?
+  var sendMilliseconds: Double?
+  var firstByteMilliseconds: Double?
+  var headersMilliseconds: Double?
+  var failureStage: FailureStage = .none
+  var httpStatus: Int?
+
+  var description: String {
+    var fields = ["phase=\(phase.rawValue)", "result=\(status.rawValue)"]
+    if index > 0 { fields.append("index=\(index)") }
+    if let address { fields.append("ip=\(address)") }
+    if let httpStatus { fields.append("http=\(httpStatus)") }
+    if failureStage != .none { fields.append("failure_stage=\(failureStage.rawValue)") }
+    let times: [(String, Double?)] = [
+      ("total_ms", milliseconds), ("local_tcp_ms", localTCPMilliseconds),
+      ("send_ms", sendMilliseconds), ("wait_first_byte_ms", firstByteMilliseconds),
+      ("first_byte_to_headers_ms", headersMilliseconds),
+    ]
+    for (name, value) in times {
+      if let value {
+        fields.append(
+          "\(name)=\(String(format: "%.3f", locale: Locale(identifier: "en_US_POSIX"), value))")
+      }
+    }
+    return fields.joined(separator: " ")
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/RuntimePaths.swift b/ShadowsocksX-NG2/Domain/Runtime/RuntimePaths.swift
new file mode 100644
index 000000000..9ab01dd2b
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/RuntimePaths.swift
@@ -0,0 +1,55 @@
+import Foundation
+
+/// GUI 发布与 Agent 监管共享的运行目录规则；所有受管引用保持在同一目录。
+struct RuntimePaths {
+  let fileURL: URL
+
+  init(directoryURL: URL) {
+    fileURL = directoryURL.appendingPathComponent("sslocal-active.json")
+  }
+
+  init(fileURL: URL) {
+    self.fileURL = fileURL
+  }
+
+  var directoryURL: URL { fileURL.deletingLastPathComponent() }
+  var supervisionFileURL: URL { directoryURL.appendingPathComponent("agent-supervision.json") }
+  var failureFileURL: URL { directoryURL.appendingPathComponent("agent-deployment-failure.json") }
+  var pidFileURL: URL { directoryURL.appendingPathComponent("agent.pid") }
+  var childPIDFileURL: URL { directoryURL.appendingPathComponent("sslocal.pid") }
+  var aclFileURL: URL { directoryURL.appendingPathComponent("acl-active.ini") }
+  var runtimeStatusFileURL: URL { directoryURL.appendingPathComponent("agent-runtime-status.json") }
+  var generationFileURL: URL { directoryURL.appendingPathComponent("runtime-generation") }
+  var publicationLockURL: URL { directoryURL.appendingPathComponent("runtime.lock") }
+  var agentLockURL: URL { directoryURL.appendingPathComponent("agent.lock") }
+
+  /// 停止只清理部署产物；高水位和两把锁跨停止保留。
+  var removableFileNames: Set<String> {
+    Set(
+      [
+        fileURL, supervisionFileURL, failureFileURL, pidFileURL, childPIDFileURL,
+        aclFileURL, runtimeStatusFileURL,
+      ].map(\.lastPathComponent))
+  }
+}
+
+/// ACL 活动链接的防逃逸校验（ADR-0011）：解析 symlink 后必须仍是运行目录
+/// 内的普通文件。目录与目标都做 symlink 解析，避免 `/var` vs `/private/var`
+/// 造成假阴性。GUI 写入侧与 Agent 加载侧共用此判定。
+enum ACLActiveLinkPolicy {
+  static func resolvesToRegularFile(inside directory: URL, linkURL: URL) -> Bool {
+    let fileManager = FileManager.default
+    let linkPath = linkURL.standardizedFileURL.path
+    guard fileManager.fileExists(atPath: linkPath) else { return false }
+    let resolved = URL(fileURLWithPath: linkPath).resolvingSymlinksInPath().standardizedFileURL
+    let resolvedDirectory = URL(fileURLWithPath: directory.path).resolvingSymlinksInPath()
+      .standardizedFileURL.path
+    guard resolved.path == resolvedDirectory || resolved.path.hasPrefix(resolvedDirectory + "/")
+    else { return false }
+    var isDirectory: ObjCBool = false
+    guard fileManager.fileExists(atPath: resolved.path, isDirectory: &isDirectory) else {
+      return false
+    }
+    return !isDirectory.boolValue
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/RuntimeReloadState.swift b/ShadowsocksX-NG2/Domain/Runtime/RuntimeReloadState.swift
new file mode 100644
index 000000000..7820c66f1
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/RuntimeReloadState.swift
@@ -0,0 +1,16 @@
+import Foundation
+
+/// 启动期间累积重载信号，只有全部投递成功后才清空。
+struct RuntimeReloadState {
+  private var pending = Set<Int32>()
+
+  mutating func enqueue(_ next: RuntimeSupervision, from current: RuntimeSupervision) {
+    pending.formUnion(next.reloadSignals(from: current))
+  }
+
+  mutating func flush(send: (Int32) -> Bool) -> Bool {
+    guard pending.sorted().allSatisfy(send) else { return false }
+    pending.removeAll()
+    return true
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/RuntimeSocketOwnershipProbe.swift b/ShadowsocksX-NG2/Domain/Runtime/RuntimeSocketOwnershipProbe.swift
new file mode 100644
index 000000000..476f250cf
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/RuntimeSocketOwnershipProbe.swift
@@ -0,0 +1,54 @@
+import Darwin
+
+/// Read the kernel's descriptor table to distinguish a candidate listener from
+/// another process that happens to answer on the same shared port.
+enum RuntimeSocketOwnershipProbe {
+  static func process(_ processID: Int32, ownsTCPListenerOn port: Int) -> Bool {
+    guard processID > 0, (1...65535).contains(port) else { return false }
+
+    let requiredBytes = proc_pidinfo(processID, PROC_PIDLISTFDS, 0, nil, 0)
+    let descriptorSize = MemoryLayout<proc_fdinfo>.size
+    guard requiredBytes >= descriptorSize else { return false }
+
+    var descriptors = [proc_fdinfo](
+      repeating: proc_fdinfo(), count: Int(requiredBytes) / descriptorSize)
+    let returnedBytes = descriptors.withUnsafeMutableBufferPointer { buffer in
+      guard let baseAddress = buffer.baseAddress else { return Int32(0) }
+      return proc_pidinfo(
+        processID,
+        PROC_PIDLISTFDS,
+        0,
+        UnsafeMutableRawPointer(baseAddress),
+        Int32(buffer.count * descriptorSize))
+    }
+    guard returnedBytes >= descriptorSize else { return false }
+
+    let descriptorCount = min(Int(returnedBytes) / descriptorSize, descriptors.count)
+    for descriptor in descriptors.prefix(descriptorCount)
+    where descriptor.proc_fdtype == UInt32(PROX_FDTYPE_SOCKET) {
+      var socketInfo = socket_fdinfo()
+      let socketInfoSize = MemoryLayout<socket_fdinfo>.size
+      let socketInfoBytes = proc_pidfdinfo(
+        processID,
+        descriptor.proc_fd,
+        PROC_PIDFDSOCKETINFO,
+        &socketInfo,
+        Int32(socketInfoSize))
+      guard socketInfoBytes == socketInfoSize else { continue }
+
+      let socket = socketInfo.psi
+      guard socket.soi_kind == SOCKINFO_TCP,
+        socket.soi_type == SOCK_STREAM,
+        socket.soi_protocol == IPPROTO_TCP,
+        socket.soi_proto.pri_tcp.tcpsi_state == TSI_S_LISTEN
+      else {
+        continue
+      }
+
+      let rawPort = UInt16(truncatingIfNeeded: socket.soi_proto.pri_tcp.tcpsi_ini.insi_lport)
+      if Int(UInt16(bigEndian: rawPort)) == port { return true }
+    }
+
+    return false
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/RuntimeSupervision.swift b/ShadowsocksX-NG2/Domain/Runtime/RuntimeSupervision.swift
new file mode 100644
index 000000000..9473c3bf4
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/RuntimeSupervision.swift
@@ -0,0 +1,191 @@
+import Darwin
+import Foundation
+
+/// Agent 的输入只包含非秘密运行事实。部署身份为随机值，不从凭据或配置摘要派生。
+struct RuntimeSupervision: Codable, Equatable, Sendable {
+  struct Endpoint: Codable, Equatable, Sendable {
+    let inboundProtocol: String
+    let localAddress: String
+    let localPort: Int
+    let mode: String
+
+    var probeHost: String {
+      switch localAddress {
+      case "0.0.0.0": "127.0.0.1"
+      case "::": "::1"
+      default: localAddress
+      }
+    }
+  }
+
+  struct ACL: Codable, Equatable, Sendable {
+    let file: String
+    let sha256: String
+    let size: Int
+  }
+
+  let version: Int
+  let generation: UInt64
+  let deploymentID: String
+  let configuration: String
+  /// 配置字节未变时复用的随机身份；旧监管资料缺失时保守重载配置。
+  let configurationID: String?
+  /// GUI 私有意图摘要的同代文件；Agent 只保留引用，不读取正文。
+  let intentMetadata: String
+  let locals: [Endpoint]
+  let ipv6Only: Bool?
+  let authenticationID: String?
+  let authenticationFiles: [String]
+  let acl: ACL?
+  let aclVariants: [String: ACL]
+
+  var retainedFiles: Set<String> {
+    Set([configuration, intentMetadata] + authenticationFiles + aclVariants.values.map(\.file))
+      .union(acl.map { [$0.file] } ?? [])
+  }
+
+  func requiresRestart(from old: Self) -> Bool {
+    locals != old.locals || ipv6Only != old.ipv6Only
+      || authenticationID != old.authenticationID
+  }
+
+  func reloadSignals(from old: Self) -> Set<Int32> {
+    var signals = Set<Int32>()
+    if configurationID == nil || configurationID != old.configurationID {
+      signals.insert(SIGUSR1)
+    }
+    if acl != old.acl { signals.insert(SIGUSR2) }
+    return signals
+  }
+
+  var hasValidStructure: Bool {
+    guard version == 2, generation > 0, UUID(uuidString: deploymentID) != nil,
+      configuration.hasPrefix("config-"), intentMetadata.hasPrefix("config-"),
+      RuntimePublication.generation(of: configuration) == generation,
+      RuntimePublication.generation(of: intentMetadata) == generation,
+      configuration != intentMetadata,
+      configurationID.map({ UUID(uuidString: $0) != nil }) ?? true,
+      authenticationFiles.allSatisfy({ $0.hasPrefix("auth-") && $0.hasSuffix(".json") }),
+      aclVariants.values.allSatisfy({ $0.file.hasPrefix("acl-") && $0.file.hasSuffix(".ini") }),
+      authenticationID.map({ UUID(uuidString: $0) != nil }) ?? true,
+      authenticationFiles.count == (authenticationID == nil ? 0 : 2),
+      [2, 4].contains(locals.count),
+      Set(locals.map(\.localPort)).count == locals.count,
+      locals.allSatisfy({
+        (1025...65535).contains($0.localPort)
+          && ["socks", "http"].contains($0.inboundProtocol)
+          && ["127.0.0.1", "0.0.0.0", "::"].contains($0.localAddress)
+          && ["tcp_only", "tcp_and_udp"].contains($0.mode)
+      }),
+      retainedFiles.allSatisfy({ name in
+        guard let fileGeneration = RuntimePublication.generation(of: name),
+          fileGeneration <= generation
+        else { return false }
+        return true
+      })
+    else { return false }
+    return true
+  }
+  func validated(in directory: URL) -> Bool {
+    hasValidStructure
+      && retainedFiles.allSatisfy {
+        RuntimePublication.isRegularFile(directory.appendingPathComponent($0))
+      }
+  }
+
+}
+
+/// 发布、引用复用和回收共享同一把 flock。Agent 持有旧快照时，回收还必须合并
+/// 锁内读取的最新发布引用；GUI 只能从该发布引用复用，不能复活已退休文件。
+enum RuntimePublication {
+  static func withLock<T>(in directory: URL, _ body: () throws -> T) throws -> T {
+    try AtomicFileWriter.prepareDirectory(at: directory)
+    let descriptor = open(
+      RuntimePaths(directoryURL: directory).publicationLockURL.path,
+      O_CREAT | O_RDWR | O_NOFOLLOW, 0o600)
+    guard descriptor >= 0 else { throw POSIXError(.EIO) }
+    defer { close(descriptor) }
+    guard flock(descriptor, LOCK_EX) == 0 else { throw POSIXError(.EIO) }
+    defer { flock(descriptor, LOCK_UN) }
+    return try body()
+  }
+
+  static func generation(of name: String) -> UInt64? {
+    let parts = name.split(separator: "-", omittingEmptySubsequences: false)
+    guard parts.count >= 3, ["config", "acl", "auth"].contains(String(parts[0])),
+      parts[1].count == 20, parts[1].allSatisfy(\.isNumber),
+      !name.contains("/"), !name.contains("..")
+    else { return nil }
+    return UInt64(parts[1])
+  }
+
+  static func isRegularFile(_ url: URL) -> Bool {
+    (try? FileManager.default.attributesOfItem(atPath: url.path)[.type]) as? FileAttributeType
+      == .typeRegular
+  }
+
+  /// 身份读取不依赖运行资源是否仍存在，缺失资源不得解除持久失败屏障。
+  static func metadata(at url: URL) -> RuntimeSupervision? {
+    guard let data = try? Data(contentsOf: url),
+      let value = try? JSONDecoder().decode(RuntimeSupervision.self, from: data),
+      value.hasValidStructure
+    else { return nil }
+    return value
+  }
+
+  static func load(at url: URL) -> RuntimeSupervision? {
+    guard let value = metadata(at: url), value.validated(in: url.deletingLastPathComponent())
+    else { return nil }
+    return value
+  }
+
+  static func select(_ snapshot: RuntimeSupervision, configurationLink: URL, aclLink: URL) throws {
+    let directory = configurationLink.deletingLastPathComponent()
+    try withLock(in: directory) {
+      guard snapshot.validated(in: directory) else { throw POSIXError(.EINVAL) }
+      if let acl = snapshot.acl { try link(acl.file, at: aclLink) }
+      try link(snapshot.configuration, at: configurationLink)
+    }
+  }
+
+  private static func link(_ name: String, at url: URL) throws {
+    let temporary = AtomicFileWriter.temporaryURL(for: url)
+    defer { try? FileManager.default.removeItem(at: temporary) }
+    try FileManager.default.createSymbolicLink(atPath: temporary.path, withDestinationPath: name)
+    guard rename(temporary.path, url.path) == 0,
+      ACLActiveLinkPolicy.resolvesToRegularFile(
+        inside: url.deletingLastPathComponent(), linkURL: url)
+    else { throw POSIXError(.EIO) }
+  }
+
+  /// 唯一回收者是 Agent。活进程与已选择快照引用由调用方传入；持锁保护扫描、
+  /// 最新发布读取及删除的整个区间，避免 GUI 在扫描后重新引用退休文件。
+  static func retire(
+    before snapshot: RuntimeSupervision, publishedAt url: URL,
+    protecting: Set<String>
+  ) throws {
+    let directory = url.deletingLastPathComponent()
+    try withLock(in: directory) {
+      guard let published = load(at: url) else { throw POSIXError(.EINVAL) }
+      let keep = protecting.union(snapshot.retainedFiles).union(published.retainedFiles)
+      for name in try FileManager.default.contentsOfDirectory(atPath: directory.path) {
+        guard let generation = generation(of: name), generation < snapshot.generation,
+          !keep.contains(name)
+        else { continue }
+        try FileManager.default.removeItem(at: directory.appendingPathComponent(name))
+      }
+    }
+  }
+}
+
+/// Receipt records Agent operations and listener ownership, not upstream application acknowledgement.
+struct RuntimeDeploymentReceipt: Codable, Equatable, Sendable {
+  let processID: Int32
+  let deploymentID: String
+}
+
+/// Both processes preserve a confirmed failure until an explicit retry or a new intent.
+struct RuntimeDeploymentFailure: Codable, Equatable, Sendable {
+  let deploymentID: String
+  let reason: String
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/SslocalOutputIntake.swift b/ShadowsocksX-NG2/Domain/Runtime/SslocalOutputIntake.swift
new file mode 100644
index 000000000..81405c9d3
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/SslocalOutputIntake.swift
@@ -0,0 +1,98 @@
+import Foundation
+import os
+
+/// 脱敏后行的去向缝：intake 只产出行（`LogLine`），行最终落在哪里由
+/// adapter 决定。
+protocol SslocalLineDestination: Sendable {
+  func receive(_ row: LogLine)
+}
+
+/// adapter：wrapper 的 stderr。`redirectStandardStreams` 以 freopen 把 stderr
+/// 收敛进 agent.log，行按统一行格式渲染（时间戳/级别/来源与诊断查看器同一
+/// 口径）。handle 可注入（生产默认标准错误），测试用管道替身断言序列化，
+/// 不碰进程全局 stderr。
+struct SslocalStandardErrorDestination: SslocalLineDestination {
+  private let handle: FileHandle
+
+  init(handle: FileHandle = .standardError) {
+    self.handle = handle
+  }
+
+  func receive(_ row: LogLine) {
+    handle.write(Data((row.rendered + "\n").utf8))
+  }
+}
+
+/// adapter：统一日志（category `sslocal`，与 RuntimeLogEvent 同 subsystem）。
+/// 上游输出是自由文本，不进封闭枚举事件流；整行标 private——上游默认日志
+/// 可能含服务器地址（ADR-0014），正文阅读继续走 agent.log 查看面。Console
+/// 获得时间戳、category、level 与行数关联；stderr/agent.log 通路没有这些
+/// 可过滤维度。级别由 intake 探测，这里只投影到统一日志五级。
+struct SslocalUnifiedLogDestination: SslocalLineDestination {
+  private let logger = Logger(subsystem: SystemLog.subsystem, category: "sslocal")
+
+  func receive(_ row: LogLine) {
+    // 统一日志写入受测试缝控制（SSXNG_SYSTEM_LOG=0 关闭），agent.log 去向不受影响。
+    guard SystemLog.systemLogEnabled else { return }
+    logger.log(level: OSLogType(row.level), "\(row.text, privacy: .private)")
+  }
+}
+
+/// sslocal 输出 intake：chunk-safe 行分帧 + 密码脱敏 + 超长行丢弃，把脱敏后的
+/// 行送到去向缝。FileHandle 回调通过锁串行访问缓冲区，避免分块输入绕过隐藏
+/// 规则。`write(Data())` 表示输入结束，冲刷尾部半行。
+///
+/// 这是上游自由文本进入日志去向的唯一入口：脱敏规则只在这一处，不再随去向
+/// 复制；上游认证失败日志包含客户端提交的密码，按完整行隐藏密码后再分发。
+/// 行模型（时间戳、级别探测、来源 `sslocal`）也在此构造，各 adapter 只做投影。
+final class SslocalOutputIntake: @unchecked Sendable {
+  private let lock = NSLock()
+  private var buffer = Data()
+  private var discardingOversizedLine = false
+  private let destinations: [any SslocalLineDestination]
+  private let now: () -> Date
+
+  init(destinations: [any SslocalLineDestination], now: @escaping () -> Date = { Date() }) {
+    self.destinations = destinations
+    self.now = now
+  }
+
+  func write(_ data: Data) {
+    lock.lock()
+    defer { lock.unlock() }
+    if discardingOversizedLine {
+      guard let newline = data.firstIndex(of: 10) else { return }
+      discardingOversizedLine = false
+      buffer.append(data.suffix(from: data.index(after: newline)))
+    } else {
+      buffer.append(data)
+    }
+    while let newline = buffer.firstIndex(of: 10) {
+      emitLine(String(data: buffer.prefix(upTo: newline), encoding: .utf8))
+      buffer.removeSubrange(...newline)
+    }
+    if data.isEmpty && !buffer.isEmpty {
+      emitLine(String(data: buffer, encoding: .utf8))
+      buffer.removeAll()
+    } else if buffer.count > 65_536 {
+      buffer.removeAll()
+      discardingOversizedLine = true
+      emitLine("log line truncated")
+    }
+  }
+
+  private func emitLine(_ text: String?) {
+    guard let text else { return }
+    let sanitized = text.replacingOccurrences(
+      of: "password: [^\\r\\n]*",
+      with: "password: [redacted]", options: .regularExpression)
+    let row = LogLine(
+      timestamp: now(),
+      level: .detect(in: sanitized),
+      source: .sslocal,
+      text: sanitized)
+    for destination in destinations {
+      destination.receive(row)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/SslocalRuntimeDocument.swift b/ShadowsocksX-NG2/Domain/Runtime/SslocalRuntimeDocument.swift
new file mode 100644
index 000000000..e65ce50da
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/SslocalRuntimeDocument.swift
@@ -0,0 +1,334 @@
+import Foundation
+
+/// Effective binding policy used by runtime documents and port probes.
+/// `disabled` represents the local loopback binding; LAN settings use
+/// `LANListenerMode` and an independent enable switch.
+enum ListenerMode: String, Codable, CaseIterable, Equatable, Sendable {
+  case disabled
+  case allIPv4Interfaces = "all_ipv4_interfaces"
+  case allIPv4AndIPv6Interfaces = "all_ipv4_and_ipv6_interfaces"
+  case allIPv6Interfaces = "all_ipv6_interfaces"
+
+  var bindAddress: String {
+    switch self {
+    case .disabled: "127.0.0.1"
+    case .allIPv4Interfaces: "0.0.0.0"
+    case .allIPv4AndIPv6Interfaces, .allIPv6Interfaces: "::"
+    }
+  }
+
+  /// `nil` omits the upstream option for IPv4 listeners. IPv6 wildcard modes
+  /// explicitly select dual-stack or IPv6-only behavior.
+  var ipv6Only: Bool? {
+    switch self {
+    case .disabled, .allIPv4Interfaces: nil
+    case .allIPv4AndIPv6Interfaces: false
+    case .allIPv6Interfaces: true
+    }
+  }
+
+  var bindingHint: String {
+    switch self {
+    case .disabled: "127.0.0.1"
+    case .allIPv4Interfaces: "0.0.0.0"
+    case .allIPv4AndIPv6Interfaces: ":: / IPV6_V6ONLY=false"
+    case .allIPv6Interfaces: ":: / IPV6_V6ONLY=true"
+    }
+  }
+
+  var displayName: String {
+    switch self {
+    case .disabled: String(localized: "关闭")
+    case .allIPv4Interfaces: String(localized: "所有 IPv4 接口")
+    case .allIPv4AndIPv6Interfaces: String(localized: "所有 IPv4 与 IPv6 接口")
+    case .allIPv6Interfaces: String(localized: "所有 IPv6 接口")
+    }
+  }
+
+  var exposesNetworkInterfaces: Bool { self != .disabled }
+}
+
+/// `sslocal` 的一个本地入站。上游 v1.26.0 通过 `locals[]` 同时承载 SOCKS5
+/// 与 HTTP；HTTP 直接由 shadowsocks-rust 提供，不经过 Legacy Privoxy。
+struct SslocalLocalDocument: Codable, Equatable, Sendable {
+  let inboundProtocol: String
+  let localAddress: String
+  let localPort: Int
+  let mode: String
+  var socks5AuthConfigPath: String?
+  var httpAuthConfigPath: String?
+
+  enum CodingKeys: String, CodingKey {
+    case mode
+    case socks5AuthConfigPath = "socks5_auth_config_path"
+    case httpAuthConfigPath = "http_auth_config_path"
+    case inboundProtocol = "protocol"
+    case localAddress = "local_address"
+    case localPort = "local_port"
+  }
+}
+
+/// GUI 内存中的监听事实；不进入 sslocal 配置或 Agent 监管资料。
+struct RuntimeListenDocument: Encodable, Equatable, Sendable {
+  let listenerMode: ListenerMode
+  let bindAddress: String
+  var lan = LANListeningFacts()
+  var authentication: RuntimeListenerAuthentication?
+
+  enum CodingKeys: String, CodingKey {
+    case lan, authentication
+    case listenerMode = "listener_mode"
+    case bindAddress = "bind_address"
+  }
+}
+
+/// GUI 派生的运行意图；上游 JSON 由独立输出表示生成。
+/// 密码与插件参数已在此解析为明文；私有意图编码不落盘，永不入日志。
+struct SslocalRuntimeDocument: Equatable, Sendable {
+  let servers: [SslocalServerDocument]
+  var locals: [SslocalLocalDocument]
+  let ipv6Only: Bool?
+  var listen: RuntimeListenDocument
+  /// 两个入站共用的稳定 ACL 路径；变体身份只供 GUI 准备和发布。
+  let aclFilePath: String?
+  let aclRuntime: ProxyACLDocument?
+
+  init(
+    servers: [SslocalServerDocument],
+    listen: ProxyListeningConfiguration,
+    acl: ProxyACLDocument? = nil
+  ) {
+    self.servers = servers
+    locals = listen.locals
+    self.listen = RuntimeListenDocument(
+      listenerMode: listen.listenerMode,
+      bindAddress: listen.bindAddress, lan: LANListeningFacts(listen.lan))
+    ipv6Only = listen.listenerMode.ipv6Only
+    aclFilePath = acl?.path
+    aclRuntime = acl
+  }
+
+  private init(
+    servers: [SslocalServerDocument],
+    locals: [SslocalLocalDocument],
+    listen: RuntimeListenDocument,
+    ipv6Only: Bool?,
+    acl: ProxyACLDocument?
+  ) {
+    self.servers = servers
+    self.locals = locals
+    self.listen = listen
+    self.ipv6Only = ipv6Only
+    aclFilePath = acl?.path
+    aclRuntime = acl
+  }
+
+  func jsonData() throws -> Data {
+    try Self.jsonEncoder.encode(
+      SslocalConfigurationDocument(
+        servers: servers, locals: locals, ipv6Only: ipv6Only, aclFilePath: aclFilePath))
+  }
+
+  var intentSHA256: String? {
+    try? ProxyACLDocument.digest(intentData())
+  }
+
+  /// 私有意图编码只用于等价比较；不落盘，也不作为 sslocal 的输入。
+  fileprivate func intentData() throws -> Data {
+    struct Intent: Encodable {
+      let servers: [SslocalServerDocument]
+      let locals: [SslocalLocalDocument]
+      let ipv6Only: Bool?
+      let listen: RuntimeListenDocument
+      let acl: ProxyACLDocument?
+    }
+    return try Self.jsonEncoder.encode(
+      Intent(servers: servers, locals: locals, ipv6Only: ipv6Only, listen: listen, acl: aclRuntime))
+  }
+
+  func replacingACL(_ acl: ProxyACLDocument?) -> SslocalRuntimeDocument {
+    SslocalRuntimeDocument(
+      servers: servers,
+      locals: locals,
+      listen: listen,
+      ipv6Only: ipv6Only,
+      acl: acl)
+  }
+
+  private static let jsonEncoder: JSONEncoder = {
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
+    return encoder
+  }()
+}
+
+/// sslocal 的输出格式；GUI 运行意图中的监听事实和 ACL 身份不进入此文档。
+struct SslocalConfigurationDocument: Codable, Equatable, Sendable {
+  let servers: [SslocalServerDocument]
+  var locals: [SslocalLocalDocument]
+  let ipv6Only: Bool?
+  let aclFilePath: String?
+
+  enum CodingKeys: String, CodingKey {
+    case servers, locals
+    case ipv6Only = "ipv6_only"
+    case aclFilePath = "acl"
+  }
+}
+
+/// 上游 `servers[]` 条目。id 携带叶子身份，供上游稳定标识；显示名是目录
+/// 元数据，不进契约（GLOSSARY.md「Runtime configuration file」）。
+/// 插件字段在无插件时整体省略。
+struct SslocalServerDocument: Codable, Equatable, Sendable {
+  let id: String
+  let server: String
+  let serverPort: Int
+  let password: String
+  let method: String
+  let plugin: String?
+  let pluginOpts: String?
+  var pluginArgs: [String]?
+  var pluginMode: PluginTransportMode?
+
+  enum CodingKeys: String, CodingKey {
+    case id, server
+    case serverPort = "server_port"
+    case password, method, plugin
+    case pluginOpts = "plugin_opts"
+    case pluginArgs = "plugin_args"
+    case pluginMode = "plugin_mode"
+  }
+}
+
+extension SslocalLocalDocument {
+  /// 探测用主机名：通配绑定地址按回环探测（wrapper 监听判定与 GUI 健康门
+  /// 共用口径）。
+  var probeHost: String {
+    switch localAddress {
+    case "0.0.0.0": "127.0.0.1"
+    case "::": "::1"
+    default: localAddress
+    }
+  }
+}
+
+extension SslocalRuntimeDocument {
+  var listenFingerprint: SslocalListenFingerprint {
+    SslocalListenFingerprint(
+      locals: locals, ipv6Only: ipv6Only, acl: aclRuntime,
+      authentication: listen.authentication)
+  }
+
+  var socksLocal: SslocalLocalDocument? {
+    locals.first { $0.inboundProtocol == "socks" }
+  }
+
+  var socksAddress: String { socksLocal?.localAddress ?? "" }
+  var socksPort: Int { socksLocal?.localPort ?? 0 }
+  var socksMode: String { socksLocal?.mode ?? "" }
+
+  /// HTTP 入站端口；缺 HTTP 入站时为 0。完整入站组由 `isWellFormed` 在
+  /// 跨进程契约缝拒绝，端口合法性由 settings store 保证。
+  var httpPort: Int {
+    locals.first { $0.inboundProtocol == "http" }?.localPort ?? 0
+  }
+
+  /// GUI 准备侧校验：端口、协议与共享范围必须一致。空 `servers` 合法：
+  /// 无活动目标时 agent 以空服务器列表提供本地监听；上游 sslocal v1.26.0
+  /// 接受空 servers 并照常绑定本地入站。
+  var isWellFormed: Bool {
+    guard
+      (aclFilePath == nil) == (aclRuntime == nil),
+      aclRuntime.map({ $0.isWellFormed && $0.path == aclFilePath }) ?? true
+    else { return false }
+
+    guard listen.bindAddress == "127.0.0.1", listen.listenerMode == listen.lan.effectiveMode,
+      ipv6Only == listen.lan.effectiveMode.ipv6Only
+    else { return false }
+    let local = locals.filter { $0.localAddress == "127.0.0.1" }
+    let network = locals.filter { $0.localAddress != "127.0.0.1" }
+    guard local.count == 2, local.filter({ $0.inboundProtocol == "socks" }).count == 1,
+      local.filter({ $0.inboundProtocol == "http" }).count == 1,
+      local.allSatisfy({
+        $0.mode == ($0.inboundProtocol == "socks" ? "tcp_and_udp" : "tcp_only")
+          && $0.socks5AuthConfigPath == nil && $0.httpAuthConfigPath == nil
+      })
+    else { return false }
+    var expected = ProxyListeningConfiguration()
+    expected.local.socksPort = socksPort
+    expected.local.httpPort = httpPort
+    expected.lan = listen.lan.configuration
+    guard network.count == (listen.lan.isEnabled ? 2 : 0),
+      expected.configuredPorts.allSatisfy({ ProxyPortRange.valid.contains($0) }),
+      Set(expected.configuredPorts).count == 4
+    else { return false }
+    for (actual, desired) in zip(locals, expected.locals) {
+      guard actual.inboundProtocol == desired.inboundProtocol,
+        actual.localAddress == desired.localAddress, actual.localPort == desired.localPort,
+        actual.mode == desired.mode
+      else { return false }
+    }
+    if listen.lan.isEnabled && listen.lan.authenticationEnabled {
+      guard let auth = listen.authentication, auth.isValid, auth.username == listen.lan.username,
+        network.first(where: { $0.inboundProtocol == "socks" })?.socks5AuthConfigPath
+          == auth.socksPath,
+        network.first(where: { $0.inboundProtocol == "http" })?.httpAuthConfigPath == auth.httpPath
+      else { return false }
+    } else if listen.authentication != nil
+      || network.contains(where: {
+        $0.socks5AuthConfigPath != nil || $0.httpAuthConfigPath != nil
+      })
+    {
+      return false
+    }
+
+    return servers.allSatisfy { server in
+      (1...65535).contains(server.serverPort)
+        && !server.id.isEmpty
+        && !server.server.isEmpty
+        && !server.method.isEmpty
+    }
+  }
+}
+
+/// GUI 准备的运行意图与私有摘要；Agent 回执使用独立随机部署身份。
+struct PreparedRuntimeContract: Sendable {
+  let document: SslocalRuntimeDocument
+  let sha256: String
+
+  init(_ document: SslocalRuntimeDocument) throws {
+    self.document = document
+    sha256 = try ProxyACLDocument.digest(document.intentData())
+  }
+}
+
+extension Redactor {
+  /// 运行时文档只允许暴露数量与模式元数据。
+  static func documentSummary(_ document: SslocalRuntimeDocument) -> String {
+    let protocols = document.locals.map(\.inboundProtocol).joined(separator: ",")
+    return "servers=\(document.servers.count) protocols=\(protocols) mode=\(document.socksMode)"
+  }
+}
+
+/// 控制器在准备完成后仅保留健康检查与界面所需事实，不缓存完整秘密文档。
+struct RuntimeDeploymentFacts: Equatable, Sendable {
+  let locals: [SslocalLocalDocument]
+  let listen: RuntimeListenFacts
+  let hasServers: Bool
+  let aclSummary: String?
+  let intentSHA256: String?
+  let configurationIntentSHA256: String?
+
+  init(_ document: SslocalRuntimeDocument) {
+    locals = document.locals.map {
+      SslocalLocalDocument(
+        inboundProtocol: $0.inboundProtocol, localAddress: $0.localAddress,
+        localPort: $0.localPort, mode: $0.mode)
+    }
+    listen = RuntimeListenFacts(document: document)
+    hasServers = !document.servers.isEmpty
+    aclSummary = document.aclRuntime?.summary
+    intentSHA256 = document.intentSHA256
+    configurationIntentSHA256 = document.replacingACL(nil).intentSHA256
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Runtime/SystemLog.swift b/ShadowsocksX-NG2/Domain/Runtime/SystemLog.swift
new file mode 100644
index 000000000..55264c2ee
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Runtime/SystemLog.swift
@@ -0,0 +1,42 @@
+import Foundation
+import os
+
+/// 统一日志（Unified Logging）最小发射单元：GUI、wrapper 与特权
+/// helper 三个进程共用同一 subsystem，Console.app 一条过滤即可对照
+/// 各进程事件。发射的事实（level/category/text/privateDetail）由调用方的
+/// 封闭事件枚举给出；privacy 拆分口径与去向取舍见 ADR-0045，特权 helper
+/// 的接入边界见 ADR-0047。
+enum SystemLog {
+  /// 系统日志 subsystem：各进程共用一个名字，Console.app 一条过滤全看。
+  static let subsystem = "com.qiuyuzhou.ShadowsocksX-NG2"
+
+  /// 统一日志写入开关（测试缝）：`SSXNG_SYSTEM_LOG=0` 关闭系统日志写入，
+  /// stderr 行与事件缓冲不受影响。scheme 的测试动作注入该值，测试拉起的
+  /// 子进程在夹具 env 显式设置——测试运行不把大量日志灌进系统日志 store。
+  static let systemLogEnabled = isSystemLogEnabled(ProcessInfo.processInfo.environment)
+
+  static func isSystemLogEnabled(_ environment: [String: String]) -> Bool {
+    environment["SSXNG_SYSTEM_LOG"] != "0"
+  }
+
+  /// 按路由发射一条统一日志消息：公开文本标 public，自由 detail 段标
+  /// private（普通视图显示 `<private>`）。写入开关关闭时整体跳过。
+  static func emit(_ route: SystemLogRoute) {
+    guard systemLogEnabled else { return }
+    let logger = Logger(subsystem: subsystem, category: route.category)
+    if let detail = route.privateDetail {
+      logger.log(level: route.level, "\(route.text, privacy: .public)\(detail, privacy: .private)")
+    } else {
+      logger.log(level: route.level, "\(route.text, privacy: .public)")
+    }
+  }
+}
+
+/// 系统日志路由事实：发射缝按此构造统一日志消息。`text` 已含与
+/// `privateDetail` 之间的分隔符，两者拼接等于事件的 `description`。
+struct SystemLogRoute: Sendable {
+  var level: OSLogType
+  var category: String
+  var text: String
+  var privateDetail: String?
+}
diff --git a/ShadowsocksX-NG2/Domain/Settings/ApplicationSupportPaths.swift b/ShadowsocksX-NG2/Domain/Settings/ApplicationSupportPaths.swift
new file mode 100644
index 000000000..a2541eafe
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Settings/ApplicationSupportPaths.swift
@@ -0,0 +1,32 @@
+import Foundation
+
+/// 应用支持目录按生命周期分类；路径计算不执行 I/O，也不迁移旧平铺文件。
+struct ApplicationSupportPaths {
+  static let current = ApplicationSupportPaths(
+    rootURL: FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask)[0]
+      .appendingPathComponent("ShadowsocksX-NG2", isDirectory: true))
+
+  let rootURL: URL
+
+  var configurationDirectoryURL: URL {
+    rootURL.appendingPathComponent("configuration", isDirectory: true)
+  }
+
+  var runtime: RuntimePaths {
+    RuntimePaths(directoryURL: rootURL.appendingPathComponent("runtime", isDirectory: true))
+  }
+
+  var logsDirectoryURL: URL { rootURL.appendingPathComponent("logs", isDirectory: true) }
+  var agentLogURL: URL { logsDirectoryURL.appendingPathComponent("agent.log") }
+  var catalogFileURL: URL { configurationDirectoryURL.appendingPathComponent("catalog.age") }
+  var proxyListeningFileURL: URL {
+    configurationDirectoryURL.appendingPathComponent("proxy-listening.age")
+  }
+  var customRulesFileURL: URL {
+    configurationDirectoryURL.appendingPathComponent("custom-rules.json")
+  }
+  var activationStateFileURL: URL {
+    configurationDirectoryURL.appendingPathComponent("activation.json")
+  }
+  var pluginMappingFileURL: URL { configurationDirectoryURL.appendingPathComponent("plugins.json") }
+}
diff --git a/ShadowsocksX-NG2/Domain/Settings/ProxyControlPreferences.swift b/ShadowsocksX-NG2/Domain/Settings/ProxyControlPreferences.swift
new file mode 100644
index 000000000..30ba48d29
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Settings/ProxyControlPreferences.swift
@@ -0,0 +1,46 @@
+import Foundation
+
+/// 当前用户的代理控制偏好；采用 UserDefaults 的即时内存更新与异步写盘语义。
+struct ProxyControlPreferences {
+  let defaults: UserDefaults
+
+  init(defaults: UserDefaults = .standard) { self.defaults = defaults }
+
+  var preferredMode: ProxyModeKind {
+    get {
+      defaults.string(forKey: "proxyControl.preferredMode").flatMap(ProxyModeKind.init(rawValue:))
+        ?? .rule
+    }
+    nonmutating set { defaults.set(newValue.rawValue, forKey: "proxyControl.preferredMode") }
+  }
+
+  var rulePreset: RulePreset {
+    get {
+      if let saved = defaults.string(forKey: "proxyControl.rulePreset").flatMap(
+        RulePreset.init(rawValue:))
+      {
+        return saved
+      }
+      let legacy =
+        defaults.string(forKey: "proxyControl.ruleDefaultAction")
+        .flatMap(RuleDefaultAction.init(rawValue:)) ?? .directWhenUnmatched
+      return RulePreset(legacy: legacy)
+    }
+    nonmutating set { defaults.set(newValue.rawValue, forKey: "proxyControl.rulePreset") }
+  }
+
+  var agentEnabled: Bool {
+    get { defaults.object(forKey: "proxyControl.agentEnabled") as? Bool ?? false }
+    nonmutating set { defaults.set(newValue, forKey: "proxyControl.agentEnabled") }
+  }
+
+  var systemProxyEnabled: Bool {
+    get { defaults.object(forKey: "proxyControl.systemProxyEnabled") as? Bool ?? false }
+    nonmutating set { defaults.set(newValue, forKey: "proxyControl.systemProxyEnabled") }
+  }
+
+  var proxyExceptions: String {
+    get { defaults.object(forKey: "proxyControl.proxyExceptions") as? String ?? "" }
+    nonmutating set { defaults.set(newValue, forKey: "proxyControl.proxyExceptions") }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Settings/ProxyListeningFileStore.swift b/ShadowsocksX-NG2/Domain/Settings/ProxyListeningFileStore.swift
new file mode 100644
index 000000000..da1a6f77c
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Settings/ProxyListeningFileStore.swift
@@ -0,0 +1,96 @@
+import Foundation
+
+extension ProxyListeningConfiguration {
+  /// 保存时联合校验四端口，身份验证开启时要求用户名与密码有效。
+  func enforcePersistenceConstraints() throws {
+    if lan.authenticationEnabled
+      && (!RuntimeListenerAuthentication.validUsername(lan.username)
+        || !RuntimeListenerAuthentication.validPassword(lan.password ?? ""))
+    {
+      throw ProxyListeningStoreError.credentialFailure(detail: String(localized: "局域网身份验证凭据无效"))
+    }
+    let errors = portValidationErrors()
+    guard errors.isEmpty else { throw ProxyListeningStoreError.invalid(errors) }
+  }
+}
+
+protocol ProxyListeningStoring {
+  func load() throws -> ProxyListeningConfiguration
+  func save(_ configuration: ProxyListeningConfiguration) throws
+}
+
+enum ProxyListeningStoreError: Error, Equatable {
+  case corrupt(detail: String)
+  case invalid([PortSettingError])
+  case ioFailure(detail: String)
+  case credentialFailure(detail: String)
+  case encryptedFile(EncryptedFileError)
+}
+
+/// 整体加密保存监听配置，不承载控制偏好或其他场景设置。
+struct ProxyListeningFileStore: ProxyListeningStoring {
+  let fileURL: URL
+  private let encrypted: EncryptedFileStorage<ProxyListeningConfiguration>
+
+  init(
+    fileURL: URL = ProxyListeningFileStore.defaultFileURL(),
+    keys: CredentialKeyStoring = KeychainCredentialKeyStore(namespace: "proxy-listening.age")
+  ) {
+    self.fileURL = fileURL
+    encrypted = EncryptedFileStorage(
+      keys: keys, maximumSize: 1024 * 1024,
+      legacyFileNames: ["proxy-listening.enc", "proxy-listening.json"],
+      makeDefault: { ProxyListeningConfiguration() },
+      encode: { configuration in
+        try configuration.enforcePersistenceConstraints()
+        return try JSONEncoder().encode(
+          ProxyListeningPayload(version: 1, configuration: configuration))
+      },
+      decode: { data in
+        let configuration: ProxyListeningConfiguration
+        do {
+          let payload = try JSONDecoder().decode(ProxyListeningPayload.self, from: data)
+          guard payload.version == 1 else { throw EncryptedFileError.unsupportedVersion }
+          configuration = payload.configuration
+        } catch let error as EncryptedFileError {
+          throw error
+        } catch { throw ProxyListeningStoreError.corrupt(detail: "invalid listening payload") }
+        try configuration.enforcePersistenceConstraints()
+        return configuration
+      })
+  }
+
+  static func defaultFileURL() -> URL { ApplicationSupportPaths.current.proxyListeningFileURL }
+
+  func load() throws -> ProxyListeningConfiguration {
+    try translatingErrors { try encrypted.load(at: fileURL, allowingInteraction: false) }
+  }
+
+  func save(_ configuration: ProxyListeningConfiguration) throws {
+    try configuration.enforcePersistenceConstraints()
+    try translatingErrors {
+      if !encrypted.isLoaded { _ = try load() }
+      try encrypted.save(configuration, at: fileURL)
+    }
+  }
+
+  func reset() throws -> ProxyListeningConfiguration {
+    try translatingErrors { try encrypted.reset(at: fileURL) }
+  }
+
+  private func translatingErrors<T>(_ operation: () throws -> T) throws -> T {
+    do { return try operation() } catch let error as ProxyListeningStoreError {
+      throw error
+    } catch let error as EncryptedFileError {
+      throw ProxyListeningStoreError.encryptedFile(error)
+    } catch is CredentialKeyStoreError {
+      throw ProxyListeningStoreError.credentialFailure(detail: String(localized: "无法访问监听配置主密钥"))
+    } catch { throw ProxyListeningStoreError.ioFailure(detail: String(describing: error)) }
+  }
+
+}
+
+private struct ProxyListeningPayload: Codable {
+  let version: Int
+  let configuration: ProxyListeningConfiguration
+}
diff --git a/ShadowsocksX-NG2/Domain/Settings/ProxyRuntimeSettings.swift b/ShadowsocksX-NG2/Domain/Settings/ProxyRuntimeSettings.swift
new file mode 100644
index 000000000..d2218a11a
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Settings/ProxyRuntimeSettings.swift
@@ -0,0 +1,72 @@
+import Foundation
+
+/// 运行计算捕获的内存快照，不代表统一持久化文档。监听配置独立保存，
+/// 控制偏好由各命令更新；代理启动前从此快照派生完整运行配置。
+struct ProxyRuntimeSettings: Equatable, Sendable {
+  static let defaultProxyExceptions = ""
+
+  var listen: ProxyListeningConfiguration
+  /// User-added system-proxy exceptions; these entries do not become ACL rules.
+  var proxyExceptions: String
+  /// The persisted current mode: the mode selector's choice survives GUI
+  /// restarts. First run defaults to rule mode.
+  var preferredMode: ProxyModeKind
+  /// 规则模式预设，首次启动默认为仅 GFW 列表内目标代理。
+  var rulePreset: RulePreset
+  var ruleDefaultAction: RuleDefaultAction {
+    rulePreset.defaultAction
+  }
+  /// 用户保存的代理服务意图，默认关闭，与当前运行健康状态独立。
+  var agentEnabled: Bool
+  /// 系统代理意图：默认关闭；与 agent 意图相互独立，开关关闭
+  /// 关闭时清理匹配 NG2 端点的系统代理配置，不影响本地监听。
+  var systemProxyEnabled: Bool
+
+  init(
+    listen: ProxyListeningConfiguration = ProxyListeningConfiguration(),
+    proxyExceptions: String = ProxyRuntimeSettings.defaultProxyExceptions,
+    preferredMode: ProxyModeKind = .rule,
+    rulePreset: RulePreset = .gfwlist,
+    agentEnabled: Bool = false,
+    systemProxyEnabled: Bool = false
+  ) {
+    self.listen = listen
+    self.proxyExceptions = proxyExceptions
+    self.preferredMode = preferredMode
+    self.rulePreset = rulePreset
+    self.agentEnabled = agentEnabled
+    self.systemProxyEnabled = systemProxyEnabled
+  }
+
+  init(listen: ProxyListeningConfiguration, preferences: ProxyControlPreferences) {
+    self.init(
+      listen: listen, proxyExceptions: preferences.proxyExceptions,
+      preferredMode: preferences.preferredMode, rulePreset: preferences.rulePreset,
+      agentEnabled: preferences.agentEnabled, systemProxyEnabled: preferences.systemProxyEnabled)
+  }
+
+  /// 系统代理的 ExceptionsList；输入顺序保留，重复项只保留第一次出现的值。
+  var proxyExceptionList: [String] {
+    var result: [String] = []
+    var seen = Set<String>()
+    for value in proxyExceptions.split(whereSeparator: { character in
+      character == "," || character == "、" || character.isWhitespace
+    }) {
+      let item = String(value)
+      let identity = item.lowercased()
+      guard !item.isEmpty, seen.insert(identity).inserted else { continue }
+      result.append(item)
+    }
+    return result
+  }
+
+  var validationErrors: [PortSettingError] {
+    listen.portValidationErrors()
+  }
+
+}
+
+struct RestoredProxyRuntimeSettings: Equatable {
+  let settings: ProxyRuntimeSettings
+  let unreadableError: ProxyListeningStoreError?
+}
diff --git a/ShadowsocksX-NG2/Domain/Settings/SilentLaunchStore.swift b/ShadowsocksX-NG2/Domain/Settings/SilentLaunchStore.swift
new file mode 100644
index 000000000..5fd56e289
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Settings/SilentLaunchStore.swift
@@ -0,0 +1,27 @@
+import Foundation
+
+/// 静默启动偏好持久化（ADR 0017）：存于应用标准 defaults 域（键
+/// `silentLaunch`）的 GUI 呈现偏好，与代理控制偏好和监听配置分别管理。
+/// 键缺失或外部错误类型按安全侧默认「不静默」（启动照常呈现主窗口）。
+/// 初版开发文件不再迁移，旧平铺目录保持不变。
+struct SilentLaunchStore {
+  private static let key = "silentLaunch"
+  let defaults: UserDefaults
+
+  init(defaults: UserDefaults = .standard) {
+    self.defaults = defaults
+  }
+
+  /// 键缺失或外部错误类型（无法按 Bool 桥接）→ `false`（安全侧：不静默），
+  /// 严格性与初版文件形态的 decode 一致，无需 register(defaults:)。
+  func loadSilentLaunchEnabled() -> Bool {
+    defaults.object(forKey: Self.key) as? Bool ?? false
+  }
+
+  /// UserDefaults 无失败信号：极端落盘失败表现为下次启动回退默认（尽力而为，
+  /// ADR 0017 修正后放弃文件版的失败点名路径）。
+  func save(silentLaunchEnabled: Bool) {
+    defaults.set(silentLaunchEnabled, forKey: Self.key)
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Domain/Subscription/SubscriptionAutoUpdate.swift b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionAutoUpdate.swift
new file mode 100644
index 000000000..de791b295
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionAutoUpdate.swift
@@ -0,0 +1,88 @@
+import Foundation
+
+enum SubscriptionUpdateMode: String, Codable, CaseIterable, Sendable {
+  case off, daily, weekly
+
+  var interval: TimeInterval? {
+    switch self {
+    case .off: nil
+    case .daily: 86_400
+    case .weekly: 604_800
+    }
+  }
+}
+
+struct SubscriptionUpdatePolicy: Codable, Equatable, Sendable {
+  var mode: SubscriptionUpdateMode
+  var allowUserOverride: Bool
+
+  enum CodingKeys: String, CodingKey {
+    case mode
+    case allowUserOverride = "allow_user_override"
+  }
+}
+
+enum SubscriptionUpdatePolicyResult: Equatable, Sendable {
+  case absent, invalid
+  case valid(SubscriptionUpdatePolicy)
+}
+
+/// Editable choices; provider facts and the persisted deadline are not form input.
+struct SubscriptionAutoUpdateSettings: Equatable, Sendable {
+  var userOverride: SubscriptionUpdateMode?
+  var interval: SubscriptionUpdateMode = .daily
+}
+
+/// Provider constraints hide, but never erase, the user's saved override.
+struct SubscriptionAutoUpdate: Codable, Equatable, Sendable {
+  private(set) var provider: SubscriptionUpdatePolicy?
+  private(set) var userOverride: SubscriptionUpdateMode?
+  private(set) var interval: SubscriptionUpdateMode = .daily
+  private(set) var nextUpdateAt: Date?
+
+  var allowsUserOverride: Bool { provider?.allowUserOverride != false }
+
+  var effectiveMode: SubscriptionUpdateMode {
+    if let provider, !provider.allowUserOverride { return provider.mode }
+    return userOverride ?? provider?.mode ?? .off
+  }
+
+  var settings: SubscriptionAutoUpdateSettings {
+    .init(userOverride: userOverride, interval: interval)
+  }
+
+  /// A source change releases its policy only after applying the old constraints.
+  mutating func save(
+    _ settings: SubscriptionAutoUpdateSettings?, sourceChanged: Bool = false,
+    at date: Date, jitter: Double
+  ) {
+    let previousMode = effectiveMode
+    if let settings, allowsUserOverride {
+      userOverride = settings.userOverride
+      interval = settings.interval == .weekly ? .weekly : .daily
+    }
+    if sourceChanged { provider = nil }
+    if previousMode != effectiveMode { schedule(from: date, jitter: jitter) }
+  }
+
+  mutating func refreshSucceeded(
+    policy: SubscriptionUpdatePolicyResult, at date: Date, jitter: Double
+  ) {
+    switch policy {
+    case .absent: provider = nil
+    case .valid(let policy): provider = policy
+    case .invalid: break
+    }
+    schedule(from: date, jitter: jitter)
+  }
+
+  mutating func refreshFailed(at date: Date, jitter: Double) {
+    schedule(from: date, jitter: jitter)
+  }
+
+  private mutating func schedule(from date: Date, jitter: Double) {
+    nextUpdateAt = effectiveMode.interval.map {
+      date.addingTimeInterval($0 * (1 + min(max(jitter, 0), 0.1)))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Subscription/SubscriptionDocument.swift b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionDocument.swift
new file mode 100644
index 000000000..fa6457d44
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionDocument.swift
@@ -0,0 +1,375 @@
+import CryptoKit
+import Foundation
+
+/// SIP-008 服务器记录的已校验明文形态（凭据尚未入存储）。
+struct RemoteServerRecord: Equatable, Sendable {
+  var address: String
+  var port: Int
+  var encryptionMethod: String
+  var password: String
+  var remark: String
+  var pluginProgram: String?
+  var pluginOptions: String?
+}
+
+/// 解析完成的订阅快照：SIP-008 `version: 1` 扁平
+/// `servers` + 可选私有扩展 `x_shadowsocksx_ng`。身份已按订阅作用域限定
+/// （服务器引用复用 `servers[].id`；无稳定 ID 的记录用地址端口指纹，
+/// 相同端点延续身份）；结构、顺序、名称全部远端权威。扩展缺失/未知/
+/// 无效时回退标准扁平列表（根分组无名称，由调用方以 URL host 兜底）。
+struct SubscriptionSnapshot: Equatable, Sendable {
+  struct ServerLeaf: Equatable, Sendable {
+    let id: NodeID
+    let record: RemoteServerRecord
+  }
+
+  /// 有序子引用：顺序即远端 `children` 的用户可见顺序（不按类型拆分）。
+  enum Child: Equatable, Sendable {
+    case group(Group)
+    case server(ServerLeaf)
+  }
+
+  struct Group: Equatable, Sendable {
+    /// 分组身份（按订阅作用域限定）。根分组的 `id` 不参与挂载——订阅固定
+    /// 分组身份客户端所有，应用时由 `groupID` 入参决定。
+    let id: NodeID
+    let name: String
+    var children: [Child]
+  }
+
+  /// 根分组内容：落入订阅固定分组（固定分组身份客户端所有，不取自远端）。
+  let root: Group
+  var information = SubscriptionInformation()
+  var autoUpdatePolicy: SubscriptionUpdatePolicyResult = .absent
+}
+
+/// 快照解析失败（整份拒绝，不做部分提交； 刷新失败族）。
+enum SubscriptionParseError: Error, Equatable, Sendable {
+  /// 正文不是合法 JSON 或顶层结构与 SIP-008 不符。
+  case decodingFailure
+  /// `version` 缺失或不是本客户端支持的版本。
+  case unsupportedSchemaVersion
+  /// `servers` 缺失或不是数组。
+  case missingServers
+  /// 单条服务器记录校验失败（地址/端口/加密/密码/ID 形态）。
+  case recordValidation(index: Int, reason: String)
+  /// `servers[].id` 重复（身份不复用）。
+  case duplicateServerID(id: String)
+}
+
+/// SIP-008 v1 文档解析器。先按标准解析并校验根 `version` 与 `servers` 建立
+/// 扁平候选集，再尝试私有扩展建树；扩展任何无效都不影响标准列表（回退扁平）。
+enum SubscriptionDocumentParser {
+  static func parse(_ data: Data, subscriptionID: NodeID) throws -> SubscriptionSnapshot {
+    let root: RootDTO
+    do {
+      root = try JSONDecoder().decode(RootDTO.self, from: data)
+    } catch {
+      throw SubscriptionParseError.decodingFailure
+    }
+    guard root.version == 1 else { throw SubscriptionParseError.unsupportedSchemaVersion }
+    guard let serverDTOs = root.servers else { throw SubscriptionParseError.missingServers }
+
+    // 标准 `servers` 列表先独立解析为扁平候选集（保持数组顺序）。
+    var leaves: [KeyedLeaf] = []
+    var recordsByID: [String: RemoteServerRecord] = [:]
+    for (index, dto) in serverDTOs.enumerated() {
+      let record = try validatedRecord(dto, index: index)
+      let key = remoteKey(dto, record: record)
+      guard !leaves.contains(where: { $0.key == key }) else {
+        throw SubscriptionParseError.duplicateServerID(id: key)
+      }
+      let id = NodeID(rawValue: "\(subscriptionID.rawValue):\(key)")
+      leaves.append(KeyedLeaf(key: key, leaf: .init(id: id, record: record)))
+      recordsByID[key] = record
+    }
+
+    guard let tree = resolveExtension(root.extensionNS?.value, records: recordsByID) else {
+      return SubscriptionSnapshot(
+        root: SubscriptionSnapshot.Group(
+          id: NodeID(rawValue: "\(subscriptionID.rawValue):root"),
+          name: "", children: leaves.map { .server($0.leaf) }),
+        information: SubscriptionInformation.parse(data),
+        autoUpdatePolicy: root.extensionNS?.policy ?? .absent)
+    }
+    var snapshot = buildSnapshot(tree: tree, leaves: leaves, subscriptionID: subscriptionID)
+    snapshot.information = SubscriptionInformation.parse(data)
+    snapshot.autoUpdatePolicy = root.extensionNS?.policy ?? .absent
+    return snapshot
+  }
+
+  // MARK: - 服务器记录校验与身份
+
+  /// 带命名空间键的叶子：键优先为供应商稳定 ID（`id:<uuid>`）；无稳定 ID 的
+  /// 记录用地址端口指纹（`content:<sha256>`）。
+  private struct KeyedLeaf {
+    var key: String
+    var leaf: SubscriptionSnapshot.ServerLeaf
+  }
+
+  /// 单条记录校验：必填字段与取值范围；任一失败整份快照拒绝。
+  private static func validatedRecord(_ dto: ServerDTO, index: Int) throws -> RemoteServerRecord {
+    guard let address = dto.server, !address.isEmpty else {
+      throw SubscriptionParseError.recordValidation(index: index, reason: "server 缺失或为空")
+    }
+    guard let port = dto.serverPort, (1...65_535).contains(port) else {
+      throw SubscriptionParseError.recordValidation(
+        index: index, reason: "server_port 缺失或超出 1–65535")
+    }
+    guard let method = dto.method, !method.isEmpty else {
+      throw SubscriptionParseError.recordValidation(index: index, reason: "method 缺失或为空")
+    }
+    guard let password = dto.password, !password.isEmpty else {
+      throw SubscriptionParseError.recordValidation(index: index, reason: "password 缺失或为空")
+    }
+    if let id = dto.id, UUID(uuidString: id) == nil {
+      throw SubscriptionParseError.recordValidation(index: index, reason: "id 不是合法 UUID")
+    }
+    return RemoteServerRecord(
+      address: address,
+      port: port,
+      encryptionMethod: method,
+      password: password,
+      remark: dto.remarks ?? "",
+      pluginProgram: (dto.plugin?.isEmpty == false) ? dto.plugin : nil,
+      pluginOptions: dto.pluginOpts)
+  }
+
+  /// 记录的命名空间键：优先供应商稳定 ID；无 ID 时相同地址和端口延续身份。
+  private static func remoteKey(_ dto: ServerDTO, record: RemoteServerRecord) -> String {
+    if let id = dto.id { return "id:\(id)" }
+    return "content:\(endpointFingerprint(record))"
+  }
+
+  /// 无稳定 ID 记录的端点指纹：地址与端口长度前缀拼接后 SHA-256，避免拼接歧义。
+  /// 名称、密码、加密方式和插件不参与，远端更新这些值不改变身份。
+  private static func endpointFingerprint(_ record: RemoteServerRecord) -> String {
+    let parts = [record.address, String(record.port)]
+    let canonical = parts.map { "\($0.utf8.count):\($0)" }.joined(separator: "|")
+    let digest = SHA256.hash(data: Data(canonical.utf8))
+    return digest.map { String(format: "%02x", $0) }.joined()
+  }
+
+  // MARK: - 私有扩展
+
+  /// 扩展树解析结果；解析函数返回 `nil` 即扩展缺失/未知/无效 → 回退扁平列表。
+  private struct ExtensionTree {
+    var rootGroupID: String
+    var groups: [String: ExtensionGroup]
+  }
+
+  private struct ExtensionGroup {
+    var name: String
+    var children: [ExtensionChild]
+  }
+
+  private enum ExtensionChild {
+    case group(String)
+    case server(String)
+  }
+
+  /// 扩展校验：schema_version 支持、分组 ID 唯一且与服务器 ID 不冲突、根存在、
+  /// 子引用可解析、单父且无环。任一不满足即返回 `nil` 回退扁平（不抛错——
+  /// 私有字段损坏不能丢掉标准服务器；解析失败时回退到扁平列表。
+  private static func resolveExtension(
+    _ dto: ExtensionDTO?, records: [String: RemoteServerRecord]
+  ) -> ExtensionTree? {
+    guard let dto else { return nil }
+    guard dto.schemaVersion == 1 else { return nil }
+    guard let rootGroupID = dto.rootGroupID, !rootGroupID.isEmpty else { return nil }
+    guard let groupDTOs = dto.groups else { return nil }
+
+    var groups: [String: ExtensionGroup] = [:]
+    for groupDTO in groupDTOs {
+      guard let parsed = extensionGroup(from: groupDTO, existing: groups, records: records) else {
+        return nil
+      }
+      groups[parsed.id] = parsed.group
+    }
+    guard groups[rootGroupID] != nil else { return nil }
+    guard isSingleParentTree(rootedAt: rootGroupID, groups: groups, records: records) else {
+      return nil
+    }
+    return ExtensionTree(rootGroupID: rootGroupID, groups: groups)
+  }
+
+  /// 单个分组 DTO → 带唯一 ID 的分组；ID 缺失、与已有分组或服务器 ID 冲突、
+  /// 子引用类型未知即拒绝（分组 ID 与服务器 ID 在整个扩展文档内保持唯一，
+  /// 子引用类型未知时拒绝该扩展。
+  private static func extensionGroup(
+    from groupDTO: GroupDTO, existing: [String: ExtensionGroup],
+    records: [String: RemoteServerRecord]
+  ) -> (id: String, group: ExtensionGroup)? {
+    guard let id = groupDTO.id, !id.isEmpty else { return nil }
+    guard existing[id] == nil, records["id:\(id)"] == nil else { return nil }
+    var children: [ExtensionChild] = []
+    for childDTO in groupDTO.children ?? [] {
+      guard let childID = childDTO.id, !childID.isEmpty else { return nil }
+      switch childDTO.type {
+      case "group": children.append(.group(childID))
+      case "server": children.append(.server(childID))
+      default: return nil
+      }
+    }
+    return (id, ExtensionGroup(name: groupDTO.name ?? "", children: children))
+  }
+
+  /// 单父 + 无环：从根出发遍历，重复到达即共享父或环；服务器子引用复用
+  /// `servers[].id`，无稳定 ID 的记录没有可引用身份（作为「未引用」落根分组）。
+  private static func isSingleParentTree(
+    rootedAt rootGroupID: String,
+    groups: [String: ExtensionGroup],
+    records: [String: RemoteServerRecord]
+  ) -> Bool {
+    var visited = Set<String>()
+    func walk(_ groupID: String) -> Bool {
+      guard visited.insert(groupID).inserted else { return false }
+      guard let group = groups[groupID] else { return false }
+      for child in group.children {
+        switch child {
+        case .group(let id):
+          guard walk(id) else { return false }
+        case .server(let id):
+          guard records["id:\(id)"] != nil else { return false }
+        }
+      }
+      return true
+    }
+    return walk(rootGroupID)
+  }
+
+  // MARK: - 快照组装
+
+  private static func buildSnapshot(
+    tree: ExtensionTree, leaves: [KeyedLeaf], subscriptionID: NodeID
+  ) -> SubscriptionSnapshot {
+    let leavesByKey = Dictionary(
+      leaves.map { ($0.key, $0.leaf) }, uniquingKeysWith: { first, _ in first })
+    var root = buildGroup(
+      tree.groups[tree.rootGroupID]!, id: tree.rootGroupID, tree: tree,
+      leavesByKey: leavesByKey, subscriptionID: subscriptionID)
+    // 未被树引用的服务器仍在标准列表中：按 `servers` 数组顺序追加在根分组，
+    // 不丢弃未被树引用的服务器；身份不变，被引用后即可自然归位。
+    let referenced = collectReferencedServerKeys(tree)
+    for keyed in leaves where !referenced.contains(keyed.key) {
+      root.children.append(.server(keyed.leaf))
+    }
+    return SubscriptionSnapshot(root: root)
+  }
+
+  private static func buildGroup(
+    _ group: ExtensionGroup, id providerID: String, tree: ExtensionTree,
+    leavesByKey: [String: SubscriptionSnapshot.ServerLeaf], subscriptionID: NodeID
+  ) -> SubscriptionSnapshot.Group {
+    var children: [SubscriptionSnapshot.Child] = []
+    for child in group.children {
+      switch child {
+      case .group(let id):
+        guard let nested = tree.groups[id] else { continue }
+        children.append(
+          .group(
+            buildGroup(
+              nested, id: id, tree: tree, leavesByKey: leavesByKey,
+              subscriptionID: subscriptionID)))
+      case .server(let id):
+        if let leaf = leavesByKey["id:\(id)"] {
+          children.append(.server(leaf))
+        }
+      }
+    }
+    // 分组身份：供应商分组 ID 按订阅作用域限定；`g:` 前缀与服务器键形态区分。
+    let groupID = NodeID(rawValue: "\(subscriptionID.rawValue):g:\(providerID)")
+    return SubscriptionSnapshot.Group(id: groupID, name: group.name, children: children)
+  }
+
+  private static func collectReferencedServerKeys(_ tree: ExtensionTree) -> Set<String> {
+    var referenced = Set<String>()
+    for group in tree.groups.values {
+      for child in group.children {
+        if case .server(let id) = child {
+          referenced.insert("id:\(id)")
+        }
+      }
+    }
+    return referenced
+  }
+}
+
+// MARK: - SIP-008 DTO（全部字段宽松可选，严格校验在解析器内逐条点名）
+
+private struct RootDTO: Decodable {
+  var version: Int?
+  var servers: [ServerDTO]?
+  /// 扩展字段形状损坏（不是对象）不构成 SIP-008 失败：宽松解码为 nil 后
+  /// 走「扩展无效 → 回退扁平」。
+  var extensionNS: LenientExtension?
+
+  enum CodingKeys: String, CodingKey {
+    case version, servers
+    case extensionNS = "x_shadowsocksx_ng"
+  }
+}
+
+private struct ServerDTO: Decodable {
+  var id: String?
+  var remarks: String?
+  var server: String?
+  var serverPort: Int?
+  var password: String?
+  var method: String?
+  var plugin: String?
+  var pluginOpts: String?
+
+  enum CodingKeys: String, CodingKey {
+    case id, remarks, server, password, method, plugin
+    case serverPort = "server_port"
+    case pluginOpts = "plugin_opts"
+  }
+}
+
+private struct LenientExtension: Decodable {
+  var value: ExtensionDTO?
+  var policy: SubscriptionUpdatePolicyResult = .invalid
+
+  enum CodingKeys: String, CodingKey {
+    case schemaVersion = "schema_version"
+    case autoUpdate = "auto_update"
+  }
+
+  init(from decoder: Decoder) throws {
+    value = try? ExtensionDTO(from: decoder)
+    guard let container = try? decoder.container(keyedBy: CodingKeys.self),
+      (try? container.decode(Int.self, forKey: .schemaVersion)) == 1
+    else { return }
+    guard container.contains(.autoUpdate) else {
+      policy = .absent
+      return
+    }
+    if let parsed = try? container.decode(SubscriptionUpdatePolicy.self, forKey: .autoUpdate) {
+      policy = .valid(parsed)
+    }
+  }
+}
+
+private struct ExtensionDTO: Decodable {
+  var schemaVersion: Int?
+  var rootGroupID: String?
+  var groups: [GroupDTO]?
+
+  enum CodingKeys: String, CodingKey {
+    case schemaVersion = "schema_version"
+    case rootGroupID = "root_group_id"
+    case groups
+  }
+}
+
+private struct GroupDTO: Decodable {
+  var id: String?
+  var name: String?
+  var children: [ChildDTO]?
+}
+
+private struct ChildDTO: Decodable {
+  var type: String?
+  var id: String?
+}
diff --git a/ShadowsocksX-NG2/Domain/Subscription/SubscriptionFetch.swift b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionFetch.swift
new file mode 100644
index 000000000..253a3e2dd
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionFetch.swift
@@ -0,0 +1,124 @@
+import Foundation
+
+/// 订阅获取缝：HTTPS 强制、TLS/证书校验不放松、Content-Type
+/// 与状态码按 SIP-008 契约检查。测试注入夹具，生产走 URLSession 实现。
+protocol SubscriptionFetching: Sendable {
+  func fetch(_ url: URL) async throws -> Data
+}
+
+/// 获取失败点名原因。任何细节都不携带订阅 URL（完整 URL 与 token 永不
+/// 进入错误文案、日志与诊断）。
+enum SubscriptionFetchError: Error, Equatable, Sendable {
+  /// URL 无法构造或没有主机。
+  case invalidURL
+  /// 非 HTTPS 地址；宽松模式不受支持。
+  case unsupportedScheme
+  /// 重定向目标不是 HTTPS（降级一律拒绝）。
+  case insecureRedirect
+  /// 连接/TLS 握手失败等传输层错误（默认证书校验失败也在此呈现）。
+  case transport(detail: String)
+  /// HTTP 状态码非 200。
+  case httpStatus(code: Int)
+  /// Content-Type 不是 `application/json; charset=utf-8`（大小写与空白不敏感）。
+  case contentType(received: String?)
+}
+
+/// URLSession 实现：重定向守卫只放行 https→https；TLS 校验用系统默认行为
+/// （从不实现证书忽略）。响应契约校验抽为纯函数便于夹具测试。
+struct HTTPSSubscriptionFetcher: SubscriptionFetching {
+  /// 单次请求超时（秒）。
+  var timeoutInterval: TimeInterval = 15
+
+  private static let requiredContentType = "application/json;charset=utf-8"
+
+  func fetch(_ url: URL) async throws -> Data {
+    guard url.scheme?.lowercased() == "https" else {
+      throw SubscriptionFetchError.unsupportedScheme
+    }
+    guard url.host != nil else { throw SubscriptionFetchError.invalidURL }
+
+    var request = URLRequest(url: url)
+    request.timeoutInterval = timeoutInterval
+    // 守卫是任务级 delegate：只拦截非 HTTPS 降级重定向，不触碰 TLS 校验链路。
+    let redirectGuard = RedirectGuard()
+    let data: Data
+    let response: URLResponse
+    do {
+      (data, response) = try await Self.session.data(for: request, delegate: redirectGuard)
+    } catch is CancellationError {
+      throw CancellationError()
+    } catch {
+      throw SubscriptionFetchError.transport(detail: Self.redactedTransportDetail(error))
+    }
+    if redirectGuard.didBlockInsecureRedirect {
+      throw SubscriptionFetchError.insecureRedirect
+    }
+    guard let http = response as? HTTPURLResponse else {
+      throw SubscriptionFetchError.transport(detail: "nonHTTPResponse")
+    }
+    try Self.validate(
+      statusCode: http.statusCode,
+      contentType: http.value(forHTTPHeaderField: "Content-Type"))
+    return data
+  }
+
+  /// 响应契约（纯函数）：200 + `application/json; charset=utf-8`。
+  static func validate(statusCode: Int, contentType: String?) throws {
+    guard statusCode == 200 else { throw SubscriptionFetchError.httpStatus(code: statusCode) }
+    let normalized = (contentType ?? "").lowercased().filter { !$0.isWhitespace }
+    guard normalized == requiredContentType else {
+      throw SubscriptionFetchError.contentType(received: contentType)
+    }
+  }
+
+  /// 重定向放行策略（纯函数）：仅 https → https。
+  static func allowsRedirect(to scheme: String?) -> Bool {
+    scheme?.lowercased() == "https"
+  }
+
+  /// 传输错误脱敏描述：URLError 只取错误码符号名；其余只取类型名。两者都
+  /// 不携带 URL 或主机。
+  static func redactedTransportDetail(_ error: Error) -> String {
+    if let urlError = error as? URLError {
+      return "URLError.\(String(describing: urlError.code))"
+    }
+    return String(describing: type(of: error))
+  }
+
+  /// 共享会话（无会话级 delegate）。
+  private static let session: URLSession = {
+    let configuration = URLSessionConfiguration.ephemeral
+    configuration.timeoutIntervalForRequest = 15
+    return URLSession(configuration: configuration)
+  }()
+}
+
+/// 重定向守卫：跟随 https→https；降级到非 HTTPS 时拒绝并标记，请求随后以
+/// 3xx 原样响应或取消收场，由调用方按标记点名 `insecureRedirect`。
+private final class RedirectGuard: NSObject, URLSessionTaskDelegate, @unchecked Sendable {
+  private let lock = NSLock()
+  private var blocked = false
+
+  func urlSession(
+    _ session: URLSession,
+    task: URLSessionTask,
+    willPerformHTTPRedirection response: HTTPURLResponse,
+    newRequest request: URLRequest,
+    completionHandler: @escaping (URLRequest?) -> Void
+  ) {
+    guard HTTPSSubscriptionFetcher.allowsRedirect(to: request.url?.scheme) else {
+      lock.lock()
+      blocked = true
+      lock.unlock()
+      completionHandler(nil)
+      return
+    }
+    completionHandler(request)
+  }
+
+  var didBlockInsecureRedirect: Bool {
+    lock.lock()
+    defer { lock.unlock() }
+    return blocked
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/Subscription/SubscriptionInformation.swift b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionInformation.swift
new file mode 100644
index 000000000..3eb679b02
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionInformation.swift
@@ -0,0 +1,155 @@
+import Foundation
+
+/// 白名单订阅资料，不含服务器连接字段、凭据或原始响应。
+struct SubscriptionInformation: Codable, Equatable, Sendable {
+  var bytesUsed: UInt64?
+  var bytesRemaining: UInt64?
+  var expiresAt: Date?
+  var trafficResetAt: Date?
+
+  var isEmpty: Bool {
+    bytesUsed == nil && bytesRemaining == nil && expiresAt == nil && trafficResetAt == nil
+  }
+
+  /// 与服务器及分组扩展的解码分别处理；无效附加资料只影响该项。
+  static func parse(_ data: Data) -> Self {
+    let root = objectFields(data, names: ["bytes_used", "bytes_remaining", "x_shadowsocksx_ng"])
+    let extensionFields = objectFields(
+      root["x_shadowsocksx_ng"] ?? Data(),
+      names: ["schema_version", "expires_at", "traffic_reset_at"])
+    let schemaVersion = extensionFields["schema_version"].flatMap {
+      try? JSONDecoder().decode(Int.self, from: $0)
+    }
+    return Self(
+      bytesUsed: byteCount(root["bytes_used"]),
+      bytesRemaining: byteCount(root["bytes_remaining"]),
+      expiresAt: schemaVersion == 1 ? date(extensionFields["expires_at"]) : nil,
+      trafficResetAt: schemaVersion == 1 ? date(extensionFields["traffic_reset_at"]) : nil)
+  }
+
+  private static func byteCount(_ value: Data?) -> UInt64? {
+    guard let value, let raw = String(bytes: value, encoding: .utf8) else { return nil }
+    let text = raw.trimmingCharacters(in: .whitespacesAndNewlines)
+    guard !text.isEmpty, text.utf8.allSatisfy({ (48...57).contains($0) }) else { return nil }
+    return UInt64(text)
+  }
+
+  private static func date(_ value: Data?) -> Date? {
+    guard let value, let text = try? JSONDecoder().decode(String.self, from: value) else {
+      return nil
+    }
+    let normalized = text.uppercased()
+    let pattern =
+      #"\A[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T"#
+      + #"([01][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)(\.[0-9]+)?"#
+      + #"(Z|[+-]([01][0-9]|2[0-3]):[0-5][0-9])\z"#
+    guard normalized.range(of: pattern, options: .regularExpression) != nil else { return nil }
+    // RFC 3339 的偏移可达 23:59，超出 Foundation 时区解析器的 18 小时范围。
+    // 先解析原地时间，再应用数值偏移；不创建会失败的 TimeZone。
+    let localText = normalized.hasSuffix("Z") ? normalized : String(normalized.dropLast(6)) + "Z"
+    guard
+      let local = try? Date.ISO8601FormatStyle(
+        includingFractionalSeconds: normalized.contains(".")
+      ).parse(localText)
+    else { return nil }
+    let parsed = local.addingTimeInterval(-Double(offsetSeconds(normalized)))
+    // Foundation 会把 2 月 30 日等无效日期向后归一化；按原偏移回读以拒绝这些值。
+    let parts = normalized.prefix(19).split(whereSeparator: { "-T:".contains($0) }).compactMap {
+      Int($0)
+    }
+    var calendar = Calendar(identifier: .gregorian)
+    calendar.timeZone = .gmt
+    let isLeapSecond = parts[5] == 60
+    let checked = isLeapSecond ? local.addingTimeInterval(-1) : local
+    let fields: Set<Calendar.Component> = [.year, .month, .day, .hour, .minute, .second]
+    let components = calendar.dateComponents(fields, from: checked)
+    guard components.year == parts[0], components.month == parts[1],
+      components.day == parts[2], components.hour == parts[3], components.minute == parts[4],
+      components.second == (isLeapSecond ? 59 : parts[5])
+    else { return nil }
+    if isLeapSecond {
+      let utc = calendar.dateComponents(fields, from: parsed.addingTimeInterval(-1))
+      guard utc.hour == 23, utc.minute == 59,
+        (utc.month == 6 && utc.day == 30) || (utc.month == 12 && utc.day == 31)
+      else { return nil }
+    }
+    return parsed
+  }
+
+  private static func offsetSeconds(_ text: String) -> Int {
+    guard !text.hasSuffix("Z") else { return 0 }
+    let offset = text.suffix(6)
+    let hours = Int(offset.dropFirst().prefix(2))!
+    let minutes = Int(offset.suffix(2))!
+    return (hours * 60 + minutes) * 60 * (offset.first == "-" ? -1 : 1)
+  }
+  /// JSON 结构已由订阅文档解析器校验。这里只切出对象直接成员中白名单值的原始片段，
+  /// 不把整个正文转换成 Any；某项超大数字因此不会损坏其他项的解码。
+  private static func objectFields(_ data: Data, names: Set<String>) -> [String: Data] {
+    let bytes = Array(data)
+    var result: [String: Data] = [:]
+    // 与现有 JSONDecoder 一致，接受可选的 UTF-8 BOM。
+    var cursor = bytes.starts(with: [0xEF, 0xBB, 0xBF]) ? 3 : 0
+    skipWhitespace(bytes, cursor: &cursor)
+    guard cursor < bytes.count, bytes[cursor] == 123 else { return result }
+    cursor += 1
+    while cursor < bytes.count {
+      skipWhitespace(bytes, cursor: &cursor)
+      guard cursor < bytes.count, bytes[cursor] == 34 else { break }
+      let keyStart = cursor
+      skipString(bytes, cursor: &cursor)
+      let key = try? JSONDecoder().decode(String.self, from: Data(bytes[keyStart..<cursor]))
+      skipWhitespace(bytes, cursor: &cursor)
+      guard cursor < bytes.count, bytes[cursor] == 58 else { break }
+      cursor += 1
+      let valueStart = cursor
+      skipValue(bytes, cursor: &cursor)
+      if let key, names.contains(key) {
+        result[key] = Data(bytes[valueStart..<cursor])
+      }
+      guard cursor < bytes.count, bytes[cursor] == 44 else { break }
+      cursor += 1
+    }
+    return result
+  }
+
+  private static func skipValue(_ bytes: [UInt8], cursor: inout Int) {
+    var depth = 0
+    while cursor < bytes.count {
+      switch bytes[cursor] {
+      case 34:
+        skipString(bytes, cursor: &cursor)
+        continue
+      case 123, 91:
+        depth += 1
+      case 125, 93:
+        guard depth > 0 else { return }
+        depth -= 1
+      case 44:
+        if depth == 0 { return }
+      default:
+        break
+      }
+      cursor += 1
+    }
+  }
+
+  private static func skipWhitespace(_ bytes: [UInt8], cursor: inout Int) {
+    while cursor < bytes.count, [9, 10, 13, 32].contains(bytes[cursor]) { cursor += 1 }
+  }
+
+  private static func skipString(_ bytes: [UInt8], cursor: inout Int) {
+    cursor += 1
+    while cursor < bytes.count {
+      if bytes[cursor] == 92 {
+        cursor = min(cursor + 2, bytes.count)
+      } else if bytes[cursor] == 34 {
+        cursor += 1
+        return
+      } else {
+        cursor += 1
+      }
+    }
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Domain/Subscription/SubscriptionRecord.swift b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionRecord.swift
new file mode 100644
index 000000000..92ecfad3d
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionRecord.swift
@@ -0,0 +1,79 @@
+import Foundation
+
+/// 订阅源记录：持久不透明的订阅 UUID + 固定分组
+/// 身份 + 订阅 URL + 最近刷新状态。URL 随服务器库整体加密；
+/// 编辑 URL 保留订阅与固定分组身份。
+struct SubscriptionRecord: Codable, Equatable, Sendable, Identifiable {
+  /// 订阅源身份；删除后新建即新身份（GLOSSARY.md「Subscription」）。
+  let id: NodeID
+  /// 固定订阅分组的稳定身份（客户端所有，跨刷新与 URL 编辑不变）。
+  let groupID: NodeID
+  var url: String
+  var status: SubscriptionRefreshStatus
+  /// 最近成功提交的白名单资料；成功响应省略时清除，失败或取消保留。
+  var information: SubscriptionInformation?
+  /// 独立于最近尝试状态，旧文件缺失时不猜测。
+  var lastSucceededAt: Date?
+  /// Optional envelope keeps existing encrypted documents compatible and disabled.
+  var autoUpdateState: SubscriptionAutoUpdate?
+
+  var autoUpdate: SubscriptionAutoUpdate {
+    get { autoUpdateState ?? SubscriptionAutoUpdate() }
+    set { autoUpdateState = newValue }
+  }
+}
+
+/// 最近一次刷新结果。失败只保存白名单事实，不保存订阅 URL、秘密、凭据引用
+/// 或任意错误 description（均需脱敏）。
+enum SubscriptionRefreshStatus: Codable, Equatable, Sendable {
+  case never
+  // swiftlint:disable:next identifier_name
+  case succeeded(at: Date)
+  // swiftlint:disable:next identifier_name
+  case failed(at: Date, failure: SubscriptionRefreshFailure)
+
+}
+
+/// 配置目录持久化文档：结构树、订阅源记录与有序收藏一次原子落盘，
+/// 保证「订阅记录 ↔ 固定分组子树」跨文档一致。
+struct CatalogDocument: Equatable, Sendable {
+  var catalog: ConfigurationCatalog
+  var subscriptions: [SubscriptionRecord]
+  var favoriteIDs: [NodeID]
+
+  init(
+    catalog: ConfigurationCatalog = ConfigurationCatalog(),
+    subscriptions: [SubscriptionRecord] = [],
+    favoriteIDs: [NodeID] = []
+  ) {
+    self.catalog = catalog
+    self.subscriptions = subscriptions
+    self.favoriteIDs = favoriteIDs
+  }
+}
+
+/// 已解析为目录形态的订阅快照：身份已按订阅作用域限定，记录携带凭据值。
+/// `root` 是固定分组的内容来源；固定分组自身身份由应用入口的 `groupID`
+/// 决定（客户端所有），`root.id` 不参与挂载。
+struct CatalogSubscriptionSnapshot: Equatable, Sendable {
+  struct ServerLeaf: Equatable, Sendable {
+    let id: NodeID
+    var fields: ServerFields
+  }
+
+  /// 有序子引用：顺序即快照（远端权威）的用户可见顺序。
+  enum Child: Equatable, Sendable {
+    case group(Group)
+    case server(ServerLeaf)
+  }
+
+  struct Group: Equatable, Sendable {
+    let id: NodeID
+    let name: String
+    var children: [Child]
+  }
+
+  /// 固定分组显示名：远端根分组名，扩展缺失时为 URL host。
+  let name: String
+  let root: Group
+}
diff --git a/ShadowsocksX-NG2/Domain/Subscription/SubscriptionRefreshFailure.swift b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionRefreshFailure.swift
new file mode 100644
index 000000000..f0fb26bf5
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/Subscription/SubscriptionRefreshFailure.swift
@@ -0,0 +1,96 @@
+import Foundation
+
+/// 持久化的订阅失败白名单，不携带 URL、秘密或任意平台错误描述。
+enum SubscriptionRefreshFailure: Error, Codable, Equatable, Sendable {
+  enum TransportCategory: String, Codable, Equatable, Sendable {
+    case timedOut, tls, connection, unknown
+  }
+  enum ContentTypeCategory: String, Codable, Equatable, Sendable {
+    case missing, unsupported
+  }
+  enum RecordField: String, Codable, Equatable, Sendable {
+    case address, port, method, password, identity
+  }
+  case invalidURL
+  case unsupportedScheme
+  case insecureRedirect
+  case transport(TransportCategory)
+  case httpStatus(code: Int)
+  case contentType(ContentTypeCategory)
+  case decodingFailure
+  case unsupportedSchemaVersion
+  case missingServers
+  case recordValidation(index: Int, field: RecordField)
+  case duplicateIdentity
+  case commit
+  case unknown
+}
+
+extension SubscriptionRefreshFailure {
+  /// The only conversion point for transport failures entering durable state.
+  static func from(fetchError: SubscriptionFetchError) -> Self {
+    switch fetchError {
+    case .invalidURL:
+      .invalidURL
+    case .unsupportedScheme:
+      .unsupportedScheme
+    case .insecureRedirect:
+      .insecureRedirect
+    case .transport(let detail):
+      .transport(transportCategory(for: detail))
+    case .httpStatus(let code):
+      .httpStatus(code: code)
+    case .contentType(let received):
+      .contentType(received == nil ? .missing : .unsupported)
+    }
+  }
+
+  /// The only conversion point for parser failures entering durable state.
+  static func from(parseError: SubscriptionParseError) -> Self {
+    switch parseError {
+    case .decodingFailure:
+      .decodingFailure
+    case .unsupportedSchemaVersion:
+      .unsupportedSchemaVersion
+    case .missingServers:
+      .missingServers
+    case .recordValidation(let index, let reason):
+      .recordValidation(index: index, field: recordField(for: reason))
+    case .duplicateServerID:
+      .duplicateIdentity
+    }
+  }
+
+  private static func transportCategory(for detail: String) -> TransportCategory {
+    let normalized = detail.lowercased()
+    if normalized.contains("timedout") || normalized.contains("timeout") {
+      return .timedOut
+    }
+    if normalized.contains("tls") || normalized.contains("secure") {
+      return .tls
+    }
+    if normalized.contains("connection") || normalized.contains("network")
+      || normalized.contains("cannotconnect")
+    {
+      return .connection
+    }
+    return .unknown
+  }
+
+  private static func recordField(for reason: String) -> RecordField {
+    switch reason {
+    case let value where value.contains("server_port"):
+      .port
+    case let value where value.contains("server"):
+      .address
+    case let value where value.contains("method"):
+      .method
+    case let value where value.contains("password"):
+      .password
+    case let value where value.contains("id"):
+      .identity
+    default:
+      .identity
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyConfiguration.swift b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyConfiguration.swift
new file mode 100644
index 000000000..67daf6eb2
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyConfiguration.swift
@@ -0,0 +1,29 @@
+import Foundation
+
+/// GUI 准备、特权 helper 机械执行的 closed typed 系统代理配置。
+/// 完整闭合：SOCKS/HTTP/HTTPS 的启停与端点、PAC、自动发现、简单主机名排除
+/// 与完整例外列表全部显式给出；helper 不补默认值、不从 HTTP 推断 HTTPS、
+/// 不把缺省解释为「保留旧值」。Codable 使其可跨 XPC 以 payload 传输。
+/// 成员逐一内联默认值：GUI 策略恒为三协议族全开、PAC/自动发现关闭、
+/// 简单主机名排除开启——合成 memberwise init 自带这些默认参数。
+struct SystemProxyConfiguration: Codable, Equatable, Sendable {
+  /// 一个系统代理协议族指向的本地端点。
+  struct Endpoint: Codable, Equatable, Sendable {
+    let host: String
+    let port: Int
+  }
+
+  var socksEnabled = true
+  var socks: Endpoint
+  var httpEnabled = true
+  var http: Endpoint
+  /// HTTPS 系统代理由 GUI 显式赋值（当前实现与 HTTP 入站共用端点），
+  /// helper 只翻译不推断。
+  var httpsEnabled = true
+  var https: Endpoint
+  var pacEnabled = false
+  var autoDiscoveryEnabled = false
+  var excludeSimpleHostnames = true
+  /// 完整例外列表：每次 apply 全量覆盖，空列表也是显式值。
+  var exceptions: [String]
+}
diff --git a/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperContract.swift b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperContract.swift
new file mode 100644
index 000000000..fcbccc12b
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperContract.swift
@@ -0,0 +1,75 @@
+import Foundation
+
+/// GUI 与特权系统代理 helper 的共享 XPC 契约。类型同时编入 GUI、
+/// helper 与测试 target；payload 以 JSON 编码保持 closed typed 语义。
+@objc protocol SystemProxyHelperControlling {
+  /// 应用 closed typed 配置到活动网络位置的每个服务。
+  func apply(_ payload: Data, withReply reply: @escaping (Data) -> Void)
+  /// 无条件清除全部网络位置全部服务的完整 Proxies 字典。
+  func clear(withReply reply: @escaping (Data) -> Void)
+}
+
+/// helper 的固定身份：MachService 名、LaunchDaemon plist 名与客户端校验基准。
+/// 客户端只按 2.0 的 bundle identifier（代码签名 identifier）接受，不限
+/// Team ID 或账号。
+enum SystemProxyHelperIdentity {
+  static let machServiceName = "com.qiuyuzhou.ShadowsocksX-NG2.systemproxy"
+  static let plistName = "com.qiuyuzhou.ShadowsocksX-NG2.systemproxy.plist"
+  static let launchdLabel = "com.qiuyuzhou.ShadowsocksX-NG2.systemproxy"
+  static let clientCodeSigningIdentifier = "com.qiuyuzhou.ShadowsocksX-NG2"
+
+  /// App bundle 内 LaunchDaemon 清单内容（注册漂移指纹的基准）。helper 进程
+  /// 内没有 bundle，返回 nil，调用方按「无基准不动作」处理。Contents/Library
+  /// 不是资源目录，Bundle 资源 API 搜不到，按固定路径直读。bundle 参数生产
+  /// 默认 Bundle.main；去宿主化（ADR 0021）后单测经控制器的 appBundle 缝注入
+  /// 构建产物 bundle。
+  static func launchDaemonPlistData(in bundle: Bundle = .main) -> Data? {
+    let url = bundle.bundleURL
+      .appendingPathComponent("Contents/Library/LaunchDaemons")
+      .appendingPathComponent(plistName)
+    return try? Data(contentsOf: url)
+  }
+}
+
+/// helper XPC 应答：成功携带 typed 结果，失败携带 typed 错误族。
+enum SystemProxyHelperResponse: Equatable, Sendable, Codable {
+  case applied(SystemProxyWriteOutcome)
+  case cleared
+  case failure(SystemProxyError)
+}
+
+enum SystemProxyHelperWireError: Error, Equatable, Sendable {
+  case undecodableResponse(String)
+}
+
+enum SystemProxyHelperWire {
+  /// SystemProxyHelperResponse 全部由简单可编码类型组成，JSON 编码不可失败；
+  /// 若未来加入不可编码载荷，显式失败好过发出无法解码的应答。
+  static func encode(_ response: SystemProxyHelperResponse) -> Data {
+    do {
+      return try JSONEncoder().encode(response)
+    } catch {
+      preconditionFailure("system proxy helper response encode failed: \(error)")
+    }
+  }
+
+  static func decode(_ payload: Data) throws -> SystemProxyHelperResponse {
+    do {
+      return try JSONDecoder().decode(SystemProxyHelperResponse.self, from: payload)
+    } catch {
+      throw SystemProxyHelperWireError.undecodableResponse(String(describing: error))
+    }
+  }
+
+  static func encodeConfiguration(_ configuration: SystemProxyConfiguration) throws -> Data {
+    try JSONEncoder().encode(configuration)
+  }
+
+  static func decodeConfiguration(_ payload: Data) throws -> SystemProxyConfiguration {
+    do {
+      return try JSONDecoder().decode(SystemProxyConfiguration.self, from: payload)
+    } catch {
+      throw SystemProxyError.invalidRequest(String(describing: error))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperEngine.swift b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperEngine.swift
new file mode 100644
index 000000000..2acc4becd
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperEngine.swift
@@ -0,0 +1,105 @@
+import Foundation
+
+/// 特权 helper 的请求引擎：解码 closed typed 请求 → 注入的特权
+/// 写入器 → 编码应答。引擎本身不含任何产品策略，只在 payload 无效时拒绝。
+/// 所有连接共享一条串行队列：请求逐个执行，最后接受的请求决定设备级配置
+/// （last-writer-wins）。
+final class SystemProxyHelperEngine: NSObject, SystemProxyHelperControlling {
+  /// 注入的特权写入器：真正触到 SystemConfiguration 的唯一边界。
+  typealias Performing =
+    @Sendable (SystemProxyHelperEngine.Request) throws ->
+    SystemProxyHelperEngine.Outcome
+
+  enum Request: Equatable, Sendable {
+    case apply(SystemProxyConfiguration)
+    case clear
+  }
+
+  enum Outcome: Equatable, Sendable {
+    case applied(SystemProxyWriteOutcome)
+    case cleared
+  }
+
+  /// 跨全部 XPC 连接共享的串行执行队列。
+  private static let sharedQueue = DispatchQueue(
+    label: "\(SystemProxyHelperIdentity.machServiceName).work")
+
+  private let queue: DispatchQueue
+  private let perform: Performing
+  private let log: @Sendable (SystemProxyHelperLogEvent) -> Void
+
+  /// `log` 是事件发射缝（ADR-0047）：生产直通统一日志，测试注入替身
+  /// 断言发射内容；默认参数不改变既有测试装配。
+  init(
+    perform: @escaping Performing,
+    queue: DispatchQueue? = nil,
+    log: @escaping @Sendable (SystemProxyHelperLogEvent) -> Void = SystemProxyHelperLog.emit
+  ) {
+    self.perform = perform
+    self.queue = queue ?? Self.sharedQueue
+    self.log = log
+    super.init()
+  }
+
+  func apply(_ payload: Data, withReply reply: @escaping (Data) -> Void) {
+    let reply = ReplyBox(reply)
+    queue.async { [perform, reply, log] in
+      let request = Result { try SystemProxyHelperWire.decodeConfiguration(payload) }
+      reply(
+        Self.loggedResponseData(request: request.map { .apply($0) }, perform: perform, log: log))
+    }
+  }
+
+  func clear(withReply reply: @escaping (Data) -> Void) {
+    let reply = ReplyBox(reply)
+    queue.async { [perform, reply, log] in
+      reply(Self.loggedResponseData(request: .success(.clear), perform: perform, log: log))
+    }
+  }
+
+  // MARK: - 请求执行（纯逻辑，可测）
+
+  static func response(
+    request: Result<Request, Error>, perform: Performing
+  ) -> SystemProxyHelperResponse {
+    do {
+      let outcome = try perform(request.get())
+      switch outcome {
+      case .applied(let writeOutcome):
+        return .applied(writeOutcome)
+      case .cleared:
+        return .cleared
+      }
+    } catch let error as SystemProxyError {
+      return .failure(error)
+    } catch {
+      return .failure(.helperUnavailable(String(describing: error)))
+    }
+  }
+
+  /// 执行请求、按应答发射一条执行结果事件并编码应答——日志与应答同源，
+  /// 不可能记下与回传不一致的结果。
+  private static func loggedResponseData(
+    request: Result<Request, Error>, perform: Performing,
+    log: @Sendable (SystemProxyHelperLogEvent) -> Void
+  ) -> Data {
+    let response = self.response(request: request, perform: perform)
+    log(SystemProxyHelperLogEvent(response: response))
+    return SystemProxyHelperWire.encode(response)
+  }
+}
+
+/// XPC 应答闭包的 Sendable 桥。@objc 协议里 reply 参数无法标注 @Sendable，
+/// 但 XPC 运行时生成的应答块线程安全且恰好调用一次，引擎在串行工作队列上
+/// 调用它；装箱只为跨过 queue.async 的 @Sendable 边界。
+private final class ReplyBox: @unchecked Sendable {
+  private let reply: (Data) -> Void
+
+  init(_ reply: @escaping (Data) -> Void) {
+    self.reply = reply
+  }
+
+  func callAsFunction(_ data: Data) {
+    reply(data)
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperListenerDelegate.swift b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperListenerDelegate.swift
new file mode 100644
index 000000000..d6a4dac50
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperListenerDelegate.swift
@@ -0,0 +1,66 @@
+import Foundation
+import Security
+
+/// XPC 监听代理：只接受代码签名 identifier 等于 2.0 bundle
+/// identifier 的客户端（开源构建换签名团队、其他账号的 2.0 实例均可），
+/// 不校验 Team ID 或 UID。校验基于连接对端 pid 的 SecCode 查询。
+final class SystemProxyHelperListenerDelegate: NSObject, NSXPCListenerDelegate {
+  private let engine: SystemProxyHelperEngine
+  private let expectedClientIdentifier: String
+  private let log: @Sendable (SystemProxyHelperLogEvent) -> Void
+
+  /// 引擎由进程入口显式注入：特权写入器 SystemProxyWriter 属 helper 专属
+  /// （不进共享编译单元），测试注入假写入器。期望客户端身份生产默认为 2.0
+  /// bundle identifier；去宿主化（ADR 0021）后单测运行于 xctest runner，
+  /// 连接方身份随宿主改变，测试注入本进程实际签名 identifier。`log` 是
+  /// 事件发射缝（ADR-0047）：连接接受/拒绝各记一条。
+  init(
+    engine: SystemProxyHelperEngine,
+    expectedClientIdentifier: String = SystemProxyHelperIdentity.clientCodeSigningIdentifier,
+    log: @escaping @Sendable (SystemProxyHelperLogEvent) -> Void = SystemProxyHelperLog.emit
+  ) {
+    self.engine = engine
+    self.expectedClientIdentifier = expectedClientIdentifier
+    self.log = log
+    super.init()
+  }
+
+  func listener(
+    _ listener: NSXPCListener,
+    shouldAcceptNewConnection newConnection: NSXPCConnection
+  ) -> Bool {
+    guard
+      SystemProxyClientValidator.clientSigningIdentifier(newConnection)
+        == expectedClientIdentifier
+    else {
+      log(.connectionRejected(pid: newConnection.processIdentifier))
+      return false
+    }
+    log(.connectionAccepted(pid: newConnection.processIdentifier))
+    newConnection.exportedInterface = NSXPCInterface(with: SystemProxyHelperControlling.self)
+    newConnection.exportedObject = engine
+    newConnection.resume()
+    return true
+  }
+}
+
+/// 客户端代码签名校验。pid 查询与连接建立之间存在理论上的 pid 复用窗口；
+/// 连接本身由内核绑定到建立时的进程，这里采用 SecCode 惯用做法。
+enum SystemProxyClientValidator {
+  static func clientSigningIdentifier(_ connection: NSXPCConnection) -> String? {
+    var code: SecCode?
+    let attributes =
+      [kSecGuestAttributePid: NSNumber(value: connection.processIdentifier)] as CFDictionary
+    guard SecCodeCopyGuestWithAttributes(nil, attributes, [], &code) == errSecSuccess,
+      let code
+    else { return nil }
+    var staticCode: SecStaticCode?
+    guard SecCodeCopyStaticCode(code, [], &staticCode) == errSecSuccess, let staticCode
+    else { return nil }
+    var information: CFDictionary?
+    guard SecCodeCopySigningInformation(staticCode, SecCSFlags(), &information) == errSecSuccess,
+      let information
+    else { return nil }
+    return (information as NSDictionary)[kSecCodeInfoIdentifier] as? String
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperLog.swift b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperLog.swift
new file mode 100644
index 000000000..c25376297
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyHelperLog.swift
@@ -0,0 +1,116 @@
+import Foundation
+import os
+
+/// 特权系统代理 helper 的封闭事件枚举：helper 侧的执行事实只进
+/// 统一日志（Console.app 按 subsystem 查看），无文件面——不写 stderr、
+/// 不进 agent.log、诊断日志视图与诊断报告（ADR-0006 不新增披露面）。
+/// 事件面是生命周期最小集：拉起就绪、连接接受/拒绝与每个请求的 typed
+/// 结果；不记 payload 内容（例外列表等）。GUI 侧 XPC 结果转述照旧，root
+/// 侧事件与之在 Console 按同一 subsystem 相邻对照（ADR-0047）。
+enum SystemProxyHelperLogEvent: Equatable, Sendable, CustomStringConvertible {
+  /// helper 进程已拉起并开始监听（launchd on-demand 激活的唯一痕迹）。
+  case listenerReady
+  /// 已接受签名标识合规的客户端连接（对端 pid 为本机事实字段）。
+  case connectionAccepted(pid: Int32)
+  /// 拒绝签名标识不符的客户端连接（谁在敲门的唯一痕迹）。
+  case connectionRejected(pid: Int32)
+  /// apply 请求成功（written/unchanged 由 typed 结果给出）。
+  case applyCompleted(SystemProxyWriteOutcome)
+  /// clear 请求成功。
+  case clearCompleted
+  /// 请求失败（typed 错误族；自由 detail 段发射时标 private）。
+  case requestFailed(SystemProxyError)
+
+  /// 从 XPC 应答派生执行结果事件；引擎把解码失败与执行异常都归入
+  /// typed 失败应答，这里不区分来源。
+  init(response: SystemProxyHelperResponse) {
+    switch response {
+    case .applied(let outcome): self = .applyCompleted(outcome)
+    case .cleared: self = .clearCompleted
+    case .failure(let error): self = .requestFailed(error)
+    }
+  }
+
+  /// 事件完整文本：typed 枚举文本 + 自由 detail 段。拆分规则沿
+  /// ADR-0045：公开文本由本描述尾部裁切派生，不手抄前缀。
+  var description: String {
+    switch self {
+    case .listenerReady:
+      return "system proxy helper listening"
+    case .connectionAccepted(let pid):
+      return "system proxy helper connection accepted (pid=\(pid))"
+    case .connectionRejected(let pid):
+      return "system proxy helper connection rejected (pid=\(pid))"
+    case .applyCompleted(let outcome):
+      switch outcome {
+      case .written:
+        return "system proxy helper apply completed (outcome=written)"
+      case .unchanged:
+        return "system proxy helper apply completed (outcome=unchanged)"
+      }
+    case .clearCompleted:
+      return "system proxy helper clear completed"
+    case .requestFailed(let error):
+      let parts = error.logParts
+      guard let detail = parts.detail else {
+        return "system proxy helper request failed: \(parts.text)"
+      }
+      return "system proxy helper request failed: \(parts.text): \(detail)"
+    }
+  }
+
+  /// 发射时标 private 的自由 detail 段：恰为 `description` 的尾段。
+  private var privateDetail: String? {
+    guard case .requestFailed(let error) = self else { return nil }
+    return error.logParts.detail
+  }
+
+  /// 系统日志路由：失败类 error、里程碑 default；category 沿用
+  /// `system-proxy`，与 GUI 侧 `.systemProxyWriteFailed` 同类可对照。
+  var logRoute: SystemLogRoute {
+    switch self {
+    case .listenerReady, .connectionAccepted, .applyCompleted, .clearCompleted:
+      return route(level: .default)
+    case .connectionRejected, .requestFailed:
+      return route(level: .error)
+    }
+  }
+
+  private func route(level: OSLogType) -> SystemLogRoute {
+    guard let detail = privateDetail else {
+      return SystemLogRoute(
+        level: level, category: "system-proxy", text: description, privateDetail: nil)
+    }
+    return SystemLogRoute(
+      level: level, category: "system-proxy",
+      text: String(description.dropLast(detail.count)), privateDetail: detail)
+  }
+}
+
+/// 事件发射缝：生产直通统一日志；测试注入替身断言发射。
+enum SystemProxyHelperLog {
+  static func emit(_ event: SystemProxyHelperLogEvent) {
+    SystemLog.emit(event.logRoute)
+  }
+}
+
+extension SystemProxyError {
+  /// 统一日志文本拆分：公开的 typed 错误名与待标 private 的自由 detail
+  /// 段（服务标识或 SC/XPC 错误文本）。
+  var logParts: (text: String, detail: String?) {
+    switch self {
+    case .preferencesUnavailable: return ("preferences unavailable", nil)
+    case .preferencesBusy: return ("preferences busy", nil)
+    case .noCurrentNetworkSet: return ("no current network set", nil)
+    case .noNetworkLocations: return ("no network locations", nil)
+    case .noProxyServices: return ("no proxy services", nil)
+    case .unreadableService(let detail): return ("unreadable service", detail)
+    case .invalidStoredConfiguration(let detail): return ("invalid stored configuration", detail)
+    case .cannotWriteService(let detail): return ("cannot write service", detail)
+    case .commitFailed(let detail): return ("commit failed", detail)
+    case .applyFailed(let detail): return ("apply failed", detail)
+    case .invalidRequest(let detail): return ("invalid request", detail)
+    case .helperUnavailable(let detail): return ("helper unavailable", detail)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyPlan.swift b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyPlan.swift
new file mode 100644
index 000000000..9b8c6539e
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyPlan.swift
@@ -0,0 +1,113 @@
+import Foundation
+
+/// 系统代理写入失败：helper 内 SC 操作失败与 GUI 侧 XPC 失败共用
+/// 同一族，可直接作为 XPC 应答 payload 编解码（Codable）。
+enum SystemProxyError: Error, Equatable, Sendable, Codable {
+  case preferencesUnavailable
+  case preferencesBusy
+  case noCurrentNetworkSet
+  case noNetworkLocations
+  case noProxyServices
+  case unreadableService(String)
+  case invalidStoredConfiguration(String)
+  case cannotWriteService(String)
+  case commitFailed(String)
+  case applyFailed(String)
+  case invalidRequest(String)
+  case helperUnavailable(String)
+}
+
+/// A service identity includes its network location because service IDs can appear in
+/// different locations during cleanup-all-locations scans.
+struct SystemProxyServiceIdentifier: Equatable, Hashable, Sendable {
+  let locationID: String
+  let serviceID: String
+}
+
+/// One service's complete Proxies dictionary as a pure value.
+struct SystemProxyServiceState: Equatable, Sendable {
+  let identifier: SystemProxyServiceIdentifier
+  /// `nil` means that the service has no Proxies entity configuration.
+  let configuration: Data?
+  var name: String = ""
+}
+
+/// One planned Proxies-entity write. `nil` clears the complete entity.
+struct SystemProxyPlannedWrite: Equatable, Sendable {
+  let identifier: SystemProxyServiceIdentifier
+  let configuration: Data?
+}
+
+/// Result of an apply plan. `unchanged` avoids an unnecessary SCPreferences commit.
+enum SystemProxyWriteOutcome: Equatable, Sendable, Codable {
+  case written
+  case unchanged
+}
+
+/// Pure configuration planning. Apply rewrites every differing service in the active
+/// location, preserving unmodeled Proxies keys. Cleanup is unconditional: the complete
+/// Proxies dictionary goes for every service in every scanned location, regardless of
+/// which application or account wrote it.
+enum SystemProxyPlanner {
+  struct ApplyPlan: Equatable, Sendable {
+    let writes: [SystemProxyPlannedWrite]
+
+    var outcome: SystemProxyWriteOutcome {
+      writes.isEmpty ? .unchanged : .written
+    }
+  }
+
+  struct ClearPlan: Equatable, Sendable {
+    let writes: [SystemProxyPlannedWrite]
+  }
+
+  static func makeApplyPlan(
+    services: [SystemProxyServiceState], configuration: SystemProxyConfiguration
+  ) throws -> ApplyPlan {
+    var writes: [SystemProxyPlannedWrite] = []
+    for service in services {
+      let original = try dictionary(
+        from: service.configuration, serviceID: service.identifier.serviceID)
+      let projected = SystemProxyPropertyList.applying(configuration, to: original)
+      let normalizedOriginal =
+        SystemProxyPropertyList.semanticallyNormalized(original) as NSDictionary
+      let normalizedDesired =
+        SystemProxyPropertyList.semanticallyNormalized(projected) as NSDictionary
+      guard !normalizedOriginal.isEqual(normalizedDesired) else { continue }
+      let desired = try propertyListData(
+        from: projected,
+        serviceID: service.identifier.serviceID)
+      writes.append(SystemProxyPlannedWrite(identifier: service.identifier, configuration: desired))
+    }
+    return ApplyPlan(writes: writes)
+  }
+
+  /// 无条件清理计划：凡持有 Proxies 实体的服务都整字典移除，不校验来源，
+  /// 也不保存或查询端点签名、所有权标记或历史快照。
+  static func makeClearPlan(services: [SystemProxyServiceState]) -> ClearPlan {
+    let writes =
+      services
+      .filter { $0.configuration != nil }
+      .map { SystemProxyPlannedWrite(identifier: $0.identifier, configuration: nil) }
+    return ClearPlan(writes: writes)
+  }
+
+  static func dictionary(from data: Data?, serviceID: String) throws -> [String: Any] {
+    guard let data else { return [:] }
+    guard
+      let propertyList = try? PropertyListSerialization.propertyList(
+        from: data, options: [], format: nil),
+      let dictionary = propertyList as? [String: Any]
+    else { throw SystemProxyError.invalidStoredConfiguration(serviceID) }
+    return dictionary
+  }
+
+  static func propertyListData(from dictionary: [String: Any], serviceID: String) throws -> Data {
+    do {
+      return try PropertyListSerialization.data(
+        fromPropertyList: dictionary, format: .binary, options: 0)
+    } catch {
+      throw SystemProxyError.unreadableService(serviceID)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyPropertyList.swift b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyPropertyList.swift
new file mode 100644
index 000000000..6e4e31987
--- /dev/null
+++ b/ShadowsocksX-NG2/Domain/SystemProxy/SystemProxyPropertyList.swift
@@ -0,0 +1,96 @@
+import Foundation
+
+/// Pure projection of one SystemConfiguration Proxies dictionary. The key mapping is a
+/// mechanical translation of the closed typed configuration : every field the
+/// GUI supplies is written, disabled protocols lose their endpoint keys, PAC/auto-
+/// discovery/simple-hostname exclusion follow their explicit flags, and the complete
+/// exceptions list is always written. Keys outside the typed field set are preserved.
+enum SystemProxyPropertyList {
+  static let httpEnabled = "HTTPEnable"
+  static let httpsEnabled = "HTTPSEnable"
+  static let socksEnabled = "SOCKSEnable"
+  static let httpPort = "HTTPPort"
+  static let httpProxy = "HTTPProxy"
+  static let httpsPort = "HTTPSPort"
+  static let httpsProxy = "HTTPSProxy"
+  static let socksPort = "SOCKSPort"
+  static let socksProxy = "SOCKSProxy"
+  static let pacEnabled = "ProxyAutoConfigEnable"
+  static let pacURL = "ProxyAutoConfigURLString"
+  static let pacJavaScript = "ProxyAutoConfigJavaScript"
+  static let autoDiscoveryEnabled = "ProxyAutoDiscoveryEnable"
+  static let exceptionsList = "ExceptionsList"
+  static let excludeSimpleHostnames = "ExcludeSimpleHostnames"
+
+  /// 一个协议族的 Proxies 键组。
+  private struct ProtocolKeys {
+    let enable: String
+    let proxy: String
+    let port: String
+  }
+
+  static func applying(
+    _ configuration: SystemProxyConfiguration, to original: [String: Any]
+  ) -> [String: Any] {
+    var dictionary = original
+    applyProtocol(
+      enabled: configuration.socksEnabled, endpoint: configuration.socks,
+      keys: ProtocolKeys(enable: socksEnabled, proxy: socksProxy, port: socksPort),
+      into: &dictionary)
+    applyProtocol(
+      enabled: configuration.httpEnabled, endpoint: configuration.http,
+      keys: ProtocolKeys(enable: httpEnabled, proxy: httpProxy, port: httpPort),
+      into: &dictionary)
+    applyProtocol(
+      enabled: configuration.httpsEnabled, endpoint: configuration.https,
+      keys: ProtocolKeys(enable: httpsEnabled, proxy: httpsProxy, port: httpsPort),
+      into: &dictionary)
+
+    dictionary[pacEnabled] = configuration.pacEnabled ? 1 : 0
+    if !configuration.pacEnabled {
+      // 关闭的 PAC 不留残余：URL 与 JavaScript 值一并移除。
+      dictionary.removeValue(forKey: pacJavaScript)
+      dictionary.removeValue(forKey: pacURL)
+    }
+    dictionary[autoDiscoveryEnabled] = configuration.autoDiscoveryEnabled ? 1 : 0
+    dictionary[excludeSimpleHostnames] = configuration.excludeSimpleHostnames ? 1 : 0
+    dictionary[exceptionsList] = configuration.exceptions
+    return dictionary
+  }
+
+  /// Normalize only values whose SystemConfiguration meaning is equivalent.
+  /// Unknown fields stay verbatim; stale managed endpoint/PAC values still differ.
+  static func semanticallyNormalized(_ original: [String: Any]) -> [String: Any] {
+    var values = original
+    for key in [
+      httpEnabled, httpsEnabled, socksEnabled, pacEnabled,
+      autoDiscoveryEnabled, excludeSimpleHostnames,
+    ] {
+      if let number = values[key] as? NSNumber {
+        values[key] = number.boolValue ? 1 : 0
+      } else if values[key] == nil {
+        values[key] = 0
+      }
+    }
+    if let exceptions = values[exceptionsList] as? [String] {
+      values[exceptionsList] = Set(exceptions).sorted()
+    }
+    return values
+  }
+
+  /// 启用的协议族写入显式端点；关闭的协议族移除端点键，保持字典与配置一致。
+  private static func applyProtocol(
+    enabled: Bool, endpoint: SystemProxyConfiguration.Endpoint,
+    keys: ProtocolKeys,
+    into dictionary: inout [String: Any]
+  ) {
+    dictionary[keys.enable] = enabled ? 1 : 0
+    if enabled {
+      dictionary[keys.proxy] = endpoint.host
+      dictionary[keys.port] = endpoint.port
+    } else {
+      dictionary.removeValue(forKey: keys.proxy)
+      dictionary.removeValue(forKey: keys.port)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/LaunchAgent/com.qiuyuzhou.ShadowsocksX-NG2.agent.plist b/ShadowsocksX-NG2/LaunchAgent/com.qiuyuzhou.ShadowsocksX-NG2.agent.plist
new file mode 100644
index 000000000..746b222b0
--- /dev/null
+++ b/ShadowsocksX-NG2/LaunchAgent/com.qiuyuzhou.ShadowsocksX-NG2.agent.plist
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>KeepAlive</key>
+	<dict>
+		<key>SuccessfulExit</key>
+		<false/>
+	</dict>
+	<key>Label</key>
+	<string>com.qiuyuzhou.ShadowsocksX-NG2.agent</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>Contents/MacOS/ShadowsocksX-NG2Agent</string>
+	</array>
+	<key>ThrottleInterval</key>
+	<integer>2</integer>
+</dict>
+</plist>
diff --git a/ShadowsocksX-NG2/LaunchDaemons/com.qiuyuzhou.ShadowsocksX-NG2.systemproxy.plist b/ShadowsocksX-NG2/LaunchDaemons/com.qiuyuzhou.ShadowsocksX-NG2.systemproxy.plist
new file mode 100644
index 000000000..f0d5c9b9c
--- /dev/null
+++ b/ShadowsocksX-NG2/LaunchDaemons/com.qiuyuzhou.ShadowsocksX-NG2.systemproxy.plist
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!-- 可执行路径用 BundleProgram（SMAppService 专用键，bundle 相对）：
+	     ProgramArguments[0] 的相对路径按 _PATH_STDPATH（PATH）解析而非
+	     bundle，launchd 找不到程序会以 EX_CONFIG 循环 spawn 失败。 -->
+	<key>BundleProgram</key>
+	<string>Contents/MacOS/ShadowsocksX-NG2SystemProxyHelper</string>
+	<key>Label</key>
+	<string>com.qiuyuzhou.ShadowsocksX-NG2.systemproxy</string>
+	<key>MachServices</key>
+	<dict>
+		<key>com.qiuyuzhou.ShadowsocksX-NG2.systemproxy</key>
+		<true/>
+	</dict>
+</dict>
+</plist>
diff --git a/ShadowsocksX-NG2/README.md b/ShadowsocksX-NG2/README.md
new file mode 100644
index 000000000..936cb07a0
--- /dev/null
+++ b/ShadowsocksX-NG2/README.md
@@ -0,0 +1,45 @@
+# ShadowsocksX-NG2
+
+English | [简体中文](README.zh.md)
+
+ShadowsocksX-NG2 is a modern rewrite of ShadowsocksX-NG for macOS 15+ and Apple Silicon (arm64). Its source code and build configuration are in this directory. The archived legacy version is described on the [repository home page](../README.md).
+
+The app uses upstream releases of `sslocal`, `v2ray-plugin`, and Cloak `ck-client`. HTTP inbound traffic is handled directly by shadowsocks-rust; Legacy Privoxy is no longer bundled.
+
+## Development, build, and test
+
+Install the Xcode/Swift toolchain, [Task](https://taskfile.dev/), [XcodeGen](https://github.com/yonaskolb/XcodeGen), and SwiftLint. See the [development guide](../docs/development.md#code-style-tools) for tool versions and installation instructions.
+
+From this directory, fetch the external binaries before generating the Xcode project for the first build:
+
+```bash
+Scripts/fetch-external-binaries.sh
+task gen:prj
+task build
+```
+
+Debug builds use ad-hoc signing by default and do not require a certificate. See [Signing and distribution](../docs/distribution.md) for Developer ID configuration and release requirements. `project.yml` is the source of truth for project settings; the generated `.xcodeproj` is not checked in.
+
+Run the unified validation workflow from the repository root:
+
+```bash
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml validate
+# Run only the requested stages, in the specified order:
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml validate -- format:check lint test
+```
+
+The default order is `lint → test → build`; execution stops on the first failure. Real-process smoke tests remain available through the explicit `test:smoke` task. Run `task format:check` separately to check formatting without modifying files. Logs and results are saved in `ShadowsocksX-NG2/.build/validation/`. From this directory, you can run `task --exit-code validate`. See the [development guide](../docs/development.md) for individual tasks, evidence, and test boundaries.
+
+## Documentation
+
+| Document | Contents |
+| --- | --- |
+| [Development, build, and test](../docs/development.md) | Validation entry points and artifacts, individual tasks, code style tools, Git hooks, and document language |
+| [Project structure and source search](../docs/project-structure.md) | Source layers, test directories, cross-target file constraints, and search methods |
+| [GUI, Agent, Helper, and sslocal architecture](../docs/design/ng2-process-architecture.md) | Implementation snapshot from 2026-10-24: process boundaries, configuration publication, traffic paths, and lifecycle |
+| [External binaries, signing, and distribution](../docs/distribution.md) | Supply-chain checks, Debug/Release signing, release requirements, and dependency updates |
+| [Bundled rule snapshots](../docs/rule-snapshots.md) | Sources, conversion semantics, maintenance scripts, and offline checks |
+| [Subscriptions, plugins, and listener configuration](../docs/configuration.md) | Subscription data, user plugins, Cloak, local and LAN listeners, and configuration recovery |
+| [Server library encryption format](../docs/server-library-encryption-format.md) | Encrypted file format and external decryption contract |
+
+The [glossary](../GLOSSARY.md) and [architecture decision records](../docs/adr/) are maintained in Simplified Chinese and describe domain terminology and accepted designs. `docs/design/` and `docs/research/` are historical design and research records. Use the current code as the source of truth for implementation behavior.
diff --git a/ShadowsocksX-NG2/README.zh.md b/ShadowsocksX-NG2/README.zh.md
new file mode 100644
index 000000000..765ec2ca1
--- /dev/null
+++ b/ShadowsocksX-NG2/README.zh.md
@@ -0,0 +1,45 @@
+# ShadowsocksX-NG2
+
+[English](README.md) | 简体中文
+
+ShadowsocksX-NG 的现代化重写版本，面向 macOS 15+ / Apple Silicon（arm64）。新工程的源码与构建配置位于本目录，旧版归档见[仓库首页](../README.zh.md)。
+
+依赖的 `sslocal`、`v2ray-plugin` 与 Cloak `ck-client` 使用上游发布的可执行文件。HTTP 入站由 shadowsocks-rust 直接提供，不再携带 Legacy Privoxy。
+
+## 开发、构建与测试
+
+准备 Xcode/Swift 工具链、[Task](https://taskfile.dev/)、[XcodeGen](https://github.com/yonaskolb/XcodeGen) 和 SwiftLint；工具基线与安装说明见[开发指南](../docs/development.zh.md#代码风格工具)。
+
+从本目录执行首次构建，先获取外部二进制，再生成工程：
+
+```bash
+Scripts/fetch-external-binaries.sh
+task gen:prj
+task build
+```
+
+Debug 默认使用 ad-hoc 签名，无需证书；Developer ID 配置与发布门槛见[签名与分发](../docs/distribution.zh.md)。工程配置以 `project.yml` 为准，生成的 `.xcodeproj` 不入库。
+
+从仓库根目录运行统一验证：
+
+```bash
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml validate
+# 按指定顺序只运行所需关卡：
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml validate -- format:check lint test
+```
+
+默认顺序为 `lint → test → build`，失败即停止；真实进程冒烟测试仍可通过显式运行 `test:smoke` 使用。格式检查可单独运行 `task format:check`，不会改写文件。日志与结果保存在 `ShadowsocksX-NG2/.build/validation/`。在本目录内可直接运行 `task --exit-code validate`。单项任务、证据读取与测试边界见[开发指南](../docs/development.zh.md)。
+
+## 文档导航
+
+| 文档 | 内容 |
+| --- | --- |
+| [开发、构建与测试](../docs/development.zh.md) | 验证入口与产物、单项任务、代码风格工具、Git hooks、文档语言 |
+| [工程结构与源码搜索](../docs/project-structure.zh.md) | 源码分层、测试目录、跨 target 文件约束、搜索方法 |
+| [GUI、Agent、Helper 与 sslocal 架构](../docs/design/ng2-process-architecture.zh.md) | 2026-10-24 实现快照：进程边界、配置发布、流量路径与生命周期 |
+| [外部二进制、签名与分发](../docs/distribution.zh.md) | 供应链校验、Debug/Release 签名、发布门槛、依赖升级 |
+| [内置规则快照](../docs/rule-snapshots.zh.md) | 来源、转换语义、维护脚本与离线检查 |
+| [订阅、插件与监听配置](../docs/configuration.zh.md) | 订阅资料、用户插件、Cloak、本地与局域网监听、配置恢复 |
+| [服务器库加密格式](../docs/server-library-encryption-format.zh.md) | 加密文件格式与外部解密约定（[English](../docs/server-library-encryption-format.md)） |
+
+领域术语与已定设计见[术语表](../GLOSSARY.md)和[架构决策记录](../docs/adr/)。`docs/design/` 与 `docs/research/` 为历史设计和研究记录，判断当前实现时以代码为准。
diff --git a/ShadowsocksX-NG2/RELEASE-NOTES.md b/ShadowsocksX-NG2/RELEASE-NOTES.md
new file mode 100644
index 000000000..5c16ef2fe
--- /dev/null
+++ b/ShadowsocksX-NG2/RELEASE-NOTES.md
@@ -0,0 +1,13 @@
+# Unreleased
+
+- Rule mode now offers three named presets: Direct for Mainland China, Proxy GFWList Targets Only, and Proxy Mainland China Targets. Existing routing choices map to their equivalent presets.
+- Each preset has its own custom rules and disabled rules. **Existing custom rules and rule enablement/disablement settings are not migrated.** Recreate these settings in the appropriate preset. Old files are retained.
+- Manage and test each preset independently on the Rules page. Select the preset used for routing in the proxy controls.
+- The Mainland China proxy preset requires a suitable user-provided Mainland China exit server. Built-in coverage is incomplete and does not guarantee access to region-restricted content.
+
+## 简体中文
+
+- 规则模式提供“中国大陆目标直连”“仅GFW列表内目标代理”“中国大陆目标代理”三项预设。已有路由选择映射到等价预设。
+- 各预设独立保存自定义规则和停用选择。**旧自定义规则、旧规则启用／禁用配置均不迁移。** 请在对应预设中重新配置；旧文件保留。
+- 规则页可独立管理、离线测试各预设；实际使用的预设在代理控制入口选择。
+- 中国大陆目标代理需要用户自行提供合适的中国大陆出口。内置集合不保证覆盖所有目标，也不承诺地区限制内容可访问。
diff --git a/ShadowsocksX-NG2/Scripts/convert-china-ipv4.py b/ShadowsocksX-NG2/Scripts/convert-china-ipv4.py
new file mode 100755
index 000000000..f8b0ed60b
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/convert-china-ipv4.py
@@ -0,0 +1,162 @@
+#!/usr/bin/env python3
+"""Convert gaoyifan/china-operator-ip china.txt into an NG2 rule snapshot.
+
+Parses one IPv4 CIDR per line, normalizes (masks host bits), deduplicates, and
+writes a normalized RuleSnapshot JSON plus loss report. Failure leaves any
+previous snapshot untouched.
+"""
+
+from __future__ import annotations
+
+import argparse
+import datetime as dt
+import hashlib
+import ipaddress
+import json
+import sys
+from pathlib import Path
+
+CONVERTER_VERSION = "2.0.0"
+SCHEMA_VERSION = 2
+
+MINIMUM_RULE_COUNT = 100
+MAXIMUM_RULE_COUNT = 50_000
+MINIMUM_SCALE_RATIO = 0.5
+MAXIMUM_SCALE_RATIO = 2.0
+MAXIMUM_REJECTION_PERCENT = 5
+
+
+def parse_lines(text: str) -> tuple[list[dict], int, int]:
+    """Return (rules, duplicate_count, rejected_count)."""
+    rules: list[dict] = []
+    seen: set[str] = set()
+    duplicates = 0
+    rejected = 0
+    for raw_line in text.splitlines():
+        line = raw_line.strip()
+        if not line or line.startswith("#"):
+            continue
+        try:
+            network = ipaddress.IPv4Network(line, strict=False)
+        except ValueError:
+            print(f"invalidCIDR: {line}")
+            rejected += 1
+            continue
+        normalized = f"{network.network_address}/{network.prefixlen}"
+        if normalized in seen:
+            duplicates += 1
+            continue
+        seen.add(normalized)
+        rules.append(
+            {
+                "action": "direct",
+                "match": {"kind": "ipv4CIDR", "value": normalized},
+            }
+        )
+    return rules, duplicates, rejected
+
+
+def build_snapshot(
+    document: str,
+    source: dict,
+    upstream_reference: str,
+    license_name: str,
+    attribution: str,
+    previous_rule_count: int | None,
+) -> dict:
+    rules, duplicates, rejected = parse_lines(document)
+    if not any(line.strip() and not line.strip().startswith("#") for line in document.splitlines()):
+        raise SystemExit("empty input")
+    if not rules and rejected:
+        raise SystemExit("all entries invalid")
+    code_lines = len(rules) + duplicates + rejected
+    if code_lines and rejected * 100 > code_lines * MAXIMUM_REJECTION_PERCENT:
+        raise SystemExit(f"abnormal format: {rejected}/{code_lines} lines rejected")
+    rule_count = len(rules)
+    if rule_count < MINIMUM_RULE_COUNT:
+        raise SystemExit(f"abnormal rule count {rule_count} (min {MINIMUM_RULE_COUNT})")
+    if rule_count > MAXIMUM_RULE_COUNT:
+        raise SystemExit(f"abnormal rule count {rule_count} (max {MAXIMUM_RULE_COUNT})")
+    if previous_rule_count is not None and previous_rule_count > 0:
+        lower = int(previous_rule_count * MINIMUM_SCALE_RATIO)
+        upper = int(previous_rule_count * MAXIMUM_SCALE_RATIO)
+        if not (lower <= rule_count <= upper):
+            raise SystemExit(
+                f"abnormal scale change: {rule_count} vs previous {previous_rule_count} "
+                f"(allowed {lower}..{upper})"
+            )
+
+    report = {
+        "convertedCount": rule_count,
+        "absorbedCount": 0,
+        "skipped": {"duplicate": duplicates} if duplicates else {},
+        "rejected": {"invalidCIDR": rejected} if rejected else {},
+    }
+    return {
+        "schemaVersion": SCHEMA_VERSION,
+        "metadata": {
+            "source": source,
+            "upstreamReference": upstream_reference,
+            "inputDigest": hashlib.sha256(document.encode("utf-8")).hexdigest(),
+            "fetchedAt": dt.datetime.now(dt.timezone.utc)
+            .replace(microsecond=0)
+            .isoformat()
+            .replace("+00:00", "Z"),
+            "converterVersion": CONVERTER_VERSION,
+            "license": license_name,
+            "attribution": attribution,
+        },
+        "rules": rules,
+        "lossReport": report,
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("input", type=Path, help="path to china.txt")
+    parser.add_argument("--upstream", required=True, help="pinned upstream version (commit)")
+    parser.add_argument(
+        "--upstream-reference",
+        required=True,
+        help="upstream repo/product identifier including the pinned commit or URL",
+    )
+    parser.add_argument("--license", required=True)
+    parser.add_argument("--attribution", required=True)
+    parser.add_argument("--out", type=Path, required=True, help="output snapshot.json")
+    parser.add_argument(
+        "--previous-count",
+        type=int,
+        default=None,
+        help="previous snapshot rule count for scale-change detection",
+    )
+    args = parser.parse_args()
+
+    document = args.input.read_text(encoding="utf-8")
+    source = {
+        "kind": "china-ipv4",
+        "upstreamVersion": args.upstream,
+        "label": "china-operator-ip",
+    }
+    snapshot = build_snapshot(
+        document,
+        source,
+        args.upstream_reference,
+        args.license,
+        args.attribution,
+        args.previous_count,
+    )
+
+    args.out.parent.mkdir(parents=True, exist_ok=True)
+    tmp = args.out.with_suffix(".json.tmp")
+    tmp.write_text(json.dumps(snapshot, separators=(",", ":"), sort_keys=True) + "\n", encoding="utf-8")
+    tmp.replace(args.out)
+    loss = snapshot["lossReport"]
+    print(
+        f"wrote {args.out}: {loss['convertedCount']} rules, "
+        f"skipped={loss['skipped']}, rejected={loss['rejected']}"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/ShadowsocksX-NG2/Scripts/convert-geolocation-cn.py b/ShadowsocksX-NG2/Scripts/convert-geolocation-cn.py
new file mode 100755
index 000000000..4d4843728
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/convert-geolocation-cn.py
@@ -0,0 +1,366 @@
+#!/usr/bin/env python3
+"""Convert Loyalsoldier/domain-list-custom geosite.dat geolocation-cn into an
+NG2 rule snapshot.
+
+Parses the geosite protobuf typed entries (Plain/Regex/Domain/Full), applies
+`.cn` suffix absorption, and writes a normalized RuleSnapshot JSON plus loss
+report. Failure leaves any previous snapshot untouched.
+"""
+
+from __future__ import annotations
+
+import argparse
+import datetime as dt
+import hashlib
+import json
+import struct
+import sys
+from pathlib import Path
+
+CONVERTER_VERSION = "2.0.0"
+SCHEMA_VERSION = 2
+
+# v2ray geosite Domain.Type
+TYPE_PLAIN = 0
+TYPE_REGEX = 1
+TYPE_DOMAIN = 2
+TYPE_FULL = 3
+
+TYPE_NAMES = {
+    TYPE_PLAIN: "plain",
+    TYPE_REGEX: "regex",
+    TYPE_DOMAIN: "domain",
+    TYPE_FULL: "full",
+}
+
+
+def read_varint(data: bytes, offset: int) -> tuple[int, int]:
+    result = 0
+    shift = 0
+    while offset < len(data):
+        byte = data[offset]
+        offset += 1
+        result |= (byte & 0x7F) << shift
+        if byte < 0x80:
+            return result, offset
+        shift += 7
+        if shift > 63:
+            raise ValueError("varint too long")
+    raise ValueError("truncated varint")
+
+
+def parse_key(data: bytes, offset: int) -> tuple[int, int, int]:
+    key, offset = read_varint(data, offset)
+    field = key >> 3
+    wire = key & 0x07
+    return field, wire, offset
+
+
+def skip_field(data: bytes, offset: int, wire: int) -> int:
+    if wire == 0:
+        _, offset = read_varint(data, offset)
+        return offset
+    if wire == 1:
+        return offset + 8
+    if wire == 2:
+        length, offset = read_varint(data, offset)
+        return offset + length
+    if wire == 5:
+        return offset + 4
+    raise ValueError(f"unsupported wire type {wire}")
+
+
+def parse_domain(data: bytes) -> dict:
+    """GeoSite.Domain: type=1 (varint), value=2 (string), attribute=3 (message)."""
+    entry = {"type": TYPE_DOMAIN, "value": "", "attributes": []}
+    offset = 0
+    while offset < len(data):
+        field, wire, offset = parse_key(data, offset)
+        if field == 1 and wire == 0:
+            entry["type"], offset = read_varint(data, offset)
+        elif field == 2 and wire == 2:
+            length, offset = read_varint(data, offset)
+            entry["value"] = data[offset : offset + length].decode("utf-8", "replace")
+            offset += length
+        elif field == 3 and wire == 2:
+            length, offset = read_varint(data, offset)
+            attr = parse_attribute(data[offset : offset + length])
+            offset += length
+            if attr:
+                entry["attributes"].append(attr)
+        else:
+            offset = skip_field(data, offset, wire)
+    return entry
+
+
+def parse_attribute(data: bytes) -> str:
+    """GeoSite.Domain.Attribute: key=1 (string)."""
+    key = ""
+    offset = 0
+    while offset < len(data):
+        field, wire, offset = parse_key(data, offset)
+        if field == 1 and wire == 2:
+            length, offset = read_varint(data, offset)
+            key = data[offset : offset + length].decode("utf-8", "replace")
+            offset += length
+        else:
+            offset = skip_field(data, offset, wire)
+    return key
+
+
+def parse_geosite(data: bytes) -> list[dict]:
+    """GeoSiteList: entry=1 (GeoSite message)."""
+    sites: list[dict] = []
+    offset = 0
+    while offset < len(data):
+        field, wire, offset = parse_key(data, offset)
+        if field == 1 and wire == 2:
+            length, offset = read_varint(data, offset)
+            sites.append(parse_geo_site(data[offset : offset + length]))
+            offset += length
+        else:
+            offset = skip_field(data, offset, wire)
+    return sites
+
+
+def parse_geo_site(data: bytes) -> dict:
+    """GeoSite: country_code=1 (string), domain=2 (Domain message)."""
+    site = {"code": "", "domains": []}
+    offset = 0
+    while offset < len(data):
+        field, wire, offset = parse_key(data, offset)
+        if field == 1 and wire == 2:
+            length, offset = read_varint(data, offset)
+            site["code"] = data[offset : offset + length].decode("utf-8", "replace")
+            offset += length
+        elif field == 2 and wire == 2:
+            length, offset = read_varint(data, offset)
+            site["domains"].append(parse_domain(data[offset : offset + length]))
+            offset += length
+        else:
+            offset = skip_field(data, offset, wire)
+    return site
+
+
+def normalize_ipv4_cidr(value: str) -> str | None:
+    if "/" in value:
+        addr, prefix_s = value.split("/", 1)
+        try:
+            prefix = int(prefix_s)
+        except ValueError:
+            return None
+        if not 0 <= prefix <= 32:
+            return None
+    else:
+        addr, prefix = value, 32
+    parts = addr.split(".")
+    if len(parts) != 4:
+        return None
+    try:
+        octets = [int(p) for p in parts]
+    except ValueError:
+        return None
+    if any(o < 0 or o > 255 for o in octets):
+        return None
+    host = (octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]
+    mask = 0 if prefix == 0 else (0xFFFFFFFF << (32 - prefix)) & 0xFFFFFFFF
+    network = host & mask
+    dotted = ".".join(str((network >> shift) & 0xFF) for shift in (24, 16, 8, 0))
+    return f"{dotted}/{prefix}"
+
+
+def domain_suffix(value: str) -> str | None:
+    v = value.strip().lower().lstrip(".")
+    if not v or "*" in v or v.endswith("."):
+        return None
+    if not all(c.isalnum() or c in "-." for c in v):
+        return None
+    labels = v.split(".")
+    if v != "cn" and len(labels) < 2:
+        return None
+    return v
+
+
+def domain_exact(value: str) -> str | None:
+    v = value.strip().lower()
+    if not v or "*" in v or v.startswith(".") or v.endswith("."):
+        return None
+    if not all(c.isalnum() or c in "-." for c in v):
+        return None
+    return v
+
+
+def convert(entries: list[dict]) -> dict:
+    report = {
+        "convertedCount": 0,
+        "absorbedCount": 0,
+        "skipped": {},
+        "rejected": {},
+    }
+    rules: list[dict] = []
+    originals: dict[tuple[str, str], str] = {}
+
+    def bump(bucket: str, key: str, n: int = 1) -> None:
+        target = report[bucket]
+        target[key] = target.get(key, 0) + n
+
+    for entry in entries:
+        etype = entry["type"]
+        value = entry["value"]
+        if etype == TYPE_PLAIN:
+            print(f"keyword: {value}")
+            bump("skipped", "keyword")
+            continue
+        if etype == TYPE_REGEX:
+            print(f"regexp: {value}")
+            bump("skipped", "regexp")
+            continue
+        if etype == TYPE_DOMAIN:
+            normalized = domain_suffix(value)
+            kind = "domainSuffix"
+            original = f"domain:{value}"
+        elif etype == TYPE_FULL:
+            normalized = domain_exact(value)
+            kind = "domainExact"
+            original = f"full:{value}"
+        else:
+            bump("skipped", "unknownType")
+            continue
+        if normalized is None:
+            print(f"invalidDomain: {value}")
+            bump("rejected", "invalidDomain")
+            continue
+        originals.setdefault((kind, normalized), original)
+        rules.append(
+            {
+                "action": "direct",
+                "match": {"kind": kind, "value": normalized},
+            }
+        )
+
+    # Deduplicate by (action, match).
+    seen: set[tuple[str, str, str]] = set()
+    deduped: list[dict] = []
+    for rule in rules:
+        key = (rule["action"], rule["match"]["kind"], rule["match"]["value"])
+        if key in seen:
+            continue
+        seen.add(key)
+        deduped.append(rule)
+    rules = deduped
+
+    # Synthesize `.cn` suffix when absent, then absorb same-action .cn domains.
+    cn_key = ("domainSuffix", "cn")
+    has_cn = any((r["match"]["kind"], r["match"]["value"]) == cn_key for r in rules)
+    if not has_cn:
+        rules.insert(
+            0,
+            {
+                "action": "direct",
+                "match": {"kind": "domainSuffix", "value": "cn"},
+            },
+        )
+        print("synthesized-cn-suffix")
+
+    absorbed_count = 0
+    kept: list[dict] = []
+    for rule in rules:
+        kind = rule["match"]["kind"]
+        value = rule["match"]["value"]
+        if (kind, value) == cn_key:
+            kept.append(rule)
+            continue
+        covered = (kind == "domainSuffix" and value.endswith(".cn") and value != "cn") or (
+            kind == "domainExact" and value.endswith(".cn")
+        )
+        if covered and rule["action"] == "direct":
+            print(f"absorbed-by-cn-suffix: {originals[(kind, value)]}")
+            absorbed_count += 1
+        else:
+            kept.append(rule)
+
+    report["convertedCount"] = len(kept)
+    report["absorbedCount"] = absorbed_count
+    return {
+        "schemaVersion": SCHEMA_VERSION,
+        "rules": kept,
+        "lossReport": report,
+    }
+
+
+def build_snapshot(
+    geosite_path: Path,
+    category: str,
+    upstream_reference: str,
+    license_name: str,
+    attribution: str,
+) -> dict:
+    raw = geosite_path.read_bytes()
+    input_digest = hashlib.sha256(raw).hexdigest()
+    sites = parse_geosite(raw)
+    match = next((s for s in sites if s["code"].lower() == category.lower()), None)
+    if match is None:
+        raise SystemExit(f"category {category!r} not found in {geosite_path}")
+
+    source = {
+        "kind": "geolocation-cn",
+        "upstreamVersion": upstream_reference,
+        "label": "geolocation-cn",
+    }
+    metadata = {
+        "source": source,
+        "upstreamReference": upstream_reference,
+        "inputDigest": input_digest,
+        "fetchedAt": dt.datetime.now(dt.timezone.utc)
+        .replace(microsecond=0)
+        .isoformat()
+        .replace("+00:00", "Z"),
+        "converterVersion": CONVERTER_VERSION,
+        "license": license_name,
+        "attribution": attribution,
+    }
+    snapshot = convert(match["domains"])
+    snapshot["metadata"] = metadata
+    return snapshot
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("geosite", type=Path, help="path to geosite.dat")
+    parser.add_argument("--category", default="GEOLOCATION-CN")
+    parser.add_argument("--upstream", required=True, help="pinned upstream reference")
+    parser.add_argument("--license", required=True)
+    parser.add_argument("--attribution", required=True)
+    parser.add_argument("--out", type=Path, required=True, help="output snapshot.json")
+    args = parser.parse_args()
+
+    snapshot = build_snapshot(
+        args.geosite,
+        args.category,
+        args.upstream,
+        args.license,
+        args.attribution,
+    )
+    rules = snapshot["rules"]
+    if len(rules) < 100:
+        print(f"error: abnormal rule count {len(rules)} (min 100)", file=sys.stderr)
+        return 1
+    if len(rules) > 200_000:
+        print(f"error: abnormal rule count {len(rules)} (max 200000)", file=sys.stderr)
+        return 1
+
+    args.out.parent.mkdir(parents=True, exist_ok=True)
+    tmp = args.out.with_suffix(".json.tmp")
+    tmp.write_text(json.dumps(snapshot, separators=(",", ":"), sort_keys=True) + "\n", encoding="utf-8")
+    tmp.replace(args.out)
+    loss = snapshot["lossReport"]
+    print(
+        f"wrote {args.out}: {loss['convertedCount']} rules, "
+        f"{loss['absorbedCount']} absorbed, skipped={loss['skipped']}, "
+        f"rejected={loss['rejected']}"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/ShadowsocksX-NG2/Scripts/convert-gfwlist.py b/ShadowsocksX-NG2/Scripts/convert-gfwlist.py
new file mode 100755
index 000000000..c2fae6734
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/convert-gfwlist.py
@@ -0,0 +1,377 @@
+#!/usr/bin/env python3
+"""Convert the official Base64 GFWList AutoProxy list into an NG2 rule snapshot.
+
+Domain anchors become suffix matches. URL prefixes with an empty or root path and a
+literal domain host become exact matches, discarding the scheme and port.
+Other URL conditions are reported as losses rather than expanded to domains.
+`@@` exceptions shadowed by a broader proxy rule are kept out of the ACL and
+reported item by item; the broader proxy rules stay. Unknown syntax, corrupt
+input, or abnormal shrinkage block the update and leave the previous snapshot.
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import binascii
+import datetime as dt
+import hashlib
+import ipaddress
+import json
+import re
+import sys
+from pathlib import Path
+from urllib.parse import urlsplit
+
+CONVERTER_VERSION = "2.0.0"
+SCHEMA_VERSION = 2
+
+MINIMUM_RULE_COUNT = 100
+MAXIMUM_RULE_COUNT = 50_000
+MINIMUM_SCALE_RATIO = 0.5
+MAXIMUM_SCALE_RATIO = 2.0
+
+DOMAIN_HOST_RE = re.compile(r"^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")
+
+
+class UnknownSyntax(Exception):
+    def __init__(self, line: str) -> None:
+        super().__init__(f"unknown AutoProxy syntax: {line}")
+        self.line = line
+
+
+def looks_like_ip(text: str) -> bool:
+    try:
+        ipaddress.ip_address(text)
+        return True
+    except ValueError:
+        pass
+    parts = text.split(".")
+    return len(parts) == 4 and all(p.isdigit() for p in parts)
+
+
+def is_valid_domain_host(host: str) -> bool:
+    return bool(host) and "." in host and DOMAIN_HOST_RE.fullmatch(host) is not None
+
+
+def parse_line(raw_line: str) -> dict:
+    """Classify one AutoProxy line. Raises UnknownSyntax on unrecognized forms."""
+    line = raw_line.strip()
+    if not line:
+        return {"kind": "blank"}
+    if line.startswith("!"):
+        return {"kind": "comment"}
+    if line.startswith("[") and line.endswith("]"):
+        return {"kind": "header"}
+
+    is_exception = line.startswith("@@")
+    pattern = line[2:] if is_exception else line
+
+    if pattern.startswith("||"):
+        return parse_domain_pattern(pattern[2:], line, is_exception)
+    if pattern.startswith("|"):
+        return parse_url_prefix(pattern[1:], line, is_exception)
+    if len(pattern) >= 3 and pattern.startswith("/") and pattern.endswith("/"):
+        return {"kind": "regexp", "original": line, "isException": is_exception}
+    if "*" in pattern:
+        return {"kind": "wildcard", "original": line, "isException": is_exception}
+    if looks_like_ip(pattern):
+        return {"kind": "ipLiteral", "original": line, "isException": is_exception}
+    if "." in pattern and DOMAIN_HOST_RE.fullmatch(pattern):
+        return {"kind": "plainText", "original": line, "isException": is_exception}
+    raise UnknownSyntax(line)
+
+
+def parse_url_prefix(url: str, original: str, is_exception: bool) -> dict:
+    skipped = {"kind": "urlPrefix", "original": original, "isException": is_exception}
+    # urlsplit tolerates whitespace and bare hosts; neither is a literal URL rule.
+    if any(char.isspace() for char in url) or not re.match(
+        r"^[A-Za-z][A-Za-z0-9+.-]*://", url
+    ):
+        return skipped
+    try:
+        parsed = urlsplit(url)
+        host = parsed.hostname or ""
+        _ = parsed.port  # Validate numeric syntax and range before dropping it.
+    except ValueError:
+        return skipped
+    if parsed.path not in {"", "/"} or "?" in url or "#" in url or parsed.username is not None:
+        return skipped
+    if (
+        parsed.netloc.endswith(":")
+        or not is_valid_domain_host(host)
+        or looks_like_ip(host)
+    ):
+        return skipped
+    labels = host.split(".")
+    if (
+        len(host) > 253
+        or not all(
+            re.fullmatch(r"[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?", label)
+            for label in labels
+        )
+        or not any(char.isalpha() for char in labels[-1])
+    ):
+        return skipped
+    kind = "exactDomainException" if is_exception else "exactDomainProxy"
+    return {"kind": kind, "host": host.lower(), "original": original}
+
+
+def parse_domain_pattern(host_part: str, original: str, is_exception: bool) -> dict:
+    if "/" in host_part:
+        return {"kind": "urlPath", "original": original, "isException": is_exception}
+    if "*" in host_part:
+        return {"kind": "wildcard", "original": original, "isException": is_exception}
+    if "$" in host_part:
+        return {"kind": "filterOption", "original": original, "isException": is_exception}
+
+    host = host_part
+    if host.endswith("^"):
+        host = host[:-1]
+        if "^" in host:
+            raise UnknownSyntax(original)
+    if looks_like_ip(host):
+        return {"kind": "ipLiteral", "original": original, "isException": is_exception}
+    if "." not in host:
+        return {
+            "kind": "singleLabelPrefix",
+            "original": original,
+            "isException": is_exception,
+        }
+    if not is_valid_domain_host(host):
+        raise UnknownSyntax(original)
+    kind = "domainException" if is_exception else "domainProxy"
+    return {"kind": kind, "host": host.lower(), "original": original}
+
+
+def domain_suffix_covers(broad: str, narrow: str) -> bool:
+    broad_host = broad.lower()
+    narrow_host = narrow.lower()
+    return narrow_host == broad_host or narrow_host.endswith("." + broad_host)
+
+
+def split_shadowed(
+    proxy_rules: list[dict], exception_rules: list[dict]
+) -> tuple[list[dict], list[dict], list[tuple[dict, dict]]]:
+    """Return (kept_proxy, kept_exceptions, shadowed_pairs).
+
+    A suffix proxy covers exact or suffix exceptions on that domain or subdomains.
+    An exact proxy only covers an exact exception on the same domain.
+    sslocal matches domain proxy_list before bypass_list, so a covered exception
+    would be an ineffective ACL entry.
+    """
+    kept_exceptions: list[dict] = []
+    shadowed: list[tuple[dict, dict]] = []
+    for exception in exception_rules:
+        blocker = None
+        for proxy in proxy_rules:
+            broad, narrow = proxy["match"], exception["match"]
+            if (
+                broad["kind"] == "domainSuffix"
+                and domain_suffix_covers(broad["value"], narrow["value"])
+            ) or (broad == narrow):
+                blocker = proxy
+                break
+        if blocker is None:
+            kept_exceptions.append(exception)
+        else:
+            shadowed.append((exception, blocker))
+    return proxy_rules, kept_exceptions, shadowed
+
+
+def make_rule(action: str, match: dict) -> dict:
+    return {
+        "action": action,
+        "match": match,
+    }
+
+
+def convert_document(document: str) -> tuple[list[dict], dict]:
+    """Return (rules, lossReport)."""
+    skipped: dict[str, int] = {}
+    proxy_rules: list[dict] = []
+    exception_rules: list[dict] = []
+    saw_code_line = False
+    originals: dict[tuple[str, str, str], str] = {}
+
+    def rule_key(rule: dict) -> tuple[str, str, str]:
+        return (rule["action"], rule["match"]["kind"], rule["match"]["value"])
+
+    def bump(category: str) -> None:
+        skipped[category] = skipped.get(category, 0) + 1
+
+    for raw_line in document.splitlines():
+        entry = parse_line(raw_line)
+        kind = entry["kind"]
+        if kind == "blank":
+            bump("blank")
+        elif kind == "comment":
+            bump("comment")
+        elif kind == "header":
+            bump("header")
+        elif kind in {"domainProxy", "domainException", "exactDomainProxy", "exactDomainException"}:
+            saw_code_line = True
+            action = "direct" if kind.endswith("Exception") else "proxy"
+            match_kind = "domainExact" if kind.startswith("exact") else "domainSuffix"
+            rule = make_rule(
+                action, {"kind": match_kind, "value": entry["host"]}
+            )
+            originals.setdefault(rule_key(rule), entry["original"])
+            (exception_rules if action == "direct" else proxy_rules).append(rule)
+        elif kind in {
+            "urlPrefix",
+            "urlPath",
+            "filterOption",
+            "wildcard",
+            "regexp",
+            "plainText",
+            "singleLabelPrefix",
+            "ipLiteral",
+        }:
+            saw_code_line = True
+            bump(kind)
+            print(f"unexpressible-{kind}: {entry['original']}")
+        else:
+            raise UnknownSyntax(entry.get("original", raw_line))
+
+    if not saw_code_line:
+        raise SystemExit("empty input")
+
+    kept_proxy, kept_exceptions, shadowed = split_shadowed(proxy_rules, exception_rules)
+    if shadowed:
+        for exception, blocker in shadowed:
+            print(
+                "shadowed-exception: "
+                f"{originals[rule_key(exception)]} "
+                f"shadowed-by {originals[rule_key(blocker)]}"
+            )
+
+    rules = kept_proxy + kept_exceptions
+    # Deduplicate by (action, match.kind, match.value), keeping first.
+    seen: set[tuple[str, str, str]] = set()
+    deduped: list[dict] = []
+    for rule in rules:
+        key = (rule["action"], rule["match"]["kind"], rule["match"]["value"])
+        if key in seen:
+            continue
+        seen.add(key)
+        deduped.append(rule)
+    rules = deduped
+
+    report = {
+        "convertedCount": len(rules),
+        "absorbedCount": len(shadowed),
+        "skipped": skipped,
+        "rejected": {},
+    }
+    return rules, report
+
+
+def build_snapshot(
+    document: str,
+    source: dict,
+    upstream_reference: str,
+    license_name: str,
+    attribution: str,
+    previous_rule_count: int | None,
+) -> dict:
+    rules, report = convert_document(document)
+    rule_count = len(rules)
+    if rule_count < MINIMUM_RULE_COUNT:
+        raise SystemExit(f"abnormal rule count {rule_count} (min {MINIMUM_RULE_COUNT})")
+    if rule_count > MAXIMUM_RULE_COUNT:
+        raise SystemExit(f"abnormal rule count {rule_count} (max {MAXIMUM_RULE_COUNT})")
+    if previous_rule_count is not None and previous_rule_count > 0:
+        lower = int(previous_rule_count * MINIMUM_SCALE_RATIO)
+        upper = int(previous_rule_count * MAXIMUM_SCALE_RATIO)
+        if not (lower <= rule_count <= upper):
+            raise SystemExit(
+                f"abnormal scale change: {rule_count} vs previous {previous_rule_count} "
+                f"(allowed {lower}..{upper})"
+            )
+
+    return {
+        "schemaVersion": SCHEMA_VERSION,
+        "metadata": {
+            "source": source,
+            "upstreamReference": upstream_reference,
+            "inputDigest": hashlib.sha256(document.encode("utf-8")).hexdigest(),
+            "fetchedAt": dt.datetime.now(dt.timezone.utc)
+            .replace(microsecond=0)
+            .isoformat()
+            .replace("+00:00", "Z"),
+            "converterVersion": CONVERTER_VERSION,
+            "license": license_name,
+            "attribution": attribution,
+        },
+        "rules": rules,
+        "lossReport": report,
+    }
+
+
+def decode_autoproxy(text: str) -> str:
+    compact = "".join(text.split())
+    try:
+        raw = base64.b64decode(compact, validate=False)
+    except (binascii.Error, ValueError) as exc:
+        raise SystemExit(f"corrupt Base64 input: {exc}") from exc
+    try:
+        return raw.decode("utf-8")
+    except UnicodeDecodeError as exc:
+        raise SystemExit(f"corrupt AutoProxy payload: {exc}") from exc
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("input", type=Path, help="path to official Base64 gfwlist.txt")
+    parser.add_argument("--upstream", required=True, help="pinned upstream commit")
+    parser.add_argument(
+        "--upstream-reference",
+        required=True,
+        help="upstream repo/product identifier including the pinned commit or URL",
+    )
+    parser.add_argument("--license", required=True)
+    parser.add_argument("--attribution", required=True)
+    parser.add_argument("--out", type=Path, required=True, help="output snapshot.json")
+    parser.add_argument(
+        "--previous-count",
+        type=int,
+        default=None,
+        help="previous snapshot rule count for scale-change detection",
+    )
+    args = parser.parse_args()
+
+    base64_text = args.input.read_text(encoding="utf-8")
+    document = decode_autoproxy(base64_text)
+    source = {
+        "kind": "gfwlist",
+        "upstreamVersion": args.upstream,
+        "label": "GFWList",
+    }
+    try:
+        snapshot = build_snapshot(
+            document,
+            source,
+            args.upstream_reference,
+            args.license,
+            args.attribution,
+            args.previous_count,
+        )
+    except UnknownSyntax as exc:
+        raise SystemExit(str(exc)) from exc
+
+    args.out.parent.mkdir(parents=True, exist_ok=True)
+    tmp = args.out.with_suffix(".json.tmp")
+    tmp.write_text(json.dumps(snapshot, separators=(",", ":"), sort_keys=True) + "\n", encoding="utf-8")
+    tmp.replace(args.out)
+    loss = snapshot["lossReport"]
+    print(
+        f"wrote {args.out}: {loss['convertedCount']} rules, "
+        f"skipped={loss['skipped']}, "
+        f"shadowed={loss['absorbedCount']}"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/ShadowsocksX-NG2/Scripts/dependency-metadata.py b/ShadowsocksX-NG2/Scripts/dependency-metadata.py
new file mode 100644
index 000000000..1652e01f7
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/dependency-metadata.py
@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""Generate and verify offline bundle resources. No network or executable probes."""
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+from urllib.parse import urlparse
+
+
+def required(value, label):
+    if not isinstance(value, str) or not value.strip():
+        raise ValueError(f'{label}: required nonempty string')
+    return value
+
+
+def web_url(value, label):
+    value = required(value, label)
+    if urlparse(value).scheme != 'https' or not urlparse(value).netloc:
+        raise ValueError(f'{label}: invalid HTTPS URL')
+    return value
+
+
+def local_path(root, reference):
+    required(reference, 'text reference')
+    if Path(reference).is_absolute():
+        raise ValueError(f'invalid reference: {reference}')
+    path = (root / reference).resolve()
+    if not path.is_relative_to(root.resolve()):
+        raise ValueError(f'invalid reference: {reference}')
+    return path
+
+
+def generate(root):
+    vendor = root / 'Vendor'
+    specs = json.loads((vendor / 'dependency-metadata.json').read_text())
+    expected_manifests = {str(p.relative_to(vendor)) for p in vendor.glob('*/manifest.json')}
+    expected_manifests |= {str(p.relative_to(vendor)) for p in vendor.glob('rules/*/manifest.json')}
+    declared = [s['manifest'] for s in specs.values() if 'manifest' in s]
+    if set(declared) != expected_manifests or len(declared) != len(set(declared)):
+        raise ValueError(f'dependency manifest coverage mismatch: expected {sorted(expected_manifests)}, declared {declared}')
+    resources, entries, plugins, aliases = {}, [], [], set()
+    for identity, spec in specs.items():
+        try:
+            if 'package' in spec:
+                name = required(spec.get('name', spec['package']), 'name')
+                # shortcut: reads the current exact-pin block; use a YAML parser if its shape expands.
+                package = re.search(r'^  ' + re.escape(spec['package']) + r':\n((?:    .*\n)+)',
+                                    (root / 'project.yml').read_text(), re.MULTILINE)
+                if not package:
+                    raise ValueError('missing XcodeGen package')
+                fields = dict(re.findall(r'^    (url|exactVersion): ([^\n]+)$', package[1], re.MULTILINE))
+                version = required(fields.get('exactVersion'), 'exactVersion')
+                project = source = web_url(fields.get('url'), 'package URL')
+                distribution = f'{source}/releases/tag/{version}'
+            else:
+                manifest = json.loads(local_path(vendor, spec['manifest']).read_text())
+                name = required(spec.get('name', manifest.get('project')), 'name')
+                version = required(manifest.get('release', manifest.get('upstreamVersion')), 'version')
+                project = web_url(spec.get('projectURL'), 'projectURL')
+                source = web_url(spec.get('sourceURL', project), 'sourceURL')
+                distribution = web_url(manifest.get('url', manifest.get('upstreamURL')), 'distributionURL')
+                if manifest.get('bundleSubpath') == 'Helpers/Plugins':
+                    names = manifest.get('pluginNames')
+                    arguments = manifest.get('defaultArguments')
+                    if not isinstance(names, list) or not names or not isinstance(arguments, list):
+                        raise ValueError('missing pluginNames/defaultArguments')
+                    for alias in names:
+                        required(alias, 'plugin alias')
+                        if alias in aliases:
+                            raise ValueError(f'duplicate plugin alias: {alias}')
+                        aliases.add(alias)
+                    for argument in arguments:
+                        required(argument, 'plugin argument')
+                    plugins.append(dict(program=identity, names=names,
+                                        executableName=required(manifest.get('binary'), 'binary'),
+                                        signIdentifier=required(manifest.get('signIdentifier'), 'signIdentifier'),
+                                        defaultArguments=arguments))
+            licenses, notices = spec.get('licenses'), spec.get('notices')
+            if not isinstance(licenses, list) or not licenses or not isinstance(notices, list) or not notices:
+                raise ValueError('licenses/notices must be text reference lists')
+            references = list(licenses) + list(notices)
+            for reference in references:
+                path = local_path(vendor, reference)
+                content = path.read_bytes()
+                if not content.decode('utf-8').strip():
+                    raise ValueError(f'empty text: {reference}')
+                if reference.endswith(('/THIRD-PARTY-NOTICES', '/NOTICE')) and version not in content.decode():
+                    raise ValueError(f'notice does not match selected version {version}: {reference}')
+                resources[reference] = content
+                # Existing aggregate notices reference shared full texts and extra notices.
+                for link in re.findall(r'`(\.\./third-party-licenses/[^`]+\.(?:txt))`', content.decode()):
+                    target = local_path(vendor, str(Path(reference).parent / link))
+                    normalized = str(target.relative_to(vendor.resolve()))
+                    if normalized not in references:
+                        references.append(normalized)
+                        notices = [*notices, normalized]
+            entries.append(dict(id=identity, name=name, projectURL=project, sourceURL=source,
+                                distributionURL=distribution, version=version,
+                                licenses=licenses, notices=notices))
+        except (ValueError, OSError, KeyError, TypeError) as error:
+            raise ValueError(f'{identity}: {error}') from error
+    resources['catalog.json'] = (json.dumps(dict(schemaVersion=1, dependencies=entries), indent=2) + '\n').encode()
+    lines = ['// Generated by Scripts/dependency-metadata.py. Do not edit.', 'import Foundation', '',
+             'extension ManagedPluginCatalog {', '  static let definitions: [ManagedPluginInfo] = [']
+    for plugin in plugins:
+        lines.append('    ManagedPluginInfo(')
+        pairs = list(plugin.items())
+        for index, (key, value) in enumerate(pairs):
+            suffix = '),' if index == len(pairs) - 1 else ','
+            lines.append(f'      {key}: {json.dumps(value, ensure_ascii=False)}{suffix}')
+    lines += ['  ]', '}', '']
+    return resources, '\n'.join(lines).encode()
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--root', type=Path, default=Path(__file__).resolve().parents[1])
+    parser.add_argument('--check', action='store_true')
+    parser.add_argument('--bundle', type=Path, help='verify actual Contents/Resources/ThirdParty')
+    args = parser.parse_args()
+    root = args.root.resolve()
+    resources, swift = generate(root)
+    if args.bundle:
+        resolved = root / 'ShadowsocksX-NG2.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved'
+        pins = json.loads(resolved.read_text())['pins']
+        package = next(entry for entry in json.loads(resources['catalog.json'])['dependencies']
+                       if entry['id'] == 'AgeSwift')
+        if not any(pin.get('location') == package['sourceURL'] and
+                   pin.get('state', {}).get('version') == package['version'] for pin in pins):
+            raise ValueError('AgeSwift: resolved package disagrees with selected source/version')
+    output = args.bundle or root / '.build/dependency-metadata/ThirdParty'
+    files = {output / path: data for path, data in resources.items()}
+    if not args.bundle:
+        files[root / 'Domain/Plugin/ManagedPluginDefinitions.generated.swift'] = swift
+    for path, data in files.items():
+        if args.check or args.bundle:
+            if not path.is_file() or path.read_bytes() != data:
+                raise ValueError(f'{"bundle" if args.bundle else "stale generated metadata"}: {path}')
+        elif not path.is_file() or path.read_bytes() != data:
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_bytes(data)
+    print(f'Dependency metadata: {len(resources)} resources verified' if args.check or args.bundle
+          else f'Dependency metadata: {len(resources)} resources generated')
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except (ValueError, OSError, KeyError, TypeError) as error:
+        sys.exit(f'error: dependency metadata: {error}')
diff --git a/ShadowsocksX-NG2/Scripts/fetch-external-binaries.sh b/ShadowsocksX-NG2/Scripts/fetch-external-binaries.sh
new file mode 100755
index 000000000..fc9c5519d
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/fetch-external-binaries.sh
@@ -0,0 +1,163 @@
+#!/bin/sh
+# Fetch and hash-verify the external binaries pinned under Vendor/.
+#
+# For every Vendor/<name>/manifest.json (see lib-manifests.sh for the schema):
+#   1. If the extracted binary is present and its recorded SHA-256 stamp still
+#      matches, nothing is downloaded (build cache hit).
+#   2. Otherwise a cached archive is checked, or the pinned release asset is
+#      downloaded; its SHA-256 must equal manifest archiveSHA256.
+#   3. A tar member or direct binary must be an arm64-only Mach-O,
+#      and is installed as Vendor/<name>/<binary> with a fresh stamp.
+#
+# Trust root is the committed manifest (tag + asset URL + archive SHA-256).
+# Local artifacts are caches and are silently refetched when they drift.
+# Usage: Scripts/fetch-external-binaries.sh   (run from anywhere)
+
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$SCRIPT_DIR/lib-manifests.sh"
+
+NG2_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
+VENDOR_DIR="$NG2_ROOT/Vendor"
+EXTERNAL_BINARY_CACHE_DIR=${EXTERNAL_BINARY_CACHE_DIR:-}
+
+fetch_one() {
+    manifest=$1
+    name=$(basename "$(dirname "$manifest")")
+
+    tmproot=$(mktemp -d "${TMPDIR:-/tmp}/ng2-fetch.XXXXXX")
+    trap 'rm -rf "$tmproot"' EXIT INT TERM
+
+    plist="$tmproot/manifest.plist"
+    manifest_to_plist "$manifest" "$plist"
+    binary=$(manifest_field "$plist" binary "$manifest")
+    format=$("$PLIST_BUDDY" -c "Print :assetFormat" "$plist" 2>/dev/null || printf 'tar')
+    case "$format" in
+        tar) member=$(manifest_field "$plist" archiveMember "$manifest") ;;
+        binary) ;;
+        *) echo "error: $manifest: unsupported assetFormat '$format'" >&2; return 1 ;;
+    esac
+    asset=$(manifest_field "$plist" asset "$manifest")
+    url=$(manifest_field "$plist" url "$manifest")
+    expected=$(manifest_field "$plist" archiveSHA256 "$manifest")
+
+    dir="$VENDOR_DIR/$name"
+    artifact="$dir/$binary"
+    stamp="$dir/.fetched.sha256"
+
+    printf '%s' "$expected" | grep -Eq '^[0-9a-f]{64}$' || {
+        echo "error: $manifest: archiveSHA256 must be 64 lowercase hex chars" >&2
+        return 1
+    }
+
+    if [ -f "$artifact" ] && [ -f "$stamp" ]; then
+        stamp_archive=$(awk '$1 == "archive" {print $2}' "$stamp")
+        stamp_binary=$(awk '$1 == "binary" {print $2}' "$stamp")
+        actual_binary=$(shasum -a 256 "$artifact" | awk '{print $1}')
+        if [ "$stamp_archive" = "$expected" ] && [ "$stamp_binary" = "$actual_binary" ]; then
+            echo "fetch($name): $binary up to date"
+            rm -rf "$tmproot"
+            trap - EXIT INT TERM
+            return 0
+        fi
+        echo "fetch($name): pinned manifest or local artifact changed; refetching release"
+    fi
+
+    archive=""
+    cache_archive=""
+    if [ -n "$EXTERNAL_BINARY_CACHE_DIR" ]; then
+        cache_archive="$EXTERNAL_BINARY_CACHE_DIR/$name/$asset"
+        if [ -f "$cache_archive" ] && [ ! -L "$cache_archive" ]; then
+            actual=$(shasum -a 256 "$cache_archive" | awk '{print $1}')
+            if [ "$actual" = "$expected" ]; then
+                archive="$cache_archive"
+                echo "fetch($name): verified archive cache hit ($asset)"
+            else
+                echo "fetch($name): cached archive SHA-256 mismatch; downloading pinned release"
+                rm -f "$cache_archive"
+            fi
+        elif [ -e "$cache_archive" ] || [ -L "$cache_archive" ]; then
+            echo "fetch($name): cached archive path is not a regular file: $cache_archive" >&2
+            rm -rf "$cache_archive"
+        fi
+    fi
+
+    if [ -z "$archive" ]; then
+        echo "fetch($name): $url"
+        archive="$tmproot/$asset"
+        curl --fail --location --silent --show-error --retry 3 \
+            --connect-timeout 15 --output "$archive" "$url" || {
+            echo "error: $name: download failed: $url" >&2
+            return 1
+        }
+
+        actual=$(shasum -a 256 "$archive" | awk '{print $1}')
+        [ "$actual" = "$expected" ] || {
+            echo "error: $name: archive SHA-256 mismatch (expected $expected, got $actual)
+error: $name: the pinned release asset changed; redo the static manifest before upgrading" >&2
+            return 1
+        }
+
+        if [ -n "$cache_archive" ]; then
+            mkdir -p "$(dirname "$cache_archive")"
+            cache_tmp=$(mktemp "${cache_archive}.XXXXXX")
+            cp "$archive" "$cache_tmp"
+            mv "$cache_tmp" "$cache_archive"
+            archive="$cache_archive"
+        fi
+    fi
+
+    case "$format" in
+        binary) extracted="$archive" ;;
+        tar)
+            if tar -tf "$archive" | grep -Eq '(^|/)\.\.(/|$)|^/'; then
+                echo "error: $name: archive contains unsafe member paths" >&2
+                return 1
+            fi
+            if ! tar -tf "$archive" | grep -Fqx "$member"; then
+                echo "error: $name: archive has no member '$member'" >&2
+                return 1
+            fi
+
+            xdir="$tmproot/extracted"
+            mkdir -p "$xdir"
+            tar -xf "$archive" -C "$xdir" "$member"
+            extracted="$xdir/$member"
+            ;;
+    esac
+    [ -f "$extracted" ] && [ ! -L "$extracted" ] || {
+        echo "error: $name: selected binary is not a regular file: $extracted" >&2
+        return 1
+    }
+
+    lipo -archs "$extracted" >/dev/null 2>&1 || {
+        echo "error: $name: selected binary is not a Mach-O binary: $extracted" >&2
+        return 1
+    }
+    archs=$(lipo -archs "$extracted" | xargs)
+    [ "$archs" = "arm64" ] || {
+        echo "error: $name: expected arm64-only binary, got: $archs" >&2
+        return 1
+    }
+
+    mkdir -p "$dir"
+    cp "$extracted" "$artifact"
+    chmod 755 "$artifact"
+
+    actual_binary=$(shasum -a 256 "$artifact" | awk '{print $1}')
+    {
+        printf 'archive\t%s\n' "$expected"
+        printf 'binary\t%s\n' "$actual_binary"
+    } > "$stamp.tmp"
+    mv "$stamp.tmp" "$stamp"
+    echo "fetch($name): verified and installed $binary ($actual_binary)"
+
+    rm -rf "$tmproot"
+    trap - EXIT INT TERM
+}
+
+manifests=$(vendor_manifests) || exit 1
+for manifest in $manifests; do
+    fetch_one "$manifest"
+done
diff --git a/ShadowsocksX-NG2/Scripts/lib-manifests.sh b/ShadowsocksX-NG2/Scripts/lib-manifests.sh
new file mode 100755
index 000000000..70998b171
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/lib-manifests.sh
@@ -0,0 +1,42 @@
+# Shared manifest reading for the Vendor supply chain scripts
+# (fetch-external-binaries.sh / sign-embedded-helpers.sh / packaging-gate.sh).
+# Sourced by those scripts; not runnable on its own.
+#
+# A manifest is Vendor/<name>/manifest.json with the fields fixed by
+# project, release, target, asset, url, archiveSHA256,
+# binary, bundleSubpath, signIdentifier. assetFormat defaults to tar; tar
+# requires archiveMember, while binary uses the downloaded asset directly.
+# JSON is parsed with
+# plutil + PlistBuddy so the scripts depend only on base macOS tooling.
+
+PLIST_BUDDY=${PLIST_BUDDY:-/usr/libexec/PlistBuddy}
+
+vendor_manifests() {
+    # Echo the path of every Vendor/*/manifest.json; fail if there are none.
+    local found=""
+    for manifest in "${VENDOR_DIR:?VENDOR_DIR not set}"/*/manifest.json; do
+        [ -f "$manifest" ] || continue
+        found=1
+        printf '%s\n' "$manifest"
+    done
+    [ -n "$found" ] || {
+        echo "error: no manifests found under $VENDOR_DIR" >&2
+        return 1
+    }
+}
+
+manifest_to_plist() {
+    # $1 = manifest.json path, $2 = destination .plist path
+    plutil -convert xml1 -o "$2" "$1" || {
+        echo "error: cannot parse manifest: $1" >&2
+        return 1
+    }
+}
+
+manifest_field() {
+    # $1 = converted .plist, $2 = key, $3 = original manifest path (for errors)
+    "$PLIST_BUDDY" -c "Print :$2" "$1" 2>/dev/null || {
+        echo "error: manifest $3: missing required field '$2'" >&2
+        return 1
+    }
+}
diff --git a/ShadowsocksX-NG2/Scripts/packaging-gate.sh b/ShadowsocksX-NG2/Scripts/packaging-gate.sh
new file mode 100755
index 000000000..6dcfd414b
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/packaging-gate.sh
@@ -0,0 +1,230 @@
+#!/bin/sh
+# Packaging gate for ShadowsocksX-NG2.
+#
+# Standalone assertion over a built app bundle; exits nonzero on any failure:
+#   1. Nested code signatures pass strict verification (incl. every helper).
+#   2. The main app and native tools are Developer ID signed with Hardened
+#      Runtime and secure timestamps. The app carries NO App Sandbox
+#      entitlement (and no network.server entitlement).
+#   3. Every Vendor manifest binary is embedded at Contents/<bundleSubpath>,
+#      is arm64-only, and is re-signed by our Developer ID with Hardened
+#      Runtime, a secure timestamp and the pinned code-signing identifier
+#      (<bundle-id>[.plugin].<name>).
+#   4. The manifest set exactly covers every Mach-O under Contents/Helpers.
+#
+# Usage: Scripts/packaging-gate.sh path/to/ShadowsocksX-NG2.app
+#        EXPECTED_TEAM_ID overrides the Team ID read from the local signing config.
+
+set -u
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$SCRIPT_DIR/lib-manifests.sh"
+
+NG2_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
+VENDOR_DIR="$NG2_ROOT/Vendor"
+
+# Expected Team ID is injected, not pinned in the repo (open source). The same
+# file the build reads supplies it here: Configs/Signing.local.xcconfig
+# (gitignored). An explicit EXPECTED_TEAM_ID wins. Knowing no expected team is a
+# hard failure: an unsigned or wrong-team bundle must not pass just because
+# there is nothing to compare against.
+LOCAL_SIGNING_CONFIG="$NG2_ROOT/Configs/Signing.local.xcconfig"
+EXPECTED_TEAM_ID=${EXPECTED_TEAM_ID:-}
+if [ -z "$EXPECTED_TEAM_ID" ] && [ -f "$LOCAL_SIGNING_CONFIG" ]; then
+    EXPECTED_TEAM_ID=$(
+        sed -n 's/^[[:space:]]*DEVELOPMENT_TEAM[[:space:]]*=[[:space:]]*\([^[:space:]]*\).*/\1/p' \
+            "$LOCAL_SIGNING_CONFIG" | tail -1
+    )
+fi
+
+APP=${1:-}
+[ -n "$APP" ] || {
+    echo "usage: $0 <path/to/App.app>" >&2
+    exit 2
+}
+[ -d "$APP/Contents" ] || {
+    echo "gate: FAIL  not an app bundle: $APP"
+    exit 1
+}
+CONTENTS="$APP/Contents"
+
+FAILS=0
+pass() { printf 'gate: PASS  %s\n' "$1"; }
+fail() { printf 'gate: FAIL  %s\n' "$1"; FAILS=$((FAILS + 1)); }
+
+dv_of() { codesign -dv --verbose=4 "$1" 2>&1; }
+dv_value() {
+    # $1 = dv output, $2 = key. Handles both "Key=value" lines and fields
+    # embedded in the CodeDirectory line ("... flags=0x10000(runtime) ...").
+    printf '%s\n' "$1" |
+        sed -n -e "s/^$2=//p" -e "s/^CodeDirectory .* $2=\([^ )]*\).*/\1/p" |
+        head -1
+}
+
+check_devid_and_runtime() {
+    # $1 = label, $2 = dv output
+    authority=$(dv_value "$2" Authority)
+    case "$authority" in
+        "Developer ID Application:"*) pass "$1: Developer ID Application signed" ;;
+        *) fail "$1: Developer ID Application signed (got: ${authority:-none})" ;;
+    esac
+    flags=$(dv_value "$2" flags)
+    case "$flags" in
+        *runtime*) pass "$1: Hardened Runtime" ;;
+        *) fail "$1: Hardened Runtime (flags: ${flags:-none})" ;;
+    esac
+    if [ -n "$(dv_value "$2" Timestamp)" ]; then
+        pass "$1: secure timestamp present"
+    else
+        fail "$1: secure timestamp present"
+    fi
+}
+
+# --- 1. strict nested signature verification -------------------------------
+if err=$(codesign --verify --strict --deep "$APP" 2>&1); then
+    pass "nested code signatures verify strictly"
+else
+    fail "nested code signatures verify strictly: $err"
+fi
+
+# --- 2. main app identity, runtime, entitlements ----------------------------
+bundle_id=$("$PLIST_BUDDY" -c 'Print :CFBundleIdentifier' "$CONTENTS/Info.plist" 2>/dev/null) || {
+    fail "read CFBundleIdentifier from Info.plist"
+    bundle_id=""
+}
+[ -n "$bundle_id" ] && pass "bundle identifier: $bundle_id"
+
+app_dv=$(dv_of "$APP")
+app_team=$(dv_value "$app_dv" TeamIdentifier)
+app_authority=$(dv_value "$app_dv" Authority)
+app_flags=$(dv_value "$app_dv" flags)
+
+if [ -z "$EXPECTED_TEAM_ID" ]; then
+    fail "expected Team ID is known (set EXPECTED_TEAM_ID or write DEVELOPMENT_TEAM in Configs/Signing.local.xcconfig)"
+else
+    [ "$app_team" = "$EXPECTED_TEAM_ID" ] ||
+        fail "main app TeamIdentifier is $EXPECTED_TEAM_ID (got: ${app_team:-none})"
+fi
+check_devid_and_runtime "main app" "$app_dv"
+for binary in ShadowsocksX-NG2Agent ShadowsocksX-NG2SystemProxyHelper; do
+    target="$CONTENTS/MacOS/$binary"
+    if [ ! -f "$target" ]; then
+        fail "$binary: embedded in Contents/MacOS"
+        continue
+    fi
+    native_dv=$(dv_of "$target")
+    check_devid_and_runtime "$binary" "$native_dv"
+    native_team=$(dv_value "$native_dv" TeamIdentifier)
+    [ "$native_team" = "$app_team" ] ||
+        fail "$binary: TeamIdentifier matches the app (got: ${native_team:-none})"
+done
+case "$app_authority" in
+    "Developer ID Application:"*) ;;
+    *)
+        echo "gate: hint  ad-hoc / non-Developer-ID artifacts come from the certificate-less Debug baseline; only a Developer ID signed release artifact can pass"
+        ;;
+esac
+
+app_entitlements=$(codesign -d --entitlements - --xml "$APP" 2>/dev/null || true)
+for forbidden in com.apple.security.app-sandbox com.apple.security.network.server; do
+    case "$app_entitlements" in
+        *"$forbidden"*) fail "main app has no $forbidden entitlement" ;;
+        *) pass "main app has no $forbidden entitlement" ;;
+    esac
+done
+
+# --- 3+4. per-binary manifest coverage --------------------------------------
+if [ ! -d "$CONTENTS/Helpers" ]; then
+    fail "Contents/Helpers exists"
+fi
+
+tmproot=$(mktemp -d "${TMPDIR:-/tmp}/ng2-gate.XXXXXX")
+trap 'rm -rf "$tmproot"' EXIT INT TERM
+expected_list="$tmproot/expected.txt"
+actual_list="$tmproot/actual.txt"
+: > "$expected_list"
+
+manifests=$(vendor_manifests) || { fail "read manifests"; manifests=""; }
+for manifest in $manifests; do
+    name=$(basename "$(dirname "$manifest")")
+    plist="$tmproot/$name.plist"
+    manifest_to_plist "$manifest" "$plist" || { fail "read manifest $name"; continue; }
+    binary=$(manifest_field "$plist" binary "$manifest") || { fail "read manifest $name"; continue; }
+    subpath=$(manifest_field "$plist" bundleSubpath "$manifest") || { fail "read manifest $name"; continue; }
+    identifier=$(manifest_field "$plist" signIdentifier "$manifest") || { fail "read manifest $name"; continue; }
+
+    subpath_ok=1
+    case "$subpath" in
+        Helpers|Helpers/*) ;;
+        *) subpath_ok=0 ;;
+    esac
+    case "$subpath" in
+        ""|/*|*..*) subpath_ok=0 ;;
+    esac
+    if [ "$subpath_ok" -eq 1 ]; then
+        pass "$name: bundleSubpath is under Helpers ($subpath)"
+    else
+        fail "$name: bundleSubpath must be Helpers or Helpers/... without '..' (got: '$subpath')"
+    fi
+
+    target="$CONTENTS/$subpath/$binary"
+    rel="${subpath#Contents/}/$binary"
+    printf '%s\n' "$rel" >> "$expected_list"
+
+    if [ ! -f "$target" ]; then
+        fail "$name: embedded at Contents/$rel"
+        continue
+    fi
+    [ -x "$target" ] || fail "$name: embedded binary is executable"
+
+    if err=$(codesign --verify --strict "$target" 2>&1); then
+        :
+    else
+        fail "$name: signature verifies strictly: $err"
+    fi
+
+    lipo -archs "$target" >/dev/null 2>&1 || { fail "$name: is an arm64 Mach-O binary"; continue; }
+    archs=$(lipo -archs "$target" | xargs)
+    [ "$archs" = "arm64" ] || fail "$name: is arm64-only (got: $archs)"
+
+    dv=$(dv_of "$target")
+    team=$(dv_value "$dv" TeamIdentifier)
+    actual_identifier=$(dv_value "$dv" Identifier)
+
+    check_devid_and_runtime "$name" "$dv"
+    [ "$team" = "$app_team" ] ||
+        fail "$name: TeamIdentifier matches the app (got: ${team:-none})"
+    [ "$actual_identifier" = "$identifier" ] ||
+        fail "$name: code-signing identifier is $identifier (got: ${actual_identifier:-none})"
+    case "$identifier" in
+        "$bundle_id".*) pass "$name: identifier is prefixed by the bundle id" ;;
+        *) fail "$name: identifier is prefixed by the bundle id ($identifier)" ;;
+    esac
+done
+
+# Every code file under Contents/Helpers must be manifest-covered, and vice
+# versa; symlinks anywhere under Helpers are anomalous and fail outright.
+if [ -d "$CONTENTS/Helpers" ]; then
+    if find "$CONTENTS/Helpers" -type l | grep -q .; then
+        fail "Contents/Helpers contains no symlinks"
+    fi
+    : > "$actual_list"
+    find "$CONTENTS/Helpers" -type f |
+        awk -v prefix="$CONTENTS/" '{print substr($0, length(prefix) + 1)}' |
+        sort > "$actual_list"
+    sort -o "$expected_list" "$expected_list"
+    if diff -u "$expected_list" "$actual_list" > "$tmproot/cover.diff" 2>&1; then
+        pass "manifest set covers every file under Contents/Helpers"
+    else
+        fail "manifest set covers every file under Contents/Helpers:
+$(sed 's/^/        /' "$tmproot/cover.diff")"
+    fi
+fi
+
+# --- summary -----------------------------------------------------------------
+if [ "$FAILS" -eq 0 ]; then
+    echo "gate: ALL CHECKS PASSED ($APP)"
+    exit 0
+fi
+echo "gate: $FAILS CHECK(S) FAILED ($APP)" >&2
+exit 1
diff --git a/ShadowsocksX-NG2/Scripts/sign-embedded-helpers.sh b/ShadowsocksX-NG2/Scripts/sign-embedded-helpers.sh
new file mode 100755
index 000000000..ca5581cb7
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/sign-embedded-helpers.sh
@@ -0,0 +1,61 @@
+#!/bin/sh
+# Re-sign every embedded helper binary with the Developer ID identity before
+# Xcode signs the app itself.
+#
+# Upstream ships these binaries ad-hoc signed; they must carry a signature with
+# Hardened Runtime and a stable code-signing identifier so the outer app seal,
+# notarization and Gatekeeper cover them. Xcode runs this as a post-build script
+# phase and applies the app's own signature afterwards, so the outer signature
+# embeds the re-signed nested code.
+#
+# The identity comes from the build configuration: Developer ID on a release
+# build, ad-hoc ("-") on the certificate-less Debug baseline. Ad-hoc mirrors
+# Xcode's own ad-hoc signing: no secure timestamp and no Hardened Runtime (Xcode
+# omits -o runtime for ad-hoc; hardened runtime with an untrusted identity would
+# only get in the way of local debugging). The release path is unchanged.
+#
+# The identifier scheme is pinned in the manifests: <bundle-id>.<name> for
+# sslocal, <bundle-id>.plugin.<name> for SIP003 plugins.
+
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$SCRIPT_DIR/lib-manifests.sh"
+
+SRCROOT=${SRCROOT:?SRCROOT not set}
+BUILT_PRODUCTS_DIR=${BUILT_PRODUCTS_DIR:?BUILT_PRODUCTS_DIR not set}
+CONTENTS_FOLDER_PATH=${CONTENTS_FOLDER_PATH:?CONTENTS_FOLDER_PATH not set}
+PRODUCT_BUNDLE_IDENTIFIER=${PRODUCT_BUNDLE_IDENTIFIER:?PRODUCT_BUNDLE_IDENTIFIER not set}
+
+IDENTITY=${EXPANDED_CODE_SIGN_IDENTITY:-${EXPANDED_CODE_SIGN_IDENTITY_NAME:-${CODE_SIGN_IDENTITY:-}}}
+[ -n "$IDENTITY" ] || {
+    echo "error: no code signing identity (EXPANDED_CODE_SIGN_IDENTITY empty)" >&2
+    exit 1
+}
+
+CONTENTS="$BUILT_PRODUCTS_DIR/$CONTENTS_FOLDER_PATH"
+tmproot=$(mktemp -d "${TMPDIR:-/tmp}/ng2-sign.XXXXXX")
+trap 'rm -rf "$tmproot"' EXIT INT TERM
+
+manifests=$(VENDOR_DIR="$SRCROOT/Vendor" vendor_manifests) || exit 1
+for manifest in $manifests; do
+    plist="$tmproot/manifest.plist"
+    manifest_to_plist "$manifest" "$plist"
+    binary=$(manifest_field "$plist" binary "$manifest")
+    subpath=$(manifest_field "$plist" bundleSubpath "$manifest")
+    identifier=$(manifest_field "$plist" signIdentifier "$manifest")
+
+    target="$CONTENTS/$subpath/$binary"
+    [ -f "$target" ] || {
+        echo "error: embedded helper missing: $target (check the Copy Files phase in project.yml)" >&2
+        exit 1
+    }
+
+    if [ "$IDENTITY" = "-" ]; then
+        codesign --force --sign - --identifier "$identifier" "$target"
+    else
+        codesign --force --sign "$IDENTITY" --timestamp --options runtime \
+            --identifier "$identifier" "$target"
+    fi
+    echo "sign($binary): $identifier"
+done
diff --git a/ShadowsocksX-NG2/Scripts/test-dependency-metadata.py b/ShadowsocksX-NG2/Scripts/test-dependency-metadata.py
new file mode 100644
index 000000000..a63488cb7
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/test-dependency-metadata.py
@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Offline acceptance checks for authoritative inputs -> packaged metadata."""
+import json
+import shutil
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / 'Scripts/dependency-metadata.py'
+
+
+class DependencyMetadataTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix='ng2-metadata-')
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        shutil.copytree(ROOT / 'Vendor', self.root / 'Vendor',
+                        ignore=lambda directory, names: [name for name in names
+                            if name == '.fetched.sha256' or
+                            (Path(directory).name == name and name in
+                             ('sslocal', 'ck-client', 'v2ray-plugin'))])
+        shutil.copy(ROOT / 'project.yml', self.root / 'project.yml')
+
+    def run_generator(self, *args, success=True):
+        result = subprocess.run(['python3', str(SCRIPT), '--root', str(self.root), *args],
+                                capture_output=True, text=True)
+        self.assertEqual(result.returncode == 0, success, result.stdout + result.stderr)
+        return result
+
+    def test_offline_generation_and_packaging(self):
+        self.run_generator()
+        self.run_generator('--check')
+        output = self.root / '.build/dependency-metadata/ThirdParty'
+        catalog = json.loads((output / 'catalog.json').read_text())
+        self.assertEqual(len(catalog['dependencies']), 7)
+        for entry in catalog['dependencies']:
+            self.assertTrue(entry['version'])
+            self.assertTrue(entry['licenses'])
+            for reference in entry['licenses'] + entry['notices']:
+                self.assertTrue((output / reference).read_text().strip())
+        bundle = self.root / 'Test.app/Contents/Resources/ThirdParty'
+        shutil.copytree(output, bundle)
+        # Model SwiftPM's actual resolution in the isolated app-build fixture.
+        package = next(entry for entry in catalog['dependencies'] if entry['id'] == 'AgeSwift')
+        resolved = self.root / 'ShadowsocksX-NG2.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved'
+        resolved.parent.mkdir(parents=True)
+        resolution = {'pins': [{'location': package['sourceURL'], 'state': {'version': package['version']}}]}
+        resolved.write_text(json.dumps(resolution))
+        self.run_generator('--bundle', str(bundle))
+        (bundle / catalog['dependencies'][0]['licenses'][0]).unlink()
+        self.assertIn('bundle', self.run_generator('--bundle', str(bundle), success=False).stderr)
+        shutil.copytree(output, bundle, dirs_exist_ok=True)
+        resolution['pins'][0]['state']['version'] = 'incorrect'
+        resolved.write_text(json.dumps(resolution))
+        self.assertIn('AgeSwift', self.run_generator('--bundle', str(bundle), success=False).stderr)
+
+    def test_one_authoritative_fact_changes_output_and_stale_output_is_rejected(self):
+        self.run_generator()
+        path = self.root / 'Vendor/dependency-metadata.json'
+        data = json.loads(path.read_text())
+        data['sslocal']['projectURL'] = 'https://example.org/project'
+        path.write_text(json.dumps(data))
+        self.assertIn('stale', self.run_generator('--check', success=False).stderr)
+        self.run_generator()
+        catalog = json.loads((self.root / '.build/dependency-metadata/ThirdParty/catalog.json').read_text())
+        entry = next(item for item in catalog['dependencies'] if item['id'] == 'sslocal')
+        self.assertEqual(entry['projectURL'], 'https://example.org/project')
+
+    def test_invalid_inputs_are_named(self):
+        path = self.root / 'Vendor/dependency-metadata.json'
+        original = json.loads(path.read_text())
+        for field, value in [('name', ''), ('licenses', ['../escape']),
+                             ('licenses', ['missing.txt']), ('notices', []), ('projectURL', 'not a URL')]:
+            with self.subTest(field=field, value=value):
+                data = json.loads(json.dumps(original))
+                data['sslocal'][field] = value
+                path.write_text(json.dumps(data))
+                self.assertIn('sslocal', self.run_generator(success=False).stderr)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/ShadowsocksX-NG2/Scripts/test-external-binary-fetch.py b/ShadowsocksX-NG2/Scripts/test-external-binary-fetch.py
new file mode 100644
index 000000000..90412bace
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/test-external-binary-fetch.py
@@ -0,0 +1,96 @@
+"""Exercise the fetch entry point with local pinned release assets on macOS."""
+import hashlib
+import json
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+
+class ExternalBinaryFetchTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="ng2-fetch-test-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        scripts = self.root / "Scripts"
+        scripts.mkdir()
+        source = Path(__file__).resolve().parent
+        for name in ("fetch-external-binaries.sh", "lib-manifests.sh"):
+            shutil.copy2(source / name, scripts / name)
+        self.script = scripts / "fetch-external-binaries.sh"
+        self.vendor = self.root / "Vendor" / "tool"
+        self.vendor.mkdir(parents=True)
+        self.asset = self.root / "release-tool"
+        code = self.root / "main.c"
+        code.write_text("int main(void) { return 0; }\n")
+        subprocess.run(["xcrun", "clang", "-arch", "arm64", str(code), "-o", str(self.asset)], check=True)
+        self.expected = hashlib.sha256(self.asset.read_bytes()).hexdigest()
+        self.manifest = dict(project="fixture", release="v1", target="darwin-arm64",
+                             asset=self.asset.name, url=self.asset.as_uri(),
+                             archiveSHA256=self.expected, assetFormat="binary", binary="tool",
+                             bundleSubpath="Helpers/Plugins", signIdentifier="fixture.tool")
+        self.write_manifest()
+
+    def write_manifest(self):
+        (self.vendor / "manifest.json").write_text(json.dumps(self.manifest))
+
+    def fetch(self):
+        return subprocess.run(["sh", str(self.script)], capture_output=True, text=True)
+
+    def test_binary_asset_is_verified_cached_and_refetched(self):
+        result = self.fetch()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        installed = self.vendor / "tool"
+        self.assertEqual(installed.read_bytes(), self.asset.read_bytes())
+        self.assertTrue(installed.stat().st_mode & 0o111)
+        self.asset.unlink()
+        cached = self.fetch()
+        self.assertEqual(cached.returncode, 0, cached.stderr)
+        self.assertIn("up to date", cached.stdout)
+        installed.write_bytes(b"changed cache")
+        missing = self.fetch()
+        self.assertNotEqual(missing.returncode, 0)
+        self.assertIn("download failed", missing.stderr)
+
+    def test_hash_mismatch_never_installs(self):
+        self.asset.write_bytes(b"changed upstream asset")
+        result = self.fetch()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("SHA-256 mismatch", result.stderr)
+        self.assertFalse((self.vendor / "tool").exists())
+
+    def test_matching_hash_does_not_accept_non_macho(self):
+        self.asset.write_bytes(b"not executable code")
+        self.manifest["archiveSHA256"] = hashlib.sha256(self.asset.read_bytes()).hexdigest()
+        self.write_manifest()
+        result = self.fetch()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("not a Mach-O binary", result.stderr)
+        self.assertFalse((self.vendor / "tool").exists())
+
+    def test_existing_tar_manifest_still_extracts_pinned_member(self):
+        import tarfile
+        archive = self.root / "release.tar.gz"
+        with tarfile.open(archive, "w:gz") as tar:
+            tar.add(self.asset, arcname="upstream_tool")
+        self.manifest.pop("assetFormat")
+        self.manifest.update(asset=archive.name, url=archive.as_uri(),
+                             archiveMember="upstream_tool",
+                             archiveSHA256=hashlib.sha256(archive.read_bytes()).hexdigest())
+        self.write_manifest()
+        result = self.fetch()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual((self.vendor / "tool").read_bytes(), self.asset.read_bytes())
+
+    def test_unknown_format_is_rejected_even_with_cached_binary(self):
+        self.assertEqual(self.fetch().returncode, 0)
+        self.manifest["assetFormat"] = "zip"
+        self.write_manifest()
+        result = self.fetch()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("unsupported assetFormat", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/ShadowsocksX-NG2/Scripts/test-rule-conversion-behavior.py b/ShadowsocksX-NG2/Scripts/test-rule-conversion-behavior.py
new file mode 100644
index 000000000..a6e1b4028
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/test-rule-conversion-behavior.py
@@ -0,0 +1,276 @@
+#!/usr/bin/env python3
+"""Exercise the sole generation path and its committed Swift consumer fixtures.
+
+Run with --write-fixtures after reviewing an intentional conversion change.
+Normal execution verifies the fixtures byte for byte; no network is used.
+"""
+import base64
+import contextlib
+import hashlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parent.parent
+FIXTURES = ROOT / 'Tests/Fixtures/RuleSnapshots'
+
+
+def load(name):
+    spec = importlib.util.spec_from_file_location(name, ROOT / f'Scripts/convert-{name}.py')
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+GEO = load('geolocation-cn')
+GFW = load('gfwlist')
+CHINA = load('china-ipv4')
+
+
+def varint(value):
+    result = bytearray()
+    while value > 127:
+        result.append((value & 127) | 128)
+        value >>= 7
+    return bytes(result + bytes([value]))
+
+
+def field(number, data):
+    return varint(number * 8 + 2) + varint(len(data)) + data
+
+
+def geosite(entries, category='GEOLOCATION-CN'):
+    domains = b''.join(field(2, b'\x08' + varint(kind) + field(2, value.encode())) for kind, value in entries)
+    return field(1, field(1, category.encode()) + domains)
+
+
+def inputs():
+    return {
+        'geolocation-cn': geosite([(2, 'foo.cn'), (2, 'example.com'), (3, 'api.example.org')]
+                                 + [(2, f'geo{i}.example.net') for i in range(100)]),
+        'china-ipv4': ('\n'.join(f'1.0.{i}.7/24' for i in range(100)) + '\n').encode(),
+        'gfwlist': base64.b64encode(('||example.com\n@@||safe.example.com\n@@||other.example\n'
+                                    '|https://exact.example.net\n@@|https://direct.example.net\n'
+                                    '|https://root.example.net/\n|https://path.example.net/a\n'
+                                    + '\n'.join(f'||gfw{i}.example.net' for i in range(100))).encode()),
+    }
+
+
+def generate(name, raw):
+    source = {'kind': name, 'upstreamVersion': 'fixture-v1', 'label': name}
+    with contextlib.redirect_stdout(io.StringIO()):
+        if name == 'geolocation-cn':
+            with tempfile.TemporaryDirectory() as directory:
+                path = Path(directory) / 'geosite.dat'
+                path.write_bytes(raw)
+                snapshot = GEO.build_snapshot(path, 'GEOLOCATION-CN', 'fixture-v1', 'MIT', 'test fixture')
+        else:
+            module = CHINA if name == 'china-ipv4' else GFW
+            document = raw.decode() if module is CHINA else GFW.decode_autoproxy(raw.decode())
+            snapshot = module.build_snapshot(document, source, 'fixture-v1', 'MIT', 'test fixture', None)
+    snapshot['metadata']['fetchedAt'] = '2026-10-03T00:00:00Z'
+    return (json.dumps(snapshot, separators=(',', ':'), sort_keys=True) + '\n').encode()
+
+
+class ConversionBehaviorTests(unittest.TestCase):
+    def setUp(self):
+        self.output = contextlib.redirect_stdout(io.StringIO())
+        self.output.__enter__()
+        self.addCleanup(self.output.__exit__, None, None, None)
+
+    def test_generated_fixtures_are_current_and_reproducible(self):
+        for name, raw in inputs().items():
+            with self.subTest(source=name):
+                self.assertEqual((FIXTURES / f'{name}.json').read_bytes(), generate(name, raw))
+                snapshot = json.loads(generate(name, raw))
+                digest_input = GFW.decode_autoproxy(raw.decode()).encode() if name == 'gfwlist' else raw
+                self.assertEqual(snapshot['metadata']['inputDigest'], hashlib.sha256(digest_input).hexdigest())
+                self.assertEqual(snapshot['lossReport']['convertedCount'], len(snapshot['rules']))
+                if name == 'gfwlist':
+                    for action, host in [('proxy', 'exact.example.net'), ('direct', 'direct.example.net'), ('proxy', 'root.example.net')]:
+                        self.assertIn({'action': action, 'match': {'kind': 'domainExact', 'value': host}}, snapshot['rules'])
+
+    def test_geosite_reads_published_typed_protobuf_and_selects_category(self):
+        raw = geosite([(2, 'IGNORE.example')], 'OTHER') + geosite([(2, 'Example.COM'), (3, 'api.example.org'), (0, 'keyword'), (1, '^regexp')])
+        sites = GEO.parse_geosite(raw)
+        self.assertEqual([site['code'] for site in sites], ['OTHER', 'GEOLOCATION-CN'])
+        snapshot = GEO.convert(sites[1]['domains'])
+        self.assertEqual([r['match']['kind'] for r in snapshot['rules']], ['domainSuffix', 'domainSuffix', 'domainExact'])
+        self.assertEqual(snapshot['rules'][1]['match']['value'], 'example.com')
+        self.assertEqual(snapshot['lossReport']['skipped'], {'keyword': 1, 'regexp': 1})
+
+    def test_geosite_invalid_varint_and_missing_category_fail(self):
+        with self.assertRaises(ValueError):
+            GEO.parse_geosite(b'\x80')
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / 'input.dat'
+            path.write_bytes(geosite([], 'OTHER'))
+            with self.assertRaisesRegex(SystemExit, 'not found'):
+                GEO.build_snapshot(path, 'GEOLOCATION-CN', 'v', 'MIT', 'test')
+
+    def test_geo_dedup_absorption_and_invalid_domains(self):
+        snapshot = GEO.convert([{'type': kind, 'value': value} for kind, value in
+                                [(2, 'cn'), (2, 'foo.cn'), (3, 'exact.cn'), (2, 'example.com'),
+                                 (2, 'Example.COM'), (2, '*.bad.com'), (3, '.bad.com')]])
+        self.assertEqual([r['match']['value'] for r in snapshot['rules']], ['cn', 'example.com'])
+        self.assertEqual(snapshot['lossReport']['absorbedCount'], 2)
+        self.assertEqual(snapshot['lossReport']['rejected'], {'invalidDomain': 2})
+
+    def test_gfw_classifies_all_unsupported_forms_without_expanding(self):
+        forms = {'urlPrefix': '|https://example.com/a', 'urlPath': '||example.com/a',
+                 'filterOption': '||example.com$third-party', 'wildcard': '||*.example.com',
+                 'regexp': '/regex/', 'plainText': 'example.com', 'singleLabelPrefix': '||google',
+                 'ipLiteral': '||1.2.3.4'}
+        for category, line in forms.items():
+            for prefix in ['', '@@']:
+                with self.subTest(line=prefix + line):
+                    rules, report = GFW.convert_document(prefix + line + '\n||keep.example\n')
+                    self.assertEqual([r['match']['value'] for r in rules], ['keep.example'])
+                    self.assertEqual(report['skipped'], {category: 1})
+
+    def test_gfw_normalizes_deduplicates_and_keeps_broader_exception(self):
+        rules, report = GFW.convert_document('[AutoProxy 0.2.9]\n! comment\n\n||Sub.Example.COM^\n||sub.example.com\n@@||example.com\n@@||else.example\n')
+        self.assertEqual([(r['action'], r['match']['value']) for r in rules],
+                         [('proxy', 'sub.example.com'), ('direct', 'example.com'), ('direct', 'else.example')])
+        self.assertEqual(report['absorbedCount'], 0)
+        self.assertEqual(report['skipped'], {'header': 1, 'comment': 1, 'blank': 1})
+
+    def test_gfw_url_prefix_without_path_converts_to_exact_domain(self):
+        rules, report = GFW.convert_document(
+            '|https://Example.COM\n|http://example.com\n||example.com\n'
+            '@@|https://Safe.Example.ORG\n|https://port.example:8443\n')
+        self.assertEqual([(r['action'], r['match']) for r in rules], [
+            ('proxy', {'kind': 'domainExact', 'value': 'example.com'}),
+            ('proxy', {'kind': 'domainSuffix', 'value': 'example.com'}),
+            ('proxy', {'kind': 'domainExact', 'value': 'port.example'}),
+            ('direct', {'kind': 'domainExact', 'value': 'safe.example.org'}),
+        ])
+        self.assertEqual(report['convertedCount'], 4)
+        self.assertEqual(report['skipped'], {})
+
+    def test_gfw_url_prefix_with_conditions_or_invalid_host_stays_skipped(self):
+        patterns = [
+            'https://example.com/path', 'https://example.com//',
+            'https://*.example.com', 'https://exam*ple.com',
+            'https://1.2.3.4', 'https://999.2.3.4', 'https://[2001:db8::1]',
+            'https://localhost', 'https://bad..example', 'https://-bad.example',
+            'https://bad-.example', 'https://example.com?query',
+            'https://example.com#fragment', 'https://user@example.com',
+            'https://example.com:invalid', 'https://example.com:65536',
+            'https://example.com:', 'https://example.com$third-party',
+            'https://example.com|', 'https://', 'example.com',
+            'https://exa\tmple.com',
+        ]
+        for pattern in patterns:
+            for prefix in ['|', '@@|']:
+                with self.subTest(line=prefix + pattern):
+                    rules, report = GFW.convert_document(prefix + pattern + '\n||keep.example')
+                    self.assertEqual([r['match']['value'] for r in rules], ['keep.example'])
+                    self.assertEqual(report['skipped'], {'urlPrefix': 1})
+
+    def test_gfw_url_prefix_root_path_converts_and_deduplicates(self):
+        rules, report = GFW.convert_document(
+            '|https://Example.COM/\n|http://example.com\n'
+            '@@|https://safe.example.org/\n@@|http://safe.example.org\n')
+        self.assertEqual(rules, [
+            {'action': 'proxy', 'match': {'kind': 'domainExact', 'value': 'example.com'}},
+            {'action': 'direct', 'match': {'kind': 'domainExact', 'value': 'safe.example.org'}},
+        ])
+        self.assertEqual(report['convertedCount'], 2)
+        self.assertEqual(report['skipped'], {})
+
+    def test_gfw_exact_proxy_only_shadows_same_exact_exception(self):
+        lines = ['|https://example.com', '@@|http://example.com',
+                 '@@|https://sub.example.com', '@@||example.com', '@@||sub.example.com']
+        for document in ['\n'.join(lines), '\n'.join(reversed(lines))]:
+            rules, report = GFW.convert_document(document)
+            self.assertEqual(report['absorbedCount'], 1)
+            self.assertEqual(len(rules), 4)
+            self.assertNotIn({'action': 'direct', 'match': {'kind': 'domainExact', 'value': 'example.com'}}, rules)
+
+    def test_gfw_suffix_proxy_shadows_exact_exception_and_reports_original(self):
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            rules, report = GFW.convert_document(
+                '@@|https://safe.example.com\n||example.com\n|https://example.com')
+        self.assertEqual(report['absorbedCount'], 1)
+        self.assertEqual(len(rules), 2)
+        self.assertIn('@@|https://safe.example.com shadowed-by ||example.com', output.getvalue())
+
+    def test_gfw_equal_and_broader_proxy_shadow_exception_in_any_order(self):
+        for document in ['||example.com\n@@||example.com\n@@||safe.example.com',
+                         '@@||safe.example.com\n@@||example.com\n||example.com']:
+            rules, report = GFW.convert_document(document)
+            self.assertEqual(len(rules), 1)
+            self.assertEqual(report['absorbedCount'], 2)
+            self.assertNotIn('shadowedException', report['skipped'])
+
+    def test_gfw_empty_unknown_and_corrupt_payload_fail(self):
+        with self.assertRaises(SystemExit):
+            GFW.convert_document('! comments only\n')
+        for line in ['???bogus???', '||bad^host.example^']:
+            with self.assertRaises(GFW.UnknownSyntax):
+                GFW.convert_document(line)
+        document = '[AutoProxy 0.2.9]\n||example.com\n'
+        self.assertEqual(GFW.decode_autoproxy(base64.b64encode(document.encode()).decode()), document)
+        for encoded in ['not!!!valid@@@base64', base64.b64encode(b'\xff').decode()]:
+            with self.assertRaises(SystemExit):
+                GFW.decode_autoproxy(encoded)
+
+    def test_china_normalizes_addresses_and_rejects_invalid_entries(self):
+        rules, duplicates, rejected = CHINA.parse_lines('# comment\n203.0.113.7/24\n203.0.113.8/24\n8.8.8.8\n::1/128\n1.2.3.4/33\ninvalid\n')
+        self.assertEqual([r['match']['value'] for r in rules], ['203.0.113.0/24', '8.8.8.8/32'])
+        self.assertEqual((duplicates, rejected), (1, 3))
+
+    def test_china_empty_invalid_and_rejection_rate_guards(self):
+        for document, reason in [('# comment\n', 'empty input'), ('invalid\n', 'all entries invalid'),
+                                 ('1.2.3.4/24\ninvalid\n', 'abnormal format')]:
+            with self.assertRaisesRegex(SystemExit, reason):
+                CHINA.build_snapshot(document, {}, 'v', 'MIT', 'test', None)
+        document = inputs()['china-ipv4'].decode() + 'invalid\n'
+        snapshot = CHINA.build_snapshot(document, {}, 'v', 'MIT', 'test', None)
+        self.assertEqual(snapshot['lossReport']['rejected'], {'invalidCIDR': 1})
+
+    def test_count_and_scale_guards_on_actual_generators(self):
+        for module, document in [(CHINA, inputs()['china-ipv4'].decode()),
+                                 (GFW, GFW.decode_autoproxy(inputs()['gfwlist'].decode()))]:
+            count = len(module.build_snapshot(document, {}, 'v', 'MIT', 'test', None)['rules'])
+            for setting, value in [('MINIMUM_RULE_COUNT', count + 1), ('MAXIMUM_RULE_COUNT', count - 1)]:
+                with patch.object(module, setting, value):
+                    with self.assertRaisesRegex(SystemExit, 'abnormal rule count'):
+                        module.build_snapshot(document, {}, 'v', 'MIT', 'test', None)
+            for previous in [count * 3, count // 3]:
+                with self.assertRaisesRegex(SystemExit, 'abnormal scale change'):
+                    module.build_snapshot(document, {}, 'v', 'MIT', 'test', previous)
+            module.build_snapshot(document, {}, 'v', 'MIT', 'test', count)
+
+    def test_failed_cli_keeps_previous_snapshot(self):
+        for name, raw in [('geolocation-cn', geosite([(2, 'small.example')])),
+                          ('china-ipv4', b'invalid'), ('gfwlist', base64.b64encode(b'???bogus???'))]:
+            with tempfile.TemporaryDirectory() as directory:
+                path = Path(directory)
+                (path / 'input').write_bytes(raw)
+                output = path / 'snapshot.json'
+                output.write_bytes(b'previous snapshot')
+                command = [sys.executable, str(ROOT / f'Scripts/convert-{name}.py'), str(path / 'input'),
+                           '--upstream', 'v', '--license', 'MIT', '--attribution', 'test', '--out', str(output)]
+                if name != 'geolocation-cn':
+                    command += ['--upstream-reference', 'v']
+                result = subprocess.run(command, capture_output=True)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertEqual(output.read_bytes(), b'previous snapshot')
+
+
+if __name__ == '__main__':
+    if sys.argv[1:] == ['--write-fixtures']:
+        FIXTURES.mkdir(parents=True, exist_ok=True)
+        for name, raw in inputs().items():
+            (FIXTURES / f'{name}.json').write_bytes(generate(name, raw))
+    else:
+        unittest.main()
diff --git a/ShadowsocksX-NG2/Scripts/test-rule-snapshot-converters.py b/ShadowsocksX-NG2/Scripts/test-rule-snapshot-converters.py
new file mode 100644
index 000000000..ab6e2b9f9
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/test-rule-snapshot-converters.py
@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""Behavior checks at the maintainer conversion boundary (no network)."""
+import contextlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+import unittest
+
+
+def converter(name):
+    path = Path(__file__).with_name(f"convert-{name}.py")
+    spec = importlib.util.spec_from_file_location(name, path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class SnapshotConverterTests(unittest.TestCase):
+    def assert_slim(self, snapshot):
+        self.assertEqual(snapshot["schemaVersion"], 2)
+        self.assertNotIn("absorbed", snapshot)
+        for rule in snapshot["rules"]:
+            self.assertEqual(set(rule), {"action", "match"})
+        report = snapshot["lossReport"]
+        self.assertEqual(set(report), {"convertedCount", "absorbedCount", "skipped", "rejected"})
+        self.assertEqual(report["convertedCount"], len(snapshot["rules"]))
+        for category in ("skipped", "rejected"):
+            self.assertTrue(all(type(count) is int and count >= 0 for count in report[category].values()))
+        self.assertNotIn("shadowedException", report["skipped"])
+
+    def test_cn_absorption_drops_narrow_entries_and_reports_only_totals(self):
+        geo = converter("geolocation-cn")
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            snapshot = geo.convert([
+                {"type": geo.TYPE_DOMAIN, "value": "foo.cn"},
+                {"type": geo.TYPE_FULL, "value": "exact.cn"},
+                {"type": geo.TYPE_DOMAIN, "value": "example.com"},
+                {"type": geo.TYPE_REGEX, "value": "^example"},
+            ])
+        self.assert_slim(snapshot)
+        self.assertEqual([rule["match"]["value"] for rule in snapshot["rules"]], ["cn", "example.com"])
+        self.assertEqual(snapshot["lossReport"]["absorbedCount"], 2)
+        self.assertEqual(snapshot["lossReport"]["skipped"], {"regexp": 1})
+        self.assertIn("synthesized-cn-suffix", output.getvalue())
+        self.assertIn("foo.cn", output.getvalue())
+        self.assertNotIn("foo.cn", json.dumps(snapshot))
+
+    def test_gfw_shadowed_exception_counts_once_and_keeps_raw_evidence_on_stdout(self):
+        gfw = converter("gfwlist")
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            rules, report = gfw.convert_document(
+                "||Example.COM^\n@@||Safe.Example.COM^\n@@||other.example\n|https://path.example/a\n")
+        snapshot = {"schemaVersion": gfw.SCHEMA_VERSION, "rules": rules, "lossReport": report}
+        self.assert_slim(snapshot)
+        self.assertEqual(report["absorbedCount"], 1)
+        self.assertEqual(report["skipped"], {"urlPrefix": 1})
+        self.assertEqual([rule["match"]["value"] for rule in rules], ["example.com", "other.example"])
+        self.assertIn("@@||Safe.Example.COM^ shadowed-by ||Example.COM^", output.getvalue())
+        self.assertNotIn("Safe.Example.COM", json.dumps(snapshot))
+
+    def test_china_ip_build_retains_metadata_normalization_and_duplicate_counts(self):
+        china = converter("china-ipv4")
+        document = "\n".join(f"1.0.{index}.1/24" for index in range(100)) + "\n1.0.0.2/24\n"
+        source = {"kind": "china-ipv4", "upstreamVersion": "fixed", "label": "China"}
+        snapshot = china.build_snapshot(document, source, "fixed", "MIT", "author", None)
+        self.assert_slim(snapshot)
+        self.assertEqual(snapshot["metadata"]["source"], source)
+        self.assertEqual(snapshot["metadata"]["converterVersion"], "2.0.0")
+        self.assertEqual(snapshot["rules"][0]["match"]["value"], "1.0.0.0/24")
+        self.assertEqual(snapshot["lossReport"]["skipped"], {"duplicate": 1})
+
+    def test_shipped_artifacts_use_compact_schema_and_preserve_pinned_rule_counts(self):
+        for name, count, absorbed in [("geolocation-cn", 4241, 1138), ("china-ipv4", 6206, 0), ("gfwlist", 4046, 31)]:
+            with self.subTest(source=name):
+                data = (Path(__file__).parent.parent / "Vendor" / "rules" / name / "snapshot.json").read_bytes()
+                self.assertEqual(data.count(b"\n"), 1)
+                snapshot = json.loads(data)
+                self.assert_slim(snapshot)
+                self.assertEqual(len(snapshot["rules"]), count)
+                self.assertEqual(snapshot["lossReport"]["absorbedCount"], absorbed)
+                self.assertEqual(snapshot["metadata"]["source"]["kind"], name)
+                self.assertEqual(snapshot["metadata"]["converterVersion"], "2.0.0")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/ShadowsocksX-NG2/Scripts/update-china-ipv4.sh b/ShadowsocksX-NG2/Scripts/update-china-ipv4.sh
new file mode 100755
index 000000000..a0951dde5
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/update-china-ipv4.sh
@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# Explicit maintainer update for the built-in china-operator-ip IPv4 CIDR rule
+# snapshot. Normal builds never run this script — they only read the
+# local pinned snapshot. On any failure the previous valid snapshot is kept.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RULES_DIR="${ROOT}/Vendor/rules/china-ipv4"
+SNAPSHOT="${RULES_DIR}/snapshot.json"
+MANIFEST="${RULES_DIR}/manifest.json"
+NOTICE="${RULES_DIR}/NOTICE"
+
+# Pinned upstream: gaoyifan/china-operator-ip ip-lists branch commit.
+# Bump these together after human review of the new commit.
+UPSTREAM_VERSION="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["upstreamVersion"])' "$MANIFEST")"
+UPSTREAM_URL="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["upstreamURL"])' "$MANIFEST")"
+UPSTREAM_SHA256="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["upstreamArchiveSHA256"])' "$MANIFEST")"
+LICENSE="MIT"
+ATTRIBUTION="China mainland IPv4 CIDR derived from gaoyifan/china-operator-ip china.txt (ip-lists branch) at commit ${UPSTREAM_VERSION}. BGP/ASN-derived candidate routing data; not a guarantee of geographic ownership or reachability."
+
+usage() {
+  cat <<'EOF'
+Usage: Scripts/update-china-ipv4.sh [--fetch-only]
+
+Explicitly refresh Vendor/rules/china-ipv4/snapshot.json from the pinned
+china-operator-ip china.txt commit. This is a maintainer action; ordinary
+builds are offline and only read the local snapshot.
+
+  --fetch-only   Download and verify china.txt without converting.
+EOF
+}
+
+FETCH_ONLY=0
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+if [[ "${1:-}" == "--fetch-only" ]]; then
+  FETCH_ONLY=1
+elif [[ $# -gt 0 ]]; then
+  usage >&2
+  exit 2
+fi
+
+TMP="$(mktemp -d)"
+cleanup() { rm -rf "${TMP}"; }
+trap cleanup EXIT
+
+echo "Fetching china.txt ${UPSTREAM_VERSION} …"
+if command -v curl >/dev/null 2>&1; then
+  curl -fsSL --retry 3 -o "${TMP}/china.txt" "${UPSTREAM_URL}"
+else
+  echo "error: curl is required" >&2
+  exit 1
+fi
+
+ACTUAL="$(shasum -a 256 "${TMP}/china.txt" | awk '{print $1}')"
+if [[ "${ACTUAL}" != "${UPSTREAM_SHA256}" ]]; then
+  echo "error: china.txt sha256 mismatch" >&2
+  echo "  expected ${UPSTREAM_SHA256}" >&2
+  echo "  actual   ${ACTUAL}" >&2
+  echo "previous snapshot kept"
+  exit 1
+fi
+echo "Verified china.txt sha256"
+
+if [[ "${FETCH_ONLY}" -eq 1 ]]; then
+  echo "fetch-only: leaving snapshot untouched"
+  exit 0
+fi
+
+mkdir -p "${RULES_DIR}"
+
+# Previous rule count feeds scale-change detection; missing snapshot is first run.
+PREVIOUS_COUNT=""
+if [[ -f "${SNAPSHOT}" ]]; then
+  PREVIOUS_COUNT="$(python3 -c 'import json,sys; print(len(json.load(open(sys.argv[1]))["rules"]))' "${SNAPSHOT}")"
+fi
+
+CONVERT_ARGS=(
+  "${TMP}/china.txt"
+  --upstream "${UPSTREAM_VERSION}"
+  --upstream-reference "${UPSTREAM_URL} @ ${UPSTREAM_VERSION}"
+  --license "${LICENSE}"
+  --attribution "${ATTRIBUTION}"
+  --out "${TMP}/snapshot.json"
+)
+if [[ -n "${PREVIOUS_COUNT}" ]]; then
+  CONVERT_ARGS+=(--previous-count "${PREVIOUS_COUNT}")
+fi
+
+# Convert into a temporary snapshot first; only replace on success.
+if ! python3 "${ROOT}/Scripts/convert-china-ipv4.py" "${CONVERT_ARGS[@]}"; then
+  echo "error: conversion failed; previous snapshot kept"
+  exit 1
+fi
+
+# Sanity: snapshot must load as JSON and carry required metadata keys.
+python3 - "${TMP}/snapshot.json" <<'PY'
+import json, sys
+from pathlib import Path
+data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+meta = data.get("metadata") or {}
+for key in ("source", "upstreamReference", "inputDigest", "fetchedAt", "converterVersion", "license", "attribution"):
+    if key not in meta:
+        raise SystemExit(f"snapshot metadata missing {key}")
+if not data.get("rules"):
+    raise SystemExit("snapshot has no rules")
+print(f"snapshot ok: {len(data['rules'])} rules")
+PY
+
+cp "${TMP}/snapshot.json" "${SNAPSHOT}"
+
+# Refresh manifest (build-time integrity anchor).
+python3 - "${SNAPSHOT}" "${MANIFEST}" "${UPSTREAM_VERSION}" "${UPSTREAM_URL}" "${UPSTREAM_SHA256}" <<'PY'
+import hashlib, json, sys
+from pathlib import Path
+snapshot_path, manifest_path, version, url, sha256 = sys.argv[1:6]
+data = Path(snapshot_path).read_bytes()
+digest = hashlib.sha256(data).hexdigest()
+manifest = {
+    "name": "china-ipv4",
+    "upstreamVersion": version,
+    "upstreamURL": url,
+    "upstreamArchiveSHA256": sha256,
+    "snapshotSHA256": digest,
+    "converterVersion": json.loads(data)["metadata"]["converterVersion"],
+}
+Path(manifest_path).write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+print(f"wrote {manifest_path}")
+PY
+
+# NOTICE: license and attribution accompany the distributed snapshot.
+cat > "${NOTICE}" <<EOF
+china-ipv4 rule snapshot
+========================
+
+Upstream: gaoyifan/china-operator-ip china.txt (ip-lists branch)
+Upstream commit: ${UPSTREAM_VERSION}
+Upstream URL: ${UPSTREAM_URL}
+Upstream archive SHA-256: ${UPSTREAM_SHA256}
+
+License: ${LICENSE}
+
+${ATTRIBUTION}
+
+This list is candidate routing data. It is not a guarantee of network
+reachability, geographic ownership, or privacy. IP-CIDR matching may cause
+sslocal to issue local DNS queries for unmatched hostnames; the product does
+not promise that all DNS queries travel through the remote Shadowsocks server.
+EOF
+
+echo "Updated ${SNAPSHOT}"
+echo "Remember to review the diff and commit the snapshot together with its NOTICE and manifest."
diff --git a/ShadowsocksX-NG2/Scripts/update-geolocation-cn.sh b/ShadowsocksX-NG2/Scripts/update-geolocation-cn.sh
new file mode 100755
index 000000000..f377cd805
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/update-geolocation-cn.sh
@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# Explicit maintainer update for the built-in geolocation-cn rule snapshot
+# Normal builds never run this script — they only read the local
+# pinned snapshot. On any failure the previous valid snapshot is kept.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RULES_DIR="${ROOT}/Vendor/rules/geolocation-cn"
+SNAPSHOT="${RULES_DIR}/snapshot.json"
+MANIFEST="${RULES_DIR}/manifest.json"
+NOTICE="${RULES_DIR}/NOTICE"
+
+# Pinned upstream: Loyalsoldier/domain-list-custom release (geosite.dat).
+# Update the manifest pin after human review of the new release.
+UPSTREAM_VERSION="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["upstreamVersion"])' "$MANIFEST")"
+UPSTREAM_URL="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["upstreamURL"])' "$MANIFEST")"
+UPSTREAM_SHA256="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["upstreamArchiveSHA256"])' "$MANIFEST")"
+LICENSE="MIT"
+ATTRIBUTION="geolocation-cn derived from Loyalsoldier/domain-list-custom geosite.dat ${UPSTREAM_VERSION} (based on v2fly/domain-list-community). The upstream export applies domain-list-custom attribute filtering (@ads and @!cn omitted)."
+
+usage() {
+  cat <<'EOF'
+Usage: Scripts/update-geolocation-cn.sh [--fetch-only]
+
+Explicitly refresh Vendor/rules/geolocation-cn/snapshot.json from the pinned
+domain-list-custom geosite.dat release. This is a maintainer action; ordinary
+builds are offline and only read the local snapshot.
+
+  --fetch-only   Download and verify geosite.dat without converting.
+EOF
+}
+
+FETCH_ONLY=0
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+if [[ "${1:-}" == "--fetch-only" ]]; then
+  FETCH_ONLY=1
+elif [[ $# -gt 0 ]]; then
+  usage >&2
+  exit 2
+fi
+
+TMP="$(mktemp -d)"
+cleanup() { rm -rf "${TMP}"; }
+trap cleanup EXIT
+
+echo "Fetching geosite.dat ${UPSTREAM_VERSION} …"
+if command -v curl >/dev/null 2>&1; then
+  curl -fsSL --retry 3 -o "${TMP}/geosite.dat" "${UPSTREAM_URL}"
+else
+  echo "error: curl is required" >&2
+  exit 1
+fi
+
+ACTUAL="$(shasum -a 256 "${TMP}/geosite.dat" | awk '{print $1}')"
+if [[ "${ACTUAL}" != "${UPSTREAM_SHA256}" ]]; then
+  echo "error: geosite.dat sha256 mismatch" >&2
+  echo "  expected ${UPSTREAM_SHA256}" >&2
+  echo "  actual   ${ACTUAL}" >&2
+  echo "previous snapshot kept"
+  exit 1
+fi
+echo "Verified geosite.dat sha256"
+
+if [[ "${FETCH_ONLY}" -eq 1 ]]; then
+  echo "fetch-only: leaving snapshot untouched"
+  exit 0
+fi
+
+mkdir -p "${RULES_DIR}"
+
+# Convert into a temporary snapshot first; only replace on success.
+if ! python3 "${ROOT}/Scripts/convert-geolocation-cn.py" \
+  "${TMP}/geosite.dat" \
+  --upstream "${UPSTREAM_VERSION}" \
+  --license "${LICENSE}" \
+  --attribution "${ATTRIBUTION}" \
+  --out "${TMP}/snapshot.json"; then
+  echo "error: conversion failed; previous snapshot kept"
+  exit 1
+fi
+
+# Sanity: snapshot must load as JSON and carry required metadata keys.
+python3 - "${TMP}/snapshot.json" <<'PY'
+import json, sys
+from pathlib import Path
+data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+meta = data.get("metadata") or {}
+for key in ("source", "upstreamReference", "inputDigest", "fetchedAt", "converterVersion", "license", "attribution"):
+    if key not in meta:
+        raise SystemExit(f"snapshot metadata missing {key}")
+if not data.get("rules"):
+    raise SystemExit("snapshot has no rules")
+print(f"snapshot ok: {len(data['rules'])} rules")
+PY
+
+cp "${TMP}/snapshot.json" "${SNAPSHOT}"
+
+# Refresh manifest (build-time integrity anchor).
+python3 - "${SNAPSHOT}" "${MANIFEST}" "${UPSTREAM_VERSION}" "${UPSTREAM_URL}" "${UPSTREAM_SHA256}" <<'PY'
+import hashlib, json, sys
+from pathlib import Path
+snapshot_path, manifest_path, version, url, sha256 = sys.argv[1:6]
+data = Path(snapshot_path).read_bytes()
+digest = hashlib.sha256(data).hexdigest()
+manifest = {
+    "name": "geolocation-cn",
+    "upstreamVersion": version,
+    "upstreamURL": url,
+    "upstreamArchiveSHA256": sha256,
+    "snapshotSHA256": digest,
+    "converterVersion": data and json.loads(data)["metadata"]["converterVersion"],
+}
+Path(manifest_path).write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+print(f"wrote {manifest_path}")
+PY
+
+# NOTICE: license and attribution accompany the distributed snapshot.
+cat > "${NOTICE}" <<EOF
+geolocation-cn rule snapshot
+============================
+
+Upstream: Loyalsoldier/domain-list-custom geosite.dat ${UPSTREAM_VERSION}
+Upstream URL: ${UPSTREAM_URL}
+Upstream archive SHA-256: ${UPSTREAM_SHA256}
+
+Based on v2fly/domain-list-community data. This distribution applies the same
+attribute filtering as domain-list-custom (omits @ads and @!cn rules from
+geolocation-cn).
+
+License: ${LICENSE}
+
+${ATTRIBUTION}
+
+This list is candidate routing data. It is not a guarantee of network
+reachability, geographic ownership, or privacy.
+EOF
+
+echo "Updated ${SNAPSHOT}"
+echo "Remember to review the diff and commit the snapshot together with its NOTICE and manifest."
diff --git a/ShadowsocksX-NG2/Scripts/update-gfwlist.sh b/ShadowsocksX-NG2/Scripts/update-gfwlist.sh
new file mode 100755
index 000000000..4e0e1431b
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/update-gfwlist.sh
@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+# Explicit maintainer update for the built-in GFWList AutoProxy rule snapshot
+# Normal builds never run this script — they only read the local
+# pinned snapshot. On any failure the previous valid snapshot is kept.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RULES_DIR="${ROOT}/Vendor/rules/gfwlist"
+SNAPSHOT="${RULES_DIR}/snapshot.json"
+MANIFEST="${RULES_DIR}/manifest.json"
+NOTICE="${RULES_DIR}/NOTICE"
+
+# Pinned upstream: edit the manifest after human review of the new commit.
+UPSTREAM_VERSION="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["upstreamVersion"])' "$MANIFEST")"
+UPSTREAM_URL="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["upstreamURL"])' "$MANIFEST")"
+UPSTREAM_SHA256="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["upstreamArchiveSHA256"])' "$MANIFEST")"
+UPSTREAM_MIRROR_URL="https://cdn.jsdelivr.net/gh/gfwlist/gfwlist@${UPSTREAM_VERSION}/gfwlist.txt"
+LICENSE="LGPL-2.1"
+ATTRIBUTION="GFWList AutoProxy rules derived from gfwlist/gfwlist gfwlist.txt at commit ${UPSTREAM_VERSION}. Official Base64 AutoProxy 0.2.9 list. Domain anchors become suffix matches. URL prefixes with an empty or root path, no query, fragment or user information, and a literal domain host become exact matches, discarding scheme and any valid port. Other URL conditions, wildcard hosts, IP literals and regex rules are reported as losses. List is candidate routing data, not a guarantee of reachability or completeness."
+
+usage() {
+  cat <<'EOF'
+Usage: Scripts/update-gfwlist.sh [--fetch-only]
+
+Explicitly refresh Vendor/rules/gfwlist/snapshot.json from the pinned
+gfwlist/gfwlist commit. This is a maintainer action; ordinary builds are
+offline and only read the local snapshot.
+
+  --fetch-only   Download and verify gfwlist.txt without converting.
+EOF
+}
+
+FETCH_ONLY=0
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+if [[ "${1:-}" == "--fetch-only" ]]; then
+  FETCH_ONLY=1
+elif [[ $# -gt 0 ]]; then
+  usage >&2
+  exit 2
+fi
+
+TMP="$(mktemp -d)"
+cleanup() { rm -rf "${TMP}"; }
+trap cleanup EXIT
+
+echo "Fetching gfwlist.txt ${UPSTREAM_VERSION} …"
+fetch_ok=0
+if command -v curl >/dev/null 2>&1; then
+  if curl -fsSL --retry 1 --max-time 20 -o "${TMP}/gfwlist.txt" "${UPSTREAM_URL}"; then
+    fetch_ok=1
+    echo "Fetched from ${UPSTREAM_URL}"
+  elif curl -fsSL --retry 2 --max-time 45 -o "${TMP}/gfwlist.txt" "${UPSTREAM_MIRROR_URL}"; then
+    fetch_ok=1
+    echo "Fetched from mirror ${UPSTREAM_MIRROR_URL}"
+  fi
+fi
+if [[ "${fetch_ok}" -ne 1 ]]; then
+  echo "error: failed to fetch gfwlist.txt from pinned upstream or mirror" >&2
+  echo "previous snapshot kept"
+  exit 1
+fi
+
+ACTUAL="$(shasum -a 256 "${TMP}/gfwlist.txt" | awk '{print $1}')"
+if [[ "${ACTUAL}" != "${UPSTREAM_SHA256}" ]]; then
+  echo "error: gfwlist.txt sha256 mismatch" >&2
+  echo "  expected ${UPSTREAM_SHA256}" >&2
+  echo "  actual   ${ACTUAL}" >&2
+  echo "previous snapshot kept"
+  exit 1
+fi
+echo "Verified gfwlist.txt sha256"
+
+if [[ "${FETCH_ONLY}" -eq 1 ]]; then
+  echo "fetch-only: leaving snapshot untouched"
+  exit 0
+fi
+
+mkdir -p "${RULES_DIR}"
+
+# Previous rule count feeds scale-change detection; missing snapshot is first run.
+PREVIOUS_COUNT=""
+if [[ -f "${SNAPSHOT}" ]]; then
+  PREVIOUS_COUNT="$(python3 -c 'import json,sys; print(len(json.load(open(sys.argv[1]))["rules"]))' "${SNAPSHOT}")"
+fi
+
+CONVERT_ARGS=(
+  "${TMP}/gfwlist.txt"
+  --upstream "${UPSTREAM_VERSION}"
+  --upstream-reference "gfwlist/gfwlist gfwlist.txt @ ${UPSTREAM_VERSION}"
+  --license "${LICENSE}"
+  --attribution "${ATTRIBUTION}"
+  --out "${TMP}/snapshot.json"
+)
+if [[ -n "${PREVIOUS_COUNT}" ]]; then
+  CONVERT_ARGS+=(--previous-count "${PREVIOUS_COUNT}")
+fi
+
+# Convert into a temporary snapshot first; only replace on success.
+if ! python3 "${ROOT}/Scripts/convert-gfwlist.py" "${CONVERT_ARGS[@]}"; then
+  echo "error: conversion failed; previous snapshot kept"
+  exit 1
+fi
+
+# Sanity: snapshot must load as JSON and carry required metadata keys.
+python3 - "${TMP}/snapshot.json" <<'PY'
+import json, sys
+from pathlib import Path
+data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+meta = data.get("metadata") or {}
+for key in ("source", "upstreamReference", "inputDigest", "fetchedAt", "converterVersion", "license", "attribution"):
+    if key not in meta:
+        raise SystemExit(f"snapshot metadata missing {key}")
+if not data.get("rules"):
+    raise SystemExit("snapshot has no rules")
+print(f"snapshot ok: {len(data['rules'])} rules, "
+      f"shadowed={data.get('lossReport', {}).get('absorbedCount', 0)}")
+PY
+
+cp "${TMP}/snapshot.json" "${SNAPSHOT}"
+
+# Refresh manifest (build-time integrity anchor).
+python3 - "${SNAPSHOT}" "${MANIFEST}" "${UPSTREAM_VERSION}" "${UPSTREAM_URL}" "${UPSTREAM_SHA256}" <<'PY'
+import hashlib, json, sys
+from pathlib import Path
+snapshot_path, manifest_path, version, url, sha256 = sys.argv[1:6]
+data = Path(snapshot_path).read_bytes()
+digest = hashlib.sha256(data).hexdigest()
+manifest = {
+    "name": "gfwlist",
+    "upstreamVersion": version,
+    "upstreamURL": url,
+    "upstreamArchiveSHA256": sha256,
+    "snapshotSHA256": digest,
+    "converterVersion": json.loads(data)["metadata"]["converterVersion"],
+}
+Path(manifest_path).write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+print(f"wrote {manifest_path}")
+PY
+
+# NOTICE: license and attribution accompany the distributed snapshot.
+cat > "${NOTICE}" <<EOF
+gfwlist rule snapshot
+=====================
+
+Upstream: gfwlist/gfwlist gfwlist.txt
+Upstream commit: ${UPSTREAM_VERSION}
+Upstream URL: ${UPSTREAM_URL}
+Upstream archive SHA-256: ${UPSTREAM_SHA256}
+
+License: ${LICENSE}
+
+${ATTRIBUTION}
+
+This list is candidate routing data. It is not a guarantee of network
+reachability, geographic ownership, or privacy. Domain anchors become suffix
+matches. Eligible URL prefixes become exact
+domain matches, discarding scheme and any valid port. Other URL conditions,
+wildcard hosts, IP literals and regex rules are counted as conversion losses.
+\`@@\` exceptions fully covered by a proxy rule are
+reported item by item and omitted from the generated ACL because sslocal would
+ignore them.
+EOF
+
+echo "Updated ${SNAPSHOT}"
+echo "Remember to review the diff and commit the snapshot together with its NOTICE and manifest."
diff --git a/ShadowsocksX-NG2/Scripts/verify-rule-snapshots.sh b/ShadowsocksX-NG2/Scripts/verify-rule-snapshots.sh
new file mode 100755
index 000000000..3d6c0461e
--- /dev/null
+++ b/ShadowsocksX-NG2/Scripts/verify-rule-snapshots.sh
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# Build-time offline verification of pinned rule snapshots.
+# Ordinary builds never fetch or convert; they only verify the local snapshots
+# are present, intact, and match their manifests. Missing, corrupt, or
+# version-mismatched snapshots fail the build.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+fail() {
+  echo "error: $*" >&2
+  echo "  (run the matching Scripts/update-*.sh after reviewing upstream changes)" >&2
+  exit 1
+}
+
+verify_one() {
+  local name="$1"
+  local min_count="$2"
+  local max_count="$3"
+  local rules_dir="${ROOT}/Vendor/rules/${name}"
+  local snapshot="${rules_dir}/snapshot.json"
+  local manifest="${rules_dir}/manifest.json"
+  local notice="${rules_dir}/NOTICE"
+
+  [[ -f "${snapshot}" ]] || fail "missing ${snapshot}"
+  [[ -f "${manifest}" ]] || fail "missing ${manifest}"
+  [[ -f "${notice}" ]] || fail "missing ${notice} (license/attribution must ship with the snapshot)"
+
+  python3 - "${snapshot}" "${manifest}" "${min_count}" "${max_count}" "${name}" <<'PY' || fail "${name} rule snapshot verification failed"
+import hashlib, json, sys
+from pathlib import Path
+
+snapshot_path, manifest_path, min_count, max_count, name = sys.argv[1:6]
+min_count, max_count = int(min_count), int(max_count)
+snapshot_bytes = Path(snapshot_path).read_bytes()
+try:
+    snapshot = json.loads(snapshot_bytes)
+except Exception as exc:  # noqa: BLE001
+    raise SystemExit(f"snapshot is not valid JSON: {exc}")
+
+if snapshot.get("schemaVersion") != 2:
+    raise SystemExit(f"schemaVersion mismatch: {snapshot.get('schemaVersion')!r} != 2")
+
+meta = snapshot.get("metadata") or {}
+for key in ("source", "upstreamReference", "inputDigest", "fetchedAt", "converterVersion", "license", "attribution"):
+    if key not in meta:
+        raise SystemExit(f"snapshot metadata missing {key!r}")
+
+if meta.get("converterVersion") != "2.0.0":
+    raise SystemExit(
+        f"converterVersion mismatch: {meta.get('converterVersion')!r} != '2.0.0' "
+        "(re-run the explicit update or bump both sides together)"
+    )
+
+rules = snapshot.get("rules")
+if not isinstance(rules, list) or not rules:
+    raise SystemExit("snapshot has no rules")
+if len(rules) < min_count or len(rules) > max_count:
+    raise SystemExit(f"abnormal rule count {len(rules)} (allowed {min_count}..{max_count})")
+
+try:
+    manifest = json.loads(Path(manifest_path).read_text(encoding="utf-8"))
+except Exception as exc:  # noqa: BLE001
+    raise SystemExit(f"manifest is not valid JSON: {exc}")
+
+for key in ("upstreamVersion", "snapshotSHA256", "converterVersion"):
+    if key not in manifest:
+        raise SystemExit(f"manifest missing {key!r}")
+
+if manifest.get("converterVersion") != meta.get("converterVersion"):
+    raise SystemExit("manifest converterVersion does not match snapshot metadata")
+
+digest = hashlib.sha256(snapshot_bytes).hexdigest()
+if digest != manifest.get("snapshotSHA256"):
+    raise SystemExit(
+        "snapshot SHA-256 does not match manifest "
+        f"({digest} != {manifest.get('snapshotSHA256')})"
+    )
+
+if manifest.get("upstreamVersion") != meta.get("source", {}).get("upstreamVersion"):
+    raise SystemExit("manifest upstreamVersion does not match snapshot metadata")
+
+print(f"{name} snapshot ok: {len(rules)} rules, upstream {meta.get('source', {}).get('upstreamVersion')}")
+PY
+}
+
+# geolocation-cn: domain rules.
+verify_one "geolocation-cn" 100 200000
+# china-ipv4: China mainland IPv4 CIDR.
+verify_one "china-ipv4" 100 50000
+# gfwlist: GFWList AutoProxy proxy candidates.
+verify_one "gfwlist" 100 50000
+
+echo "verify-rule-snapshots: ok"
diff --git a/ShadowsocksX-NG2/SystemProxyHelper/SystemProxyWriter.swift b/ShadowsocksX-NG2/SystemProxyHelper/SystemProxyWriter.swift
new file mode 100644
index 000000000..58b336472
--- /dev/null
+++ b/ShadowsocksX-NG2/SystemProxyHelper/SystemProxyWriter.swift
@@ -0,0 +1,181 @@
+import Foundation
+import SystemConfiguration
+
+/// root 进程内的 SystemConfiguration 写入器：GUI 域决策的机械
+/// 执行者。apply 覆盖活动网络位置的每个服务，只改 typed 字段并保留未建模
+/// 键，值已等价时跳过提交；clear 无条件移除全部位置全部服务的完整 Proxies
+/// 字典。root 身份直接创建 SCPreferences，不走授权对话框。
+enum SystemProxyWriter {
+  static func perform(
+    _ request: SystemProxyHelperEngine.Request
+  ) throws -> SystemProxyHelperEngine.Outcome {
+    switch request {
+    case .apply(let configuration):
+      return .applied(try apply(configuration))
+    case .clear:
+      try clear()
+      return .cleared
+    }
+  }
+
+  static func apply(_ configuration: SystemProxyConfiguration) throws -> SystemProxyWriteOutcome {
+    try withPreferences { preferences in
+      try lockPreferencesOrThrow(preferences)
+      defer { SCPreferencesUnlock(preferences) }
+
+      let services = try activeServiceSnapshots(in: preferences)
+      guard !services.isEmpty else { throw SystemProxyError.noProxyServices }
+      let plan = try SystemProxyPlanner.makeApplyPlan(
+        services: services.map(\.plannerState), configuration: configuration)
+
+      guard !plan.writes.isEmpty else { return .unchanged }
+      let servicesByID = Dictionary(uniqueKeysWithValues: services.map { ($0.identifier, $0) })
+      for write in plan.writes {
+        guard let service = servicesByID[write.identifier] else {
+          throw SystemProxyError.cannotWriteService(write.identifier.serviceID)
+        }
+        if service.proxyProtocol == nil {
+          _ = SCNetworkServiceAddProtocolType(
+            service.networkService, kSCNetworkProtocolTypeProxies)
+        }
+        guard
+          let proxyProtocol = service.proxyProtocol
+            ?? SCNetworkServiceCopyProtocol(service.networkService, kSCNetworkProtocolTypeProxies),
+          setConfiguration(write.configuration, on: proxyProtocol)
+        else { throw SystemProxyError.cannotWriteService(write.identifier.serviceID) }
+      }
+      try commitAndApply(preferences)
+      return .written
+    }
+  }
+
+  static func clear() throws {
+    try withPreferences { preferences in
+      try lockPreferencesOrThrow(preferences)
+      defer { SCPreferencesUnlock(preferences) }
+
+      let services = try allServiceSnapshots(in: preferences)
+      let plan = SystemProxyPlanner.makeClearPlan(services: services.map(\.plannerState))
+      guard !plan.writes.isEmpty else { return }
+
+      let servicesByID = Dictionary(uniqueKeysWithValues: services.map { ($0.identifier, $0) })
+      for write in plan.writes {
+        guard let service = servicesByID[write.identifier],
+          let proxyProtocol = service.proxyProtocol,
+          setConfiguration(nil, on: proxyProtocol)
+        else { throw SystemProxyError.cannotWriteService(write.identifier.serviceID) }
+      }
+      try commitAndApply(preferences)
+    }
+  }
+
+  // MARK: - SystemConfiguration 读取与写入
+
+  private struct ServiceSnapshot {
+    let identifier: SystemProxyServiceIdentifier
+    let networkService: SCNetworkService
+    let proxyProtocol: SCNetworkProtocol?
+    let configuration: Data?
+
+    var plannerState: SystemProxyServiceState {
+      SystemProxyServiceState(identifier: identifier, configuration: configuration)
+    }
+  }
+
+  private static func withPreferences<T>(_ body: (SCPreferences) throws -> T) throws -> T {
+    guard
+      let preferences = SCPreferencesCreate(
+        nil, SystemProxyHelperIdentity.machServiceName as CFString, nil)
+    else { throw SystemProxyError.preferencesUnavailable }
+    return try body(preferences)
+  }
+
+  private static func activeServiceSnapshots(
+    in preferences: SCPreferences
+  ) throws -> [ServiceSnapshot] {
+    guard let set = SCNetworkSetCopyCurrent(preferences) else {
+      throw SystemProxyError.noCurrentNetworkSet
+    }
+    guard let locationID = SCNetworkSetGetSetID(set) as String? else {
+      throw SystemProxyError.noCurrentNetworkSet
+    }
+    return try serviceSnapshots(in: set, locationID: locationID)
+  }
+
+  private static func allServiceSnapshots(
+    in preferences: SCPreferences
+  ) throws -> [ServiceSnapshot] {
+    guard let sets = SCNetworkSetCopyAll(preferences) as? [SCNetworkSet], !sets.isEmpty else {
+      throw SystemProxyError.noNetworkLocations
+    }
+    return try sets.flatMap { set -> [ServiceSnapshot] in
+      guard let locationID = SCNetworkSetGetSetID(set) as String? else {
+        return [ServiceSnapshot]()
+      }
+      return try serviceSnapshots(in: set, locationID: locationID)
+    }
+  }
+
+  private static func serviceSnapshots(
+    in set: SCNetworkSet, locationID: String
+  ) throws -> [ServiceSnapshot] {
+    guard let services = SCNetworkSetCopyServices(set) as? [SCNetworkService] else {
+      return []
+    }
+    return try services.compactMap { service in
+      guard let serviceID = SCNetworkServiceGetServiceID(service) as String? else { return nil }
+      let proxyProtocol = SCNetworkServiceCopyProtocol(service, kSCNetworkProtocolTypeProxies)
+      let configurationValue: CFPropertyList?
+      if let proxyProtocol {
+        configurationValue = SCNetworkProtocolGetConfiguration(proxyProtocol)
+      } else {
+        configurationValue = nil
+      }
+      return ServiceSnapshot(
+        identifier: SystemProxyServiceIdentifier(
+          locationID: locationID, serviceID: serviceID),
+        networkService: service,
+        proxyProtocol: proxyProtocol,
+        configuration: try propertyListData(from: configurationValue, serviceID: serviceID))
+    }
+  }
+
+  private static func propertyListData(
+    from value: CFPropertyList?, serviceID: String
+  ) throws -> Data? {
+    guard let value else { return nil }
+    guard let dictionary = value as? [String: Any] else {
+      throw SystemProxyError.unreadableService(serviceID)
+    }
+    return try SystemProxyPlanner.propertyListData(from: dictionary, serviceID: serviceID)
+  }
+
+  private static func setConfiguration(_ data: Data?, on proxyProtocol: SCNetworkProtocol) -> Bool {
+    guard let data else { return SCNetworkProtocolSetConfiguration(proxyProtocol, nil) }
+    guard
+      let propertyList = try? PropertyListSerialization.propertyList(
+        from: data, options: [], format: nil),
+      let dictionary = propertyList as? [String: Any]
+    else { return false }
+    return SCNetworkProtocolSetConfiguration(proxyProtocol, dictionary as CFDictionary)
+  }
+
+  private static func commitAndApply(_ preferences: SCPreferences) throws {
+    guard SCPreferencesCommitChanges(preferences) else {
+      throw SystemProxyError.commitFailed(systemConfigurationError())
+    }
+    guard SCPreferencesApplyChanges(preferences) else {
+      throw SystemProxyError.applyFailed(systemConfigurationError())
+    }
+  }
+
+  private static func systemConfigurationError() -> String {
+    String(cString: SCErrorString(SCError()))
+  }
+}
+
+private func lockPreferencesOrThrow(_ preferences: SCPreferences) throws {
+  guard SCPreferencesLock(preferences, true) else {
+    throw SystemProxyError.preferencesBusy
+  }
+}
diff --git a/ShadowsocksX-NG2/SystemProxyHelper/main.swift b/ShadowsocksX-NG2/SystemProxyHelper/main.swift
new file mode 100644
index 000000000..9f6d95f9c
--- /dev/null
+++ b/ShadowsocksX-NG2/SystemProxyHelper/main.swift
@@ -0,0 +1,14 @@
+import Foundation
+
+// 特权系统代理 helper 入口：随 app 打包、经 SMAppService.daemon
+// 注册的 on-demand LaunchDaemon。launchd 以 MachServices 键按需拉起本进程，
+// GUI 侧每次连接到固定 MachService 名即触发激活。
+let delegate = SystemProxyHelperListenerDelegate(
+  engine: SystemProxyHelperEngine(perform: SystemProxyWriter.perform))
+let listener = NSXPCListener(machServiceName: SystemProxyHelperIdentity.machServiceName)
+listener.delegate = delegate
+listener.resume()
+// 拉起就绪事件只进统一日志（ADR-0047）：launchd 丢弃本进程 stdout/stderr，
+// 这是「helper 是否被拉起」的唯一痕迹。
+SystemProxyHelperLog.emit(.listenerReady)
+dispatchMain()
diff --git a/ShadowsocksX-NG2/Taskfile.dist.yml b/ShadowsocksX-NG2/Taskfile.dist.yml
new file mode 100644
index 000000000..2cf5fd7ab
--- /dev/null
+++ b/ShadowsocksX-NG2/Taskfile.dist.yml
@@ -0,0 +1,239 @@
+# https://taskfile.dev/
+version: '3'
+
+includes:
+  packaging:
+    taskfile: ./Taskfile.package.yml
+    flatten: true
+  publishing:
+    taskfile: ./Taskfile.publish.yml
+    flatten: true
+
+vars:
+  PROJECT_NAME: "ShadowsocksX-NG2"
+  BUILD_DIR: "{{ .TASKFILE_DIR }}/.build"
+  DERIVED_DATA_DIR: '{{default (printf "%s/derivedData" .BUILD_DIR) .DERIVED_DATA_DIR}}'
+  RELEASE_VERSION_PATTERN: '^v?[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'
+  TEST_TIMEOUT_ARGS: '-test-timeouts-enabled YES -default-test-execution-time-allowance 120 -maximum-test-execution-time-allowance 300'
+
+tasks:
+  validate:
+    desc: 'Run validation gates in order and retain logs/results; stop on first failure'
+    dir: '{{.TASKFILE_DIR}}'
+    silent: true
+    vars:
+      GATES: '{{default "lint test build" .CLI_ARGS | trim}}'
+      RUN_DIR:
+        sh: |
+          mkdir -p {{.BUILD_DIR | shellQuote}}/validation
+          mktemp -d {{.BUILD_DIR | shellQuote}}/validation/$(date -u +%Y%m%dT%H%M%SZ)-XXXXXX
+    preconditions:
+      - sh: '{{if regexMatch "^(format:check|lint|test|test:smoke|build)( (format:check|lint|test|test:smoke|build))*$" .GATES}}true{{else}}false{{end}}'
+        msg: 'Choose validation gates: format:check, lint, test, test:smoke, build (space separated).'
+      - sh: '{{if eq (len (splitList " " .GATES)) (len (uniq (splitList " " .GATES)))}}true{{else}}false{{end}}'
+        msg: 'Choose each validation gate at most once.'
+    cmds:
+      - defer:
+          task: validate:summary
+          vars:
+            RUN_DIR: '{{.RUN_DIR}}'
+            GATES: '{{.GATES}}'
+            CODE: '{{default "0" .EXIT_CODE}}'
+      - "printf '%s\n' {{printf \"Validation results: %s\" .RUN_DIR | shellQuote}}"
+      - for: {var: GATES, split: ' '}
+        task: validate:gate
+        vars:
+          RUN_DIR: '{{.RUN_DIR}}'
+          GATE: '{{.ITEM}}'
+
+  validate:gate:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    silent: true
+    vars:
+      GATE_DIR: '{{.RUN_DIR}}/{{.GATE | replace ":" "-"}}'
+    cmds:
+      - mkdir -p {{.GATE_DIR | shellQuote}}
+      - defer:
+          task: validate:result
+          vars:
+            GATE: '{{.GATE}}'
+            GATE_DIR: '{{.GATE_DIR}}'
+            CODE: '{{default "0" .EXIT_CODE}}'
+      - "printf '%s\n' {{printf \"[%s] running; log: %s/raw.log\" .GATE .GATE_DIR | shellQuote}}"
+      - >-
+        task --exit-code --taskfile {{.TASKFILE_DIR | shellQuote}}/Taskfile.dist.yml {{.GATE | shellQuote}}
+        RESULT_BUNDLE_PATH={{.GATE_DIR | shellQuote}}/result.xcresult
+        > {{.GATE_DIR | shellQuote}}/raw.log 2>&1
+
+  validate:result:
+    internal: true
+    silent: true
+    cmds:
+      - |
+        status=failed
+        if [ {{.CODE | shellQuote}} = 0 ]; then status=passed; fi
+        echo "[{{.GATE}}] $status; exit={{.CODE}}" > {{.GATE_DIR | shellQuote}}/status.txt
+      - cmd: |
+          {{if and (ne .GATE "lint") (ne .GATE "format:check")}}
+          if [ ! -d {{.GATE_DIR | shellQuote}}/result.xcresult ]; then
+            echo '[{{.GATE}}] evidence incomplete: result bundle missing; test counts unknown' >> {{.GATE_DIR | shellQuote}}/status.txt
+          {{if ne .GATE "build"}}
+          elif xcrun xcresulttool get test-results summary --path {{.GATE_DIR | shellQuote}}/result.xcresult > {{.GATE_DIR | shellQuote}}/test-summary.json 2> {{.GATE_DIR | shellQuote}}/test-summary.stderr.log; then
+            if passed=$(plutil -extract passedTests raw -expect integer {{.GATE_DIR | shellQuote}}/test-summary.json) &&
+               failed=$(plutil -extract failedTests raw -expect integer {{.GATE_DIR | shellQuote}}/test-summary.json) &&
+               skipped=$(plutil -extract skippedTests raw -expect integer {{.GATE_DIR | shellQuote}}/test-summary.json) &&
+               expected=$(plutil -extract expectedFailures raw -expect integer {{.GATE_DIR | shellQuote}}/test-summary.json) &&
+               total=$(plutil -extract totalTestCount raw -expect integer {{.GATE_DIR | shellQuote}}/test-summary.json); then
+              echo "[{{.GATE}}] tests: passed=$passed failed=$failed skipped=$skipped expectedFailures=$expected total=$total" >> {{.GATE_DIR | shellQuote}}/status.txt
+            else
+              printf '%s\n' "$passed" "$failed" "$skipped" "$expected" "$total" >> {{.GATE_DIR | shellQuote}}/count-reader.log
+              echo '[{{.GATE}}] evidence incomplete: invalid test summary; test counts unknown (see count-reader.log)' >> {{.GATE_DIR | shellQuote}}/status.txt
+            fi 2> {{.GATE_DIR | shellQuote}}/count-reader.log
+          else
+            echo '[{{.GATE}}] evidence incomplete: xcresulttool failed; test counts unknown (see test-summary.stderr.log)' >> {{.GATE_DIR | shellQuote}}/status.txt
+          {{end}}
+          fi
+          {{end}}
+      - cat {{.GATE_DIR | shellQuote}}/status.txt
+
+  validate:summary:
+    internal: true
+    silent: true
+    cmds:
+      - |
+        echo 'Validation command exit={{.CODE}}' > {{.RUN_DIR | shellQuote}}/summary.txt
+        echo 'Selected gates: {{.GATES}}' >> {{.RUN_DIR | shellQuote}}/summary.txt
+      - for: {var: GATES, split: ' '}
+        cmd: |
+          if [ -f {{.RUN_DIR | shellQuote}}/{{.ITEM | replace ":" "-"}}/status.txt ]; then
+            cat {{.RUN_DIR | shellQuote}}/{{.ITEM | replace ":" "-"}}/status.txt >> {{.RUN_DIR | shellQuote}}/summary.txt
+          else
+            echo '[{{.ITEM}}] not_run' >> {{.RUN_DIR | shellQuote}}/summary.txt
+          fi
+      - cat {{.RUN_DIR | shellQuote}}/summary.txt
+      - "printf '%s\n' {{printf \"Summary: %s/summary.txt\" .RUN_DIR | shellQuote}}"
+
+  gen:prj:
+    desc: 'Generate xcode project by xcodegen'
+    cmds:
+      - xcodegen generate
+
+  build:
+    desc: Build the ShadowsocksX-NG2 macOS application with Debug Config
+    vars:
+      BUILD_DESTINATION: '{{default "platform=macOS,arch=arm64" .BUILD_DESTINATION}}'
+    deps:
+      - gen:prj
+    cmds:
+      - >-
+        xcodebuild
+        -project ShadowsocksX-NG2.xcodeproj
+        -scheme ShadowsocksX-NG2
+        -configuration Debug
+        -destination {{.BUILD_DESTINATION | shellQuote}}
+        -derivedDataPath {{.DERIVED_DATA_DIR | shellQuote}}
+        {{if .RESULT_BUNDLE_PATH}}-resultBundlePath {{.RESULT_BUNDLE_PATH | shellQuote}}{{end}}
+        SWIFT_SUPPRESS_WARNINGS=NO SWIFT_TREAT_WARNINGS_AS_ERRORS={{if .BUILD_ALLOW_DEPRECATED}}NO{{else}}YES{{end}} GCC_TREAT_WARNINGS_AS_ERRORS=YES
+        {{if .BUILD_ALLOW_DEPRECATED}}OTHER_SWIFT_FLAGS='-warnings-as-errors -Wwarning DeprecatedDeclaration'{{end}}
+        build
+
+  build:release:
+    desc: Build the ShadowsocksX-NG2 macOS application with Release Config
+    requires:
+      vars: [MARKETING_VERSION, CURRENT_PROJECT_VERSION]
+    vars:
+      BUNDLE_MARKETING_VERSION: '{{regexFind "[0-9]+\\.[0-9]+\\.[0-9]+" (default "" .MARKETING_VERSION)}}'
+    preconditions:
+      - sh: '{{if regexMatch .RELEASE_VERSION_PATTERN .MARKETING_VERSION}}true{{else}}false{{end}}'
+        msg: 'MARKETING_VERSION must be a release version (for example, 2.1.0 or v2.0.0-alpha-1).'
+      - sh: '{{if regexMatch "^[0-9]+(\\.[0-9]+){0,2}$" .CURRENT_PROJECT_VERSION}}true{{else}}false{{end}}'
+        msg: 'CURRENT_PROJECT_VERSION must have one to three numeric components.'
+    cmds:
+      - task: gen:prj
+      - >-
+        xcodebuild
+        -project ShadowsocksX-NG2.xcodeproj
+        -scheme ShadowsocksX-NG2
+        -configuration Release
+        -destination 'platform=macOS,arch=arm64'
+        -derivedDataPath {{.DERIVED_DATA_DIR | shellQuote}}
+        {{printf "MARKETING_VERSION=%s" .BUNDLE_MARKETING_VERSION | shellQuote}}
+        {{printf "CURRENT_PROJECT_VERSION=%s" .CURRENT_PROJECT_VERSION | shellQuote}}
+        SWIFT_SUPPRESS_WARNINGS=NO SWIFT_TREAT_WARNINGS_AS_ERRORS=YES GCC_TREAT_WARNINGS_AS_ERRORS=YES
+        build
+
+  format:
+    desc: 'Format the code by swift-format'
+    cmds:
+      - swift format format --in-place --recursive --configuration .swift-format App Tests Domain Agent
+
+  format:check:
+    desc: 'Check Swift formatting without modifying files'
+    cmds:
+      - swift format lint --strict --recursive --configuration .swift-format App Tests Domain Agent
+
+  lint:
+    desc: 'Lint the swift code by swiftlint'
+    cmds:
+      - swiftlint lint --strict --config .swiftlint.yml --no-cache
+  
+  lint:fix:
+    desc: 'Automatically fix SwiftLint violations'
+    cmds:
+      - swiftlint lint --fix --strict --config .swiftlint.yml --no-cache
+  
+  test:
+    desc: 'Run conversion and unit tests'
+    deps:
+      - gen:prj
+    cmds:
+      - task: test:binaries
+      - task: test:rules
+      - task: test:metadata
+      - >-
+        xcodebuild
+        -project ShadowsocksX-NG2.xcodeproj
+        -scheme ShadowsocksX-NG2
+        -destination 'platform=macOS,arch=arm64'
+        -derivedDataPath {{.DERIVED_DATA_DIR | shellQuote}}
+        {{if .RESULT_BUNDLE_PATH}}-resultBundlePath {{.RESULT_BUNDLE_PATH | shellQuote}}{{end}}
+        {{.TEST_TIMEOUT_ARGS}}
+        SWIFT_SUPPRESS_WARNINGS=NO SWIFT_TREAT_WARNINGS_AS_ERRORS=YES GCC_TREAT_WARNINGS_AS_ERRORS=YES
+        test
+
+  test:binaries:
+    desc: 'Verify pinned external binary downloads with local assets'
+    cmds:
+      - PYTHONDONTWRITEBYTECODE=1 python3 Scripts/test-external-binary-fetch.py
+
+  test:metadata:
+    desc: 'Verify offline dependency metadata generation and rejection paths'
+    cmds:
+      - PYTHONDONTWRITEBYTECODE=1 python3 Scripts/test-dependency-metadata.py
+
+  test:rules:
+    desc: 'Run offline rule conversion and generated fixture checks'
+    cmds:
+      - PYTHONDONTWRITEBYTECODE=1 python3 Scripts/test-rule-snapshot-converters.py
+      - PYTHONDONTWRITEBYTECODE=1 python3 Scripts/test-rule-conversion-behavior.py
+
+  test:smoke:
+    desc: 'Run real-process smoke tests (real sslocal; release gate)'
+    deps:
+      - gen:prj
+    cmds:
+      - >-
+        xcodebuild
+        -project ShadowsocksX-NG2.xcodeproj
+        -scheme ShadowsocksX-NG2Smoke
+        -destination 'platform=macOS,arch=arm64'
+        -derivedDataPath {{.DERIVED_DATA_DIR | shellQuote}}
+        {{if .RESULT_BUNDLE_PATH}}-resultBundlePath {{.RESULT_BUNDLE_PATH | shellQuote}}{{end}}
+        {{.TEST_TIMEOUT_ARGS}}
+        SWIFT_SUPPRESS_WARNINGS=NO SWIFT_TREAT_WARNINGS_AS_ERRORS=YES GCC_TREAT_WARNINGS_AS_ERRORS=YES
+        test
+
+  clean:
+    cmds:
+      - rm -rf {{ .BUILD_DIR }}
diff --git a/ShadowsocksX-NG2/Taskfile.package.yml b/ShadowsocksX-NG2/Taskfile.package.yml
new file mode 100644
index 000000000..746935ba0
--- /dev/null
+++ b/ShadowsocksX-NG2/Taskfile.package.yml
@@ -0,0 +1,199 @@
+# https://taskfile.dev/
+version: '3'
+
+vars:
+  DIST_DIR: '{{.TASKFILE_DIR}}/dist'
+  DMG_REQUIREMENT: '=anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.13] exists'
+
+tasks:
+  package:
+    desc: Build, sign, notarize and publish an arm64 Release DMG
+    dir: '{{.TASKFILE_DIR}}'
+    requires:
+      vars: [NOTARY_PROFILE, MARKETING_VERSION, CURRENT_PROJECT_VERSION]
+    preconditions:
+      - sh: 'test -n {{.NOTARY_PROFILE | shellQuote}}'
+        msg: 'NOTARY_PROFILE must name credentials stored by notarytool store-credentials.'
+      - sh: '{{if regexMatch .RELEASE_VERSION_PATTERN .MARKETING_VERSION}}true{{else}}false{{end}}'
+        msg: 'MARKETING_VERSION must be a release version (for example, 2.1.0 or v2.0.0-alpha-1).'
+      - sh: '{{if regexMatch "^[0-9]+(\\.[0-9]+){0,2}$" .CURRENT_PROJECT_VERSION}}true{{else}}false{{end}}'
+        msg: 'CURRENT_PROJECT_VERSION must have one to three numeric components.'
+      - sh: 'test ! -e {{.RELEASE_PATH | shellQuote}} && test ! -L {{.RELEASE_PATH | shellQuote}}'
+        msg: 'This release already exists in dist; existing releases are never overwritten: {{.RELEASE_PATH}}'
+    vars:
+      RELEASE_PATH: '{{.DIST_DIR}}/ShadowsocksX-NG2-{{.MARKETING_VERSION}}-{{.CURRENT_PROJECT_VERSION}}-arm64.dmg'
+      RUN_DIR:
+        sh: |
+          mkdir -p {{.BUILD_DIR | shellQuote}}/packaging
+          mktemp -d {{.BUILD_DIR | shellQuote}}/packaging/run-XXXXXX
+    cmds:
+      - 'printf "Packaging workspace: %s\n" {{.RUN_DIR | shellQuote}}'
+      - for: [xcodebuild, xcodegen, hdiutil, codesign, ditto, plutil, shasum, spctl, link]
+        cmd: 'command -v {{.ITEM}} > /dev/null'
+      - xcrun --find stapler
+      - >-
+        xcrun notarytool history --keychain-profile {{.NOTARY_PROFILE | shellQuote}}
+        --output-format json > {{.RUN_DIR | shellQuote}}/notary-history.json
+      - Scripts/fetch-external-binaries.sh
+      - task: test:smoke
+        vars:
+          DERIVED_DATA_DIR: '{{.RUN_DIR}}/derivedData'
+          RESULT_BUNDLE_PATH: '{{.RUN_DIR}}/smoke.xcresult'
+      - task: build:release
+        vars:
+          DERIVED_DATA_DIR: '{{.RUN_DIR}}/derivedData'
+      - task: package:image
+        vars:
+          RUN_DIR: '{{.RUN_DIR}}'
+          APP_PATH: '{{.RUN_DIR}}/derivedData/Build/Products/Release/ShadowsocksX-NG2.app'
+
+  package:image:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    requires:
+      vars: [MARKETING_VERSION]
+    vars:
+      APP_VERSION:
+        sh: plutil -extract CFBundleShortVersionString raw -expect string -o - {{.APP_PATH | shellQuote}}/Contents/Info.plist
+      APP_BUILD:
+        sh: plutil -extract CFBundleVersion raw -expect string -o - {{.APP_PATH | shellQuote}}/Contents/Info.plist
+      IMAGE_VERSION: '{{.MARKETING_VERSION}}'
+      IMAGE_NAME: 'ShadowsocksX-NG2-{{.IMAGE_VERSION}}-{{.APP_BUILD}}-arm64.dmg'
+      IMAGE_PATH: '{{.RUN_DIR}}/{{.IMAGE_NAME}}'
+    preconditions:
+      - sh: '{{if regexMatch "^[0-9]+\\.[0-9]+\\.[0-9]+$" .APP_VERSION}}true{{else}}false{{end}}'
+        msg: 'Built App has an invalid CFBundleShortVersionString.'
+      - sh: '{{if regexMatch "^[0-9]+(\\.[0-9]+){0,2}$" .APP_BUILD}}true{{else}}false{{end}}'
+        msg: 'Built App has an invalid CFBundleVersion.'
+      - sh: '{{if and (regexMatch .RELEASE_VERSION_PATTERN .IMAGE_VERSION) (eq (regexFind "[0-9]+\\.[0-9]+\\.[0-9]+" .IMAGE_VERSION) .APP_VERSION)}}true{{else}}false{{end}}'
+        msg: 'Release version must be valid and match the built App version.'
+      - sh: 'test ! -e {{printf "%s/%s" .DIST_DIR .IMAGE_NAME | shellQuote}} && test ! -L {{printf "%s/%s" .DIST_DIR .IMAGE_NAME | shellQuote}}'
+        msg: 'This release already exists in dist; existing releases are never overwritten.'
+    cmds:
+      - Scripts/packaging-gate.sh {{.APP_PATH | shellQuote}}
+      - mkdir {{.RUN_DIR | shellQuote}}/stage
+      - ditto {{.APP_PATH | shellQuote}} {{.RUN_DIR | shellQuote}}/stage/ShadowsocksX-NG2.app
+      - ln -s /Applications {{.RUN_DIR | shellQuote}}/stage/Applications
+      - >-
+        hdiutil create -volname ShadowsocksX-NG2 -format UDZO
+        -srcfolder {{.RUN_DIR | shellQuote}}/stage {{.IMAGE_PATH | shellQuote}}
+      - codesign --display {{printf "--extract-certificates=%s/signing-" .RUN_DIR | shellQuote}} {{.APP_PATH | shellQuote}}
+      - task: package:sign
+        vars:
+          RUN_DIR: '{{.RUN_DIR}}'
+          DMG_PATH: '{{.IMAGE_PATH}}'
+      - task: package:notarize
+        vars:
+          DMG_PATH: '{{.IMAGE_PATH}}'
+
+  package:sign:
+    internal: true
+    vars:
+      CERTIFICATE_HASH:
+        sh: shasum -a 1 {{.RUN_DIR | shellQuote}}/signing-0
+      IDENTITY: '{{first (splitList " " .CERTIFICATE_HASH)}}'
+    preconditions:
+      - sh: '{{if regexMatch "^[0-9a-fA-F]{40}$" .IDENTITY}}true{{else}}false{{end}}'
+        msg: 'Cannot identify the certificate that signed the App.'
+    cmds:
+      - >-
+        codesign --sign {{.IDENTITY | shellQuote}} --timestamp
+        --identifier com.qiuyuzhou.ShadowsocksX-NG2.dmg {{.DMG_PATH | shellQuote}}
+
+  package:notarize:
+    desc: Notarize a signed DMG, staple its ticket and publish after verification
+    dir: '{{.TASKFILE_DIR}}'
+    requires:
+      vars: [DMG_PATH, NOTARY_PROFILE]
+    preconditions:
+      - sh: 'test -n {{.NOTARY_PROFILE | shellQuote}}'
+        msg: 'NOTARY_PROFILE must name credentials stored by notarytool store-credentials.'
+      - sh: '{{if and (hasPrefix "/" .DMG_PATH) (hasSuffix ".dmg" .DMG_PATH)}}true{{else}}false{{end}}'
+        msg: 'DMG_PATH must be an absolute path ending in .dmg.'
+      - sh: 'test -f {{.DMG_PATH | shellQuote}}'
+        msg: 'DMG_PATH does not name a file.'
+      - sh: 'test ! -e {{printf "%s/%s" .DIST_DIR (base .DMG_PATH) | shellQuote}} && test ! -L {{printf "%s/%s" .DIST_DIR (base .DMG_PATH) | shellQuote}}'
+        msg: 'This release already exists in dist; existing releases are never overwritten.'
+    vars:
+      LOG_DIR:
+        sh: |
+          mkdir -p {{.BUILD_DIR | shellQuote}}/notarization
+          mktemp -d {{.BUILD_DIR | shellQuote}}/notarization/run-XXXXXX
+    cmds:
+      - 'printf "Notarization evidence: %s\n" {{.LOG_DIR | shellQuote}}'
+      - codesign --verify --strict -R {{.DMG_REQUIREMENT | shellQuote}} {{.DMG_PATH | shellQuote}}
+      - shasum -a 256 {{.DMG_PATH | shellQuote}} > {{.LOG_DIR | shellQuote}}/input.sha256
+      - >-
+        xcrun notarytool submit {{.DMG_PATH | shellQuote}}
+        --keychain-profile {{.NOTARY_PROFILE | shellQuote}} --output-format json
+        > {{.LOG_DIR | shellQuote}}/submission.json
+        2> {{.LOG_DIR | shellQuote}}/submission.stderr.log
+      - task: package:wait
+        vars:
+          LOG_DIR: '{{.LOG_DIR}}'
+      - xcrun stapler staple {{.DMG_PATH | shellQuote}}
+      - xcrun stapler validate {{.DMG_PATH | shellQuote}}
+      - codesign --verify --strict -R {{.DMG_REQUIREMENT | shellQuote}} {{.DMG_PATH | shellQuote}}
+      - spctl --assess --type open --context context:primary-signature --verbose {{.DMG_PATH | shellQuote}}
+      - task: package:publish
+        vars:
+          DMG_PATH: '{{.DMG_PATH}}'
+
+  package:wait:
+    internal: true
+    vars:
+      SUBMISSION_ID:
+        sh: plutil -extract id raw -expect string -o - {{.LOG_DIR | shellQuote}}/submission.json
+    preconditions:
+      - sh: '{{if regexMatch "^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$" .SUBMISSION_ID}}true{{else}}false{{end}}'
+        msg: 'No valid notarization submission ID; inspect submission.json and submission.stderr.log.'
+    cmds:
+      - defer:
+          task: package:notary-log
+          vars:
+            SUBMISSION_ID: '{{.SUBMISSION_ID}}'
+            LOG_DIR: '{{.LOG_DIR}}'
+      - >-
+        xcrun notarytool wait {{.SUBMISSION_ID | shellQuote}} --timeout 30m
+        --keychain-profile {{.NOTARY_PROFILE | shellQuote}} --output-format json
+        > {{.LOG_DIR | shellQuote}}/result.json
+        2> {{.LOG_DIR | shellQuote}}/wait.stderr.log
+      - task: package:accepted
+        vars:
+          LOG_DIR: '{{.LOG_DIR}}'
+
+  package:accepted:
+    internal: true
+    vars:
+      NOTARY_STATUS:
+        sh: plutil -extract status raw -expect string -o - {{.LOG_DIR | shellQuote}}/result.json
+    preconditions:
+      - sh: '{{if eq .NOTARY_STATUS "Accepted"}}true{{else}}false{{end}}'
+        msg: 'Apple did not accept this submission; inspect result.json and notary-log.json.'
+    cmds:
+      - 'printf "Notarization status: %s\n" {{.NOTARY_STATUS | shellQuote}}'
+
+  package:notary-log:
+    internal: true
+    cmds:
+      - cmd: >-
+          xcrun notarytool log {{.SUBMISSION_ID | shellQuote}}
+          --keychain-profile {{.NOTARY_PROFILE | shellQuote}}
+          {{.LOG_DIR | shellQuote}}/notary-log.json
+          2> {{.LOG_DIR | shellQuote}}/notary-log.stderr.log
+        ignore_error: true
+
+  package:publish:
+    internal: true
+    vars:
+      PUBLISH_DIR:
+        sh: |
+          mkdir -p {{.DIST_DIR | shellQuote}}
+          mktemp -d {{.DIST_DIR | shellQuote}}/.package-XXXXXX
+      OUTPUT_PATH: '{{.DIST_DIR}}/{{base .DMG_PATH}}'
+    cmds:
+      - defer: 'rm -rf {{.PUBLISH_DIR | shellQuote}}'
+      - ditto {{.DMG_PATH | shellQuote}} {{.PUBLISH_DIR | shellQuote}}/release.dmg
+      # Linking within dist publishes a complete file atomically and refuses replacement.
+      - link {{.PUBLISH_DIR | shellQuote}}/release.dmg {{.OUTPUT_PATH | shellQuote}}
+      - 'printf "Release DMG: %s\n" {{.OUTPUT_PATH | shellQuote}}'
diff --git a/ShadowsocksX-NG2/Taskfile.publish.yml b/ShadowsocksX-NG2/Taskfile.publish.yml
new file mode 100644
index 000000000..52fd4f0c4
--- /dev/null
+++ b/ShadowsocksX-NG2/Taskfile.publish.yml
@@ -0,0 +1,241 @@
+# https://taskfile.dev/
+version: '3'
+
+vars:
+  PUBLISH_TAG: 'v{{trimPrefix "v" (default "" .MARKETING_VERSION)}}'
+  PUBLISH_DMG: '{{.TASKFILE_DIR}}/dist/ShadowsocksX-NG2-{{default "" .MARKETING_VERSION}}-{{default "" .CURRENT_PROJECT_VERSION}}-arm64.dmg'
+  PUBLISH_MERGE_MESSAGE: 'chore(release): merge {{.PUBLISH_TAG}} into master'
+
+tasks:
+  publish:
+    desc: Push a release tag, merge develop into master, and open a GitHub draft with the packaged DMG
+    dir: '{{.TASKFILE_DIR}}'
+    requires:
+      vars: [MARKETING_VERSION, CURRENT_PROJECT_VERSION]
+    vars:
+      GIT_COMMON_DIR:
+        sh: git rev-parse --git-common-dir
+    preconditions:
+      - sh: '{{regexMatch .RELEASE_VERSION_PATTERN .MARKETING_VERSION}}'
+        msg: 'MARKETING_VERSION must be a release version, such as 2.1.0 or v2.1.0-rc.1.'
+      - sh: '{{regexMatch "^[0-9]+(\\.[0-9]+){0,2}$" .CURRENT_PROJECT_VERSION}}'
+        msg: 'CURRENT_PROJECT_VERSION must have one to three numeric components.'
+      - sh: 'test -f {{.PUBLISH_DMG | shellQuote}} && test ! -L {{.PUBLISH_DMG | shellQuote}}'
+        msg: 'Run package with exactly the same version parameters first.'
+      - sh: '{{if default "" .RELEASE_NOTES_FILE}}test -f {{.RELEASE_NOTES_FILE | shellQuote}} && test -r {{.RELEASE_NOTES_FILE | shellQuote}}{{else}}true{{end}}'
+        msg: 'RELEASE_NOTES_FILE must name a readable file.'
+      - sh: 'test "$(git branch --show-current)" = develop && test -z "$(git status --porcelain)"'
+        msg: 'Run publish from a clean develop branch, including no untracked files.'
+      - sh: |
+          for state in MERGE_HEAD CHERRY_PICK_HEAD REVERT_HEAD rebase-merge rebase-apply; do
+            test ! -e "$(git rev-parse --git-path "$state")" || exit 1
+          done
+        msg: 'Finish or abort the existing Git operation before publishing.'
+    cmds:
+      - for: [git, gh, shasum, cmp]
+        cmd: 'command -v {{.ITEM}} > /dev/null'
+      - 'mkdir {{printf "%s/ng2-publish.lock" .GIT_COMMON_DIR | shellQuote}}'
+      - defer: 'rmdir {{printf "%s/ng2-publish.lock" .GIT_COMMON_DIR | shellQuote}}'
+      - git fetch --no-tags origin +refs/heads/develop:refs/remotes/origin/develop +refs/heads/master:refs/remotes/origin/master
+      - task: publish:inspect-git
+
+  publish:inspect-git:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    vars:
+      COMMIT:
+        sh: git rev-parse refs/heads/develop
+      MASTER:
+        sh: git rev-parse refs/remotes/origin/master
+      FETCH_URL:
+        sh: git remote get-url origin
+      PUSH_URL:
+        sh: git remote get-url --push --all origin
+      REPO: '{{.FETCH_URL | trimPrefix "https://" | trimPrefix "ssh://git@" | trimPrefix "git@" | replace ":" "/" | trimSuffix ".git" | lower}}'
+      PUSH_REPO: '{{.PUSH_URL | trimPrefix "https://" | trimPrefix "ssh://git@" | trimPrefix "git@" | replace ":" "/" | trimSuffix ".git" | lower}}'
+      REMOTE_TAGS:
+        sh: git ls-remote --tags origin {{printf "refs/tags/%s" .PUBLISH_TAG | shellQuote}} {{printf "refs/tags/%s^{}" .PUBLISH_TAG | shellQuote}}
+      # Annotated tags have a final peeled line; lightweight tags have only one line.
+      REMOTE_TAG: '{{regexFind "^[0-9a-f]+" (last (splitList "\n" .REMOTE_TAGS))}}'
+      WORKTREES:
+        sh: git worktree list --porcelain
+      STATE:
+        map:
+          commit: '{{.COMMIT}}'
+          remote_tag: '{{.REMOTE_TAG}}'
+          repo: '{{.REPO}}'
+    preconditions:
+      - sh: '{{and (regexMatch "^[A-Za-z0-9.-]+/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$" .REPO) (eq .REPO .PUSH_REPO)}}'
+        msg: 'origin fetch and push URLs must identify the same single GitHub repository.'
+      - sh: 'test {{.COMMIT | shellQuote}} = "$(git rev-parse refs/remotes/origin/develop)"'
+        msg: 'develop must match origin/develop; synchronize it before publishing.'
+      - sh: '! git show-ref --verify --quiet {{printf "refs/tags/%s" .PUBLISH_TAG | shellQuote}} || test "$(git rev-parse {{printf "refs/tags/%s^{commit}" .PUBLISH_TAG | shellQuote}})" = {{.COMMIT | shellQuote}}'
+        msg: 'The local release tag points to a different commit.'
+      - sh: '{{or (empty .REMOTE_TAG) (eq .REMOTE_TAG .COMMIT)}}'
+        msg: 'The remote release tag points to a different commit.'
+      - sh: |
+          if git show-ref --verify --quiet refs/heads/master; then
+            test "$(git rev-parse master)" = {{.MASTER | shellQuote}} || {
+              test "$(git show -s --format=%P master)" = {{printf "%s %s" .MASTER .COMMIT | shellQuote}} &&
+              test "$(git show -s --format=%B master)" = {{.PUBLISH_MERGE_MESSAGE | shellQuote}}
+            }
+          fi
+        msg: 'Local master must match origin/master or be the pending release merge from a failed push.'
+      - sh: '{{not (regexMatch "(?m)^branch refs/heads/master$" .WORKTREES)}}'
+        msg: 'master is checked out in another worktree; release it before publishing.'
+    cmds:
+      - gh auth status --hostname {{first (splitList "/" .REPO) | shellQuote}}
+      - task: publish:inspect-release
+        vars:
+          STATE:
+            ref: .STATE
+
+  publish:inspect-release:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    vars:
+      RELEASE_PAGES_JSON:
+        sh: >-
+          gh api --hostname {{first (splitList "/" .STATE.repo) | shellQuote}} --paginate --slurp
+          {{printf "repos/%s/releases?per_page=100" (join "/" (rest (splitList "/" .STATE.repo))) | shellQuote}}
+      RELEASE_JSON: |
+        {{- $release := dict -}}
+        {{- range $page := mustFromJson .RELEASE_PAGES_JSON -}}
+          {{- range $page -}}
+            {{- if eq .tag_name $.PUBLISH_TAG -}}
+              {{- if $release -}}{{fail "Duplicate releases"}}{{- end -}}
+              {{- $release = . -}}
+            {{- end -}}
+          {{- end -}}
+        {{- end -}}
+        {{- $dmgs := list -}}
+        {{- range $release.assets -}}
+          {{- if hasSuffix ".dmg" (lower .name) -}}
+            {{- $dmgs = append $dmgs . -}}
+          {{- end -}}
+        {{- end -}}
+        {{- $_ := set $release "dmgs" $dmgs -}}
+        {{- mustToJson $release -}}
+      RELEASE:
+        ref: mustFromJson .RELEASE_JSON
+      ASSET:
+        ref: first .RELEASE.dmgs
+      DMG_CHECKSUM:
+        sh: shasum -a 256 {{.PUBLISH_DMG | shellQuote}}
+    preconditions:
+      # Existing tags determine the released commit; target_commitish is only used to create new tags.
+      - sh: '{{or (not .RELEASE.tag_name) (eq .STATE.remote_tag .STATE.commit) (eq .RELEASE.target_commitish .STATE.commit)}}'
+        msg: 'The existing release targets a different commit.'
+      - sh: '{{or (not .RELEASE.tag_name) (eq .RELEASE.prerelease (contains "-" .MARKETING_VERSION))}}'
+        msg: 'The existing release has a different prerelease flag.'
+      - sh: '{{le (len .RELEASE.dmgs) 1}}'
+        msg: 'The existing release contains conflicting DMG assets.'
+      - sh: '{{or (not .ASSET) (eq .ASSET.name (base .PUBLISH_DMG))}}'
+        msg: 'The existing release contains a different DMG.'
+      - sh: '{{or (not .ASSET) (eq .ASSET.state "uploaded")}}'
+        msg: 'The existing DMG upload is incomplete; resolve it manually.'
+      - sh: '{{or (not .RELEASE.tag_name) .RELEASE.draft (not (empty .ASSET))}}'
+        msg: 'The published release is missing the expected DMG.'
+      - sh: '{{if and .RELEASE.tag_name (not .RELEASE.draft)}}test {{.STATE.remote_tag | shellQuote}} = {{.STATE.commit | shellQuote}} && git merge-base --is-ancestor {{.STATE.commit | shellQuote}} origin/master{{else}}true{{end}}'
+        msg: 'The published release has incomplete Git state; resolve it manually.'
+    cmds:
+      - task: publish:verify-asset
+        if: '{{not (empty .ASSET)}}'
+        vars: &release-context
+          STATE:
+            ref: .STATE
+          RELEASE:
+            ref: .RELEASE
+          ASSET:
+            ref: .ASSET
+          DMG_CHECKSUM: '{{.DMG_CHECKSUM}}'
+      - task: '{{if and (not .RELEASE.tag_name) (not (default "" .RELEASE_NOTES_FILE))}}publish:confirm-generated-notes{{else}}publish:execute{{end}}'
+        vars: *release-context
+
+  publish:verify-asset:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    vars:
+      DOWNLOAD_DIR:
+        sh: mktemp -d "${TMPDIR:-/tmp}/ng2-release-verify.XXXXXX"
+    cmds:
+      - defer: 'rm -rf {{.DOWNLOAD_DIR | shellQuote}}'
+      - gh release download {{.PUBLISH_TAG | shellQuote}} --repo {{.STATE.repo | shellQuote}} --pattern {{base .PUBLISH_DMG | shellQuote}} --dir {{.DOWNLOAD_DIR | shellQuote}}
+      - cmp {{.PUBLISH_DMG | shellQuote}} {{printf "%s/%s" .DOWNLOAD_DIR (base .PUBLISH_DMG) | shellQuote}}
+
+  publish:confirm-generated-notes:
+    internal: true
+    prompt: 'No RELEASE_NOTES_FILE supplied. Use GitHub-generated notes and proceed with tag/master pushes?'
+    cmds:
+      - task: publish:execute
+        vars: *release-context
+
+  publish:execute:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    cmds:
+      - task: publish:tag
+        vars: *release-context
+      - task: publish:master
+        vars: *release-context
+      - 'printf "%s\n" {{.DMG_CHECKSUM | shellQuote}} | shasum -a 256 --check'
+      - task: publish:create-draft
+        vars: *release-context
+      - task: publish:upload
+        vars: *release-context
+      - cmd: 'printf "Release already published and matches this package: %s\n" {{.PUBLISH_TAG | shellQuote}}'
+        if: '{{and .RELEASE.tag_name (not .RELEASE.draft)}}'
+      - gh release view {{.PUBLISH_TAG | shellQuote}} --repo {{.STATE.repo | shellQuote}} --web
+
+  publish:tag:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    status:
+      - '{{not (empty .STATE.remote_tag)}}'
+    cmds:
+      - cmd: git tag -a {{.PUBLISH_TAG | shellQuote}} {{.STATE.commit | shellQuote}} -m {{printf "Release %s" .PUBLISH_TAG | shellQuote}}
+        if: '! git show-ref --verify --quiet {{printf "refs/tags/%s" .PUBLISH_TAG | shellQuote}}'
+      - git push origin {{printf "refs/tags/%s:refs/tags/%s" .PUBLISH_TAG .PUBLISH_TAG | shellQuote}}
+
+  publish:master:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    status:
+      - git merge-base --is-ancestor {{.STATE.commit | shellQuote}} origin/master
+    cmds:
+      - defer: |
+          if [ "$(git branch --show-current)" = master ]; then
+            if [ -z "$(git status --porcelain)" ] && [ ! -e "$(git rev-parse --git-path MERGE_HEAD)" ]; then
+              git switch develop
+            else
+              printf '%s\n' 'Merge state retained on master. Resolve it or run git merge --abort, then git switch develop.' >&2
+            fi
+          fi
+      - cmd: git switch --track -c master origin/master
+        if: '! git show-ref --verify --quiet refs/heads/master'
+      - cmd: git switch master
+        if: 'test "$(git branch --show-current)" != master'
+      - cmd: git merge --no-ff --no-edit -m {{.PUBLISH_MERGE_MESSAGE | shellQuote}} {{.STATE.commit | shellQuote}}
+        if: '! git merge-base --is-ancestor {{.STATE.commit | shellQuote}} master'
+      - git push origin refs/heads/master:refs/heads/master
+      - git switch develop
+
+  publish:create-draft:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    status:
+      - '{{not (empty .RELEASE.tag_name)}}'
+    cmds:
+      - >-
+        gh release create {{.PUBLISH_TAG | shellQuote}} --repo {{.STATE.repo | shellQuote}}
+        --draft --verify-tag --target {{.STATE.commit | shellQuote}} --title {{.PUBLISH_TAG | shellQuote}}
+        {{if contains "-" .MARKETING_VERSION}}--prerelease{{end}}
+        {{if default "" .RELEASE_NOTES_FILE}}--notes-file {{.RELEASE_NOTES_FILE | shellQuote}}{{else}}--generate-notes{{end}}
+
+  publish:upload:
+    internal: true
+    dir: '{{.TASKFILE_DIR}}'
+    status:
+      - '{{not (empty .ASSET)}}'
+    cmds:
+      - gh release upload {{.PUBLISH_TAG | shellQuote}} {{.PUBLISH_DMG | shellQuote}} --repo {{.STATE.repo | shellQuote}}
diff --git a/ShadowsocksX-NG2/Tests/Activation/ActivationFeedbackStateTests.swift b/ShadowsocksX-NG2/Tests/Activation/ActivationFeedbackStateTests.swift
new file mode 100644
index 000000000..c26f02fcd
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Activation/ActivationFeedbackStateTests.swift
@@ -0,0 +1,133 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 激活反馈状态模块单测：单飞互斥、反馈映射与意外错误的双通道（记录
+/// `.failed` + 原样上抛）。命令经 `makeCatalogWorkflow` 假 seam 发出；
+/// pending 态经命令进行中钩子在同任务内观察（不跨任务轮询）。
+@MainActor
+final class ActivationFeedbackStateTests: XCTestCase {
+  private var workDir: URL!
+  private var activator: InFlightObservingActivator!
+  private var workflow: CatalogWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("activation-feedback-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    activator = InFlightObservingActivator()
+    let runtime = FakeCatalogRuntime()
+    runtime.hasActiveTarget = true
+    workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: workDir.appendingPathComponent("catalog.json")),
+        runtime: runtime),
+      activator: activator)
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  func testActivatedOutcomeRecordsSkippedFeedbackAndClearsPending() async throws {
+    let model = ActivationFeedbackState()
+    activator.result = .activated(skippedInvalid: 2)
+    let startedAt = Date()
+    let outcome = try await model.activate(NodeID(rawValue: "a"), via: workflow)
+    XCTAssertEqual(outcome, .activated(skippedInvalid: 2))
+    XCTAssertEqual(model.feedback, .activated(skippedInvalid: 2))
+    let completion = try XCTUnwrap(model.completion)
+    XCTAssertEqual(completion.targetID, NodeID(rawValue: "a"))
+    XCTAssertEqual(completion.feedback, model.feedback)
+    XCTAssertGreaterThanOrEqual(completion.completedAt, startedAt)
+    XCTAssertLessThanOrEqual(completion.completedAt, Date())
+    XCTAssertNil(model.pendingTargetID)
+    XCTAssertFalse(model.isPending)
+  }
+
+  func testRejectedOutcomeFeedbackCarriesTypedReason() async throws {
+    let model = ActivationFeedbackState()
+    let id = NodeID(rawValue: "a")
+    activator.result = .rejectedActivation(.targetNotFound(id))
+    let outcome = try await model.activate(id, via: workflow)
+    XCTAssertEqual(outcome, .rejectedActivation(.targetNotFound(id)))
+    XCTAssertEqual(model.feedback, .rejected(.targetNotFound(id)))
+    XCTAssertEqual(model.completion?.feedback, model.feedback)
+  }
+
+  func testUnexpectedErrorRecordsFailedMessageAndRethrows() async throws {
+    let model = ActivationFeedbackState()
+    let id = NodeID(rawValue: "a")
+    activator.error = CatalogError.nodeNotFound(id)
+    do {
+      _ = try await model.activate(id, via: workflow)
+      XCTFail("意外错误应原样上抛")
+    } catch {
+      XCTAssertEqual(error as? CatalogError, .nodeNotFound(id))
+    }
+    XCTAssertEqual(model.feedback, .failed(message: "节点不存在（可能已被删除）"))
+    XCTAssertEqual(model.completion?.feedback, model.feedback)
+    XCTAssertNil(model.pendingTargetID)
+  }
+
+  func testPendingVisibleInFlightAndSingleFlightIgnoresNewCommand() async throws {
+    let model = ActivationFeedbackState()
+    let id = NodeID(rawValue: "a")
+    var observedPending: NodeID?
+    var observedFeedbackCleared = false
+    var ignoredOutcome: ActivationCommandOutcome??
+    activator.whileInFlight = {
+      observedPending = model.pendingTargetID
+      observedFeedbackCleared = model.feedback == nil && model.completion == nil
+      // 首命令 pending 中的再入：单飞忽略，同步返回 nil。
+      do {
+        ignoredOutcome = .some(
+          try await model.activate(NodeID(rawValue: "b"), via: self.workflow))
+      } catch {
+        XCTFail("单飞忽略路径不应抛错：\(error)")
+      }
+    }
+    activator.result = .activated(skippedInvalid: 0)
+    let outcome = try await model.activate(id, via: workflow)
+    XCTAssertEqual(outcome, .activated(skippedInvalid: 0))
+    XCTAssertEqual(observedPending, id, "命令进行中应可见 pending 目标")
+    XCTAssertTrue(observedFeedbackCleared, "新命令开始即清空旧反馈")
+    XCTAssertEqual(ignoredOutcome, .some(nil), "pending 中的新命令被单飞忽略")
+    XCTAssertNil(model.pendingTargetID)
+  }
+
+  func testFeedbackClearsWhenNextCommandStarts() async throws {
+    let model = ActivationFeedbackState()
+    activator.result = .rejectedActivation(.noActiveTarget)
+    _ = try await model.activate(NodeID(rawValue: "a"), via: workflow)
+    XCTAssertEqual(model.feedback, .rejected(.noActiveTarget))
+
+    let firstCompletionID = model.completion?.id
+    var feedbackAtSecondCommandStart: ActivationFeedbackState.Feedback? = .activated(
+      skippedInvalid: 0)
+    activator.whileInFlight = { feedbackAtSecondCommandStart = model.feedback }
+    activator.result = .activated(skippedInvalid: 1)
+    _ = try await model.activate(NodeID(rawValue: "b"), via: workflow)
+    XCTAssertNil(feedbackAtSecondCommandStart, "第二命令开始时应已清空旧反馈")
+    XCTAssertEqual(model.feedback, .activated(skippedInvalid: 1))
+    XCTAssertNotEqual(model.completion?.id, firstCompletionID)
+  }
+}
+
+/// 命令进行中可挂钩的激活替身：钩子在命令返回结果前同任务执行，用于
+/// 观察 pending 态与再入单飞；错误在钩子前抛出。
+@MainActor
+private final class InFlightObservingActivator: Activating {
+  var result: ActivationCommandOutcome = .activated(skippedInvalid: 0)
+  var error: Error?
+  var whileInFlight: (@MainActor () async -> Void)?
+
+  func activate(_ target: NodeID) async throws -> ActivationCommandOutcome {
+    if let error { throw error }
+    await whileInFlight?()
+    whileInFlight = nil
+    return result
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Activation/ActivationReexpansionTests.swift b/ShadowsocksX-NG2/Tests/Activation/ActivationReexpansionTests.swift
new file mode 100644
index 000000000..5c1d3e9c8
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Activation/ActivationReexpansionTests.swift
@@ -0,0 +1,193 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 目录提交后的立即重展开缝：有效非空 → 原子更新；目标被
+/// 删除/变空/单服务器变无效/无有效叶子 → 清除目标并发出停止意图；分组中的
+/// 无效叶子会被跳过并保留有效子集，点名原因、无静默回退。
+/// 点名原因、无静默回退。
+final class ActivationReexpansionTests: XCTestCase {
+  private var machine = ActivationStateMachine()
+
+  @discardableResult
+  private func activate(
+    _ target: NodeID, in catalog: ConfigurationCatalog
+  ) throws -> RuntimeConfiguration {
+    try ActivationFixture.activate(&machine, target, in: catalog)
+  }
+
+  private func commit(
+    _ catalog: ConfigurationCatalog
+  ) -> ActivationEffect? {
+    ActivationFixture.commit(&machine, catalog)
+  }
+
+  func testCommitWithoutActiveTargetProducesNoEffect() throws {
+    var catalog = ConfigurationCatalog()
+    _ = try ActivationFixture.addPlainServer("a", in: &catalog)
+
+    XCTAssertNil(commit(catalog))
+  }
+
+  func testSubtreeEditReexpandsAndDeploysUpdatedDocumentAtomically() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let leaf = try ActivationFixture.addPlainServer(
+      "a", to: group, in: &catalog)
+    try activate(group, in: catalog)
+
+    var updatedFields = try ActivationFixture.serverFields(of: leaf, in: catalog)
+    updatedFields.address = "198.51.100.9"
+    updatedFields.port = 443
+    updatedFields.password = "new-secret"
+    try catalog.updateServer(leaf, with: updatedFields)
+
+    let configuration = try ActivationFixture.requireDeployed(
+      commit(catalog))
+    XCTAssertEqual(machine.activeTargetID, group, "重展开不改变活动目标")
+    XCTAssertEqual(configuration.targetID, group)
+    XCTAssertEqual(configuration.document.servers[0].server, "198.51.100.9")
+    XCTAssertEqual(configuration.document.servers[0].serverPort, 443)
+    XCTAssertEqual(
+      configuration.document.servers[0].password, "new-secret", "同一引用解析最新秘密")
+  }
+
+  func testDeleteActiveTargetClearsTargetAndEmitsStopIntent() throws {
+    var catalog = ConfigurationCatalog()
+    let leaf = try ActivationFixture.addPlainServer("a", in: &catalog)
+    try activate(leaf, in: catalog)
+
+    try catalog.remove(leaf)
+
+    let failure = try ActivationFixture.requireCleared(commit(catalog))
+    XCTAssertEqual(failure, .targetNotFound(leaf), "点名原因")
+    XCTAssertNil(machine.activeTargetID, "目标被清除")
+    XCTAssertNil(commit(catalog), "清除后不再产生效应")
+  }
+
+  func testInvalidActiveServerClearsTargetAndStops() throws {
+    var catalog = ConfigurationCatalog()
+    let leaf = try ActivationFixture.addPlainServer("a", in: &catalog)
+    try activate(leaf, in: catalog)
+
+    var fields = try ActivationFixture.serverFields(of: leaf, in: catalog)
+    fields.encryptionMethod = "future-cipher"
+    try catalog.updateServer(leaf, with: fields)
+
+    let failure = try ActivationFixture.requireCleared(commit(catalog))
+    XCTAssertEqual(
+      failure, .invalidLeaf(node: leaf, reason: .unsupportedEncryptionMethod("future-cipher")))
+    XCTAssertNil(machine.activeTargetID)
+  }
+
+  func testInvalidLeafInActiveGroupIsSkippedAndKeepsTarget() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let valid = try ActivationFixture.addPlainServer(
+      "a", to: group, in: &catalog)
+    let broken = try ActivationFixture.addPlainServer(
+      "b", to: group, in: &catalog)
+    try activate(group, in: catalog)
+
+    var fields = try ActivationFixture.serverFields(of: broken, in: catalog)
+    fields.encryptionMethod = "future-cipher"
+    try catalog.updateServer(broken, with: fields)
+
+    let configuration = try ActivationFixture.requireDeployed(
+      commit(catalog))
+    XCTAssertEqual(configuration.targetID, group)
+    XCTAssertEqual(configuration.document.servers.map(\.id), [valid.rawValue])
+    XCTAssertEqual(
+      configuration.skippedServers,
+      [SkippedServer(id: broken, reason: .unsupportedEncryptionMethod("future-cipher"))])
+    XCTAssertEqual(machine.activeTargetID, group)
+  }
+
+  func testEmptyingActiveGroupClearsTargetAndStops() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let leaf = try ActivationFixture.addPlainServer(
+      "a", to: group, in: &catalog)
+    try activate(group, in: catalog)
+
+    try catalog.remove(leaf)
+
+    let failure = try ActivationFixture.requireCleared(commit(catalog))
+    XCTAssertEqual(failure, .targetExpandsToNothing(group))
+    XCTAssertNil(machine.activeTargetID)
+  }
+
+  func testUnprovidedPluginIntroducedIntoOnlyActiveGroupLeafClearsTarget() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let leaf = try ActivationFixture.addPlainServer(
+      "a", to: group, in: &catalog)
+    try activate(group, in: catalog)
+
+    var fields = try ActivationFixture.serverFields(of: leaf, in: catalog)
+    fields.pluginProgram = "kcptun"
+    try catalog.updateServer(leaf, with: fields)
+
+    let failure = try ActivationFixture.requireCleared(commit(catalog))
+    XCTAssertEqual(failure, .targetExpandsToNothing(group))
+    XCTAssertNil(machine.activeTargetID)
+  }
+
+  func testEmptyPasswordInActiveSubtreeClearsTargetAndStops() throws {
+    var catalog = ConfigurationCatalog()
+    let leaf = try catalog.addServer(ActivationFixture.plainFields(remark: "a"))
+    _ = try machine.activate(
+      leaf, in: catalog, plugins: ActivationFixture.plugins,
+      options: RuntimeDocumentOptions(listen: ActivationFixture.listen))
+    var fields = try ActivationFixture.serverFields(of: leaf, in: catalog)
+    fields.password = ""
+    try catalog.updateServer(leaf, with: fields)
+    let effect = machine.catalogDidCommit(
+      catalog, plugins: ActivationFixture.plugins,
+      options: RuntimeDocumentOptions(listen: ActivationFixture.listen))
+    let failure = try ActivationFixture.requireCleared(effect)
+    XCTAssertEqual(failure, .invalidLeaf(node: leaf, reason: .missingPassword))
+    XCTAssertNil(machine.activeTargetID)
+
+  }
+
+  func testPriorTargetSurvivesFailedActivationAndStaysDeployableOnCommit() throws {
+    var catalog = ConfigurationCatalog()
+    let valid = try ActivationFixture.addPlainServer("a", in: &catalog)
+    let group = try catalog.addGroup("组")
+    let broken = try ActivationFixture.addPlainServer(
+      "b", to: group, in: &catalog)
+    var brokenFields = try ActivationFixture.serverFields(of: broken, in: catalog)
+    brokenFields.pluginProgram = "kcptun"
+    try catalog.updateServer(broken, with: brokenFields)
+    try activate(valid, in: catalog)
+
+    ActivationFixture.assertThrows(
+      .invalidLeaf(node: broken, reason: .pluginNotProvided(program: "kcptun")),
+      {
+        try activate(broken, in: catalog)
+      })
+
+    let configuration = try ActivationFixture.requireDeployed(
+      commit(catalog))
+    XCTAssertEqual(configuration.targetID, valid, "无静默回退：失败后原目标仍是活动目标")
+    XCTAssertEqual(machine.activeTargetID, valid)
+  }
+
+  func testRestoredTargetRevalidatesOnNextCommit() throws {
+    var catalog = ConfigurationCatalog()
+    let leaf = try ActivationFixture.addPlainServer("a", in: &catalog)
+    let deletedID = NodeID(rawValue: "deleted")
+
+    var restored = ActivationStateMachine(activeTargetID: leaf)
+    let configuration = try ActivationFixture.requireDeployed(
+      ActivationFixture.commit(&restored, catalog))
+    XCTAssertEqual(configuration.targetID, leaf, "恢复的有效目标在下次提交时重放派生（D5 同步）")
+
+    var stale = ActivationStateMachine(activeTargetID: deletedID)
+    let failure = try ActivationFixture.requireCleared(
+      ActivationFixture.commit(&stale, catalog))
+    XCTAssertEqual(failure, .targetNotFound(deletedID), "恢复的失效目标在下次提交时清除并停止")
+    XCTAssertNil(stale.activeTargetID)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Activation/ActivationStateFileStoreTests.swift b/ShadowsocksX-NG2/Tests/Activation/ActivationStateFileStoreTests.swift
new file mode 100644
index 000000000..c10b8b833
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Activation/ActivationStateFileStoreTests.swift
@@ -0,0 +1,93 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 活动目标持久化缝：往返无损、缺失/损坏按安全侧恢复、权限基线。
+final class ActivationStateFileStoreTests: XCTestCase {
+  private var workDir: URL!
+  private var store: ActivationStateFileStore!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("activation-file-store-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    store = ActivationStateFileStore(fileURL: workDir.appendingPathComponent("activation.json"))
+  }
+
+  override func tearDownWithError() throws {
+    try FileManager.default.removeItem(at: workDir)
+    try super.tearDownWithError()
+  }
+
+  // MARK: 缺失与损坏
+
+  func testMissingFileLoadsAsNoActiveTarget() throws {
+    XCTAssertNil(try store.loadActiveTargetID(), "文件缺失按从未激活处理")
+  }
+
+  func testBrokenJSONLoadsAsNoActiveTargetOnTheSafeSide() throws {
+    try "{ not json {{{".write(to: store.fileURL, atomically: true, encoding: .utf8)
+
+    XCTAssertNil(
+      try store.loadActiveTargetID(), "损坏按安全侧恢复：无活动目标，代理保持停止")
+  }
+
+  func testUnknownSchemaVersionLoadsAsNoActiveTarget() throws {
+    let payload = """
+      {"version": 99, "activeTargetID": "s1"}
+      """
+    try payload.write(to: store.fileURL, atomically: true, encoding: .utf8)
+
+    XCTAssertNil(try store.loadActiveTargetID())
+  }
+
+  // MARK: 往返无损
+
+  func testRoundTripPreservesTargetIdentity() throws {
+    let target = NodeID(rawValue: "manual:group-1")
+
+    try store.save(activeTargetID: target)
+
+    XCTAssertEqual(try store.loadActiveTargetID(), target, "目标身份跨持久化无损")
+  }
+
+  func testSavingNilClearsPersistedTarget() throws {
+    try store.save(activeTargetID: NodeID(rawValue: "s1"))
+
+    try store.save(activeTargetID: nil)
+
+    XCTAssertNil(try store.loadActiveTargetID(), "清除即整文件替换，不再残留旧目标")
+  }
+
+  func testDefaultFileURLMatchesRuntimeDirectoryContract() {
+    XCTAssertTrue(
+      ActivationStateFileStore.defaultFileURL().path.hasSuffix(
+        "ShadowsocksX-NG2/configuration/activation.json")
+    )
+  }
+
+  // MARK: 与状态机的生命周期往返
+
+  func testActivationLifecycleRoundTripThroughFileStore() throws {
+    var catalog = ConfigurationCatalog()
+    let leaf = try ActivationFixture.addPlainServer("a", in: &catalog)
+    var machine = ActivationStateMachine()
+    _ = try ActivationFixture.activate(&machine, leaf, in: catalog)
+    try store.save(activeTargetID: machine.activeTargetID)
+
+    // 下次启动：从文件恢复目标，载入目录后立即重校验（「重新校验同步」）。
+    var restored = ActivationStateMachine(activeTargetID: try store.loadActiveTargetID())
+    let configuration = try ActivationFixture.requireDeployed(
+      ActivationFixture.commit(&restored, catalog))
+    XCTAssertEqual(configuration.targetID, leaf, "恢复的目标重放派生")
+
+    // 目标随后失效：清除并停止，持久化同步清空。
+    try catalog.remove(leaf)
+    let failure = try ActivationFixture.requireCleared(
+      ActivationFixture.commit(&restored, catalog))
+    XCTAssertEqual(failure, .targetNotFound(leaf))
+    try store.save(activeTargetID: restored.activeTargetID)
+    XCTAssertNil(try store.loadActiveTargetID(), "清除随持久化落盘，重启不再复活旧目标")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Activation/ActivationStateMachineTests.swift b/ShadowsocksX-NG2/Tests/Activation/ActivationStateMachineTests.swift
new file mode 100644
index 000000000..01ba78091
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Activation/ActivationStateMachineTests.swift
@@ -0,0 +1,187 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 激活主缝测试：单服务器激活、组展开顺序与无效候选过滤、
+/// 原子失败点名原因、组目标身份保持。重展开与清除停止见 ActivationReexpansionTests。
+final class ActivationStateMachineTests: XCTestCase {
+  private var machine = ActivationStateMachine()
+
+  @discardableResult
+  private func activate(
+    _ target: NodeID, in catalog: ConfigurationCatalog
+  ) throws -> RuntimeConfiguration {
+    try ActivationFixture.activate(&machine, target, in: catalog)
+  }
+
+  // MARK: 激活
+
+  func testActivateSingleServerSelectsItAndUsesRecordPassword() throws {
+    var catalog = ConfigurationCatalog()
+    let server = try catalog.addServer(
+      ActivationFixture.plainFields(remark: "香港 01", password: "SECRET-密码"))
+
+    let configuration = try activate(server, in: catalog)
+
+    XCTAssertEqual(machine.activeTargetID, server, "单服务器激活即单选")
+    XCTAssertEqual(configuration.targetID, server)
+    XCTAssertEqual(configuration.document.servers.count, 1)
+    let entry = configuration.document.servers[0]
+    XCTAssertEqual(entry.id, server.rawValue)
+    XCTAssertEqual(entry.server, "203.0.113.7")
+    XCTAssertEqual(entry.serverPort, 8388)
+    XCTAssertEqual(entry.method, "aes-256-gcm")
+    XCTAssertEqual(entry.password, "SECRET-密码", "密码由已提交记录派生")
+    XCTAssertNil(entry.plugin, "无插件时 plugin 字段整体省略")
+    XCTAssertNil(entry.pluginOpts)
+    XCTAssertEqual(configuration.document.socksAddress, "127.0.0.1")
+    XCTAssertEqual(configuration.document.socksPort, 11086)
+    XCTAssertEqual(configuration.document.socksLocal?.inboundProtocol, "socks")
+    XCTAssertEqual(configuration.document.socksMode, "tcp_and_udp")
+  }
+
+  func testActivateGroupExpandsValidLeavesInExplicitOrderAndKeepsGroupIdentity() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("自用")
+    let first = try ActivationFixture.addPlainServer(
+      "a", to: group, in: &catalog)
+    let invalidLeaf = try ActivationFixture.addPlainServer(
+      "b", to: group, in: &catalog)
+    var invalidFields = try ActivationFixture.serverFields(of: invalidLeaf, in: catalog)
+    invalidFields.encryptionMethod = "future-cipher"
+    try catalog.updateServer(invalidLeaf, with: invalidFields)
+    let nested = try catalog.addGroup("嵌套", to: group)
+    let deepFirst = try ActivationFixture.addPlainServer(
+      "c", to: nested, in: &catalog)
+    let deepInvalid = try ActivationFixture.addPlainServer(
+      "d", to: nested, in: &catalog)
+    var deepInvalidFields = try ActivationFixture.serverFields(of: deepInvalid, in: catalog)
+    deepInvalidFields.encryptionMethod = "future-cipher"
+    try catalog.updateServer(deepInvalid, with: deepInvalidFields)
+    let last = try ActivationFixture.addPlainServer(
+      "e", to: group, in: &catalog)
+
+    let configuration = try activate(group, in: catalog)
+
+    XCTAssertEqual(machine.activeTargetID, group)
+    XCTAssertEqual(
+      configuration.targetID, group, "组目标保持组 UUID，不被 sslocal 实际选中的后代替换")
+    XCTAssertEqual(
+      configuration.document.servers.map(\.id),
+      [first.rawValue, deepFirst.rawValue, last.rawValue],
+      "显式子序深度优先展开，已知无效叶子被跳过")
+    XCTAssertEqual(
+      configuration.skippedServers.map(\.id), [invalidLeaf, deepInvalid])
+  }
+
+  func testActivateGroupWithAllInvalidLeavesIsRejected() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let leaf = try ActivationFixture.addPlainServer(
+      "a", to: group, in: &catalog)
+    var fields = try ActivationFixture.serverFields(of: leaf, in: catalog)
+    fields.encryptionMethod = "future-cipher"
+    try catalog.updateServer(leaf, with: fields)
+
+    ActivationFixture.assertThrows(.targetExpandsToNothing(group)) {
+      try activate(group, in: catalog)
+    }
+    XCTAssertNil(machine.activeTargetID)
+  }
+
+  func testActivateEmptyGroupIsRejected() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("空组")
+
+    ActivationFixture.assertThrows(.targetExpandsToNothing(group)) {
+      try activate(group, in: catalog)
+    }
+    XCTAssertNil(machine.activeTargetID)
+  }
+
+  func testActivateServerWithUnprovidedPluginIsRejectedNamingProgram() throws {
+    var catalog = ConfigurationCatalog()
+    let leaf = try ActivationFixture.addPlainServer("a", in: &catalog)
+    var fields = try ActivationFixture.serverFields(of: leaf, in: catalog)
+    fields.pluginProgram = "kcptun"
+    try catalog.updateServer(leaf, with: fields)
+
+    ActivationFixture.assertThrows(
+      .invalidLeaf(node: leaf, reason: .pluginNotProvided(program: "kcptun"))
+    ) {
+      try activate(leaf, in: catalog)
+    }
+    XCTAssertNil(machine.activeTargetID, "拒绝激活，不产生目标")
+  }
+
+  func testActivateGroupContainingUnprovidedPluginLeafSkipsIt() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let valid = try ActivationFixture.addPlainServer(
+      "a", to: group, in: &catalog)
+    let broken = try ActivationFixture.addPlainServer(
+      "b", to: group, in: &catalog)
+    var brokenFields = try ActivationFixture.serverFields(of: broken, in: catalog)
+    brokenFields.pluginProgram = "kcptun"
+    try catalog.updateServer(broken, with: brokenFields)
+    let configuration = try activate(group, in: catalog)
+
+    XCTAssertEqual(configuration.document.servers.map(\.id), [valid.rawValue])
+    XCTAssertEqual(
+      configuration.skippedServers,
+      [SkippedServer(id: broken, reason: .pluginNotProvided(program: "kcptun"))])
+    XCTAssertEqual(machine.activeTargetID, group)
+  }
+
+  func testActivateServerWithManagedPluginWritesBundlePathAndResolvesOptions() throws {
+    var catalog = ConfigurationCatalog()
+    let leaf = try catalog.addServer(
+      ServerFields(
+        address: "203.0.113.7",
+        port: 8388,
+        encryptionMethod: "aes-256-gcm",
+        password: "password",
+        remark: "带插件",
+        pluginProgram: "v2ray-plugin",
+        pluginOptions: "loglevel=none"
+      ))
+
+    let configuration = try activate(leaf, in: catalog)
+
+    let entry = configuration.document.servers[0]
+    XCTAssertEqual(entry.plugin, "/bundle/Helpers/Plugins/v2ray-plugin", "受管集提供 bundle 内路径")
+    XCTAssertEqual(entry.pluginOpts, "loglevel=none", "插件参数同样派生时解析")
+  }
+
+  func testActivateUnknownTargetIsRejected() throws {
+    var catalog = ConfigurationCatalog()
+    _ = try ActivationFixture.addPlainServer("a", in: &catalog)
+
+    ActivationFixture.assertThrows(.targetNotFound(NodeID(rawValue: "ghost"))) {
+      try activate(NodeID(rawValue: "ghost"), in: catalog)
+    }
+  }
+
+  func testActivateServerWithEmptyPasswordIsRejected() throws {
+    var catalog = ConfigurationCatalog()
+    let leaf = try catalog.addServer(
+      ActivationFixture.plainFields(remark: "a", password: ""))
+
+    ActivationFixture.assertThrows(
+      .invalidLeaf(node: leaf, reason: .missingPassword)
+    ) {
+      try activate(leaf, in: catalog)
+    }
+  }
+
+  func testReactivateReplacesTarget() throws {
+    var catalog = ConfigurationCatalog()
+    let first = try ActivationFixture.addPlainServer("a", in: &catalog)
+    let second = try ActivationFixture.addPlainServer("b", in: &catalog)
+    try activate(first, in: catalog)
+
+    try activate(second, in: catalog)
+
+    XCTAssertEqual(machine.activeTargetID, second)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Activation/LeafPreparationTests.swift b/ShadowsocksX-NG2/Tests/Activation/LeafPreparationTests.swift
new file mode 100644
index 000000000..feb8e7e9b
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Activation/LeafPreparationTests.swift
@@ -0,0 +1,101 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 叶子预检缝：一次完成激活阻塞判定与凭据/插件解析，产出供目录树呈现与
+/// 运行时装配共用的事实。文档装配不在本缝。
+final class LeafPreparationTests: XCTestCase {
+  func testSupportedServerWithOpaquePluginOptionsIsReady() throws {
+    let fields = ServerFields(
+      address: "203.0.113.7",
+      port: 8388,
+      encryptionMethod: "aes-256-gcm",
+      password: "password",
+      pluginProgram: "v2ray-plugin",
+      pluginOptions: "plugin-option-that-the-app-does-not-parse")
+
+    let preparation = LeafPreparation.prepare(
+      fields, plugins: ActivationFixture.plugins)
+
+    XCTAssertEqual(preparation.issues, [])
+    XCTAssertEqual(preparation.password, "password")
+    XCTAssertEqual(preparation.plugin?.path, "/bundle/Helpers/Plugins/v2ray-plugin")
+    XCTAssertEqual(preparation.pluginOptions, "plugin-option-that-the-app-does-not-parse")
+  }
+
+  func testUnsupportedEncryptionMethodIsAnInvalidActivationCandidate() throws {
+    let fields = ServerFields(
+      address: "203.0.113.7",
+      port: 8388,
+      encryptionMethod: "future-cipher",
+      password: "password")
+
+    let preparation = LeafPreparation.prepare(
+      fields, plugins: ActivationFixture.plugins)
+
+    XCTAssertEqual(preparation.issues, [.unsupportedEncryptionMethod("future-cipher")])
+  }
+
+  func testMissingPluginExecutableIsInvalidWithoutInspectingOptions() throws {
+    let fields = ServerFields(
+      address: "203.0.113.7",
+      port: 8388,
+      encryptionMethod: "aes-256-gcm",
+      password: "password",
+      pluginProgram: "unknown-plugin",
+      pluginOptions: "opaque-options")
+
+    let preparation = LeafPreparation.prepare(
+      fields, plugins: NoManagedPluginProvider())
+
+    XCTAssertEqual(
+      preparation.issues,
+      [.pluginNotProvided(program: "unknown-plugin")])
+  }
+
+  func testMissingPasswordIsInvalid() throws {
+    let fields = ActivationFixture.plainFields(remark: "server", password: "")
+
+    let preparation = LeafPreparation.prepare(
+      fields, plugins: ActivationFixture.plugins)
+
+    XCTAssertEqual(preparation.issues, [.missingPassword])
+  }
+
+  func testFieldAndCredentialIssuesAreAllCollected() throws {
+    let fields = ServerFields(
+      address: " ",
+      port: 0,
+      encryptionMethod: "future-cipher",
+      password: "")
+
+    let preparation = LeafPreparation.prepare(
+      fields, plugins: ActivationFixture.plugins)
+
+    XCTAssertEqual(
+      preparation.issues,
+      [
+        .invalidAddress,
+        .invalidPort(0),
+        .unsupportedEncryptionMethod("future-cipher"),
+        .missingPassword,
+      ])
+    XCTAssertNil(preparation.password)
+    XCTAssertNil(preparation.plugin)
+    XCTAssertNil(preparation.pluginOptions)
+  }
+
+  func testResolvedPluginFactsPassThroughForAssembly() throws {
+    var fields = ActivationFixture.plainFields(remark: "带插件", password: "SECRET")
+    fields.pluginProgram = "v2ray-plugin"
+
+    let preparation = LeafPreparation.prepare(
+      fields, plugins: ActivationFixture.plugins)
+
+    XCTAssertEqual(preparation.issues, [])
+    XCTAssertEqual(preparation.password, "SECRET")
+    XCTAssertEqual(preparation.plugin?.path, "/bundle/Helpers/Plugins/v2ray-plugin")
+    XCTAssertEqual(preparation.plugin?.arguments, [])
+    XCTAssertNil(preparation.pluginOptions, "无插件选项引用时不解析选项")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Agent/AgentAuthenticationLogTests.swift b/ShadowsocksX-NG2/Tests/Agent/AgentAuthenticationLogTests.swift
new file mode 100644
index 000000000..dd08dafab
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Agent/AgentAuthenticationLogTests.swift
@@ -0,0 +1,97 @@
+import Darwin
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct AgentAuthenticationLogTests {
+  @Test func wrapperHidesPasswordsAcrossChunksAndDiscardsOversizedLines() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let contract = directory.appendingPathComponent("sslocal-active.json")
+    var listen = ProxyListeningConfiguration()
+    listen.socksPort = Int.random(in: 30_000...60_000)
+    listen.httpPort = listen.socksPort + 1
+    try RuntimeFileStore(fileURL: contract).write(
+      SslocalRuntimeDocument(servers: [], listen: listen))
+    let stub = directory.appendingPathComponent("sslocal-stub")
+    let script = """
+      #!/bin/sh
+      /usr/bin/awk 'BEGIN {
+        print "authentication rejected, password: secret-one";
+        printf "password: ";
+        for (i=0; i<70000; i++) printf "x";
+        fflush(); system("/bin/sleep 0.05");
+        print "secret-tail"; print "ordinary event";
+        fflush(); system("/bin/sleep 0.1");
+      }'
+      """
+    try script.write(to: stub, atomically: true, encoding: .utf8)
+    try FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: stub.path)
+    let process = Process()
+    process.executableURL = AppArtifact.bundleURL.appendingPathComponent(
+      "Contents/MacOS/ShadowsocksX-NG2Agent")
+    var environment = ProcessInfo.processInfo.environment
+    environment["SSXNG_CONTRACT_PATH"] = contract.path
+    environment["SSXNG_SSLOCAL_PATH"] = stub.path
+    environment["SSXNG_RUNTIME_DIR"] = directory.path
+    environment["SSXNG_SYSTEM_LOG"] = "0"
+    process.environment = environment
+    try process.run()
+    defer {
+      if process.isRunning { kill(process.processIdentifier, SIGKILL) }
+      process.waitUntilExit()
+    }
+    let deadline = Date().addingTimeInterval(5)
+    while process.isRunning && Date() < deadline { Thread.sleep(forTimeInterval: 0.01) }
+    #expect(!process.isRunning)
+    let log = try String(contentsOf: directory.appendingPathComponent("agent.log"), encoding: .utf8)
+    #expect(!log.contains("secret-one"))
+    #expect(!log.contains("secret-tail"))
+    #expect(log.contains("password: [redacted]"))
+    #expect(log.contains("ordinary event"))
+  }
+}
+
+extension AgentAuthenticationLogTests {
+  @Test(arguments: [false, true])
+  func wrapperCreatesRuntimeIndependentlyOfLogs(contractOverride: Bool) throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let paths = ApplicationSupportPaths(rootURL: root)
+    let process = Process()
+    process.executableURL = AppArtifact.bundleURL.appendingPathComponent(
+      "Contents/MacOS/ShadowsocksX-NG2Agent")
+    var environment = ProcessInfo.processInfo.environment.filter { !$0.key.hasPrefix("SSXNG_") }
+    // 剥离只针对路径缝；统一日志开关继续显式关闭（与 scheme 测试动作一致）。
+    environment["SSXNG_SYSTEM_LOG"] = "0"
+    if contractOverride {
+      environment["SSXNG_CONTRACT_PATH"] = paths.runtime.fileURL.path
+      environment["SSXNG_RUNTIME_DIR"] = root.appendingPathComponent("unused").path
+    } else {
+      environment["SSXNG_RUNTIME_DIR"] = paths.runtime.directoryURL.path
+    }
+    environment["SSXNG_LOG_PATH"] = paths.agentLogURL.path
+    process.environment = environment
+    try process.run()
+    defer {
+      if process.isRunning { kill(process.processIdentifier, SIGKILL) }
+      process.waitUntilExit()
+    }
+    let deadline = Date().addingTimeInterval(5)
+    while process.isRunning && Date() < deadline { Thread.sleep(forTimeInterval: 0.01) }
+    try #require(!process.isRunning)
+    #expect(process.terminationStatus == 0)
+    #expect(FileManager.default.fileExists(atPath: paths.runtime.agentLockURL.path))
+    #expect(!FileManager.default.fileExists(atPath: root.appendingPathComponent("unused").path))
+    #expect(try String(contentsOf: paths.agentLogURL, encoding: .utf8).contains("contract missing"))
+    for directory in [root, paths.runtime.directoryURL, paths.logsDirectoryURL] {
+      let attributes = try FileManager.default.attributesOfItem(atPath: directory.path)
+      #expect(attributes[.posixPermissions] as? Int == 0o700)
+    }
+    for file in [paths.runtime.agentLockURL, paths.agentLogURL] {
+      let attributes = try FileManager.default.attributesOfItem(atPath: file.path)
+      #expect(attributes[.posixPermissions] as? Int == 0o600)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Architecture/ExternalBinaryManifestTests.swift b/ShadowsocksX-NG2/Tests/Architecture/ExternalBinaryManifestTests.swift
new file mode 100644
index 000000000..a40a1a49e
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Architecture/ExternalBinaryManifestTests.swift
@@ -0,0 +1,90 @@
+import XCTest
+
+/// 校验 Vendor 外部二进制清单的通用结构与稳定打包属性；发布值只在清单中维护。
+final class ExternalBinaryManifestTests: XCTestCase {
+  private struct Manifest: Decodable {
+    var project: String
+    var release: String
+    var asset: String
+    var url: String
+    var archiveSHA256: String
+    var archiveMember: String?
+    var assetFormat: String?
+    var binary: String
+    var bundleSubpath: String
+    var signIdentifier: String
+  }
+
+  private static let bundleID = "com.qiuyuzhou.ShadowsocksX-NG2"
+  private static let vendorRoot = TestSourceTree.ng2Root().appendingPathComponent("Vendor")
+
+  private func manifest(_ name: String) throws -> Manifest {
+    let file = Self.vendorRoot.appendingPathComponent(name).appendingPathComponent("manifest.json")
+    return try JSONDecoder().decode(Manifest.self, from: Data(contentsOf: file))
+  }
+
+  private func assertPinnedSchema(_ manifest: Manifest, name: String) throws {
+    XCTAssertFalse(manifest.release.isEmpty, "\(name): release 必须显式固定")
+    XCTAssertNotEqual(manifest.release, "latest", "\(name): 禁止 latest 漂移")
+
+    let url = try XCTUnwrap(URL(string: manifest.url), "\(name): url 不可解析")
+    XCTAssertEqual(url.scheme, "https", "\(name): 资产必须走 https")
+    XCTAssertEqual(url.host, "github.com", "\(name): 资产必须来自官方 GitHub release")
+    XCTAssertTrue(url.path.contains(manifest.release), "\(name): url 必须锚定固定 tag")
+    XCTAssertEqual(url.lastPathComponent, manifest.asset, "\(name): url 与 asset 不一致")
+
+    XCTAssertTrue(
+      manifest.archiveSHA256.range(of: "^[0-9a-f]{64}$", options: .regularExpression) != nil,
+      "\(name): archiveSHA256 必须是 64 位小写十六进制")
+
+    let format = manifest.assetFormat ?? "tar"
+    XCTAssertTrue(["tar", "binary"].contains(format))
+    if format == "tar" {
+      XCTAssertFalse(try XCTUnwrap(manifest.archiveMember).isEmpty)
+    }
+    XCTAssertEqual(manifest.binary, name, "\(name): bundle 内二进制名与清单目录一致")
+
+    XCTAssertFalse(
+      manifest.bundleSubpath.hasPrefix("/") || manifest.bundleSubpath.contains(".."),
+      "\(name): bundleSubpath 不得越出 bundle")
+    XCTAssertTrue(
+      manifest.bundleSubpath == "Helpers" || manifest.bundleSubpath.hasPrefix("Helpers/"),
+      "\(name): 外部二进制按 TN2206 属嵌套代码，必须装在 Contents/Helpers 下")
+
+    XCTAssertTrue(
+      manifest.signIdentifier.hasPrefix(Self.bundleID + "."),
+      "\(name): signIdentifier 必须以宿主 bundle id 为前缀")
+  }
+
+  func testSslocalManifestStructure() throws {
+    let manifest = try manifest("sslocal")
+    try assertPinnedSchema(manifest, name: "sslocal")
+    XCTAssertEqual(manifest.project, "shadowsocks-rust")
+    let url = try XCTUnwrap(URL(string: manifest.url))
+    XCTAssertTrue(
+      url.path.hasPrefix("/qiuyuzhou/shadowsocks-rust/releases/download/"),
+      "sslocal 应固定到 ShadowsocksX-NG fork 的 release")
+    XCTAssertEqual(manifest.bundleSubpath, "Helpers")
+    XCTAssertEqual(manifest.signIdentifier, Self.bundleID + ".sslocal")
+  }
+
+  func testV2rayPluginManifestStructure() throws {
+    let manifest = try manifest("v2ray-plugin")
+    try assertPinnedSchema(manifest, name: "v2ray-plugin")
+    XCTAssertEqual(manifest.project, "v2ray-plugin")
+    XCTAssertEqual(manifest.archiveMember, "v2ray-plugin_darwin_arm64")
+    XCTAssertEqual(manifest.bundleSubpath, "Helpers/Plugins")
+    // SIP003 插件的签名 identifier 形如 <bundle-id>.plugin.<name>。
+    XCTAssertEqual(manifest.signIdentifier, Self.bundleID + ".plugin.v2ray-plugin")
+  }
+  func testCloakClientManifestStructure() throws {
+    let manifest = try manifest("ck-client")
+    try assertPinnedSchema(manifest, name: "ck-client")
+    XCTAssertEqual(manifest.project, "Cloak")
+    XCTAssertEqual(manifest.assetFormat, "binary")
+    XCTAssertNil(manifest.archiveMember)
+    XCTAssertEqual(manifest.bundleSubpath, "Helpers/Plugins")
+    XCTAssertEqual(manifest.signIdentifier, Self.bundleID + ".plugin.ck-client")
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Architecture/LaunchAgentManifestTests.swift b/ShadowsocksX-NG2/Tests/Architecture/LaunchAgentManifestTests.swift
new file mode 100644
index 000000000..9755e9024
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Architecture/LaunchAgentManifestTests.swift
@@ -0,0 +1,39 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// LaunchAgent manifest 双份 artifact 的一致性守卫：bundle 内打包 plist
+/// （SMAppService 审批用）与 writeUserPlist 运行时重建（launchctl bootstrap
+/// 用）承载同一 crash 重放协议（KeepAlive={SuccessfulExit:false} +
+/// ThrottleInterval），任一份漂移都会让注册行为与审批所见分叉。
+/// ProgramArguments 的 bundle 相对 vs 绝对路径是文档化的刻意差异
+/// （SMAppService 对相对 ProgramArguments 解析不可靠），只断言形状等价。
+struct LaunchAgentManifestTests {
+  @Test func bundledManifestMatchesCodeBuiltKeys() throws {
+    // 打包 plist 经 copyFiles 部署在 Contents/Library/LaunchAgents/（SMAppService
+    // 的固定读取位置）；按部署路径直读，路径缺失即用例失败。
+    let bundledURL = AppArtifact.bundleURL
+      .appendingPathComponent("Contents/Library/LaunchAgents")
+      .appendingPathComponent("com.qiuyuzhou.ShadowsocksX-NG2.agent.plist")
+    let data = try Data(contentsOf: bundledURL)
+    let bundled = try #require(
+      PropertyListSerialization.propertyList(from: data, format: nil) as? [String: Any])
+
+    let programName = "ShadowsocksX-NG2Agent"
+    let built = SMAppLaunchAgentService.manifestDictionary(programArguments: [
+      "/Applications/ShadowsocksX-NG2.app/Contents/MacOS/\(programName)"
+    ])
+
+    #expect(bundled["Label"] as? String == built["Label"] as? String)
+    #expect(bundled["KeepAlive"] as? [String: Bool] == built["KeepAlive"] as? [String: Bool])
+    #expect(bundled["ThrottleInterval"] as? Int == built["ThrottleInterval"] as? Int)
+
+    let bundledArguments = try #require(bundled["ProgramArguments"] as? [String])
+    let builtArguments = try #require(built["ProgramArguments"] as? [String])
+    #expect(bundledArguments.count == 1)
+    #expect(builtArguments.count == 1)
+    #expect((bundledArguments[0] as NSString).lastPathComponent == programName)
+    #expect((builtArguments[0] as NSString).lastPathComponent == programName)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Architecture/PlatformEffectsTests.swift b/ShadowsocksX-NG2/Tests/Architecture/PlatformEffectsTests.swift
new file mode 100644
index 000000000..e952adb4f
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Architecture/PlatformEffectsTests.swift
@@ -0,0 +1,142 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class QrImageSaverTests: XCTestCase {
+  func testSuggestedFileNameReplacesPathReservedCharacters() {
+    XCTAssertEqual(
+      QrImageSaveDraft.suggestedFileName(from: "机房/一号:备用"),
+      "机房 一号 备用.png")
+  }
+
+  func testSuggestedFileNameFallsBackWhenCleaningLeavesNothing() {
+    XCTAssertEqual(QrImageSaveDraft.suggestedFileName(from: " /: "), "ss-qrcode.png")
+    XCTAssertEqual(QrImageSaveDraft.suggestedFileName(from: ""), "ss-qrcode.png")
+  }
+
+  func testSuggestedFileNameKeepsCleanNameAndAppendsPNGExtension() {
+    XCTAssertEqual(QrImageSaveDraft.suggestedFileName(from: "  家里  "), "家里.png")
+  }
+}
+
+@MainActor
+final class DiagnosticReportExportActionTests: DiagnosticsWorkflowTestCase {
+  func testCancelledExportDoesNotRecordCompletion() {
+    let workflow = makeWorkflow(catalog: { DiagnosticCatalogFacts() })
+    let exporter = InMemoryDiagnosticReportExporter(result: .cancelled)
+
+    let outcome = DiagnosticReportExportAction(
+      diagnostics: workflow, exporter: exporter
+    ).perform()
+
+    XCTAssertEqual(outcome, .cancelled)
+    XCTAssertEqual(exporter.drafts.count, 1)
+    XCTAssertTrue(events.snapshot.isEmpty)
+  }
+
+  func testFailedExportDoesNotRecordCompletion() {
+    let workflow = makeWorkflow(catalog: { DiagnosticCatalogFacts() })
+    let exporter = InMemoryDiagnosticReportExporter(result: .failed(.writeFailed))
+
+    let outcome = DiagnosticReportExportAction(
+      diagnostics: workflow, exporter: exporter
+    ).perform()
+
+    XCTAssertEqual(outcome, .exportFailed(.writeFailed))
+    XCTAssertEqual(exporter.drafts.count, 1)
+    XCTAssertTrue(events.snapshot.isEmpty)
+  }
+
+  func testSuccessfulExportReturnsSelectedURLBeforeCompletionIsRecorded() throws {
+    let workflow = makeWorkflow(catalog: { DiagnosticCatalogFacts() })
+    let url = workDir.appendingPathComponent("diagnostics.txt")
+    let exporter = InMemoryDiagnosticReportExporter(result: .saved(url))
+
+    let outcome = DiagnosticReportExportAction(
+      diagnostics: workflow, exporter: exporter
+    ).perform()
+
+    XCTAssertEqual(outcome, .saved(url))
+    XCTAssertTrue(events.snapshot.isEmpty)
+
+    workflow.noteExportCompleted()
+
+    let exportedEvents = events.snapshot.filter { entry in
+      if case .diagnosticsExported = entry.event { return true }
+      return false
+    }
+    XCTAssertEqual(exportedEvents.count, 1)
+  }
+
+  func testReportPreparationFailureDoesNotOpenExporterOrRecordCompletion() {
+    let workflow = makeWorkflow(
+      catalog: { DiagnosticCatalogFacts() },
+      render: { _ in nil })
+    let exporter = InMemoryDiagnosticReportExporter(result: .cancelled)
+
+    let outcome = DiagnosticReportExportAction(
+      diagnostics: workflow, exporter: exporter
+    ).perform()
+
+    XCTAssertEqual(outcome, .preparationFailed(.encodingFailed))
+    XCTAssertTrue(exporter.drafts.isEmpty)
+    XCTAssertTrue(events.snapshot.isEmpty)
+  }
+}
+
+final class PlatformEffectsArchitectureTests: XCTestCase {
+  func testClipboardAndFileExportAppKitSymbolsStayInFocusedAdapters() throws {
+    let appDirectory = Self.testTargetRoot.appendingPathComponent("App")
+    let sourceFiles = try Self.swiftSourceFiles(in: appDirectory)
+
+    let pasteboardUsers = try Self.files(containing: "NSPasteboard", in: sourceFiles)
+    XCTAssertEqual(
+      pasteboardUsers.map(\.lastPathComponent).sorted(),
+      ["AppKitImageClipboard.swift", "AppKitTextClipboard.swift"],
+      "pasteboard 访问必须集中在 clipboard adapter（文本与图片各一）")
+
+    let savePanelUsers = try Self.files(containing: "NSSavePanel", in: sourceFiles)
+    XCTAssertEqual(
+      Set(savePanelUsers.map(\.lastPathComponent)),
+      Set([
+        "AppKitDiagnosticReportExporter.swift", "ConfigurationGroupFileExporter.swift",
+        "QrImageSaver.swift",
+      ]),
+      "保存面板访问必须集中在对应的 AppKit exporter/saver adapter")
+
+    let reportWriterUsers = try Self.files(containing: ".data.write(to:", in: sourceFiles)
+    XCTAssertEqual(
+      Set(reportWriterUsers.map(\.lastPathComponent)),
+      Set([
+        "AppKitDiagnosticReportExporter.swift", "ConfigurationGroupFileExporter.swift",
+        "QrImageSaver.swift",
+      ]),
+      "文件写入必须集中在对应的 AppKit exporter/saver adapter")
+  }
+
+  private static let testTargetRoot = TestSourceTree.ng2Root()
+
+  private static func swiftSourceFiles(in directory: URL) throws -> [URL] {
+    guard
+      let enumerator = FileManager.default.enumerator(
+        at: directory, includingPropertiesForKeys: nil)
+    else {
+      XCTFail("无法枚举 App 源码目录：\(directory.path)")
+      return []
+    }
+    return enumerator.compactMap { item in
+      guard let url = item as? URL, url.pathExtension == "swift" else { return nil }
+      return url
+    }
+  }
+
+  private static func files(containing token: String, in files: [URL]) throws -> [URL] {
+    var matches: [URL] = []
+    for file in files where (try? String(contentsOf: file, encoding: .utf8).contains(token)) == true
+    {
+      matches.append(file)
+    }
+    return matches
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Architecture/SigningConfigurationTests.swift b/ShadowsocksX-NG2/Tests/Architecture/SigningConfigurationTests.swift
new file mode 100644
index 000000000..ff614bfb6
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Architecture/SigningConfigurationTests.swift
@@ -0,0 +1,141 @@
+import Foundation
+import Testing
+
+/// 签名身份注入守卫：证书与 Team 都不入库（开源仓库），由 config 基线 + 本机
+/// xcconfig 在构建期决定。
+///
+/// 这条约束容易被无声破坏：`project.yml` 一旦重新设置 `DEVELOPMENT_TEAM` 或
+/// `CODE_SIGN_IDENTITY`，pbxproj 里的构建设置会盖掉 `Configs/Signing-*.xcconfig`
+/// （Xcode 构建设置优先级，实测），注入失效却不报错。本套用例把整条链条钉住：
+/// 工程定义不碰签名键 → config 基线各自正确且本机文件能（或不能）盖掉它 →
+/// 本机文件不入库 → 供应链脚本与发布门槛跟着基线走。
+struct SigningConfigurationTests {
+  private static let ng2Root = TestSourceTree.ng2Root()
+  private static let repositoryRoot = ng2Root.deletingLastPathComponent()
+
+  /// 逐行匹配：`String.CompareOptions` 没有 `.anchorsMatchLines`，整段文本上
+  /// `^`/`$` 只锚定字符串首尾，因此把行切开再套正则。
+  private static func matchingLines(_ pattern: String, in text: String) -> [String] {
+    text.split(separator: "\n", omittingEmptySubsequences: false)
+      .filter { $0.range(of: pattern, options: .regularExpression) != nil }
+      .map(String.init)
+  }
+
+  private static func firstLineIndex(matching pattern: String, in text: String) -> Int? {
+    text.split(separator: "\n", omittingEmptySubsequences: false)
+      .firstIndex { $0.range(of: pattern, options: .regularExpression) != nil }
+  }
+
+  private static func text(_ relativePath: String) throws -> String {
+    try String(contentsOf: ng2Root.appendingPathComponent(relativePath), encoding: .utf8)
+  }
+
+  /// 只命中 YAML 键（行首为 `KEY:`），注释行以 `#` 开头，不算设置。
+  private static func yamlKeyPattern(_ key: String) -> String { #"^\s*\#(key)\s*:"# }
+
+  private static let identityAssignment = #"^\s*CODE_SIGN_IDENTITY\s*="#
+  private static let localInclude = #"^\s*#include\?\s+"Signing\.local\.xcconfig"#
+
+  @Test
+  func projectSpecDoesNotPinSigningKeys() throws {
+    let spec = try Self.text("project.yml")
+    for key in ["DEVELOPMENT_TEAM", "CODE_SIGN_IDENTITY"] {
+      let pinned = Self.matchingLines(Self.yamlKeyPattern(key), in: spec)
+      #expect(
+        pinned.isEmpty,
+        "project.yml 不得设置 \(key)（pbxproj 设置会静默盖掉 Configs/Signing-*.xcconfig，且证书/Team 不应入库）：\(pinned)"
+      )
+    }
+  }
+
+  @Test
+  func projectSpecInjectsPerConfigurationBaselines() throws {
+    let spec = try Self.text("project.yml")
+    let expected = [
+      "Debug": "Configs/Signing-Debug.xcconfig",
+      "Release": "Configs/Signing-Release.xcconfig",
+    ]
+    for (configuration, path) in expected {
+      let pattern = #"^\s*\#(configuration):\s*\#(path)\s*$"#
+      #expect(
+        !Self.matchingLines(pattern, in: spec).isEmpty,
+        "project.yml 的 configFiles 必须把 \(configuration) 挂到 \(path)")
+    }
+  }
+
+  /// Debug 必须无证书可构建：基线 ad-hoc，且本机文件能把它升级成真证书。
+  @Test
+  func debugBaselineIsAdHocAndUpgradableByLocalFile() throws {
+    let config = try Self.text("Configs/Signing-Debug.xcconfig")
+    #expect(
+      Self.matchingLines(#"^\s*CODE_SIGN_IDENTITY\s*=\s*-\s*$"#, in: config).count == 1,
+      "Configs/Signing-Debug.xcconfig 必须恰好有一条 ad-hoc（-）CODE_SIGN_IDENTITY 基线")
+    let baseline = try #require(
+      Self.firstLineIndex(matching: Self.identityAssignment, in: config),
+      "Configs/Signing-Debug.xcconfig 缺少 CODE_SIGN_IDENTITY 基线")
+    let include = try #require(
+      Self.firstLineIndex(matching: Self.localInclude, in: config),
+      "Configs/Signing-Debug.xcconfig 必须包含 Configs/Signing.local.xcconfig")
+    #expect(
+      baseline < include,
+      "Debug 的 #include? 必须在 ad-hoc 基线之后：xcconfig 后赋值者胜，本机文件才能升级身份")
+  }
+
+  /// Release 必须真签名：本机文件只能补 Team，不能把发布身份改成 ad-hoc。
+  @Test
+  func releaseBaselineStaysDeveloperID() throws {
+    let config = try Self.text("Configs/Signing-Release.xcconfig")
+    let assignments = Self.matchingLines(Self.identityAssignment, in: config)
+    #expect(
+      assignments.last?.contains("Developer ID Application") == true,
+      "Configs/Signing-Release.xcconfig 最后生效的 CODE_SIGN_IDENTITY 必须是 Developer ID Application：\(assignments)"
+    )
+    let include = try #require(
+      Self.firstLineIndex(matching: Self.localInclude, in: config),
+      "Configs/Signing-Release.xcconfig 必须包含 Configs/Signing.local.xcconfig")
+    let baseline = try #require(
+      Self.firstLineIndex(matching: Self.identityAssignment, in: config),
+      "Configs/Signing-Release.xcconfig 缺少 CODE_SIGN_IDENTITY 基线")
+    #expect(include < baseline, "Release 的 #include? 必须在 Developer ID 基线之前，发布身份不被本机文件削弱")
+  }
+
+  @Test
+  func committedBaselinesDoNotPinTeamID() throws {
+    for path in ["Configs/Signing-Debug.xcconfig", "Configs/Signing-Release.xcconfig"] {
+      let config = try Self.text(path)
+      #expect(
+        Self.matchingLines(#"^\s*DEVELOPMENT_TEAM\s*="#, in: config).isEmpty,
+        "入库的 \(path) 不得固化 DEVELOPMENT_TEAM")
+    }
+  }
+
+  @Test
+  func localSigningConfigIsGitIgnored() throws {
+    let ignoreList = try String(
+      contentsOf: Self.repositoryRoot.appendingPathComponent(".gitignore"), encoding: .utf8)
+    #expect(
+      ignoreList.contains("ShadowsocksX-NG2/Configs/Signing.local.xcconfig"),
+      ".gitignore 必须忽略 Configs/Signing.local.xcconfig（本机证书/Team 不入库）")
+  }
+
+  /// 嵌套二进制重签必须跟着基线走：ad-hoc 构建没有 secure timestamp。
+  @Test
+  func embeddedHelperSigningHandlesAdHocIdentity() throws {
+    let script = try Self.text("Scripts/sign-embedded-helpers.sh")
+    #expect(
+      !Self.matchingLines(#"--sign -"#, in: script).isEmpty,
+      "sign-embedded-helpers.sh 必须有无证书（ad-hoc）分支，否则 Debug 基线无法封套嵌套二进制")
+  }
+
+  /// 发布门槛的 Team 期望值同样不许写死：只能取自同一个注入文件或显式环境变量。
+  @Test
+  func packagingGateDerivesTeamIDFromInjectedConfig() throws {
+    let gate = try Self.text("Scripts/packaging-gate.sh")
+    #expect(
+      gate.contains("Signing.local.xcconfig"),
+      "packaging-gate.sh 必须从 Configs/Signing.local.xcconfig 读取期望 Team ID")
+    #expect(
+      Self.matchingLines(#":-[A-Z0-9]{10}\}"#, in: gate).isEmpty,
+      "packaging-gate.sh 不得给 Team ID 留 10 位写死的默认值")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Architecture/SkeletonTests.swift b/ShadowsocksX-NG2/Tests/Architecture/SkeletonTests.swift
new file mode 100644
index 000000000..9ba2ef8be
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Architecture/SkeletonTests.swift
@@ -0,0 +1,195 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class SkeletonTests: XCTestCase {
+  // app bundle 断言按构建产物定位（AppArtifact），不依赖测试宿主进程；守住
+  // 的是打包面：bundle id 与旧版区分、菜单栏形态（LSUIElement）。
+
+  func testAppBundleIDIsDistinctFromLegacy() throws {
+    let bundle = try XCTUnwrap(Bundle(url: AppArtifact.bundleURL))
+    XCTAssertEqual(bundle.bundleIdentifier, "com.qiuyuzhou.ShadowsocksX-NG2")
+    XCTAssertNotEqual(bundle.bundleIdentifier, "com.qiuyuzhou.ShadowsocksX-NG")
+  }
+
+  func testAppIsMenuBarAgent() throws {
+    let bundle = try XCTUnwrap(Bundle(url: AppArtifact.bundleURL))
+    XCTAssertEqual(bundle.object(forInfoDictionaryKey: "LSUIElement") as? Bool, true)
+  }
+}
+
+/// 架构 deletion check：UI 源文件不得引用目录工作流的实现
+/// 协作者或原始目录/凭据存储类型。
+///
+/// 扫描范围由目录正面圈定：只扫 `App/UI/`（视图层）。分层因此是目录声明而非
+/// 豁免登记——把文件移出 `UI/` 是显式的架构动作；组合根放 `App/Composition/`、
+/// 运行时与系统适配器放 `App/Application/`、平台效应 seam 放
+/// `App/PlatformEffects/`，天然落在扫描范围之外，新增时无需登记豁免。
+/// 规则只点名实现缝，不锁定实现内部的文件划分或私有 helper。
+final class CatalogWorkflowArchitectureTests: XCTestCase {
+  func testUISourceFilesDoNotReferenceCatalogWorkflowImplementation() throws {
+    let uiDirectory = Self.testTargetRoot.appendingPathComponent("App/UI")
+    let uiFiles = try Self.swiftSourceFiles(in: uiDirectory)
+    XCTAssertFalse(uiFiles.isEmpty, "UI 源文件集合不应为空（App/UI 目录缺失？）")
+
+    var violations: [String] = []
+    for file in uiFiles {
+      let content = try String(contentsOf: file, encoding: .utf8)
+      for (index, line) in content.components(separatedBy: .newlines).enumerated() {
+        for pattern in Self.forbiddenPatterns
+        where pattern.regex.firstMatch(
+          in: line, range: NSRange(line.startIndex..., in: line)) != nil
+        {
+          violations.append("\(file.lastPathComponent):\(index + 1) → \(pattern.label)")
+        }
+      }
+    }
+    XCTAssertTrue(
+      violations.isEmpty,
+      """
+      UI 源文件不得引用代理控制器、目录工作流实现协作者或原始目录/凭据存储类型；
+      经 CatalogWorkflow/ProxyControlWorkflow 的 UI-facing interface 表达
+      （issue #49；控制器依赖由主窗口壳与服务器分区清零后固化为守卫）：
+      \(violations.joined(separator: "\n"))
+      """)
+  }
+
+  // MARK: - 扫描范围与禁令表
+
+  private static let testTargetRoot = TestSourceTree.ng2Root()
+
+  /// 禁令：实现协作者类型、原始目录/凭据存储类型与 workflow 内部成员缝。
+  private static let forbiddenPatterns = makeForbiddenPatterns()
+
+  private static func makeForbiddenPatterns() -> [(label: String, regex: NSRegularExpression)] {
+    let typeTokens = [
+      "ProxyRuntimeController",
+      "CatalogWorkflowDependencies", "CatalogCommitCoordinator", "CatalogFileStore",
+      "ConfigurationCatalog", "CatalogEntry", "CommittedCatalogSnapshot",
+      "CredentialStoring", "KeychainCredentialStore", "CredentialWriteJournal",
+      "CredentialReference", "PluginExecutableResolving", "BundleManagedPluginProvider",
+      "SubscriptionFetching", "HTTPSSubscriptionFetcher", "SubscriptionRecord",
+      "LegacyImportService", "LegacySnapshot", "Activating", "ServerFields",
+    ]
+    // workflow 内部成员缝（不作为可访问属性/方法暴露给 UI）。
+    let memberTokens = [
+      "\\.dependencies\\b", "\\bfileStore\\b", "discoveredLegacySnapshot",
+      "republishCommittedState", "commitSubscriptionDocument", "publishLegacyImportState",
+      "automaticUpdateState", "subscriptionRequests", "setSubscriptionRefreshFailure",
+      "subscriptionSummaries", "credentialRefs",
+    ]
+    return (typeTokens + memberTokens).map { token in
+      do {
+        return (label: token, regex: try NSRegularExpression(pattern: token))
+      } catch {
+        preconditionFailure("禁令正则编译失败：\(token)")
+      }
+    }
+  }
+
+  /// 视图层源文件 = `App/UI/` 下全部 Swift 文件（递归含各子视图目录）。
+  private static func swiftSourceFiles(in directory: URL) throws -> [URL] {
+    guard
+      let enumerator = FileManager.default.enumerator(
+        at: directory, includingPropertiesForKeys: nil)
+    else {
+      XCTFail("无法枚举 UI 源码目录：\(directory.path)")
+      return []
+    }
+    return enumerator.compactMap { item in
+      guard let url = item as? URL, url.pathExtension == "swift" else { return nil }
+      return url
+    }
+  }
+}
+
+/// Domain 布局守卫：`Domain/` 是「目录即主题」——根下只放主题子目录，不放平铺
+/// 文件，主题口径见 `project.yml` 的 Domain 注释与 GLOSSARY.md 的章节划分。
+///
+/// 无此守卫时，新增领域文件会默认堆回根下，主题划分靠人工记忆维持；守卫把
+/// 该约定固定为可执行的断言。
+final class DomainLayoutTests: XCTestCase {
+  private static let domainDirectory = TestSourceTree.ng2Root()
+    .appendingPathComponent("Domain")
+
+  func testDomainRootHasNoLooseSwiftFiles() throws {
+    let rootEntries = try FileManager.default.contentsOfDirectory(
+      at: Self.domainDirectory, includingPropertiesForKeys: nil)
+    let looseSwiftFiles =
+      rootEntries
+      .filter { $0.pathExtension == "swift" }
+      .map(\.lastPathComponent)
+      .sorted()
+
+    XCTAssertTrue(
+      looseSwiftFiles.isEmpty,
+      """
+      Domain/ 根下不得平铺 Swift 文件，应按主题归入子目录（Catalog / Subscription /
+      Rules / Rules/Custom / Runtime / Activation / Settings / SystemProxy / Plugin /
+      Credentials / LegacyImport / Diagnostics）：
+      \(looseSwiftFiles.joined(separator: "\n"))
+      """)
+  }
+
+  /// `Domain/` 整目录是 app 与 Core target 的 source path：任何非 Swift 文件都会被
+  /// XcodeGen 收进 Resources 阶段、封进签名后的 app bundle（同 App/ 的已知行为），
+  /// 因此树下不允许出现这类文件——确需随包发布应改走 Vendor/ 并显式声明 buildPhase。
+  func testDomainTreeContainsOnlySwiftFiles() throws {
+    let domainDirectory = Self.domainDirectory
+    let enumerator = try XCTUnwrap(
+      FileManager.default.enumerator(at: domainDirectory, includingPropertiesForKeys: nil),
+      "无法枚举 Domain 目录：\(domainDirectory.path)")
+
+    var unexpectedFiles: [String] = []
+    for case let url as URL in enumerator {
+      let isRegularFile =
+        try url.resourceValues(forKeys: [.isRegularFileKey])
+        .isRegularFile == true
+      guard isRegularFile else { continue }
+      if url.pathExtension != "swift" {
+        unexpectedFiles.append(
+          url.path.replacingOccurrences(of: domainDirectory.path + "/", with: ""))
+      }
+    }
+
+    XCTAssertTrue(
+      unexpectedFiles.isEmpty,
+      """
+      Domain/ 树下只允许 .swift 文件，否则会被收进 app bundle 的 Resources 阶段：
+      \(unexpectedFiles.sorted().joined(separator: "\n"))
+      """)
+  }
+}
+
+/// Tests 布局守卫：`Tests/` 同样是目录即主题——根下只放主题子目录，不放平铺
+/// 测试文件，主题口径对齐 `Domain/` 的主题与 `App/` 的 `*Workflow`。
+///
+/// 比 `DomainLayoutTests` 弱一档，只断言根层没有平铺 `.swift`：`Tests/` 树下的
+/// 非 Swift 文件是必需的——`Fixtures/RuleSnapshots/*.json` 是随测试 bundle 发布
+/// 的 folder resource，根层还有作为 `info.path` 生成的 `Info.plist`，两者都不能
+/// 用「树下只有 .swift」那条不变量覆盖。
+final class TestsLayoutTests: XCTestCase {
+  private static let testsDirectory = TestSourceTree.ng2Root()
+    .appendingPathComponent("Tests")
+
+  func testTestsRootHasNoLooseSwiftFiles() throws {
+    let rootEntries = try FileManager.default.contentsOfDirectory(
+      at: Self.testsDirectory, includingPropertiesForKeys: nil)
+    let looseSwiftFiles =
+      rootEntries
+      .filter { $0.pathExtension == "swift" }
+      .map(\.lastPathComponent)
+      .sorted()
+
+    XCTAssertTrue(
+      looseSwiftFiles.isEmpty,
+      """
+      Tests/ 根下不得平铺测试文件，应按主题归入子目录（Architecture / Support /
+      Agent / Activation / Catalog（含 Workflow）/ Subscription / Rules（含 Custom）/
+      ProxyRuntime / ProxyControl / Runtime / Settings / SystemProxy / Plugin /
+      Diagnostics / Credentials / Workspace / Servers / Smoke）：
+      \(looseSwiftFiles.joined(separator: "\n"))
+      """)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Architecture/WorkspaceRouteTests.swift b/ShadowsocksX-NG2/Tests/Architecture/WorkspaceRouteTests.swift
new file mode 100644
index 000000000..cdc8d2013
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Architecture/WorkspaceRouteTests.swift
@@ -0,0 +1,37 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class WorkspaceRouteTests: XCTestCase {
+  func testFreshRouteStartsAtHomeWithoutPersistedState() {
+    XCTAssertEqual(WorkspaceRoute().destination, .home)
+  }
+
+  /// 侧栏 List/NavigationSplitView 会在视图更新期间回写 selection Binding；
+  /// 同值导航不得 publish（否则触发 view-update 期间发布警告）。
+  func testNavigateToCurrentDestinationDoesNotPublish() {
+    let route = WorkspaceRoute()
+    var changeCount = 0
+    let cancellable = route.objectWillChange.sink { _ in changeCount += 1 }
+    defer { cancellable.cancel() }
+
+    route.navigate(to: .home)
+    XCTAssertEqual(changeCount, 0)
+    XCTAssertEqual(route.destination, .home)
+
+    route.navigate(to: .servers)
+    XCTAssertEqual(changeCount, 1)
+    XCTAssertEqual(route.destination, .servers)
+
+    route.navigate(to: .servers)
+    XCTAssertEqual(changeCount, 1)
+  }
+
+  func testDestinationVocabularyIsFiniteAndStable() {
+    XCTAssertEqual(
+      WorkspaceDestination.allCases,
+      [.home, .servers, .rules, .settings])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/AgeConfigurationStorageTests.swift b/ShadowsocksX-NG2/Tests/Catalog/AgeConfigurationStorageTests.swift
new file mode 100644
index 000000000..6b484110a
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/AgeConfigurationStorageTests.swift
@@ -0,0 +1,262 @@
+import AgeSwift
+import Foundation
+import Security
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct AgeConfigurationStorageTests {
+  @Test(arguments: [false, true])
+  func standardCLIReadsAppFilesAndAppReadsBinaryAndArmor(listening: Bool) throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let keys = TestLibraryKeys()
+    let url = directory.appendingPathComponent(listening ? "proxy-listening.age" : "catalog.age")
+    let library = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    let listeners = ProxyListeningFileStore(fileURL: url, keys: keys)
+    if listening {
+      var configuration = try listeners.load()
+      configuration.lan.password = "CLI-INTEROP-SECRET"
+      try listeners.save(configuration)
+    } else {
+      var document = try library.load()
+      _ = try document.catalog.addGroup("CLI-INTEROP-SECRET")
+      try library.save(document)
+    }
+    let identityData = try #require(keys.values.values.first)
+    let identity = try AgeIdentity(string: #require(String(data: identityData, encoding: .utf8)))
+    let identityURL = directory.appendingPathComponent("identity.txt")
+    try AtomicFileWriter.write(identityData + Data("\n".utf8), to: identityURL)
+    let jsonURL = directory.appendingPathComponent("payload.json")
+    try runAge(["-d", "-i", identityURL.path, "-o", jsonURL.path, url.path])
+    let payload = try Data(contentsOf: jsonURL)
+    #expect(payload.range(of: Data("CLI-INTEROP-SECRET".utf8)) != nil)
+    for armor in [false, true] {
+      let output = directory.appendingPathComponent(armor ? "cli-armored.age" : "cli-binary.age")
+      try runAge(
+        ["-e", "-r", identity.recipient.serialized, "-o", output.path]
+          + (armor ? ["-a"] : []) + [jsonURL.path])
+      try Data(contentsOf: output).write(to: url)
+      if listening {
+        let reopened = ProxyListeningFileStore(fileURL: url, keys: keys)
+        let configuration = try reopened.load()
+        #expect(configuration.lan.password == "CLI-INTEROP-SECRET")
+        try reopened.save(configuration)
+      } else {
+        let reopened = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+        let document = try reopened.load()
+        #expect(document.catalog.entries.values.first?.displayName == "CLI-INTEROP-SECRET")
+        try reopened.save(document)
+      }
+      #expect(try Data(contentsOf: url).starts(with: Data("age-encryption.org/v1\n".utf8)))
+      #expect(keys.values.count == 1)
+    }
+  }
+
+  @Test(arguments: ["catalog.enc", "catalog.json", "proxy-listening.enc", "proxy-listening.json"])
+  func historicalFilesRequireExplicitReset(name: String) throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let oldURL = directory.appendingPathComponent(name)
+    let old = Data("unsupported historical configuration".utf8)
+    try old.write(to: oldURL)
+    let keys = TestLibraryKeys()
+    if name.hasPrefix("catalog") {
+      let store = CatalogFileStore(
+        fileURL: directory.appendingPathComponent("catalog.age"),
+        library: ServerLibraryStorage(keys: keys))
+      #expect(throws: EncryptedFileError.unsupportedVersion) { try store.load() }
+      #expect(keys.values.isEmpty)
+      _ = try store.reset()
+      #expect(
+        try CatalogFileStore(fileURL: store.fileURL, library: ServerLibraryStorage(keys: keys))
+          .load().catalog.isEmpty)
+    } else {
+      let store = ProxyListeningFileStore(
+        fileURL: directory.appendingPathComponent("proxy-listening.age"), keys: keys)
+      #expect(throws: ProxyListeningStoreError.encryptedFile(.unsupportedVersion)) {
+        try store.load()
+      }
+      #expect(keys.values.isEmpty)
+      _ = try store.reset()
+      #expect(
+        try ProxyListeningFileStore(fileURL: store.fileURL, keys: keys).load()
+          == ProxyListeningConfiguration())
+    }
+    #expect(try Data(contentsOf: oldURL) == old)
+  }
+
+  @Test func inaccessibleAndUnrelatedIdentitiesDoNotBlockTheMatchingIdentity() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let keys = TestLibraryKeys()
+    let url = directory.appendingPathComponent("catalog.age")
+    let original = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    _ = try original.load()
+    let identity = try #require(keys.values.values.first)
+    let blocked = UUID(uuidString: "00000000-0000-0000-0000-000000000001")!
+    let unrelated = UUID(uuidString: "00000000-0000-0000-0000-000000000002")!
+    let matching = UUID(uuidString: "FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF")!
+    keys.values = [
+      blocked: identity, unrelated: Data(try AgeIdentity.generate().serialized.utf8),
+      matching: identity,
+    ]
+    keys.blockedIDs = [blocked]
+    let reopened = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    var document = try reopened.load()
+    _ = try document.catalog.addGroup("matching identity")
+    try reopened.save(document)
+    keys.values = [matching: identity]
+    #expect(
+      try CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys)).load()
+        == document)
+  }
+
+  @Test(arguments: [false, true])
+  func failedFileCommitAfterIdentityCreationPreservesThePreviousConfiguration(listening: Bool)
+    throws
+  {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer {
+      if let files = try? FileManager.default.contentsOfDirectory(
+        at: directory, includingPropertiesForKeys: nil)
+      {
+        for file in files {
+          try? FileManager.default.setAttributes([.immutable: false], ofItemAtPath: file.path)
+        }
+      }
+      try? FileManager.default.removeItem(at: directory)
+    }
+    let keys = TestLibraryKeys()
+    let url = directory.appendingPathComponent(listening ? "proxy-listening.age" : "catalog.age")
+    let library = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    let listeners = ProxyListeningFileStore(fileURL: url, keys: keys)
+    if listening { _ = try listeners.load() } else { _ = try library.load() }
+    let original = try Data(contentsOf: url)
+    try FileManager.default.setAttributes([.immutable: true], ofItemAtPath: url.path)
+    #expect(throws: (any Error).self) {
+      if listening { _ = try listeners.reset() } else { _ = try library.reset() }
+    }
+    #expect(keys.values.count == 2)
+    #expect(try Data(contentsOf: url) == original)
+    try FileManager.default.setAttributes([.immutable: false], ofItemAtPath: url.path)
+    if listening {
+      #expect(
+        try ProxyListeningFileStore(fileURL: url, keys: keys).load()
+          == ProxyListeningConfiguration())
+    } else {
+      #expect(
+        try CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+          .load().catalog.isEmpty)
+    }
+  }
+
+  @Test(arguments: [
+    "unknown-version", "invalid-listener", "oversized", "oversized-file", "truncated",
+  ])
+  func invalidListeningPayloadCannotReplaceCommittedConfiguration(failure: String) throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let keys = TestLibraryKeys()
+    let url = directory.appendingPathComponent("proxy-listening.age")
+    let store = ProxyListeningFileStore(fileURL: url, keys: keys)
+    _ = try store.load()
+    let identityData = try #require(keys.values.values.first)
+    let identityText = try #require(String(data: identityData, encoding: .utf8))
+    let identity = try AgeIdentity(string: identityText)
+    let original = try Data(contentsOf: url)
+    var json = try #require(
+      JSONSerialization.jsonObject(with: Age.decrypt(original, identities: [identity]))
+        as? [String: Any])
+    switch failure {
+    case "unknown-version": json["version"] = 999
+    case "invalid-listener":
+      var configuration = try #require(json["configuration"] as? [String: Any])
+      var local = try #require(configuration["local"] as? [String: Any])
+      local["socksPort"] = 0
+      configuration["local"] = local
+      json["configuration"] = configuration
+    case "oversized": json["padding"] = String(repeating: "x", count: 1024 * 1024)
+    default: break
+    }
+    var ciphertext = try Age.encrypt(
+      JSONSerialization.data(withJSONObject: json), recipients: [identity.recipient])
+    if failure == "truncated" { ciphertext.removeLast() }
+    if failure == "oversized-file" { ciphertext = Data(repeating: 0, count: 2 * 1024 * 1024) }
+    try ciphertext.write(to: url)
+    let reopened = ProxyListeningFileStore(fileURL: url, keys: keys)
+    #expect(throws: (any Error).self) { try reopened.load() }
+    #expect(throws: (any Error).self) { try reopened.save(ProxyListeningConfiguration()) }
+    #expect(try Data(contentsOf: url) == ciphertext)
+    try original.write(to: url)
+    var tooLarge = try store.load()
+    tooLarge.lan.password = String(repeating: "x", count: 1024 * 1024)
+    #expect(throws: ProxyListeningStoreError.encryptedFile(.malformedFile)) {
+      try store.save(tooLarge)
+    }
+    #expect(try Data(contentsOf: url) == original)
+  }
+
+  @Test func realKeychainIdentityCanBeEnumeratedAndReopenedWithoutInteraction() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    let keys = KeychainCredentialKeyStore(namespace: "age-tests.\(UUID().uuidString)")
+    defer {
+      try? FileManager.default.removeItem(at: directory)
+      cleanUpKeychainItems(for: keys)
+    }
+    let url = directory.appendingPathComponent("catalog.age")
+    let store = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    let document = try store.load()
+    let ids = try keys.ids()
+    #expect(ids.count == 1)
+    let id = try #require(ids.first)
+    let data = try #require(try keys.read(id, allowingInteraction: false))
+    #expect(data.starts(with: Data("AGE-SECRET-KEY-1".utf8)))
+    #expect(
+      try CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys)).load()
+        == document)
+    _ = try store.reset()
+    #expect(try keys.ids().count == 2)
+    #expect(
+      try CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+        .load().catalog.isEmpty)
+  }
+
+  private func runAge(_ arguments: [String]) throws {
+    let process = Process()
+    process.executableURL = URL(fileURLWithPath: "/usr/bin/env")
+    process.arguments = ["age"] + arguments
+    // Xcode test runners do not inherit the interactive shell's Homebrew PATH.
+    process.environment = ProcessInfo.processInfo.environment.merging([
+      "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
+    ]) { _, value in value }
+    process.standardOutput = FileHandle.nullDevice
+    process.standardError = FileHandle.nullDevice
+    try process.run()
+    process.waitUntilExit()
+    #expect(process.terminationStatus == 0)
+    guard process.terminationStatus == 0 else { throw EncryptedFileError.malformedFile }
+  }
+
+  private func cleanUpKeychainItems(for keys: KeychainCredentialKeyStore) {
+    let ids = try? keys.ids()
+    #expect(ids != nil, "读取测试 Keychain 项时清理失败")
+    for id in ids ?? [] {
+      let status = SecItemDelete(
+        [
+          kSecClass as String: kSecClassGenericPassword,
+          kSecAttrService as String: keys.service,
+          kSecAttrAccount as String: id.uuidString,
+          kSecAttrSynchronizable as String: false,
+          kSecUseDataProtectionKeychain as String: false,
+        ] as CFDictionary)
+      #expect(
+        status == errSecSuccess || status == errSecItemNotFound,
+        "删除测试 Keychain 项失败：\(status)")
+    }
+    let remainingIDs = try? keys.ids()
+    #expect(remainingIDs?.isEmpty == true, "测试 Keychain 项未清理干净")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/CatalogCommitCoordinatorTests.swift b/ShadowsocksX-NG2/Tests/Catalog/CatalogCommitCoordinatorTests.swift
new file mode 100644
index 000000000..09140dff2
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/CatalogCommitCoordinatorTests.swift
@@ -0,0 +1,321 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 确定性运行时同步替身（测试缝）：记录 converge 快照与次序，
+/// 可编程每次结果；门闩让同步在收敛中挂起，用于验证提交代次语义。
+@MainActor
+final class FakeCatalogRuntime: CatalogRuntimeSyncing {
+  var hasActiveTarget = false
+  var onNextConverge: (() -> Void)?
+  /// 未编程结果时的默认返回。
+  var defaultOutcome: RuntimeSyncOutcome = .converged(skippedServers: [])
+  private var outcomeQueue: [RuntimeSyncOutcome] = []
+  private(set) var convergeSnapshots: [CommittedCatalogSnapshot] = []
+
+  /// 门闩：武装后接下来的 converge 在记录调用后挂起，直到 openGate。
+  private var armedGateCount = 0
+  private var gateWaiters: [CheckedContinuation<Void, Never>] = []
+
+  var convergeCount: Int { convergeSnapshots.count }
+
+  /// 预编程按次序返回的结果（耗尽后回退 `defaultOutcome`）。
+  func enqueueOutcomes(_ outcomes: [RuntimeSyncOutcome]) {
+    outcomeQueue.append(contentsOf: outcomes)
+  }
+
+  func armGate(count: Int = 1) {
+    armedGateCount = count
+  }
+
+  func openGate() {
+    armedGateCount = 0
+    for waiter in gateWaiters {
+      waiter.resume()
+    }
+    gateWaiters.removeAll()
+  }
+
+  func converge(to snapshot: CommittedCatalogSnapshot) async -> RuntimeSyncOutcome {
+    convergeSnapshots.append(snapshot)
+    let callback = onNextConverge
+    onNextConverge = nil
+    callback?()
+    let result = outcomeQueue.isEmpty ? defaultOutcome : outcomeQueue.removeFirst()
+    if armedGateCount > 0 {
+      armedGateCount -= 1
+      await withCheckedContinuation { gateWaiters.append($0) }
+    }
+    return result
+  }
+}
+
+/// 让出 MainActor 直到条件成立（被测同步任务在同一线程上排队执行）。供
+/// 协调器与视图模型测试共享：提交后的运行时收敛不再内联等待。
+@MainActor
+func waitUntilRuntimeSettles(
+  _ condition: @autoclosure () -> Bool,
+  timeout: TimeInterval = 2,
+  file: StaticString = #filePath,
+  line: UInt = #line
+) async {
+  let deadline = Date().addingTimeInterval(timeout)
+  while !condition() && Date() < deadline {
+    await Task.yield()
+  }
+  XCTAssertTrue(condition(), "等待条件超时", file: file, line: line)
+}
+
+/// 目录提交—运行时同步协调器：只断言外部行为——持久化与发布、
+/// 运行时是否被调用及使用的快照、阶段与失败结果、并发提交的最终赢家、无效
+/// 活动目标的停止语义。全部走临时目录文件存储，不触碰真实运行时。
+@MainActor
+final class CatalogCommitCoordinatorTests: XCTestCase {
+  private var workDir: URL!
+  private var fileURL: URL!
+  private var runtime: FakeCatalogRuntime!
+  private var coordinator: CatalogCommitCoordinator!
+  private var bootstrap: CatalogCommitBootstrap!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    // 专用工作目录：写入器会把父目录强制 0700（不得指向临时根）。
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-commit-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    fileURL = workDir.appendingPathComponent("catalog.json")
+    runtime = FakeCatalogRuntime()
+    coordinator = makeCoordinator()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  private func makeCoordinator() -> CatalogCommitCoordinator {
+    let fileStore = makeTestCatalogStore(fileURL: fileURL)
+    bootstrap = CatalogCommitCoordinator.bootstrap(fileStore: fileStore)
+    return CatalogCommitCoordinator(fileStore: fileStore, runtime: runtime, bootstrap: bootstrap)
+  }
+
+  /// 预置目录后重建协调器（模拟已落盘的既有状态）。
+  private func seedCatalog(_ mutate: (inout ConfigurationCatalog) throws -> Void) throws {
+    var catalog = ConfigurationCatalog()
+    try mutate(&catalog)
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: catalog))
+    coordinator = makeCoordinator()
+  }
+
+  private func persistedCatalog() throws -> ConfigurationCatalog {
+    try makeTestCatalogStore(fileURL: fileURL).load().catalog
+  }
+
+  // MARK: - 无活动目标
+
+  func testCommitWithoutActiveTargetPersistsAndPublishesWithoutRuntimeCall() throws {
+    runtime.hasActiveTarget = false
+
+    let added = try coordinator.commit { catalog, _ in
+      try catalog.addTestServer("香港 01")
+    }
+
+    XCTAssertTrue(coordinator.committedCatalog.contains(added), "提交后已发布新状态")
+    XCTAssertTrue(
+      bootstrap.catalogSnapshotReader.catalogSnapshot.contains(added),
+      "controller reader 与 coordinator 观察同一已提交目录")
+    XCTAssertEqual(try persistedCatalog().rootChildren, [added], "变更已原子持久化")
+    XCTAssertEqual(runtime.convergeCount, 0, "无活动目标不驱动运行时")
+    XCTAssertEqual(coordinator.syncStatus, .idle)
+  }
+
+  // MARK: - 活动目标提交
+
+  func testCommitWithActiveServerTargetConvergesToCommittedSnapshot() async throws {
+    try seedCatalog { try $0.addTestServer("已有节点") }
+    runtime.hasActiveTarget = true
+
+    let added = try coordinator.commit { catalog, _ in
+      try catalog.addTestServer("新节点")
+    }
+
+    // 一次提交恰好一次同步。
+    await waitUntilRuntimeSettles(runtime.convergeCount == 1)
+    let snapshot = try XCTUnwrap(runtime.convergeSnapshots.first)
+    XCTAssertTrue(snapshot.catalog.contains(added), "同步使用刚提交的内存快照")
+    XCTAssertEqual(snapshot.subscriptions, [])
+    XCTAssertEqual(
+      coordinator.syncStatus,
+      .finished(generation: 1, outcome: .converged(skippedServers: [])))
+  }
+
+  func testCommitWithActiveGroupTargetUsesSamePipeline() async throws {
+    try seedCatalog { catalog in
+      let group = try catalog.addGroup("手动组")
+      _ = try catalog.addTestServer("成员", to: group)
+    }
+    runtime.hasActiveTarget = true
+    let groupID = try XCTUnwrap(coordinator.committedCatalog.rootChildren.first)
+
+    _ = try coordinator.commit { catalog, _ in
+      try catalog.addTestServer("新成员", to: groupID)
+    }
+
+    await waitUntilRuntimeSettles(runtime.convergeCount == 1)
+    XCTAssertEqual(runtime.convergeCount, 1, "分组目标与服务器目标共用同一提交语义")
+    let snapshot = try XCTUnwrap(runtime.convergeSnapshots.first)
+    let group = try XCTUnwrap(snapshot.catalog.entry(for: groupID))
+    guard case .group(let fields) = group.kind else {
+      return XCTFail("快照中的目标应为分组")
+    }
+    XCTAssertEqual(fields.children.count, 2, "同步快照携带刚提交的新子树")
+  }
+
+  func testMoveRemoveAndRenameShareCommitSemantics() async throws {
+    try seedCatalog { catalog in
+      let group = try catalog.addGroup("组")
+      _ = try catalog.addTestServer("成员", to: group)
+    }
+    runtime.hasActiveTarget = true
+    let groupID = try XCTUnwrap(coordinator.committedCatalog.rootChildren.first)
+    let serverID = try XCTUnwrap(coordinator.committedCatalog.children(of: groupID).first)
+
+    try coordinator.commit { catalog, _ in try catalog.move(serverID, to: nil) }
+    await waitUntilRuntimeSettles(runtime.convergeCount == 1)
+    try coordinator.commit { catalog, _ in try catalog.renameGroup(groupID, to: "改名") }
+    await waitUntilRuntimeSettles(runtime.convergeCount == 2)
+    _ = try coordinator.commit { catalog, _ in try catalog.remove(serverID) }
+    // 移动、改名、删除各触发一次同步。
+    await waitUntilRuntimeSettles(runtime.convergeCount == 3)
+
+    XCTAssertEqual(
+      coordinator.syncStatus,
+      .finished(generation: 3, outcome: .converged(skippedServers: [])),
+      "最新代次的收敛结果是最终状态")
+  }
+
+  // MARK: - 无效活动目标
+
+  func testRemovedActiveTargetClearsAndStopsWithoutSilentFallback() async throws {
+    try seedCatalog { try $0.addTestServer("活动节点") }
+    let targetID = try XCTUnwrap(coordinator.committedCatalog.rootChildren.first)
+    runtime.hasActiveTarget = true
+    runtime.enqueueOutcomes([.clearedAndStopped(.targetNotFound(targetID))])
+
+    _ = try coordinator.commit { catalog, _ in try catalog.remove(targetID) }
+
+    await waitUntilRuntimeSettles(coordinator.syncStatus != .syncing(generation: 1))
+    XCTAssertEqual(runtime.convergeCount, 1)
+    XCTAssertEqual(
+      coordinator.syncStatus,
+      .finished(generation: 1, outcome: .clearedAndStopped(.targetNotFound(targetID))),
+      "清除停止以结构化结果呈现")
+    XCTAssertFalse(try persistedCatalog().contains(targetID), "运行时失败不回滚目录")
+  }
+
+  // MARK: - 目录与运行时结果区分
+
+  func testRuntimeFailureKeepsCommittedCatalogAndDistinguishesResult() async throws {
+    runtime.hasActiveTarget = true
+    runtime.defaultOutcome = .failed(failure: .service(.agent))
+
+    let added = try coordinator.commit { catalog, _ in
+      try catalog.addTestServer("香港 01")
+    }
+
+    await waitUntilRuntimeSettles(coordinator.syncStatus != .syncing(generation: 1))
+    XCTAssertTrue(try persistedCatalog().contains(added), "运行时失败不回滚已提交目录")
+    XCTAssertEqual(
+      coordinator.syncStatus,
+      .finished(generation: 1, outcome: .failed(failure: .service(.agent))),
+      "结果明确区分目录已提交与运行时未收敛")
+  }
+
+  // MARK: - 提交代次
+
+  func testSupersededSyncBeforeStartNeverCallsRuntime() async throws {
+    runtime.hasActiveTarget = true
+
+    _ = try coordinator.commit { catalog, _ in try catalog.addTestServer("第一台") }
+    _ = try coordinator.commit { catalog, _ in try catalog.addTestServer("第二台") }
+    // 同一 MainActor 回合内的两次提交：旧代次同步尚未启动即被取代。
+    await waitUntilRuntimeSettles(runtime.convergeCount == 1)
+
+    let snapshot = try XCTUnwrap(runtime.convergeSnapshots.first)
+    XCTAssertEqual(snapshot.catalog.rootChildren.count, 2, "最终同步采用最新提交快照")
+    XCTAssertEqual(
+      coordinator.syncStatus,
+      .finished(generation: 2, outcome: .converged(skippedServers: [])))
+  }
+
+  func testDelayedSyncCannotOverrideLatestSnapshotOrResult() async throws {
+    runtime.hasActiveTarget = true
+    runtime.enqueueOutcomes([
+      .converged(skippedServers: []),
+      .failed(failure: .service(.unknown)),
+    ])
+    runtime.armGate()
+
+    _ = try coordinator.commit { catalog, _ in try catalog.addTestServer("第一台") }
+    await waitUntilRuntimeSettles(runtime.convergeCount == 1)
+
+    _ = try coordinator.commit { catalog, _ in try catalog.addTestServer("第二台") }
+    runtime.openGate()
+    await waitUntilRuntimeSettles(runtime.convergeCount == 2)
+    await waitUntilRuntimeSettles(coordinator.syncStatus != .syncing(generation: 2))
+
+    XCTAssertEqual(runtime.convergeCount, 2)
+    XCTAssertEqual(
+      runtime.convergeSnapshots[1].catalog.rootChildren.count, 2, "最新代次使用最新快照")
+    XCTAssertEqual(
+      coordinator.syncStatus,
+      .finished(generation: 2, outcome: .failed(failure: .service(.unknown))),
+      "迟到的旧代次结果不得覆盖最新代次")
+  }
+
+  // MARK: - 独立路径对齐
+
+  func testReloadCommittedStateAdoptsExternalWritesWithoutRuntimeCall() throws {
+    runtime.hasActiveTarget = true
+
+    // Legacy 导入等独立路径绕过协调器直接落盘（订阅固定分组须在目录内）。
+    var external = ConfigurationCatalog()
+    let groupID = NodeID(rawValue: "import:group")
+    try external.addGroup("导入订阅组", source: .subscription, id: groupID)
+    try makeTestCatalogStore(fileURL: fileURL).save(
+      CatalogDocument(
+        catalog: external,
+        subscriptions: [
+          SubscriptionRecord(
+            id: .fresh(), groupID: groupID, url: "https://provider.example/sub", status: .never)
+        ]))
+
+    coordinator.reloadCommittedStateFromStore()
+
+    XCTAssertEqual(coordinator.committedCatalog.rootChildren, [groupID], "已提交状态对齐磁盘")
+    XCTAssertEqual(
+      bootstrap.catalogSnapshotReader.catalogSnapshot.rootChildren, [groupID],
+      "独立导入 reload 发布到共享目录来源")
+    XCTAssertEqual(coordinator.committedSubscriptions.count, 1)
+    XCTAssertEqual(runtime.convergeCount, 0, "对齐不触发运行时收敛")
+  }
+
+  func testFailedPersistenceDoesNotPublishSharedCatalog() throws {
+    let blocker = workDir.appendingPathComponent("not-a-directory")
+    try Data().write(to: blocker)
+    let blockedStore = makeTestCatalogStore(fileURL: blocker.appendingPathComponent("catalog.json"))
+    let blockedBootstrap = CatalogCommitCoordinator.bootstrap(fileStore: blockedStore)
+    let blockedCoordinator = CatalogCommitCoordinator(
+      fileStore: blockedStore, runtime: runtime, bootstrap: blockedBootstrap)
+    let original = blockedBootstrap.catalogSnapshotReader.catalogSnapshot
+
+    XCTAssertThrowsError(
+      try blockedCoordinator.commit { catalog, _ in
+        try catalog.addTestServer("不能发布")
+      })
+
+    XCTAssertEqual(blockedBootstrap.catalogSnapshotReader.catalogSnapshot, original)
+    XCTAssertEqual(blockedCoordinator.committedCatalog, original)
+    XCTAssertEqual(runtime.convergeCount, 0, "持久化失败不驱动运行时")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/CatalogExpansionStateTests.swift b/ShadowsocksX-NG2/Tests/Catalog/CatalogExpansionStateTests.swift
new file mode 100644
index 000000000..2c893e149
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/CatalogExpansionStateTests.swift
@@ -0,0 +1,113 @@
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class CatalogExpansionStateTests: XCTestCase {
+  func testFreshStateIsFullyExpanded() {
+    let expansion = CatalogExpansionState()
+
+    XCTAssertTrue(expansion.collapsedGroupIDs.isEmpty)
+    XCTAssertFalse(expansion.isCollapsed(NodeID(rawValue: "g1")))
+  }
+
+  /// 切换语义：未收起 → 收起 → 再切换 → 展开（分区切换往返不重置的事实基础）。
+  func testToggleCollapsesThenReexpands() {
+    let expansion = CatalogExpansionState()
+    let id = NodeID(rawValue: "g1")
+
+    expansion.toggleCollapsed(id)
+    XCTAssertTrue(expansion.isCollapsed(id))
+
+    expansion.toggleCollapsed(id)
+    XCTAssertFalse(expansion.isCollapsed(id))
+  }
+
+  /// 服务器管理树的各组折叠事实按身份独立保存。
+  func testCollapseSetIsKeyedPerGroupID() {
+    let expansion = CatalogExpansionState()
+    let first = NodeID(rawValue: "g-first")
+    let second = NodeID(rawValue: "g-second")
+
+    expansion.toggleCollapsed(first)
+    expansion.toggleCollapsed(second)
+
+    XCTAssertEqual(expansion.collapsedGroupIDs, [first, second])
+
+    expansion.toggleCollapsed(first)
+    XCTAssertEqual(expansion.collapsedGroupIDs, [second])
+    XCTAssertFalse(expansion.isCollapsed(first))
+    XCTAssertTrue(expansion.isCollapsed(second))
+  }
+}
+
+@MainActor
+struct CatalogCreationExpansionTests {
+  @Test
+  func collapsingAncestorSelectsThatGroupAndPreservesOtherExpansionState() throws {
+    var catalog = ConfigurationCatalog()
+    let outer = try catalog.addGroup("外层")
+    let inner = try catalog.addGroup("内层", to: outer)
+    let selected = try catalog.addGroup("选中项", to: inner)
+    let other = try catalog.addGroup("其他")
+    let tree = CatalogTreeSnapshot.build(
+      from: catalog, plugins: NoManagedPluginProvider())
+    let node = try #require(tree.node(withID: outer))
+    let expansion = CatalogExpansionState()
+    expansion.toggleCollapsed(other)
+
+    let selection = expansion.setExpanded(false, for: node, selection: selected)
+
+    #expect(selection == outer)
+    #expect(expansion.collapsedGroupIDs == [outer, other])
+    #expect(expansion.setExpanded(true, for: node, selection: outer) == outer)
+    #expect(expansion.collapsedGroupIDs == [other])
+  }
+
+  @Test
+  func revealingCreatedNodeExpandsAncestorsAndPreservesOtherCollapsedGroups() throws {
+    var catalog = ConfigurationCatalog()
+    let outer = try catalog.addGroup("工作")
+    let inner = try catalog.addGroup("香港", to: outer)
+    let created = try catalog.addGroup("新组", to: inner)
+    let other = try catalog.addGroup("其他")
+    let tree = CatalogTreeSnapshot.build(
+      from: catalog, plugins: NoManagedPluginProvider())
+    let expansion = CatalogExpansionState()
+    for id in [outer, inner, other] { expansion.toggleCollapsed(id) }
+
+    expansion.reveal(created, in: tree)
+
+    #expect(expansion.collapsedGroupIDs == [other])
+    #expect(tree.visibleRows(collapsed: expansion.collapsedGroupIDs).map(\.id).contains(created))
+  }
+
+  @Test(arguments: [false, true])
+  func removedCreationParentRejectsWithoutFallingBackToRoot(createServer: Bool) async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.json")),
+        runtime: FakeCatalogRuntime()))
+    let parent = try await workflow.createGroup(named: "目标组", into: nil)
+    _ = try await workflow.remove(parent)
+
+    do {
+      if createServer {
+        _ = try await workflow.createServer(
+          ServerEditDraft(
+            address: "203.0.113.1", port: 8388, encryptionMethod: "aes-256-gcm",
+            password: "pw", remark: "新服务器", plugin: .none, pluginOptions: nil), into: parent)
+      } else {
+        _ = try await workflow.createGroup(named: "新组", into: parent)
+      }
+      Issue.record("失效的父组应拒绝创建")
+    } catch {
+      let underlying = error
+      #expect(underlying as? CatalogError == .parentNotFound(parent))
+    }
+    #expect(workflow.tree.isEmpty)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/CatalogFileStoreTests+Corruption.swift b/ShadowsocksX-NG2/Tests/Catalog/CatalogFileStoreTests+Corruption.swift
new file mode 100644
index 000000000..0ff968bda
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/CatalogFileStoreTests+Corruption.swift
@@ -0,0 +1,18 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct ServerLibraryCorruptionTests {
+  @Test func damagedFileIsPreserved() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let url = directory.appendingPathComponent("catalog.age")
+    let original = Data("damaged-ciphertext".utf8)
+    try original.write(to: url)
+    let store = makeTestCatalogStore(fileURL: url)
+    #expect(throws: (any Error).self) { try store.load() }
+    #expect(try Data(contentsOf: url) == original)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/CatalogFileStoreTests.swift b/ShadowsocksX-NG2/Tests/Catalog/CatalogFileStoreTests.swift
new file mode 100644
index 000000000..dbc3b8330
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/CatalogFileStoreTests.swift
@@ -0,0 +1,192 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 持久化缝：往返无损、文件缺失/损坏行为明确、权限基线、不含明文秘密。
+final class CatalogFileStoreTests: XCTestCase {
+  private var workDir: URL!
+  var store: CatalogFileStore!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-file-store-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    store = makeTestCatalogStore(fileURL: workDir.appendingPathComponent("catalog.json"))
+  }
+
+  override func tearDownWithError() throws {
+    try FileManager.default.removeItem(at: workDir)
+    try super.tearDownWithError()
+  }
+
+  // MARK: 往返无损
+
+  func testRoundTripIsLosslessAndKeepsIdentity() throws {
+    let original = try Self.makeRichCatalog()
+
+    try store.save(CatalogDocument(catalog: original))
+    let loaded = try store.load()
+
+    XCTAssertEqual(loaded.catalog, original, "结构、顺序、字段与订阅夹具全部无损")
+
+    let serverID = NodeID(rawValue: "manual:server")
+    let server = try XCTUnwrap(loaded.catalog.entry(for: serverID))
+    XCTAssertEqual(server.id, serverID, "身份跨持久化稳定")
+    guard case .server(let fields) = server.kind else { return XCTFail("目标应是服务器叶子") }
+    XCTAssertEqual(fields.pluginProgram, "v2ray-plugin", "插件程序引用原样保留")
+    XCTAssertEqual(fields.pluginOptions, "options")
+  }
+
+  func testSecondSaveReplacesContent() throws {
+    var catalog = ConfigurationCatalog()
+    let first = try catalog.addTestServer("first")
+    try store.save(CatalogDocument(catalog: catalog))
+
+    try catalog.remove(first)
+    _ = try catalog.addTestServer("second")
+    try store.save(CatalogDocument(catalog: catalog))
+
+    XCTAssertEqual(try store.load().catalog, catalog)
+    XCTAssertFalse(try store.load().catalog.contains(first), "旧内容被整体替换而非追加")
+  }
+
+  // MARK: 敏感信息
+
+  func testPersistedFileContainsNoPlaintextSecrets() throws {
+    var catalog = ConfigurationCatalog()
+    let fields = ServerFields(
+      address: "203.0.113.7",
+      port: 8388,
+      encryptionMethod: "aes-256-gcm",
+      password: "TOPSECRET-密码",
+      remark: "含插件",
+      pluginProgram: "v2ray-plugin",
+      pluginOptions: "obfs-local;obfs=http"
+    )
+    _ = try catalog.addServer(fields)
+
+    try store.save(CatalogDocument(catalog: catalog))
+
+    let raw = try Data(contentsOf: store.fileURL)
+    XCTAssertFalse(raw.range(of: Data("TOPSECRET-密码".utf8)) != nil, "密码明文不得进入持久化文件")
+    XCTAssertFalse(raw.range(of: Data("obfs-local;obfs=http".utf8)) != nil, "插件参数明文不得进入持久化文件")
+  }
+
+  /// 富夹具：订阅子树 + 手动组嵌套 + 空组 + 无效节点 + 重排后子序。
+  static func makeRichCatalog() throws -> ConfigurationCatalog {
+    var catalog = try CatalogFixtures.makeSubscriptionFixture(prefix: "sub9").catalog
+    let group = NodeID(rawValue: "manual:group")
+    try catalog.addGroup("手动组", id: group)
+    let server = NodeID(rawValue: "manual:server")
+    try catalog.addServer(
+      ServerFields(
+        address: "198.51.100.5",
+        port: 443,
+        encryptionMethod: "chacha20-ietf-poly1305",
+        password: "password",
+        remark: "带插件",
+        pluginProgram: "v2ray-plugin",
+        pluginOptions: "options"
+      ),
+      id: server,
+      to: group
+    )
+    _ = try catalog.addTestServer("无效", to: group)
+    try catalog.addGroup("空组", id: NodeID(rawValue: "manual:empty"))
+    try catalog.move(server, to: group, index: 0)
+    return catalog
+  }
+
+  // MARK: 订阅记录文档（v2）
+
+  func testSubscriptionRecordRoundTripsWithStatus() throws {
+    let catalog = try CatalogFixtures.makeSubscriptionFixture(prefix: "sub2").catalog
+    let record = SubscriptionRecord(
+      id: NodeID(rawValue: "sub2:source"),
+      groupID: NodeID(rawValue: "sub2:group"),
+      url: "https://provider.example/sub",
+      status: .failed(
+        at: Date(timeIntervalSince1970: 1_789_000_000),
+        failure: .httpStatus(code: 503)))
+
+    try store.save(CatalogDocument(catalog: catalog, subscriptions: [record]))
+    let loaded = try store.load()
+
+    XCTAssertEqual(loaded.subscriptions, [record], "订阅记录与刷新状态无损")
+    XCTAssertEqual(loaded.catalog, catalog)
+    XCTAssertFalse(
+      try Data(contentsOf: store.fileURL).range(of: Data("https://".utf8)) != nil,
+      "订阅 URL 明文不得落盘（D5：只存凭据引用）")
+  }
+
+  // MARK: 节点时间戳（v5，ADR-0031）
+
+  func testNodeTimestampsRoundTripLosslessly() throws {
+    var catalog = ConfigurationCatalog()
+    let created = Date(timeIntervalSince1970: 1_700_000_000)
+    let id = try catalog.addServer(
+      ServerFields(
+        address: "198.51.100.9",
+        port: 8388,
+        encryptionMethod: "aes-256-gcm",
+        password: "password",
+        remark: "时间戳"
+      ),
+      id: NodeID(rawValue: "manual:timestamped"),
+      now: created
+    )
+
+    try store.save(CatalogDocument(catalog: catalog))
+    let loaded = try store.load()
+
+    let entry = try XCTUnwrap(loaded.catalog.entry(for: id))
+    XCTAssertEqual(entry.createdAt, created, "创建时间无损")
+    XCTAssertEqual(entry.updatedAt, created)
+  }
+
+  /// 订阅记录 JSON 用真编码器生成：枚举 Codable 形状是实现细节，不在测试里手写。
+  private func subscriptionJSON(
+    id: String, groupID: String, url: String = "https://provider.example/sub"
+  ) throws -> String {
+    let record = SubscriptionRecord(
+      id: NodeID(rawValue: id),
+      groupID: NodeID(rawValue: groupID),
+      url: url,
+      status: .never)
+    return String(data: try JSONEncoder().encode(record), encoding: .utf8)!
+  }
+
+  func testSubscriptionGroupMissingLoadsAsCorrupt() throws {
+    let recordJSON = try subscriptionJSON(id: "sub-x", groupID: "ghost")
+    let payload =
+      """
+      {"version": 7, "rootChildren": [], "entries": [], "favoriteIDs": [], "subscriptions": [\(recordJSON)]}
+      """
+    XCTAssertThrowsError(try CatalogFileStore.decode(Data(payload.utf8))) { error in
+      guard
+        case CatalogFileStore.PersistenceError.corrupt? = error
+          as? CatalogFileStore.PersistenceError
+      else {
+        return XCTFail("固定分组缺失应报 corrupt，实际 \(error)")
+      }
+    }
+  }
+
+  func testDuplicateSubscriptionIDLoadsAsCorrupt() throws {
+    let first = try subscriptionJSON(id: "sub-x", groupID: "g1", url: "https://provider.example/u")
+    let second = try subscriptionJSON(id: "sub-x", groupID: "g1", url: "https://provider.example/v")
+    let payload =
+      """
+      {"version": 7, "rootChildren": [], "entries": [], "favoriteIDs": [], "subscriptions": [\(first), \(second)]}
+      """
+    XCTAssertThrowsError(try CatalogFileStore.decode(Data(payload.utf8))) { error in
+      guard
+        case CatalogFileStore.PersistenceError.corrupt? = error
+          as? CatalogFileStore.PersistenceError
+      else {
+        return XCTFail("重复订阅身份应报 corrupt，实际 \(error)")
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/CatalogTreeProjectionTests.swift b/ShadowsocksX-NG2/Tests/Catalog/CatalogTreeProjectionTests.swift
new file mode 100644
index 000000000..3e06f6f68
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/CatalogTreeProjectionTests.swift
@@ -0,0 +1,270 @@
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// CatalogTreeSnapshot 树投影的纯单元测试：折叠可见行与服务器叶子计数。
+/// 直接构造 snapshot（memberwise init），不经工作流。
+final class CatalogTreeProjectionTests: XCTestCase {
+  private func server(_ id: String) -> CatalogTreeNode {
+    CatalogTreeNode(
+      id: NodeID(rawValue: id), name: id, isGroup: false, source: .manual, parentID: nil,
+      createdAt: nil, updatedAt: nil,
+      invalidReasons: [], childCount: 0, subtreeNodeCount: 0, invalidDescendantCount: 0,
+      children: nil)
+  }
+
+  private func group(_ id: String, children: [CatalogTreeNode]) -> CatalogTreeNode {
+    CatalogTreeNode(
+      id: NodeID(rawValue: id), name: id, isGroup: true, source: .manual, parentID: nil,
+      createdAt: nil, updatedAt: nil,
+      invalidReasons: [], childCount: children.count,
+      subtreeNodeCount: children.reduce(0) { $0 + 1 + $1.subtreeNodeCount },
+      invalidDescendantCount: 0, children: children)
+  }
+
+  /// 两层嵌套 + 根叶子 + 空组：覆盖深度、子树跳过与空组语义。
+  private func nestedTree() -> CatalogTreeSnapshot {
+    CatalogTreeSnapshot(roots: [
+      server("root-server"),
+      group(
+        "outer",
+        children: [
+          group("inner", children: [server("deep-leaf")]),
+          server("outer-leaf"),
+        ]),
+      group("empty", children: []),
+    ])
+  }
+
+  // MARK: - 可见行折叠投影
+
+  func testVisibleRowsWalkDepthFirstWithDepth() {
+    let rows = nestedTree().visibleRows(collapsed: [])
+    XCTAssertEqual(
+      rows.map(\.id.rawValue),
+      ["root-server", "outer", "inner", "deep-leaf", "outer-leaf", "empty"])
+    XCTAssertEqual(rows.map(\.depth), [0, 0, 1, 2, 1, 0])
+  }
+
+  func testVisibleRowsSkipCollapsedSubtrees() {
+    let tree = nestedTree()
+    XCTAssertEqual(
+      tree.visibleRows(collapsed: [NodeID(rawValue: "outer")]).map(\.id.rawValue),
+      ["root-server", "outer", "empty"], "收起组的子树不出现，组行自身保留可再展开")
+    XCTAssertEqual(
+      tree.visibleRows(collapsed: [NodeID(rawValue: "inner")]).map(\.id.rawValue),
+      ["root-server", "outer", "inner", "outer-leaf", "empty"])
+  }
+
+  func testVisibleRowsTreatUnknownAndLeafIDsAsInert() {
+    let collapsed: Set<NodeID> = [NodeID(rawValue: "nope"), NodeID(rawValue: "root-server")]
+    XCTAssertEqual(
+      nestedTree().visibleRows(collapsed: collapsed).map(\.id.rawValue),
+      ["root-server", "outer", "inner", "deep-leaf", "outer-leaf", "empty"])
+  }
+
+  // MARK: - 服务器叶子计数
+
+  func testServerLeafCountCountsLeavesAcrossNesting() {
+    XCTAssertEqual(nestedTree().serverLeafCount, 3)
+    XCTAssertEqual(CatalogTreeSnapshot(roots: []).serverLeafCount, 0)
+  }
+}
+
+struct CatalogTreeTimestampProjectionTests {
+  @Test
+  func treeExposesCommittedCreationAndModificationTimes() throws {
+    var catalog = ConfigurationCatalog()
+    let created = Date(timeIntervalSince1970: 100)
+    let modified = Date(timeIntervalSince1970: 200)
+    let group = try catalog.addGroup("原名", now: created)
+    try catalog.renameGroup(group, to: "新名", now: modified)
+    let tree = CatalogTreeSnapshot.build(
+      from: catalog, plugins: NoManagedPluginProvider())
+
+    #expect(tree.node(withID: group)?.createdAt == created)
+    #expect(tree.node(withID: group)?.updatedAt == modified)
+  }
+}
+
+struct SubscriptionRootGroupClassificationTests {
+  private func node(
+    _ id: String, source: NodeSource, parentID: NodeID?, isGroup: Bool = true
+  ) -> CatalogTreeNode {
+    CatalogTreeNode(
+      id: NodeID(rawValue: id), name: id, isGroup: isGroup, source: source, parentID: parentID,
+      createdAt: nil, updatedAt: nil, invalidReasons: [], childCount: 0,
+      subtreeNodeCount: 0, invalidDescendantCount: 0, children: isGroup ? [] : nil)
+  }
+
+  @Test
+  func onlyRootSubscriptionGroupsQualify() {
+    let rootID = NodeID(rawValue: "subscription-root")
+    let root = node("subscription-root", source: .subscription, parentID: nil)
+    let nested = node("nested-subscription-group", source: .subscription, parentID: rootID)
+    let manual = node("manual-group", source: .manual, parentID: nil)
+    let server = node("subscription-server", source: .subscription, parentID: nil, isGroup: false)
+
+    #expect(root.isRootSubscriptionGroup)
+    #expect(!nested.isRootSubscriptionGroup)
+    #expect(!manual.isRootSubscriptionGroup)
+    #expect(!server.isRootSubscriptionGroup)
+  }
+}
+
+struct ServerTableDirectoryOrderTests {
+  @Test
+  func hierarchyKeepsDirectoryOrderAndCollapseHidesOnlyThatSubtree() throws {
+    var catalog = ConfigurationCatalog()
+    let outer = try catalog.addGroup("Z 外层")
+    let root = try catalog.addGroup("A 根层")
+    let childZ = try catalog.addGroup("Z 子组", to: outer)
+    let childA = try catalog.addGroup("A 子组", to: outer)
+    let leaf = try catalog.addGroup("孙节点", to: childA)
+    let tree = CatalogTreeSnapshot.build(
+      from: catalog, plugins: NoManagedPluginProvider())
+    let rows = tree.visibleRows(source: .manual, collapsed: [])
+
+    #expect(rows.map(\.id) == [outer, childZ, childA, leaf, root])
+    #expect(rows.map(\.depth) == [0, 1, 1, 2, 0])
+    #expect(
+      tree.visibleRows(
+        source: .manual, collapsed: [outer]
+      ).map(\.id) == [outer, root])
+    #expect(tree.roots.map(\.id) == [outer, root])
+    #expect(tree.node(withID: outer)?.childNodes.map(\.id) == [childZ, childA])
+  }
+
+  @Test
+  func sourceFilteringKeepsDirectoryOrderAndCompleteSubtrees() {
+    func node(
+      _ id: String, source: NodeSource = .manual, parentID: NodeID? = nil,
+      children: [CatalogTreeNode] = []
+    ) -> CatalogTreeNode {
+      CatalogTreeNode(
+        id: NodeID(rawValue: id), name: id, isGroup: true, source: source, parentID: parentID,
+        createdAt: nil, updatedAt: nil, invalidReasons: [], childCount: children.count,
+        subtreeNodeCount: children.count, invalidDescendantCount: 0, children: children)
+    }
+    let subscription = node(
+      "subscription", source: .subscription,
+      children: [
+        node(
+          "subscription-child", source: .subscription,
+          parentID: NodeID(rawValue: "subscription"))
+      ])
+    let tree = CatalogTreeSnapshot(roots: [
+      node("Z-first"), subscription, node("A-last"),
+    ])
+    #expect(
+      tree.visibleRows(source: .manual, collapsed: []).map(\.id.rawValue)
+        == ["Z-first", "A-last"])
+    let subscriptionRows = tree.visibleRows(source: .subscription, collapsed: [])
+    #expect(subscriptionRows.map(\.id.rawValue) == ["subscription", "subscription-child"])
+    #expect(subscriptionRows.map(\.depth) == [0, 1])
+    #expect(
+      tree.visibleRows(source: .subscription, collapsed: [subscription.id]).map(\.id.rawValue)
+        == ["subscription"])
+    #expect(
+      tree.visibleRows(collapsed: []).map(\.id.rawValue)
+        == ["Z-first", "subscription", "subscription-child", "A-last"])
+  }
+}
+
+@MainActor
+struct ServerTableInsertionTests {
+  @Test
+  func insertionLinesUseTheDestinationRowsParent() throws {
+    var catalog = ConfigurationCatalog()
+    let outer = try catalog.addGroup("外层")
+    let inner = try catalog.addGroup("内层", to: outer)
+    let leaf = try catalog.addGroup("内层成员", to: inner)
+    let sibling = try catalog.addGroup("外层成员", to: outer)
+    let root = try catalog.addGroup("根层")
+    let tree = CatalogTreeSnapshot.build(
+      from: catalog, plugins: NoManagedPluginProvider())
+    let rows = tree.visibleRows(collapsed: [])
+    #expect(rows.map(\.id) == [outer, inner, leaf, sibling, root])
+
+    #expect(ServerTableDropState.insertionParent(at: 0, in: rows) == nil)
+    #expect(ServerTableDropState.insertionParent(at: 1, in: rows) == outer)
+    #expect(ServerTableDropState.insertionParent(at: 2, in: rows) == inner)
+    #expect(ServerTableDropState.insertionParent(at: 3, in: rows) == outer)
+    #expect(ServerTableDropState.insertionParent(at: 4, in: rows) == nil)
+    #expect(ServerTableDropState.insertionParent(at: rows.count, in: rows) == nil)
+
+    let collapsed = tree.visibleRows(collapsed: [inner])
+    #expect(ServerTableDropState.insertionParent(at: 2, in: collapsed) == outer)
+    #expect(ServerTableDropState.insertionParent(at: 0, in: []) == nil)
+  }
+}
+
+/// 活动目标行标记的祖先推导：空心闪电候选是活动目标的严格祖先分组。
+struct CatalogTreeActiveTargetAncestorTests {
+  private struct Fixture {
+    let tree: CatalogTreeSnapshot
+    let outer: NodeID
+    let inner: NodeID
+    let deepLeaf: NodeID
+    let rootServer: NodeID
+  }
+
+  private func nestedTree() throws -> Fixture {
+    var catalog = ConfigurationCatalog()
+    let outer = try catalog.addGroup("外层")
+    let inner = try catalog.addGroup("内层", to: outer)
+    let deepLeaf = try catalog.addTestServer("深层服务器", to: inner)
+    let rootServer = try catalog.addTestServer("根层服务器")
+    let tree = CatalogTreeSnapshot.build(from: catalog, plugins: NoManagedPluginProvider())
+    return Fixture(
+      tree: tree, outer: outer, inner: inner, deepLeaf: deepLeaf, rootServer: rootServer)
+  }
+
+  @Test
+  func absentOrUnknownActiveTargetYieldsNoAncestors() throws {
+    let fixture = try nestedTree()
+    #expect(fixture.tree.ancestors(of: nil).isEmpty)
+    #expect(fixture.tree.ancestors(of: NodeID(rawValue: "nope")).isEmpty)
+  }
+
+  @Test
+  func deepServerYieldsEveryAncestorGroup() throws {
+    let fixture = try nestedTree()
+    #expect(fixture.tree.ancestors(of: fixture.deepLeaf) == [fixture.outer, fixture.inner])
+    #expect(fixture.tree.ancestors(of: fixture.rootServer).isEmpty)
+  }
+
+  @Test
+  func activeGroupItselfIsExcludedFromItsOwnAncestors() throws {
+    let fixture = try nestedTree()
+    #expect(fixture.tree.ancestors(of: fixture.inner) == [fixture.outer])
+    #expect(fixture.tree.ancestors(of: fixture.outer).isEmpty)
+  }
+}
+
+@MainActor
+struct ServerTableRowDropTests {
+  @Test
+  func serverRowMovesAnOutsideNodeIntoItsContainingGroup() throws {
+    var catalog = ConfigurationCatalog()
+    let outer = try catalog.addGroup("外层")
+    let inner = try catalog.addGroup("内层", to: outer)
+    let member = try catalog.addTestServer("组内服务器", to: inner)
+    let outside = try catalog.addTestServer("组外服务器")
+    let tree = CatalogTreeSnapshot.build(
+      from: catalog, plugins: NoManagedPluginProvider())
+    let memberNode = try #require(tree.node(withID: member))
+    let parent = ServerTableDropState.rowParent(for: memberNode)
+    #expect(parent == inner)
+    #expect(ServerTableDropState.rowParent(for: try #require(tree.node(withID: inner))) == inner)
+    #expect(ServerTableDropState.rowParent(for: try #require(tree.node(withID: outside))) == nil)
+
+    try catalog.move(outside, to: parent)
+    let movedTree = CatalogTreeSnapshot.build(
+      from: catalog, plugins: NoManagedPluginProvider())
+    #expect(movedTree.node(withID: outside)?.parentID == inner)
+    #expect(movedTree.node(withID: member)?.parentID == inner)
+    #expect(movedTree.node(withID: inner)?.childNodes.map(\.id) == [member, outside])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/ConfigurationCatalogRejectionTests.swift b/ShadowsocksX-NG2/Tests/Catalog/ConfigurationCatalogRejectionTests.swift
new file mode 100644
index 000000000..4dfe5f8f2
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/ConfigurationCatalogRejectionTests.swift
@@ -0,0 +1,157 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 非法操作拒绝：跨来源、身份复用（共享父）、成环、越界与不存在的容器/节点，
+/// 全部带明确原因，且失败不产生任何变更。
+final class ConfigurationCatalogRejectionTests: XCTestCase {
+  func testCrossSourceMoveIsRejected() throws {
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    var catalog = fixture.catalog
+    let manual = try catalog.addTestServer("手动节点")
+
+    XCTAssertThrowsError(try catalog.move(manual, to: fixture.groupID)) { error in
+      XCTAssertEqual(
+        error as? CatalogError,
+        .crossSourcePlacement(node: .manual, container: .subscription),
+        "手动节点不得并入订阅子树"
+      )
+    }
+    XCTAssertEqual(try catalog.parentID(of: manual), nil, "被拒操作不得产生任何变更")
+  }
+
+  func testSubscriptionNodesRejectMoveAndRemove() throws {
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    var catalog = fixture.catalog
+    let subscriptionServer = fixture.serverIDs[0]
+
+    XCTAssertThrowsError(try catalog.move(subscriptionServer, to: nil)) { error in
+      XCTAssertEqual(error as? CatalogError, .subscriptionNodeImmutable(subscriptionServer))
+    }
+    XCTAssertThrowsError(try catalog.move(fixture.nestedGroupID, to: fixture.groupID)) { error in
+      XCTAssertEqual(error as? CatalogError, .subscriptionNodeImmutable(fixture.nestedGroupID))
+    }
+    XCTAssertThrowsError(try catalog.remove(fixture.groupID)) { error in
+      XCTAssertEqual(error as? CatalogError, .subscriptionNodeImmutable(fixture.groupID))
+    }
+    XCTAssertTrue(catalog.contains(fixture.groupID), "被拒删除不得产生任何变更")
+  }
+
+  func testSubscriptionNodesRejectRenameAndFieldEdit() throws {
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    var catalog = fixture.catalog
+    let subscriptionServer = fixture.serverIDs[0]
+
+    XCTAssertThrowsError(try catalog.renameGroup(fixture.groupID, to: "改名")) { error in
+      XCTAssertEqual(error as? CatalogError, .subscriptionNodeImmutable(fixture.groupID))
+    }
+    XCTAssertThrowsError(
+      try catalog.updateServer(subscriptionServer, with: CatalogFixtures.serverFields(remark: "x"))
+    ) { error in
+      XCTAssertEqual(error as? CatalogError, .subscriptionNodeImmutable(subscriptionServer))
+    }
+  }
+
+  func testMoveGroupIntoItsOwnSubtreeIsRejected() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let nested = try catalog.addGroup("嵌套组", to: group)
+
+    XCTAssertThrowsError(try catalog.move(group, to: group)) { error in
+      XCTAssertEqual(error as? CatalogError, .cycleDetected(group), "移入自身成环")
+    }
+    XCTAssertThrowsError(try catalog.move(group, to: nested)) { error in
+      XCTAssertEqual(error as? CatalogError, .cycleDetected(group), "移入自身深层子树同样成环")
+    }
+    XCTAssertEqual(try catalog.children(of: group), [nested], "被拒操作不得产生任何变更")
+  }
+
+  func testAddingNodeWithExistingIdentityIsRejectedAsDuplicateID() throws {
+    var catalog = ConfigurationCatalog()
+    let existing = try catalog.addTestServer("已存在")
+    let group = try catalog.addGroup("组")
+
+    XCTAssertThrowsError(try catalog.addTestServer("新节点", id: existing)) { error in
+      XCTAssertEqual(
+        error as? CatalogError, .duplicateID(existing),
+        "同一身份不得出现两份（身份复用即共享父）"
+      )
+    }
+    XCTAssertThrowsError(try catalog.addGroup("新组", id: existing, to: group)) { error in
+      XCTAssertEqual(error as? CatalogError, .duplicateID(existing))
+    }
+    XCTAssertEqual(catalog.entries.count, 2, "被拒操作不得产生任何变更")
+  }
+
+  func testSubscriptionServerAtRootIsRejected() throws {
+    var catalog = ConfigurationCatalog()
+
+    XCTAssertThrowsError(
+      try catalog.addTestServer("游离订阅节点", source: .subscription)
+    ) { error in
+      guard case CatalogError.subscriptionServerAtRoot? = error as? CatalogError else {
+        return XCTFail("应报 subscriptionServerAtRoot，实际 \(error)")
+      }
+    }
+    XCTAssertTrue(catalog.isEmpty, "被拒操作不得产生任何变更")
+  }
+
+  func testMissingOrNonGroupParentIsRejected() throws {
+    var catalog = ConfigurationCatalog()
+    let server = try catalog.addTestServer("leaf")
+    let missing = NodeID(rawValue: "missing")
+
+    XCTAssertThrowsError(try catalog.addTestServer("x", to: missing)) { error in
+      XCTAssertEqual(error as? CatalogError, .parentNotFound(missing))
+    }
+    XCTAssertThrowsError(try catalog.addTestServer("x", to: server)) { error in
+      XCTAssertEqual(error as? CatalogError, .parentNotAGroup(server), "服务器叶子不是容器")
+    }
+    XCTAssertThrowsError(try catalog.move(server, to: missing)) { error in
+      XCTAssertEqual(error as? CatalogError, .parentNotFound(missing))
+    }
+    XCTAssertThrowsError(try catalog.move(server, to: server)) { error in
+      XCTAssertEqual(error as? CatalogError, .cycleDetected(server), "叶子移入自身优先判成环")
+    }
+  }
+
+  func testIndexOutOfRangeIsRejected() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let leaf = try catalog.addTestServer("leaf")
+
+    XCTAssertThrowsError(try catalog.addTestServer("x", to: group, index: 1)) { error in
+      XCTAssertEqual(
+        error as? CatalogError, .indexOutOfRange(parent: group, index: 1, childCount: 0))
+    }
+    XCTAssertThrowsError(try catalog.move(leaf, to: nil, index: -1)) { error in
+      XCTAssertEqual(
+        error as? CatalogError, .indexOutOfRange(parent: nil, index: -1, childCount: 1))
+    }
+    XCTAssertThrowsError(try catalog.move(leaf, to: nil, index: 2)) { error in
+      XCTAssertEqual(
+        error as? CatalogError, .indexOutOfRange(parent: nil, index: 2, childCount: 1),
+        "重排范围以摘除自身后的子序计")
+    }
+  }
+
+  func testOperationsOnUnknownNodesAreRejected() throws {
+    var catalog = ConfigurationCatalog()
+    let missing = NodeID(rawValue: "missing")
+
+    XCTAssertThrowsError(try catalog.renameGroup(missing, to: "x")) { error in
+      XCTAssertEqual(error as? CatalogError, .nodeNotFound(missing))
+    }
+    XCTAssertThrowsError(
+      try catalog.updateServer(missing, with: CatalogFixtures.serverFields(remark: "x"))
+    ) { error in
+      XCTAssertEqual(error as? CatalogError, .nodeNotFound(missing))
+    }
+    XCTAssertThrowsError(try catalog.move(missing, to: nil)) { error in
+      XCTAssertEqual(error as? CatalogError, .nodeNotFound(missing))
+    }
+    XCTAssertThrowsError(try catalog.remove(missing)) { error in
+      XCTAssertEqual(error as? CatalogError, .nodeNotFound(missing))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/ConfigurationCatalogTests.swift b/ShadowsocksX-NG2/Tests/Catalog/ConfigurationCatalogTests.swift
new file mode 100644
index 000000000..996597dbe
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/ConfigurationCatalogTests.swift
@@ -0,0 +1,140 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 主缝测试：配置目录树操作。覆盖增删改、移动和重排，保持身份与
+/// 子序；空组持久保留。非法操作的拒绝用例见 ConfigurationCatalogRejectionTests。
+final class ConfigurationCatalogTests: XCTestCase {
+  func testAddServersAtRootGeneratesFreshIdentityAndPreservesOrder() throws {
+    var catalog = ConfigurationCatalog()
+    let first = try catalog.addTestServer("香港 01")
+    let second = try catalog.addTestServer("日本 02")
+
+    XCTAssertNotEqual(first, second, "每次新建必须生成全新身份")
+    XCTAssertEqual(try catalog.children(of: nil), [first, second], "根子序按插入顺序")
+    let entry = try XCTUnwrap(catalog.entry(for: first))
+    XCTAssertEqual(entry.source, .manual)
+    guard case .server(let fields) = entry.kind else { return XCTFail("应为服务器叶子") }
+    XCTAssertEqual(fields.remark, "香港 01")
+    XCTAssertEqual(fields.address, "203.0.113.7")
+    XCTAssertEqual(fields.port, 8388)
+  }
+
+  func testAddGroupWithProposedIDAndExplicitChildIndex() throws {
+    var catalog = ConfigurationCatalog()
+    let group = NodeID(rawValue: "manual-group-1")
+    try catalog.addGroup("自用", id: group)
+    let first = try catalog.addTestServer("a", to: group, index: 0)
+    let second = try catalog.addTestServer("b", to: group)
+
+    XCTAssertEqual(try catalog.children(of: group), [first, second])
+    let third = try catalog.addTestServer("c", to: group, index: 1)
+    XCTAssertEqual(try catalog.children(of: group), [first, third, second], "显式索引插入")
+  }
+
+  func testUpdateServerAndRenameGroupPreserveIdentityAndOrder() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("旧名")
+    let orderBefore = try catalog.children(of: nil)
+    let first = try catalog.addTestServer("a", to: group)
+    let second = try catalog.addTestServer("b", to: group)
+
+    let newFields = ServerFields(
+      address: "198.51.100.9",
+      port: 443,
+      encryptionMethod: "chacha20-ietf-poly1305",
+      password: "password",
+      remark: "a-改名",
+      pluginProgram: nil,
+      pluginOptions: nil
+    )
+    try catalog.updateServer(first, with: newFields)
+    try catalog.renameGroup(group, to: "新名")
+
+    XCTAssertEqual(catalog.entry(for: first)?.id, first, "改字段不改身份")
+    XCTAssertEqual(try catalog.children(of: group), [first, second], "改字段不改子序")
+    XCTAssertEqual(try catalog.children(of: nil), orderBefore)
+    guard case .server(let fields)? = catalog.entry(for: first)?.kind else {
+      return XCTFail("目标应是服务器叶子")
+    }
+    XCTAssertEqual(fields.address, "198.51.100.9")
+    XCTAssertEqual(fields.pluginProgram, nil, "插件字段按提交值原样存储")
+    guard case .group(let groupFields) = catalog.entry(for: group)?.kind else {
+      return XCTFail("目标应是分组")
+    }
+    XCTAssertEqual(groupFields.name, "新名")
+  }
+
+  func testMoveCarriesSubtreeWithoutChangingIdentityOrChildOrder() throws {
+    var catalog = ConfigurationCatalog()
+    let target = try catalog.addGroup("目标组")
+    let moved = try catalog.addGroup("被移组")
+    let leaf = try catalog.addTestServer("leaf", to: moved)
+    let nested = try catalog.addGroup("嵌套组", to: moved)
+    let deepLeaf = try catalog.addTestServer("deep", to: nested)
+
+    try catalog.move(moved, to: target)
+
+    XCTAssertEqual(try catalog.parentID(of: moved), target, "单父随移动更新")
+    XCTAssertEqual(try catalog.children(of: moved), [leaf, nested], "子树与显子序原样携带")
+    XCTAssertEqual(try catalog.children(of: nested), [deepLeaf])
+    XCTAssertEqual(try catalog.children(of: nil), [target], "根子序只剩未移动节点")
+    XCTAssertNotNil(catalog.entry(for: deepLeaf), "后代身份不变")
+  }
+
+  func testReorderWithinParentChangesOnlyPosition() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let first = try catalog.addTestServer("a", to: group)
+    let second = try catalog.addTestServer("b", to: group)
+    let third = try catalog.addTestServer("c", to: group)
+
+    try catalog.move(second, to: group, index: 0)
+
+    XCTAssertEqual(try catalog.children(of: group), [second, first, third])
+  }
+
+  func testRemoveServerLeafKeepsSiblingsAndReturnsEntryForCredentialCleanup() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let first = try catalog.addTestServer("a", to: group)
+    let second = try catalog.addTestServer("b", to: group)
+
+    let removed = try catalog.remove(first)
+
+    XCTAssertEqual(removed.map(\.id), [first])
+    XCTAssertEqual(catalog.contains(first), false)
+    XCTAssertEqual(try catalog.children(of: group), [second])
+    let entry = try XCTUnwrap(removed.first)
+    guard case .server(let fields) = entry.kind else { return XCTFail("被删节点应是服务器叶子") }
+    XCTAssertNotEqual(fields.password, "", "被删节点携带凭据引用，供调用方清理 Keychain")
+  }
+
+  func testRemoveNonEmptyManualGroupIsRecursive() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let leaf = try catalog.addTestServer("leaf", to: group)
+    let nested = try catalog.addGroup("嵌套组", to: group)
+    let deep = try catalog.addTestServer("deep", to: nested)
+
+    let removed = try catalog.remove(group)
+
+    XCTAssertEqual(Set(removed.map(\.id)), Set([group, leaf, nested, deep]))
+    XCTAssertEqual(catalog.entries.count, 0, "整棵子树全部移除")
+    XCTAssertEqual(try catalog.children(of: nil), [], "根子序同步移除")
+  }
+
+  func testEmptyGroupIsExplicitlyRemovableAndOtherwiseRetained() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组")
+    let only = try catalog.addTestServer("only", to: group)
+
+    try catalog.remove(only)
+    XCTAssertTrue(catalog.contains(group), "删空子节点后空组持久保留，不被回收")
+
+    let removed = try catalog.remove(group)
+    XCTAssertEqual(removed.map(\.id), [group])
+    XCTAssertFalse(catalog.contains(group), "空组允许显式删除")
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/ConfigurationCatalogTimestampTests.swift b/ShadowsocksX-NG2/Tests/Catalog/ConfigurationCatalogTimestampTests.swift
new file mode 100644
index 000000000..749f6dc97
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/ConfigurationCatalogTimestampTests.swift
@@ -0,0 +1,228 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 节点时间戳语义（ADR-0031）：节点自身资料变化更新自身修改时间；分组的
+/// 直接子节点集合或顺序变化更新该分组（类目录修改时间）；被移动节点自身
+/// 不动；内容未变不更新。订阅刷新按节点内容逐项比较。
+final class ConfigurationCatalogTimestampTests: XCTestCase {
+  private let time0 = Date(timeIntervalSince1970: 1_700_000_000)
+  private let time1 = Date(timeIntervalSince1970: 1_700_001_000)
+  private let time2 = Date(timeIntervalSince1970: 1_700_002_000)
+
+  // MARK: 手动子树
+
+  func testNewNodeStampsBothTimesAndBumpsParentGroup() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组", now: time0)
+    let leaf = try catalog.addTestServer("a", to: group, now: time1)
+
+    let groupEntry = try XCTUnwrap(catalog.entry(for: group))
+    let leafEntry = try XCTUnwrap(catalog.entry(for: leaf))
+    XCTAssertEqual(groupEntry.createdAt, time0)
+    XCTAssertEqual(groupEntry.updatedAt, time1, "新增子节点更新落点分组修改时间")
+    XCTAssertEqual(leafEntry.createdAt, time1)
+    XCTAssertEqual(leafEntry.updatedAt, time1)
+  }
+
+  func testUpdateServerBumpsOnlyWhenContentChanges() throws {
+    var catalog = ConfigurationCatalog()
+    let id = try catalog.addTestServer("a", now: time0)
+    guard case .server(var fields)? = catalog.entry(for: id)?.kind else {
+      return XCTFail("应为服务器叶子")
+    }
+
+    fields.port = 9999
+    try catalog.updateServer(id, with: fields, now: time1)
+    XCTAssertEqual(catalog.entry(for: id)?.updatedAt, time1, "内容变化更新修改时间")
+    XCTAssertEqual(catalog.entry(for: id)?.createdAt, time0, "创建时间保留")
+
+    try catalog.updateServer(id, with: fields, now: time2)
+    XCTAssertEqual(catalog.entry(for: id)?.updatedAt, time1, "内容未变不更新修改时间")
+  }
+
+  func testRenameGroupBumpsOnlyWhenNameChanges() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("旧名", now: time0)
+
+    try catalog.renameGroup(group, to: "旧名", now: time1)
+    XCTAssertEqual(catalog.entry(for: group)?.updatedAt, time0, "同名重命名是内容未变")
+
+    try catalog.renameGroup(group, to: "新名", now: time2)
+    XCTAssertEqual(catalog.entry(for: group)?.updatedAt, time2)
+    XCTAssertEqual(catalog.entry(for: group)?.createdAt, time0)
+  }
+
+  func testMoveBumpsSourceAndTargetGroupsButNotMovedNode() throws {
+    var catalog = ConfigurationCatalog()
+    let source = try catalog.addGroup("源组", now: time0)
+    let target = try catalog.addGroup("目标组", now: time0)
+    let leaf = try catalog.addTestServer("a", to: source, now: time0)
+
+    try catalog.move(leaf, to: target, now: time1)
+
+    XCTAssertEqual(catalog.entry(for: leaf)?.updatedAt, time0, "被移动节点自身内容不变")
+    XCTAssertEqual(catalog.entry(for: source)?.updatedAt, time1, "原分组失去子节点")
+    XCTAssertEqual(catalog.entry(for: target)?.updatedAt, time1, "目标分组获得子节点")
+  }
+
+  func testReorderBumpsParentOnly() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组", now: time0)
+    let first = try catalog.addTestServer("a", to: group, now: time0)
+    let second = try catalog.addTestServer("b", to: group, now: time0)
+
+    try catalog.move(second, to: group, index: 0, now: time1)
+
+    XCTAssertEqual(try catalog.children(of: group), [second, first])
+    XCTAssertEqual(catalog.entry(for: group)?.updatedAt, time1, "直接子序变化更新分组")
+    XCTAssertEqual(catalog.entry(for: first)?.updatedAt, time0)
+    XCTAssertEqual(catalog.entry(for: second)?.updatedAt, time0)
+  }
+
+  func testRemoveBumpsParentGroupOfRemovedRoot() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("组", now: time0)
+    let leaf = try catalog.addTestServer("a", to: group, now: time0)
+
+    _ = try catalog.remove(leaf, now: time1)
+
+    XCTAssertFalse(catalog.contains(leaf))
+    XCTAssertEqual(catalog.entry(for: group)?.updatedAt, time1, "分组失去子节点")
+  }
+
+  func testRootLevelChangesDoNotTouchAnyTimestamp() throws {
+    var catalog = ConfigurationCatalog()
+    let first = try catalog.addTestServer("a", now: time0)
+    let second = try catalog.addTestServer("b", now: time1)
+
+    _ = try catalog.remove(first, now: time2)
+
+    XCTAssertEqual(catalog.entry(for: second)?.updatedAt, time1, "根层结构变化无分组可更新")
+  }
+
+  // MARK: 订阅快照刷新
+
+  private let groupID = NodeID(rawValue: "t:group")
+  private let nestedID = NodeID(rawValue: "t:nested")
+  private let leafA = NodeID(rawValue: "t:a")
+  private let leafB = NodeID(rawValue: "t:b")
+
+  private func fields(remark: String, port: Int = 8388) -> ServerFields {
+    ServerFields(
+      address: "203.0.113.7",
+      port: port,
+      encryptionMethod: "aes-256-gcm",
+      password: "password",
+      remark: remark
+    )
+  }
+
+  /// 固定分组（嵌套分组 + 两个服务器叶子）与快照同构的目录夹具。
+  private func makeSubscriptionCatalog() throws -> ConfigurationCatalog {
+    var catalog = ConfigurationCatalog()
+    try catalog.addGroup("订阅分组", source: .subscription, id: groupID, now: time0)
+    try catalog.addGroup("嵌套分组", source: .subscription, id: nestedID, to: groupID, now: time0)
+    try catalog.addServer(
+      fields(remark: "a"), source: .subscription, id: leafA, to: groupID, now: time0)
+    try catalog.addServer(
+      fields(remark: "b"), source: .subscription, id: leafB, to: nestedID, now: time0)
+    return catalog
+  }
+
+  /// 与夹具同构的快照（固定分组 = 嵌套分组 + 服务器 a；嵌套 = 服务器 b），
+  /// 各参数可单独改写以制造远端变化。
+  private func snapshot(
+    name: String = "订阅分组",
+    nestedName: String = "嵌套分组",
+    nestedChildren: [CatalogSubscriptionSnapshot.Child]
+  ) -> CatalogSubscriptionSnapshot {
+    let nested = CatalogSubscriptionSnapshot.Group(
+      id: nestedID, name: nestedName, children: nestedChildren)
+    return CatalogSubscriptionSnapshot(
+      name: name,
+      root: CatalogSubscriptionSnapshot.Group(
+        id: NodeID(rawValue: "t:remote-root"), name: name,
+        children: [
+          CatalogSubscriptionSnapshot.Child.group(nested),
+          leaf(leafA, fields(remark: "a")),
+        ]))
+  }
+
+  private func leaf(
+    _ id: NodeID, _ leafFields: ServerFields
+  ) -> CatalogSubscriptionSnapshot.Child {
+    .server(.init(id: id, fields: leafFields))
+  }
+
+  func testIdenticalSnapshotRefreshKeepsEveryTimestamp() throws {
+    var catalog = try makeSubscriptionCatalog()
+    let before = catalog
+    let snap = snapshot(nestedChildren: [leaf(leafB, fields(remark: "b"))])
+
+    _ = try catalog.applySubscriptionSnapshot(snap, into: groupID, now: time1)
+
+    XCTAssertEqual(catalog, before, "内容未变的刷新不动任何节点的时间戳")
+  }
+
+  func testChangedLeafBumpsOnlyThatLeaf() throws {
+    var catalog = try makeSubscriptionCatalog()
+    let snap = snapshot(nestedChildren: [leaf(leafB, fields(remark: "b", port: 9999))])
+
+    _ = try catalog.applySubscriptionSnapshot(snap, into: groupID, now: time1)
+
+    XCTAssertEqual(catalog.entry(for: leafB)?.updatedAt, time1, "内容变化的叶子更新修改时间")
+    XCTAssertEqual(catalog.entry(for: leafB)?.createdAt, time0, "延续叶子保留创建时间")
+    XCTAssertEqual(catalog.entry(for: nestedID)?.updatedAt, time0, "嵌套分组名称与直接子序未变")
+    XCTAssertEqual(catalog.entry(for: groupID)?.updatedAt, time0, "固定分组名称与直接子序未变")
+  }
+
+  func testNewLeafStampsFreshTimesAndBumpsItsParentGroup() throws {
+    var catalog = try makeSubscriptionCatalog()
+    let leafC = NodeID(rawValue: "t:c")
+    let snap = snapshot(
+      nestedChildren: [leaf(leafB, fields(remark: "b")), leaf(leafC, fields(remark: "c"))])
+
+    _ = try catalog.applySubscriptionSnapshot(snap, into: groupID, now: time1)
+
+    XCTAssertEqual(catalog.entry(for: leafC)?.createdAt, time1)
+    XCTAssertEqual(catalog.entry(for: leafC)?.updatedAt, time1)
+    XCTAssertEqual(catalog.entry(for: nestedID)?.updatedAt, time1, "嵌套分组直接子节点集合变化")
+    XCTAssertEqual(catalog.entry(for: groupID)?.updatedAt, time0, "固定分组直接子序未变")
+  }
+
+  func testRemoteRenameBumpsOnlyRenamedGroup() throws {
+    var catalog = try makeSubscriptionCatalog()
+    let snap = snapshot(
+      nestedName: "远端新名", nestedChildren: [leaf(leafB, fields(remark: "b"))])
+
+    _ = try catalog.applySubscriptionSnapshot(snap, into: groupID, now: time1)
+
+    XCTAssertEqual(catalog.entry(for: nestedID)?.updatedAt, time1)
+    XCTAssertEqual(catalog.entry(for: leafB)?.updatedAt, time0)
+    XCTAssertEqual(catalog.entry(for: groupID)?.updatedAt, time0, "固定分组自身名称未变")
+  }
+
+  func testRemoteFixedGroupNameChangeBumpsFixedGroup() throws {
+    var catalog = try makeSubscriptionCatalog()
+    let snap = snapshot(
+      name: "远端新订阅名", nestedChildren: [leaf(leafB, fields(remark: "b"))])
+
+    _ = try catalog.applySubscriptionSnapshot(snap, into: groupID, now: time1)
+
+    XCTAssertEqual(catalog.entry(for: groupID)?.updatedAt, time1)
+    XCTAssertEqual(catalog.entry(for: groupID)?.createdAt, time0, "固定分组身份客户端所有，创建时间保留")
+    XCTAssertEqual(catalog.entry(for: nestedID)?.updatedAt, time0)
+  }
+
+  func testRemovedLeafBumpsItsParentGroup() throws {
+    var catalog = try makeSubscriptionCatalog()
+    let snap = snapshot(nestedChildren: [])
+
+    _ = try catalog.applySubscriptionSnapshot(snap, into: groupID, now: time1)
+
+    XCTAssertFalse(catalog.contains(leafB))
+    XCTAssertEqual(catalog.entry(for: nestedID)?.updatedAt, time1, "子节点被远端移除")
+    XCTAssertEqual(catalog.entry(for: groupID)?.updatedAt, time0)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/ConfigurationGroupExportTests.swift b/ShadowsocksX-NG2/Tests/Catalog/ConfigurationGroupExportTests.swift
new file mode 100644
index 000000000..99417e042
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/ConfigurationGroupExportTests.swift
@@ -0,0 +1,364 @@
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// The workflow export draft is the public seam for complete SIP-008 serialization.
+@MainActor
+final class ConfigurationGroupExportTests: XCTestCase {
+  private var workDir: URL!
+  private var catalogFileURL: URL!
+  private var fetcher: FakeSubscriptionFetcher!
+  private var workflow: CatalogWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("group-export-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    catalogFileURL = workDir.appendingPathComponent("catalog.json")
+
+    fetcher = FakeSubscriptionFetcher(behavior: .success(Data()))
+    workflow = makeWorkflow()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  func testDraftContainsFlattenedServersAndOrderedGroupTree() async throws {
+    let rootID = try await workflow.createGroup(named: "组 根", into: nil)
+    let firstID = try await addServer(
+      host: "203.0.113.1", password: "first-secret", remark: "First", into: rootID)
+    let nestedID = try await workflow.createGroup(named: "嵌套", into: rootID)
+    let nestedServerID = try await addServer(
+      host: "203.0.113.2", password: "nested-secret", remark: "Nested", into: nestedID)
+    let lastID = try await addServer(
+      host: "203.0.113.3", password: "last-secret", remark: "Last", into: rootID)
+
+    let draft = try workflow.configurationGroupExportDraft(for: rootID)
+
+    XCTAssertEqual(draft.suggestedFileName, "组 根.json")
+    let document = try XCTUnwrap(JSONSerialization.jsonObject(with: draft.data) as? [String: Any])
+    XCTAssertEqual(document["version"] as? Int, 1)
+    let servers = try XCTUnwrap(document["servers"] as? [[String: Any]])
+    XCTAssertEqual(
+      servers.compactMap { $0["server"] as? String },
+      [
+        "203.0.113.1", "203.0.113.2", "203.0.113.3",
+      ])
+    XCTAssertEqual(
+      servers.compactMap { $0["password"] as? String },
+      [
+        "first-secret", "nested-secret", "last-secret",
+      ])
+    XCTAssertEqual(servers.compactMap { $0["remarks"] as? String }, ["First", "Nested", "Last"])
+    let serverIDValues = servers.compactMap { $0["id"] as? String }
+    XCTAssertEqual(serverIDValues.compactMap { UUID(uuidString: $0) }.count, 3)
+    XCTAssertEqual(
+      UUID(uuidString: try XCTUnwrap(serverIDValues.first)), UUID(uuidString: firstID.rawValue))
+    XCTAssertEqual(
+      UUID(uuidString: try XCTUnwrap(serverIDValues.dropFirst().first)),
+      UUID(uuidString: nestedServerID.rawValue))
+    XCTAssertEqual(
+      UUID(uuidString: try XCTUnwrap(serverIDValues.last)), UUID(uuidString: lastID.rawValue))
+
+    let extensionObject = try XCTUnwrap(document["x_shadowsocksx_ng"] as? [String: Any])
+    XCTAssertEqual(extensionObject["schema_version"] as? Int, 1)
+    let groups = try XCTUnwrap(extensionObject["groups"] as? [[String: Any]])
+    let rootGroupID = try XCTUnwrap(extensionObject["root_group_id"] as? String)
+    let rootGroup = try XCTUnwrap(groups.first { $0["id"] as? String == rootGroupID })
+    XCTAssertEqual(rootGroup["name"] as? String, "组 根")
+    let nestedGroup = try XCTUnwrap(groups.first { $0["name"] as? String == "嵌套" })
+    let rootChildren = try XCTUnwrap(rootGroup["children"] as? [[String: String]])
+    let nestedGroupIDValue = try XCTUnwrap(nestedGroup["id"] as? String)
+    XCTAssertEqual(
+      rootChildren,
+      [
+        ["type": "server", "id": try XCTUnwrap(servers[0]["id"] as? String)],
+        ["type": "group", "id": nestedGroupIDValue],
+        ["type": "server", "id": try XCTUnwrap(servers[2]["id"] as? String)],
+      ])
+
+  }
+
+  func testSubscriptionExportPreservesProviderIDsAndDerivesStableIDs() async throws {
+    let providerID = "aaaaaaaa-0000-4000-8000-00000000000a"
+    let nestedProviderID = "bbbbbbbb-0000-4000-8000-00000000000b"
+    fetcher.setBehavior(
+      .success(
+        subscriptionDocument(
+          providerID: providerID, nestedProviderID: nestedProviderID)))
+    workflow = makeWorkflow()
+    let subscription = try await workflow.createSubscription(
+      urlString: "https://provider.example.com/config.json")
+    let root = try XCTUnwrap(workflow.tree.node(withID: subscription.groupID))
+    let nested = try XCTUnwrap(root.childNodes.first(where: \.isGroup))
+
+    let rootDraft = try workflow.configurationGroupExportDraft(for: subscription.groupID)
+    let repeatedRootDraft = try workflow.configurationGroupExportDraft(for: subscription.groupID)
+    let nestedDraft = try workflow.configurationGroupExportDraft(for: nested.id)
+    let rootServers = try jsonServers(in: rootDraft)
+    let nestedServers = try jsonServers(in: nestedDraft)
+    let rootIDs = rootServers.compactMap { $0["id"] as? String }
+    let nestedIDs = nestedServers.compactMap { $0["id"] as? String }
+
+    XCTAssertEqual(rootIDs[0], providerID)
+    XCTAssertEqual(rootIDs[1], nestedProviderID)
+    XCTAssertEqual(nestedIDs, [nestedProviderID])
+    let repeatedRootIDs = try jsonServers(in: repeatedRootDraft).compactMap { $0["id"] as? String }
+    XCTAssertEqual(rootIDs[2], repeatedRootIDs[2], "无 provider UUID 的服务器身份稳定")
+    XCTAssertNotNil(UUID(uuidString: try XCTUnwrap(rootIDs[2])))
+
+    let rootExtension = try groupExtension(in: rootDraft)
+    let nestedExtension = try groupExtension(in: nestedDraft)
+    let rootExportID = try XCTUnwrap(rootExtension["root_group_id"] as? String)
+    let nestedExportID = try XCTUnwrap(nestedExtension["root_group_id"] as? String)
+    let providerRootExportID = try groupID(named: "Provider root", in: rootDraft)
+    let nestedGroupExportID = try groupID(named: "Nested", in: rootDraft)
+    XCTAssertEqual(rootExportID, providerRootExportID)
+    XCTAssertEqual(nestedExportID, nestedGroupExportID, "分组 ID 不随导出根变化")
+  }
+
+  func testExportabilityUsesServerPresenceNotActivationValidity() async throws {
+    var catalog = ConfigurationCatalog()
+    let emptyRoot = NodeID.fresh()
+    let emptyNested = NodeID.fresh()
+    let exportRoot = NodeID.fresh()
+    let invalidServer = NodeID.fresh()
+    try catalog.addGroup("空组", id: emptyRoot)
+    try catalog.addGroup("空子组", id: emptyNested, to: emptyRoot)
+    try catalog.addGroup("含无效服务器", id: exportRoot)
+    try catalog.addServer(
+      ServerFields(
+        address: "203.0.113.8", port: 8388, encryptionMethod: "aes-256-gcm",
+        password: "password", remark: "activation-invalid", pluginProgram: "missing-plugin",
+        pluginOptions: "obfs=http"),
+      id: invalidServer, to: exportRoot)
+    try install(catalog)
+
+    let empty = try XCTUnwrap(workflow.tree.node(withID: emptyRoot))
+    let emptyChild = try XCTUnwrap(workflow.tree.node(withID: emptyNested))
+    let nonCandidate = try XCTUnwrap(workflow.tree.node(withID: invalidServer))
+    let exportableGroup = try XCTUnwrap(workflow.tree.node(withID: exportRoot))
+    XCTAssertFalse(empty.containsServerConfiguration)
+    XCTAssertFalse(emptyChild.containsServerConfiguration)
+    XCTAssertTrue(nonCandidate.isInvalid, "插件未提供使服务器不具备激活资格")
+    XCTAssertTrue(exportableGroup.containsServerConfiguration)
+
+    let servers = try jsonServers(in: workflow.configurationGroupExportDraft(for: exportRoot))
+    XCTAssertEqual(servers.first?["plugin"] as? String, "missing-plugin")
+    XCTAssertEqual(servers.first?["plugin_opts"] as? String, "obfs=http")
+  }
+
+  func testPluginOptionsWithoutProgramFailsBeforeCallingExporter() async throws {
+    var catalog = ConfigurationCatalog()
+    let rootID = NodeID.fresh()
+    let serverID = NodeID.fresh()
+    try catalog.addGroup("不完整组", id: rootID)
+    try catalog.addServer(
+      ServerFields(
+        address: "203.0.113.9", port: 8388, encryptionMethod: "aes-256-gcm",
+        password: "password", pluginOptions: "mode=websocket"),
+      id: serverID, to: rootID)
+    try install(catalog)
+    let exporter = InMemoryConfigurationGroupFileExporter()
+
+    let outcome = ConfigurationGroupExportAction(workflow: workflow, exporter: exporter)
+      .perform(for: rootID)
+
+    XCTAssertEqual(outcome, .preparationFailed(.pluginOptionsWithoutProgram(serverID)))
+    XCTAssertTrue(exporter.drafts.isEmpty, "不完整文档不能进入保存面板")
+  }
+
+  func testExportActionPropagatesCancelSaveAndWriteFailure() async throws {
+    let rootID = try await workflow.createGroup(named: "动作", into: nil)
+    _ = try await addServer(host: "203.0.113.10", password: "pw", remark: "node", into: rootID)
+    let exporter = InMemoryConfigurationGroupFileExporter()
+
+    exporter.result = .cancelled
+    XCTAssertEqual(
+      ConfigurationGroupExportAction(workflow: workflow, exporter: exporter).perform(for: rootID),
+      .cancelled)
+    let savedURL = URL(fileURLWithPath: "/tmp/group.json")
+    exporter.result = .saved(savedURL)
+    XCTAssertEqual(
+      ConfigurationGroupExportAction(workflow: workflow, exporter: exporter).perform(for: rootID),
+      .saved(savedURL))
+    exporter.result = .failed(.writeFailed)
+    XCTAssertEqual(
+      ConfigurationGroupExportAction(workflow: workflow, exporter: exporter).perform(for: rootID),
+      .exportFailed(.writeFailed))
+    XCTAssertEqual(exporter.drafts.count, 3)
+  }
+
+  private func makeWorkflow() -> CatalogWorkflow {
+    makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: catalogFileURL), runtime: FakeCatalogRuntime()),
+      subscriptionFetcher: fetcher)
+  }
+
+  private func install(_ catalog: ConfigurationCatalog) throws {
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+    workflow = makeWorkflow()
+  }
+
+  private func subscriptionDocument(providerID: String, nestedProviderID: String) -> Data {
+    Data(
+      """
+      {
+        "version": 1,
+        "servers": [
+          {"id":"\(providerID)","remarks":"root server","server":"203.0.113.11",
+           "server_port":8388,"password":"p1","method":"aes-256-gcm"},
+          {"id":"\(nestedProviderID)","remarks":"nested server","server":"203.0.113.12",
+           "server_port":8389,"password":"p2","method":"aes-256-gcm"},
+          {"remarks":"idless","server":"203.0.113.13","server_port":8390,
+           "password":"p3","method":"aes-256-gcm"}
+        ],
+        "x_shadowsocksx_ng": {
+          "schema_version": 1,
+          "root_group_id": "provider-root",
+          "groups": [
+            {"id":"provider-root","name":"Provider root","children":[
+              {"type":"server","id":"\(providerID)"},
+              {"type":"group","id":"nested"}]},
+            {"id":"nested","name":"Nested","children":[
+              {"type":"server","id":"\(nestedProviderID)"}]}
+          ]
+        }
+      }
+      """.utf8)
+  }
+
+  private func jsonServers(in draft: ConfigurationGroupExportDraft) throws -> [[String: Any]] {
+    let document = try XCTUnwrap(JSONSerialization.jsonObject(with: draft.data) as? [String: Any])
+    return try XCTUnwrap(document["servers"] as? [[String: Any]])
+  }
+
+  private func groupExtension(in draft: ConfigurationGroupExportDraft) throws -> [String: Any] {
+    let document = try XCTUnwrap(JSONSerialization.jsonObject(with: draft.data) as? [String: Any])
+    return try XCTUnwrap(document["x_shadowsocksx_ng"] as? [String: Any])
+  }
+
+  private func groupID(named name: String, in draft: ConfigurationGroupExportDraft) throws -> String
+  {
+    let groups = try XCTUnwrap(groupExtension(in: draft)["groups"] as? [[String: Any]])
+    return try XCTUnwrap(groups.first { $0["name"] as? String == name }?["id"] as? String)
+  }
+
+  private func addServer(
+    host: String, password: String, remark: String, into parent: NodeID
+  ) async throws -> NodeID {
+    let uri = SsUri(
+      method: "aes-256-gcm", password: password, host: host, port: 8388, remark: remark
+    ).encode()
+    let result = await workflow.importServers(from: [.clipboardText(uri)], into: parent)
+    XCTAssertEqual(result.sources.first?.result.importedCount, 1)
+    return try XCTUnwrap(workflow.tree.node(withID: parent)?.childNodes.last?.id)
+  }
+}
+
+@Suite("Configuration group sharing")
+@MainActor
+struct ConfigurationGroupSharingTests {
+  @Test func nestedURIListPreservesOrderAndCompleteConnectionData() throws {
+    let fixture = try Fixture()
+    defer { fixture.cleanUp() }
+    let draft = try fixture.workflow.configurationGroupShareDraft(for: fixture.root)
+    let uris = try draft.uriText.split(separator: "\n").map { try SsUri.decode(String($0)) }
+    #expect(uris.map(\.host) == ["203.0.113.1", "2001:db8::2", "203.0.113.3"])
+    #expect(uris.map(\.password) == ["first", "nested", "last"])
+    #expect(uris[1].pluginProgram == "missing-plugin")
+    #expect(uris[1].pluginOptions == "mode=websocket;host=example.com")
+    #expect(uris[1].remark == "嵌套服务器")
+    #expect(draft.uriList.suggestedFileName == "组 根.txt")
+    #expect(draft.uriList.format == .uriList)
+    let node = try #require(fixture.workflow.tree.node(withID: fixture.root))
+    #expect(node.serverConfigurationCount == 3)
+    let document = try #require(
+      JSONSerialization.jsonObject(with: draft.json.data) as? [String: Any])
+    let servers = try #require(document["servers"] as? [[String: Any]])
+    #expect(servers.compactMap { $0["server"] as? String } == uris.map(\.host))
+    #expect(draft.json.format == .json)
+  }
+
+  @Test func missingNestedCredentialRejectsWholeShareAndSnapshotRemainsStable() throws {
+    let fixture = try Fixture()
+    defer { fixture.cleanUp() }
+    let snapshot = try fixture.workflow.configurationGroupShareDraft(for: fixture.root)
+    try fixture.workflow.commit { catalog in
+      guard case .server(var fields) = catalog.entry(for: fixture.nestedServer)?.kind else {
+        return
+      }
+      fields.password = ""
+      try catalog.updateServer(fixture.nestedServer, with: fields)
+    }
+    #expect(
+      throws: ConfigurationGroupExportFailure.invalidServer(fixture.nestedServer, .missingPassword)
+    ) {
+      try fixture.workflow.configurationGroupShareDraft(for: fixture.root)
+    }
+    #expect(
+      try SsUri.decode(String(snapshot.uriText.split(separator: "\n")[1])).password == "nested")
+  }
+
+  @Test func emptyGroupCannotPrepareShare() throws {
+    let fixture = try Fixture()
+    defer { fixture.cleanUp() }
+    #expect(throws: ConfigurationGroupExportFailure.noServers) {
+      try fixture.workflow.configurationGroupShareDraft(for: fixture.empty)
+    }
+    #expect(fixture.workflow.tree.node(withID: fixture.empty)?.serverConfigurationCount == 0)
+  }
+
+  @MainActor
+  private struct Fixture {
+    let directory: URL
+    let root = NodeID.fresh()
+    let empty = NodeID.fresh()
+    let nestedServer = NodeID.fresh()
+    let workflow: CatalogWorkflow
+
+    init() throws {
+      directory = FileManager.default.temporaryDirectory.appendingPathComponent(
+        "group-share-\(UUID())")
+      try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+      var catalog = ConfigurationCatalog()
+      try catalog.addGroup("组/根", id: root)
+      try catalog.addGroup("空组", id: empty)
+      try catalog.addServer(
+        ServerFields(
+          address: "203.0.113.1", port: 8388,
+          encryptionMethod: "aes-256-gcm", password: "first", remark: "First"),
+        id: .fresh(), to: root)
+      let nested = NodeID.fresh()
+      try catalog.addGroup("嵌套", id: nested, to: root)
+      try catalog.addServer(
+        ServerFields(
+          address: "2001:db8::2", port: 8389,
+          encryptionMethod: "aes-256-gcm", password: "nested", remark: "嵌套服务器",
+          pluginProgram: "missing-plugin", pluginOptions: "mode=websocket;host=example.com"),
+        id: nestedServer, to: nested)
+      try catalog.addServer(
+        ServerFields(
+          address: "203.0.113.3", port: 8390,
+          encryptionMethod: "aes-256-gcm", password: "last", remark: "Last"),
+        id: .fresh(), to: root)
+      // 外部服务器不得混入所选子树。
+      try catalog.addServer(
+        ServerFields(
+          address: "203.0.113.99", port: 8388,
+          encryptionMethod: "aes-256-gcm", password: "first"), id: .fresh())
+      let store = makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.json"))
+      try store.save(CatalogDocument(catalog: catalog))
+      workflow = makeCatalogWorkflow(
+        coordinator: CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime()),
+        subscriptionFetcher: FakeSubscriptionFetcher(behavior: .success(Data())))
+    }
+
+    func cleanUp() { try? FileManager.default.removeItem(at: directory) }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/EncryptedServerLibraryTests.swift b/ShadowsocksX-NG2/Tests/Catalog/EncryptedServerLibraryTests.swift
new file mode 100644
index 000000000..fc9ff6abd
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/EncryptedServerLibraryTests.swift
@@ -0,0 +1,123 @@
+import AgeSwift
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct EncryptedServerLibraryTests {
+  @Test func historicalJSONIsRejectedWithoutMigrationOrCleanup() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let legacyURL = directory.appendingPathComponent("catalog.json")
+    let original = Data("historical-library".utf8)
+    try original.write(to: legacyURL)
+    let keys = TestLibraryKeys()
+    let store = CatalogFileStore(
+      fileURL: directory.appendingPathComponent("catalog.age"),
+      library: ServerLibraryStorage(keys: keys))
+    #expect(throws: ServerLibraryError.unsupportedVersion) { try store.load() }
+    #expect(try Data(contentsOf: legacyURL) == original)
+    #expect(!FileManager.default.fileExists(atPath: store.fileURL.path))
+    #expect(keys.values.isEmpty)
+    _ = try store.reset()
+    #expect(try store.load().catalog.isEmpty)
+    #expect(try Data(contentsOf: legacyURL) == original)
+  }
+
+  @Test func completeRecordsSurviveRestartAndOnlyCiphertextIsWritten() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let url = directory.appendingPathComponent("catalog.age")
+    let keys = TestLibraryKeys()
+    let store = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    _ = try store.load()
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("PRIVATE-GROUP", source: .subscription)
+    let fields = ServerFields(
+      address: "private.example", port: 8388, encryptionMethod: "aes-256-gcm",
+      password: "PRIVATE-PASSWORD", remark: "PRIVATE-NAME",
+      pluginProgram: "v2ray-plugin", pluginOptions: "host=PRIVATE-PLUGIN")
+    _ = try catalog.addServer(fields, source: .subscription, to: group)
+    let record = SubscriptionRecord(
+      id: .fresh(), groupID: group, url: "https://provider.example/sub?token=PRIVATE-TOKEN",
+      status: .never)
+    let document = CatalogDocument(catalog: catalog, subscriptions: [record], favoriteIDs: [group])
+    try store.save(document)
+    let first = try Data(contentsOf: url)
+    #expect(first.starts(with: Data("age-encryption.org/v1\n".utf8)))
+    for secret in ["PRIVATE-", "private.example", "provider.example"] {
+      #expect(first.range(of: Data(secret.utf8)) == nil)
+    }
+    let restarted = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    #expect(try restarted.load() == document)
+    try restarted.save(document)
+    #expect(try Data(contentsOf: url) != first)
+  }
+
+  @Test(arguments: [0, 8, 9, 45, -1])
+  func alteredFileIsRejectedWithoutFallback(offset: Int) throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let url = directory.appendingPathComponent("catalog.age")
+    let keys = TestLibraryKeys()
+    let store = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    _ = try store.load()
+    var data = try Data(contentsOf: url)
+    data[offset == -1 ? data.count - 1 : offset] ^= 1
+    try data.write(to: url)
+    try Data("old-library".utf8).write(to: directory.appendingPathComponent("catalog.json"))
+    let restarted = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    #expect(throws: (any Error).self) { try restarted.load() }
+    #expect(try Data(contentsOf: url) == data)
+  }
+
+  @Test func previousEncryptedEnvelopeIsUnsupportedAndPreserved() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let url = directory.appendingPathComponent("catalog.age")
+    let keys = TestLibraryKeys()
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let old = Data("SSXNG2LB".utf8) + Data([2]) + Data(repeating: 0, count: 64)
+    try old.write(to: url)
+    let restarted = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    #expect(throws: ServerLibraryError.unsupportedVersion) { try restarted.load() }
+    #expect(try Data(contentsOf: url) == old)
+  }
+
+  @Test func unavailableOrWrongKeyDoesNotReplaceCiphertext() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let url = directory.appendingPathComponent("catalog.age")
+    let keys = TestLibraryKeys()
+    let store = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    _ = try store.load()
+    let ciphertext = try Data(contentsOf: url)
+    let restarted = CatalogFileStore(
+      fileURL: url, library: ServerLibraryStorage(keys: TestLibraryKeys()))
+    #expect(throws: ServerLibraryError.keyUnavailable) { try restarted.load() }
+    keys.values = try keys.values.mapValues { _ in Data(try AgeIdentity.generate().serialized.utf8)
+    }
+    let wrongKey = CatalogFileStore(fileURL: url, library: ServerLibraryStorage(keys: keys))
+    #expect(throws: ServerLibraryError.authenticationFailed) { try wrongKey.load() }
+    #expect(try Data(contentsOf: url) == ciphertext)
+  }
+}
+
+final class TestLibraryKeys: CredentialKeyStoring {
+  var values: [UUID: Data] = [:]
+  var requiresInteraction = false
+  var createFails = false
+  var blockedIDs: Set<UUID> = []
+  func ids() throws -> [UUID] { values.keys.sorted { $0.uuidString < $1.uuidString } }
+  func read(_ id: UUID, allowingInteraction: Bool) throws -> Data? {
+    if blockedIDs.contains(id) || (requiresInteraction && !allowingInteraction) {
+      throw CredentialKeyStoreError.keychainStatus(-25308)
+    }
+    return values[id]
+  }
+  func create(_ data: Data, id: UUID, allowingInteraction: Bool) throws {
+    if createFails { throw CredentialKeyStoreError.keychainStatus(-25308) }
+    values[id] = data
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/LegacyImportTests.swift b/ShadowsocksX-NG2/Tests/Catalog/LegacyImportTests.swift
new file mode 100644
index 000000000..5affa3861
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/LegacyImportTests.swift
@@ -0,0 +1,255 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// Legacy 导入主缝：用属性列表快照模拟旧版 UserDefaults，通过导入结果与持久化
+/// 文档观察身份映射、服务器记录、凭据引用和事务语义；不读取或修改真实 Legacy 数据。
+final class LegacyImportTests: XCTestCase {
+  private var directory: URL!
+  private var catalogURL: URL!
+  private var activationURL: URL!
+  private var settingsURL: URL!
+  private var marker: TestLegacyImportMarker!
+  private var provider: FixedLegacySnapshotProvider!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("legacy-import-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    catalogURL = directory.appendingPathComponent("catalog.json")
+    activationURL = directory.appendingPathComponent("activation.json")
+    settingsURL = directory.appendingPathComponent("proxy-listening.json")
+
+    marker = TestLegacyImportMarker()
+    provider = FixedLegacySnapshotProvider(snapshot: try Self.makeSnapshot())
+  }
+
+  override func tearDownWithError() throws {
+    try? FileManager.default.removeItem(at: directory)
+    try super.tearDownWithError()
+  }
+
+  func testImportMapsProfilesAndCredentials() throws {
+    let service = makeService()
+
+    let outcome = try service.importCurrentSnapshot()
+
+    XCTAssertEqual(outcome.report.importedServerCount, 4)
+    XCTAssertEqual(outcome.report.skippedRecords.map(\.index), [4, 5])
+    XCTAssertEqual(
+      outcome.report.skippedRecords.map(\.reason),
+      [.invalidAddress, .notDictionary])
+    XCTAssertEqual(outcome.report.regeneratedIdentityCount, 3)
+    XCTAssertTrue(marker.completed)
+
+    let document = try makeTestCatalogStore(fileURL: catalogURL).load()
+    let groupID = try XCTUnwrap(document.catalog.rootChildren.first)
+    let group = try XCTUnwrap(document.catalog.entry(for: groupID))
+    guard case .group(let groupFields) = group.kind else {
+      return XCTFail("Legacy 导入应创建手动分组")
+    }
+    XCTAssertEqual(group.source, .manual)
+    XCTAssertEqual(groupFields.children.count, 4)
+
+    let first = try XCTUnwrap(document.catalog.entry(for: groupFields.children[0]))
+    guard case .server(let fields) = first.kind else {
+      return XCTFail("导入条目应为服务器叶子")
+    }
+    XCTAssertEqual(first.id, NodeID(rawValue: Self.validID))
+    XCTAssertEqual(fields.pluginProgram, "unknown-plugin")
+    XCTAssertEqual(
+      fields.password, "password-1")
+    XCTAssertEqual(
+      fields.pluginOptions,
+      "mode=websocket;host=example.test")
+    XCTAssertNil(try ActivationStateFileStore(fileURL: activationURL).loadActiveTargetID())
+  }
+
+  func testImportIgnoresLegacyPreferencesAndActiveTarget() throws {
+    var existingSettings = ProxyRuntimeSettings()
+    existingSettings.listen.socksPort = 2086
+    existingSettings.listen.httpPort = 2087
+    existingSettings.preferredMode = .global
+    let listeningStore = makeTestListeningStore(
+      fileURL: settingsURL)
+    try listeningStore.save(existingSettings.listen)
+
+    let existingTarget = NodeID(rawValue: "existing-target")
+    let activationStore = ActivationStateFileStore(fileURL: activationURL)
+    try activationStore.save(activeTargetID: existingTarget)
+
+    _ = try makeService().importCurrentSnapshot()
+
+    XCTAssertEqual(try listeningStore.load(), existingSettings.listen)
+    XCTAssertEqual(try activationStore.loadActiveTargetID(), existingTarget)
+  }
+
+  func testExplicitReimportCreatesIndependentGroupAndDoesNotRepeatAutomatically() throws {
+    let service = makeService()
+    let first = try service.importCurrentSnapshot()
+
+    XCTAssertThrowsError(try service.importCurrentSnapshot()) { error in
+      XCTAssertEqual(error as? LegacyImportError, .alreadyCompleted)
+    }
+
+    let second = try service.importCurrentSnapshot(reimport: true)
+    let document = try makeTestCatalogStore(fileURL: catalogURL).load()
+    XCTAssertEqual(document.catalog.rootChildren.count, 2)
+    XCTAssertNotEqual(document.catalog.rootChildren[0], document.catalog.rootChildren[1])
+    XCTAssertNotEqual(second.groupID, first.groupID)
+    XCTAssertTrue(marker.completed)
+  }
+
+  func testFailedCommitRestoresCatalogCredentialsAndMarkerWithoutTouchingActivation() throws {
+    let originalID = NodeID(rawValue: "existing-target")
+    var originalCatalog = ConfigurationCatalog()
+    let originalServer = try originalCatalog.addTestServer("原有节点", id: originalID)
+    let originalFields = try XCTUnwrap(originalCatalog.entry(for: originalServer))
+    guard case .server(var originalServerFields) = originalFields.kind else {
+      return XCTFail("原有夹具应为服务器")
+    }
+    originalServerFields.password = "original-password"
+    try originalCatalog.updateServer(originalServer, with: originalServerFields)
+    try makeTestCatalogStore(fileURL: catalogURL).save(CatalogDocument(catalog: originalCatalog))
+    try ActivationStateFileStore(fileURL: activationURL).save(activeTargetID: originalID)
+
+    marker.failWhenSettingCompleted = true
+    let service = makeService()
+
+    XCTAssertThrowsError(try service.importCurrentSnapshot()) { error in
+      guard case .commitFailed = error as? LegacyImportError else {
+        return XCTFail("应以事务失败返回，实际：\(error)")
+      }
+    }
+
+    XCTAssertEqual(try makeTestCatalogStore(fileURL: catalogURL).load().catalog, originalCatalog)
+    XCTAssertEqual(
+      try ActivationStateFileStore(fileURL: activationURL).loadActiveTargetID(), originalID)
+    XCTAssertFalse(marker.completed)
+  }
+
+  func testPreferenceOnlyLegacyDomainIsNotImportable() throws {
+    let defaults = UserDefaults(suiteName: "legacy-import-preferences-only")!
+    defaults.removePersistentDomain(forName: "legacy-import-preferences-only")
+    defer { defaults.removePersistentDomain(forName: "legacy-import-preferences-only") }
+    defaults.set("externalPAC", forKey: "ShadowsocksRunningMode")
+    defaults.set(false, forKey: "LaunchAtLogin")
+
+    let provider = UserDefaultsLegacySnapshotProvider(
+      defaults: defaults, bundleIdentifier: "legacy-import-preferences-only")
+
+    XCTAssertNil(try provider.readSnapshot())
+  }
+}
+
+extension LegacyImportTests {
+  func testValidProfileWithoutLegacyIDGetsNewIdentityAndCounts() throws {
+    var profile = Self.validProfile()
+    profile.removeValue(forKey: "Id")
+    provider.snapshot = try LegacySnapshot(
+      propertyList: ["ServerProfiles": [profile]])
+
+    let outcome = try makeService().importCurrentSnapshot()
+
+    XCTAssertEqual(outcome.report.importedServerCount, 1)
+    XCTAssertEqual(outcome.report.regeneratedIdentityCount, 1)
+  }
+
+  fileprivate static let validID = "11111111-1111-4111-8111-111111111111"
+  fileprivate static let duplicateID = "22222222-2222-4222-8222-222222222222"
+
+  fileprivate static func validProfile() -> [String: Any] {
+    [
+      "Id": validID,
+      "ServerHost": "203.0.113.7",
+      "ServerPort": 8388,
+      "Method": "aes-256-gcm",
+      "Password": "password-1",
+      "Remark": "香港 01",
+      "Plugin": "unknown-plugin",
+      "PluginOptions": "mode=websocket;host=example.test",
+    ]
+  }
+
+  /// 精简档案；`id` 为 nil 时缺省 Id 键（模拟无稳定身份的旧记录）。
+  fileprivate static func profile(
+    id: String?, host: String, port: Int, method: String, password: String
+  ) -> [String: Any] {
+    var profile: [String: Any] = [
+      "ServerHost": host,
+      "ServerPort": port,
+      "Method": method,
+      "Password": password,
+    ]
+    if let id { profile["Id"] = id }
+    return profile
+  }
+
+  fileprivate static func makeSnapshot() throws -> LegacySnapshot {
+    try LegacySnapshot(
+      propertyList: [
+        "ServerProfiles": [
+          validProfile(),
+          profile(
+            id: "not-a-uuid", host: "198.51.100.8", port: 8389,
+            method: "chacha20-ietf-poly1305", password: "password-2"),
+          profile(
+            id: duplicateID, host: "198.51.100.9", port: 8390,
+            method: "aes-128-gcm", password: "password-3"),
+          profile(
+            id: duplicateID, host: "198.51.100.10", port: 8391,
+            method: "aes-128-gcm", password: "password-4"),
+          profile(
+            id: nil, host: "not a host", port: 8392,
+            method: "aes-128-gcm", password: "password-5"),
+          "not-a-profile",
+        ],
+        "ActiveServerProfileId": validID,
+        "LocalSocks5.ListenPort": 2086,
+        "LocalSocks5.ListenAddress": "127.0.0.1",
+        "LocalHTTP.ListenPort": 2087,
+        "LocalHTTPOn": true,
+        "PacServer.ListenPort": 2089,
+        "PacServer.BindToLocalhost": true,
+        "LocalSocks5.EnableUDPRelay": true,
+        "LocalSocks5.Timeout": 120,
+        "LocalSocks5.EnableVerboseMode": true,
+        "ProxyExceptions": "localhost, example.test",
+        "ExternalPACURL": "https://pac.example.test/proxy.pac",
+        "GFWListURL": "https://gfw.example.test/list.txt",
+        "ShadowsocksRunningMode": "externalPAC",
+        "EnableSwitchMode.PAC": true,
+        "EnableSwitchMode.Global": true,
+        "EnableSwitchMode.Manual": false,
+        "EnableSwitchMode.ExternalPAC": true,
+        "LaunchAtLogin": false,
+      ])
+  }
+
+  fileprivate func makeService() -> LegacyImportService {
+    LegacyImportService(
+      source: provider,
+      catalogStore: makeTestCatalogStore(fileURL: catalogURL),
+      marker: marker)
+  }
+}
+
+private final class TestLegacyImportMarker: LegacyImportMarkerStoring {
+  var completed = false
+  var failWhenSettingCompleted = false
+
+  func isCompleted() throws -> Bool { completed }
+
+  func setCompleted(_ completed: Bool) throws {
+    if completed && failWhenSettingCompleted {
+      throw TestMarkerError.rejected
+    }
+    self.completed = completed
+  }
+}
+
+private enum TestMarkerError: Error {
+  case rejected
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/SsUriTests.swift b/ShadowsocksX-NG2/Tests/Catalog/SsUriTests.swift
new file mode 100644
index 000000000..ec5aded7b
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/SsUriTests.swift
@@ -0,0 +1,242 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// SIP002 ss:// 编解码往返，覆盖插件同构与特殊字符。
+/// base64 期望值用系统 `base64` 独立计算，不依赖被测代码。
+final class SsUriTests: XCTestCase {
+  // MARK: - 解码：SIP002 形态
+
+  func testDecodeSIP002Minimal() throws {
+    let uri = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM=@203.0.113.7:8388"
+    let decoded = try SsUri.decode(uri)
+    XCTAssertEqual(decoded.method, "aes-256-gcm")
+    XCTAssertEqual(decoded.password, "password123")
+    XCTAssertEqual(decoded.host, "203.0.113.7")
+    XCTAssertEqual(decoded.port, 8388)
+    XCTAssertNil(decoded.pluginProgram)
+    XCTAssertNil(decoded.pluginOptions)
+    XCTAssertNil(decoded.remark)
+  }
+
+  func testDecodeSIP002WithTrailingSlashAndRemark() throws {
+    let uri = "ss://cmM0LW1kNTpwYXNzd29yZA==@192.168.100.1:8888/#Example1"
+    let decoded = try SsUri.decode(uri)
+    XCTAssertEqual(decoded.method, "rc4-md5")
+    XCTAssertEqual(decoded.password, "password")
+    XCTAssertEqual(decoded.remark, "Example1")
+  }
+
+  func testDecodeSIP002PluginQuery() throws {
+    // 官方示例形态：query 值整体百分号编码（: = → %3B %3A %3D）。
+    let uri =
+      "ss://cmM0LW1kNTpwYXNzd29yZA==@192.168.100.1:8888/"
+      + "?plugin=obfs-local%3Bobfs%3Dhttp%3Bobfs-host%3Dexample.com#Example1"
+    let decoded = try SsUri.decode(uri)
+    XCTAssertEqual(decoded.pluginProgram, "obfs-local")
+    XCTAssertEqual(decoded.pluginOptions, "obfs=http;obfs-host=example.com")
+  }
+
+  func testDecodeSIP002PluginWithoutOptions() throws {
+    let uri = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM=@203.0.113.7:8388/?plugin=v2ray-plugin"
+    let decoded = try SsUri.decode(uri)
+    XCTAssertEqual(decoded.pluginProgram, "v2ray-plugin")
+    XCTAssertNil(decoded.pluginOptions)
+  }
+
+  func testDecodeSIP002EmptyPluginValueIsNoPlugin() throws {
+    let uri = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM=@203.0.113.7:8388/?plugin="
+    let decoded = try SsUri.decode(uri)
+    XCTAssertNil(decoded.pluginProgram)
+  }
+
+  func testDecodeSIP002IPv6Host() throws {
+    let uri = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM=@[2001:db8::1]:8388"
+    let decoded = try SsUri.decode(uri)
+    XCTAssertEqual(decoded.host, "2001:db8::1")
+    XCTAssertEqual(decoded.port, 8388)
+  }
+
+  /// AEAD-2022 客户端按 SIP022 用百分号编码明文 userinfo。
+  func testDecodeSIP022PlaintextUserInfo() throws {
+    let uri =
+      "ss://2022-blake3-aes-256-gcm:hmackyEyXXXXXXXXXXXXXXXXXXXw%3D%3D@203.0.113.7:8388"
+    let decoded = try SsUri.decode(uri)
+    XCTAssertEqual(decoded.method, "2022-blake3-aes-256-gcm")
+    XCTAssertEqual(decoded.password, "hmackyEyXXXXXXXXXXXXXXXXXXXw==")
+  }
+
+  func testDecodeLegacyBase64Form() throws {
+    let uri = "ss://YWVzLTI1Ni1nY206dGVzdEAyMDMuMC4xMTMuNzo4Mzg4#香港 01"
+    let decoded = try SsUri.decode(uri)
+    XCTAssertEqual(decoded.method, "aes-256-gcm")
+    XCTAssertEqual(decoded.password, "test")
+    XCTAssertEqual(decoded.host, "203.0.113.7")
+    XCTAssertEqual(decoded.port, 8388)
+    XCTAssertEqual(decoded.remark, "香港 01")
+  }
+
+  /// Legacy 密码为明文：凭据必须在最后一个 @ 处切分，密码中的 `@` 与 `:` 原样保留。
+  func testDecodeLegacyPasswordContainingAtAndColon() throws {
+    let uri = "ss://YWVzLTI1Ni1nY206dEBzdDpwd0AyMDMuMC4xMTMuNzo4Mzg4"
+    let decoded = try SsUri.decode(uri)
+    XCTAssertEqual(decoded.method, "aes-256-gcm")
+    XCTAssertEqual(decoded.password, "t@st:pw")
+    XCTAssertEqual(decoded.host, "203.0.113.7")
+    XCTAssertEqual(decoded.port, 8388)
+  }
+
+  func testDecodeToleratesMissingBase64PaddingAndURLSafeAlphabet() throws {
+    // `chacha20-ietf-poly1305:pw` 的 base64 末尾 padding 常被省略。
+    let padded = Data("chacha20-ietf-poly1305:pw".utf8).base64EncodedString()
+    let unpadded = padded.replacingOccurrences(of: "=", with: "")
+    let uriSafe = unpadded.replacingOccurrences(of: "+", with: "-")
+      .replacingOccurrences(of: "/", with: "_")
+    let decoded = try SsUri.decode("ss://\(uriSafe)@203.0.113.7:8388")
+    XCTAssertEqual(decoded.method, "chacha20-ietf-poly1305")
+    XCTAssertEqual(decoded.password, "pw")
+  }
+
+  func testDecodeTrimsSurroundingWhitespace() throws {
+    let decoded = try SsUri.decode("  ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM=@203.0.113.7:8388\n")
+    XCTAssertEqual(decoded.port, 8388)
+  }
+
+  // MARK: - 解码失败
+
+  func testDecodeRejectsNonSsScheme() {
+    XCTAssertThrowsError(try SsUri.decode("http://example.com")) { error in
+      XCTAssertEqual(error as? SsUriError, .notSsUri)
+    }
+    XCTAssertThrowsError(try SsUri.decode("plain text")) { error in
+      XCTAssertEqual(error as? SsUriError, .notSsUri)
+    }
+  }
+
+  func testDecodeRejectsMissingPort() {
+    XCTAssertThrowsError(try SsUri.decode("ss://YWVz@203.0.113.7")) { error in
+      guard case SsUriError.malformed = error else { return XCTFail("\(error)") }
+    }
+  }
+
+  func testDecodeRejectsInvalidPort() {
+    XCTAssertThrowsError(try SsUri.decode("ss://YWVz@203.0.113.7:notaport"))
+    XCTAssertThrowsError(try SsUri.decode("ss://YWVz@203.0.113.7:0"))
+    XCTAssertThrowsError(try SsUri.decode("ss://YWVz@203.0.113.7:70000"))
+  }
+
+  func testDecodeRejectsGarbagePayload() {
+    XCTAssertThrowsError(try SsUri.decode("ss://!!!not-base64@203.0.113.7:8388"))
+    XCTAssertThrowsError(try SsUri.decode("ss://!!!!"))
+  }
+
+  // MARK: - 编码
+
+  func testEncodeCanonicalSIP002() {
+    let uri = SsUri(
+      method: "aes-256-gcm", password: "password123", host: "203.0.113.7", port: 8388)
+    // 生态惯例（Outline / shadowsocks-rust）：url-safe 字母表、无 padding。
+    XCTAssertEqual(uri.encode(), "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")
+  }
+
+  func testEncodeBase64URLAlphabetWithoutPadding() {
+    // 含 `+`/`/` 的明文：编码必须落在 url-safe 字母表且无 padding。
+    let uri = SsUri(method: "aes-128-gcm", password: "??>>", host: "203.0.113.7", port: 1)
+    let encoded = uri.encode()
+    let userInfo = String(encoded.dropFirst("ss://".count).prefix { $0 != "@" })
+    XCTAssertFalse(userInfo.contains("+"))
+    XCTAssertFalse(userInfo.contains("/"))
+    XCTAssertFalse(userInfo.contains("="))
+  }
+
+  func testEncodePluginUsesPercentEncoding() {
+    let uri = SsUri(
+      method: "rc4-md5", password: "password", host: "192.168.100.1", port: 8888,
+      pluginProgram: "obfs-local", pluginOptions: "obfs=http;obfs-host=example.com",
+      remark: "Example1")
+    XCTAssertEqual(
+      uri.encode(),
+      "ss://cmM0LW1kNTpwYXNzd29yZA@192.168.100.1:8888"
+        + "/?plugin=obfs-local%3Bobfs%3Dhttp%3Bobfs-host%3Dexample.com#Example1")
+  }
+
+  func testEncodeSIP022UsesPlaintextPercentEncodedUserInfo() {
+    let uri = SsUri(
+      method: "2022-blake3-aes-256-gcm", password: "hmackyEyXXXXXXXXXXXXXXXXXXXw==",
+      host: "203.0.113.7", port: 8388)
+    XCTAssertEqual(
+      uri.encode(),
+      "ss://2022-blake3-aes-256-gcm:hmackyEyXXXXXXXXXXXXXXXXXXXw%3D%3D@203.0.113.7:8388")
+  }
+
+  func testEncodeIPv6Rebrackets() {
+    let uri = SsUri(method: "aes-256-gcm", password: "p", host: "2001:db8::1", port: 8388)
+    XCTAssertTrue(uri.encode().hasSuffix("@[2001:db8::1]:8388"))
+  }
+
+  // MARK: - 往返同构
+
+  func testRoundTripCorpusPreservesAllFields() throws {
+    let corpus: [SsUri] = [
+      SsUri(method: "aes-256-gcm", password: "password123", host: "203.0.113.7", port: 8388),
+      SsUri(
+        method: "rc4-md5", password: "password", host: "192.168.100.1", port: 8888,
+        remark: "Example1"),
+      // 特殊字符：密码含 URI 结构字符、空白、中文。
+      SsUri(
+        method: "chacha20-ietf-poly1305", password: "p@ss:wo/rd#1&=%+ 空格",
+        host: "203.0.113.7", port: 8388, remark: "香港 01 #备注"),
+      // 插件同构：name;opts 原样保留（含 `=`、`:`、`/`、`%`、中文）。
+      SsUri(
+        method: "aes-256-gcm", password: "p", host: "203.0.113.7", port: 8388,
+        pluginProgram: "v2ray-plugin",
+        pluginOptions: "mode=websocket;path=/wss%20x;host=例.com;loglevel=warn"),
+      // 插件参数含 URI 分隔符与 `&`、`;`（透传形态）。
+      SsUri(
+        method: "aes-256-gcm", password: "p", host: "203.0.113.7", port: 8388,
+        pluginProgram: "v2ray-plugin", pluginOptions: "mux=1&t=11;path=/a;b"),
+      // 仅有插件名、无参数。
+      SsUri(
+        method: "aes-256-gcm", password: "p", host: "203.0.113.7", port: 8388,
+        pluginProgram: "v2ray-plugin"),
+      // SIP022 明文 userinfo 往返。
+      SsUri(
+        method: "2022-blake3-aes-256-gcm", password: "hmackyEyXXXXXXXXXXXXXXXXXXXw==",
+        host: "203.0.113.7", port: 8388),
+      // IPv6 往返。
+      SsUri(method: "aes-256-gcm", password: "p", host: "2001:db8::1", port: 9101),
+    ]
+    for original in corpus {
+      let decoded = try SsUri.decode(original.encode())
+      XCTAssertEqual(decoded, original, "往返失真：\(original)")
+    }
+  }
+
+  func testDecodeRejectsEmptyPassword() {
+    let encoded = SsUri(
+      method: "aes-256-gcm", password: "", host: "203.0.113.7", port: 8388
+    ).encode()
+    XCTAssertThrowsError(try SsUri.decode(encoded))
+  }
+
+  func testCanonicalInputSurvivesDecodeEncodeVerbatim() throws {
+    let canonical =
+      "ss://cmM0LW1kNTpwYXNzd29yZA@192.168.100.1:8888"
+      + "/?plugin=obfs-local%3Bobfs%3Dhttp%3Bobfs-host%3Dexample.com#Example1"
+    XCTAssertEqual(try SsUri.decode(canonical).encode(), canonical)
+  }
+
+  /// 密码与插件参数里的 `@`/`#`/`?`/`&` 不得破坏 URI 结构。
+  func testStructureCharactersInSecretsStayOpaque() throws {
+    let hostile = SsUri(
+      method: "aes-256-gcm",
+      password: "a@b#c?d&e=f g/h;i%3B",
+      host: "203.0.113.7", port: 8388,
+      pluginProgram: "v2ray-plugin",
+      pluginOptions: "path=/ws?x=1;host=h@ck#er",
+      remark: "名#字?1")
+    let decoded = try SsUri.decode(hostile.encode())
+    XCTAssertEqual(decoded, hostile)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowCreateServerTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowCreateServerTests.swift
new file mode 100644
index 000000000..d234591c7
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowCreateServerTests.swift
@@ -0,0 +1,124 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 表单新建手动服务器的点名校验用例（标签 + 草稿 + 预期 typed error）。
+private struct InvalidCreateDraftCase {
+  let label: String
+  let draft: ServerEditDraft
+  let expected: ServerFormError
+
+  init(_ label: String, _ draft: ServerEditDraft, _ expected: ServerFormError) {
+    self.label = label
+    self.draft = draft
+    self.expected = expected
+  }
+}
+
+/// 表单新建手动服务器命令（`createServer`）的 UI-facing interface 测试：
+/// 落点与身份、凭据入存储、点名校验拒绝与插件选择落盘，语义与编辑提交对称。
+@MainActor
+final class CatalogWorkflowCreateServerTests: XCTestCase {
+  private var workDir: URL!
+  private var fileURL: URL!
+  private var runtime: FakeCatalogRuntime!
+  var workflow: CatalogWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    // 专用工作目录：写入器会把父目录强制 0700（不得指向临时根）。
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-create-server-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    fileURL = workDir.appendingPathComponent("catalog.json")
+
+    runtime = FakeCatalogRuntime()
+    runtime.hasActiveTarget = true
+    workflow = makeWorkflow()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  private func makeWorkflow() -> CatalogWorkflow {
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: makeTestCatalogStore(fileURL: fileURL), runtime: runtime)
+    return makeCatalogWorkflow(
+      coordinator: coordinator,
+      plugins: NoManagedPluginProvider())
+  }
+
+  func testCreateServerAddsManualLeafWithCredentialAndReturnsIdentity() async throws {
+    let groupID = try await workflow.createGroup(named: "手动组", into: nil)
+    let id = try await workflow.createServer(
+      ServerEditDraft(
+        address: "203.0.113.10", port: 8389, encryptionMethod: "aes-256-gcm",
+        password: "表单密码", remark: "新来的", plugin: .none, pluginOptions: nil),
+      into: groupID)
+    let node = try XCTUnwrap(workflow.tree.node(withID: id))
+    XCTAssertFalse(node.isGroup)
+    XCTAssertTrue(node.isManual)
+    XCTAssertEqual(node.parentID, groupID)
+    let form = try XCTUnwrap(try workflow.serverEditForm(for: id))
+    XCTAssertEqual(form.address, "203.0.113.10")
+    XCTAssertEqual(form.port, 8389)
+    XCTAssertEqual(form.remark, "新来的")
+    XCTAssertEqual(form.encryptionMethod, "aes-256-gcm")
+    XCTAssertEqual(form.password, "表单密码", "密码作为凭据写入，目录持引用")
+    XCTAssertTrue(node.invalidReasons.isEmpty)
+  }
+
+  func testCreateServerRejectsInvalidDraftsLeavingCatalogAndCredentialsUntouched() async throws {
+    let groupID = try await workflow.createGroup(named: "组", into: nil)
+    for caseItem in Self.invalidDraftCases {
+      await expectThrowsAsync(
+        { _ = try await workflow.createServer(caseItem.draft, into: groupID) },
+        onThrow: { error in
+          XCTAssertEqual(error as? ServerFormError, caseItem.expected, caseItem.label)
+        })
+    }
+
+    XCTAssertEqual(workflow.tree.node(withID: groupID)?.childCount, 0, "校验失败不进目录")
+  }
+
+  func testCreateServerPluginSelectionStoresProgramAndOptions() async throws {
+    let id = try await workflow.createServer(
+      ServerEditDraft(
+        address: "203.0.113.10", port: 8388, encryptionMethod: "aes-256-gcm",
+        password: "密码", remark: "插件服务器", plugin: .named(program: "v2ray-plugin"),
+        pluginOptions: "mode=websocket;host=example.com"),
+      into: nil)
+    let plugin = try XCTUnwrap(try workflow.serverEditForm(for: id)?.plugin)
+    XCTAssertEqual(plugin.selection, .named(program: "v2ray-plugin"))
+    XCTAssertTrue(plugin.optionsPresent)
+    XCTAssertEqual(plugin.options, "mode=websocket;host=example.com")
+  }
+
+  /// 表单校验用例表：与 `updateServer` 同规则的点名拒绝（含受管集外插件）。
+  private static var invalidDraftCases: [InvalidCreateDraftCase] {
+    func draft(
+      address: String = "203.0.113.10", port: Int = 8388,
+      encryptionMethod: String = "aes-256-gcm", password: String = "密码",
+      plugin: PluginSelection = .none
+    ) -> ServerEditDraft {
+      ServerEditDraft(
+        address: address, port: port, encryptionMethod: encryptionMethod, password: password,
+        remark: "", plugin: plugin, pluginOptions: nil)
+    }
+    return [
+      InvalidCreateDraftCase("空地址", draft(address: "  "), .invalidAddress),
+      InvalidCreateDraftCase("端口下界", draft(port: 0), .invalidPort),
+      InvalidCreateDraftCase("端口上界", draft(port: 65_536), .invalidPort),
+      InvalidCreateDraftCase("缺加密方式", draft(encryptionMethod: " "), .missingEncryptionMethod),
+      InvalidCreateDraftCase(
+        "不支持加密方式", draft(encryptionMethod: "future-cipher"),
+        .unsupportedEncryptionMethod("future-cipher")),
+      InvalidCreateDraftCase("空密码", draft(password: ""), .invalidPassword),
+      InvalidCreateDraftCase(
+        "受管集外插件", draft(plugin: .named(program: "future-plugin")),
+        .pluginUnknown("future-plugin")),
+    ]
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowDuplicateTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowDuplicateTests.swift
new file mode 100644
index 000000000..8563ba664
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowDuplicateTests.swift
@@ -0,0 +1,166 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct CatalogWorkflowDuplicateTests {
+  @Test func subscriptionCopyPreservesWholeTreeAsManual() async throws {
+    let source = try CatalogFixtures.makeSubscriptionFixture()
+    var catalog = source.catalog
+    try catalog.addGroup("Empty", source: .subscription, to: source.nestedGroupID)
+    let fixture = try DuplicateFixture(catalog: catalog)
+    let workflow = fixture.workflow
+    #expect(workflow.canDuplicate(source.groupID))
+    #expect(!workflow.canDuplicate(source.nestedGroupID))
+    #expect(!workflow.canDuplicate(source.serverIDs[0]))
+    #expect(!workflow.canDuplicate(NodeID.fresh()))
+    let copy = try await workflow.duplicate(source.groupID, nameSuffix: "副本")
+    #expect(workflow.tree.roots.map(\.id) == [source.groupID, copy])
+    let root = try #require(workflow.tree.node(withID: copy))
+    #expect(root.name == "订阅分组 副本")
+    #expect(root.childNodes.map(\.name) == ["嵌套分组", "香港 01"])
+    let nested = try #require(root.childNodes.first)
+    #expect(nested.childNodes.map(\.name) == ["日本 02", "Empty"])
+    let originalRoot = try #require(workflow.tree.node(withID: source.groupID))
+    #expect(root.subtreeIDs.isDisjoint(with: originalRoot.subtreeIDs))
+    for id in root.subtreeIDs {
+      #expect(workflow.tree.node(withID: id)?.isManual == true)
+    }
+    let server = try #require(nested.childNodes.first)
+    #expect(
+      try workflow.serverDetailPluginOptions(for: server.id) == "options")
+    _ = try await workflow.remove(copy)
+    #expect(
+      try workflow.serverDetailPluginOptions(for: source.serverIDs[1])
+        == "options")
+    await #expect(throws: CatalogError.subscriptionNodeImmutable(source.nestedGroupID)) {
+      _ = try await workflow.duplicate(source.nestedGroupID, nameSuffix: "Copy")
+    }
+  }
+
+  @Test func nestedManualGroupCopyKeepsInvalidFieldsAndEmptyGroups() async throws {
+    var catalog = ConfigurationCatalog()
+    let parent = try catalog.addGroup("Parent")
+    let original = try catalog.addGroup("Group", to: parent)
+    let fields = ServerFields(
+      address: "203.0.113.7", port: 8388, encryptionMethod: "future-cipher",
+      password: "password", remark: "Invalid", pluginProgram: nil,
+      pluginOptions: "unknown;flag;flag=")
+    try catalog.addServer(fields, to: original)
+    try catalog.addGroup("Empty", to: original)
+    try catalog.addGroup("Group Copy", to: parent)
+    let fixture = try DuplicateFixture(catalog: catalog)
+    let copy = try await fixture.workflow.duplicate(original, nameSuffix: "Copy")
+    let node = try #require(fixture.workflow.tree.node(withID: copy))
+    #expect(node.parentID == parent)
+    #expect(node.name == "Group Copy 2")
+    #expect(node.childNodes.map(\.name) == ["Invalid", "Empty"])
+    let leaf = try #require(node.childNodes.first)
+    #expect(leaf.isInvalid)
+    #expect(
+      fixture.workflow.serverDetailPresentation(for: leaf.id)?.encryptionMethod == "future-cipher")
+    #expect(try fixture.workflow.serverDetailPluginOptions(for: leaf.id) == "unknown;flag;flag=")
+    let reloaded = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: fixture.fileURL), runtime: FakeCatalogRuntime()))
+    #expect(reloaded.tree.node(withID: copy)?.childNodes.map(\.name) == ["Invalid", "Empty"])
+  }
+
+  @Test func persistenceFailureDoesNotPublishPartialCopy() async throws {
+    let fixture = try DuplicateFixture()
+    let original = try await fixture.workflow.createServer(fixture.draft, into: nil)
+    let gate = fixture.directory.appendingPathComponent("gate")
+    try FileManager.default.removeItem(at: gate)
+    try Data().write(to: gate)
+    await #expect(throws: (any Error).self) {
+      _ = try await fixture.workflow.duplicate(original, nameSuffix: "Copy")
+    }
+    #expect(fixture.workflow.tree.roots.map(\.id) == [original])
+    #expect(try fixture.workflow.serverEditForm(for: original)?.password == "password")
+  }
+
+  @Test func runtimeFailureRetainsCommittedCopy() async throws {
+    let fixture = try DuplicateFixture()
+    let original = try await fixture.workflow.createServer(fixture.draft, into: nil)
+    fixture.runtime.hasActiveTarget = true
+    fixture.runtime.defaultOutcome = .failed(failure: nil)
+    let copy = try await fixture.workflow.duplicate(original, nameSuffix: "Copy")
+    await waitUntilRuntimeSettles(fixture.workflow.runtimeSync != .syncing(generation: 2))
+    #expect(
+      fixture.workflow.runtimeSync == .finished(generation: 2, outcome: .failed(failure: nil)))
+    #expect(fixture.workflow.tree.containsNode(copy))
+    #expect(fixture.runtime.convergeSnapshots.last?.catalog.rootChildren == [original, copy])
+  }
+
+  @Test(arguments: ["副本", "Copy"])
+  func copyingCopiesUsesOneSuffixAndSiblingNumbers(suffix: String) async throws {
+    let fixture = try DuplicateFixture()
+    let workflow = fixture.workflow
+    let original = try await workflow.createGroup(named: "websocket", into: nil)
+    let first = try await workflow.duplicate(original, nameSuffix: suffix)
+    let second = try await workflow.duplicate(first, nameSuffix: suffix)
+    let third = try await workflow.duplicate(second, nameSuffix: suffix)
+    #expect(workflow.displayName(for: first) == "websocket \(suffix)")
+    #expect(workflow.displayName(for: second) == "websocket \(suffix) 2")
+    #expect(workflow.displayName(for: third) == "websocket \(suffix) 3")
+    let otherSuffix = suffix == "Copy" ? "副本" : "Copy"
+    let fourth = try await workflow.duplicate(third, nameSuffix: otherSuffix)
+    #expect(workflow.displayName(for: fourth) == "websocket \(suffix) 4")
+    let detached = try await workflow.createGroup(named: "Detached \(suffix) 2", into: nil)
+    let detachedCopy = try await workflow.duplicate(detached, nameSuffix: suffix)
+    #expect(workflow.displayName(for: detachedCopy) == "Detached \(suffix) 3")
+    let interior = try await workflow.createGroup(named: "websocket \(suffix) backup", into: nil)
+    let interiorCopy = try await workflow.duplicate(interior, nameSuffix: suffix)
+    #expect(workflow.displayName(for: interiorCopy) == "websocket \(suffix) backup \(suffix)")
+  }
+
+  @Test func serverCopyIsAdjacentAndIndependent() async throws {
+    let fixture = try DuplicateFixture()
+    let workflow = fixture.workflow
+    let parent = try await workflow.createGroup(named: "Parent", into: nil)
+    let original = try await workflow.createServer(fixture.draft, into: parent)
+    let next = try await workflow.createGroup(named: "Next", into: parent)
+    let copy = try await workflow.duplicate(original, nameSuffix: "Copy")
+    #expect(workflow.tree.node(withID: parent)?.childNodes.map(\.id) == [original, copy, next])
+    #expect(workflow.displayName(for: copy) == "Server Copy")
+    #expect(try workflow.serverEditForm(for: copy)?.password == "password")
+    var edited = fixture.draft
+    edited.password = "changed"
+    try await workflow.updateServer(copy, draft: edited)
+    #expect(try workflow.serverEditForm(for: original)?.password == "password")
+    _ = try await workflow.remove(copy)
+    #expect(try workflow.serverEditForm(for: original)?.password == "password")
+    let copy2 = try await workflow.duplicate(original, nameSuffix: "Copy")
+    let copy3 = try await workflow.duplicate(original, nameSuffix: "Copy")
+    #expect(workflow.displayName(for: copy2) == "Server Copy")
+    #expect(workflow.displayName(for: copy3) == "Server Copy 2")
+  }
+}
+
+@MainActor
+private final class DuplicateFixture {
+  let directory: URL
+  let fileURL: URL
+  let runtime = FakeCatalogRuntime()
+  let workflow: CatalogWorkflow
+  var draft: ServerEditDraft {
+    ServerEditDraft(
+      address: "203.0.113.7", port: 8388, encryptionMethod: "aes-256-gcm",
+      password: "password", remark: "Server", plugin: .none, pluginOptions: nil)
+  }
+
+  init(
+    catalog: ConfigurationCatalog = ConfigurationCatalog()
+  ) throws {
+    directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("duplicate-\(UUID().uuidString)")
+    fileURL = directory.appendingPathComponent("gate/catalog.json")
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: catalog))
+    workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: fileURL), runtime: runtime))
+  }
+
+  deinit { try? FileManager.default.removeItem(at: directory) }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowFavoritesTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowFavoritesTests.swift
new file mode 100644
index 000000000..0060bc544
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowFavoritesTests.swift
@@ -0,0 +1,251 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct CatalogWorkflowFavoritesTests {
+  @Test(arguments: [false, true], [false, true])
+  func textImportSelectsNewNodeIncludingPartialSuccess(partial: Bool, intoGroup: Bool) async throws
+  {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let parent =
+      intoGroup ? try await fixture.workflow.createGroup(named: "Existing", into: nil) : nil
+    let uri = "ss://YWVzLTI1Ni1nY206cHc@203.0.113.7:8388#New"
+    let outcome = await fixture.workflow.importServers(
+      from: [.clipboardText(partial ? uri + "\ninvalid" : uri)], into: parent)
+    let children =
+      parent.flatMap { fixture.workflow.tree.node(withID: $0)?.childNodes }
+      ?? fixture.workflow.tree.roots
+    let added = try #require(children.first)
+    #expect(outcome.newNodeSelectionCandidate == added.id)
+    #expect(fixture.workflow.favoriteIDs.isEmpty)
+  }
+
+  @Test func legacyImportPreservesExistingFavorites() async throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let group = try await fixture.workflow.createGroup(named: "Existing", into: nil)
+    try fixture.workflow.setFavorite(group, isFavorite: true)
+    let snapshot = try LegacySnapshot(propertyList: [
+      "ServerProfiles": [
+        [
+          "ServerHost": "203.0.113.8", "ServerPort": 8388,
+          "Method": "aes-256-gcm", "Password": "fixture", "Remark": "Imported",
+        ]
+      ]
+    ])
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(fileStore: fixture.store, runtime: fixture.runtime),
+      legacyImportService: LegacyImportService(
+        source: FixedLegacySnapshotProvider(snapshot: snapshot), catalogStore: fixture.store,
+        marker: InMemoryLegacyImportMarker()))
+    let outcome = try await workflow.importLegacy()
+    #expect(outcome.report.importedServerCount == 1)
+    #expect(workflow.favoriteIDs == [group])
+    #expect(fixture.reloaded().favoriteIDs == [group])
+  }
+
+  @Test(arguments: [1, 2, 3, 4, 5])
+  func historicalDocumentsAreRejected(version: Int) throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let json =
+      "{\"version\":\(version),\"rootChildren\":[],\"entries\":[],\"subscriptions\":[],\"favoriteIDs\":[]}"
+    #expect(throws: CatalogFileStore.PersistenceError.self) {
+      try CatalogFileStore.decode(Data(json.utf8))
+    }
+  }
+
+  @Test func failedSavesKeepTheCommittedOrder() async throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let first = try await fixture.workflow.createGroup(named: "First", into: nil)
+    let second = try await fixture.workflow.createGroup(named: "Second", into: nil)
+    try fixture.workflow.setFavorite(first, isFavorite: true)
+    try fixture.workflow.setFavorite(second, isFavorite: true)
+    let originalData = try CatalogFileStore.encode(fixture.store.load())
+    let gate = fixture.store.fileURL.deletingLastPathComponent()
+    let backup = fixture.directory.appendingPathComponent("backup")
+    try FileManager.default.moveItem(at: gate, to: backup)
+    try Data().write(to: gate)
+
+    #expect(throws: (any Error).self) {
+      try fixture.workflow.moveFavorite(second, before: first)
+    }
+    #expect(throws: (any Error).self) {
+      try fixture.workflow.setFavorite(first, isFavorite: false)
+    }
+    #expect(fixture.workflow.favoriteIDs == [first, second])
+    try FileManager.default.removeItem(at: gate)
+    try FileManager.default.moveItem(at: backup, to: gate)
+    #expect(try CatalogFileStore.encode(fixture.store.load()) == originalData)
+    #expect(fixture.reloaded().favoriteIDs == [first, second])
+  }
+
+  @Test func invalidReorderTargetsLeaveFavoritesUnchanged() async throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let group = try await fixture.workflow.createGroup(named: "Group", into: nil)
+    try fixture.workflow.setFavorite(group, isFavorite: true)
+    let missing = NodeID(rawValue: "missing")
+    #expect(throws: CatalogError.nodeNotFound(missing)) {
+      try fixture.workflow.moveFavorite(group, before: missing)
+    }
+    #expect(throws: CatalogError.nodeNotFound(missing)) {
+      try fixture.workflow.setFavorite(missing, isFavorite: true)
+    }
+    try fixture.workflow.moveFavorite(group, before: group)
+    #expect(fixture.reloaded().favoriteIDs == [group])
+  }
+
+  @Test func subscriptionRefreshPreservesSurvivorsAndNeverRestoresRemovedFavorites() async throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let summary = try await fixture.workflow.createSubscription(
+      urlString: "https://example.com/sub.json")
+    let group = try #require(fixture.workflow.tree.node(withID: summary.groupID))
+    let nestedNode = group.childNodes.first { $0.isGroup }
+    let nested = try #require(nestedNode)
+    let server = try #require(nested.childNodes.first)
+    for id in [server.id, summary.groupID, nested.id] {
+      try fixture.workflow.setFavorite(id, isFavorite: true)
+    }
+
+    fixture.fetcher.setBehavior(.success(SubscriptionDocs.treeRenamedAndReordered()))
+    await fixture.workflow.refreshSubscription(summary.id)
+    #expect(fixture.workflow.favoriteIDs == [server.id, summary.groupID, nested.id])
+
+    fixture.fetcher.setBehavior(.success(Data("invalid".utf8)))
+    await fixture.workflow.refreshSubscription(summary.id)
+    #expect(fixture.reloaded().favoriteIDs == [server.id, summary.groupID, nested.id])
+
+    fixture.fetcher.setBehavior(.success(SubscriptionDocs.flat(serverCount: 0)))
+    await fixture.workflow.refreshSubscription(summary.id)
+    #expect(fixture.reloaded().favoriteIDs == [summary.groupID])
+    fixture.fetcher.setBehavior(.success(SubscriptionDocs.tree()))
+    await fixture.workflow.refreshSubscription(summary.id)
+    #expect(fixture.workflow.tree.containsNode(server.id))
+    #expect(fixture.workflow.favoriteIDs == [summary.groupID])
+
+    try fixture.workflow.setFavorite(server.id, isFavorite: true)
+    _ = try await fixture.workflow.removeSubscription(summary.id)
+    #expect(fixture.reloaded().favorites.isEmpty)
+  }
+
+  @Test func importingNewNodesDoesNotInheritFavorites() async throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let uri = "ss://YWVzLTI1Ni1nY206cHc@203.0.113.7:8388#Same"
+    _ = await fixture.workflow.importServers(from: [.clipboardText(uri)], into: nil)
+    let first = try #require(fixture.workflow.tree.roots.first)
+    try fixture.workflow.setFavorite(first.id, isFavorite: true)
+    _ = await fixture.workflow.importServers(from: [.clipboardText(uri)], into: nil)
+    #expect(fixture.workflow.tree.roots.count == 2)
+    #expect(fixture.workflow.favoriteIDs == [first.id])
+  }
+
+  @Test(arguments: [["group", "group"], ["missing"]])
+  func inconsistentFavoritesCannotBeLoaded(ids: [String]) throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    var catalog = ConfigurationCatalog()
+    try catalog.addGroup("Group", id: NodeID(rawValue: "group"))
+    try fixture.store.save(CatalogDocument(catalog: catalog))
+    let raw = try JSONSerialization.jsonObject(with: CatalogFileStore.encode(fixture.store.load()))
+    var payload = try #require(raw as? [String: Any])
+    payload["favoriteIDs"] = ids
+    let invalid = try JSONSerialization.data(withJSONObject: payload)
+    #expect(throws: CatalogFileStore.PersistenceError.self) { try CatalogFileStore.decode(invalid) }
+  }
+
+  @Test func directoryEditsPreserveFavoritesAndRemovalCleansDescendants() async throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let parent = try await fixture.workflow.createGroup(named: "Parent", into: nil)
+    let child = try await fixture.workflow.createGroup(named: "Child", into: parent)
+    let other = try await fixture.workflow.createGroup(named: "Other", into: nil)
+    for id in [child, parent, other] {
+      try fixture.workflow.setFavorite(id, isFavorite: true)
+    }
+    try await fixture.workflow.renameGroup(child, to: "Renamed")
+    try await fixture.workflow.move(parent, to: other)
+    let copy = try await fixture.workflow.duplicate(parent, nameSuffix: "Copy")
+    #expect(fixture.workflow.favorites.map(\.id) == [child, parent, other])
+    #expect(fixture.workflow.favorites.first?.name == "Renamed")
+    #expect(!fixture.workflow.isFavorite(copy))
+
+    _ = try await fixture.workflow.remove(parent)
+    #expect(fixture.workflow.favoriteIDs == [other])
+    #expect(fixture.reloaded().favoriteIDs == [other])
+  }
+
+  @Test func reorderingAndRefavoritingChangeOnlyFavorites() async throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let first = try await fixture.workflow.createGroup(named: "First", into: nil)
+    let second = try await fixture.workflow.createGroup(named: "Second", into: nil)
+    let third = try await fixture.workflow.createGroup(named: "Third", into: nil)
+    let originalTree = fixture.workflow.tree
+    fixture.runtime.hasActiveTarget = true
+    for id in [first, second, third] {
+      try fixture.workflow.setFavorite(id, isFavorite: true)
+    }
+
+    try fixture.workflow.moveFavorite(third, before: first)
+    #expect(fixture.workflow.favorites.map(\.id) == [third, first, second])
+    try fixture.workflow.moveFavorite(third, before: nil)
+    #expect(fixture.workflow.favorites.map(\.id) == [first, second, third])
+    try fixture.workflow.setFavorite(second, isFavorite: false)
+    try fixture.workflow.setFavorite(second, isFavorite: true)
+    #expect(fixture.reloaded().favorites.map(\.id) == [first, third, second])
+    #expect(fixture.workflow.tree == originalTree)
+    #expect(fixture.workflow.runtimeSync == .idle)
+    await Task.yield()
+    #expect(fixture.runtime.convergeCount == 0)
+  }
+
+  @Test func favoritesAreUniqueOrderedAndRestored() async throws {
+    let fixture = try FavoritesFixture()
+    defer { fixture.cleanUp() }
+    let first = try await fixture.workflow.createGroup(named: "First", into: nil)
+    let second = try await fixture.workflow.createGroup(named: "Second", into: first)
+
+    try fixture.workflow.setFavorite(first, isFavorite: true)
+    try fixture.workflow.setFavorite(second, isFavorite: true)
+    try fixture.workflow.setFavorite(first, isFavorite: true)
+
+    #expect(fixture.workflow.favorites.map(\.id) == [first, second])
+    #expect(fixture.reloaded().favorites.map(\.id) == [first, second])
+  }
+}
+
+@MainActor
+private struct FavoritesFixture {
+  let directory: URL
+  let store: CatalogFileStore
+  let runtime = FakeCatalogRuntime()
+  let fetcher = FakeSubscriptionFetcher(behavior: .success(SubscriptionDocs.tree()))
+  let workflow: CatalogWorkflow
+
+  init() throws {
+    directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("favorites-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let gate = directory.appendingPathComponent("gate", isDirectory: true)
+    try FileManager.default.createDirectory(at: gate, withIntermediateDirectories: true)
+    store = makeTestCatalogStore(fileURL: gate.appendingPathComponent("catalog.json"))
+    workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(fileStore: store, runtime: runtime),
+      plugins: NoManagedPluginProvider(), subscriptionFetcher: fetcher)
+  }
+
+  func reloaded() -> CatalogWorkflow {
+    makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(fileStore: store, runtime: runtime),
+      plugins: NoManagedPluginProvider(), subscriptionFetcher: fetcher)
+  }
+
+  func cleanUp() { try? FileManager.default.removeItem(at: directory) }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowImportTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowImportTests.swift
new file mode 100644
index 000000000..9f471446a
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowImportTests.swift
@@ -0,0 +1,333 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 统一服务器导入管线的 interface 测试（docs/design/unified-server-import.md，
+/// ADR-0027）：来源嗅探分派、SIP-008 整树导入与整份拒绝、来源间独立性、凭据
+/// journal 回滚与命名兜底。全部经 `importServers(from:into:)` 单一接缝观察
+/// projection 与结构化结果，不触碰内部存储。
+@MainActor
+struct CatalogWorkflowImportTests {
+  // MARK: - SIP-008 整树导入
+
+  @Test func sip008FileImportsTreeWithFreshIdentities() async throws {
+    try await withImportWorkflow { workflow in
+      let outcome = await workflow.importServers(
+        from: [.file(name: "机场.json", data: Data(SIP008DocumentFixture.tree.utf8))], into: nil)
+
+      let groupID = try #require(outcome.sources.first?.result.importedGroupID)
+      #expect(outcome.sources.first?.result.importedCount == 2)
+      #expect(outcome.selectionCandidate == groupID)
+
+      let root = try #require(workflow.tree.node(withID: groupID))
+      #expect(root.isGroup)
+      #expect(root.isManual, "导入产物是手动子树")
+      #expect(root.name == "我的机场")
+      #expect(root.childCount == 3, "服务器 + 嵌套分组 + 服务器按文档顺序")
+      #expect(root.childNodes.map(\.name) == ["香港 01", "嵌套组", "日本 02"])
+
+      // ADR-0027：目录身份全新 UUID，文档 ID 只作装配键不进入目录。
+      #expect(UUID(uuidString: groupID.rawValue) != nil, "根分组身份客户端所有、全新生成")
+      for child in root.childNodes where !child.isGroup {
+        #expect(UUID(uuidString: child.id.rawValue) != nil, "服务器叶子身份全新生成")
+      }
+
+      let first = try #require(root.childNodes.first)
+      #expect(try workflow.serverEditForm(for: first.id)?.password == "pw1", "密码入凭据存储")
+      #expect(try workflow.serverEditForm(for: first.id)?.remark == "香港 01")
+      let second = try #require(root.childNodes.last)
+      #expect(try workflow.serverEditForm(for: second.id)?.password == "pw2")
+    }
+  }
+
+  @Test func sip008FlatFallbackNamesRootFromFileName() async throws {
+    try await withImportWorkflow { workflow in
+      let outcome = await workflow.importServers(
+        from: [.file(name: "我的机场.json", data: Data(SIP008DocumentFixture.flat.utf8))], into: nil)
+
+      let groupID = try #require(outcome.sources.first?.result.importedGroupID)
+      #expect(workflow.tree.node(withID: groupID)?.name == "我的机场", "文件名去扩展名兜底")
+      #expect(workflow.tree.node(withID: groupID)?.childCount == 2, "扁平回退平铺根分组")
+    }
+  }
+
+  @Test func sip008NamelessFileFallsBackToGenericRootName() async throws {
+    try await withImportWorkflow { workflow in
+      let outcome = await workflow.importServers(
+        from: [.file(name: "", data: Data(SIP008DocumentFixture.flat.utf8))], into: nil)
+
+      let groupID = try #require(outcome.sources.first?.result.importedGroupID)
+      #expect(workflow.tree.node(withID: groupID)?.name == "导入的服务器")
+    }
+  }
+
+  @Test func sip008DuplicateRootNameGetsSuffix() async throws {
+    try await withImportWorkflow { workflow in
+      _ = await workflow.importServers(
+        from: [.file(name: "机场.json", data: Data(SIP008DocumentFixture.tree.utf8))], into: nil)
+      _ = await workflow.importServers(
+        from: [.file(name: "机场.json", data: Data(SIP008DocumentFixture.tree.utf8))], into: nil)
+
+      #expect(workflow.tree.roots.count == 2)
+      #expect(workflow.tree.roots.map(\.name) == ["我的机场", "我的机场 2"], "重名加序号后缀")
+      #expect(Set(workflow.tree.roots.map(\.id)).count == 2, "重复导入产生独立副本（ADR-0027）")
+    }
+  }
+
+  @Test func sip008PluginOptionsStoredWithoutProgram() async throws {
+    try await withImportWorkflow { workflow in
+      _ = await workflow.importServers(
+        from: [.file(name: "opts.json", data: Data(SIP008DocumentFixture.pluginOptions.utf8))],
+        into: nil)
+
+      let group = try #require(workflow.tree.roots.first)
+      #expect(group.name == "opts", "文件名兜底")
+      let node = try #require(group.childNodes.first)
+      let form = try #require(try workflow.serverEditForm(for: node.id))
+      #expect(form.plugin.selection == .none, "无插件程序名")
+      #expect(form.plugin.optionsPresent, "插件参数保真存入")
+      #expect(form.password == "pw3")
+      #expect(try workflow.serverDetailPluginOptions(for: node.id) == "mode=websocket")
+    }
+  }
+
+  // MARK: - SIP-008 整份拒绝
+
+  @Test func sip008InvalidRecordRejectsWholeSource() async throws {
+    try await withImportWorkflow { workflow in
+      let document = """
+        {"version":1,"servers":[
+          {"server":"203.0.113.7","server_port":8388,"password":"pw","method":"aes-256-gcm"},
+          {"server":"203.0.113.8","server_port":8389,"password":"","method":"aes-256-gcm"}]}
+        """
+      let outcome = await workflow.importServers(
+        from: [.file(name: "bad.json", data: Data(document.utf8))], into: nil)
+
+      let failure = try #require(outcome.sources.first?.result.sourceFailure)
+      guard case .parse(.recordValidation(let index, _)) = failure else {
+        Issue.record("应为记录校验失败：\(failure)")
+        return
+      }
+      #expect(index == 1, "点名无效记录")
+      #expect(workflow.tree.roots.isEmpty, "整份拒绝不留部分子树")
+    }
+  }
+
+  // MARK: - 二维码图片
+
+  @Test func qrImageImportsDetectedServers() async throws {
+    try await withImportWorkflow { workflow in
+      let uri = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388#二维码"
+      let png = try QrCodeCodec.generatePNG(for: uri)
+
+      let outcome = await workflow.importServers(
+        from: [.file(name: "qr.png", data: png)], into: nil)
+
+      #expect(outcome.sources.first?.result.importedCount == 1)
+      #expect(workflow.tree.roots.first?.name == "二维码")
+    }
+  }
+
+  @Test func qrImageWithoutSSPayloadFails() async throws {
+    try await withImportWorkflow { workflow in
+      let png = try QrCodeCodec.generatePNG(for: "plain text payload")
+
+      let outcome = await workflow.importServers(
+        from: [.file(name: "qr.png", data: png)], into: nil)
+
+      let failure = try #require(outcome.sources.first?.result.sourceFailure)
+      guard case .qrPayloadNotFound = failure else {
+        Issue.record("应为二维码无 ss:// 负载：\(failure)")
+        return
+      }
+      #expect(workflow.tree.roots.isEmpty)
+    }
+  }
+
+  // MARK: - 文本文件与剪贴板
+
+  @Test func textFileImportsLinesPartially() async throws {
+    try await withImportWorkflow { workflow in
+      let text = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388#文件行\n垃圾行\n"
+      let outcome = await workflow.importServers(
+        from: [.file(name: "list.txt", data: Data(text.utf8))], into: nil)
+
+      let facts = try #require(outcome.sources.first?.result.partialFacts)
+      #expect(facts.addedCount == 1)
+      #expect(facts.failures.count == 1)
+      #expect(facts.failures[0].lineIndex == 1)
+      #expect(outcome.selectionCandidate == nil, "根层文本来源无可选中新分组")
+    }
+  }
+
+  @Test func blankLinesKeepOriginalFailureIndexes() async throws {
+    try await withImportWorkflow { workflow in
+      let text = "第一行垃圾\n\n\nss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388"
+      let outcome = await workflow.importServers(
+        from: [.clipboardText(text)], into: nil)
+
+      let facts = try #require(outcome.sources.first?.result.partialFacts)
+      #expect(facts.addedCount == 1)
+      #expect(facts.failures.count == 1)
+      #expect(facts.failures[0].lineIndex == 0, "失败行按含空行的原始下标点名")
+    }
+  }
+
+  @Test func clipboardEmptyTextFailsWithoutCatalogChange() async throws {
+    try await withImportWorkflow { workflow in
+      let outcome = await workflow.importServers(
+        from: [.clipboardText("   \n  ")], into: nil)
+
+      let failure = try #require(outcome.sources.first?.result.sourceFailure)
+      guard case .noImportableLines = failure else {
+        Issue.record("应为无可导入行：\(failure)")
+        return
+      }
+      #expect(workflow.tree.roots.isEmpty)
+    }
+  }
+
+  // MARK: - 来源独立性与提交失败回滚
+
+  @Test func sourcesImportIndependently() async throws {
+    try await withImportWorkflow { workflow in
+      let broken = """
+        {"version":1,"servers":[
+          {"server":"203.0.113.7","server_port":8388,"password":"","method":"aes-256-gcm"}]}
+        """
+      let text = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388#可用来源"
+
+      let outcome = await workflow.importServers(
+        from: [.file(name: "bad.json", data: Data(broken.utf8)), .clipboardText(text)], into: nil)
+
+      #expect(outcome.sources.count == 2)
+      #expect(outcome.sources[0].result.sourceFailure != nil, "坏文件整体失败")
+      #expect(outcome.sources[1].result.importedCount == 1, "失败不影响其他来源")
+      #expect(workflow.tree.roots.count == 1, "只有可用来源落盘")
+      #expect(workflow.tree.roots.first?.name == "可用来源")
+    }
+  }
+
+  @Test func commitFailureDoesNotPublishImportedRecords() async throws {
+    try await withGateBrokenWorkflow { workflow in
+      let text = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388#提交失败"
+
+      let outcome = await workflow.importServers(from: [.clipboardText(text)], into: nil)
+
+      let failure = try #require(outcome.sources.first?.result.sourceFailure)
+      guard case .commit = failure else {
+        Issue.record("应为提交失败：\(failure)")
+        return
+      }
+      #expect(workflow.tree.roots.isEmpty, "目录提交失败不留节点")
+    }
+  }
+
+  @Test func selectionCandidatePrefersLastImportedGroup() async throws {
+    try await withImportWorkflow { workflow in
+      let text = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388#根层"
+      let outcome = await workflow.importServers(
+        from: [
+          .clipboardText(text),
+          .file(name: "机场.json", data: Data(SIP008DocumentFixture.tree.utf8)),
+        ],
+        into: nil)
+
+      let fileGroupID = try #require(outcome.sources[1].result.importedGroupID)
+      #expect(outcome.selectionCandidate == fileGroupID, "选中最后一个成功来源的新分组")
+    }
+  }
+
+  // MARK: - 夹具
+
+  /// 临时目录 + 内存凭据与库密钥；UUID 后缀命名，进程私有资源（runner 并行安全）。
+  private func withImportWorkflow(
+    _ body: @MainActor (CatalogWorkflow) async throws -> Void
+  ) async throws {
+    let directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-import-tests-\(UUID().uuidString)", isDirectory: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: makeTestCatalogStore(
+        fileURL: directory.appendingPathComponent("catalog.json")),
+      runtime: FakeCatalogRuntime())
+    let workflow = makeCatalogWorkflow(coordinator: coordinator)
+    try await body(workflow)
+  }
+
+  /// 目录文件置于 gate 子目录；把 gate 目录替换为同名文件后，下一次持久化
+  /// 必然失败（回滚测试的确定性失败注入，与 CatalogWorkflowRollbackTests 同法）。
+  private func withGateBrokenWorkflow(
+    _ body: @MainActor (CatalogWorkflow) async throws -> Void
+  ) async throws {
+    let directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-import-gate-\(UUID().uuidString)", isDirectory: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let gateDir = directory.appendingPathComponent("gate")
+    try FileManager.default.createDirectory(at: gateDir, withIntermediateDirectories: true)
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: makeTestCatalogStore(fileURL: gateDir.appendingPathComponent("catalog.json")),
+      runtime: FakeCatalogRuntime())
+    let workflow = makeCatalogWorkflow(coordinator: coordinator)
+    try FileManager.default.removeItem(at: gateDir)
+    try Data().write(to: gateDir)
+    try await body(workflow)
+  }
+}
+
+/// SIP-008 文档夹具（与导出侧键名同构）。
+private enum SIP008DocumentFixture {
+  /// 根分组 + 嵌套分组 + 两台服务器。
+  static let tree = """
+    {
+      "version": 1,
+      "servers": [
+        {"id": "11111111-1111-4111-8111-111111111111",
+         "remarks": "香港 01", "server": "203.0.113.7", "server_port": 8388,
+         "password": "pw1", "method": "aes-256-gcm"},
+        {"id": "22222222-2222-4222-8222-222222222222",
+         "remarks": "日本 02", "server": "203.0.113.8", "server_port": 8389,
+         "password": "pw2", "method": "aes-256-gcm"}
+      ],
+      "x_shadowsocksx_ng": {
+        "schema_version": 1,
+        "root_group_id": "doc-root-group",
+        "groups": [
+          {"id": "doc-root-group", "name": "我的机场", "children": [
+            {"type": "server", "id": "11111111-1111-4111-8111-111111111111"},
+            {"type": "group", "id": "doc-nested-group"},
+            {"type": "server", "id": "22222222-2222-4222-8222-222222222222"}
+          ]},
+          {"id": "doc-nested-group", "name": "嵌套组", "children": []}
+        ]
+      }
+    }
+    """
+
+  /// 无扩展的标准扁平文档（第三方 SIP-008 消费形态）。
+  static let flat = """
+    {
+      "version": 1,
+      "servers": [
+        {"remarks": "香港 01", "server": "203.0.113.7", "server_port": 8388,
+         "password": "pw1", "method": "aes-256-gcm"},
+        {"remarks": "日本 02", "server": "203.0.113.8", "server_port": 8389,
+         "password": "pw2", "method": "aes-256-gcm"}
+      ]
+    }
+    """
+
+  /// 有插件参数但缺插件程序名的记录（保真存入语义）。
+  static let pluginOptions = """
+    {
+      "version": 1,
+      "servers": [
+        {"id": "33333333-3333-4333-8333-333333333333", "server": "203.0.113.9",
+         "server_port": 8390, "password": "pw3", "method": "aes-256-gcm",
+         "plugin_opts": "mode=websocket"}
+      ]
+    }
+    """
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowLibraryTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowLibraryTests.swift
new file mode 100644
index 000000000..e6b6923cb
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowLibraryTests.swift
@@ -0,0 +1,207 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct CatalogWorkflowLibraryTests {
+  @Test func failedLoadPreventsEditsAndPreservesFile() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let url = directory.appendingPathComponent("catalog.json")
+    let damaged = Data("damaged-library".utf8)
+    try damaged.write(to: url)
+    let runtime = FakeCatalogRuntime()
+    runtime.hasActiveTarget = true
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: makeTestCatalogStore(fileURL: url), runtime: runtime)
+    let workflow = makeCatalogWorkflow(
+      coordinator: coordinator)
+    await #expect(throws: (any Error).self) {
+      try await workflow.createGroup(named: "must-not-save", into: nil)
+    }
+    #expect(try Data(contentsOf: url) == damaged)
+    #expect(runtime.convergeCount == 0)
+  }
+  @Test func explicitUnlockLoadsLibraryAndResumesRuntime() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let url = directory.appendingPathComponent("catalog.age")
+    let keys = TestLibraryKeys()
+    func makeStore() -> CatalogFileStore {
+      CatalogFileStore(
+        fileURL: url,
+        library: ServerLibraryStorage(
+          keys: keys))
+    }
+    let original = makeStore()
+    _ = try original.load()
+    var catalog = ConfigurationCatalog()
+    _ = try catalog.addGroup("saved-group")
+    try original.save(CatalogDocument(catalog: catalog))
+    let encrypted = try Data(contentsOf: url)
+    keys.requiresInteraction = true
+    let store = makeStore()
+    let runtime = FakeCatalogRuntime()
+    let coordinator = CatalogCommitCoordinator(fileStore: store, runtime: runtime)
+    let workflow = makeCatalogWorkflow(coordinator: coordinator)
+    #expect(workflow.libraryFailure == .authorization(-25308))
+    #expect(!coordinator.committedCatalog.contains(catalog.rootChildren[0]))
+    #expect(runtime.convergeCount == 0)
+    await withCheckedContinuation { continuation in
+      runtime.onNextConverge = { continuation.resume() }
+      workflow.unlockLibrary()
+    }
+    #expect(workflow.libraryFailure == nil)
+    #expect(workflow.tree.roots.first?.name == "saved-group")
+    #expect(try Data(contentsOf: url) == encrypted)
+    #expect(runtime.convergeCount == 1)
+  }
+
+  @Test func failedResetPreservesOldLibraryAndSuccessfulResetUsesNewKey() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let url = directory.appendingPathComponent("catalog.age")
+    let keys = TestLibraryKeys()
+    let store = CatalogFileStore(
+      fileURL: url,
+      library: ServerLibraryStorage(
+        keys: keys))
+    _ = try store.load()
+    var catalog = ConfigurationCatalog()
+    _ = try catalog.addGroup("saved-group")
+    try store.save(CatalogDocument(catalog: catalog))
+    let encrypted = try Data(contentsOf: url)
+    let runtime = FakeCatalogRuntime()
+    runtime.hasActiveTarget = true
+    let coordinator = CatalogCommitCoordinator(fileStore: store, runtime: runtime)
+    let workflow = makeCatalogWorkflow(coordinator: coordinator)
+    keys.createFails = true
+    workflow.resetLibrary()
+    #expect(workflow.libraryFailure != nil)
+    #expect(try Data(contentsOf: url) == encrypted)
+    #expect(workflow.tree.roots.first?.name == "saved-group")
+    #expect(runtime.convergeCount == 0)
+    keys.createFails = false
+    await withCheckedContinuation { continuation in
+      runtime.onNextConverge = { continuation.resume() }
+      workflow.resetLibrary()
+    }
+    #expect(workflow.libraryFailure == nil)
+    #expect(workflow.tree.roots.isEmpty)
+    #expect(try store.load().catalog.isEmpty)
+    #expect(keys.values.count == 2)
+    #expect(runtime.convergeSnapshots.last?.catalog.isEmpty == true)
+  }
+
+  @Test func failedLoadDoesNotClearActiveTargetOrRewriteRuntimeOnLaunch() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let url = directory.appendingPathComponent("catalog.json")
+    try Data("broken-library".utf8).write(to: url)
+    let activation = ActivationStateFileStore(
+      fileURL: directory.appendingPathComponent("activation.json"))
+    let target = NodeID(rawValue: "existing-target")
+    try activation.save(activeTargetID: target)
+    let runtimeURL = directory.appendingPathComponent("sslocal-active.json")
+    let previousContract = Data("existing-runtime-contract".utf8)
+    try previousContract.write(to: runtimeURL)
+    let bootstrap = CatalogCommitCoordinator.bootstrap(
+      fileStore: makeTestCatalogStore(fileURL: url))
+    let agent = ProxyRuntimeFixture.FakeLaunchAgent(initialStatus: .registered)
+    let controller = ProxyRuntimeController(
+      controlPreferences: makeTestProxyControlPreferences(),
+      catalogSnapshotReader: bootstrap.catalogSnapshotReader, activationFileStore: activation,
+      runtimeFileStore: RuntimeFileStore(fileURL: runtimeURL),
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(agentEnabled: true), unreadableError: nil),
+      agent: agent)
+    await controller.resyncOnLaunch()
+    await controller.convergeAgent()
+    #expect(try activation.loadActiveTargetID() == target)
+    #expect(controller.activeTargetID == target)
+    #expect(try Data(contentsOf: runtimeURL) == previousContract)
+    #expect(agent.registerCount == 0)
+    #expect(agent.unregisterCount == 0)
+  }
+
+  @Test func editedSubscriptionURLPersistsWhileRefreshIsInProgress() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let url = directory.appendingPathComponent("catalog.age")
+    let keys = TestLibraryKeys()
+    let fixture = try CatalogFixtures.makeSubscriptionFixture(prefix: "edit-url")
+    let record = SubscriptionRecord(
+      id: NodeID.fresh(), groupID: fixture.groupID,
+      url: "https://old.example/sub", status: .never)
+    let document = CatalogDocument(catalog: fixture.catalog, subscriptions: [record])
+    let store = CatalogFileStore(
+      fileURL: url,
+      library: ServerLibraryStorage(
+        keys: keys))
+    _ = try store.load()
+    try store.save(document)
+    let fetcher = GatedFetcher()
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime()),
+      subscriptionFetcher: fetcher)
+    let refresh = Task { await workflow.refreshSubscription(record.id) }
+    try await withTestTask(refresh, release: fetcher.releaseAll) {
+      try await requireTestCondition("old URL fetch entered") { fetcher.didEnterFetch }
+      let edit = Task {
+        do {
+          try await workflow.saveSubscription(record.id, urlString: "https://new.example/sub")
+        } catch { Issue.record(error) }
+      }
+      try await withTestTask(edit, release: fetcher.releaseAll) {
+        try await requireTestCondition("new URL fetch entered") { fetcher.requestCount == 2 }
+        let restored = CatalogFileStore(
+          fileURL: url, library: ServerLibraryStorage(keys: keys))
+        _ = try restored.load()
+        #expect(try restored.load().subscriptions.first?.url == "https://new.example/sub")
+      }
+    }
+  }
+
+  @Test func failedURLSaveDoesNotFetchOrPublishAndFailedRefreshKeepsSecrets() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = makeTestCatalogStore(fileURL: directory.appendingPathComponent("gate/catalog.age"))
+    let fetcher = FakeSubscriptionFetcher(behavior: .success(SubscriptionDocs.tree()))
+    let runtime = FakeCatalogRuntime()
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(fileStore: store, runtime: runtime),
+      subscriptionFetcher: fetcher)
+    let subscription = try await workflow.createSubscription(urlString: "https://old.example/sub")
+    let server = try #require(
+      workflow.tree.node(withID: subscription.groupID)?.childNodes
+        .first(where: { !$0.isGroup }))
+    let before = try #require(try workflow.serverEditForm(for: server.id))
+    let requests = fetcher.requestCount
+    let gate = directory.appendingPathComponent("gate")
+    try FileManager.default.removeItem(at: gate)
+    try Data().write(to: gate)
+    await #expect(throws: (any Error).self) {
+      try await workflow.saveSubscription(
+        subscription.id, urlString: "https://new.example/sub",
+        autoUpdate: .init(userOverride: .daily))
+    }
+    #expect(workflow.subscriptions.first?.autoUpdate == subscription.autoUpdate)
+    #expect(try workflow.subscriptionURL(for: subscription.id) == "https://old.example/sub")
+    #expect(fetcher.requestCount == requests)
+    #expect(runtime.convergeCount == 0)
+    let updatedDocument = try #require(String(bytes: SubscriptionDocs.tree(), encoding: .utf8))
+    fetcher.setBehavior(
+      .success(
+        Data(
+          updatedDocument.replacingOccurrences(of: "\"pa\"", with: "\"changed-password\"").utf8)))
+    await workflow.refreshSubscription(subscription.id)
+    let after = try #require(try workflow.serverEditForm(for: server.id))
+    #expect(after.password == before.password)
+    #expect(after.plugin.options == before.plugin.options)
+    #expect(workflow.subscriptionRefreshFailure(for: subscription.id) == .commit)
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowPluginTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowPluginTests.swift
new file mode 100644
index 000000000..8d4401afb
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowPluginTests.swift
@@ -0,0 +1,209 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 插件区编辑语义经目录工作流 module interface 观察：
+/// 选择器三态呈现与落盘、「无」整体清除、参数写删钥匙串、集外引用原样保留，
+/// 以及经编辑面的 ss:// 分享往返。走内存凭据存储与注入 bundleURL 的受管插件
+/// 提供。
+@MainActor
+final class CatalogWorkflowPluginTests: XCTestCase {
+  private var workDir: URL!
+  private var bundleRoot: URL!
+  private var fileURL: URL!
+  private var workflow: CatalogWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent(
+        "catalog-plugin-workflow-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    bundleRoot = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-plugin-bundle-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(
+      at: bundleRoot.appendingPathComponent("Contents/Helpers/Plugins"),
+      withIntermediateDirectories: true)
+    fileURL = workDir.appendingPathComponent("catalog.json")
+
+    workflow = makeWorkflow()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try? FileManager.default.removeItem(at: bundleRoot)
+    try await super.tearDown()
+  }
+
+  private var pluginBinaryName: String { ManagedPluginCatalog.plugins[0].program }
+
+  private func writePluginBinary() throws {
+    let url = bundleRoot.appendingPathComponent("Contents/Helpers/Plugins/\(pluginBinaryName)")
+    try Data("#!/bin/sh\n".utf8).write(to: url)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: url.path)
+  }
+
+  private func makeWorkflow() -> CatalogWorkflow {
+    makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: fileURL), runtime: FakeCatalogRuntime()),
+      plugins: BundleManagedPluginProvider(bundleURL: bundleRoot))
+  }
+
+  /// 直建目录（不经 URI 导入）后重载工作流，返回该服务器身份。
+  private func addPluginServer(program: String?, options: String?) async throws -> NodeID {
+    var catalog = ConfigurationCatalog()
+    var fields = ServerFields(
+      address: "203.0.113.7",
+      port: 8388,
+      encryptionMethod: "aes-256-gcm",
+      password: "password",
+      remark: "带插件")
+    fields.password = "pw"
+    if let program {
+      fields.pluginProgram = program
+      if let options {
+        fields.pluginOptions = options
+      }
+    }
+    try catalog.addServer(fields)
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: catalog))
+    workflow = makeWorkflow()
+    return try XCTUnwrap(workflow.tree.roots.first?.id)
+  }
+
+  private func update(
+    _ id: NodeID,
+    plugin: PluginSelection,
+    pluginOptions: String?,
+    address: String = "203.0.113.7"
+  ) async throws {
+    try await workflow.updateServer(
+      id,
+      draft: ServerEditDraft(
+        address: address, port: 8388, encryptionMethod: "aes-256-gcm", password: "pw",
+        remark: "带插件", plugin: plugin, pluginOptions: pluginOptions))
+  }
+
+  // MARK: - 选择器呈现
+
+  func testManagedSelectionShownWithFactsAndParamsPlaintext() async throws {
+    try writePluginBinary()
+    let id = try await addPluginServer(program: pluginBinaryName, options: "mode=websocket")
+    let plugin = try XCTUnwrap(try workflow.serverEditForm(for: id)?.plugin)
+    XCTAssertEqual(plugin.selection, .named(program: pluginBinaryName))
+    XCTAssertEqual(
+      plugin.programs.first { $0.program == pluginBinaryName }?.availability, .available, "二进制在位即提供"
+    )
+    XCTAssertTrue(plugin.optionsPresent)
+    XCTAssertEqual(plugin.options, "mode=websocket", "参数明文供输入框预填")
+    XCTAssertEqual(
+      Set(plugin.programs.map(\.program)),
+      Set(["cloak", "cloak-v2", pluginBinaryName, "v2ray-plugin-v1"]))
+  }
+
+  func testMissingBinaryShowsManagedButNotProvided() async throws {
+    let id = try await addPluginServer(program: pluginBinaryName, options: nil)
+    let plugin = try XCTUnwrap(try workflow.serverEditForm(for: id)?.plugin)
+    XCTAssertEqual(plugin.selection, .named(program: pluginBinaryName))
+    XCTAssertEqual(
+      plugin.programs.first { $0.program == pluginBinaryName }?.availability, .missing,
+      "打包损坏/降级丢插件时点名呈现")
+  }
+
+  func testUnknownProgramRendersExplicitUnknownState() async throws {
+    let id = try await addPluginServer(program: "obfs-local", options: "obfs=http")
+    let plugin = try XCTUnwrap(try workflow.serverEditForm(for: id)?.plugin)
+    XCTAssertEqual(plugin.selection, .unknown(program: "obfs-local"), "集外引用显式未提供")
+    XCTAssertFalse(
+      plugin.programs.contains { $0.program == "obfs-local" && $0.availability == .available })
+    XCTAssertTrue(plugin.optionsPresent, "已配置参数的事实照常呈现")
+    XCTAssertEqual(plugin.options, "", "集外引用不解析参数明文")
+  }
+
+  func testNoPluginSelectionIsDefault() async throws {
+    let id = try await addPluginServer(program: nil, options: nil)
+    let plugin = try XCTUnwrap(try workflow.serverEditForm(for: id)?.plugin)
+    XCTAssertEqual(plugin.selection, .none)
+    XCTAssertFalse(plugin.optionsPresent)
+  }
+
+  // MARK: - 落盘语义
+
+  func testSelectingManagedPluginSavesProgramAndOptions() async throws {
+    try writePluginBinary()
+    let id = try await addPluginServer(program: nil, options: nil)
+    try await update(
+      id, plugin: .named(program: pluginBinaryName),
+      pluginOptions: "mode=websocket;host=example.com")
+    let plugin = try XCTUnwrap(try workflow.serverEditForm(for: id)?.plugin)
+    XCTAssertEqual(plugin.selection, .named(program: pluginBinaryName))
+    XCTAssertEqual(plugin.options, "mode=websocket;host=example.com")
+    XCTAssertTrue(plugin.optionsPresent)
+  }
+
+  func testSavingEmptyOptionsDropsOptions() async throws {
+    try writePluginBinary()
+    let id = try await addPluginServer(program: pluginBinaryName, options: "mode=websocket")
+    try await update(id, plugin: .named(program: pluginBinaryName), pluginOptions: "   ")
+    let plugin = try XCTUnwrap(try workflow.serverEditForm(for: id)?.plugin)
+    XCTAssertEqual(plugin.selection, .named(program: pluginBinaryName), "程序引用保留")
+    XCTAssertFalse(plugin.optionsPresent, "空参数即无参数引用")
+    XCTAssertEqual(plugin.options, "")
+  }
+
+  func testSelectingNoneClearsProgramAndOptions() async throws {
+    let id = try await addPluginServer(program: pluginBinaryName, options: "mode=websocket")
+    try await update(id, plugin: .none, pluginOptions: nil)
+    let plugin = try XCTUnwrap(try workflow.serverEditForm(for: id)?.plugin)
+    XCTAssertEqual(plugin.selection, .none)
+    XCTAssertFalse(plugin.optionsPresent)
+  }
+
+  func testUnknownSelectionPreservesReferenceAndOptionsVerbatim() async throws {
+    let id = try await addPluginServer(program: "obfs-local", options: "obfs=http")
+    try await update(
+      id, plugin: .unknown(program: "obfs-local"), pluginOptions: nil,
+      address: "198.51.100.9")
+    let form = try XCTUnwrap(try workflow.serverEditForm(for: id))
+    XCTAssertEqual(form.address, "198.51.100.9", "连接字段照常更新")
+    XCTAssertEqual(form.plugin.selection, .unknown(program: "obfs-local"), "集外引用原样保留")
+    XCTAssertTrue(form.plugin.optionsPresent)
+    XCTAssertEqual(try workflow.serverDetailPluginOptions(for: id), "obfs=http", "参数秘密不动")
+  }
+
+  func testForgedUnmanagedSelectionIsRejected() async throws {
+    let id = try await addPluginServer(program: nil, options: nil)
+    await expectThrowsAsync(
+      {
+        try await update(id, plugin: .named(program: "obfs-local"), pluginOptions: nil)
+      },
+      onThrow: { error in
+        XCTAssertEqual(error as? ServerFormError, .pluginUnknown("obfs-local"))
+      })
+  }
+
+  // MARK: - 分享往返（与 ss:// URI 编解码一致）
+
+  func testSharedSsUriRoundTripsThroughEditorEdit() async throws {
+    try writePluginBinary()
+    let id = try await addPluginServer(program: nil, options: nil)
+    try await update(
+      id, plugin: .named(program: pluginBinaryName),
+      pluginOptions: "mode=websocket;host=example.com")
+
+    let shared = try workflow.shareURI(for: id)
+    let decoded = try SsUri.decode(shared)
+    XCTAssertEqual(decoded.pluginProgram, pluginBinaryName)
+    XCTAssertEqual(decoded.pluginOptions, "mode=websocket;host=example.com")
+
+    // 导回目录：插件字段同构（新建身份，不按内容去重）。
+    let outcome = await workflow.importServers(from: [.clipboardText(shared)], into: nil)
+    XCTAssertEqual(outcome.sources.first?.result.importedCount, 1)
+    let importedNode = try XCTUnwrap(
+      workflow.tree.roots.dropFirst().first, "第二个根节点应是新导入的服务器")
+    let imported = try XCTUnwrap(try workflow.serverEditForm(for: importedNode.id))
+    XCTAssertEqual(imported.plugin.selection, .named(program: pluginBinaryName))
+    XCTAssertEqual(imported.plugin.options, "mode=websocket;host=example.com")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowPolicyTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowPolicyTests.swift
new file mode 100644
index 000000000..d04c3ae1d
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowPolicyTests.swift
@@ -0,0 +1,199 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 目录政策 seam 的 interface 测试：删除确认档位、
+/// 拖放/移动资格、激活资格与激活命令经假 adapter 的目标传递。只观察结构化
+/// fact 与 typed command outcome，不锁定 SwiftUI。
+@MainActor
+final class CatalogWorkflowPolicyTests: XCTestCase {
+  private var workDir: URL!
+  private var fileURL: URL!
+  private var runtime: FakeCatalogRuntime!
+  private var activator: FakeActivator!
+  private var workflow: CatalogWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-policy-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    fileURL = workDir.appendingPathComponent("catalog.json")
+
+    runtime = FakeCatalogRuntime()
+    activator = FakeActivator()
+    workflow = makeWorkflow()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  private func makeWorkflow() -> CatalogWorkflow {
+    runtime.hasActiveTarget = true
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: makeTestCatalogStore(fileURL: fileURL), runtime: runtime)
+    return makeCatalogWorkflow(
+      coordinator: coordinator,
+      plugins: NoManagedPluginProvider(),
+      activator: activator)
+  }
+
+  private func importServer(into parent: NodeID? = nil) async throws -> NodeID {
+    let before = Set(workflow.tree.roots.flatMap(\.subtreeIDs))
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: parent)
+    if let parent {
+      let node = try XCTUnwrap(workflow.tree.node(withID: parent))
+      return try XCTUnwrap(node.childNodes.last?.id)
+    }
+    let added = workflow.tree.roots.map(\.id).filter { !before.contains($0) }
+    return try XCTUnwrap(added.last)
+  }
+
+  // MARK: - 删除确认档位
+
+  func testDeleteFactsLeafIsEmptySingleConfirm() async throws {
+    let serverID = try await importServer()
+    XCTAssertEqual(workflow.deleteFacts(for: serverID), .leaf)
+  }
+
+  func testDeleteFactsEmptyManualGroupIsSingleConfirm() async throws {
+    let groupID = try await workflow.createGroup(named: "空组", into: nil)
+    XCTAssertEqual(workflow.deleteFacts(for: groupID), .emptyGroup)
+  }
+
+  func testDeleteFactsNonEmptyGroupNamesSubtreeAndCredentials() async throws {
+    let groupID = try await workflow.createGroup(named: "组", into: nil)
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: groupID)
+    let nestedID = try await workflow.createGroup(named: "嵌套", into: groupID)
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.8:8388")],
+      into: nestedID)
+    // 组内：服务器 + 嵌套组 + 嵌套服务器 = 3 个后代节点（不含自身）。
+    XCTAssertEqual(
+      workflow.deleteFacts(for: groupID),
+      .subtree(count: 3, includesCredentials: true))
+  }
+
+  // MARK: - 删除资格
+
+  func testCanDeleteManualLeafAndGroupButNotSubscriptionOrMissing() async throws {
+    let serverID = try await importServer()
+    let groupID = try await workflow.createGroup(named: "组", into: nil)
+    XCTAssertTrue(workflow.canDelete(serverID), "手动叶子可删")
+    XCTAssertTrue(workflow.canDelete(groupID), "手动分组可删（空组同理）")
+
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: fixture.catalog))
+    workflow = makeWorkflow()
+    XCTAssertFalse(workflow.canDelete(fixture.serverIDs[0]), "订阅成员结构只读")
+    XCTAssertFalse(workflow.canDelete(fixture.groupID), "订阅分组结构只读")
+    XCTAssertFalse(workflow.canDelete(NodeID(rawValue: "ghost")), "节点不存在")
+  }
+
+  // MARK: - 移动/拖放资格
+
+  func testCanMoveRejectsSelfCycleAndSubscriptionTarget() async throws {
+    let groupID = try await workflow.createGroup(named: "组", into: nil)
+    let nestedID = try await workflow.createGroup(named: "嵌套", into: groupID)
+    let serverID = try await importServer(into: groupID)
+
+    XCTAssertFalse(workflow.canMove(groupID, to: groupID), "非自身")
+    XCTAssertFalse(workflow.canMove(groupID, to: nil), "根层节点不得同父重排")
+    XCTAssertFalse(workflow.canMove(groupID, to: nestedID), "目标在被拖子树内")
+    XCTAssertTrue(workflow.canMove(nestedID, to: nil))
+    XCTAssertFalse(workflow.canMove(nestedID, to: nestedID))
+    XCTAssertTrue(workflow.canMove(serverID, to: nestedID))
+    XCTAssertFalse(workflow.canMove(serverID, to: groupID), "已有父组不得同父重排")
+
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: fixture.catalog))
+    workflow = makeWorkflow()
+    XCTAssertFalse(workflow.canMove(fixture.serverIDs[0], to: nil), "订阅节点不可拖")
+    XCTAssertFalse(workflow.canMove(serverID, to: fixture.groupID), "目标非手动组")
+    XCTAssertFalse(workflow.canMove(NodeID(rawValue: "ghost"), to: nil), "不存在")
+  }
+
+  func testDragPayloadManualHasIDSubscriptionNil() async throws {
+    let serverID = try await importServer()
+    XCTAssertEqual(workflow.dragPayload(for: serverID), serverID.rawValue)
+
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: fixture.catalog))
+    workflow = makeWorkflow()
+    XCTAssertNil(workflow.dragPayload(for: fixture.serverIDs[0]))
+    XCTAssertNil(workflow.dragPayload(for: fixture.groupID))
+  }
+
+  // MARK: - 激活资格
+
+  func testActivationEligibilityEmptyGroup() async throws {
+    let groupID = try await workflow.createGroup(named: "空组", into: nil)
+    XCTAssertEqual(
+      workflow.activationEligibility(for: groupID),
+      ActivationEligibility(
+        canActivate: false, candidateCount: 0, skippedInvalidCount: 0,
+        ineligibility: .emptyGroup))
+  }
+
+  func testActivationEligibilityCountsCandidatesAndSkips() async throws {
+    let groupID = try await workflow.createGroup(named: "组", into: nil)
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: groupID)
+    // 无效叶子（不支持的加密方法）。
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://ZnV0dXJlLWNpcGhlcjp4eHg=@203.0.113.9:8388")],
+      into: groupID)
+    let eligibility = try XCTUnwrap(workflow.activationEligibility(for: groupID))
+    XCTAssertTrue(eligibility.canActivate)
+    XCTAssertEqual(eligibility.candidateCount, 1)
+    XCTAssertEqual(eligibility.skippedInvalidCount, 1)
+    XCTAssertNil(eligibility.ineligibility)
+  }
+
+  func testActivationEligibilityAllInvalidIsNoCandidates() async throws {
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://ZnV0dXJlLWNpcGhlcjp4eHg=@203.0.113.9:8388")],
+      into: nil)
+    let serverID = try XCTUnwrap(workflow.tree.roots.first?.id)
+    let eligibility = try XCTUnwrap(workflow.activationEligibility(for: serverID))
+    XCTAssertEqual(eligibility.ineligibility, .noCandidates)
+    XCTAssertFalse(eligibility.canActivate)
+    XCTAssertEqual(eligibility.skippedInvalidCount, 1)
+  }
+
+  // MARK: - 激活命令经假 adapter
+
+  func testActivateForwardsTargetThroughActivatingPort() async throws {
+    let serverID = try await importServer()
+    activator.result = .activated(skippedInvalid: 2)
+    let outcome = try await workflow.activate(serverID)
+    XCTAssertEqual(outcome, .activated(skippedInvalid: 2))
+    XCTAssertEqual(activator.activated, [serverID])
+  }
+
+  func testActivateRejectedOutcomeIsNotThrown() async throws {
+    let serverID = try await importServer()
+    activator.result = .rejectedActivation(.targetNotFound(serverID))
+    let outcome = try await workflow.activate(serverID)
+    XCTAssertEqual(outcome, .rejectedActivation(.targetNotFound(serverID)))
+  }
+}
+
+private final class FakeActivator: Activating {
+  var activated: [NodeID] = []
+  var result: ActivationCommandOutcome = .activated(skippedInvalid: 0)
+  var error: Error?
+
+  func activate(_ target: NodeID) async throws -> ActivationCommandOutcome {
+    activated.append(target)
+    if let error { throw error }
+    return result
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowRollbackTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowRollbackTests.swift
new file mode 100644
index 000000000..0cf839b18
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowRollbackTests.swift
@@ -0,0 +1,277 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 目录工作流 module 的失败语义与阶段分离：
+/// 目录持久化失败时旧配置与旧凭据都保持有效；目录提交完成与运行时收敛是分离
+/// 的观察面且收敛失败不回滚目录；Legacy 导入不驱动运行时收敛、不自动重复。
+@MainActor
+final class CatalogWorkflowRollbackTests: XCTestCase {
+  private var workDir: URL!
+  private var fileURL: URL!
+  private var settingsURL: URL!
+  private var activationURL: URL!
+  private var runtime: FakeCatalogRuntime!
+  private var bootstrap: CatalogCommitBootstrap!
+  private var rootsSeenByLegacyPostImport: [NodeID]?
+
+  override func setUp() async throws {
+    try await super.setUp()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-rollback-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    // 目录文件置于 gate 子目录:破坏持久化时把 gate 目录替换为同名文件,
+    // 临时文件创建必失败(比替换目标更确定的失败注入)。
+    fileURL = workDir.appendingPathComponent("gate/catalog.json")
+    settingsURL = workDir.appendingPathComponent("proxy-listening.json")
+    activationURL = workDir.appendingPathComponent("activation.json")
+    runtime = FakeCatalogRuntime()
+  }
+
+  /// 让下一次目录持久化必然失败:gate 目录替换为同名文件后,临时文件无法
+  /// 在其中创建。
+  private func breakPersistence() throws {
+    let gateDir = workDir.appendingPathComponent("gate")
+    try FileManager.default.removeItem(at: gateDir)
+    try Data().write(to: gateDir)
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  private func makeWorkflow(
+    legacyImportService: LegacyImportService? = nil,
+    postLegacyImport: ((LegacyImportOutcome) async -> Void)? = nil
+  ) -> CatalogWorkflow {
+    runtime.hasActiveTarget = true
+    let fileStore = makeTestCatalogStore(fileURL: fileURL)
+    bootstrap = CatalogCommitCoordinator.bootstrap(fileStore: fileStore)
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: fileStore, runtime: runtime, bootstrap: bootstrap)
+    return makeCatalogWorkflow(
+      coordinator: coordinator,
+      plugins: NoManagedPluginProvider(),
+      legacyImportService: legacyImportService,
+      postLegacyImport: postLegacyImport)
+  }
+
+  /// 直建一条完整服务器记录，返回其身份。
+  private func seedServer(password: String) async throws -> NodeID {
+    var catalog = ConfigurationCatalog()
+    let fields = ServerFields(
+      address: "203.0.113.7", port: 8388, encryptionMethod: "aes-256-gcm",
+      password: password, remark: "夹具")
+    try catalog.addServer(fields)
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: catalog))
+    let workflow = makeWorkflow()
+    self.workflow = workflow
+    return try XCTUnwrap(workflow.tree.roots.first?.id)
+  }
+
+  private var workflow: CatalogWorkflow!
+
+  private func isFinished(_ status: RuntimeSyncStatus) -> Bool {
+    if case .finished = status { return true }
+    return false
+  }
+
+  // MARK: - 持久化失败 → 旧配置与旧凭据都保持有效
+
+  func testFailedSavePreservesServerFieldsAndPassword() async throws {
+    let id = try await seedServer(password: "旧密码")
+
+    try breakPersistence()
+
+    await expectThrowsAsync {
+      try await workflow.updateServer(
+        id,
+        draft: ServerEditDraft(
+          address: "198.51.100.9", port: 9999, encryptionMethod: "aes-256-gcm",
+          password: "新密码", remark: "新名称", plugin: .none, pluginOptions: nil))
+    }
+
+    let form = try XCTUnwrap(try workflow.serverEditForm(for: id))
+    XCTAssertEqual(form.address, "203.0.113.7", "目录提交失败则已发布状态不动")
+    XCTAssertEqual(form.password, "旧密码", "保存失败保留旧密码")
+  }
+
+  func testFailedSavePreservesPluginOptions() async throws {
+    // 尝试移除插件参数时保存失败，应保留完整旧记录。
+    var catalog = ConfigurationCatalog()
+    let fields = ServerFields(
+      address: "203.0.113.7", port: 8388, encryptionMethod: "aes-256-gcm",
+      password: "旧密码", remark: "夹具",
+      pluginProgram: "v2ray-plugin",
+      pluginOptions: "mode=websocket")
+    try catalog.addServer(fields)
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: catalog))
+    workflow = makeWorkflow()
+    let id = try XCTUnwrap(workflow.tree.roots.first?.id)
+
+    try breakPersistence()
+
+    await expectThrowsAsync {
+      try await workflow.updateServer(
+        id,
+        draft: ServerEditDraft(
+          address: "203.0.113.7", port: 8388, encryptionMethod: "aes-256-gcm",
+          password: "旧密码", remark: "新名称", plugin: .none, pluginOptions: nil))
+    }
+
+    let form = try XCTUnwrap(try workflow.serverEditForm(for: id))
+    XCTAssertEqual(form.plugin.selection, .named(program: "v2ray-plugin"), "插件引用保留")
+    XCTAssertEqual(form.plugin.options, "mode=websocket", "被删除的参数秘密已恢复")
+  }
+
+  func testMissingServerUpdateFailsWithoutPublishing() async throws {
+    _ = try await seedServer(password: "旧密码")
+
+    // 节点不存在时拒绝更新。
+    await expectThrowsAsync {
+      try await workflow.updateServer(
+        NodeID(rawValue: "missing"),
+        draft: ServerEditDraft(
+          address: "198.51.100.9", port: 9999, encryptionMethod: "aes-256-gcm",
+          password: "新密码", remark: "新名称", plugin: .none, pluginOptions: nil))
+    }
+  }
+
+  // MARK: - 表单新建持久化失败不发布记录
+
+  func testFailedCreateDoesNotPublishServer() async throws {
+    let workflow = makeWorkflow()
+    // 先落一份空目录建立 gate 存储（写入器才会创建父目录），再破坏持久化。
+    try makeTestCatalogStore(fileURL: fileURL).save(
+      CatalogDocument(catalog: ConfigurationCatalog()))
+
+    try breakPersistence()
+
+    await expectThrowsAsync {
+      try await workflow.createServer(
+        ServerEditDraft(
+          address: "198.51.100.9", port: 8388, encryptionMethod: "aes-256-gcm",
+          password: "新密码", remark: "新名称", plugin: .none, pluginOptions: nil),
+        into: nil)
+    }
+
+    XCTAssertTrue(workflow.tree.isEmpty, "目录提交失败则已发布状态不动")
+  }
+
+  // MARK: - 提交完成与运行时收敛是分离的观察面
+
+  func testCommitCompletesWhileRuntimeConvergenceIsStillSyncing() async throws {
+    let workflow = makeWorkflow()
+    runtime.hasActiveTarget = true
+    runtime.armGate(count: 1)
+
+    let groupID = try await workflow.createGroup(named: "组", into: nil)
+
+    // 目录提交已完成（树已发布），运行时仍在收敛中。
+    XCTAssertNotNil(workflow.tree.node(withID: groupID))
+    XCTAssertEqual(workflow.runtimeSync, .syncing(generation: 1))
+    runtime.openGate()
+    await waitUntilRuntimeSettles(isFinished(workflow.runtimeSync))
+    guard case .finished(1, .converged(skippedServers: [])) = workflow.runtimeSync else {
+      return XCTFail("收敛应正常结束，实际 \(workflow.runtimeSync)")
+    }
+  }
+
+  // MARK: - 运行时收敛失败不回滚已提交目录
+
+  func testRuntimeConvergenceFailureDoesNotRollbackCatalog() async throws {
+    let workflow = makeWorkflow()
+    runtime.hasActiveTarget = true
+    runtime.enqueueOutcomes([.failed(failure: .launch(.missingRuntimeDocument))])
+
+    let groupID = try await workflow.createGroup(named: "组", into: nil)
+
+    await waitUntilRuntimeSettles(isFinished(workflow.runtimeSync))
+    XCTAssertNotNil(workflow.tree.node(withID: groupID), "收敛失败不回滚已提交目录")
+    XCTAssertEqual(
+      workflow.runtimeSync,
+      .finished(generation: 1, outcome: .failed(failure: .launch(.missingRuntimeDocument))))
+  }
+
+  // MARK: - Legacy 导入不驱动运行时，不自动重复
+
+  func testLegacyImportCommitsGroupWithoutRuntimeSyncOrRepeat() async throws {
+    var existingSettings = ProxyRuntimeSettings()
+    existingSettings.listen.socksPort = 2086
+    existingSettings.listen.httpPort = 2087
+    existingSettings.preferredMode = .global
+    let listeningStore = makeTestListeningStore(
+      fileURL: settingsURL)
+    try listeningStore.save(existingSettings.listen)
+    let existingTarget = NodeID(rawValue: "existing-target")
+    let activationStore = ActivationStateFileStore(fileURL: activationURL)
+    try activationStore.save(activeTargetID: existingTarget)
+
+    let service = try makeLegacyService()
+    var postCalls = 0
+    rootsSeenByLegacyPostImport = nil
+    let workflow = makeWorkflow(legacyImportService: service) { [weak self] _ in
+      postCalls += 1
+      self?.rootsSeenByLegacyPostImport =
+        self?.bootstrap.catalogSnapshotReader
+        .catalogSnapshot.rootChildren
+    }
+    XCTAssertTrue(
+      workflow.legacyImportState.snapshotFound, "发现快照后统一导入面板提供 Legacy 入口")
+    XCTAssertFalse(workflow.legacyImportState.completed)
+    // 有活动目标也不得触发运行时收敛（导入不启动代理、不写系统代理）。
+    XCTAssertTrue(runtime.hasActiveTarget)
+
+    let outcome = try await workflow.importLegacy()
+
+    XCTAssertEqual(outcome.report.importedServerCount, 1)
+    XCTAssertEqual(workflow.tree.roots.count, 1)
+    let group = try XCTUnwrap(workflow.tree.roots.first)
+    XCTAssertTrue(group.isGroup)
+    XCTAssertTrue(group.isManual)
+    XCTAssertEqual(group.childCount, 1)
+    XCTAssertEqual(
+      rootsSeenByLegacyPostImport, [group.id],
+      "独立导入先 reload 并发布共享目录快照，再进入运行时清理回调")
+    XCTAssertEqual(runtime.convergeCount, 0, "导入不经提交管线触发运行时收敛")
+    XCTAssertEqual(postCalls, 1, "导入后的运行时边界只经注入闭包（独立于普通提交）")
+    XCTAssertEqual(workflow.legacyImportState.completed, true, "成功导入写完成标记")
+    XCTAssertNotNil(workflow.tree.node(withID: outcome.groupID), "返回新建分组身份供选中")
+    XCTAssertEqual(try listeningStore.load(), existingSettings.listen, "工作流导入不得写入 2.0 偏好")
+    XCTAssertEqual(
+      try activationStore.loadActiveTargetID(), existingTarget,
+      "工作流导入不得写入或清除活动目标")
+
+    // 首次导入成功后不再自动重复；显式再导入创建独立分组。
+    workflow.refreshLegacyImportState()
+    XCTAssertTrue(workflow.legacyImportState.snapshotFound, "发现状态与完成标记独立")
+    XCTAssertTrue(workflow.legacyImportState.completed)
+    _ = try await workflow.importLegacy(reimport: true)
+    XCTAssertEqual(workflow.tree.roots.count, 2, "再导入创建新的独立手动分组")
+    XCTAssertEqual(runtime.convergeCount, 0)
+  }
+
+  // MARK: - 夹具
+
+  private func makeLegacySnapshot() throws -> LegacySnapshot {
+    let profile: [String: Any] = [
+      "Id": "11111111-2222-4333-8444-555555555555",
+      "ServerHost": "203.0.113.9",
+      "ServerPort": 8388,
+      "Method": "aes-256-gcm",
+      "Password": "legacy-pw",
+      "Remark": "旧服务器",
+    ]
+    return try LegacySnapshot(
+      propertyList: ["ServerProfiles": [profile], "ShadowsocksRunningMode": "manual"])
+  }
+
+  private func makeLegacyService() throws -> LegacyImportService {
+    let snapshot = try makeLegacySnapshot()
+    return LegacyImportService(
+      source: FixedLegacySnapshotProvider(snapshot: snapshot),
+      catalogStore: makeTestCatalogStore(fileURL: fileURL),
+      marker: InMemoryLegacyImportMarker())
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowSubscriptionTests+RefreshFailures.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowSubscriptionTests+RefreshFailures.swift
new file mode 100644
index 000000000..debd5b0f5
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowSubscriptionTests+RefreshFailures.swift
@@ -0,0 +1,143 @@
+import Security
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+extension CatalogWorkflowSubscriptionTests {
+  // MARK: 失败保留语义
+
+  func testFailedRefreshKeepsSnapshotAndStatus() async throws {
+    fetcher = FakeSubscriptionFetcher(behavior: .success(treeDoc))
+    workflow = makeWorkflow()
+    let record = try await workflow.createSubscription(urlString: "https://p.example.com/s.json")
+    let convergesBefore = runtime.convergeCount
+    let treeBefore = workflow.tree
+
+    fetcher.setBehavior(.failure(.httpStatus(code: 503)))
+    await workflow.refreshSubscription(record.id)
+
+    // 快照原样保留。
+    XCTAssertEqual(workflow.tree, treeBefore, "传输失败不动最后成功快照（projection 等价）")
+    XCTAssertEqual(findNode(withSuffix: "aaaaaaaa-0000-4000-8000-00000000000a")?.name, "香港 01")
+    // 状态点名失败且原因脱敏。
+    guard case .failed(_, let failure) = workflow.subscriptions[0].status else {
+      return XCTFail("应记失败态")
+    }
+    XCTAssertEqual(failure, .httpStatus(code: 503))
+    // 仅状态提交了一次（快照未动）。
+    await waitUntilRuntimeSettles(runtime.convergeCount - convergesBefore == 1)
+  }
+
+  func testDuplicateIDFailureKeepsSnapshot() async throws {
+    let record = try await seedSuccessfulSubscription()
+    let treeBefore = workflow.tree
+
+    fetcher.setBehavior(.success(SubscriptionDocs.duplicateIDs()))
+    await workflow.refreshSubscription(record.id)
+
+    guard case .failed(_, let failure) = workflow.subscriptions[0].status else {
+      return XCTFail("应记失败态")
+    }
+    XCTAssertEqual(failure, .duplicateIdentity)
+    XCTAssertEqual(workflow.tree, treeBefore)
+  }
+
+  func testRecordValidationFailureKeepsSnapshot() async throws {
+    let record = try await seedSuccessfulSubscription()
+    let treeBefore = workflow.tree
+
+    fetcher.setBehavior(.success(SubscriptionDocs.invalidRecord()))
+    await workflow.refreshSubscription(record.id)
+
+    guard case .failed(_, let failure) = workflow.subscriptions[0].status else {
+      return XCTFail("应记失败态")
+    }
+    XCTAssertEqual(failure, .recordValidation(index: 0, field: .port))
+    XCTAssertEqual(workflow.tree, treeBefore)
+  }
+
+  // MARK: 空快照与扁平回退
+
+  func testEmptySnapshotIsSuccessAndClearsSubtree() async throws {
+    let record = try await seedSuccessfulSubscription()
+
+    fetcher.setBehavior(.success(SubscriptionDocs.flat(serverCount: 0)))
+    await workflow.refreshSubscription(record.id)
+
+    let group = try XCTUnwrap(workflow.tree.node(withID: record.groupID))
+    XCTAssertTrue(group.isGroup)
+    XCTAssertEqual(group.childCount, 0, "合法空快照清空子树")
+    guard case .succeeded = workflow.subscriptions[0].status else {
+      return XCTFail("空快照按成功处理")
+    }
+  }
+
+  func testCycleDocumentFallsBackToFlatAndSucceeds() async throws {
+    let record = try await seedSuccessfulSubscription()
+
+    fetcher.setBehavior(.success(SubscriptionDocs.cycleExtension()))
+    await workflow.refreshSubscription(record.id)
+
+    let group = try XCTUnwrap(workflow.tree.node(withID: record.groupID))
+    XCTAssertEqual(group.childCount, 2, "回退扁平：标准服务器直接进固定分组")
+    XCTAssertEqual(group.name, "p.example.com", "扁平回退以 host 兜底名称")
+    guard case .succeeded = workflow.subscriptions[0].status else {
+      return XCTFail("回退扁平仍是成功刷新")
+    }
+  }
+}
+
+@MainActor
+extension CatalogWorkflowSubscriptionTests {
+  // MARK: Typed failure projection
+
+  func testDecodeAndSchemaFailuresMarkFailedWithoutTouchingSnapshot() async throws {
+    let record = try await seedSuccessfulSubscription()
+
+    for (behavior, expected) in [
+      (
+        FakeSubscriptionFetcher.Behavior.failure(.contentType(received: "text/plain")),
+        SubscriptionRefreshFailure.contentType(.unsupported)
+      ),
+      (
+        FakeSubscriptionFetcher.Behavior.success(Data("not json".utf8)),
+        SubscriptionRefreshFailure.decodingFailure
+      ),
+      (
+        FakeSubscriptionFetcher.Behavior.success(Data(#"{"version": 9, "servers": []}"#.utf8)),
+        SubscriptionRefreshFailure.unsupportedSchemaVersion
+      ),
+    ] {
+      let treeBefore = workflow.tree
+      fetcher.setBehavior(behavior)
+      await workflow.refreshSubscription(record.id)
+
+      guard case .failed(_, let failure) = workflow.subscriptions[0].status else {
+        return XCTFail("应记失败态：\(behavior)")
+      }
+      XCTAssertEqual(failure, expected)
+      XCTAssertEqual(workflow.tree, treeBefore, "解析类失败不动快照（projection 等价）")
+    }
+  }
+
+  func testSubscriptionSummaryReflectsStatusAndCounts() async throws {
+    _ = try await seedSuccessfulSubscription()
+    let healthy = try XCTUnwrap(workflow.subscriptions.first)
+    XCTAssertEqual(healthy.name, "Example subscription")
+    XCTAssertEqual(healthy.host, "p.example.com", "卡片展示 host，不展示完整 URL（story 23）")
+    guard case .succeeded = healthy.status else { return XCTFail("应记成功态") }
+    XCTAssertEqual(healthy.serverCount, 2)
+
+    fetcher.setBehavior(.failure(.transport(detail: "URLError.cannotConnectToHost")))
+    await workflow.refreshSubscription(healthy.id)
+
+    let failed = try XCTUnwrap(workflow.subscriptions.first)
+    guard case .failed(_, let failure) = failed.status else {
+      return XCTFail("应保留 typed 失败事实")
+    }
+    XCTAssertEqual(failure, .transport(.connection))
+    XCTAssertEqual(failed.serverCount, 2, "失败保留最后成功的服务器数")
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowSubscriptionTests+RefreshOrchestration.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowSubscriptionTests+RefreshOrchestration.swift
new file mode 100644
index 000000000..e64c8cb0a
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowSubscriptionTests+RefreshOrchestration.swift
@@ -0,0 +1,101 @@
+import Foundation
+import Security
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+extension CatalogWorkflowSubscriptionTests {
+  // MARK: 批量刷新与持久化
+
+  func testRefreshAllRefreshesEverySubscription() async throws {
+    _ = try await seedSuccessfulSubscription()
+    _ = try await createOnly(urlString: "https://q.example.com/t.json")
+    let requestsBefore = fetcher.requestCount
+    let convergesBefore = runtime.convergeCount
+
+    await workflow.refreshAllSubscriptions()
+
+    XCTAssertEqual(fetcher.requestCount - requestsBefore, 2, "每个订阅各刷一次")
+    for summary in workflow.subscriptions {
+      guard case .succeeded = summary.status else {
+        return XCTFail("全部订阅都应记成功态：\(summary.id)")
+      }
+    }
+    await waitUntilRuntimeSettles(runtime.convergeCount - convergesBefore == 2)
+  }
+
+  func testSubscriptionsPersistAcrossWorkflowReload() async throws {
+    let record = try await seedSuccessfulSubscription()
+
+    let reloaded = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: fileURL), runtime: FakeCatalogRuntime()))
+    XCTAssertEqual(reloaded.subscriptions.count, 1)
+    XCTAssertEqual(reloaded.subscriptions[0].id, record.id)
+    guard case .succeeded = reloaded.subscriptions[0].status else {
+      return XCTFail("刷新状态跨持久化保留")
+    }
+    XCTAssertNotNil(reloaded.tree.node(withID: serverAID), "订阅子树跨持久化保留")
+  }
+
+  // MARK: 并发守卫
+
+  func testConcurrentRefreshOnSameSubscriptionDoesNotReenter() async throws {
+    let record = try await seedSuccessfulSubscription()
+    // 用门控获取器重建工作流：刷新停在 fetch 内部，验证并发守卫。
+    let gated = GatedFetcher()
+    let refreshWorkflow = makeWorkflow(fetcher: gated)
+    workflow = refreshWorkflow
+
+    async let first: Void = refreshWorkflow.refreshSubscription(record.id)
+    // 轮询而非阻塞等待：主线程阻塞会饿死继承 MainActor 的 async let 子任务。
+    while !gated.didEnterFetch {
+      try await Task.sleep(nanoseconds: 10_000_000)
+    }
+    await refreshWorkflow.refreshSubscription(record.id)
+
+    XCTAssertEqual(gated.requestCount, 1, "同一订阅刷新进行中不重入")
+    gated.releaseAll()
+    await first
+    XCTAssertTrue(refreshWorkflow.refreshingSubscriptionIDs.isEmpty, "完成后守卫释放")
+  }
+}
+
+/// 可门控获取缝：让第一次刷新停在 fetch 内部，验证并发守卫。fetch 挂起等待
+/// 异步门闩，不阻塞 MainActor 或协作线程池。
+final class GatedFetcher: SubscriptionFetching, @unchecked Sendable {
+  private let lock = NSLock()
+  private let release = AsyncGate()
+  private let entry = AsyncGate()
+  private var count = 0
+  private var entered = false
+
+  var requestCount: Int {
+    lock.lock()
+    defer { lock.unlock() }
+    return count
+  }
+
+  var didEnterFetch: Bool {
+    lock.lock()
+    defer { lock.unlock() }
+    return entered
+  }
+
+  func fetch(_ url: URL) async throws -> Data {
+    lock.withLock {
+      count += 1
+      entered = true
+    }
+    entry.release()
+    await release.wait()
+    return SubscriptionDocs.flat(serverCount: 0)
+  }
+
+  func waitUntilEntered() async { await entry.wait() }
+
+  func releaseAll() {
+    release.release()
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowSubscriptionTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowSubscriptionTests.swift
new file mode 100644
index 000000000..c608d2a00
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowSubscriptionTests.swift
@@ -0,0 +1,341 @@
+import Security
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 订阅端到端语义经目录工作流 module interface 观察：创建
+/// 门禁、刷新失败保留快照、身份连续性、URL 编辑保身份、删除递归清除、卡片
+/// projection 与提交接线。获取走 FakeSubscriptionFetcher（传输侧契约在
+/// SubscriptionFetcherTests）；提交后的运行时收敛以确定性 fake 计数。
+@MainActor
+final class CatalogWorkflowSubscriptionTests: XCTestCase {
+  private var workDir: URL!
+  var fileURL: URL!
+  var fetcher: FakeSubscriptionFetcher!
+  var runtime: FakeCatalogRuntime!
+  var workflow: CatalogWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("subscription-workflow-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    fileURL = workDir.appendingPathComponent("catalog.json")
+
+    runtime = FakeCatalogRuntime()
+    fetcher = FakeSubscriptionFetcher(behavior: .success(SubscriptionDocs.flat(serverCount: 1)))
+    workflow = makeWorkflow()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  func makeWorkflow(fetcher override: SubscriptionFetching? = nil) -> CatalogWorkflow {
+    // 计数即提交计数：提交后的运行时收敛由协调器异步调度。
+    runtime.hasActiveTarget = true
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: makeTestCatalogStore(fileURL: fileURL), runtime: runtime)
+    return makeCatalogWorkflow(
+      coordinator: coordinator,
+      plugins: NoManagedPluginProvider(),
+      subscriptionFetcher: override ?? fetcher!)
+  }
+
+  /// 文档稳定 ID 后缀在树 projection 中定位节点（订阅前缀随机）。
+  func findNode(withSuffix suffix: String) -> CatalogTreeNode? {
+    var stack = workflow.tree.roots
+    while let node = stack.popLast() {
+      if node.id.rawValue.hasSuffix(suffix) { return node }
+      stack.append(contentsOf: node.children ?? [])
+    }
+    return nil
+  }
+
+  var serverAID: NodeID {
+    findNode(withSuffix: "aaaaaaaa-0000-4000-8000-00000000000a")?.id
+      ?? NodeID(rawValue: "missing-a")
+  }
+
+  private var serverBID: NodeID {
+    findNode(withSuffix: "bbbbbbbb-0000-4000-8000-00000000000b")?.id
+      ?? NodeID(rawValue: "missing-b")
+  }
+
+  /// b 移到根 + a 改名 + 重排（远端改名/移动/排序跟随的对照文档）。
+  var treeDoc: Data { SubscriptionDocs.tree() }
+  private var changedTreeDoc: Data { SubscriptionDocs.treeRenamedAndReordered() }
+
+  // MARK: 创建门禁
+
+  func testCreateRequiresHTTPSURL() async {
+    for bad in ["http://example.com/sub.json", "ftp://x/y", "不是 URL", "https://"] {
+      do {
+        _ = try await workflow.createSubscription(urlString: bad)
+        XCTFail("「\(bad)」应被拒绝")
+      } catch {
+        XCTAssertEqual(error as? SubscriptionFormError, .invalidURL)
+      }
+    }
+    XCTAssertTrue(workflow.subscriptions.isEmpty, "创建失败不留半成品")
+    XCTAssertTrue(workflow.tree.isEmpty)
+  }
+
+  func testCreateAddsRecordEmptyGroupAndRefreshes() async throws {
+    fetcher = FakeSubscriptionFetcher(behavior: .success(treeDoc))
+    workflow = makeWorkflow()
+
+    let summary = try await workflow.createSubscription(
+      urlString: "https://provider.example.com/sub.json")
+
+    XCTAssertEqual(summary.id, workflow.subscriptions.first?.id)
+    XCTAssertEqual(fetcher.lastURL?.host, "provider.example.com", "创建即首次刷新")
+    let group = try XCTUnwrap(workflow.tree.node(withID: summary.groupID))
+    XCTAssertTrue(group.isGroup)
+    XCTAssertEqual(group.name, "Example subscription", "名称跟随远端根分组")
+    XCTAssertFalse(group.isManual)
+    guard case .succeeded = workflow.subscriptions[0].status else {
+      return XCTFail("首次刷新成功应记成功态")
+    }
+  }
+
+  func testFirstRefreshFailureLeavesEmptyGroupWithFailedStatus() async throws {
+    fetcher = FakeSubscriptionFetcher(
+      behavior: .failure(.transport(detail: "URLError.timedOut")))
+    workflow = makeWorkflow()
+
+    let created = try await workflow.createSubscription(
+      urlString: "https://provider.example.com/s.json")
+
+    XCTAssertNotNil(workflow.tree.node(withID: created.groupID), "首刷失败仍留空分组")
+    XCTAssertEqual(created.name, "provider.example.com", "空分组以 host 兜底")
+    guard case .failed(_, let reason) = workflow.subscriptions[0].status else {
+      return XCTFail("首刷失败应记失败态")
+    }
+    XCTAssertEqual(reason, .transport(.timedOut))
+  }
+
+  // MARK: 身份连续性
+
+  func testRemoteRenameMoveReorderFollowsWithoutLocalOverlay() async throws {
+    fetcher = FakeSubscriptionFetcher(behavior: .success(treeDoc))
+    workflow = makeWorkflow()
+    let record = try await workflow.createSubscription(urlString: "https://p.example.com/s.json")
+    fetcher.setBehavior(.success(changedTreeDoc))
+    await workflow.refreshSubscription(record.id)
+
+    // 身份不变；名称/位置/顺序跟随远端。
+    XCTAssertEqual(findNode(withSuffix: "aaaaaaaa-0000-4000-8000-00000000000a")?.name, "香港 01（新名）")
+    let group = try XCTUnwrap(workflow.tree.node(withID: record.groupID))
+    let japanGroupID = try XCTUnwrap(
+      findNode(withSuffix: "g:jp")?.id,
+      "嵌套分组应存在")
+    XCTAssertEqual(group.children?.map(\.id), [serverBID, japanGroupID], "远端排序跟随")
+  }
+
+  func testIdLessServerContinuityOnlyForExactMatch() async throws {
+    fetcher = FakeSubscriptionFetcher(behavior: .success(SubscriptionDocs.idLess()))
+    workflow = makeWorkflow()
+    let record = try await workflow.createSubscription(urlString: "https://p.example.com/s.json")
+    let serverID = try XCTUnwrap(onlyServerChildID(ofGroup: record.groupID))
+    // 完全相同记录 → 身份延续。
+    await workflow.refreshSubscription(record.id)
+    XCTAssertEqual(onlyServerChildID(ofGroup: record.groupID), serverID)
+
+    // 端口变化 → 新身份：旧节点删除（无墓碑）。
+    fetcher.setBehavior(.success(SubscriptionDocs.idLess(port: 9999)))
+    await workflow.refreshSubscription(record.id)
+    XCTAssertNil(workflow.tree.node(withID: serverID), "无稳定 ID 且记录变化即不同节点")
+    let newID = try XCTUnwrap(onlyServerChildID(ofGroup: record.groupID))
+    XCTAssertNotEqual(newID, serverID)
+  }
+
+  // MARK: URL 编辑与删除
+
+  func testEditURLKeepsIdentityAndRetainsSnapshotUntilSuccess() async throws {
+    let record = try await seedSuccessfulSubscription()
+    let originalRecordID = record.id
+    let originalGroupID = record.groupID
+
+    // 新地址先失败：快照保留、身份不动。
+    fetcher.setBehavior(.failure(.httpStatus(code: 404)))
+    try await workflow.saveSubscription(
+      record.id, urlString: "https://other.example.com/v2.json")
+    XCTAssertEqual(workflow.subscriptions[0].id, originalRecordID, "订阅身份保留")
+    guard case .failed = workflow.subscriptions[0].status else {
+      return XCTFail("新地址失败应记失败态")
+    }
+    XCTAssertEqual(fetcher.lastURL?.host, "other.example.com")
+    XCTAssertNotNil(findNode(withSuffix: "aaaaaaaa-0000-4000-8000-00000000000a"), "失败保留最后成功快照")
+
+    // 新地址成功：同一身份命名空间下应用新内容。
+    fetcher.setBehavior(.success(SubscriptionDocs.flat(serverCount: 1)))
+    await workflow.refreshSubscription(record.id)
+    XCTAssertEqual(workflow.subscriptions[0].groupID, originalGroupID)
+    guard case .succeeded = workflow.subscriptions[0].status else {
+      return XCTFail("换址成功应记成功态，实际 \(workflow.subscriptions[0].status)")
+    }
+    XCTAssertEqual(workflow.tree.roots.count, 1)
+  }
+
+  func testEditURLRequiresHTTPS() async throws {
+    let record = try await seedSuccessfulSubscription()
+    await expectThrowsAsync(
+      { try await workflow.saveSubscription(record.id, urlString: "http://p.example.com/x") },
+      onThrow: { error in
+        XCTAssertEqual(error as? SubscriptionFormError, .invalidURL)
+      })
+  }
+
+  func testRemoveSubscriptionClearsSubtreeCredentialsAndReportsInvalidation() async throws {
+    let record = try await seedSuccessfulSubscription()
+    // 身份在删除前捕获(删除后树上已不存在)。
+    let serverA = serverAID
+    let serverB = serverBID
+    let convergesBefore = runtime.convergeCount
+
+    let outcome = try await workflow.removeSubscription(record.id)
+
+    XCTAssertTrue(workflow.subscriptions.isEmpty, "订阅记录移除")
+    XCTAssertNil(workflow.tree.node(withID: record.groupID), "固定分组递归清除")
+    XCTAssertNil(workflow.tree.node(withID: serverA))
+    XCTAssertNil(workflow.tree.node(withID: serverB))
+    XCTAssertTrue(
+      outcome.removedNodeIDs.contains(serverA) && outcome.removedNodeIDs.contains(record.groupID)
+        && outcome.removedNodeIDs.contains(serverB),
+      "删除结果携带被删子树身份（selection invalidation，story 18/30）")
+    // 删除经提交协调器触发活动目标重展开，恰好一次。
+    await waitUntilRuntimeSettles(runtime.convergeCount - convergesBefore == 1)
+  }
+
+  // MARK: 夹具与辅助
+
+  private func onlyServerChildID(ofGroup groupID: NodeID) -> NodeID? {
+    guard let group = workflow.tree.node(withID: groupID),
+      group.childCount == 1,
+      let only = group.children?.first,
+      !only.isGroup
+    else { return nil }
+    return only.id
+  }
+
+  /// 建一个「创建 + 首刷成功（tree 文档，服务器 a/b）」的订阅。
+  func seedSuccessfulSubscription() async throws -> SubscriptionSummary {
+    fetcher = FakeSubscriptionFetcher(behavior: .success(SubscriptionDocs.tree()))
+    workflow = makeWorkflow()
+    return try await createOnly(urlString: "https://p.example.com/s.json")
+  }
+
+  func createOnly(urlString: String) async throws -> SubscriptionSummary {
+    try await workflow.createSubscription(urlString: urlString)
+  }
+}
+
+/// SIP-008 文档夹具（订阅工作流语义测试）。
+enum SubscriptionDocs {
+  private static let stableServerA = "aaaaaaaa-0000-4000-8000-00000000000a"
+  private static let stableServerB = "bbbbbbbb-0000-4000-8000-00000000000b"
+
+  static func serverJSON(id: String, address: String, port: Int, remark: String) -> String {
+    """
+    {"id": "\(id)", "remarks": "\(remark)", "server": "\(address)", "server_port": \(port), \
+    "password": "pw", "method": "aes-256-gcm"}
+    """
+  }
+
+  static func flat(serverCount: Int) -> Data {
+    guard serverCount > 0 else {
+      return Data(#"{"version": 1, "servers": []}"#.utf8)
+    }
+    let servers = (1...serverCount).map {
+      serverJSON(
+        id: String(format: "%08x-0000-4000-8000-%012d", $0, $0), address: "203.0.113.\($0)",
+        port: 8388 + $0, remark: "节点 \($0)")
+    }.joined(separator: ",")
+    return Data(
+      """
+      {"version": 1, "servers": [\(servers)]}
+      """.utf8)
+  }
+
+  /// 根分组 [嵌套组 Japan(→b), 服务器 a]；稳定 UUID a/b。
+  static func tree() -> Data {
+    Data(
+      """
+      {"version": 1,
+       "servers": [
+         {"id": "aaaaaaaa-0000-4000-8000-00000000000a", "remarks": "香港 01", "server": "203.0.113.1",
+          "server_port": 8388, "password": "pa", "method": "aes-256-gcm"},
+         {"id": "bbbbbbbb-0000-4000-8000-00000000000b", "remarks": "日本 02", "server": "203.0.113.2",
+          "server_port": 8389, "password": "pb", "method": "aes-256-gcm"}],
+       "x_shadowsocksx_ng": {"schema_version": 1, "root_group_id": "root",
+         "groups": [
+           {"id": "root", "name": "Example subscription", "children": [
+             {"type": "group", "id": "jp"}, {"type": "server", "id": "aaaaaaaa-0000-4000-8000-00000000000a"}]},
+           {"id": "jp", "name": "Japan", "children": [
+             {"type": "server", "id": "bbbbbbbb-0000-4000-8000-00000000000b"}]}]}}
+      """.utf8)
+  }
+
+  /// 远端改名 + b 移到根 + 重排：[b, Japan(空)]，a 改名留在 Japan。
+  static func treeRenamedAndReordered() -> Data {
+    Data(
+      """
+      {"version": 1,
+       "servers": [
+         {"id": "aaaaaaaa-0000-4000-8000-00000000000a", "remarks": "香港 01（新名）", "server": "203.0.113.1",
+          "server_port": 8388, "password": "pa", "method": "aes-256-gcm"},
+         {"id": "bbbbbbbb-0000-4000-8000-00000000000b", "remarks": "日本 02", "server": "203.0.113.2",
+          "server_port": 8389, "password": "pb", "method": "aes-256-gcm"}],
+       "x_shadowsocksx_ng": {"schema_version": 1, "root_group_id": "root",
+         "groups": [
+           {"id": "root", "name": "Example subscription", "children": [
+             {"type": "server", "id": "bbbbbbbb-0000-4000-8000-00000000000b"},
+             {"type": "group", "id": "jp"}]},
+           {"id": "jp", "name": "Japan", "children": [
+             {"type": "server", "id": "aaaaaaaa-0000-4000-8000-00000000000a"}]}]}}
+      """.utf8)
+  }
+
+  static func duplicateIDs() -> Data {
+    let server = serverJSON(id: stableServerA, address: "203.0.113.1", port: 8388, remark: "x")
+    let duplicate = serverJSON(id: stableServerA, address: "203.0.113.2", port: 9999, remark: "y")
+    return Data(
+      """
+      {"version": 1, "servers": [\(server), \(duplicate)]}
+      """.utf8)
+  }
+
+  static func invalidRecord() -> Data {
+    Data(
+      """
+      {"version": 1, "servers": [
+        {"id": "\(stableServerA)", "server": "203.0.113.1", "server_port": 0,
+         "password": "p", "method": "m"}]}
+      """.utf8)
+  }
+
+  static func idLess(port: Int = 8388) -> Data {
+    Data(
+      """
+      {"version": 1, "servers": [
+        {"server": "203.0.113.5", "server_port": \(port), "password": "p",
+         "method": "m", "remarks": "无名"}]}
+      """.utf8)
+  }
+
+  static func cycleExtension() -> Data {
+    Data(
+      """
+      {"version": 1,
+       "servers": [
+         {"id": "\(stableServerA)", "server": "203.0.113.1", "server_port": 8388, "password": "pa", "method": "m"},
+         {"id": "\(stableServerB)", "server": "203.0.113.2", "server_port": 8389, "password": "pb", "method": "m"}],
+       "x_shadowsocksx_ng": {"schema_version": 1, "root_group_id": "root",
+         "groups": [
+           {"id": "root", "name": "R", "children": [{"type": "group", "id": "x"}]},
+           {"id": "x", "name": "X", "children": [{"type": "group", "id": "root"}]}]}}
+      """.utf8)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowTests+RenameAndMove.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowTests+RenameAndMove.swift
new file mode 100644
index 000000000..5a0dfab71
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowTests+RenameAndMove.swift
@@ -0,0 +1,44 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+extension CatalogWorkflowTests {
+  // MARK: - 重命名与移动
+
+  func testRenameGroupKeepsIdentityParentAndOrder() async throws {
+    let groupID = try await workflow.createGroup(named: "旧名", into: nil)
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: groupID)
+    try await workflow.renameGroup(groupID, to: "新名")
+    let node = try XCTUnwrap(workflow.tree.node(withID: groupID))
+    XCTAssertEqual(node.name, "新名")
+    XCTAssertEqual(node.childCount, 1, "identity 与子项顺序不变(story 6)")
+    await expectThrowsAsync(
+      { try await workflow.renameGroup(groupID, to: "  ") },
+      onThrow: { error in XCTAssertEqual(error as? ServerFormError, .emptyName) })
+  }
+
+  func testMoveRejectsCrossSourceAndCycle() async throws {
+    try makeSubscriptionCatalog()
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    let manualGroupID = try await workflow.createGroup(named: "手动组", into: nil)
+
+    await expectThrowsAsync { try await workflow.move(fixture.serverIDs[0], to: manualGroupID) }
+    await expectThrowsAsync { _ = try await workflow.remove(fixture.serverIDs[0]) }
+    await expectThrowsAsync { try await workflow.renameGroup(fixture.groupID, to: "改名") }
+    await expectThrowsAsync {
+      try await workflow.updateServer(
+        fixture.serverIDs[0],
+        draft: ServerEditDraft(
+          address: "0.0.0.0", port: 1, encryptionMethod: "x", password: "p",
+          remark: "", plugin: .none, pluginOptions: nil))
+    }
+    // 手动节点移进订阅子树同样被拒（跨来源）。
+    await expectThrowsAsync { try await workflow.move(manualGroupID, to: fixture.groupID) }
+    // 分组移动进自身子树被拒（成环）。
+    let nestedID = try await workflow.createGroup(named: "嵌套", into: manualGroupID)
+    await expectThrowsAsync { try await workflow.move(manualGroupID, to: nestedID) }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowTests.swift
new file mode 100644
index 000000000..ff175b413
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Catalog/Workflow/CatalogWorkflowTests.swift
@@ -0,0 +1,371 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 目录工作流 module 的 UI-facing interface 测试：三入口导入、
+/// 手动服务器/分组创建、重命名、移动、删除、来源所有权、树 projection 与
+/// 分享往返。全部观察 projection、command outcome 与 typed error，不锁定
+/// SwiftUI 视图层级或内部存储；凭据生命周期经注入的内存存储观察。提交后的
+/// 运行时收敛以确定性 fake 计数。
+@MainActor
+final class CatalogWorkflowTests: XCTestCase {
+  private var workDir: URL!
+  private var fileURL: URL!
+  private var runtime: FakeCatalogRuntime!
+  var workflow: CatalogWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    // 专用工作目录：写入器会把父目录强制 0700（不得指向临时根）。
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-workflow-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    fileURL = workDir.appendingPathComponent("catalog.json")
+
+    runtime = FakeCatalogRuntime()
+    workflow = makeWorkflow()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  private func makeWorkflow() -> CatalogWorkflow {
+    // 计数即提交计数：提交后的运行时收敛由协调器异步调度。
+    runtime.hasActiveTarget = true
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: makeTestCatalogStore(fileURL: fileURL), runtime: runtime)
+    return makeCatalogWorkflow(
+      coordinator: coordinator,
+      plugins: NoManagedPluginProvider())
+  }
+
+  func makeSubscriptionCatalog() throws {
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: fixture.catalog))
+    workflow = makeWorkflow()
+  }
+
+  // MARK: - 三入口导入（共同落点）
+
+  func testImportMixedLinesAddsParsedAndReportsFailures() async throws {
+    let validSIP002 = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388#香港 01"
+    let legacy = "ss://YWVzLTI1Ni1nY206dGVzdEAyMDMuMC4xMTMuNzo4Mzg4"
+    let outcome = await workflow.importServers(
+      from: [.clipboardText("\(validSIP002)\n垃圾行\n\(legacy)")], into: nil)
+    let facts = try XCTUnwrap(outcome.sources.first?.result.partialFacts)
+    XCTAssertEqual(facts.addedCount, 2)
+    XCTAssertEqual(facts.failures.count, 1)
+    XCTAssertEqual(facts.failures[0].lineIndex, 1, "失败行按换行切分点名")
+
+    let roots = workflow.tree.roots
+    XCTAssertEqual(roots.count, 2)
+    XCTAssertEqual(roots[0].name, "香港 01", "备注优先的显示名")
+    XCTAssertEqual(
+      try workflow.serverEditForm(for: roots[0].id)?.password, "password123", "密码入凭据存储")
+    XCTAssertTrue(roots[0].invalidReasons.isEmpty)
+    // 两个身份均为全新 UUID 形态（不按内容去重）。
+    XCTAssertNotEqual(roots[0].id, roots[1].id)
+  }
+
+  func testImportWithPluginStoresProgramAndOptions() async throws {
+    let uri =
+      "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388"
+      + "/?plugin=v2ray-plugin%3Bmode%3Dwebsocket%3Bhost%3Dexample.com"
+    _ = await workflow.importServers(from: [.clipboardText(uri)], into: nil)
+    let id = try XCTUnwrap(workflow.tree.roots.first?.id)
+    let plugin = try XCTUnwrap(try workflow.serverEditForm(for: id)?.plugin)
+    XCTAssertEqual(plugin.selection, .named(program: "v2ray-plugin"))
+    XCTAssertTrue(plugin.optionsPresent)
+    // NoManagedPluginProvider:程序引用保留但可执行文件缺失(集外点名事实)。
+    XCTAssertEqual(plugin.programs.first { $0.program == "v2ray-plugin" }?.availability, .missing)
+    XCTAssertEqual(plugin.options, "mode=websocket;host=example.com")
+  }
+
+  func testImportUnsupportedMethodKeepsServerAsInvalidCandidate() async throws {
+    let uri = SsUri(
+      method: "future-cipher", password: "password", host: "203.0.113.7", port: 8388
+    ).encode()
+
+    let outcome = await workflow.importServers(from: [.clipboardText(uri)], into: nil)
+
+    XCTAssertEqual(outcome.sources.first?.result.importedCount, 1)
+    let node = try XCTUnwrap(workflow.tree.roots.first)
+    XCTAssertEqual(
+      node.invalidReasons, [.unsupportedEncryptionMethod("future-cipher")],
+      "不支持的方法保留并明确标记为无效(story 9)")
+  }
+
+  func testImportIntoSelectedManualGroup() async throws {
+    let groupID = try await workflow.createGroup(named: "手动组", into: nil)
+    let target = try XCTUnwrap(workflow.importTargetParent(for: groupID))
+    XCTAssertEqual(target, groupID)
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: target)
+    XCTAssertEqual(workflow.tree.node(withID: groupID)?.childCount, 1)
+    // 选中服务器时落到其手动父组；无选中落到根。
+    let serverID = try XCTUnwrap(workflow.tree.node(withID: groupID)?.children?.first?.id)
+    XCTAssertEqual(workflow.importTargetParent(for: serverID), groupID)
+    XCTAssertNil(workflow.importTargetParent(for: nil))
+  }
+
+  func testImportTargetSkipsSubscriptionSubtree() async throws {
+    try makeSubscriptionCatalog()
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    XCTAssertEqual(workflow.importTargetParent(for: fixture.groupID), nil)
+    XCTAssertEqual(workflow.importTargetParent(for: fixture.serverIDs[0]), nil)
+  }
+
+  // MARK: - 树 projection
+
+  func testTreeSnapshotMirrorsStructureCountsAndParents() async throws {
+    let groupID = try await workflow.createGroup(named: "组A", into: nil)
+    let nestedID = try await workflow.createGroup(named: "嵌套", into: groupID)
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: nestedID)
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.8:8388")],
+      into: nil)
+
+    let group = try XCTUnwrap(workflow.tree.node(withID: groupID))
+    XCTAssertTrue(group.isGroup)
+    XCTAssertTrue(group.isManual)
+    XCTAssertEqual(group.parentID, nil)
+    XCTAssertEqual(group.childCount, 1)
+    XCTAssertEqual(group.subtreeNodeCount, 2, "嵌套分组 + 服务器叶子")
+    let nested = try XCTUnwrap(group.children?.first)
+    XCTAssertEqual(nested.id, nestedID)
+    XCTAssertEqual(nested.parentID, groupID)
+    let rootServer = try XCTUnwrap(workflow.tree.roots.last)
+    XCTAssertFalse(rootServer.isGroup)
+    XCTAssertFalse(rootServer.isInvalid)
+    XCTAssertNil(rootServer.children)
+    XCTAssertTrue(workflow.tree.containsNode(groupID))
+  }
+
+  // MARK: - 活动目标路径摘要（代理控制窄缝取用）
+
+  func testPathSummaryResolvesRootToLeafNames() async throws {
+    let groupID = try await workflow.createGroup(named: "组A", into: nil)
+    let nestedID = try await workflow.createGroup(named: "嵌套", into: groupID)
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: nestedID)
+    let leafID = try XCTUnwrap(workflow.tree.node(withID: nestedID)?.childNodes.first?.id)
+
+    XCTAssertEqual(workflow.tree.pathSummary(for: groupID), "组A")
+    XCTAssertEqual(workflow.tree.pathSummary(for: nestedID), "组A / 嵌套")
+    XCTAssertEqual(workflow.tree.pathSummary(for: leafID), "组A / 嵌套 / 203.0.113.7:8388")
+  }
+
+  func testPathSummaryIsNilForMissingTarget() {
+    XCTAssertNil(workflow.tree.pathSummary(for: NodeID(rawValue: "gone")))
+  }
+
+  // MARK: - 表单编辑与凭据生命周期
+
+  func testUpdateServerPersistsFieldsAndPassword() async throws {
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: nil)
+    let id = try XCTUnwrap(workflow.tree.roots.first?.id)
+    try await workflow.updateServer(
+      id,
+      draft: ServerEditDraft(
+        address: "198.51.100.9", port: 9999,
+        encryptionMethod: "chacha20-ietf-poly1305", password: "新密码",
+        remark: "改过的", plugin: .none, pluginOptions: nil))
+    let form = try XCTUnwrap(try workflow.serverEditForm(for: id))
+    XCTAssertEqual(form.address, "198.51.100.9")
+    XCTAssertEqual(form.port, 9999)
+    XCTAssertEqual(form.remark, "改过的")
+    XCTAssertEqual(form.password, "新密码", "同一引用始终对应最新秘密")
+    XCTAssertEqual(form.encryptionMethod, "chacha20-ietf-poly1305")
+    // 连续提交合并为最新代次的收敛：旧代次在启动前被取代，
+    // 最终结果必为最新提交快照。
+    await waitUntilRuntimeSettles(workflow.runtimeSync != .syncing(generation: 2))
+    XCTAssertEqual(
+      workflow.runtimeSync,
+      .finished(generation: 2, outcome: .converged(skippedServers: [])),
+      "目录提交与运行时收敛分离呈现(story 38)")
+  }
+
+  func testUpdateServerRejectsInvalidAddressAndPort() async throws {
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: nil)
+    let id = try XCTUnwrap(workflow.tree.roots.first?.id)
+    await expectThrowsAsync(
+      {
+        try await workflow.updateServer(
+          id,
+          draft: ServerEditDraft(
+            address: "  ", port: 8388, encryptionMethod: "aes-256-gcm", password: "p",
+            remark: "", plugin: .none, pluginOptions: nil))
+      },
+      onThrow: { error in
+        XCTAssertEqual(error as? ServerFormError, .invalidAddress)
+      })
+    await expectThrowsAsync(
+      {
+        try await workflow.updateServer(
+          id,
+          draft: ServerEditDraft(
+            address: "203.0.113.7", port: 0, encryptionMethod: "aes-256-gcm", password: "p",
+            remark: "", plugin: .none, pluginOptions: nil))
+      },
+      onThrow: { error in
+        XCTAssertEqual(error as? ServerFormError, .invalidPort)
+      })
+  }
+
+  func testRemoveServerCleansCredentials() async throws {
+    // 已知凭据引用直建目录（模块投影不含引用；身份经文件夹具固定）。
+    var catalog = ConfigurationCatalog()
+    var fields = ServerFields(
+      address: "203.0.113.7", port: 8388, encryptionMethod: "aes-256-gcm",
+      password: "password", remark: "删除我",
+      pluginProgram: "v2ray-plugin",
+      pluginOptions: "options")
+    fields.password = "pw"
+    fields.pluginOptions = "opts"
+    try catalog.addServer(fields)
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: catalog))
+    workflow = makeWorkflow()
+
+    let id = try XCTUnwrap(workflow.tree.roots.first?.id)
+    let outcome = try await workflow.remove(id)
+
+    XCTAssertEqual(outcome.removedNodeIDs, [id], "删除返回 selection invalidation(story 18)")
+    XCTAssertTrue(workflow.tree.isEmpty)
+    XCTAssertNil(try workflow.serverEditForm(for: id))
+    XCTAssertFalse(try makeTestCatalogStore(fileURL: fileURL).load().catalog.contains(id))
+  }
+
+  func testRemoveNonEmptyGroupRemovesWholeSubtree() async throws {
+    let groupID = try await workflow.createGroup(named: "组", into: nil)
+    _ = await workflow.importServers(
+      from: [.clipboardText("ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388")],
+      into: groupID)
+    let serverID = try XCTUnwrap(workflow.tree.node(withID: groupID)?.children?.first?.id)
+    let outcome = try await workflow.remove(groupID)
+    XCTAssertEqual(outcome.removedNodeIDs, [groupID, serverID])
+    XCTAssertTrue(workflow.tree.isEmpty)
+  }
+
+  // MARK: - 分享（与添加互逆）
+
+  func testShareSsUriRoundTripsBackThroughImport() async throws {
+    let source =
+      "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388"
+      + "/?plugin=v2ray-plugin%3Bmode%3Dwebsocket%3Bhost%3Dexample.com#分享节点"
+    _ = await workflow.importServers(from: [.clipboardText(source)], into: nil)
+    let id = try XCTUnwrap(workflow.tree.roots.first?.id)
+    let shared = try workflow.shareURI(for: id)
+    let decoded = try SsUri.decode(shared)
+    XCTAssertEqual(decoded.method, "aes-256-gcm")
+    XCTAssertEqual(decoded.password, "password123")
+    XCTAssertEqual(decoded.host, "203.0.113.7")
+    XCTAssertEqual(decoded.port, 8388)
+    XCTAssertEqual(decoded.pluginProgram, "v2ray-plugin")
+    XCTAssertEqual(decoded.pluginOptions, "mode=websocket;host=example.com")
+    XCTAssertEqual(decoded.remark, "分享节点")
+  }
+
+  func testShareFailsWhenCredentialMissing() async throws {
+    var catalog = ConfigurationCatalog()
+    var fields = CatalogFixtures.serverFields(remark: "无凭据")
+    fields.password = ""
+    try catalog.addServer(fields)
+    try makeTestCatalogStore(fileURL: fileURL).save(CatalogDocument(catalog: catalog))
+    workflow = makeWorkflow()
+    let id = try XCTUnwrap(workflow.tree.roots.first?.id)
+    await expectThrowsAsync { _ = try workflow.shareURI(for: id) }
+  }
+
+  // MARK: - 持久化
+
+  func testChangesPersistAcrossWorkflowInstances() async throws {
+    let groupID = try await workflow.createGroup(named: "持久组", into: nil)
+    let reloaded = makeWorkflow()
+    XCTAssertTrue(reloaded.tree.containsNode(groupID))
+    XCTAssertEqual(reloaded.displayName(for: groupID), "持久组")
+  }
+}
+
+/// 组合根 fakes 装配覆盖：工作流可以完全经依赖束以
+/// hermetic fake 组装——init 的发现状态、目录命令、激活命令与 Legacy 导入
+/// 全部命中注入替身，不触碰生产 Keychain、app 数据、LaunchAgent、代理进程
+/// 或 SystemConfiguration。
+@MainActor
+final class CatalogWorkflowHermeticAssemblyTests: XCTestCase {
+  private var workDir: URL!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("catalog-assembly-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  func testWorkflowAssemblesFromFakesWithoutProductionSideEffects() async throws {
+    let fileURL = workDir.appendingPathComponent("catalog.json")
+    let runtime = FakeCatalogRuntime()
+    let marker = InMemoryLegacyImportMarker()
+    let dependencies = CatalogWorkflowDependencies(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: fileURL), runtime: runtime),
+      plugins: NoManagedPluginProvider(),
+      subscriptionFetcher: FakeSubscriptionFetcher(behavior: .success(Data())),
+      legacyImportService: LegacyImportService(
+        source: FixedLegacySnapshotProvider(snapshot: try makeLegacySnapshot()),
+        catalogStore: makeTestCatalogStore(fileURL: fileURL),
+        marker: marker),
+      postLegacyImport: nil,
+      activator: RejectingActivator())
+
+    let workflow = CatalogWorkflow(dependencies: dependencies)
+
+    // init 的发现状态来自注入的 Legacy 服务，而非生产缺省实现。
+    XCTAssertEqual(
+      workflow.legacyImportState,
+      LegacyImportAvailability(snapshotFound: true, completed: false))
+
+    // 目录命令落在注入的内存凭据与文件存储上；激活命令命中注入替身。
+    let groupID = try await workflow.createGroup(named: "组装组", into: nil)
+    XCTAssertTrue(workflow.tree.containsNode(groupID))
+    let activation = try await workflow.activate(groupID)
+    XCTAssertEqual(activation, .rejectedActivation(.noActiveTarget))
+
+    // Legacy 导入走注入服务：报告、完成标记与凭据写入都落在注入的 fake 上；
+    // 不经提交管线触发运行时收敛。
+    let outcome = try await workflow.importLegacy()
+    XCTAssertEqual(outcome.report.importedServerCount, 1)
+    XCTAssertEqual(try marker.isCompleted(), true)
+    let importedID = try XCTUnwrap(
+      workflow.tree.node(withID: outcome.groupID)?.childNodes.first?.id)
+    XCTAssertEqual(try workflow.serverEditForm(for: importedID)?.password, "legacy-pw")
+    XCTAssertEqual(runtime.convergeCount, 0, "导入不经提交管线触发运行时收敛")
+  }
+
+  private func makeLegacySnapshot() throws -> LegacySnapshot {
+    let profile: [String: Any] = [
+      "Id": "11111111-2222-4333-8444-555555555555",
+      "ServerHost": "203.0.113.9",
+      "ServerPort": 8388,
+      "Method": "aes-256-gcm",
+      "Password": "legacy-pw",
+      "Remark": "旧服务器",
+    ]
+    return try LegacySnapshot(
+      propertyList: ["ServerProfiles": [profile], "ShadowsocksRunningMode": "manual"])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityCatalogTests.swift b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityCatalogTests.swift
new file mode 100644
index 000000000..b0a04738c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityCatalogTests.swift
@@ -0,0 +1,44 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ConnectivityCatalogTests {
+  @Test func groupConnectivityIDsExpandAndConfigurationReadsCommittedCatalog() throws {
+    let subscription = try CatalogFixtures.makeSubscriptionFixture(prefix: UUID().uuidString)
+    var catalog = subscription.catalog
+    let group = try catalog.addGroup("Local")
+    let nested = try catalog.addGroup("Nested", to: group)
+    let firstTarget = try ActivationFixture.addPlainServer(
+      "A", to: group, in: &catalog)
+    let secondTarget = try ActivationFixture.addPlainServer(
+      "B", to: nested, in: &catalog)
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.json"))
+    try store.save(CatalogDocument(catalog: catalog))
+    let runtime = FakeCatalogRuntime()
+    let coordinator = CatalogCommitCoordinator(fileStore: store, runtime: runtime)
+    let workflow = makeCatalogWorkflow(coordinator: coordinator)
+    #expect(
+      workflow.tree.node(withID: group)?.connectivityServerIDs == [secondTarget, firstTarget])
+    let before = try Data(contentsOf: store.fileURL)
+    let tree = workflow.tree
+    let version = workflow.connectivityRevision(for: firstTarget)
+    let derived = try workflow.connectivityConfiguration(for: firstTarget)
+    #expect(derived.id == firstTarget.rawValue)
+    #expect(derived.password == "pw-A")
+    #expect(runtime.convergeCount == 0)
+    #expect(workflow.tree == tree)
+    #expect(try Data(contentsOf: store.fileURL) == before)
+    let fields = try #require(catalog.entry(for: firstTarget))
+    guard case .server(var connection) = fields.kind else { return }
+    connection.password = "different"
+    try coordinator.commit { catalog, _ in
+      try catalog.updateServer(firstTarget, with: connection)
+    }
+    #expect(workflow.connectivityRevision(for: firstTarget) != version)
+    #expect(try workflow.connectivityConfiguration(for: firstTarget).password == "different")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityCertificateTests.swift b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityCertificateTests.swift
new file mode 100644
index 000000000..c665950d4
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityCertificateTests.swift
@@ -0,0 +1,106 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ConnectivityCertificateTests {
+  @Test func dohRejectsUntrustedCertificateThroughRequiredProxy() async throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let (cert, key) = try makeCertificate(in: root)
+    let marker = root.appendingPathComponent("tls-error")
+    let script = try writeProxyScript(in: root)
+    let proxy = Process()
+    let output = Pipe()
+    proxy.executableURL = URL(fileURLWithPath: "/usr/bin/env")
+    proxy.arguments = ["python3", script.path, cert.path, key.path, marker.path]
+    proxy.standardOutput = output
+    proxy.standardError = FileHandle.nullDevice
+    try proxy.run()
+    defer {
+      if proxy.isRunning {
+        proxy.terminate()
+        proxy.waitUntilExit()
+      }
+    }
+    var data = Data()
+    while let byte = try output.fileHandleForReading.read(upToCount: 1), !byte.isEmpty {
+      if byte == Data([10]) { break }
+      data.append(byte)
+    }
+    let port = try #require(
+      Int(
+        (String(data: data, encoding: .utf8) ?? "").trimmingCharacters(in: .whitespacesAndNewlines))
+    )
+    await #expect(throws: (any Error).self) {
+      try await ConnectivityDoHResolver().query(
+        host: "target.invalid", endpoint: "https://target.invalid/resolve", proxyPort: port,
+        deadline: .now.advanced(by: .seconds(3)))
+    }
+    let alertDeadline = ContinuousClock.now.advanced(by: .seconds(1))
+    while !FileManager.default.fileExists(atPath: marker.path), ContinuousClock.now < alertDeadline
+    {
+      try await Task.sleep(for: .milliseconds(10))
+    }
+    let requestMarker = URL(fileURLWithPath: marker.path + ".request")
+    #expect(FileManager.default.fileExists(atPath: requestMarker.path))
+    if FileManager.default.fileExists(atPath: requestMarker.path) {
+      let request = try String(contentsOf: requestMarker, encoding: .utf8)
+      #expect(request.hasPrefix("CONNECT target.invalid:443 "))
+    }
+    #expect(FileManager.default.fileExists(atPath: marker.path))
+
+  }
+  private func makeCertificate(in root: URL) throws -> (URL, URL) {
+    let cert = root.appendingPathComponent("cert.pem")
+    let key = root.appendingPathComponent("key.pem")
+    let openssl = Process()
+    openssl.executableURL = URL(fileURLWithPath: "/usr/bin/openssl")
+    openssl.arguments = [
+      "req", "-x509", "-newkey", "rsa:2048", "-nodes", "-keyout", key.path,
+      "-out", cert.path, "-days", "1", "-subj", "/CN=target.invalid", "-addext",
+      "subjectAltName=DNS:target.invalid",
+    ]
+    openssl.standardOutput = FileHandle.nullDevice
+    openssl.standardError = FileHandle.nullDevice
+    try openssl.run()
+    openssl.waitUntilExit()
+    #expect(openssl.terminationStatus == 0)
+    return (cert, key)
+  }
+
+  private func writeProxyScript(in root: URL) throws -> URL {
+    let script = root.appendingPathComponent("proxy.py")
+    try """
+    import socket, ssl, sys, pathlib
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.load_cert_chain(sys.argv[1], sys.argv[2])
+    server = socket.socket()
+    server.bind(('127.0.0.1', 0)); server.listen()
+    print(server.getsockname()[1], flush=True)
+    while True:
+        connection, _ = server.accept()
+        request = b''
+        while b'\\r\\n\\r\\n' not in request:
+            data = connection.recv(4096)
+            if not data: break
+            request += data
+        pathlib.Path(sys.argv[3] + '.request').write_bytes(request)
+        if not request.startswith(b'CONNECT target.invalid:443 '):
+            connection.close(); continue
+        connection.sendall(b'HTTP/1.1 200 Connection Established\\r\\n\\r\\n')
+        try:
+            secured = context.wrap_socket(connection, server_side=True)
+            secured.recv(4096)
+            secured.sendall(b'HTTP/1.1 204 No Content\\r\\n\\r\\n')
+            secured.close()
+        except ssl.SSLError as error:
+            pathlib.Path(sys.argv[3]).write_text(str(error))
+            connection.close()
+    """.write(to: script, atomically: true, encoding: .utf8)
+    return script
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityDoHTests.swift b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityDoHTests.swift
new file mode 100644
index 000000000..d6f11a2ac
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityDoHTests.swift
@@ -0,0 +1,137 @@
+import Foundation
+import Synchronization
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@Suite(.timeLimit(.minutes(1)))
+struct ConnectivityDoHTests {
+  @Test func fallsBackToCloudflare() async {
+    let resolver = ConnectivityDoHResolver(
+      sessionConfiguration: {
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.protocolClasses = [FallbackAnswersProtocol.self]
+        return configuration
+      },
+      waitForDeadline: { _ in
+        let pending = AsyncStream<Void> { (_: AsyncStream<Void>.Continuation) in }
+        for await _ in pending {}
+      })
+    let result = await resolver.resolve(
+      host: "target.invalid", proxyPort: 1234, deadline: .now.advanced(by: .seconds(60)))
+    #expect(result.addresses == ["192.0.2.1", "2001:db8::1"])
+    #expect(result.trace.map(\.phase) == [.google, .cloudflare])
+    #expect(result.trace.map(\.status) == [.network, .success])
+    #expect(!result.trace.map(\.description).joined().contains("target.invalid"))
+  }
+
+  @Test func acceptsOnlyMatchingIPRecords() throws {
+    let data = Data(
+      (#"{"Status":0,"Answer":[{"type":5,"data":"alias.invalid"},"#
+        + #"{"type":1,"data":"192.0.2.1"},{"type":1,"data":"2001:db8::bad"},"#
+        + #"{"type":1,"data":"bad.invalid"},{"type":28,"data":"2001:db8::1"},"#
+        + #"{"type":28,"data":"192.0.2.4"}]}"#).utf8)
+    #expect(try ConnectivityDoHResolver.addresses(from: data, type: 1) == ["192.0.2.1"])
+    #expect(try ConnectivityDoHResolver.addresses(from: data, type: 28) == ["2001:db8::1"])
+  }
+
+  @Test func familyThatExceedsDeadlineDoesNotDiscardOtherFamily() async {
+    let events = AsyncStream<[String]?> { continuation in
+      continuation.yield(["192.0.2.1"])
+      continuation.yield(nil)
+      continuation.yield(["2001:db8::1"])
+      continuation.finish()
+    }
+    let addresses = await ConnectivityDoHResolver.collectAddresses(from: events)
+    #expect(addresses == ["192.0.2.1"])
+  }
+
+  @Test func completedFamiliesDoNotWaitForDeadline() async {
+    let events = AsyncStream<[String]?> { continuation in
+      continuation.yield(["192.0.2.1"])
+      continuation.yield(["2001:db8::1"])
+    }
+    let addresses = await ConnectivityDoHResolver.collectAddresses(from: events)
+    #expect(addresses == ["192.0.2.1", "2001:db8::1"])
+  }
+
+  @MainActor
+  @Test func pendingFamiliesAreCancelledAtDeadline() async throws {
+    let host = UUID().uuidString.lowercased() + ".invalid"
+    let started = XCTestExpectation(description: "Both address families started")
+    let stopped = XCTestExpectation(description: "Both address families cancelled")
+    started.expectedFulfillmentCount = 2
+    stopped.expectedFulfillmentCount = 2
+    PendingAnswersProtocol.observers.withLock {
+      $0[host] = { loading in
+        if loading { started.fulfill() } else { stopped.fulfill() }
+      }
+    }
+    defer { PendingAnswersProtocol.observers.withLock { $0[host] = nil } }
+    let deadline = AsyncStream<Void>.makeStream()
+    let resolver = ConnectivityDoHResolver(
+      sessionConfiguration: {
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.protocolClasses = [PendingAnswersProtocol.self]
+        return configuration
+      },
+      waitForDeadline: { _ in
+        for await _ in deadline.stream {}
+      })
+    let task = Task {
+      do {
+        _ = try await resolver.query(
+          host: host, endpoint: "https://\(host)/resolve", proxyPort: 1234,
+          deadline: .now)
+        Issue.record("Pending requests unexpectedly resolved")
+      } catch {
+        #expect(error is ConnectivityDoHResolver.Failure)
+      }
+    }
+    try await withTestTask(
+      task, release: { deadline.continuation.finish() },
+      body: {
+        try await requireTestPhase([started])
+        deadline.continuation.finish()
+        try await requireTestPhase([stopped])
+      })
+  }
+}
+
+private final class FallbackAnswersProtocol: URLProtocol, @unchecked Sendable {
+  override static func canInit(with request: URLRequest) -> Bool { true }
+  override static func canonicalRequest(for request: URLRequest) -> URLRequest { request }
+  override func startLoading() {
+    guard let url = request.url else { return }
+    let type = URLComponents(url: url, resolvingAgainstBaseURL: false)?
+      .queryItems?.first(where: { $0.name == "type" })?.value
+    let failed = url.host == "dns.google"
+    let answer =
+      type == "1"
+      ? #"{"Status":0,"Answer":[{"type":1,"data":"192.0.2.1"}]}"#
+      : #"{"Status":0,"Answer":[{"type":28,"data":"2001:db8::1"}]}"#
+    let response = HTTPURLResponse(
+      url: url, statusCode: failed ? 503 : 200, httpVersion: "HTTP/1.1",
+      headerFields: ["Content-Type": "application/dns-json"])!
+    client?.urlProtocol(self, didReceive: response, cacheStoragePolicy: .notAllowed)
+    client?.urlProtocol(self, didLoad: Data(answer.utf8))
+    client?.urlProtocolDidFinishLoading(self)
+  }
+  override func stopLoading() {}
+}
+
+private final class PendingAnswersProtocol: URLProtocol, @unchecked Sendable {
+  static let observers = Mutex<[String: @Sendable (Bool) -> Void]>([:])
+
+  override static func canInit(with request: URLRequest) -> Bool { true }
+  override static func canonicalRequest(for request: URLRequest) -> URLRequest { request }
+  override func startLoading() { observe(loading: true) }
+  override func stopLoading() { observe(loading: false) }
+
+  private func observe(loading: Bool) {
+    guard let host = request.url?.host else { return }
+    let observer = Self.observers.withLock { $0[host] }
+    observer?(loading)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityFormalRuntimeTests.swift b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityFormalRuntimeTests.swift
new file mode 100644
index 000000000..2245b95c2
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityFormalRuntimeTests.swift
@@ -0,0 +1,55 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ConnectivityFormalRuntimeTests {
+  @Test func changingTestURLDoesNotConvergeTheRunningFormalProxy() async throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let agent = ProxyRuntimeFixture.FakeLaunchAgent()
+    let systemProxy = ProxyRuntimeFixture.FakeSystemProxy()
+    let store = SettingsWorkflowTests.InMemorySettingsStore()
+    let fileStore = RuntimeFileStore(fileURL: runtime.contract)
+    agent.onRegister = {
+      try? fileStore.writePublishedRuntimeReceipt(processID: 42)
+    }
+    let controller = ProxyRuntimeController(
+      controlPreferences: makeTestProxyControlPreferences(),
+      catalogSnapshotReader: ProxyRuntimeFixture.catalogSnapshotReader(
+        at: runtime.directory.appendingPathComponent("catalog.json")),
+      activationFileStore: ActivationStateFileStore(
+        fileURL: runtime.directory.appendingPathComponent("activation.json")),
+      runtimeFileStore: fileStore, plugins: ActivationFixture.plugins,
+      listeningStore: store,
+      customRuleStore: CustomRuleStore(
+        fileURL: runtime.directory.appendingPathComponent("rules.json")),
+      appBundle: AppArtifact.bundle,
+      ruleSnapshots: BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot),
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(listen: ActivationFixture.listen), unreadableError: nil),
+      agent: agent,
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(), systemProxy: systemProxy,
+      systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService(),
+      launchHealthTimeoutSeconds: 0.05,
+      sendSignal: { _, _ in 0 }, processIsAlive: { $0 == 42 })
+    await controller.setAgentEnabled(true)
+    let state = controller.state
+    let calls = agent.registerCount
+    let target = controller.activeTargetID
+    let document = try Data(contentsOf: runtime.contract)
+    let suite = "ConnectivityFormalRuntimeTests.\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+    let workflow = SettingsWorkflow(
+      committing: controller, connectivityDefaults: defaults)
+    #expect(await workflow.saveConnectivityURL("http://example.com/probe?token=private"))
+    #expect(controller.state == state)
+    #expect(controller.activeTargetID == target)
+    #expect(agent.registerCount == calls)
+    #expect(agent.unregisterCount == 0)
+    #expect(systemProxy.applied.isEmpty)
+    #expect(try Data(contentsOf: runtime.contract) == document)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityHTTPTests.swift b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityHTTPTests.swift
new file mode 100644
index 000000000..9acf7a411
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityHTTPTests.swift
@@ -0,0 +1,220 @@
+import Foundation
+import Network
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ConnectivityHTTPTests {
+  @Test(arguments: [(204, false), (200, false), (302, false), (500, false), (200, true)])
+  func sendsGETThroughProxyAndStopsAtHeaders(status: Int, informational: Bool) async throws {
+    let headers =
+      "HTTP/1.1 \(status) Response\r\nLocation: http://another.invalid/redirect\r\nContent-Length: 99999\r\n\r\n"
+    let proxy = try HeaderProxy(
+      response: (informational ? "HTTP/1.1 100 Continue\r\n\r\n" : "") + headers)
+    defer { proxy.stop() }
+    let port = try await proxy.start()
+    // This name cannot resolve; a successful response proves proxy routing.
+    let id = NodeID.fresh()
+    let module = ServerConnectivity(
+      configuration: { _ in Self.server },
+      measure: { _, url, _ in
+        await ConnectivityHTTPRequest().perform(url: url, proxyPort: port)
+      })
+    module.setURL(URL(string: "http://target.invalid/test")!)
+    await module.wait(for: module.test([id]))
+    let value = try #require(module.history(for: id).first?.outcome)
+    if (200..<300).contains(status) {
+      guard case .success = value else {
+        Issue.record("Expected successful proxy response, got \(value)")
+        return
+      }
+    } else {
+      #expect(value == .http(status))
+    }
+    #expect(proxy.requests.count == 1)
+    #expect(proxy.requests.first?.hasPrefix("GET http://target.invalid/test HTTP/") == true)
+  }
+
+  @Test func informationalAndFragmentedHeadersDoNotWaitForBody() async throws {
+    // Leave the socket readable while the reader supplies exact response chunks.
+    let proxy = try HeaderProxy(response: "ready")
+    defer { proxy.stop() }
+    let port = try await proxy.start()
+    let result = await Task.detached {
+      var chunks = [
+        "HTTP/1.1 100 Continue\r\n\r\nHTTP/1.1 200 OK\r\nContent-Len",
+        "gth: 999999\r\n\r\n",
+      ].map { Array($0.utf8) }
+      let cancellation = ConnectivityHTTPCreateCancellation()
+      defer { ConnectivityHTTPDestroyCancellation(cancellation) }
+      return withUnsafeMutablePointer(to: &chunks) { context in
+        "GET http://target.invalid/test HTTP/1.1\r\nHost: target.invalid\r\n\r\n".withCString {
+          ConnectivityHTTPProbeWithReader(
+            $0, Int32(port), 5000, cancellation,
+            { buffer, capacity, context in
+              let chunks = context!.assumingMemoryBound(to: [[UInt8]].self)
+              guard !chunks.pointee.isEmpty else { return 0 }
+              let chunk = chunks.pointee.removeFirst()
+              precondition(chunk.count <= capacity)
+              chunk.withUnsafeBytes {
+                buffer!.copyMemory(from: $0.baseAddress!, byteCount: $0.count)
+              }
+              return chunk.count
+            }, context)
+        }
+      }
+    }.value
+    #expect(result.received_headers == 1)
+    #expect(result.status == 200)
+    #expect(result.timed_out == 0)
+  }
+
+  @Test func fixedAddressPreservesHostAndReportsClientPhases() async throws {
+    let proxy = try HeaderProxy(
+      response: "HTTP/1.1 204 No Content\r\nContent-Length: 99999\r\n\r\n")
+    defer { proxy.stop() }
+    let port = try await proxy.start()
+    let result = await ConnectivityHTTPRequest().observe(
+      url: URL(string: "http://target.invalid:8080/test?q=private%20value")!,
+      targetIP: "2001:db8::1", proxyPort: port, timeout: 5)
+    guard case .success = result.outcome else {
+      Issue.record("Expected successful fixed-address request")
+      return
+    }
+    let request = try #require(proxy.requests.first)
+    #expect(request.hasPrefix("GET http://[2001:db8::1]:8080/test?q=private%20value HTTP/1.1\r\n"))
+    #expect(request.contains("\r\nHost: target.invalid:8080\r\n"))
+    #expect(result.localTCPMilliseconds != nil)
+    #expect(result.sendMilliseconds != nil)
+    #expect(result.firstByteMilliseconds != nil)
+    #expect(result.headersMilliseconds != nil)
+    #expect(result.totalMilliseconds >= 0)
+  }
+
+  @Test(arguments: [
+    "HTTP/2 200 OK\r\n\r\n",
+    "HTTP/1.1 200 OK\r\nInvalid Header\r\n\r\n",
+    "HTTP/1.1 200 OK\r\nX-Large: " + String(repeating: "x", count: 65536),
+    String(repeating: "HTTP/1.1 100 Continue\r\n\r\n", count: 3000),
+    // Each block fits; only the cumulative budget including final headers is exceeded.
+    "HTTP/1.1 100 Continue\r\nX-Large: " + String(repeating: "x", count: 60000) + "\r\n\r\n"
+      + "HTTP/1.1 204 No Content\r\nX-Large: " + String(repeating: "x", count: 6000) + "\r\n\r\n",
+  ])
+  func rejectsMalformedOrUnboundedHeaders(response: String) async throws {
+    let proxy = try HeaderProxy(response: response)
+    defer { proxy.stop() }
+    let port = try await proxy.start()
+    let result = await ConnectivityHTTPRequest().observe(
+      url: URL(string: "http://target.invalid/test")!, targetIP: "192.0.2.1", proxyPort: port,
+      timeout: 5)
+    #expect(result.outcome == .network)
+    #expect(result.failureStage == "headers")
+  }
+
+  @Test func httpsIsRejectedBeforeOpeningProxyConnection() async throws {
+    let proxy = try HeaderProxy(
+      response: "HTTP/1.1 204 No Content\r\nContent-Length: 99999\r\n\r\n")
+    defer { proxy.stop() }
+    let port = try await proxy.start()
+    let result = await ConnectivityHTTPRequest().perform(
+      url: URL(string: "https://target.invalid/test")!, proxyPort: port)
+    #expect(result == .configuration)
+    #expect(proxy.requests.isEmpty)
+  }
+
+  @Test(.timeLimit(.minutes(1)))
+  func timesOutWhileWaitingForFirstByte() async throws {
+    let proxy = try HeaderProxy()
+    defer { proxy.stop() }
+    let port = try await proxy.start()
+    let result = await ConnectivityHTTPRequest().observe(
+      url: URL(string: "http://target.invalid/slow")!, targetIP: nil, proxyPort: port,
+      timeout: 0.5)
+    #expect(result.outcome == .requestTimeout)
+    #expect(result.failureStage == "first_byte")
+    #expect(result.totalMilliseconds >= 500)
+    #expect(proxy.requests.count == 1)
+  }
+
+  @Test func cancellationEndsRequestWithoutWaitingForHeaders() async throws {
+    let proxy = try HeaderProxy()
+    defer { proxy.stop() }
+    let port = try await proxy.start()
+    let id = NodeID.fresh()
+    let module = ServerConnectivity(
+      configuration: { _ in Self.server },
+      measure: { _, url, _ in
+        await ConnectivityHTTPRequest().perform(url: url, proxyPort: port)
+      })
+    module.setURL(URL(string: "http://target.invalid/test")!)
+    let batch = module.test([id])
+    let pendingDeadline = ContinuousClock.now.advanced(by: .seconds(2))
+    while proxy.requests.isEmpty, ContinuousClock.now < pendingDeadline {
+      try await Task.sleep(for: .milliseconds(5))
+    }
+    #expect(proxy.requests.count == 1)
+    let cancelledAt = ContinuousClock.now
+    await module.shutdown()
+    #expect(ContinuousClock.now - cancelledAt < .seconds(1))
+    await module.wait(for: batch)
+    #expect(module.history(for: id).isEmpty)
+    #expect(module.isCooling(id))
+  }
+  private static var server: SslocalServerDocument {
+    SslocalServerDocument(
+      id: "test", server: "example.com", serverPort: 443,
+      password: "test", method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+  }
+}
+
+/// Controlled HTTP proxy: headers arrive, but the declared body never does.
+private final class HeaderProxy: @unchecked Sendable {
+  private let listener: NWListener
+  private let response: String?
+  private let lock = NSLock()
+  private var received: [String] = []
+  private var connections: [NWConnection] = []
+  var requests: [String] { lock.withLock { received } }
+
+  init(response: String? = nil) throws {
+    self.response = response
+    listener = try NWListener(using: .tcp, on: .any)
+  }
+
+  func start() async throws -> Int {
+    listener.newConnectionHandler = { [self] connection in
+      lock.withLock { connections.append(connection) }
+      connection.start(queue: DispatchQueue(label: UUID().uuidString))
+      connection.receive(minimumIncompleteLength: 1, maximumLength: 65536) { [self] data, _, _, _ in
+        if let data { lock.withLock { received.append(String(data: data, encoding: .utf8) ?? "") } }
+        if let response {
+          connection.send(content: Data(response.utf8), completion: .contentProcessed { _ in })
+        }
+      }
+    }
+    return try await withCheckedThrowingContinuation { continuation in
+      listener.stateUpdateHandler = { [self] state in
+        switch state {
+        case .ready:
+          listener.stateUpdateHandler = nil
+          continuation.resume(returning: Int(listener.port!.rawValue))
+        case .failed(let error):
+          listener.stateUpdateHandler = nil
+          continuation.resume(throwing: error)
+        default: break
+        }
+      }
+      listener.start(queue: DispatchQueue(label: UUID().uuidString))
+    }
+  }
+
+  func stop() {
+    listener.cancel()
+    listener.newConnectionHandler = nil
+    let connections = lock.withLock { self.connections }
+    for connection in connections {
+      connection.cancel()
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityMeasurementTests.swift b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityMeasurementTests.swift
new file mode 100644
index 000000000..85f46640d
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivityMeasurementTests.swift
@@ -0,0 +1,140 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ConnectivityMeasurementTests {
+  @Test func selectsFastestSuccessfulIPAndSamplesItsMedian() async throws {
+    var addresses: [String] = []
+    var limits: [Double] = []
+    let values = [90, 20, 200, 40, 60]
+    let module = ConnectivityMeasurement(
+      resolve: { _, _, _ in ["192.0.2.1", "192.0.2.2"] },
+      request: { _, address, _, timeout in
+        let index = addresses.count
+        addresses.append(address)
+        limits.append(timeout)
+        return ConnectivityHTTPObservation(
+          outcome: .success(milliseconds: values[index]),
+          totalMilliseconds: Double(values[index]))
+      })
+    let result = await module.measure(
+      url: URL(string: "http://target.invalid/check?token=private")!, proxyPort: 1234,
+      preparationDeadline: .now.advanced(by: .seconds(30)))
+    #expect(result.outcome == .success(milliseconds: 60))
+    #expect(result.selectedIP == "192.0.2.2")
+    #expect(addresses == ["192.0.2.1", "192.0.2.2", "192.0.2.2", "192.0.2.2", "192.0.2.2"])
+    #expect(limits == [3, 3, 5, 5, 5])
+    #expect(result.samples.count == 3)
+  }
+  @Test(arguments: [true, false])
+  func requiresTwoSuccessesAndAveragesTwoSamples(twoSuccesses: Bool) async {
+    var calls = 0
+    let module = ConnectivityMeasurement(
+      resolve: { _, _, _ in ["192.0.2.1"] },
+      request: { _, _, _, _ in
+        defer { calls += 1 }
+        if calls == 2 || (!twoSuccesses && calls == 3) {
+          return ConnectivityHTTPObservation(outcome: .requestTimeout, failureStage: "first_byte")
+        }
+        return ConnectivityHTTPObservation(
+          outcome: .success(milliseconds: 10), totalMilliseconds: calls == 1 ? 10 : 30)
+      })
+    let result = await module.measure(
+      url: URL(string: "http://target.invalid/")!, proxyPort: 1234,
+      preparationDeadline: .now.advanced(by: .seconds(30)))
+    #expect(calls == 4)
+    #expect(result.outcome == (twoSuccesses ? .success(milliseconds: 20) : .requestTimeout))
+    #expect(result.trace.filter { $0.phase == .sample }.count == 3)
+    #expect(result.trace.last?.status == (twoSuccesses ? .success : .insufficientSamples))
+  }
+
+  @Test func boundsCandidatesPerFamilyAndDoesNotSelectFailedResponses() async {
+    var addresses: [String] = []
+    let module = ConnectivityMeasurement(
+      resolve: { _, _, _ in
+        [
+          "not-an-ip", "192.0.2.1", "192.0.2.1", "192.0.2.2", "192.0.2.3",
+          "2001:db8::1", "2001:db8::2", "2001:db8::3",
+        ]
+      },
+      request: { _, address, _, _ in
+        addresses.append(address)
+        return ConnectivityHTTPObservation(
+          outcome: address == "2001:db8::2" ? .success(milliseconds: 10) : .http(302),
+          totalMilliseconds: 10)
+      })
+    let result = await module.measure(
+      url: URL(string: "http://target.invalid/")!, proxyPort: 1234,
+      preparationDeadline: .now.advanced(by: .seconds(30)))
+    #expect(Array(addresses.prefix(4)) == ["192.0.2.1", "192.0.2.2", "2001:db8::1", "2001:db8::2"])
+    #expect(Array(addresses.suffix(3)) == Array(repeating: "2001:db8::2", count: 3))
+    #expect(result.outcome == .success(milliseconds: 10))
+  }
+
+  @Test func expiredPreparationDoesNotRequestAndRecordsItsFailureStage() async {
+    var calls = 0
+    let module = ConnectivityMeasurement(
+      resolve: { _, _, _ in ["192.0.2.1"] },
+      request: { _, _, _, _ in
+        calls += 1
+        return ConnectivityHTTPObservation()
+      })
+    let result = await module.measure(
+      url: URL(string: "http://target.invalid/")!, proxyPort: 1234,
+      preparationDeadline: .now.advanced(by: .seconds(-1)))
+    #expect(result.outcome == .preparationTimeout)
+    #expect(calls == 0)
+    #expect(result.trace.last?.status == .timeout)
+    #expect(result.trace.last?.failureStage == .selection)
+  }
+
+  @Test func literalTargetSkipsDNSAndLogsNeverContainURLSecrets() async {
+    var resolutions = 0
+    let module = ConnectivityMeasurement(
+      resolve: { _, _, _ in
+        resolutions += 1
+        return []
+      },
+      request: { _, _, _, _ in
+        ConnectivityHTTPObservation(outcome: .success(milliseconds: 15), totalMilliseconds: 15)
+      })
+    let result = await module.measure(
+      url: URL(string: "http://192.0.2.1/private?token=SECRET")!, proxyPort: 1234,
+      preparationDeadline: .now.advanced(by: .seconds(30)))
+    #expect(resolutions == 0)
+    #expect(result.outcome == .success(milliseconds: 15))
+    let lines = result.trace.map { RuntimeLogEvent.connectivityMeasurement(id: UUID(), entry: $0) }
+    #expect(lines.allSatisfy { $0.diagnosticReportLine == nil })
+    #expect(lines.allSatisfy { $0.standardErrorLine() == nil })
+    #expect(!lines.map(\.description).joined().contains("SECRET"))
+    #expect(!lines.map(\.description).joined().contains("private"))
+  }
+
+  @Test func cancellationDuringCandidateDoesNotStartMoreRequests() async {
+    let gate = AsyncGate()
+    var calls = 0
+    let module = ConnectivityMeasurement(
+      resolve: { _, _, _ in ["192.0.2.1", "192.0.2.2"] },
+      request: { _, _, _, _ in
+        calls += 1
+        await gate.wait()
+        return ConnectivityHTTPObservation(
+          outcome: .success(milliseconds: 10), totalMilliseconds: 10)
+      })
+    let task = Task {
+      await module.measure(
+        url: URL(string: "http://target.invalid/")!, proxyPort: 1234,
+        preparationDeadline: .now.advanced(by: .seconds(30)))
+    }
+    while calls == 0 { await Task.yield() }
+    task.cancel()
+    gate.release()
+    let result = await task.value
+    #expect(calls == 1)
+    #expect(result.samples.isEmpty)
+    #expect(result.trace.last?.status == .cancelled)
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Connectivity/ConnectivitySettingsTests.swift b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivitySettingsTests.swift
new file mode 100644
index 000000000..c56b0e2c6
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Connectivity/ConnectivitySettingsTests.swift
@@ -0,0 +1,80 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ConnectivitySettingsTests {
+  @Test func customURLPersistsWithoutCredentialsOrProxyRuntimeSettingsCommit() async throws {
+    let suite = "ConnectivitySettingsTests.\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+    let committer = FakeSettingsCommitter()
+    committer.updateError = ProxyListeningStoreError.ioFailure(detail: "must not commit")
+    let workflow = SettingsWorkflow(
+      committing: committer, connectivityDefaults: defaults)
+    var published: [URL] = []
+    workflow.connectivityURLDidChange = { published.append($0) }
+    let url = "http://example.com/probe?token=public"
+    #expect(await workflow.saveConnectivityURL(url))
+    #expect(workflow.beginConnectivityURLEditing() == url)
+    #expect(committer.committedSettings == ProxyRuntimeSettings())
+    #expect(published.map(\.absoluteString) == [url])
+    let reopened = SettingsWorkflow(
+      committing: committer, connectivityDefaults: defaults)
+    #expect(reopened.beginConnectivityURLEditing() == url)
+  }
+
+  @Test func missingOrInvalidPreferencesUseDefaultURL() throws {
+    let suite = "ConnectivitySettingsTests.\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+    let workflow = SettingsWorkflow(
+      committing: FakeSettingsCommitter(),
+      connectivityDefaults: defaults)
+    #expect(workflow.beginConnectivityURLEditing() == "http://www.gstatic.com/generate_204")
+    for value: Any in [
+      42, "", "https://example.com", "http://user:pass@example.com",
+      "http://example.com/#fragment", "http://example.com:0",
+    ] {
+      defaults.set(value, forKey: "connectivityTestURL")
+      #expect(workflow.beginConnectivityURLEditing() == "http://www.gstatic.com/generate_204")
+    }
+  }
+
+  @Test func invalidSaveKeepsPreviousURLAndDefaultCanBeRestored() async throws {
+    let suite = "ConnectivitySettingsTests.\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+    let workflow = SettingsWorkflow(
+      committing: FakeSettingsCommitter(),
+      connectivityDefaults: defaults)
+    var published: [URL] = []
+    workflow.connectivityURLDidChange = { published.append($0) }
+    #expect(await workflow.saveConnectivityURL("  http://example.com/probe?token=public \n"))
+    #expect(await !workflow.saveConnectivityURL("https://example.com"))
+    #expect(workflow.beginConnectivityURLEditing() == "http://example.com/probe?token=public")
+    #expect(published.count == 1)
+    #expect(await workflow.saveConnectivityURL("http://www.gstatic.com/generate_204"))
+    #expect(workflow.beginConnectivityURLEditing() == "http://www.gstatic.com/generate_204")
+    #expect(published.count == 2)
+  }
+
+  @Test func testURLIgnoresHistoricalCredentialReference() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let file = directory.appendingPathComponent("proxy-listening.json")
+    let original = Data(#"{"connectivityURLReference":{"obsolete":true}}"#.utf8)
+    try original.write(to: file)
+    let suite = "ConnectivitySettingsTests.\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+    let committer = FakeSettingsCommitter()
+    let workflow = SettingsWorkflow(
+      committing: committer,
+      connectivityDefaults: defaults)
+    #expect(workflow.beginConnectivityURLEditing() == "http://www.gstatic.com/generate_204")
+    #expect(try Data(contentsOf: file) == original)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Connectivity/ServerConnectivityTests.swift b/ShadowsocksX-NG2/Tests/Connectivity/ServerConnectivityTests.swift
new file mode 100644
index 000000000..2f7509dde
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Connectivity/ServerConnectivityTests.swift
@@ -0,0 +1,192 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ServerConnectivityTests {
+  @Test func repeatedRequestsShareWorkAndCoolingDoesNotAddHistory() async {
+    let id = NodeID(rawValue: UUID().uuidString)
+    var calls = 0
+    var now = Date(timeIntervalSince1970: 100)
+    let module = ServerConnectivity(
+      configuration: { _ in .fixture }, now: { now },
+      measure: { _, _, _ in
+        calls += 1
+        await Task.yield()
+        return .success(milliseconds: 42)
+      })
+    let batch = module.test([id, id])
+    _ = module.test([id])
+    await module.wait(for: batch)
+    #expect(calls == 1)
+    #expect(module.history(for: id).count == 1)
+    let skipped = module.test([id])
+    #expect(module.batch(skipped)?.cooling == [id])
+    #expect(module.history(for: id).count == 1)
+    now.addTimeInterval(10)
+    await module.wait(for: module.test([id]))
+    #expect(calls == 2)
+  }
+
+  @Test func overlappingBatchesShareOneSlotUntilCleanupCompletes() async {
+    let ids = (0..<7).map { _ in NodeID.fresh() }
+    let gate = AsyncGate()
+    var active = 0
+    var peak = 0
+    var calls = 0
+    let module = ServerConnectivity(
+      configuration: { _ in .fixture },
+      measure: { _, _, _ in
+        active += 1
+        calls += 1
+        peak = max(peak, active)
+        await gate.wait()
+        active -= 1
+        return .success(milliseconds: 12)
+      })
+    let firstTarget = module.test(Array(ids.prefix(5)))
+    let secondTarget = module.test(Array(ids.suffix(5)))
+    for _ in 0..<100 { await Task.yield() }
+    #expect(calls == 1)
+    #expect(module.testing.count == 7)
+    gate.release()
+    await module.wait(for: firstTarget)
+    await module.wait(for: secondTarget)
+    #expect(peak == 1)
+    #expect(calls == 7)
+    #expect(ids.allSatisfy { module.history(for: $0).count == 1 })
+  }
+
+  @Test func credentialValueChangesSuppressLateResultsAndPreserveCooldown() async {
+    let id = NodeID.fresh()
+    var server = SslocalServerDocument.fixture
+    let gate = AsyncGate()
+    let module = ServerConnectivity(
+      configuration: { _ in server },
+      measure: { _, _, _ in
+        await gate.wait()
+        return .success(milliseconds: 9)
+      })
+    let batch = module.test([id])
+    await Task.yield()
+    server = SslocalServerDocument(
+      id: "test", server: "example.com", serverPort: 443,
+      password: "changed", method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+    module.configurationsChanged()
+    gate.release()
+    await module.wait(for: batch)
+    #expect(module.history(for: id).isEmpty)
+    #expect(module.isCooling(id))
+    module.setURL(URL(string: "https://example.com/check")!)
+    #expect(module.isCooling(id))
+  }
+
+  @Test func latestFailureReplacesSuccessAndHistoryIsBounded() async {
+    let id = NodeID.fresh()
+    var now = Date(timeIntervalSince1970: 100)
+    var outcome = ServerConnectivity.Outcome.success(milliseconds: 11)
+    let module = ServerConnectivity(
+      configuration: { _ in .fixture }, now: { now },
+      measure: { _, _, _ in outcome })
+    await module.wait(for: module.test([id]))
+    outcome = .http(302)
+    for _ in 0..<12 {
+      now.addTimeInterval(10)
+      await module.wait(for: module.test([id]))
+    }
+    #expect(module.history(for: id).count == 10)
+    #expect(module.history(for: id).first?.outcome == .http(302))
+    let summary = module.summary(for: [id])
+    #expect(summary.hasResults)
+    #expect(summary.record == nil)
+    #expect(!summary.isTesting)
+  }
+
+  @Test func fastestLatestSuccessIgnoresAgeAndTiesUseCatalogOrder() async {
+    let ids = (0..<3).map { _ in NodeID.fresh() }
+    var now = Date(timeIntervalSince1970: 100)
+    var latency = 1
+    let module = ServerConnectivity(
+      configuration: { _ in .fixture }, now: { now },
+      measure: { _, _, _ in .success(milliseconds: latency) })
+    await module.wait(for: module.test([ids[0]]))
+    now.addTimeInterval(300)
+    latency = 20
+    await module.wait(for: module.test(Array(ids.suffix(2))))
+    let firstRecord = module.history(for: ids[0]).first
+    #expect(module.summary(for: ids).serverID == ids[0])
+    #expect(module.summary(for: Array(ids.suffix(2))).serverID == ids[1])
+    module.networkChanged()
+    #expect(module.summary(for: ids).serverID == ids[0])
+    #expect(module.history(for: ids[0]).first == firstRecord)
+    module.setURL(URL(string: "https://example.com/new")!)
+    #expect(!module.summary(for: ids).hasResults)
+  }
+
+  @Test func urlAndNetworkChangesSuppressInFlightAndShutdownDrainsQueuedWork() async {
+    let ids = (0..<5).map { _ in NodeID.fresh() }
+    let gate = AsyncGate()
+    let module = ServerConnectivity(
+      configuration: { _ in .fixture },
+      measure: { _, _, _ in
+        await gate.wait()
+        return .success(milliseconds: 9)
+      })
+    let batch = module.test(ids)
+    await Task.yield()
+    module.networkChanged()
+    let shutdown = Task { await module.shutdown() }
+    await Task.yield()
+    #expect(!module.testing.isEmpty)
+    gate.release()
+    await shutdown.value
+    await module.wait(for: batch)
+    #expect(module.testing.isEmpty)
+    #expect(ids.allSatisfy { module.history(for: $0).isEmpty && module.isCooling($0) })
+  }
+
+  @Test func queuedConfigurationIsRecheckedBeforeLaunching() async {
+    let ids = (0..<4).map { _ in NodeID.fresh() }
+    let gate = AsyncGate()
+    var changed = false
+    var calls = 0
+    let module = ServerConnectivity(
+      configuration: { id in
+        if changed && id == ids[3] { throw ServerFormLoadError.notFound }
+        return .fixture
+      },
+      measure: { _, _, _ in
+        calls += 1
+        await gate.wait()
+        return .success(milliseconds: 5)
+      })
+    let batch = module.test(ids)
+    for _ in 0..<100 { await Task.yield() }
+    changed = true
+    gate.release()
+    await module.wait(for: batch)
+    #expect(calls == 3)
+    #expect(module.history(for: ids[3]).isEmpty)
+    #expect(module.isCooling(ids[3]))
+  }
+
+  @Test func urlValidationAllowsHTTPOnly() {
+    #expect(ServerConnectivity.validURL("http://example.com/check") != nil)
+    #expect(ServerConnectivity.validURL("https://example.com/check?q=secret") == nil)
+    for value in [
+      "file:///tmp/check", "ftp://example.com", "https:///", "example.com", "http://x/#fragment",
+    ] {
+      #expect(ServerConnectivity.validURL(value) == nil)
+    }
+  }
+
+}
+
+extension SslocalServerDocument {
+  fileprivate static var fixture: Self {
+    Self(
+      id: "test", server: "example.com", serverPort: 443, password: "secret",
+      method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticFileCollectorTests.swift b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticFileCollectorTests.swift
new file mode 100644
index 000000000..211856d05
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticFileCollectorTests.swift
@@ -0,0 +1,57 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 文件事实收集：只读存在性/权限/大小/时间，永不读内容。
+final class DiagnosticFileCollectorTests: XCTestCase {
+  private var directory: URL!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-diag-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    // 临时目录默认带 0755：对齐产品基线（运行时目录 0700）再断言。
+    try FileManager.default.setAttributes(
+      [.posixPermissions: 0o700], ofItemAtPath: directory.path)
+  }
+
+  override func tearDownWithError() throws {
+    try? FileManager.default.removeItem(at: directory)
+    try super.tearDownWithError()
+  }
+
+  func testCollectsPermissionsSizeAndTimeForFile() throws {
+    let url = directory.appendingPathComponent("catalog.json")
+    try Data(repeating: 0x41, count: 123).write(to: url)
+    try FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: url.path)
+    let before = Date().addingTimeInterval(-60)
+
+    let facts = DiagnosticFileCollector.collect(label: "catalog.json", url: url)
+
+    XCTAssertTrue(facts.exists)
+    XCTAssertFalse(facts.isDirectory)
+    XCTAssertEqual(facts.permissionsOctal, "0600")
+    XCTAssertEqual(facts.sizeBytes, 123)
+    let modified = try XCTUnwrap(facts.modifiedAt)
+    XCTAssertGreaterThanOrEqual(modified, before)
+  }
+
+  func testCollectsDirectoryPermissionsWithoutSize() throws {
+    let facts = DiagnosticFileCollector.collect(label: "运行时目录", url: directory)
+
+    XCTAssertTrue(facts.exists)
+    XCTAssertTrue(facts.isDirectory)
+    XCTAssertEqual(facts.permissionsOctal, "0700")
+  }
+
+  func testMissingFileReportsNonExistenceWithNoFacts() {
+    let facts = DiagnosticFileCollector.collect(
+      label: "agent.pid", url: directory.appendingPathComponent("missing"))
+
+    XCTAssertFalse(facts.exists)
+    XCTAssertNil(facts.permissionsOctal)
+    XCTAssertNil(facts.sizeBytes)
+    XCTAssertNil(facts.modifiedAt)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticLogIntakeTests.swift b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticLogIntakeTests.swift
new file mode 100644
index 000000000..1947e8ceb
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticLogIntakeTests.swift
@@ -0,0 +1,154 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 日志视图 intake：tail 窗口、行归一、时间归并与过滤。
+struct DiagnosticLogIntakeTests {
+  // MARK: - tail 窗口
+
+  @Test func readsWholeTailWithinLimit() throws {
+    let url = try temporaryLogFile(content: "AAAA\nBBBB\nCC\n")
+    #expect(DiagnosticLogIntake.readTail(of: url, maxBytes: 1024) == "AAAA\nBBBB\nCC\n")
+  }
+
+  @Test func dropsPartialFirstLineAtWindowBoundary() throws {
+    let url = try temporaryLogFile(content: "AAAA\nBBBB\nCC\n")  // 共 13 字节
+    // 窗口切在第二行中间：末 6 字节是 "BB\nCC\n"，起始半行「BB」应丢弃。
+    #expect(DiagnosticLogIntake.readTail(of: url, maxBytes: 6) == "CC\n")
+  }
+
+  @Test func dropsPartialCRLFLineAtWindowBoundary() throws {
+    let url = try temporaryLogFile(content: "AAAA\r\nBBBB\r\nCC\r\n")
+    #expect(DiagnosticLogIntake.readTail(of: url, maxBytes: 8) == "CC\r\n")
+  }
+
+  @Test func missingFileReturnsNil() {
+    let url = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-tail-\(UUID().uuidString)/agent.log")
+    #expect(DiagnosticLogIntake.readTail(of: url) == nil)
+  }
+
+  // MARK: - 行归一与归并
+
+  @Test func crlfOutputKeepsFollowingErrorsVisible() throws {
+    let pipe = Pipe()
+    let intake = SslocalOutputIntake(
+      destinations: [SslocalStandardErrorDestination(handle: pipe.fileHandleForWriting)])
+    intake.write(Data("INFO first\r\nERROR second\r\n".utf8))
+    try pipe.fileHandleForWriting.close()
+    let tail = try #require(
+      String(data: pipe.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8))
+    try pipe.fileHandleForReading.close()
+
+    let rows = DiagnosticLogIntake.rows(events: [], tail: tail)
+    #expect(rows.map(\.text) == ["INFO first\r", "ERROR second\r"])
+    #expect(rows.map(\.level) == [.info, .error])
+    #expect(DiagnosticLogFilter(level: .errors).apply(rows).map(\.text) == ["ERROR second\r"])
+  }
+
+  @Test func mergesAcrossDaylightSavingFallback() throws {
+    let clock = ISO8601DateFormatter()
+    let store = RuntimeEventStore()
+    store.append(
+      event: .agentRegistered,
+      timestamp: try #require(clock.date(from: "2026-11-01T06:00:00Z")))
+    let tail = """
+      2026-11-01 01:59:00.000 -0400 [info] [wrapper] before fallback
+      2026-11-01 01:01:00.000 -0500 [error] [wrapper] after fallback
+      """
+
+    let rows = DiagnosticLogIntake.rows(events: store.snapshot, tail: tail)
+    #expect(rows.map(\.text) == ["before fallback", "launch agent registered", "after fallback"])
+    #expect(rows.allSatisfy { $0.timestamp != nil })
+  }
+
+  @Test func mergesRowsByTimestamp() {
+    let store = RuntimeEventStore()
+    store.append(
+      event: .contractWritten(serverCount: 1), timestamp: Date(timeIntervalSince1970: 3_000))
+    store.append(event: .agentRegistered, timestamp: Date(timeIntervalSince1970: 5_000))
+    let tail = [
+      LogLine(
+        timestamp: Date(timeIntervalSince1970: 4_000), level: .warning, source: .sslocal,
+        text: "retry"
+      ).rendered,
+      LogLine(
+        timestamp: Date(timeIntervalSince1970: 1_000), level: .error, source: .sslocal,
+        text: "boom"
+      ).rendered,
+    ].joined(separator: "\n")
+
+    let rows = DiagnosticLogIntake.rows(events: store.snapshot, tail: tail)
+
+    #expect(
+      rows.map(\.text) == [
+        "boom", "contract written (servers=1)", "retry", "launch agent registered",
+      ])
+    #expect(rows.map(\.source) == [.sslocal, .gui, .sslocal, .gui])
+    #expect(rows.map(\.level) == [.error, .info, .warning, .info], "GUI 行级别取自事件路由级别")
+  }
+
+  @Test func legacyRowsSortFirstAndKeepRawText() {
+    let store = RuntimeEventStore()
+    store.append(event: .agentRegistered, timestamp: Date(timeIntervalSince1970: 5_000))
+    let tail = [
+      "ssxng: old event without timestamp",
+      LogLine(
+        timestamp: Date(timeIntervalSince1970: 2_000), level: .info, source: .sslocal,
+        text: "recent"
+      ).rendered,
+    ].joined(separator: "\n")
+
+    let rows = DiagnosticLogIntake.rows(events: store.snapshot, tail: tail)
+
+    #expect(
+      rows.map(\.text) == [
+        "ssxng: old event without timestamp", "recent", "launch agent registered",
+      ])
+    #expect(rows.first?.source == .wrapper)
+    #expect(rows.first?.timestamp == nil, "旧格式行时间未知，排在最前保持文件内顺序")
+  }
+
+  @Test func emptyTailYieldsOnlyEventRows() {
+    let store = RuntimeEventStore()
+    store.append(event: .agentRegistered, timestamp: Date(timeIntervalSince1970: 5_000))
+    #expect(DiagnosticLogIntake.rows(events: store.snapshot, tail: nil).count == 1)
+    #expect(DiagnosticLogIntake.rows(events: store.snapshot, tail: "").count == 1)
+  }
+
+  @Test func keepsBlankLinesFromTailForRawFidelity() {
+    let rows = DiagnosticLogIntake.rows(events: [], tail: "first\n\nthird\n")
+    #expect(rows.map(\.text) == ["first", "", "third"], "空行是行内容，只排除结尾行分隔符")
+  }
+
+  // MARK: - 过滤
+
+  @Test func filterCombinesLevelAndSource() {
+    let rows = [
+      LogLine(timestamp: nil, level: .error, source: .gui, text: "a"),
+      LogLine(timestamp: nil, level: .warning, source: .wrapper, text: "b"),
+      LogLine(timestamp: nil, level: .info, source: .sslocal, text: "c"),
+      LogLine(timestamp: nil, level: .error, source: .sslocal, text: "d"),
+    ]
+    #expect(DiagnosticLogFilter().apply(rows).count == 4)
+    #expect(
+      DiagnosticLogFilter(level: .warnings).apply(rows).map(\.text) == ["a", "b", "d"],
+      "警告+错误 = warning 与 error")
+    #expect(DiagnosticLogFilter(level: .errors).apply(rows).map(\.text) == ["a", "d"])
+    #expect(DiagnosticLogFilter(source: .sslocal).apply(rows).map(\.text) == ["c", "d"])
+    #expect(
+      DiagnosticLogFilter(level: .errors, source: .sslocal).apply(rows).map(\.text) == ["d"])
+  }
+
+  // MARK: - 夹具
+
+  private func temporaryLogFile(content: String) throws -> URL {
+    let directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-tail-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let url = directory.appendingPathComponent("agent.log")
+    try Data(content.utf8).write(to: url)
+    return url
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticLogTableRowTests.swift b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticLogTableRowTests.swift
new file mode 100644
index 000000000..684236d09
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticLogTableRowTests.swift
@@ -0,0 +1,96 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct DiagnosticLogTableRowTests {
+  @Test func selectionSurvivesTailCroppingAndAppendingIdenticalLines() throws {
+    try withLogFile(Data("same\nsame\n".utf8)) { url in
+      let original = try entries(at: url)
+      var selection: Set<DiagnosticLogEntry.ID> = [original[1].id]
+      let writer = try FileHandle(forWritingTo: url)
+      defer { try? writer.close() }
+      try writer.seekToEnd()
+      try writer.write(contentsOf: Data("same\n".utf8))
+
+      // 读取末尾两行；窗口边界处丢弃首行，保留原来选中的第二行。
+      let refreshed = try entries(at: url, maxBytes: 11)
+      #expect(refreshed.count == 2)
+      #expect(refreshed[0].id == original[1].id)
+      #expect(refreshed[1].id != original[1].id)
+      selection.formIntersection(refreshed.map(\.id))
+      #expect(selection == [original[1].id])
+      #expect(refreshed.filter { selection.contains($0.id) }.map(\.line.rendered) == ["same"])
+
+      var removedSelection: Set<DiagnosticLogEntry.ID> = [original[0].id]
+      removedSelection.formIntersection(refreshed.map(\.id))
+      #expect(removedSelection.isEmpty)
+    }
+  }
+
+  @Test func blankAndMalformedUTF8LinesKeepTheirBytePositions() throws {
+    let data = Data([0xFF, 10]) + Data("\n\n末行\r\n".utf8)
+    try withLogFile(data) { url in
+      let original = try entries(at: url)
+      let refreshed = try entries(at: url, maxBytes: data.count - 1)
+      #expect(original.map(\.line.text) == ["�", "", "", "末行\r"])
+      #expect(refreshed.map(\.id) == Array(original.dropFirst()).map(\.id))
+      #expect(Set(original.map(\.id)).count == original.count)
+    }
+  }
+
+  @Test func replacingOrRewritingFileDoesNotReuseSelectedRow() throws {
+    try withLogFile(Data("same\n".utf8)) { url in
+      let original = try entries(at: url)
+      // 原子替换保留原文，但创建新文件；不应把旧文件的选择交给新文件。
+      try Data("same\n".utf8).write(to: url, options: .atomic)
+      #expect(try entries(at: url).first?.id != original[0].id)
+
+      let replacement = try entries(at: url)
+      let writer = try FileHandle(forWritingTo: url)
+      defer { try? writer.close() }
+      try writer.truncate(atOffset: 0)
+      try writer.write(contentsOf: Data("other\n".utf8))
+      #expect(try entries(at: url).first?.id != replacement[0].id)
+    }
+  }
+
+  @Test func guiIdentitySurvivesRingBufferEvictionAndFiltering() {
+    let events = RuntimeEventStore(capacity: 2)
+    let stamp = Date(timeIntervalSince1970: 100)
+    events.append(event: .agentRegistered, timestamp: stamp)
+    events.append(event: .agentRegistered, timestamp: stamp)
+    let original = DiagnosticLogIntake.entries(events: events.snapshot, tail: nil)
+    events.append(event: .agentRegistered, timestamp: stamp)
+    let refreshed = DiagnosticLogIntake.entries(events: events.snapshot, tail: nil)
+    #expect(refreshed[0].id == original[1].id)
+    #expect(refreshed[1].id != original[1].id)
+    let filtered = refreshed.filter { DiagnosticLogFilter(source: .gui).admits($0.line) }
+    #expect(filtered.map(\.id) == refreshed.map(\.id))
+  }
+
+  @Test func showsUnknownTimestampAndPreservesCompleteMessage() {
+    let message = "long message\nwith a second line\r"
+    let row = DiagnosticLogEntry(
+      id: .gui(0),
+      line: LogLine(timestamp: nil, level: .warning, source: .gui, text: message))
+    #expect(row.timestampText == "—")
+    #expect(row.sourceText == "GUI")
+    #expect(row.line.text == message)
+    #expect(row.line.rendered == message)
+  }
+
+  private func entries(at url: URL, maxBytes: Int = 64 * 1024) throws -> [DiagnosticLogEntry] {
+    let tail = try #require(DiagnosticLogIntake.readTailSnapshot(of: url, maxBytes: maxBytes))
+    return DiagnosticLogIntake.entries(events: [], tail: tail)
+  }
+
+  private func withLogFile(_ data: Data, perform: (URL) throws -> Void) throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let url = directory.appendingPathComponent("agent.log")
+    try data.write(to: url)
+    try perform(url)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticReportTests.swift b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticReportTests.swift
new file mode 100644
index 000000000..226e70b0e
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticReportTests.swift
@@ -0,0 +1,238 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 诊断导出脱敏验收：投毒夹具把敏感值埋进目录、
+/// 契约与状态字段，验证导出报告只含 允许的元数据类目，且导出动作自身
+/// 不带出任何敏感值。
+final class DiagnosticReportTests: XCTestCase {
+  private let password = "SECRET-PASSWORD"
+  private let pluginOpts = "obfs=http;obfs-host=SECRET-HOST"
+  private let address = "203.0.113.7"
+  private let remark = "香港 01"
+  private let groupName = "SECRET-GROUP"
+  private let subURL = "https://user:SECRET@example.com/sub/CLASH-SECRET?token=TOKEN-SECRET"
+
+  private var secrets: [String] {
+    [password, pluginOpts, address, remark, groupName, "CLASH-SECRET", "TOKEN-SECRET"]
+  }
+
+  /// 投毒目录：分组名、服务器地址、备注、插件参数全为敏感值；含订阅子树、
+  /// 插件节点，用于覆盖数量统计分支。
+  private func poisonedCatalog() throws -> ConfigurationCatalog {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup(groupName)
+    _ = try catalog.addServer(
+      ServerFields(
+        address: address,
+        port: 8388,
+        encryptionMethod: "aes-256-gcm",
+        password: password,
+        remark: remark,
+        pluginProgram: "v2ray-plugin",
+        pluginOptions: pluginOpts
+      ),
+      to: group)
+    let subscriptionGroup = try catalog.addGroup(groupName + "-sub", source: .subscription)
+    _ = try catalog.addServer(
+      ServerFields(
+        address: address,
+        port: 8389,
+        encryptionMethod: "chacha20-ietf-poly1305",
+        password: password,
+        remark: remark
+      ),
+      source: .subscription,
+      to: subscriptionGroup)
+    return catalog
+  }
+
+  private func poisonedSnapshot(catalog: ConfigurationCatalog) -> DiagnosticSnapshot {
+    var snapshot = DiagnosticSnapshot()
+    snapshot.appVersion = "版本 2.0.0，构建 2"
+    snapshot.systemSummary = "macOS Version 15.0（Build 24A335），arm64"
+    snapshot.proxyState = .activationFailed(
+      reason: AppPresentation.message(
+        for: ActivationFailure.invalidLeaf(
+          node: NodeID(rawValue: "leaf-1"),
+          reason: .pluginNotProvided(program: "simple-obfs"))))
+    snapshot.hasActiveTarget = true
+    snapshot.listen = RuntimeListenFacts(listen: ProxyListeningConfiguration())
+    snapshot.runtimeDocumentSummary = Redactor.documentSummary(
+      ProxyRuntimeFixture.makeDocument(
+        serverAddress: address, password: password, pluginOpts: pluginOpts))
+    snapshot.catalogFacts = DiagnosticCatalogFacts(
+      counts: DiagnosticReportBuilder.counts(in: catalog))
+    snapshot.fileFacts = [
+      DiagnosticFileFacts(
+        label: "sslocal-active.json", exists: true, isDirectory: false,
+        permissionsOctal: "0600", sizeBytes: 512,
+        modifiedAt: Date(timeIntervalSince1970: 1_758_000_000)),
+      DiagnosticFileFacts(
+        label: "agent.pid", exists: false, isDirectory: false,
+        permissionsOctal: nil, sizeBytes: nil, modifiedAt: nil),
+    ]
+    snapshot.eventLines = [
+      RuntimeLogEvent.contractWritten(serverCount: 2).description,
+      RuntimeLogEvent.endpointProbeFailed(
+        host: "127.0.0.1", port: 1086, detail: "Connection refused"
+      ).description,
+      RuntimeLogEvent.diagnosticsExported.description,
+    ]
+    snapshot.homePathForRedaction = "/Users/SECRETUSER"
+    return snapshot
+  }
+
+  private func assertNoSecrets(
+    _ text: String, file: StaticString = #filePath, line: UInt = #line
+  ) {
+    for secret in secrets {
+      XCTAssertFalse(
+        text.contains(secret),
+        "诊断导出不得包含敏感值「\(secret)」\n实际：\(text)",
+        file: file, line: line)
+    }
+    XCTAssertFalse(
+      text.contains("{"), "诊断导出不得携带 JSON 文档内容", file: file, line: line)
+  }
+
+  /// 验收标准「导出文件经夹具验证不含任何敏感类目」。
+  func testPoisonedFixtureExportContainsOnlyAllowedCategories() throws {
+    let catalog = try poisonedCatalog()
+    let report = DiagnosticReportBuilder.markdown(from: poisonedSnapshot(catalog: catalog))
+
+    assertNoSecrets(report)
+
+    // 允许类目的事实必须在场：状态、数量、权限、存在性、脱敏元数据。
+    XCTAssertTrue(report.contains("激活失败"), "缺少代理状态行：\n\(report)")
+    XCTAssertTrue(report.contains("活动目标：已设置"))
+    XCTAssertTrue(report.contains("局域网监听：关闭"))
+    XCTAssertTrue(report.contains("SOCKS5 端口 11086"))
+    XCTAssertTrue(report.contains("HTTP 端口 11087"))
+    XCTAssertTrue(report.contains("servers=1 protocols=socks,http mode=tcp_and_udp"), "缺少契约脱敏摘要")
+    XCTAssertFalse(report.contains("UDP 中继"), "诊断不应呈现已移除的 UDP 偏好开关")
+    XCTAssertTrue(report.contains("服务器：2（配置插件 1；手动 1 / 订阅 1）"))
+    XCTAssertTrue(report.contains("分组：2"))
+    XCTAssertTrue(report.contains("| sslocal-active.json | 是 | 0600 | 512 |"))
+    XCTAssertTrue(report.contains("| agent.pid | 否 | — | — |"))
+    XCTAssertTrue(report.contains("contract written (servers=2)"))
+    XCTAssertTrue(report.contains("diagnostics report exported (redacted)"))
+  }
+
+  /// 受管插件清单：名称与版本入导出；插件参数仍是敏感值不入。
+  func testManagedPluginSectionListsNameAndVersionWithoutOptions() throws {
+    var snapshot = poisonedSnapshot(catalog: try poisonedCatalog())
+    snapshot.managedPlugins = [
+      DiagnosticPluginFacts(program: "v2ray-plugin", version: "test-version", present: true),
+      DiagnosticPluginFacts(program: "shadow-tls", version: "v3", present: false),
+    ]
+
+    let report = DiagnosticReportBuilder.markdown(from: snapshot)
+
+    XCTAssertTrue(report.contains("## 受管插件"), "缺少受管插件清单：\n\(report)")
+    XCTAssertTrue(report.contains("- v2ray-plugin test-version：已提供"))
+    XCTAssertTrue(report.contains("- shadow-tls v3：缺失"))
+    assertNoSecrets(report)
+  }
+
+  func testEmptyManagedPluginSectionStatesExplicitNone() {
+    let report = DiagnosticReportBuilder.markdown(from: DiagnosticSnapshot())
+    XCTAssertTrue(report.contains("（本版本未打包任何插件）"))
+  }
+
+  /// 监听方式与实际绑定地址进入报告；设置不再收集单独的 LAN 地址。
+  func testAllIPv4ListenerModeReportsItsBindingAddress() {
+    var snapshot = DiagnosticSnapshot()
+    snapshot.listen = RuntimeListenFacts(
+      listen: ProxyListeningConfiguration(listenerMode: .allIPv4Interfaces))
+    snapshot.homePathForRedaction = nil
+
+    let report = DiagnosticReportBuilder.markdown(from: snapshot)
+
+    XCTAssertTrue(report.contains("局域网监听：所有 IPv4 接口（0.0.0.0）"))
+  }
+
+  /// 契约摘要走 Redactor：完整订阅 URL 只保留 scheme+host。
+  func testSubscriptionURLIsReducedToSchemeAndHost() {
+    let summary = Redactor.remoteURL(subURL)
+    let report = DiagnosticReportBuilder.markdown(from: DiagnosticSnapshot())
+
+    XCTAssertFalse(report.contains(subURL))
+    XCTAssertEqual(summary, "https://example.com/…")
+  }
+
+  /// 家目录前缀改写是报告渲染的兜底防线（后自由 detail 已被上游
+  /// 白名单清洗，此防御保留给任何仍携带路径的文本）。
+  func testHomePathRedactionRewritesPrefix() {
+    let text = RuntimeLogEvent.runtimePersistFailed(
+      detail: "/Users/SECRETUSER/Library/Application Support/ShadowsocksX-NG2: errno 13"
+    ).description
+
+    let redacted = DiagnosticReportBuilder.redactingHomePaths(text, home: "/Users/SECRETUSER")
+
+    XCTAssertTrue(redacted.contains("~/Library/Application Support"))
+    XCTAssertFalse(redacted.contains("/Users/SECRETUSER"))
+    XCTAssertEqual(
+      DiagnosticReportBuilder.redactingHomePaths(text, home: nil), text)
+  }
+
+  /// 原始错误文本不属于白名单类目：serviceFailed 只呈现固定状态文案。
+  func testServiceFailedExportsLabelOnly() {
+    var snapshot = DiagnosticSnapshot()
+    snapshot.proxyState = .serviceFailed
+    snapshot.homePathForRedaction = "/Users/SECRETUSER"
+
+    let report = DiagnosticReportBuilder.markdown(from: snapshot)
+
+    XCTAssertTrue(report.contains("- 代理状态：服务管理失败"))
+    XCTAssertFalse(report.contains("服务失败详情"))
+    XCTAssertFalse(report.contains("errno"))
+  }
+
+  /// 空快照（所有可选输入缺省）优雅降级，不崩溃、无占位泄漏。
+  func testEmptySnapshotRendersGracefully() {
+    let report = DiagnosticReportBuilder.markdown(from: DiagnosticSnapshot())
+
+    XCTAssertTrue(report.contains("应用版本：未提供"))
+    XCTAssertTrue(report.contains("配置目录不可用"))
+    XCTAssertTrue(report.contains("（无事件）"))
+    XCTAssertTrue(report.contains("活动目标：未设置"))
+    assertNoSecrets(report)
+  }
+
+  func testCountsCoverServerAndPluginPresence() throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("g")
+    _ = try catalog.addServer(
+      ServerFields(
+        address: address, port: 1, encryptionMethod: "aes-256-gcm",
+        password: password
+      ),
+      to: group)
+    let counts = DiagnosticReportBuilder.counts(in: catalog)
+
+    XCTAssertEqual(
+      counts,
+      DiagnosticReportBuilder.CatalogCounts(
+        servers: 1, groups: 1,
+        serversWithPlugin: 0, manualServers: 1, subscriptionServers: 0))
+  }
+
+  /// 自定义规则诊断摘要：只含数量与内容版本，无原始域名。
+  func testCustomRuleSummaryExportsCountAndVersionWithoutRawDomains() throws {
+    var snapshot = DiagnosticSnapshot()
+    snapshot.customRuleSummary = CustomRuleSummary(
+      count: 3, contentVersion: "abc123def456")
+
+    let report = DiagnosticReportBuilder.markdown(from: snapshot)
+
+    XCTAssertTrue(report.contains("自定义规则：3 条（版本 abc123def456）"))
+    assertNoSecrets(report)
+  }
+
+  /// 自定义规则摘要缺失时明确标注不可用。
+  func testMissingCustomRuleSummaryIsMarkedUnavailable() {
+    let report = DiagnosticReportBuilder.markdown(from: DiagnosticSnapshot())
+    XCTAssertTrue(report.contains("自定义规则：不可用"))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticsLayoutTests.swift b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticsLayoutTests.swift
new file mode 100644
index 000000000..b782e1c2a
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticsLayoutTests.swift
@@ -0,0 +1,126 @@
+import AppKit
+import SwiftUI
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct DiagnosticsLayoutTests {
+  @Test func splitKeepsInitialAndUserAdjustedWidths() async throws {
+    let fixture = makeWindow()
+    defer { fixture.close() }
+    await settle(fixture.host)
+    let split = try #require(descendants(of: NSSplitView.self, in: fixture.host).first)
+    #expect(split.arrangedSubviews[0].frame.width > split.arrangedSubviews[1].frame.width * 2)
+    #expect(split.bounds.width == fixture.host.bounds.width - 60)
+    #expect(split.arrangedSubviews[1].frame.width == 220)
+    split.setPosition(split.bounds.width - split.dividerThickness - 300, ofDividerAt: 0)
+    fixture.events.append(event: .diagnosticsExported)
+    await settle(fixture.host)
+    selectFirstRow(in: fixture.host)
+    await settle(fixture.host)
+    #expect(split.arrangedSubviews[1].frame.width == 300)
+    fixture.window.setContentSize(NSSize(width: 1400, height: 600))
+    await settle(fixture.host)
+    #expect(split.arrangedSubviews[1].frame.width == 300)
+    fixture.reading.cancel()
+    await fixture.reading.value
+  }
+
+  @Test func filtersKeepTheirFramesDuringSelectionAndRefresh() async throws {
+    let fixture = makeWindow()
+    defer { fixture.close() }
+    let host = fixture.host
+    await settle(host)
+    let pickers = descendants(of: NSSegmentedControl.self, in: host)
+    try #require(pickers.count == 2)
+    let initialFrames = pickers.map { $0.convert($0.bounds, to: host) }
+    var observedFrames: [(Int, NSRect)] = []
+    let observers = pickers.enumerated().map { index, picker in
+      picker.postsFrameChangedNotifications = true
+      return NotificationCenter.default.addObserver(
+        forName: NSView.frameDidChangeNotification, object: picker, queue: .main
+      ) { _ in
+        MainActor.assumeIsolated {
+          observedFrames.append((index, picker.convert(picker.bounds, to: host)))
+        }
+      }
+    }
+    defer { observers.forEach(NotificationCenter.default.removeObserver) }
+    for iteration in 0..<6 {
+      let picker = pickers[iteration % pickers.count]
+      picker.selectedSegment = iteration % picker.segmentCount
+      picker.sendAction(picker.action, to: picker.target)
+      await settle(host)
+      selectFirstRow(in: host)
+      fixture.events.append(event: .diagnosticsExported)
+      await settle(host)
+      let frames = descendants(of: NSSegmentedControl.self, in: host)
+        .map { $0.convert($0.bounds, to: host) }
+      #expect(frames == initialFrames)
+    }
+    for (index, frame) in observedFrames {
+      #expect(frame == initialFrames[index])
+    }
+    fixture.reading.cancel()
+    await fixture.reading.value
+  }
+
+  @MainActor
+  private struct HostedDiagnostics {
+    let events: RuntimeEventStore
+    let host: NSHostingView<DiagnosticsView>
+    let window: NSWindow
+    let reading: Task<Void, Never>
+
+    func close() {
+      reading.cancel()
+      window.orderOut(nil)
+      window.contentView = nil
+    }
+  }
+
+  private func makeWindow() -> HostedDiagnostics {
+    let events = RuntimeEventStore()
+    events.append(event: .agentRegistered)
+    let workflow = DiagnosticsWorkflow(
+      runtimeFacts: FakeRuntimeFacts(), events: events, catalogFacts: { nil },
+      agentLogTail: { DiagnosticLogTail(text: "ERROR example\n", fileID: 1, offset: 0) },
+      pollInterval: .milliseconds(10))
+    let state = DiagnosticsWindowState()
+    let host = NSHostingView(
+      rootView: DiagnosticsView(
+        diagnostics: workflow, windowState: state,
+        clipboard: AppKitTextClipboard(pasteboard: .withUniqueName()),
+        exporter: InMemoryDiagnosticReportExporter()))
+    let window = NSWindow(
+      contentRect: NSRect(x: -10000, y: -10000, width: 1200, height: 600),
+      styleMask: [.titled, .resizable], backing: .buffered, defer: false)
+    window.isReleasedWhenClosed = false
+    window.contentView = host
+    window.orderFront(nil)
+    let reading = Task { await workflow.readWhileActive() }
+    return HostedDiagnostics(events: events, host: host, window: window, reading: reading)
+  }
+
+  private func selectFirstRow(in host: NSView) {
+    for table in descendants(of: NSTableView.self, in: host) where table.numberOfRows > 0 {
+      table.selectRowIndexes(IndexSet(integer: 0), byExtendingSelection: false)
+    }
+  }
+
+  private func settle(_ view: NSView) async {
+    for _ in 0..<3 {
+      await withCheckedContinuation { continuation in
+        DispatchQueue.main.async {
+          view.layoutSubtreeIfNeeded()
+          continuation.resume()
+        }
+      }
+    }
+  }
+
+  private func descendants<T: NSView>(of type: T.Type, in view: NSView) -> [T] {
+    (view as? T).map { [$0] } ?? view.subviews.flatMap { descendants(of: type, in: $0) }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticsReportWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticsReportWorkflowTests.swift
new file mode 100644
index 000000000..d39fa02c5
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticsReportWorkflowTests.swift
@@ -0,0 +1,171 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 诊断报告准备的安全验收：投毒夹具验证导出只含白名单清洗后的
+/// 事件与聚合事实；raw 日志视图与报告严格分离；safe projection 无法构造时
+/// 返回 typed failure 且不产生报告（ADR-0006）。
+@MainActor
+final class DiagnosticsReportWorkflowTests: DiagnosticsWorkflowTestCase {
+  // MARK: - 报告安全验收
+
+  func testReportContainsSafeFactsAndExcludesPoisonedSources() throws {
+    appendPoisonedEvents()
+    let workflow = makeWorkflow(
+      catalog: { try? self.poisonedCatalogFacts() },
+      agentLog: {
+        "sslocal ERROR: connect to \(self.address):8388 failed: auth \(self.password)\n"
+      },
+      fileFacts: {
+        [
+          DiagnosticFileFacts(
+            label: "sslocal-active.json", exists: true, isDirectory: false,
+            permissionsOctal: "0600", sizeBytes: 512,
+            modifiedAt: Date(timeIntervalSince1970: 1_758_000_000)),
+          DiagnosticFileFacts(
+            label: "agent.pid", exists: false, isDirectory: false,
+            permissionsOctal: nil, sizeBytes: nil, modifiedAt: nil),
+        ]
+      },
+      managedPlugins: {
+        [
+          DiagnosticPluginFacts(program: "v2ray-plugin", version: "test-version", present: true),
+          DiagnosticPluginFacts(program: "shadow-tls", version: "v3", present: false),
+        ]
+      },
+      homePath: { self.home })
+    facts.proxyState = .running
+    facts.hasActiveTarget = true
+    facts.contractSummary = "servers=1 protocols=socks mode=tcp_and_udp"
+
+    let report = try reportText(workflow.prepareReport())
+
+    assertNoSecrets(report)
+
+    // 允许类目的事实必须在场：状态、端口、契约摘要、数量、插件、文件行、生成时间。
+    XCTAssertTrue(report.contains("- 代理状态：运行中"))
+    XCTAssertTrue(report.contains("- 活动目标：已设置"))
+    XCTAssertTrue(report.contains("- 局域网监听：关闭"))
+    XCTAssertTrue(report.contains("SOCKS5 端口 11086"))
+    XCTAssertTrue(report.contains("servers=1 protocols=socks mode=tcp_and_udp"))
+    XCTAssertTrue(report.contains("服务器：2（配置插件 1；手动 1 / 订阅 1）"))
+    XCTAssertTrue(report.contains("分组：2"))
+    XCTAssertTrue(report.contains("- v2ray-plugin test-version：已提供"))
+    XCTAssertTrue(report.contains("- shadow-tls v3：缺失"))
+    XCTAssertTrue(report.contains("| sslocal-active.json | 是 | 0600 | 512 |"))
+    XCTAssertTrue(report.contains("| agent.pid | 否 | — | — |"))
+    let expectedTime = Self.reportTimestamp(Date(timeIntervalSince1970: 1_758_000_000))
+    XCTAssertTrue(report.contains("生成时间：\(expectedTime)"), "报告应携带生成时间")
+  }
+
+  // MARK: - 事件白名单
+
+  func testEventAllowlistKeepsCountsAndPortsButDropsFreeDetail() throws {
+    appendPoisonedEvents()
+    let workflow = makeWorkflow(homePath: { self.home })
+
+    let report = try reportText(workflow.prepareReport())
+
+    // 白名单允许的类别与安全字段（数量、端口、领域点名原因）保留。
+    XCTAssertTrue(report.contains("contract written (servers=3)"))
+    XCTAssertTrue(report.contains("local endpoint not ready (port=11086)"))
+    XCTAssertTrue(report.contains("launch agent register failed"))
+    XCTAssertTrue(report.contains("listen not established within deadline"))
+    XCTAssertTrue(report.contains("runtime metadata persist failed"))
+    XCTAssertTrue(report.contains("settings unreadable, falling back to factory defaults"))
+    XCTAssertTrue(
+      report.contains("activation failed: 激活目标 leaf-9 的插件 simple-obfs 未随 app 提供"),
+      "领域点名原因按白名单决策进入报告")
+    assertNoSecrets(report)
+  }
+
+  // MARK: - raw 日志视图与报告的分离（ADR-0006）
+
+  func testRawLogViewServesExplicitViewButReportExcludesIt() async throws {
+    appendPoisonedEvents()
+    let rawTail = "wrapper stderr \(password) \(address)\n"
+    let workflow = makeWorkflow(agentLog: { rawTail }, homePath: { self.home })
+
+    // 读取循环提供 raw 投影（显式查看/复制的唯一来源）。
+    let task = Task { await workflow.readWhileActive() }
+    await waitUntil(workflow.logView.rows.contains { $0.text.hasPrefix("wrapper stderr") })
+    XCTAssertTrue(
+      workflow.logView.rows.contains {
+        $0.source == .gui && $0.text.contains("SECRET-PROBE-DETAIL")
+      },
+      "raw 事件行保留 detail 供本地排障")
+    XCTAssertTrue(
+      workflow.logView.rows.contains { $0.text.contains(password) },
+      "raw 日志视图是显式本地查看面，正文不改写")
+    task.cancel()
+    await task.value
+
+    let report = try reportText(workflow.prepareReport())
+    XCTAssertFalse(report.contains("wrapper stderr"), "raw wrapper 日志不得进入报告")
+    assertNoSecrets(report)
+  }
+
+  // MARK: - best-effort 缺失标注
+
+  func testUnavailableFactSourcesAreMarkedAndOthersRemain() throws {
+    facts.proxyState = .running
+    facts.contractSummary = nil
+    let workflow = makeWorkflow(
+      agentLog: { nil },
+      fileFacts: {
+        [
+          DiagnosticFileFacts(
+            label: "agent.pid", exists: false, isDirectory: false,
+            permissionsOctal: nil, sizeBytes: nil, modifiedAt: nil)
+        ]
+      })
+
+    let report = try reportText(workflow.prepareReport())
+
+    XCTAssertTrue(report.contains("- 配置目录不可用"), "目录缺失须明确标注")
+    XCTAssertTrue(report.contains("- 运行时契约摘要：不可用"), "契约缺失须明确标注")
+    XCTAssertTrue(report.contains("| agent.pid | 否 | — | — |"))
+    XCTAssertTrue(report.contains("- 代理状态：运行中"), "其余可用事实保留")
+  }
+
+  // MARK: - 报告 builder 只接受已裁剪事实
+
+  func testRenderingReceivesTrimmedFactsOnly() throws {
+    appendPoisonedEvents()
+    var captured: [DiagnosticSnapshot] = []
+    let workflow = makeWorkflow(
+      catalog: { try? self.poisonedCatalogFacts() },
+      agentLog: { "SECRET raw tail" },
+      homePath: { self.home },
+      capture: { captured.append($0) })
+
+    _ = workflow.prepareReport()
+
+    XCTAssertEqual(captured.count, 1)
+    let snapshot = try XCTUnwrap(captured.first)
+    // 快照只携带聚合事实：计数不含任何敏感值，事件行是白名单清洗文本。
+    XCTAssertEqual(snapshot.catalogFacts?.counts.servers, 2)
+    XCTAssertEqual(snapshot.catalogFacts?.counts.groups, 2)
+    XCTAssertEqual(snapshot.eventLines.count, events.snapshot.count)
+    for line in snapshot.eventLines {
+      for secret in secrets {
+        XCTAssertFalse(line.contains(secret), "快照事件行不得携带「\(secret)」")
+      }
+    }
+    XCTAssertEqual(snapshot.homePathForRedaction, home, "脱敏基准随事实源注入")
+  }
+
+  func testRenderingFailureYieldsTypedFailureWithoutCompletion() {
+    let workflow = makeWorkflow(render: { _ in nil })
+
+    guard case .failed(.encodingFailed) = workflow.prepareReport() else {
+      XCTFail("safe projection 无法构造时应返回 typed failure")
+      return
+    }
+    XCTAssertFalse(
+      events.snapshot.contains {
+        if case .diagnosticsExported = $0.event { return true } else { return false }
+      },
+      "报告未生成就不得登记导出完成")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticsWorkflowLifecycleTests.swift b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticsWorkflowLifecycleTests.swift
new file mode 100644
index 000000000..f36e31b58
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Diagnostics/DiagnosticsWorkflowLifecycleTests.swift
@@ -0,0 +1,156 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 诊断工作流的读取生命周期与导出登记测试：安全摘要共用
+/// projection、只读收集、读取代际与取消语义、导出完成只在显式确认后登记、
+/// 目录事实缝只输出聚合事实。
+@MainActor
+final class DiagnosticsWorkflowLifecycleTests: DiagnosticsWorkflowTestCase {
+  // MARK: - 安全摘要
+
+  func testSummaryTracksRuntimeFactsWhileReading() async throws {
+    let workflow = makeWorkflow()
+    XCTAssertEqual(workflow.summary.proxyState, .off)
+    XCTAssertFalse(workflow.summary.hasActiveTarget)
+
+    let task = Task { await workflow.readWhileActive() }
+    facts.proxyState = .running
+    facts.hasActiveTarget = true
+    await waitUntil(
+      workflow.summary == DiagnosticSummary(proxyState: .running, hasActiveTarget: true))
+    task.cancel()
+    await task.value
+  }
+
+  // MARK: - 导出完成登记
+
+  func testExportCompletionRecordedOnlyAfterExplicitConfirmation() throws {
+    let workflow = makeWorkflow(catalog: { DiagnosticCatalogFacts() })
+
+    guard case .ready = workflow.prepareReport() else {
+      XCTFail("标准事实源应产出 ready 报告")
+      return
+    }
+    XCTAssertTrue(
+      events.snapshot.isEmpty, "打开面板/准备报告不得登记导出完成")
+
+    workflow.noteExportCompleted()
+
+    XCTAssertEqual(events.snapshot.last?.event, .diagnosticsExported)
+  }
+
+  // MARK: - 只读与读取生命周期
+
+  func testCollectionIsReadOnly() async throws {
+    let fileURL = workDir.appendingPathComponent("catalog.json")
+    try Data("{\"servers\":1}".utf8).write(to: fileURL)
+    try FileManager.default.setAttributes(
+      [.posixPermissions: 0o600], ofItemAtPath: fileURL.path)
+    let fileFacts: @MainActor @Sendable () -> [DiagnosticFileFacts] = {
+      [DiagnosticFileCollector.collect(label: "catalog.json", url: fileURL)]
+    }
+    let beforeFacts = fileFacts()
+    let beforeContents = try Data(contentsOf: fileURL)
+
+    var counter = 0
+    let workflow = makeWorkflow(
+      catalog: { DiagnosticCatalogFacts() },
+      agentLog: {
+        counter += 1
+        return "tail-\(counter)"
+      },
+      fileFacts: fileFacts)
+    let initialSummary = workflow.summary
+    let task = Task { await workflow.readWhileActive() }
+    // 计数闭包每次轮询都产生新值：等待「首个 tail 投影到达」而非具体值。
+    await waitUntil(workflow.logView.rows.contains { $0.text.hasPrefix("tail-") })
+    _ = workflow.prepareReport()
+    task.cancel()
+    await task.value
+
+    XCTAssertEqual(fileFacts(), beforeFacts, "收集不得改变文件元数据")
+    XCTAssertEqual(try Data(contentsOf: fileURL), beforeContents, "收集不得改变文件内容")
+    XCTAssertEqual(workflow.summary, initialSummary, "收集不得改变 runtime 事实")
+    // 凭据与系统代理设置不在 workflow 的依赖面内：module 结构上不可触达。
+  }
+
+  /// 读取代际：新一代读取进入后，旧循环必须退场，不得再发布
+  /// 旧代结果覆盖最新 projection。
+  func testNewerReadGenerationSupersedesOlderLoop() async throws {
+    var counter = 0
+    let workflow = makeWorkflow(agentLog: {
+      counter += 1
+      return "tail-\(counter)"
+    })
+
+    let older = Task { await workflow.readWhileActive() }
+    await waitUntil(workflow.logView.rows.contains { $0.text.hasPrefix("tail-") })
+
+    let newer = Task { await workflow.readWhileActive() }
+    // 旧循环最迟在下一个轮询间隔随代际守卫退出。
+    let olderExited = await withTaskGroup(of: Bool.self) { group in
+      group.addTask {
+        await older.value
+        return true
+      }
+      group.addTask {
+        try? await Task.sleep(for: .seconds(2))
+        return false
+      }
+      let first = await group.next() ?? false
+      group.cancelAll()
+      return first
+    }
+    XCTAssertTrue(olderExited, "旧一代读取循环应在新一代进入后退场")
+
+    newer.cancel()
+    await newer.value
+    XCTAssertTrue(
+      workflow.logView.rows.contains { $0.text.hasPrefix("tail-") }, "最新 projection 保持")
+  }
+
+  func testCancellingReadStopsPublishingNewProjections() async throws {
+    var counter = 0
+    let workflow = makeWorkflow(agentLog: {
+      counter += 1
+      return "tail-\(counter)"
+    })
+
+    let task = Task { await workflow.readWhileActive() }
+    await waitUntil(workflow.logView.rows.contains { $0.text.hasPrefix("tail-") })
+    task.cancel()
+    await task.value
+    let frozen = workflow.logView
+
+    events.append(event: .agentRegistered, timestamp: Date())
+    try await Task.sleep(for: .milliseconds(100))
+
+    XCTAssertEqual(workflow.logView, frozen, "取消读取后不得再发布新 projection")
+  }
+
+  // MARK: - 目录事实缝
+
+  func testCatalogWorkflowProvidesAggregateDiagnosticFactsOnly() async throws {
+    let fileURL = workDir.appendingPathComponent("catalog.json")
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: makeTestCatalogStore(fileURL: fileURL), runtime: FakeCatalogRuntime())
+    let catalogWorkflow = makeCatalogWorkflow(
+      coordinator: coordinator,
+      plugins: ActivationFixture.TestManagedPlugins(pathsByProgram: [:]))
+    // 带受管插件引用的服务器：程序在集内但可执行文件缺失 → 已知无效。
+    let uri =
+      "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@\(address):8388"
+      + "/?plugin=v2ray-plugin%3Bmode%3Dwebsocket"
+    _ = await catalogWorkflow.importServers(from: [.clipboardText(uri)], into: nil)
+
+    let facts = catalogWorkflow.diagnosticCatalogFacts
+
+    XCTAssertEqual(facts.counts.servers, 1)
+    XCTAssertEqual(facts.counts.groups, 0)
+    XCTAssertEqual(facts.counts.serversWithPlugin, 1)
+    XCTAssertEqual(facts.counts.manualServers, 1)
+    XCTAssertEqual(facts.counts.subscriptionServers, 0)
+    XCTAssertEqual(facts.knownInvalidServerCount, 1, "插件缺失的服务器计为已知无效")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Fixtures/RuleSnapshots/china-ipv4.json b/ShadowsocksX-NG2/Tests/Fixtures/RuleSnapshots/china-ipv4.json
new file mode 100644
index 000000000..5c6fc6a1b
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Fixtures/RuleSnapshots/china-ipv4.json
@@ -0,0 +1 @@
+{"lossReport":{"absorbedCount":0,"convertedCount":100,"rejected":{},"skipped":{}},"metadata":{"attribution":"test fixture","converterVersion":"2.0.0","fetchedAt":"2026-10-03T00:00:00Z","inputDigest":"89bc4521a39935e99ba9f5112c46a8afed0ca17da5b4be0e76becdc8f03ca396","license":"MIT","source":{"kind":"china-ipv4","label":"china-ipv4","upstreamVersion":"fixture-v1"},"upstreamReference":"fixture-v1"},"rules":[{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.1.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.3.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.4.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.5.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.6.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.7.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.8.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.9.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.10.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.11.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.12.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.13.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.14.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.15.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.16.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.17.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.19.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.20.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.21.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.22.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.23.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.24.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.25.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.26.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.27.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.28.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.29.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.30.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.31.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.32.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.33.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.34.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.35.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.36.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.37.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.38.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.39.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.40.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.41.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.42.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.43.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.44.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.45.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.46.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.47.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.48.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.49.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.50.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.51.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.52.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.53.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.54.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.55.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.56.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.57.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.58.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.59.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.60.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.61.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.62.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.64.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.65.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.66.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.67.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.68.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.69.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.70.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.71.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.72.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.73.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.74.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.75.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.76.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.77.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.78.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.79.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.80.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.82.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.83.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.84.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.85.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.86.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.88.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.89.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.90.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.91.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.92.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.93.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.94.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.95.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.96.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.97.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.98.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.99.0/24"}}],"schemaVersion":2}
diff --git a/ShadowsocksX-NG2/Tests/Fixtures/RuleSnapshots/geolocation-cn.json b/ShadowsocksX-NG2/Tests/Fixtures/RuleSnapshots/geolocation-cn.json
new file mode 100644
index 000000000..94e2bf6d7
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Fixtures/RuleSnapshots/geolocation-cn.json
@@ -0,0 +1 @@
+{"lossReport":{"absorbedCount":1,"convertedCount":103,"rejected":{},"skipped":{}},"metadata":{"attribution":"test fixture","converterVersion":"2.0.0","fetchedAt":"2026-10-03T00:00:00Z","inputDigest":"ca69e48acc06a1335754d268a641088d306a004dc5e86bc087f9f1184f92d1f4","license":"MIT","source":{"kind":"geolocation-cn","label":"geolocation-cn","upstreamVersion":"fixture-v1"},"upstreamReference":"fixture-v1"},"rules":[{"action":"direct","match":{"kind":"domainSuffix","value":"cn"}},{"action":"direct","match":{"kind":"domainSuffix","value":"example.com"}},{"action":"direct","match":{"kind":"domainExact","value":"api.example.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo0.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo1.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo2.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo3.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo4.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo5.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo6.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo7.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo8.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo9.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo10.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo11.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo12.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo13.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo14.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo15.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo16.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo17.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo18.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo19.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo20.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo21.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo22.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo23.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo24.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo25.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo26.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo27.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo28.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo29.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo30.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo31.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo32.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo33.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo34.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo35.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo36.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo37.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo38.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo39.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo40.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo41.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo42.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo43.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo44.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo45.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo46.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo47.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo48.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo49.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo50.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo51.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo52.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo53.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo54.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo55.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo56.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo57.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo58.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo59.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo60.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo61.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo62.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo63.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo64.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo65.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo66.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo67.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo68.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo69.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo70.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo71.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo72.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo73.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo74.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo75.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo76.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo77.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo78.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo79.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo80.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo81.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo82.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo83.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo84.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo85.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo86.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo87.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo88.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo89.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo90.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo91.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo92.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo93.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo94.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo95.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo96.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo97.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo98.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geo99.example.net"}}],"schemaVersion":2}
diff --git a/ShadowsocksX-NG2/Tests/Fixtures/RuleSnapshots/gfwlist.json b/ShadowsocksX-NG2/Tests/Fixtures/RuleSnapshots/gfwlist.json
new file mode 100644
index 000000000..2f0cd6913
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Fixtures/RuleSnapshots/gfwlist.json
@@ -0,0 +1 @@
+{"lossReport":{"absorbedCount":1,"convertedCount":105,"rejected":{},"skipped":{"urlPrefix":1}},"metadata":{"attribution":"test fixture","converterVersion":"2.0.0","fetchedAt":"2026-10-03T00:00:00Z","inputDigest":"f57c4c422d9a7456f7b2b2e107a753eda00d5a26f7789d1bb16f9c998ea349f7","license":"MIT","source":{"kind":"gfwlist","label":"gfwlist","upstreamVersion":"fixture-v1"},"upstreamReference":"fixture-v1"},"rules":[{"action":"proxy","match":{"kind":"domainSuffix","value":"example.com"}},{"action":"proxy","match":{"kind":"domainExact","value":"exact.example.net"}},{"action":"proxy","match":{"kind":"domainExact","value":"root.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw0.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw1.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw2.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw3.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw4.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw5.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw6.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw7.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw8.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw9.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw10.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw11.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw12.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw13.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw14.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw15.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw16.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw17.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw18.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw19.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw20.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw21.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw22.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw23.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw24.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw25.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw26.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw27.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw28.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw29.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw30.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw31.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw32.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw33.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw34.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw35.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw36.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw37.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw38.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw39.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw40.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw41.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw42.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw43.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw44.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw45.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw46.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw47.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw48.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw49.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw50.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw51.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw52.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw53.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw54.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw55.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw56.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw57.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw58.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw59.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw60.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw61.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw62.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw63.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw64.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw65.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw66.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw67.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw68.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw69.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw70.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw71.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw72.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw73.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw74.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw75.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw76.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw77.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw78.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw79.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw80.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw81.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw82.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw83.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw84.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw85.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw86.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw87.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw88.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw89.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw90.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw91.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw92.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw93.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw94.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw95.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw96.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw97.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw98.example.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw99.example.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"other.example"}},{"action":"direct","match":{"kind":"domainExact","value":"direct.example.net"}}],"schemaVersion":2}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/BundleManagedPluginProviderTests.swift b/ShadowsocksX-NG2/Tests/Plugin/BundleManagedPluginProviderTests.swift
new file mode 100644
index 000000000..d967c113f
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/BundleManagedPluginProviderTests.swift
@@ -0,0 +1,165 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 受管插件提供：受管集内且 bundle 内可执行文件在位才返回
+/// 绝对路径；集外引用与文件缺失都归一为「本版本未提供」（nil → 状态机点名
+/// 拒绝）。路径只从静态事实表派生，绝不拼接引用原文。
+final class BundleManagedPluginProviderTests: XCTestCase {
+  private var bundleRoot: URL!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    bundleRoot = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-plugin-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(
+      at: bundleRoot.appendingPathComponent("Contents/Helpers/Plugins"),
+      withIntermediateDirectories: true)
+
+  }
+
+  override func tearDownWithError() throws {
+    try? FileManager.default.removeItem(at: bundleRoot)
+    try super.tearDownWithError()
+  }
+
+  private var pluginBinaryName: String { ManagedPluginCatalog.plugins[0].program }
+
+  private var pluginURL: URL {
+    bundleRoot.appendingPathComponent("Contents/Helpers/Plugins/\(pluginBinaryName)")
+  }
+
+  private func writePluginBinary(permissions: Int) throws {
+    try Data("#!/bin/sh\n".utf8).write(to: pluginURL)
+    try FileManager.default.setAttributes(
+      [.posixPermissions: permissions], ofItemAtPath: pluginURL.path)
+  }
+
+  private func makeProvider() -> BundleManagedPluginProvider {
+    BundleManagedPluginProvider(bundleURL: bundleRoot)
+  }
+
+  func testMajorVersionAliasResolvesToSameBundledExecutable() throws {
+    try writePluginBinary(permissions: 0o755)
+    XCTAssertEqual(
+      makeProvider().resolve(program: "v2ray-plugin-v1")?.path,
+      makeProvider().resolve(program: "v2ray-plugin")?.path)
+    XCTAssertNotNil(makeProvider().resolve(program: "v2ray-plugin-v1")?.path)
+  }
+
+  func testCloakAliasesUseClientBinaryAndPreserveOptions() throws {
+    let client = bundleRoot.appendingPathComponent("Contents/Helpers/Plugins/ck-client")
+    try Data("#!/bin/sh\n".utf8).write(to: client)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: client.path)
+    let provider = makeProvider()
+    for name in ["cloak", "cloak-v2"] {
+      XCTAssertEqual(provider.resolve(program: name)?.path, client.path)
+      XCTAssertEqual(provider.resolve(program: name)?.mode, .tcpOnly)
+      var catalog = ConfigurationCatalog()
+      var fields = ActivationFixture.plainFields(remark: "Cloak", password: "password")
+      fields.pluginProgram = name
+      fields.pluginOptions = "options"
+      let options = "UID=test;PublicKey=test;ServerName=example.com;EncryptionMethod=plain"
+      fields.password = "pw"
+      fields.pluginOptions = options
+      let id = try catalog.addServer(fields)
+      var machine = ActivationStateMachine()
+      let runtime = try machine.activate(
+        id, in: catalog, plugins: provider,
+        options: RuntimeDocumentOptions(listen: ActivationFixture.listen))
+      let server = try XCTUnwrap(runtime.document.servers.first)
+      XCTAssertEqual(server.plugin, client.path)
+      XCTAssertEqual(server.pluginOpts, options)
+    }
+    XCTAssertNil(provider.resolve(program: "ck-client"))
+    XCTAssertNil(provider.resolve(program: "Cloak"))
+  }
+
+  func testReturnsBundleAbsolutePathForProvidedManagedProgram() throws {
+    try writePluginBinary(permissions: 0o755)
+    let path = try XCTUnwrap(makeProvider().resolve(program: pluginBinaryName)?.path)
+    XCTAssertEqual(path, pluginURL.path, "配置生成的 plugin 字段是 bundle 内绝对路径")
+    XCTAssertTrue(path.hasPrefix(bundleRoot.path))
+  }
+
+  func testMissingBinaryIsNotProvided() {
+    XCTAssertNil(makeProvider().resolve(program: pluginBinaryName)?.path)
+  }
+
+  func testNonExecutableBinaryIsNotProvided() throws {
+    try writePluginBinary(permissions: 0o644)
+    XCTAssertNil(makeProvider().resolve(program: pluginBinaryName)?.path)
+  }
+
+  func testUnmanagedProgramIsNeverProvided() throws {
+    try writePluginBinary(permissions: 0o755)
+    let provider = makeProvider()
+    XCTAssertNil(provider.resolve(program: "obfs-local")?.path, "集外程序名一律未提供")
+    XCTAssertNil(provider.resolve(program: "sslocal")?.path, "非插件的 bundle 内二进制不算插件")
+    XCTAssertNil(provider.resolve(program: "../Helpers/sslocal")?.path, "路径形态引用不拼接")
+    XCTAssertNil(provider.resolve(program: "v2ray-plugin/child")?.path, "子路径引用不拼接")
+    XCTAssertNil(provider.resolve(program: "")?.path)
+  }
+
+  /// 组合根事实：app bundle（生产默认 provider 的取值来源，经 AppArtifact 按
+  /// 构建产物定位、不依赖测试宿主）内受管插件在位——防止打包回归静默断开激
+  /// 活链路（编辑器显示提供而激活拒绝）。
+  func testHostAppBundleProvidesManagedPlugin() throws {
+    let path = try XCTUnwrap(
+      BundleManagedPluginProvider(bundleURL: AppArtifact.bundleURL)
+        .resolve(program: pluginBinaryName)?.path,
+      "app bundle 未嵌入受管插件（先跑 fetch-external-binaries.sh）")
+    XCTAssertTrue(path.hasSuffix("Contents/Helpers/Plugins/\(pluginBinaryName)"))
+  }
+
+  func testHostAppBundleProvidesCloakAliasesAndNotices() throws {
+    let bundle = AppArtifact.bundleURL
+    let provider = BundleManagedPluginProvider(bundleURL: bundle)
+    let path = try XCTUnwrap(provider.resolve(program: "cloak")?.path)
+    XCTAssertTrue(path.hasSuffix("Contents/Helpers/Plugins/ck-client"))
+    XCTAssertEqual(provider.resolve(program: "cloak-v2")?.path, path)
+    let catalog = try BundledDependencyCatalog(bundleURL: bundle)
+    let dependency = try XCTUnwrap(catalog.dependencies.first { $0.id == "ck-client" })
+    for reference in dependency.licenses + dependency.notices {
+      XCTAssertFalse(try catalog.text(at: reference).isEmpty)
+    }
+  }
+
+  /// 与状态机缝的契约：文件缺失 → provider nil → 激活以 pluginNotProvided
+  /// 原子拒绝（app 降级丢插件时同一语义）。
+  func testActivationRejectsMissingPluginByNamedReason() throws {
+    var catalog = ConfigurationCatalog()
+    var fields = ActivationFixture.plainFields(remark: "带插件", password: "password")
+    fields.pluginProgram = pluginBinaryName
+    fields.password = "pw"
+    let id = try catalog.addServer(fields)
+    var machine = ActivationStateMachine()
+
+    ActivationFixture.assertThrows(
+      .invalidLeaf(node: id, reason: .pluginNotProvided(program: pluginBinaryName))
+    ) {
+      try machine.activate(
+        id, in: catalog, plugins: makeProvider(),
+        options: RuntimeDocumentOptions(listen: ActivationFixture.listen))
+    }
+  }
+
+  /// 在位 → 派生文档携带 bundle 内绝对路径（与 opts 解析），激活成功。
+  func testActivationDerivesBundlePathWhenProvided() throws {
+    try writePluginBinary(permissions: 0o755)
+    var catalog = ConfigurationCatalog()
+    var fields = ActivationFixture.plainFields(remark: "带插件", password: "password")
+    fields.pluginProgram = pluginBinaryName
+    fields.password = "pw"
+    let id = try catalog.addServer(fields)
+    var machine = ActivationStateMachine()
+
+    let configuration = try machine.activate(
+      id, in: catalog, plugins: makeProvider(),
+      options: RuntimeDocumentOptions(listen: ActivationFixture.listen))
+
+    let server = try XCTUnwrap(configuration.document.servers.first)
+    XCTAssertEqual(server.plugin, pluginURL.path)
+    XCTAssertNil(server.pluginOpts, "无参数引用时整体省略 pluginOpts")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/BundledDependencyCatalogTests.swift b/ShadowsocksX-NG2/Tests/Plugin/BundledDependencyCatalogTests.swift
new file mode 100644
index 000000000..337c23d3d
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/BundledDependencyCatalogTests.swift
@@ -0,0 +1,53 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct BundledDependencyCatalogTests {
+  @Test func installedCatalogIncludesReadableTextsAndForkProvenance() throws {
+    let catalog = try BundledDependencyCatalog(bundleURL: AppArtifact.bundleURL)
+    #expect(catalog.dependencies.count == 7)
+    for dependency in catalog.dependencies {
+      #expect(!dependency.version.isEmpty)
+      #expect(!dependency.licenses.isEmpty)
+      for reference in dependency.licenses + dependency.notices {
+        #expect(try !catalog.text(at: reference).isEmpty)
+      }
+    }
+    let sslocal = try #require(catalog.dependencies.first { $0.id == "sslocal" })
+    #expect(sslocal.projectURL == "https://github.com/shadowsocks/shadowsocks-rust")
+    #expect(sslocal.sourceURL == "https://github.com/qiuyuzhou/shadowsocks-rust")
+    #expect(sslocal.distributionURL.hasPrefix(sslocal.sourceURL + "/releases/"))
+    let plugins = ManagedPluginCatalog.plugins(in: AppArtifact.bundleURL)
+    #expect(plugins.count == 2)
+    for plugin in plugins {
+      #expect(plugin.dependency == catalog.dependencies.first { $0.id == plugin.program })
+    }
+  }
+
+  @Test func metadataFailureDoesNotDisableExecutableResolution() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let executable = root.appendingPathComponent("Contents/Helpers/Plugins/v2ray-plugin")
+    try FileManager.default.createDirectory(
+      at: executable.deletingLastPathComponent(), withIntermediateDirectories: true)
+    try Data("#!/bin/sh\nexit 99\n".utf8).write(to: executable)
+    try FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: executable.path)
+    let provider = BundleManagedPluginProvider(bundleURL: root)
+    for contents in [nil, Data("broken".utf8)] {
+      if let contents {
+        let catalogURL = root.appendingPathComponent("Contents/Resources/ThirdParty/catalog.json")
+        try FileManager.default.createDirectory(
+          at: catalogURL.deletingLastPathComponent(), withIntermediateDirectories: true)
+        try contents.write(to: catalogURL)
+      }
+      #expect(throws: (any Error).self) { try BundledDependencyCatalog(bundleURL: root) }
+      #expect(ManagedPluginCatalog.plugins(in: root).allSatisfy { $0.dependency == nil })
+      #expect(provider.resolve(program: "v2ray-plugin-v1")?.path == executable.path)
+      #expect(provider.resolve(program: "v2ray-plugin")?.arguments == ["-disableAccessLog"])
+      let snapshot = PluginCatalogSnapshot(configuration: PluginConfiguration(), managed: provider)
+      #expect(snapshot.resolve(program: "v2ray-plugin")?.path == executable.path)
+      #expect(snapshot.entry(for: "v2ray-plugin")?.managedInfo?.dependency == nil)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/HealthCheckSupersessionController.swift b/ShadowsocksX-NG2/Tests/Plugin/HealthCheckSupersessionController.swift
new file mode 100644
index 000000000..8c4d154ed
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/HealthCheckSupersessionController.swift
@@ -0,0 +1,32 @@
+import Foundation
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+func makeHealthCheckSupersessionController(
+  runtime: ProxyRuntimeFixture.TemporaryRuntime, catalogFile: URL, plugins: PluginCatalog,
+  agent: ProxyRuntimeFixture.FakeLaunchAgent, probe: ProxyRuntimeFixture.BlockingProbe
+) -> ProxyRuntimeController {
+  let directory = runtime.directory
+  let files = RuntimeFileStore(fileURL: runtime.contract)
+  agent.onRegister = {
+    try? files.writePublishedRuntimeReceipt(processID: 42)
+  }
+  return ProxyRuntimeController(
+    controlPreferences: makeTestProxyControlPreferences(),
+    catalogSnapshotReader: ProxyRuntimeFixture.catalogSnapshotReader(at: catalogFile),
+    activationFileStore: ActivationStateFileStore(
+      fileURL: directory.appendingPathComponent("activation.json")),
+    runtimeFileStore: files, plugins: plugins,
+    listeningStore: InMemoryProxyListeningStore(),
+    customRuleStore: CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json")),
+    appBundle: AppArtifact.bundle,
+    ruleSnapshots: BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot),
+    settingsRestore: RestoredProxyRuntimeSettings(
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: true),
+      unreadableError: nil),
+    agent: agent, probe: probe, systemProxy: ProxyRuntimeFixture.FakeSystemProxy(),
+    systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService(),
+    firewallChecker: ProxyRuntimeFixture.FakeFirewallChecker(),
+    sendSignal: { _, _ in 0 }, processIsAlive: { $0 == 42 })
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/ManagedPluginCatalogTests.swift b/ShadowsocksX-NG2/Tests/Plugin/ManagedPluginCatalogTests.swift
new file mode 100644
index 000000000..83fa9def8
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/ManagedPluginCatalogTests.swift
@@ -0,0 +1,58 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 受管插件目录与 Vendor 清单的稳定身份和打包事实保持一致。
+final class ManagedPluginCatalogTests: XCTestCase {
+  private struct Manifest: Decodable {
+    var project: String
+    var binary: String
+    var bundleSubpath: String
+    var signIdentifier: String
+  }
+
+  private static let vendorRoot = TestSourceTree.ng2Root().appendingPathComponent("Vendor")
+
+  /// Vendor 下所有插件类清单（bundleSubpath 落在 Helpers/Plugins 的目录）。
+  private static var vendorPluginManifests: [(directory: String, manifest: Manifest)] {
+    guard
+      let directories = try? FileManager.default.contentsOfDirectory(atPath: vendorRoot.path)
+    else { return [] }
+    return directories.sorted().compactMap { directory in
+      let url = vendorRoot.appendingPathComponent(directory).appendingPathComponent("manifest.json")
+      guard let data = try? Data(contentsOf: url),
+        let manifest = try? JSONDecoder().decode(Manifest.self, from: data),
+        manifest.bundleSubpath == "Helpers/Plugins"
+      else { return nil }
+      return (directory, manifest)
+    }
+  }
+
+  func testCatalogMatchesVendorPluginManifests() throws {
+    let manifests = Self.vendorPluginManifests
+    XCTAssertFalse(manifests.isEmpty, "Vendor 下应至少有一个插件清单")
+    XCTAssertEqual(
+      ManagedPluginCatalog.plugins.count, manifests.count,
+      "派生插件目录与 Vendor 插件清单数量不一致（须重新生成派生目录）")
+    for (directory, manifest) in manifests {
+      let info = try XCTUnwrap(
+        ManagedPluginCatalog.plugins.first { $0.program == directory },
+        "\(directory): 清单里的记录「\(directory)」不在派生插件目录内")
+      XCTAssertEqual(info.executableName, manifest.binary, "\(directory): 打包文件名漂移")
+      XCTAssertEqual(info.signIdentifier, manifest.signIdentifier, "\(directory): 重签标识漂移")
+    }
+  }
+
+  func testEveryCatalogEntryHasVendorManifest() {
+    for info in ManagedPluginCatalog.plugins {
+      let match = Self.vendorPluginManifests.first { $0.manifest.binary == info.program }
+      XCTAssertNotNil(match, "「\(info.program)」在派生插件目录内但缺少 Vendor 插件清单")
+    }
+  }
+
+  func testProgramLookup() {
+    XCTAssertNotNil(ManagedPluginCatalog.info(forProgram: "v2ray-plugin"))
+    XCTAssertNil(ManagedPluginCatalog.info(forProgram: "obfs-local"), "集外程序名不在受管集")
+    XCTAssertNil(ManagedPluginCatalog.info(forProgram: ""), "空程序名不在受管集")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/PluginCatalogTests.swift b/ShadowsocksX-NG2/Tests/Plugin/PluginCatalogTests.swift
new file mode 100644
index 000000000..fff1916e6
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/PluginCatalogTests.swift
@@ -0,0 +1,360 @@
+import Foundation
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+struct QuietPluginInspector: PluginInspecting {
+  func inspect(_ executable: URL) async -> PluginSecurityFacts {
+    PluginSecurityFacts(quarantine: .absent, signature: .notApplicable, policy: .notApplicable)
+  }
+}
+
+struct PluginCatalogTests {
+  @Test func invalidOverrideDoesNotUseManagedExecutable() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let binary = root.appendingPathComponent("Contents/Helpers/Plugins/v2ray-plugin")
+    try FileManager.default.createDirectory(
+      at: binary.deletingLastPathComponent(), withIntermediateDirectories: true)
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let snapshot = PluginCatalogSnapshot(
+      mappings: ["v2ray-plugin": root.appendingPathComponent("missing").path],
+      managed: BundleManagedPluginProvider(bundleURL: root))
+    #expect(snapshot.resolve(program: "v2ray-plugin")?.path == nil)
+    #expect(snapshot.entry(for: "v2ray-plugin")?.source == .user)
+  }
+  @Test @MainActor func savedMappingIsUsedAndRemovalRemovesCustomName() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let binary = root.appendingPathComponent("custom-plugin")
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let store = PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json"))
+    let catalog = PluginCatalog(store: store, inspector: QuietPluginInspector())
+    try catalog.addPlugin(program: "custom-plugin", path: binary.path)
+    #expect(catalog.catalogSnapshot().resolve(program: "custom-plugin")?.path == binary.path)
+    #expect(
+      PluginCatalog(store: store, inspector: QuietPluginInspector()).catalogSnapshot().entry(
+        for: "custom-plugin")?.source == .user)
+    try catalog.removePlugin(program: "custom-plugin")
+    #expect(catalog.catalogSnapshot().entry(for: "custom-plugin") == nil)
+  }
+
+  @Test @MainActor func userPluginCanBeSavedThroughServerFormInterface() async throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let binary = root.appendingPathComponent("custom-plugin")
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let plugins = PluginCatalog(
+      store: PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json")),
+      inspector: QuietPluginInspector())
+    try plugins.addPlugin(program: "custom-plugin", path: binary.path)
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: root.appendingPathComponent("catalog.json")),
+        runtime: FakeCatalogRuntime()), plugins: plugins)
+    let id = try await workflow.createServer(
+      ServerEditDraft(
+        address: "127.0.0.1", port: 8388, encryptionMethod: "aes-256-gcm", password: "pw",
+        remark: "Custom", plugin: .named(program: "custom-plugin"), pluginOptions: "flag"),
+      into: nil)
+    #expect(try workflow.serverEditForm(for: id)?.plugin.options == "flag")
+    let presentation = try #require(workflow.serverFormPresentation(for: id))
+    #expect(
+      presentation.plugin.programs.contains { $0.program == "custom-plugin" && $0.source == .user })
+  }
+
+  @Test @MainActor func commitPublishesBeforeSchedulingRuntimeApplication() async throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let binary = root.appendingPathComponent("custom-plugin")
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let catalog = PluginCatalog(
+      store: PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json")),
+      inspector: QuietPluginInspector())
+    var events: [String] = []
+    let applied = AsyncStream<Void>.makeStream()
+    catalog.connect(
+      invalidateRuntime: { events.append("invalidate") },
+      revalidate: { events.append("publish") },
+      converge: {
+        events.append("apply")
+        applied.continuation.yield(())
+      })
+    try catalog.addPlugin(program: "custom-plugin", path: binary.path)
+    #expect(events == ["invalidate", "publish"])
+    for await _ in applied.stream { break }
+    #expect(events == ["invalidate", "publish", "apply"])
+  }
+
+  @Test @MainActor func corruptionBlocksManagedResolutionUntilExplicitRepair() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let binary = root.appendingPathComponent("Contents/Helpers/Plugins/v2ray-plugin")
+    try FileManager.default.createDirectory(
+      at: binary.deletingLastPathComponent(), withIntermediateDirectories: true)
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let file = root.appendingPathComponent("plugins.json")
+    try Data("broken".utf8).write(to: file)
+    let catalog = PluginCatalog(
+      store: PluginMappingFileStore(fileURL: file),
+      managed: BundleManagedPluginProvider(bundleURL: root), inspector: QuietPluginInspector())
+    #expect(catalog.catalogSnapshot().mappingsUnreadable)
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: root.appendingPathComponent("catalog.json")),
+        runtime: FakeCatalogRuntime()), plugins: catalog)
+    #expect(
+      workflow.newFormPluginSection(selection: .named(program: "v2ray-plugin")).mappingsUnreadable)
+
+    #expect(catalog.resolve(program: "v2ray-plugin")?.path == nil)
+    #expect(catalog.catalogSnapshot().entry(for: "v2ray-plugin")?.source == .unknown)
+    #expect(throws: PluginMappingError.unreadable) { try catalog.commit([]) }
+    try catalog.replaceTestMappings([:])
+    #expect(catalog.resolve(program: "v2ray-plugin")?.path == binary.path)
+  }
+
+  @Test @MainActor func failedPersistenceDoesNotPublishOrInvalidateRuntime() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let binary = root.appendingPathComponent("tool")
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let catalog = PluginCatalog(store: FailingMappingStore(), inspector: QuietPluginInspector())
+    var published = false
+    catalog.connect(
+      invalidateRuntime: { published = true }, revalidate: { published = true }, converge: {})
+    #expect(throws: PluginMappingError.unreadable) {
+      try catalog.addPlugin(program: "tool", path: binary.path)
+    }
+    #expect(!published)
+    #expect(catalog.catalogSnapshot().generation == 0)
+    #expect(catalog.catalogSnapshot().entry(for: "tool") == nil)
+  }
+
+  @Test @MainActor func symlinkAndCaseSensitiveNamesSurviveAtomicRename() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let binary = root.appendingPathComponent("tool")
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let link = root.appendingPathComponent("link")
+    try FileManager.default.createSymbolicLink(at: link, withDestinationURL: binary)
+    let catalog = PluginCatalog(
+      store: PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json")),
+      inspector: QuietPluginInspector())
+    try catalog.addPlugin(program: " Tool ", path: link.path)
+    #expect(catalog.resolve(program: "Tool")?.path == link.path)
+    #expect(catalog.resolve(program: "tool")?.path == nil)
+    let captured = catalog.catalogSnapshot()
+    try catalog.renamePlugin(program: "Tool", newProgram: "Other", path: link.path)
+    #expect(catalog.resolve(program: "Tool")?.path == nil)
+    #expect(captured.resolve(program: "Tool")?.path == link.path)
+    try FileManager.default.removeItem(at: binary)
+    #expect(catalog.resolve(program: "Other")?.path == nil)
+    try catalog.removePlugin(program: "Other")
+    #expect(catalog.catalogSnapshot().entry(for: "Other") == nil)
+  }
+
+  @Test @MainActor func mappingAdoptionRefreshesOnlyPluginDraft() throws {
+    let id = NodeID.fresh()
+    let fields = ServerFormFields()
+    var plugin = PluginSectionState(
+      selection: .unknown(program: "tool"), programs: [], mappingsUnreadable: false,
+      optionsPresent: true, options: "")
+    let original = ServerEditForm(
+      address: "127.0.0.1", port: 8388, encryptionMethod: "aes-256-gcm", password: "pw",
+      remark: "Original", plugin: plugin, isEditable: true)
+    fields.showServer(id) { _ in original }
+    fields.remark = "Unsaved name"
+    plugin = PluginSectionState(
+      selection: .named(program: "tool"),
+      programs: [.init(program: "tool", source: .user, availability: .available)],
+      mappingsUnreadable: false,
+      optionsPresent: true, options: "flag")
+    let mapped = ServerEditForm(
+      address: original.address, port: original.port, encryptionMethod: original.encryptionMethod,
+      password: original.password, remark: original.remark, plugin: plugin, isEditable: true)
+    fields.updatePresentation(
+      ServerFormPresentation(isEditable: true, plugin: plugin), load: { _ in mapped })
+    #expect(fields.remark == "Unsaved name")
+    #expect(fields.pluginChoice == .named(program: "tool"))
+    #expect(fields.pluginOptions.composedString == "flag")
+    #expect(fields.hasChanges)
+  }
+
+  @Test @MainActor func changedMappingSupersedesInFlightRuntimeHealthCheck() async throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let first = runtime.directory.appendingPathComponent("first-plugin")
+    let second = runtime.directory.appendingPathComponent("second-plugin")
+    for binary in [first, second] {
+      try Data("#!/bin/sh\n".utf8).write(to: binary)
+      try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    }
+    let plugins = PluginCatalog(
+      store: PluginMappingFileStore(
+        fileURL: runtime.directory.appendingPathComponent("plugins.json")),
+      inspector: QuietPluginInspector())
+    try plugins.addPlugin(program: "tool", path: first.path)
+    var catalog = ConfigurationCatalog()
+    var fields = ActivationFixture.plainFields(remark: "Plugin")
+    fields.pluginProgram = "tool"
+    let id = try catalog.addServer(fields, to: nil)
+    let catalogFile = runtime.directory.appendingPathComponent("catalog.json")
+    try makeTestCatalogStore(fileURL: catalogFile).save(CatalogDocument(catalog: catalog))
+    let agent = ProxyRuntimeFixture.FakeLaunchAgent()
+    let files = RuntimeFileStore(fileURL: runtime.contract)
+    let probe = ProxyRuntimeFixture.BlockingProbe()
+    let controller = makeHealthCheckSupersessionController(
+      runtime: runtime, catalogFile: catalogFile, plugins: plugins, agent: agent, probe: probe)
+    let started = XCTestExpectation(description: "old runtime entered health check")
+    probe.arm(started: started)
+    plugins.connect(
+      invalidateRuntime: { controller.pluginMappingsDidPublish() }, revalidate: {}, converge: {})
+    let oldActivation = Task { try await controller.activate(id) }
+    do {
+      try await requireTestPhase([started])
+      try plugins.updatePlugin(program: "tool", path: second.path)
+      probe.release()
+      _ = try await oldActivation.value
+    } catch {
+      probe.release()
+      oldActivation.cancel()
+      _ = await oldActivation.result
+      throw error
+    }
+    // A later successful deployment must not hide stale health-check side effects.
+    #expect(controller.state == .starting)
+    #expect(files.readFailure() == nil)
+    #expect(agent.unregisterCount == 0)
+    let outcome = await controller.catalogDidCommit(snapshot: catalog)
+    #expect(outcome == .converged(skippedServers: []))
+    #expect(files.loadDocument()?.servers.first?.plugin == second.path)
+    #expect(controller.state == .running)
+  }
+
+}
+
+struct PluginCatalogSecurityTests {
+  @Test(arguments: ["unchanged", "replace", "remove", "permissions"])
+  @MainActor func inspectionEvidenceFollowsCurrentMappingAndFile(change: String) async throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let binary = root.appendingPathComponent("tool")
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let inspector = HeldPluginInspector()
+    let catalog = PluginCatalog(
+      store: PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json")),
+      inspector: inspector)
+    try catalog.addPlugin(program: "tool", path: binary.path)
+    let check = catalog.refreshSecurityFacts()
+    var started = inspector.started.makeAsyncIterator()
+    _ = await started.next()
+    if change == "replace" {
+      try Data("#!/bin/sh\n# replacement\n".utf8).write(to: binary, options: .atomic)
+      try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    } else if change == "permissions" {
+      try FileManager.default.setAttributes([.posixPermissions: 0o644], ofItemAtPath: binary.path)
+    } else if change == "remove" {
+      try catalog.removePlugin(program: "tool")
+    }
+    await inspector.release()
+    await check.value
+    if change == "unchanged" {
+      #expect(catalog.securityFacts["tool"]?.policy == .rejected)
+      #expect(catalog.resolve(program: "tool")?.path == binary.path)
+    } else {
+      #expect(catalog.securityFacts["tool"] == nil)
+      #expect(
+        catalog.resolve(program: "tool")?.path
+          == (["remove", "permissions"].contains(change) ? nil : binary.path))
+    }
+  }
+
+  @Test func symlinkTargetsMustBeExecutableFiles() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let directoryLink = root.appendingPathComponent("directory-link")
+    let missingLink = root.appendingPathComponent("missing-link")
+    try FileManager.default.createSymbolicLink(at: directoryLink, withDestinationURL: root)
+    try FileManager.default.createSymbolicLink(
+      at: missingLink, withDestinationURL: root.appendingPathComponent("missing"))
+    let snapshot = PluginCatalogSnapshot(
+      mappings: ["directory": directoryLink.path, "missing": missingLink.path])
+    #expect(snapshot.entry(for: "directory")?.availability == .notExecutable)
+    #expect(snapshot.entry(for: "missing")?.availability == .missing)
+    #expect(snapshot.resolve(program: "directory")?.path == nil)
+    #expect(snapshot.resolve(program: "missing")?.path == nil)
+  }
+
+  @Test func failedFileInspectionIsDistinctFromMissingFile() {
+    let snapshot = PluginCatalogSnapshot(
+      mappings: ["tool": "/unreadable/tool"],
+      managed: BundleManagedPluginProvider(fileManager: UnreadablePluginFileManager()))
+    #expect(snapshot.entry(for: "tool")?.availability == .unreadable)
+    #expect(snapshot.resolve(program: "tool")?.path == nil)
+  }
+
+  /// 用户来源条目在生产映射中恒无版本（managedInfo 为 nil），
+  /// 报告行内显示来源标签而不是版本号。
+  @Test func userDiagnosticFactsShowSourceLabelInsteadOfVersion() {
+    var snapshot = DiagnosticSnapshot()
+    snapshot.managedPlugins = [
+      DiagnosticPluginFacts(program: "v2ray-plugin", version: "", present: true, source: .user)
+    ]
+    let report = DiagnosticReportBuilder.markdown(from: snapshot)
+    #expect(report.contains("v2ray-plugin user"))
+  }
+
+}
+
+private struct FailingMappingStore: PluginMappingStoring {
+  func load() throws -> PluginConfiguration { PluginConfiguration() }
+  func save(_ configuration: PluginConfiguration) throws { throw PluginMappingError.unreadable }
+}
+
+private actor HeldPluginInspector: PluginInspecting {
+  nonisolated let started: AsyncStream<Void>
+  private let signal: AsyncStream<Void>.Continuation
+  private var pending: CheckedContinuation<PluginSecurityFacts, Never>?
+
+  init() {
+    let stream = AsyncStream<Void>.makeStream()
+    started = stream.stream
+    signal = stream.continuation
+  }
+
+  func inspect(_ executable: URL) async -> PluginSecurityFacts {
+    await withCheckedContinuation { continuation in
+      pending = continuation
+      signal.yield(())
+    }
+  }
+
+  func release() {
+    pending?.resume(
+      returning: PluginSecurityFacts(
+        quarantine: .present, signature: .unsigned, policy: .rejected))
+    pending = nil
+  }
+}
+
+private final class UnreadablePluginFileManager: FileManager, @unchecked Sendable {
+  override func attributesOfItem(atPath path: String) throws -> [FileAttributeKey: Any] {
+    throw NSError(domain: NSCocoaErrorDomain, code: NSFileReadNoPermissionError)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/PluginFormCatalogTests.swift b/ShadowsocksX-NG2/Tests/Plugin/PluginFormCatalogTests.swift
new file mode 100644
index 000000000..12142bba9
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/PluginFormCatalogTests.swift
@@ -0,0 +1,131 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// Server-form behavior through workflow and draft interfaces.
+struct PluginFormCatalogTests {
+  @Test(arguments: [
+    PluginCatalogSnapshot.Availability.available, .missing, .notExecutable, .unreadable,
+  ])
+  @MainActor func formRetainsAvailabilityForNewlySelectedPlugin(
+    availability: PluginCatalogSnapshot.Availability
+  ) throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let snapshot = PluginCatalogSnapshot(entries: [
+      .init(
+        program: "tool", path: "/private/tool", source: .user,
+        availability: availability, managedInfo: nil)
+    ])
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: root.appendingPathComponent("catalog.json")),
+        runtime: FakeCatalogRuntime()), plugins: snapshot)
+    let form = workflow.newFormPluginSection(selection: .named(program: "tool"))
+    #expect(form.programs.first?.source == .user)
+    #expect(form.programs.first?.availability == availability)
+    #expect(!form.mappingsUnreadable)
+  }
+
+  @Test @MainActor func missingUnsavedChoiceHasUnresolvedPresentation() {
+    let plugin = PluginSectionState(
+      selection: .named(program: "saved"),
+      programs: [.init(program: "saved", source: .managed, availability: .available)],
+      mappingsUnreadable: false, optionsPresent: true, options: "flag")
+    let form = ServerEditForm(
+      address: "127.0.0.1", port: 8388,
+      encryptionMethod: "aes-256-gcm", password: "pw", remark: "Original",
+      plugin: plugin, isEditable: true)
+    let fields = ServerFormFields()
+    fields.showServer(.fresh()) { _ in form }
+    fields.pluginChoice = .named(program: "removed")
+    fields.pluginOptions.load("host=unsaved")
+    fields.updatePresentation(ServerFormPresentation(isEditable: true, plugin: plugin))
+    #expect(fields.pluginChoice == .named(program: "removed"))
+    #expect(fields.presentation?.plugin.unresolvedProgram(for: fields.pluginChoice) == "removed")
+    #expect(fields.pluginOptions.composedString == "host=unsaved")
+    #expect(plugin.unresolvedProgram(for: .none) == nil)
+    #expect(plugin.unresolvedProgram(for: .named(program: "saved")) == nil)
+  }
+
+  @Test @MainActor func mappingRemovalAndOverrideChangesPreserveServerDraft() async throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let fixture = try makePluginFormFixture(root: root)
+    let id = try await fixture.workflow.createServer(
+      ServerEditDraft(
+        address: "127.0.0.1", port: 8388, encryptionMethod: "aes-256-gcm",
+        password: "pw", remark: "Original", plugin: .named(program: "tool"), pluginOptions: "flag"),
+      into: nil)
+    let fields = ServerFormFields()
+    fields.showServer(id, load: fixture.workflow.serverEditForm)
+    fields.remark = "Unsaved"
+    fields.pluginOptions.load("host=unsaved")
+    try fixture.plugins.removePlugin(program: "tool")
+    fields.updatePresentation(
+      fixture.workflow.serverFormPresentation(for: id), load: fixture.workflow.serverEditForm)
+    #expect(fields.pluginChoice == .unknown(program: "tool"))
+    #expect(fields.pluginOptions.composedString == "host=unsaved")
+    try fixture.plugins.addPlugin(program: "tool", path: fixture.managedBinary.path)
+    fields.updatePresentation(
+      fixture.workflow.serverFormPresentation(for: id), load: fixture.workflow.serverEditForm)
+    #expect(fields.pluginChoice == .named(program: "tool"))
+    #expect(fields.pluginOptions.composedString == "host=unsaved")
+    #expect(try fixture.workflow.serverEditForm(for: id)?.plugin.options == "flag")
+    #expect(fields.remark == "Unsaved")
+
+    // An unsaved choice disappearing must retain a selectable unresolved reference.
+    fields.pluginChoice = .named(program: "tool")
+    try fixture.plugins.removePlugin(program: "tool")
+    fields.updatePresentation(
+      fixture.workflow.serverFormPresentation(for: id), load: fixture.workflow.serverEditForm)
+    #expect(fields.presentation?.plugin.unresolvedProgram(for: .named(program: "tool")) == "tool")
+    #expect(
+      fixture.workflow.newFormPluginSection(selection: .named(program: "tool"))
+        .unresolvedProgram(for: .named(program: "tool")) == "tool")
+    #expect(fields.pluginOptions.composedString == "host=unsaved")
+
+    fields.pluginChoice = .named(program: "v2ray-plugin")
+    try fixture.plugins.addPlugin(program: "v2ray-plugin", path: fixture.managedBinary.path)
+    fields.updatePresentation(
+      fixture.workflow.serverFormPresentation(for: id), load: fixture.workflow.serverEditForm)
+    #expect(
+      fields.presentation?.plugin.programs.first { $0.program == "v2ray-plugin" }?.source == .user)
+    try fixture.plugins.removePlugin(program: "v2ray-plugin")
+    fields.updatePresentation(
+      fixture.workflow.serverFormPresentation(for: id), load: fixture.workflow.serverEditForm)
+    #expect(
+      fields.presentation?.plugin.programs.first { $0.program == "v2ray-plugin" }?.source
+        == .managed)
+    #expect(fields.pluginChoice == .named(program: "v2ray-plugin"))
+    #expect(fields.pluginOptions.composedString == "host=unsaved")
+    #expect(fields.remark == "Unsaved")
+  }
+
+}
+
+private struct PluginFormFixture {
+  let managedBinary: URL
+  let plugins: PluginCatalog
+  let workflow: CatalogWorkflow
+}
+
+@MainActor
+private func makePluginFormFixture(root: URL) throws -> PluginFormFixture {
+  let managedBinary = root.appendingPathComponent("Contents/Helpers/Plugins/v2ray-plugin")
+  try FileManager.default.createDirectory(
+    at: managedBinary.deletingLastPathComponent(), withIntermediateDirectories: true)
+  try Data("#!/bin/sh\n".utf8).write(to: managedBinary)
+  try FileManager.default.setAttributes(
+    [.posixPermissions: 0o755], ofItemAtPath: managedBinary.path)
+  let plugins = PluginCatalog(
+    store: PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json")),
+    managed: BundleManagedPluginProvider(bundleURL: root), inspector: QuietPluginInspector())
+  try plugins.addPlugin(program: "tool", path: managedBinary.path)
+  let workflow = makeCatalogWorkflow(
+    coordinator: CatalogCommitCoordinator(
+      fileStore: makeTestCatalogStore(fileURL: root.appendingPathComponent("catalog.json")),
+      runtime: FakeCatalogRuntime()), plugins: plugins)
+  return PluginFormFixture(managedBinary: managedBinary, plugins: plugins, workflow: workflow)
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/PluginManagementTests.swift b/ShadowsocksX-NG2/Tests/Plugin/PluginManagementTests.swift
new file mode 100644
index 000000000..6a1106cb2
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/PluginManagementTests.swift
@@ -0,0 +1,224 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct PluginManagementTests {
+  @Test func editingTransportModePersistsForUserAndManagedRecords() throws {
+    let fixture = try ManagementFixture()
+    defer { fixture.cleanUp() }
+    let model = PluginManagementModel(catalog: fixture.catalog)
+    let add = model.beginAdding()
+    #expect(add.initialMode == .tcpOnly)
+    try model.save(
+      add, names: ["custom", "custom-v2"], path: fixture.first.path,
+      arguments: ["--verbose"], mode: .tcpAndUDP)
+    let edit = try #require(model.testBeginEditing("custom"))
+    #expect(edit.initialMode == .tcpAndUDP)
+    try model.save(
+      edit, names: edit.initialNames, path: edit.initialPath,
+      arguments: [], mode: edit.initialMode)
+    #expect(model.snapshot.resolve(program: "custom-v2")?.mode == .tcpAndUDP)
+    #expect(model.snapshot.resolve(program: "custom-v2")?.arguments == [])
+    let managed = try #require(model.beginManagedSettings("v2ray-plugin"))
+    #expect(managed.initialMode == .tcpOnly)
+    try model.save(
+      managed, names: managed.initialNames, path: "",
+      arguments: ["--verbose"], mode: .tcpAndUDP)
+    let restored = PluginManagementModel(
+      catalog: PluginCatalog(store: fixture.store, inspector: ManagementInspector()))
+    #expect(restored.beginManagedSettings("v2ray-plugin")?.initialMode == .tcpAndUDP)
+    #expect(restored.testBeginEditing("custom")?.initialMode == .tcpAndUDP)
+    try restored.save(managed, names: managed.initialNames, path: "", mode: .tcpOnly)
+    #expect(restored.beginManagedSettings("v2ray-plugin")?.initialMode == .tcpOnly)
+  }
+
+  @Test func fullyOverriddenManagedRecordKeepsItsOwnFileFacts() throws {
+    let fixture = try ManagementFixture()
+    defer { fixture.cleanUp() }
+    let model = PluginManagementModel(catalog: fixture.catalog)
+    let original = try #require(model.rows.first { $0.managedProgram == "v2ray-plugin" })
+    try model.save(
+      model.beginAdding(), names: ["v2ray-plugin", "v2ray-plugin-v1"],
+      path: fixture.first.path, arguments: ["--verbose"])
+    let covered = try #require(model.rows.first { $0.managedProgram == "v2ray-plugin" })
+    #expect(covered.path == original.path)
+    #expect(covered.availability == original.availability)
+    #expect(covered.overriddenNames == ["v2ray-plugin", "v2ray-plugin-v1"])
+    #expect(covered.path != fixture.first.path)
+    let edit = try #require(model.beginManagedSettings("v2ray-plugin"))
+    try model.save(edit, names: edit.initialNames, path: "", arguments: ["--threads", "8"])
+    #expect(model.beginManagedSettings("v2ray-plugin")?.initialArguments == ["--threads", "8"])
+    #expect(model.snapshot.resolve(program: "v2ray-plugin")?.arguments == ["--verbose"])
+    try model.clearManagedArguments("v2ray-plugin")
+    #expect(model.beginManagedSettings("v2ray-plugin")?.initialArguments == [])
+  }
+
+  @Test func editingChangesNamesAndUpdatesExecutable() throws {
+    let fixture = try ManagementFixture()
+    defer { fixture.cleanUp() }
+    let model = PluginManagementModel(catalog: fixture.catalog)
+    let add = model.beginAdding()
+    try model.save(add, names: ["custom"], path: fixture.first.path)
+    let edit = try #require(model.testBeginEditing("custom"))
+    #expect(edit.initialNames == ["custom"])
+    #expect(edit.initialPath == fixture.first.path)
+    try model.save(
+      edit, names: ["renamed", "renamed-v2"], path: fixture.second.path,
+      arguments: ["--verbose"])
+    #expect(model.snapshot.entry(for: "custom") == nil)
+    #expect(model.snapshot.entry(for: "renamed")?.path == fixture.second.path)
+    #expect(model.snapshot.resolve(program: "renamed-v2")?.arguments == ["--verbose"])
+    #expect(fixture.catalog.userRecords.first?.id == edit.recordID)
+  }
+
+  @Test func overrideCanBeEditedAndRestoredWithoutDeletingManagedEntry() throws {
+    let fixture = try ManagementFixture()
+    defer { fixture.cleanUp() }
+    let model = PluginManagementModel(catalog: fixture.catalog)
+    let override = try #require(model.beginOverriding("v2ray-plugin"))
+    #expect(override.initialNames == ["v2ray-plugin"])
+    #expect(override.initialPath.isEmpty)
+    #expect(!override.isEditing)
+    try model.save(override, names: ["v2ray-plugin"], path: fixture.first.path)
+    #expect(model.snapshot.entry(for: "v2ray-plugin")?.source == .user)
+    #expect(model.beginOverriding("v2ray-plugin") == nil)
+    let edit = try #require(model.testBeginEditing("v2ray-plugin"))
+    try model.save(edit, names: ["v2ray-plugin"], path: fixture.second.path)
+    #expect(model.snapshot.entry(for: "v2ray-plugin")?.path == fixture.second.path)
+    try model.testRemove("v2ray-plugin")
+    #expect(model.snapshot.entry(for: "v2ray-plugin")?.source == .managed)
+    #expect(model.testBeginEditing("v2ray-plugin") == nil)
+    #expect(model.beginOverriding("v2ray-plugin") != nil)
+  }
+
+  @Test func unreadableMappingsBlockChangesUntilSuccessfulReadRetry() throws {
+    let fixture = try ManagementFixture(corrupt: true)
+    defer { fixture.cleanUp() }
+    let model = PluginManagementModel(catalog: fixture.catalog)
+    #expect(model.snapshot.mappingsUnreadable)
+    #expect(model.beginOverriding("v2ray-plugin") == nil)
+    #expect(throws: PluginMappingError.unreadable) {
+      try model.save(model.beginAdding(), names: ["custom"], path: fixture.first.path)
+    }
+    #expect(throws: PluginMappingError.unreadable) { try model.retryReading() }
+    #expect(model.snapshot.mappingsUnreadable)
+    try fixture.store.save(["custom": fixture.first.path])
+    let repairedBytes = try Data(contentsOf: fixture.store.fileURL)
+    try model.retryReading()
+    #expect(!model.snapshot.mappingsUnreadable)
+    #expect(model.snapshot.entry(for: "custom")?.path == fixture.first.path)
+    #expect(try Data(contentsOf: fixture.store.fileURL) == repairedBytes)
+    #expect(model.testBeginEditing("custom") != nil)
+  }
+
+  @Test func failedSavePreservesMappingAndAllowsSameEditorToRetry() throws {
+    let fixture = try ManagementFixture()
+    defer { fixture.cleanUp() }
+    let model = PluginManagementModel(catalog: fixture.catalog)
+    try model.save(model.beginAdding(), names: ["custom"], path: fixture.first.path)
+    let edit = try #require(model.testBeginEditing("custom"))
+    let config = fixture.store.fileURL.deletingLastPathComponent()
+    let backup = fixture.root.appendingPathComponent("backup")
+    try FileManager.default.moveItem(at: config, to: backup)
+    try Data("blocking file".utf8).write(to: config)
+    #expect(throws: (any Error).self) {
+      try model.save(edit, names: ["custom"], path: fixture.second.path, mode: .tcpAndUDP)
+    }
+    #expect(model.snapshot.entry(for: "custom")?.path == fixture.first.path)
+    #expect(model.testBeginEditing("custom")?.initialPath == fixture.first.path)
+    #expect(model.testBeginEditing("custom")?.initialMode == .tcpOnly)
+    try FileManager.default.removeItem(at: config)
+    try FileManager.default.moveItem(at: backup, to: config)
+    try model.save(edit, names: ["custom"], path: fixture.second.path, mode: .tcpAndUDP)
+    #expect(model.snapshot.entry(for: "custom")?.path == fixture.second.path)
+    #expect(model.testBeginEditing("custom")?.initialMode == .tcpAndUDP)
+  }
+
+  @Test func unavailableFilesAndDuplicateNamesAreRejectedAndRemovalKeepsOtherMappings() throws {
+    let fixture = try ManagementFixture()
+    defer { fixture.cleanUp() }
+    let model = PluginManagementModel(catalog: fixture.catalog)
+    let add = model.beginAdding()
+    #expect(!add.isEditing)
+    #expect(add.initialPath.isEmpty)
+    #expect(model.testNameIssue("", session: add) == .invalidName)
+    #expect(model.pathIssue("relative") == .invalidPath)
+    try model.save(add, names: ["custom"], path: fixture.first.path)
+    #expect(model.testNameIssue("custom", session: model.beginAdding()) == .nameExists)
+    #expect(throws: PluginMappingError.nameExists) {
+      try model.save(model.beginAdding(), names: ["custom"], path: fixture.second.path)
+    }
+    #expect(throws: PluginMappingError.unavailableFile) {
+      try model.save(
+        model.beginAdding(), names: ["missing"],
+        path: fixture.root.appendingPathComponent("missing").path)
+    }
+    try model.save(model.beginAdding(), names: ["other"], path: fixture.second.path)
+    try model.testRemove("custom")
+    #expect(model.snapshot.entry(for: "custom") == nil)
+    #expect(model.snapshot.entry(for: "other")?.path == fixture.second.path)
+    try FileManager.default.removeItem(at: fixture.second)
+    model.refresh()
+    #expect(model.snapshot.entry(for: "other")?.availability == .missing)
+    #expect(model.testBeginEditing("other")?.initialPath == fixture.second.path)
+  }
+
+}
+
+private struct ManagementInspector: PluginInspecting {
+  func inspect(_ executable: URL) async -> PluginSecurityFacts {
+    PluginSecurityFacts(quarantine: .absent, signature: .notApplicable, policy: .notApplicable)
+  }
+}
+
+@MainActor
+private struct ManagementFixture {
+  let root: URL
+  let first: URL
+  let second: URL
+  let store: PluginMappingFileStore
+  let catalog: PluginCatalog
+
+  init(corrupt: Bool = false) throws {
+    root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    first = root.appendingPathComponent("first")
+    second = root.appendingPathComponent("second")
+    store = PluginMappingFileStore(fileURL: root.appendingPathComponent("config/plugins.json"))
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    try FileManager.default.createDirectory(
+      at: store.fileURL.deletingLastPathComponent(), withIntermediateDirectories: true)
+    for binary in [first, second] {
+      try Data("#!/bin/sh\n".utf8).write(to: binary)
+      try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    }
+    if corrupt { try Data("broken".utf8).write(to: store.fileURL) }
+    catalog = PluginCatalog(store: store, inspector: ManagementInspector())
+  }
+
+  func cleanUp() { try? FileManager.default.removeItem(at: root) }
+}
+
+@MainActor
+extension PluginManagementModel {
+  fileprivate func testBeginEditing(_ name: String) -> PluginEditorSession? {
+    guard let id = catalog.userRecords.first(where: { $0.names.contains(name) })?.id else {
+      return nil
+    }
+    return beginEditing(id)
+  }
+
+  fileprivate func testRemove(_ name: String) throws {
+    guard let id = catalog.userRecords.first(where: { $0.names.contains(name) })?.id else {
+      throw PluginMappingError.nameMissing
+    }
+    try remove(id)
+  }
+
+  fileprivate func testNameIssue(_ name: String, session: PluginEditorSession)
+    -> PluginMappingError?
+  {
+    namesIssue([name], session: session)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/PluginMappingCommitTests.swift b/ShadowsocksX-NG2/Tests/Plugin/PluginMappingCommitTests.swift
new file mode 100644
index 000000000..bee3bf248
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/PluginMappingCommitTests.swift
@@ -0,0 +1,385 @@
+import Foundation
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct PluginMappingCommitTests {
+  @Test func savedTransportModeUpdatesActiveRuntime() async throws {
+    let fixture = try PluginMappingCommitFixture()
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.group)
+    var record = try #require(fixture.plugins.userRecords.first { $0.names.contains("tool") })
+    record.mode = .tcpAndUDP
+    try fixture.plugins.commit([.save(record)])
+    _ = await fixture.nextApplication()
+    #expect(
+      fixture.files.loadDocument()?.servers.first { $0.plugin != nil }?.pluginMode == .tcpAndUDP)
+    #expect(fixture.controller.state == .running)
+    record.mode = .tcpOnly
+    try fixture.plugins.commit([.save(record)])
+    _ = await fixture.nextApplication()
+    #expect(fixture.files.loadDocument()?.servers.first { $0.plugin != nil }?.pluginMode == nil)
+  }
+
+  @Test func runtimeFailureDoesNotUndoSavedMapping() async throws {
+    let fixture = try PluginMappingCommitFixture()
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.group)
+    #expect(fixture.controller.state == .running)
+    try FileManager.default.removeItem(at: fixture.files.pidFileURL)
+    fixture.agent.registerError = NSError(domain: "PluginMappingCommitTests", code: 1)
+    try fixture.plugins.updatePlugin(program: "tool", path: fixture.second.path)
+    let outcome = await fixture.nextApplication()
+    guard case .failed = outcome else {
+      Issue.record("Expected runtime failure after the mapping was saved")
+      return
+    }
+    #expect(fixture.plugins.testMappings["tool"] == fixture.second.path)
+    let restored = PluginCatalog(store: fixture.store, inspector: CommitPluginInspector())
+    #expect(restored.resolve(program: "tool")?.path == fixture.second.path)
+  }
+
+  @Test func unrelatedAndIdenticalMappingsDoNotRestartHealthyRuntime() async throws {
+    let fixture = try PluginMappingCommitFixture()
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.group)
+    #expect(fixture.controller.state == .running)
+    let registered = fixture.agent.registerCount
+    let unregistered = fixture.agent.unregisterCount
+    let signals = fixture.signals.count
+    let deployed = try #require(fixture.files.readData())
+    try fixture.plugins.addPlugin(program: "unused", path: fixture.second.path)
+    _ = await fixture.nextApplication()
+    #expect(fixture.agent.registerCount == registered)
+    #expect(fixture.agent.unregisterCount == unregistered)
+    #expect(fixture.signals.count == signals)
+    #expect(fixture.files.readData() == deployed)
+    let generation = fixture.plugins.catalogSnapshot().generation
+    try fixture.plugins.updatePlugin(program: "unused", path: fixture.second.path)
+    await fixture.drainMainQueue()
+    #expect(fixture.plugins.catalogSnapshot().generation == generation)
+    #expect(fixture.agent.registerCount == registered)
+    #expect(fixture.agent.unregisterCount == unregistered)
+    #expect(fixture.signals.count == signals)
+  }
+
+  @Test func mappingRemovalRevalidatesGroupBeforeRuntimeApplication() async throws {
+    let fixture = try PluginMappingCommitFixture()
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.group)
+    #expect(fixture.controller.state == .running)
+    try fixture.plugins.removePlugin(program: "tool")
+    let group = try #require(fixture.workflow.tree.roots.first)
+    #expect(group.invalidDescendantCount == 1)
+    #expect(
+      group.find(fixture.pluginServer)?.invalidReasons == [.pluginNotProvided(program: "tool")])
+    #expect(group.find(fixture.plainServer)?.isInvalid == false)
+    _ = await fixture.nextApplication()
+    #expect(fixture.controller.activeTargetID == fixture.group)
+    #expect(
+      fixture.controller.skippedServers == [
+        SkippedServer(id: fixture.pluginServer, reason: .pluginNotProvided(program: "tool"))
+      ])
+    let document = try #require(fixture.files.loadDocument())
+    #expect(document.servers.count == 1)
+    #expect(document.servers.first?.password == "pw-Plain")
+    #expect(fixture.controller.state == .running)
+  }
+
+  @Test(arguments: [false, true])
+  func newerMappingWinsBeforeApplicationAndDuringHealthCheck(inFlight: Bool) async throws {
+    let fixture = try PluginMappingCommitFixture()
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.group)
+    #expect(fixture.controller.state == .running)
+    let started = XCTestExpectation(description: "mapping A entered health check")
+    if inFlight { fixture.probe.arm(started: started) }
+    try fixture.plugins.updatePlugin(program: "tool", path: fixture.second.path)
+    if inFlight {
+      let result = await XCTWaiter.fulfillment(of: [started], timeout: 3)
+      #expect(result == .completed)
+    }
+    try fixture.plugins.updatePlugin(program: "tool", path: fixture.third.path)
+    fixture.probe.release()
+    _ = await fixture.nextApplication()
+    if inFlight { _ = await fixture.nextApplication() }
+    #expect(fixture.plugins.testMappings["tool"] == fixture.third.path)
+    #expect(
+      try fixture.store.load().userPlugins.first { $0.names.contains("tool") }?.path
+        == fixture.third.path)
+    #expect(fixture.files.loadDocument()?.servers.first?.plugin == fixture.third.path)
+    #expect(fixture.controller.state == .running)
+    if !inFlight { #expect(fixture.applicationPaths == [fixture.third.path]) }
+  }
+
+  @Test func atomicWriteFailurePreservesCommittedFactsAndDoesNotApply() async throws {
+    let fixture = try PluginMappingCommitFixture()
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.group)
+    let generation = fixture.plugins.catalogSnapshot().generation
+    let tree = fixture.workflow.tree
+    let contract = fixture.files.readData()
+    let registered = fixture.agent.registerCount
+    let mappingsDirectory = fixture.store.fileURL.deletingLastPathComponent()
+    let backup = fixture.directory.appendingPathComponent("saved-mappings")
+    try FileManager.default.moveItem(at: mappingsDirectory, to: backup)
+    try Data("blocks temporary file creation".utf8).write(to: mappingsDirectory)
+    #expect(throws: (any Error).self) {
+      try fixture.plugins.updatePlugin(program: "tool", path: fixture.second.path)
+    }
+    #expect(fixture.plugins.testMappings["tool"] == fixture.first.path)
+    #expect(fixture.plugins.catalogSnapshot().generation == generation)
+    #expect(fixture.workflow.tree == tree)
+    #expect(fixture.agent.registerCount == registered)
+    #expect(fixture.files.readData() == contract)
+    await fixture.drainMainQueue()
+    #expect(fixture.applicationStarts == 0)
+    #expect(fixture.applicationPaths.isEmpty)
+    try FileManager.default.removeItem(at: mappingsDirectory)
+    try FileManager.default.moveItem(at: backup, to: mappingsDirectory)
+    #expect(
+      try fixture.store.load().userPlugins.first { $0.names.contains("tool") }?.path
+        == fixture.first.path)
+  }
+
+}
+
+private struct CommitPluginInspector: PluginInspecting {
+  func inspect(_ executable: URL) async -> PluginSecurityFacts {
+    PluginSecurityFacts(quarantine: .absent, signature: .notApplicable, policy: .notApplicable)
+  }
+}
+
+/// Production commit wiring with private files and controllable runtime effects.
+@MainActor
+private final class PluginMappingCommitFixture {
+  let directory: URL
+  let first: URL
+  let second: URL
+  let third: URL
+  let store: PluginMappingFileStore
+  let plugins: PluginCatalog
+  let files: RuntimeFileStore
+  let agent: ProxyRuntimeFixture.FakeLaunchAgent
+  let probe: ProxyRuntimeFixture.BlockingProbe
+  let signals: CommitSignals
+  let controller: ProxyRuntimeController
+  let workflow: CatalogWorkflow
+  let group: NodeID
+  let pluginServer: NodeID
+  let plainServer: NodeID
+  private(set) var applicationStarts = 0
+  private(set) var applicationPaths: [String] = []
+  private var applications: AsyncStream<RuntimeSyncOutcome>.Iterator
+
+  init() throws {
+    let setup = try makePluginMappingCommitSetup()
+    directory = setup.runtime.directory
+    first = setup.first
+    second = setup.second
+    third = setup.third
+    store = setup.store
+    plugins = setup.plugins
+    files = setup.files
+    agent = setup.agent
+    probe = setup.probe
+    signals = setup.signals
+    controller = setup.controller
+    workflow = setup.workflow
+    group = setup.group
+    pluginServer = setup.pluginServer
+    plainServer = setup.plainServer
+    let stream = AsyncStream<RuntimeSyncOutcome>.makeStream()
+    applications = stream.stream.makeAsyncIterator()
+    connectPluginCatalog(stream.continuation)
+  }
+
+  private func connectPluginCatalog(
+    _ continuation: AsyncStream<RuntimeSyncOutcome>.Continuation
+  ) {
+    let controller = controller
+    let workflow = workflow
+    let files = files
+    plugins.connect(
+      invalidateRuntime: { [weak controller] in controller?.pluginMappingsDidPublish() },
+      revalidate: { [weak workflow] in workflow?.republishCommittedState() },
+      converge: { [weak self, weak controller] in
+        guard let controller else { return }
+        self?.applicationStarts += 1
+        let outcome = await controller.catalogDidCommit(
+          snapshot: controller.catalogSnapshotReader.catalogSnapshot)
+        if let path = files.loadDocument()?.servers.first?.plugin {
+          self?.applicationPaths.append(path)
+        }
+        continuation.yield(outcome)
+      })
+  }
+
+  func nextApplication() async -> RuntimeSyncOutcome? {
+    var iterator = applications
+    let outcome = await iterator.next(isolation: MainActor.shared)
+    applications = iterator
+    return outcome
+  }
+
+  /// Observe jobs already submitted to the main executor before asserting no application.
+  func drainMainQueue() async {
+    await withCheckedContinuation { continuation in
+      DispatchQueue.main.async { continuation.resume() }
+    }
+  }
+
+  func cleanUp() {
+    probe.release()
+    try? FileManager.default.removeItem(at: directory)
+  }
+}
+
+private final class CommitSignals: @unchecked Sendable {
+  private let lock = NSLock()
+  private var recorded = 0
+
+  var count: Int { lock.withLock { recorded } }
+
+  func record() { lock.withLock { recorded += 1 } }
+}
+
+@MainActor
+private struct PluginMappingCommitSetup {
+  let runtime: ProxyRuntimeFixture.TemporaryRuntime
+  let first: URL
+  let second: URL
+  let third: URL
+  let store: PluginMappingFileStore
+  let plugins: PluginCatalog
+  let files: RuntimeFileStore
+  let agent: ProxyRuntimeFixture.FakeLaunchAgent
+  let probe: ProxyRuntimeFixture.BlockingProbe
+  let signals: CommitSignals
+  let controller: ProxyRuntimeController
+  let workflow: CatalogWorkflow
+  let group: NodeID
+  let pluginServer: NodeID
+  let plainServer: NodeID
+}
+
+@MainActor
+private struct PluginMappingCatalogSetup {
+  let fileStore: CatalogFileStore
+  let bootstrap: CatalogCommitBootstrap
+  let group: NodeID
+  let pluginServer: NodeID
+  let plainServer: NodeID
+}
+
+@MainActor
+private struct PluginMappingControllerContext {
+  let directory: URL
+  let bootstrap: CatalogCommitBootstrap
+  let files: RuntimeFileStore
+  let plugins: PluginCatalog
+  let agent: ProxyRuntimeFixture.FakeLaunchAgent
+  let probe: ProxyRuntimeFixture.BlockingProbe
+  let signals: CommitSignals
+}
+
+@MainActor
+private func makePluginMappingCommitSetup() throws -> PluginMappingCommitSetup {
+  let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+  let first = runtime.directory.appendingPathComponent("first")
+  let second = runtime.directory.appendingPathComponent("second")
+  let third = runtime.directory.appendingPathComponent("third")
+  try installPluginCommitExecutables([first, second, third])
+  let store = PluginMappingFileStore(
+    fileURL: runtime.directory.appendingPathComponent("mappings/plugins.json"))
+  let plugins = PluginCatalog(store: store, inspector: CommitPluginInspector())
+  try plugins.addPlugin(program: "tool", path: first.path)
+  let catalog = try makePluginMappingCatalogSetup(in: runtime.directory)
+  let files = RuntimeFileStore(fileURL: runtime.contract)
+  let agent = ProxyRuntimeFixture.FakeLaunchAgent()
+  let probe = ProxyRuntimeFixture.BlockingProbe()
+  let signals = CommitSignals()
+  agent.onRegister = {
+    try? Data("42".utf8).write(to: files.pidFileURL)
+    try? files.writePublishedRuntimeReceipt(processID: 42)
+  }
+  let controller = makePluginMappingCommitController(
+    PluginMappingControllerContext(
+      directory: runtime.directory, bootstrap: catalog.bootstrap, files: files,
+      plugins: plugins, agent: agent, probe: probe, signals: signals))
+  let workflow = makeCatalogWorkflow(
+    coordinator: CatalogCommitCoordinator(
+      fileStore: catalog.fileStore, runtime: ProxyRuntimeSyncAdapter(controller: controller),
+      bootstrap: catalog.bootstrap), plugins: plugins)
+  return PluginMappingCommitSetup(
+    runtime: runtime, first: first, second: second, third: third, store: store,
+    plugins: plugins, files: files, agent: agent, probe: probe, signals: signals,
+    controller: controller, workflow: workflow, group: catalog.group,
+    pluginServer: catalog.pluginServer, plainServer: catalog.plainServer)
+}
+
+private func installPluginCommitExecutables(_ binaries: [URL]) throws {
+  for binary in binaries {
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+  }
+}
+
+@MainActor
+private func makePluginMappingCatalogSetup(in directory: URL) throws -> PluginMappingCatalogSetup {
+  let store = makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.json"))
+  var catalog = ConfigurationCatalog()
+  let group = try catalog.addGroup("Group")
+  let pluginServer = try ActivationFixture.addPlainServer("Plugin", to: group, in: &catalog)
+  let plainServer = try ActivationFixture.addPlainServer("Plain", to: group, in: &catalog)
+  guard case .server(var fields) = try #require(catalog.entry(for: pluginServer)).kind else {
+    throw CocoaError(.fileReadCorruptFile)
+  }
+  fields.pluginProgram = "tool"
+  try catalog.updateServer(pluginServer, with: fields)
+  try store.save(CatalogDocument(catalog: catalog))
+  return PluginMappingCatalogSetup(
+    fileStore: store, bootstrap: CatalogCommitCoordinator.bootstrap(fileStore: store),
+    group: group, pluginServer: pluginServer, plainServer: plainServer)
+}
+
+@MainActor
+private func makePluginMappingCommitController(
+  _ context: PluginMappingControllerContext
+) -> ProxyRuntimeController {
+  let directory = context.directory
+  let bootstrap = context.bootstrap
+  let files = context.files
+  let plugins = context.plugins
+  let agent = context.agent
+  let probe = context.probe
+  let signals = context.signals
+  let contractURL = files.fileURL
+  return ProxyRuntimeController(
+    controlPreferences: makeTestProxyControlPreferences(),
+    catalogSnapshotReader: bootstrap.catalogSnapshotReader,
+    activationFileStore: ActivationStateFileStore(
+      fileURL: directory.appendingPathComponent("activation.json")),
+    runtimeFileStore: files, plugins: plugins,
+    listeningStore: InMemoryProxyListeningStore(),
+    customRuleStore: CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json")),
+    appBundle: AppArtifact.bundle,
+    ruleSnapshots: BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot),
+    settingsRestore: RestoredProxyRuntimeSettings(
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: true),
+      unreadableError: nil),
+    agent: agent, probe: probe, systemProxy: ProxyRuntimeFixture.FakeSystemProxy(),
+    systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService(),
+    firewallChecker: ProxyRuntimeFixture.FakeFirewallChecker(),
+    launchHealthTimeoutSeconds: 0.2,
+    launchHealthRetryDelay: { try await Task.sleep(for: .milliseconds(10)) },
+    sendSignal: { _, signal in
+      guard signal != 0 else { return 0 }
+      signals.record()
+      let store = RuntimeFileStore(fileURL: contractURL)
+      try? store.writePublishedRuntimeReceipt(processID: 42)
+      return 0
+    }, processIsAlive: { $0 == 42 })
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/PluginOptionsModePickerTests.swift b/ShadowsocksX-NG2/Tests/Plugin/PluginOptionsModePickerTests.swift
new file mode 100644
index 000000000..21bdbefb1
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/PluginOptionsModePickerTests.swift
@@ -0,0 +1,66 @@
+import AppKit
+import Combine
+import SwiftUI
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct PluginOptionsModePickerTests {
+  @Test
+  func nativePickerDefersDraftPublicationUntilAfterItsAction() async throws {
+    let draft = PluginOptionsDraft()
+    draft.load("tls;host=example.com;path=/ws;")
+    let host = NSHostingView(rootView: PluginOptionsModePicker(draft: draft))
+    host.frame = NSRect(x: 0, y: 0, width: 320, height: 60)
+    host.layoutSubtreeIfNeeded()
+    let picker = try #require(Self.segmentedControl(in: host))
+    var publications = 0
+    let observation = draft.objectWillChange.sink { publications += 1 }
+    defer { observation.cancel() }
+
+    // 原生 macOS Picker 的 action 在 SwiftUI 更新事务内写入绑定。
+    // 此时同步发布 ObservableObject 变更会触发运行时警告。
+    picker.selectedSegment = 1
+    picker.sendAction(picker.action, to: picker.target)
+    #expect(publications == 0)
+    #expect(draft.mode == .table)
+
+    await Task { @MainActor in }.value
+    #expect(draft.mode == .rawText)
+    #expect(draft.rawText == "tls;host=example.com;path=/ws;")
+    #expect(publications > 0)
+
+    publications = 0
+    picker.selectedSegment = 0
+    picker.sendAction(picker.action, to: picker.target)
+    #expect(publications == 0)
+    await Task { @MainActor in }.value
+    #expect(draft.mode == .table)
+    #expect(draft.composedString == "tls;host=example.com;path=/ws;")
+  }
+
+  @Test
+  func nativePickerKeepsTableModeWhenARowIsUnfinished() async throws {
+    let draft = PluginOptionsDraft()
+    draft.load("host=example.com")
+    draft.updateValue("unfinished", of: draft.quickAddRowID)
+    let host = NSHostingView(rootView: PluginOptionsModePicker(draft: draft))
+    host.frame = NSRect(x: 0, y: 0, width: 320, height: 60)
+    host.layoutSubtreeIfNeeded()
+    let picker = try #require(Self.segmentedControl(in: host))
+
+    picker.selectedSegment = 1
+    picker.sendAction(picker.action, to: picker.target)
+    await Task { @MainActor in }.value
+    host.layoutSubtreeIfNeeded()
+    #expect(draft.mode == .table)
+    #expect(draft.hasUnfinishedRows)
+    #expect(picker.selectedSegment == 0)
+  }
+
+  private static func segmentedControl(in view: NSView) -> NSSegmentedControl? {
+    if let control = view as? NSSegmentedControl { return control }
+    return view.subviews.lazy.compactMap { segmentedControl(in: $0) }.first
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/PluginRecordTests.swift b/ShadowsocksX-NG2/Tests/Plugin/PluginRecordTests.swift
new file mode 100644
index 000000000..e31f6ebe5
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/PluginRecordTests.swift
@@ -0,0 +1,349 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct PluginRecordTests {
+  @Test(arguments: [
+    #"""
+    {"userPlugins":[{"id":"00000000-0000-0000-0000-000000000001","names":["tool"],
+    "path":"/missing/tool","arguments":[],"plugin_mode":"udp_only"}],"managedArguments":{}}
+    """#,
+    #"""
+    {"userPlugins":[],"managedArguments":{},
+    "managedModes":{"v2ray-plugin":"udp_only"}}
+    """#,
+  ])
+  func unknownTransportModeBlocksReadingWithoutRewriting(configurationJSON: String) throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let store = PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json"))
+    let original = Data(
+      "{\"version\":2,\"configuration\":\(configurationJSON)}".utf8)
+    try original.write(to: store.fileURL)
+    #expect(throws: PluginMappingError.unreadable) { try store.load() }
+    #expect(try Data(contentsOf: store.fileURL) == original)
+  }
+
+  @Test func oldV2RecordsDefaultToTCPWithoutRewriting() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let store = PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json"))
+    let original = Data(
+      #"""
+      {"version":2,"configuration":{"userPlugins":[
+      {"id":"00000000-0000-0000-0000-000000000001","names":["tool"],
+      "path":"/missing/tool","arguments":[]}],"managedArguments":{}}}
+      """#
+      .utf8)
+    try original.write(to: store.fileURL)
+    let configuration = try store.load()
+    #expect(configuration.userPlugins.first?.mode == .tcpOnly)
+    #expect(
+      PluginCatalogSnapshot(configuration: configuration).managedRecords["v2ray-plugin"]?.mode
+        == .tcpOnly)
+    #expect(try Data(contentsOf: store.fileURL) == original)
+    try store.save(configuration)
+    #expect(try store.load() == configuration)
+  }
+
+  @Test @MainActor func managedModePersistsAcrossAliasesAndArgumentClearing() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let binary = root.appendingPathComponent("Contents/Helpers/Plugins/v2ray-plugin")
+    try FileManager.default.createDirectory(
+      at: binary.deletingLastPathComponent(), withIntermediateDirectories: true)
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let store = PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json"))
+    let managed = BundleManagedPluginProvider(bundleURL: root)
+    let initial = PluginCatalog(store: store, managed: managed, inspector: QuietPluginInspector())
+    let originalArguments = try #require(initial.resolve(program: "v2ray-plugin")).arguments
+    try Data(
+      #"""
+      {"version":2,"configuration":{"userPlugins":[],
+      "managedArguments":{"v2ray-plugin":["--verbose"]},
+      "managedModes":{"v2ray-plugin":"tcp_and_udp"}}}
+      """#
+      .utf8
+    ).write(to: store.fileURL)
+    let catalog = PluginCatalog(store: store, managed: managed, inspector: QuietPluginInspector())
+    #expect(catalog.resolve(program: "v2ray-plugin-v1")?.mode == .tcpAndUDP)
+    try catalog.commit([.managedArguments(program: "v2ray-plugin", arguments: [])])
+    let restored = PluginCatalog(store: store, managed: managed, inspector: QuietPluginInspector())
+    #expect(restored.resolve(program: "v2ray-plugin")?.mode == .tcpAndUDP)
+    #expect(restored.resolve(program: "v2ray-plugin")?.arguments == originalArguments)
+    try restored.commit([.save(UserPluginRecord(names: ["v2ray-plugin"], path: binary.path))])
+    #expect(restored.resolve(program: "v2ray-plugin")?.mode == .tcpOnly)
+    #expect(restored.resolve(program: "v2ray-plugin-v1")?.mode == .tcpAndUDP)
+  }
+
+  @Test @MainActor func nameConflictAndInvalidArgumentsDoNotPublish() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let binary = root.appendingPathComponent("tool")
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let store = PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json"))
+    let catalog = PluginCatalog(store: store, inspector: QuietPluginInspector())
+    let first = UserPluginRecord(names: ["tool", "tool-v2"], path: binary.path)
+    try catalog.commit([.save(first)])
+    let bytes = try Data(contentsOf: store.fileURL)
+    let generation = catalog.catalogSnapshot().generation
+    #expect(throws: PluginMappingError.nameExists) {
+      try catalog.commit([.save(UserPluginRecord(names: ["tool-v2"], path: binary.path))])
+    }
+    #expect(throws: PluginMappingError.invalidArguments) {
+      try catalog.commit([.managedArguments(program: "v2ray-plugin", arguments: ["bad\0value"])])
+    }
+    #expect(try Data(contentsOf: store.fileURL) == bytes)
+    #expect(catalog.catalogSnapshot().generation == generation)
+    #expect(catalog.userRecords == [first])
+    var renamed = first
+    renamed.names = ["tool-v2"]
+    try catalog.commit([.save(renamed)])
+    #expect(catalog.resolve(program: "tool") == nil)
+    #expect(catalog.userRecords.first?.id == first.id)
+    #expect(catalog.resolve(program: "tool-v2")?.path == binary.path)
+  }
+
+  @Test func legacyMappingsMigrateIndependentlyAndReadDoesNotRewriteFile() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let store = PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json"))
+    let original = Data(
+      #"{"version":1,"mappings":{"tool":"/missing/tool","tool-v2":"/missing/tool"}}"#.utf8)
+    try original.write(to: store.fileURL)
+    let configuration = try store.load()
+    #expect(configuration.userPlugins.count == 2)
+    #expect(Set(configuration.userPlugins.map(\.id)).count == 2)
+    #expect(configuration.userPlugins.map(\.names) == [["tool"], ["tool-v2"]])
+    #expect(
+      configuration.userPlugins.allSatisfy {
+        $0.arguments.isEmpty && $0.path == "/missing/tool" && $0.mode == .tcpOnly
+      })
+    #expect(try Data(contentsOf: store.fileURL) == original)
+    try store.save(configuration)
+    #expect(try store.load() == configuration)
+    let json = try #require(
+      JSONSerialization.jsonObject(with: Data(contentsOf: store.fileURL)) as? [String: Any])
+    #expect(json["version"] as? Int == 2)
+  }
+
+  @Test(arguments: [PluginTransportMode.tcpOnly, .tcpAndUDP])
+  @MainActor func activationWritesLocalArgumentsWithoutChangingServerOptions(
+    mode: PluginTransportMode
+  ) throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let binary = root.appendingPathComponent("tool")
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let plugins = PluginCatalog(
+      store: PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json")),
+      inspector: QuietPluginInspector())
+    try plugins.commit([
+      .save(
+        UserPluginRecord(
+          names: ["tool", "tool-v2"], path: binary.path,
+          arguments: ["--threads", "4", "--log-file", "/tmp/My Log.txt", ""], mode: mode))
+    ])
+    var catalog = ConfigurationCatalog()
+    let leaf = try ActivationFixture.addPlainServer(
+      "Plugin", in: &catalog)
+    var fields = try ActivationFixture.serverFields(of: leaf, in: catalog)
+    fields.pluginProgram = "tool-v2"
+    fields.pluginOptions = "options"
+    fields.pluginOptions = "tls;host=example.com"
+    try catalog.updateServer(leaf, with: fields)
+    var machine = ActivationStateMachine()
+    let runtime = try machine.activate(
+      leaf, in: catalog, plugins: plugins,
+      options: RuntimeDocumentOptions(listen: ActivationFixture.listen))
+    let json = try #require(
+      JSONSerialization.jsonObject(with: runtime.document.jsonData()) as? [String: Any])
+    let server = try #require((json["servers"] as? [[String: Any]])?.first)
+    #expect(
+      server["plugin_args"] as? [String] == ["--threads", "4", "--log-file", "/tmp/My Log.txt", ""])
+    #expect(server["plugin_mode"] as? String == (mode == .tcpAndUDP ? "tcp_and_udp" : nil))
+    #expect(server["plugin"] as? String == binary.path)
+    #expect(server["plugin_opts"] as? String == "tls;host=example.com")
+    #expect(try ActivationFixture.serverFields(of: leaf, in: catalog).pluginProgram == "tool-v2")
+  }
+
+  @Test(arguments: ["v2ray-plugin", "v2ray-plugin-v1"], [false, true])
+  @MainActor func activationAppliesAccessLogDefaultOnlyToManagedPlugins(
+    program: String, overrideManaged: Bool
+  ) throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let binary = root.appendingPathComponent("Contents/Helpers/Plugins/v2ray-plugin")
+    try FileManager.default.createDirectory(
+      at: binary.deletingLastPathComponent(), withIntermediateDirectories: true)
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let plugins = PluginCatalog(
+      store: PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json")),
+      managed: BundleManagedPluginProvider(bundleURL: root), inspector: QuietPluginInspector())
+    try plugins.commit([.managedArguments(program: "v2ray-plugin", arguments: ["--verbose"])])
+    if overrideManaged {
+      try plugins.commit([
+        .save(UserPluginRecord(names: [program], path: binary.path, arguments: ["--user-option"]))
+      ])
+    }
+    var catalog = ConfigurationCatalog()
+    let leaf = try ActivationFixture.addPlainServer("Plugin", in: &catalog)
+    var fields = try ActivationFixture.serverFields(of: leaf, in: catalog)
+    fields.pluginProgram = program
+    fields.pluginOptions = "tls;host=example.com"
+    try catalog.updateServer(leaf, with: fields)
+    var machine = ActivationStateMachine()
+    let runtime = try machine.activate(
+      leaf, in: catalog, plugins: plugins,
+      options: RuntimeDocumentOptions(listen: ActivationFixture.listen))
+    let json = try #require(
+      JSONSerialization.jsonObject(with: runtime.document.jsonData()) as? [String: Any])
+    let server = try #require((json["servers"] as? [[String: Any]])?.first)
+    #expect(
+      server["plugin_args"] as? [String]
+        == (overrideManaged ? ["--user-option"] : ["-disableAccessLog", "--verbose"]))
+    #expect(server["plugin"] as? String == binary.path)
+    #expect(server["plugin_opts"] as? String == "tls;host=example.com")
+  }
+
+  @Test @MainActor func aliasesShareArgumentsAndOnlyExplicitNamesOverrideManaged() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let binary = root.appendingPathComponent("Contents/Helpers/Plugins/v2ray-plugin")
+    try FileManager.default.createDirectory(
+      at: binary.deletingLastPathComponent(), withIntermediateDirectories: true)
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let store = PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json"))
+    let catalog = PluginCatalog(
+      store: store, managed: BundleManagedPluginProvider(bundleURL: root),
+      inspector: QuietPluginInspector())
+    let originalAlias = try #require(catalog.resolve(program: "v2ray-plugin-v1"))
+    let record = UserPluginRecord(
+      names: ["v2ray-plugin", "custom-v2"], path: binary.path,
+      arguments: ["--config", "/Users/me/My Config.json", "", "--verbose"])
+    try catalog.commit([.save(record)])
+    let snapshot = catalog.catalogSnapshot()
+    #expect(snapshot.resolve(program: "custom-v2")?.arguments == record.arguments)
+    #expect(snapshot.resolve(program: "v2ray-plugin") == snapshot.resolve(program: "custom-v2"))
+    #expect(snapshot.entry(for: "v2ray-plugin-v1")?.source == .managed)
+    #expect(snapshot.resolve(program: "v2ray-plugin-v1") == originalAlias)
+    let restored = PluginCatalog(store: store, inspector: QuietPluginInspector())
+    #expect(restored.userRecords == [record])
+  }
+
+}
+
+extension PluginRecordTests {
+  @Test @MainActor func cloakOverrideOnlyReplacesExplicitAlias() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let client = root.appendingPathComponent("Contents/Helpers/Plugins/ck-client")
+    try FileManager.default.createDirectory(
+      at: client.deletingLastPathComponent(),
+      withIntermediateDirectories: true)
+    try Data("#!/bin/sh\n".utf8).write(to: client)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: client.path)
+    let catalog = PluginCatalog(
+      store: PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json")),
+      managed: BundleManagedPluginProvider(bundleURL: root), inspector: QuietPluginInspector())
+    try catalog.commit([.managedArguments(program: "ck-client", arguments: ["-v"])])
+    let userClient = root.appendingPathComponent("user-client")
+    try Data("#!/bin/sh\n".utf8).write(to: userClient)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: userClient.path)
+    let user = UserPluginRecord(
+      names: ["cloak"], path: userClient.path, arguments: ["-c", "local.json"])
+    try catalog.commit([.save(user)])
+    #expect(catalog.resolve(program: "cloak")?.arguments == user.arguments)
+    #expect(catalog.resolve(program: "cloak-v2")?.arguments == ["-v"])
+    #expect(catalog.catalogSnapshot().entry(for: "cloak")?.source == .user)
+    #expect(catalog.catalogSnapshot().entry(for: "cloak-v2")?.source == .managed)
+    try FileManager.default.removeItem(at: userClient)
+    #expect(catalog.resolve(program: "cloak") == nil)
+    #expect(catalog.resolve(program: "cloak-v2")?.path == client.path)
+    #expect(catalog.catalogSnapshot().entry(for: "cloak")?.source == .user)
+    try catalog.commit([.remove(user.id)])
+    #expect(catalog.resolve(program: "cloak")?.arguments == ["-v"])
+  }
+}
+
+extension PluginRecordTests {
+  @Test @MainActor func sharingKeepsReferenceAndOptionsWithoutLocalArguments() async throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let binary = root.appendingPathComponent("tool")
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let plugins = PluginCatalog(
+      store: PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json")),
+      inspector: QuietPluginInspector())
+    try plugins.commit([
+      .save(
+        UserPluginRecord(
+          names: ["tool", "tool-v2"], path: binary.path,
+          arguments: ["--local-argument-sentinel"], mode: .tcpAndUDP))
+    ])
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: root.appendingPathComponent("catalog.json")),
+        runtime: FakeCatalogRuntime()), plugins: plugins)
+    let group = try await workflow.createGroup(named: "Share", into: nil)
+    let id = try await workflow.createServer(
+      ServerEditDraft(
+        address: "example.com", port: 8388,
+        encryptionMethod: "aes-256-gcm", password: "pw", remark: "Plugin",
+        plugin: .named(program: "tool-v2"), pluginOptions: "tls;host=example.com"), into: group)
+    let draft = try workflow.configurationGroupExportDraft(for: group)
+    let json = try #require(JSONSerialization.jsonObject(with: draft.data) as? [String: Any])
+    let server = try #require((json["servers"] as? [[String: Any]])?.first)
+    #expect(server["plugin"] as? String == "tool-v2")
+    #expect(server["plugin_opts"] as? String == "tls;host=example.com")
+    #expect(server["plugin_args"] == nil)
+    #expect(server["plugin_mode"] == nil)
+    let uri = try workflow.shareURI(for: id)
+    #expect(uri.contains("tool-v2"))
+    #expect(!uri.contains("local-argument-sentinel"))
+    #expect(!uri.contains("tcp_and_udp"))
+    let exportedText = try #require(String(bytes: draft.data, encoding: .utf8))
+    #expect(!exportedText.contains(binary.path))
+  }
+
+  @Test @MainActor func managedArgumentsRemainWithUncoveredAliasesAndCanBeCleared() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let binary = root.appendingPathComponent("Contents/Helpers/Plugins/v2ray-plugin")
+    try FileManager.default.createDirectory(
+      at: binary.deletingLastPathComponent(), withIntermediateDirectories: true)
+    try Data("#!/bin/sh\n".utf8).write(to: binary)
+    try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: binary.path)
+    let store = PluginMappingFileStore(fileURL: root.appendingPathComponent("plugins.json"))
+    let managed = BundleManagedPluginProvider(bundleURL: root)
+    let catalog = PluginCatalog(store: store, managed: managed, inspector: QuietPluginInspector())
+    let originalArguments = try #require(catalog.resolve(program: "v2ray-plugin-v1")).arguments
+    try catalog.commit([.managedArguments(program: "v2ray-plugin", arguments: ["--verbose"])])
+    let configuredAlias = try #require(catalog.resolve(program: "v2ray-plugin-v1"))
+    #expect(configuredAlias.arguments == originalArguments + ["--verbose"])
+    let user = UserPluginRecord(
+      names: ["v2ray-plugin"], path: binary.path, arguments: ["--threads", "4"])
+    try catalog.commit([.save(user)])
+    #expect(catalog.resolve(program: "v2ray-plugin")?.arguments == ["--threads", "4"])
+    let restored = PluginCatalog(store: store, managed: managed, inspector: QuietPluginInspector())
+    #expect(restored.resolve(program: "v2ray-plugin-v1") == configuredAlias)
+    try restored.commit([.managedArguments(program: "v2ray-plugin", arguments: [])])
+    #expect(restored.resolve(program: "v2ray-plugin-v1")?.arguments == originalArguments)
+    #expect(restored.resolve(program: "v2ray-plugin")?.arguments == ["--threads", "4"])
+    try restored.commit([.remove(user.id)])
+    #expect(restored.resolve(program: "v2ray-plugin")?.arguments == originalArguments)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/PluginSecurityInspectionTests.swift b/ShadowsocksX-NG2/Tests/Plugin/PluginSecurityInspectionTests.swift
new file mode 100644
index 000000000..e0cefb367
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/PluginSecurityInspectionTests.swift
@@ -0,0 +1,24 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct PluginSecurityInspectionTests {
+  @Test func commandLineAssessmentContextIsNotReportedAsExecutionBlock() async throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let binary = root.appendingPathComponent("tool")
+    try Data([0xcf, 0xfa, 0xed, 0xfe]).write(to: binary)
+    let checker = MacOSPluginInspection { tool, _ in
+      if tool.lastPathComponent == "codesign" {
+        return PluginInspectionCommandResult(status: 0, output: "valid on disk")
+      }
+      return PluginInspectionCommandResult(
+        status: 3, output: "tool: rejected (the code is valid but does not seem to be an app)")
+    }
+    let facts = await checker.inspect(binary)
+    #expect(facts.signature == .valid)
+    #expect(facts.policy == .notApplicable)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Plugin/ThirdPartyComponentsTests.swift b/ShadowsocksX-NG2/Tests/Plugin/ThirdPartyComponentsTests.swift
new file mode 100644
index 000000000..a0a17d9cc
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Plugin/ThirdPartyComponentsTests.swift
@@ -0,0 +1,63 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct ThirdPartyComponentsTests {
+  @Test func repeatedReferencesAppearOnceAndMissingTextRejectsEntirePresentation() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let resources = root.appendingPathComponent("Contents/Resources/ThirdParty")
+    let shared = "third-party-licenses/MIT.txt"
+    let extra = "third-party-licenses/additional-notices/COPYRIGHT.txt"
+    for reference in ["plugin/LICENSE", "plugin/NOTICE", shared, extra] {
+      let file = resources.appendingPathComponent(reference)
+      try FileManager.default.createDirectory(
+        at: file.deletingLastPathComponent(), withIntermediateDirectories: true)
+      try "Original text: \(reference)\n".write(to: file, atomically: true, encoding: .utf8)
+    }
+    let dependency = BundledDependency(
+      id: "plugin", name: "Plugin", projectURL: "https://example.com/project",
+      sourceURL: "https://example.com/fork", distributionURL: "https://example.com/releases",
+      version: "0123456789abcdef0123456789abcdef01234567",
+      licenses: ["plugin/LICENSE"], notices: ["plugin/NOTICE", shared, shared, extra])
+    struct Catalog: Encodable {
+      let schemaVersion = 1
+      let dependencies: [BundledDependency]
+    }
+    let catalogURL = resources.appendingPathComponent("catalog.json")
+    try JSONEncoder().encode(Catalog(dependencies: [dependency])).write(to: catalogURL)
+    let contents = try ThirdPartyComponents(bundleURL: root)
+    let component = try #require(contents.components.first)
+    #expect(component.metadata == dependency)
+    #expect(component.sharedLicenses.map(\.reference) == [shared])
+    #expect(component.sharedLicenses.first?.text == "Original text: third-party-licenses/MIT.txt\n")
+    #expect(component.notices.map(\.reference) == ["plugin/NOTICE", extra])
+
+    try FileManager.default.removeItem(at: resources.appendingPathComponent(shared))
+    #expect(throws: (any Error).self) { try ThirdPartyComponents(bundleURL: root) }
+    try Data("broken".utf8).write(to: catalogURL)
+    #expect(throws: (any Error).self) { try ThirdPartyComponents(bundleURL: root) }
+    try FileManager.default.removeItem(at: catalogURL)
+    #expect(throws: (any Error).self) { try ThirdPartyComponents(bundleURL: root) }
+  }
+
+  @Test func installedComponentsExposeCompleteOfflineDocuments() throws {
+    let contents = try ThirdPartyComponents(bundleURL: AppArtifact.bundleURL)
+    #expect(contents.components.count == 7)
+    #expect(contents.components.first?.metadata.name == "AgeSwift")
+    let plugin = try #require(contents.components.first { $0.id == "v2ray-plugin" })
+    #expect(plugin.licenses.map(\.reference) == ["v2ray-plugin/LICENSE"])
+    #expect(plugin.sharedLicenses.contains { $0.reference == "third-party-licenses/MIT.txt" })
+    #expect(plugin.notices.contains { $0.reference == "v2ray-plugin/THIRD-PARTY-NOTICES" })
+    #expect(plugin.notices.allSatisfy { !$0.reference.hasSuffix("/MIT.txt") })
+    let catalog = try BundledDependencyCatalog(bundleURL: AppArtifact.bundleURL)
+    for component in contents.components {
+      let documents = component.licenses + component.notices + component.sharedLicenses
+      #expect(Set(documents.map(\.reference)).count == documents.count)
+      for document in documents {
+        #expect(try document.text == catalog.text(at: document.reference))
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Presentation/DetailFeedbackStateTests.swift b/ShadowsocksX-NG2/Tests/Presentation/DetailFeedbackStateTests.swift
new file mode 100644
index 000000000..626ec29e3
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Presentation/DetailFeedbackStateTests.swift
@@ -0,0 +1,171 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct DetailFeedbackStateTests {
+  @Test func successExpiresFromCompletionRatherThanAppearance() async {
+    let completedAt = Date(timeIntervalSince1970: 100)
+    let result = SubscriptionRefreshCompletion(completedAt: completedAt)
+    let gate = AsyncGate()
+    let entered = AsyncGate()
+    var delays: [TimeInterval] = []
+    let state = DetailFeedbackState<SubscriptionRefreshCompletion>(
+      now: { completedAt.addingTimeInterval(2) },
+      sleep: { delay in
+        delays.append(delay)
+        entered.release()
+        await gate.wait()
+      })
+    let task = Task { await state.present(result) }
+    await entered.wait()
+    #expect(state.completion == result)
+    #expect(delays == [1])
+    gate.release()
+    await task.value
+    #expect(state.completion == nil)
+  }
+  @Test func supersededTaskCannotClearNewResult() async {
+    let date = Date(timeIntervalSince1970: 100)
+    let first = SubscriptionRefreshCompletion(completedAt: date)
+    let next = SubscriptionRefreshCompletion(completedAt: date, failure: .httpStatus(code: 503))
+    let firstEntered = AsyncGate()
+    let nextEntered = AsyncGate()
+    let firstSleep = AsyncGate()
+    let nextSleep = AsyncGate()
+    var calls = 0
+    let state = DetailFeedbackState<SubscriptionRefreshCompletion>(
+      now: { date },
+      sleep: { _ in
+        calls += 1
+        if calls == 1 {
+          firstEntered.release()
+          await firstSleep.wait()
+        } else {
+          nextEntered.release()
+          await nextSleep.wait()
+        }
+      })
+    let oldTask = Task { await state.present(first) }
+    await firstEntered.wait()
+    oldTask.cancel()
+    let newTask = Task { await state.present(next) }
+    await nextEntered.wait()
+    firstSleep.release()
+    await oldTask.value
+    #expect(state.completion == next)
+    nextSleep.release()
+    await newTask.value
+    #expect(state.completion == nil)
+  }
+  @Test(arguments: [
+    (ActivationFeedbackState.Feedback.activated(skippedInvalid: 2), 3.0),
+    (.rejected(.noActiveTarget), 10.0),
+    (.failed(message: "failure"), 10.0),
+  ])
+  func activationUsesTheSharedLifetime(
+    feedback: ActivationFeedbackState.Feedback, seconds: TimeInterval
+  ) async {
+    let date = Date(timeIntervalSince1970: 100)
+    let result = ActivationFeedbackState.Completion(
+      targetID: NodeID(rawValue: "a"), feedback: feedback, completedAt: date)
+    await checkLifetime(result, seconds: seconds)
+  }
+
+  @Test func subscriptionFailureLastsTenSeconds() async {
+    await checkLifetime(
+      SubscriptionRefreshCompletion(
+        completedAt: Date(timeIntervalSince1970: 100), failure: .httpStatus(code: 503)),
+      seconds: 10)
+  }
+
+  @Test func leavingCancelsAndReturningUsesRemainingLifetime() async {
+    let date = Date(timeIntervalSince1970: 100)
+    let result = SubscriptionRefreshCompletion(completedAt: date)
+    var now = date
+    var delays: [TimeInterval] = []
+    let firstEntered = AsyncGate()
+    let nextEntered = AsyncGate()
+    let firstSleep = AsyncGate()
+    let nextSleep = AsyncGate()
+    let state = DetailFeedbackState<SubscriptionRefreshCompletion>(
+      now: { now },
+      sleep: { delay in
+        delays.append(delay)
+        let isFirst = delays.count == 1
+        let entered = isFirst ? firstEntered : nextEntered
+        let sleeper = isFirst ? firstSleep : nextSleep
+        try await withTaskCancellationHandler {
+          entered.release()
+          await sleeper.wait()
+          try Task.checkCancellation()
+        } onCancel: {
+          sleeper.release()
+        }
+      })
+    let firstVisit = Task { await state.present(result) }
+    await firstEntered.wait()
+    firstVisit.cancel()
+    await firstVisit.value
+    #expect(state.completion == nil)
+    now = date.addingTimeInterval(2)
+    let nextVisit = Task { await state.present(result) }
+    await nextEntered.wait()
+    #expect(state.completion == result)
+    #expect(delays == [3, 1])
+    nextSleep.release()
+    await nextVisit.value
+    now = date.addingTimeInterval(3)
+    await state.present(result)
+    #expect(state.completion == nil)
+    #expect(delays == [3, 1])
+  }
+
+  @Test func clearingInputInvalidatesPendingExpiration() async {
+    let date = Date(timeIntervalSince1970: 100)
+    let result = SubscriptionRefreshCompletion(completedAt: date)
+    let entered = AsyncGate()
+    let sleeper = AsyncGate()
+    let state = DetailFeedbackState<SubscriptionRefreshCompletion>(
+      now: { date },
+      sleep: { _ in
+        entered.release()
+        await sleeper.wait()
+      })
+    let task = Task { await state.present(result) }
+    await entered.wait()
+    await state.present(nil)
+    #expect(state.completion == nil)
+    sleeper.release()
+    await task.value
+    #expect(state.completion == nil)
+  }
+
+  private func checkLifetime<Result: DetailFeedbackResult & Equatable>(
+    _ result: Result, seconds: TimeInterval
+  ) async {
+    var now = result.completedAt
+    var delays: [TimeInterval] = []
+    let entered = AsyncGate()
+    let sleeper = AsyncGate()
+    let state = DetailFeedbackState<Result>(
+      now: { now },
+      sleep: { delay in
+        delays.append(delay)
+        entered.release()
+        await sleeper.wait()
+      })
+    let task = Task { await state.present(result) }
+    await entered.wait()
+    #expect(state.completion == result)
+    #expect(delays == [seconds])
+    sleeper.release()
+    await task.value
+    #expect(state.completion == nil)
+    now = result.completedAt.addingTimeInterval(seconds)
+    await state.present(result)
+    #expect(state.completion == nil)
+    #expect(delays == [seconds])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyControl/ProxyCommandAddressLifecycleTests.swift b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyCommandAddressLifecycleTests.swift
new file mode 100644
index 000000000..ce75f6a64
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyCommandAddressLifecycleTests.swift
@@ -0,0 +1,221 @@
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 选择生命周期与命令生成：两种 shell 共用选中地址（端口取已
+/// 保存值、IPv6 方括号、no_proxy 不变）、会话保留与新会话重置、失效回退
+/// （地址消失/监听方式切换/复制前刷新/枚举失败）与命令边界。
+@MainActor
+final class ProxyCommandAddressLifecycleTests: XCTestCase {
+  private var runtime: FakeProxyRuntime!
+  private var interfaceFacts: FakeLocalInterfaceFacts!
+  private var workflow: ProxyControlWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    runtime = FakeProxyRuntime()
+    interfaceFacts = FakeLocalInterfaceFacts()
+    workflow = ProxyControlWorkflow(
+      runtime: runtime, targetFacts: FakeTargetFacts(), interfaceFacts: interfaceFacts)
+  }
+
+  private func setListenerMode(_ mode: ListenerMode) {
+    runtime.listenFacts = RuntimeListenFacts(
+      listenerMode: .disabled, socksPort: 11086, httpPort: 11087)
+    runtime.listenFacts.lan.isEnabled = mode != .disabled
+    if let lanMode = LANListenerMode(rawValue: mode.rawValue) {
+      runtime.listenFacts.lan.mode = lanMode
+    }
+    runtime.emitChange()
+  }
+
+  func testSelectionDrivesBothShellsAndSavedPorts() {
+    runtime.listenFacts = RuntimeListenFacts(
+      listenerMode: .disabled, socksPort: 11086, httpPort: 11087)
+    runtime.listenFacts.lan.isEnabled = true
+    runtime.listenFacts.lan.mode = .allIPv4Interfaces
+    runtime.listenFacts.lan.socksPort = 12086
+    runtime.listenFacts.lan.httpPort = 12087
+    runtime.emitChange()
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.168.1.10")])
+    ]
+    interfaceFacts.emitChange()
+
+    let wifi = workflow.snapshot.commandAddressPicker.candidates[1]
+    _ = workflow.selectCommandAddress(wifi)
+
+    let commands = workflow.snapshot.terminalProxyEnvironmentCommands
+    XCTAssertEqual(
+      commands.zshBash,
+      "export http_proxy='http://192.168.1.10:12087'; "
+        + "export https_proxy='http://192.168.1.10:12087'; "
+        + "export all_proxy='socks5://192.168.1.10:12086'; "
+        + "export no_proxy='localhost,127.0.0.1,::1,.local';",
+      "HTTP/HTTPS/SOCKS 端点共用选中地址，端口取已保存值，no_proxy 保持不变")
+    XCTAssertEqual(
+      commands.fish,
+      "set -gx http_proxy 'http://192.168.1.10:12087'; "
+        + "set -gx https_proxy 'http://192.168.1.10:12087'; "
+        + "set -gx all_proxy 'socks5://192.168.1.10:12086'; "
+        + "set -gx no_proxy 'localhost,127.0.0.1,::1,.local';",
+      "fish 语法保持 set -gx 形式且端点共用同一地址")
+    XCTAssertTrue(runtime.agentCommands.isEmpty, "命令选址不触发运行时命令")
+    XCTAssertTrue(runtime.systemProxyCommands.isEmpty)
+    XCTAssertTrue(runtime.modeCommands.isEmpty)
+  }
+
+  func testIPv6SelectionProducesBracketedURLs() {
+    setListenerMode(.allIPv4AndIPv6Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(
+        addresses: [.ipv6("2001:db8::1", flags: [.autoconf, .secured])])
+    ]
+    interfaceFacts.emitChange()
+
+    let v6Candidate = workflow.snapshot.commandAddressPicker.candidates[1]
+    _ = workflow.selectCommandAddress(v6Candidate)
+
+    let commands = workflow.snapshot.terminalProxyEnvironmentCommands
+    XCTAssertTrue(
+      commands.zshBash.contains("export http_proxy='http://[2001:db8::1]:11089'"),
+      "IPv6 URL 使用方括号与已保存 HTTP 端口")
+    XCTAssertTrue(
+      commands.fish.contains("set -gx all_proxy 'socks5://[2001:db8::1]:11088'"))
+    XCTAssertFalse(
+      commands.zshBash.contains("autoconf"), "类型注记只进标签，不进命令")
+  }
+
+  func testSelectionSurvivesLeavingAndReenteringHome() {
+    setListenerMode(.allIPv4Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.168.1.10")])
+    ]
+    interfaceFacts.emitChange()
+    let wifi = workflow.snapshot.commandAddressPicker.candidates[1]
+    _ = workflow.selectCommandAddress(wifi)
+
+    _ = workflow.refreshTerminalCommands()  // 离开再进入首页
+
+    XCTAssertEqual(
+      workflow.snapshot.commandAddressPicker.selected.identity, wifi.identity,
+      "同一会话内选择跨首页离开/返回保留")
+  }
+
+  func testNewSessionResetsSelectionToDefaultLoopback() {
+    setListenerMode(.allIPv4Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.168.1.10")])
+    ]
+    interfaceFacts.emitChange()
+    let wifi = workflow.snapshot.commandAddressPicker.candidates[1]
+    _ = workflow.selectCommandAddress(wifi)
+
+    let freshWorkflow = ProxyControlWorkflow(
+      runtime: runtime,
+      targetFacts: FakeTargetFacts(),
+      interfaceFacts: interfaceFacts)
+
+    XCTAssertEqual(
+      freshWorkflow.snapshot.commandAddressPicker.selected.address, "127.0.0.1",
+      "新会话恢复默认回环地址，不沿用先前选择")
+  }
+
+  func testDisappearedAddressFallsBackToLoopback() {
+    setListenerMode(.allIPv4Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.168.1.10")])
+    ]
+    interfaceFacts.emitChange()
+    let wifi = workflow.snapshot.commandAddressPicker.candidates[1]
+    _ = workflow.selectCommandAddress(wifi)
+
+    interfaceFacts.interfaces = []
+    interfaceFacts.emitChange()
+
+    XCTAssertEqual(
+      workflow.snapshot.commandAddressPicker.selected.address, "127.0.0.1",
+      "地址消失回退默认回环")
+  }
+
+  func testListenerModeSwitchToIncompatibleFamilyFallsBack() {
+    setListenerMode(.allIPv4AndIPv6Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv6("2001:db8::1")])
+    ]
+    interfaceFacts.emitChange()
+    let v6Candidate = workflow.snapshot.commandAddressPicker.candidates[1]
+    _ = workflow.selectCommandAddress(v6Candidate)
+
+    setListenerMode(.allIPv4Interfaces)
+
+    XCTAssertEqual(
+      workflow.snapshot.commandAddressPicker.selected.address, "127.0.0.1",
+      "监听方式不再支持该地址族时回退")
+    XCTAssertEqual(
+      workflow.snapshot.commandAddressPicker.candidates.map(\.address),
+      ["127.0.0.1"],
+      "切换监听方式立即重新过滤候选")
+  }
+
+  func testEnumerationFailureKeepsLoopbackCandidatesAndCopy() {
+    setListenerMode(.allIPv4Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.168.1.10")])
+    ]
+    interfaceFacts.emitChange()
+    let wifi = workflow.snapshot.commandAddressPicker.candidates[1]
+    _ = workflow.selectCommandAddress(wifi)
+
+    interfaceFacts.interfaces = nil
+    interfaceFacts.emitChange()
+
+    let picker = workflow.snapshot.commandAddressPicker
+    XCTAssertEqual(
+      picker.candidates.map(\.address), ["127.0.0.1"], "枚举失败仅提供兼容回环候选")
+    XCTAssertEqual(picker.selected.address, "127.0.0.1")
+    XCTAssertTrue(
+      workflow.snapshot.terminalProxyEnvironmentCommands.zshBash.contains("127.0.0.1"),
+      "枚举失败仍可复制回环命令")
+  }
+
+  func testCopyPreparationRefreshesFallsBackAndMatchesProjection() {
+    runtime.listenFacts = RuntimeListenFacts(
+      listenerMode: .disabled, socksPort: 11086, httpPort: 11087)
+    runtime.listenFacts.lan.isEnabled = true
+    runtime.listenFacts.lan.mode = .allIPv4Interfaces
+    runtime.emitChange()
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.168.1.10")])
+    ]
+    interfaceFacts.emitChange()
+    let wifi = workflow.snapshot.commandAddressPicker.candidates[1]
+    _ = workflow.selectCommandAddress(wifi)
+
+    // 复制前地址消失且变化通知丢失：复制前刷新发现失效。
+    interfaceFacts.interfaces = []
+    let prepared = workflow.refreshTerminalCommands()
+
+    XCTAssertFalse(
+      prepared.zshBash.contains("192.168.1.10"), "复制内容不包含已消失的地址")
+    XCTAssertTrue(prepared.zshBash.contains("127.0.0.1"))
+    XCTAssertEqual(
+      prepared, workflow.snapshot.terminalProxyEnvironmentCommands,
+      "复制前刷新产生的变化同步至提示投影")
+    XCTAssertEqual(
+      workflow.snapshot.commandAddressPicker.selected.address, "127.0.0.1",
+      "回退结果更新界面选择")
+  }
+
+  func testProxyOffStillPreparesCommands() {
+    setListenerMode(.allIPv4Interfaces)
+    runtime.runtimeFacts = ProxyRuntimeFacts(status: .off, isOn: false)
+    runtime.emitChange()
+
+    let prepared = workflow.refreshTerminalCommands()
+
+    XCTAssertTrue(prepared.zshBash.contains("127.0.0.1"), "代理未运行时命令仍可准备")
+    XCTAssertEqual(runtime.resyncCount, 0, "刷新不触碰运行时生命周期")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyControl/ProxyCommandAddressWorkflowTests.swift b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyCommandAddressWorkflowTests.swift
new file mode 100644
index 000000000..8934566c0
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyCommandAddressWorkflowTests.swift
@@ -0,0 +1,256 @@
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct LANCommandEnablementTests {
+  @Test(arguments: [false, true])
+  func copyRejectsLostIPIncludingAButtonRenderedBeforeNetworkNotification(
+    notificationDelivered: Bool
+  ) {
+    let runtime = FakeProxyRuntime()
+    let interfaces = FakeLocalInterfaceFacts()
+    runtime.listenFacts.lan.isEnabled = true
+    interfaces.interfaces = [FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.0.2.2")])]
+    let workflow = ProxyControlWorkflow(
+      runtime: runtime, targetFacts: FakeTargetFacts(), interfaceFacts: interfaces)
+    let address = workflow.snapshot.commandAddressPicker.candidates[1]
+    workflow.selectCommandAddress(address)
+    interfaces.interfaces = []
+    if notificationDelivered { interfaces.emitChange() }
+    #expect(throws: TerminalCommandFailure.addressUnavailable) {
+      try workflow.prepareTerminalCommandsForCopy(expectedAddress: address.identity)
+    }
+    #expect(workflow.snapshot.commandAddressPicker.selected.address == "127.0.0.1")
+    #expect(workflow.snapshot.terminalCommandShells == [.zshBash, .fish, .nushell])
+    #expect(runtime.agentCommands.isEmpty)
+    #expect(runtime.systemProxyCommands.isEmpty)
+  }
+
+  @Test func windowsFormatsRequireEnabledLANAndSelectedNetworkIPWithoutRequiringRunningProxy() {
+    let runtime = FakeProxyRuntime()
+    let interfaces = FakeLocalInterfaceFacts()
+    let workflow = ProxyControlWorkflow(
+      runtime: runtime, targetFacts: FakeTargetFacts(), interfaceFacts: interfaces)
+    #expect(workflow.snapshot.terminalCommandShells == [.zshBash, .fish, .nushell])
+    runtime.listenFacts.lan.isEnabled = true
+    interfaces.interfaces = [FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.0.2.2")])]
+    runtime.emitChange()
+    #expect(workflow.snapshot.terminalCommandShells == [.zshBash, .fish, .nushell])
+    workflow.selectCommandAddress(workflow.snapshot.commandAddressPicker.candidates[1])
+    runtime.runtimeFacts = ProxyRuntimeFacts(status: .off, isOn: false)
+    runtime.emitChange()
+    #expect(
+      workflow.snapshot.terminalCommandShells == [
+        .zshBash, .fish, .nushell, .windowsCMD, .windowsPowerShell,
+      ])
+    runtime.listenFacts.lan.isEnabled = false
+    runtime.emitChange()
+    #expect(workflow.snapshot.terminalCommandShells == [.zshBash, .fish, .nushell])
+    #expect(runtime.agentCommands.isEmpty)
+    #expect(runtime.systemProxyCommands.isEmpty)
+  }
+
+  @Test func disablingLANRetainsIPv6ModeAndFallsBackFromSelectedNetworkAddress() {
+    let runtime = FakeProxyRuntime()
+    let interfaces = FakeLocalInterfaceFacts()
+    let workflow = ProxyControlWorkflow(
+      runtime: runtime, targetFacts: FakeTargetFacts(), interfaceFacts: interfaces)
+    runtime.listenFacts.lan.isEnabled = true
+    runtime.listenFacts.lan.mode = .allIPv6Interfaces
+    interfaces.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv6("2001:db8::1")])
+    ]
+    runtime.emitChange()
+    let address = workflow.snapshot.commandAddressPicker.candidates[1]
+    _ = workflow.selectCommandAddress(address)
+    #expect(workflow.snapshot.commandAddressPicker.selected.address == "2001:db8::1")
+    runtime.listenFacts.lan.isEnabled = false
+    runtime.emitChange()
+    #expect(runtime.listenFacts.lan.mode == .allIPv6Interfaces)
+    let picker = workflow.snapshot.commandAddressPicker
+    #expect(!picker.isVisible)
+    #expect(picker.candidates.map(\.address) == ["127.0.0.1"])
+    #expect(picker.selected.address == "127.0.0.1")
+    #expect(
+      workflow.snapshot.terminalProxyEnvironmentCommands.zshBash.contains("http://127.0.0.1:11087"))
+  }
+}
+
+/// 首页命令地址选择器 contract。候选派生：启用状态与三种监听方式的地址族
+/// 过滤与默认值、严格接口类型过滤、名称回退、排序合并与网络变化刷新。选择
+/// 生命周期与命令生成见 `ProxyCommandAddressLifecycleTests`。复用
+/// ProxyControlWorkflowTests 的可编程替身。
+@MainActor
+final class ProxyCommandAddressWorkflowTests: XCTestCase {
+  private var runtime: FakeProxyRuntime!
+  private var interfaceFacts: FakeLocalInterfaceFacts!
+  private var workflow: ProxyControlWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    runtime = FakeProxyRuntime()
+    interfaceFacts = FakeLocalInterfaceFacts()
+    workflow = ProxyControlWorkflow(
+      runtime: runtime, targetFacts: FakeTargetFacts(), interfaceFacts: interfaceFacts)
+  }
+
+  /// 把已保存监听事实切到指定方式并触发重观察。
+  private func setListenerMode(_ mode: ListenerMode) {
+    runtime.listenFacts = RuntimeListenFacts(
+      listenerMode: .disabled, socksPort: 11086, httpPort: 11087)
+    runtime.listenFacts.lan.isEnabled = mode != .disabled
+    if let lanMode = LANListenerMode(rawValue: mode.rawValue) {
+      runtime.listenFacts.lan.mode = lanMode
+    }
+    runtime.emitChange()
+  }
+
+  func testLocalhostModeHidesPickerWithLoopbackOnlyCandidates() {
+    setListenerMode(.disabled)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.168.1.10")]),
+      FakeLocalInterfaceFacts.loopback(),
+    ]
+    interfaceFacts.emitChange()
+
+    let picker = workflow.snapshot.commandAddressPicker
+    XCTAssertFalse(picker.isVisible, "仅本机监听方式隐藏下拉框")
+    XCTAssertEqual(
+      picker.candidates,
+      [TerminalCommandAddress(bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")],
+      "仅本机方式候选只有 IPv4 回环")
+    XCTAssertEqual(picker.selected.address, "127.0.0.1")
+  }
+
+  func testIPv4ModeFiltersFamiliesAndAllowedInterfaceTypes() {
+    setListenerMode(.allIPv4Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(
+        addresses: [.ipv4("192.168.1.10"), .ipv6("2001:db8::1"), .ipv6("fe80::1", linkLocal: true)]
+      ),
+      FakeLocalInterfaceFacts.ethernet(addresses: [.ipv4("10.0.0.5")]),
+      FakeLocalInterfaceFacts.vpn(),
+      FakeLocalInterfaceFacts.virtual(),
+      FakeLocalInterfaceFacts.loopback(),
+    ]
+    interfaceFacts.emitChange()
+
+    let picker = workflow.snapshot.commandAddressPicker
+    XCTAssertTrue(picker.isVisible)
+    XCTAssertEqual(
+      picker.candidates.map(\.address),
+      ["127.0.0.1", "10.0.0.5", "192.168.1.10"],
+      "回环置顶，其余按接口名称排序；IPv6、VPN、其他类型与回环事实不进候选")
+    XCTAssertEqual(picker.selected.address, "127.0.0.1", "默认兼容回环地址")
+  }
+
+  func testDualStackModeIncludesBothLoopbacksAndBothFamilies() {
+    setListenerMode(.allIPv4AndIPv6Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(
+        addresses: [
+          .ipv6("2001:db8::1"), .ipv4("192.168.1.10"), .ipv4("169.254.9.9"),
+          .ipv6("fe80::1", linkLocal: true),
+        ])
+    ]
+    interfaceFacts.emitChange()
+
+    let picker = workflow.snapshot.commandAddressPicker
+    XCTAssertEqual(
+      picker.candidates.map(\.address),
+      ["127.0.0.1", "169.254.9.9", "192.168.1.10", "2001:db8::1"],
+      "双栈提供两个回环（127.0.0.1 在前）、允许 IPv4 链路本地、排除 IPv6 链路本地，同接口 IPv4 先于 IPv6")
+    XCTAssertEqual(picker.selected.address, "127.0.0.1")
+  }
+
+  func testTemporaryIPv6ExcludedAndAnnotationsKeptAsSeparateFacts() {
+    setListenerMode(.allIPv4AndIPv6Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(
+        addresses: [
+          .ipv6("240e::8150", flags: [.autoconf, .secured]),
+          .ipv6("240e::855", flags: [.autoconf, .temporary]),
+          .ipv6("240e::17", flags: [.dynamic]),
+        ])
+    ]
+    interfaceFacts.emitChange()
+
+    let picker = workflow.snapshot.commandAddressPicker
+    XCTAssertEqual(
+      picker.candidates.map(\.address),
+      ["127.0.0.1", "240e::17", "240e::8150"],
+      "RFC 4941 隐私临时地址被过滤（会轮换）；其余按地址稳定排序")
+    let secured = picker.candidates.first { $0.address == "240e::8150" }
+    XCTAssertEqual(secured?.displayName, "Wi-Fi")
+    XCTAssertEqual(secured?.annotation, "autoconf secured", "注记作为独立呈现事实")
+    XCTAssertEqual(
+      picker.candidates.first { $0.address == "240e::17" }?.annotation,
+      "dynamic", "DHCPv6 地址注记 dynamic")
+  }
+
+  func testIPv6OnlyModeDefaultsToV1AndFiltersFamilies() {
+    setListenerMode(.allIPv6Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(
+        addresses: [.ipv4("192.168.1.10"), .ipv6("2001:db8::1")])
+    ]
+    interfaceFacts.emitChange()
+
+    let picker = workflow.snapshot.commandAddressPicker
+    XCTAssertEqual(
+      picker.candidates.map(\.address), ["127.0.0.1", "2001:db8::1"],
+      "仅 IPv6 方式默认 ::1 且候选只有 IPv6")
+    XCTAssertEqual(picker.selected.address, "127.0.0.1")
+  }
+
+  func testDisplayNamesUseLocalizedNameWithBSDNameFallback() {
+    setListenerMode(.allIPv4Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(localizedName: "Wi-Fi", addresses: [.ipv4("192.168.1.10")]),
+      FakeLocalInterfaceFacts.ethernet(localizedName: nil, addresses: [.ipv4("10.0.0.5")]),
+    ]
+    interfaceFacts.emitChange()
+
+    XCTAssertEqual(
+      workflow.snapshot.commandAddressPicker.candidates.map(\.displayName),
+      ["lo0", "en1", "Wi-Fi"],
+      "名称缺失回退 BSD 名，回环显示 lo0")
+  }
+
+  func testSameInterfaceDuplicateIPMergesAcrossInterfacesKept() {
+    setListenerMode(.allIPv4Interfaces)
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(
+        localizedName: "Wi-Fi",
+        addresses: [.ipv4("192.168.1.10"), .ipv4("192.168.1.10")]),
+      FakeLocalInterfaceFacts.ethernet(
+        bsdName: "en2", localizedName: "Ethernet 2", addresses: [.ipv4("192.168.1.10")]),
+    ]
+    interfaceFacts.emitChange()
+
+    let picker = workflow.snapshot.commandAddressPicker
+    XCTAssertEqual(
+      picker.candidates.map(\.identity),
+      [
+        TerminalCommandAddressIdentity(bsdName: "lo0", address: "127.0.0.1"),
+        TerminalCommandAddressIdentity(bsdName: "en2", address: "192.168.1.10"),
+        TerminalCommandAddressIdentity(bsdName: "en0", address: "192.168.1.10"),
+      ],
+      "同接口重复 IP 合并；不同接口同 IP 保留接口身份")
+  }
+
+  func testInterfaceChangeNotificationRepublishesCandidates() {
+    setListenerMode(.allIPv4Interfaces)
+
+    interfaceFacts.interfaces = [
+      FakeLocalInterfaceFacts.wifi(addresses: [.ipv4("192.168.1.10")])
+    ]
+    interfaceFacts.emitChange()
+
+    XCTAssertEqual(
+      workflow.snapshot.commandAddressPicker.candidates.map(\.address),
+      ["127.0.0.1", "192.168.1.10"], "接口事实变化后候选随网络刷新")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests+SystemProxy.swift b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests+SystemProxy.swift
new file mode 100644
index 000000000..848821522
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests+SystemProxy.swift
@@ -0,0 +1,139 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension ProxyControlWorkflowIntegrationTests {
+  func testPassiveNetworkChangesNeverReapplySystemProxy() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+    _ = await composition.control.setSystemProxyEnabled(true)
+    let writes = systemProxy.applied.count
+    XCTAssertEqual(writes, 1)
+    await emitAndWaitForInspection(
+      [.networkConfiguration, .proxyConfiguration, .networkPath], in: composition)
+    XCTAssertEqual(systemProxy.applied.count, writes)
+    XCTAssertEqual(systemProxy.clearCount, 0)
+  }
+
+  // MARK: - 系统代理开关
+
+  func testSystemProxyIntentAppliesThroughSnapshot() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+    let snapshot = await composition.control.setSystemProxyEnabled(true)
+
+    XCTAssertTrue(snapshot.systemProxyIntentEnabled)
+    XCTAssertEqual(snapshot.systemProxyApplication, .applied)
+    XCTAssertEqual(snapshot.runtime.status, .running, "agent 运行状态不受系统代理影响")
+    XCTAssertEqual(systemProxy.applied.count, 1)
+  }
+
+  /// 健康门禁：端点不健康时系统代理意图保持待应用（快照呈现 pending）。
+  func testSystemProxyIntentStaysPendingWhenEndpointsUnhealthy() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.refusing())
+
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+    let snapshot = await composition.control.setSystemProxyEnabled(true)
+
+    XCTAssertTrue(snapshot.systemProxyIntentEnabled)
+    XCTAssertEqual(snapshot.systemProxyApplication, .paused, "待应用进入 snapshot")
+    XCTAssertEqual(snapshot.runtime.status, .launchFailed)
+    XCTAssertTrue(systemProxy.applied.isEmpty, "健康门未过不写系统设置")
+  }
+
+  /// 系统代理写入失败：typed fact 进入 snapshot，agent 继续运行。
+  func testSystemProxyFailureSurfacesTypedFactInSnapshot() async throws {
+    let server = try makeSeededCatalog()
+    systemProxy.applyError = SystemProxyError.applyFailed("denied")
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+    let snapshot = await composition.control.setSystemProxyEnabled(true)
+
+    XCTAssertTrue(snapshot.systemProxyIntentEnabled)
+    XCTAssertEqual(
+      snapshot.systemProxyApplication, .failed(.operation(.applyFailed)))
+    XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .running, isOn: true))
+  }
+
+  /// 关闭系统代理：清理匹配端点的设置；本地监听不停止。
+  func testSystemProxyOffKeepsAgentRunningAndReflectsIdleInSnapshot() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+    _ = await composition.control.setSystemProxyEnabled(true)
+
+    let snapshot = await composition.control.setSystemProxyEnabled(false)
+
+    XCTAssertFalse(snapshot.systemProxyIntentEnabled)
+    XCTAssertEqual(snapshot.systemProxyApplication, .idle)
+    XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .running, isOn: true))
+    XCTAssertEqual(systemProxy.clearCount, 1)
+    XCTAssertEqual(agent.unregisterCount, 0, "不注销 agent")
+  }
+
+  /// 无活动目标：agent 监听，但需要出口的系统代理意图保持待应用。
+  func testSystemProxyIntentStaysPendingWithoutActiveTarget() async throws {
+    _ = try makeSeededCatalog()
+    let composition = makeProxies(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: false))
+    _ = await composition.control.setAgentEnabled(true)
+
+    let snapshot = await composition.control.setSystemProxyEnabled(true)
+
+    XCTAssertEqual(snapshot.runtime.status, .running, "agent 以空列表监听")
+    XCTAssertEqual(snapshot.systemProxyApplication, .paused, "无可用出口保持待应用")
+    XCTAssertTrue(systemProxy.applied.isEmpty)
+    XCTAssertNil(snapshot.activeTarget)
+  }
+
+  /// 待应用意图在目标激活后自动收敛。目录命令后的 snapshot 更新
+  /// 经主队列 hop 到达，有界等待收敛。
+  func testPendingSystemProxyIntentConvergesAfterTargetActivation() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    _ = await composition.control.setAgentEnabled(true)
+    let pending = await composition.control.setSystemProxyEnabled(true)
+    XCTAssertEqual(pending.systemProxyApplication, .paused)
+
+    _ = try await composition.catalog.activate(server)
+    let deadline = Date().addingTimeInterval(2)
+    while composition.control.snapshot.systemProxyApplication != .applied && Date() < deadline {
+      try await Task.sleep(nanoseconds: 10_000_000)
+    }
+
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .applied, "激活后自动收敛")
+    XCTAssertEqual(systemProxy.applied.count, 1)
+  }
+
+  // MARK: - HTTP 导出能力派生（生产 adapter 的唯一点）
+
+  func testHTTPExportCapabilityDerivesSafeCopyableLineForLoopback() {
+    XCTAssertEqual(
+      HTTPExportCapability(listen: ProxyListeningConfiguration()).copyableLine,
+      "export http_proxy=http://127.0.0.1:11087;export https_proxy=http://127.0.0.1:11087;")
+  }
+
+  /// 导出行恒指向本地监听回环 127.0.0.1，与 listenerMode 无关（ADR-0034）。
+  func testHTTPExportCapabilityAlwaysUsesIPv4LoopbackRegardlessOfListenerMode() {
+    for mode in ListenerMode.allCases {
+      var listen = ProxyListeningConfiguration(listenerMode: mode)
+      listen.httpPort = 8080
+
+      XCTAssertEqual(
+        HTTPExportCapability(listen: listen).copyableLine,
+        "export http_proxy=http://127.0.0.1:8080;export https_proxy=http://127.0.0.1:8080;",
+        "\(mode) 不改变导出行")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests+SystemProxyInspection.swift b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests+SystemProxyInspection.swift
new file mode 100644
index 000000000..c80c94432
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests+SystemProxyInspection.swift
@@ -0,0 +1,287 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension ProxyControlWorkflowIntegrationTests {
+  func enabledSystemProxyComposition(
+    probe: ProxyRuntimeFixture.FakeProbe = .reachable()
+  ) async throws -> Composition {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: probe)
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+    _ = await composition.control.setSystemProxyEnabled(true)
+    return composition
+  }
+
+  func waitForSnapshot(
+    _ composition: Composition, matching predicate: (ProxyControlSnapshot) -> Bool
+  ) async throws {
+    let deadline = Date().addingTimeInterval(2)
+    while !predicate(composition.control.snapshot) && Date() < deadline {
+      try await Task.sleep(nanoseconds: 10_000_000)
+    }
+    XCTAssertTrue(predicate(composition.control.snapshot), "实际快照：\(composition.control.snapshot)")
+  }
+
+  func waitForSystemProxyObservationCycle(_ composition: Composition) async throws {
+    systemProxyHelper.setStatus(.requiresApproval)
+    try await waitForSnapshot(composition) { $0.systemProxyApprovalRequired }
+    systemProxyHelper.setStatus(.approved)
+    try await waitForSnapshot(composition) { !$0.systemProxyApprovalRequired }
+  }
+
+  func testCurrentDifferencesIncludeChangedAndNewServicesAndDisappearWhenRestored() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    let original = systemProxy.services[0]
+    systemProxy.services = [
+      SystemProxyServiceState(
+        identifier: original.identifier, configuration: nil, name: "很长的办公室 Wi-Fi 网络接口名称"),
+      SystemProxyServiceState(
+        identifier: .init(locationID: "home", serviceID: "ethernet"), configuration: nil,
+        name: "USB Ethernet"),
+    ]
+    networkMonitor.emit(.proxyConfiguration)
+    try await waitForSnapshot(composition) { $0.systemProxyInspection.differences.count == 2 }
+    XCTAssertEqual(
+      composition.control.snapshot.systemProxyInspection.differences.map(\.kind),
+      [.changed, .notApplied])
+    XCTAssertEqual(
+      composition.control.snapshot.systemProxyInspection.differences.map(\.name),
+      ["很长的办公室 Wi-Fi 网络接口名称", "USB Ethernet"])
+    XCTAssertEqual(systemProxy.applied.count, 1)
+    XCTAssertTrue(composition.control.snapshot.systemProxyInspection.canRepair)
+
+    systemProxy.services[0] = original
+    networkMonitor.emit(.proxyConfiguration)
+    try await waitForSnapshot(composition) { $0.systemProxyInspection.differences.count == 1 }
+    _ = await composition.control.repairSystemProxy()
+    XCTAssertEqual(systemProxy.repairedServices, [.init(locationID: "home", serviceID: "ethernet")])
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .applied)
+    XCTAssertTrue(composition.control.snapshot.systemProxyInspection.differences.isEmpty)
+  }
+
+  func testRepairReadsLatestLocationAndSkipsAlreadyConsistentServices() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    let original = systemProxy.services[0]
+    systemProxy.services[0] = SystemProxyServiceState(
+      identifier: original.identifier, configuration: nil, name: original.name)
+    _ = await composition.control.recheckSystemProxy()
+    systemProxy.services = [
+      SystemProxyServiceState(
+        identifier: .init(locationID: "work", serviceID: "vpn"), configuration: nil, name: "VPN"),
+      SystemProxyServiceState(
+        identifier: .init(locationID: "work", serviceID: "wifi"),
+        configuration: original.configuration, name: "Wi-Fi"),
+    ]
+    _ = await composition.control.repairSystemProxy()
+    XCTAssertEqual(systemProxy.repairedServices, [.init(locationID: "work", serviceID: "vpn")])
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .applied)
+    await emitAndWaitForInspection(.networkPath, in: composition)
+    XCTAssertEqual(systemProxy.applied.count, 2, "被动事件不重写")
+  }
+
+  func testRepairSuccessResponseCannotHideRemainingDifference() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    let original = systemProxy.services[0]
+    systemProxy.services[0] = SystemProxyServiceState(
+      identifier: original.identifier, configuration: nil, name: original.name)
+    _ = await composition.control.recheckSystemProxy()
+    systemProxy.preserveConfigurationOnApply = true
+    _ = await composition.control.repairSystemProxy()
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .changed)
+    XCTAssertEqual(
+      composition.control.snapshot.systemProxyInspection.differences.map(\.kind), [.remaining])
+  }
+
+  func testDuplicateRepairDoesNotWriteTwiceAndKeepsNamesDuringProgress() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    let original = systemProxy.services[0]
+    systemProxy.services[0] = SystemProxyServiceState(
+      identifier: original.identifier, configuration: nil, name: original.name)
+    _ = await composition.control.recheckSystemProxy()
+    let gate = ProxyControlOperationGate(started: expectation(description: "repair paused"))
+    defer { gate.resume() }
+    systemProxy.beforeRepair = { await gate.wait() }
+    let first = Task { await composition.control.repairSystemProxy() }
+    await fulfillment(of: [gate.started], timeout: 2)
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .repairing)
+    XCTAssertEqual(
+      composition.control.snapshot.systemProxyInspection.differences.map(\.name), ["Wi-Fi"])
+    XCTAssertFalse(composition.control.snapshot.systemProxyInspection.canRepair)
+    _ = await composition.control.repairSystemProxy()
+    gate.resume()
+    _ = await first.value
+    XCTAssertEqual(systemProxy.applied.count, 2)
+  }
+
+  func testReadFailureIsUnknownAndRecheckNeverWrites() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    systemProxy.readError = SystemProxyError.preferencesUnavailable
+    let failed = await composition.control.recheckSystemProxy()
+    XCTAssertEqual(failed.systemProxyApplication, .unreadable(.operation(.preferencesUnavailable)))
+    XCTAssertFalse(failed.systemProxyInspection.canRepair)
+    XCTAssertEqual(systemProxy.applied.count, 1)
+    systemProxy.readError = nil
+    let restored = await composition.control.recheckSystemProxy()
+    XCTAssertEqual(restored.systemProxyApplication, .applied)
+    XCTAssertEqual(systemProxy.applied.count, 1)
+  }
+
+  func testSteadyObservationDoesNotProbeOrInferFailureFromReceiptState() async throws {
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let composition = try await enabledSystemProxyComposition(probe: probe)
+    let store = composition.controller.runtimeFileStore
+    let callsAfterLaunch = probe.callCount
+    probe.setOutcomes([.refused(detail: "must not probe while running")])
+    try JSONEncoder().encode(
+      RuntimeDeploymentFailure(deploymentID: UUID().uuidString, reason: "older deployment failed")
+    ).write(to: store.failureFileURL)
+
+    for receipt in [
+      nil,
+      RuntimeDeploymentReceipt(processID: 42, deploymentID: UUID().uuidString),
+      RuntimeDeploymentReceipt(
+        processID: 9999,
+        deploymentID: try XCTUnwrap(store.readRuntimeReceipt()).deploymentID),
+    ] {
+      if let receipt {
+        try JSONEncoder().encode(receipt).write(to: store.runtimeStatusFileURL)
+      } else {
+        try FileManager.default.removeItem(at: store.runtimeStatusFileURL)
+      }
+      // Two approval transitions prove that observation continues across complete iterations.
+      try await waitForSystemProxyObservationCycle(composition)
+      XCTAssertEqual(systemProxy.clearCount, 0)
+      XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .applied)
+      XCTAssertEqual(composition.control.snapshot.runtime.status, .running)
+    }
+    let metadata = try XCTUnwrap(RuntimePublication.metadata(at: store.supervisionFileURL))
+    try store.recordFailure(reason: "unattributable after identity loss")
+    try FileManager.default.removeItem(
+      at: store.directoryURL.appendingPathComponent(metadata.intentMetadata))
+    try await waitForSystemProxyObservationCycle(composition)
+    XCTAssertEqual(systemProxy.clearCount, 0, "无法匹配部署身份时不推断当前故障")
+    try FileManager.default.removeItem(at: store.supervisionFileURL)
+    try await waitForSystemProxyObservationCycle(composition)
+    XCTAssertEqual(systemProxy.clearCount, 0, "缺失监管资料不能把旧部署失败变成当前故障")
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .applied)
+    XCTAssertEqual(probe.callCount, callsAfterLaunch)
+  }
+
+  func testDeploymentFailureClearsOnceAndExplicitRetryApplies() async throws {
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let composition = try await enabledSystemProxyComposition(probe: probe)
+    try composition.controller.runtimeFileStore.recordFailure(reason: "Agent confirmed failure")
+    try await waitForSnapshot(composition) { $0.systemProxyApplication == .paused }
+    XCTAssertTrue(composition.control.snapshot.systemProxyIntentEnabled)
+    XCTAssertEqual(systemProxy.clearCount, 1)
+    await emitAndWaitForInspection(.networkPath, in: composition)
+    XCTAssertEqual(systemProxy.clearCount, 1, "失效期间不循环重试")
+    try composition.controller.runtimeFileStore.clearFailure()
+    try await waitForSystemProxyObservationCycle(composition)
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .paused)
+    XCTAssertEqual(systemProxy.applied.count, 1, "删除失败记录本身不是恢复证明")
+    _ = await composition.control.setAgentEnabled(true)
+    try await waitForSnapshot(composition) { $0.systemProxyApplication == .applied }
+    XCTAssertEqual(systemProxy.applied.count, 2)
+  }
+
+  func testPausedIntentOffPreventsRecoveryApply() async throws {
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let composition = try await enabledSystemProxyComposition(probe: probe)
+    try composition.controller.runtimeFileStore.recordFailure(reason: "Agent confirmed failure")
+    try await waitForSnapshot(composition) { $0.systemProxyApplication == .paused }
+    let healthObservation = composition.controller.systemProxyObserver.systemProxyHealthTask
+    XCTAssertNotNil(healthObservation)
+    _ = await composition.control.setSystemProxyEnabled(false)
+    try composition.controller.runtimeFileStore.clearFailure()
+    await healthObservation?.value
+    XCTAssertFalse(networkMonitor.isObserving, "关闭意图后应停止观察与自动恢复")
+    XCTAssertEqual(systemProxy.applied.count, 1)
+    XCTAssertFalse(composition.control.snapshot.systemProxyIntentEnabled)
+  }
+
+  func testClearFailureAndApprovalCoexistAfterIntentOffWithoutAutomaticRetry() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    systemProxy.clearError = SystemProxyError.helperUnavailable("approval missing")
+    systemProxyHelper.setStatus(.requiresApproval)
+    let failed = await composition.control.setSystemProxyEnabled(false)
+    XCTAssertEqual(failed.systemProxyApplication, .clearFailed(.operation(.helperUnavailable)))
+    XCTAssertTrue(failed.systemProxyApprovalRequired)
+    XCTAssertFalse(failed.systemProxyInspection.canRetryClear)
+    XCTAssertNil(StatusMenuModel.summary(from: failed).systemProxyDetail, "批准原因不重复说明")
+    systemProxyHelper.setStatus(.approved)
+    _ = await composition.control.openSystemProxyHelperApproval()
+    XCTAssertEqual(systemProxy.clearCount, 1)
+    XCTAssertTrue(composition.control.snapshot.systemProxyInspection.canRetryClear)
+    systemProxy.clearError = nil
+    let restored = await composition.control.retrySystemProxyClear()
+    XCTAssertEqual(restored.systemProxyApplication, .idle)
+    XCTAssertEqual(systemProxy.clearCount, 2)
+  }
+
+  func testFailedApplyApprovalDoesNotRetryButUnattemptedEnableContinues() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+    systemProxyHelper.setStatus(.requiresApproval)
+    _ = await composition.control.setSystemProxyEnabled(true)
+    XCTAssertTrue(systemProxy.applied.isEmpty)
+    systemProxy.applyError = SystemProxyError.helperUnavailable("connection failed")
+    systemProxyHelper.setStatus(.approved)
+    _ = await composition.control.openSystemProxyHelperApproval()
+    XCTAssertEqual(
+      composition.control.snapshot.systemProxyApplication, .failed(.operation(.helperUnavailable)))
+    systemProxyHelper.setStatus(.requiresApproval)
+    _ = await composition.control.recheckSystemProxy()
+    XCTAssertTrue(composition.control.snapshot.systemProxyApprovalRequired)
+    XCTAssertFalse(composition.control.snapshot.systemProxyInspection.canRepair)
+    systemProxy.applyError = nil
+    systemProxyHelper.setStatus(.approved)
+    _ = await composition.control.openSystemProxyHelperApproval()
+    XCTAssertTrue(systemProxy.applied.isEmpty)
+    XCTAssertTrue(composition.control.snapshot.systemProxyInspection.canRepair)
+    _ = await composition.control.repairSystemProxy()
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .applied)
+  }
+
+  func testHealthyStartupOnlyReadsAndNewLocationIsNotAppliedCategory() async throws {
+    _ = try makeSeededCatalog()
+    let composition = makeProxies(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true),
+      proxyMode: .direct)
+    let before = systemProxy.applied.count
+    await composition.control.resyncOnLaunch()
+    XCTAssertEqual(systemProxy.applied.count, before)
+    XCTAssertEqual(systemProxy.clearCount, 0)
+    systemProxy.services = [
+      SystemProxyServiceState(
+        identifier: .init(locationID: "new", serviceID: "wifi"), configuration: nil, name: "Airport"
+      )
+    ]
+    networkMonitor.emit(.networkConfiguration)
+    try await waitForSnapshot(composition) {
+      $0.systemProxyInspection.differences.map(\.name) == ["Airport"]
+    }
+    XCTAssertEqual(
+      composition.control.snapshot.systemProxyInspection.differences.map(\.kind), [.notApplied])
+    XCTAssertEqual(systemProxy.applied.count, before)
+  }
+
+  func testUnhealthyStartupClearsAndPreservesIntentWithoutApplying() async throws {
+    _ = try makeSeededCatalog()
+    let composition = makeProxies(
+      probe: ProxyRuntimeFixture.FakeProbe.refusing(),
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
+    await composition.control.resyncOnLaunch()
+    XCTAssertEqual(systemProxy.clearCount, 1)
+    XCTAssertTrue(systemProxy.applied.isEmpty)
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .paused)
+    XCTAssertTrue(composition.control.snapshot.systemProxyIntentEnabled)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests+SystemProxyRecovery.swift b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests+SystemProxyRecovery.swift
new file mode 100644
index 000000000..a7b81c964
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests+SystemProxyRecovery.swift
@@ -0,0 +1,169 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension ProxyControlWorkflowIntegrationTests {
+  func testSavedExceptionsAutomaticallyApplyButDraftAndDisabledIntentDoNot() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    let editor = SettingsWorkflow(committing: composition.controller)
+    _ = editor.beginProxyExceptionsEditing()
+    XCTAssertEqual(systemProxy.applied.count, 1, "草稿不写系统设置")
+    _ = await editor.saveProxyExceptions("example.com")
+    try await waitForSnapshot(composition) { $0.systemProxyApplication == .applied }
+    XCTAssertEqual(systemProxy.applied.count, 2)
+    XCTAssertTrue(try XCTUnwrap(systemProxy.applied.last).exceptions.contains("example.com"))
+    _ = await composition.control.setSystemProxyEnabled(false)
+    _ = await editor.saveProxyExceptions("example.org")
+    XCTAssertEqual(systemProxy.applied.count, 2, "关闭意图下保存不应用")
+  }
+
+  func testDeploymentFailureClearErrorPreservesIntentAndNeedsExplicitRetry() async throws {
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let composition = try await enabledSystemProxyComposition(probe: probe)
+    systemProxy.clearError = SystemProxyError.commitFailed("busy")
+    try composition.controller.runtimeFileStore.recordFailure(reason: "Agent confirmed failure")
+    try await waitForSnapshot(composition) { $0.systemProxyApplication.isClearFailure }
+    XCTAssertTrue(composition.control.snapshot.systemProxyIntentEnabled)
+    XCTAssertTrue(composition.control.snapshot.systemProxyInspection.canRetryClear)
+    XCTAssertFalse(composition.control.snapshot.systemProxyInspection.canRepair)
+    await emitAndWaitForInspection(.networkConfiguration, in: composition)
+    XCTAssertEqual(systemProxy.clearCount, 1)
+    systemProxy.clearError = nil
+    _ = await composition.control.retrySystemProxyClear()
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .paused)
+    XCTAssertEqual(systemProxy.clearCount, 2)
+  }
+
+  func testRepairFailureKeepsDifferenceAndApprovalPathUntilExplicitRetry() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    let original = systemProxy.services[0]
+    systemProxy.services[0] = SystemProxyServiceState(
+      identifier: original.identifier, configuration: nil, name: original.name)
+    _ = await composition.control.recheckSystemProxy()
+    systemProxy.beforeRepair = { [systemProxyHelper] in
+      systemProxyHelper?.setStatus(.requiresApproval)
+    }
+    systemProxy.applyError = SystemProxyError.helperUnavailable("approval")
+    let failed = await composition.control.repairSystemProxy()
+    XCTAssertEqual(failed.systemProxyApplication, .repairFailed(.operation(.helperUnavailable)))
+    XCTAssertEqual(failed.systemProxyInspection.differences.map(\.name), ["Wi-Fi"])
+    XCTAssertTrue(failed.systemProxyApprovalRequired)
+    XCTAssertFalse(failed.systemProxyInspection.canRepair)
+    systemProxyHelper.setStatus(.approved)
+    systemProxy.beforeRepair = nil
+    systemProxy.applyError = nil
+    try await waitForSnapshot(composition) { $0.systemProxyInspection.canRepair }
+    XCTAssertEqual(systemProxy.applied.count, 1, "批准后失败操作不自动重试")
+    _ = await composition.control.repairSystemProxy()
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .applied)
+  }
+
+  func testUnmanagedFieldChangeAndEquivalentWritesStayAppliedWithoutWrites() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    let original = systemProxy.services[0]
+    var dictionary = try SystemProxyPlanner.dictionary(
+      from: original.configuration, serviceID: "wifi")
+    dictionary["ExternalMetadata"] = "unmanaged"
+    dictionary.removeValue(forKey: "ProxyAutoDiscoveryEnable")
+    dictionary["ExceptionsList"] = (dictionary["ExceptionsList"] as? [String])?.reversed().map {
+      $0
+    }
+    systemProxy.services[0] = SystemProxyServiceState(
+      identifier: original.identifier,
+      configuration: try SystemProxyPlanner.propertyListData(from: dictionary, serviceID: "wifi"),
+      name: original.name)
+    let result = await composition.control.recheckSystemProxy()
+    XCTAssertEqual(result.systemProxyApplication, .applied)
+    XCTAssertTrue(result.systemProxyInspection.differences.isEmpty)
+    XCTAssertEqual(systemProxy.applied.count, 1)
+  }
+
+  func testPassiveReadCannotOverwriteHealthSuspension() async throws {
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let composition = try await enabledSystemProxyComposition(probe: probe)
+    let gate = ProxyControlOperationGate(started: expectation(description: "read paused"))
+    defer { gate.resume() }
+    systemProxy.beforeRead = { await gate.wait() }
+    let read = Task { await composition.control.recheckSystemProxy() }
+    await fulfillment(of: [gate.started], timeout: 2)
+    try composition.controller.runtimeFileStore.recordFailure(reason: "Agent confirmed failure")
+    try await waitForSnapshot(composition) { $0.systemProxyApplication == .paused }
+    gate.resume()
+    _ = await read.value
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .paused)
+    XCTAssertEqual(systemProxy.clearCount, 1)
+  }
+
+  func testPassiveReadCannotOverwriteHealthClearFailure() async throws {
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let composition = try await enabledSystemProxyComposition(probe: probe)
+    systemProxy.clearError = SystemProxyError.commitFailed("busy")
+    let gate = ProxyControlOperationGate(started: expectation(description: "read paused"))
+    defer { gate.resume() }
+    systemProxy.beforeRead = { await gate.wait() }
+    let read = Task { await composition.control.recheckSystemProxy() }
+    await fulfillment(of: [gate.started], timeout: 2)
+    try composition.controller.runtimeFileStore.recordFailure(reason: "Agent confirmed failure")
+    try await waitForSnapshot(composition) { $0.systemProxyApplication.isClearFailure }
+    gate.resume()
+    _ = await read.value
+    XCTAssertEqual(
+      composition.control.snapshot.systemProxyApplication, .clearFailed(.operation(.commitFailed)))
+    XCTAssertTrue(composition.control.snapshot.systemProxyInspection.canRetryClear)
+  }
+
+  func testIntentOffDuringRepairPreflightPreventsWrite() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    let original = systemProxy.services[0]
+    systemProxy.services[0] = SystemProxyServiceState(
+      identifier: original.identifier, configuration: nil, name: original.name)
+    _ = await composition.control.recheckSystemProxy()
+    let gate = ProxyControlOperationGate(started: expectation(description: "read paused"))
+    defer { gate.resume() }
+    systemProxy.beforeRead = { await gate.wait() }
+    let repair = Task { await composition.control.repairSystemProxy() }
+    await fulfillment(of: [gate.started], timeout: 2)
+    XCTAssertTrue(composition.control.snapshot.systemProxyInspection.isBusy)
+    let off = Task { await composition.control.setSystemProxyEnabled(false) }
+    try await waitForSnapshot(composition) { !$0.systemProxyIntentEnabled }
+    gate.resume()
+    _ = await repair.value
+    _ = await off.value
+    XCTAssertEqual(systemProxy.applied.count, 1)
+    XCTAssertEqual(systemProxy.clearCount, 1)
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .idle)
+  }
+
+  func testHealthLossDuringRepairPreflightPreventsWrite() async throws {
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let composition = try await enabledSystemProxyComposition(probe: probe)
+    let original = systemProxy.services[0]
+    systemProxy.services[0] = SystemProxyServiceState(
+      identifier: original.identifier, configuration: nil, name: original.name)
+    _ = await composition.control.recheckSystemProxy()
+    let gate = ProxyControlOperationGate(started: expectation(description: "read paused"))
+    defer { gate.resume() }
+    systemProxy.beforeRead = { await gate.wait() }
+    let repair = Task { await composition.control.repairSystemProxy() }
+    await fulfillment(of: [gate.started], timeout: 2)
+    XCTAssertTrue(composition.control.snapshot.systemProxyInspection.isBusy)
+    try composition.controller.runtimeFileStore.recordFailure(reason: "Agent confirmed failure")
+    try await waitForSnapshot(composition) { $0.runtime.status != .running }
+    gate.resume()
+    _ = await repair.value
+    try await waitForSnapshot(composition) { $0.systemProxyApplication == .paused }
+    XCTAssertEqual(systemProxy.applied.count, 1)
+    XCTAssertEqual(systemProxy.clearCount, 1)
+  }
+  func testAgentOffClearFailureKeepsApprovalEntryAfterCascade() async throws {
+    let composition = try await enabledSystemProxyComposition()
+    systemProxyHelper.setStatus(.requiresApproval)
+    systemProxy.clearError = SystemProxyError.helperUnavailable("approval")
+    let failed = await composition.control.setAgentEnabled(false)
+    XCTAssertFalse(failed.systemProxyIntentEnabled)
+    XCTAssertFalse(failed.agentIntentEnabled)
+    XCTAssertEqual(failed.systemProxyApplication, .clearFailed(.operation(.helperUnavailable)))
+    XCTAssertTrue(failed.systemProxyApprovalRequired)
+    XCTAssertFalse(failed.systemProxyInspection.canRetryClear)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests.swift b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests.swift
new file mode 100644
index 000000000..cea10aaa6
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowIntegrationTests.swift
@@ -0,0 +1,321 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 代理控制命令矩阵：经生产 runtime adapter 包装的真实控制器
+/// 验证 agent 开关、系统代理开关与模式切换的失败分类与恢复语义原样进入
+/// snapshot。全部使用 fixture 替身，不启动真实 launch agent、不写真实
+/// SystemConfiguration（这些替身测试不构成真实系统写入验证）。
+@MainActor
+final class ProxyControlWorkflowIntegrationTests: XCTestCase {
+  var controlPreferences: ProxyControlPreferences!
+  private var runtime: ProxyRuntimeFixture.TemporaryRuntime!
+  private var catalogFileURL: URL!
+  private var activationFileURL: URL!
+  var agent: ProxyRuntimeFixture.FakeLaunchAgent!
+  var systemProxy: ProxyRuntimeFixture.FakeSystemProxy!
+  var networkMonitor = ProxyRuntimeFixture.FakeSystemProxyNetworkChangeMonitor()
+  var systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    controlPreferences = makeTestProxyControlPreferences()
+    runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    catalogFileURL = runtime.directory.appendingPathComponent("catalog.json")
+    activationFileURL = runtime.directory.appendingPathComponent("activation.json")
+
+    agent = ProxyRuntimeFixture.FakeLaunchAgent()
+    systemProxy = ProxyRuntimeFixture.FakeSystemProxy()
+    systemProxyHelper = ProxyRuntimeFixture.FakeSystemProxyHelperService()
+    networkMonitor = ProxyRuntimeFixture.FakeSystemProxyNetworkChangeMonitor()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: runtime.directory)
+    try await super.tearDown()
+  }
+
+  /// 控制器、目录工作流与代理控制工作流的生产组合（同一控制器经两条缝）。
+  struct Composition {
+    let catalog: CatalogWorkflow
+    let control: ProxyControlWorkflow
+    let controller: ProxyRuntimeController
+  }
+
+  /// 建一个含单台服务器的目录并落盘（服务器密码进内存凭据存储）。
+  func makeSeededCatalog() throws -> NodeID {
+    var catalog = ConfigurationCatalog()
+    let server = try ActivationFixture.addPlainServer(
+      "香港 01", in: &catalog)
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+    return server
+  }
+
+  func makeProxies(
+    probe: EndpointProbing,
+    agentStatus: LaunchAgentStatus = .notRegistered,
+    listeningStore: ProxyListeningStoring? = nil,
+    settings: ProxyRuntimeSettings? = nil,
+    proxyMode: ProxyMode = .rule
+  ) -> Composition {
+    agent.setStatus(agentStatus)
+    let runtimeFileStore = RuntimeFileStore(fileURL: runtime.contract)
+    agent.onRegister = { [runtimeFileStore] in
+      try? runtimeFileStore.writePublishedRuntimeReceipt(processID: 42)
+    }
+    let controller = ProxyRuntimeController(
+      controlPreferences: controlPreferences,
+      catalogSnapshotReader: ProxyRuntimeFixture.catalogSnapshotReader(at: catalogFileURL),
+      activationFileStore: ActivationStateFileStore(fileURL: activationFileURL),
+      runtimeFileStore: runtimeFileStore,
+      plugins: ActivationFixture.plugins,
+      listeningStore: listeningStore ?? InMemoryProxyListeningStore(),
+      appBundle: AppArtifact.bundle,
+      // Keep real ACL compilation; corpus coverage belongs to the packaged-rule tests.
+      ruleSnapshots: BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot),
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: settings ?? ProxyRuntimeSettings(listen: ActivationFixture.listen),
+        unreadableError: nil),
+      agent: agent, probe: probe,
+      systemProxy: systemProxy,
+      systemProxyHelper: systemProxyHelper,
+      systemProxyNetworkChangeMonitor: networkMonitor,
+      proxyMode: proxyMode,
+      firewallChecker: ProxyRuntimeFixture.FakeFirewallChecker(),
+      firewallExecutableURLs: [URL(fileURLWithPath: "/bundle/Helpers/sslocal")],
+      firewallPollIntervalNanoseconds: 1_000_000,
+      // 生产默认 15 秒健康窗；FakeProbe 结果确定，短窗口走同一超时呈现路径。
+      launchHealthTimeoutSeconds: 0.05,
+      launchHealthRetryDelay: { try await Task.sleep(for: .milliseconds(1)) },
+      systemProxyHealthPollIntervalNanoseconds: 20_000_000,
+      helperRefreshDelayNanoseconds: 0,
+      sendSignal: { _, _ in 0 },
+      processIsAlive: { $0 == 42 })
+    let fileStore = makeTestCatalogStore(fileURL: catalogFileURL)
+    let bootstrap = CatalogCommitCoordinator.bootstrap(fileStore: fileStore)
+    let catalogWorkflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: fileStore,
+        runtime: ProxyRuntimeSyncAdapter(controller: controller),
+        bootstrap: bootstrap),
+      plugins: ActivationFixture.plugins,
+      activator: controller)
+    let control = ProxyControlWorkflow(
+      runtime: ControllerProxyRuntimeAdapter(controller: controller),
+      targetFacts: catalogWorkflow,
+      interfaceFacts: FakeLocalInterfaceFacts())
+    return Composition(
+      catalog: catalogWorkflow, control: control, controller: controller)
+  }
+
+  // MARK: - Agent 开关与首次默认
+
+  func testAgentEnableWithoutActiveTargetListensThroughSnapshot() async throws {
+    _ = try makeSeededCatalog()
+    let composition = makeProxies(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: false))
+
+    let snapshot = await composition.control.setAgentEnabled(true)
+
+    XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .running, isOn: true))
+    XCTAssertTrue(snapshot.agentIntentEnabled, "开关意图进入 snapshot")
+    XCTAssertTrue(snapshotAgentListening(composition), "空服务器监听契约已部署")
+    XCTAssertTrue(systemProxy.applied.isEmpty, "系统代理意图默认关闭")
+    XCTAssertEqual(snapshot.systemProxyApplication, .idle)
+    XCTAssertEqual(agent.registerCount, 1)
+  }
+
+  /// 空监听判定辅助：契约存在且无服务器。
+  private func snapshotAgentListening(_ composition: Composition) -> Bool {
+    guard
+      let data = try? Data(contentsOf: runtime.contract),
+      let document = try? JSONDecoder().decode(SslocalConfigurationDocument.self, from: data)
+    else { return false }
+    return document.servers.isEmpty
+  }
+
+  func testAgentEnableConvergesToWholeRunningSnapshotWithRealCatalogFacts() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+
+    // 目录激活走目录工作流（生产 activator 是同一控制器）；agent 开关走控制 seam。
+    _ = try await composition.catalog.activate(server)
+    let snapshot = await composition.control.setAgentEnabled(true)
+
+    XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .running, isOn: true))
+    XCTAssertNil(snapshot.runtime.failure)
+    XCTAssertTrue(snapshot.agentIntentEnabled)
+    XCTAssertEqual(snapshot.proxyMode, .rule)
+    XCTAssertEqual(snapshot.availableModes, [.rule, .global, .direct])
+    XCTAssertEqual(snapshot.activeTarget?.pathSummary, "香港 01", "活动目标摘要来自真实目录树")
+    XCTAssertEqual(snapshot.skippedInvalidServerCount, 0)
+    XCTAssertTrue(
+      snapshot.httpExport.copyableLine.contains("127.0.0.1:11087"),
+      "HTTP 导出能力在 snapshot 中就绪")
+  }
+
+  func testUnhealthyEndpointSurfacesTypedLaunchFailureInSnapshot() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.refusing())
+
+    _ = try await composition.catalog.activate(server)
+    let snapshot = await composition.control.setAgentEnabled(true)
+
+    XCTAssertEqual(snapshot.runtime.status, .launchFailed)
+    XCTAssertFalse(snapshot.runtime.isOn)
+    guard
+      case .launch(.localEndpoint(let endpoint, let host, _, .refused)) = snapshot.runtime.failure
+    else {
+      return XCTFail("应点名本机端点失败，实际 \(String(describing: snapshot.runtime.failure))")
+    }
+    XCTAssertEqual(endpoint, "SOCKS")
+    XCTAssertEqual(host, "127.0.0.1")
+  }
+
+  func testPendingBackgroundApprovalSurfacesTypedFactInSnapshot() async throws {
+    let server = try makeSeededCatalog()
+    agent.statusAfterRegister = .requiresApproval
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+
+    _ = try await composition.catalog.activate(server)
+    let snapshot = await composition.control.setAgentEnabled(true)
+
+    XCTAssertEqual(
+      snapshot.runtime,
+      ProxyRuntimeFacts(
+        status: .requiresApproval,
+        isOn: true,
+        failure: .requiresApproval))
+  }
+
+  // MARK: - Agent 关闭矩阵
+
+  func testDisableReflectsClosedIntentAndKeepsModesAvailable() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+
+    let snapshot = await composition.control.setAgentEnabled(false)
+
+    XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .off, isOn: false))
+    XCTAssertFalse(snapshot.agentIntentEnabled)
+    XCTAssertNil(snapshot.runtime.failure)
+    XCTAssertEqual(snapshot.availableModes, [.rule, .global, .direct], "停用后可用操作不消失")
+  }
+
+  /// 关闭 agent 且系统代理清理失败：agent 停止，清理失败以系统代理 typed fact 呈现。
+  func testAgentOffWithSystemProxyClearFailureSurfacesTypedFact() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+    XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .applied)
+    systemProxy.clearError = SystemProxyError.commitFailed("busy")
+
+    let snapshot = await composition.control.setAgentEnabled(false)
+
+    XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .off, isOn: false))
+    XCTAssertEqual(
+      snapshot.systemProxyApplication, .clearFailed(.operation(.commitFailed)),
+      "清理失败以 typed fact 呈现，不静默视为已清理")
+  }
+
+  // MARK: - 模式命令矩阵
+
+  func testModeSwitchWhileOffPersistsAndSnapshotConvergesWithoutRuntimeTouch() async throws {
+    _ = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let composition = makeProxies(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: false))
+
+    let snapshot = await composition.control.setProxyMode(.global)
+
+    XCTAssertEqual(snapshot.proxyMode, .global)
+    XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .off, isOn: false))
+    XCTAssertEqual(composition.controller.controlPreferences.preferredMode, .global, "模式先持久化")
+    XCTAssertTrue(systemProxy.applied.isEmpty, "agent 未运行时不触碰系统代理")
+    XCTAssertEqual(systemProxy.clearCount, 0)
+  }
+
+  func testSameModeCommandIsNoopWithoutSettingsOrSystemProxyWrites() async throws {
+    _ = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let composition = makeProxies(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: false))
+    let before = composition.control.snapshot
+
+    let after = await composition.control.setProxyMode(.rule)
+
+    XCTAssertEqual(after, before, "同模式命令无副作用，snapshot 不动")
+    XCTAssertNil(listeningStore.saved)
+    XCTAssertTrue(systemProxy.applied.isEmpty)
+    XCTAssertEqual(systemProxy.clearCount, 0)
+  }
+
+  // MARK: - 集成级 model test（deletion 验证）
+
+  /// 状态菜单的呈现面只凭 ProxyControlWorkflow 的 snapshot 与 CatalogWorkflow
+  /// 的目录事实即可完整推导；本文件不要求启动 SwiftUI，也不依赖控制器字段。
+  func testStatusMenuSummaryProjectsWorkflowStateAndTarget() async throws {
+    let server = try makeSeededCatalog()
+    let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    _ = try await composition.catalog.activate(server)
+    _ = await composition.control.setAgentEnabled(true)
+    _ = await composition.control.setSystemProxyEnabled(true)
+
+    let summary = StatusMenuModel.summary(from: composition.control.snapshot)
+
+    XCTAssertTrue(summary.agentIntentEnabled)
+    XCTAssertTrue(summary.isOn)
+    XCTAssertEqual(summary.targetPath, "香港 01")
+    XCTAssertNil(summary.detail)
+    XCTAssertTrue(summary.systemProxyIntentEnabled)
+    XCTAssertNil(summary.systemProxyDetail)
+  }
+
+}
+
+/// Pause the first operation at its I/O seam; subsequent reads can finish normally.
+@MainActor
+final class ProxyControlOperationGate {
+  let started: XCTestExpectation
+  private var didPause = false
+  private var continuation: CheckedContinuation<Void, Never>?
+
+  init(started: XCTestExpectation) { self.started = started }
+
+  func wait() async {
+    guard !didPause else { return }
+    didPause = true
+    await withCheckedContinuation {
+      continuation = $0
+      started.fulfill()
+    }
+  }
+
+  func resume() {
+    continuation?.resume()
+    continuation = nil
+  }
+}
+
+extension ProxyControlWorkflowIntegrationTests {
+  func emitAndWaitForInspection(
+    _ change: SystemProxyNetworkChange, in composition: Composition
+  ) async {
+    XCTAssertTrue(networkMonitor.isObserving)
+    networkMonitor.emit(change)
+    let inspection = composition.controller.systemProxyObserver.systemProxyInspectionTask
+    XCTAssertNotNil(inspection, "被动事件应调度检查")
+    await inspection?.value
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowTests.swift b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowTests.swift
new file mode 100644
index 000000000..2b119484d
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyControlWorkflowTests.swift
@@ -0,0 +1,339 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+// MARK: - 确定性替身（snapshot 与命令 contract；不触真实运行时）
+// 供本文件与 ProxyCommandAddressWorkflowTests 共用（测试 target 内部）。
+
+/// 可编程 runtime 替身：事实可编程、命令全记录；
+/// changes 为手动 subject，同步发值保证观察测试确定性。
+@MainActor
+final class FakeProxyRuntime: ProxyRuntimeAdapting {
+  var runtimeFacts: ProxyRuntimeFacts
+  var agentIntentEnabled: Bool
+  var activationFailure: ActivationFailure?
+  var systemProxyIntentEnabled: Bool
+  var systemProxyApplication: SystemProxyApplicationFacts
+  var systemProxyApprovalRequired = false
+  var systemProxyInspection = SystemProxyInspectionFacts()
+  var proxyMode: ProxyMode
+  var rulePreset: RulePreset = .chinaDirect
+  var skippedInvalidServerCount = 0
+  var activeTargetID: NodeID?
+  var httpExportCapability = HTTPExportCapability(
+    copyableLine:
+      "export http_proxy=http://127.0.0.1:11087;export https_proxy=http://127.0.0.1:11087;")
+  var listenFacts = RuntimeListenFacts(listen: ProxyListeningConfiguration())
+
+  private let changeSubject = PassthroughSubject<Void, Never>()
+  var changes: AnyPublisher<Void, Never> { changeSubject.eraseToAnyPublisher() }
+
+  private(set) var resyncCount = 0
+  private(set) var agentCommands: [Bool] = []
+  private(set) var systemProxyCommands: [Bool] = []
+  private(set) var approvalCommandCount = 0
+  private(set) var modeCommands: [ProxyMode] = []
+  private(set) var rulePresetCommands: [RulePreset] = []
+
+  init(
+    facts: ProxyRuntimeFacts = ProxyRuntimeFacts(status: .off, isOn: false),
+    agentIntent: Bool = true,
+    systemProxyIntent: Bool = false,
+    systemProxyApplication: SystemProxyApplicationFacts = .idle,
+    mode: ProxyMode = .rule
+  ) {
+    runtimeFacts = facts
+    agentIntentEnabled = agentIntent
+    systemProxyIntentEnabled = systemProxyIntent
+    self.systemProxyApplication = systemProxyApplication
+    proxyMode = mode
+  }
+
+  func emitChange() { changeSubject.send() }
+
+  func resyncOnLaunch() async { resyncCount += 1 }
+
+  func setAgentEnabled(_ enabled: Bool) async { agentCommands.append(enabled) }
+
+  func setSystemProxyEnabled(_ enabled: Bool) async { systemProxyCommands.append(enabled) }
+
+  func openSystemProxyHelperApproval() async { approvalCommandCount += 1 }
+
+  func repairSystemProxy() async {}
+  func retrySystemProxyClear() async {}
+  func recheckSystemProxy() async {}
+
+  func setProxyMode(_ mode: ProxyMode) async { modeCommands.append(mode) }
+
+  func setRulePreset(_ preset: RulePreset) async {
+    rulePresetCommands.append(preset)
+  }
+}
+
+/// 可编程目标事实替身：路径摘要可编程、查询全记录。
+@MainActor
+final class FakeTargetFacts: ProxyTargetFactsReading {
+  var pathByTarget: [NodeID: String] = [:]
+  private(set) var queriedTargetIDs: [NodeID?] = []
+
+  func activeTargetFacts(for targetID: NodeID?) -> ProxyActiveTargetFacts? {
+    queriedTargetIDs.append(targetID)
+    guard let targetID else { return nil }
+    return ProxyActiveTargetFacts(id: targetID, pathSummary: pathByTarget[targetID])
+  }
+}
+
+/// 代理控制工作流的 snapshot 与命令 contract：整体一致性、
+/// typed commands、窄目录事实缝、运行时变化重观察与命令边界。
+@MainActor
+final class ProxyControlWorkflowTests: XCTestCase {
+  private var runtime: FakeProxyRuntime!
+  private var targetFacts: FakeTargetFacts!
+  private var interfaceFacts: FakeLocalInterfaceFacts!
+  private var workflow: ProxyControlWorkflow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    runtime = FakeProxyRuntime()
+    targetFacts = FakeTargetFacts()
+    interfaceFacts = FakeLocalInterfaceFacts()
+    workflow = ProxyControlWorkflow(
+      runtime: runtime, targetFacts: targetFacts, interfaceFacts: interfaceFacts)
+  }
+
+  private static let serverID = NodeID(rawValue: "manual:server-1")
+
+  /// 默认监听设置下的预期完整命令（字面量组装，独立于生产派生路径）。
+  private static let defaultLoopbackCommands = TerminalProxyEnvironmentCommands(
+    zshBash:
+      "export http_proxy='http://127.0.0.1:11087'; "
+      + "export https_proxy='http://127.0.0.1:11087'; "
+      + "export all_proxy='socks5://127.0.0.1:11086'; "
+      + "export no_proxy='localhost,127.0.0.1,::1,.local';",
+    fish:
+      "set -gx http_proxy 'http://127.0.0.1:11087'; "
+      + "set -gx https_proxy 'http://127.0.0.1:11087'; "
+      + "set -gx all_proxy 'socks5://127.0.0.1:11086'; "
+      + "set -gx no_proxy 'localhost,127.0.0.1,::1,.local';",
+    nushell:
+      "$env.http_proxy = 'http://127.0.0.1:11087'; "
+      + "$env.https_proxy = 'http://127.0.0.1:11087'; "
+      + "$env.all_proxy = 'socks5://127.0.0.1:11086'; "
+      + "$env.no_proxy = 'localhost,127.0.0.1,::1,.local';",
+    windowsCMD:
+      "set \"http_proxy=http://127.0.0.1:11087\" & "
+      + "set \"https_proxy=http://127.0.0.1:11087\" & "
+      + "set \"all_proxy=socks5://127.0.0.1:11086\" & "
+      + "set \"no_proxy=localhost,127.0.0.1,::1,.local\"",
+    windowsPowerShell:
+      "$env:http_proxy = 'http://127.0.0.1:11087'; "
+      + "$env:https_proxy = 'http://127.0.0.1:11087'; "
+      + "$env:all_proxy = 'socks5://127.0.0.1:11086'; "
+      + "$env:no_proxy = 'localhost,127.0.0.1,::1,.local';")
+
+  // MARK: - 整体 snapshot
+
+  func testSnapshotAssemblesAllFactsFromSingleObservation() {
+    runtime.runtimeFacts = ProxyRuntimeFacts(
+      status: .running,
+      isOn: true,
+      failure: .firewallBlocked(FirewallBlockedFacts(executableName: "sslocal")))
+    runtime.agentIntentEnabled = true
+    runtime.activationFailure = .noActiveTarget
+    runtime.systemProxyIntentEnabled = true
+    runtime.systemProxyApplication = .pending
+    runtime.proxyMode = .global
+    runtime.skippedInvalidServerCount = 3
+    runtime.activeTargetID = Self.serverID
+    runtime.httpExportCapability = HTTPExportCapability(
+      copyableLine: "export http_proxy=http://127.0.0.1:11087;")
+    targetFacts.pathByTarget[Self.serverID] = "组A / 香港 01"
+    runtime.emitChange()
+
+    let loopback = TerminalCommandAddress(bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")
+    XCTAssertEqual(
+      workflow.snapshot,
+      ProxyControlSnapshot(
+        runtime: ProxyRuntimeFacts(
+          status: .running,
+          isOn: true,
+          failure: .firewallBlocked(FirewallBlockedFacts(executableName: "sslocal"))),
+        agentIntentEnabled: true,
+        activationFailure: .noActiveTarget,
+        systemProxyIntentEnabled: true,
+        systemProxyApplication: .pending,
+        systemProxyApprovalRequired: false,
+        proxyMode: .global,
+        rulePreset: .chinaDirect,
+        availableModes: ProxyMode.availableModes,
+        activeTarget: ProxyActiveTargetFacts(id: Self.serverID, pathSummary: "组A / 香港 01"),
+        skippedInvalidServerCount: 3,
+        httpExport: HTTPExportCapability(
+          copyableLine: "export http_proxy=http://127.0.0.1:11087;"),
+        commandAddressPicker: TerminalCommandAddressPicker(
+          isVisible: false, candidates: [loopback], selected: loopback),
+        terminalProxyEnvironmentCommands: Self.defaultLoopbackCommands))
+    XCTAssertEqual(
+      workflow.snapshot.availableModes, ProxyMode.availableModes,
+      "可用模式是 issue #46 Domain 单点策略的投影")
+  }
+
+  // MARK: - typed commands：转发并整体重发布
+
+  func testAgentEnableCommandForwardsAndRepublishesWholeSnapshot() async {
+    let before = workflow.snapshot
+    runtime.runtimeFacts = ProxyRuntimeFacts(status: .running, isOn: true)
+    runtime.agentIntentEnabled = true
+    runtime.skippedInvalidServerCount = 2
+    runtime.activeTargetID = Self.serverID
+
+    let after = await workflow.setAgentEnabled(true)
+
+    XCTAssertEqual(runtime.agentCommands, [true])
+    XCTAssertEqual(after, workflow.snapshot, "命令返回值就是已发布的最新 snapshot")
+    XCTAssertNotEqual(after, before, "命令完成后整体重发布")
+    XCTAssertEqual(after.runtime, ProxyRuntimeFacts(status: .running, isOn: true))
+    XCTAssertEqual(after.skippedInvalidServerCount, 2)
+  }
+
+  func testAgentDisableCommandForwardsAndRepublishesWholeSnapshot() async {
+    runtime.runtimeFacts = ProxyRuntimeFacts(status: .running, isOn: true)
+    runtime.agentIntentEnabled = true
+    _ = await workflow.setAgentEnabled(true)
+    runtime.runtimeFacts = ProxyRuntimeFacts(status: .off, isOn: false)
+    runtime.agentIntentEnabled = false
+    runtime.skippedInvalidServerCount = 0
+    runtime.activeTargetID = nil
+
+    let after = await workflow.setAgentEnabled(false)
+
+    XCTAssertEqual(runtime.agentCommands, [true, false])
+    XCTAssertEqual(after.runtime, ProxyRuntimeFacts(status: .off, isOn: false))
+    XCTAssertFalse(after.agentIntentEnabled)
+    XCTAssertNil(after.activeTarget)
+  }
+
+  /// 系统代理命令与 agent 命令互不触碰对方事实。
+  func testSystemProxyCommandsForwardIndependentlyFromAgentCommands() async {
+    runtime.agentIntentEnabled = true
+    runtime.runtimeFacts = ProxyRuntimeFacts(status: .running, isOn: true)
+    _ = await workflow.setAgentEnabled(true)
+    runtime.systemProxyIntentEnabled = true
+    runtime.systemProxyApplication = .applied
+
+    let applied = await workflow.setSystemProxyEnabled(true)
+
+    XCTAssertEqual(runtime.systemProxyCommands, [true])
+    XCTAssertTrue(applied.systemProxyIntentEnabled)
+    XCTAssertEqual(applied.systemProxyApplication, .applied)
+    XCTAssertEqual(applied.agentIntentEnabled, true, "agent 意图不被系统代理命令触碰")
+
+    runtime.systemProxyIntentEnabled = false
+    runtime.systemProxyApplication = .idle
+    let off = await workflow.setSystemProxyEnabled(false)
+
+    XCTAssertEqual(runtime.systemProxyCommands, [true, false])
+    XCTAssertFalse(off.systemProxyIntentEnabled)
+    XCTAssertEqual(off.systemProxyApplication, .idle)
+    XCTAssertEqual(runtime.agentCommands, [true], "系统代理命令不触发 agent 命令")
+  }
+
+  func testModeCommandForwardsAndRepublishesWholeSnapshot() async {
+    runtime.runtimeFacts = ProxyRuntimeFacts(status: .running, isOn: true)
+    _ = await workflow.setAgentEnabled(true)
+    runtime.proxyMode = .global
+
+    let after = await workflow.setProxyMode(.global)
+
+    XCTAssertEqual(runtime.modeCommands, [.global])
+    XCTAssertEqual(after.proxyMode, .global)
+    XCTAssertEqual(after.runtime, ProxyRuntimeFacts(status: .running, isOn: true))
+  }
+
+  func testRulePresetCommandsForwardAndRepublishWithoutLosingIdentity() async {
+    for preset in RulePreset.allCases {
+      let before = runtime.rulePreset
+      let after = await workflow.setRulePreset(preset)
+      XCTAssertEqual(runtime.rulePresetCommands.last, preset)
+      // 命令完成后从 runtime 重读事实，不提前发布请求值。
+      XCTAssertEqual(after.rulePreset, before)
+      runtime.rulePreset = preset
+      runtime.emitChange()
+      XCTAssertEqual(workflow.snapshot.rulePreset, preset)
+      XCTAssertEqual(workflow.snapshot.ruleDefaultAction, preset.defaultAction)
+      XCTAssertEqual(workflow.snapshot.proxyMode, runtime.proxyMode)
+    }
+    XCTAssertEqual(runtime.rulePresetCommands, RulePreset.allCases)
+  }
+
+  func testResyncOnLaunchForwardsAndRepublishes() async {
+    let before = workflow.snapshot
+    runtime.runtimeFacts = ProxyRuntimeFacts(
+      status: .running, isOn: true, failure: nil)
+
+    await workflow.resyncOnLaunch()
+
+    XCTAssertEqual(runtime.resyncCount, 1)
+    XCTAssertNotEqual(workflow.snapshot, before)
+    XCTAssertEqual(workflow.snapshot.runtime.status, .running)
+  }
+
+  // MARK: - 运行时变化重观察
+
+  func testRuntimeChangeRepublishesWholeSnapshotWithoutCommand() {
+    runtime.runtimeFacts = ProxyRuntimeFacts(status: .starting, isOn: true)
+    runtime.emitChange()
+    XCTAssertEqual(workflow.snapshot.runtime.status, .starting)
+
+    runtime.runtimeFacts = ProxyRuntimeFacts(status: .running, isOn: true)
+    runtime.emitChange()
+    XCTAssertEqual(workflow.snapshot.runtime.status, .running)
+    XCTAssertTrue(workflow.snapshot.runtime.isOn)
+  }
+
+  // MARK: - 窄目录目标事实缝
+
+  func testActiveTargetFactsComeFromNarrowCatalogSeam() {
+    runtime.activeTargetID = Self.serverID
+    targetFacts.pathByTarget[Self.serverID] = "订阅分组 / 香港 01"
+    runtime.emitChange()
+
+    XCTAssertEqual(
+      workflow.snapshot.activeTarget,
+      ProxyActiveTargetFacts(id: Self.serverID, pathSummary: "订阅分组 / 香港 01"))
+    XCTAssertEqual(targetFacts.queriedTargetIDs.last, Self.serverID)
+  }
+
+  func testNoActiveTargetYieldsNilTargetFacts() {
+    XCTAssertNil(workflow.snapshot.activeTarget)
+    XCTAssertEqual(targetFacts.queriedTargetIDs, [nil] as [NodeID?], "init 观察即查询一次")
+  }
+
+  func testTargetMissingFromTreeKeepsExistenceWithNilSummary() {
+    runtime.activeTargetID = Self.serverID
+    targetFacts.pathByTarget[Self.serverID] = nil
+    runtime.emitChange()
+
+    let target = workflow.snapshot.activeTarget
+    XCTAssertEqual(target?.id, Self.serverID, "存在性来自活动目标身份")
+    XCTAssertNil(target?.pathSummary, "目标不在当前目录树中时摘要为 nil")
+  }
+
+  // MARK: - 命令边界
+
+  /// 四个命令各自只触达自己的运行时缝：模式命令不派发 agent/系统代理命令，
+  /// 重同步不派发开关命令；目录激活、订阅刷新、设置保存与诊断导出不在本
+  /// module 的依赖面上（类型层面不存在这些入口）。
+  func testCommandsTouchOnlyTheirOwnRuntimeAdapter() async {
+    await workflow.setAgentEnabled(true)
+    await workflow.setSystemProxyEnabled(true)
+    await workflow.setProxyMode(.global)
+    await workflow.resyncOnLaunch()
+
+    XCTAssertEqual(runtime.agentCommands, [true])
+    XCTAssertEqual(runtime.systemProxyCommands, [true])
+    XCTAssertEqual(runtime.modeCommands, [.global])
+    XCTAssertEqual(runtime.resyncCount, 1)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyControl/ProxyModeAvailabilityTests.swift b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyModeAvailabilityTests.swift
new file mode 100644
index 000000000..43b1960b8
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyModeAvailabilityTests.swift
@@ -0,0 +1,50 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// Built-in modes keep a stable selector order and project local proxy settings.
+final class ProxyModeAvailabilityTests: XCTestCase {
+  func testBuiltInModesAreAlwaysAvailableInProductOrder() {
+    XCTAssertEqual(
+      ProxyMode.availableModes.map(\.kind),
+      [.rule, .global, .direct])
+  }
+
+  func testDirectModeUsesLocalSOCKSAndIncludesFixedBypasses() {
+    let document = SslocalRuntimeDocument(servers: [], listen: ProxyListeningConfiguration())
+
+    let configuration = ProxyMode.direct.systemProxyConfiguration(for: document)
+
+    XCTAssertEqual(
+      configuration.socks,
+      .init(host: "127.0.0.1", port: ProxyListeningConfiguration.defaultSocksPort))
+    XCTAssertEqual(
+      configuration.http,
+      .init(host: "127.0.0.1", port: ProxyListeningConfiguration.defaultHTTPPort))
+    XCTAssertEqual(
+      configuration.exceptions,
+      FixedLocalProxyRanges.systemProxyExceptions)
+  }
+
+  /// 全局模式：系统 SOCKS/HTTP 投影 + 固定本地例外，与直连共用
+  /// 同一安全范围；公网路由由 ACL 决定，不由系统例外决定。
+  func testGlobalModeUsesLocalSOCKSAndIncludesFixedBypasses() {
+    let document = SslocalRuntimeDocument(servers: [], listen: ProxyListeningConfiguration())
+
+    let configuration = ProxyMode.global.systemProxyConfiguration(for: document)
+
+    XCTAssertEqual(
+      configuration.socks,
+      .init(host: "127.0.0.1", port: ProxyListeningConfiguration.defaultSocksPort))
+    XCTAssertEqual(
+      configuration.http,
+      .init(host: "127.0.0.1", port: ProxyListeningConfiguration.defaultHTTPPort))
+    XCTAssertEqual(
+      configuration.exceptions,
+      FixedLocalProxyRanges.systemProxyExceptions)
+    XCTAssertFalse(
+      configuration.exceptions.contains("100.64.0.0/10"),
+      "不加入 CGNAT")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyControl/ProxyPortSemanticsTests.swift b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyPortSemanticsTests.swift
new file mode 100644
index 000000000..861cd0bb4
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyControl/ProxyPortSemanticsTests.swift
@@ -0,0 +1,210 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 端口语义主缝测试：出厂默认、占用校验、建议端口
+/// 算法与点名错误。bind 探测覆盖真实回环 socket；lsof 输出解析为纯函数夹具。
+final class ProxyPortSemanticsTests: XCTestCase {
+  // MARK: 出厂默认（与 Legacy 隔离，任何路径不静默改端口）
+
+  func testFactoryDefaultsAvoidLegacyPortsAndValidateClean() {
+    let settings = ProxyListeningConfiguration()
+
+    XCTAssertEqual(settings.socksPort, 11086)
+    XCTAssertEqual(settings.httpPort, 11087)
+    XCTAssertTrue(settings.portValidationErrors().isEmpty)
+  }
+
+  // MARK: 配置校验与点名错误
+
+  func testOutOfRangePortsAreRejectedNamingEndpointAndPort() {
+    var settings = ProxyListeningConfiguration()
+    settings.socksPort = 0
+    settings.httpPort = 65536
+
+    XCTAssertEqual(
+      settings.portValidationErrors(),
+      [
+        .portOutOfRange(endpoint: .socks, port: 0),
+        .portOutOfRange(endpoint: .http, port: 65536),
+      ])
+  }
+
+  func testDuplicateConfiguredPortsAreRejectedNamingBothEndpoints() {
+    let settings = ProxyListeningConfiguration(
+      socksPort: 1086,
+      httpPort: 1086)
+
+    XCTAssertEqual(
+      settings.portValidationErrors(),
+      [.duplicatePort(endpoint: .socks, otherEndpoint: .http, port: 1086)],
+      "两个端点的配置值都必须互异")
+  }
+
+  func testPresentationNamesEndpointAndPort() {
+    XCTAssertEqual(
+      AppPresentation.message(
+        for: PortSettingError.portOutOfRange(endpoint: .http, port: 70000)),
+      "本地 HTTP 代理 端口 70000 无效，必须是 1025–65535 之间的整数")
+    XCTAssertEqual(
+      AppPresentation.message(
+        for: PortSettingError.duplicatePort(
+          endpoint: .socks, otherEndpoint: .http, port: 1086)),
+      "本地 SOCKS5 代理 端口与 本地 HTTP 代理 端口冲突（都是 1086），请为每个端点配置不同的端口")
+  }
+
+  // MARK: 建议端口算法（32768–65535 高位段，空闲且与另两端点配置值互异）
+
+  func testSuggestionScansHighRangeAscendingSkippingExcludedAndOccupied() {
+    var probed: [Int] = []
+    let suggested = PortSuggestion.firstFree(
+      excluding: [32768],
+      isFree: { port in
+        probed.append(port)
+        return port != 32769
+      })
+
+    XCTAssertEqual(suggested, 32770)
+    XCTAssertEqual(probed, [32769, 32770], "被排除的 32768 不探测；占用端口跳过")
+  }
+
+  func testSuggestionReturnsNilWhenWholeRangeExhausted() {
+    XCTAssertNil(PortSuggestion.firstFree(excluding: [], isFree: { _ in false }))
+  }
+
+  func testSuggestedPortForEndpointExcludesOtherConfiguredValues() {
+    let settings = ProxyListeningConfiguration(
+      socksPort: 40000, httpPort: 40001)
+    var probed: [Int] = []
+    let suggested = settings.suggestedPort(for: .http) { port in
+      probed.append(port)
+      return port == 40002
+    }
+
+    XCTAssertEqual(suggested, 40002)
+    XCTAssertFalse(probed.contains(40000), "另个端点的配置值无论启用与否都排除")
+  }
+
+  // MARK: 占用探测（设置区即时校验的 I/O 缝；激活仍以 runtime 实际绑定的
+  // 健康门禁为准，本探测只是编辑期尽力而为的提示）
+
+  func testBindProbeReportsOccupiedThenFreeOnRealLoopbackSocket() throws {
+    let held = try ListenerFixture()
+    let port = held.port
+    let probe = SystemPortOccupancyProbe()
+
+    guard case .occupied = probe.occupancy(port: port, listenerMode: .disabled) else {
+      return XCTFail("已被本测试进程监听的端口必须判为占用")
+    }
+
+    held.close()
+
+    guard case .free = probe.occupancy(port: port, listenerMode: .disabled) else {
+      return XCTFail("关闭监听后同一端口必须判为空闲")
+    }
+  }
+
+  func testBindProbeReportsUnknownWhenBindIsNotPermitted() async throws {
+    try XCTSkipIf(getuid() == 0, "root 可绑定特权端口，无法用 EACCES 构造 .unknown")
+    // 特权端口：非 root 进程 bind 失败（EACCES）≠ 占用，也不得冒充空闲。
+    let request = PortOccupancyProbeRequest(
+      endpoint: .socks,
+      listen: RuntimeListenFacts(listen: ProxyListeningConfiguration()),
+      port: 80)
+    let outcome = await SystemPortOccupancyProbe().occupancy(for: request)
+
+    guard case .unknown = outcome else {
+      return XCTFail("绑定失败时必须报 .unknown，不得冒充空闲或占用，实际 \(outcome)")
+    }
+  }
+
+  func testIPv6OnlyBindCanShareAnIPv4PortWhileDualStackCannot() throws {
+    let held = try ListenerFixture(listenerMode: .allIPv4Interfaces)
+    defer { held.close() }
+    let probe = SystemPortOccupancyProbe()
+
+    guard case .free = probe.occupancy(port: held.port, listenerMode: .allIPv6Interfaces) else {
+      return XCTFail("IPv6-only 探测不应与 IPv4 通配监听冲突")
+    }
+    guard
+      case .occupied = probe.occupancy(
+        port: held.port, listenerMode: .allIPv4AndIPv6Interfaces)
+    else {
+      return XCTFail("双栈探测必须覆盖 IPv4，因而与 IPv4 通配监听冲突")
+    }
+  }
+
+  func testOccupierNameParsedFromLsofOutputFixture() {
+    let output = """
+      COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
+      sslocal 12345 qiu    7u  IPv4  0xabcd      0t0  TCP 127.0.0.1:1086 (LISTEN)
+      TestApp 12346 qiu    8u  IPv4  0xabce      0t0  TCP 127.0.0.1:1086 (LISTEN)
+      """
+    XCTAssertEqual(SystemPortOccupancyProbe.occupierProcessName(fromLsofOutput: output), "sslocal")
+    XCTAssertEqual(
+      SystemPortOccupancyProbe.occupierProcessIDs(fromLsofOutput: output), [12345, 12346])
+    XCTAssertEqual(
+      SystemPortOccupancyProbe.lsofArguments(port: 1086, addressFamily: .ipv4),
+      ["-nP", "-i4TCP:1086", "-sTCP:LISTEN"])
+    XCTAssertEqual(
+      SystemPortOccupancyProbe.lsofArguments(port: 1086, addressFamily: .ipv6),
+      ["-nP", "-i6TCP:1086", "-sTCP:LISTEN"])
+    XCTAssertNil(SystemPortOccupancyProbe.occupierProcessName(fromLsofOutput: "  \n"))
+    XCTAssertNil(
+      SystemPortOccupancyProbe.occupierProcessName(fromLsofOutput: "COMMAND PID USER FD"),
+      "只有表头（无占用进程）时解析为 nil")
+  }
+}
+
+/// 测试专用回环监听器：占用一个内核分配端口，供占用探测断言真实占用。
+private final class ListenerFixture {
+  let descriptor: Int32
+  let port: Int
+
+  init(listenerMode: ListenerMode = .disabled) throws {
+    let listenerFD = socket(AF_INET, SOCK_STREAM, 0)
+    guard listenerFD >= 0 else { throw POSIXError(.ENOTSOCK) }
+    var address = sockaddr_in()
+    address.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_port = 0
+    guard inet_pton(AF_INET, listenerMode.bindAddress, &address.sin_addr) == 1 else {
+      Darwin.close(listenerFD)
+      throw POSIXError(.EADDRNOTAVAIL)
+    }
+    let bindResult = withUnsafePointer(to: &address) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        bind(listenerFD, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    guard bindResult == 0 else {
+      let error = errno
+      Darwin.close(listenerFD)
+      throw POSIXError(POSIXErrorCode(rawValue: error)!)
+    }
+    guard listen(listenerFD, 1) == 0 else {
+      let error = errno
+      Darwin.close(listenerFD)
+      throw POSIXError(POSIXErrorCode(rawValue: error)!)
+    }
+    var bound = sockaddr_in()
+    var length = socklen_t(MemoryLayout<sockaddr_in>.size)
+    let nameResult = withUnsafeMutablePointer(to: &bound) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        getsockname(listenerFD, $0, &length)
+      }
+    }
+    guard nameResult == 0 else {
+      let error = errno
+      Darwin.close(listenerFD)
+      throw POSIXError(POSIXErrorCode(rawValue: error)!)
+    }
+    descriptor = listenerFD
+    port = Int(CFSwapInt16BigToHost(bound.sin_port))
+  }
+
+  func close() {
+    Darwin.close(descriptor)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/CoalescedFactSignalTests.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/CoalescedFactSignalTests.swift
new file mode 100644
index 000000000..2fb6e9b3b
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/CoalescedFactSignalTests.swift
@@ -0,0 +1,61 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 每主队列轮合并器的契约：同一同步轮多次标记只发一次；冲洗晚于同步轮，
+/// 订阅方读到最终事实。
+final class CoalescedFactSignalTests: XCTestCase {
+  @MainActor
+  func testMarksWithinSameTurnCoalesceIntoSingleChange() async {
+    let signal = CoalescedFactSignal()
+    var changeCount = 0
+    let cancellable = signal.changes.sink { _ in changeCount += 1 }
+    defer { cancellable.cancel() }
+
+    signal.markChanged()
+    signal.markChanged()
+    signal.markChanged()
+    await Task.yield()
+
+    XCTAssertEqual(changeCount, 1, "同一同步轮的多次标记只发一次")
+  }
+
+  @MainActor
+  func testFlushReadsFinalFactsNotMidTurnState() async {
+    @MainActor
+    final class FactHolder {
+      let signal = CoalescedFactSignal()
+      var fact = 0 {
+        didSet { signal.markChanged() }
+      }
+    }
+    let holder = FactHolder()
+    var observed: [Int] = []
+    let cancellable = holder.signal.changes.sink { @MainActor _ in
+      observed.append(holder.fact)
+    }
+    defer { cancellable.cancel() }
+
+    holder.fact = 1
+    holder.fact = 2
+    await Task.yield()
+
+    XCTAssertEqual(observed, [2], "冲洗发生在同步轮结束后，读到最终事实")
+  }
+
+  @MainActor
+  func testLaterMarksAfterFlushEmitAgain() async {
+    let signal = CoalescedFactSignal()
+    var changeCount = 0
+    let cancellable = signal.changes.sink { _ in changeCount += 1 }
+    defer { cancellable.cancel() }
+
+    signal.markChanged()
+    await Task.yield()
+    signal.markChanged()
+    await Task.yield()
+
+    XCTAssertEqual(changeCount, 2, "跨轮的标记各自冲洗一次")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerModeTests.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerModeTests.swift
new file mode 100644
index 000000000..30ae668d9
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerModeTests.swift
@@ -0,0 +1,281 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// Mode restoration and commands share the Domain availability policy without
+/// starting a real runtime or touching host proxy settings.
+@MainActor
+final class ProxyRuntimeControllerModeTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  func testRuntimeFactsProjectControllerStateAtStableSeam() async {
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+
+    XCTAssertEqual(
+      controller.runtimeFacts,
+      ProxyRuntimeFacts(status: .off, isOn: false))
+
+    await controller.resyncOnLaunch()
+
+    XCTAssertEqual(
+      controller.runtimeFacts,
+      ProxyRuntimeFacts(status: .running, isOn: true),
+      "默认 agent 意图开启：重同步后无目标也进入空列表监听")
+  }
+}
+
+// MARK: - 收敛票据全事实检查（候选①：agent 关闭不得被任何 await 窗口内的
+// 旧收敛复活；restore 先查时效再动持久层）
+
+@MainActor
+extension ProxyRuntimeControllerModeTests {
+  /// agent-off 落在 mode 切换的健康门 await 窗口内：票据查全四事实 →
+  /// superseded，不触发 restore 重注册，用户的 mode 意图保留在持久层与内存。
+  func testAgentOffDuringModeTransitionHealthGateSupersedesWithoutRestore() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.BlockingProbe()
+    let started = expectation(description: "mode transition health probe paused")
+    let listeningStore = InMemoryProxyListeningStore()
+    let controller = makeController(
+      probe: probe,
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .global,
+        agentEnabled: true, systemProxyEnabled: true),
+      proxyMode: .global)
+    try await controller.activate(seeded.server)
+    XCTAssertEqual(controller.state, .running)
+
+    probe.arm(started: started)
+    let modeSwitch = Task { await controller.setProxyMode(.direct) }
+    await fulfillment(of: [started], timeout: 3)
+    await controller.setAgentEnabled(false)
+    XCTAssertEqual(controller.state, .off)
+    let registrationsAfterStop = agent.registerCount
+    probe.release()
+    await modeSwitch.value
+
+    XCTAssertEqual(
+      agent.registerCount, registrationsAfterStop, "被取代的切换不得经 restore 重注册 agent")
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertFalse(controller.settings.agentEnabled)
+    XCTAssertEqual(controller.settings.preferredMode, ProxyModeKind.direct, "切换意图保留在内存")
+    XCTAssertEqual(controller.controlPreferences.preferredMode, ProxyModeKind.direct, "切换意图保留在持久层")
+    XCTAssertEqual(controller.settings.agentEnabled, false)
+    XCTAssertNil(controller.runtimeObservation)
+  }
+
+  /// agent-off 落在 mode→rule 的派生窗口内：派生缝 preparationIsCurrent
+  /// 恒查 agent 意图与并发流，派生即弃权，apply 根本不会启动。
+  func testAgentOffDuringModeRuleDerivationSupersedesDeployment() async throws {
+    let seeded = try makeSeededCatalog()
+    let started = expectation(description: "rule snapshot load paused")
+    let release = TestAsyncGate("rule snapshot load release")
+    defer { release.release() }
+    let loader = BuiltinRuleSnapshots(loader: { source -> RuleSnapshot in
+      if source == .geolocationCN {
+        started.fulfill()
+        _ = await release.wait()
+      }
+      return rulesFixture(source)
+    })
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .global,
+        rulePreset: .chinaDirect, agentEnabled: true),
+      proxyMode: .global,
+      ruleSnapshots: loader)
+    try await controller.activate(seeded.server)
+
+    let modeSwitch = Task { await controller.setProxyMode(.rule) }
+    await fulfillment(of: [started], timeout: 3)
+    await controller.setAgentEnabled(false)
+    XCTAssertEqual(controller.state, .off)
+    let registrationsAfterStop = agent.registerCount
+    release.release()
+    await modeSwitch.value
+
+    XCTAssertEqual(agent.registerCount, registrationsAfterStop, "派生被取代后不得部署")
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertNil(controller.runtimeObservation)
+    XCTAssertFalse(controller.settings.agentEnabled)
+    XCTAssertEqual(controller.settings.preferredMode, ProxyModeKind.rule, "切换意图保留")
+  }
+
+  /// agent-off 落在目录部署的健康门窗口内：结果必须是
+  /// superseded（而非误分类的 failed），运行时保持 off、lastDocument 不复活。
+  func testAgentOffDuringDeploymentHealthGateSupersedesDeployment() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.BlockingProbe()
+    let started = expectation(description: "deployment health probe paused")
+    let controller = makeController(
+      probe: probe,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .global, agentEnabled: true),
+      proxyMode: .global)
+    try await controller.activate(seeded.server)
+    XCTAssertEqual(controller.state, .running)
+
+    probe.arm(started: started)
+    let deployment = Task {
+      await controller.deploy(SslocalRuntimeDocument(servers: [], listen: ActivationFixture.listen))
+    }
+    await fulfillment(of: [started], timeout: 3)
+    await controller.setAgentEnabled(false)
+    XCTAssertEqual(controller.state, .off)
+    let registrationsAfterStop = agent.registerCount
+    probe.release()
+    let result = await deployment.value
+
+    XCTAssertEqual(result, .superseded)
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertEqual(agent.registerCount, registrationsAfterStop)
+    XCTAssertNil(controller.runtimeObservation)
+  }
+
+  /// 防火墙轮询在 await 恢复后代际已推进（含取消本任务的 stop 路径）时，
+  /// 不得把过期的 .firewallBlocked 盖到最新状态呈现上。
+  func testFirewallPollDoesNotWriteAfterExecutionSupersedesIt() async throws {
+    let seeded = try makeSeededCatalog()
+    let started = expectation(description: "firewall poll awaiting checker")
+    let checker = ProxyRuntimeFixture.BlockingFirewallChecker(
+      outcomes: [.permitted, .blocked], blockOnCall: 2, started: started)
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listen: ProxyListeningConfiguration(listenerMode: .allIPv4Interfaces),
+      firewallChecker: checker)
+    try await controller.activate(seeded.server)
+    XCTAssertEqual(controller.state, .running, "首次防火墙检查通过后进入运行态并武装轮询")
+
+    await fulfillment(of: [started], timeout: 3)
+    await controller.setAgentEnabled(false)
+    XCTAssertEqual(controller.state, .off)
+    checker.release()
+    try await Task.sleep(nanoseconds: 50_000_000)
+
+    XCTAssertEqual(controller.state, .off, "被取代的轮询不得改写状态")
+  }
+
+}
+
+/// Coordinator/controller integration for the shared committed catalog source.
+@MainActor
+final class CatalogRuntimeSnapshotIntegrationTests: XCTestCase {
+  private var runtime: ProxyRuntimeFixture.TemporaryRuntime!
+  private var catalogFileURL: URL!
+  private var activationFileURL: URL!
+  private var agent: ProxyRuntimeFixture.FakeLaunchAgent!
+  private var systemProxy: ProxyRuntimeFixture.FakeSystemProxy!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    catalogFileURL = runtime.directory.appendingPathComponent("catalog.json")
+    activationFileURL = runtime.directory.appendingPathComponent("activation.json")
+
+    agent = ProxyRuntimeFixture.FakeLaunchAgent()
+    systemProxy = ProxyRuntimeFixture.FakeSystemProxy()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: runtime.directory)
+    try await super.tearDown()
+  }
+
+  func testCommitWithoutActiveTargetFeedsLaterActivationThroughSharedSnapshot() async throws {
+    let fileStore = makeTestCatalogStore(fileURL: catalogFileURL)
+    let bootstrap = CatalogCommitCoordinator.bootstrap(fileStore: fileStore)
+    let controller = makeController(
+      catalogSnapshotReader: bootstrap.catalogSnapshotReader,
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: false))
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: fileStore,
+      runtime: ProxyRuntimeSyncAdapter(controller: controller),
+      bootstrap: bootstrap)
+
+    let server = try coordinator.commit { catalog, _ in
+      try ActivationFixture.addPlainServer(
+        "提交后激活", in: &catalog)
+    }
+
+    XCTAssertEqual(coordinator.syncStatus, .idle, "无目标时目录只发布，不触发运行时")
+    XCTAssertNil(controller.activeTargetID)
+    try await controller.activate(server)
+
+    XCTAssertEqual(controller.activeTargetID, server, "激活读取协调器刚发布的唯一快照")
+    XCTAssertEqual(controller.state, .off, "agent 意图关闭时该命令仅选择目标，不部署")
+  }
+
+  func testCoordinatorUsesProductionAdapterToClearRemovedActiveTarget() async throws {
+    let server = try makeSeededCatalog()
+    try ActivationStateFileStore(fileURL: activationFileURL).save(activeTargetID: server)
+    let fileStore = makeTestCatalogStore(fileURL: catalogFileURL)
+    let bootstrap = CatalogCommitCoordinator.bootstrap(fileStore: fileStore)
+    let controller = makeController(
+      catalogSnapshotReader: bootstrap.catalogSnapshotReader,
+      probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    let coordinator = CatalogCommitCoordinator(
+      fileStore: fileStore,
+      runtime: ProxyRuntimeSyncAdapter(controller: controller),
+      bootstrap: bootstrap)
+
+    _ = try coordinator.commit { catalog, _ in try catalog.remove(server) }
+
+    await waitUntilRuntimeSettles(
+      {
+        if case .finished = coordinator.syncStatus { return true }
+        return false
+      }())
+
+    guard case .finished(_, .clearedAndStopped) = coordinator.syncStatus else {
+      return XCTFail("生产 adapter 应以刚提交快照清理无效目标")
+    }
+    XCTAssertNil(controller.activeTargetID)
+    XCTAssertNil(
+      try ActivationStateFileStore(fileURL: activationFileURL).loadActiveTargetID(),
+      "adapter 收敛后持久化清除失效目标")
+  }
+
+  private func makeController(
+    catalogSnapshotReader: RuntimeCatalogSnapshotReading,
+    settings: ProxyRuntimeSettings? = nil,
+    probe: EndpointProbing = SystemEndpointProbe()
+  ) -> ProxyRuntimeController {
+    let runtimeFileStore = RuntimeFileStore(fileURL: runtime.contract)
+    agent.onRegister = { [runtimeFileStore] in
+      try? runtimeFileStore.writePublishedRuntimeReceipt(processID: 42)
+    }
+    return ProxyRuntimeController(
+      controlPreferences: makeTestProxyControlPreferences(),
+      catalogSnapshotReader: catalogSnapshotReader,
+      activationFileStore: ActivationStateFileStore(fileURL: activationFileURL),
+      runtimeFileStore: runtimeFileStore,
+      plugins: ActivationFixture.plugins,
+      listeningStore: InMemoryProxyListeningStore(),
+      appBundle: AppArtifact.bundle,
+      ruleSnapshots: BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot),
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: settings ?? ProxyRuntimeSettings(listen: ActivationFixture.listen),
+        unreadableError: nil),
+      agent: agent,
+      probe: probe,
+      systemProxy: systemProxy,
+      systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService(),
+      firewallExecutableURLs: [URL(fileURLWithPath: "/bundle/Helpers/sslocal")],
+      firewallPollIntervalNanoseconds: 1_000_000,
+      launchHealthTimeoutSeconds: 0.05,
+      sendSignal: { _, _ in 0 },
+      processIsAlive: { $0 == 42 })
+  }
+
+  private func makeSeededCatalog() throws -> NodeID {
+    var catalog = ConfigurationCatalog()
+    let server = try ActivationFixture.addPlainServer(
+      "待删除", in: &catalog)
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+    return server
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+AgentAndSystemProxy.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+AgentAndSystemProxy.swift
new file mode 100644
index 000000000..35abc116e
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+AgentAndSystemProxy.swift
@@ -0,0 +1,291 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// Agent 开关与系统代理开关的拆分语义：与既有开关用例同文件
+/// 追加（Xcode 测试扫描限制），扩展持有独立用例组。
+final class ProxyRuntimeAgentAndSystemProxyTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  func testEnableWithoutActiveTargetDeploysEmptyServerListening() async throws {
+    _ = try makeSeededCatalog()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: false))
+
+    await controller.setAgentEnabled(true)
+
+    XCTAssertEqual(controller.state, .running, "无活动目标 agent 仍提供本地监听")
+    XCTAssertEqual(agent.registerCount, 1, "开启意图驱动注册")
+    XCTAssertEqual(controller.controlPreferences.agentEnabled, true, "开启意图随快照持久化")
+    let onDisk = try XCTUnwrap(
+      RuntimeFileStore(fileURL: runtime.contract).loadDocument())
+    XCTAssertTrue(onDisk.servers.isEmpty, "无活动目标以空服务器列表监听")
+    XCTAssertEqual(onDisk.socksPort, ActivationFixture.listen.socksPort)
+    XCTAssertTrue(systemProxy.applied.isEmpty, "系统代理意图关闭，不写系统设置")
+    XCTAssertEqual(controller.systemProxyState, .idle)
+  }
+  /// 首次运行默认语义（ADR-0011）：全新用户没有服务器配置，GUI 重同步不
+  /// 注册、不拉起 Agent；启动永不清理系统代理设置。
+  func testFirstRunResyncKeepsAgentOffWithoutSystemProxy() async throws {
+    _ = try makeSeededCatalog()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: false))
+
+    await controller.resyncOnLaunch()
+
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertEqual(agent.registerCount, 0, "首次运行默认不启动 agent")
+    XCTAssertFalse(controller.settings.agentEnabled)
+    XCTAssertEqual(systemProxy.clearCount, 0, "启动时意图关闭不清理系统设置")
+    XCTAssertFalse(systemProxyNetworkChangeMonitor.isObserving, "无观察进行")
+    XCTAssertNil(
+      RuntimeFileStore(fileURL: runtime.contract).loadDocument(),
+      "Agent 未启用时不写运行时契约")
+    XCTAssertEqual(controller.systemProxyState, .idle)
+    XCTAssertTrue(systemProxy.applied.isEmpty)
+  }
+  /// 显式关闭 agent 的选择持久化：GUI 重启（全新控制器 + 恢复
+  /// 快照 + 注册态残留）后仍收敛到关闭。
+  func testExplicitAgentOffPersistsAcrossGUIRestart() async throws {
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(), listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: true))
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    await controller.setAgentEnabled(false)
+    XCTAssertEqual(controller.controlPreferences.agentEnabled, false, "关闭选择已持久化")
+
+    // GUI 重启：agent 注册态残留、运行时文件残留，恢复快照携带关闭意图。
+    agent.setStatus(.registered)
+    try Data("stale contract".utf8).write(to: runtime.contract)
+    try Data("99999".utf8).write(to: runtime.pidFile)
+    let restarted = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      agentStatus: .registered,
+      listeningStore: listeningStore,
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(
+          listen: ActivationFixture.listen, preferences: controlPreferences), unreadableError: nil))
+
+    await restarted.resyncOnLaunch()
+
+    XCTAssertEqual(restarted.state, .off, "显式关闭的选择在 GUI 重启后仍生效")
+    XCTAssertEqual(agent.registerCount, 1, "重启后的关闭路径不得重新注册")
+    XCTAssertEqual(agent.unregisterCount, 2, "注册态残留按停止协议再次收敛")
+    XCTAssertFalse(FileManager.default.fileExists(atPath: runtime.contract.path))
+  }
+  func testSystemProxyIntentAppliesOnlyAfterHealthGateAndExitAvailable() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    await controller.setSystemProxyEnabled(true)
+
+    XCTAssertEqual(controller.systemProxyState, .applied)
+    XCTAssertEqual(
+      systemProxy.applied,
+      [
+        SystemProxyConfiguration(
+          socks: .init(host: "127.0.0.1", port: ActivationFixture.listen.socksPort),
+          http: .init(host: "127.0.0.1", port: ActivationFixture.listen.httpPort),
+          https: .init(host: "127.0.0.1", port: ActivationFixture.listen.httpPort),
+          exceptions: FixedLocalProxyRanges.systemProxyExceptions(
+            including: ProxyRuntimeSettings().proxyExceptionList))
+      ],
+      "系统代理只在本地端点健康且存在可用出口后写入")
+  }
+  /// 端点不健康时系统代理意图保持待应用；条件恢复后随下次收敛自动应用，
+  /// 无需重新开关系统代理（「条件恢复后自动收敛」）。
+  func testSystemProxyIntentStaysPendingUntilEndpointsRecover() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.FakeProbe.refusing()
+    let controller = makeController(probe: probe)
+
+    // 激活即按默认意图部署：端点持续不可达 → 启动失败（走满注入的短健康窗）。
+    try await controller.activate(seeded.server)
+    if case .launchFailed = controller.state {
+    } else {
+      XCTFail("端点不可达应呈现启动失败，实际 \(controller.state)")
+    }
+    await controller.setSystemProxyEnabled(true)
+    XCTAssertEqual(controller.systemProxyState, .paused, "失效时清除并保留意图")
+    XCTAssertTrue(systemProxy.applied.isEmpty, "端点不健康不得写系统代理")
+
+    // 条件恢复后由用户显式重试；普通收敛不得重试已确认失败。
+    probe.setOutcomes([.reachable])
+    await controller.setAgentEnabled(true)
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertEqual(controller.systemProxyState, .applied, "恢复后自动收敛待应用意图")
+    XCTAssertEqual(systemProxy.applied.count, 1)
+  }
+  /// 关闭系统代理：on→off 意图迁移触发一次无条件清理；本地监听
+  /// 与 agent 注册态不受影响。
+  func testSystemProxyOffClearsAllSettingsAndKeepsListening() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    await controller.setSystemProxyEnabled(true)
+    XCTAssertEqual(controller.systemProxyState, .applied)
+
+    await controller.setSystemProxyEnabled(false)
+
+    XCTAssertEqual(controller.systemProxyState, .idle)
+    XCTAssertEqual(systemProxy.clearCount, 1)
+    XCTAssertEqual(controller.state, .running, "本地监听不受系统代理开关影响")
+    XCTAssertEqual(agent.unregisterCount, 0, "不注销 agent")
+    XCTAssertTrue(
+      FileManager.default.fileExists(atPath: runtime.contract.path), "运行时契约保留")
+  }
+
+  /// 系统代理意图持久化：GUI 重启后从恢复快照读回。
+  func testSystemProxyIntentPersistsAcrossGUIRestart() async throws {
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(), listeningStore: listeningStore)
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    await controller.setSystemProxyEnabled(true)
+    XCTAssertEqual(controller.controlPreferences.systemProxyEnabled, true)
+
+    let restarted = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      agentStatus: .registered,
+      listeningStore: listeningStore,
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(
+          listen: ActivationFixture.listen, preferences: controlPreferences), unreadableError: nil))
+    XCTAssertTrue(restarted.systemProxyIntentEnabled)
+
+    await restarted.resyncOnLaunch()
+
+    XCTAssertEqual(restarted.systemProxyState, .applied, "启动时先重应用当前网络位置")
+    XCTAssertTrue(systemProxyNetworkChangeMonitor.isObserving, "重同步完成后开始网络观察")
+  }
+  /// 系统代理写入错误以 typed fact 呈现，agent 继续运行。
+  func testSystemProxyApplyFailureSurfacesTypedFailureAndKeepsAgentRunning() async throws {
+    let seeded = try makeSeededCatalog()
+    systemProxy.applyError = SystemProxyError.applyFailed("write failed")
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    await controller.setSystemProxyEnabled(true)
+
+    XCTAssertEqual(
+      controller.systemProxyState, .failed(.operation(.applyFailed)), "写入错误以 typed 呈现")
+    XCTAssertEqual(controller.state, .running, "agent 不受系统代理失败影响")
+    XCTAssertTrue(systemProxy.applied.isEmpty)
+  }
+  /// 关闭 agent 的级联：系统代理意图仍开启时一并持久化为关闭，
+  /// 先请求清理、再停止监听；之后重启 agent 不会恢复系统代理意图。
+}
+
+extension ProxyRuntimeAgentAndSystemProxyTests {
+  /// 意图已开启时的开启命令是失败态的显式重试入口：无需先关再开。
+  func testAgentEnableCommandRetriesConvergenceWhileIntentAlreadyOn() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.FakeProbe.refusing()
+    let controller = makeController(probe: probe)
+
+    // 激活即按默认意图部署：端点不可达 → 启动失败（走满注入的短健康窗）。
+    try await controller.activate(seeded.server)
+    if case .launchFailed = controller.state {
+    } else {
+      XCTFail("端点不可达应呈现启动失败，实际 \(controller.state)")
+    }
+
+    probe.setOutcomes([.reachable])
+    await controller.setAgentEnabled(true)
+
+    XCTAssertEqual(controller.state, .running, "意图已开启时开启命令重走收敛")
+    XCTAssertEqual(controller.systemProxyState, .idle)
+  }
+
+  /// 等值零写入路径：seam 返回 unchanged 时仍呈现 applied，并
+  /// 发一条 GUI 事件行供诊断日志回答「这次为何没有授权弹窗」。
+  func testUnchangedSystemProxyValuesStayAppliedAndEmitEventLine() async throws {
+    let seeded = try makeSeededCatalog()
+    systemProxy.applyOutcome = .unchanged
+    let recorder = RuntimeLogRecorder()
+    RuntimeLog.setSink(recorder)
+    defer { RuntimeLog.setSink(nil) }
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    XCTAssertEqual(controller.systemProxyState, .applied, "unchanged 仍视为已应用")
+    XCTAssertGreaterThanOrEqual(
+      systemProxy.applied.count, 1, "收敛调用照常发生，跳过发生在 seam 内")
+    XCTAssertTrue(
+      recorder.recorded.contains(.systemProxyUnchanged),
+      "跳过路径发事件行，实际 \(recorder.recorded)")
+  }
+
+  /// LaunchDaemon 清单漂移：launchd 沿用注册提交时的 job
+  /// 定义快照，app 更新改了清单后须注销重注才生效。已批准注册仅在清单指纹
+  /// 与注册时不一致时重注（审批与签名绑定，不重弹授权）；首次注册成功即记录
+  /// 指纹，指纹一致不动作。
+  func testHelperRegistrationRefreshesOnlyOnPlistDrift() async throws {
+    let defaults = UserDefaults.standard
+    let stampKey = SystemProxyHelperRegistrationStamp.defaultsKey
+    defer { defaults.removeObject(forKey: stampKey) }
+    defaults.removeObject(forKey: stampKey)
+
+    let seeded = try makeSeededCatalog()
+    systemProxyHelper.setStatus(.notRegistered)
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    await controller.setSystemProxyEnabled(true)
+
+    let stampAfterRegister = try XCTUnwrap(
+      defaults.string(forKey: stampKey), "注册成功应记录 LaunchDaemon 清单指纹")
+    let registerCountAfterEnable = systemProxyHelper.registerCount
+    let unregisterCountAfterEnable = systemProxyHelper.unregisterCount
+
+    // 指纹一致：后续收敛不注销重注。
+    await controller.systemProxyObserver.convergeSystemProxy()
+    XCTAssertEqual(systemProxyHelper.registerCount, registerCountAfterEnable, "指纹一致不重注")
+    XCTAssertEqual(systemProxyHelper.unregisterCount, unregisterCountAfterEnable)
+    XCTAssertEqual(controller.systemProxyState, .applied)
+
+    // 指纹漂移（模拟 app 更新改了清单）：注销重注一次并更新指纹。
+    defaults.set("drifted-stamp", forKey: stampKey)
+    await controller.systemProxyObserver.convergeSystemProxy()
+    XCTAssertEqual(systemProxyHelper.unregisterCount, unregisterCountAfterEnable + 1, "漂移触发重注")
+    XCTAssertEqual(systemProxyHelper.registerCount, registerCountAfterEnable + 1)
+    XCTAssertEqual(defaults.string(forKey: stampKey), stampAfterRegister, "重注后记录当前清单指纹")
+    XCTAssertEqual(controller.systemProxyState, .applied, "重注后照常收敛应用")
+  }
+}
+
+/// 测试专用事件接收缝。
+private final class RuntimeLogRecorder: RuntimeEventSink, @unchecked Sendable {
+  private let lock = NSLock()
+  private var events: [RuntimeLogEvent] = []
+
+  var recorded: [RuntimeLogEvent] {
+    lock.lock()
+    defer { lock.unlock() }
+    return events
+  }
+
+  func append(event: RuntimeLogEvent, timestamp: Date) {
+    lock.lock()
+    events.append(event)
+    lock.unlock()
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+CatalogConvergence.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+CatalogConvergence.swift
new file mode 100644
index 000000000..0889ff222
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+CatalogConvergence.swift
@@ -0,0 +1,141 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 目录提交 → 运行时收敛语义与 GLOSSARY.md「有效值未变的提交不做
+/// 运行时收敛」）：与主测试类同构扩展，按既有模式独立成文件。
+final class ProxyRuntimeCatalogConvergenceTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  // MARK: 目录重展开消费
+
+  /// 模拟 wrapper 在跑（pid 指向本测试进程，kill(pid, 0) 判活通过）。
+  private func simulateRunningWrapper() throws {
+    try Data("\(ProcessInfo.processInfo.processIdentifier)".utf8).write(to: runtime.pidFile)
+  }
+
+  private func committedCatalog() throws -> ConfigurationCatalog {
+    try makeTestCatalogStore(fileURL: catalogFileURL).load().catalog
+  }
+
+  private func replacedFields(
+    _ fields: ServerFields, address: String? = nil, remark: String? = nil
+  ) -> ServerFields {
+    ServerFields(
+      address: address ?? fields.address,
+      port: fields.port,
+      encryptionMethod: fields.encryptionMethod,
+      password: fields.password,
+      remark: remark ?? fields.remark,
+      pluginProgram: fields.pluginProgram,
+      pluginOptions: fields.pluginOptions)
+  }
+
+  func testCatalogValueEditOfActiveTargetRewritesAndSignalsRunningWrapper() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    try simulateRunningWrapper()
+
+    // 修改激活服务器的连接地址（契约有效值变化），提交目录变更。
+    var catalog = try makeTestCatalogStore(fileURL: catalogFileURL).load().catalog
+    let fields = try ActivationFixture.serverFields(of: seeded.server, in: catalog)
+    try catalog.updateServer(
+      seeded.server, with: replacedFields(fields, address: "203.0.113.9"))
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+
+    // 协调器生产适配入口：以刚提交的内存快照重展开。
+    _ = await controller.catalogDidCommit(snapshot: try committedCatalog())
+
+    XCTAssertEqual(controller.state, .running)
+    let onDisk = try XCTUnwrap(RuntimeFileStore(fileURL: runtime.contract).loadDocument())
+    XCTAssertEqual(onDisk.servers.first?.server, "203.0.113.9", "运行时文档已原子更新")
+    let signalsSent = signals.signalsSent.filter { $0.signal != 0 }
+    XCTAssertEqual(signalsSent.count, 1, "代理运行中：重写后应发一次 SIGUSR1")
+    XCTAssertEqual(signalsSent.first?.signal, SIGUSR1)
+  }
+
+  func testCatalogRemarkOnlyEditOfActiveTargetKeepsRuntimeUntouched() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let controller = makeController(probe: probe)
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    try simulateRunningWrapper()
+    let contractDataBefore = try Data(contentsOf: runtime.contract)
+
+    // 修改激活服务器的备注：显示名是目录元数据，不进契约 → 零收敛
+    // （不写盘、不发信号、不闪 starting、不重走健康门）。
+    var catalog = try makeTestCatalogStore(fileURL: catalogFileURL).load().catalog
+    let fields = try ActivationFixture.serverFields(of: seeded.server, in: catalog)
+    try catalog.updateServer(
+      seeded.server, with: replacedFields(fields, remark: "新加坡 01"))
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+
+    let outcome = await controller.catalogDidCommit(snapshot: try committedCatalog())
+
+    XCTAssertEqual(outcome, .converged(skippedServers: []))
+    XCTAssertEqual(controller.state, .running, "状态面原地不动，不闪回 starting")
+    XCTAssertEqual(try Data(contentsOf: runtime.contract), contractDataBefore, "契约逐字节未变")
+    XCTAssertEqual(
+      signals.signalsSent.filter { $0.signal != 0 }.count, 0, "不向 wrapper 发信号")
+    XCTAssertEqual(probe.callCount, 2, "不重走健康门（初始部署探测过 SOCKS+HTTP 各一次）")
+  }
+
+  func testCatalogValueEditOutsideActiveSubtreeKeepsRuntimeUntouched() async throws {
+    var catalog = ConfigurationCatalog()
+    let activeServer = try ActivationFixture.addPlainServer(
+      "香港 01", in: &catalog)
+    let idleServer = try ActivationFixture.addPlainServer(
+      "备用 02", in: &catalog)
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let controller = makeController(probe: probe)
+    try await controller.activate(activeServer)
+    await controller.setAgentEnabled(true)
+    try simulateRunningWrapper()
+    let contractDataBefore = try Data(contentsOf: runtime.contract)
+
+    // 修改目标子树之外服务器的连接地址：派生契约不变 → 零收敛。
+    var working = try makeTestCatalogStore(fileURL: catalogFileURL).load().catalog
+    let fields = try ActivationFixture.serverFields(of: idleServer, in: working)
+    try working.updateServer(idleServer, with: replacedFields(fields, address: "198.51.100.9"))
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: working))
+
+    let outcome = await controller.catalogDidCommit(snapshot: try committedCatalog())
+
+    XCTAssertEqual(outcome, .converged(skippedServers: []))
+    XCTAssertEqual(controller.state, .running, "状态面原地不动，不闪回 starting")
+    XCTAssertEqual(try Data(contentsOf: runtime.contract), contractDataBefore, "契约逐字节未变")
+    XCTAssertEqual(signals.signalsSent.filter { $0.signal != 0 }.count, 0, "不向 wrapper 发信号")
+    XCTAssertEqual(probe.callCount, 2, "不重走健康门")
+  }
+
+  func testCatalogGroupMemberValueEditRewritesAndSignalsRunningWrapper() async throws {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("分组")
+    let member = try ActivationFixture.addPlainServer(
+      "香港 01", to: group, in: &catalog)
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(group)
+    await controller.setAgentEnabled(true)
+    try simulateRunningWrapper()
+
+    // 激活目标是分组：成员连接值变化是活动子树的真实值变化 → 正常收敛。
+    var working = try makeTestCatalogStore(fileURL: catalogFileURL).load().catalog
+    let fields = try ActivationFixture.serverFields(of: member, in: working)
+    try working.updateServer(member, with: replacedFields(fields, address: "203.0.113.9"))
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: working))
+
+    _ = await controller.catalogDidCommit(snapshot: try committedCatalog())
+
+    XCTAssertEqual(controller.state, .running)
+    let onDisk = try XCTUnwrap(RuntimeFileStore(fileURL: runtime.contract).loadDocument())
+    XCTAssertEqual(onDisk.servers.first?.server, "203.0.113.9", "成员值变化进入运行时文档")
+    XCTAssertEqual(signals.signalsSent.filter { $0.signal != 0 }.count, 1, "转发一次 SIGUSR1")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+Firewall.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+Firewall.swift
new file mode 100644
index 000000000..3462f7902
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+Firewall.swift
@@ -0,0 +1,81 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class ProxyRuntimeFirewallTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  func testLocalhostModeNeverQueriesApplicationFirewall() async throws {
+    let seeded = try makeSeededCatalog()
+    let firewall = ProxyRuntimeFixture.FakeFirewallChecker(.blocked)
+    var listen = ProxyListeningConfiguration()
+    listen.lan.mode = .allIPv6Interfaces
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(), listen: listen, firewallChecker: firewall)
+
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertTrue(firewall.checkedURLs.isEmpty, "回环态与应用防火墙零交互")
+    XCTAssertEqual(controller.effectiveRuntimeListenFacts?.lan.isEnabled, false)
+    XCTAssertEqual(controller.effectiveRuntimeListenFacts?.lan.mode, .allIPv6Interfaces)
+  }
+
+  func testAllIPv4InterfacesBlockedByFirewallPresentsTargetedRepair() async throws {
+    let seeded = try makeSeededCatalog()
+    let firewall = ProxyRuntimeFixture.FakeFirewallChecker(.blocked)
+    let listen = ProxyListeningConfiguration(
+      listenerMode: .allIPv4Interfaces,
+      socksPort: 1086,
+      httpPort: 1087)
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listen: listen,
+      firewallChecker: firewall)
+
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    guard case .firewallBlocked(let facts) = controller.state else {
+      XCTFail("主机态被拒应呈现防火墙状态，实际 \(controller.state)")
+      return
+    }
+    XCTAssertEqual(facts.executableName, "sslocal")
+    XCTAssertTrue(
+      AppPresentation.message(for: RuntimeFailureFacts.firewallBlocked(facts)).contains("允许传入连接"))
+    XCTAssertEqual(firewall.checkedURLs.map(\.lastPathComponent), ["sslocal"])
+    XCTAssertEqual(
+      controller.effectiveRuntimeListenFacts?.lan.mode,
+      .allIPv4Interfaces)
+  }
+
+  func testAllInterfaceModeDetectsFirewallRefusalAfterInitialHealthyPresentation() async throws {
+    let seeded = try makeSeededCatalog()
+    let firewall = ProxyRuntimeFixture.FakeFirewallChecker(outcomes: [.permitted, .blocked])
+    let listen = ProxyListeningConfiguration(listenerMode: .allIPv4Interfaces)
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listen: listen,
+      firewallChecker: firewall)
+
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    let deadline = Date().addingTimeInterval(1)
+    while controller.state == .running && Date() < deadline {
+      try await Task.sleep(nanoseconds: 5_000_000)
+    }
+    guard case .firewallBlocked(let facts) = controller.state else {
+      XCTFail("稍后发生的拒绝也必须被检测，实际 \(controller.state)")
+      return
+    }
+    XCTAssertEqual(facts.executableName, "sslocal")
+    XCTAssertTrue(
+      AppPresentation.message(for: RuntimeFailureFacts.firewallBlocked(facts)).contains("允许传入连接"))
+    XCTAssertGreaterThanOrEqual(firewall.checkedURLs.count, 2)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+GlobalMode.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+GlobalMode.swift
new file mode 100644
index 000000000..84f776af9
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+GlobalMode.swift
@@ -0,0 +1,99 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 全局模式以 ACL 实现：proxy_all + 固定本地绕过；无活动服务器
+/// 时 agent 仍监听、系统代理保持待应用；ACL 变化完整重启，失败保留最新意图。
+final class ProxyRuntimeGlobalModeTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  func testGlobalModeDeploysProxyAllACLAndProjectsSOCKSProxyWithFixedExceptions() async throws {
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
+    try await controller.activate(seeded.server)
+    XCTAssertEqual(controller.systemProxyState, .applied)
+    let unregisterCount = agent.unregisterCount
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+
+    await controller.setProxyMode(.global)
+
+    XCTAssertEqual(controller.proxyMode, .global)
+    XCTAssertEqual(controller.settings.preferredMode, .global)
+    XCTAssertEqual(controller.controlPreferences.preferredMode, .global)
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertEqual(
+      agent.unregisterCount, unregisterCount + 1, "ACL 变化触发完整 agent 重启")
+    let document = try XCTUnwrap(runtimeStore.loadDocument())
+    XCTAssertEqual(document.aclRuntime?.summary, "global")
+    let expectedACL = ProxyACLDocument.global(at: runtimeStore.aclFileURL)
+    XCTAssertTrue(expectedACL.content.hasPrefix("[proxy_all]\n[bypass_list]\n"))
+    XCTAssertEqual(
+      try Data(contentsOf: runtimeStore.aclFileURL),
+      Data(expectedACL.content.utf8),
+      "链接解析后的内容是 global 变体")
+    XCTAssertEqual(
+      systemProxy.applied.last?.socks,
+      .init(host: "127.0.0.1", port: ActivationFixture.listen.socksPort))
+    XCTAssertEqual(
+      systemProxy.applied.last?.http,
+      .init(host: "127.0.0.1", port: ActivationFixture.listen.httpPort))
+    XCTAssertTrue(
+      Set(FixedLocalProxyRanges.systemProxyExceptions).isSubset(
+        of: Set(systemProxy.applied.last?.exceptions ?? [])),
+      "系统例外包含固定本地范围")
+    XCTAssertEqual(controller.systemProxyState, .applied)
+  }
+
+  func testGlobalModeWithoutServerKeepsListeningAndPendingUntilTargetRecovers() async throws {
+    // 目录先播种、控制器再创建：bootstrap 快照读取器持有已提交目录，但尚无
+    // 活动目标——正是「全局模式 + 无可用出口」的起点。
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
+    await controller.resyncOnLaunch()
+    XCTAssertEqual(controller.state, .running, "无活动目标时 agent 仍监听")
+    XCTAssertNil(controller.activeTargetID)
+    let unregisterCount = agent.unregisterCount
+
+    await controller.setProxyMode(.global)
+
+    XCTAssertEqual(controller.proxyMode, .global)
+    XCTAssertEqual(controller.state, .running, "全局模式空服务器列表仍提供本地监听")
+    XCTAssertEqual(
+      agent.unregisterCount, unregisterCount + 1, "ACL 变化触发完整 agent 重启")
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let document = try XCTUnwrap(runtimeStore.loadDocument())
+    XCTAssertTrue(document.servers.isEmpty, "无活动目标时服务器列表为空")
+    XCTAssertEqual(document.aclRuntime?.summary, "global")
+    XCTAssertEqual(
+      controller.systemProxyState, .paused,
+      "无可用代理出口时系统代理意图保持待应用")
+    XCTAssertTrue(systemProxy.applied.isEmpty, "不得把系统代理指向无出口入口")
+
+    // 服务器有效且端点健康后自动应用已开启的系统代理意图。
+    try await controller.activate(seeded.server)
+
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertEqual(
+      controller.systemProxyState, .applied,
+      "服务器有效且健康后自动收敛待应用意图")
+    XCTAssertEqual(
+      systemProxy.applied.last?.socks,
+      .init(host: "127.0.0.1", port: ActivationFixture.listen.socksPort))
+    XCTAssertEqual(
+      systemProxy.applied.last?.http,
+      .init(host: "127.0.0.1", port: ActivationFixture.listen.httpPort))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+Mode.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+Mode.swift
new file mode 100644
index 000000000..2f993560e
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+Mode.swift
@@ -0,0 +1,262 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class ProxyRuntimeModeCommandTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  func testHealthyModeSwitchKeepsRunningWithoutProbingPorts() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let controller = makeController(probe: probe)
+    try await controller.activate(seeded.server)
+    try Data("42".utf8).write(to: runtime.pidFile)
+    let callsBefore = probe.callCount
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    var statesAtReload: [ProxyRuntimeController.AgentRunState] = []
+    signals.reloadReceipt = {
+      statesAtReload.append(controller.state)
+      try? runtimeStore.writePublishedRuntimeReceipt(processID: 42)
+    }
+
+    await controller.setProxyMode(.direct)
+    await controller.setProxyMode(.global)
+    await controller.setProxyMode(.rule)
+
+    XCTAssertEqual(statesAtReload, [.running, .running, .running])
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertEqual(probe.callCount, callsBefore, "热重载不得重新探测未变化的监听端口")
+  }
+
+  func testACLReloadWithReplacementChildStillProbesListeners() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let controller = makeController(probe: probe, processIsAlive: { [42, 43].contains($0) })
+    try await controller.activate(seeded.server)
+    try Data("42".utf8).write(to: runtime.pidFile)
+    let callsBefore = probe.callCount
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    signals.reloadReceipt = { try? runtimeStore.writePublishedRuntimeReceipt(processID: 43) }
+
+    await controller.setProxyMode(.direct)
+
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertGreaterThan(probe.callCount, callsBefore, "新子进程必须重新验证监听")
+  }
+
+  func testACLReloadRequiresCurrentReceiptWithoutProbingUnchangedListeners() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let controller = makeController(probe: probe)
+    try await controller.activate(seeded.server)
+    try Data("42".utf8).write(to: runtime.pidFile)
+    let callsBefore = probe.callCount
+    signals.reloadReceipt = {}
+
+    await controller.setProxyMode(.direct)
+
+    XCTAssertEqual(controller.state, .serviceFailed(.agent))
+    XCTAssertEqual(probe.callCount, callsBefore)
+    XCTAssertNotNil(RuntimeFileStore(fileURL: runtime.contract).readFailure())
+  }
+
+  func testNewModeSupersedesPendingACLReloadWithoutStartingOrProbing() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let waiting = expectation(description: "waiting for reload receipt")
+    let gate = RuleRuntimeDelayGate(started: waiting)
+    let controller = makeController(
+      probe: probe, launchHealthTimeoutSeconds: 5,
+      launchHealthRetryDelay: { try await gate.wait() })
+    try await controller.activate(seeded.server)
+    try Data("42".utf8).write(to: runtime.pidFile)
+    let callsBefore = probe.callCount
+    signals.reloadReceipt = {}
+    let pending = Task { await controller.setProxyMode(.direct) }
+    try await withTestTask(
+      pending, release: { gate.resume() },
+      body: {
+        try await requireTestPhase([waiting])
+        XCTAssertEqual(controller.state, .running)
+        let store = RuntimeFileStore(fileURL: runtime.contract)
+        var stateAtReload: ProxyRuntimeController.AgentRunState?
+        self.signals.reloadReceipt = {
+          stateAtReload = controller.state
+          try? store.writePublishedRuntimeReceipt(processID: 42)
+        }
+        await controller.setProxyMode(.global)
+        XCTAssertEqual(stateAtReload, .running)
+        XCTAssertEqual(controller.state, .running)
+        XCTAssertEqual(probe.callCount, callsBefore)
+      })
+    XCTAssertTrue(controller.runtimeReloadProcesses.isEmpty)
+    XCTAssertEqual(controller.proxyMode, .global)
+    XCTAssertEqual(controller.state, .running)
+  }
+
+  func testSetProxyModePersistsTheChoiceAndARestoreRestoresIt() async throws {
+    let listeningStore = InMemoryProxyListeningStore()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(), listeningStore: listeningStore)
+
+    await controller.setProxyMode(.global)
+
+    XCTAssertEqual(controller.proxyMode, .global)
+    XCTAssertEqual(controller.settings.preferredMode, .global)
+    XCTAssertEqual(controller.controlPreferences.preferredMode, .global, "模式选择随快照持久化")
+
+    // GUI 重启路径：恢复出的控制器不注入显式模式，从持久快照读回。
+    let restored = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(
+          listen: ActivationFixture.listen, preferences: controlPreferences), unreadableError: nil),
+      proxyMode: nil)
+    XCTAssertEqual(restored.proxyMode, .global)
+  }
+
+  func testDirectModeDeploysACLWithoutServerAndProjectsSOCKSProxy() async throws {
+    let listeningStore = InMemoryProxyListeningStore()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
+
+    await controller.resyncOnLaunch()
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertTrue(systemProxy.applied.isEmpty, "规则模式没有活动目标时不应用系统代理")
+    let unregisterCount = agent.unregisterCount
+
+    await controller.setProxyMode(.direct)
+
+    XCTAssertEqual(controller.proxyMode, .direct)
+    XCTAssertEqual(controller.settings.preferredMode, .direct)
+    XCTAssertEqual(controller.controlPreferences.preferredMode, .direct)
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertEqual(agent.unregisterCount, unregisterCount + 1, "ACL 变化触发完整 agent 重启")
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let document = try XCTUnwrap(runtimeStore.loadDocument())
+    XCTAssertTrue(document.servers.isEmpty, "直连模式允许空服务器列表")
+    XCTAssertEqual(document.aclRuntime?.summary, "direct")
+    let expectedACL = ProxyACLDocument.direct(at: runtimeStore.aclFileURL)
+    XCTAssertEqual(
+      try Data(contentsOf: runtimeStore.aclFileURL),
+      Data(expectedACL.content.utf8),
+      "链接解析后的内容是 direct 变体")
+    XCTAssertEqual(
+      systemProxy.applied.last?.socks,
+      .init(host: "127.0.0.1", port: ActivationFixture.listen.socksPort))
+    XCTAssertEqual(
+      systemProxy.applied.last?.http,
+      .init(host: "127.0.0.1", port: ActivationFixture.listen.httpPort))
+    XCTAssertTrue(
+      Set(FixedLocalProxyRanges.systemProxyExceptions).isSubset(
+        of: Set(systemProxy.applied.last?.exceptions ?? [])))
+    XCTAssertEqual(controller.systemProxyState, .applied)
+
+    let registersBeforeDisable = agent.unregisterCount
+    await controller.setSystemProxyEnabled(false)
+    XCTAssertEqual(controller.state, .running, "关闭系统代理不停止本地入口")
+    XCTAssertEqual(agent.unregisterCount, registersBeforeDisable)
+    XCTAssertEqual(controller.systemProxyState, .idle)
+
+    let restored = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(
+          listen: ActivationFixture.listen, preferences: controlPreferences), unreadableError: nil),
+      proxyMode: nil)
+    XCTAssertEqual(restored.proxyMode, .direct, "模式选择从持久快照恢复")
+  }
+
+  func testFailedDirectInstanceKeepsNewModeAndStopsService() async throws {
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true),
+      launchHealthTimeoutSeconds: 0.05)
+    try await controller.activate(seeded.server)
+    XCTAssertEqual(controller.systemProxyState, .applied)
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let previousDocument = try XCTUnwrap(runtimeStore.loadDocument())
+    let previousApplicationCount = systemProxy.applied.count
+    var observedStates: [ProxyRuntimeController.AgentRunState] = []
+    let cancellable = controller.factChanges.changes.sink { @MainActor _ in
+      observedStates.append(controller.state)
+    }
+    defer { cancellable.cancel() }
+
+    agent.onRegister = { [runtimeStore, previousDocument] in
+      guard let requested = runtimeStore.loadDocument() else { return }
+      let accepted = requested.aclRuntime == nil ? requested : previousDocument
+      try? runtimeStore.writeRuntimeReceipt(for: accepted, processID: 42)
+    }
+
+    await controller.setProxyMode(.direct)
+
+    XCTAssertTrue(observedStates.contains(.starting), "重启期间呈现短暂不可用状态")
+    XCTAssertEqual(controller.proxyMode, .direct)
+    XCTAssertEqual(controller.settings.preferredMode, .direct)
+    XCTAssertEqual(controller.controlPreferences.preferredMode, .direct)
+    XCTAssertEqual(runtimeStore.loadDocument()?.aclRuntime?.summary, "direct")
+    XCTAssertEqual(controller.state, .serviceFailed(.agent))
+    XCTAssertTrue(controller.agentIntentEnabled)
+    XCTAssertTrue(controller.systemProxyIntentEnabled)
+    XCTAssertNotNil(runtimeStore.readFailure())
+    XCTAssertEqual(systemProxy.applied.count, previousApplicationCount)
+    XCTAssertGreaterThan(systemProxy.clearCount, 0)
+  }
+
+  func testDirectReceiptIsRecheckedAfterReachableStaleListenerProbes() async throws {
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let processLiveness = ProcessLivenessRecorder()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true),
+      processIsAlive: { processLiveness.isAlive($0) })
+    try await controller.activate(seeded.server)
+    XCTAssertEqual(controller.systemProxyState, .applied)
+
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let appliedCount = systemProxy.applied.count
+    agent.onRegister = { [runtimeStore] in
+      guard let requested = runtimeStore.loadDocument() else { return }
+      // 新直连实例用一次性存活的 pid 43。
+      let processID: Int32 = requested.aclRuntime?.summary == "direct" ? 43 : 42
+      try? runtimeStore.writeRuntimeReceipt(for: requested, processID: processID)
+    }
+
+    await controller.setProxyMode(.direct)
+
+    XCTAssertEqual(controller.proxyMode, .direct)
+    XCTAssertEqual(controller.state, .serviceFailed(.agent))
+    XCTAssertEqual(runtimeStore.loadDocument()?.aclRuntime?.summary, "direct")
+    XCTAssertNotNil(runtimeStore.readFailure())
+    XCTAssertEqual(systemProxy.applied.count, appliedCount)
+    XCTAssertGreaterThan(systemProxy.clearCount, 0)
+  }
+}
+
+private final class ProcessLivenessRecorder: @unchecked Sendable {
+  private let lock = NSLock()
+  private var candidateChecks = 0
+
+  func isAlive(_ pid: Int32) -> Bool {
+    if pid == 42 { return true }
+    guard pid == 43 else { return false }
+    lock.lock()
+    defer { lock.unlock() }
+    candidateChecks += 1
+    return candidateChecks == 1
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+ResyncAndSettings.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+ResyncAndSettings.swift
new file mode 100644
index 000000000..46a5d2277
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+ResyncAndSettings.swift
@@ -0,0 +1,100 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class ProxyRuntimeResyncAndSettingsTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  // MARK: GUI 重启重同步
+
+  func testResyncWithRegisteredAgentAndMatchingContractSkipsRewrite() async throws {
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let enabledSettings = ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: true)
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(), agentStatus: .notRegistered,
+      listeningStore: listeningStore, settings: enabledSettings)
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    XCTAssertTrue(agent.registerCount >= 1)
+    let contractMtime =
+      try FileManager.default.attributesOfItem(
+        atPath: runtime.contract.path
+      )[.modificationDate] as? Date
+
+    // 模拟 GUI 重启：全新控制器，agent 已注册、wrapper pid 存活（本测试进程）。
+    try Data("\(ProcessInfo.processInfo.processIdentifier)".utf8).write(to: runtime.pidFile)
+    let restarted = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(), agentStatus: .registered,
+      listeningStore: listeningStore, settings: enabledSettings)
+
+    await restarted.resyncOnLaunch()
+
+    XCTAssertEqual(restarted.state, .running)
+    XCTAssertEqual(agent.registerCount, 1, "已注册不再重复注册")
+    let afterResyncMtime =
+      try FileManager.default.attributesOfItem(
+        atPath: runtime.contract.path
+      )[.modificationDate] as? Date
+    XCTAssertEqual(contractMtime, afterResyncMtime, "相同契约内容跳过写入（幂等）")
+    XCTAssertTrue(
+      signals.signalsSent.filter { $0.signal != 0 }.isEmpty,
+      "内容一致不需要 reload 信号")
+  }
+
+  func testLegacyImportBoundaryStopsRuntimeWithoutRestoringSystemProxy() async throws {
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    var importedSettings = ProxyRuntimeSettings()
+    importedSettings.preferredMode = .global
+    listeningStore.saved = importedSettings.listen
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      systemProxy: systemProxy)
+
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    XCTAssertEqual(controller.state, .running)
+
+    await controller.legacyImportDidCommit()
+
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertEqual(controller.settings.listen, importedSettings.listen)
+    XCTAssertTrue(controller.settings.agentEnabled, "导入不改变控制偏好")
+    XCTAssertEqual(controller.activeTargetID, seeded.server)
+    XCTAssertEqual(systemProxy.clearCount, 0, "Legacy 导入不能写入或清理系统代理")
+    XCTAssertTrue(systemProxy.applied.isEmpty, "导入边界不应重新应用系统代理")
+  }
+
+  func testUpdatingSettingsPersistsAndReactivatesTheRuntimeContract() async throws {
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
+
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    var next = controller.settings
+    next.listen.httpPort = 2088
+    next.proxyExceptions = "localhost, 127.0.0.1"
+    try await controller.updateListening(next.listen)
+    await controller.updateProxyExceptions(next.proxyExceptions)
+
+    let document = try XCTUnwrap(RuntimeFileStore(fileURL: runtime.contract).loadDocument())
+    XCTAssertEqual(controller.settings, next)
+    XCTAssertEqual(listeningStore.saved, next.listen)
+    XCTAssertEqual(document.httpPort, 2088)
+    XCTAssertEqual(
+      systemProxy.applied.last?.exceptions,
+      FixedLocalProxyRanges.systemProxyExceptions(including: ["localhost", "127.0.0.1"]),
+      "系统代理意图开启时随设置更新重新应用")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+SystemProxyCommands.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+SystemProxyCommands.swift
new file mode 100644
index 000000000..83852660e
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests+SystemProxyCommands.swift
@@ -0,0 +1,226 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension ProxyRuntimeAgentAndSystemProxyTests {
+  func testAgentOffClearsSystemProxyBeforeStoppingListeningAndCascadesIntentOff() async throws {
+    let seeded = try makeSeededCatalog()
+    let listeningStore = InMemoryProxyListeningStore()
+    let eventLog = ProxyRuntimeEventLog()
+    agent.eventLog = eventLog
+    systemProxy.eventLog = eventLog
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      listeningStore: listeningStore,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    XCTAssertEqual(controller.systemProxyState, .applied)
+
+    await controller.setAgentEnabled(false)
+
+    XCTAssertEqual(controller.state, .off, "关闭级联后运行时停止")
+    XCTAssertEqual(
+      eventLog.events,
+      ["register", "apply", "clear", "unregister"],
+      "先清理系统设置，再停止 agent 监听")
+    XCTAssertEqual(controller.systemProxyState, .idle, "级联后意图关闭且清理完成")
+    XCTAssertEqual(controller.controlPreferences.agentEnabled, false)
+    XCTAssertEqual(controller.controlPreferences.systemProxyEnabled, false, "级联关闭一并持久化")
+
+    // 重启 agent 不恢复系统代理意图。
+    await controller.setAgentEnabled(true)
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertEqual(systemProxy.applied.count, 1, "不再应用系统代理")
+    XCTAssertEqual(controller.systemProxyState, .idle)
+    XCTAssertFalse(systemProxyNetworkChangeMonitor.isObserving, "意图关闭不开网络观察")
+  }
+
+  /// 系统代理意图本就关闭时关闭 agent：不做任何系统设置操作。
+  func testAgentOffWithSystemProxyIntentAlreadyOffSendsNoClear() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    await controller.setAgentEnabled(false)
+
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertEqual(systemProxy.clearCount, 0, "未发生 on→off 迁移，不清理")
+    XCTAssertEqual(controller.systemProxyState, .idle)
+  }
+
+  /// 特权 helper 待批准：意图保持待应用、系统设置不变，
+  /// 置位批准路径；收敛被 helper 门禁挡下，不尝试写入。
+  func testHelperApprovalRequiredKeepsIntentPendingAndOffersApprovalPath() async throws {
+    let seeded = try makeSeededCatalog()
+    systemProxyHelper.setStatus(.requiresApproval)
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    await controller.setSystemProxyEnabled(true)
+
+    XCTAssertEqual(controller.systemProxyState, .pending, "意图保持待应用")
+    XCTAssertTrue(controller.systemProxyApprovalRequired, "呈现批准路径")
+    XCTAssertTrue(systemProxy.applied.isEmpty, "helper 不可用不写入")
+    XCTAssertEqual(systemProxyNetworkChangeMonitor.isObserving, true, "意图开启照常观察")
+
+    // 批准路径：打开登录项设置并重试收敛；批准达成后 applied。
+    systemProxyHelper.setStatus(.approved)
+    await controller.systemProxyObserver.openSystemProxyHelperApproval()
+
+    XCTAssertEqual(controller.systemProxyState, .applied)
+    XCTAssertFalse(controller.systemProxyApprovalRequired)
+    XCTAssertEqual(systemProxyHelper.openApprovalPathCount, 1)
+  }
+
+  /// helper 未注册时显式开启即注册：注册成功走正常
+  /// 收敛；注册失败保持待应用与批准路径。
+  func testExplicitEnableRegistersHelperAndSurvivesRegistrationFailure() async throws {
+    let seeded = try makeSeededCatalog()
+    systemProxyHelper.setStatus(.notRegistered)
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    await controller.setSystemProxyEnabled(true)
+
+    XCTAssertEqual(systemProxyHelper.registerCount, 1, "首次显式开启注册 helper")
+    XCTAssertEqual(controller.systemProxyState, .applied)
+
+    // 重新安装/注册丢失后的重试路径：注册失败也保持意图待应用。
+    let secondSystemProxy = ProxyRuntimeFixture.FakeSystemProxy()
+    systemProxyHelper.setStatus(.notRegistered)
+    systemProxyHelper.setRegisterError(
+      ProxyListeningStoreError.corrupt(detail: "SMError"))
+    systemProxyHelper.statusAfterRegister = .notRegistered
+    let second = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true),
+      systemProxy: secondSystemProxy)
+    try await second.activate(seeded.server)
+    await second.setAgentEnabled(true)
+
+    await second.setSystemProxyEnabled(false)
+    await second.setSystemProxyEnabled(true)
+
+    XCTAssertEqual(second.systemProxyState, .pending, "注册失败保持待应用")
+    XCTAssertTrue(second.systemProxyApprovalRequired, "呈现批准路径")
+    XCTAssertTrue(secondSystemProxy.applied.isEmpty, "注册失败不写入")
+  }
+
+  /// 清理失败：typed 呈现且无后台重试；观察在该次尝试后停止。
+  func testDisableClearFailureIsPresentedWithoutDeferredRetry() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    await controller.setSystemProxyEnabled(true)
+    systemProxy.clearError = SystemProxyError.helperUnavailable("helper gone")
+
+    await controller.setSystemProxyEnabled(false)
+
+    XCTAssertEqual(controller.systemProxyState, .clearFailed(.operation(.helperUnavailable)))
+    XCTAssertFalse(systemProxyNetworkChangeMonitor.isObserving, "清理失败后也结束临时观察")
+    XCTAssertEqual(systemProxy.clearCount, 1, "只请求一次清理，无后台重试")
+  }
+
+  func testEnabledSystemProxyInspectsAllPassiveChangesWithoutReapplying() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    await controller.setSystemProxyEnabled(true)
+    XCTAssertEqual(systemProxy.applied.count, 1)
+    XCTAssertTrue(systemProxyNetworkChangeMonitor.isObserving)
+
+    systemProxyNetworkChangeMonitor.emit(.proxyConfiguration)
+    await Task.yield()
+    XCTAssertEqual(systemProxy.applied.count, 1, "代理配置变化不触发重写")
+
+    systemProxyNetworkChangeMonitor.emit(.networkConfiguration)
+    let reads = systemProxy.readCount
+    await waitUntil(systemProxy.readCount > reads)
+    XCTAssertEqual(systemProxy.applied.count, 1, "网络位置或服务变化只检查")
+
+    systemProxyNetworkChangeMonitor.emit(.networkPath)
+    let pathReads = systemProxy.readCount
+    await waitUntil(systemProxy.readCount > pathReads)
+    XCTAssertEqual(systemProxy.applied.count, 1, "网络路径变化只检查")
+  }
+
+  func testDisableCleanupRescansChangesThatArriveDuringCleanupThenStopsObservation() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    await controller.setSystemProxyEnabled(true)
+    var emittedCleanupChange = false
+    let monitor = systemProxyNetworkChangeMonitor!
+    systemProxy.onClear = {
+      guard !emittedCleanupChange else { return }
+      emittedCleanupChange = true
+      monitor.emit(.proxyConfiguration)
+    }
+
+    await controller.setSystemProxyEnabled(false)
+
+    XCTAssertEqual(systemProxy.clearCount, 2, "清理期间代理变化触发第二次全量扫描")
+    XCTAssertFalse(systemProxyNetworkChangeMonitor.isObserving, "关闭清理结束后停止监听")
+    XCTAssertEqual(controller.systemProxyState, .idle)
+  }
+
+  /// 无效活动目标：清除目标且不悄悄回退；agent 继续以空服务器
+  /// 列表监听；目标失效不清理系统设置，意图保持待应用。
+  func testInvalidTargetOnCommitKeepsListeningAndHoldsSystemProxyIntent() async throws {
+    let seeded = try makeSeededCatalog()
+    try Data("\(ProcessInfo.processInfo.processIdentifier)".utf8).write(to: runtime.pidFile)
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    XCTAssertEqual(controller.systemProxyState, .applied)
+
+    // 删除活动目标 → 重展开失败 → 清除目标，agent 继续监听。
+    var catalog = try makeTestCatalogStore(fileURL: catalogFileURL).load().catalog
+    try catalog.remove(seeded.server)
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+
+    let committed = try makeTestCatalogStore(fileURL: catalogFileURL).load().catalog
+    _ = await controller.catalogDidCommit(snapshot: committed)
+
+    XCTAssertNil(controller.activeTargetID)
+    XCTAssertNotNil(controller.lastActivationFailure, "点名原因独立呈现")
+    XCTAssertEqual(controller.state, .running, "agent 保持监听")
+    XCTAssertEqual(agent.unregisterCount, 0, "不注销 agent")
+    let onDisk = try XCTUnwrap(RuntimeFileStore(fileURL: runtime.contract).loadDocument())
+    XCTAssertTrue(onDisk.servers.isEmpty, "运行时以空服务器列表继续监听")
+    XCTAssertEqual(systemProxy.clearCount, 1, "目标失效清除不可用入口")
+    XCTAssertEqual(controller.systemProxyState, .paused, "清除成功后暂停并保留意图")
+  }
+  func testResyncWithInvalidActiveTargetClearsAndKeepsListening() async throws {
+    _ = try makeSeededCatalog()
+    try Data("garbage".utf8).write(to: runtime.contract)
+    let missingTarget = NodeID(rawValue: "removed-target")
+    try ActivationStateFileStore(fileURL: activationFileURL).save(activeTargetID: missingTarget)
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(), agentStatus: .registered)
+
+    await controller.resyncOnLaunch()
+
+    XCTAssertEqual(controller.state, .running, "目标失效后 agent 继续监听")
+    XCTAssertNil(controller.activeTargetID)
+    let persisted = try ActivationStateFileStore(fileURL: activationFileURL).loadActiveTargetID()
+    XCTAssertNil(persisted, "失效目标已清除")
+    let onDisk = try XCTUnwrap(RuntimeFileStore(fileURL: runtime.contract).loadDocument())
+    XCTAssertTrue(onDisk.servers.isEmpty, "以空服务器列表继续监听")
+    XCTAssertNotNil(controller.lastActivationFailure)
+    XCTAssertTrue(systemProxy.applied.isEmpty, "系统代理意图关闭，不写系统设置")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests.swift
new file mode 100644
index 000000000..7347978e9
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/ProxyRuntimeControllerTests.swift
@@ -0,0 +1,338 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 代理运行时控制器：以替身注入 LaunchAgent 与端点探测，验证
+/// agent 开关与系统代理开关的独立语义、目录重展开消费与 GUI 重同步重合（不
+/// 触真实 SMAppService/launchd/SystemConfiguration）。
+@MainActor
+class ProxyRuntimeControllerTests: XCTestCase {
+  var controlPreferences: ProxyControlPreferences!
+  var runtime: ProxyRuntimeFixture.TemporaryRuntime!
+  var catalogFileURL: URL!
+  var activationFileURL: URL!
+  var agent: ProxyRuntimeFixture.FakeLaunchAgent!
+  var systemProxy: ProxyRuntimeFixture.FakeSystemProxy!
+  var systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService!
+  var systemProxyNetworkChangeMonitor: ProxyRuntimeFixture.FakeSystemProxyNetworkChangeMonitor!
+  var signals: SignalRecorder!
+
+  /// SIGUSR1 投递记录缝。
+  final class SignalRecorder: @unchecked Sendable {
+    private let lock = NSLock()
+    private(set) var records: [(pid: Int32, signal: Int32)] = []
+    /// SIGUSR1 送达后模拟 wrapper 热重载刷新回执。
+    var reloadReceipt: (() -> Void)?
+    /// wrapper 进程存活位：生产中注销 LaunchAgent 后 wrapper 随 launchd 停止
+    /// 消亡，pid 文件留存至 deleteRuntimeFiles、死亡靠 kill(_, 0) 探测；
+    /// 重注册即拉起新进程。不置死则停止协议会空等退出超时上限。
+    private var wrapperAlive = true
+
+    var signalsSent: [(pid: Int32, signal: Int32)] {
+      lock.lock()
+      defer { lock.unlock() }
+      return records
+    }
+
+    func record(_ pid: Int32, _ signal: Int32) {
+      lock.lock()
+      records.append((pid, signal))
+      lock.unlock()
+    }
+
+    /// 注销 LaunchAgent：对应 wrapper 进程消亡。
+    func terminateWrapper() {
+      lock.lock()
+      wrapperAlive = false
+      lock.unlock()
+    }
+
+    /// 重新注册：拉起新 wrapper 进程。
+    func relaunchWrapper() {
+      lock.lock()
+      wrapperAlive = true
+      lock.unlock()
+    }
+
+    func send(_ pid: Int32, _ signal: Int32) -> Int32 {
+      record(pid, signal)
+      if signal == SIGUSR1 {
+        reloadReceipt?()
+      }
+      // kill(_, 0) 判活语义：只对夹具约定的存活 pid（42 与本测试进程）报告
+      // 在跑；陈旧残留 pid 返回 ESRCH，停止协议才不必空等退出超时上限。
+      if signal == 0 {
+        lock.lock()
+        let alive = wrapperAlive
+        lock.unlock()
+        return (pid == 42 && alive) || pid == ProcessInfo.processInfo.processIdentifier
+          ? 0 : Int32(ESRCH)
+      }
+      return 0
+    }
+  }
+
+  override func setUp() async throws {
+    try await super.setUp()
+    controlPreferences = makeTestProxyControlPreferences()
+    runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    catalogFileURL = runtime.directory.appendingPathComponent("catalog.json")
+    activationFileURL = runtime.directory.appendingPathComponent("activation.json")
+
+    agent = ProxyRuntimeFixture.FakeLaunchAgent()
+    systemProxy = ProxyRuntimeFixture.FakeSystemProxy()
+    systemProxyHelper = ProxyRuntimeFixture.FakeSystemProxyHelperService()
+    systemProxyNetworkChangeMonitor = ProxyRuntimeFixture.FakeSystemProxyNetworkChangeMonitor()
+    signals = SignalRecorder()
+    // 注销即 wrapper 消亡：停止协议的退出等待据 kill(_, 0) 放行，不空等超时。
+    agent.onUnregister = { [weak self] in self?.signals?.terminateWrapper() }
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: runtime.directory)
+    try await super.tearDown()
+  }
+
+  /// 建一个含单台服务器的目录并落盘（服务器密码进内存凭据存储）。
+  func makeSeededCatalog() throws -> (catalog: ConfigurationCatalog, server: NodeID) {
+    var catalog = ConfigurationCatalog()
+    let server = try ActivationFixture.addPlainServer(
+      "香港 01", in: &catalog)
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+    return (catalog, server)
+  }
+
+  /// Subclasses can choose small rule inputs without changing packaged-data suites.
+  func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(bundle: AppArtifact.bundle)
+  }
+
+  func makeController(
+    probe: EndpointProbing,
+    agentStatus: LaunchAgentStatus = .notRegistered,
+    listen: ProxyListeningConfiguration = ActivationFixture.listen,
+    listeningStore: ProxyListeningStoring? = nil,
+    settings: ProxyRuntimeSettings? = nil,
+    settingsRestore: RestoredProxyRuntimeSettings? = nil,
+    proxyMode: ProxyMode? = .rule,
+    systemProxy: SystemProxyControlling? = nil,
+    networkChangeMonitor: SystemProxyNetworkChangeMonitoring? = nil,
+    firewallChecker: FirewallStatusChecking = ProxyRuntimeFixture.FakeFirewallChecker(),
+    firewallExecutableURLs: [URL] = [URL(fileURLWithPath: "/bundle/Helpers/sslocal")],
+    firewallPollIntervalNanoseconds: UInt64 = 1_000_000,
+    // 生产默认 30 秒健康窗；FakeProbe 结果确定，短窗口走同一超时呈现路径。
+    launchHealthTimeoutSeconds: TimeInterval = 0.05,
+    launchHealthRetryDelay: @escaping () async throws -> Void = {
+      try await Task.sleep(for: .milliseconds(200))
+    },
+    ruleApplicationDelay: @escaping () async throws -> Void = {
+      try await Task.sleep(for: .milliseconds(150))
+    },
+    // 漂移重注的注销-重注间隔与用例无关，缩短保持套件快速。
+    helperRefreshDelayNanoseconds: UInt64 = 10_000_000,
+    processIsAlive: @escaping @Sendable (Int32) -> Bool = { $0 == 42 },
+    customRuleStore: CustomRuleStore? = nil,
+    ruleSnapshots: BuiltinRuleSnapshots? = nil
+  ) -> ProxyRuntimeController {
+    agent.setStatus(agentStatus)
+    let runtimeFileStore = RuntimeFileStore(fileURL: runtime.contract)
+    agent.onRegister = { [runtimeFileStore, signals] in
+      // 重注册＝拉起新 wrapper 进程（注销时已随 LaunchAgent 置死）。
+      signals?.relaunchWrapper()
+      try? runtimeFileStore.writePublishedRuntimeReceipt(processID: 42)
+    }
+    // SIGUSR1 模拟 wrapper 热重载后刷新回执（真实 wrapper 会如此）。
+    signals.reloadReceipt = { [runtimeFileStore] in
+      try? runtimeFileStore.writePublishedRuntimeReceipt(processID: 42)
+    }
+    let restored =
+      settingsRestore
+      ?? RestoredProxyRuntimeSettings(
+        // 控制器行为用例默认「用户已打开 Agent」；出厂默认 off 由 ProxyRuntimeSettingsTests 锁定。
+        settings: settings ?? ProxyRuntimeSettings(listen: listen, agentEnabled: true),
+        unreadableError: nil)
+    // Fixture snapshots represent previously saved intent, matching production bootstrap.
+    controlPreferences.preferredMode = restored.settings.preferredMode
+    controlPreferences.rulePreset = restored.settings.rulePreset
+    controlPreferences.agentEnabled = restored.settings.agentEnabled
+    controlPreferences.systemProxyEnabled = restored.settings.systemProxyEnabled
+    controlPreferences.proxyExceptions = restored.settings.proxyExceptions
+    return ProxyRuntimeController(
+      controlPreferences: controlPreferences,
+      catalogSnapshotReader: ProxyRuntimeFixture.catalogSnapshotReader(at: catalogFileURL),
+      activationFileStore: ActivationStateFileStore(fileURL: activationFileURL),
+      runtimeFileStore: runtimeFileStore,
+      plugins: ActivationFixture.plugins,
+      listeningStore: listeningStore ?? InMemoryProxyListeningStore(),
+      customRuleStore: customRuleStore
+        ?? CustomRuleStore(fileURL: runtime.directory.appendingPathComponent("custom-rules.json")),
+      appBundle: AppArtifact.bundle,
+      ruleSnapshots: ruleSnapshots ?? makeDefaultRuleSnapshots(),
+      settingsRestore: restored,
+      agent: agent,
+      probe: probe,
+      systemProxy: systemProxy ?? self.systemProxy,
+      systemProxyHelper: systemProxyHelper ?? self.systemProxyHelper,
+      systemProxyNetworkChangeMonitor: networkChangeMonitor ?? systemProxyNetworkChangeMonitor,
+      proxyMode: proxyMode,
+      firewallChecker: firewallChecker,
+      firewallExecutableURLs: firewallExecutableURLs,
+      firewallPollIntervalNanoseconds: firewallPollIntervalNanoseconds,
+      launchHealthTimeoutSeconds: launchHealthTimeoutSeconds,
+      launchHealthRetryDelay: launchHealthRetryDelay,
+      ruleApplicationDelay: ruleApplicationDelay,
+      helperRefreshDelayNanoseconds: helperRefreshDelayNanoseconds,
+      sendSignal: { [signals] pid, number in signals!.send(pid, number) },
+      processIsAlive: processIsAlive)
+  }
+
+}
+
+/// Concrete suite; the shared fixture must not contain inherited test methods.
+final class ProxyRuntimeControllerCoreTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  // MARK: Agent 开关与首次默认
+
+  func testActivateWhileAgentOffPublishesActiveTargetIDWithoutDeploying() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(listen: ActivationFixture.listen, agentEnabled: false))
+    var observed: NodeID?
+    let cancellable = controller.factChanges.changes.sink { @MainActor _ in
+      observed = controller.activeTargetID
+    }
+    defer { cancellable.cancel() }
+
+    try await controller.activate(seeded.server)
+    // 事实通道在主队列轮末冲洗：让排队的冲洗先于断言运行。
+    await Task.yield()
+
+    XCTAssertEqual(controller.activeTargetID, seeded.server)
+    XCTAssertEqual(observed, seeded.server, "agent 关闭路径的激活也要发布目标变更")
+    XCTAssertEqual(controller.state, .off, "agent 意图关闭时仅选择目标，不部署")
+    XCTAssertEqual(agent.registerCount, 0)
+  }
+
+  func testActivateThenEnableWritesContractRegistersAndReachesRunning() async throws {
+    let seeded = try makeSeededCatalog()
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let controller = makeController(probe: probe)
+
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertEqual(agent.registerCount, 1)
+    let persisted = try ActivationStateFileStore(fileURL: activationFileURL).loadActiveTargetID()
+    XCTAssertEqual(persisted, seeded.server, "活动目标已持久化")
+    let onDisk = try XCTUnwrap(
+      RuntimeFileStore(fileURL: runtime.contract).loadDocument())
+    XCTAssertEqual(onDisk.servers.count, 1)
+    XCTAssertEqual(onDisk.socksPort, ActivationFixture.listen.socksPort)
+    XCTAssertEqual(onDisk.servers.first?.password, "pw-香港 01", "凭据已解析进文档")
+    XCTAssertTrue(
+      systemProxy.applied.isEmpty, "系统代理意图默认关闭：agent 运行也不写系统设置")
+    XCTAssertEqual(probe.ports, [11086, 11087], "健康门先探测 SOCKS 和 HTTP 入站")
+  }
+
+  func testEffectiveRuntimeListenerProcessIDRequiresCurrentLiveReceipt() throws {
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(), processIsAlive: { $0 == 42 })
+    let document = SslocalRuntimeDocument(servers: [], listen: ActivationFixture.listen)
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    try runtimeStore.write(document)
+    try runtimeStore.writeRuntimeReceipt(for: document, processID: 42)
+    controller.runtimeObservation = RuntimeDeploymentFacts(document)
+    controller.state = .running
+
+    XCTAssertEqual(controller.effectiveRuntimeListenerProcessID, 42)
+
+    let staleReceipt = RuntimeDeploymentReceipt(processID: 42, deploymentID: UUID().uuidString)
+    try AtomicFileWriter.write(
+      JSONEncoder().encode(staleReceipt), to: runtimeStore.runtimeStatusFileURL)
+    XCTAssertNil(controller.effectiveRuntimeListenerProcessID, "回执必须匹配当前运行契约")
+
+    try runtimeStore.writeRuntimeReceipt(for: document, processID: 42)
+    controller.state = .off
+    XCTAssertNil(controller.effectiveRuntimeListenerProcessID, "已停止 runtime 不得拥有监听器")
+  }
+
+  func testSwitchingGlobalAndRuleModesIsImmediateAndRestoresOnAgentOff() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen,
+        preferredMode: .global,
+        agentEnabled: true,
+        systemProxyEnabled: true),
+      proxyMode: .global)
+
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+    XCTAssertEqual(
+      systemProxy.applied,
+      [
+        SystemProxyConfiguration(
+          socks: .init(host: "127.0.0.1", port: 11086),
+          http: .init(host: "127.0.0.1", port: 11087),
+          https: .init(host: "127.0.0.1", port: 11087),
+          exceptions: FixedLocalProxyRanges.systemProxyExceptions(
+            including: ProxyRuntimeSettings().proxyExceptionList))
+      ])
+
+    await controller.setProxyMode(.rule)
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertEqual(systemProxy.applied.count, 2)
+    XCTAssertEqual(
+      systemProxy.applied.last,
+      SystemProxyConfiguration(
+        socks: .init(host: "127.0.0.1", port: 11086),
+        http: .init(host: "127.0.0.1", port: 11087),
+        https: .init(host: "127.0.0.1", port: 11087),
+        exceptions: FixedLocalProxyRanges.systemProxyExceptions(
+          including: ProxyRuntimeSettings().proxyExceptionList)))
+
+    await controller.setAgentEnabled(false)
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertEqual(systemProxy.clearCount, 1, "关闭 agent 清除已应用的系统代理")
+  }
+
+  func testEnableWhenProbeNeverSucceedsPresentsFailureNamingEndpointAndPort() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(
+      probe: ProxyRuntimeFixture.FakeProbe.refusing(), agentStatus: .notRegistered)
+
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    guard case .launchFailed(.localEndpoint(_, _, let port, let cause)) = controller.state else {
+      XCTFail("应呈现启动失败，实际 \(controller.state)")
+      return
+    }
+    XCTAssertEqual(port, 11086)
+    XCTAssertEqual(cause, .refused)
+    XCTAssertTrue(systemProxy.applied.isEmpty, "端点不健康时不得写系统代理")
+    XCTAssertEqual(controller.systemProxyState, .idle, "系统代理意图默认关闭")
+  }
+
+  func testDisableAgentUnregistersAndCleansRuntimeFiles() async throws {
+    let seeded = try makeSeededCatalog()
+    let controller = makeController(probe: ProxyRuntimeFixture.FakeProbe.reachable())
+    try await controller.activate(seeded.server)
+    await controller.setAgentEnabled(true)
+
+    await controller.setAgentEnabled(false)
+
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertEqual(agent.unregisterCount, 1)
+    XCTAssertFalse(FileManager.default.fileExists(atPath: runtime.contract.path), "显式停止后清理契约")
+    XCTAssertFalse(FileManager.default.fileExists(atPath: runtime.pidFile.path))
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/ProxyRuntime/RuntimeConvergenceTests.swift b/ShadowsocksX-NG2/Tests/ProxyRuntime/RuntimeConvergenceTests.swift
new file mode 100644
index 000000000..dbcce6138
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/ProxyRuntime/RuntimeConvergenceTests.swift
@@ -0,0 +1,246 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 通过模式命令验证配置派生失败和无 ACL 变化路径，不调用恢复实现。
+@MainActor
+struct RuntimeConvergenceTests {
+  @Test(arguments: [false, true])
+  func modeAndRuleChangesUseLatestCommittedCatalog(savedRules: Bool) async throws {
+    let fixture = try Fixture(systemProxyEnabled: false)
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.server)
+    if savedRules { await fixture.controller.setProxyMode(.rule) }
+    var catalog = fixture.catalogReader.catalogSnapshot
+    var fields = ActivationFixture.plainFields(remark: "更新资料", password: "updated-password")
+    fields.address = "198.51.100.9"
+    try catalog.updateServer(fixture.server, with: fields)
+    try makeTestCatalogStore(
+      fileURL: fixture.runtime.directory.appendingPathComponent("catalog.json")
+    )
+    .save(CatalogDocument(catalog: catalog))
+    fixture.catalogReader.catalogSnapshot = catalog
+
+    if savedRules {
+      await fixture.controller.convergeRuntime(.savedRules)
+    } else {
+      await fixture.controller.setProxyMode(.direct)
+    }
+
+    let output = try #require(fixture.runtimeStore.loadDocument())
+    #expect(output.servers.first?.server == "198.51.100.9")
+    #expect(output.servers.first?.password == "updated-password")
+    #expect(fixture.controller.state == .running)
+  }
+
+  @Test func modeDerivationFailurePreservesNewIntentAndPublishedFiles() async throws {
+    let fixture = try Fixture(
+      systemProxyEnabled: true,
+      snapshots: BuiltinRuleSnapshots(loader: { _ in throw RuleSnapshotError.missing }))
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.server)
+    let previous = try #require(fixture.runtimeStore.loadDocument())
+    let appliedCount = fixture.proxy.applied.count
+
+    await fixture.controller.setProxyMode(.rule)
+
+    #expect(fixture.controller.proxyMode == .rule)
+    #expect(fixture.controller.settings.preferredMode == .rule)
+    #expect(fixture.runtimeStore.loadDocument() == previous)
+    #expect(
+      fixture.controller.state
+        == .serviceFailed(.runtimeFile))
+    #expect(fixture.controller.controlPreferences.preferredMode == .rule)
+    #expect(fixture.controller.systemProxyState == .applied)
+    #expect(fixture.proxy.applied.count == appliedCount)
+    #expect(fixture.proxy.clearCount == 0)
+  }
+
+  @Test func publishedFailureSurvivesGUIReconstructionAndExplicitRetryWorks() async throws {
+    let fixture = try Fixture(systemProxyEnabled: true)
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.server)
+    fixture.probe.setOutcomes([.refused(detail: "test failure")])
+    await fixture.controller.setProxyMode(.direct)
+    #expect(fixture.controller.proxyMode == .direct)
+    #expect(fixture.controller.settings.agentEnabled)
+    #expect(fixture.controller.settings.systemProxyEnabled)
+    #expect(!fixture.controller.state.isOn)
+    #expect(fixture.proxy.clearCount > 0)
+    let failure = try #require(fixture.runtimeStore.readFailure())
+    let requested = try #require(fixture.runtimeStore.loadDocument())
+    #expect(requested.aclRuntime?.summary == "direct")
+    let registerCount = fixture.agent.registerCount
+    fixture.probe.setOutcomes([.reachable])
+    await fixture.controller.resyncOnLaunch()
+    #expect(fixture.agent.registerCount == registerCount)
+    #expect(fixture.runtimeStore.readFailure() == failure)
+    // 文件存取对象重建后仍使用磁盘失败身份，而非控制器中的瞬时状态。
+    let reopened = RuntimeFileStore(fileURL: fixture.runtimeStore.fileURL)
+    #expect(reopened.readFailure()?.deploymentID == reopened.receiptIdentity(for: requested))
+    await fixture.controller.setAgentEnabled(true)
+    #expect(fixture.controller.state == .running)
+    #expect(fixture.runtimeStore.readFailure() == nil)
+    #expect(fixture.agent.registerCount > registerCount)
+  }
+
+  @Test(arguments: ["configuration", "acl", "intent"])
+  func missingResourcesCannotTurnGUIRestartIntoRetry(resource: String) async throws {
+    let fixture = try Fixture(systemProxyEnabled: true)
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.server)
+    fixture.probe.setOutcomes([.refused(detail: "failure")])
+    await fixture.controller.setProxyMode(.direct)
+    let snapshot = try #require(
+      RuntimePublication.load(at: fixture.runtimeStore.supervisionFileURL))
+    let name =
+      resource == "configuration"
+      ? snapshot.configuration
+      : resource == "intent" ? snapshot.intentMetadata : try #require(snapshot.acl?.file)
+    try FileManager.default.removeItem(at: fixture.runtime.directory.appendingPathComponent(name))
+    let count = fixture.agent.registerCount
+    let restarted = fixture.reopeningController()
+    defer {
+      restarted.systemProxyObserver.systemProxyHealthTask?.cancel()
+      restarted.cancelFirewallObservation()
+    }
+    fixture.probe.setOutcomes([.reachable])
+    await restarted.resyncOnLaunch()
+    #expect(fixture.agent.registerCount == count)
+    #expect(restarted.state == .serviceFailed(.agent))
+    #expect(fixture.runtimeStore.readFailure()?.deploymentID == snapshot.deploymentID)
+    await restarted.setAgentEnabled(true)
+    #expect(restarted.state == .running)
+    #expect(fixture.agent.registerCount > count)
+  }
+
+  @Test(arguments: [false, true], RulePreset.allCases)
+  func unchangedModeACLDoesNotReprobeHealthyListeners(
+    systemProxyEnabled: Bool, preset: RulePreset
+  ) async throws {
+    let fixture = try Fixture(systemProxyEnabled: systemProxyEnabled)
+    defer { fixture.cleanUp() }
+    try await fixture.controller.activate(fixture.server)
+    try Data("42".utf8).write(to: fixture.runtime.pidFile)
+    let bytes = try Data(contentsOf: fixture.runtimeStore.fileURL)
+    let registers = fixture.agent.registerCount
+    let unregisters = fixture.agent.unregisterCount
+    let probes = fixture.probe.ports.count
+    let signals = fixture.signals.signalsSent.filter { $0.signal != 0 }.count
+
+    // 全局模式仍保存规则预设，但它不改变全局 ACL。
+    await fixture.controller.setRulePreset(preset)
+    let generation = fixture.controller.modeChangeGeneration
+    await fixture.controller.setRulePreset(preset)
+
+    #expect(fixture.controller.rulePreset == preset)
+    #expect(fixture.controller.modeChangeGeneration == generation)
+    if preset != .gfwlist {
+      #expect(fixture.controller.controlPreferences.rulePreset == preset)
+    }
+    #expect(fixture.controller.proxyMode == .global)
+    #expect(fixture.controller.state == .running)
+    #expect(try Data(contentsOf: fixture.runtimeStore.fileURL) == bytes)
+    #expect(fixture.agent.registerCount == registers)
+    #expect(fixture.agent.unregisterCount == unregisters)
+    #expect(fixture.signals.signalsSent.filter { $0.signal != 0 }.count == signals)
+    #expect(fixture.probe.ports.count == probes)
+  }
+
+  @MainActor
+  private final class CatalogReader: RuntimeCatalogSnapshotReading {
+    var catalogSnapshot: ConfigurationCatalog
+    init(_ catalog: ConfigurationCatalog) { catalogSnapshot = catalog }
+  }
+
+  @MainActor
+  private struct Fixture {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    let agent = ProxyRuntimeFixture.FakeLaunchAgent()
+    let probe = ProxyRuntimeFixture.FakeProbe.reachable()
+    let proxy = ProxyRuntimeFixture.FakeSystemProxy()
+    let settings = InMemoryProxyListeningStore()
+    let signals = ProxyRuntimeControllerTests.SignalRecorder()
+    let runtimeStore: RuntimeFileStore
+    let controller: ProxyRuntimeController
+    let server: NodeID
+    let catalogReader: CatalogReader
+
+    init(
+      systemProxyEnabled: Bool,
+      snapshots: BuiltinRuleSnapshots = BuiltinRuleSnapshots(
+        loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+    ) throws {
+      var catalog = ConfigurationCatalog()
+      server = try ActivationFixture.addPlainServer("收敛测试", in: &catalog)
+      let catalogURL = runtime.directory.appendingPathComponent("catalog.json")
+      try makeTestCatalogStore(fileURL: catalogURL).save(CatalogDocument(catalog: catalog))
+      catalogReader = CatalogReader(catalog)
+      runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+      let store = runtimeStore
+      let recorder = signals
+      agent.onUnregister = { recorder.terminateWrapper() }
+      agent.onRegister = {
+        recorder.relaunchWrapper()
+        try? store.writePublishedRuntimeReceipt(processID: 42)
+      }
+      recorder.reloadReceipt = {
+        try? store.writePublishedRuntimeReceipt(processID: 42)
+      }
+      controller = ProxyRuntimeController(
+        controlPreferences: makeTestProxyControlPreferences(),
+        catalogSnapshotReader: catalogReader,
+        activationFileStore: ActivationStateFileStore(
+          fileURL: runtime.directory.appendingPathComponent("activation.json")),
+        runtimeFileStore: runtimeStore,
+        plugins: ActivationFixture.plugins, listeningStore: settings,
+        customRuleStore: CustomRuleStore(
+          fileURL: runtime.directory.appendingPathComponent("rules.json")),
+        appBundle: AppArtifact.bundle, ruleSnapshots: snapshots,
+        settingsRestore: RestoredProxyRuntimeSettings(
+          settings: ProxyRuntimeSettings(
+            listen: ActivationFixture.listen, preferredMode: .global,
+            agentEnabled: true, systemProxyEnabled: systemProxyEnabled),
+          unreadableError: nil),
+        agent: agent, probe: probe, systemProxy: proxy,
+        systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService(),
+        proxyMode: .global, firewallChecker: ProxyRuntimeFixture.FakeFirewallChecker(),
+        launchHealthTimeoutSeconds: 0.05,
+        launchHealthRetryDelay: { await Task.yield() },
+        systemProxyHealthPollIntervalNanoseconds: 60_000_000_000,
+        helperRefreshDelayNanoseconds: 0,
+        sendSignal: { recorder.send($0, $1) },
+        processIsAlive: { recorder.send($0, 0) == 0 })
+    }
+
+    func reopeningController() -> ProxyRuntimeController {
+      ProxyRuntimeController(
+        controlPreferences: makeTestProxyControlPreferences(),
+        catalogSnapshotReader: controller.catalogSnapshotReader,
+        activationFileStore: controller.activationFileStore,
+        runtimeFileStore: runtimeStore,
+        plugins: ActivationFixture.plugins, listeningStore: settings,
+        customRuleStore: CustomRuleStore(
+          fileURL: runtime.directory.appendingPathComponent("rules.json")),
+        appBundle: AppArtifact.bundle,
+        ruleSnapshots: BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot),
+        settingsRestore: RestoredProxyRuntimeSettings(
+          settings: controller.settings, unreadableError: nil),
+        agent: agent, probe: probe, systemProxy: proxy,
+        systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService(),
+        firewallChecker: ProxyRuntimeFixture.FakeFirewallChecker(),
+        launchHealthTimeoutSeconds: 0.05, launchHealthRetryDelay: { await Task.yield() },
+        systemProxyHealthPollIntervalNanoseconds: 60_000_000_000,
+        helperRefreshDelayNanoseconds: 0,
+        sendSignal: { [signals] in signals.send($0, $1) },
+        processIsAlive: { [signals] in signals.send($0, 0) == 0 })
+    }
+
+    func cleanUp() {
+      controller.systemProxyObserver.systemProxyHealthTask?.cancel()
+      controller.cancelFirewallObservation()
+      try? FileManager.default.removeItem(at: runtime.directory)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/BuiltinRuleCatalogTests.swift b/ShadowsocksX-NG2/Tests/Rules/BuiltinRuleCatalogTests.swift
new file mode 100644
index 000000000..42463ae0f
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/BuiltinRuleCatalogTests.swift
@@ -0,0 +1,230 @@
+import Foundation
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 内置规则目录：bundle 快照加载与中国直连候选投影。
+final class BuiltinRuleCatalogTests: XCTestCase {
+  func testConcurrentConsumersShareOneSourceLoad() async throws {
+    let started = expectation(description: "source read")
+    let loader = SharedRuleSourceLoader(started: started)
+    defer { loader.release.release() }
+    let snapshots = BuiltinRuleSnapshots(loader: { try await loader.load($0) })
+    async let first = snapshots.load(.gfwlist)
+    await fulfillment(of: [started], timeout: 3)
+    async let second = snapshots.load(.gfwlist)
+    loader.release.release()
+    let (one, two) = try await (first, second)
+    XCTAssertEqual(one, two)
+    _ = try await snapshots.load(.gfwlist)
+    XCTAssertEqual(loader.count(.gfwlist), 1)
+  }
+
+  func testRetryReadsOnlyFailedSourcesAndSuccessNeverExpires() async throws {
+    let loader = SharedRuleSourceLoader()
+    let snapshots = BuiltinRuleSnapshots(loader: { try await loader.load($0) })
+    let first = await snapshots.browsingSources()
+    XCTAssertThrowsError(try first[.chinaIPv4]?.get())
+    _ = await snapshots.browsingSources()
+    XCTAssertEqual(loader.count(.chinaIPv4), 1, "Ordinary requests retain the failure")
+    let retried = await snapshots.browsingSources(retryFailures: true)
+    XCTAssertNoThrow(try retried[.chinaIPv4]?.get())
+    XCTAssertEqual(loader.count(.chinaIPv4), 2)
+    XCTAssertEqual(loader.count(.geolocationCN), 1)
+    XCTAssertEqual(loader.count(.gfwlist), 1)
+  }
+
+  @MainActor
+  func testFirstBrowsingRetainsRuntimeSourceFailureUntilExplicitRetry() async throws {
+    let loader = SharedRuleSourceLoader()
+    let snapshots = BuiltinRuleSnapshots(loader: { try await loader.load($0) })
+    do {
+      _ = try await snapshots.load(.chinaIPv4)
+      XCTFail("The first runtime source request should fail")
+    } catch {}
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect, loadCustom: { [] }, builtinSnapshots: snapshots)
+    await workflow.refresh()
+    XCTAssertFalse(workflow.snapshot.isComplete)
+    XCTAssertEqual(loader.count(.chinaIPv4), 1)
+    await workflow.refresh(retryFailedSources: true)
+    XCTAssertTrue(workflow.snapshot.isComplete)
+    XCTAssertEqual(loader.count(.chinaIPv4), 2)
+    XCTAssertEqual(loader.count(.geolocationCN), 1)
+    XCTAssertEqual(loader.count(.gfwlist), 0)
+  }
+
+  func testGeolocationCNSnapshotLoadsFromBundleOrSourceTree() throws {
+    // 优先 bundle（随 App 分发）；测试环境回退到源码树固定快照。
+    let snapshot: RuleSnapshot
+    do {
+      snapshot = try BuiltinRuleCatalog.loadGeolocationCN()
+    } catch {
+      let sourceURL = TestSourceTree.ng2Root()
+        .appendingPathComponent("Vendor/rules/geolocation-cn/snapshot.json")
+      snapshot = try RuleSnapshotStore(fileURL: sourceURL).load()
+    }
+
+    XCTAssertEqual(snapshot.metadata.source.kind, .geolocationCN)
+    XCTAssertEqual(
+      snapshot.metadata.converterVersion, RuleSnapshotStore.currentConverterVersion)
+    XCTAssertFalse(snapshot.metadata.license.isEmpty)
+    XCTAssertFalse(snapshot.metadata.attribution.isEmpty)
+    XCTAssertFalse(snapshot.metadata.inputDigest.isEmpty)
+    XCTAssertFalse(snapshot.metadata.upstreamReference.isEmpty)
+
+    let rules = BuiltinRuleCatalog.chinaDirectRules(from: snapshot)
+    XCTAssertFalse(rules.isEmpty)
+    XCTAssertTrue(rules.allSatisfy { $0.action == .direct })
+    XCTAssertTrue(
+      rules.contains { $0.match.pattern == .domainSuffix("cn") },
+      "快照应含 .cn 后缀直连规则")
+
+    // 转换期已删除被 .cn 吸收的域名条目。
+    let independentCN = rules.filter {
+      switch $0.match.pattern {
+      case .domainSuffix(let value): return value.hasSuffix(".cn") && value != "cn"
+      case .domainExact(let value): return value.hasSuffix(".cn")
+      default: return false
+      }
+    }
+    XCTAssertTrue(independentCN.isEmpty, "快照不保留被吸收的规则")
+  }
+
+  /// china-ipv4 快照：从 bundle 或源码树加载，直连候选为 IPv4 CIDR。
+  func testChinaIPv4SnapshotLoadsFromBundleOrSourceTree() throws {
+    let snapshot: RuleSnapshot
+    do {
+      snapshot = try BuiltinRuleCatalog.loadChinaIPv4()
+    } catch {
+      let sourceURL = TestSourceTree.ng2Root()
+        .appendingPathComponent("Vendor/rules/china-ipv4/snapshot.json")
+      snapshot = try RuleSnapshotStore(fileURL: sourceURL).load()
+    }
+
+    XCTAssertEqual(snapshot.metadata.source.kind, .chinaIPv4)
+    XCTAssertEqual(
+      snapshot.metadata.converterVersion, RuleSnapshotStore.currentConverterVersion)
+    XCTAssertFalse(snapshot.metadata.license.isEmpty)
+    XCTAssertFalse(snapshot.metadata.attribution.isEmpty)
+    XCTAssertFalse(snapshot.metadata.inputDigest.isEmpty)
+    XCTAssertFalse(snapshot.metadata.upstreamReference.isEmpty)
+
+    let rules = BuiltinRuleCatalog.chinaDirectRules(from: snapshot)
+    XCTAssertFalse(rules.isEmpty)
+    XCTAssertTrue(rules.allSatisfy { $0.action == .direct })
+    XCTAssertTrue(
+      rules.allSatisfy {
+        if case .ipv4CIDR = $0.match.pattern { return true }
+        return false
+      }, "china-ipv4 快照应只含 IPv4 CIDR 直连候选")
+  }
+
+  /// gfwlist 快照：从 bundle 或源码树加载，代理候选为域名后缀。
+  func testGFWListSnapshotLoadsFromBundleOrSourceTree() throws {
+    let snapshot: RuleSnapshot
+    do {
+      snapshot = try BuiltinRuleCatalog.loadGFWList()
+    } catch {
+      snapshot = try loadSourceTreeSnapshot(path: "Vendor/rules/gfwlist/snapshot.json")
+    }
+
+    XCTAssertEqual(snapshot.metadata.source.kind, .gfwlist)
+    XCTAssertEqual(
+      snapshot.metadata.converterVersion, RuleSnapshotStore.currentConverterVersion)
+    XCTAssertFalse(snapshot.metadata.license.isEmpty)
+    XCTAssertFalse(snapshot.metadata.attribution.isEmpty)
+    XCTAssertFalse(snapshot.metadata.inputDigest.isEmpty)
+    XCTAssertFalse(snapshot.metadata.upstreamReference.isEmpty)
+
+    let rules = BuiltinRuleCatalog.gfwlistRules(from: snapshot)
+    XCTAssertFalse(rules.isEmpty)
+    XCTAssertTrue(
+      rules.allSatisfy {
+        if case .domainSuffix = $0.match.pattern { return true }
+        return false
+      }, "gfwlist 快照候选应为域名后缀")
+
+    // 损失报告保留来源、摘要、许可证/归属与转换损失（含遮蔽例外）。
+    XCTAssertGreaterThan(snapshot.lossReport.absorbedCount, 0)
+    XCTAssertNil(snapshot.lossReport.skipped["shadowedException"])
+  }
+
+  /// 合并投影：域名 + CIDR 直连候选一起进入 ACL 编译输入。
+  func testChinaDirectRulesMergeDomainAndCIDRSnapshots() throws {
+    let geolocation = try loadSourceTreeSnapshot(path: "Vendor/rules/geolocation-cn/snapshot.json")
+    let chinaIPv4 = try loadSourceTreeSnapshot(path: "Vendor/rules/china-ipv4/snapshot.json")
+    let merged = BuiltinRuleCatalog.chinaDirectRules(from: [geolocation, chinaIPv4])
+
+    XCTAssertTrue(
+      merged.contains { rule in
+        if case .domainSuffix("cn") = rule.match.pattern { return true }
+        return false
+      }, "合并结果应含 .cn 域名直连候选")
+    XCTAssertTrue(
+      merged.contains { rule in
+        if case .ipv4CIDR = rule.match.pattern { return true }
+        return false
+      }, "合并结果应含 IPv4 CIDR 直连候选")
+    XCTAssertTrue(merged.allSatisfy { $0.action == .direct })
+  }
+
+  private func loadSourceTreeSnapshot(path: String) throws -> RuleSnapshot {
+    let sourceURL = TestSourceTree.ng2Root().appendingPathComponent(path)
+    return try RuleSnapshotStore(fileURL: sourceURL).load()
+  }
+
+  func testRuleDefaultActionLabelsAndFallback() throws {
+    XCTAssertEqual(RuleDefaultAction.proxyWhenUnmatched.label, "代理")
+    XCTAssertEqual(RuleDefaultAction.directWhenUnmatched.label, "直连")
+    XCTAssertEqual(RuleDefaultAction.proxyWhenUnmatched.fallbackAction, .proxy)
+    XCTAssertEqual(RuleDefaultAction.directWhenUnmatched.fallbackAction, .direct)
+    XCTAssertEqual(RuleDefaultAction.allCases, [.proxyWhenUnmatched, .directWhenUnmatched])
+  }
+
+}
+
+private final class SharedRuleSourceLoader: @unchecked Sendable {
+  private let lock = NSLock()
+  private var counts: [RulesSource: Int] = [:]
+  private let started: XCTestExpectation?
+  let release = TestAsyncGate("shared rule source release")
+  init(started: XCTestExpectation? = nil) { self.started = started }
+  func count(_ source: RulesSource) -> Int { lock.withLock { counts[source, default: 0] } }
+  func load(_ source: RulesSource) async throws -> RuleSnapshot {
+    let count = lock.withLock {
+      counts[source, default: 0] += 1
+      return counts[source, default: 0]
+    }
+    if let started {
+      started.fulfill()
+      _ = await release.wait()
+    } else if source == .chinaIPv4 && count == 1 {
+      throw RuleSnapshotError.missing
+    }
+    return rulesFixture(source)
+  }
+}
+
+@Test func builtinSnapshotsRejectNonBuiltinSources() async {
+  let snapshots = BuiltinRuleSnapshots(loader: { _ in rulesFixture(.custom) })
+  for source in [RulesSource.custom, .fixed] {
+    do {
+      _ = try await snapshots.load(source)
+      Issue.record("Non-builtin source must not load a snapshot")
+    } catch {
+      #expect(error as? RuleSnapshotError == .missing)
+    }
+  }
+}
+
+@Test func builtinSnapshotsRejectMismatchedMetadata() async {
+  let snapshots = BuiltinRuleSnapshots(loader: { _ in rulesFixture(.chinaIPv4) })
+  do {
+    _ = try await snapshots.load(.geolocationCN)
+    Issue.record("Mismatched source metadata must be rejected")
+  } catch {
+    #expect(error as? RuleSnapshotError == .corrupt(detail: "Unexpected rule source"))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleControllerTests.swift b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleControllerTests.swift
new file mode 100644
index 000000000..0a5f43950
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleControllerTests.swift
@@ -0,0 +1,240 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// Saved custom-rule intent and independent runtime application/recovery.
+extension ProxyRuntimeControllerTests {
+  func makeCustomRuleStore(preset: RulePreset = .chinaDirect) throws -> (
+    store: CustomRuleStore, directory: URL
+  ) {
+    let directory = runtime.directory.appendingPathComponent(
+      "custom-rules-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let store = CustomRuleStore(
+      preset: preset, baseURL: directory.appendingPathComponent("custom-rules.json"))
+    return (store, directory)
+  }
+
+  func makeControllerWithCustomRules(
+    store: CustomRuleStore,
+    probe: EndpointProbing = ProxyRuntimeFixture.FakeProbe.reachable(),
+    settings: ProxyRuntimeSettings? = nil,
+    proxyMode: ProxyMode? = nil,
+    launchHealthTimeoutSeconds: TimeInterval = 0.05,
+    launchHealthRetryDelay: @escaping () async throws -> Void = {
+      try await Task.sleep(for: .milliseconds(200))
+    },
+    ruleApplicationDelay: @escaping () async throws -> Void = {
+      try await Task.sleep(for: .milliseconds(150))
+    },
+    ruleSnapshots: BuiltinRuleSnapshots? = nil
+  ) -> ProxyRuntimeController {
+    makeController(
+      probe: probe,
+      listeningStore: InMemoryProxyListeningStore(),
+      settings: settings
+        ?? ProxyRuntimeSettings(
+          listen: ActivationFixture.listen, rulePreset: .chinaDirect, agentEnabled: true),
+      proxyMode: proxyMode,
+      launchHealthTimeoutSeconds: launchHealthTimeoutSeconds,
+      launchHealthRetryDelay: launchHealthRetryDelay,
+      ruleApplicationDelay: ruleApplicationDelay,
+      customRuleStore: store, ruleSnapshots: ruleSnapshots)
+  }
+
+  /// 从链接解析读取当前 ACL 变体内容（契约不再内嵌 content）。
+  func activeACLContent(_ store: RuntimeFileStore) throws -> String {
+    let data = try Data(contentsOf: store.aclFileURL)
+    return String(bytes: data, encoding: .utf8) ?? ""
+  }
+
+}
+
+final class CustomRuleControllerTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  /// 规则内容变化重编译 ACL 并按完整重启路径生效。
+  func testUpdateCustomRulesRecompilesACLAndRestarts() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let settings = ProxyRuntimeSettings(
+      listen: ActivationFixture.listen,
+      preferredMode: .rule,
+      rulePreset: .chinaDirect,
+      agentEnabled: true)
+    let controller = makeControllerWithCustomRules(
+      store: store, settings: settings, proxyMode: .rule)
+    try await controller.activate(seeded.server)
+    XCTAssertEqual(controller.state, .running)
+    XCTAssertEqual(controller.proxyMode, .rule)
+    let unregisterBefore = agent.unregisterCount
+
+    let rule = CustomRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "internal.example"))
+    let outcome = await controller.commitRuleDocument(CustomRuleDocument(rules: [rule])).outcome
+
+    XCTAssertEqual(outcome, .saved)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(try store.load(), [rule])
+    XCTAssertEqual(agent.unregisterCount, unregisterBefore + 1, "ACL 变化触发完整 agent 重启")
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let document = try XCTUnwrap(runtimeStore.loadDocument())
+    XCTAssertEqual(document.aclRuntime?.summary, "rule-proxy-default")
+    XCTAssertTrue(
+      try activeACLContent(runtimeStore).contains("||internal.example"),
+      "自定义直连规则应进入规则模式 ACL")
+  }
+
+  func testSchemeActionRulesPersistAndReorderingDoesNotRedeploy() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore(preset: .gfwlist)
+    let settings = ProxyRuntimeSettings(
+      listen: ActivationFixture.listen, preferredMode: .rule,
+      rulePreset: .gfwlist, agentEnabled: true)
+    let controller = makeControllerWithCustomRules(
+      store: store, settings: settings, proxyMode: .rule)
+    try await controller.activate(seeded.server)
+    let rules = [
+      CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "order.example")),
+      CustomRule(action: .proxy, match: try RuleMatch(domainExact: "a.order.example")),
+      CustomRule(action: .proxy, match: try RuleMatch(domainExact: "b.order.example")),
+    ]
+    let first = await controller.commitRuleDocument(CustomRuleDocument(rules: rules)).outcome
+    XCTAssertEqual(first, .saved)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(try store.load(), rules, "保存保留用户 UUID 和全部意图")
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let before = try activeACLContent(runtimeStore)
+    let unregisterBefore = agent.unregisterCount
+    let summary = controller.readCustomRuleSummary()
+    let reversed = Array(rules.reversed())
+    let reordered = await controller.commitRuleDocument(CustomRuleDocument(rules: reversed))
+      .outcome
+    XCTAssertEqual(reordered, .saved)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(try store.load(), reversed)
+    XCTAssertEqual(try activeACLContent(runtimeStore), before)
+    XCTAssertEqual(agent.unregisterCount, unregisterBefore)
+    XCTAssertEqual(controller.readCustomRuleSummary(), summary)
+  }
+
+  /// 校验拒绝：固定本地冲突整批不落地，旧规则保持不变。
+  func testUpdateCustomRulesRejectsFixedLocalConflictAndKeepsPreviousRules() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let existing = CustomRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "kept.example"))
+    try store.save([existing])
+    let settings = ProxyRuntimeSettings(
+      listen: ActivationFixture.listen,
+      preferredMode: .rule,
+      rulePreset: .chinaDirect,
+      agentEnabled: true)
+    let controller = makeControllerWithCustomRules(
+      store: store, settings: settings, proxyMode: .rule)
+    try await controller.activate(seeded.server)
+
+    let conflicting = CustomRule(
+      action: .proxy, match: try RuleMatch(ipv4CIDR: "127.0.0.0/8"))
+    let outcome = await controller.commitRuleDocument(
+      CustomRuleDocument(rules: [existing, conflicting])
+    ).outcome
+
+    guard case .rejected(let rejected) = outcome else {
+      return XCTFail("应拒绝固定本地冲突，实际 \(outcome)")
+    }
+    XCTAssertEqual(rejected.map(\.reason), [.conflictsWithFixedLocalScope])
+    XCTAssertFalse(rejected[0].explanation.isEmpty)
+    XCTAssertEqual(try store.load(), [existing], "拒绝时旧规则保持不变")
+  }
+
+  /// Failed application retains saved rules and the failed deployment.
+  func testFailedCustomRuleDeployKeepsSavedRulesAndStopsRuntime() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let existing = CustomRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "kept.example"))
+    try store.save([existing])
+    let settings = ProxyRuntimeSettings(
+      listen: ActivationFixture.listen,
+      preferredMode: .rule,
+      rulePreset: .chinaDirect,
+      agentEnabled: true,
+      systemProxyEnabled: true)
+    let controller = makeControllerWithCustomRules(
+      store: store, settings: settings, proxyMode: .rule, launchHealthTimeoutSeconds: 0.05)
+    try await controller.activate(seeded.server)
+    XCTAssertEqual(controller.state, .running)
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let previousDocument = try XCTUnwrap(runtimeStore.loadDocument())
+    let previousApplicationCount = systemProxy.applied.count
+
+    agent.onRegister = { [runtimeStore, previousDocument] in
+      try? runtimeStore.writeRuntimeReceipt(for: previousDocument, processID: 42)
+    }
+
+    let newRule = CustomRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "new-rule.example"))
+    let result = await controller.commitRuleDocument(CustomRuleDocument(rules: [newRule]))
+
+    XCTAssertEqual(result.outcome, .saved)
+    XCTAssertEqual(result.document, CustomRuleDocument(rules: [newRule]))
+    await controller.ruleApplicationTask?.value
+    XCTAssertNotNil(controller.runtimeFacts.failure)
+    XCTAssertEqual(try store.load(), [newRule], "部署失败保留已保存规则")
+    XCTAssertNotEqual(runtimeStore.loadDocument(), previousDocument)
+    XCTAssertNotNil(runtimeStore.readFailure())
+    XCTAssertFalse(controller.state.isOn)
+    XCTAssertTrue(controller.agentIntentEnabled)
+    XCTAssertTrue(controller.systemProxyIntentEnabled)
+    XCTAssertEqual(systemProxy.applied.count, previousApplicationCount)
+    XCTAssertGreaterThan(systemProxy.clearCount, 0)
+  }
+
+  /// 全局模式不加载自定义规则：保存成功但 ACL 不变、不触发重启。
+  func testGlobalModePersistsCustomRulesWithoutACLRestart() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let settings = ProxyRuntimeSettings(
+      listen: ActivationFixture.listen,
+      preferredMode: .global,
+      rulePreset: .chinaDirect,
+      agentEnabled: true)
+    let controller = makeControllerWithCustomRules(
+      store: store, settings: settings, proxyMode: .global)
+    try await controller.activate(seeded.server)
+    XCTAssertEqual(controller.proxyMode, .global)
+    let unregisterBefore = agent.unregisterCount
+
+    let rule = CustomRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "internal.example"))
+    let outcome = await controller.commitRuleDocument(CustomRuleDocument(rules: [rule])).outcome
+
+    XCTAssertEqual(outcome, .saved)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(try store.load(), [rule])
+    XCTAssertEqual(agent.unregisterCount, unregisterBefore, "全局模式 ACL 不含自定义规则，无需重启")
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let document = try XCTUnwrap(runtimeStore.loadDocument())
+    XCTAssertEqual(document.aclRuntime?.summary, "global")
+    XCTAssertFalse(try activeACLContent(runtimeStore).contains("internal.example"))
+  }
+
+  /// 诊断摘要只含数量与内容版本。
+  func testCustomRuleSummaryExposesCountAndVersionOnly() async throws {
+    let (store, _) = try makeCustomRuleStore()
+    try store.save([
+      CustomRule(action: .direct, match: try RuleMatch(domainSuffix: "secret.example"))
+    ])
+    let controller = makeControllerWithCustomRules(store: store)
+
+    let summary = try XCTUnwrap(controller.readCustomRuleSummary())
+
+    XCTAssertEqual(summary.count, 1)
+    XCTAssertEqual(summary.contentVersion.count, 12)
+    XCTAssertFalse(summary.contentVersion.contains("secret"))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleDeletionControllerTests.swift b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleDeletionControllerTests.swift
new file mode 100644
index 000000000..76e78219a
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleDeletionControllerTests.swift
@@ -0,0 +1,201 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class CustomRuleDeletionControllerTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: { source in
+      // Keep the covering rule used by the unchanged-ACL deletion scenario.
+      if source == .geolocationCN {
+        return rulesFixture(
+          source,
+          rules: [
+            ProxyRule(action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn"))
+          ])
+      }
+      return try ProxyRuntimeFixture.controlFlowRuleSnapshot(source)
+    })
+  }
+
+  func testDeletionWhileOffPersistsBatchAndDisabledOrphansWithoutStarting() async throws {
+    let (store, _) = try makeCustomRuleStore()
+    let rules = [
+      CustomRule(action: .direct, match: try RuleMatch(domainExact: "one.example")),
+      CustomRule(action: .direct, match: try RuleMatch(domainExact: "two.example")),
+    ]
+    let original = CustomRuleDocument(rules: rules, disabledIdentities: [rules[0].identity])
+    try store.saveDocument(original)
+    let controller = makeDeletionController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, rulePreset: .chinaDirect, agentEnabled: false))
+    let workflow = deletionWorkflow(controller)
+    await workflow.refresh()
+    workflow.select(Set(workflow.snapshot.rows.map(\.id)))
+    let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .saved)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(
+      try store.loadDocument(),
+      CustomRuleDocument(rules: [], disabledIdentities: original.disabledIdentities))
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertEqual(agent.registerCount, 0)
+    var query = workflow.snapshot.query
+    query.enabled = false
+    workflow.query(query)
+    let orphan = try XCTUnwrap(workflow.snapshot.rows.first { $0.identity == rules[0].identity })
+    XCTAssertFalse(orphan.hasCurrentSource)
+    await workflow.setEnabled(true, identities: [rules[0].identity])
+    XCTAssertFalse(workflow.snapshot.rows.contains { $0.identity == rules[0].identity })
+    XCTAssertTrue(try store.loadDocument().disabledIdentities.isEmpty)
+  }
+
+  func testBatchDeletionDeploysOnceAndInvalidatesAddressTest() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let rules = [
+      CustomRule(action: .direct, match: try RuleMatch(domainExact: "one-delete.example")),
+      CustomRule(action: .direct, match: try RuleMatch(domainExact: "two-delete.example")),
+    ]
+    try store.save(rules)
+    let controller = makeDeletionController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .rule,
+        rulePreset: .chinaDirect, agentEnabled: true), proxyMode: .rule)
+    try await controller.activate(seeded.server)
+    let workflow = deletionWorkflow(controller)
+    await workflow.refresh()
+    workflow.setTestTarget("one-delete.example")
+    await workflow.testAddress()
+    XCTAssertNotNil(workflow.snapshot.addressTest.result)
+    workflow.select(Set(workflow.snapshot.rows.filter { !$0.customIDs.isEmpty }.map(\.id)))
+    let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+    let registrations = agent.registerCount
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .saved)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(agent.registerCount, registrations + 1)
+    XCTAssertTrue(try store.load().isEmpty)
+    let content = try activeACLContent(RuntimeFileStore(fileURL: runtime.contract))
+    XCTAssertFalse(content.contains("one-delete.example"))
+    XCTAssertFalse(content.contains("two-delete.example"))
+    XCTAssertNil(workflow.snapshot.addressTest.result)
+    XCTAssertTrue(workflow.snapshot.selection.isEmpty)
+    XCTAssertEqual(workflow.snapshot.commitFeedback?.operation, .delete)
+  }
+
+  func testDeletionInNonRuleModesOnlySavesAndCoveredRuleDoesNotRestart() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let rule = CustomRule(action: .direct, match: try RuleMatch(domainExact: "covered.cn"))
+    for mode in [ProxyMode.global, .direct, .rule] {
+      try store.save([rule])
+      let controller = makeDeletionController(
+        store: store,
+        settings: ProxyRuntimeSettings(
+          listen: ActivationFixture.listen, preferredMode: mode.kind,
+          rulePreset: .chinaDirect, agentEnabled: true), proxyMode: mode)
+      try await controller.activate(seeded.server)
+      let workflow = deletionWorkflow(controller)
+      await workflow.refresh()
+      workflow.select(Set(workflow.snapshot.rows.filter { !$0.customIDs.isEmpty }.map(\.id)))
+      let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+      let registrations = agent.registerCount
+      await workflow.deleteCustomRules(confirmation)
+      XCTAssertEqual(workflow.snapshot.commitOutcome, .saved)
+      await controller.ruleApplicationTask?.value
+      XCTAssertEqual(agent.registerCount, registrations)
+      XCTAssertTrue(try store.load().isEmpty)
+      await controller.setAgentEnabled(false)
+    }
+  }
+
+  func testDeletionDeploymentFailureKeepsSavedDeletionAndStopsRuntime() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let rule = CustomRule(action: .direct, match: try RuleMatch(domainExact: "keep-one.example"))
+    let orphan = ProxyRule(action: .proxy, match: try RuleMatch(domainExact: "orphan.example"))
+    try store.saveDocument(CustomRuleDocument(rules: [rule], disabledIdentities: [orphan]))
+    let controller = makeDeletionController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .rule,
+        rulePreset: .chinaDirect, agentEnabled: true), proxyMode: .rule)
+    try await controller.activate(seeded.server)
+    let workflow = deletionWorkflow(controller)
+    await workflow.refresh()
+    workflow.select([.rule(rule.identity)])
+    let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let previousRuntime = try XCTUnwrap(runtimeStore.loadDocument())
+    agent.onRegister = {
+      try? runtimeStore.writeRuntimeReceipt(for: previousRuntime, processID: 42)
+    }
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .saved)
+    let saved = CustomRuleDocument(rules: [], disabledIdentities: [orphan])
+    XCTAssertEqual(try store.loadDocument(), saved)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(try store.loadDocument(), saved)
+    XCTAssertNotEqual(runtimeStore.loadDocument(), previousRuntime)
+    XCTAssertNotNil(runtimeStore.readFailure())
+    XCTAssertNotEqual(controller.state, .running)
+    XCTAssertNotNil(controller.runtimeFacts.failure)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .saved)
+    XCTAssertTrue(workflow.snapshot.rows.allSatisfy { $0.customIDs.isEmpty })
+    agent.onRegister = {
+      try? FileManager.default.removeItem(at: runtimeStore.runtimeStatusFileURL)
+    }
+    await controller.setAgentEnabled(true)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(try store.loadDocument(), saved)
+    XCTAssertNotEqual(controller.state, .running)
+  }
+
+  func testDeletionPersistenceFailureRetainsOwnedDocumentAndDoesNotStartRuntime() async throws {
+    let (store, directory) = try makeCustomRuleStore()
+    let rule = CustomRule(action: .direct, match: try RuleMatch(domainExact: "kept.example"))
+    let original = CustomRuleDocument(rules: [rule], disabledIdentities: [rule.identity])
+    try store.saveDocument(original)
+    let controller = makeDeletionController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, rulePreset: .chinaDirect, agentEnabled: false))
+    let workflow = deletionWorkflow(controller)
+    await workflow.refresh()
+    workflow.select(Set(workflow.snapshot.rows.map(\.id)))
+    let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+    let originalData = try Data(contentsOf: store.fileURL)
+    let backupDirectory = directory.appendingPathExtension("backup")
+    try FileManager.default.moveItem(at: directory, to: backupDirectory)
+    try Data("blocks parent directory".utf8).write(to: directory)
+    let backup = backupDirectory.appendingPathComponent(
+      store.fileURL.path.replacingOccurrences(of: directory.path + "/", with: ""))
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .persistenceFailed)
+    XCTAssertEqual(controller.ruleDocuments.current, original)
+    XCTAssertEqual(try Data(contentsOf: backup), originalData)
+    XCTAssertEqual(workflow.snapshot.version, confirmation.version)
+    XCTAssertEqual(workflow.deletableSelection, [rule.id])
+    XCTAssertEqual(agent.registerCount, 0)
+  }
+
+  private func makeDeletionController(
+    store: CustomRuleStore, settings: ProxyRuntimeSettings, proxyMode: ProxyMode? = nil
+  ) -> ProxyRuntimeController {
+    makeControllerWithCustomRules(
+      store: store, settings: settings, proxyMode: proxyMode,
+      launchHealthRetryDelay: { try await Task.sleep(for: .milliseconds(1)) },
+      ruleApplicationDelay: { await Task.yield() })
+  }
+
+  private func deletionWorkflow(_ controller: ProxyRuntimeController) -> RulesWorkflow {
+    RulesWorkflow(
+      preset: controller.rulePreset,
+      loadDocument: { try controller.ruleDocuments.load() },
+      commitDocument: { await controller.commitRuleDocument($0) },
+      builtinSnapshots: controller.ruleSnapshots)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleDeletionWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleDeletionWorkflowTests.swift
new file mode 100644
index 000000000..8a65a9c6c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleDeletionWorkflowTests.swift
@@ -0,0 +1,166 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class CustomRuleDeletionWorkflowTests: XCTestCase {
+  func testMixedSelectionDeletesOnlyCustomUUIDsAndPreservesDisablementAndBuiltinMembership()
+    async throws
+  {
+    let custom = CustomRule(
+      action: .proxy, match: try RuleMatch(domainSuffix: "merged.example"))
+    let other = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "other.example"))
+    let orphan = ProxyRule(action: .proxy, match: try RuleMatch(domainExact: "orphan.example"))
+    let builtin = ProxyRule(action: custom.action, match: custom.match)
+    var saved = CustomRuleDocument(
+      rules: [custom, other], disabledIdentities: [custom.identity, orphan])
+    var commits = 0
+    let workflow = RulesWorkflow(
+      preset: .gfwlist,
+      loadDocument: { saved },
+      commitDocument: {
+        commits += 1
+        saved = $0
+        return RuleDocumentCommit(outcome: .saved, document: saved)
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: {
+        rulesFixture($0, rules: $0 == .gfwlist ? [builtin] : [])
+      }))
+    await workflow.refresh()
+    workflow.select(Set(workflow.snapshot.rows.map(\.id)))
+    XCTAssertEqual(workflow.deletableSelection, [custom.id, other.id])
+    let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+    XCTAssertEqual(confirmation.customIDs, [custom.id, other.id])
+    XCTAssertEqual(commits, 0, "Preparing and discarding a confirmation has no side effects")
+    let oldVersion = workflow.snapshot.version
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .saved)
+    XCTAssertEqual(commits, 1)
+    XCTAssertTrue(saved.rules.isEmpty)
+    XCTAssertEqual(saved.disabledIdentities, [custom.identity, orphan])
+    workflow.query(RulesQuery(source: .gfwlist))
+    let merged = try XCTUnwrap(workflow.snapshot.rows.first { $0.identity == custom.identity })
+    XCTAssertEqual(merged.sources, [.gfwlist])
+    XCTAssertTrue(merged.customIDs.isEmpty)
+    XCTAssertFalse(merged.isEnabled)
+    XCTAssertNotEqual(workflow.snapshot.version, oldVersion)
+    XCTAssertFalse(workflow.snapshot.rows.contains { $0.identity == other.identity })
+    XCTAssertTrue(workflow.snapshot.selection.isSubset(of: Set(workflow.snapshot.rows.map(\.id))))
+    XCTAssertEqual(workflow.snapshot.commitFeedback?.changedCount, 2)
+  }
+}
+
+extension CustomRuleDeletionWorkflowTests {
+  func testFilteredSelectionCannotEnterConfirmationAndStaleConfirmationCannotExpand() async throws {
+    let first = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "first.example"))
+    let hidden = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "hidden.example"))
+    var commits = 0
+    var saved = CustomRuleDocument(rules: [first, hidden])
+    let workflow = RulesWorkflow(
+      loadDocument: { saved },
+      commitDocument: {
+        commits += 1
+        saved = $0
+        return RuleDocumentCommit(outcome: .saved, document: saved)
+      }, builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.select(Set(workflow.snapshot.rows.map(\.id)))
+    var query = workflow.snapshot.query
+    query.search = "first"
+    workflow.query(query)
+    let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+    XCTAssertEqual(confirmation.customIDs, [first.id])
+    query.search = ""
+    workflow.query(query)
+    workflow.select(Set(workflow.snapshot.rows.map(\.id)))
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .saved)
+    XCTAssertEqual(saved.rules.map(\.id), [hidden.id], "New selection cannot expand captured UUIDs")
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitFeedback?.outcome, .superseded)
+    XCTAssertEqual(commits, 1)
+    workflow.select([])
+    XCTAssertNil(workflow.prepareCustomRuleDeletion())
+  }
+
+  func testVersionChangeRejectsDeletionEvenWhenTheCustomUUIDStillExists() async throws {
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "kept.example"))
+    var commits = 0
+    let workflow = RulesWorkflow(
+      loadDocument: { CustomRuleDocument(rules: [rule]) },
+      commitDocument: {
+        commits += 1
+        return RuleDocumentCommit(outcome: .saved, document: $0)
+      }, builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.select(Set(workflow.snapshot.rows.map(\.id)))
+    let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+    await workflow.setEnabled(false, identities: [rule.identity])
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitFeedback?.outcome, .superseded)
+    XCTAssertEqual(commits, 1)
+    XCTAssertEqual(workflow.deletableSelection, [rule.id])
+  }
+
+  func testPendingDeletionBlocksRepeatsAndPersistenceFailureKeepsConfirmationRetryable()
+    async throws
+  {
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "kept.example"))
+    let original = CustomRuleDocument(rules: [rule])
+    let started = expectation(description: "delete awaiting commit")
+    var continuation: CheckedContinuation<Void, Never>?
+    var commits = 0
+    let workflow = RulesWorkflow(
+      loadDocument: { original },
+      commitDocument: { _ in
+        commits += 1
+        await withCheckedContinuation {
+          continuation = $0
+          started.fulfill()
+        }
+        return RuleDocumentCommit(outcome: .persistenceFailed, document: original)
+      }, builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.select(Set(workflow.snapshot.rows.map(\.id)))
+    let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+    let pending = Task { await workflow.deleteCustomRules(confirmation) }
+    await fulfillment(of: [started], timeout: 3)
+    XCTAssertNil(workflow.prepareCustomRuleDeletion())
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitFeedback?.outcome, .busy)
+    continuation?.resume()
+    await pending.value
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .persistenceFailed)
+    XCTAssertEqual(commits, 1)
+    XCTAssertEqual(workflow.snapshot.version, confirmation.version)
+    XCTAssertEqual(workflow.prepareCustomRuleDeletion(), confirmation)
+  }
+
+  func testIncompleteCollectionRejectsDeletionFromPreviouslyLoadedFacts() async throws {
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "kept.example"))
+    let loadState = DocumentLoadState()
+    var commits = 0
+    let workflow = RulesWorkflow(
+      loadDocument: {
+        if loadState.shouldFail { throw CustomRuleStoreError.corrupt(detail: "fixture") }
+        return CustomRuleDocument(rules: [rule])
+      },
+      commitDocument: {
+        commits += 1
+        return RuleDocumentCommit(outcome: .saved, document: $0)
+      }, builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.select(Set(workflow.snapshot.rows.map(\.id)))
+    let confirmation = try XCTUnwrap(workflow.prepareCustomRuleDeletion())
+    loadState.shouldFail = true
+    await workflow.refresh()
+    XCTAssertNil(workflow.prepareCustomRuleDeletion())
+    await workflow.deleteCustomRules(confirmation)
+    XCTAssertEqual(workflow.snapshot.commitFeedback?.outcome, .superseded)
+    XCTAssertEqual(commits, 0)
+  }
+  @MainActor
+  private final class DocumentLoadState {
+    var shouldFail = false
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleEditingControllerTests.swift b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleEditingControllerTests.swift
new file mode 100644
index 000000000..da4391e92
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleEditingControllerTests.swift
@@ -0,0 +1,110 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// Verify the editor's public commands against the production commit adapter,
+/// using the existing hostless runtime and system-proxy fixtures.
+final class CustomRuleEditingControllerTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  func testEditorSaveWhileOffPersistsWithoutStartingRuntime() async throws {
+    let (store, _) = try makeCustomRuleStore()
+    let controller = makeControllerWithCustomRules(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, rulePreset: .chinaDirect, agentEnabled: false))
+    let workflow = editingWorkflow(controller)
+    await workflow.refresh()
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    draft.kind = .ipAddress
+    draft.content = "8.8.8.8"
+    let result = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(result, .committed(.saved))
+    XCTAssertEqual(try store.load().first?.id, draft.id)
+    XCTAssertEqual(controller.state, .off)
+    XCTAssertEqual(agent.registerCount, 0)
+    XCTAssertEqual(workflow.snapshot.commitFeedback?.operation, .add)
+  }
+
+  func testEditorChangesRuntimeACLOnceAndRetainsUUIDAcrossEdits() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let controller = makeControllerWithCustomRules(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .rule,
+        rulePreset: .chinaDirect, agentEnabled: true), proxyMode: .rule)
+    try await controller.activate(seeded.server)
+    let workflow = editingWorkflow(controller)
+    await workflow.refresh()
+    let registrations = agent.registerCount
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    draft.content = "new-rule.example"
+    let added = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(added, .committed(.saved))
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(agent.registerCount, registrations + 1)
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    XCTAssertTrue(try activeACLContent(runtimeStore).contains("||new-rule.example"))
+    var edited = try XCTUnwrap(workflow.makeCustomRuleDraft(editing: draft.id))
+    edited.content = "edited-rule.example"
+    let saved = await workflow.saveCustomRule(edited)
+    XCTAssertEqual(saved, .committed(.saved))
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(agent.registerCount, registrations + 2)
+    XCTAssertEqual(try store.load().map(\.id), [draft.id])
+    XCTAssertFalse(try activeACLContent(runtimeStore).contains("||new-rule.example"))
+    XCTAssertTrue(try activeACLContent(runtimeStore).contains("||edited-rule.example"))
+    XCTAssertEqual(workflow.snapshot.commitFeedback?.operation, .edit)
+  }
+
+  func testEditorFailedDeploymentKeepsSavedEditAndStopsRuntime() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let existing = CustomRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "kept.example"))
+    try store.save([existing])
+    let controller = makeControllerWithCustomRules(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .rule,
+        rulePreset: .chinaDirect, agentEnabled: true), proxyMode: .rule)
+    try await controller.activate(seeded.server)
+    let workflow = editingWorkflow(controller)
+    await workflow.refresh()
+    let version = workflow.snapshot.version
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let originalRuntime = try XCTUnwrap(runtimeStore.loadDocument())
+    agent.onRegister = {
+      try? runtimeStore.writeRuntimeReceipt(for: originalRuntime, processID: 42)
+    }
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft(editing: existing.id))
+    draft.content = "new-rule.example"
+    let result = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(result, .committed(.saved))
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(try store.load().first?.id, existing.id)
+    XCTAssertEqual(
+      try store.load().first?.match, try RuleMatch(domainSuffix: "new-rule.example"))
+    XCTAssertNotEqual(workflow.snapshot.version, version)
+    XCTAssertEqual(
+      workflow.snapshot.rows.first { $0.customIDs.contains(existing.id) }?.identity,
+      ProxyRule(action: .direct, match: try RuleMatch(domainSuffix: "new-rule.example")))
+    XCTAssertNotEqual(runtimeStore.loadDocument(), originalRuntime)
+    XCTAssertNotNil(runtimeStore.readFailure())
+    XCTAssertNotEqual(controller.state, .running)
+    let preview = await workflow.previewCustomRule(draft)
+    XCTAssertEqual(preview.failure, .staleDraft)
+    XCTAssertNotNil(controller.runtimeFacts.failure)
+  }
+
+  private func editingWorkflow(_ controller: ProxyRuntimeController) -> RulesWorkflow {
+    RulesWorkflow(
+      preset: controller.rulePreset,
+      loadDocument: { try controller.ruleDocuments.load() },
+      commitDocument: { await controller.commitRuleDocument($0) },
+      builtinSnapshots: controller.ruleSnapshots)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleEditingWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleEditingWorkflowTests.swift
new file mode 100644
index 000000000..b815b4535
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleEditingWorkflowTests.swift
@@ -0,0 +1,354 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class CustomRuleEditingWorkflowTests: XCTestCase {
+  func testIPPreviewNormalizesWithoutSavingAndSavePublishesNewRow() async throws {
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadDocument: { CustomRuleDocument(rules: []) },
+      commitDocument: { RuleDocumentCommit(outcome: .saved, document: $0) },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    let version = workflow.snapshot.version
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    draft.kind = .ipAddress
+    draft.content = " 2001:DB8::1 "
+    let preview = await workflow.previewCustomRule(draft)
+    XCTAssertNil(preview.failure)
+    XCTAssertEqual(preview.rule?.match, try RuleMatch(ipv6CIDR: "2001:db8::1/128"))
+    XCTAssertEqual(preview.displayContent, "2001:db8::1")
+    XCTAssertEqual(workflow.snapshot.version, version)
+    XCTAssertFalse(workflow.snapshot.rows.contains { $0.customIDs.contains(draft.id) })
+    let outcome = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(outcome, .committed(.saved))
+    let row = try XCTUnwrap(workflow.snapshot.rows.first { $0.customIDs.contains(draft.id) })
+    XCTAssertEqual(row.identity?.match, try RuleMatch(ipv6CIDR: "2001:db8::1/128"))
+    XCTAssertEqual(row.sources, [.custom])
+    XCTAssertNotEqual(workflow.snapshot.version, version)
+  }
+  func testEditingDisabledMergedRuleMovesOnlyCustomMembershipAndKeepsUUID() async throws {
+    let original = CustomRule(
+      action: .proxy, match: try RuleMatch(domainSuffix: "old.example"))
+    let builtin = ProxyRule(action: .proxy, match: original.match)
+    var saved = CustomRuleDocument(rules: [original], disabledIdentities: [original.identity])
+    let workflow = RulesWorkflow(
+      preset: .gfwlist,
+      loadDocument: { saved },
+      commitDocument: {
+        saved = $0
+        return RuleDocumentCommit(outcome: .saved, document: saved)
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: {
+        rulesFixture($0, rules: $0 == .gfwlist ? [builtin] : [])
+      }))
+    await workflow.refresh()
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft(editing: original.id))
+    let unchanged = await workflow.previewCustomRule(draft)
+    XCTAssertNil(unchanged.failure, "Editing excludes its own UUID")
+    draft.content = "new.example"
+    let preview = await workflow.previewCustomRule(draft)
+    XCTAssertTrue(preview.inheritsDisablement)
+    XCTAssertEqual(preview.row?.isEnabled, false)
+    let result = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(result, .committed(.saved))
+    XCTAssertEqual(saved.rules.count, 1)
+    XCTAssertEqual(saved.rules.first?.id, original.id)
+    XCTAssertEqual(
+      saved.disabledIdentities,
+      [
+        original.identity,
+        ProxyRule(action: .proxy, match: try RuleMatch(domainSuffix: "new.example")),
+      ])
+    workflow.query(RulesQuery(source: .gfwlist))
+    let oldRow = try XCTUnwrap(workflow.snapshot.rows.first { $0.identity == original.identity })
+    XCTAssertEqual(oldRow.sources, [.gfwlist])
+    XCTAssertTrue(oldRow.customIDs.isEmpty)
+    XCTAssertFalse(oldRow.isEnabled)
+    workflow.query(RulesQuery(source: .custom))
+    let newRow = try XCTUnwrap(workflow.snapshot.rows.first { $0.customIDs.contains(original.id) })
+    XCTAssertEqual(newRow.sources, [.custom])
+    XCTAssertFalse(newRow.isEnabled)
+  }
+
+  func testCIDRRequiresAddressAndPrefixAndShowsMaskedNetwork() async throws {
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadDocument: { CustomRuleDocument(rules: []) },
+      commitDocument: { RuleDocumentCommit(outcome: .saved, document: $0) },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    draft.kind = .cidr
+    for invalid in ["/8.8.8.8", "8.8.8.8/", "8.8.8.8", "8.8.8.8/33", "2001:db8::1/129"] {
+      draft.content = invalid
+      let preview = await workflow.previewCustomRule(draft)
+      XCTAssertEqual(preview.failure, .invalidInput(.cidr), invalid)
+    }
+    for (input, expected) in [
+      ("8.8.8.9/24", "8.8.8.0/24"), ("2001:db8:1::123/48", "2001:db8:1::/48"),
+    ] {
+      draft.content = input
+      let preview = await workflow.previewCustomRule(draft)
+      XCTAssertNil(preview.failure)
+      XCTAssertEqual(preview.displayContent, expected)
+    }
+  }
+
+  func testDuplicateAndFixedLocalConflictAreRejectedWithoutCommit() async throws {
+    let existing = CustomRule(action: .proxy, match: try RuleMatch(ipv4CIDR: "8.8.8.8/32"))
+    var commits = 0
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadDocument: { CustomRuleDocument(rules: [existing]) },
+      commitDocument: {
+        commits += 1
+        return RuleDocumentCommit(outcome: .saved, document: $0)
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    draft.kind = .ipAddress
+    draft.content = "8.8.8.8"
+    let duplicate = await workflow.previewCustomRule(draft)
+    XCTAssertEqual(duplicate.failure, .duplicate)
+    let duplicateSave = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(duplicateSave, .unavailable(.duplicate))
+    draft.kind = .cidr
+    draft.content = "8.8.8.8/32"
+    let cidr = await workflow.previewCustomRule(draft)
+    XCTAssertEqual(cidr.failure, .duplicate, "IP and full CIDR have one identity")
+    draft.kind = .ipAddress
+    for input in ["192.168.1.1", "::ffff:192.168.1.1", "::1"] {
+      draft.content = input
+      let conflict = await workflow.previewCustomRule(draft)
+      XCTAssertEqual(conflict.failure, .fixedLocalConflict, input)
+      let save = await workflow.saveCustomRule(draft)
+      XCTAssertEqual(save, .unavailable(.fixedLocalConflict))
+    }
+    XCTAssertEqual(commits, 0)
+  }
+
+  func testEquivalentBuiltinAndDisabledOrphanCanBeAddedWithoutEnabling() async throws {
+    let builtin = ProxyRule(
+      action: .proxy, match: try RuleMatch(domainSuffix: "merge.example"))
+    let orphan = ProxyRule(action: .proxy, match: try RuleMatch(domainExact: "orphan.example"))
+    let workflow = RulesWorkflow(
+      preset: .gfwlist,
+      loadDocument: {
+        CustomRuleDocument(rules: [], disabledIdentities: [builtin, orphan])
+      },
+      commitDocument: { RuleDocumentCommit(outcome: .saved, document: $0) },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: {
+        rulesFixture($0, rules: $0 == .gfwlist ? [builtin] : [])
+      }))
+    await workflow.refresh()
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    draft.content = ".MERGE.Example"
+    let preview = await workflow.previewCustomRule(draft)
+    XCTAssertNil(preview.failure)
+    XCTAssertEqual(preview.displayContent, "merge.example")
+    XCTAssertEqual(preview.row?.sources, [.custom, .gfwlist])
+    XCTAssertEqual(preview.row?.isEnabled, false)
+    let result = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(result, .committed(.saved))
+    let row = try XCTUnwrap(workflow.snapshot.rows.first { $0.customIDs.contains(draft.id) })
+    XCTAssertEqual(row.sources, [.custom, .gfwlist])
+    XCTAssertFalse(row.isEnabled)
+    var next = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    next.kind = .domainExact
+    next.content = "orphan.example"
+    let orphanPreview = await workflow.previewCustomRule(next)
+    XCTAssertEqual(orphanPreview.row?.isEnabled, false)
+    let orphanSave = await workflow.saveCustomRule(next)
+    XCTAssertEqual(orphanSave, .committed(.saved))
+    XCTAssertFalse(
+      try XCTUnwrap(workflow.snapshot.rows.first { $0.customIDs.contains(next.id) }).isEnabled)
+  }
+
+  func testDomainBoundaryAndNationalSuffixUseExistingNormalization() async throws {
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect, loadDocument: { CustomRuleDocument(rules: []) },
+      commitDocument: { RuleDocumentCommit(outcome: .saved, document: $0) },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    for kind in [CustomRuleDraft.Kind.domainExact, .domainSuffix] {
+      draft.kind = kind
+      for input in [
+        "", "例子.cn", "*.example.com", "https://example.com", "example.com/path", "^example$",
+      ] {
+        draft.content = input
+        let preview = await workflow.previewCustomRule(draft)
+        XCTAssertEqual(preview.failure, .invalidInput(kind), input)
+      }
+      draft.content = " XN--FIQS8S.Example "
+      let valid = await workflow.previewCustomRule(draft)
+      XCTAssertNil(valid.failure)
+      XCTAssertEqual(valid.displayContent, "xn--fiqs8s.example")
+    }
+    draft.kind = .domainSuffix
+    draft.content = "CN"
+    let national = await workflow.previewCustomRule(draft)
+    XCTAssertNil(national.failure)
+    XCTAssertEqual(national.rule?.match, try RuleMatch(nationalDomainSuffix: "cn"))
+    draft.kind = .ipAddress
+    for input in ["8.8.8.8/32", "[2001:db8::1]", "8.8.8.8:80", "example.com"] {
+      draft.content = input
+      let invalid = await workflow.previewCustomRule(draft)
+      XCTAssertEqual(invalid.failure, .invalidInput(.ipAddress))
+    }
+  }
+
+  func testPreviewExplainsSameActionAbsorptionAndAllowsSave() async throws {
+    let broad = CustomRule(
+      action: .proxy, match: try RuleMatch(domainSuffix: "coverage.example"))
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadDocument: { CustomRuleDocument(rules: [broad]) },
+      commitDocument: { RuleDocumentCommit(outcome: .saved, document: $0) },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    draft.kind = .domainExact
+    draft.content = "a.coverage.example"
+    let preview = await workflow.previewCustomRule(draft)
+    XCTAssertNil(preview.failure)
+    XCTAssertTrue(
+      preview.row?.relationships.contains {
+        $0.kind == .absorption && $0.extent == .full && $0.covering == [broad.identity]
+      } == true)
+    let saved = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(saved, .committed(.saved))
+    await workflow.analysisTask?.value
+    XCTAssertEqual(
+      workflow.snapshot.rows.first { $0.customIDs.contains(draft.id) }?.relationships,
+      preview.row?.relationships)
+  }
+
+}
+
+extension CustomRuleEditingWorkflowTests {
+  func testPendingSaveBlocksRepeatsAndFailureKeepsSnapshotAvailableForRetry() async throws {
+    let original = CustomRuleDocument(rules: [])
+    let started = expectation(description: "save awaiting adapter")
+    var continuation: CheckedContinuation<Void, Never>?
+    var commits = 0
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadDocument: { original },
+      commitDocument: { _ in
+        commits += 1
+        await withCheckedContinuation {
+          continuation = $0
+          started.fulfill()
+        }
+        return RuleDocumentCommit(outcome: .persistenceFailed, document: original)
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    let version = workflow.snapshot.version
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    draft.content = "pending.example"
+    let pending = Task { await workflow.saveCustomRule(draft) }
+    await fulfillment(of: [started], timeout: 3)
+    XCTAssertTrue(workflow.snapshot.isCommitting)
+    XCTAssertEqual(workflow.snapshot.operationStatus, .updating)
+    let repeated = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(repeated, .unavailable(.busy))
+    XCTAssertNil(workflow.makeCustomRuleDraft())
+    continuation?.resume()
+    let result = await pending.value
+    XCTAssertEqual(result, .committed(.persistenceFailed))
+    XCTAssertEqual(commits, 1)
+    XCTAssertEqual(workflow.snapshot.version, version)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .persistenceFailed)
+    XCTAssertFalse(workflow.snapshot.rows.contains { $0.customIDs.contains(draft.id) })
+    let retry = await workflow.previewCustomRule(draft)
+    XCTAssertNil(retry.failure)
+  }
+
+  func testSavedEditRejectsStaleDraftAndIncompleteCollection() async throws {
+    let rule = CustomRule(
+      action: .proxy, match: try RuleMatch(domainSuffix: "old.example"))
+    let original = CustomRuleDocument(rules: [rule])
+    let outcome = CustomRuleUpdateOutcome.saved
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadDocument: { original },
+      commitDocument: { RuleDocumentCommit(outcome: outcome, document: $0) },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    XCTAssertNil(workflow.makeCustomRuleDraft())
+    await workflow.refresh()
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft(editing: rule.id))
+    draft.content = "new.example"
+    let result = await workflow.saveCustomRule(draft)
+    XCTAssertEqual(result, .committed(outcome))
+    XCTAssertEqual(workflow.snapshot.commitOutcome, outcome)
+    XCTAssertEqual(
+      workflow.snapshot.rows.first { $0.customIDs.contains(rule.id) }?.content, "new.example")
+    let stale = await workflow.previewCustomRule(draft)
+    XCTAssertEqual(stale.failure, .staleDraft)
+    let incomplete = RulesWorkflow(
+      preset: .gfwlist,
+      loadDocument: { throw CustomRuleStoreError.corrupt(detail: "fixture error") },
+      commitDocument: { RuleDocumentCommit(outcome: .saved, document: $0) },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await incomplete.refresh()
+    XCTAssertNil(incomplete.makeCustomRuleDraft())
+    let refused = await incomplete.saveCustomRule(draft)
+    XCTAssertEqual(refused, .unavailable(.incompleteCollection))
+  }
+}
+
+extension CustomRuleEditingWorkflowTests {
+  func testDisabledEditCannotInheritDisablementOntoImmutableFixedIdentity() async throws {
+    let original = CustomRule(
+      action: .direct, match: try RuleMatch(domainExact: "disabled.example"))
+    var commits = 0
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect,
+      loadDocument: {
+        CustomRuleDocument(rules: [original], disabledIdentities: [original.identity])
+      },
+      commitDocument: {
+        commits += 1
+        return RuleDocumentCommit(outcome: .saved, document: $0)
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    var draft = try XCTUnwrap(workflow.makeCustomRuleDraft(editing: original.id))
+    draft.kind = .cidr
+    draft.content = "127.0.0.0/8"
+    let preview = await workflow.previewCustomRule(draft)
+    XCTAssertEqual(preview.failure, .fixedPolicyDisablement)
+    XCTAssertNil(preview.document)
+    let result = await workflow.saveCustomRule(draft)
+    guard case .unavailable = result else { return XCTFail("Must reject fixed-policy disablement") }
+    XCTAssertEqual(commits, 0)
+    XCTAssertFalse(workflow.snapshot.rows.filter(\.isFixed).contains { !$0.isEnabled })
+  }
+}
+
+extension CustomRuleEditingWorkflowTests {
+  func testStaleDraftCannotOverwriteAnotherSavedChangeAndDiscardingDraftDoesNothing() async throws {
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "kept.example"))
+    var commits = 0
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadDocument: { CustomRuleDocument(rules: [rule]) },
+      commitDocument: {
+        commits += 1
+        return RuleDocumentCommit(outcome: .saved, document: $0)
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    var discarded = try XCTUnwrap(workflow.makeCustomRuleDraft(editing: rule.id))
+    discarded.content = "discarded.example"
+    _ = await workflow.previewCustomRule(discarded)
+    XCTAssertEqual(commits, 0)
+    XCTAssertEqual(
+      workflow.snapshot.rows.first { $0.customIDs.contains(rule.id) }?.identity, rule.identity)
+    var stale = try XCTUnwrap(workflow.makeCustomRuleDraft())
+    stale.content = "new.example"
+    await workflow.setEnabled(false, identities: [rule.identity])
+    let result = await workflow.saveCustomRule(stale)
+    XCTAssertEqual(result, .unavailable(.staleDraft))
+    XCTAssertEqual(commits, 1)
+    XCTAssertFalse(workflow.snapshot.rows.contains { $0.customIDs.contains(stale.id) })
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleMergeTests.swift b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleMergeTests.swift
new file mode 100644
index 000000000..f81f9aac3
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleMergeTests.swift
@@ -0,0 +1,168 @@
+import Foundation
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 自定义规则合并进 ACL：两种规则子模式按各自内置来源与
+/// 自定义规则合并；全局和直连模式不加载自定义规则。
+final class CustomRuleMergeTests: XCTestCase {
+
+  private func custom(_ action: RuleAction, _ match: RuleMatch) -> CustomRule {
+    CustomRule(action: action, match: match)
+  }
+
+  func testACLIdentityDoesNotDependOnRuleOrderOrDuplicates() throws {
+    let first = ProxyRule(action: .direct, match: try RuleMatch(domainSuffix: "z.example"))
+    let equivalent = ProxyRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "z.example"))
+    let second = ProxyRule(action: .proxy, match: try RuleMatch(domainExact: "a.example"))
+    let url = URL(fileURLWithPath: "/tmp/rules-order.acl")
+    for action in RuleDefaultAction.allCases {
+      let expected = ProxyACLDocument.rule(at: url, defaultAction: action, rules: [first, second])
+      let reordered = ProxyACLDocument.rule(
+        at: url, defaultAction: action, rules: [second, equivalent, first])
+      XCTAssertEqual(expected.content, reordered.content)
+      XCTAssertEqual(expected.sha256, reordered.sha256)
+    }
+  }
+
+  /// 「未匹配时代理」：中国直连候选 + 自定义直连进 bypass_list；自定义代理
+  /// 不写 proxy_list（默认已代理）。
+  func testProxyWhenUnmatchedMergesChinaDirectAndCustomDirect() throws {
+    let builtIn = [
+      ProxyRule(
+        action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn")),
+      ProxyRule(
+        action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24")),
+    ]
+    let customRules = [
+      custom(.direct, try RuleMatch(domainSuffix: "internal.example")),
+      custom(.proxy, try RuleMatch(domainSuffix: "always-proxy.example")),
+    ]
+
+    let result = CustomRuleValidator.validate(
+      custom: customRules, builtIn: builtIn, defaultAction: .proxyWhenUnmatched)
+    let merged = builtIn + result.accepted
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(merged.count, 4)
+    let acl = ProxyACLDocument.rule(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"),
+      defaultAction: .proxyWhenUnmatched,
+      rules: merged)
+    XCTAssertTrue(acl.content.contains("||cn\n"))
+    XCTAssertTrue(acl.content.contains("203.0.113.0/24\n"))
+    XCTAssertTrue(acl.content.contains("||internal.example\n"))
+    XCTAssertFalse(
+      acl.content.contains("||always-proxy.example\n"),
+      "未匹配时代理骨架不写 proxy_list；代理动作默认已覆盖")
+    XCTAssertTrue(acl.content.hasPrefix("[proxy_all]"))
+  }
+
+  /// 「未匹配时直连」：GFWList 代理候选 + 自定义代理进 proxy_list；自定义
+  /// 未遮蔽直连进 bypass_list。
+  func testDirectWhenUnmatchedMergesGFWListAndCustomRules() throws {
+    let builtIn = [
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example"))
+    ]
+    let customRules = [
+      custom(.proxy, try RuleMatch(domainSuffix: "also-blocked.example")),
+      custom(.direct, try RuleMatch(domainSuffix: "unshadowed.example")),
+    ]
+
+    let result = CustomRuleValidator.validate(
+      custom: customRules, builtIn: builtIn, defaultAction: .directWhenUnmatched)
+    let merged = builtIn + result.accepted
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    let acl = ProxyACLDocument.rule(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"),
+      defaultAction: .directWhenUnmatched,
+      rules: merged)
+    XCTAssertTrue(acl.content.contains("[proxy_list]\n"))
+    XCTAssertTrue(acl.content.contains("||blocked.example\n"))
+    XCTAssertTrue(acl.content.contains("||also-blocked.example\n"))
+    XCTAssertTrue(acl.content.contains("||unshadowed.example\n"))
+    XCTAssertTrue(acl.content.hasPrefix("[bypass_all]"))
+  }
+
+  /// 被遮蔽条目保留；ACL 优先级决定其实际作用。
+  func testShadowedCustomDirectIsRetainedAndExplained() throws {
+    let builtIn = [
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example"))
+    ]
+    let customRules = [
+      custom(.direct, try RuleMatch(domainExact: "sub.blocked.example"))
+    ]
+
+    let result = CustomRuleValidator.validate(
+      custom: customRules, builtIn: builtIn, defaultAction: .directWhenUnmatched)
+    let merged = builtIn + result.accepted
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.relationships.first?.extent, .full)
+    let acl = ProxyACLDocument.rule(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"),
+      defaultAction: .directWhenUnmatched,
+      rules: merged)
+    XCTAssertTrue(acl.content.contains("sub.blocked.example"), "保留可表达意图，路由由 sslocal 优先级决定")
+  }
+
+  /// 单模式遮蔽：在「未匹配时代理」下有效（不被遮蔽），在「未匹配时直连」下
+  /// 被 GFWList 代理遮蔽并返回原因。保存允许（另一模式可生效），编译按当前
+  /// 模式解释。
+  func testOneModeShadowedRuleIsValidInTheOtherMode() throws {
+    let gfwBuiltIn = [
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example"))
+    ]
+    let chinaBuiltIn = [
+      ProxyRule(
+        action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn"))
+    ]
+    let customRules = [
+      custom(.direct, try RuleMatch(domainExact: "sub.blocked.example"))
+    ]
+
+    let proxyDefault = CustomRuleValidator.validate(
+      custom: customRules, builtIn: chinaBuiltIn, defaultAction: .proxyWhenUnmatched)
+    XCTAssertTrue(
+      proxyDefault.rejected.isEmpty,
+      "未匹配时代理骨架无域名代理表，自定义直连不被遮蔽")
+
+    let directDefault = CustomRuleValidator.validate(
+      custom: customRules, builtIn: gfwBuiltIn, defaultAction: .directWhenUnmatched)
+    XCTAssertTrue(directDefault.rejected.isEmpty)
+    XCTAssertEqual(directDefault.relationships.first?.kind, .shadowing)
+    XCTAssertEqual(directDefault.accepted.count, 1)
+  }
+}
+
+struct RuleSchemeRuntimeTests {
+  @Test func reverseIPExceptionCannotOverrideSchemeAction() throws {
+    let proxy = ProxyRule(action: .proxy, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24"))
+    let reverse = CustomRule(action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.8/32"))
+    let document = CustomRuleDocument(rules: [reverse])
+    let source = SslocalRuntimeDocument(servers: [], listen: ActivationFixture.listen)
+    let compiled = RuleRuntimeCompiler.compile(
+      .init(
+        source: source, mode: .rule, defaultAction: .directWhenUnmatched,
+        document: document, builtIn: [proxy], aclURL: URL(fileURLWithPath: "/tmp/scheme.acl")))
+    let content = try #require(compiled.aclRuntime?.content)
+    #expect(content.contains("203.0.113.0/24\n"))
+    #expect(!content.contains("203.0.113.8/32\n"))
+    #expect(content.contains("127.0.0.0/8\n"))
+    let collection = RulesCollection.load(
+      preset: .chinaProxy, custom: { [reverse] },
+      builtin: {
+        rulesFixture(
+          $0, rules: $0 == .chinaIPv4 ? [ProxyRule(action: .direct, match: proxy.match)] : [])
+      })
+    let result = try OfflineRuleMatcher.test(collection: collection, address: "203.0.113.8")
+    #expect(result.outcome == .proxy)
+    #expect(result.deciding.map(\.identity) == [proxy])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleStoreTests.swift b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleStoreTests.swift
new file mode 100644
index 000000000..269528ab6
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleStoreTests.swift
@@ -0,0 +1,269 @@
+import Foundation
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 自定义规则持久化：往返、缺失文件、损坏与诊断摘要。
+final class CustomRuleStoreTests: XCTestCase {
+  private var directory: URL!
+  private var store: CustomRuleStore!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-custom-rules-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    store = CustomRuleStore(fileURL: directory.appendingPathComponent("custom-rules.json"))
+  }
+
+  override func tearDownWithError() throws {
+    try? FileManager.default.removeItem(at: directory)
+    try super.tearDownWithError()
+  }
+
+  func testSchemaOneMigratesAndDisablementRoundTripsInSameDocument() throws {
+    let rule = CustomRule(action: .direct, match: try RuleMatch(domainExact: "private.example"))
+    let legacy = Data(
+      """
+      {"schemaVersion":1,"rules":[{"id":"\(rule.id.uuidString)","action":"direct",
+       "match":{"kind":"domainExact","value":"private.example"},
+       "source":{"kind":"custom","upstreamVersion":"user","label":"自定义"}}]}
+      """.utf8)
+    try legacy.write(to: store.fileURL)
+    let migrated = try store.loadDocument()
+    XCTAssertEqual(migrated.rules, [rule])
+    XCTAssertTrue(migrated.disabledIdentities.isEmpty)
+    try store.saveDocument(
+      CustomRuleDocument(rules: migrated.rules, disabledIdentities: [rule.identity]))
+    let saved = try store.loadDocument()
+    XCTAssertEqual(saved.disabledIdentities, [rule.identity])
+    XCTAssertNotEqual(
+      try store.summary().contentVersion, CustomRuleSummary.summarizing([rule]).contentVersion)
+  }
+
+  func testMissingFileLoadsAsEmpty() throws {
+    XCTAssertEqual(try store.load(), [])
+  }
+
+  func testRoundTripPersistsActionMatchAndUUID() throws {
+    let match = try RuleMatch(domainSuffix: "example.com")
+    let rule = CustomRule(action: .direct, match: match)
+
+    try store.save([rule])
+    let loaded = try store.load()
+
+    XCTAssertEqual(loaded.count, 1)
+    XCTAssertEqual(loaded[0].id, rule.id)
+    XCTAssertEqual(loaded[0].action, .direct)
+    XCTAssertEqual(loaded[0].match, match)
+  }
+
+  func testRoundTripKeepsMultipleRuleKinds() throws {
+    let rules = [
+      CustomRule(action: .proxy, match: try RuleMatch(domainExact: "a.example.com")),
+      CustomRule(action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24")),
+      CustomRule(action: .proxy, match: try RuleMatch(ipv6CIDR: "2001:db8::/32")),
+    ]
+
+    try store.save(rules)
+
+    XCTAssertEqual(try store.load(), rules)
+  }
+
+  func testStoredMatchIsNormalizedWithoutChangingCustomIdentity() throws {
+    let rule = CustomRule(action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.15/24"))
+    try store.save([rule])
+    let loaded = try XCTUnwrap(store.load().first)
+    XCTAssertEqual(loaded.id, rule.id)
+    XCTAssertEqual(loaded.match, try RuleMatch(ipv4CIDR: "203.0.113.0/24"))
+    XCTAssertEqual(loaded.identity, rule.identity)
+  }
+
+  func testMalformedStoredCIDRReportsCorruptionWithoutRewritingDocument() throws {
+    for kind in ["ipv4CIDR", "ipv6CIDR"] {
+      try Data(
+        """
+        {"schemaVersion":3,"rules":[{"id":"A22CD040-4788-41CC-BA73-AF296C7FE410",
+         "action":"direct","match":{"kind":"\(kind)","value":"/"}}],"disabledIdentities":[]}
+        """.utf8
+      ).write(to: store.fileURL)
+      let before = try Data(contentsOf: store.fileURL)
+      XCTAssertThrowsError(try store.load()) { error in
+        guard case .corrupt = error as? CustomRuleStoreError else {
+          return XCTFail("Expected corrupt document, got \(error)")
+        }
+      }
+      XCTAssertEqual(try Data(contentsOf: store.fileURL), before)
+    }
+  }
+
+  func testCorruptFileThrowsCorrupt() throws {
+    try Data("not-json".utf8).write(to: store.fileURL)
+
+    XCTAssertThrowsError(try store.load()) { error in
+      guard case .corrupt = error as? CustomRuleStoreError else {
+        return XCTFail("应点名 corrupt，实际 \(error)")
+      }
+    }
+  }
+
+  func testSchemaVersionMismatchIsRejected() throws {
+    let payload = """
+      {"schemaVersion": 99, "rules": []}
+      """
+    try Data(payload.utf8).write(to: store.fileURL)
+
+    XCTAssertThrowsError(try store.load()) { error in
+      guard case .schemaVersionMismatch(let found, let expected)? = error as? CustomRuleStoreError
+      else {
+        return XCTFail("应点名 schema 版本不匹配，实际 \(error)")
+      }
+      XCTAssertEqual(found, 99)
+      XCTAssertEqual(expected, CustomRuleStore.currentSchemaVersion)
+    }
+  }
+
+  func testSummaryExposesCountAndStableContentVersionWithoutRawDomains() throws {
+    let rules = [
+      CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "secret-internal.example")),
+      CustomRule(action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24")),
+    ]
+    try store.save(rules)
+
+    let summary = try store.summary()
+
+    XCTAssertEqual(summary.count, 2)
+    XCTAssertEqual(summary.contentVersion.count, 12)
+    XCTAssertFalse(summary.contentVersion.contains("secret"))
+    // 重排不改内容版本。
+    let reordered = CustomRuleSummary.summarizing(Array(rules.reversed()))
+    XCTAssertEqual(reordered.contentVersion, summary.contentVersion)
+    // 内容变化改版本。
+    let changed = CustomRuleSummary.summarizing([
+      CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "other.example"))
+    ])
+    XCTAssertNotEqual(changed.contentVersion, summary.contentVersion)
+  }
+}
+
+struct CustomRuleStorageMigrationTests {
+  @Test(arguments: RulePreset.allCases)
+  func migrationRemovesDefaultActionRulesAndPreservesRemainingIntent(_ preset: RulePreset) throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(
+      preset: preset, baseURL: directory.appendingPathComponent("rules.json"))
+    try FileManager.default.createDirectory(
+      at: store.fileURL.deletingLastPathComponent(), withIntermediateDirectories: true)
+    let action: RuleAction = preset == .chinaDirect ? .direct : .proxy
+    let first = CustomRule(action: action, match: try RuleMatch(domainExact: "first.example"))
+    let removed = CustomRule(
+      action: preset == .chinaDirect ? .proxy : .direct,
+      match: try RuleMatch(ipv4CIDR: "203.0.113.8/32"))
+    let last = CustomRule(action: action, match: try RuleMatch(domainSuffix: "last.example"))
+    let disabled: Set<ProxyRule> = [first.identity, removed.identity]
+    let document = CustomRuleDocument(rules: [first, removed, last], disabledIdentities: disabled)
+    var json = try #require(
+      JSONSerialization.jsonObject(with: CustomRuleStore.encode(document)) as? [String: Any])
+    json["schemaVersion"] = 3
+    let legacy = try JSONSerialization.data(withJSONObject: json)
+    try legacy.write(to: store.fileURL)
+    let loaded = try store.loadDocument()
+    #expect(loaded.rules == [first, last])
+    #expect(loaded.disabledIdentities == disabled)
+    #expect(try store.loadDocument() == loaded)
+    #expect(try Data(contentsOf: store.fileURL) == legacy)
+    try store.saveDocument(loaded)
+    #expect(try store.loadDocument() == loaded)
+    let saved = try #require(
+      JSONSerialization.jsonObject(with: Data(contentsOf: store.fileURL)) as? [String: Any])
+    #expect(saved["schemaVersion"] as? Int == 4)
+  }
+
+  @Test func legacySourceIsDiscardedOnNextSaveWithoutLosingSavedIntent() throws {
+    let data = Data(
+      """
+      {"schemaVersion":2,"rules":[
+        {"id":"A22CD040-4788-41CC-BA73-AF296C7FE410","action":"direct",
+         "match":{"kind":"ipv4CIDR","value":"203.0.113.15/24"},
+         "source":{"kind":"custom","upstreamVersion":"imported","label":"Old import"}}
+      ],"disabledIdentities":[
+        {"action":"proxy","match":{"kind":"domainExact","value":"orphan.example"}}
+      ]}
+      """.utf8)
+    let document = try CustomRuleStore.decode(data)
+    #expect(document.rules.first?.id.uuidString == "A22CD040-4788-41CC-BA73-AF296C7FE410")
+    #expect(document.disabledIdentities.count == 1)
+    let encoded = try CustomRuleStore.encode(document)
+    let json = try #require(JSONSerialization.jsonObject(with: encoded) as? [String: Any])
+    #expect(json["schemaVersion"] as? Int == 4)
+    let rule = try #require((json["rules"] as? [[String: Any]])?.first)
+    #expect(rule["source"] == nil)
+    #expect((rule["match"] as? [String: String])?["value"] == "203.0.113.0/24")
+    #expect(try CustomRuleStore.decode(encoded).disabledIdentities == document.disabledIdentities)
+  }
+}
+
+extension CustomRuleStorageMigrationTests {
+  @Test(arguments: [3, 4])
+  func scopedLoadRejectsCorruptionWithoutRewriting(schema: Int) throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(
+      preset: .chinaProxy, baseURL: directory.appendingPathComponent("rules.json"))
+    try FileManager.default.createDirectory(
+      at: store.fileURL.deletingLastPathComponent(), withIntermediateDirectories: true)
+    let reverse = CustomRule(action: .direct, match: try RuleMatch(domainExact: "reverse.example"))
+    // A duplicate must remain corrupt even when migration would remove both entries.
+    let rules = schema == 3 ? [reverse, reverse] : [reverse]
+    var json = try #require(
+      JSONSerialization.jsonObject(with: CustomRuleStore.encode(CustomRuleDocument(rules: rules)))
+        as? [String: Any])
+    json["schemaVersion"] = schema
+    let bytes = try JSONSerialization.data(withJSONObject: json)
+    try bytes.write(to: store.fileURL)
+    #expect(throws: CustomRuleStoreError.self) { try store.loadDocument() }
+    #expect(try Data(contentsOf: store.fileURL) == bytes)
+  }
+
+  @Test func loadDoesNotRewriteLegacyFileAndSaveRetainsOrphanDisablement() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let legacy = Data(
+      """
+      {"schemaVersion":2,"rules":[],"disabledIdentities":[
+        {"action":"proxy","match":{"kind":"domainExact","value":"orphan.example"}}]}
+      """.utf8)
+    try legacy.write(to: store.fileURL)
+    let document = try store.loadDocument()
+    #expect(try Data(contentsOf: store.fileURL) == legacy)
+    let rule = CustomRule(action: .direct, match: try RuleMatch(domainExact: "new.example"))
+    try store.save([rule])
+    let saved = try store.loadDocument()
+    #expect(saved.rules == [rule])
+    #expect(saved.disabledIdentities == document.disabledIdentities)
+  }
+
+  @Test(arguments: ["uuid", "identity", "disabled"])
+  func duplicateRecordsRemainRejected(kind: String) throws {
+    let record: [String: Any] = [
+      "id": "A22CD040-4788-41CC-BA73-AF296C7FE410", "action": "direct",
+      "match": ["kind": "domainExact", "value": "example.com"],
+    ]
+    var second = record
+    if kind == "identity" { second["id"] = "B22CD040-4788-41CC-BA73-AF296C7FE410" }
+    if kind == "uuid" { second["action"] = "proxy" }
+    let disabled: [String: Any] = [
+      "action": "proxy", "match": ["kind": "domainExact", "value": "orphan.example"],
+    ]
+    let json: [String: Any] = [
+      "schemaVersion": 3, "rules": kind == "disabled" ? [] : [record, second],
+      "disabledIdentities": kind == "disabled" ? [disabled, disabled] : [],
+    ]
+    let data = try JSONSerialization.data(withJSONObject: json)
+    #expect(throws: CustomRuleStoreError.self) { try CustomRuleStore.decode(data) }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleValidatorTests.swift b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleValidatorTests.swift
new file mode 100644
index 000000000..60b43b0c7
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/Custom/CustomRuleValidatorTests.swift
@@ -0,0 +1,277 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 自定义规则校验：固定本地冲突、ACL 优先级说明与重复拒绝，
+/// 并返回可解释原因。
+final class CustomRuleValidatorTests: XCTestCase {
+
+  private func rule(
+    _ action: RuleAction,
+    _ match: RuleMatch,
+    id: UUID = UUID()
+  ) -> CustomRule {
+    CustomRule(id: id, action: action, match: match)
+  }
+
+  func testOppositeActionsAreRetainedRegardlessOfCustomOrder() throws {
+    let rules = [
+      rule(.direct, try RuleMatch(domainExact: "a.example.com")),
+      rule(.proxy, try RuleMatch(domainSuffix: "example.com")),
+    ]
+    let first = CustomRuleValidator.validate(custom: rules, defaultAction: .directWhenUnmatched)
+    let reversed = CustomRuleValidator.validate(
+      custom: Array(rules.reversed()), defaultAction: .directWhenUnmatched)
+    XCTAssertTrue(first.rejected.isEmpty)
+    XCTAssertTrue(reversed.rejected.isEmpty)
+    XCTAssertEqual(first, reversed)
+    XCTAssertEqual(first.accepted.count, 2)
+  }
+
+  // MARK: 有效规则
+
+  func testValidDomainAndCIDRRulesAreAccepted() throws {
+    let custom = [
+      rule(.proxy, try RuleMatch(domainSuffix: "blocked.example")),
+      rule(.direct, try RuleMatch(domainExact: "ok.example.cn")),
+      rule(.direct, try RuleMatch(ipv4CIDR: "203.0.113.0/24")),
+      rule(.proxy, try RuleMatch(ipv6CIDR: "2001:db8::/32")),
+    ]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, defaultAction: .directWhenUnmatched)
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.accepted.count, 4)
+    XCTAssertTrue(
+      result.accepted.contains { $0.aclLine == "||blocked.example" && $0.action == .proxy })
+  }
+
+  func testMappedIPv6CannotBypassFixedLocalConflictValidation() throws {
+    let privateRule = rule(.proxy, try RuleMatch(ipv6CIDR: "::ffff:192.168.1.2"))
+    let broadRule = rule(.proxy, try RuleMatch(ipv6CIDR: "::ffff:0.0.0.0/96"))
+    let publicRule = rule(.proxy, try RuleMatch(ipv6CIDR: "::ffff:203.0.113.8"))
+    let result = CustomRuleValidator.validate(
+      custom: [privateRule, publicRule, broadRule], defaultAction: .directWhenUnmatched)
+    XCTAssertEqual(result.rejected.count, 2)
+    XCTAssertTrue(result.rejected.allSatisfy { $0.reason == .conflictsWithFixedLocalScope })
+    XCTAssertEqual(result.accepted, [publicRule.proxyRule])
+  }
+
+  // MARK: 固定本地冲突
+
+  func testProxyRuleOverFixedLocalIPRangeIsRejected() throws {
+    let custom = [rule(.proxy, try RuleMatch(ipv4CIDR: "10.1.2.3/32"))]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, defaultAction: .directWhenUnmatched)
+
+    XCTAssertEqual(result.accepted.count, 0)
+    XCTAssertEqual(result.rejected.count, 1)
+    XCTAssertEqual(result.rejected[0].reason, .conflictsWithFixedLocalScope)
+    XCTAssertFalse(result.rejected[0].explanation.isEmpty)
+  }
+
+  func testProxyRuleOverlappingFixedLocalIPRangeIsRejected() throws {
+    // 172.0.0.0/8 与固定本地 172.16.0.0/12 相交。
+    let custom = [rule(.proxy, try RuleMatch(ipv4CIDR: "172.0.0.0/8"))]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, defaultAction: .proxyWhenUnmatched)
+
+    XCTAssertEqual(result.rejected.map(\.reason), [.conflictsWithFixedLocalScope])
+  }
+
+  func testProxyRuleOverLocalHostnameIsRejected() throws {
+    let custom = [
+      rule(.proxy, try RuleMatch(domainExact: "localhost")),
+      rule(.proxy, try RuleMatch(domainExact: "printer.local")),
+      rule(.proxy, try RuleMatch(domainExact: "myhost")),
+      rule(.proxy, try RuleMatch(domainSuffix: "home.local")),
+    ]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, defaultAction: .directWhenUnmatched)
+
+    XCTAssertEqual(result.accepted.count, 0)
+    XCTAssertEqual(result.rejected.count, 4)
+    XCTAssertTrue(
+      result.rejected.allSatisfy { $0.reason == .conflictsWithFixedLocalScope })
+  }
+
+  func testDirectRuleOverFixedLocalIsAllowed() throws {
+    let custom = [rule(.direct, try RuleMatch(ipv4CIDR: "127.0.0.0/8"))]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, defaultAction: .proxyWhenUnmatched)
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.accepted.count, 1)
+  }
+
+  func testProxyRuleOutsideFixedLocalIsAllowed() throws {
+    let custom = [
+      rule(.proxy, try RuleMatch(ipv4CIDR: "203.0.113.0/24")),
+      rule(.proxy, try RuleMatch(domainSuffix: "example.com")),
+      rule(.proxy, try RuleMatch(ipv4CIDR: "172.15.0.0/16")),
+    ]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, defaultAction: .directWhenUnmatched)
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.accepted.count, 3)
+  }
+
+  // MARK: 遮蔽
+
+  func testDomainDirectShadowedByBroaderDomainProxyIsExplainedWhenProxySideWritten() throws {
+    let builtIn = [
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example"))
+    ]
+    let custom = [rule(.direct, try RuleMatch(domainExact: "sub.blocked.example"))]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, builtIn: builtIn, defaultAction: .directWhenUnmatched)
+
+    XCTAssertEqual(result.accepted.count, 1)
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.relationships.first?.extent, .full)
+  }
+
+  func testDomainDirectNotShadowedWhenProxySideNotWritten() throws {
+    // 「未匹配时代理」骨架不写 proxy_list，域名代理表为空，直连规则不会被遮蔽。
+    let builtIn = [
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example"))
+    ]
+    let custom = [rule(.direct, try RuleMatch(domainExact: "sub.blocked.example"))]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, builtIn: builtIn, defaultAction: .proxyWhenUnmatched)
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.accepted.count, 1)
+  }
+
+  func testIPProxyShadowedByBroaderIPDirectIsExplainedWhenProxySideWritten() throws {
+    let builtIn = [
+      ProxyRule(
+        action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24"))
+    ]
+    let custom = [rule(.proxy, try RuleMatch(ipv4CIDR: "203.0.113.10/32"))]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, builtIn: builtIn, defaultAction: .directWhenUnmatched)
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.relationships.first?.kind, .shadowing)
+    XCTAssertEqual(result.relationships.first?.extent, .full)
+  }
+
+  func testIPProxyNotRejectedWhenProxySideNotWritten() throws {
+    // 「未匹配时代理」不写 proxy_list；IP 代理规则不参与 bypass 优先判定。
+    let builtIn = [
+      ProxyRule(
+        action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24"))
+    ]
+    let custom = [rule(.proxy, try RuleMatch(ipv4CIDR: "203.0.113.10/32"))]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, builtIn: builtIn, defaultAction: .proxyWhenUnmatched)
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.accepted.count, 1)
+  }
+
+  func testDomainProxyNotShadowedByDomainDirect() throws {
+    // 域名 proxy_list 优先于 bypass_list：代理规则不会被直连遮蔽。
+    let builtIn = [
+      ProxyRule(
+        action: .direct, match: try RuleMatch(domainSuffix: "example.com"))
+    ]
+    let custom = [rule(.proxy, try RuleMatch(domainExact: "a.example.com"))]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, builtIn: builtIn, defaultAction: .directWhenUnmatched)
+
+    XCTAssertTrue(result.rejected.isEmpty)
+  }
+
+  func testCustomToCustomDomainShadowingIsDetected() throws {
+    let custom = [
+      rule(.proxy, try RuleMatch(domainSuffix: "example.com")),
+      rule(.direct, try RuleMatch(domainExact: "a.example.com")),
+    ]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, defaultAction: .directWhenUnmatched)
+
+    XCTAssertEqual(result.accepted.count, 2)
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.relationships.first?.rule.action, .direct)
+  }
+
+  func testCustomToCustomIPShadowingIsDetected() throws {
+    let custom = [
+      rule(.direct, try RuleMatch(ipv4CIDR: "198.51.100.0/24")),
+      rule(.proxy, try RuleMatch(ipv4CIDR: "198.51.100.5/32")),
+    ]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, defaultAction: .directWhenUnmatched)
+
+    XCTAssertTrue(result.rejected.isEmpty)
+    XCTAssertEqual(result.relationships.first?.kind, .shadowing)
+    XCTAssertEqual(result.relationships.first?.extent, .full)
+    XCTAssertEqual(result.relationships.first?.rule.action, .proxy)
+  }
+
+  // MARK: 重复
+
+  func testDuplicateContentIsRejected() throws {
+    let match = try RuleMatch(domainSuffix: "example.com")
+    let custom = [
+      rule(.proxy, match),
+      rule(.proxy, match),
+    ]
+
+    let result = CustomRuleValidator.validate(
+      custom: custom, defaultAction: .directWhenUnmatched)
+
+    XCTAssertTrue(result.accepted.isEmpty)
+    XCTAssertEqual(result.rejected.map(\.reason), [.duplicate, .duplicate])
+  }
+
+  // MARK: 覆盖判定
+
+  func testDomainCoverageMatrix() throws {
+    let suffixExample = try RuleMatch(domainSuffix: "example.com")
+    let exactA = try RuleMatch(domainExact: "a.example.com")
+    let exactExample = try RuleMatch(domainExact: "example.com")
+    let suffixA = try RuleMatch(domainSuffix: "a.example.com")
+    let suffixOther = try RuleMatch(domainSuffix: "other.example")
+
+    XCTAssertTrue(RuleCoverage.domainCovers(suffixExample, exactA))
+    XCTAssertTrue(RuleCoverage.domainCovers(suffixExample, exactExample))
+    XCTAssertTrue(RuleCoverage.domainCovers(suffixExample, suffixA))
+    XCTAssertFalse(RuleCoverage.domainCovers(exactA, suffixA), "精确不覆盖后缀")
+    XCTAssertFalse(RuleCoverage.domainCovers(suffixA, suffixExample), "窄后缀不覆盖宽后缀")
+    XCTAssertFalse(RuleCoverage.domainCovers(suffixExample, suffixOther))
+    XCTAssertTrue(RuleCoverage.domainCovers(exactA, exactA))
+  }
+
+  func testIPCoverageMatrix() throws {
+    let slash8 = try RuleMatch(ipv4CIDR: "10.0.0.0/8")
+    let slash16 = try RuleMatch(ipv4CIDR: "10.1.0.0/16")
+    let host = try RuleMatch(ipv4CIDR: "10.1.2.3/32")
+    let other = try RuleMatch(ipv4CIDR: "11.0.0.0/8")
+
+    XCTAssertTrue(RuleCoverage.ipCovers(slash8, slash16))
+    XCTAssertTrue(RuleCoverage.ipCovers(slash8, host))
+    XCTAssertFalse(RuleCoverage.ipCovers(slash16, slash8))
+    XCTAssertFalse(RuleCoverage.ipCovers(slash8, other))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/Custom/RuleDocumentSessionTests.swift b/ShadowsocksX-NG2/Tests/Rules/Custom/RuleDocumentSessionTests.swift
new file mode 100644
index 000000000..ca5774c87
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/Custom/RuleDocumentSessionTests.swift
@@ -0,0 +1,176 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct RuleDocumentSessionTests {
+  @Test(arguments: RulePreset.allCases)
+  func reverseActionCommitIsRejectedWithoutChangingSavedFacts(_ preset: RulePreset) throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(
+      preset: preset, baseURL: directory.appendingPathComponent("rules.json"))
+    let session = RuleDocumentSession(store: store)
+    let original = CustomRuleDocument(rules: [
+      CustomRule(
+        action: preset == .chinaDirect ? .direct : .proxy,
+        match: try RuleMatch(domainExact: "kept.example"))
+    ])
+    #expect(session.commit(original).outcome == .saved)
+    let bytes = try Data(contentsOf: store.fileURL)
+    let invalid = CustomRuleDocument(rules: [
+      CustomRule(
+        action: preset == .chinaDirect ? .proxy : .direct,
+        match: try RuleMatch(domainExact: "reverse.example"))
+    ])
+    let result = session.commit(invalid)
+    #expect(
+      result.outcome == .invalidDocument(detail: "Custom rule action must match its rule scheme"))
+    #expect(result.document == original)
+    #expect(session.revision == 1)
+    #expect(try Data(contentsOf: store.fileURL) == bytes)
+    #expect(throws: CustomRuleStoreError.self) { try store.saveDocument(invalid) }
+    #expect(try Data(contentsOf: store.fileURL) == bytes)
+  }
+
+  @Test func successfulCommitPublishesSavedFactsAndOnlyChangedContentAdvancesRevision() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(
+      preset: .chinaProxy, baseURL: directory.appendingPathComponent("rules.json"))
+    let session = RuleDocumentSession(store: store)
+    let document = CustomRuleDocument(rules: [
+      CustomRule(action: .proxy, match: try RuleMatch(domainExact: "saved.example"))
+    ])
+
+    let result = session.commit(document)
+
+    #expect(result.outcome == .saved)
+    #expect(result.document == document)
+    #expect(try session.load() == document)
+    #expect(session.revision == 1)
+    #expect(session.commit(document).outcome == .saved)
+    #expect(session.revision == 1)
+    #expect(try RuleDocumentSession(store: store).load() == document)
+  }
+}
+
+extension RuleDocumentSessionTests {
+  @Test(arguments: ["fixedConflict", "duplicate", "fixedDisabled"])
+  func invalidCommitRetainsSavedFactsAndRevision(reason: String) throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let session = RuleDocumentSession(store: store)
+    let kept = CustomRule(action: .direct, match: try RuleMatch(domainExact: "kept.example"))
+    let original = CustomRuleDocument(rules: [kept])
+    #expect(session.commit(original).outcome == .saved)
+    let proposal: CustomRuleDocument
+    switch reason {
+    case "fixedConflict":
+      proposal = CustomRuleDocument(rules: [
+        kept,
+        CustomRule(action: .proxy, match: try RuleMatch(ipv4CIDR: "127.0.0.0/8")),
+      ])
+    case "duplicate":
+      proposal = CustomRuleDocument(rules: [
+        kept,
+        CustomRule(action: kept.action, match: kept.rule.match),
+      ])
+    default:
+      proposal = CustomRuleDocument(
+        rules: [kept],
+        disabledIdentities: [
+          ProxyRule(action: .direct, match: try RuleMatch(ipv4CIDR: "127.0.0.0/8"))
+        ])
+    }
+
+    let result = session.commit(proposal)
+
+    if reason == "fixedDisabled" {
+      #expect(result.outcome == .invalidDocument(detail: "Fixed local policy cannot be disabled"))
+    } else {
+      guard case .rejected(let rejected) = result.outcome else {
+        Issue.record("Expected whole-document rejection, got \(result.outcome)")
+        return
+      }
+      #expect(
+        rejected.map(\.reason).allSatisfy {
+          $0 == (reason == "duplicate" ? .duplicate : .conflictsWithFixedLocalScope)
+        })
+      #expect(!rejected.isEmpty)
+    }
+    #expect(result.document == original)
+    #expect(session.current == original)
+    #expect(session.revision == 1)
+    #expect(try RuleDocumentSession(store: store).load() == original)
+  }
+}
+
+extension RuleDocumentSessionTests {
+  @Test func corruptFirstLoadRejectsCommitWithoutOverwritingFile() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let corrupt = Data("broken".utf8)
+    try corrupt.write(to: store.fileURL)
+    let session = RuleDocumentSession(store: store)
+
+    let result = session.commit(CustomRuleDocument(rules: []))
+
+    #expect(result.outcome == .persistenceFailed)
+    #expect(result.document == nil)
+    #expect(session.current == nil)
+    #expect(session.revision == 0)
+    #expect(try Data(contentsOf: store.fileURL) == corrupt)
+  }
+
+  @Test func failedWriteRetainsOwnedFactsAndRevision() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let storage = directory.appendingPathComponent("storage")
+    let store = CustomRuleStore(fileURL: storage.appendingPathComponent("rules.json"))
+    let session = RuleDocumentSession(store: store)
+    let original = CustomRuleDocument(rules: [
+      CustomRule(action: .direct, match: try RuleMatch(domainExact: "kept.example"))
+    ])
+    #expect(session.commit(original).outcome == .saved)
+    let backup = directory.appendingPathComponent("backup")
+    try FileManager.default.moveItem(at: storage, to: backup)
+    try Data("blocked".utf8).write(to: storage)
+
+    let result = session.commit(CustomRuleDocument(rules: []))
+
+    #expect(result.outcome == .persistenceFailed)
+    #expect(result.document == original)
+    #expect(try session.load() == original)
+    #expect(session.revision == 1)
+    try FileManager.default.removeItem(at: storage)
+    try FileManager.default.moveItem(at: backup, to: storage)
+    #expect(try RuleDocumentSession(store: store).load() == original)
+  }
+
+  @Test func overlappingOppositeActionsAndOrphanedDisablementRemainSavedIntent() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let session = RuleDocumentSession(store: store)
+    let document = CustomRuleDocument(
+      rules: [
+        CustomRule(action: .direct, match: try RuleMatch(domainSuffix: "example.com")),
+        CustomRule(action: .proxy, match: try RuleMatch(domainExact: "a.example.com")),
+        CustomRule(action: .direct, match: try RuleMatch(domainExact: "a.example.com")),
+      ],
+      disabledIdentities: [
+        ProxyRule(action: .proxy, match: try RuleMatch(domainExact: "orphan.example"))
+      ])
+
+    let result = session.commit(document)
+
+    #expect(result.outcome == .saved)
+    #expect(result.document == document)
+    #expect(try RuleDocumentSession(store: store).load() == document)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/GeneratedRuleSnapshotTests.swift b/ShadowsocksX-NG2/Tests/Rules/GeneratedRuleSnapshotTests.swift
new file mode 100644
index 000000000..fce1faab2
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/GeneratedRuleSnapshotTests.swift
@@ -0,0 +1,191 @@
+import Foundation
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class GeneratedRuleSnapshotTests: XCTestCase {
+  func testDisablingCNSuffixDoesNotRestoreOmittedOfflineRows() throws {
+    let snapshot = try generatedSnapshot("geolocation-cn")
+    let collection = RulesCollection.load(
+      preset: .chinaDirect,
+      custom: { [] },
+      builtin: { source in
+        source == .geolocationCN ? snapshot : rulesFixture(source)
+      })
+    let narrow = ProxyRule(action: .direct, match: try RuleMatch(domainSuffix: "foo.cn"))
+    XCTAssertFalse(collection.rows.contains { $0.identity == narrow })
+    XCTAssertEqual(
+      try OfflineRuleMatcher.test(collection: collection, address: "foo.cn").outcome, .direct)
+    let disabled = collection.replacingUserDocument(
+      CustomRuleDocument(
+        rules: [],
+        disabledIdentities: [
+          ProxyRule(action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn"))
+        ]))
+    let result = try OfflineRuleMatcher.test(collection: disabled, address: "foo.cn")
+    XCTAssertEqual(result.outcome, .proxy)
+    XCTAssertTrue(result.deciding.isEmpty)
+  }
+
+  func testSnapshotLoadRejectsOldVersionsAndAbnormalCounts() throws {
+    let snapshot = try generatedSnapshot("geolocation-cn")
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let url = directory.appendingPathComponent("snapshot.json")
+    let store = RuleSnapshotStore(fileURL: url)
+    let encoded = try RuleSnapshotStore.encode(snapshot)
+    let original = try XCTUnwrap(JSONSerialization.jsonObject(with: encoded) as? [String: Any])
+    var old = original
+    old["schemaVersion"] = 1
+    try JSONSerialization.data(withJSONObject: old).write(to: url)
+    XCTAssertThrowsError(try store.load()) {
+      XCTAssertEqual($0 as? RuleSnapshotError, .schemaVersionMismatch(found: 1, expected: 2))
+    }
+    var obsolete = original
+    var metadata = try XCTUnwrap(obsolete["metadata"] as? [String: Any])
+    metadata["converterVersion"] = "1.0.0"
+    obsolete["metadata"] = metadata
+    try JSONSerialization.data(withJSONObject: obsolete).write(to: url)
+    XCTAssertThrowsError(try store.load()) {
+      XCTAssertEqual(
+        $0 as? RuleSnapshotError,
+        .converterVersionMismatch(found: "1.0.0", expected: "2.0.0"))
+    }
+    let rule = try XCTUnwrap(snapshot.rules.first)
+    for count in [99, 100] {
+      try store.save(
+        RuleSnapshot(
+          metadata: snapshot.metadata,
+          rules: Array(repeating: rule, count: count)))
+      if (100...200_000).contains(count) {
+        XCTAssertEqual(try store.load().rules.count, count)
+      } else {
+        XCTAssertThrowsError(try store.load()) {
+          XCTAssertEqual(
+            $0 as? RuleSnapshotError,
+            .abnormalRuleCount(found: count, minimum: 100, maximum: 200_000))
+        }
+      }
+    }
+  }
+
+  func testSnapshotEncodingOmitsForensicsAndKeepsNumericReport() throws {
+    let snapshot = try generatedSnapshot("geolocation-cn")
+    let data = try RuleSnapshotStore.encode(snapshot)
+    XCTAssertFalse(data.contains(10), "Snapshot JSON is compact")
+    let json = try XCTUnwrap(JSONSerialization.jsonObject(with: data) as? [String: Any])
+    XCTAssertEqual(Set(json.keys), ["schemaVersion", "metadata", "rules", "lossReport"])
+    let report = try XCTUnwrap(json["lossReport"] as? [String: Any])
+    XCTAssertEqual(Set(report.keys), ["convertedCount", "absorbedCount", "skipped", "rejected"])
+    XCTAssertEqual(report["absorbedCount"] as? Int, 1)
+    let rules = try XCTUnwrap(json["rules"] as? [[String: Any]])
+    XCTAssertTrue(rules.allSatisfy { Set($0.keys) == ["action", "match"] })
+  }
+
+  func testSnapshotStoreRoundTripAndMissingFileGuard() throws {
+    let snapshot = try generatedSnapshot("geolocation-cn")
+    let dir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-rule-snapshot-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: dir) }
+    let url = dir.appendingPathComponent("snapshot.json")
+
+    let store = RuleSnapshotStore(fileURL: url)
+    XCTAssertThrowsError(try store.load()) { error in
+      XCTAssertEqual(error as? RuleSnapshotError, .missing)
+    }
+    try store.save(snapshot)
+    let loaded = try store.load()
+    XCTAssertEqual(loaded.rules.map(\.match), snapshot.rules.map(\.match))
+    XCTAssertEqual(loaded.metadata, snapshot.metadata)
+  }
+}
+
+struct RuleSnapshotCountTests {
+  @Test func geolocationCountBoundaries() throws {
+    try checkBoundaries(source: .geolocationCN, maximum: 200_000)
+  }
+
+  @Test(arguments: [RuleSourceKind.chinaIPv4, .gfwlist, .custom])
+  func otherSourceCountBoundaries(source: RuleSourceKind) throws {
+    try checkBoundaries(source: source, maximum: 50_000)
+  }
+
+  private func checkBoundaries(source: RuleSourceKind, maximum: Int) throws {
+    for count in [0, 99, maximum + 1] {
+      #expect(
+        throws: RuleSnapshotError.abnormalRuleCount(found: count, minimum: 100, maximum: maximum)
+      ) {
+        try RuleSnapshotStore.validateRuleCount(count, source: source)
+      }
+    }
+    for count in [100, maximum] {
+      try RuleSnapshotStore.validateRuleCount(count, source: source)
+    }
+  }
+}
+
+private func generatedSnapshot(_ name: String) throws -> RuleSnapshot {
+  let url = try XCTUnwrap(
+    Bundle(for: GeneratedRuleSnapshotTests.self)
+      .url(forResource: name, withExtension: "json", subdirectory: "RuleSnapshots"))
+  return try RuleSnapshotStore(fileURL: url).load()
+}
+
+extension GeneratedRuleSnapshotTests {
+  func testAllGeneratedSourcesLoadAndCompileIntoACL() throws {
+    let snapshots = try ["geolocation-cn", "china-ipv4", "gfwlist"].map(generatedSnapshot)
+    let acl = ProxyACLDocument.rule(
+      at: URL(fileURLWithPath: "/tmp/generated-fixture.acl"),
+      defaultAction: .directWhenUnmatched, rules: snapshots.flatMap(\.rules))
+    XCTAssertTrue(acl.content.contains("||example.com"))
+    XCTAssertTrue(acl.content.contains("1.0.0.0/24"))
+    XCTAssertFalse(acl.content.contains("||safe.example.com"))
+    let collection = RulesCollection.load(
+      preset: .gfwlist,
+      custom: { [] },
+      builtin: { source in
+        try XCTUnwrap(
+          [
+            RulesSource.geolocationCN: snapshots[0], .chinaIPv4: snapshots[1],
+            .gfwlist: snapshots[2],
+          ][source])
+      })
+    XCTAssertEqual(
+      try OfflineRuleMatcher.test(collection: collection, address: "1.0.0.42").outcome, .direct)
+    XCTAssertEqual(
+      try OfflineRuleMatcher.test(collection: collection, address: "example.com").outcome, .proxy)
+    XCTAssertEqual(
+      try OfflineRuleMatcher.test(collection: collection, address: "api.example.org").outcome,
+      .direct)
+  }
+}
+
+extension GeneratedRuleSnapshotTests {
+  func testDisablingBlockerDoesNotRestoreOmittedOfflineException() throws {
+    let snapshot = try generatedSnapshot("gfwlist")
+    let collection = RulesCollection.load(
+      preset: .gfwlist,
+      custom: { [] },
+      builtin: { source in
+        source == .gfwlist ? snapshot : rulesFixture(source)
+      })
+    let exception = ProxyRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "safe.example.com"))
+    XCTAssertFalse(collection.rows.contains { $0.identity == exception })
+    XCTAssertEqual(
+      try OfflineRuleMatcher.test(collection: collection, address: "safe.example.com").outcome,
+      .proxy)
+    let disabled = collection.replacingUserDocument(
+      CustomRuleDocument(
+        rules: [],
+        disabledIdentities: [
+          ProxyRule(action: .proxy, match: try RuleMatch(domainSuffix: "example.com"))
+        ]))
+    let result = try OfflineRuleMatcher.test(collection: disabled, address: "safe.example.com")
+    XCTAssertEqual(result.outcome, .direct)
+    XCTAssertTrue(result.deciding.isEmpty)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/OfflineRuleMatcherTests.swift b/ShadowsocksX-NG2/Tests/Rules/OfflineRuleMatcherTests.swift
new file mode 100644
index 000000000..660935c0f
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/OfflineRuleMatcherTests.swift
@@ -0,0 +1,153 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class OfflineRuleMatcherTests: XCTestCase {
+  func testURLAndLiteralIPNormalizationSelectOnlyTheHostBranch() throws {
+    let rules = [
+      CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "example.com")),
+      CustomRule(action: .proxy, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24")),
+      CustomRule(action: .direct, match: try RuleMatch(ipv6CIDR: "2001:db8::/32")),
+    ]
+    let collection = RulesCollection.load(
+      preset: .gfwlist, custom: { rules }, builtin: { rulesFixture($0) })
+    for input in [" A.Example.COM. \n", "https://A.Example.COM.:8443/path?q=203.0.113.8#fragment"] {
+      let result = try OfflineRuleMatcher.test(collection: collection, address: input)
+      XCTAssertEqual(result.target, "a.example.com")
+      XCTAssertEqual(result.outcome, .proxy)
+      XCTAssertTrue(result.domainWithoutDNS)
+    }
+    for input in ["203.0.113.8", "https://203.0.113.8:443/path"] {
+      let result = try OfflineRuleMatcher.test(collection: collection, address: input)
+      XCTAssertEqual(result.target, "203.0.113.8")
+      XCTAssertEqual(result.outcome, .proxy)
+      XCTAssertFalse(result.domainWithoutDNS)
+    }
+    let ipv6 = try OfflineRuleMatcher.test(
+      collection: collection, address: "https://[2001:DB8::8]:8443/path")
+    XCTAssertEqual(ipv6.target, "2001:db8::8")
+    XCTAssertEqual(ipv6.outcome, .direct)
+    XCTAssertFalse(ipv6.domainWithoutDNS)
+  }
+  func testDomainOverlapAndSuffixBoundariesKeepAllCommonEvidence() throws {
+    let suffix = CustomRule(action: .direct, match: try RuleMatch(domainSuffix: "example.com"))
+    let exact = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "a.example.com"))
+    let secondProxy = CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "example.com"))
+    let rules = [suffix, exact, secondProxy]
+    for entries in [rules, Array(rules.reversed())] {
+      let collection = RulesCollection.load(
+        preset: .gfwlist, custom: { entries }, builtin: { rulesFixture($0) })
+      let result = try OfflineRuleMatcher.test(collection: collection, address: "a.example.com")
+      XCTAssertEqual(result.outcome, .proxy)
+      XCTAssertEqual(result.explanation, .singleAction)
+      XCTAssertEqual(
+        Set(result.deciding.compactMap(\.identity)), [exact.identity, secondProxy.identity])
+      XCTAssertEqual(result.otherMatches.isEmpty, true)
+      XCTAssertEqual(
+        try OfflineRuleMatcher.test(collection: collection, address: "notexample.com").outcome,
+        .direct)
+    }
+    let collection = RulesCollection.load(
+      preset: .gfwlist,
+      custom: { [suffix, exact] }, builtin: { rulesFixture($0) })
+    XCTAssertEqual(
+      try OfflineRuleMatcher.test(collection: collection, address: "example.com").outcome, .direct)
+    XCTAssertEqual(
+      try OfflineRuleMatcher.test(collection: collection, address: "b.example.com").outcome, .direct
+    )
+    let exactOnly = RulesCollection.load(
+      preset: .gfwlist, custom: { [exact] }, builtin: { rulesFixture($0) })
+    XCTAssertEqual(
+      try OfflineRuleMatcher.test(collection: exactOnly, address: "sub.a.example.com").outcome,
+      .direct)
+  }
+
+  func testIPOverlapAndMappedAddressesUseOnlySchemeAction() throws {
+    for reverseActions in [false, true] {
+      let broad = CustomRule(
+        action: reverseActions ? .direct : .proxy,
+        match: try RuleMatch(ipv4CIDR: "203.0.113.0/24"))
+      let narrow = CustomRule(
+        action: reverseActions ? .proxy : .direct,
+        match: try RuleMatch(ipv6CIDR: "::ffff:203.0.113.8/128"))
+      let collection = RulesCollection.load(
+        preset: .gfwlist,
+        custom: { [broad, narrow] }, builtin: { rulesFixture($0) })
+      for address in ["203.0.113.8", "::ffff:203.0.113.8"] {
+        let result = try OfflineRuleMatcher.test(collection: collection, address: address)
+        XCTAssertEqual(result.outcome, .proxy)
+        XCTAssertEqual(result.explanation, .singleAction)
+        XCTAssertEqual(
+          result.deciding.map(\.identity), [reverseActions ? narrow.identity : broad.identity])
+        XCTAssertEqual(
+          result.otherMatches.map(\.identity), [])
+      }
+      XCTAssertEqual(
+        try OfflineRuleMatcher.test(collection: collection, address: "203.0.113.9").outcome,
+        reverseActions ? .direct : .proxy)
+      XCTAssertEqual(
+        try OfflineRuleMatcher.test(collection: collection, address: "198.51.100.8").outcome,
+        .direct)
+      XCTAssertEqual(
+        try OfflineRuleMatcher.test(collection: collection, address: "unresolved.example").outcome,
+        .direct)
+    }
+  }
+
+  func testFixedPolicyWinsAndSourceMembershipsRemainComplete() throws {
+    let proxy = ProxyRule(action: .proxy, match: .localSuffix)
+    let collection = RulesCollection.load(
+      preset: .gfwlist,
+      custom: { [] },
+      builtin: {
+        rulesFixture($0, rules: $0 == .gfwlist ? [proxy] : [])
+      })
+    for address in [
+      "printer", "localhost", "a.localhost", "host.local", "127.0.0.1", "192.168.1.2",
+      "::1", "::ffff:192.168.1.2", "fe80::1",
+    ] {
+      let result = try OfflineRuleMatcher.test(collection: collection, address: address)
+      XCTAssertEqual(result.outcome, .direct, address)
+      XCTAssertEqual(result.explanation, .fixedLocal, address)
+      XCTAssertTrue(result.deciding.allSatisfy(\.isFixed))
+    }
+    let local = try OfflineRuleMatcher.test(collection: collection, address: "host.local")
+    XCTAssertEqual(local.otherMatches.map(\.identity), [proxy])
+    let match = try RuleMatch(domainExact: "example.com")
+    let custom = CustomRule(action: .proxy, match: match)
+    let duplicate = ProxyRule(action: .proxy, match: match)
+    let merged = RulesCollection.load(
+      preset: .gfwlist,
+      custom: { [custom] },
+      builtin: {
+        rulesFixture($0, rules: $0 == .gfwlist ? [duplicate] : [])
+      })
+    let result = try OfflineRuleMatcher.test(collection: merged, address: "example.com")
+    XCTAssertEqual(result.deciding.count, 1)
+    XCTAssertEqual(result.deciding[0].sources, [.custom, .gfwlist])
+    XCTAssertEqual(result.deciding[0].customIDs, [custom.id])
+  }
+
+  func testInvalidInputsAreOperationErrorsRatherThanUnmatched() throws {
+    let collection = RulesCollection.load(
+      preset: .gfwlist, custom: { [] }, builtin: { rulesFixture($0) })
+    for input in [
+      "", " ", "example..com", "example.com..", "-example.com", "example-.com",
+      "https:///path", "https://", "file:///tmp/test", "203.0.113.999", "203.0.113.8/32",
+      "2001:db8::xyz", "example.com:443", "a example.com", "*.example.com",
+      "https://example.com:99999",
+      "https://ex%61mple.com", "例子.com", "https://例子.com",
+    ] {
+      XCTAssertThrowsError(
+        try OfflineRuleMatcher.test(collection: collection, address: input), input
+      ) {
+        XCTAssertEqual($0 as? OfflineRuleMatcher.Failure, .invalidTarget, input)
+      }
+    }
+    let valid = try OfflineRuleMatcher.test(
+      collection: collection, address: "XN--BCHER-KVA.example.")
+    XCTAssertEqual(valid.target, "xn--bcher-kva.example")
+    XCTAssertEqual(valid.outcome, .direct)
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/OfflineRulesWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Rules/OfflineRulesWorkflowTests.swift
new file mode 100644
index 000000000..59d256ace
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/OfflineRulesWorkflowTests.swift
@@ -0,0 +1,104 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class OfflineRulesWorkflowTests: XCTestCase {
+  func testAddressTestUsesCompleteSavedCollectionDespiteBrowsingFilters() async throws {
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "example.com"))
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadCustom: { [rule] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(search: "hidden", action: .direct, source: .chinaIPv4))
+    XCTAssertTrue(workflow.snapshot.rows.isEmpty)
+    workflow.setTestTarget("a.example.com")
+    await workflow.testAddress()
+    let result = try XCTUnwrap(workflow.snapshot.addressTest.result)
+    XCTAssertEqual(result.outcome, .proxy)
+    XCTAssertEqual(result.version, workflow.snapshot.version)
+    XCTAssertEqual(result.deciding.map(\.identity), [rule.identity])
+    XCTAssertTrue(result.domainWithoutDNS)
+  }
+  func testInvalidAndIncompleteCollectionsExposeOperationErrors() async throws {
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadCustom: { [] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    workflow.setTestTarget("example.com")
+    await workflow.testAddress()
+    XCTAssertEqual(workflow.snapshot.addressTest.failure, .incompleteCollection)
+    await workflow.refresh()
+    workflow.setTestTarget("https://")
+    await workflow.testAddress()
+    XCTAssertEqual(workflow.snapshot.addressTest.failure, .invalidTarget)
+    XCTAssertNil(workflow.snapshot.addressTest.result)
+    let incomplete = RulesWorkflow(
+      preset: .gfwlist, loadCustom: { [] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { _ in throw RuleSnapshotError.missing }))
+    await incomplete.refresh()
+    incomplete.setTestTarget("localhost")
+    await incomplete.testAddress()
+    XCTAssertEqual(incomplete.snapshot.addressTest.failure, .incompleteCollection)
+    XCTAssertNil(incomplete.snapshot.addressTest.result)
+  }
+
+  func testPublicRefreshClearsOldResultAndUsesNewSavedVersion() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let proxy = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "example.com"))
+    try store.save([proxy])
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadCustom: { try store.load() },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.setTestTarget("example.com")
+    await workflow.testAddress()
+    let version = workflow.snapshot.addressTest.result?.version
+    try store.save([CustomRule(action: .direct, match: proxy.match)])
+    await workflow.refresh()
+    XCTAssertNil(workflow.snapshot.addressTest.result)
+    XCTAssertFalse(workflow.snapshot.addressTest.isTesting)
+    XCTAssertNotEqual(workflow.snapshot.version, version)
+    XCTAssertEqual(workflow.snapshot.addressTest.target, "example.com")
+    await workflow.testAddress()
+    XCTAssertEqual(workflow.snapshot.addressTest.result?.outcome, .direct)
+    try Data("broken".utf8).write(to: store.fileURL)
+    await workflow.refresh()
+    await workflow.testAddress()
+    XCTAssertEqual(workflow.snapshot.addressTest.failure, .incompleteCollection)
+    XCTAssertNil(workflow.snapshot.addressTest.result)
+  }
+
+  func testClearingTargetOrStartingRefreshPreventsLateTestPublication() async throws {
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "example.com"))
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadCustom: { [rule] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.setTestTarget("example.com")
+    await workflow.testAddress()
+    workflow.setTestTarget("")
+    XCTAssertNil(workflow.snapshot.addressTest.result)
+    XCTAssertNil(workflow.snapshot.addressTest.failure)
+
+    // Queue a new public command as soon as the old test starts. The old
+    // detached task must not publish after that command invalidates its intent.
+    for refresh in [false, true] {
+      workflow.setTestTarget("example.com")
+      var invalidation: Task<Void, Never>?
+      let observation = workflow.$snapshot.sink { page in
+        guard page.addressTest.isTesting, invalidation == nil else { return }
+        invalidation = Task { @MainActor in
+          if refresh { await workflow.refresh() } else { workflow.setTestTarget("") }
+        }
+      }
+      await workflow.testAddress()
+      await invalidation?.value
+      observation.cancel()
+      XCTAssertNil(workflow.snapshot.addressTest.result)
+      XCTAssertFalse(workflow.snapshot.addressTest.isTesting)
+    }
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/ProxyRuleTests.swift b/ShadowsocksX-NG2/Tests/Rules/ProxyRuleTests.swift
new file mode 100644
index 000000000..6d4f5799c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/ProxyRuleTests.swift
@@ -0,0 +1,138 @@
+import Foundation
+import Testing
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 规则领域模型：动作与匹配条件独立于
+/// PAC、ACL 文本和系统代理设置。
+final class ProxyRuleTests: XCTestCase {
+  // MARK: - 动作与匹配
+
+  func testActionsAreProxyAndDirect() throws {
+    XCTAssertEqual(RuleAction.proxy.rawValue, "proxy")
+    XCTAssertEqual(RuleAction.direct.rawValue, "direct")
+  }
+
+  func testMatchKindsCoverDomainAndCIDR() throws {
+    let exact = try RuleMatch(domainExact: "api.example.com")
+    let suffix = try RuleMatch(domainSuffix: "example.com")
+    // swiftlint:disable:next identifier_name
+    let v4 = try RuleMatch(ipv4CIDR: "203.0.113.0/24")
+    // swiftlint:disable:next identifier_name
+    let v6 = try RuleMatch(ipv6CIDR: "2001:db8::/32")
+
+    XCTAssertEqual(exact.pattern, .domainExact("api.example.com"))
+    XCTAssertEqual(suffix.pattern, .domainSuffix("example.com"))
+    XCTAssertEqual(v4.pattern, .ipv4CIDR("203.0.113.0/24"))
+    XCTAssertEqual(v6.pattern, .ipv6CIDR("2001:db8::/32"))
+  }
+
+  func testDomainExactRejectsSuffixSemantics() throws {
+    XCTAssertThrowsError(try RuleMatch(domainExact: "example.com."))
+    XCTAssertThrowsError(try RuleMatch(domainExact: ".example.com"))
+    XCTAssertThrowsError(try RuleMatch(domainExact: "*.example.com"))
+    XCTAssertThrowsError(try RuleMatch(domainExact: ""))
+    XCTAssertThrowsError(try RuleMatch(domainExact: "exa mple.com"))
+    XCTAssertThrowsError(try RuleMatch(domainExact: "例子.com"))
+  }
+
+  func testDomainSuffixNormalizesAndRejectsInvalid() throws {
+    XCTAssertEqual(try RuleMatch(domainSuffix: "Example.COM").pattern, .domainSuffix("example.com"))
+    XCTAssertEqual(
+      try RuleMatch(domainSuffix: ".example.com").pattern, .domainSuffix("example.com"))
+    XCTAssertThrowsError(try RuleMatch(domainSuffix: "example.com."))
+    XCTAssertThrowsError(try RuleMatch(domainSuffix: "*.example.com"))
+    XCTAssertThrowsError(try RuleMatch(domainSuffix: ""))
+    XCTAssertThrowsError(try RuleMatch(domainSuffix: "localhost"))
+    XCTAssertThrowsError(try RuleMatch(domainSuffix: "com"), "单标签后缀不允许，避免过宽匹配")
+  }
+
+  func testIPv4CIDRNormalizesHostAddressesAndRejectsInvalid() throws {
+    XCTAssertEqual(try RuleMatch(ipv4CIDR: "203.0.113.7").pattern, .ipv4CIDR("203.0.113.7/32"))
+    XCTAssertEqual(try RuleMatch(ipv4CIDR: "203.0.113.0/24").pattern, .ipv4CIDR("203.0.113.0/24"))
+    // 主机位非零的前缀按网络地址规范化。
+    XCTAssertEqual(try RuleMatch(ipv4CIDR: "203.0.113.15/24").pattern, .ipv4CIDR("203.0.113.0/24"))
+    XCTAssertThrowsError(try RuleMatch(ipv4CIDR: "203.0.113.0/33"))
+    XCTAssertThrowsError(try RuleMatch(ipv4CIDR: "203.0.113.256/24"))
+    XCTAssertThrowsError(try RuleMatch(ipv4CIDR: "2001:db8::/32"), "IPv6 不得进入 IPv4 匹配")
+    XCTAssertThrowsError(try RuleMatch(ipv4CIDR: "not-an-ip"))
+  }
+
+  func testIPv6CIDRNormalizesAndRejectsInvalid() throws {
+    XCTAssertEqual(try RuleMatch(ipv6CIDR: "2001:db8::/32").pattern, .ipv6CIDR("2001:db8::/32"))
+    XCTAssertEqual(
+      try RuleMatch(ipv6CIDR: "2001:DB8:0:0:0:0:0:0/32").pattern, .ipv6CIDR("2001:db8::/32"))
+    XCTAssertThrowsError(try RuleMatch(ipv6CIDR: "2001:db8::/129"))
+    XCTAssertThrowsError(try RuleMatch(ipv6CIDR: "203.0.113.0/24"), "IPv4 不得进入 IPv6 匹配")
+    XCTAssertThrowsError(try RuleMatch(ipv6CIDR: "gggg::/32"))
+  }
+
+  // MARK: - 规则序列化
+
+  func testCustomRuleStorageKeepsFlatActionAndMatch() throws {
+    let rule = ProxyRule(action: .direct, match: try RuleMatch(domainSuffix: "example.com"))
+    let document = CustomRuleDocument(rules: [CustomRule(action: rule.action, match: rule.match)])
+    let data = try CustomRuleStore.encode(document)
+    let json = try XCTUnwrap(JSONSerialization.jsonObject(with: data) as? [String: Any])
+    let entry = try XCTUnwrap((json["rules"] as? [[String: Any]])?.first)
+    XCTAssertEqual(Set(entry.keys), ["id", "action", "match"])
+    XCTAssertEqual(try CustomRuleStore.decode(data).rules.first?.rule, rule)
+  }
+}
+
+struct NormalizedRuleValueTests {
+  private struct HistoricalCase {
+    let match: RuleMatch
+    let token: String
+    let acl: String
+  }
+
+  @Test func equivalentInputsShareIdentityTokensAndACL() throws {
+    let first = ProxyRule(action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.15/24"))
+    let second = ProxyRule(action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24"))
+    #expect(first == second)
+    #expect(Set([first, second]).count == 1)
+    #expect(first.contentToken == "direct|ipv4CIDR(\"203.0.113.0/24\")")
+    #expect(first.aclLine == "203.0.113.0/24")
+    #expect(first.match.pattern == .ipv4CIDR("203.0.113.0/24"))
+    let mapped = ProxyRule(
+      action: .direct, match: try RuleMatch(ipv6CIDR: "::ffff:203.0.113.0/120"))
+    #expect(first != mapped)
+  }
+
+  @Test func historicalTokensAndACLRenderingSurviveRepresentationChange() throws {
+    let cases = [
+      HistoricalCase(
+        match: try RuleMatch(domainExact: " API.Example.COM "),
+        token: "proxy|domainExact(\"api.example.com\")", acl: "|api.example.com"),
+      HistoricalCase(
+        match: try RuleMatch(domainSuffix: ".Example.COM"),
+        token: "proxy|domainSuffix(\"example.com\")", acl: "||example.com"),
+      HistoricalCase(
+        match: try RuleMatch(ipv6CIDR: "2001:DB8::8/32"),
+        token: "proxy|ipv6CIDR(\"2001:db8::/32\")", acl: "2001:db8::/32"),
+    ]
+    for item in cases {
+      let rule = ProxyRule(action: .proxy, match: item.match)
+      #expect(rule.contentToken == item.token)
+      #expect(rule.aclLine == item.acl)
+    }
+  }
+
+  @Test func fixedSuffixesRoundTripThroughSnapshotButRemainUnavailableToCustomRules() throws {
+    let fixed = [RuleMatch.localSuffix, .localhostSuffix]
+    let rules = fixed.map { ProxyRule(action: .direct, match: $0) }
+    let snapshot = rulesFixture(.geolocationCN, rules: rules)
+    let decoded = try RuleSnapshotStore.decode(RuleSnapshotStore.encode(snapshot))
+    #expect(decoded == snapshot)
+    for match in fixed {
+      let custom = CustomRule(action: .direct, match: match)
+      let data = try CustomRuleStore.encode(CustomRuleDocument(rules: [custom]))
+      #expect(throws: (any Error).self) { try CustomRuleStore.decode(data) }
+    }
+    for value in ["local", "localhost", "com"] {
+      #expect(throws: RuleMatchError.self) { try RuleMatch(nationalDomainSuffix: value) }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RuleAnalysisTests.swift b/ShadowsocksX-NG2/Tests/Rules/RuleAnalysisTests.swift
new file mode 100644
index 000000000..1c086bb84
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RuleAnalysisTests.swift
@@ -0,0 +1,106 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class RuleAnalysisTests: XCTestCase {
+  func testDomainShadowingSeparatesFullCoverageFromPartialOverlap() throws {
+    let broad = CustomRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "example.com"))
+    let narrow = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "a.example.com"))
+    let partial = RuleAnalysis(rules: [broad.proxyRule, narrow.proxyRule])
+    XCTAssertEqual(
+      partial.relationships,
+      [
+        RuleRelationship(
+          rule: broad.identity, kind: .shadowing, extent: .partial,
+          covering: [narrow.identity])
+      ])
+    let full = RuleAnalysis(rules: [
+      broad.proxyRule,
+      CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "example.com"))
+        .proxyRule,
+    ])
+    XCTAssertEqual(full.relationships.first?.extent, .full)
+  }
+  func testIdentityNormalizesContentWithoutUsingCustomUUIDOrMergingFamilies() throws {
+    let host = CustomRule(action: .proxy, match: try RuleMatch(ipv4CIDR: "203.0.113.8"))
+    let cidr = CustomRule(action: .proxy, match: try RuleMatch(ipv4CIDR: "203.0.113.8/32"))
+    XCTAssertNotEqual(host.id, cidr.id)
+    XCTAssertEqual(host.identity, cidr.identity)
+    XCTAssertEqual(host.contentToken, cidr.contentToken)
+    XCTAssertNotEqual(
+      host.identity,
+      CustomRule(action: .direct, match: host.match).identity)
+    XCTAssertNotEqual(
+      host.identity,
+      CustomRule(action: .proxy, match: try RuleMatch(ipv6CIDR: "::ffff:203.0.113.8/128")).identity)
+    XCTAssertEqual(
+      CustomRule(action: .direct, match: try RuleMatch(domainSuffix: ".Example.COM"))
+        .identity.match,
+      try RuleMatch(domainSuffix: "example.com"))
+  }
+
+  func testAnalysisAndVersionsDoNotDependOnDuplicateRulesOrCustomOrder() throws {
+    let custom = [
+      CustomRule(action: .direct, match: try RuleMatch(domainSuffix: "example.com")),
+      CustomRule(action: .direct, match: try RuleMatch(domainExact: "a.example.com")),
+      CustomRule(action: .proxy, match: try RuleMatch(domainExact: "a.example.com")),
+    ]
+    let builtIn = [
+      ProxyRule(action: .proxy, match: try RuleMatch(domainSuffix: "a.example.com"))
+    ]
+    let expected = RuleAnalysis(rules: builtIn + custom.map(\.proxyRule))
+    for order in [custom, Array(custom.reversed()), [custom[1], custom[2], custom[0]]] {
+      for sourceOrder in [builtIn, builtIn + builtIn] {
+        let actual = RuleAnalysis(rules: order.map(\.proxyRule) + sourceOrder)
+        XCTAssertEqual(actual, expected)
+        XCTAssertEqual(actual.contentVersion, expected.contentVersion)
+        XCTAssertEqual(CustomRuleSummary.summarizing(order), CustomRuleSummary.summarizing(custom))
+        for action in RuleDefaultAction.allCases {
+          XCTAssertEqual(
+            CustomRuleValidator.validate(
+              custom: order, builtIn: sourceOrder, defaultAction: action),
+            CustomRuleValidator.validate(custom: custom, builtIn: builtIn, defaultAction: action))
+        }
+      }
+    }
+    XCTAssertTrue(expected.relationships.contains { $0.kind == .absorption && $0.extent == .full })
+    XCTAssertTrue(
+      expected.relationships.contains { $0.kind == .shadowing && $0.extent == .partial })
+  }
+
+  func testIPCoverageCombinesNarrowerRangesAndKeepsPartialRemainder() throws {
+    let broad = CustomRule(action: .proxy, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24"))
+    let lower = CustomRule(action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.0/25"))
+    let upper = CustomRule(
+      action: .direct, match: try RuleMatch(ipv6CIDR: "::ffff:203.0.113.128/121"))
+    XCTAssertEqual(
+      RuleAnalysis(rules: [broad.proxyRule, lower.proxyRule])
+        .relationships.first?.extent, .partial)
+    let full = RuleAnalysis(rules: [upper.proxyRule, broad.proxyRule, lower.proxyRule])
+    XCTAssertEqual(full.relationships.first?.extent, .full)
+    XCTAssertEqual(full.relationships.first?.covering.count, 2)
+  }
+
+  func testSuffixBoundaryAndMappedCoverageFollowSslocal() throws {
+    XCTAssertFalse(
+      RuleCoverage.domainIntersects(
+        try RuleMatch(domainSuffix: "example.com"),
+        try RuleMatch(domainExact: "notexample.com")))
+    XCTAssertFalse(
+      RuleCoverage.domainCovers(
+        try RuleMatch(domainExact: "example.com"), try RuleMatch(domainExact: "a.example.com")))
+    XCTAssertTrue(
+      RuleCoverage.ipCovers(
+        try RuleMatch(ipv4CIDR: "203.0.113.0/24"), try RuleMatch(ipv6CIDR: "::ffff:203.0.113.8/128")
+      ))
+    XCTAssertTrue(
+      RuleCoverage.ipCovers(
+        try RuleMatch(ipv6CIDR: "::ffff:203.0.113.0/120"), try RuleMatch(ipv4CIDR: "203.0.113.8/32")
+      ))
+    XCTAssertFalse(
+      RuleCoverage.ipIntersects(
+        try RuleMatch(ipv4CIDR: "203.0.113.0/24"), try RuleMatch(ipv6CIDR: "2001:db8::/32")))
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RuleEnablementControllerTests.swift b/ShadowsocksX-NG2/Tests/Rules/RuleEnablementControllerTests.swift
new file mode 100644
index 000000000..ac5ebb75c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RuleEnablementControllerTests.swift
@@ -0,0 +1,393 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class RuleEnablementControllerTests: ProxyRuntimeControllerTests {
+  override func makeDefaultRuleSnapshots() -> BuiltinRuleSnapshots {
+    BuiltinRuleSnapshots(loader: ProxyRuntimeFixture.controlFlowRuleSnapshot)
+  }
+
+  private func makeRuleEnablementController(
+    store: CustomRuleStore,
+    settings: ProxyRuntimeSettings,
+    proxyMode: ProxyMode? = nil,
+    launchHealthTimeoutSeconds: TimeInterval = 0.05,
+    ruleSnapshots: BuiltinRuleSnapshots? = nil,
+    launchHealthRetryDelay: @escaping () async throws -> Void = {
+      try await Task.sleep(for: .milliseconds(1))
+    },
+    ruleApplicationDelay: @escaping () async throws -> Void = { await Task.yield() }
+  ) -> ProxyRuntimeController {
+    makeControllerWithCustomRules(
+      store: store, settings: settings, proxyMode: proxyMode,
+      launchHealthTimeoutSeconds: launchHealthTimeoutSeconds,
+      launchHealthRetryDelay: launchHealthRetryDelay,
+      ruleApplicationDelay: ruleApplicationDelay,
+      ruleSnapshots: ruleSnapshots)
+  }
+
+  func testRapidRuleSavesCoalesceIntoOneLatestACLDeployment() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let first = CustomRule(action: .direct, match: try RuleMatch(domainExact: "first-save.example"))
+    let latest = CustomRule(
+      action: .direct, match: try RuleMatch(domainExact: "latest-save.example"))
+    let applicationStarted = expectation(description: "rule application paused")
+    let applicationGate = RuleRuntimeDelayGate(started: applicationStarted)
+    defer { applicationGate.resume() }
+    let controller = makeRuleEnablementController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .rule,
+        rulePreset: .chinaDirect, agentEnabled: true),
+      proxyMode: .rule, ruleApplicationDelay: { try await applicationGate.wait() })
+    try await controller.activate(seeded.server)
+    let before = agent.registerCount
+    let one = await controller.commitRuleDocument(CustomRuleDocument(rules: [first]))
+    try await withRuleApplicationTask(
+      try XCTUnwrap(controller.ruleApplicationTask), controller: controller,
+      release: applicationGate.resume,
+      body: {
+        try await requireTestPhase([applicationStarted], timeout: 3)
+        let two = await controller.commitRuleDocument(CustomRuleDocument(rules: [latest]))
+        XCTAssertEqual(one.outcome, .saved)
+        XCTAssertEqual(two.outcome, .saved)
+        XCTAssertEqual(try store.load(), [latest])
+        XCTAssertEqual(
+          agent.registerCount, before, "Saving does not wait for or start deployment inline")
+        applicationGate.resume()
+        await controller.ruleApplicationTask?.value
+        XCTAssertEqual(agent.registerCount, before + 1)
+        let content = try activeACLContent(RuntimeFileStore(fileURL: runtime.contract))
+        XCTAssertTrue(content.contains("latest-save.example"))
+        XCTAssertFalse(content.contains("first-save.example"))
+      })
+  }
+
+  func testSaveDuringDeploymentIsAcceptedAndLatestDocumentConvergesAfterIt() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let first = CustomRule(action: .direct, match: try RuleMatch(domainExact: "in-flight.example"))
+    let latest = CustomRule(
+      action: .direct, match: try RuleMatch(domainExact: "after-flight.example"))
+    let healthWaiting = expectation(description: "health retry paused")
+    let healthGate = RuleRuntimeDelayGate(started: healthWaiting)
+    defer { healthGate.resume() }
+    let controller = makeRuleEnablementController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .rule,
+        rulePreset: .chinaDirect, agentEnabled: true),
+      proxyMode: .rule, launchHealthTimeoutSeconds: 0.3,
+      launchHealthRetryDelay: { try await healthGate.wait() })
+    try await controller.activate(seeded.server)
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let started = expectation(description: "first deployment awaiting receipt")
+    let before = agent.registerCount
+    var firstDocument: PublishedRuntimeConfiguration?
+    agent.onRegister = { [agent] in
+      guard let document = runtimeStore.loadDocument() else { return }
+      if agent?.registerCount == before + 1 {
+        firstDocument = document
+        try? FileManager.default.removeItem(at: runtimeStore.runtimeStatusFileURL)
+        started.fulfill()
+      } else {
+        try? runtimeStore.writeRuntimeReceipt(for: document, processID: 42)
+      }
+    }
+    let one = await controller.commitRuleDocument(CustomRuleDocument(rules: [first]))
+    XCTAssertEqual(one.outcome, .saved)
+    try await withRuleApplicationTask(
+      try XCTUnwrap(controller.ruleApplicationTask), controller: controller,
+      release: healthGate.resume,
+      body: {
+        try await requireTestPhase([started, healthWaiting], timeout: 3)
+        let two = await controller.commitRuleDocument(CustomRuleDocument(rules: [latest]))
+        XCTAssertEqual(two.outcome, .saved)
+        XCTAssertEqual(try store.load(), [latest])
+        XCTAssertEqual(
+          agent.registerCount, before + 1, "A new save cannot overlap rule deployments")
+        try runtimeStore.writeRuntimeReceipt(for: XCTUnwrap(firstDocument), processID: 42)
+        healthGate.resume()
+        try await assertLatestRuleDeployment(
+          LatestRuleDeploymentAssertion(
+            controller: controller, store: store, runtimeStore: runtimeStore,
+            expectedRule: latest, expectedRegistrations: before + 2, agent: agent))
+      })
+  }
+
+  func testNewPreparationStopsRemainingActionsOfAnAwaitingRuntimeOperation() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let started = expectation(description: "new source preparation")
+    let loader = PausedRuntimeRuleSource(started: started)
+    defer { loader.resume() }
+    let controller = makeRuleEnablementController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .global,
+        rulePreset: .chinaDirect, agentEnabled: true),
+      proxyMode: .global, ruleSnapshots: BuiltinRuleSnapshots(loader: { await loader.load($0) }))
+    try await controller.activate(seeded.server)
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let previous = try XCTUnwrap(runtimeStore.loadDocument())
+    try Data("42".utf8).write(to: runtimeStore.pidFileURL)
+    let unregistered = expectation(description: "old operation waiting for wrapper exit")
+    agent.onUnregister = { unregistered.fulfill() }
+    let oldOperation = Task { await controller.execute(.stop, document: nil) }
+    try await withTestTask(
+      oldOperation, release: { loader.resume() },
+      body: {
+        try await requireTestPhase([unregistered], timeout: 3)
+        let newMode = Task { await controller.setProxyMode(.rule) }
+        try await withTestTask(
+          newMode, release: { loader.resume() },
+          body: {
+            try await requireTestPhase([started], timeout: 3)
+            try FileManager.default.removeItem(at: runtimeStore.pidFileURL)
+            let completed = await oldOperation.value
+            XCTAssertFalse(completed.succeeded)
+            XCTAssertEqual(
+              runtimeStore.loadDocument(), previous, "Stale stop must not delete the contract")
+            loader.resume()
+            await newMode.value
+            XCTAssertEqual(controller.runtimeObservation?.aclSummary, "rule-proxy-default")
+            XCTAssertEqual(controller.state, .running)
+          })
+      })
+  }
+
+  func testSystemProxyToggleDoesNotDiscardPendingRuleModePreparation() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let started = expectation(description: "background source preparation")
+    let loader = PausedRuntimeRuleSource(started: started)
+    defer { loader.resume() }
+    let controller = makeRuleEnablementController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .global,
+        rulePreset: .chinaDirect, agentEnabled: true),
+      proxyMode: .global, ruleSnapshots: BuiltinRuleSnapshots(loader: { await loader.load($0) }))
+    try await controller.activate(seeded.server)
+    let modeSwitch = Task { await controller.setProxyMode(.rule) }
+    try await withTestTask(
+      modeSwitch, release: { loader.resume() },
+      body: {
+        try await requireTestPhase([started], timeout: 3)
+        await controller.setSystemProxyEnabled(true)
+        loader.resume()
+        await modeSwitch.value
+        XCTAssertEqual(controller.proxyMode, .rule)
+        XCTAssertTrue(controller.settings.systemProxyEnabled)
+        XCTAssertEqual(controller.runtimeObservation?.aclSummary, "rule-proxy-default")
+        XCTAssertEqual(controller.state, .running)
+      })
+  }
+
+  func testOffIntentDuringSharedSourcePreparationCannotBeOverwritten() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let started = expectation(description: "background source preparation")
+    let loader = PausedRuntimeRuleSource(started: started)
+    defer { loader.resume() }
+    let snapshots = BuiltinRuleSnapshots(loader: { await loader.load($0) })
+    let settings = ProxyRuntimeSettings(
+      listen: ActivationFixture.listen, preferredMode: .global,
+      rulePreset: .chinaDirect, agentEnabled: true)
+    let controller = makeRuleEnablementController(
+      store: store, settings: settings, proxyMode: .global, ruleSnapshots: snapshots)
+    try await controller.activate(seeded.server)
+    let modeSwitch = Task { await controller.setProxyMode(.rule) }
+    try await withTestTask(
+      modeSwitch, release: { loader.resume() },
+      body: {
+        try await requireTestPhase([started], timeout: 3)
+        let identity = ProxyRule(action: .proxy, match: try RuleMatch(domainExact: "kept.example"))
+        let ruleCommit = Task {
+          await controller.commitRuleDocument(
+            CustomRuleDocument(rules: [], disabledIdentities: [identity]))
+        }
+        try await withRuleApplicationTask(
+          ruleCommit, controller: controller, release: loader.resume,
+          body: {
+            // Persistence happens before the awaited source. Observe the owner, not timing.
+            try await requireTestCondition("rule document persisted") {
+              controller.ruleDocuments.current?.disabledIdentities.contains(identity) == true
+            }
+            await controller.setAgentEnabled(false)
+            let registrationsAfterStop = agent.registerCount
+            loader.resume()
+            await modeSwitch.value
+            let result = await ruleCommit.value
+            XCTAssertEqual(result.outcome, .saved)
+            await controller.ruleApplicationTask?.value
+            XCTAssertEqual(result.document?.disabledIdentities, [identity])
+            XCTAssertEqual(try store.loadDocument().disabledIdentities, [identity])
+            XCTAssertEqual(controller.state, .off)
+            XCTAssertFalse(controller.settings.agentEnabled)
+            XCTAssertEqual(agent.registerCount, registrationsAfterStop)
+            XCTAssertNil(RuntimeFileStore(fileURL: runtime.contract).loadDocument())
+          })
+      })
+  }
+
+  func testNewModeSupersedesRulePreparationWithoutRestoringOldMode() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let started = expectation(description: "background source preparation")
+    let loader = PausedRuntimeRuleSource(started: started)
+    defer { loader.resume() }
+    let controller = makeRuleEnablementController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, preferredMode: .global,
+        rulePreset: .chinaDirect, agentEnabled: true),
+      proxyMode: .global, ruleSnapshots: BuiltinRuleSnapshots(loader: { await loader.load($0) }))
+    try await controller.activate(seeded.server)
+    let old = Task { await controller.setProxyMode(.rule) }
+    try await withTestTask(
+      old, release: { loader.resume() },
+      body: {
+        try await requireTestPhase([started], timeout: 3)
+        await controller.setProxyMode(.direct)
+        loader.resume()
+        await old.value
+        XCTAssertEqual(controller.proxyMode, .direct)
+        XCTAssertEqual(controller.state, .running)
+        XCTAssertEqual(
+          RuntimeFileStore(fileURL: runtime.contract).loadDocument()?.aclRuntime?.summary, "direct")
+      })
+  }
+
+}
+
+extension RuleEnablementControllerTests {
+  func testAgentOffDuringDeploymentCannotBeOverwrittenByOldRuleTransaction() async throws {
+    try await interruptRuleDeployment(switchMode: false)
+  }
+
+  func testModeSwitchDuringDeploymentCannotBeOverwrittenByOldRuleTransaction() async throws {
+    try await interruptRuleDeployment(switchMode: true)
+  }
+
+  private func interruptRuleDeployment(switchMode: Bool) async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let rule = CustomRule(action: .direct, match: try RuleMatch(domainExact: "kept.example"))
+    try store.save([rule])
+    let settings = ProxyRuntimeSettings(
+      listen: ActivationFixture.listen, preferredMode: .rule,
+      rulePreset: .chinaDirect, agentEnabled: true)
+    let deploymentWaiting = expectation(description: "deployment health retry paused")
+    let deploymentGate = RuleRuntimeDelayGate(started: deploymentWaiting)
+    defer { deploymentGate.resume() }
+    var deploymentIsRunning = false
+    let controller = makeRuleEnablementController(
+      store: store, settings: settings, proxyMode: .rule,
+      launchHealthTimeoutSeconds: 0.05,
+      launchHealthRetryDelay: {
+        if deploymentIsRunning {
+          try await deploymentGate.wait()
+        } else {
+          try await Task.sleep(for: .milliseconds(1))
+        }
+      })
+    try await controller.activate(seeded.server)
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let initialRegistrations = agent.registerCount
+    configureDeploymentReceipts(runtimeStore, initialRegistrations: initialRegistrations) {
+      deploymentIsRunning = true
+    }
+    let disabledDocument = CustomRuleDocument(rules: [rule], disabledIdentities: [rule.identity])
+    let pending = Task { await controller.commitRuleDocument(disabledDocument).outcome }
+    try await withRuleApplicationTask(
+      pending, controller: controller, release: deploymentGate.resume,
+      body: {
+        try await requireTestPhase([deploymentWaiting], timeout: 5)
+        if switchMode {
+          await controller.setProxyMode(.global)
+        } else {
+          await controller.setAgentEnabled(false)
+        }
+        let registrations = agent.registerCount
+        deploymentGate.resume()
+        let outcome = await pending.value
+        XCTAssertEqual(outcome, .saved)
+        await controller.ruleApplicationTask?.value
+        try assertInterruptedDeploymentState(
+          InterruptedDeploymentAssertion(
+            controller: controller, store: store, runtimeStore: runtimeStore, rule: rule,
+            switchMode: switchMode, expectedRegistrations: registrations, agent: agent))
+      })
+  }
+
+  private func configureDeploymentReceipts(
+    _ runtimeStore: RuntimeFileStore,
+    initialRegistrations: Int,
+    onDeployment: @escaping () -> Void
+  ) {
+    agent.onRegister = { [agent] in
+      if agent?.registerCount == initialRegistrations + 1 {
+        onDeployment()
+        try? FileManager.default.removeItem(at: runtimeStore.runtimeStatusFileURL)
+      } else {
+        try? runtimeStore.writePublishedRuntimeReceipt(processID: 42)
+      }
+    }
+  }
+
+  func testFailedDisableKeepsSavedIntentAndReportsDeploymentFailure() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let rule = CustomRule(action: .direct, match: try RuleMatch(domainExact: "kept.example"))
+    try store.save([rule])
+    let settings = ProxyRuntimeSettings(
+      listen: ActivationFixture.listen, preferredMode: .rule,
+      rulePreset: .chinaDirect, agentEnabled: true)
+    let controller = makeRuleEnablementController(
+      store: store, settings: settings, proxyMode: .rule)
+    try await controller.activate(seeded.server)
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    agent.onRegister = {
+      try? FileManager.default.removeItem(at: runtimeStore.runtimeStatusFileURL)
+    }
+    let result = await controller.commitRuleDocument(
+      CustomRuleDocument(rules: [rule], disabledIdentities: [rule.identity]))
+    XCTAssertEqual(result.outcome, .saved)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(
+      result.document, CustomRuleDocument(rules: [rule], disabledIdentities: [rule.identity]))
+    XCTAssertEqual(try store.loadDocument().disabledIdentities, [rule.identity])
+    XCTAssertNotNil(controller.runtimeFacts.failure)
+    XCTAssertNotEqual(controller.state, .running)
+  }
+}
+
+extension RuleEnablementControllerTests {
+  func testOffSaveUsesOwnedDocumentAndNewSessionRejectsCorruption() async throws {
+    let (store, _) = try makeCustomRuleStore()
+    let controller = makeRuleEnablementController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, rulePreset: .chinaDirect, agentEnabled: false))
+    let identity = ProxyRule(action: .proxy, match: try RuleMatch(domainExact: "saved.example"))
+    let outcome = await controller.commitRuleDocument(
+      CustomRuleDocument(rules: [], disabledIdentities: [identity])
+    ).outcome
+    XCTAssertEqual(outcome, .saved)
+    await controller.ruleApplicationTask?.value
+    XCTAssertEqual(agent.registerCount, 0)
+    XCTAssertEqual(try store.loadDocument().disabledIdentities, [identity])
+    let broken = Data("broken".utf8)
+    try broken.write(to: store.fileURL)
+    let newSession = makeRuleEnablementController(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, rulePreset: .chinaDirect, agentEnabled: false))
+    let rejected = await newSession.commitRuleDocument(CustomRuleDocument(rules: [])).outcome
+    XCTAssertEqual(rejected, .persistenceFailed)
+    XCTAssertEqual(try Data(contentsOf: store.fileURL), broken)
+    XCTAssertEqual(agent.registerCount, 0)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RuleEnablementDeploymentAssertions.swift b/ShadowsocksX-NG2/Tests/Rules/RuleEnablementDeploymentAssertions.swift
new file mode 100644
index 000000000..725335d35
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RuleEnablementDeploymentAssertions.swift
@@ -0,0 +1,50 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct LatestRuleDeploymentAssertion {
+  let controller: ProxyRuntimeController
+  let store: CustomRuleStore
+  let runtimeStore: RuntimeFileStore
+  let expectedRule: CustomRule
+  let expectedRegistrations: Int
+  let agent: ProxyRuntimeFixture.FakeLaunchAgent
+}
+
+@MainActor
+func assertLatestRuleDeployment(_ assertion: LatestRuleDeploymentAssertion) async throws {
+  await assertion.controller.ruleApplicationTask?.value
+  XCTAssertEqual(try assertion.store.load(), [assertion.expectedRule])
+  XCTAssertEqual(assertion.agent.registerCount, assertion.expectedRegistrations)
+  let data = try Data(contentsOf: assertion.runtimeStore.aclFileURL)
+  let content = String(bytes: data, encoding: .utf8) ?? ""
+  XCTAssertTrue(content.contains("after-flight.example"))
+  XCTAssertFalse(content.contains("in-flight.example"))
+  XCTAssertEqual(assertion.controller.state, .running)
+}
+
+@MainActor
+struct InterruptedDeploymentAssertion {
+  let controller: ProxyRuntimeController
+  let store: CustomRuleStore
+  let runtimeStore: RuntimeFileStore
+  let rule: CustomRule
+  let switchMode: Bool
+  let expectedRegistrations: Int
+  let agent: ProxyRuntimeFixture.FakeLaunchAgent
+}
+
+@MainActor
+func assertInterruptedDeploymentState(_ assertion: InterruptedDeploymentAssertion) throws {
+  XCTAssertEqual(try assertion.store.loadDocument().disabledIdentities, [assertion.rule.identity])
+  XCTAssertEqual(assertion.agent.registerCount, assertion.expectedRegistrations)
+  if assertion.switchMode {
+    XCTAssertEqual(assertion.controller.proxyMode, .global)
+    XCTAssertEqual(assertion.runtimeStore.loadDocument()?.aclRuntime?.summary, "global")
+  } else {
+    XCTAssertFalse(assertion.controller.settings.agentEnabled)
+    XCTAssertEqual(assertion.controller.state, .off)
+    XCTAssertNil(assertion.runtimeStore.loadDocument())
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RuleEnablementWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Rules/RuleEnablementWorkflowTests.swift
new file mode 100644
index 000000000..33c91d236
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RuleEnablementWorkflowTests.swift
@@ -0,0 +1,219 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class RuleEnablementWorkflowTests: XCTestCase {
+  func testSavedTogglesStayInteractiveAndOfflineMatchingUsesLatestFactsDuringAnalysis() async throws
+  {
+    let broad = CustomRule(
+      action: .direct, match: try RuleMatch(domainSuffix: "pending.example"))
+    let narrow = CustomRule(action: .direct, match: try RuleMatch(domainExact: "x.pending.example"))
+    let started = expectation(description: "analysis debounce paused")
+    let gate = RulesAnalysisGate(started: started)
+    var documents: [CustomRuleDocument] = []
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect, loadDocument: { CustomRuleDocument(rules: [broad, narrow]) },
+      commitDocument: {
+        documents.append($0)
+        return RuleDocumentCommit(outcome: .saved, document: $0)
+      },
+      analysisDelay: { await gate.wait() },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(source: .custom))
+    let originalOrder = workflow.snapshot.rows.map(\.id)
+    let oldRelationships = try XCTUnwrap(
+      workflow.snapshot.rows.first { $0.identity == narrow.identity }
+    ).relationships
+    XCTAssertFalse(oldRelationships.isEmpty)
+    await workflow.setEnabled(false, identities: [broad.identity])
+    await fulfillment(of: [started], timeout: 3)
+    XCTAssertTrue(workflow.snapshot.isComplete)
+    XCTAssertFalse(workflow.snapshot.isCommitting)
+    XCTAssertFalse(workflow.snapshot.rows.first { $0.identity == broad.identity }!.isEnabled)
+    XCTAssertEqual(
+      workflow.snapshot.rows.first { $0.identity == narrow.identity }!.relationships,
+      oldRelationships)
+    workflow.setTestTarget("other.pending.example")
+    await workflow.testAddress()
+    XCTAssertEqual(workflow.snapshot.addressTest.result?.outcome, .proxy)
+    await workflow.setEnabled(true, identities: [broad.identity])
+    await workflow.setEnabled(false, identities: [broad.identity])
+    XCTAssertEqual(documents.count, 3)
+    let version = workflow.snapshot.version
+    await gate.resume()
+    await workflow.analysisTask?.value
+    XCTAssertEqual(workflow.snapshot.version, version)
+    XCTAssertEqual(workflow.snapshot.rows.map(\.id), originalOrder)
+    XCTAssertFalse(workflow.snapshot.rows.first { $0.identity == broad.identity }!.isEnabled)
+    XCTAssertTrue(
+      workflow.snapshot.rows.first { $0.identity == narrow.identity }!.relationships.isEmpty)
+  }
+
+  func testCollectionSaveKeepsRowOrderAndFixedFactsWithoutWaitingForAnalysis() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let session = RuleDocumentSession(store: store)
+    let started = expectation(description: "analysis paused")
+    let gate = RulesAnalysisGate(started: started)
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect,
+      loadDocument: { try session.load() },
+      commitDocument: { session.commit($0) },
+      analysisDelay: { await gate.wait() },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { source in
+        if source == .geolocationCN {
+          return rulesFixture(
+            source,
+            rules: [
+              ProxyRule(action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn")),
+              ProxyRule(action: .direct, match: try RuleMatch(domainExact: "fixture.example")),
+            ])
+        }
+        return rulesFixture(source)
+      }))
+    await workflow.refresh()
+    XCTAssertTrue(workflow.snapshot.isComplete)
+    XCTAssertTrue(workflow.snapshot.sources.contains { $0.id == .geolocationCN })
+    workflow.query(RulesQuery())
+    let rowIDs = workflow.snapshot.rows.map(\.id)
+    let fixed = workflow.snapshot.rows.filter(\.isFixed)
+    XCTAssertFalse(fixed.isEmpty)
+    let nationalSuffix = ProxyRule(
+      action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn"))
+    await workflow.setEnabled(false, identities: [nationalSuffix])
+    XCTAssertTrue(try store.loadDocument().disabledIdentities.contains(nationalSuffix))
+    XCTAssertEqual(workflow.snapshot.rows.map(\.id), rowIDs)
+    XCTAssertEqual(workflow.snapshot.rows.filter(\.isFixed), fixed)
+    XCTAssertFalse(workflow.snapshot.rows.first { $0.identity == nationalSuffix }!.isEnabled)
+    XCTAssertTrue(workflow.snapshot.isComplete)
+    await fulfillment(of: [started], timeout: 3)
+    await gate.resume()
+    await workflow.analysisTask?.value
+    XCTAssertEqual(workflow.snapshot.rows.map(\.id), rowIDs)
+    XCTAssertEqual(workflow.snapshot.rows.filter(\.isFixed), fixed)
+  }
+
+  func testSuccessfulCommitDoesNotReadSourcesOrUserDocumentAgain() async throws {
+    let reads = RulesReadCounts()
+    let rule = CustomRule(action: .direct, match: try RuleMatch(domainExact: "saved.example"))
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect,
+      loadDocument: {
+        reads.recordDocument()
+        return CustomRuleDocument(rules: [rule])
+      },
+      commitDocument: { RuleDocumentCommit(outcome: .saved, document: $0) },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { source in
+        reads.recordSource()
+        return rulesFixture(source)
+      }))
+    await workflow.refresh()
+    await workflow.setEnabled(false, identities: [rule.identity])
+    XCTAssertEqual(reads.documentCount, 1)
+    XCTAssertEqual(reads.sourceCount, 2)
+    XCTAssertFalse(
+      try XCTUnwrap(workflow.snapshot.rows.first { $0.identity == rule.identity }).isEnabled)
+  }
+
+  func testInFlightBatchRejectsRepeatedCommandAndPublishesProgress() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "example.net"))
+    try store.save([rule])
+    let started = expectation(description: "commit started")
+    var continuation: CheckedContinuation<Void, Never>?
+    var commits = 0
+    let workflow = RulesWorkflow(
+      loadDocument: { try store.loadDocument() },
+      commitDocument: { document in
+        commits += 1
+        await withCheckedContinuation {
+          continuation = $0
+          started.fulfill()
+        }
+        do {
+          try store.saveDocument(document)
+          return RuleDocumentCommit(outcome: .saved, document: document)
+        } catch {
+          XCTFail("Fixture save failed: \(error)")
+          return RuleDocumentCommit(
+            outcome: .persistenceFailed, document: try? store.loadDocument())
+        }
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    let pending = Task { await workflow.setEnabled(false, identities: [rule.identity]) }
+    await fulfillment(of: [started], timeout: 3)
+    XCTAssertTrue(workflow.snapshot.isCommitting)
+    XCTAssertEqual(workflow.snapshot.operationStatus, .updating)
+    XCTAssertNil(workflow.snapshot.commitFeedback)
+    await workflow.setEnabled(false, identities: [rule.identity])
+    await workflow.refresh()
+    XCTAssertEqual(commits, 1)
+    continuation?.resume()
+    await pending.value
+    XCTAssertFalse(workflow.snapshot.isCommitting)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .saved)
+    let feedback = try XCTUnwrap(workflow.snapshot.commitFeedback)
+    XCTAssertEqual(feedback.changedCount, 1)
+    XCTAssertEqual(feedback.operation, .enablement(false))
+    XCTAssertEqual(workflow.snapshot.operationStatus, .feedback(feedback))
+    XCTAssertFalse(workflow.snapshot.rows.first { $0.identity == rule.identity }!.isEnabled)
+  }
+
+  func testFailedSaveKeepsSnapshotWithoutReload() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "kept.example"))
+    try store.save([rule])
+    var commits = 0
+    let workflow = RulesWorkflow(
+      loadDocument: { try store.loadDocument() },
+      commitDocument: { _ in
+        commits += 1
+        return RuleDocumentCommit(outcome: .persistenceFailed, document: try? store.loadDocument())
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    let version = workflow.snapshot.version
+    await workflow.setEnabled(false, identities: [rule.identity])
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .persistenceFailed)
+    XCTAssertEqual(workflow.snapshot.version, version)
+    XCTAssertTrue(workflow.snapshot.rows.first { $0.identity == rule.identity }!.isEnabled)
+    XCTAssertEqual(commits, 1)
+  }
+}
+
+private final class RulesReadCounts: @unchecked Sendable {
+  private let lock = NSLock()
+  private var documents = 0
+  private var sources = 0
+  func recordDocument() { lock.withLock { documents += 1 } }
+  func recordSource() { lock.withLock { sources += 1 } }
+  var documentCount: Int { lock.withLock { documents } }
+  var sourceCount: Int { lock.withLock { sources } }
+}
+
+private actor RulesAnalysisGate {
+  let started: XCTestExpectation
+  private var continuation: CheckedContinuation<Void, Never>?
+  private var first = true
+  init(started: XCTestExpectation) { self.started = started }
+  func wait() async {
+    guard first else { return }
+    first = false
+    await withCheckedContinuation {
+      continuation = $0
+      started.fulfill()
+    }
+  }
+  func resume() {
+    continuation?.resume()
+    continuation = nil
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RulePresetControllerTests.swift b/ShadowsocksX-NG2/Tests/Rules/RulePresetControllerTests.swift
new file mode 100644
index 000000000..a2a95b81b
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RulePresetControllerTests.swift
@@ -0,0 +1,43 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension RuleEnablementControllerTests {
+  func testSelectedPresetDrivesACLAndInactivePresetSaveDoesNotDeploy() async throws {
+    let seeded = try makeSeededCatalog()
+    let (store, _) = try makeCustomRuleStore()
+    let controller = makeControllerWithCustomRules(
+      store: store,
+      settings: ProxyRuntimeSettings(
+        listen: ActivationFixture.listen, rulePreset: .chinaDirect, agentEnabled: true),
+      proxyMode: .rule, ruleApplicationDelay: { await Task.yield() })
+    try await controller.activate(seeded.server)
+    let runtimeStore = RuntimeFileStore(fileURL: runtime.contract)
+    let before = try activeACLContent(runtimeStore)
+    let registrations = agent.registerCount
+    let custom = CustomRule(
+      action: .proxy, match: try RuleMatch(domainSuffix: "preset-only.example"))
+    let saved = await controller.commitRuleDocument(
+      CustomRuleDocument(rules: [custom]), preset: .chinaProxy)
+    XCTAssertEqual(saved.outcome, .saved)
+    XCTAssertNil(controller.ruleApplicationTask)
+    XCTAssertEqual(try activeACLContent(runtimeStore), before)
+    XCTAssertEqual(agent.registerCount, registrations)
+    XCTAssertTrue(try controller.documents(for: .chinaDirect).load().rules.isEmpty)
+    await controller.setRulePreset(.chinaProxy)
+    let china = try activeACLContent(runtimeStore)
+    XCTAssertTrue(china.hasPrefix("[bypass_all]"))
+    XCTAssertTrue(china.contains("preset-only.example"))
+    XCTAssertTrue(china.contains("[proxy_list]"))
+    XCTAssertEqual(controller.controlPreferences.rulePreset, .chinaProxy)
+    let generation = controller.modeChangeGeneration
+    await controller.setRulePreset(.chinaProxy)
+    XCTAssertEqual(controller.rulePreset, .chinaProxy)
+    XCTAssertEqual(controller.modeChangeGeneration, generation)
+    XCTAssertEqual(try activeACLContent(runtimeStore), china)
+    await controller.setRulePreset(.chinaDirect)
+    XCTAssertEqual(try activeACLContent(runtimeStore), before)
+    await controller.setRulePreset(.gfwlist)
+    XCTAssertFalse(try activeACLContent(runtimeStore).contains("preset-only.example"))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RulePresetWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Rules/RulePresetWorkflowTests.swift
new file mode 100644
index 000000000..b01242487
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RulePresetWorkflowTests.swift
@@ -0,0 +1,231 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct RulePresetWorkflowTests {
+  @Test func gfwSchemeDropsDefaultActionBuiltinExceptions() async throws {
+    let proxy = ProxyRule(action: .proxy, match: try RuleMatch(domainSuffix: "proxy.example"))
+    let exception = ProxyRule(action: .direct, match: try RuleMatch(domainExact: "direct.example"))
+    let snapshot = rulesFixture(.gfwlist, rules: [proxy, exception])
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadCustom: { [] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { _ in snapshot }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(source: .gfwlist))
+    #expect(workflow.snapshot.rows.map(\.identity) == [proxy])
+    workflow.setTestTarget("direct.example")
+    await workflow.testAddress()
+    #expect(workflow.snapshot.addressTest.result?.outcome == .direct)
+    #expect(workflow.snapshot.addressTest.result?.explanation == .defaultAction)
+    let source = SslocalRuntimeDocument(servers: [], listen: ActivationFixture.listen)
+    let compiled = RuleRuntimeCompiler.compile(
+      .init(
+        source: source, mode: .rule, defaultAction: .directWhenUnmatched,
+        document: nil, builtIn: RulePreset.gfwlist.rules(from: snapshot),
+        aclURL: URL(fileURLWithPath: "/tmp/gfw-scheme.acl")))
+    let content = try #require(compiled.aclRuntime?.content)
+    #expect(content.contains("||proxy.example\n"))
+    #expect(!content.contains("|direct.example\n"))
+  }
+
+  @Test(arguments: RulePreset.allCases)
+  func customRuleCreationAndEditingUseOwningSchemeAction(_ preset: RulePreset) async throws {
+    var document = CustomRuleDocument(rules: [])
+    let workflow = RulesWorkflow(
+      preset: preset, loadDocument: { document },
+      commitDocument: {
+        document = $0
+        return RuleDocumentCommit(outcome: .saved, document: $0)
+      }, builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    var draft = try #require(workflow.makeCustomRuleDraft())
+    let action: RuleAction = preset == .chinaDirect ? .direct : .proxy
+    #expect(draft.action == action)
+    draft.content = "created.example"
+    let preview = await workflow.previewCustomRule(draft)
+    #expect(preview.rule?.action == action)
+    #expect(await workflow.saveCustomRule(draft) == .committed(.saved))
+    var edited = try #require(workflow.makeCustomRuleDraft(editing: draft.id))
+    #expect(edited.action == action)
+    edited.content = "edited.example"
+    #expect(await workflow.saveCustomRule(edited) == .committed(.saved))
+    #expect(document.rules.first?.id == draft.id)
+    #expect(document.rules.first?.action == action)
+    workflow.setTestTarget("www.edited.example")
+    await workflow.testAddress()
+    #expect(
+      workflow.snapshot.addressTest.result?.outcome == (preset == .chinaDirect ? .direct : .proxy))
+  }
+
+  @Test(arguments: RulePreset.allCases)
+  func chinaTargetsUsePresetActionAndUnmatchedUsesDefault(_ preset: RulePreset) async throws {
+    let workflow = RulesWorkflow(
+      preset: preset, loadCustom: { [] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { source in
+        rulesFixture(
+          source,
+          rules: source == .geolocationCN
+            ? [ProxyRule(action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn"))] : [])
+      }))
+    await workflow.refresh()
+    #expect(workflow.snapshot.query.source == .custom)
+    let expectedSources: Set<RulesSource> =
+      preset == .gfwlist
+      ? [.custom, .gfwlist, .fixed] : [.custom, .geolocationCN, .chinaIPv4, .fixed]
+    #expect(Set(workflow.snapshot.sources.map(\.id)) == expectedSources)
+    workflow.setTestTarget("new-service.cn")
+    await workflow.testAddress()
+    #expect(
+      workflow.snapshot.addressTest.result?.outcome == (preset == .chinaProxy ? .proxy : .direct))
+    #expect(workflow.snapshot.addressTest.result?.deciding.isEmpty == (preset == .gfwlist))
+    workflow.setTestTarget("unlisted.example")
+    await workflow.testAddress()
+    #expect(
+      workflow.snapshot.addressTest.result?.outcome == (preset == .chinaDirect ? .proxy : .direct))
+    #expect(workflow.snapshot.addressTest.result?.explanation == .defaultAction)
+    workflow.setTestTarget("127.0.0.1")
+    await workflow.testAddress()
+    #expect(workflow.snapshot.addressTest.result?.outcome == .direct)
+    #expect(workflow.snapshot.addressTest.result?.explanation == .fixedLocal)
+  }
+}
+
+extension RulePresetWorkflowTests {
+  @Test func workspacesKeepRulesDisablementAndBrowsingStateAcrossSwitchesAndReload() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let baseURL = directory.appendingPathComponent("rules.json")
+    let legacy = CustomRuleStore(fileURL: baseURL)
+    let old = CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "legacy.example"))
+    try legacy.saveDocument(CustomRuleDocument(rules: [old], disabledIdentities: [old.identity]))
+    let workspaces = makeWorkspaces(baseURL: baseURL)
+    let shared = ProxyRule(action: .proxy, match: try RuleMatch(domainSuffix: "shared.example"))
+    let scenarios: [(RulePreset, RulesQuery)] = [
+      (.gfwlist, RulesQuery(search: "shared", action: .proxy, source: .custom, enabled: false)),
+      (.chinaDirect, RulesQuery(action: .direct, source: .fixed, enabled: true)),
+      (.chinaProxy, RulesQuery(search: "proxy", source: .chinaIPv4)),
+    ]
+    for (preset, query) in scenarios {
+      workspaces.selectedPreset = preset
+      let workflow = workspaces.current
+      await workflow.refresh()
+      #expect(workflow.snapshot.rows.isEmpty)
+      var draft = try #require(workflow.makeCustomRuleDraft())
+      draft.kind = .domainSuffix
+      draft.content = "shared.example"
+      let saved = await workflow.saveCustomRule(draft)
+      #expect(saved == .committed(.saved))
+      #expect(
+        workflow.snapshot.rows.first?.identity
+          == ProxyRule(
+            action: preset == .chinaDirect ? .direct : .proxy, match: shared.match))
+      if preset == .gfwlist { await workflow.setEnabled(false, identities: [shared]) }
+      workflow.query(query)
+      workflow.setTestTarget("\(preset.rawValue).shared.example")
+      await workflow.testAddress()
+    }
+    for (preset, query) in scenarios {
+      workspaces.selectedPreset = preset
+      let page = workspaces.current.snapshot
+      let target = "\(preset.rawValue).shared.example"
+      #expect(page.query == query)
+      #expect(page.addressTest.target == target)
+      #expect(page.addressTest.result?.target == target)
+      #expect(page.addressTest.result?.outcome == (preset == .chinaProxy ? .proxy : .direct))
+      workspaces.current.query(RulesQuery(source: .custom))
+      #expect(workspaces.current.snapshot.rows.first?.isEnabled == (preset != .gfwlist))
+      try assertSavedSharedRule(preset: preset, baseURL: baseURL, shared: shared)
+    }
+    #expect(
+      try legacy.loadDocument()
+        == CustomRuleDocument(rules: [old], disabledIdentities: [old.identity]))
+  }
+}
+
+extension RulePresetWorkflowTests {
+  @Test func delayedSaveAndAnalysisPublishOnlyToTheirOwningWorkspace() async throws {
+    let started = TestAsyncGate("save started")
+    let release = TestAsyncGate("save release")
+    let workspaces = RulesWorkspaces { preset in
+      RulesWorkflow(
+        preset: preset, loadDocument: { CustomRuleDocument(rules: []) },
+        commitDocument: { document in
+          started.release()
+          _ = await release.wait()
+          return RuleDocumentCommit(outcome: .saved, document: document)
+        }, builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    }
+    let originalPreset = workspaces.selectedPreset
+    let original = workspaces.current
+    await original.refresh()
+    var draft = try #require(original.makeCustomRuleDraft())
+    draft.content = "delayed.example"
+    let captured = draft
+    let save = Task { await original.saveCustomRule(captured) }
+    defer { release.release() }
+    #expect(await started.wait())
+    workspaces.selectedPreset = .chinaProxy
+    let other = workspaces.current
+    await other.refresh()
+    other.setTestTarget("unlisted.example")
+    await other.testAddress()
+    let untouched = other.snapshot
+    release.release()
+    #expect(await save.value == .committed(.saved))
+    await original.analysisTask?.value
+    #expect(other.snapshot == untouched)
+    workspaces.selectedPreset = originalPreset
+    #expect(workspaces.current.snapshot.rows.first?.content == "delayed.example")
+    #expect(workspaces.current.snapshot.rows.first?.action == .proxy)
+    #expect(workspaces.current.snapshot.commitOutcome == .saved)
+  }
+}
+
+extension RulePresetWorkflowTests {
+  private func assertSavedSharedRule(preset: RulePreset, baseURL: URL, shared: ProxyRule) throws {
+    let loaded = try CustomRuleStore(preset: preset, baseURL: baseURL).loadDocument()
+    #expect(loaded.rules.count == 1)
+    #expect(
+      loaded.rules.first?.identity
+        == ProxyRule(
+          action: preset == .chinaDirect ? .direct : .proxy, match: shared.match))
+    #expect(loaded.disabledIdentities == (preset == .gfwlist ? [shared] : []))
+  }
+
+  private func makeWorkspaces(baseURL: URL) -> RulesWorkspaces {
+    return RulesWorkspaces { preset in
+      let session = RuleDocumentSession(store: CustomRuleStore(preset: preset, baseURL: baseURL))
+      return RulesWorkflow(
+        preset: preset, loadDocument: { try session.load() },
+        commitDocument: { session.commit($0) },
+        builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    }
+  }
+}
+
+extension RulePresetWorkflowTests {
+  @Test func chinaDirectExplanationUsesOnlyActionsExpressedByItsACL() async throws {
+    let direct = ProxyRule(action: .direct, match: try RuleMatch(domainSuffix: "example.cn"))
+    let custom = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "www.example.cn"))
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect, loadCustom: { [custom] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: {
+        rulesFixture($0, rules: $0 == .geolocationCN ? [direct] : [])
+      }))
+    await workflow.refresh()
+    workflow.setTestTarget("www.example.cn")
+    await workflow.testAddress()
+    #expect(workflow.snapshot.addressTest.result?.outcome == .direct)
+    #expect(workflow.snapshot.addressTest.result?.deciding.map(\.identity) == [direct])
+    workflow.query(RulesQuery(source: .geolocationCN))
+    #expect(workflow.snapshot.rows.first?.relationships.isEmpty == true)
+    workflow.setTestTarget("unlisted.example")
+    await workflow.testAddress()
+    #expect(workflow.snapshot.addressTest.result?.explanation == .defaultAction)
+    workflow.setTestTarget("www.example.cn")
+    workflow.query(RulesQuery(source: .custom))
+    #expect(workflow.snapshot.rows.isEmpty)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RuleRuntimeDelayGateTests.swift b/ShadowsocksX-NG2/Tests/Rules/RuleRuntimeDelayGateTests.swift
new file mode 100644
index 000000000..84fc92e68
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RuleRuntimeDelayGateTests.swift
@@ -0,0 +1,59 @@
+import Testing
+import XCTest
+
+@MainActor
+struct RuleRuntimeDelayGateTests {
+  @Test func releaseBeforeWaitIsRemembered() async throws {
+    let gate = RuleRuntimeDelayGate(started: XCTestExpectation(description: "entered"))
+    gate.resume()
+    gate.resume()
+    try await gate.wait()
+  }
+
+  @Test func missingReleaseTimesOutAndReportsFailure() async {
+    var reported = false
+    let gate = RuleRuntimeDelayGate(
+      started: XCTestExpectation(description: "entered"), onTimeout: { reported = true })
+    await #expect(throws: TestWaitError.self) {
+      try await gate.wait(timeout: .milliseconds(20))
+    }
+    #expect(reported)
+    gate.resume()
+    gate.resume()
+  }
+
+  @Test func cancellationBeforeEntryDoesNotSuspend() async {
+    let gate = RuleRuntimeDelayGate(started: XCTestExpectation(description: "entered"))
+    let task = Task {
+      withUnsafeCurrentTask { $0?.cancel() }
+      try await gate.wait()
+    }
+    await #expect(throws: CancellationError.self) { try await task.value }
+  }
+
+  @Test func cancellationWhileWaitingDrainsTheWait() async throws {
+    let entered = XCTestExpectation(description: "entered")
+    let gate = RuleRuntimeDelayGate(started: entered)
+    let task = Task { try await gate.wait() }
+    try await requireTestPhase([entered])
+    task.cancel()
+    await #expect(throws: CancellationError.self) { try await task.value }
+    gate.resume()
+  }
+
+  @Test func releaseAndCancellationCanRaceWithoutDoubleResume() async throws {
+    for _ in 0..<100 {
+      let entered = XCTestExpectation(description: "entered")
+      let gate = RuleRuntimeDelayGate(started: entered)
+      let task = Task { try await gate.wait() }
+      try await requireTestPhase([entered])
+      let cancellation = Task.detached { task.cancel() }
+      gate.resume()
+      gate.resume()
+      do { try await task.value } catch {
+        #expect(error is CancellationError)
+      }
+      await cancellation.value
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RuleStatusWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Rules/RuleStatusWorkflowTests.swift
new file mode 100644
index 000000000..7313895b2
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RuleStatusWorkflowTests.swift
@@ -0,0 +1,176 @@
+import Combine
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class RuleStatusWorkflowTests: XCTestCase {
+  func testUnavailableFinalDocumentKeepsRowsAndRequiresExplicitRetry() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "example.net"))
+    try store.save([rule])
+    let workflow = RulesWorkflow(
+      loadDocument: { try store.loadDocument() },
+      commitDocument: { document in
+        _ = saveFixture(document, to: store, outcome: .saved)
+        return RuleDocumentCommit(outcome: .saved, document: nil)
+      },
+      feedbackDelay: { XCTFail("An incomplete collection must not start the success timer") },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    let rows = workflow.snapshot.rows
+    await workflow.setEnabled(false, identities: [rule.identity])
+    XCTAssertEqual(workflow.snapshot.operationStatus, .collectionIncomplete)
+    XCTAssertEqual(workflow.snapshot.rows, rows)
+    XCTAssertFalse(workflow.snapshot.isComplete)
+    await workflow.refresh()
+    XCTAssertEqual(workflow.snapshot.operationStatus, .idle)
+    XCTAssertFalse(workflow.snapshot.rows.first { $0.identity == rule.identity }!.isEnabled)
+  }
+
+  func testSuccessCountsOnlyActualChangesAndExpiresAfterCollectionUpdate() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let disabled = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "disabled.example"))
+    let enabled = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "enabled.example"))
+    try store.saveDocument(
+      CustomRuleDocument(rules: [disabled, enabled], disabledIdentities: [disabled.identity]))
+    let timerStarted = expectation(description: "success timer started")
+    let clock = RuleFeedbackClock(started: timerStarted)
+    let workflow = RulesWorkflow(
+      loadDocument: { try store.loadDocument() },
+      commitDocument: { document in
+        saveFixture(document, to: store, outcome: .saved)
+      },
+      feedbackDelay: { await clock.wait() },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(source: .fixed))
+    let fixed = try XCTUnwrap(workflow.snapshot.rows.first { $0.isFixed }?.identity)
+    workflow.query(RulesQuery(source: .custom))
+    await workflow.setEnabled(true, identities: [disabled.identity, enabled.identity, fixed])
+    let feedback = try XCTUnwrap(workflow.snapshot.commitFeedback)
+    XCTAssertEqual(feedback.changedCount, 1)
+    XCTAssertEqual(feedback.operation, .enablement(true))
+    XCTAssertEqual(feedback.outcome, .saved)
+    XCTAssertTrue(workflow.snapshot.rows.first { $0.identity == disabled.identity }!.isEnabled)
+    await fulfillment(of: [timerStarted], timeout: 3)
+    let expired = expectation(description: "success dismissed")
+    let observation = workflow.$snapshot.filter { $0.commitFeedback == nil }.sink { _ in
+      expired.fulfill()
+    }
+    await clock.resume()
+    await fulfillment(of: [expired], timeout: 3)
+    XCTAssertEqual(workflow.snapshot.operationStatus, .idle)
+    withExtendedLifetime(observation) {}
+  }
+
+  func testCommitRemainsOneBusyOperationAndAllowsBrowsing() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "example.net"))
+    try store.save([rule])
+    let reloadStarted = expectation(description: "collection reload paused")
+    let gate = RuleFeedbackClock(started: reloadStarted)
+    let workflow = RulesWorkflow(
+      loadDocument: { try store.loadDocument() },
+      commitDocument: { document in
+        await gate.wait()
+        return saveFixture(document, to: store, outcome: .saved)
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    let pending = Task { await workflow.setEnabled(false, identities: [rule.identity]) }
+    await fulfillment(of: [reloadStarted], timeout: 3)
+    XCTAssertFalse(workflow.snapshot.isLoading)
+    XCTAssertEqual(workflow.snapshot.operationStatus, .updating)
+    XCTAssertNil(workflow.snapshot.commitFeedback)
+    XCTAssertTrue(workflow.snapshot.rows.first { $0.identity == rule.identity }!.isEnabled)
+    let query = RulesQuery(search: "example", source: .custom)
+    workflow.query(query)
+    let row = try XCTUnwrap(workflow.snapshot.rows.first)
+    workflow.select([row.id])
+    await gate.resume()
+    await pending.value
+    XCTAssertEqual(workflow.snapshot.query, query)
+    XCTAssertEqual(workflow.snapshot.selection, [row.id])
+    XCTAssertFalse(workflow.snapshot.rows.first!.isEnabled)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .saved)
+  }
+
+  func testOldSuccessTimerCannotDismissNewFailureAndClosingDoesNotChangeRules() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let rule = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "example.net"))
+    try store.save([rule])
+    let timerStarted = expectation(description: "success timer started")
+    let timerReturned = expectation(description: "old timer returned")
+    let clock = RuleFeedbackClock(started: timerStarted)
+    let commitState = RuleCommitState()
+    let workflow = RulesWorkflow(
+      loadDocument: { try store.loadDocument() },
+      commitDocument: { document in
+        commitState.outcome.isSuccess
+          ? saveFixture(document, to: store, outcome: commitState.outcome)
+          : RuleDocumentCommit(outcome: commitState.outcome, document: try? store.loadDocument())
+      },
+      feedbackDelay: {
+        await clock.wait()
+        timerReturned.fulfill()
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    await workflow.setEnabled(false, identities: [rule.identity])
+    await fulfillment(of: [timerStarted], timeout: 3)
+    commitState.outcome = .persistenceFailed
+    await workflow.setEnabled(true, identities: [rule.identity])
+    await clock.resume()
+    await fulfillment(of: [timerReturned], timeout: 3)
+    XCTAssertEqual(workflow.snapshot.commitOutcome, .persistenceFailed)
+    XCTAssertFalse(workflow.snapshot.rows.first { $0.identity == rule.identity }!.isEnabled)
+    workflow.dismissFeedback()
+    XCTAssertEqual(workflow.snapshot.operationStatus, .idle)
+    XCTAssertFalse(workflow.snapshot.rows.first { $0.identity == rule.identity }!.isEnabled)
+  }
+}
+
+@MainActor
+private final class RuleCommitState {
+  var outcome: CustomRuleUpdateOutcome = .saved
+}
+
+private actor RuleFeedbackClock {
+  let started: XCTestExpectation
+  private var continuation: CheckedContinuation<Void, Never>?
+
+  init(started: XCTestExpectation) { self.started = started }
+
+  func wait() async {
+    await withCheckedContinuation {
+      continuation = $0
+      started.fulfill()
+    }
+  }
+
+  func resume() {
+    continuation?.resume()
+    continuation = nil
+  }
+}
+
+private func saveFixture(
+  _ document: CustomRuleDocument, to store: CustomRuleStore, outcome: CustomRuleUpdateOutcome
+) -> RuleDocumentCommit {
+  do {
+    try store.saveDocument(document)
+    return RuleDocumentCommit(outcome: outcome, document: document)
+  } catch {
+    XCTFail("Fixture save failed: \(error)")
+    return RuleDocumentCommit(outcome: .persistenceFailed, document: try? store.loadDocument())
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RulesPresentationTests.swift b/ShadowsocksX-NG2/Tests/Rules/RulesPresentationTests.swift
new file mode 100644
index 000000000..e1e68b02f
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RulesPresentationTests.swift
@@ -0,0 +1,123 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class RulesPresentationTests: XCTestCase {
+  func testReportIsAnExplicitSnapshotUnaffectedByQueryOrRefresh() async throws {
+    let loader = ReportFixtureLoader()
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect, loadCustom: { [] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { loader.load($0) }))
+    await workflow.refresh()
+    XCTAssertTrue(workflow.openSourceReport(.geolocationCN))
+    let opened = try XCTUnwrap(workflow.reportSource)
+    workflow.query(RulesQuery(source: .chinaIPv4))
+    loader.advance()
+    await workflow.refresh()
+    XCTAssertEqual(workflow.reportSource, opened)
+    XCTAssertTrue(workflow.openSourceReport(.geolocationCN))
+    XCTAssertEqual(workflow.reportSource, opened)
+    XCTAssertTrue(workflow.openSourceReport(.chinaIPv4))
+    XCTAssertEqual(workflow.reportSource?.id, .chinaIPv4)
+    XCTAssertFalse(workflow.openSourceReport(.custom))
+    XCTAssertEqual(workflow.reportSource?.id, .chinaIPv4)
+  }
+  func testRelationshipExplanationRequiresExactlyOneRelatedSelection() async throws {
+    let broad = CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "example.com"))
+    let narrow = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "a.example.com"))
+    let independent = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "other.net"))
+    let workflow = RulesWorkflow(
+      preset: .gfwlist, loadCustom: { [broad, narrow, independent] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    XCTAssertNil(workflow.selectedRelationshipRow)
+    workflow.select([.rule(narrow.identity)])
+    let row = try XCTUnwrap(workflow.selectedRelationshipRow)
+    XCTAssertEqual(row.identity, narrow.identity)
+    XCTAssertEqual(row.relationships.first?.kind, .absorption)
+    XCTAssertEqual(row.relationships.first?.covering, [broad.identity])
+    workflow.select([.rule(narrow.identity), .rule(independent.identity)])
+    XCTAssertNil(workflow.selectedRelationshipRow)
+    workflow.select([.rule(independent.identity)])
+    XCTAssertNil(workflow.selectedRelationshipRow)
+  }
+
+  func testSameActionAndFixedCoverageRemainExplainable() async throws {
+    let broad = CustomRule(action: .direct, match: try RuleMatch(domainSuffix: "example.net"))
+    let narrow = CustomRule(action: .direct, match: try RuleMatch(domainExact: "a.example.net"))
+    let local = CustomRule(action: .direct, match: try RuleMatch(domainExact: "device.local"))
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect, loadCustom: { [broad, narrow, local] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.select([.rule(narrow.identity)])
+    let absorbed = try XCTUnwrap(workflow.selectedRelationshipRow)
+    XCTAssertEqual(absorbed.relationships.first?.kind, .absorption)
+    XCTAssertEqual(absorbed.relationships.first?.covering, [broad.identity])
+    workflow.select([.rule(local.identity)])
+    let fixed = try XCTUnwrap(workflow.selectedRelationshipRow?.fixedCoverage)
+    XCTAssertEqual(fixed.matches, [.localSuffix])
+    workflow.select([.noDotHostname])
+    XCTAssertNil(workflow.selectedRelationshipRow)
+  }
+
+  func testOutcomeCopyMappingCoversEveryCase() throws {
+    XCTAssertEqual(CustomRuleUpdateOutcome.saved.rulesMessage, RulesCopy.text("已保存"))
+    XCTAssertEqual(
+      CustomRuleUpdateOutcome.persistenceFailed.rulesMessage, RulesCopy.text("保存失败，规则未更改"))
+    XCTAssertEqual(
+      CustomRuleUpdateOutcome.persistenceFailed.nextStep, RulesCopy.text("请重试规则操作。"))
+    XCTAssertNil(CustomRuleUpdateOutcome.persistenceFailed.failureDetail)
+    XCTAssertEqual(CustomRuleUpdateOutcome.busy.rulesMessage, RulesCopy.text("正在更新规则…"))
+    XCTAssertEqual(
+      CustomRuleUpdateOutcome.superseded.rulesMessage, RulesCopy.text("规则集合已变化，操作未执行。"))
+    XCTAssertEqual(CustomRuleUpdateOutcome.superseded.nextStep, RulesCopy.text("请重试规则操作。"))
+    XCTAssertNil(CustomRuleUpdateOutcome.superseded.failureDetail)
+    let invalid = CustomRuleUpdateOutcome.invalidDocument(detail: "detail-1")
+    XCTAssertEqual(invalid.rulesMessage, RulesCopy.text("无法更新规则"))
+    XCTAssertEqual(invalid.failureDetail, "detail-1")
+    XCTAssertEqual(invalid.nextStep, RulesCopy.text("请检查规则数据后再操作。"))
+    let rejected = CustomRuleUpdateOutcome.rejected([
+      RejectedCustomRule(
+        rule: CustomRule(action: .direct, match: try RuleMatch(domainExact: "a.test")),
+        reason: .duplicate, explanation: "r1"),
+      RejectedCustomRule(
+        rule: CustomRule(action: .direct, match: try RuleMatch(domainExact: "b.test")),
+        reason: .duplicate, explanation: "r2"),
+    ])
+    XCTAssertEqual(rejected.failureDetail, "r1\nr2")
+    XCTAssertEqual(rejected.nextStep, RulesCopy.text("请检查规则数据后再操作。"))
+    XCTAssertNil(CustomRuleUpdateOutcome.saved.failureDetail)
+    XCTAssertNil(CustomRuleUpdateOutcome.saved.nextStep)
+    let success = RulesCommitFeedback(
+      outcome: .saved, operation: .enablement(true), changedCount: 3)
+    XCTAssertEqual(
+      success.summary,
+      RulesCopy.text("已启用 3 条规则") + " · " + RulesCopy.text("已保存"))
+    let failure = RulesCommitFeedback(outcome: .busy, operation: .delete, changedCount: 1)
+    XCTAssertEqual(failure.summary, RulesCopy.text("正在更新规则…"))
+  }
+
+}
+
+private final class ReportFixtureLoader: @unchecked Sendable {
+  private let lock = NSLock()
+  private var version = 1
+
+  func advance() { lock.withLock { version += 1 } }
+
+  func load(_ source: RulesSource) -> RuleSnapshot {
+    let version = lock.withLock { version }
+    let fixture = rulesFixture(source)
+    let metadata = fixture.metadata
+    return RuleSnapshot(
+      metadata: RuleSnapshotMetadata(
+        source: RuleSourceIdentity(
+          kind: metadata.source.kind, upstreamVersion: "v\(version)", label: metadata.source.label),
+        upstreamReference: metadata.upstreamReference, inputDigest: "digest-\(version)",
+        fetchedAt: metadata.fetchedAt, converterVersion: metadata.converterVersion,
+        license: metadata.license, attribution: metadata.attribution),
+      rules: fixture.rules, lossReport: RuleConversionLossReport(absorbedCount: version))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RulesWorkflowCoverageTests.swift b/ShadowsocksX-NG2/Tests/Rules/RulesWorkflowCoverageTests.swift
new file mode 100644
index 000000000..af634a063
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RulesWorkflowCoverageTests.swift
@@ -0,0 +1,97 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class RulesWorkflowCoverageTests: XCTestCase {
+  func testCoverageUsesAllSourcesAndDistinguishesPartialFromFull() async throws {
+    let broad = ProxyRule(action: .direct, match: try RuleMatch(domainSuffix: "example.com"))
+    let narrow = CustomRule(action: .direct, match: try RuleMatch(domainExact: "www.example.com"))
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect, loadCustom: { [narrow] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: {
+        rulesFixture($0, rules: $0 == .geolocationCN ? [broad] : [])
+      }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(source: .geolocationCN))
+    let broadRow = try XCTUnwrap(workflow.snapshot.rows.first { $0.identity == broad })
+    XCTAssertTrue(
+      broadRow.relationships.contains {
+        $0.kind == .absorption && $0.extent == .partial && $0.covering == [narrow.identity]
+      })
+    workflow.query(RulesQuery(source: .custom))
+    let narrowRow = try XCTUnwrap(workflow.snapshot.rows.first)
+    XCTAssertTrue(
+      narrowRow.relationships.contains {
+        $0.kind == .absorption && $0.extent == .full && $0.covering == [broad]
+      })
+    XCTAssertTrue(narrowRow.relationships.allSatisfy { $0.kind != .shadowing })
+  }
+
+  func testMappedIPAndCombinedNarrowRangesExplainCoverageThroughWorkflow() async throws {
+    let broad = CustomRule(action: .direct, match: try RuleMatch(ipv6CIDR: "::ffff:8.8.8.0/120"))
+    let lower = CustomRule(action: .direct, match: try RuleMatch(ipv4CIDR: "8.8.8.0/25"))
+    let upper = CustomRule(action: .direct, match: try RuleMatch(ipv4CIDR: "8.8.8.128/25"))
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect, loadCustom: { [broad, lower, upper] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(action: .direct, source: .custom))
+    let row = try XCTUnwrap(workflow.snapshot.rows.first)
+    XCTAssertEqual(row.identity, broad.identity)
+    XCTAssertEqual(row.relationships.count, 1)
+    XCTAssertEqual(row.relationships.first?.kind, .absorption)
+    XCTAssertEqual(row.relationships.first?.extent, .full)
+    XCTAssertEqual(Set(row.relationships.first?.covering ?? []), [lower.identity, upper.identity])
+  }
+
+  func testFixedProtectionExplainsSimpleHostsAndPreventsFalseLocalShadowing() async throws {
+    let simple = ProxyRule(
+      action: .direct, match: try RuleMatch(domainExact: "printer"))
+    let simpleSuffix = ProxyRule(action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn"))
+    let localProxy = ProxyRule(
+      action: .direct, match: try RuleMatch(domainExact: "device.local"))
+    let localDirect = CustomRule(action: .direct, match: try RuleMatch(domainExact: "device.local"))
+    let nationalDirect = CustomRule(
+      action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn"))
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect,
+      loadCustom: { [localDirect, nationalDirect] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { requested in
+        rulesFixture(
+          requested, rules: requested == .geolocationCN ? [simple, simpleSuffix, localProxy] : [])
+      }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(source: .geolocationCN))
+    let simpleRow = try XCTUnwrap(workflow.snapshot.rows.first { $0.identity == simple })
+    XCTAssertEqual(simpleRow.fixedCoverage?.extent, .full)
+    let suffixRow = try XCTUnwrap(
+      workflow.snapshot.rows.first { $0.identity == simpleSuffix })
+    XCTAssertEqual(suffixRow.fixedCoverage?.extent, .partial)
+    workflow.query(RulesQuery(source: .custom))
+    let localRow = try XCTUnwrap(
+      workflow.snapshot.rows.first { $0.identity == localDirect.identity })
+    XCTAssertEqual(localRow.fixedCoverage?.extent, .full)
+    XCTAssertFalse(localRow.relationships.contains { $0.kind == .shadowing })
+    let nationalRow = try XCTUnwrap(
+      workflow.snapshot.rows.first { $0.identity == nationalDirect.identity })
+    XCTAssertEqual(nationalRow.fixedCoverage?.extent, .partial)
+    XCTAssertFalse(nationalRow.relationships.contains { $0.kind == .shadowing })
+  }
+
+  func testFixedLocalCoverageDoesNotShadowPublicPartOfDirectSuffix() async throws {
+    let direct = CustomRule(action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn"))
+    let proxy = ProxyRule(action: .proxy, match: try RuleMatch(domainExact: "cn"))
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect,
+      loadCustom: { [direct] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { requested in
+        rulesFixture(requested, rules: requested == .gfwlist ? [proxy] : [])
+      }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(source: .custom))
+    let row = try XCTUnwrap(workflow.snapshot.rows.first)
+    XCTAssertFalse(row.relationships.contains { $0.kind == .shadowing })
+    XCTAssertEqual(row.fixedCoverage?.extent, .partial)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RulesWorkflowPublicationTests.swift b/ShadowsocksX-NG2/Tests/Rules/RulesWorkflowPublicationTests.swift
new file mode 100644
index 000000000..7e7c78e18
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RulesWorkflowPublicationTests.swift
@@ -0,0 +1,30 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class RulesWorkflowPublicationTests: XCTestCase {
+  func testNativeControlsWritingTheSameQueryDoNotRepublishThePage() async {
+    let workflow = RulesWorkflow(
+      loadCustom: { [] }, builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(source: .gfwlist))
+    var changes = 0
+    let observation = workflow.$snapshot.dropFirst().sink { _ in changes += 1 }
+    workflow.query(workflow.snapshot.query)
+    observation.cancel()
+    XCTAssertEqual(changes, 0)
+  }
+
+  func testNativeControlsWritingTheSameVisibleSelectionDoNotRepublishThePage() async {
+    let workflow = RulesWorkflow(
+      loadCustom: { [] }, builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.select([.noDotHostname])
+    var changes = 0
+    let observation = workflow.$snapshot.dropFirst().sink { _ in changes += 1 }
+    workflow.select([.noDotHostname])
+    observation.cancel()
+    XCTAssertEqual(changes, 0)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Rules/RulesWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Rules/RulesWorkflowTests.swift
new file mode 100644
index 000000000..2dbb4ed76
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Rules/RulesWorkflowTests.swift
@@ -0,0 +1,348 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class RulesWorkflowTests: XCTestCase {
+  func testDisableAcrossSourcesRestoresCoverageAndOrphanCanBeEnabled() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let broad = CustomRule(
+      action: .proxy, match: try RuleMatch(domainSuffix: "example.com"))
+    let narrow = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "safe.example.com"))
+    let orphan = ProxyRule(action: .proxy, match: try RuleMatch(domainExact: "gone.example"))
+    try store.saveDocument(
+      CustomRuleDocument(rules: [broad, narrow], disabledIdentities: [orphan]))
+    var commits = 0
+    let workflow = RulesWorkflow(
+      preset: .gfwlist,
+      loadDocument: { try store.loadDocument() },
+      commitDocument: { document in
+        commits += 1
+        do {
+          try store.saveDocument(document)
+          return RuleDocumentCommit(outcome: .saved, document: document)
+        } catch {
+          XCTFail("Fixture save failed: \(error)")
+          return RuleDocumentCommit(
+            outcome: .persistenceFailed, document: try? store.loadDocument())
+        }
+      },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { source in
+        guard source == .gfwlist else { return rulesFixture(source) }
+        return rulesFixture(
+          source,
+          rules: [
+            ProxyRule(action: .proxy, match: broad.match)
+          ])
+      }))
+    await workflow.refresh()
+    let version = workflow.snapshot.version
+    let covered = try XCTUnwrap(workflow.snapshot.rows.first { $0.identity == narrow.identity })
+    XCTAssertTrue(covered.relationships.contains { $0.kind == .absorption && $0.extent == .full })
+    workflow.select([.rule(broad.identity), .noDotHostname])
+    XCTAssertEqual(workflow.actionableSelection, [broad.identity])
+    await workflow.setEnabled(false, identities: workflow.actionableSelection)
+    XCTAssertEqual(commits, 1)
+    XCTAssertNotEqual(workflow.snapshot.version, version)
+    try await assertDisabledRowsAndOrphanCanBeEnabled(
+      workflow: workflow, store: store, broad: broad, narrow: narrow, orphan: orphan)
+  }
+
+  private func assertDisabledRowsAndOrphanCanBeEnabled(
+    workflow: RulesWorkflow, store: CustomRuleStore, broad: CustomRule,
+    narrow: CustomRule, orphan: ProxyRule
+  ) async throws {
+    let disabled = try XCTUnwrap(workflow.snapshot.rows.first { $0.identity == broad.identity })
+    XCTAssertFalse(disabled.isEnabled)
+    XCTAssertEqual(disabled.sources, [.custom, .gfwlist])
+    await workflow.analysisTask?.value
+    XCTAssertTrue(
+      workflow.snapshot.rows.first { $0.identity == narrow.identity }!.relationships.isEmpty)
+    workflow.setTestTarget("safe.example.com")
+    await workflow.testAddress()
+    XCTAssertEqual(workflow.snapshot.addressTest.result?.outcome, .proxy)
+    workflow.query(RulesQuery(enabled: false))
+    XCTAssertTrue(workflow.snapshot.rows.contains { $0.identity == orphan && !$0.hasCurrentSource })
+    await workflow.setEnabled(true, identities: [orphan])
+    XCTAssertFalse(workflow.snapshot.rows.contains { $0.identity == orphan })
+    XCTAssertNil(workflow.snapshot.addressTest.result)
+    XCTAssertFalse(try store.loadDocument().disabledIdentities.contains(orphan))
+  }
+
+  func testEquivalentSourcesMergeForShippedRules() async throws {
+    let match = try RuleMatch(domainExact: "Example.COM")
+    let custom = CustomRule(action: .direct, match: match)
+    let source = RuleSourceIdentity(kind: .geolocationCN, upstreamVersion: "fixture", label: "geo")
+    let snapshot = RuleSnapshot(
+      metadata: RuleSnapshotMetadata(
+        source: source, upstreamReference: "upstream", inputDigest: "digest",
+        fetchedAt: Date(timeIntervalSince1970: 0), converterVersion: "2.0.0", license: "MIT",
+        attribution: "author"),
+      rules: [ProxyRule(action: .direct, match: match)])
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect,
+      loadCustom: { [custom] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { source in
+        source == .geolocationCN ? snapshot : rulesFixture(source)
+      }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(search: "EXAMPLE", action: .direct, source: .geolocationCN))
+    let row = try XCTUnwrap(workflow.snapshot.rows.first)
+    XCTAssertEqual(workflow.snapshot.rows.count, 1)
+    XCTAssertTrue(row.sources.contains(.custom))
+    XCTAssertTrue(row.sources.contains(.geolocationCN))
+    XCTAssertEqual(row.customIDs, [custom.id])
+    XCTAssertEqual(row.identity, custom.identity)
+  }
+  func testWrongBuiltinSourceIsAnIncompleteCollectionRatherThanMislabeledRules() async throws {
+    let workflow = RulesWorkflow(
+      loadCustom: { [] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { _ in
+        rulesFixture(.geolocationCN)
+      }))
+    await workflow.refresh()
+    XCTAssertFalse(workflow.snapshot.isComplete)
+    XCTAssertEqual(workflow.snapshot.issues.count, 1)
+  }
+
+  func testSearchActionAndSourceIntersectAndHiddenSelectionIsCleared() async throws {
+    let direct = CustomRule(action: .direct, match: try RuleMatch(domainSuffix: "example.com"))
+    let other = CustomRule(action: .direct, match: try RuleMatch(domainExact: "outside.net"))
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect, loadCustom: { [direct, other] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.select([.rule(direct.identity), .rule(other.identity), .noDotHostname])
+    workflow.query(RulesQuery(search: "EXAMPLE", action: .direct, source: .custom))
+    XCTAssertEqual(workflow.snapshot.rows.map(\.identity), [direct.identity])
+    XCTAssertEqual(workflow.snapshot.selection, [.rule(direct.identity)])
+    workflow.query(RulesQuery(search: "EXAMPLE", action: .proxy, source: .custom))
+    XCTAssertTrue(workflow.snapshot.rows.isEmpty)
+    XCTAssertTrue(workflow.snapshot.selection.isEmpty)
+    XCTAssertTrue(workflow.snapshot.isComplete)
+  }
+
+  func testStableInputOrderAndNavigationPreserveVersionAndSessionQuery() async throws {
+    let entries = [
+      CustomRule(action: .proxy, match: try RuleMatch(domainExact: "z.net")),
+      CustomRule(action: .proxy, match: try RuleMatch(domainExact: "a.net")),
+    ]
+    let workflow = RulesWorkflow(
+      loadCustom: { entries }, builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    let version = workflow.snapshot.version
+    workflow.query(RulesQuery(source: .custom))
+    workflow.select([.rule(entries[0].identity)])
+    let route = WorkspaceRoute()
+    route.navigate(to: .rules)
+    route.navigate(to: .home)
+    route.navigate(to: .rules)
+    XCTAssertEqual(workflow.snapshot.rows.map(\.content), ["z.net", "a.net"])
+    XCTAssertEqual(workflow.snapshot.query.source, .custom)
+    XCTAssertEqual(workflow.snapshot.selection, [.rule(entries[0].identity)])
+    await workflow.refresh()
+    XCTAssertEqual(workflow.snapshot.version, version)
+    XCTAssertEqual(workflow.snapshot.selection, [.rule(entries[0].identity)])
+  }
+
+  func testCorruptUserDocumentAndMissingBuiltinStayDistinctFromEmptySearch() async throws {
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect,
+      loadCustom: { throw CustomRuleStoreError.corrupt(detail: "fixture") },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { source in
+        if source == .chinaIPv4 { throw RuleSnapshotError.missing }
+        return rulesFixture(source)
+      }))
+    await workflow.refresh()
+    XCTAssertFalse(workflow.snapshot.isComplete)
+    XCTAssertEqual(
+      workflow.snapshot.issues,
+      [.userDocument("corrupt(detail: \"fixture\")"), .builtin(.chinaIPv4, "missing")])
+    workflow.query(RulesQuery(source: .fixed))
+    XCTAssertTrue(workflow.snapshot.rows.contains { $0.isFixed })
+    workflow.query(RulesQuery(search: "no-result.example"))
+    XCTAssertTrue(workflow.snapshot.rows.isEmpty)
+    XCTAssertFalse(workflow.snapshot.isComplete)
+    XCTAssertEqual(workflow.snapshot.issues.count, 2)
+  }
+
+  func testPackagedCollectionLoadsMetadataShippedRulesAndFixedSemanticPolicy() async throws {
+    let bundle = AppArtifact.bundle
+    let workflow = RulesWorkflow(
+      preset: .chinaDirect,
+      loadCustom: { [] },
+      builtinSnapshots: BuiltinRuleSnapshots(bundle: bundle))
+    await workflow.refresh()
+    XCTAssertTrue(workflow.snapshot.isComplete, "\(workflow.snapshot.issues)")
+    XCTAssertEqual(workflow.snapshot.sources.count, 4)
+    workflow.query(RulesQuery(source: .fixed))
+    XCTAssertTrue(workflow.snapshot.rows.contains { $0.id == .noDotHostname && $0.isFixed })
+    let geo = try XCTUnwrap(workflow.snapshot.sources.first { $0.id == .geolocationCN })
+    XCTAssertEqual(geo.count, 4241)
+    XCTAssertEqual(geo.metadata?.source.upstreamVersion, "20260925234224")
+    XCTAssertNotNil(geo.conversionReport)
+    let rows = workflow.snapshot.rows
+    XCTAssertEqual(Set(rows.map(\.id)).count, rows.count)
+    workflow.query(RulesQuery(source: .geolocationCN))
+    XCTAssertTrue(workflow.snapshot.rows.contains { $0.content == "cn" })
+    XCTAssertEqual(workflow.snapshot.rows.count, 4241)
+  }
+
+  func testRefreshPublishesVersionAndRowsTogetherAndInvalidatesRemovedSelection() async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = CustomRuleStore(fileURL: directory.appendingPathComponent("rules.json"))
+    let old = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "old.net"))
+    let new = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "new.net"))
+    try store.save([old])
+    let workflow = RulesWorkflow(
+      loadCustom: { try store.load() },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    workflow.query(RulesQuery(source: .custom))
+    workflow.select([.rule(old.identity)])
+    let oldVersion = workflow.snapshot.version
+    try store.save([new])
+    let observation = workflow.$snapshot.sink { snapshot in
+      if snapshot.version != oldVersion {
+        XCTAssertEqual(snapshot.rows.map(\.content), ["new.net"])
+        XCTAssertTrue(snapshot.selection.isEmpty)
+      }
+    }
+    await workflow.refresh()
+    observation.cancel()
+    XCTAssertNotEqual(workflow.snapshot.version, oldVersion)
+    XCTAssertEqual(workflow.snapshot.rows.map(\.identity), [new.identity])
+    let loadedVersion = workflow.snapshot.version
+    try Data("broken".utf8).write(to: store.fileURL)
+    await workflow.refresh()
+    XCTAssertFalse(workflow.snapshot.isComplete)
+    XCTAssertEqual(workflow.snapshot.issues.count, 1)
+    XCTAssertEqual(workflow.snapshot.rows.map(\.identity), [new.identity])
+    XCTAssertEqual(workflow.snapshot.version, loadedVersion)
+    XCTAssertEqual(workflow.snapshot.operationStatus, .collectionIncomplete)
+  }
+
+  func testLateOldRefreshCannotReplaceTheNewCollection() async throws {
+    let firstRead = XCTestExpectation(description: "first read")
+    let barrier = RulesReadBarrier(firstRead: firstRead)
+    let workflow = RulesWorkflow(
+      loadCustom: { try barrier.read() },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    let older = Task { await workflow.refresh() }
+    await fulfillment(of: [firstRead], timeout: 3)
+    defer { barrier.release.signal() }
+    XCTAssertTrue(workflow.snapshot.isLoading)
+    await workflow.refresh()
+    workflow.query(RulesQuery(source: .custom))
+    XCTAssertEqual(workflow.snapshot.rows.map(\.content), ["new.net"])
+    let version = workflow.snapshot.version
+    barrier.release.signal()
+    await older.value
+    XCTAssertEqual(workflow.snapshot.rows.map(\.content), ["new.net"])
+    XCTAssertEqual(workflow.snapshot.version, version)
+    XCTAssertFalse(workflow.snapshot.isLoading)
+  }
+
+}
+
+extension RulesWorkflowTests {
+  func testCandidatePermutationKeepsVersionAndCoverageWhilePreservingInputOrder() async throws {
+    let broad = CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "example.com"))
+    let narrow = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "www.example.com"))
+    let forward = RulesWorkflow(
+      loadCustom: { [broad, narrow] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    let reverse = RulesWorkflow(
+      loadCustom: { [narrow, broad] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await forward.refresh()
+    await reverse.refresh()
+    XCTAssertEqual(forward.snapshot.version, reverse.snapshot.version)
+    XCTAssertEqual(
+      Dictionary(uniqueKeysWithValues: forward.snapshot.rows.map { ($0.id, $0) }),
+      Dictionary(uniqueKeysWithValues: reverse.snapshot.rows.map { ($0.id, $0) }))
+    XCTAssertEqual(
+      forward.snapshot.rows.prefix(2).compactMap(\.identity), [broad.identity, narrow.identity])
+    XCTAssertEqual(
+      reverse.snapshot.rows.prefix(2).compactMap(\.identity), [narrow.identity, broad.identity])
+  }
+
+  func testSameNamedExactAndSuffixHaveStableVersionsAcrossRefreshes() async throws {
+    let exact = CustomRule(action: .proxy, match: try RuleMatch(domainExact: "example.com"))
+    let suffix = CustomRule(action: .proxy, match: try RuleMatch(domainSuffix: "example.com"))
+    let workflow = RulesWorkflow(
+      loadCustom: { [suffix, exact] },
+      builtinSnapshots: BuiltinRuleSnapshots(loader: { rulesFixture($0) }))
+    await workflow.refresh()
+    let version = workflow.snapshot.version
+    let identities = workflow.snapshot.rows.map(\.identity)
+    for _ in 0..<12 {
+      await workflow.refresh()
+      XCTAssertEqual(workflow.snapshot.version, version)
+      XCTAssertEqual(workflow.snapshot.rows.map(\.identity), identities)
+    }
+  }
+
+}
+
+extension RulesWorkflowTests {
+  func testCollectionRemovesReverseActionsAndPreservesRemainingInputOrder() throws {
+    let exact = try RuleMatch(domainExact: "same.example")
+    let suffix = try RuleMatch(domainSuffix: "same.example")
+    let rules = [
+      CustomRule(action: .proxy, match: suffix),
+      CustomRule(action: .direct, match: suffix),
+      CustomRule(action: .proxy, match: exact),
+      CustomRule(action: .direct, match: exact),
+    ]
+    for input in [rules, Array(rules.reversed())] {
+      let collection = RulesCollection.load(
+        preset: .gfwlist, custom: { input }, builtin: { rulesFixture($0) })
+      XCTAssertTrue(collection.issues.isEmpty)
+      XCTAssertEqual(
+        collection.rows.filter { $0.content == "same.example" }.compactMap(\.identity),
+        input.filter { $0.action == .proxy }.map(\.identity))
+      XCTAssertTrue(collection.rows.contains { $0.id == .noDotHostname && $0.isFixed })
+    }
+  }
+}
+
+func rulesFixture(
+  _ source: RulesSource, rules: [ProxyRule] = []
+) -> RuleSnapshot {
+  guard let kind = source.sourceKind else {
+    preconditionFailure("Fixed policy has no rule snapshot")
+  }
+  return RuleSnapshot(
+    metadata: RuleSnapshotMetadata(
+      source: RuleSourceIdentity(kind: kind, upstreamVersion: "v1", label: source.rawValue),
+      upstreamReference: "https://example.com/source", inputDigest: "fixture",
+      fetchedAt: Date(timeIntervalSince1970: 0), converterVersion: "2.0.0",
+      license: "MIT", attribution: "fixture author"), rules: rules)
+}
+
+private final class RulesReadBarrier: @unchecked Sendable {
+  let release = DispatchSemaphore(value: 0)
+  private let lock = NSLock()
+  private var reads = 0
+  private let firstRead: XCTestExpectation
+
+  init(firstRead: XCTestExpectation) { self.firstRead = firstRead }
+
+  func read() throws -> [CustomRule] {
+    lock.lock()
+    reads += 1
+    let first = reads == 1
+    lock.unlock()
+    if first {
+      firstRead.fulfill()
+      guard release.wait(timeout: .now() + 5) == .success else { throw RuleSnapshotError.missing }
+    }
+    return [
+      CustomRule(action: .proxy, match: try RuleMatch(domainExact: first ? "old.net" : "new.net"))
+    ]
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/EndpointHealthProbeTests.swift b/ShadowsocksX-NG2/Tests/Runtime/EndpointHealthProbeTests.swift
new file mode 100644
index 000000000..6e9cb0898
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/EndpointHealthProbeTests.swift
@@ -0,0 +1,57 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 端点健康探测：真实 socket 上验证「监听即连通」「未监听
+/// 即拒绝」，失败原因可供「启动失败」点名端点与端口。
+final class EndpointHealthProbeTests: XCTestCase {
+  /// 绑定回环临时端口；调用方负责 close 返回的描述符。
+  private func bindLoopbackListener() throws -> (descriptor: Int32, port: Int) {
+    let socketFD = socket(AF_INET, SOCK_STREAM, 0)
+    _ = try XCTUnwrap(socketFD >= 0 ? socketFD : nil, "创建探测用 socket 失败")
+
+    var address = sockaddr_in()
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_addr.s_addr = INADDR_LOOPBACK.bigEndian
+    address.sin_port = 0
+    let bindResult = withUnsafePointer(to: &address) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        Darwin.bind(socketFD, sockaddrPointer, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    XCTAssertEqual(bindResult, 0, "绑定回环失败")
+    XCTAssertEqual(listen(socketFD, 1), 0)
+
+    var boundAddress = sockaddr_in()
+    var length = socklen_t(MemoryLayout<sockaddr_in>.size)
+    let nameResult = withUnsafeMutablePointer(to: &boundAddress) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        getsockname(socketFD, sockaddrPointer, &length)
+      }
+    }
+    XCTAssertEqual(nameResult, 0)
+    return (socketFD, Int(CFSwapInt16BigToHost(boundAddress.sin_port)))
+  }
+
+  func testProbeReachesBoundLoopbackListener() throws {
+    let (descriptor, port) = try bindLoopbackListener()
+    defer { close(descriptor) }
+
+    let outcome = EndpointHealthProbe.probe(host: "127.0.0.1", port: port, timeout: 2)
+
+    XCTAssertEqual(outcome, .reachable, "监听中的端点应可连通")
+  }
+
+  func testProbeRefusesClosedLoopbackPort() throws {
+    // 绑定后立即释放：端口大概率无人监听，连接应立即被拒而非超时。
+    let (descriptor, port) = try bindLoopbackListener()
+    close(descriptor)
+
+    let outcome = EndpointHealthProbe.probe(host: "127.0.0.1", port: port, timeout: 2)
+
+    guard case .refused = outcome else {
+      XCTFail("未监听端口应为 refused，实际 \(outcome)")
+      return
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/FirewallStatusCheckerTests.swift b/ShadowsocksX-NG2/Tests/Runtime/FirewallStatusCheckerTests.swift
new file mode 100644
index 000000000..658402e48
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/FirewallStatusCheckerTests.swift
@@ -0,0 +1,38 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class FirewallStatusCheckerTests: XCTestCase {
+  func testGetAppBlockedOutputMapsToBlockedStatus() async {
+    var capturedExecutable: URL?
+    var capturedArguments: [String] = []
+    let checker = SocketFilterFirewallChecker { executable, arguments in
+      capturedExecutable = executable
+      capturedArguments = arguments
+      return "Incoming connection to /bundle/Helpers/sslocal is blocked.\n"
+    }
+    let target = URL(fileURLWithPath: "/bundle/Helpers/sslocal")
+
+    let blocked = await checker.status(for: target)
+    XCTAssertEqual(blocked, .blocked)
+    XCTAssertEqual(
+      capturedExecutable?.path,
+      "/usr/libexec/ApplicationFirewall/socketfilterfw")
+    XCTAssertEqual(capturedArguments, ["--getappblocked", target.path])
+  }
+
+  func testPermittedAndUnknownResultsDegradeWithoutFalseBlock() async {
+    let permitted = SocketFilterFirewallChecker { _, _ in
+      "Incoming connection to /bundle/Helpers/sslocal is permitted.\n"
+    }
+    let unavailable = SocketFilterFirewallChecker { _, _ in
+      throw CocoaError(.fileNoSuchFile)
+    }
+    let target = URL(fileURLWithPath: "/bundle/Helpers/sslocal")
+
+    let permittedStatus = await permitted.status(for: target)
+    let unavailableStatus = await unavailable.status(for: target)
+    XCTAssertEqual(permittedStatus, .permitted)
+    XCTAssertEqual(unavailableStatus, .unknown)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/LogLineTests.swift b/ShadowsocksX-NG2/Tests/Runtime/LogLineTests.swift
new file mode 100644
index 000000000..e0573d600
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/LogLineTests.swift
@@ -0,0 +1,104 @@
+import Foundation
+import Testing
+import os
+
+@testable import ShadowsocksX_NG2
+
+/// 统一日志行模型：渲染/解析往返、旧格式降级与级别口径。
+struct LogLineTests {
+  @Test func rendersAndParsesUniformRows() {
+    let stamp = Date(timeIntervalSince1970: 1_758_000_000)
+    for level in [LogLineLevel.error, .warning, .info] {
+      for source in [LogLineSource.gui, .wrapper, .sslocal] {
+        let row = LogLine(
+          timestamp: stamp, level: level, source: source, text: "body [with] brackets")
+        let rendered = row.rendered
+        #expect(rendered.hasPrefix("\(LogLine.timestampFormatter.string(from: stamp)) "))
+        #expect(
+          rendered.hasSuffix(" [\(level.rawValue)] [\(source.rawValue)] body [with] brackets"))
+        #expect(LogLine.parse(rendered) == row, "渲染/解析往返必须无损：\(rendered)")
+      }
+    }
+  }
+
+  @Test func parseRejectsUnstructuredText() {
+    #expect(LogLine.parse("") == nil)
+    #expect(LogLine.parse("plain line without metadata") == nil)
+    #expect(LogLine.parse("2026-10-20 12:00:00.123 [bogus] [gui] text") == nil)
+    #expect(LogLine.parse("2026-10-20 12:00:00.123 [info] [nowhere] text") == nil)
+    // 时间戳位置必须是可解析的固定格式（上游 ISO 时间是原文，不是行元数据）。
+    #expect(LogLine.parse("2026-10-20T03:04:12.123456Z [info] [gui] text") == nil)
+  }
+
+  @Test func offsetTimestampsPreserveRepeatedLocalTimes() throws {
+    let first = try #require(
+      LogLine.parse("2026-11-01 01:30:00.000 -0400 [info] [wrapper] first"))
+    let second = try #require(
+      LogLine.parse("2026-11-01 01:30:00.000 -0500 [info] [wrapper] second"))
+    let firstTime = try #require(first.timestamp)
+    let secondTime = try #require(second.timestamp)
+    #expect(secondTime.timeIntervalSince(firstTime) == 3600)
+    #expect(LogLine.parse(first.rendered) == first)
+    #expect(LogLine.parse(second.rendered) == second)
+    #expect(
+      first.rendered.range(of: " [+-][0-9]{4} \\[info\\]", options: .regularExpression) != nil)
+  }
+
+  @Test func readsUniformRowsWithoutTimezoneFromEarlierVersions() throws {
+    let row = try #require(
+      LogLine.parse("2026-10-20 12:00:00.123 [error] [wrapper] older event"))
+    #expect(row.timestamp != nil)
+    #expect(row.level == .error)
+    #expect(row.source == .wrapper)
+    #expect(row.text == "older event")
+  }
+
+  @Test func legacyRowsKeepRawTextAndGuessSource() {
+    let event = LogLine.legacy("ssxng: listen not established within deadline: a 127.0.0.1:1")
+    #expect(event.timestamp == nil)
+    #expect(event.source == .wrapper)
+    #expect(event.text == "ssxng: listen not established within deadline: a 127.0.0.1:1")
+    #expect(event.rendered == event.text, "旧格式行保留原文（raw capture 不改写）")
+
+    let upstream = LogLine.legacy("2026-10-20T03:04:12Z ERROR sslocal] boom")
+    #expect(upstream.source == .sslocal)
+    #expect(upstream.level == .error)
+
+    let warningText = "[Warning] [107248047] app/dispatcher: default route"
+    let warning = LogLine.legacy(warningText)
+    #expect(warning.level == .warning)
+    #expect(warning.text == warningText)
+    #expect(warning.rendered == warningText)
+  }
+
+  @Test func detectsUpstreamLevelTokens() {
+    #expect(LogLineLevel.detect(in: "2026-10-20T03:04:12Z ERROR sslocal] boom") == .error)
+    #expect(LogLineLevel.detect(in: "[2026-10-20T03:04:12Z WARN sslocal] retrying") == .warning)
+    #expect(LogLineLevel.detect(in: "WARNING token alone") == .warning)
+    #expect(LogLineLevel.detect(in: "2026-10-20T03:04:12Z error sslocal] boom") == .error)
+    #expect(LogLineLevel.detect(in: "2026-10-20T03:04:12Z ErRoR sslocal] boom") == .error)
+    #expect(
+      LogLineLevel.detect(in: "[Warning] [107248047] app/dispatcher: default route") == .warning)
+    #expect(LogLineLevel.detect(in: "[wArN] retrying") == .warning)
+    #expect(LogLineLevel.detect(in: "[Warning] later ERROR in message") == .warning)
+    #expect(LogLineLevel.detect(in: "connected to server") == .info)
+    #expect(LogLineLevel.detect(in: "an error occurred") == .error)
+    #expect(LogLineLevel.detect(in: "ERROR: boom") == .info)
+    #expect(LogLineLevel.detect(in: "password: [redacted]") == .info)
+    // CRLF 行尾不得吞掉级别 token（\r 也是空白）。
+    #expect(LogLineLevel.detect(in: "2026-10-20T03:04:12Z ERROR boom\r") == .error)
+    #expect(LogLineLevel.detect(in: "2026-10-20T03:04:12Z WARN retry\r") == .warning)
+  }
+
+  @Test func projectsLevelsToUnifiedLogScale() {
+    // 统一日志没有 warning 级：WARN/WARNING 落持久的 .default，与 error 可区分。
+    #expect(OSLogType(LogLineLevel.error) == .error)
+    #expect(OSLogType(LogLineLevel.warning) == .default)
+    #expect(OSLogType(LogLineLevel.info) == .info)
+    #expect(LogLineLevel(os: .error) == .error)
+    #expect(LogLineLevel(os: .fault) == .error)
+    #expect(LogLineLevel(os: .default) == .info)
+    #expect(LogLineLevel(os: .info) == .info)
+    #expect(LogLineLevel(os: .debug) == .info)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/LoginAtLoginServiceTests.swift b/ShadowsocksX-NG2/Tests/Runtime/LoginAtLoginServiceTests.swift
new file mode 100644
index 000000000..8814abcd5
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/LoginAtLoginServiceTests.swift
@@ -0,0 +1,86 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+final class LaunchAtLoginServiceTests: XCTestCase {
+  func testStartsOffUntilTheUserEnablesIt() {
+    let service = FakeLoginItemService()
+    let controller = LaunchAtLoginController(service: service)
+
+    XCTAssertFalse(controller.isEnabled)
+    XCTAssertEqual(controller.status, .notRegistered)
+    XCTAssertEqual(service.registerCount, 0, "启动不自动注册,默认关闭")
+  }
+
+  func testEnablingRegistersAndReflectsSystemState() {
+    let service = FakeLoginItemService()
+    let controller = LaunchAtLoginController(service: service)
+
+    controller.setEnabled(true)
+
+    XCTAssertTrue(controller.isEnabled)
+    XCTAssertEqual(service.registerCount, 1)
+    XCTAssertEqual(controller.status, .registered)
+    XCTAssertNil(controller.errorMessage)
+  }
+
+  func testDisablingUnregistersAndReflectsSystemState() {
+    let service = FakeLoginItemService()
+    let controller = LaunchAtLoginController(service: service)
+    controller.setEnabled(true)
+
+    controller.setEnabled(false)
+
+    XCTAssertFalse(controller.isEnabled)
+    XCTAssertEqual(service.unregisterCount, 1)
+    XCTAssertEqual(controller.status, .notRegistered)
+  }
+
+  func testApprovalPendingCountsAsEnabled() {
+    let service = FakeLoginItemService()
+    service.status = .requiresApproval
+    let controller = LaunchAtLoginController(service: service)
+
+    XCTAssertTrue(controller.isEnabled)
+    XCTAssertTrue(controller.requiresApproval)
+    XCTAssertEqual(service.registerCount, 0)
+  }
+
+  func testRegistrationFailureNamesErrorAndKeepsSystemState() {
+    let service = FakeLoginItemService()
+    service.registerError = FakeError.system
+    let controller = LaunchAtLoginController(service: service)
+
+    controller.setEnabled(true)
+
+    XCTAssertFalse(controller.isEnabled)
+    XCTAssertEqual(controller.status, .notRegistered)
+    XCTAssertEqual(service.registerCount, 1)
+    XCTAssertEqual(controller.errorMessage, AppPresentation.unknownError)
+  }
+
+  private enum FakeError: Error, CustomStringConvertible {
+    case system
+
+    var description: String { "fake-system-error" }
+  }
+
+  private final class FakeLoginItemService: LaunchAtLoginControlling {
+    var status: LoginItemStatus = .notRegistered
+    var registerCount = 0
+    var unregisterCount = 0
+    var registerError: Error?
+
+    func register() throws {
+      registerCount += 1
+      if let registerError { throw registerError }
+      status = .registered
+    }
+
+    func unregister() throws {
+      unregisterCount += 1
+      status = .notRegistered
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/ProxyACLTests.swift b/ShadowsocksX-NG2/Tests/Runtime/ProxyACLTests.swift
new file mode 100644
index 000000000..4b6e6475f
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/ProxyACLTests.swift
@@ -0,0 +1,250 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class ProxyACLTests: XCTestCase {
+  func testDirectACLUsesBypassAllAndFixedLocalSafetyRules() {
+    let acl = ProxyACLDocument.direct(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"))
+
+    XCTAssertTrue(acl.isWellFormed)
+    XCTAssertTrue(acl.content.hasPrefix("[bypass_all]\n[bypass_list]\n"))
+    XCTAssertFalse(acl.content.contains("[proxy_list]"))
+    XCTAssertTrue(acl.content.contains("127.0.0.0/8\n"))
+    XCTAssertTrue(acl.content.contains("10.0.0.0/8\n"))
+    XCTAssertTrue(acl.content.contains("172.16.0.0/12\n"))
+    XCTAssertTrue(acl.content.contains("192.168.0.0/16\n"))
+    XCTAssertTrue(acl.content.contains("169.254.0.0/16\n"))
+    XCTAssertTrue(acl.content.contains("::1/128\n"))
+    XCTAssertTrue(acl.content.contains("fe80::/10\n"))
+    XCTAssertTrue(acl.content.contains("fc00::/7\n"))
+    XCTAssertTrue(acl.content.contains("||localhost\n"))
+    XCTAssertTrue(acl.content.contains("||local\n"))
+    XCTAssertTrue(acl.content.contains("^[^.]+$\n"))
+    XCTAssertFalse(acl.content.contains("100.64.0.0/10"))
+  }
+
+  /// 全局模式：只含固定本地绕过的最小 ACL；不混入中国列表、
+  /// GFWList 或自定义规则。公网目标默认代理，本地目标固定直连。
+  func testGlobalACLUsesProxyAllAndOnlyFixedLocalSafetyRules() {
+    let acl = ProxyACLDocument.global(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"))
+
+    XCTAssertTrue(acl.isWellFormed)
+    XCTAssertEqual(acl.summary, "global")
+    XCTAssertTrue(acl.content.hasPrefix("[proxy_all]\n[bypass_list]\n"))
+    XCTAssertFalse(acl.content.contains("[proxy_list]"))
+    XCTAssertFalse(acl.content.contains("[bypass_all]"))
+    XCTAssertTrue(acl.content.contains("127.0.0.0/8\n"))
+    XCTAssertTrue(acl.content.contains("10.0.0.0/8\n"))
+    XCTAssertTrue(acl.content.contains("172.16.0.0/12\n"))
+    XCTAssertTrue(acl.content.contains("192.168.0.0/16\n"))
+    XCTAssertTrue(acl.content.contains("169.254.0.0/16\n"))
+    XCTAssertTrue(acl.content.contains("::1/128\n"))
+    XCTAssertTrue(acl.content.contains("fe80::/10\n"))
+    XCTAssertTrue(acl.content.contains("fc00::/7\n"))
+    XCTAssertTrue(acl.content.contains("||localhost\n"))
+    XCTAssertTrue(acl.content.contains("||local\n"))
+    XCTAssertTrue(acl.content.contains("^[^.]+$\n"))
+    XCTAssertFalse(acl.content.contains("100.64.0.0/10"), "不加入 CGNAT")
+    // 仅固定本地绕过：不携带任何来源规则或用户规则痕迹。
+    let rules = Array(acl.content.split(separator: "\n").map(String.init).dropFirst(2))
+    XCTAssertEqual(
+      rules, FixedLocalProxyRanges.aclBypassRules,
+      "全局 ACL 的规则区应与固定本地绕过完全一致")
+  }
+
+  func testACLRejectsChangedDigestAndNonAbsolutePath() {
+    let valid = ProxyACLDocument.direct(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/acl-active.ini"))
+    let badDigest = ProxyACLDocument(
+      path: valid.path,
+      summary: valid.summary,
+      content: valid.content,
+      sha256: String(repeating: "0", count: 64))
+    let relativePath = ProxyACLDocument(
+      path: "acl-active.ini",
+      summary: valid.summary,
+      content: valid.content,
+      sha256: valid.sha256)
+
+    XCTAssertFalse(badDigest.isWellFormed)
+    XCTAssertFalse(relativePath.isWellFormed)
+  }
+
+  /// ADR-0011：契约只传身份字段。解码后的文档没有 content，等式与 well-formed
+  /// 校验只看 path/summary/sha256；生成侧 content 存在时仍自证摘要。
+  func testACLIdentityEqualityIgnoresContentPresence() {
+    let generated = ProxyACLDocument.direct(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/acl-active.ini"))
+    let decodedShape = ProxyACLDocument(
+      path: generated.path,
+      summary: generated.summary,
+      content: "",
+      sha256: generated.sha256)
+
+    XCTAssertEqual(generated, decodedShape, "content 不参与身份等式")
+    XCTAssertTrue(decodedShape.isWellFormed, "无 content 时按身份形状校验")
+    XCTAssertFalse(
+      ProxyACLDocument(
+        path: generated.path, summary: "", content: "", sha256: generated.sha256
+      ).isWellFormed,
+      "summary 为空仍拒绝")
+    XCTAssertFalse(
+      ProxyACLDocument(
+        path: generated.path, summary: generated.summary, content: "",
+        sha256: "not-a-digest"
+      ).isWellFormed,
+      "摘要形状无效仍拒绝")
+    let mismatchedContent = ProxyACLDocument(
+      path: generated.path, summary: generated.summary, content: "[proxy_all]\n",
+      sha256: generated.sha256)
+    XCTAssertFalse(mismatchedContent.isWellFormed, "携带 content 时仍自证摘要")
+  }
+
+  func testACLIdentityChangeBreaksEquality() {
+    let base = ProxyACLDocument.direct(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/acl-active.ini"))
+    let otherPath = ProxyACLDocument.direct(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/other/acl-active.ini"))
+    let otherSummary = ProxyACLDocument.global(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/acl-active.ini"))
+
+    XCTAssertNotEqual(base, otherPath)
+    XCTAssertNotEqual(base, otherSummary)
+  }
+
+  // MARK: - 规则模式
+
+  /// 规则＋未匹配时代理：proxy_all + 固定本地绕过 + 中国域名直连候选。
+  func testRuleProxyDefaultACLUsesProxyAllAndChinaDirectCandidates() throws {
+    let rules = [
+      ProxyRule(action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn")),
+      ProxyRule(action: .direct, match: try RuleMatch(domainSuffix: "qq.com")),
+      ProxyRule(
+        action: .direct, match: try RuleMatch(domainExact: "api.example.cn")),
+    ]
+    let acl = ProxyACLDocument.rule(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"),
+      defaultAction: .proxyWhenUnmatched,
+      rules: rules)
+
+    XCTAssertTrue(acl.isWellFormed)
+    XCTAssertEqual(acl.summary, "rule-proxy-default")
+    XCTAssertTrue(acl.content.hasPrefix("[proxy_all]\n[bypass_list]\n"))
+    XCTAssertFalse(acl.content.contains("[bypass_all]"))
+    XCTAssertFalse(acl.content.contains("[proxy_list]"))
+    // 固定本地绕过仍在。
+    XCTAssertTrue(acl.content.contains("127.0.0.0/8\n"))
+    XCTAssertTrue(acl.content.contains("||localhost\n"))
+    // 中国域名直连候选。
+    XCTAssertTrue(acl.content.contains("||cn\n"))
+    XCTAssertTrue(acl.content.contains("||qq.com\n"))
+    XCTAssertTrue(acl.content.contains("|api.example.cn\n"))
+    XCTAssertFalse(acl.content.contains("100.64.0.0/10"), "不加入 CGNAT")
+  }
+
+  /// 规则＋未匹配时直连：bypass_all + 固定本地 + GFWList 可生效
+  /// 代理规则。两种默认动作不把全部内置来源无条件并集，因此不混入中国直连项。
+  func testRuleDirectDefaultACLUsesBypassAllAndGFWListProxyCandidates() throws {
+    let rules = [
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example")),
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "also-blocked.example")),
+      ProxyRule(
+        action: .direct, match: try RuleMatch(domainSuffix: "unshadowed.example")),
+    ]
+    let acl = ProxyACLDocument.rule(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"),
+      defaultAction: .directWhenUnmatched,
+      rules: rules)
+
+    XCTAssertTrue(acl.isWellFormed)
+    XCTAssertEqual(acl.summary, "rule-direct-default")
+    XCTAssertTrue(acl.content.hasPrefix("[bypass_all]\n[bypass_list]\n"))
+    XCTAssertEqual(
+      acl.content.components(separatedBy: "[proxy_list]\n").last,
+      "||also-blocked.example\n||blocked.example\n")
+    XCTAssertTrue(acl.content.contains("||unshadowed.example\n"), "未遮蔽例外参与编译进 bypass_list")
+    XCTAssertFalse(acl.content.contains("[proxy_all]"))
+    // 不无条件并集中国来源。
+    XCTAssertFalse(acl.content.contains("||cn\n"))
+    // 固定本地绕过仍在。
+    XCTAssertTrue(acl.content.contains("127.0.0.0/8\n"))
+    XCTAssertTrue(acl.content.contains("||localhost\n"))
+    // 未匹配目标走 bypass_all 默认直连。
+    XCTAssertTrue(acl.content.hasPrefix("[bypass_all]"))
+  }
+
+  /// 规则＋未匹配时直连：IP 字面目标无可用规则命中时直连（无 IP 代理规则时
+  /// proxy_list 只有域名项）。
+  func testRuleDirectDefaultACLLeavesIPLiteralsUnmatchedDirect() throws {
+    let rules = [
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example"))
+    ]
+    let acl = ProxyACLDocument.rule(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"),
+      defaultAction: .directWhenUnmatched,
+      rules: rules)
+
+    let proxySection =
+      (acl.content.components(separatedBy: "[proxy_list]\n").last ?? "")
+      .split(whereSeparator: \.isNewline).map(String.init)
+    XCTAssertTrue(
+      proxySection.allSatisfy { line in
+        line.hasPrefix("||") || line.hasPrefix("|") || line.hasPrefix("^")
+      },
+      "GFWList 代理候选只含域名规则；IP 字面目标未命中即直连")
+  }
+
+  /// 规则＋未匹配时代理：proxy_all 同时含中国域名与 IPv4 CIDR
+  /// 直连候选，固定本地绕过仍优先。
+  func testRuleProxyDefaultACLIncludesChinaIPv4CIDRCandidates() throws {
+    let rules = [
+      ProxyRule(
+        action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn")),
+      ProxyRule(
+        action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24")),
+      ProxyRule(
+        action: .direct, match: try RuleMatch(ipv4CIDR: "198.51.100.0/24")),
+    ]
+    let acl = ProxyACLDocument.rule(
+      at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"),
+      defaultAction: .proxyWhenUnmatched,
+      rules: rules)
+
+    XCTAssertTrue(acl.isWellFormed)
+    XCTAssertTrue(acl.content.hasPrefix("[proxy_all]\n[bypass_list]\n"))
+    XCTAssertTrue(acl.content.contains("||cn\n"), "中国域名直连候选")
+    XCTAssertTrue(acl.content.contains("203.0.113.0/24\n"), "中国 IPv4 CIDR 直连候选")
+    XCTAssertTrue(acl.content.contains("198.51.100.0/24\n"), "中国 IPv4 CIDR 直连候选")
+    // 固定本地绕过仍排在中国候选之前（优先级）。
+    let lines = acl.content.split(separator: "\n").map(String.init)
+    let localIndex = lines.firstIndex(of: "127.0.0.0/8") ?? -1
+    let cidrIndex = lines.firstIndex(of: "203.0.113.0/24") ?? -1
+    XCTAssertTrue(localIndex >= 0 && cidrIndex > localIndex, "固定本地绕过应优先于中国 CIDR")
+  }
+
+  /// 冲突元数据不影响 ACL 行；同匹配只输出一行。
+  func testRuleACLLineMapping() throws {
+    XCTAssertEqual(
+      ProxyRule(action: .direct, match: try RuleMatch(domainSuffix: "example.com"))
+        .aclLine,
+      "||example.com")
+    XCTAssertEqual(
+      ProxyRule(action: .direct, match: try RuleMatch(domainExact: "a.example.com"))
+        .aclLine,
+      "|a.example.com")
+    XCTAssertEqual(
+      ProxyRule(action: .direct, match: try RuleMatch(ipv4CIDR: "203.0.113.0/24"))
+        .aclLine,
+      "203.0.113.0/24")
+    XCTAssertEqual(
+      ProxyRule(action: .direct, match: try RuleMatch(ipv6CIDR: "2001:db8::/32"))
+        .aclLine,
+      "2001:db8::/32")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/ProxyRuntimePlanTests.swift b/ShadowsocksX-NG2/Tests/Runtime/ProxyRuntimePlanTests.swift
new file mode 100644
index 000000000..8ebd6f695
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/ProxyRuntimePlanTests.swift
@@ -0,0 +1,64 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 发布 module 提供意图是否一致；计划只决定进程动作及其顺序。
+final class ProxyRuntimePlanTests: XCTestCase {
+  private let document = ProxyRuntimeFixture.makeDocument()
+
+  private func actions(
+    agent: LaunchAgentStatus,
+    wrapper: WrapperProcessState = .notRunning,
+    current: Bool = false
+  ) -> [RuntimeAction] {
+    ProxyRuntimePlan.actions(
+      intent: .run(document), agentStatus: agent, wrapper: wrapper,
+      configurationIsCurrent: current)
+  }
+
+  func testEnableWhenUnregisteredWritesContractThenRegisters() {
+    XCTAssertEqual(actions(agent: .notRegistered), [.writeContract, .registerAgent])
+  }
+
+  func testEnableWhenNotFoundBehavesLikeUnregistered() {
+    XCTAssertEqual(actions(agent: .notFound), [.writeContract, .registerAgent])
+  }
+
+  func testEnableWhenRequiresApprovalStillWritesAndRegisters() {
+    XCTAssertEqual(actions(agent: .requiresApproval), [.writeContract, .registerAgent])
+  }
+
+  func testRunningWithCurrentPublicationSkipsWriteAndSignal() {
+    XCTAssertEqual(actions(agent: .registered, wrapper: .running(pid: 42), current: true), [])
+  }
+
+  func testRunningWithChangedOrMissingPublicationWritesThenSignals() {
+    XCTAssertEqual(
+      actions(agent: .registered, wrapper: .running(pid: 42)),
+      [.writeContract, .signalReload(pid: 42)])
+  }
+
+  func testRegisteredButWrapperDeadRelaunchesAgentEvenWhenIntentMatches() {
+    XCTAssertEqual(
+      actions(agent: .registered, current: true),
+      [.writeContract, .unregisterAgent, .registerAgent])
+  }
+
+  func testStopWhenRegisteredUnregistersThenDeletesRuntimeFiles() {
+    XCTAssertEqual(
+      ProxyRuntimePlan.actions(
+        intent: .stop, agentStatus: .registered, wrapper: .running(pid: 42),
+        configurationIsCurrent: false),
+      [.unregisterAgent, .deleteRuntimeFiles])
+  }
+
+  func testStopWhenUnregisteredOrApprovalPendingOnlyCleansResidue() {
+    for status: LaunchAgentStatus in [.notRegistered, .requiresApproval] {
+      XCTAssertEqual(
+        ProxyRuntimePlan.actions(
+          intent: .stop, agentStatus: status, wrapper: .notRunning,
+          configurationIsCurrent: false),
+        [.deleteRuntimeFiles])
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/RuntimeDocumentTests.swift b/ShadowsocksX-NG2/Tests/Runtime/RuntimeDocumentTests.swift
new file mode 100644
index 000000000..3daaaa1b9
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/RuntimeDocumentTests.swift
@@ -0,0 +1,162 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 运行时文档缝：派生 JSON 的字段契约与监听设置透传。
+/// 上游字段名以 shadowsocks-rust v1.26.0 配置契约为准；无插件时整体省略插件字段。
+final class RuntimeDocumentTests: XCTestCase {
+  private func encodedDictionary(_ document: SslocalRuntimeDocument) throws -> [String: Any] {
+    let data = try document.jsonData()
+    let object = try JSONSerialization.jsonObject(with: data)
+    return try XCTUnwrap(object as? [String: Any])
+  }
+
+  private func makeDocument(
+    plugin: String? = nil, pluginOpts: String? = nil
+  ) -> SslocalRuntimeDocument {
+    SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "server-1",
+          server: "203.0.113.7",
+          serverPort: 8388,
+          password: "resolved-password",
+          method: "aes-256-gcm",
+          plugin: plugin,
+          pluginOpts: pluginOpts
+        )
+      ], listen: ProxyListeningConfiguration()
+    )
+  }
+
+  // MARK: 字段契约
+
+  func testDocumentEncodesUpstreamContractKeys() throws {
+    let dictionary = try encodedDictionary(
+      makeDocument(plugin: "/bundle/plugins/x", pluginOpts: "obfs=http"))
+
+    let locals = try XCTUnwrap(dictionary["locals"] as? [[String: Any]])
+    XCTAssertEqual(locals.count, 2)
+    XCTAssertEqual(locals[0]["local_address"] as? String, "127.0.0.1")
+    XCTAssertEqual(locals[0]["local_port"] as? Int, 11086)
+    XCTAssertEqual(locals[0]["protocol"] as? String, "socks")
+    XCTAssertEqual(locals[0]["mode"] as? String, "tcp_and_udp")
+    XCTAssertEqual(locals[1]["local_port"] as? Int, 11087)
+    XCTAssertEqual(locals[1]["protocol"] as? String, "http")
+    XCTAssertNil(dictionary["x_shadowsocksx_ng_listen"])
+    XCTAssertNil(dictionary["x_shadowsocksx_ng_acl"])
+    XCTAssertNil(dictionary["ipv6_only"])
+    XCTAssertNil(dictionary["timeout"])
+    let servers = try XCTUnwrap(dictionary["servers"] as? [[String: Any]])
+    XCTAssertEqual(servers.count, 1)
+    let server = servers[0]
+    XCTAssertEqual(server["id"] as? String, "server-1", "叶子身份进入文档，供诊断与稳定标识")
+    XCTAssertFalse(
+      server.keys.contains("remarks"), "显示名是目录元数据，不进契约（只承载连接有效值）")
+    XCTAssertEqual(server["server"] as? String, "203.0.113.7")
+    XCTAssertEqual(server["server_port"] as? Int, 8388)
+    XCTAssertEqual(server["password"] as? String, "resolved-password")
+    XCTAssertEqual(server["method"] as? String, "aes-256-gcm")
+    XCTAssertEqual(server["plugin"] as? String, "/bundle/plugins/x")
+    XCTAssertEqual(server["plugin_opts"] as? String, "obfs=http")
+  }
+
+  func testPluginFieldsAreAbsentEntirelyWithoutPlugin() throws {
+    let dictionary = try encodedDictionary(makeDocument())
+
+    let server = try XCTUnwrap((dictionary["servers"] as? [[String: Any]])?[0])
+    XCTAssertFalse(server.keys.contains("plugin"), "选「无」时 plugin 字段整体省略（D10）")
+    XCTAssertFalse(server.keys.contains("plugin_opts"))
+  }
+
+  // MARK: 监听设置透传
+
+  func testRuntimeDocumentLeavesTimeoutAndLoggingAtUpstreamDefaults() throws {
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "server-1", server: "example.com", serverPort: 8388,
+          password: "pw", method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+      ],
+      listen: ProxyListeningConfiguration())
+
+    let dictionary = try encodedDictionary(document)
+    XCTAssertFalse(dictionary.keys.contains("timeout"))
+    XCTAssertFalse(dictionary.keys.contains("verbose"))
+  }
+
+  func testACLIdentityStaysInMemoryAndOnlyPathIsEncoded() throws {
+    let acl = ProxyACLDocument.direct(
+      at: URL(fileURLWithPath: "/tmp/ssxng-tests/acl-active.ini"))
+    let document = SslocalRuntimeDocument(
+      servers: [], listen: ProxyListeningConfiguration(), acl: acl)
+    let dictionary = try encodedDictionary(document)
+    XCTAssertEqual(dictionary["acl"] as? String, acl.path)
+    XCTAssertNil(dictionary["x_shadowsocksx_ng_acl"])
+
+    let changedPath = document.replacingACL(
+      .direct(at: URL(fileURLWithPath: "/tmp/ssxng-tests/other.acl")))
+    XCTAssertNotEqual(document.listenFingerprint, changedPath.listenFingerprint)
+  }
+
+  func testLocalhostModeDerivesBothSslocalInbounds() {
+    let listen = ProxyListeningConfiguration(
+      listenerMode: .disabled,
+      socksPort: 1086,
+      httpPort: 1087)
+
+    XCTAssertEqual(
+      listen.locals,
+      [
+        SslocalLocalDocument(
+          inboundProtocol: "socks", localAddress: "127.0.0.1", localPort: 1086,
+          mode: "tcp_and_udp"),
+        SslocalLocalDocument(
+          inboundProtocol: "http", localAddress: "127.0.0.1", localPort: 1087,
+          mode: "tcp_only"),
+      ])
+  }
+
+  func testAllIPv4ModeUsesWildcardBindings() {
+    let listen = ProxyListeningConfiguration(
+      listenerMode: .allIPv4Interfaces,
+      socksPort: 1086,
+      httpPort: 1087)
+
+    XCTAssertEqual(Set(listen.locals.map(\.localAddress)), ["127.0.0.1", "0.0.0.0"])
+  }
+
+  func testDualStackModeSetsIPv6OnlyFalseAndChangesListenerFingerprint() throws {
+    var listen = ProxyListeningConfiguration()
+    listen.listenerMode = .allIPv4AndIPv6Interfaces
+    let dualStack = SslocalRuntimeDocument(servers: [], listen: listen)
+    let dictionary = try encodedDictionary(dualStack)
+
+    XCTAssertEqual(dictionary["ipv6_only"] as? Bool, false)
+    XCTAssertEqual(dualStack.socksLocal?.probeHost, "127.0.0.1")
+
+    listen.listenerMode = .allIPv6Interfaces
+    let ipv6Only = SslocalRuntimeDocument(servers: [], listen: listen)
+
+    XCTAssertEqual(try encodedDictionary(ipv6Only)["ipv6_only"] as? Bool, true)
+    XCTAssertNotEqual(
+      dualStack.listenFingerprint, ipv6Only.listenFingerprint,
+      "IPv6_ONLY 差异必须使 wrapper 重启 sslocal，即使两者都绑定 ::")
+  }
+
+  func testListenerModeBindingsAndProxyLoopbackAddresses() {
+    XCTAssertEqual(
+      ListenerMode.allCases.map(\.bindingHint),
+      [
+        "127.0.0.1",
+        "0.0.0.0",
+        ":: / IPV6_V6ONLY=false",
+        ":: / IPV6_V6ONLY=true",
+      ])
+    for mode in ListenerMode.allCases {
+      let document = SslocalRuntimeDocument(
+        servers: [], listen: ProxyListeningConfiguration(listenerMode: mode))
+      XCTAssertEqual(document.socksLocal?.probeHost, "127.0.0.1")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/RuntimeEventStoreTests.swift b/ShadowsocksX-NG2/Tests/Runtime/RuntimeEventStoreTests.swift
new file mode 100644
index 000000000..cf7adf78a
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/RuntimeEventStoreTests.swift
@@ -0,0 +1,69 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// GUI 事件环形缓冲与 RuntimeLog 接收缝：顺序保持、容量封顶、
+/// emit 路由与恢复。
+final class RuntimeEventStoreTests: XCTestCase {
+  override func tearDown() {
+    super.tearDown()
+    // 恢复生产接线，避免污染同进程内其他测试。
+    RuntimeLog.setSink(RuntimeEventStore.shared)
+  }
+
+  func testAppendKeepsChronologicalOrderAndRendersLine() {
+    let store = RuntimeEventStore()
+    let first = Date(timeIntervalSince1970: 1_000)
+    let second = Date(timeIntervalSince1970: 2_000)
+
+    store.append(event: .contractWritten(serverCount: 42), timestamp: first)
+    store.append(event: .agentRegistered, timestamp: second)
+
+    let snapshot = store.snapshot
+    XCTAssertEqual(
+      snapshot.map(\.text),
+      ["contract written (servers=42)", "launch agent registered"])
+    XCTAssertEqual(snapshot.map(\.id), [0, 1])
+    // 行格式 = 固定格式时间戳 + 两空格 + 事件文本（不锚定时区，格式器随本机）。
+    XCTAssertEqual(
+      snapshot[0].renderedLine,
+      LogLine.timestampFormatter.string(from: first)
+        + "  contract written (servers=42)")
+    XCTAssertEqual(
+      snapshot[1].renderedLine,
+      LogLine.timestampFormatter.string(from: second) + "  launch agent registered")
+  }
+
+  func testCapacityKeepsMostRecentEvents() {
+    let store = RuntimeEventStore(capacity: 3)
+    for index in 0..<5 {
+      store.append(event: .contractWritten(serverCount: index), timestamp: Date())
+    }
+
+    XCTAssertEqual(
+      store.snapshot.map(\.text),
+      [
+        "contract written (servers=2)", "contract written (servers=3)",
+        "contract written (servers=4)",
+      ])
+  }
+
+  func testEmitRoutesToRegisteredSink() {
+    let store = RuntimeEventStore()
+    RuntimeLog.setSink(store)
+    defer { RuntimeLog.setSink(RuntimeEventStore.shared) }
+
+    RuntimeLog.emit(.contractWritten(serverCount: 2))
+
+    XCTAssertEqual(store.snapshot.last?.text, "contract written (servers=2)")
+    XCTAssertEqual(store.snapshot.count, 1)
+  }
+
+  func testEmitWithoutSinkStillWritesStderrOnly() {
+    RuntimeLog.setSink(nil)
+    defer { RuntimeLog.setSink(RuntimeEventStore.shared) }
+
+    // 未注册接收缝时 emit 只走 stderr，不崩溃即可（GUI 启动前的事件路径）。
+    RuntimeLog.emit(.agentRegistered)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/RuntimeFileStoreTests.swift b/ShadowsocksX-NG2/Tests/Runtime/RuntimeFileStoreTests.swift
new file mode 100644
index 000000000..fbe8129ef
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/RuntimeFileStoreTests.swift
@@ -0,0 +1,161 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 运行时文件存取：0700/0600 权限基线、原子替换、
+/// 读取侧判定与显式停止清理。
+final class RuntimeFileStoreTests: XCTestCase {
+  private var runtime: ProxyRuntimeFixture.TemporaryRuntime!
+  private var store: RuntimeFileStore!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    store = RuntimeFileStore(fileURL: runtime.contract)
+  }
+
+  override func tearDownWithError() throws {
+    try? FileManager.default.removeItem(at: runtime.directory)
+    try super.tearDownWithError()
+  }
+
+  private func permissions(of url: URL) throws -> Int {
+    let attributes = try FileManager.default.attributesOfItem(atPath: url.path)
+    return try XCTUnwrap(attributes[.posixPermissions] as? Int)
+  }
+
+  // MARK: 权限基线
+
+  func testWriteCreatesDirectoryWith0700AndFileWith0600() throws {
+    try store.write(ProxyRuntimeFixture.makeDocument())
+
+    XCTAssertEqual(try permissions(of: runtime.directory), 0o700, "runtime/ 目录 0700")
+    XCTAssertEqual(try permissions(of: store.supervisionFileURL), 0o600, "契约文件 0600")
+  }
+
+  func testWriteHealsDirectoryPermissionBaseline() throws {
+    try FileManager.default.createDirectory(
+      at: runtime.directory, withIntermediateDirectories: true)
+    try FileManager.default.setAttributes(
+      [.posixPermissions: 0o755], ofItemAtPath: runtime.directory.path)
+
+    try store.write(ProxyRuntimeFixture.makeDocument())
+
+    XCTAssertEqual(try permissions(of: runtime.directory), 0o700, "目录权限自愈回 0700")
+  }
+
+  func testAtomicReplaceKeepsFileAt0600() throws {
+    try store.write(ProxyRuntimeFixture.makeDocument(localPort: 1086))
+
+    try store.write(ProxyRuntimeFixture.makeDocument(localPort: 2086))
+
+    XCTAssertEqual(try permissions(of: store.supervisionFileURL), 0o600, "替换后仍 0600")
+    let document = try XCTUnwrap(store.loadDocument())
+    XCTAssertEqual(document.socksPort, 2086, "内容已被原子替换")
+  }
+
+  func testWriteLeavesNoTemporaryFilesBehind() throws {
+    try store.write(ProxyRuntimeFixture.makeDocument())
+    try store.write(ProxyRuntimeFixture.makeDocument(localPort: 2087))
+
+    let residue = try FileManager.default.contentsOfDirectory(atPath: runtime.directory.path)
+      .filter(AtomicFileWriter.isResidueName)
+    XCTAssertTrue(residue.isEmpty, "临时文件不应残留，实际 \(residue)")
+  }
+
+  // MARK: 读取侧判定
+
+  func testPublicationRecognizesWrittenIntent() throws {
+    let document = ProxyRuntimeFixture.makeDocument()
+    try store.write(document)
+
+    XCTAssertTrue(try store.contains(PreparedRuntimeContract(document)))
+    XCTAssertEqual(store.readData(), try document.jsonData())
+  }
+
+  func testLoadDocumentReturnsNilForMissingFile() throws {
+    XCTAssertNil(store.loadDocument())
+    XCTAssertNil(store.readData())
+  }
+
+  func testLoadDocumentReturnsNilForCorruptJSON() throws {
+    try AtomicFileWriter.write(Data("not json {".utf8), to: store.supervisionFileURL)
+
+    XCTAssertNil(store.loadDocument())
+  }
+
+  func testWriteRejectsStructurallyInvalidDocument() throws {
+    XCTAssertThrowsError(
+      try store.write(
+        SslocalRuntimeDocument(
+          servers: [], listen: ProxyListeningConfiguration(socksPort: 0))))
+    XCTAssertNil(store.loadDocument())
+  }
+
+  func testExplicitStopCleansFilesButPreservesGenerationHighWatermark() throws {
+    try store.write(ProxyRuntimeFixture.makeDocument())
+    let first = try XCTUnwrap(RuntimePublication.load(at: store.supervisionFileURL))
+    try store.deleteRuntimeFiles()
+    XCTAssertNil(store.loadDocument())
+    try store.deleteRuntimeFiles()
+    try store.write(ProxyRuntimeFixture.makeDocument())
+    XCTAssertGreaterThan(
+      try XCTUnwrap(RuntimePublication.load(at: store.supervisionFileURL)).generation,
+      first.generation)
+  }
+
+  // MARK: 文档校验与监听指纹
+
+  func testWellFormedValidationRejectsStructuralGarbage() {
+    func document(
+      localPort: Int = 1086,
+      servers: [SslocalServerDocument]
+    ) -> SslocalRuntimeDocument {
+      SslocalRuntimeDocument(
+        servers: servers,
+        listen: ProxyListeningConfiguration(
+          socksPort: localPort))
+    }
+    func server(
+      id: String = "s", address: String = "203.0.113.7", port: Int = 8388,
+      method: String = "aes-256-gcm"
+    ) -> SslocalServerDocument {
+      SslocalServerDocument(
+        id: id, server: address, serverPort: port, password: "pw",
+        method: method, plugin: nil, pluginOpts: nil)
+    }
+
+    XCTAssertTrue(document(servers: [server()]).isWellFormed)
+    XCTAssertTrue(
+      document(servers: []).isWellFormed,
+      "空 servers 合法：无活动目标的本地监听")
+    XCTAssertFalse(document(localPort: 0, servers: [server()]).isWellFormed)
+    XCTAssertFalse(document(localPort: 65_536, servers: [server()]).isWellFormed)
+    XCTAssertFalse(document(servers: [server(port: 0)]).isWellFormed)
+    XCTAssertFalse(document(servers: [server(address: "")]).isWellFormed)
+    XCTAssertFalse(document(servers: [server(method: "")]).isWellFormed)
+    XCTAssertFalse(document(servers: [server(id: "")]).isWellFormed)
+  }
+
+  func testListenFingerprintIgnoresServerChangesAndTracksListenFields() {
+    let base = ProxyRuntimeFixture.makeDocument()
+    let serverChanged = ProxyRuntimeFixture.makeDocument(serverAddress: "198.51.100.9")
+    let listenChanged = ProxyRuntimeFixture.makeDocument(localPort: 2088)
+
+    XCTAssertEqual(
+      base.listenFingerprint, serverChanged.listenFingerprint,
+      "仅服务器列表变化不影响监听指纹（走 SIGUSR1 热重载）")
+    XCTAssertNotEqual(
+      base.listenFingerprint, listenChanged.listenFingerprint,
+      "监听端口变化改变指纹（走优雅重启）")
+  }
+
+  func testValidatedRuntimeRequiresFixedTCPAndUDPModeForSOCKS() throws {
+    let base = ProxyRuntimeFixture.makeDocument()
+    var document = base
+    document.locals[0] = SslocalLocalDocument(
+      inboundProtocol: "socks", localAddress: "127.0.0.1", localPort: base.socksPort,
+      mode: "tcp_only")
+    XCTAssertFalse(document.isWellFormed)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/RuntimeFileStoreTransactionTests.swift b/ShadowsocksX-NG2/Tests/Runtime/RuntimeFileStoreTransactionTests.swift
new file mode 100644
index 000000000..e02913f3c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/RuntimeFileStoreTransactionTests.swift
@@ -0,0 +1,138 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct RuntimeFileStoreTransactionTests {
+  @Test(arguments: ["config-", "acl-", "agent-supervision.json"])
+  func failedPreparationPreservesPublishedDeployment(failingName: String) throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let old = ProxyRuntimeFixture.makeDocument().replacingACL(.direct(at: store.aclFileURL))
+    try store.write(old)
+    let before = try Data(contentsOf: store.supervisionFileURL)
+    let files = try FileManager.default.contentsOfDirectory(atPath: runtime.directory.path).sorted()
+    let failing = RuntimeFileStore(fileURL: runtime.contract) { data, url in
+      if url.lastPathComponent.hasPrefix(failingName) { throw POSIXError(.ENOSPC) }
+      try AtomicFileWriter.write(data, to: url)
+    }
+    #expect(throws: (any Error).self) {
+      try failing.write(old.replacingACL(.global(at: store.aclFileURL)))
+    }
+    #expect(try Data(contentsOf: store.supervisionFileURL) == before)
+    #expect(try store.contains(PreparedRuntimeContract(old)))
+    #expect(
+      try FileManager.default.contentsOfDirectory(atPath: runtime.directory.path).sorted() == files)
+  }
+
+  @Test func reuseAndRetirementProtectPublishedCachesAndFuturePreparations() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let direct = ProxyRuntimeFixture.makeDocument().replacingACL(.direct(at: store.aclFileURL))
+    try store.write(direct)
+    let first = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    try RuntimePublication.select(
+      first, configurationLink: runtime.contract, aclLink: store.aclFileURL)
+    try store.write(direct.replacingACL(.global(at: store.aclFileURL)))
+    let second = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let futureName = "config-00000000000000000099-sslocal.json"
+    let future = runtime.directory.appendingPathComponent(futureName)
+    try AtomicFileWriter.write(Data("preparing".utf8), to: future)
+    // Agent 持有旧快照，GUI 已发布新代；旧进程和新发布引用必须同时存活。
+    try RuntimePublication.retire(
+      before: second, publishedAt: store.supervisionFileURL,
+      protecting: first.retainedFiles)
+    #expect(
+      first.retainedFiles.union(second.retainedFiles).allSatisfy {
+        FileManager.default.fileExists(atPath: runtime.directory.appendingPathComponent($0).path)
+      })
+    try store.write(direct)
+    let third = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    #expect(third.acl == first.acl)
+    try RuntimePublication.retire(
+      before: second, publishedAt: store.supervisionFileURL,
+      protecting: first.retainedFiles)
+    #expect(
+      FileManager.default.fileExists(
+        atPath: runtime.directory.appendingPathComponent(third.configuration).path))
+    try RuntimePublication.select(
+      third, configurationLink: runtime.contract, aclLink: store.aclFileURL)
+    try RuntimePublication.retire(
+      before: third, publishedAt: store.supervisionFileURL, protecting: [])
+    #expect(
+      !FileManager.default.fileExists(
+        atPath: runtime.directory.appendingPathComponent(first.configuration).path))
+    #expect(FileManager.default.fileExists(atPath: future.path))
+    #expect(try String(contentsOf: store.aclFileURL, encoding: .utf8) == direct.aclRuntime?.content)
+  }
+}
+
+extension RuntimeFileStoreTransactionTests {
+  @Test func writerErrorAfterPublicationDoesNotDeletePublishedResources() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let failing = RuntimeFileStore(fileURL: runtime.contract) { data, url in
+      try AtomicFileWriter.write(data, to: url)
+      if url == store.supervisionFileURL { throw POSIXError(.EIO) }
+    }
+    #expect(throws: (any Error).self) { try failing.write(ProxyRuntimeFixture.makeDocument()) }
+    #expect(try store.contains(PreparedRuntimeContract(ProxyRuntimeFixture.makeDocument())))
+    #expect(RuntimePublication.load(at: store.supervisionFileURL) != nil)
+  }
+
+  @Test func cleanupWaitsForPublicationAndKeepsReusedOlderACL() async throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let direct = ProxyRuntimeFixture.makeDocument().replacingACL(.direct(at: store.aclFileURL))
+    try store.write(direct)
+    try store.write(direct.replacingACL(.global(at: store.aclFileURL)))
+    let stale = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let preparing = DispatchSemaphore(value: 0)
+    let release = DispatchSemaphore(value: 0)
+    let retired = DispatchSemaphore(value: 0)
+    let contractURL = runtime.contract
+    let publishedURL = store.supervisionFileURL
+    let writer = Task.detached {
+      let preparingStore = RuntimeFileStore(fileURL: contractURL) { data, url in
+        if url.lastPathComponent.hasSuffix("-sslocal.json") {
+          preparing.signal()
+          guard release.wait(timeout: .now() + 5) == .success else { throw POSIXError(.ETIMEDOUT) }
+        }
+        try AtomicFileWriter.write(data, to: url)
+      }
+      try preparingStore.write(direct)
+    }
+    let awaitPreparation = { preparing.wait(timeout: .now() + 5) }
+    #expect(awaitPreparation() == .success)
+    let cleanup = Task.detached {
+      defer { retired.signal() }
+      try RuntimePublication.retire(before: stale, publishedAt: publishedURL, protecting: [])
+    }
+    let awaitRetirement = { retired.wait(timeout: .now() + 0.05) }
+    #expect(awaitRetirement() == .timedOut)
+    release.signal()
+    try await writer.value
+    try await cleanup.value
+    let current = try #require(RuntimePublication.load(at: publishedURL))
+    #expect(current.generation > stale.generation)
+    #expect(current.acl == stale.aclVariants["direct"])
+    #expect(try store.contains(PreparedRuntimeContract(direct)))
+  }
+}
+
+extension RuntimeFileStoreTransactionTests {
+  @Test func successfulGUIObservationCannotEraseAgentsCurrentFailure() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    try store.write(ProxyRuntimeFixture.makeDocument())
+    try store.recordFailure(reason: "Agent observed failure after GUI probe")
+    let failure = try #require(store.readFailure())
+    #expect(throws: (any Error).self) { try store.settleSuccessfulDeployment() }
+    #expect(store.readFailure() == failure)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/RuntimeLogRedactionTests.swift b/ShadowsocksX-NG2/Tests/Runtime/RuntimeLogRedactionTests.swift
new file mode 100644
index 000000000..bafed761c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/RuntimeLogRedactionTests.swift
@@ -0,0 +1,86 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 日志脱敏基线：封闭事件枚举由构造保证不携带敏感值；脱敏
+/// 工具按敏感信息定义收敛 URL 与运行时文档摘要。
+final class RuntimeLogRedactionTests: XCTestCase {
+  /// 投毒夹具：敏感值埋进文档各字段，任何一条日志事件都不得带出。
+  private let poisoned = ProxyRuntimeFixture.makeDocument(
+    serverAddress: "203.0.113.7",
+    password: "SECRET-PASSWORD",
+    pluginOpts: "obfs=http;obfs-host=SECRET-HOST"
+  )
+
+  private let secrets = [
+    "SECRET-PASSWORD",
+    "SECRET-HOST",
+    "203.0.113.7",
+    "香港 01",
+  ]
+
+  private func assertNoSecrets(
+    _ text: String, file: StaticString = #filePath, line: UInt = #line
+  ) {
+    for secret in secrets {
+      XCTAssertFalse(
+        text.contains(secret),
+        "日志不得包含敏感值「\(secret)」\n实际：\(text)",
+        file: file, line: line)
+    }
+    XCTAssertFalse(text.contains("{"), "日志不得携带 JSON 文档内容", file: file, line: line)
+  }
+
+  func testDocumentSummaryExposesOnlyCountsProtocolsAndMode() {
+    let summary = Redactor.documentSummary(poisoned)
+
+    XCTAssertEqual(summary, "servers=1 protocols=socks,http mode=tcp_and_udp")
+    assertNoSecrets(summary)
+  }
+
+  func testRemoteURLKeepsOnlySchemeAndHost() {
+    XCTAssertEqual(
+      Redactor.remoteURL("https://user:SECRET@example.com/sub/CLASH-SECRET?token=abc&x=1"),
+      "https://example.com/…",
+      "完整订阅 URL 与 URL token 永不入日志（D5）")
+  }
+
+  func testRemoteURLRedactsUnparseableAndEmptyValues() {
+    for bad in ["", "not a url", "https://", "ftp://"] {
+      XCTAssertEqual(
+        Redactor.remoteURL(bad), "<redacted-url>",
+        "无法安全归约的 URL 一律占位：\(bad)")
+    }
+  }
+
+  func testEveryRuntimeLogEventRendersWithoutJSONDumps() {
+    let events: [RuntimeLogEvent] = [
+      .contractWritten(serverCount: poisoned.servers.count),
+      .contractUnchanged,
+      .runtimeFilesDeleted,
+      .runtimePersistFailed(detail: "errno 13"),
+      .agentRegistered,
+      .agentRegisterFailed(detail: "SMAppService error 9"),
+      .agentUnregistered,
+      .agentUnregisterFailed(detail: "SMAppService error 9"),
+      .sslocalSpawned(pid: 42),
+      .sslocalSpawnFailed,
+      .sslocalExitedUnexpectedly(status: 78),
+      .sslocalStopRequested,
+      .contractMissing,
+      .contractInvalid,
+      .reloadForwarded,
+      .reloadRestarted,
+      .endpointProbeFailed(host: "127.0.0.1", port: 1086, detail: "Connection refused"),
+      .activationFailed(
+        reason: AppPresentation.message(
+          for: ActivationFailure.invalidLeaf(
+            node: NodeID(rawValue: "leaf-1"),
+            reason: .pluginNotProvided(program: "simple-obfs")))),
+      .diagnosticsExported,
+    ]
+
+    let joined = events.map(\.description).joined(separator: "\n")
+    XCTAssertFalse(joined.contains("{"), "日志不得携带 JSON 文档内容")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/RuntimeLogSystemLogRouteTests.swift b/ShadowsocksX-NG2/Tests/Runtime/RuntimeLogSystemLogRouteTests.swift
new file mode 100644
index 000000000..2a5c0d67c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/RuntimeLogSystemLogRouteTests.swift
@@ -0,0 +1,101 @@
+import Foundation
+import Testing
+import os
+
+@testable import ShadowsocksX_NG2
+
+/// 系统日志路由基线：level 三分（失败 error / 里程碑 default / 冗长测量
+/// info）、category 五分、公开文本与 private detail 的拆分。映射是封闭枚举
+/// 上的纯数据，测数据不测转发。
+@Suite struct RuntimeLogSystemLogRouteTests {
+  private let detail = "SECRET-DETAIL"
+
+  private struct Expectation {
+    var event: RuntimeLogEvent
+    var level: OSLogType
+    var category: String
+    var detail: String?
+  }
+
+  /// 全部事件的路由事实；新增事件漏路由由穷举 switch 兜底，本表锁定
+  /// level / category / detail 拆分不随重构漂移。
+  private var expectations: [Expectation] {
+    let trace = ConnectivityTrace(phase: .sample, status: .success)
+    return [
+      Expectation(
+        event: .contractWritten(serverCount: 2), level: .default, category: "runtime", detail: nil),
+      Expectation(event: .contractUnchanged, level: .default, category: "runtime", detail: nil),
+      Expectation(event: .runtimeFilesDeleted, level: .default, category: "runtime", detail: nil),
+      Expectation(event: .contractMissing, level: .error, category: "runtime", detail: nil),
+      Expectation(event: .contractInvalid, level: .error, category: "runtime", detail: nil),
+      Expectation(
+        event: .activationFailed(reason: "no usable server"), level: .error, category: "runtime",
+        detail: nil),
+      Expectation(
+        event: .runtimePersistFailed(detail: detail), level: .error, category: "runtime",
+        detail: detail),
+      Expectation(
+        event: .settingsUnreadable(detail: detail), level: .error, category: "runtime",
+        detail: detail),
+      Expectation(event: .agentRegistered, level: .default, category: "supervision", detail: nil),
+      Expectation(event: .agentUnregistered, level: .default, category: "supervision", detail: nil),
+      Expectation(
+        event: .sslocalSpawned(pid: 1), level: .default, category: "supervision", detail: nil),
+      Expectation(
+        event: .sslocalStopRequested, level: .default, category: "supervision", detail: nil),
+      Expectation(event: .reloadForwarded, level: .default, category: "supervision", detail: nil),
+      Expectation(event: .reloadDeferred, level: .default, category: "supervision", detail: nil),
+      Expectation(event: .reloadRestarted, level: .default, category: "supervision", detail: nil),
+      Expectation(event: .sslocalSpawnFailed, level: .error, category: "supervision", detail: nil),
+      Expectation(
+        event: .sslocalExitedUnexpectedly(status: 1), level: .error, category: "supervision",
+        detail: nil),
+      Expectation(
+        event: .listenNotEstablished(detail: "socks 127.0.0.1:11086"),
+        level: .error, category: "supervision", detail: nil),
+      Expectation(
+        event: .agentRegisterFailed(detail: detail), level: .error, category: "supervision",
+        detail: detail),
+      Expectation(
+        event: .agentUnregisterFailed(detail: detail), level: .error, category: "supervision",
+        detail: detail),
+      Expectation(
+        event: .systemProxyUnchanged, level: .default, category: "system-proxy", detail: nil),
+      Expectation(
+        event: .systemProxyHelperRegisterFailed(detail: detail),
+        level: .error, category: "system-proxy", detail: detail),
+      Expectation(
+        event: .systemProxyWriteFailed(detail: detail), level: .error, category: "system-proxy",
+        detail: detail),
+      Expectation(
+        event: .connectivityMeasurement(id: UUID(), entry: trace),
+        level: .info, category: "connectivity", detail: trace.description),
+      Expectation(
+        event: .endpointProbeFailed(host: "127.0.0.1", port: 11086, detail: detail),
+        level: .error, category: "connectivity", detail: detail),
+      Expectation(
+        event: .diagnosticsExported, level: .default, category: "diagnostics", detail: nil),
+    ]
+  }
+
+  @Test func everyEventRoutesToLevelCategoryAndPrivacySplit() {
+    for row in expectations {
+      let route = row.event.systemLogRoute
+      #expect(route.level == row.level, "level 漂移：\(row.event)")
+      #expect(route.category == row.category, "category 漂移：\(row.event)")
+      #expect(route.privateDetail == row.detail, "detail 拆分漂移：\(row.event)")
+    }
+  }
+
+  @Test func publicTextPlusPrivateDetailMatchesDescription() {
+    for row in expectations {
+      let route = row.event.systemLogRoute
+      // 公开文本只到分隔符为止；detail（含连通性测量的目标 IP）只进 private 段。
+      #expect(
+        route.text + (route.privateDetail ?? "") == row.event.description, "公开文本漂移：\(row.event)")
+      if let detail = route.privateDetail {
+        #expect(!route.text.contains(detail), "公开文本不得携带 private detail：\(row.event)")
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/RuntimePublicationTests.swift b/ShadowsocksX-NG2/Tests/Runtime/RuntimePublicationTests.swift
new file mode 100644
index 000000000..bde198edb
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/RuntimePublicationTests.swift
@@ -0,0 +1,360 @@
+import Darwin
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct RuntimePublicationTests {
+  @Test func aclAndServerChangesDoNotRequireRestart() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    try store.write(
+      ProxyRuntimeFixture.makeDocument().replacingACL(.global(at: store.aclFileURL)))
+    let previous = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    try store.write(
+      ProxyRuntimeFixture.makeDocument(serverAddress: "198.51.100.9")
+        .replacingACL(.direct(at: store.aclFileURL)))
+    let next = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    #expect(next.acl != previous.acl)
+    #expect(next.configurationID != previous.configurationID)
+    #expect(next.reloadSignals(from: previous) == [SIGUSR1, SIGUSR2])
+    #expect(!next.requiresRestart(from: previous))
+  }
+
+  @Test func configurationIdentitySurvivesACLOnlyPublicationAndLegacyReloadIsConservative() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let source = ProxyRuntimeFixture.makeDocument().replacingACL(.global(at: store.aclFileURL))
+    try store.write(source)
+    let previous = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    try store.write(source.replacingACL(.direct(at: store.aclFileURL)))
+    let next = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    #expect(previous.configurationID != nil)
+    #expect(next.configurationID == previous.configurationID)
+    #expect(next.configuration != previous.configuration)
+    #expect(next.reloadSignals(from: previous) == [SIGUSR2])
+    let bytes = try JSONEncoder().encode(next)
+    var object = try #require(JSONSerialization.jsonObject(with: bytes) as? [String: Any])
+    object.removeValue(forKey: "configurationID")
+    let legacy = try JSONDecoder().decode(
+      RuntimeSupervision.self, from: JSONSerialization.data(withJSONObject: object))
+    #expect(legacy.hasValidStructure)
+    #expect(legacy.reloadSignals(from: legacy) == [SIGUSR1])
+  }
+
+  @Test func publicationDoesNotSelectActiveLinks() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let source = ProxyRuntimeFixture.makeDocument().replacingACL(.direct(at: store.aclFileURL))
+    try store.write(source)
+    #expect(
+      (try? FileManager.default.destinationOfSymbolicLink(atPath: store.aclFileURL.path)) == nil)
+    #expect(!FileManager.default.fileExists(atPath: runtime.contract.path))
+    #expect(try store.contains(PreparedRuntimeContract(source)))
+  }
+}
+
+extension RuntimePublicationTests {
+  @Test func opaqueConfigurationUsesExplicitMetadataThroughSelectionAndRetirement() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let document = ProxyRuntimeFixture.makeDocument()
+    try store.write(document)
+    let original = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let bytes = try Data(contentsOf: store.supervisionFileURL)
+    var object = try #require(JSONSerialization.jsonObject(with: bytes) as? [String: Any])
+    let prefix = String(format: "config-%020llu-", original.generation)
+    let configuration = prefix + "payload.bin"
+    let metadata = prefix + "gui-metadata.dat"
+    try FileManager.default.moveItem(
+      at: runtime.directory.appendingPathComponent(original.intentMetadata),
+      to: runtime.directory.appendingPathComponent(metadata))
+    let payload = Data([0x00, 0xff, 0x80, 0x01])
+    try AtomicFileWriter.write(payload, to: runtime.directory.appendingPathComponent(configuration))
+    object["configuration"] = configuration
+    object["intentMetadata"] = metadata
+    try AtomicFileWriter.write(
+      JSONSerialization.data(withJSONObject: object), to: store.supervisionFileURL)
+
+    let selected = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    #expect(store.publishedSummary()?.contains("servers=1") == true)
+    try RuntimePublication.select(
+      selected, configurationLink: runtime.contract, aclLink: store.aclFileURL)
+    #expect(try Data(contentsOf: runtime.contract) == payload)
+    try store.write(document)
+    let next = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    try RuntimePublication.retire(
+      before: next, publishedAt: store.supervisionFileURL, protecting: selected.retainedFiles)
+    for name in [configuration, metadata] {
+      #expect(
+        FileManager.default.fileExists(atPath: runtime.directory.appendingPathComponent(name).path))
+    }
+    try RuntimePublication.select(
+      next, configurationLink: runtime.contract, aclLink: store.aclFileURL)
+    try RuntimePublication.retire(
+      before: next, publishedAt: store.supervisionFileURL, protecting: [])
+    for name in [configuration, metadata] {
+      #expect(
+        !FileManager.default.fileExists(atPath: runtime.directory.appendingPathComponent(name).path)
+      )
+    }
+    #expect(try store.contains(PreparedRuntimeContract(document)))
+  }
+
+  @Test func metadataReferenceIsRequiredAndMustBeDistinctAndFromTheSameGeneration() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    try store.write(ProxyRuntimeFixture.makeDocument())
+    let snapshot = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let bytes = try Data(contentsOf: store.supervisionFileURL)
+    let invalidReferences: [String?] = [
+      nil, "../outside.json", snapshot.configuration,
+      String(format: "config-%020llu-intent.json", snapshot.generation - 1),
+      String(format: "config-%020llu-intent.json", snapshot.generation + 1),
+      String(format: "auth-%020llu-intent.json", snapshot.generation),
+    ]
+    for reference in invalidReferences {
+      var object = try #require(JSONSerialization.jsonObject(with: bytes) as? [String: Any])
+      object["intentMetadata"] = reference
+      try AtomicFileWriter.write(
+        JSONSerialization.data(withJSONObject: object), to: store.supervisionFileURL)
+      #expect(RuntimePublication.metadata(at: store.supervisionFileURL) == nil)
+    }
+  }
+
+  @Test func missingOrSymlinkedMetadataPreventsDeploymentSelection() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    try store.write(ProxyRuntimeFixture.makeDocument())
+    let snapshot = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let metadataURL = runtime.directory.appendingPathComponent(snapshot.intentMetadata)
+    try FileManager.default.removeItem(at: metadataURL)
+    #expect(RuntimePublication.load(at: store.supervisionFileURL) == nil)
+    #expect(throws: (any Error).self) {
+      try RuntimePublication.select(
+        snapshot, configurationLink: runtime.contract, aclLink: store.aclFileURL)
+    }
+    try FileManager.default.createSymbolicLink(
+      at: metadataURL,
+      withDestinationURL: runtime.directory.appendingPathComponent(snapshot.configuration))
+    #expect(RuntimePublication.load(at: store.supervisionFileURL) == nil)
+    #expect(throws: (any Error).self) {
+      try RuntimePublication.select(
+        snapshot, configurationLink: runtime.contract, aclLink: store.aclFileURL)
+    }
+    #expect(!FileManager.default.fileExists(atPath: runtime.contract.path))
+  }
+
+  @Test func routingIntentChangesEvenWhenUpstreamJSONDoesNot() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let direct = ProxyRuntimeFixture.makeDocument().replacingACL(.direct(at: store.aclFileURL))
+    let global = direct.replacingACL(.global(at: store.aclFileURL))
+    try store.write(direct)
+
+    #expect(try direct.jsonData() == global.jsonData())
+    #expect(try store.contains(PreparedRuntimeContract(direct)))
+    #expect(try !store.contains(PreparedRuntimeContract(global)))
+    #expect(store.receiptIdentity(for: global) == nil)
+    #expect(store.publishedSummary()?.contains("servers=1") == true)
+  }
+
+  @Test func damagedOutputIsNotConsideredCurrentAndKeepsFailureIdentity() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let document = ProxyRuntimeFixture.makeDocument()
+    try store.write(document)
+    try store.recordFailure(reason: "test failure")
+    let snapshot = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    try AtomicFileWriter.write(
+      Data("damaged output".utf8),
+      to: runtime.directory.appendingPathComponent(snapshot.configuration))
+
+    #expect(try !store.contains(PreparedRuntimeContract(document)))
+    #expect(store.blocksDeployment(document))
+    #expect(store.receiptIdentity(for: document) == snapshot.deploymentID)
+    #expect(store.publishedSummary()?.contains("servers=1") == true)
+  }
+
+  @Test func publishedConfigurationContainsOnlyUpstreamFields() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    var listen = ProxyListeningConfiguration(listenerMode: .allIPv4Interfaces)
+    listen.lan.authenticationEnabled = true
+    let document = SslocalRuntimeDocument(
+      servers: [], listen: listen, acl: .direct(at: store.aclFileURL)
+    ).authenticatingLAN(
+      .init(username: "user", password: "lan-secret", directory: runtime.directory.path))
+    try store.write(document)
+    let snapshot = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let data = try Data(
+      contentsOf: runtime.directory.appendingPathComponent(snapshot.configuration))
+    let object = try #require(JSONSerialization.jsonObject(with: data) as? [String: Any])
+    #expect(Set(object.keys) == ["servers", "locals", "acl"])
+    #expect(data.range(of: Data("lan-secret".utf8)) == nil)
+    #expect(object["acl"] as? String == store.aclFileURL.path)
+  }
+
+  @Test func supervisionContainsNoCredentialsAndAuthenticationUsesOpaqueIdentity() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    var listen = ProxyListeningConfiguration(listenerMode: .allIPv4Interfaces)
+    listen.lan.authenticationEnabled = true
+    listen.lan.username = "sample-lan-user"
+    listen.lan.password = "sample-keychain-reference"
+    let auth = RuntimeListenerAuthentication(
+      username: listen.lan.username,
+      password: "sample-lan-password", directory: runtime.directory.path)
+    let document = SslocalRuntimeDocument(
+      servers: [
+        .init(
+          id: "server", server: "127.0.0.1", serverPort: 8388,
+          password: "sample-server-password", method: "aes-256-gcm",
+          plugin: "plugin", pluginOpts: "sample-plugin-secret")
+      ], listen: listen
+    ).authenticatingLAN(auth)
+    try store.write(document)
+    let snapshot = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let bytes = try String(contentsOf: store.supervisionFileURL, encoding: .utf8)
+    for secret in [
+      auth.username, auth.password, "sample-keychain-reference", "sample-server-password",
+      "sample-plugin-secret", ProxyACLDocument.digest(auth.username + ":" + auth.password),
+    ] {
+      #expect(!bytes.contains(secret))
+    }
+    #expect(snapshot.authenticationID.flatMap(UUID.init(uuidString:)) != nil)
+    #expect(snapshot.authenticationFiles.count == 2)
+    try store.write(document)
+    let next = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    #expect(next.generation > snapshot.generation)
+    #expect(next.authenticationID == snapshot.authenticationID)
+    #expect(next.authenticationFiles == snapshot.authenticationFiles)
+    #expect(next.configuration != snapshot.configuration)
+    let rotated = document.authenticatingLAN(
+      .init(
+        username: auth.username,
+        password: "new-password", directory: runtime.directory.path))
+    try store.write(rotated)
+    let last = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    #expect(last.requiresRestart(from: next))
+    #expect(last.authenticationID != next.authenticationID)
+  }
+
+  @Test func invalidVersionsAndEscapingReferencesAreRejected() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    try store.write(ProxyRuntimeFixture.makeDocument())
+    let bytes = try Data(contentsOf: store.supervisionFileURL)
+    for (key, value) in [
+      ("version", 1 as Any), ("version", 99 as Any), ("configuration", "../outside.json" as Any),
+      ("configurationID", "invalid-identity" as Any),
+    ] {
+      var object = try #require(JSONSerialization.jsonObject(with: bytes) as? [String: Any])
+      object[key] = value
+      try AtomicFileWriter.write(
+        JSONSerialization.data(withJSONObject: object), to: store.supervisionFileURL)
+      #expect(RuntimePublication.load(at: store.supervisionFileURL) == nil)
+    }
+    try AtomicFileWriter.write(bytes, to: store.supervisionFileURL)
+    let snapshot = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let url = runtime.directory.appendingPathComponent(snapshot.configuration)
+    try FileManager.default.removeItem(at: url)
+    try FileManager.default.createSymbolicLink(atPath: url.path, withDestinationPath: "/etc/hosts")
+    #expect(RuntimePublication.load(at: store.supervisionFileURL) == nil)
+  }
+
+  @Test func generationOverflowAndCorruptionNeverReplacePublication() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    try store.write(ProxyRuntimeFixture.makeDocument())
+    let before = try Data(contentsOf: store.supervisionFileURL)
+    for value in [String(UInt64.max), "broken"] {
+      try AtomicFileWriter.write(
+        Data(value.utf8), to: runtime.directory.appendingPathComponent("runtime-generation"))
+      #expect(throws: (any Error).self) { try store.write(ProxyRuntimeFixture.makeDocument()) }
+      #expect(try Data(contentsOf: store.supervisionFileURL) == before)
+    }
+  }
+}
+
+extension RuntimePublicationTests {
+  @Test func defaultStorageSeparatesConfigurationRuntimeAndLogs() {
+    let configurationFiles = [
+      CatalogFileStore.defaultFileURL(), ProxyListeningFileStore.defaultFileURL(),
+      ActivationStateFileStore.defaultFileURL(), CustomRuleStore.defaultFileURL(),
+      PluginMappingFileStore().fileURL,
+    ]
+    for file in configurationFiles {
+      #expect(file.deletingLastPathComponent().lastPathComponent == "configuration")
+    }
+    #expect(ApplicationSupportPaths.current.runtime.directoryURL.lastPathComponent == "runtime")
+    #expect(
+      ApplicationSupportPaths.current.agentLogURL.deletingLastPathComponent().lastPathComponent
+        == "logs")
+  }
+}
+
+extension RuntimePublicationTests {
+  @Test func stoppingRuntimePreservesConfigurationLogsAndCoordinationFiles() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let paths = ApplicationSupportPaths(rootURL: root)
+    let preserved = [
+      paths.catalogFileURL, paths.proxyListeningFileURL, paths.customRulesFileURL,
+      paths.activationStateFileURL, paths.pluginMappingFileURL, paths.agentLogURL,
+      paths.configurationDirectoryURL.appendingPathComponent(".catalog.age.tmp-in-flight"),
+      root.appendingPathComponent("catalog.age"),
+    ]
+    let sentinel = Data("must survive stopping the runtime".utf8)
+    for file in preserved { try AtomicFileWriter.write(sentinel, to: file) }
+    let store = RuntimeFileStore(fileURL: paths.runtime.fileURL)
+    let document = ProxyRuntimeFixture.makeDocument().replacingACL(
+      .direct(at: paths.runtime.aclFileURL))
+    try store.write(document)
+    let first = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    try RuntimePublication.select(
+      first, configurationLink: store.fileURL, aclLink: store.aclFileURL)
+    try AtomicFileWriter.write(Data(), to: paths.runtime.agentLockURL)
+    try store.deleteRuntimeFiles()
+
+    for file in preserved { #expect(try Data(contentsOf: file) == sentinel) }
+    #expect(!FileManager.default.fileExists(atPath: store.fileURL.path))
+    #expect(!FileManager.default.fileExists(atPath: store.supervisionFileURL.path))
+    #expect(
+      try Set(FileManager.default.contentsOfDirectory(atPath: store.directoryURL.path))
+        == ["runtime-generation", "runtime.lock", "agent.lock"])
+    try store.write(document)
+    let next = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    #expect(next.generation > first.generation)
+  }
+}
+
+extension RuntimePublicationTests {
+  @Test func newLayoutDoesNotLoadOrModifyFlatConfiguration() throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let paths = ApplicationSupportPaths(rootURL: root)
+    let oldURL = root.appendingPathComponent("catalog.age")
+    let oldStore = makeTestCatalogStore(fileURL: oldURL)
+    var catalog = ConfigurationCatalog()
+    _ = try catalog.addTestServer("old-layout")
+    try oldStore.save(CatalogDocument(catalog: catalog))
+    let oldBytes = try Data(contentsOf: oldURL)
+    let newStore = makeTestCatalogStore(fileURL: paths.catalogFileURL)
+    #expect(try newStore.load().catalog == ConfigurationCatalog())
+    #expect(try Data(contentsOf: oldURL) == oldBytes)
+    #expect(try oldStore.load().catalog == catalog)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/RuntimeReloadStateTests.swift b/ShadowsocksX-NG2/Tests/Runtime/RuntimeReloadStateTests.swift
new file mode 100644
index 000000000..87c6df8ce
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/RuntimeReloadStateTests.swift
@@ -0,0 +1,52 @@
+import Darwin
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct RuntimeReloadStateTests {
+  @Test func serverPublicationPreservesDeferredACLReloadAndFlushClearsSignals() throws {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    defer { try? FileManager.default.removeItem(at: runtime.directory) }
+    let store = RuntimeFileStore(fileURL: runtime.contract)
+    let initial = ProxyRuntimeFixture.makeDocument(localPort: 1086).replacingACL(
+      .global(at: store.aclFileURL))
+    try store.write(initial)
+    let previous = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let direct = initial.replacingACL(.direct(at: store.aclFileURL))
+    try store.write(direct)
+    let aclOnly = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    try store.write(
+      ProxyRuntimeFixture.makeDocument(serverAddress: "198.51.100.9", localPort: 1086)
+        .replacingACL(direct.aclRuntime))
+    let serverOnly = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+
+    var state = RuntimeReloadState()
+    state.enqueue(aclOnly, from: previous)
+    state.enqueue(serverOnly, from: aclOnly)
+    state.enqueue(serverOnly, from: serverOnly)
+    var delivered: [Int32] = []
+    #expect(
+      state.flush {
+        delivered.append($0)
+        return true
+      })
+    #expect(delivered == [SIGUSR1, SIGUSR2].sorted())
+    delivered.removeAll()
+    #expect(
+      state.flush {
+        delivered.append($0)
+        return true
+      })
+    #expect(delivered.isEmpty)
+
+    state.enqueue(aclOnly, from: serverOnly)
+    #expect(!state.flush { _ in false })
+    #expect(
+      state.flush {
+        delivered.append($0)
+        return true
+      })
+    #expect(delivered == [SIGUSR1])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/SeparateListenerTests.swift b/ShadowsocksX-NG2/Tests/Runtime/SeparateListenerTests.swift
new file mode 100644
index 000000000..f8079573c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/SeparateListenerTests.swift
@@ -0,0 +1,230 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct SeparateListenerTests {
+  @Test func disabledAuthenticationDoesNotPublishRetainedPassword() throws {
+    var listen = ProxyListeningConfiguration()
+    listen.lan.password = "PRIVATE-RETAINED-PASSWORD"
+    let document = SslocalRuntimeDocument(servers: [], listen: listen)
+    #expect(try document.jsonData().range(of: Data("PRIVATE-RETAINED-PASSWORD".utf8)) == nil)
+  }
+
+  @Test func terminalCommandsTreatPasswordAsUsableSecretWithoutReshaping() {
+    var settings = ProxyListeningConfiguration(listenerMode: .allIPv4Interfaces)
+    settings.lan.authenticationEnabled = true
+    settings.lan.username = "user"
+    // 契约 = 可用秘密：空密码等不合规形状不再被本层拒绝，只做百分号编码。
+    let commands = TerminalProxyEnvironmentCommands(
+      listen: RuntimeListenFacts(listen: settings),
+      commandAddress: TerminalCommandAddress(
+        bsdName: "en0", address: "192.0.2.2", displayName: "Wi-Fi"),
+      password: { "" })
+    #expect(commands.failure == nil)
+    #expect(commands.zshBash.contains("http://user:@192.0.2.2:11089"))
+    #expect(commands.zshBash.contains("socks5://user:@192.0.2.2:11088"))
+  }
+
+  @Test func newFormatsPreserveEncodedLANCredentialsAndBracketIPv6() {
+    var settings = ProxyListeningConfiguration(listenerMode: .allIPv4AndIPv6Interfaces)
+    settings.lan.authenticationEnabled = true
+    settings.lan.username = "u @"
+    let commands = TerminalProxyEnvironmentCommands(
+      listen: RuntimeListenFacts(listen: settings),
+      commandAddress: TerminalCommandAddress(
+        bsdName: "en0", address: "2001:db8::2", displayName: "Wi-Fi"),
+      password: { "p':@/$%!\"&^()" })
+    let http = "http://u%20%40:p%27%3A%40%2F%24%25%21%22%26%5E%28%29@[2001:db8::2]:11089"
+    #expect(commands.nushell.contains("$env.http_proxy = '\(http)'"))
+    #expect(commands.windowsPowerShell.contains("$env:http_proxy = '\(http)'"))
+    let cmdUserInfo = "u%~P20%~P40:p%~P27%~P3A%~P40%~P2F%~P24%~P25%~P21%~P22%~P26%~P5E%~P28%~P29"
+    #expect(
+      commands.windowsCMD
+        == "for %P in (\"%\") do set \"http_proxy=http://\(cmdUserInfo)@[2001:db8::2]:11089\"\r\n"
+        + "for %P in (\"%\") do set \"https_proxy=http://\(cmdUserInfo)@[2001:db8::2]:11089\"\r\n"
+        + "for %P in (\"%\") do set \"all_proxy=socks5://\(cmdUserInfo)@[2001:db8::2]:11088\"\r\n"
+        + "set \"no_proxy=localhost,127.0.0.1,::1,.local\"")
+    #expect(commands.failure == nil)
+  }
+
+  @Test func windowsFormatsSetFourSessionVariablesUsingLANPorts() {
+    let commands = TerminalProxyEnvironmentCommands(
+      listen: RuntimeListenFacts(
+        listen: ProxyListeningConfiguration(listenerMode: .allIPv4Interfaces)),
+      commandAddress: TerminalCommandAddress(
+        bsdName: "en0", address: "192.0.2.2", displayName: "Wi-Fi"))
+    #expect(
+      commands.windowsCMD == "set \"http_proxy=http://192.0.2.2:11089\" & "
+        + "set \"https_proxy=http://192.0.2.2:11089\" & "
+        + "set \"all_proxy=socks5://192.0.2.2:11088\" & "
+        + "set \"no_proxy=localhost,127.0.0.1,::1,.local\"")
+    #expect(
+      commands.windowsPowerShell == "$env:http_proxy = 'http://192.0.2.2:11089'; "
+        + "$env:https_proxy = 'http://192.0.2.2:11089'; "
+        + "$env:all_proxy = 'socks5://192.0.2.2:11088'; "
+        + "$env:no_proxy = 'localhost,127.0.0.1,::1,.local';")
+  }
+
+  @Test func nushellSetsFourSessionVariablesUsingLocalPorts() {
+    let commands = TerminalProxyEnvironmentCommands(
+      listen: RuntimeListenFacts(listen: ProxyListeningConfiguration()),
+      commandAddress: TerminalCommandAddress(
+        bsdName: "lo0", address: "127.0.0.1", displayName: "lo0"))
+    #expect(
+      commands.nushell == "$env.http_proxy = 'http://127.0.0.1:11087'; "
+        + "$env.https_proxy = 'http://127.0.0.1:11087'; "
+        + "$env.all_proxy = 'socks5://127.0.0.1:11086'; "
+        + "$env.no_proxy = 'localhost,127.0.0.1,::1,.local';")
+  }
+
+  @Test func disabledIPv6ConfigurationRoundTripsWithoutAffectingEffectiveRuntime() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = makeTestListeningStore(
+      fileURL: directory.appendingPathComponent("proxy-listening.json"))
+    var listen = ProxyListeningConfiguration()
+    listen.lan.mode = .allIPv6Interfaces
+    listen.lan.authenticationEnabled = true
+    listen.lan.password = "saved-reference"
+    try store.save(listen)
+    let restored = try store.load()
+    #expect(!restored.lan.isEnabled)
+    #expect(restored.lan.mode == .allIPv6Interfaces)
+    #expect(restored.lan.password == "saved-reference")
+    let document = SslocalRuntimeDocument(servers: [], listen: restored)
+    #expect(document.locals.count == 2)
+    #expect(document.ipv6Only == nil)
+    #expect(document.isWellFormed)
+    #expect(
+      PortOccupancyProbeRequest(endpoint: .socks, listen: RuntimeListenFacts(listen: restored))
+        .bindAddress == "127.0.0.1")
+  }
+
+  @Test func enablingLANPreservesLocalListeners() {
+    var listen = ProxyListeningConfiguration()
+    listen.listenerMode = .allIPv4Interfaces
+    #expect(listen.locals.count == 4)
+    #expect(listen.locals.first?.localAddress == "127.0.0.1")
+    #expect(listen.locals.first?.mode == "tcp_and_udp")
+    #expect(listen.locals.last?.localPort == 11089)
+  }
+
+  @Test func oldSettingsFileIsIgnoredAndPreserved() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let oldURL = directory.appendingPathComponent("settings.json")
+    let oldData = Data(
+      #"{"localListen":{"socksPort":13001,"httpPort":13002},"agentEnabled":true}"#.utf8)
+    try AtomicFileWriter.write(oldData, to: oldURL)
+    let newURL = directory.appendingPathComponent(
+      ProxyListeningFileStore.defaultFileURL().lastPathComponent)
+    let store = makeTestListeningStore(fileURL: newURL)
+    #expect(try store.load() == ProxyListeningConfiguration())
+    try store.save(ProxyListeningConfiguration())
+    #expect(try Data(contentsOf: oldURL) == oldData)
+  }
+
+  @Test func networkCommandUsesLANPorts() {
+    let listen = ProxyListeningConfiguration(listenerMode: .allIPv4Interfaces)
+    let commands = TerminalProxyEnvironmentCommands(
+      listen: RuntimeListenFacts(listen: listen),
+      commandAddress: TerminalCommandAddress(
+        bsdName: "en0", address: "192.0.2.2", displayName: "Wi-Fi"))
+    #expect(commands.zshBash.contains("http://192.0.2.2:11089"))
+    #expect(commands.fish.contains("socks5://192.0.2.2:11088"))
+  }
+
+  @Test func authenticationEncodesSpecialCharactersAndNeverReadsPasswordForLocalCommands() {
+    var settings = ProxyListeningConfiguration(listenerMode: .allIPv4AndIPv6Interfaces)
+    settings.lan.authenticationEnabled = true
+    settings.lan.username = "u @"
+    let facts = RuntimeListenFacts(listen: settings)
+    let commands = TerminalProxyEnvironmentCommands(
+      listen: facts,
+      commandAddress: TerminalCommandAddress(
+        bsdName: "en0", address: "2001:db8::2", displayName: "Wi-Fi"),
+      password: { "p':@/$" })
+    #expect(commands.zshBash.contains("http://u%20%40:p%27%3A%40%2F%24@[2001:db8::2]:11089"))
+    #expect(commands.fish.contains("socks5://u%20%40:p%27%3A%40%2F%24@[2001:db8::2]:11088"))
+    #expect(commands.failure == nil)
+    let local = TerminalProxyEnvironmentCommands(
+      listen: facts,
+      commandAddress: TerminalCommandAddress(
+        bsdName: "lo0", address: "127.0.0.1", displayName: "lo0"),
+      password: {
+        Issue.record("本地命令不得读取局域网密码")
+        return ""
+      })
+    #expect(local.zshBash.contains("http://127.0.0.1:11087"))
+    #expect(local.failure == nil)
+    let unavailable = TerminalProxyEnvironmentCommands(
+      listen: facts,
+      commandAddress: TerminalCommandAddress(
+        bsdName: "en0", address: "2001:db8::2", displayName: "Wi-Fi"))
+    #expect(unavailable.failure == .credentialUnreadable)
+    #expect(unavailable.zshBash.isEmpty)
+  }
+
+  @Test func runtimeAuthenticationCreatesProtectedFilesAndRotatingPasswordChangesFingerprint()
+    throws
+  {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    var settings = ProxyListeningConfiguration(listenerMode: .allIPv6Interfaces)
+    settings.lan.authenticationEnabled = true
+    let base = SslocalRuntimeDocument(servers: [], listen: settings)
+    #expect(!base.isWellFormed)
+    let auth = RuntimeListenerAuthentication(
+      username: "user", password: "password01", directory: directory.path)
+    let document = base.authenticatingLAN(auth)
+    #expect(document.isWellFormed)
+    #expect(document.locals[0].socks5AuthConfigPath == nil)
+    #expect(document.locals[2].socks5AuthConfigPath == auth.socksPath)
+    #expect(document.locals[3].httpAuthConfigPath == auth.httpPath)
+    let store = RuntimeFileStore(fileURL: directory.appendingPathComponent("sslocal-active.json"))
+    try store.write(document)
+    let snapshot = try #require(RuntimePublication.load(at: store.supervisionFileURL))
+    let paths = snapshot.authenticationFiles.map { directory.appendingPathComponent($0).path }
+    let http =
+      try JSONSerialization.jsonObject(with: Data(contentsOf: URL(fileURLWithPath: paths[1])))
+      as? [String: Any]
+    #expect(http?["basic"] != nil)
+    for path in paths {
+      let permissions =
+        try FileManager.default.attributesOfItem(atPath: path)[.posixPermissions] as? Int
+      #expect(permissions == 0o600)
+    }
+    let rotated = base.authenticatingLAN(
+      RuntimeListenerAuthentication(
+        username: "user", password: "password02", directory: directory.path))
+    #expect(document.listenFingerprint != rotated.listenFingerprint)
+    let json = try #require(String(data: try document.jsonData(), encoding: .utf8))
+    #expect(!json.contains("local_udp_port"))
+  }
+
+  @Test func disabledLANStillParticipatesInFourPortValidation() {
+    var settings = ProxyListeningConfiguration()
+    settings.lan.socksPort = 11086
+    #expect(
+      settings.portValidationErrors().contains(
+        .duplicatePort(endpoint: .socks, otherEndpoint: .lanSocks, port: 11086)))
+    settings.lan.socksPort = 1024
+    #expect(
+      settings.portValidationErrors().contains(.portOutOfRange(endpoint: .lanSocks, port: 1024)))
+    settings.lan.socksPort = 1025
+    #expect(settings.portValidationErrors().isEmpty)
+  }
+
+  @Test func portProbeRequestsDistinguishLocalAndIPv6LANBindings() {
+    let settings = ProxyListeningConfiguration(listenerMode: .allIPv6Interfaces)
+    let facts = RuntimeListenFacts(listen: settings)
+    let local = PortOccupancyProbeRequest(endpoint: .socks, listen: facts)
+    let lan = PortOccupancyProbeRequest(endpoint: .lanSocks, listen: facts)
+    #expect(local.bindAddress == "127.0.0.1")
+    #expect(local.port == 11086)
+    #expect(lan.bindAddress == "::")
+    #expect(lan.port == 11088)
+    #expect(lan.listenerMode.ipv6Only == true)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/SslocalOutputIntakeTests.swift b/ShadowsocksX-NG2/Tests/Runtime/SslocalOutputIntakeTests.swift
new file mode 100644
index 000000000..4eb7c72d3
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/SslocalOutputIntakeTests.swift
@@ -0,0 +1,105 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 记录 intake 分发行的替身去向。
+private final class RecordingDestination: SslocalLineDestination, @unchecked Sendable {
+  private let lock = NSLock()
+  private var rows: [LogLine] = []
+
+  func receive(_ row: LogLine) {
+    lock.lock()
+    defer { lock.unlock() }
+    rows.append(row)
+  }
+
+  var received: [LogLine] {
+    lock.lock()
+    defer { lock.unlock() }
+    return rows
+  }
+}
+
+struct SslocalOutputIntakeTests {
+  /// 固定时钟：行时间戳可精确断言。
+  private static let stamp = Date(timeIntervalSince1970: 1_758_000_000)
+
+  private func makeIntake(_ destinations: [any SslocalLineDestination]) -> SslocalOutputIntake {
+    SslocalOutputIntake(destinations: destinations, now: { Self.stamp })
+  }
+
+  @Test func framesLinesAcrossChunkBoundaries() {
+    let destination = RecordingDestination()
+    let intake = makeIntake([destination])
+    intake.write(Data("hel".utf8))
+    intake.write(Data("lo wo".utf8))
+    intake.write(Data("rld\nsecond\n".utf8))
+    #expect(destination.received.map(\.text) == ["hello world", "second"])
+    #expect(
+      destination.received.allSatisfy {
+        $0.timestamp == Self.stamp && $0.level == .info && $0.source == .sslocal
+      }, "intake 产出行：时间戳来自注入时钟，来源固定 sslocal")
+  }
+
+  @Test func hidesPasswordBeforeDeliveringToEveryDestination() {
+    let first = RecordingDestination()
+    let second = RecordingDestination()
+    let intake = makeIntake([first, second])
+    intake.write(Data("authentication rejected, password: secret-one\n".utf8))
+    intake.write(Data("password: sec".utf8))
+    intake.write(Data("ret-two\n".utf8))
+    let expected = [
+      "authentication rejected, password: [redacted]",
+      "password: [redacted]",
+    ]
+    #expect(first.received.map(\.text) == expected)
+    #expect(second.received.map(\.text) == expected)
+  }
+
+  @Test func discardsOversizedLineAndKeepsFollowingLines() {
+    let destination = RecordingDestination()
+    let intake = makeIntake([destination])
+    var oversized = Data("password: ".utf8)
+    oversized.append(Data(String(repeating: "x", count: 70_000).utf8))
+    intake.write(oversized)
+    intake.write(Data("secret-tail\nordinary event\n".utf8))
+    #expect(destination.received.map(\.text) == ["log line truncated", "ordinary event"])
+    // 截断标记是 info：agent.log 才是持久面，统一日志侧不落盘。
+    #expect(destination.received.first?.level == .info)
+  }
+
+  @Test func flushesTrailingPartialLineAtEndOfStream() {
+    let destination = RecordingDestination()
+    let intake = makeIntake([destination])
+    intake.write(Data("no trailing newline".utf8))
+    intake.write(Data())
+    #expect(destination.received.map(\.text) == ["no trailing newline"])
+    intake.write(Data())
+    #expect(destination.received.map(\.text) == ["no trailing newline"])
+  }
+
+  @Test func detectsUpstreamLevelIntoRow() {
+    let destination = RecordingDestination()
+    let intake = makeIntake([destination])
+    intake.write(
+      Data(
+        "2026-10-20T03:04:12Z ERROR sslocal] boom\n2026-10-20T03:04:12Z WARN retry\r\nok\n".utf8))
+    #expect(destination.received.map(\.level) == [.error, .warning, .info])
+  }
+
+  @Test func stderrDestinationRendersUniformRows() throws {
+    let pipe = Pipe()
+    let destination = SslocalStandardErrorDestination(handle: pipe.fileHandleForWriting)
+    destination.receive(
+      LogLine(timestamp: Self.stamp, level: .warning, source: .sslocal, text: "hello"))
+    destination.receive(LogLine(timestamp: Self.stamp, level: .info, source: .sslocal, text: ""))
+    try pipe.fileHandleForWriting.close()
+    let data = pipe.fileHandleForReading.readDataToEndOfFile()
+    let stamp = LogLine.timestampFormatter.string(from: Self.stamp)
+    #expect(
+      data
+        == Data(
+          "\(stamp) [warning] [sslocal] hello\n\(stamp) [info] [sslocal] \n".utf8))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/SystemInterfaceFactsProviderTests.swift b/ShadowsocksX-NG2/Tests/Runtime/SystemInterfaceFactsProviderTests.swift
new file mode 100644
index 000000000..ab0c6b6c6
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/SystemInterfaceFactsProviderTests.swift
@@ -0,0 +1,102 @@
+import SystemConfiguration
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 生产本机接口事实来源的真实主机非视觉验证：替身测试证明策略
+/// 行为，本组用例证明系统适配器整合——接口名称与类型映射、回环识别、地址
+/// 规范化与链路本地判定均来自真实 macOS。候选枚举本身不证明跨设备可达。
+@MainActor
+final class SystemInterfaceFactsProviderTests: XCTestCase {
+  private var provider: SystemInterfaceFactsProvider!
+  private var interfaces: [LocalInterfaceFacts]!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    provider = SystemInterfaceFactsProvider()
+    guard let interfaces = provider.interfaces else {
+      self.interfaces = []
+      XCTFail("真实主机 getifaddrs 枚举不应失败")
+      return
+    }
+    self.interfaces = interfaces
+  }
+
+  private func fact(_ bsdName: String) -> LocalInterfaceFacts? {
+    interfaces.first { $0.bsdName == bsdName }
+  }
+
+  func testLoopbackIsIdentifiedWithNormalizedAddresses() {
+    guard let lo0 = fact("lo0") else {
+      return XCTFail("真实主机必有 lo0：\(interfaces.map(\.bsdName))")
+    }
+    XCTAssertTrue(lo0.isLoopback, "回环以 IFF_LOOPBACK 识别")
+    XCTAssertNil(lo0.interfaceType, "回环无 SystemConfiguration 类型映射")
+    XCTAssertTrue(
+      lo0.addresses.contains(
+        LocalInterfaceAddress(
+          address: "127.0.0.1", family: .ipv4, isIPv6LinkLocal: false, v6Flags: nil)),
+      "回环单播含规范化 127.0.0.1")
+  }
+
+  func testInterfaceTypeMappingCoversRealSystemInterfaces() {
+    let mapped = interfaces.filter { $0.interfaceType != nil }
+    XCTAssertFalse(
+      mapped.isEmpty, "真实主机至少有一个 SystemConfiguration 可见接口：\(String(describing: interfaces))")
+    for interface in mapped {
+      if let localizedName = interface.localizedName {
+        XCTAssertFalse(localizedName.isEmpty, "\(interface.bsdName) 本地化名称非空")
+      }
+    }
+  }
+
+  func testAddressTextIsNormalizedWithoutScopeOrEmptiness() {
+    for interface in interfaces {
+      for address in interface.addresses {
+        XCTAssertFalse(address.address.isEmpty)
+        XCTAssertFalse(
+          address.address.contains("%"),
+          "\(interface.bsdName) 地址不含作用域后缀：\(address.address)")
+        if address.family == .ipv6 {
+          XCTAssertNotNil(
+            address.v6Flags, "\(interface.bsdName) IPv6 地址标志查询不应失败")
+          if address.address.hasPrefix("fe80") {
+            XCTAssertTrue(address.isIPv6LinkLocal, "fe80 地址必须标记链路本地")
+          } else {
+            XCTAssertFalse(address.isIPv6LinkLocal, "非 fe80 地址不应标记链路本地")
+          }
+        } else {
+          XCTAssertNil(address.v6Flags, "IPv4 地址不携带 IPv6 标志")
+        }
+      }
+    }
+  }
+
+  func testPolicyAppliedToRealFactsYieldsLoopbackFirstAndAllowedTypesOnly() {
+    let candidates = TerminalCommandAddressPolicy.candidates(
+      for: .allIPv4AndIPv6Interfaces, interfaces: interfaces)
+
+    XCTAssertEqual(
+      candidates.prefix(1).map(\.address), ["127.0.0.1"],
+      "本地 IPv4 回环置顶且来自真实主机")
+    let nonLoopback = candidates.dropFirst(1)
+    XCTAssertFalse(nonLoopback.isEmpty, "真实主机存在可列出的接口地址候选")
+    for candidate in nonLoopback {
+      let fact = interfaces.first { $0.bsdName == candidate.bsdName }?
+        .addresses.first { $0.address == candidate.address }
+      let type = interfaces.first { $0.bsdName == candidate.bsdName }?.interfaceType
+      XCTAssertTrue(
+        type == kSCNetworkInterfaceTypeIEEE80211 as String
+          || type == kSCNetworkInterfaceTypeEthernet as String,
+        "候选 \(candidate.address) 必须来自允许类型接口（实际类型 \(type ?? "nil")）")
+      XCTAssertFalse(candidate.address.contains("%"), "候选地址已规范化")
+      XCTAssertFalse(
+        fact?.v6Flags?.contains(.temporary) ?? false,
+        "临时地址（会轮换）不进候选：\(candidate.address)")
+      let knownAnnotations: Set<String?> = ["autoconf secured", "autoconf", "dynamic", nil]
+      XCTAssertTrue(
+        knownAnnotations.contains(candidate.annotation),
+        "IPv6 候选注记只能来自 ifconfig 同源闭集：\(candidate.address)")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Runtime/SystemLogSwitchTests.swift b/ShadowsocksX-NG2/Tests/Runtime/SystemLogSwitchTests.swift
new file mode 100644
index 000000000..19f7d88ba
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Runtime/SystemLogSwitchTests.swift
@@ -0,0 +1,11 @@
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct SystemLogSwitchTests {
+  @Test func systemLogIsDisabledOnlyByExplicitZero() {
+    #expect(SystemLog.isSystemLogEnabled([:]))
+    #expect(SystemLog.isSystemLogEnabled(["SSXNG_SYSTEM_LOG": "1"]))
+    #expect(!SystemLog.isSystemLogEnabled(["SSXNG_SYSTEM_LOG": "0"]))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Servers/NodeDetailPresentationTests.swift b/ShadowsocksX-NG2/Tests/Servers/NodeDetailPresentationTests.swift
new file mode 100644
index 000000000..1649c4783
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Servers/NodeDetailPresentationTests.swift
@@ -0,0 +1,223 @@
+import AppKit
+import Foundation
+import SwiftUI
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct NodeDetailPresentationTests {
+  @Test
+  func groupCountsServerDescendantsAndShowsUnknownTimes() {
+    let detail = NodeDetailPresentation(
+      node: node(isGroup: true), server: nil,
+      eligibility: ActivationEligibility(
+        canActivate: true, candidateCount: 2, skippedInvalidCount: 1, ineligibility: nil),
+      isActiveTarget: true)
+    #expect(detail.title == "测试节点")
+    #expect(detail.subtitle.contains(String(localized: "活动目标")))
+    #expect(!detail.subtitle.contains("激活时将跳过"))
+    #expect(detail.activationMessages.count == 1)
+    #expect(detail.activationMessages[0].contains("1"))
+    #expect(detail.properties.count == 1)
+    #expect(detail.properties[0].items.map(\.value) == ["detail-id", "2", "1", "—", "—"])
+  }
+
+  @Test
+  func groupContainingActiveTargetMarksItInSubtitle() {
+    let marked = NodeDetailPresentation(
+      node: node(isGroup: true), server: nil, eligibility: nil,
+      isActiveTarget: false, containsActiveTarget: true)
+    #expect(marked.subtitle == "本地 · 含活动目标")
+    let unmarked = NodeDetailPresentation(
+      node: node(isGroup: true), server: nil, eligibility: nil,
+      isActiveTarget: false, containsActiveTarget: false)
+    #expect(unmarked.subtitle == "本地")
+  }
+
+  @Test
+  func parameterPropertiesPreserveFlagsEmptyValuesOrderAndDuplicates() {
+    var detail = NodeDetailPresentation(
+      node: node(isGroup: false), server: nil, eligibility: nil, isActiveTarget: false)
+    detail.appendPluginParameters("tls;host=one;host=two;empty=")
+    let items = detail.properties.last!.items
+    #expect(items.map(\.label) == ["tls", "host", "host", "empty"])
+    #expect(items.map(\.value) == [String(localized: "开关"), "one", "two", String(localized: "空值")])
+  }
+
+  @Test
+  func opaqueParametersRemainVerbatimAndEmptyParametersAddNoGroup() {
+    var detail = NodeDetailPresentation(
+      node: node(isGroup: false), server: nil, eligibility: nil, isActiveTarget: false)
+    detail.appendPluginParameters("")
+    #expect(detail.properties.count == 1)
+    detail.appendPluginParameters("opaque\\")
+    #expect(detail.properties.last?.items.map(\.value) == ["opaque\\"])
+  }
+
+  @Test
+  func parameterFailureLeavesConnectionInformationVisible() {
+    let server = ServerDetailPresentation(
+      name: "测试节点", address: "example.com", port: 8388, encryptionMethod: "aes-256-gcm",
+      plugin: PluginSectionState(
+        selection: .unknown(program: "unknown-plugin"), programs: [],
+        mappingsUnreadable: false, optionsPresent: true, options: ""))
+    var detail = NodeDetailPresentation(
+      node: node(isGroup: false), server: server, eligibility: nil, isActiveTarget: false)
+    detail.appendPluginParameterFailure()
+    #expect(
+      detail.properties[1].items.map(\.value) == [
+        "example.com", "8388", "aes-256-gcm", "unknown-plugin",
+      ])
+    #expect(detail.properties[2].items.map(\.value) == [String(localized: "无法读取插件参数")])
+    #expect(detail.properties[0].items.map(\.value) == ["detail-id", "—", "—"])
+  }
+
+  @Test
+  func pluginAvailabilityFailureKeepsItsSpecificExplanation() {
+    let plugin = PluginSectionState(
+      selection: .named(program: "v2ray-plugin"),
+      programs: [.init(program: "v2ray-plugin", source: .user, availability: .notExecutable)],
+      mappingsUnreadable: false, optionsPresent: false, options: "")
+    let server = ServerDetailPresentation(
+      name: "测试节点", address: "example.com", port: 8388,
+      encryptionMethod: "aes-256-gcm", plugin: plugin)
+    let detail = NodeDetailPresentation(
+      node: node(isGroup: false, invalidReasons: [.pluginNotProvided(program: "v2ray-plugin")]),
+      server: server, eligibility: nil, isActiveTarget: false)
+    #expect(!detail.subtitle.contains("插件文件不可执行"))
+    #expect(detail.activationMessages == ["插件文件不可执行，请检查文件类型和执行权限。"])
+  }
+
+  @Test(arguments: [false, true])
+  func propertiesFooterRendersWithAndWithoutRows(hasRows: Bool) throws {
+    var detail = NodeDetailPresentation(
+      node: node(isGroup: true), server: nil, eligibility: nil, isActiveTarget: false)
+    detail.properties = [
+      .init(
+        id: .information, title: "Properties", items: hasRows ? [.init(label: "A", value: "B")] : []
+      )
+    ]
+    let host = NSHostingView(
+      rootView: NodeDetailView(detail: detail) {
+        EmptyView()
+      } secondaryActions: {
+        EmptyView()
+      } feedback: {
+        EmptyView()
+      } propertiesFooter: { group in
+        group.id == .information ? FooterMarker() : nil
+      })
+    host.frame = NSRect(x: 0, y: 0, width: 480, height: 600)
+    host.layoutSubtreeIfNeeded()
+    #expect(containsFooter(in: host))
+  }
+
+  @Test
+  func connectivityHistoryUsesTimeOnlyAndPreservesRepeatedLabelsAndFailures() {
+    let date = Date(timeIntervalSince1970: 37_421)
+    let records = [
+      ServerConnectivity.Record(
+        finishedAt: date, outcome: .success(milliseconds: 42)),
+      ServerConnectivity.Record(finishedAt: date, outcome: .requestTimeout),
+      ServerConnectivity.Record(finishedAt: date.addingTimeInterval(-60), outcome: .http(302)),
+    ]
+    let properties = NodeDetailPresentation.connectivityHistory(
+      records, locale: Locale(identifier: "en_GB"), timeZone: TimeZone(secondsFromGMT: 3600)!)
+    #expect(properties.id == .connectivity)
+    #expect(properties.items.map(\.label) == ["11:23:41", "11:23:41", "11:22:41"])
+    #expect(properties.items.map(\.value) == ["42 ms", ConnectivityCopy.text("请求超时"), "HTTP 302"])
+  }
+
+  @Test
+  func connectivityEmptyStatesAreExplicitProperties() {
+    let locale = Locale(identifier: "en_GB")
+    let zone = TimeZone(secondsFromGMT: 0)!
+    let history = NodeDetailPresentation.connectivityHistory([], locale: locale, timeZone: zone)
+    #expect(
+      history.items == [
+        .init(label: ConnectivityCopy.text("状态"), value: ConnectivityCopy.text("尚未测试"))
+      ])
+    for hasResults in [false, true] {
+      let summary = ServerConnectivity.Summary(
+        serverID: nil, record: nil, hasResults: hasResults, isTesting: true)
+      let properties = NodeDetailPresentation.connectivitySummary(
+        summary,
+        serverName: { _ in
+          Issue.record("No server should be resolved")
+          return ""
+        },
+        locale: locale, timeZone: zone)
+      #expect(
+        properties.items == [
+          .init(
+            label: ConnectivityCopy.text("状态"),
+            value: ConnectivityCopy.text(hasResults ? "无成功结果" : "尚未测试"))
+        ])
+    }
+  }
+
+  @Test
+  func connectivityGroupPropertiesFollowLatestResultsNetworkChangesAndNames() async {
+    let ids = [NodeID.fresh(), NodeID.fresh()]
+    var now = Date(timeIntervalSince1970: 37_421)
+    var latency = 10
+    var name = "First"
+    let module = ServerConnectivity(
+      configuration: { _ in
+        SslocalServerDocument(
+          id: "test", server: "example.com", serverPort: 443, password: "secret",
+          method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+      }, now: { now },
+      measure: { _, _, _ in .success(milliseconds: latency) })
+    func properties() -> NodeDetailPresentation.Properties {
+      NodeDetailPresentation.connectivitySummary(
+        module.summary(for: ids), serverName: { $0 == ids[0] ? name : "Second" },
+        locale: Locale(identifier: "en_GB"), timeZone: TimeZone(secondsFromGMT: 0)!)
+    }
+    await module.wait(for: module.test([ids[0]]))
+    #expect(properties().items.map(\.value) == ["10 ms", "First", "10:23:41"])
+    name = "Renamed"
+    #expect(properties().items[1].value == "Renamed")
+    now.addTimeInterval(60)
+    latency = 20
+    await module.wait(for: module.test([ids[1]]))
+    #expect(properties().items[1].value == "Renamed")
+    // The older result remains the fastest without another measurement.
+    #expect(
+      properties().items.map(\.value) == [
+        "10 ms", "Renamed", "10:23:41",
+      ])
+    module.networkChanged()
+    #expect(
+      properties().items.map(\.value) == [
+        "10 ms", "Renamed", "10:23:41",
+      ])
+    module.setURL(URL(string: "http://example.com/check")!)
+    #expect(properties().items.map(\.value) == [ConnectivityCopy.text("尚未测试")])
+  }
+
+  private func containsFooter(in view: NSView) -> Bool {
+    view.identifier?.rawValue == "properties-footer"
+      || view.subviews.contains { containsFooter(in: $0) }
+  }
+
+  private struct FooterMarker: NSViewRepresentable {
+    func makeNSView(context: Context) -> NSTextField {
+      let field = NSTextField(labelWithString: "Custom footer")
+      field.identifier = NSUserInterfaceItemIdentifier("properties-footer")
+      return field
+    }
+
+    func updateNSView(_ nsView: NSTextField, context: Context) {}
+  }
+
+  private func node(isGroup: Bool, invalidReasons: [LeafInvalidationReason] = []) -> CatalogTreeNode
+  {
+    CatalogTreeNode(
+      id: NodeID(rawValue: "detail-id"), name: "测试节点", isGroup: isGroup,
+      source: .manual, parentID: nil, createdAt: nil, updatedAt: nil,
+      invalidReasons: invalidReasons, childCount: 1, subtreeNodeCount: 4,
+      invalidDescendantCount: 1, children: isGroup ? [] : nil)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Servers/PasswordAutofillOptOutTests.swift b/ShadowsocksX-NG2/Tests/Servers/PasswordAutofillOptOutTests.swift
new file mode 100644
index 000000000..741b5c4d1
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Servers/PasswordAutofillOptOutTests.swift
@@ -0,0 +1,112 @@
+import AppKit
+import SwiftUI
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 系统对安全输入框默认提供「密码自动填充」，`textContentType(nil)` 只清字段
+/// 语义、关不掉它；生产代码改字段级私有开关 `_setPasswordAutofillEnabled:`
+/// （`PasswordAutofillOptOut` 探针认领同帧文本框后经 KVC 写入）。
+///
+/// 这些用例固定认领范围：只关密码列自己的文本框，同一表单的其他输入框保持
+/// 系统默认。私有开关哪天消失，用例失败即提示重做这个缝，而不是静默回退。
+@MainActor
+struct PasswordAutofillOptOutTests {
+  @Test
+  func securePasswordFieldOptsOutWithoutTouchingNeighbours() async throws {
+    let fields = ServerFormFields.newForm()
+    let hosted = await Self.hostGrid(fields)
+
+    let textFields = Self.textFields(in: hosted.host)
+    let secure = textFields.filter { $0 is NSSecureTextField }
+    #expect(secure.count == 1, "密码列是全表单唯一的安全输入框")
+    #expect(Self.disabledAutofillFields(in: hosted.host).count == 1, "只允许关掉密码列")
+    #expect(Self.passwordAutofillEnabled(try #require(secure.first)) == false)
+    #expect(
+      textFields.filter { !($0 is NSSecureTextField) }
+        .allSatisfy { Self.passwordAutofillEnabled($0) == true },
+      "名称/服务器地址/端口等字段保持系统默认")
+  }
+
+  @Test
+  func visiblePasswordBranchOptsOutToo() async throws {
+    let fields = ServerFormFields.newForm()
+    fields.showPassword = true
+    let hosted = await Self.hostGrid(fields)
+
+    let textFields = Self.textFields(in: hosted.host)
+    #expect(textFields.allSatisfy { !($0 is NSSecureTextField) }, "明文分支不渲染安全输入框")
+    #expect(Self.disabledAutofillFields(in: hosted.host).count == 1, "只允许关掉密码列")
+  }
+
+  @Test
+  func togglingPasswordVisibilityKeepsAutofillOff() async throws {
+    let fields = ServerFormFields.newForm()
+    let hosted = await Self.hostGrid(fields)
+    #expect(Self.disabledAutofillFields(in: hosted.host).count == 1)
+
+    // 明文/密文切换会换掉承载的文本框，认领必须跟着新实例重做。
+    fields.showPassword = true
+    await Self.settle(hosted.host)
+    #expect(Self.textFields(in: hosted.host).allSatisfy { !($0 is NSSecureTextField) })
+    #expect(Self.disabledAutofillFields(in: hosted.host).count == 1)
+
+    fields.showPassword = false
+    await Self.settle(hosted.host)
+    #expect(Self.textFields(in: hosted.host).filter { $0 is NSSecureTextField }.count == 1)
+    #expect(Self.disabledAutofillFields(in: hosted.host).count == 1)
+  }
+
+  // MARK: 夹具
+
+  /// 复用生产表单：探针、栅格与字段实现都在真实布局里跑一遍。
+  private struct GridHarness: View {
+    @ObservedObject var fields: ServerFormFields
+    @FocusState private var fieldFocus: ServerFormField?
+
+    var body: some View {
+      ServerFormFieldsGrid(
+        fields: fields, plugin: nil, isEditable: true, fieldFocus: $fieldFocus)
+    }
+  }
+
+  /// 探针在窗口坐标里认领文本框：无窗口的 hosting view 不构成呈现，认领会落空，
+  /// 因此夹具必须给一个离屏窗口（不呈现、不抢 key）。
+  private static func hostGrid(
+    _ fields: ServerFormFields
+  ) async -> (window: NSWindow, host: NSHostingView<GridHarness>) {
+    let host = NSHostingView(rootView: GridHarness(fields: fields))
+    host.frame = NSRect(x: 0, y: 0, width: 560, height: 720)
+    let window = NSWindow(
+      contentRect: NSRect(x: 0, y: 0, width: 560, height: 720),
+      styleMask: [.titled], backing: .buffered, defer: false)
+    window.contentView = host
+    await settle(host)
+    return (window, host)
+  }
+
+  /// 让 SwiftUI 的渲染事务与探针的布局回调都跑完再断言。
+  private static func settle(_ host: NSHostingView<GridHarness>) async {
+    for _ in 0..<2 {
+      await Task { @MainActor in }.value
+      host.layoutSubtreeIfNeeded()
+    }
+  }
+
+  private static func textFields(in view: NSView) -> [NSTextField] {
+    if let field = view as? NSTextField { return [field] + view.subviews.flatMap(textFields) }
+    return view.subviews.flatMap(textFields)
+  }
+
+  private static func disabledAutofillFields(in view: NSView) -> [NSTextField] {
+    textFields(in: view).filter { passwordAutofillEnabled($0) == false }
+  }
+
+  /// BOOL 返回值不能走 `perform`（会被当成对象返回值），只能取 IMP 直调。
+  private static func passwordAutofillEnabled(_ field: NSTextField) -> Bool? {
+    let selector = NSSelectorFromString("_isPasswordAutofillEnabled")
+    guard let method = class_getInstanceMethod(type(of: field), selector) else { return nil }
+    typealias Getter = @convention(c) (AnyObject, Selector) -> Bool
+    return unsafeBitCast(method_getImplementation(method), to: Getter.self)(field, selector)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Servers/QrCodeCodecTests.swift b/ShadowsocksX-NG2/Tests/Servers/QrCodeCodecTests.swift
new file mode 100644
index 000000000..c1b8ac2d3
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Servers/QrCodeCodecTests.swift
@@ -0,0 +1,25 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 二维码分享/识别互逆（验收：分享与添加互逆）。
+final class QrCodeCodecTests: XCTestCase {
+  func testGenerateThenDetectRoundTrip() throws {
+    let payload = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQxMjM@203.0.113.7:8388#香港 01"
+    let png = try QrCodeCodec.generatePNG(for: payload)
+    let payloads = try QrCodeCodec.detectPayloads(in: png)
+    XCTAssertEqual(payloads, [payload])
+  }
+
+  func testDetectHandlesChineseAndPluginPayload() throws {
+    let payload =
+      "ss://cmM0LW1kNTpwYXNzd29yZA@192.168.100.1:8888"
+      + "/?plugin=obfs-local%3Bobfs%3Dhttp%3Bobfs-host%3Dexample.com#示例节点 🇭🇰"
+    let png = try QrCodeCodec.generatePNG(for: payload)
+    XCTAssertEqual(try QrCodeCodec.detectPayloads(in: png), [payload])
+  }
+
+  func testDetectGarbageDataThrows() {
+    XCTAssertThrowsError(try QrCodeCodec.detectPayloads(in: Data("not an image".utf8)))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Servers/ServerFormFieldLimitsTests.swift b/ShadowsocksX-NG2/Tests/Servers/ServerFormFieldLimitsTests.swift
new file mode 100644
index 000000000..4f7f9fb53
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Servers/ServerFormFieldLimitsTests.swift
@@ -0,0 +1,232 @@
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 服务器表单的手动输入上限与端口十进制草稿：全部经表单草稿
+/// 模块的公开面观察（装载、校验、提交草稿、变更检测），不触碰内部实现。
+@MainActor
+struct ServerFormFieldLimitsTests {
+  private static let overLongName = String(
+    repeating: "港", count: ServerFormFields.nameCharacterLimit + 1)
+  private static let overLongAddress = String(
+    repeating: "a", count: ServerFormFields.addressCharacterLimit + 1)
+  private static let overLongPassword = String(
+    repeating: "p", count: ServerFormFields.passwordCharacterLimit + 1)
+  private static let overLongOptions = String(
+    repeating: "港", count: ServerFormFields.pluginOptionsUTF8Limit / 3 + 1)
+
+  private static func editForm(
+    name: String = "服务器",
+    address: String = "203.0.113.7",
+    port: Int = 8388,
+    password: String = "password",
+    pluginOptions: String = ""
+  ) -> ServerEditForm {
+    ServerEditForm(
+      address: address,
+      port: port,
+      encryptionMethod: "aes-256-gcm",
+      password: password,
+      remark: name,
+      plugin: PluginSectionState(
+        selection: .named(program: "v2ray-plugin"),
+        programs: [.init(program: "v2ray-plugin", source: .managed, availability: .available)],
+        mappingsUnreadable: false,
+        optionsPresent: !pluginOptions.isEmpty,
+        options: pluginOptions),
+      isEditable: true)
+  }
+
+  private static func loadedFields(_ form: ServerEditForm = editForm()) -> ServerFormFields {
+    let fields = ServerFormFields()
+    fields.load(from: form)
+    return fields
+  }
+
+  // MARK: - 端口十进制草稿
+
+  @Test(
+    arguments: [
+      ("", "空输入"), ("abc", "非数字"), ("12a4", "中途字母"), ("123456", "六位数字"),
+      ("0", "零"), ("65536", "超范围"), ("-1", "负号"), (" 8388", "带空格"),
+      ("８３８８", "全角数字"),
+    ])
+  func invalidPortDraftsBlockSubmissionAndNeverSubmitStaleValues(_ text: String, _ label: String) {
+    let fields = Self.loadedFields()
+    fields.portText = text
+    #expect(!fields.validateForSubmit(), "\(label)")
+    #expect(fields.fieldErrors[.port] == .invalidPort, "\(label)")
+    #expect(fields.draft == nil, "无效端口不得回落到旧绑定值：\(label)")
+    #expect(fields.hasChanges, "非法端口仍是变更，保存入口不得死锁：\(label)")
+  }
+
+  @Test(arguments: [("1", 1), ("65535", 65_535), ("8388", 8388), ("08388", 8388)])
+  func validPortDraftsSubmitParsedValues(_ text: String, expected: Int) {
+    let fields = Self.loadedFields()
+    fields.portText = text
+    #expect(fields.validateForSubmit())
+    #expect(fields.draft?.port == expected)
+  }
+
+  @Test
+  func numericallyEqualPortRewriteIsNotAChange() {
+    let fields = Self.loadedFields()
+    fields.portText = "08388"
+    #expect(!fields.hasChanges)
+    fields.portText = "8389"
+    #expect(fields.hasChanges)
+  }
+
+  // MARK: - 字符上限（Swift Character 计量）
+
+  @Test
+  func nameLimitCountsCharactersIncludingComposedSequences() {
+    let fields = Self.loadedFields()
+    fields.remark = String(repeating: "港", count: ServerFormFields.nameCharacterLimit)
+    #expect(fields.validateForSubmit())
+    fields.remark = Self.overLongName
+    #expect(!fields.validateForSubmit())
+    #expect(
+      fields.fieldErrors[.name] == .tooManyCharacters(limit: ServerFormFields.nameCharacterLimit))
+
+    // 组合字符序列按用户可见字符计数：e + U+0301 是一个 Character。
+    fields.remark = String(repeating: "e\u{301}", count: ServerFormFields.nameCharacterLimit)
+    #expect(fields.validateForSubmit())
+    fields.remark = String(repeating: "e\u{301}", count: ServerFormFields.nameCharacterLimit + 1)
+    #expect(!fields.validateForSubmit())
+  }
+
+  @Test
+  func nameAndAddressLimitsMeasurePreparedValuesAfterExistingTrimming() {
+    let fields = Self.loadedFields()
+    // 名称/地址沿用首尾空白处理后计量：首尾空白不计入上限。
+    fields.remark = " " + String(repeating: "港", count: ServerFormFields.nameCharacterLimit) + " "
+    #expect(fields.validateForSubmit())
+    fields.address = " " + String(repeating: "a", count: ServerFormFields.addressCharacterLimit)
+    #expect(fields.validateForSubmit())
+    // 去掉空白后仍超一位才越界。
+    fields.remark = " " + Self.overLongName
+    #expect(!fields.validateForSubmit())
+    fields.remark = "服务器"
+    fields.address = Self.overLongAddress
+    #expect(!fields.validateForSubmit())
+    #expect(
+      fields.fieldErrors[.address]
+        == .tooManyCharacters(limit: ServerFormFields.addressCharacterLimit))
+  }
+
+  @Test
+  func passwordLimitDoesNotTrimOrNormalize() {
+    let fields = Self.loadedFields()
+    fields.password = String(repeating: "p", count: ServerFormFields.passwordCharacterLimit)
+    #expect(fields.validateForSubmit(), "恰好达标")
+    // 密码不 trim、不归一化：尾随空格计入长度，1025 位即越界。
+    fields.password = String(repeating: "p", count: ServerFormFields.passwordCharacterLimit) + " "
+    #expect(!fields.validateForSubmit())
+    fields.password = Self.overLongPassword
+    #expect(!fields.validateForSubmit())
+    #expect(
+      fields.fieldErrors[.password]
+        == .tooManyCharacters(limit: ServerFormFields.passwordCharacterLimit))
+  }
+
+  // MARK: - 插件参数字节上限（UTF-8 计量）
+
+  @Test
+  func pluginOptionsLimitCountsUTF8BytesOfTheWholeString() {
+    let fields = Self.loadedFields()
+    fields.pluginOptions.switchToRawText()
+    fields.pluginOptions.rawText = String(
+      repeating: "a", count: ServerFormFields.pluginOptionsUTF8Limit)
+    #expect(fields.validateForSubmit(), "恰好 65,536 字节达标")
+    fields.pluginOptions.rawText = String(
+      repeating: "a", count: ServerFormFields.pluginOptionsUTF8Limit + 1)
+    #expect(!fields.validateForSubmit())
+    #expect(
+      fields.fieldErrors[.pluginOptions]
+        == .tooManyBytes(limit: ServerFormFields.pluginOptionsUTF8Limit))
+
+    // 多字节字符按字节计：21846 个「港」= 65,538 字节越界。
+    fields.pluginOptions.rawText = String(repeating: "港", count: 21_846)
+    #expect(!fields.validateForSubmit())
+  }
+
+  @Test
+  func hiddenOptionsDraftDoesNotBlockSaveWhenPluginIsNone() {
+    let fields = Self.loadedFields()
+    fields.pluginChoice = .none
+    fields.pluginOptions.switchToRawText()
+    fields.pluginOptions.rawText = Self.overLongOptions
+    #expect(fields.validateForSubmit(), "插件「无」时隐藏参数草稿不阻塞保存")
+  }
+
+  // MARK: - 超长基线兼容
+
+  @Test
+  func unmodifiedOverLongBaselineFieldsDoNotBlockSavingOtherChanges() {
+    let fields = Self.loadedFields(
+      Self.editForm(
+        name: Self.overLongName, address: Self.overLongAddress,
+        password: Self.overLongPassword, pluginOptions: Self.overLongOptions))
+    #expect(fields.validateForSubmit(), "未修改的历史超长字段放行")
+    #expect(fields.draft != nil)
+
+    // 只改名称（合规新值），其余超长基线字段继续放行。
+    fields.remark = "新名称"
+    #expect(fields.validateForSubmit())
+
+    // 主动修改超限字段后必须满足上限。
+    fields.address = Self.overLongAddress + "x"
+    #expect(!fields.validateForSubmit())
+    #expect(
+      fields.fieldErrors[.address]
+        == .tooManyCharacters(limit: ServerFormFields.addressCharacterLimit))
+  }
+
+  @Test
+  func baselineExemptionUsesTheLoadedSnapshotNotLiveCatalogValues() {
+    let fields = Self.loadedFields(Self.editForm(name: Self.overLongName))
+    #expect(fields.validateForSubmit())
+    // 再次成功装载后基线刷新。
+    fields.remark = "正常名称"
+    fields.load(from: Self.editForm(name: Self.overLongName))
+    #expect(fields.validateForSubmit(), "重载后基线恢复为超长保存值，未修改即放行")
+  }
+
+  // MARK: - 错误呈现时机
+
+  @Test
+  func firstOpenShowsNoErrorsAndErrorsClearOnFieldEdit() {
+    let fields = ServerFormFields.newForm()
+    #expect(fields.fieldErrors.isEmpty, "首次打开不显示校验错误")
+    #expect(!fields.validateForSubmit(), "新建面名称为空仍拒绝提交（原有必填规则）")
+    #expect(fields.firstErrorField == .name)
+    #expect(fields.fieldErrors[.name] == .missingName)
+
+    fields.remark = "有名称"
+    #expect(fields.fieldErrors[.name] == nil, "重新编辑对应字段即清除")
+
+    fields.portText = "abc"
+    #expect(!fields.validateForSubmit())
+    fields.portText = "8388"
+    #expect(fields.fieldErrors[.port] == nil)
+  }
+
+  @Test
+  func firstErrorFieldFollowsGridOrder() {
+    let fields = Self.loadedFields()
+    fields.portText = "0"
+    fields.remark = ""
+    fields.password = Self.overLongPassword
+    #expect(!fields.validateForSubmit())
+    #expect(fields.firstErrorField == .name, "名称 → 地址 → 端口 → 密码 → 参数")
+  }
+
+  @Test
+  func loadedEditFormShowsNoErrorsUntilValidated() {
+    let fields = Self.loadedFields(Self.editForm(name: Self.overLongName))
+    #expect(fields.fieldErrors.isEmpty)
+    #expect(fields.validateForSubmit())
+    #expect(fields.fieldErrors.isEmpty)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Servers/ServerFormLoadingTests.swift b/ShadowsocksX-NG2/Tests/Servers/ServerFormLoadingTests.swift
new file mode 100644
index 000000000..8c246642c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Servers/ServerFormLoadingTests.swift
@@ -0,0 +1,310 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ServerFormLoadingTests {
+  @Test func absentServerCannotLoadAnEditForm() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.age")),
+        runtime: FakeCatalogRuntime()))
+    #expect(try workflow.serverEditForm(for: .fresh()) == nil)
+  }
+  @Test
+  func appearingAgainAndUpdatingPresentationDoNotReloadManualDraft() {
+    let fields = ServerFormFields()
+    let id = NodeID(rawValue: "manual")
+    var reads = 0
+    let load = { (_: NodeID) -> ServerEditForm? in
+      reads += 1
+      return Self.form()
+    }
+    fields.showServer(id, load: load)
+    fields.remark = "未保存名称"
+    fields.showServer(id, load: load)
+    fields.updatePresentation(ServerFormPresentation(isEditable: true, plugin: Self.form().plugin))
+    #expect(reads == 1)
+    #expect(fields.remark == "未保存名称")
+    #expect(fields.hasChanges)
+    fields.reloadServer(load: load)
+    #expect(reads == 2)
+    #expect(fields.remark == "服务器")
+    #expect(!fields.hasChanges)
+  }
+
+  @Test
+  func resetFailurePreservesManualDraftButBlocksSavingUntilReloadSucceeds() {
+    let fields = ServerFormFields()
+    fields.showServer(NodeID(rawValue: "manual")) { _ in Self.form() }
+    fields.password = "edited password"
+    fields.reloadServer { _ in throw ServerFormLoadError.credentialsUnavailable }
+    #expect(fields.password == "edited password")
+    #expect(fields.hasLoadedServer)
+    #expect(!fields.canSaveServer)
+    #expect(fields.loadFailure == .credentialsUnavailable)
+    fields.reloadServer { _ in Self.form(password: "latest") }
+    #expect(fields.password == "latest")
+    #expect(fields.canSaveServer)
+    #expect(fields.loadFailure == nil)
+    #expect(!fields.hasChanges)
+  }
+
+  @Test
+  func failedSelectionNeverShowsPreviousServerAndLateSaveDoesNotResetNewDraft() {
+    let fields = ServerFormFields()
+    let first = NodeID(rawValue: "first")
+    let second = NodeID(rawValue: "second")
+    fields.showServer(first) { _ in Self.form() }
+    fields.showServer(second) { _ in throw ServerFormLoadError.credentialsUnavailable }
+    #expect(fields.password.isEmpty)
+    #expect(fields.address.isEmpty)
+    #expect(!fields.hasLoadedServer)
+    #expect(!fields.canSaveServer)
+    fields.reloadServer { _ in Self.form(password: "second password") }
+    fields.password = "unsaved second password"
+    fields.didSaveServer(first) { _ in
+      Issue.record("保存其他服务器不应装载当前草稿")
+      return Self.form()
+    }
+    #expect(fields.password == "unsaved second password")
+    fields.didSaveServer(second) { _ in Self.form(password: "saved second password") }
+    #expect(fields.password == "saved second password")
+    #expect(!fields.hasChanges)
+  }
+
+  @Test
+  func onlyAffectedReadOnlyServerReloadsAndFailedReloadClearsOldFields() {
+    let fields = ServerFormFields()
+    let id = NodeID(rawValue: "subscription")
+    fields.showServer(id) { _ in Self.form(isEditable: false) }
+    fields.subscriptionDidRefresh(affectedServers: [NodeID(rawValue: "other")]) { _ in
+      Issue.record("其他订阅不应触发装载")
+      return nil
+    }
+    #expect(fields.password == "pw")
+    fields.subscriptionDidRefresh(affectedServers: [id]) { _ in
+      throw ServerFormLoadError.credentialsUnavailable
+    }
+    #expect(fields.password.isEmpty)
+    #expect(fields.portText.isEmpty)
+    #expect(fields.pluginOptions.composedString == "")
+    #expect(!fields.hasLoadedServer)
+    #expect(fields.loadFailure == .credentialsUnavailable)
+    fields.updatePresentation(
+      ServerFormPresentation(isEditable: false, plugin: Self.form().plugin))
+    fields.subscriptionDidRefresh(affectedServers: [id]) { _ in
+      Self.form(isEditable: false, password: "new password")
+    }
+    #expect(fields.password == "new password")
+    #expect(fields.loadFailure == nil)
+
+    fields.showServer(NodeID(rawValue: "manual")) { _ in Self.form() }
+    fields.password = "manual draft"
+    fields.subscriptionDidRefresh(affectedServers: [fields.serverID!]) { _ in
+      Issue.record("手动草稿不应自动装载")
+      return nil
+    }
+    #expect(fields.password == "manual draft")
+  }
+
+  @Test func presentationOmitsSecretsAndEditFormReadsCompleteRecord() async throws {
+    try await Self.withWorkflow { workflow in
+      let program = ManagedPluginCatalog.plugins[0].program
+      let id = try await workflow.createServer(
+        ServerEditDraft(
+          address: "203.0.113.1", port: 8388, encryptionMethod: "aes-256-gcm",
+          password: "pw", remark: "服务器", plugin: .named(program: program),
+          pluginOptions: "mode=websocket"), into: nil)
+      let presentation = try #require(workflow.serverFormPresentation(for: id))
+      #expect(presentation.isEditable)
+      #expect(presentation.plugin.optionsPresent)
+      #expect(presentation.plugin.options.isEmpty)
+      let form = try #require(try workflow.serverEditForm(for: id))
+      #expect(form.password == "pw")
+      #expect(form.plugin.options == "mode=websocket")
+    }
+  }
+
+  @Test
+  func successfulRefreshReloadsSecretChangesAndFailureDoesNotReload() async throws {
+    let fetcher = FakeSubscriptionFetcher(behavior: .success(SubscriptionDocs.flat(serverCount: 1)))
+    try await Self.withWorkflow(fetcher: fetcher) { workflow in
+      let summary = try await workflow.createSubscription(urlString: "https://example.com/sub.json")
+      let server = try #require(workflow.tree.node(withID: summary.groupID)?.childNodes.first)
+      let fields = ServerFormFields()
+      fields.showServer(server.id, load: workflow.serverEditForm)
+      let oldTree = workflow.tree
+      var reloads = 0
+      let observation = workflow.subscriptionServerRefreshes.sink { affected in
+        fields.updatePresentation(workflow.serverFormPresentation(for: server.id))
+        fields.subscriptionDidRefresh(affectedServers: affected) { id in
+          reloads += 1
+          return try workflow.serverEditForm(for: id)
+        }
+      }
+      defer { observation.cancel() }
+      let original = try #require(
+        String(data: SubscriptionDocs.flat(serverCount: 1), encoding: .utf8))
+      let changed = original.replacingOccurrences(
+        of: "\"password\": \"pw\"", with: "\"password\": \"new password\"")
+      fetcher.setBehavior(.success(Data(changed.utf8)))
+      await workflow.refreshSubscription(summary.id)
+      #expect(workflow.tree.roots.map(\.id) == oldTree.roots.map(\.id))
+      #expect(workflow.tree.node(withID: server.id)?.createdAt == server.createdAt)
+      #expect(workflow.tree.node(withID: server.id)?.updatedAt != server.updatedAt)
+      #expect(fields.password == "new password")
+      #expect(reloads == 1)
+      fetcher.setBehavior(.failure(.transport(detail: "fixture failure")))
+      await workflow.refreshSubscription(summary.id)
+      #expect(reloads == 1)
+      #expect(fields.password == "new password")
+      fetcher.setBehavior(.success(Data(changed.utf8)))
+      _ = try await workflow.createSubscription(urlString: "https://other.example/sub.json")
+      #expect(reloads == 1)
+    }
+  }
+
+  private static func withWorkflow(
+    fetcher: SubscriptionFetching = FakeSubscriptionFetcher(behavior: .success(Data())),
+    _ body: (CatalogWorkflow) async throws -> Void
+  ) async throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(
+        fileStore: makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.json")),
+        runtime: FakeCatalogRuntime()), subscriptionFetcher: fetcher)
+    try await body(workflow)
+  }
+
+  private static func form(isEditable: Bool = true, password: String = "pw") -> ServerEditForm {
+    ServerEditForm(
+      address: "203.0.113.1", port: 8388, encryptionMethod: "aes-256-gcm",
+      password: password, remark: "服务器",
+      plugin: PluginSectionState(
+        selection: .none, programs: [], mappingsUnreadable: false,
+        optionsPresent: false, options: ""), isEditable: isEditable)
+  }
+}
+
+extension ServerFormLoadingTests {
+  @Test
+  func newFormStartsUnchangedAndReturningToDefaultsClearsChanges() {
+    let fields = ServerFormFields.newForm()
+    #expect(!fields.hasChanges)
+    fields.remark = "未保存"
+    #expect(fields.hasChanges)
+    fields.remark = ""
+    #expect(!fields.hasChanges)
+    fields.portText = "bad"
+    #expect(fields.hasChanges)
+  }
+
+  @Test func detailFactsOmitSecretsAndExplicitParameterReadPreservesRawValue() async throws {
+    try await Self.withWorkflow { workflow in
+      let program = ManagedPluginCatalog.plugins[0].program
+      let id = try await workflow.createServer(
+        ServerEditDraft(
+          address: "203.0.113.1", port: 8388, encryptionMethod: "aes-256-gcm",
+          password: "pw", remark: "服务器", plugin: .named(program: program),
+          pluginOptions: "tls;host=example.com;host=other.example;empty="), into: nil)
+      let facts = try #require(workflow.serverDetailPresentation(for: id))
+      #expect(facts.name == "服务器")
+      #expect(facts.plugin.options.isEmpty)
+      #expect(
+        try workflow.serverDetailPluginOptions(for: id)
+          == "tls;host=example.com;host=other.example;empty=")
+    }
+  }
+
+  @Test
+  func unknownPluginDetailReadsOptionsWithoutLoadingPassword() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.json"))
+    var catalog = ConfigurationCatalog()
+    let id = try catalog.addServer(
+      ServerFields(
+        address: "203.0.113.1", port: 8388, encryptionMethod: "aes-256-gcm",
+        password: "password", remark: "未知插件服务器",
+        pluginProgram: "unknown-test-plugin", pluginOptions: "opaque=one;opaque=two"))
+    try store.save(CatalogDocument(catalog: catalog))
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime()))
+    #expect(
+      workflow.serverDetailPresentation(for: id)?.plugin.selection
+        == .unknown(program: "unknown-test-plugin"))
+    #expect(try workflow.serverDetailPluginOptions(for: id) == "opaque=one;opaque=two")
+  }
+
+  @Test
+  func parameterSessionSwitchesIdentityAndOnlyReloadsAffectedRefreshes() {
+    let parameters = ServerDetailParameters()
+    let first = NodeID(rawValue: "first")
+    let second = NodeID(rawValue: "second")
+    var reads = 0
+    parameters.showServer(first) { _ in
+      reads += 1
+      return "tls;host=one;host=two;empty="
+    }
+    #expect(parameters.options.rows.filter { !$0.isBlank }.count == 4)
+    parameters.showServer(first) { _ in
+      reads += 1
+      return "tls;host=one;host=two;empty="
+    }
+    parameters.didRefresh(affectedServers: [second]) { _ in
+      Issue.record("不相关刷新不应重载")
+      return ""
+    }
+    parameters.didRefresh(affectedServers: [first]) { _ in
+      reads += 1
+      return "host=new"
+    }
+    #expect(reads == 3)
+    #expect(parameters.options.composedString == "host=new")
+    parameters.showServer(second) { _ in throw ServerFormLoadError.credentialsUnavailable }
+    #expect(parameters.options.composedString == "")
+    #expect(parameters.failure == .credentialsUnavailable)
+    parameters.reload { _ in "trailing\\" }
+    #expect(parameters.failure == nil)
+    #expect(parameters.options.mode == .rawText)
+    #expect(parameters.options.rawText == "trailing\\")
+    parameters.didRefresh(affectedServers: [second]) { _ in
+      throw ServerFormLoadError.credentialsUnavailable
+    }
+    #expect(parameters.options.rawText.isEmpty)
+    #expect(parameters.failure == .credentialsUnavailable)
+  }
+
+  @Test
+  func editingPresentationChangesNeverReplaceDraftAndDeletionBlocksSaving() {
+    let fields = ServerFormFields()
+    let id = NodeID(rawValue: "manual")
+    let form = ServerEditForm(
+      address: "203.0.113.1", port: 8388, encryptionMethod: "aes-256-gcm",
+      password: "pw", remark: "服务器",
+      plugin: PluginSectionState(
+        selection: .unknown(program: "plugin"), programs: [], mappingsUnreadable: false,
+        optionsPresent: true, options: ""), isEditable: true)
+    fields.showServer(id) { _ in form }
+    fields.remark = "未保存名称"
+    let updatedPlugin = PluginSectionState(
+      selection: .named(program: "plugin"), programs: [], mappingsUnreadable: false,
+      optionsPresent: true, options: "")
+    fields.updatePresentation(
+      ServerFormPresentation(isEditable: true, plugin: updatedPlugin), preservingDraft: true)
+    #expect(fields.pluginChoice == .unknown(program: "plugin"))
+    #expect(fields.remark == "未保存名称")
+    #expect(fields.canSaveServer)
+    fields.updatePresentation(nil, preservingDraft: true)
+    #expect(!fields.canSaveServer)
+    #expect(fields.hasLoadedServer)
+    #expect(fields.password == "pw")
+    #expect(fields.remark == "未保存名称")
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Servers/ServerFormPluginOptionsTests.swift b/ShadowsocksX-NG2/Tests/Servers/ServerFormPluginOptionsTests.swift
new file mode 100644
index 000000000..585a17052
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Servers/ServerFormPluginOptionsTests.swift
@@ -0,0 +1,368 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 插件参数无损编辑会话：全部经表单草稿模块公开面观察
+/// （装载、行编辑、模式切换、拼装串、校验与变更检测），不为内部扫描器
+/// 单独建立测试边界。
+@MainActor
+struct ServerFormPluginOptionsTests {
+  private static let certRaw = String(repeating: "A", count: 5_000)
+
+  private static func editForm(pluginOptions: String) -> ServerEditForm {
+    ServerEditForm(
+      address: "203.0.113.7",
+      port: 8388,
+      encryptionMethod: "aes-256-gcm",
+      password: "password",
+      remark: "服务器",
+      plugin: PluginSectionState(
+        selection: .named(program: "v2ray-plugin"),
+        programs: [.init(program: "v2ray-plugin", source: .managed, availability: .available)],
+        mappingsUnreadable: false,
+        optionsPresent: !pluginOptions.isEmpty,
+        options: pluginOptions),
+      isEditable: true)
+  }
+
+  private static func loadedFields(_ options: String) -> ServerFormFields {
+    let fields = ServerFormFields()
+    fields.load(from: editForm(pluginOptions: options))
+    return fields
+  }
+
+  private static func formalRows(_ fields: ServerFormFields) -> [PluginOptionsDraft.Row] {
+    fields.pluginOptions.rows.filter { !$0.isBlank }
+  }
+
+  // MARK: - 无编辑往返逐字保留
+
+  @Test(
+    arguments: [
+      "", "tls", "key=",
+      "mode=websocket;host=example.com;path=/ws",
+      "k=1;k=2",
+      "path=/a\\;b",
+      "k=a\\=b",
+      "k=a\\\\b",
+      "a=1;",
+      " host = x ",
+      "未知参数=yes",
+      "港=值",
+      "certRaw=" + String(repeating: "A", count: 5_000),
+    ])
+  func noEditSessionsReturnTheOriginalStringVerbatim(_ original: String) {
+    let fields = Self.loadedFields(original)
+    #expect(fields.pluginOptions.mode == .table, "可解析内容默认进入参数列表")
+    #expect(fields.pluginOptions.composedString == original)
+    #expect(!fields.hasChanges, "仅查看不改写参数")
+    #expect(fields.validateForSubmit())
+    #expect(fields.draft?.pluginOptions == original)
+  }
+
+  @Test
+  func modeSwitchingAloneReturnsTheOriginalAndDoesNotMarkChanges() {
+    let fields = Self.loadedFields("a=1;")
+    #expect(fields.pluginOptions.switchToRawText())
+    #expect(fields.pluginOptions.mode == .rawText)
+    #expect(fields.pluginOptions.rawText == "a=1;")
+    #expect(!fields.hasChanges, "切换模式不触发表单变更")
+    #expect(fields.pluginOptions.switchToTable())
+    #expect(fields.pluginOptions.mode == .table)
+    #expect(fields.pluginOptions.composedString == "a=1;")
+    #expect(!fields.hasChanges)
+  }
+
+  @Test(arguments: ["a=1;;b=2", "=x", "a=1\\", ";a=1"])
+  func unparseableOptionsDefaultToRawModeAndStillSubmit(_ original: String) {
+    let fields = Self.loadedFields(original)
+    #expect(fields.pluginOptions.mode == .rawText, "不可可靠解析时默认原始文本")
+    #expect(fields.pluginOptions.composedString == original)
+    #expect(!fields.hasChanges)
+    #expect(fields.validateForSubmit(), "解析失败不是提交的新增阻塞原因")
+    #expect(fields.draft?.pluginOptions == original)
+  }
+
+  // MARK: - 行编辑的局部保留
+
+  @Test
+  func editingOneRowEncodesOnlyThatRow() throws {
+    let fields = Self.loadedFields("tls;host=a;path=/p")
+    let rows = Self.formalRows(fields)
+    let host = try #require(rows.first { $0.keyText == "host" })
+
+    // 只改值：该行重新转义编码，其他行原文照抄。
+    fields.pluginOptions.updateValue("b;c", of: host.id)
+    #expect(fields.pluginOptions.composedString == "tls;host=b\\;c;path=/p")
+
+    // 只改参数名。
+    fields.pluginOptions.updateKey("topic", of: host.id)
+    #expect(fields.pluginOptions.composedString == "tls;topic=b\\;c;path=/p")
+
+    // 编辑后改回原值：该行回到原文写法。
+    fields.pluginOptions.updateKey("host", of: host.id)
+    fields.pluginOptions.updateValue("a", of: host.id)
+    #expect(fields.pluginOptions.composedString == "tls;host=a;path=/p")
+  }
+
+  @Test
+  func addingARowAppendsWithMinimalSeparatorAdjustment() {
+    let fields = Self.loadedFields("a=1")
+    // 在空行开始输入后行身份保持（焦点稳定），新的空行补到末尾。
+    let added = fields.pluginOptions.quickAddRowID
+    fields.pluginOptions.updateKey("b", of: added)
+    fields.pluginOptions.updateValue("2", of: added)
+    #expect(fields.pluginOptions.rows.count == 3)
+    #expect(fields.pluginOptions.composedString == "a=1;b=2")
+  }
+
+  @Test
+  func trailingSeparatorSurvivesContentEditsAndDropsOnlyOnStructuralChange() {
+    let fields = Self.loadedFields("a=1;")
+    let row = Self.formalRows(fields)[0]
+    fields.pluginOptions.updateValue("2", of: row.id)
+    #expect(fields.pluginOptions.composedString == "a=2;", "内容修改保留既有末尾分号")
+    fields.pluginOptions.deleteRow(row.id)
+    #expect(fields.pluginOptions.composedString == "", "删除行后不再保留悬空分隔符")
+  }
+
+  @Test
+  func deletingARowKeepsOtherRowsVerbatim() throws {
+    let fields = Self.loadedFields("tls;host=a;path=/p")
+    let host = try #require(Self.formalRows(fields).first { $0.keyText == "host" })
+    fields.pluginOptions.deleteRow(host.id)
+    #expect(fields.pluginOptions.composedString == "tls;path=/p")
+  }
+
+  // MARK: - 无值开关与空字符串值
+
+  @Test
+  func flagAndEmptyValueAreDistinctAndReversible() {
+    let fields = Self.loadedFields("tls")
+    let row = Self.formalRows(fields)[0]
+    #expect(row.kind == .flag)
+
+    // 无值开关 → 键值：没有会话值草稿则序列化为 key=，不得自动相互推断。
+    fields.pluginOptions.setKind(.keyValue, of: row.id)
+    #expect(fields.pluginOptions.composedString == "tls=")
+    fields.pluginOptions.setKind(.flag, of: row.id)
+    #expect(fields.pluginOptions.composedString == "tls")
+
+    // 键值 → 开关 → 键值：恢复本会话保留的值草稿。
+    let other = Self.loadedFields("host=a")
+    let hostRow = Self.formalRows(other)[0]
+    other.pluginOptions.setKind(.flag, of: hostRow.id)
+    #expect(other.pluginOptions.composedString == "host")
+    other.pluginOptions.setKind(.keyValue, of: hostRow.id)
+    #expect(other.pluginOptions.composedString == "host=a")
+  }
+
+  // MARK: - 行顺序调整
+
+  @Test
+  func movingARowReordersVerbatimSlicesOnly() throws {
+    let fields = Self.loadedFields("tls;host=a;path=/p")
+    let host = try #require(Self.formalRows(fields).first { $0.keyText == "host" })
+    fields.pluginOptions.moveRow(host.id, by: 1)
+    #expect(fields.pluginOptions.composedString == "tls;path=/p;host=a")
+    #expect(fields.hasChanges, "重排改变拼装串顺序")
+  }
+
+  @Test
+  func editedRowCarriesItsEncodingWhenMoved() throws {
+    let fields = Self.loadedFields("tls;host=a;path=/p")
+    let path = try #require(Self.formalRows(fields).first { $0.keyText == "path" })
+    fields.pluginOptions.updateValue("x;y", of: path.id)
+    fields.pluginOptions.moveRow(path.id, by: -1)
+    #expect(fields.pluginOptions.composedString == "tls;path=x\\;y;host=a")
+  }
+
+  @Test
+  func trailingSeparatorSurvivesRowMoves() throws {
+    let fields = Self.loadedFields("a=1;b=2;")
+    let first = try #require(Self.formalRows(fields).first)
+    fields.pluginOptions.moveRow(first.id, by: 1)
+    #expect(fields.pluginOptions.composedString == "b=2;a=1;", "移动不算结构修改，末尾分号保留")
+  }
+
+  @Test
+  func movesAreBoundedByFormalRowsAndTheQuickAddRowStaysLast() throws {
+    let fields = Self.loadedFields("a=1;b=2")
+    let rows = Self.formalRows(fields)
+    let firstRow = try #require(rows.first { $0.keyText == "a" })
+    let secondRow = try #require(rows.first { $0.keyText == "b" })
+    let blank = fields.pluginOptions.quickAddRowID
+
+    // 空行不可移动；末尾正式行不可再下移（不得越过空行）。
+    fields.pluginOptions.moveRow(blank, by: -1)
+    fields.pluginOptions.moveRow(secondRow.id, by: 1)
+    #expect(fields.pluginOptions.composedString == "a=1;b=2")
+    #expect(fields.pluginOptions.rows.last?.id == blank)
+
+    // 首行不可上移。
+    fields.pluginOptions.moveRow(firstRow.id, by: -1)
+    #expect(fields.pluginOptions.composedString == "a=1;b=2")
+
+    // 有效下移仍可用。
+    fields.pluginOptions.moveRow(firstRow.id, by: 1)
+    #expect(fields.pluginOptions.composedString == "b=2;a=1")
+    #expect(fields.pluginOptions.rows.last?.id == blank)
+  }
+
+  // MARK: - 底部空行与未完成草稿
+
+  @Test
+  func blankQuickAddRowIsPromotedOnInputAndNeverSerialized() {
+    let fields = Self.loadedFields("a=1")
+    #expect(fields.pluginOptions.rows.count == 2, "一条正式行 + 底部空行")
+    #expect(fields.pluginOptions.composedString == "a=1")
+
+    // 只输入参数名：提升为正式行并补上新的空行。
+    fields.pluginOptions.updateKey("b", of: fields.pluginOptions.quickAddRowID)
+    #expect(fields.pluginOptions.rows.count == 3)
+    #expect(fields.pluginOptions.composedString == "a=1;b=")
+
+    // 清回完全空白：回到占位状态，不进入参数串。
+    fields.pluginOptions.updateKey("", of: fields.pluginOptions.rows[1].id)
+    #expect(fields.pluginOptions.composedString == "a=1")
+  }
+
+  @Test
+  func unfinishedRowsBlockAssemblySaveAndModeSwitch() throws {
+    let fields = Self.loadedFields("a=1")
+    fields.pluginOptions.updateValue("x", of: fields.pluginOptions.quickAddRowID)
+    #expect(fields.pluginOptions.hasUnfinishedRows)
+    #expect(fields.pluginOptions.composedString == nil)
+    #expect(fields.draft == nil)
+    #expect(fields.hasChanges, "未完成输入仍是变更，保存入口不得死锁")
+    #expect(!fields.validateForSubmit())
+    #expect(fields.fieldErrors[.pluginOptions] == .unfinishedPluginOptionRow)
+    #expect(!fields.pluginOptions.switchToRawText(), "未完成行阻止切换到原始文本")
+    #expect(fields.pluginOptions.mode == .table)
+
+    // 重新编辑该行即清除字段错误。
+    let unfinished = try #require(fields.pluginOptions.rows.first { $0.isUnfinished })
+    fields.pluginOptions.updateKey("b", of: unfinished.id)
+    #expect(fields.fieldErrors[.pluginOptions] == nil)
+    #expect(fields.pluginOptions.composedString == "a=1;b=x")
+    #expect(fields.pluginOptions.switchToRawText())
+  }
+
+  @Test
+  func clearedKeyWithKeptValueIsUnfinishedAndNotAutoDeleted() {
+    let fields = Self.loadedFields("a=1")
+    let row = Self.formalRows(fields)[0]
+    fields.pluginOptions.updateKey("", of: row.id)
+    #expect(fields.pluginOptions.rows.contains { $0.id == row.id }, "清空参数名不得自动删除行")
+    #expect(fields.pluginOptions.hasUnfinishedRows)
+    fields.pluginOptions.deleteRow(row.id)
+    #expect(fields.pluginOptions.composedString == "")
+  }
+
+  // MARK: - 原始文本编辑
+
+  @Test
+  func rawTextEditsReparseOnSwitchBackOrStayRawOnFailure() {
+    let fields = Self.loadedFields("a=1")
+    #expect(fields.pluginOptions.switchToRawText())
+    fields.pluginOptions.rawText = "x=1;y"
+    #expect(fields.pluginOptions.switchToTable())
+    #expect(fields.pluginOptions.composedString == "x=1;y")
+
+    // 解析不可靠：留在原始模式并保留原文，不丢弃草稿。
+    fields.pluginOptions.switchToRawText()
+    fields.pluginOptions.rawText = "bad;;"
+    #expect(!fields.pluginOptions.switchToTable())
+    #expect(fields.pluginOptions.mode == .rawText)
+    #expect(fields.pluginOptions.rawText == "bad;;")
+    #expect(fields.pluginOptions.composedString == "bad;;")
+  }
+
+  // MARK: - 装载/重置与提交边界
+
+  @Test
+  func reloadRestoresRowsModeAndRawStateTogether() {
+    let fields = Self.loadedFields("a=1")
+    fields.pluginOptions.updateKey("b", of: fields.pluginOptions.quickAddRowID)
+    fields.pluginOptions.switchToRawText()
+    #expect(fields.hasChanges)
+
+    fields.load(from: Self.editForm(pluginOptions: "a=1"))
+    #expect(fields.pluginOptions.mode == .table)
+    #expect(fields.pluginOptions.composedString == "a=1")
+    #expect(!fields.hasChanges)
+    #expect(fields.fieldErrors.isEmpty)
+
+    fields.load(from: Self.editForm(pluginOptions: "bad;;"))
+    #expect(fields.pluginOptions.mode == .rawText)
+    #expect(fields.pluginOptions.composedString == "bad;;")
+  }
+
+  @Test
+  func composedStringFeedsTheByteLimitAtTheFormBoundary() {
+    let fields = Self.loadedFields("a=1")
+    #expect(fields.pluginOptions.switchToRawText())
+    // 14 × 5,000 字符 + 前缀 > 65,536 字节上限。
+    fields.pluginOptions.rawText = "certRaw=" + String(repeating: Self.certRaw, count: 14)
+    #expect(!fields.validateForSubmit())
+    #expect(
+      fields.fieldErrors[.pluginOptions]
+        == .tooManyBytes(limit: ServerFormFields.pluginOptionsUTF8Limit))
+    #expect(fields.hasChanges)
+  }
+
+  @Test
+  func hiddenPluginSelectionDoesNotBlockOnOptionsDraft() {
+    let fields = Self.loadedFields("a=1")
+    fields.pluginChoice = .none
+    fields.pluginOptions.updateValue("x", of: fields.pluginOptions.quickAddRowID)
+    #expect(fields.validateForSubmit(), "插件「无」时隐藏参数草稿不阻塞保存")
+  }
+}
+
+extension ServerFormPluginOptionsTests {
+  // 移动可行性与执行共用草稿 interface。
+  @Test(arguments: [false, true])
+  func movementEligibilityMatchesActionsAndTracksReordering(rawMode: Bool) throws {
+    let fields = Self.loadedFields("a=1;b=2;")
+    let draft = fields.pluginOptions
+    let rows = Self.formalRows(fields)
+    let first = try #require(rows.first)
+    let last = try #require(rows.last)
+    let blank = draft.quickAddRowID
+    let unknown = UUID()
+    if rawMode { #expect(draft.switchToRawText()) }
+
+    let denied = [
+      (first.id, -1), (last.id, 1), (blank, -1), (blank, 1),
+      (unknown, -1), (unknown, 1), (first.id, 0), (first.id, 2),
+      (first.id, Int.min), (first.id, Int.max),
+    ]
+    for (id, offset) in denied {
+      #expect(!draft.canMoveRow(id, by: offset))
+      draft.moveRow(id, by: offset)
+      #expect(draft.rows.map(\.id) == rows.map(\.id) + [blank])
+      #expect(draft.composedString == "a=1;b=2;")
+      #expect(!fields.hasChanges)
+    }
+
+    #expect(draft.canMoveRow(first.id, by: 1) == !rawMode)
+    #expect(draft.canMoveRow(last.id, by: -1) == !rawMode)
+    draft.moveRow(first.id, by: 1)
+    if rawMode {
+      #expect(draft.composedString == "a=1;b=2;")
+      #expect(!fields.hasChanges)
+    } else {
+      #expect(draft.rows.map(\.id) == [last.id, first.id, blank])
+      #expect(draft.composedString == "b=2;a=1;")
+      #expect(fields.hasChanges)
+      #expect(!draft.canMoveRow(first.id, by: 1))
+      #expect(!draft.canMoveRow(last.id, by: -1))
+      #expect(draft.canMoveRow(first.id, by: -1))
+      draft.moveRow(first.id, by: -1)
+      #expect(draft.composedString == "a=1;b=2;")
+      #expect(!fields.hasChanges)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Servers/ServerNameWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Servers/ServerNameWorkflowTests.swift
new file mode 100644
index 000000000..0106e6229
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Servers/ServerNameWorkflowTests.swift
@@ -0,0 +1,297 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+private struct ServerNameImportCase: Sendable {
+  let host: String
+  let port: Int
+  let supplied: String?
+  let expected: String
+
+  static let all: [Self] = [
+    .init(host: "203.0.113.7", port: 8388, supplied: nil, expected: "203.0.113.7:8388"),
+    .init(host: "203.0.113.7", port: 8389, supplied: "", expected: "203.0.113.7:8389"),
+    .init(host: "server.example", port: 443, supplied: "", expected: "server.example:443"),
+    .init(host: "2001:db8::7", port: 8388, supplied: " \t\n ", expected: "[2001:db8::7]:8388"),
+    .init(host: "server.example", port: 8388, supplied: " 香港 01 ", expected: " 香港 01 "),
+  ]
+}
+
+/// 名称行为通过目录命令与导入 interface 观察，覆盖持久化和无副作用拒绝。
+@MainActor
+struct ServerNameWorkflowTests {
+  @Test(arguments: ["", " \t\n ", "\u{3000}"])
+  func manualCreateAndEditRejectBlankNamesWithoutWrites(_ name: String) async throws {
+    try await withWorkflow { workflow, store in
+      let id = try await workflow.createServer(Self.draft(name: "原名"), into: nil)
+      let before = try store.load()
+      let treeBefore = workflow.tree
+      do {
+        _ = try await workflow.createServer(Self.draft(name: name), into: nil)
+        Issue.record("空白名称应拒绝新建")
+      } catch {
+        #expect(error as? ServerFormError == .emptyName)
+      }
+      do {
+        try await workflow.updateServer(id, draft: Self.draft(name: name, password: "changed"))
+        Issue.record("空白名称应拒绝编辑")
+      } catch {
+        #expect(error as? ServerFormError == .emptyName)
+      }
+      #expect(try store.load() == before)
+      #expect(workflow.tree == treeBefore)
+    }
+  }
+
+  @Test
+  func manualNamesAreTrimmedAndGeneratedNamesSurviveEndpointEdits() async throws {
+    try await withWorkflow { workflow, store in
+      let created = try await workflow.createServer(Self.draft(name: " \t新名称\n "), into: nil)
+      #expect(try workflow.serverEditForm(for: created)?.remark == "新名称")
+      try await workflow.updateServer(created, draft: Self.draft(name: "\n编辑名称\t"))
+      #expect(try workflow.serverEditForm(for: created)?.remark == "编辑名称")
+      _ = await workflow.importServers(
+        from: [
+          .clipboardText(
+            SsUri(method: "aes-256-gcm", password: "p", host: "203.0.113.7", port: 8388)
+              .encode())
+        ], into: nil)
+      let imported = try #require(workflow.tree.roots.last)
+      var edited = Self.draft(name: imported.name)
+      edited.address = "198.51.100.9"
+      edited.port = 9999
+      try await workflow.updateServer(imported.id, draft: edited)
+      #expect(try workflow.serverEditForm(for: imported.id)?.remark == "203.0.113.7:8388")
+      #expect(try store.load().catalog.entry(for: imported.id)?.displayName == "203.0.113.7:8388")
+    }
+  }
+
+  @Test(arguments: ServerNameImportCase.all)
+  fileprivate func uriImportsSaveNames(_ sample: ServerNameImportCase) async throws {
+    try await withWorkflow { workflow, store in
+      let uri = SsUri(
+        method: "aes-256-gcm", password: "p", host: sample.host, port: sample.port,
+        remark: sample.supplied)
+      let result = await workflow.importServers(from: [.clipboardText(uri.encode())], into: nil)
+      #expect(result.sources.first?.result.importedCount == 1)
+      let node = try #require(workflow.tree.roots.first)
+      #expect(node.name == sample.expected)
+      #expect(try workflow.serverEditForm(for: node.id)?.remark == sample.expected)
+      #expect(try store.load().catalog.entry(for: node.id)?.displayName == sample.expected)
+    }
+  }
+
+  @Test(arguments: ServerNameImportCase.all)
+  fileprivate func legacyImportsSaveNames(_ sample: ServerNameImportCase) async throws {
+    try await withWorkflow { _, store in
+      var profile: [String: Any] = [
+        "ServerHost": sample.host, "ServerPort": sample.port,
+        "Method": "aes-256-gcm", "Password": "p",
+      ]
+      if let supplied = sample.supplied { profile["Remark"] = supplied }
+      let snapshot = try LegacySnapshot(propertyList: ["ServerProfiles": [profile]])
+      let importer = LegacyImportService(
+        source: FixedLegacySnapshotProvider(snapshot: snapshot), catalogStore: store,
+        marker: InMemoryLegacyImportMarker())
+      let result = try importer.importCurrentSnapshot()
+      #expect(result.report.importedServerCount == 1)
+      let catalog = try store.load().catalog
+      let group = try #require(catalog.entry(for: result.groupID))
+      guard case .group(let fields) = group.kind else {
+        Issue.record("预期导入分组")
+        return
+      }
+      let id = try #require(fields.children.first)
+      let entry = try #require(catalog.entry(for: id))
+      #expect(entry.displayName == sample.expected)
+      guard case .server(let server) = entry.kind else {
+        Issue.record("预期服务器")
+        return
+      }
+      #expect(server.remark == sample.expected)
+    }
+  }
+
+  @Test(arguments: ServerNameImportCase.all)
+  fileprivate func subscriptionImportsSaveNames(_ sample: ServerNameImportCase) async throws {
+    let fetcher = FakeSubscriptionFetcher(behavior: .success(try Self.document(sample)))
+    try await withWorkflow(fetcher: fetcher) { workflow, store in
+      let subscription = try await workflow.createSubscription(
+        urlString: "https://provider.example/s")
+      let group = try #require(workflow.tree.node(withID: subscription.groupID))
+      let node = try #require(group.childNodes.first)
+      #expect(node.name == sample.expected)
+      #expect(try workflow.serverEditForm(for: node.id)?.remark == sample.expected)
+      #expect(try store.load().catalog.entry(for: node.id)?.displayName == sample.expected)
+    }
+  }
+
+  @Test
+  func subscriptionRenamesKeepIdentityAndRefreshesRegenerateMissingNames() async throws {
+    let initial = ServerNameImportCase.all[0]
+    let fetcher = FakeSubscriptionFetcher(behavior: .success(try Self.document(initial)))
+    try await withWorkflow(fetcher: fetcher) { workflow, _ in
+      let subscription = try await workflow.createSubscription(
+        urlString: "https://provider.example/s")
+      let id = try #require(workflow.tree.node(withID: subscription.groupID)?.childNodes.first?.id)
+      fetcher.setBehavior(
+        .success(
+          try Self.document(
+            .init(host: initial.host, port: initial.port, supplied: "远端新名", expected: "远端新名"))))
+      await workflow.refreshSubscription(subscription.id)
+      #expect(workflow.tree.node(withID: id)?.name == "远端新名")
+      fetcher.setBehavior(.success(try Self.document(initial, password: "updated-password")))
+      await workflow.refreshSubscription(subscription.id)
+      #expect(try workflow.serverEditForm(for: id)?.password == "updated-password")
+      fetcher.setBehavior(.success(try Self.document(initial)))
+      await workflow.refreshSubscription(subscription.id)
+      #expect(workflow.tree.node(withID: id)?.name == "203.0.113.7:8388")
+      fetcher.setBehavior(.success(try Self.document(ServerNameImportCase.all[1])))
+      await workflow.refreshSubscription(subscription.id)
+      let replacement = try #require(
+        workflow.tree.node(withID: subscription.groupID)?.childNodes.first)
+      #expect(replacement.name == "203.0.113.7:8389")
+      #expect(replacement.id != id)
+    }
+  }
+
+  @Test
+  func subscriptionRefreshReplacesSecretsAndClearsUnusedPluginOptions() async throws {
+    let sample = ServerNameImportCase.all[0]
+    let fetcher = FakeSubscriptionFetcher(
+      behavior: .success(
+        try Self.document(
+          sample, plugin: "v2ray-plugin", pluginOptions: "mode=websocket")))
+    try await withWorkflow(fetcher: fetcher) { workflow, _ in
+      let subscription = try await workflow.createSubscription(
+        urlString: "https://provider.example/s")
+      let id = try #require(workflow.tree.node(withID: subscription.groupID)?.childNodes.first?.id)
+      fetcher.setBehavior(
+        .success(
+          try Self.document(
+            sample, password: "new-password", plugin: "v2ray-plugin", pluginOptions: "mode=quic")))
+      await workflow.refreshSubscription(subscription.id)
+      let updated = try #require(try workflow.serverEditForm(for: id))
+      #expect(updated.password == "new-password")
+      #expect(updated.plugin.options == "mode=quic")
+      fetcher.setBehavior(.success(try Self.document(sample, password: "new-password")))
+      await workflow.refreshSubscription(subscription.id)
+      let cleared = try #require(try workflow.serverEditForm(for: id))
+      #expect(cleared.password == "new-password")
+      #expect(cleared.plugin.selection == .none)
+      #expect(cleared.plugin.options.isEmpty)
+      #expect(!cleared.plugin.optionsPresent)
+    }
+  }
+
+  @Test
+  func duplicateEndpointsRejectRefreshAndPreserveSavedSnapshot() async throws {
+    let sample = ServerNameImportCase.all[0]
+    let fetcher = FakeSubscriptionFetcher(behavior: .success(try Self.document(sample)))
+    try await withWorkflow(fetcher: fetcher) { workflow, store in
+      let subscription = try await workflow.createSubscription(
+        urlString: "https://provider.example/s")
+      let treeBefore = workflow.tree
+      let catalogBefore = try store.load().catalog
+      let duplicate = Data(
+        """
+        {"version":1,"servers":[
+          {"server":"203.0.113.7","server_port":8388,"method":"aes-256-gcm","password":"p","remarks":"甲"},
+          {"server":"203.0.113.7","server_port":8388,"method":"aes-256-gcm","password":"other","remarks":"乙"}
+        ]}
+        """.utf8)
+      fetcher.setBehavior(.success(duplicate))
+      await workflow.refreshSubscription(subscription.id)
+      #expect(workflow.tree == treeBefore)
+      #expect(try store.load().catalog == catalogBefore)
+      guard case .failed(_, let failure) = workflow.subscriptions.first?.status else {
+        Issue.record("重复端点应拒绝整个刷新")
+        return
+      }
+      #expect(failure == .duplicateIdentity)
+    }
+  }
+
+  @Test(arguments: ["server", "server_port", "method", "password", "plugin", "plugin_opts"])
+  func idLessIdentityDependsOnlyOnEndpoint(_ changedField: String) throws {
+    let base: [String: Any] = [
+      "server": "203.0.113.7", "server_port": 8388, "method": "aes-256-gcm",
+      "password": "p", "plugin": "v2ray-plugin", "plugin_opts": "mode=websocket",
+    ]
+    let replacements: [String: Any] = [
+      "server": "203.0.113.8", "server_port": 8389, "method": "aes-128-gcm",
+      "password": "p2", "plugin": "other-plugin", "plugin_opts": "mode=quic",
+    ]
+    func identity(_ server: [String: Any]) throws -> NodeID {
+      let data = try JSONSerialization.data(withJSONObject: ["version": 1, "servers": [server]])
+      let snapshot = try SubscriptionDocumentParser.parse(
+        data, subscriptionID: NodeID(rawValue: "sub"))
+      guard case .server(let leaf) = snapshot.root.children.first else {
+        throw NSError(domain: "ServerNameTests", code: 1)
+      }
+      return leaf.id
+    }
+    var changed = base
+    changed[changedField] = replacements[changedField]
+    if changedField == "server" || changedField == "server_port" {
+      #expect(try identity(base) != identity(changed))
+    } else {
+      #expect(try identity(base) == identity(changed))
+    }
+  }
+
+  @Test
+  func providerIDsAllowDistinctServersAtTheSameEndpoint() throws {
+    let data = Data(
+      """
+      {"version":1,"servers":[
+        {"id":"aaaaaaaa-0000-4000-8000-00000000000a","server":"203.0.113.7","server_port":8388,
+         "method":"aes-256-gcm","password":"p","remarks":"甲"},
+        {"id":"bbbbbbbb-0000-4000-8000-00000000000b","server":"203.0.113.7","server_port":8388,
+         "method":"aes-256-gcm","password":"other","remarks":"乙"}
+      ]}
+      """.utf8)
+    let snapshot = try SubscriptionDocumentParser.parse(
+      data, subscriptionID: NodeID(rawValue: "sub"))
+    #expect(snapshot.root.children.count == 2)
+  }
+
+}
+
+extension ServerNameWorkflowTests {
+  private static func draft(name: String, password: String = "p") -> ServerEditDraft {
+    ServerEditDraft(
+      address: "203.0.113.7", port: 8388, encryptionMethod: "aes-256-gcm", password: password,
+      remark: name, plugin: .none, pluginOptions: nil)
+  }
+
+  private static func document(
+    _ sample: ServerNameImportCase, password: String = "p", plugin: String? = nil,
+    pluginOptions: String? = nil
+  ) throws -> Data {
+    var server: [String: Any] = [
+      "server": sample.host, "server_port": sample.port, "method": "aes-256-gcm",
+      "password": password,
+    ]
+    if let supplied = sample.supplied { server["remarks"] = supplied }
+    if let plugin { server["plugin"] = plugin }
+    if let pluginOptions { server["plugin_opts"] = pluginOptions }
+    return try JSONSerialization.data(withJSONObject: ["version": 1, "servers": [server]])
+  }
+
+  private func withWorkflow(
+    fetcher: SubscriptionFetching = FakeSubscriptionFetcher(behavior: .success(Data())),
+    _ body:
+      @MainActor (CatalogWorkflow, CatalogFileStore) async throws -> Void
+  ) async throws {
+    let directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("server-name-tests-\(UUID().uuidString)", isDirectory: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.json"))
+    let coordinator = CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime())
+    let workflow = makeCatalogWorkflow(
+      coordinator: coordinator, subscriptionFetcher: fetcher)
+    try await body(workflow, store)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/AppLanguagePreferencesTests.swift b/ShadowsocksX-NG2/Tests/Settings/AppLanguagePreferencesTests.swift
new file mode 100644
index 000000000..0a42a2faf
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/AppLanguagePreferencesTests.swift
@@ -0,0 +1,57 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct AppLanguagePreferencesTests {
+  @Test func missingApplicationOverrideUsesAutomatic() throws {
+    let suite = "language-tests-\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+
+    let preferences = AppLanguagePreferences(defaults: defaults, applicationID: suite)
+
+    #expect(preferences.selection == .automatic)
+  }
+
+  @Test func languageSelectionSurvivesRelaunchAndAutomaticRemovesOverride() throws {
+    let suite = "language-tests-\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+    defaults.set(true, forKey: "silentLaunch")
+    let preferences = AppLanguagePreferences(defaults: defaults, applicationID: suite)
+
+    for language in [AppLanguage.english, .simplifiedChinese] {
+      preferences.select(language)
+      #expect(preferences.selection == language)
+      #expect(
+        AppLanguagePreferences(defaults: defaults, applicationID: suite).selection == language)
+      #expect(defaults.stringArray(forKey: "AppleLanguages") == [language.rawValue])
+    }
+
+    preferences.select(.automatic)
+    #expect(
+      AppLanguagePreferences(defaults: defaults, applicationID: suite).selection == .automatic)
+    #expect(defaults.persistentDomain(forName: suite)?["AppleLanguages"] == nil)
+    #expect(defaults.bool(forKey: "silentLaunch"))
+  }
+
+  @Test func menuNamesUseNativePrefixAndCurrentInterfaceTranslation() throws {
+    let appBundle = AppArtifact.bundle
+    let english = try #require(
+      Bundle(url: appBundle.bundleURL.appendingPathComponent("Contents/Resources/en.lproj")))
+    let chinese = try #require(
+      Bundle(url: appBundle.bundleURL.appendingPathComponent("Contents/Resources/zh-Hans.lproj")))
+
+    #expect(AppLanguage.automatic.menuTitle(in: english) == "Auto Detect · Auto Detect")
+    #expect(AppLanguage.simplifiedChinese.menuTitle(in: english) == "简体中文 · Simplified Chinese")
+    #expect(AppLanguage.english.menuTitle(in: english) == "English · English")
+    #expect(AppLanguage.automatic.menuTitle(in: chinese) == "Auto Detect · 自动检测")
+    #expect(AppLanguage.simplifiedChinese.menuTitle(in: chinese) == "简体中文 · 简体中文")
+    #expect(AppLanguage.english.menuTitle(in: chinese) == "English · 英文")
+    #expect(AppLanguage.automatic.currentValueTitle(in: english) == "Auto Detect")
+    #expect(AppLanguage.simplifiedChinese.currentValueTitle(in: english) == "简体中文")
+    #expect(AppLanguage.english.currentValueTitle(in: chinese) == "English")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/LANListeningWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Settings/LANListeningWorkflowTests.swift
new file mode 100644
index 000000000..d54ec458b
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/LANListeningWorkflowTests.swift
@@ -0,0 +1,306 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@Suite(.timeLimit(.minutes(1)))
+@MainActor
+struct LANListeningWorkflowTests {
+  @Test func disabledAuthenticationDoesNotGateLANSaveOnCredentialShape() async throws {
+    let committing = FakeSettingsCommitter()
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: FakeOccupancyProbe())
+    var draft = workflow.beginLANListeningEditing()
+    draft.isEnabled = true
+    draft.authenticationEnabled = false
+    draft.username = ""
+    draft.password = ""
+    workflow.refreshPortEditorOccupancy(for: draft.ports)
+    await waitForPortEditorOccupancy(workflow, draft: draft.ports, port: .socks)
+    #expect(workflow.canSaveLANListening(draft))
+    #expect(await workflow.saveLANListening(draft) == .persisted)
+  }
+
+  @Test func enabledAuthenticationGatesLANSaveOnCredentialShape() async throws {
+    let workflow = SettingsWorkflow(
+      committing: FakeSettingsCommitter(), occupancyProbe: FakeOccupancyProbe())
+    var draft = workflow.beginLANListeningEditing()
+    draft.isEnabled = true
+    draft.authenticationEnabled = true
+    draft.username = "user:name"
+    draft.password = "ok"
+    workflow.refreshPortEditorOccupancy(for: draft.ports)
+    await waitForPortEditorOccupancy(workflow, draft: draft.ports, port: .socks)
+    #expect(!workflow.canSaveLANListening(draft))
+  }
+
+  @Test func savingLocalPortsIgnoresPreservedInvalidCredentialsWhileAuthenticationIsOff() async {
+    let committing = FakeSettingsCommitter()
+    committing.committedSettings.listen.lan.authenticationEnabled = false
+    committing.committedSettings.listen.lan.username = ""
+    committing.committedSettings.listen.lan.password = "kept"
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: FakeOccupancyProbe())
+    var draft = workflow.beginPortSettingsEditing()
+    draft.socksPort = 13001
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitForPortEditorOccupancy(workflow, draft: draft, port: .socks)
+    #expect(workflow.canSavePortSettings(draft))
+    #expect(await workflow.savePortSettings(draft) == .persisted)
+    #expect(committing.committedSettings.listen.lan.username == "")
+  }
+
+  @Test func togglingLANInvalidatesOccupancyWithoutChangingModeOrPorts() async throws {
+    let probe = FakeOccupancyProbe(occupiedPorts: [11088])
+    let workflow = SettingsWorkflow(
+      committing: FakeSettingsCommitter(), occupancyProbe: probe)
+    var draft = workflow.beginLANListeningEditing()
+    draft.isEnabled = true
+    workflow.refreshPortEditorOccupancy(for: draft.ports)
+    await waitForPortEditorOccupancy(workflow, draft: draft.ports, port: .socks)
+    #expect(!workflow.canSaveLANListening(draft))
+
+    draft.isEnabled = false
+    #expect(workflow.portFieldState(for: .socks, editorDraft: draft.ports).occupancy == nil)
+    workflow.refreshPortEditorOccupancy(for: draft.ports)
+    #expect(workflow.canSaveLANListening(draft))
+    let count = probe.callCount
+
+    draft.isEnabled = true
+    #expect(workflow.portFieldState(for: .socks, editorDraft: draft.ports).occupancy == nil)
+    #expect(!workflow.canSaveLANListening(draft))
+    workflow.refreshPortEditorOccupancy(for: draft.ports)
+    await waitForPortEditorOccupancy(workflow, draft: draft.ports, port: .socks)
+    #expect(probe.callCount == count + 2)
+    #expect(!workflow.canSaveLANListening(draft))
+  }
+
+  @Test func disablingAndReenablingLANPreservesModePortsAndCredentials() async throws {
+    let committing = FakeSettingsCommitter()
+    let probe = FakeOccupancyProbe()
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: probe)
+    var draft = workflow.beginLANListeningEditing()
+    #expect(!draft.isEnabled)
+    #expect(draft.mode == .allIPv4Interfaces)
+    draft.isEnabled = true
+    draft.mode = .allIPv6Interfaces
+    draft.ports.socksPort = 13001
+    draft.udpRelayEnabled = true
+    draft.authenticationEnabled = true
+    draft.password = "saved-password"
+    #expect(await workflow.saveLANListening(draft) == .persisted)
+
+    draft.isEnabled = false
+    let probeCount = probe.callCount
+    #expect(await workflow.saveLANListening(draft) == .persisted)
+    #expect(probe.callCount == probeCount)
+    #expect(committing.committedSettings.listen.locals.count == 2)
+    var reopened = workflow.beginLANListeningEditing()
+    #expect(!reopened.isEnabled)
+    #expect(reopened.mode == .allIPv6Interfaces)
+    #expect(reopened.ports.socksPort == 13001)
+    #expect(reopened.udpRelayEnabled)
+    #expect(reopened.authenticationEnabled)
+    #expect(reopened.password == "saved-password")
+    reopened.isEnabled = true
+    #expect(await workflow.saveLANListening(reopened) == .persisted)
+    #expect(committing.committedSettings.listen.locals.count == 4)
+    #expect(committing.committedSettings.listen.locals.last?.localAddress == "::")
+  }
+
+  @Test func savingDisabledLANKeepsLocalPortsAndSkipsOccupancy() async throws {
+    let committing = FakeSettingsCommitter()
+    committing.committedSettings.listen.socksPort = 13001
+    let probe = FakeOccupancyProbe(occupiedPorts: [11088, 11089])
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: probe)
+    let draft = workflow.beginLANListeningEditing()
+    #expect(draft.password.count == 10)
+    #expect(await workflow.saveLANListening(draft) == .persisted)
+    #expect(committing.committedSettings.listen.socksPort == 13001)
+    #expect(probe.callCount == 0)
+    let reopened = workflow.beginLANListeningEditing()
+    #expect(reopened.password == draft.password)
+  }
+
+  @Test func editingOneLocalPortPermitsTheOtherRuntimeOwnedPort() async {
+    let committing = FakeSettingsCommitter()
+    committing.runtimeListenFacts = RuntimeListenFacts(listen: committing.committedSettings.listen)
+    committing.runtimeListenerProcessID = 123
+    let probe = FakeOccupancyProbe(occupiedPorts: [11087], occupierProcessIDs: [123])
+    let workflow = SettingsWorkflow(committing: committing, occupancyProbe: probe)
+    var draft = workflow.beginPortSettingsEditing()
+    draft.socksPort = 13001
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitForPortEditorOccupancy(workflow, draft: draft, port: .http)
+    #expect(await workflow.savePortSettings(draft) == .persisted)
+    #expect(committing.committedSettings.listen.socksPort == 13001)
+  }
+
+  @Test func persistenceFailurePreservesCompleteCommittedListeningConfiguration() async throws {
+    let committing = FakeSettingsCommitter()
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: FakeOccupancyProbe())
+    let original = workflow.beginLANListeningEditing()
+    #expect(await workflow.saveLANListening(original) == .persisted)
+    let saved = committing.committedSettings
+    var edited = workflow.beginLANListeningEditing()
+    edited.password = "replacement"
+    committing.updateError = ProxyListeningStoreError.ioFailure(detail: "disk full")
+    #expect(
+      await workflow.saveLANListening(edited)
+        == .commitFailed(.store(.ioFailure(detail: "disk full"))))
+    #expect(committing.committedSettings == saved)
+    #expect(workflow.beginLANListeningEditing().password == original.password)
+  }
+
+  @Test func savingLANLocksTheEditorBeforeTCPProbing() async throws {
+    let committing = FakeSettingsCommitter()
+    let probe = GatedOccupancyProbe(gatedAnswer: .free, passThroughAnswer: .free)
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: probe)
+    var draft = workflow.beginLANListeningEditing()
+    draft.isEnabled = true
+    draft.mode = .allIPv4Interfaces
+    let submission = Task { await workflow.saveLANListening(draft) }
+    try await withTestTask(
+      submission, release: { probe.releaseGatedCalls() },
+      body: {
+        try await probe.waitUntilEntered()
+        #expect(workflow.isCommitting)
+        #expect(await workflow.saveProxyExceptions("example.com") == .rejected(.inProgress))
+        probe.passThrough(.free)
+        probe.releaseGatedCalls()
+        #expect(await submission.value == .persisted)
+        #expect(!workflow.isCommitting)
+      })
+  }
+
+  @Test func ownLANPortExceptionUsesLANRuntimePortAndMode() async throws {
+    let committing = FakeSettingsCommitter()
+    committing.committedSettings.listen.lan.isEnabled = true
+    committing.committedSettings.listen.lan.mode = .allIPv4AndIPv6Interfaces
+    committing.runtimeListenFacts = RuntimeListenFacts(listen: committing.committedSettings.listen)
+    committing.runtimeListenerProcessID = 123
+    let probe = FakeOccupancyProbe(
+      occupiedPorts: [11088], occupierIPv6ProcessIDs: [123], occupiedFamilies: [.ipv4])
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: probe)
+    var draft = workflow.beginLANListeningEditing()
+    draft.isEnabled = true
+    draft.mode = .allIPv4Interfaces
+    workflow.refreshPortEditorOccupancy(for: draft.ports)
+    await waitForPortEditorOccupancy(workflow, draft: draft.ports, port: .socks)
+    #expect(workflow.portFieldState(for: .socks, editorDraft: draft.ports).isRuntimePortException)
+    #expect(await workflow.saveLANListening(draft) == .persisted)
+  }
+
+  @Test func matchingPIDCannotExemptAChangedLANPort() async throws {
+    let committing = FakeSettingsCommitter()
+    committing.committedSettings.listen.lan.isEnabled = true
+    committing.committedSettings.listen.lan.mode = .allIPv4Interfaces
+    committing.runtimeListenFacts = RuntimeListenFacts(listen: committing.committedSettings.listen)
+    committing.runtimeListenerProcessID = 123
+    let probe = FakeOccupancyProbe(occupiedPorts: [13001], occupierProcessIDs: [123])
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: probe)
+    var draft = workflow.beginLANListeningEditing()
+    draft.ports.socksPort = 13001
+    workflow.refreshPortEditorOccupancy(for: draft.ports)
+    await waitForPortEditorOccupancy(workflow, draft: draft.ports, port: .socks)
+    #expect(!workflow.portFieldState(for: .socks, editorDraft: draft.ports).isRuntimePortException)
+    #expect(await workflow.saveLANListening(draft) == .rejected(.occupied([.socks])))
+  }
+
+  @Test func invalidOtherGroupStillBlocksSavingWithoutMarkingLocalFields() async {
+    let committing = FakeSettingsCommitter()
+    committing.committedSettings.listen.lan.socksPort = 0
+    let workflow = SettingsWorkflow(committing: committing, occupancyProbe: FakeOccupancyProbe())
+    let draft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitForPortEditorOccupancy(workflow, draft: draft, port: .http)
+    #expect(workflow.portFieldState(for: .socks, editorDraft: draft).issues.isEmpty)
+    #expect(workflow.portFieldState(for: .http, editorDraft: draft).issues.isEmpty)
+    #expect(!workflow.canSavePortSettings(draft))
+    #expect(await workflow.savePortSettings(draft) == .rejected(.validation([])))
+    #expect(committing.updateCalls.isEmpty)
+  }
+
+}
+
+extension LANListeningWorkflowTests {
+  @Test(arguments: [
+    LANListenerMode.allIPv4Interfaces, .allIPv4AndIPv6Interfaces, .allIPv6Interfaces,
+  ])
+  func editorProbesPreserveBothGroupsAndUseLANEndpoints(mode: LANListenerMode) async throws {
+    let committing = FakeSettingsCommitter()
+    let probe = FakeOccupancyProbe()
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: probe)
+    var draft = workflow.beginLANListeningEditing()
+    draft.isEnabled = true
+    draft.mode = mode
+    draft.ports.socksPort = 13001
+    workflow.refreshPortEditorOccupancy(for: draft.ports)
+    await waitForPortEditorOccupancy(workflow, draft: draft.ports, port: .http)
+
+    var expected = RuntimeListenFacts(listen: committing.committedSettings.listen)
+    expected.lan.isEnabled = true
+    expected.lan.mode = mode
+    expected.lan.socksPort = 13001
+    #expect(probe.requests.count == 2)
+    #expect(probe.requests.map(\.endpoint) == [.lanSocks, .lanHTTP])
+    #expect(probe.requests.map(\.port) == [13001, 11089])
+    #expect(
+      probe.requests.allSatisfy { $0.listen == expected && $0.listenerMode == mode.bindingMode })
+    #expect(probe.requests.allSatisfy { $0.bindAddress == mode.bindAddress })
+
+    #expect(await workflow.saveLANListening(draft) == .persisted)
+    #expect(probe.requests.count == 4)
+    #expect(Array(probe.requests.suffix(2)).map(\.endpoint) == [.lanSocks, .lanHTTP])
+    #expect(probe.requests.allSatisfy { $0.listen == expected })
+  }
+
+  @Test func suggestedLANPortKeepsLocalIdentityAndExcludesAllConfiguredPorts() async throws {
+    let committing = FakeSettingsCommitter()
+    committing.committedSettings.listen.socksPort = 32768
+    committing.committedSettings.listen.httpPort = 32769
+    let probe = FakeOccupancyProbe(occupiedPorts: [11088])
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: probe)
+    var draft = workflow.beginLANListeningEditing()
+    draft.isEnabled = true
+    draft.mode = .allIPv6Interfaces
+    workflow.refreshPortEditorOccupancy(for: draft.ports)
+    await waitForPortEditorOccupancy(workflow, draft: draft.ports, port: .socks)
+    #expect(workflow.portFieldState(for: .socks, editorDraft: draft.ports).canSuggestFreePort)
+    #expect(
+      await workflow.suggestFreePort(for: .socks, from: draft.ports)
+        == .suggestedPort(port: .socks, value: 32770))
+    let request = try #require(probe.requests.last)
+    #expect(request.endpoint == .lanSocks)
+    #expect(request.port == 32770)
+    #expect(request.listen.socksPort == 32768)
+    #expect(request.listen.httpPort == 32769)
+    #expect(request.listen.lan.socksPort == 32770)
+    #expect(request.listen.lan.httpPort == 11089)
+    #expect(request.listenerMode == .allIPv6Interfaces)
+    #expect(committing.updateCalls.isEmpty)
+  }
+
+  @Test(arguments: [SettingsListeningGroup.local, .lan])
+  func crossGroupDuplicatesOnlyMarkTheEditedField(group: SettingsListeningGroup) async {
+    let committing = FakeSettingsCommitter()
+    let workflow = SettingsWorkflow(committing: committing, occupancyProbe: FakeOccupancyProbe())
+    let draft = SettingsPortDraft(
+      socksPort: group == .local ? 11089 : 11087,
+      httpPort: group == .local ? 11087 : 11089,
+      group: group, listenerMode: .allIPv4Interfaces)
+    #expect(workflow.portFieldState(for: .socks, editorDraft: draft).issues.count == 1)
+    #expect(workflow.portFieldState(for: .http, editorDraft: draft).issues.isEmpty)
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitForPortEditorOccupancy(workflow, draft: draft, port: .http)
+    #expect(!workflow.canSavePortSettings(draft))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/ListenerModeSettingsWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Settings/ListenerModeSettingsWorkflowTests.swift
new file mode 100644
index 000000000..92b3ec553
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/ListenerModeSettingsWorkflowTests.swift
@@ -0,0 +1,131 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+extension SettingsWorkflowInterfaceTests {
+  private func saveMode(_ workflow: SettingsWorkflow, _ mode: LANListenerMode?) async
+    -> SettingsCommandOutcome
+  {
+    var draft = workflow.beginLANListeningEditing()
+    draft.isEnabled = mode != nil
+    if let mode { draft.mode = mode }
+    return await workflow.saveLANListening(draft)
+  }
+
+  func testListenerModeAllowsReplacingItsOwnActiveListener() async {
+    probe = FakeOccupancyProbe(
+      occupiedPorts: [11088], occupierName: "sslocal", occupierProcessIDs: [42],
+      occupiedFamilies: [.ipv4])
+    committing.committedSettings.listen.listenerMode = .allIPv4Interfaces
+    committing.isProxyRunning = true
+    committing.runtimeListenerProcessID = 42
+    let workflow = makeWorkflow()
+
+    let outcome = await saveMode(workflow, .allIPv4AndIPv6Interfaces)
+
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertEqual(
+      committing.committedSettings.listen.listenerMode, .allIPv4AndIPv6Interfaces)
+  }
+
+  func testListenerModeDoesNotTreatAnotherSslocalAsItsOwnListener() async {
+    probe = FakeOccupancyProbe(
+      occupiedPorts: [11088], occupierName: "sslocal", occupierProcessIDs: [43],
+      occupiedFamilies: [.ipv4])
+    committing.committedSettings.listen.listenerMode = .allIPv4Interfaces
+    committing.isProxyRunning = true
+    committing.runtimeListenerProcessID = 42
+    let workflow = makeWorkflow()
+
+    let outcome = await saveMode(workflow, .allIPv4AndIPv6Interfaces)
+
+    XCTAssertEqual(outcome, .rejected(.occupied([.socks])))
+    XCTAssertEqual(committing.committedSettings.listen.listenerMode, .allIPv4Interfaces)
+    XCTAssertTrue(committing.updateCalls.isEmpty)
+  }
+
+  func testListenerModeIgnoresUnrelatedIPv6OccupantWhenSavingIPv4Mode() async {
+    probe = FakeOccupancyProbe(
+      occupiedPorts: [11088], occupierName: "sslocal", occupierProcessIDs: [42],
+      occupierIPv6ProcessIDs: [43], occupiedFamilies: [.ipv4])
+    committing.committedSettings.listen.listenerMode = .allIPv4Interfaces
+    committing.isProxyRunning = true
+    committing.runtimeListenerProcessID = 42
+    let workflow = makeWorkflow()
+
+    let outcome = await saveMode(workflow, nil)
+
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertEqual(committing.committedSettings.listen.listenerMode, .disabled)
+  }
+
+  func testListenerModeCanReplaceItsOwnDualStackSocketWithIPv4Mode() async {
+    probe = FakeOccupancyProbe(
+      occupiedPorts: [11088], occupierName: "sslocal", occupierIPv6ProcessIDs: [42],
+      occupiedFamilies: [.ipv4])
+    committing.committedSettings.listen.listenerMode = .allIPv4AndIPv6Interfaces
+    committing.isProxyRunning = true
+    committing.runtimeListenerProcessID = 42
+    let workflow = makeWorkflow()
+
+    let outcome = await saveMode(workflow, .allIPv4Interfaces)
+
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertEqual(
+      committing.committedSettings.listen.listenerMode, .allIPv4Interfaces)
+  }
+
+  func testListenerModeReportsUnknownDualStackFamilyAlongsideOwnListener() async {
+    probe = FakeOccupancyProbe(
+      occupiedPorts: [11088], occupierName: "sslocal", occupierProcessIDs: [42],
+      occupiedFamilies: [.ipv4],
+      unverifiedFamilyDetail: "IPv4 地址族无法判定")
+    committing.committedSettings.listen.listenerMode = .allIPv4Interfaces
+    committing.isProxyRunning = true
+    committing.runtimeListenerProcessID = 42
+    let workflow = makeWorkflow()
+
+    let outcome = await saveMode(workflow, .allIPv4AndIPv6Interfaces)
+
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertEqual(
+      committing.committedSettings.listen.listenerMode, .allIPv4AndIPv6Interfaces)
+  }
+
+  func testListenerModeSavePreservesOtherCommittedSettings() async {
+    committing.committedSettings.listen.socksPort = 12_086
+    committing.committedSettings.listen.httpPort = 12_087
+    committing.committedSettings.proxyExceptions = "existing.example"
+    committing.committedSettings.preferredMode = .global
+    committing.committedSettings.agentEnabled = true
+    committing.committedSettings.systemProxyEnabled = true
+    let original = committing.committedSettings
+    let workflow = makeWorkflow()
+
+    let outcome = await saveMode(workflow, .allIPv4AndIPv6Interfaces)
+
+    var expected = original
+    expected.listen.listenerMode = .allIPv4AndIPv6Interfaces
+    expected.listen.lan.password =
+      committing.committedSettings.listen.lan.password
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertEqual(committing.updateCalls, [expected])
+    XCTAssertEqual(committing.committedSettings, expected)
+  }
+
+  func testListenerModePersistenceFailurePreservesCommittedSettings() async {
+    let original = committing.committedSettings
+    committing.updateError = ProxyListeningStoreError.ioFailure(detail: "disk full")
+    let workflow = makeWorkflow()
+
+    let outcome = await saveMode(workflow, .allIPv6Interfaces)
+
+    XCTAssertEqual(
+      outcome,
+      .commitFailed(.store(.ioFailure(detail: "disk full"))))
+    XCTAssertEqual(workflow.lastFailure, .store(.ioFailure(detail: "disk full")))
+    XCTAssertEqual(committing.committedSettings, original)
+    XCTAssertFalse(workflow.isCommitting)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/ListenerOccupancyLifecycleTests.swift b/ShadowsocksX-NG2/Tests/Settings/ListenerOccupancyLifecycleTests.swift
new file mode 100644
index 000000000..3f951fd33
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/ListenerOccupancyLifecycleTests.swift
@@ -0,0 +1,161 @@
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ListenerOccupancyLifecycleTests {
+  @Test func cachedOwnershipIsNotReinterpretedForAnotherProcess() async {
+    let committing = FakeSettingsCommitter()
+    committing.isProxyRunning = true
+    committing.runtimeListenerProcessID = 123
+    let workflow = SettingsWorkflow(
+      committing: committing,
+      occupancyProbe: FakeOccupancyProbe(occupiedPorts: [11086], occupierProcessIDs: [456]))
+    let draft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy != nil)
+    #expect(!workflow.portFieldState(for: .socks, editorDraft: draft).isRuntimePortException)
+
+    committing.runtimeListenerProcessID = 456
+    let field = workflow.portFieldState(for: .socks, editorDraft: draft)
+    #expect(field.occupancy == nil)
+    #expect(!field.isRuntimePortException)
+    #expect(!field.canSuggestFreePort)
+  }
+
+  @Test(arguments: ContextChange.allCases)
+  func changedContextDuringSuggestionDiscardsCandidate(change: ContextChange) async {
+    let committing = FakeSettingsCommitter()
+    let probe = SuggestionProbe()
+    let workflow = SettingsWorkflow(committing: committing, occupancyProbe: probe)
+    let draft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.canSavePortSettings(draft))
+    let suggestion = Task { await workflow.suggestFreePort(for: .socks, from: draft) }
+    await waitUntil(probe.gate.entered > 0)
+
+    change.apply(to: committing)
+    probe.gate.releaseGatedCalls()
+    #expect(await suggestion.value == .rejected(.superseded))
+    #expect(committing.updateCalls.isEmpty)
+  }
+
+  @Test(arguments: ContextChange.allCases)
+  func changedContextDuringProbeDiscardsItsObservationAndReprobes(change: ContextChange) async {
+    let committing = FakeSettingsCommitter()
+    let probe = GatedOccupancyProbe(
+      gatedAnswer: .occupied(PortOccupancyFacts(occupier: "old process")),
+      passThroughAnswer: .free)
+    let workflow = SettingsWorkflow(committing: committing, occupancyProbe: probe)
+    let draft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(probe.entered > 0)
+
+    change.apply(to: committing)
+    probe.releaseGatedCalls()
+    await waitUntil(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy != nil)
+    #expect(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy == .free)
+    #expect(workflow.canSavePortSettings(draft))
+  }
+
+  @Test(arguments: ContextChange.allCases)
+  func changedContextRejectsCachedSaveAndRefreshesWithoutCommitting(change: ContextChange) async {
+    let committing = FakeSettingsCommitter()
+    let workflow = SettingsWorkflow(committing: committing, occupancyProbe: FakeOccupancyProbe())
+    let draft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.canSavePortSettings(draft))
+
+    change.apply(to: committing)
+    #expect(!workflow.canSavePortSettings(draft))
+    #expect(await workflow.savePortSettings(draft) == .rejected(.superseded))
+    #expect(committing.updateCalls.isEmpty)
+    await waitUntil(workflow.canSavePortSettings(draft))
+    #expect(committing.updateCalls.isEmpty)
+    #expect(await workflow.savePortSettings(draft) == .persisted)
+  }
+
+  @Test func supersededSuggestionDoesNotReplaceTheNewerEditorPreview() async {
+    let committing = FakeSettingsCommitter()
+    let probe = SuggestionProbe()
+    let workflow = SettingsWorkflow(committing: committing, occupancyProbe: probe)
+    let draft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.canSavePortSettings(draft))
+    let suggestion = Task { await workflow.suggestFreePort(for: .socks, from: draft) }
+    await waitUntil(probe.gate.entered > 0)
+
+    var edited = draft
+    edited.socksPort = 13001
+    workflow.refreshPortEditorOccupancy(for: edited)
+    await waitUntil(workflow.canSavePortSettings(edited))
+    probe.gate.releaseGatedCalls()
+    #expect(await suggestion.value == .rejected(.superseded))
+    #expect(workflow.canSavePortSettings(edited))
+    #expect(!workflow.canSavePortSettings(draft))
+  }
+
+  @Test(arguments: LANSaveChange.allCases)
+  func changedLANSaveContextOnlyRejectsListeningChanges(change: LANSaveChange)
+    async throws
+  {
+    let committing = FakeSettingsCommitter()
+    let probe = GatedOccupancyProbe(gatedAnswer: .free, passThroughAnswer: .free)
+    let workflow = SettingsWorkflow(
+      committing: committing, occupancyProbe: probe)
+    var draft = workflow.beginLANListeningEditing()
+    draft.isEnabled = true
+    let submission = Task { await workflow.saveLANListening(draft) }
+    await waitUntil(probe.entered > 0)
+    switch change {
+    case .pid: committing.runtimeListenerProcessID = 456
+    case .runtime: committing.isProxyRunning = true
+    case .localPort: committing.committedSettings.listen.httpPort = 13009
+    case .unrelatedSetting: committing.committedSettings.proxyExceptions = "example.com"
+    }
+    probe.releaseGatedCalls()
+
+    if case .unrelatedSetting = change {
+      #expect(await submission.value == .persisted)
+      #expect(!workflow.isCommitting)
+      #expect(committing.committedSettings.proxyExceptions == "example.com")
+      #expect(committing.committedSettings.listen.lan.isEnabled)
+      #expect(committing.updateCalls.count == 1)
+      return
+    }
+
+    #expect(await submission.value == .rejected(.superseded))
+    #expect(!workflow.isCommitting)
+    #expect(committing.updateCalls.isEmpty)
+    await waitUntil(workflow.canSaveLANListening(draft))
+    #expect(committing.updateCalls.isEmpty)
+  }
+
+  enum LANSaveChange: CaseIterable, Sendable {
+    case pid, runtime, localPort, unrelatedSetting
+  }
+
+  enum ContextChange: CaseIterable, Sendable {
+    case pid, runtime, otherGroupPort, otherGroupMode, otherGroupEnabled
+
+    @MainActor
+    func apply(to committing: FakeSettingsCommitter) {
+      switch self {
+      case .pid: committing.runtimeListenerProcessID = 456
+      case .runtime: committing.isProxyRunning = true
+      case .otherGroupPort: committing.committedSettings.listen.lan.httpPort = 13009
+      case .otherGroupMode: committing.committedSettings.listen.lan.mode = .allIPv6Interfaces
+      case .otherGroupEnabled: committing.committedSettings.listen.lan.isEnabled = true
+      }
+    }
+  }
+
+}
+
+private final class SuggestionProbe: PortOccupancyProbing, Sendable {
+  let gate = GatedOccupancyProbe(gatedAnswer: .free, passThroughAnswer: .free)
+
+  func occupancy(for request: PortOccupancyProbeRequest) async -> PortOccupancy {
+    request.port >= PortSuggestion.range.lowerBound ? await gate.occupancy(for: request) : .free
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/LocalizationCoverageTests.swift b/ShadowsocksX-NG2/Tests/Settings/LocalizationCoverageTests.swift
new file mode 100644
index 000000000..8d62e5a76
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/LocalizationCoverageTests.swift
@@ -0,0 +1,89 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct LocalizationCoverageTests {
+  @Test func interfaceAndErrorResourcesResolveInBothLanguages() throws {
+    let resources = AppArtifact.bundle.bundleURL.appendingPathComponent("Contents/Resources")
+    let english = try #require(Bundle(url: resources.appendingPathComponent("en.lproj")))
+    let chinese = try #require(Bundle(url: resources.appendingPathComponent("zh-Hans.lproj")))
+    #expect(
+      String(localized: "后台代理客户端", bundle: english, locale: Locale(identifier: "en"))
+        == "Background proxy client")
+    #expect(String(localized: "后台代理客户端", bundle: chinese) == "后台代理客户端")
+    #expect(
+      String(localized: "目标分组不存在", bundle: english, locale: Locale(identifier: "en"))
+        == "The destination group does not exist")
+    #expect(String(localized: "目标分组不存在", bundle: chinese) == "目标分组不存在")
+    let field = "server address"
+    let index = 3
+    #expect(
+      String(
+        localized: "订阅第 \(index) 条服务器记录的\(field)无效", bundle: english,
+        locale: Locale(identifier: "en"))
+        == "Invalid server address in subscription server record 3")
+    let singleCount = 1
+    let multipleCount = 2
+    let group = "My Group"
+    #expect(
+      String(
+        localized: "已导入 \(singleCount) 台服务器到「\(group)」", bundle: english,
+        locale: Locale(identifier: "en"))
+        == "Imported 1 server into “My Group”")
+    #expect(
+      String(
+        localized: "已导入 \(multipleCount) 台服务器到「\(group)」", bundle: english,
+        locale: Locale(identifier: "en"))
+        == "Imported 2 servers into “My Group”")
+    let socks = "1080"
+    let http = "8080"
+    #expect(
+      String(
+        localized: "SOCKS \(socks)，HTTP 代理 \(http)", bundle: english,
+        locale: Locale(identifier: "en"))
+        == "SOCKS 1080, HTTP proxy 8080")
+  }
+
+  @Test func allCatalogEntriesHaveBundledTranslations() throws {
+    let directory = TestSourceTree.ng2Root().appendingPathComponent("App/Resources")
+    let catalogs = try FileManager.default.contentsOfDirectory(
+      at: directory, includingPropertiesForKeys: nil
+    ).filter { $0.pathExtension == "xcstrings" }
+    #expect(!catalogs.isEmpty)
+    for language in ["en", "zh-Hans"] {
+      let resources = AppArtifact.bundle.bundleURL.appendingPathComponent("Contents/Resources")
+      let bundle = try #require(Bundle(url: resources.appendingPathComponent("\(language).lproj")))
+      for catalog in catalogs {
+        let document = try JSONSerialization.jsonObject(with: Data(contentsOf: catalog))
+        let object = try #require(document as? [String: Any])
+        let sourceLanguage = try #require(object["sourceLanguage"] as? String)
+        let entries = try #require(object["strings"] as? [String: [String: Any]])
+        for (key, entry) in entries {
+          let localizations = try #require(entry["localizations"] as? [String: Any])
+          #expect(
+            language == sourceLanguage || localizations[language] != nil,
+            "\(catalog.lastPathComponent): \(key), \(language)")
+          let translated = bundle.localizedString(
+            forKey: key, value: "__missing_translation__",
+            table: catalog.deletingPathExtension().lastPathComponent)
+          #expect(translated != "__missing_translation__", "\(key), \(language)")
+          #expect(!translated.isEmpty, "\(key), \(language)")
+          if language == "en" {
+            #expect(
+              translated.range(of: "\\p{Han}", options: .regularExpression) == nil,
+              "Untranslated English: \(key)")
+          }
+        }
+      }
+    }
+  }
+
+  @Test func credentialFailurePreservesExternalDetail() {
+    let detail = "OSStatus -25293: external detail 保留原文"
+    let message = AppPresentation.message(
+      for: ProxyListeningStoreError.credentialFailure(detail: detail))
+    #expect(message.hasSuffix(detail))
+    #expect(message != detail)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/ProxyControlPreferencesTests.swift b/ShadowsocksX-NG2/Tests/Settings/ProxyControlPreferencesTests.swift
new file mode 100644
index 000000000..cdd7e1e4b
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/ProxyControlPreferencesTests.swift
@@ -0,0 +1,79 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct ProxyControlPreferencesTests {
+  @Test func freshPreferencesUseFactoryIntentWithoutChangingExistingPreferences() throws {
+    let suite = "proxy-control-defaults-\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+    defaults.set(true, forKey: "silentLaunch")
+    defaults.set("http://example.com/probe", forKey: "connectivityTestURL")
+
+    let settings = ProxyRuntimeSettings(
+      listen: ProxyListeningConfiguration(),
+      preferences: ProxyControlPreferences(defaults: defaults))
+
+    #expect(settings.preferredMode == .rule)
+    #expect(settings.rulePreset == .gfwlist)
+    #expect(settings.ruleDefaultAction == .directWhenUnmatched)
+    #expect(!settings.agentEnabled)
+    #expect(!settings.systemProxyEnabled)
+    #expect(settings.proxyExceptions.isEmpty)
+    #expect(defaults.bool(forKey: "silentLaunch"))
+    #expect(defaults.string(forKey: "connectivityTestURL") == "http://example.com/probe")
+  }
+
+  @Test func rebuildingSnapshotRestoresIndependentPreferencesAndCurrentListeningConfiguration()
+    throws
+  {
+    let suite = "proxy-control-roundtrip-\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+    let preferences = ProxyControlPreferences(defaults: defaults)
+    preferences.preferredMode = .direct
+    preferences.rulePreset = .chinaProxy
+    preferences.agentEnabled = true
+    preferences.systemProxyEnabled = true
+    preferences.proxyExceptions = "example.com, localhost"
+    var listen = ProxyListeningConfiguration()
+    listen.socksPort = 23001
+    listen.httpPort = 23002
+
+    let reopened = ProxyControlPreferences(defaults: try #require(UserDefaults(suiteName: suite)))
+    let settings = ProxyRuntimeSettings(listen: listen, preferences: reopened)
+
+    #expect(settings.preferredMode == .direct)
+    #expect(settings.rulePreset == .chinaProxy)
+    #expect(settings.ruleDefaultAction == .directWhenUnmatched)
+    #expect(settings.agentEnabled)
+    #expect(settings.systemProxyEnabled)
+    #expect(settings.proxyExceptionList == ["example.com", "localhost"])
+    #expect(settings.listen.socksPort == 23001)
+    #expect(settings.listen.httpPort == 23002)
+  }
+
+  @Test(arguments: RuleDefaultAction.allCases)
+  func legacyDefaultActionIsReadUntilAnExplicitPresetIsSaved(_ action: RuleDefaultAction) throws {
+    let suite = "proxy-control-legacy-\(UUID().uuidString)"
+    let defaults = try #require(UserDefaults(suiteName: suite))
+    defer { defaults.removePersistentDomain(forName: suite) }
+    defaults.set(action.rawValue, forKey: "proxyControl.ruleDefaultAction")
+    let preferences = ProxyControlPreferences(defaults: defaults)
+    let expected: RulePreset = action == .proxyWhenUnmatched ? .chinaDirect : .gfwlist
+    #expect(preferences.rulePreset == expected)
+    #expect(defaults.object(forKey: "proxyControl.rulePreset") == nil)
+
+    for preset in RulePreset.allCases {
+      preferences.rulePreset = preset
+      let reopened = ProxyControlPreferences(defaults: defaults)
+      let settings = ProxyRuntimeSettings(
+        listen: ProxyListeningConfiguration(), preferences: reopened)
+      #expect(settings.rulePreset == preset)
+      #expect(settings.ruleDefaultAction == preset.defaultAction)
+      #expect(defaults.string(forKey: "proxyControl.ruleDefaultAction") == action.rawValue)
+    }
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/ProxyListeningFileStoreTests.swift b/ShadowsocksX-NG2/Tests/Settings/ProxyListeningFileStoreTests.swift
new file mode 100644
index 000000000..1b1d1852e
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/ProxyListeningFileStoreTests.swift
@@ -0,0 +1,90 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 监听文件持久化缝：只保存本地与局域网监听，不承载独立偏好。
+final class ProxyListeningFileStoreTests: XCTestCase {
+  private var directory: URL!
+  private var store: ProxyListeningFileStore!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-settings-tests-\(UUID().uuidString)", isDirectory: true)
+    store = makeTestListeningStore(
+      fileURL: directory.appendingPathComponent("proxy-listening.age"))
+  }
+
+  override func tearDownWithError() throws {
+    try? FileManager.default.removeItem(at: directory)
+    try super.tearDownWithError()
+  }
+
+  private func makeWriteFailingStore() throws -> ProxyListeningFileStore {
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let blockedParent = directory.appendingPathComponent("blocked")
+    try Data("not a directory".utf8).write(to: blockedParent)
+    return makeTestListeningStore(
+      fileURL: blockedParent.appendingPathComponent("proxy-listening.age"))
+  }
+
+  func testRoundTripKeepsListeningConfiguration() throws {
+    var settings = ProxyListeningConfiguration()
+    settings.listenerMode = .allIPv6Interfaces
+    settings.socksPort = 2086
+    settings.httpPort = 2087
+
+    try store.save(settings)
+
+    XCTAssertEqual(try store.load(), settings)
+  }
+
+  func testEncryptedListeningHasItsOwnFile() {
+    XCTAssertEqual(
+      ProxyListeningFileStore.defaultFileURL().lastPathComponent, "proxy-listening.age")
+  }
+
+  func testEveryListenerModeRoundTripsWithoutAnAdvertisedAddress() throws {
+    for mode in ListenerMode.allCases {
+      try store.save(ProxyListeningConfiguration(listenerMode: mode))
+
+      XCTAssertEqual(try store.load().listenerMode, mode)
+    }
+  }
+
+  func testLoadPreservesPersistedLegacyDefaultPortsWithoutImplicitMigration() throws {
+    var settings = ProxyListeningConfiguration()
+    settings.socksPort = 1086
+    settings.httpPort = 1087
+    try store.save(settings)
+
+    let loaded = try store.load()
+
+    XCTAssertEqual(loaded.socksPort, 1086)
+    XCTAssertEqual(loaded.httpPort, 1087)
+  }
+
+  func testInvalidSaveDoesNotTouchExistingSettings() throws {
+    try store.save(ProxyListeningConfiguration())
+    var invalid = ProxyListeningConfiguration()
+    invalid.socksPort = 0
+
+    XCTAssertThrowsError(try store.save(invalid)) { error in
+      XCTAssertEqual(
+        error as? ProxyListeningStoreError,
+        .invalid([.portOutOfRange(endpoint: .socks, port: 0)]))
+    }
+    XCTAssertEqual(try store.load(), ProxyListeningConfiguration())
+  }
+
+  func testSaveFailureIsTypedIOFailure() throws {
+    store = try makeWriteFailingStore()
+
+    XCTAssertThrowsError(try store.save(ProxyListeningConfiguration())) { error in
+      guard case .ioFailure = error as? ProxyListeningStoreError else {
+        return XCTFail("文件写入失败应保留为 typed io failure，实际为 \(error)")
+      }
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/ProxyListeningStartupTests.swift b/ShadowsocksX-NG2/Tests/Settings/ProxyListeningStartupTests.swift
new file mode 100644
index 000000000..9cb79c82b
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/ProxyListeningStartupTests.swift
@@ -0,0 +1,52 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ProxyListeningStartupTests {
+  @Test func unsupportedListeningFileBlocksStartupUntilResetIsConfirmed() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    let oldURL = directory.appendingPathComponent("proxy-listening.json")
+    let old = Data("old-listening-configuration".utf8)
+    try old.write(to: oldURL)
+    let keys = TestLibraryKeys()
+    let store = ProxyListeningFileStore(
+      fileURL: directory.appendingPathComponent("proxy-listening.age"), keys: keys)
+    var prompts = 0
+    let configuration = ProxyListeningStartup.load(store: store) { error in
+      prompts += 1
+      #expect(error == .encryptedFile(.unsupportedVersion))
+      #expect(keys.values.isEmpty)
+      #expect(!FileManager.default.fileExists(atPath: store.fileURL.path))
+    }
+    #expect(prompts == 1)
+    #expect(configuration == ProxyListeningConfiguration())
+    #expect(!configuration.lan.isEnabled)
+    #expect(try store.load() == configuration)
+    #expect(try Data(contentsOf: oldURL) == old)
+  }
+  @Test func failedResetKeepsOriginalFileAndRequestsConfirmationAgain() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let keys = TestLibraryKeys()
+    let file = directory.appendingPathComponent("proxy-listening.age")
+    let store = ProxyListeningFileStore(fileURL: file, keys: keys)
+    _ = try store.load()
+    let original = try Data(contentsOf: file)
+    keys.values.removeAll()
+    keys.createFails = true
+    var prompts = 0
+    let restarted = ProxyListeningFileStore(fileURL: file, keys: keys)
+    let configuration = ProxyListeningStartup.load(store: restarted) { _ in
+      prompts += 1
+      #expect((try? Data(contentsOf: file)) == original)
+      if prompts >= 2 { keys.createFails = false }
+    }
+    #expect(prompts == 2)
+    #expect(configuration == ProxyListeningConfiguration())
+    #expect(try ProxyListeningFileStore(fileURL: file, keys: keys).load() == configuration)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/ProxyListeningStoreRecoveryTests.swift b/ShadowsocksX-NG2/Tests/Settings/ProxyListeningStoreRecoveryTests.swift
new file mode 100644
index 000000000..37e9deb08
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/ProxyListeningStoreRecoveryTests.swift
@@ -0,0 +1,78 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct ProxyListeningStoreRecoveryTests {
+  @Test func completeListeningIdentitySurvivesRestartWithoutPlaintextOnDisk() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let file = directory.appendingPathComponent("proxy-listening.age")
+    let keys = TestLibraryKeys()
+    let store = ProxyListeningFileStore(fileURL: file, keys: keys)
+    var configuration = try store.load()
+    configuration.lan.username = "PRIVATE-LAN-USERNAME"
+    configuration.lan.password = "PRIVATE-LAN-PASSWORD"
+    try store.save(configuration)
+    let data = try Data(contentsOf: file)
+    for secret in ["PRIVATE-LAN-USERNAME", "PRIVATE-LAN-PASSWORD"] {
+      #expect(data.range(of: Data(secret.utf8)) == nil)
+    }
+    #expect(try ProxyListeningFileStore(fileURL: file, keys: keys).load() == configuration)
+  }
+
+  @Test func unavailableKeyBlocksOrdinarySaveAndResetCreatesIndependentDefaults() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let keys = TestLibraryKeys()
+    let file = directory.appendingPathComponent("proxy-listening.age")
+    let store = ProxyListeningFileStore(fileURL: file, keys: keys)
+    var configuration = try store.load()
+    configuration.lan.isEnabled = true
+    configuration.lan.authenticationEnabled = true
+    configuration.lan.password = "secret"
+    try store.save(configuration)
+    let original = try Data(contentsOf: file)
+    keys.values.removeAll()
+    let restarted = ProxyListeningFileStore(fileURL: file, keys: keys)
+    #expect(throws: ProxyListeningStoreError.encryptedFile(.keyUnavailable)) {
+      try restarted.load()
+    }
+    #expect(throws: ProxyListeningStoreError.encryptedFile(.keyUnavailable)) {
+      try restarted.save(ProxyListeningConfiguration())
+    }
+    #expect(try Data(contentsOf: file) == original)
+    keys.createFails = true
+    #expect(throws: (any Error).self) { try restarted.reset() }
+    #expect(try Data(contentsOf: file) == original)
+    keys.createFails = false
+    #expect(try restarted.reset() == ProxyListeningConfiguration())
+    #expect(
+      try ProxyListeningFileStore(fileURL: file, keys: keys).load() == ProxyListeningConfiguration()
+    )
+  }
+
+  @Test func resettingOneStoreDoesNotInvalidateTheOtherStore() throws {
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let keys = TestLibraryKeys()
+    let library = CatalogFileStore(
+      fileURL: directory.appendingPathComponent("catalog.age"),
+      library: ServerLibraryStorage(keys: keys))
+    let store = ProxyListeningFileStore(
+      fileURL: directory.appendingPathComponent("proxy-listening.age"), keys: keys)
+    _ = try library.load()
+    var configuration = try store.load()
+    configuration.local.socksPort = 12000
+    configuration.lan.password = "retained-password"
+    try store.save(configuration)
+    _ = try library.reset()
+    #expect(try ProxyListeningFileStore(fileURL: store.fileURL, keys: keys).load() == configuration)
+    let libraryBytes = try Data(contentsOf: library.fileURL)
+    _ = try store.reset()
+    #expect(try Data(contentsOf: library.fileURL) == libraryBytes)
+    #expect(
+      try CatalogFileStore(fileURL: library.fileURL, library: ServerLibraryStorage(keys: keys))
+        .load().catalog.isEmpty)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/ProxyRuntimeSettingsTests.swift b/ShadowsocksX-NG2/Tests/Settings/ProxyRuntimeSettingsTests.swift
new file mode 100644
index 000000000..d3923611c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/ProxyRuntimeSettingsTests.swift
@@ -0,0 +1,36 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 设置主缝：偏好校验与绕过列表解析只通过公开领域入口断言，不依赖
+/// SwiftUI 视图实现。
+final class ProxyRuntimeSettingsTests: XCTestCase {
+  func testFactoryDefaultsAvoidLegacyPortsAndValidate() {
+    let settings = ProxyRuntimeSettings()
+
+    XCTAssertEqual(settings.listen.socksPort, 11086)
+    XCTAssertEqual(settings.listen.httpPort, 11087)
+    XCTAssertFalse(settings.agentEnabled, "全新用户无服务器配置，Agent 默认 off")
+    XCTAssertFalse(settings.systemProxyEnabled)
+    XCTAssertTrue(settings.validationErrors.isEmpty)
+  }
+
+  func testProxyExceptionsSplitCommaChineseCommaAndWhitespaceWithoutDuplicates() {
+    var settings = ProxyRuntimeSettings()
+    settings.proxyExceptions = "localhost, 127.0.0.1、localhost\n::1"
+
+    XCTAssertEqual(settings.proxyExceptionList, ["localhost", "127.0.0.1", "::1"])
+  }
+
+  func testListenerModeDoesNotAddAddressTextValidation() {
+    var settings = ProxyRuntimeSettings()
+    settings.listen.listenerMode = .allIPv6Interfaces
+    settings.listen.socksPort = settings.listen.httpPort
+
+    XCTAssertEqual(
+      settings.validationErrors,
+      [
+        .duplicatePort(endpoint: .socks, otherEndpoint: .http, port: 11087)
+      ])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/SettingsWorkflowInterfaceTests+CommitFailures.swift b/ShadowsocksX-NG2/Tests/Settings/SettingsWorkflowInterfaceTests+CommitFailures.swift
new file mode 100644
index 000000000..8002bbd60
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/SettingsWorkflowInterfaceTests+CommitFailures.swift
@@ -0,0 +1,25 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+extension SettingsWorkflowInterfaceTests {
+  func testPortSettingsPersistenceFailurePreservesCommittedSnapshot() async {
+    let original = committedSettingsForItemSaveTests()
+    committing.committedSettings = original
+    committing.updateError = ProxyListeningStoreError.ioFailure(detail: "disk full")
+    let workflow = makeWorkflow()
+    let edited = SettingsPortDraft(socksPort: 12_096, httpPort: 12_097)
+    workflow.refreshPortEditorOccupancy(for: edited)
+    await waitUntil(workflow.canSavePortSettings(edited))
+
+    let outcome = await workflow.savePortSettings(edited)
+
+    XCTAssertEqual(
+      outcome, .commitFailed(.store(.ioFailure(detail: "disk full"))))
+    XCTAssertEqual(workflow.lastFailure, .store(.ioFailure(detail: "disk full")))
+    XCTAssertTrue(workflow.lastFailure?.presentableMessage.contains("偏好文件") == true)
+    XCTAssertEqual(committing.committedSettings, original)
+    XCTAssertFalse(workflow.isCommitting)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/SettingsWorkflowInterfaceTests.swift b/ShadowsocksX-NG2/Tests/Settings/SettingsWorkflowInterfaceTests.swift
new file mode 100644
index 000000000..e88c4b2e7
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/SettingsWorkflowInterfaceTests.swift
@@ -0,0 +1,256 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 设置项编辑器的 UI-facing interface 测试；写入缝与占用探测均注入替身，
+/// 不触碰真实偏好文件、钥匙串与系统端口。
+@MainActor
+final class SettingsWorkflowInterfaceTests: XCTestCase {
+  var committing: FakeSettingsCommitter!
+  var probe: FakeOccupancyProbe!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    committing = FakeSettingsCommitter()
+    probe = FakeOccupancyProbe()
+  }
+
+  func makeWorkflow() -> SettingsWorkflow {
+    SettingsWorkflow(
+      committing: committing, occupancyProbe: probe)
+  }
+
+  func testPortEditorMapsValidationIssuesToTheAffectedFields() {
+    let workflow = makeWorkflow()
+    let invalid = SettingsPortDraft(socksPort: 0, httpPort: 11_087)
+
+    XCTAssertEqual(
+      workflow.portFieldState(for: .socks, editorDraft: invalid).issues,
+      [.port(.socks, error: .portOutOfRange(endpoint: .socks, port: 0))])
+    XCTAssertTrue(workflow.portFieldState(for: .http, editorDraft: invalid).issues.isEmpty)
+
+    let duplicate = SettingsPortDraft(socksPort: 11_086, httpPort: 11_086)
+    let duplicateIssue = SettingsFieldIssue.port(
+      .socks, error: .duplicatePort(endpoint: .socks, otherEndpoint: .http, port: 11_086))
+    XCTAssertEqual(
+      workflow.portFieldState(for: .socks, editorDraft: duplicate).issues,
+      [
+        duplicateIssue
+      ])
+    XCTAssertEqual(
+      workflow.portFieldState(for: .http, editorDraft: duplicate).issues,
+      [.port(.http, error: .duplicatePort(endpoint: .socks, otherEndpoint: .http, port: 11_086))])
+  }
+
+  func testPortEditorReportsFreeOccupiedAndUnknownFacts() async {
+    probe = FakeOccupancyProbe(occupiedPorts: [11_087])
+    let workflow = makeWorkflow()
+    let draft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy != nil)
+
+    XCTAssertEqual(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy, .free)
+    XCTAssertEqual(
+      workflow.portFieldState(for: .http, editorDraft: draft).occupancy,
+      .occupied(occupier: "other-app"))
+
+    probe = FakeOccupancyProbe(unknownPorts: [11_086])
+    let unknownWorkflow = makeWorkflow()
+    let unknownDraft = unknownWorkflow.beginPortSettingsEditing()
+    unknownWorkflow.refreshPortEditorOccupancy(for: unknownDraft)
+    await waitUntil(
+      unknownWorkflow.portFieldState(for: .socks, editorDraft: unknownDraft).occupancy != nil)
+    XCTAssertEqual(
+      unknownWorkflow.portFieldState(for: .socks, editorDraft: unknownDraft).occupancy,
+      .unknown(detail: "无法判定"))
+  }
+
+  func testPortEditorProbeUsesTheCompleteCommittedListenIdentity() async {
+    committing.committedSettings.listen.listenerMode = .allIPv4Interfaces
+    let workflow = makeWorkflow()
+    let draft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: draft)
+    let expected = RuntimeListenFacts(listen: committing.committedSettings.listen)
+
+    await waitUntil(probe.requests.contains { $0.listen == expected })
+
+    XCTAssertEqual(probe.requests.first(where: { $0.listen == expected })?.endpoint, .socks)
+    XCTAssertEqual(probe.requests.first(where: { $0.listen == expected })?.bindAddress, "127.0.0.1")
+  }
+
+  func testRuntimePortExceptionRequiresVerifiedOwnership() async {
+    probe = FakeOccupancyProbe(occupiedPorts: [11_086], occupierProcessIDs: [123])
+    committing.isProxyRunning = true
+    committing.runtimeListenerProcessID = 123
+    let workflow = makeWorkflow()
+    let draft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy != nil)
+
+    XCTAssertTrue(workflow.portFieldState(for: .socks, editorDraft: draft).isRuntimePortException)
+    XCTAssertFalse(workflow.portFieldState(for: .socks, editorDraft: draft).canSuggestFreePort)
+    XCTAssertTrue(workflow.canSavePortSettings(draft))
+
+    committing.runtimeListenerProcessID = 456
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy != nil)
+
+    XCTAssertFalse(workflow.portFieldState(for: .socks, editorDraft: draft).isRuntimePortException)
+    XCTAssertFalse(workflow.canSavePortSettings(draft))
+  }
+
+  func testChangedPortWithKnownExternalOccupancyBlocksPortSave() async {
+    probe = FakeOccupancyProbe(occupiedPorts: [12_086])
+    let workflow = makeWorkflow()
+    let draft = SettingsPortDraft(socksPort: 12_086, httpPort: 12_087)
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy != nil)
+
+    XCTAssertTrue(workflow.portFieldState(for: .socks, editorDraft: draft).canSuggestFreePort)
+    XCTAssertFalse(workflow.canSavePortSettings(draft))
+    let outcome = await workflow.savePortSettings(draft)
+    XCTAssertEqual(outcome, .rejected(.occupied([.socks])))
+    XCTAssertTrue(committing.updateCalls.isEmpty)
+  }
+
+  func testUnknownPortOccupancyAllowsPortSave() async {
+    probe = FakeOccupancyProbe(unknownPorts: [12_086])
+    let workflow = makeWorkflow()
+    let draft = SettingsPortDraft(socksPort: 12_086, httpPort: 12_087)
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy != nil)
+
+    XCTAssertTrue(workflow.canSavePortSettings(draft))
+    let outcome = await workflow.savePortSettings(draft)
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertEqual(committing.committedSettings.listen.socksPort, 12_086)
+  }
+
+  func testPortSuggestionReturnsACandidateWithoutSavingIt() async {
+    probe = FakeOccupancyProbe(occupiedPorts: [12_086])
+    let workflow = makeWorkflow()
+    let draft = SettingsPortDraft(socksPort: 12_086, httpPort: 12_087)
+    workflow.refreshPortEditorOccupancy(for: draft)
+    await waitUntil(workflow.portFieldState(for: .socks, editorDraft: draft).occupancy != nil)
+
+    let outcome = await workflow.suggestFreePort(for: .socks, from: draft)
+
+    XCTAssertEqual(outcome, .suggestedPort(port: .socks, value: 32_768))
+    XCTAssertTrue(committing.updateCalls.isEmpty)
+    XCTAssertEqual(committing.committedSettings.listen.socksPort, 11_086)
+  }
+
+  func testPortSettingsSaveChangesOnlyTheCommittedPorts() async {
+    let original = committedSettingsForItemSaveTests()
+    committing.committedSettings = original
+    let workflow = makeWorkflow()
+    let edited = SettingsPortDraft(socksPort: 12_096, httpPort: 12_097)
+    workflow.refreshPortEditorOccupancy(for: edited)
+    await waitUntil(workflow.canSavePortSettings(edited))
+
+    let outcome = await workflow.savePortSettings(edited)
+
+    var expected = original
+    expected.listen.socksPort = edited.socksPort
+    expected.listen.httpPort = edited.httpPort
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertEqual(committing.updateCalls, [expected])
+    XCTAssertEqual(committing.committedSettings, expected)
+  }
+
+  /// store 是唯一强制点：探测门禁通过后，非法端口由 store 拒绝并映射回字段 issue，
+  /// 不写入、不留提交锁。探测未完成时保存命令按占用门禁拒绝，不触达 store。
+  func testPortSaveRejectsInvalidPortsWithoutWriting() async {
+    let workflow = makeWorkflow()
+    let invalid = SettingsPortDraft(socksPort: 0, httpPort: 11_087)
+    workflow.refreshPortEditorOccupancy(for: invalid)
+    await waitUntil(workflow.portFieldState(for: .socks, editorDraft: invalid).occupancy != nil)
+
+    let outcome = await workflow.savePortSettings(invalid)
+    XCTAssertEqual(
+      outcome,
+      .rejected(
+        .validation([
+          .port(.socks, error: .portOutOfRange(endpoint: .socks, port: 0))
+        ])))
+    XCTAssertFalse(workflow.isCommitting)
+    XCTAssertTrue(committing.updateCalls.isEmpty)
+  }
+
+  func testProxyExceptionsSaveChangesOnlyTheCommittedExceptions() async {
+    let original = committedSettingsForItemSaveTests()
+    committing.committedSettings = original
+    let workflow = makeWorkflow()
+    let edited = "localhost\nexample.com"
+
+    let outcome = await workflow.saveProxyExceptions(edited)
+
+    var expected = original
+    expected.proxyExceptions = edited
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertEqual(committing.updateCalls, [expected])
+    XCTAssertEqual(committing.committedSettings, expected)
+    XCTAssertNil(workflow.lastFailure)
+    XCTAssertFalse(workflow.isCommitting)
+  }
+
+  func testItemSavesSerializeWhilePersistenceIsInProgress() async {
+    committing.updateGate = AsyncGate()
+    let workflow = makeWorkflow()
+    let first = Task { await workflow.saveProxyExceptions("localhost") }
+    await waitUntil(workflow.isCommitting)
+
+    let second = await workflow.savePortSettings(
+      SettingsPortDraft(socksPort: 11_086, httpPort: 11_087))
+    committing.updateGate?.release()
+    let firstOutcome = await first.value
+
+    XCTAssertEqual(second, .rejected(.inProgress))
+    XCTAssertEqual(firstOutcome, .persisted)
+    XCTAssertEqual(committing.updateCalls.count, 1)
+  }
+
+  func testEqualProxyExceptionsDoNotWrite() async {
+    let workflow = makeWorkflow()
+    committing.committedSettings.proxyExceptions = "localhost"
+
+    let outcome = await workflow.saveProxyExceptions("localhost")
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertTrue(committing.updateCalls.isEmpty)
+  }
+
+  func testStalePortOccupancyCannotOverrideTheNewerEditorDraft() async {
+    let gated = GatedOccupancyProbe(
+      gatedAnswer: .occupied(
+        PortOccupancyFacts(
+          occupier: "stale", occupiedFamilies: [.ipv4], verifiedFamilies: [.ipv4])),
+      passThroughAnswer: .free)
+    let workflow = SettingsWorkflow(committing: committing, occupancyProbe: gated)
+    let firstDraft = workflow.beginPortSettingsEditing()
+    workflow.refreshPortEditorOccupancy(for: firstDraft)
+    await waitUntil(gated.entered > 0)
+
+    let laterDraft = SettingsPortDraft(socksPort: 30_086, httpPort: 11_087)
+    gated.passThrough(.free)
+    workflow.refreshPortEditorOccupancy(for: laterDraft)
+    await waitUntil(
+      workflow.portFieldState(for: .socks, editorDraft: laterDraft).occupancy == .free)
+
+    gated.releaseGatedCalls()
+    try? await Task.sleep(nanoseconds: 50_000_000)
+    XCTAssertEqual(
+      workflow.portFieldState(for: .socks, editorDraft: laterDraft).occupancy, .free)
+  }
+
+  func committedSettingsForItemSaveTests() -> ProxyRuntimeSettings {
+    var settings = ProxyRuntimeSettings()
+    settings.listen.listenerMode = .allIPv6Interfaces
+    settings.listen.socksPort = 12_086
+    settings.listen.httpPort = 12_087
+    settings.proxyExceptions = "existing.example"
+    settings.preferredMode = .global
+    settings.agentEnabled = true
+    settings.systemProxyEnabled = true
+    return settings
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/SettingsWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Settings/SettingsWorkflowTests.swift
new file mode 100644
index 000000000..9965ff062
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/SettingsWorkflowTests.swift
@@ -0,0 +1,89 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// SettingsWorkflow 与真实 ProxyRuntimeController 的监听设置提交集成。
+@MainActor
+final class SettingsWorkflowTests: XCTestCase {
+  private var runtime: ProxyRuntimeFixture.TemporaryRuntime!
+  private var catalogFileURL: URL!
+  private var activationFileURL: URL!
+  private var agent: ProxyRuntimeFixture.FakeLaunchAgent!
+  private var systemProxy: ProxyRuntimeFixture.FakeSystemProxy!
+  private var listeningStore: InMemorySettingsStore!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    catalogFileURL = runtime.directory.appendingPathComponent("catalog.json")
+    activationFileURL = runtime.directory.appendingPathComponent("activation.json")
+
+    agent = ProxyRuntimeFixture.FakeLaunchAgent()
+    systemProxy = ProxyRuntimeFixture.FakeSystemProxy()
+    listeningStore = InMemorySettingsStore()
+  }
+
+  override func tearDown() async throws {
+    try? FileManager.default.removeItem(at: runtime.directory)
+    try await super.tearDown()
+  }
+
+  func testListenerModeSavePersistsWithoutStartingAnOffAgent() async throws {
+    let pair = makePair()
+
+    var draft = pair.workflow.beginLANListeningEditing()
+    draft.isEnabled = true
+    draft.mode = .allIPv4AndIPv6Interfaces
+    let outcome = await pair.workflow.saveLANListening(draft)
+
+    XCTAssertEqual(outcome, .persisted)
+    XCTAssertEqual(pair.controller.settings.listen.listenerMode, .allIPv4AndIPv6Interfaces)
+    XCTAssertEqual(listeningStore.saved?.listenerMode, .allIPv4AndIPv6Interfaces)
+    XCTAssertEqual(pair.controller.state, .off)
+    XCTAssertEqual(agent.registerCount, 0)
+  }
+
+  private func makePair() -> (controller: ProxyRuntimeController, workflow: SettingsWorkflow) {
+    let catalogSnapshotReader = CatalogCommitCoordinator.bootstrap(
+      fileStore: makeTestCatalogStore(fileURL: catalogFileURL)
+    ).catalogSnapshotReader
+    let runtimeFileStore = RuntimeFileStore(fileURL: runtime.contract)
+    agent.onRegister = { [runtimeFileStore] in
+      try? runtimeFileStore.writePublishedRuntimeReceipt(processID: 42)
+    }
+    let controller = ProxyRuntimeController(
+      controlPreferences: makeTestProxyControlPreferences(),
+      catalogSnapshotReader: catalogSnapshotReader,
+      activationFileStore: ActivationStateFileStore(fileURL: activationFileURL),
+      runtimeFileStore: runtimeFileStore,
+      plugins: ActivationFixture.plugins,
+      listeningStore: listeningStore,
+      appBundle: AppArtifact.bundle,
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(listen: ActivationFixture.listen), unreadableError: nil),
+      agent: agent,
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      systemProxy: systemProxy,
+      systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService(),
+      firewallExecutableURLs: [URL(fileURLWithPath: "/bundle/Helpers/sslocal")],
+      firewallPollIntervalNanoseconds: 1_000_000,
+      launchHealthTimeoutSeconds: 0.05,
+      sendSignal: { _, _ in 0 },
+      processIsAlive: { $0 == 42 })
+    let workflow = SettingsWorkflow(
+      committing: controller, occupancyProbe: FakeOccupancyProbe())
+    return (controller, workflow)
+  }
+
+  final class InMemorySettingsStore: ProxyListeningStoring {
+    var saved: ProxyListeningConfiguration?
+
+    func load() throws -> ProxyListeningConfiguration {
+      saved ?? ProxyListeningConfiguration()
+    }
+
+    func save(_ settings: ProxyListeningConfiguration) throws {
+      saved = settings
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/SilentLaunchControllerTests.swift b/ShadowsocksX-NG2/Tests/Settings/SilentLaunchControllerTests.swift
new file mode 100644
index 000000000..bc41cd047
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/SilentLaunchControllerTests.swift
@@ -0,0 +1,52 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 静默启动控制器（ADR 0017）：初始值来自持久化；翻转先落盘后翻内存。
+/// UserDefaults 无失败信号，文件版的「失败保原值并点名」路径不再存在。
+@MainActor
+final class SilentLaunchControllerTests: XCTestCase {
+  private var suiteName: String!
+  private var defaults: UserDefaults!
+  private var store: SilentLaunchStore!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    suiteName = "silent-launch-controller-tests-\(UUID().uuidString)"
+    defaults = UserDefaults(suiteName: suiteName)!
+    defaults.removePersistentDomain(forName: suiteName)
+    store = SilentLaunchStore(defaults: defaults)
+  }
+
+  override func tearDown() async throws {
+    defaults.removePersistentDomain(forName: suiteName)
+    try await super.tearDown()
+  }
+
+  func testInitialValueComesFromStore() {
+    XCTAssertFalse(
+      SilentLaunchController(store: store).isEnabled, "无持久化记录按出厂默认：不静默")
+
+    store.save(silentLaunchEnabled: true)
+    XCTAssertTrue(SilentLaunchController(store: store).isEnabled)
+  }
+
+  func testEnablePersistsBeforeFlippingPublishedState() {
+    let controller = SilentLaunchController(store: store)
+
+    controller.setEnabled(true)
+
+    XCTAssertTrue(controller.isEnabled)
+    XCTAssertTrue(store.loadSilentLaunchEnabled())
+  }
+
+  func testDisablePersists() {
+    store.save(silentLaunchEnabled: true)
+    let controller = SilentLaunchController(store: store)
+
+    controller.setEnabled(false)
+
+    XCTAssertFalse(controller.isEnabled)
+    XCTAssertFalse(store.loadSilentLaunchEnabled())
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/SilentLaunchStoreTests.swift b/ShadowsocksX-NG2/Tests/Settings/SilentLaunchStoreTests.swift
new file mode 100644
index 000000000..ea24f5323
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/SilentLaunchStoreTests.swift
@@ -0,0 +1,49 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 静默启动偏好持久化（ADR 0017，UserDefaults 形态）：往返无损；键缺失与
+/// 外部错误类型按安全侧恢复「不静默」。
+/// 套件实例 + teardown 移除持久域，不触碰生产 defaults（测试封闭性公约）。
+final class SilentLaunchStoreTests: XCTestCase {
+  private var suiteName: String!
+  private var defaults: UserDefaults!
+  private var store: SilentLaunchStore!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    suiteName = "silent-launch-store-tests-\(UUID().uuidString)"
+    defaults = UserDefaults(suiteName: suiteName)!
+    defaults.removePersistentDomain(forName: suiteName)
+    store = SilentLaunchStore(defaults: defaults)
+  }
+
+  override func tearDownWithError() throws {
+    defaults.removePersistentDomain(forName: suiteName)
+    try super.tearDownWithError()
+  }
+
+  // MARK: 缺失与错误类型
+
+  func testMissingKeyLoadsAsNotSilent() {
+    XCTAssertFalse(store.loadSilentLaunchEnabled(), "键缺失按出厂默认：不静默")
+  }
+
+  func testForeignTypeLoadsAsNotSilentOnTheSafeSide() {
+    // cfprefs 无「损坏」可观测性：外部写入的错误类型按安全侧回落默认。
+    defaults.set("yes", forKey: "silentLaunch")
+
+    XCTAssertFalse(store.loadSilentLaunchEnabled())
+  }
+
+  // MARK: 往返无损
+
+  func testSaveAndLoadRoundTripBothValues() {
+    store.save(silentLaunchEnabled: true)
+    XCTAssertTrue(store.loadSilentLaunchEnabled())
+
+    store.save(silentLaunchEnabled: false)
+    XCTAssertFalse(store.loadSilentLaunchEnabled())
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Settings/UnreadableSettingsTests.swift b/ShadowsocksX-NG2/Tests/Settings/UnreadableSettingsTests.swift
new file mode 100644
index 000000000..5810492e4
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Settings/UnreadableSettingsTests.swift
@@ -0,0 +1,109 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 偏好设置不可读时的控制器行为（「任何路径不静默改端口」）：
+/// 占位出厂端口不得部署，已有后台代理与系统代理保持原状。
+@MainActor
+struct UnreadableSettingsTests {
+  private struct Fixture {
+    let runtime: ProxyRuntimeFixture.TemporaryRuntime
+    let controller: ProxyRuntimeController
+    let agent: ProxyRuntimeFixture.FakeLaunchAgent
+    let systemProxy: ProxyRuntimeFixture.FakeSystemProxy
+    let serverID: NodeID
+  }
+
+  private func makeFixture(
+    agentStatus: LaunchAgentStatus,
+    settingsRestore: RestoredProxyRuntimeSettings
+  ) throws -> Fixture {
+    let runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
+    let catalogFileURL = runtime.directory.appendingPathComponent("catalog.json")
+    let activationFileURL = runtime.directory.appendingPathComponent("activation.json")
+    let agent = ProxyRuntimeFixture.FakeLaunchAgent()
+    let systemProxy = ProxyRuntimeFixture.FakeSystemProxy()
+    agent.setStatus(agentStatus)
+
+    var catalog = ConfigurationCatalog()
+    let server = try ActivationFixture.addPlainServer(
+      "香港 01", in: &catalog)
+    try makeTestCatalogStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
+
+    let catalogSnapshotReader = CatalogCommitCoordinator.bootstrap(
+      fileStore: makeTestCatalogStore(fileURL: catalogFileURL)
+    ).catalogSnapshotReader
+    let controller = ProxyRuntimeController(
+      controlPreferences: makeTestProxyControlPreferences(),
+      catalogSnapshotReader: catalogSnapshotReader,
+      activationFileStore: ActivationStateFileStore(fileURL: activationFileURL),
+      runtimeFileStore: RuntimeFileStore(fileURL: runtime.contract),
+      plugins: ActivationFixture.plugins,
+      appBundle: AppArtifact.bundle,
+      settingsRestore: settingsRestore,
+      agent: agent,
+      probe: ProxyRuntimeFixture.FakeProbe.reachable(),
+      systemProxy: systemProxy,
+      systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService(),
+      launchHealthTimeoutSeconds: 0.05,
+      sendSignal: { _, _ in 0 })
+    return Fixture(
+      runtime: runtime, controller: controller, agent: agent,
+      systemProxy: systemProxy, serverID: server)
+  }
+
+  @Test
+  func enableWithUnreadableSettingsRefusesDeploymentAndNamesReason() async throws {
+    let fixture = try makeFixture(
+      agentStatus: .notRegistered,
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(),
+        unreadableError: .invalid([
+          .duplicatePort(endpoint: .socks, otherEndpoint: .http, port: 1086)
+        ])))
+    defer { try? FileManager.default.removeItem(at: fixture.runtime.directory) }
+
+    try await fixture.controller.activate(fixture.serverID)
+    await fixture.controller.setAgentEnabled(true)
+
+    guard case .launchFailed(.unreadableSettings) = fixture.controller.state else {
+      Issue.record("应呈现启动失败，实际 \(fixture.controller.state)")
+      return
+    }
+    #expect(
+      AppPresentation.message(for: RuntimeFailureFacts.launch(.unreadableSettings))
+        .contains("配置无法读取"))
+    #expect(fixture.agent.registerCount == 0, "占位出厂端口不得部署")
+    #expect(!FileManager.default.fileExists(atPath: fixture.runtime.contract.path))
+    #expect(fixture.systemProxy.applied.isEmpty, "占位端口不得写系统代理")
+  }
+
+  @Test
+  func resyncWithUnreadableSettingsPreservesRunningAgentAndContract() async throws {
+    let fixture = try makeFixture(
+      agentStatus: .registered,
+      settingsRestore: RestoredProxyRuntimeSettings(
+        settings: ProxyRuntimeSettings(agentEnabled: true),
+        unreadableError: .corrupt(detail: "test")))
+    defer { try? FileManager.default.removeItem(at: fixture.runtime.directory) }
+
+    try ActivationStateFileStore(
+      fileURL: fixture.runtime.directory.appendingPathComponent("activation.json")
+    ).save(activeTargetID: fixture.serverID)
+    try RuntimeFileStore(fileURL: fixture.runtime.contract)
+      .write(ProxyRuntimeFixture.makeDocument())
+
+    await fixture.controller.resyncOnLaunch()
+
+    guard case .launchFailed(.unreadableSettings) = fixture.controller.state else {
+      Issue.record("应呈现启动失败，实际 \(fixture.controller.state)")
+      return
+    }
+    #expect(
+      fixture.agent.unregisterCount == 0, "读取失败不得停止已有后台代理")
+    #expect(RuntimeFileStore(fileURL: fixture.runtime.contract).loadDocument() != nil)
+    #expect(fixture.systemProxy.applied.isEmpty)
+    #expect(fixture.controller.effectiveRuntimeListenFacts == nil)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/AgentLifecycleTests+ChangeProtocol.swift b/ShadowsocksX-NG2/Tests/Smoke/AgentLifecycleTests+ChangeProtocol.swift
new file mode 100644
index 000000000..bfaf388de
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/AgentLifecycleTests+ChangeProtocol.swift
@@ -0,0 +1,220 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class AgentLifecycleChangeProtocolTests: AgentLifecycleTests {
+  // MARK: 变更协议
+
+  func testSIGUSR1WithServerOnlyChangeIsForwardedToSslocal() throws {
+    try writeContract(ProxyRuntimeFixture.makeDocument(serverAddress: "203.0.113.7"))
+    let wrapper = try launchWrapper(behavior: "run")
+    XCTAssertTrue(
+      try waitUntil { self.stateLog().contains("invoked:") }, "等待首次拉起")
+
+    try writeContract(ProxyRuntimeFixture.makeDocument(serverAddress: "198.51.100.9"))
+    kill(wrapper.processIdentifier, SIGUSR1)
+
+    XCTAssertTrue(
+      try waitUntil { self.stateLog().contains("SIGUSR1") },
+      "仅服务器列表变化应转发 SIGUSR1 热重载（上游只替换配置来源服务器）")
+    XCTAssertTrue(pidAlive(wrapper.processIdentifier), "热重载不重启 wrapper")
+    XCTAssertFalse(stateLog().contains("SIGTERM"), "热重载不触发子进程重启")
+
+    kill(wrapper.processIdentifier, SIGTERM)
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+  }
+
+  func testSIGUSR1WithListenChangePerformsGracefulRestart() throws {
+    try writeContract(ProxyRuntimeFixture.makeDocument(localPort: 1086))
+    let wrapper = try launchWrapper(behavior: "run")
+    XCTAssertTrue(
+      try waitUntil { self.stateLog().contains("invoked:") }, "等待首次拉起")
+
+    try writeContract(ProxyRuntimeFixture.makeDocument(localPort: 2086))
+    kill(wrapper.processIdentifier, SIGUSR1)
+
+    XCTAssertTrue(
+      try waitUntil {
+        self.stateLog().contains("SIGTERM")
+          && self.stateLog().components(separatedBy: "invoked:").count >= 3
+      },
+      "监听结构变化走优雅重启：先 SIGTERM 旧实例再以新契约拉起，实际：\(stateLog())")
+    XCTAssertTrue(pidAlive(wrapper.processIdentifier), "重启后 wrapper 常驻")
+
+    XCTAssertFalse(stateLog().contains("OVERLAPPING CHILD"), "新实例启动时旧实例必须已退出")
+    // 重启后的实例也要能被显式停止。
+    kill(wrapper.processIdentifier, SIGTERM)
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+    XCTAssertEqual(
+      stateLog().components(separatedBy: "SIGTERM").count - 1, 2,
+      "两次停止各转发一次 SIGTERM")
+  }
+
+  func testACLReloadIsDeferredWithoutRestartUntilListenersAreReady() throws {
+    let runtimeStore = RuntimeFileStore(fileURL: contractURL)
+    let previous = ProxyRuntimeFixture.makeDocument()
+      .replacingACL(.global(at: runtimeStore.aclFileURL))
+    try writeContract(previous)
+    let wrapper = try launchWrapper(behavior: "run")
+    XCTAssertTrue(try waitUntil { self.stateLog().contains("invoked:") })
+
+    let next = previous.replacingACL(.direct(at: runtimeStore.aclFileURL))
+    try writeContract(next)
+    XCTAssertEqual(kill(wrapper.processIdentifier, SIGUSR1), 0)
+    XCTAssertTrue(
+      try waitUntil { self.agentLog().contains("reload deferred until listeners are ready") })
+    XCTAssertFalse(stateLog().contains("SIGUSR1"))
+    XCTAssertFalse(stateLog().contains("SIGUSR2"))
+    XCTAssertFalse(stateLog().contains("SIGTERM"))
+    XCTAssertEqual(stateLog().components(separatedBy: "invoked:").count - 1, 1)
+    XCTAssertNil(runtimeStore.readRuntimeReceipt())
+
+    kill(wrapper.processIdentifier, SIGTERM)
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+  }
+
+}
+
+final class AgentLifecycleStaleListenerTests: AgentLifecycleTests {
+  func testACLReceiptIsNotPublishedWhenOnlyStaleListenersAreReachable() throws {
+    let staleSocksListener = try TCPListenerFixture()
+    let staleHTTPListener = try TCPListenerFixture()
+    let runtimeStore = RuntimeFileStore(fileURL: contractURL)
+    let listen = ProxyListeningConfiguration(
+      socksPort: staleSocksListener.port,
+      httpPort: staleHTTPListener.port)
+    let directDocument = SslocalRuntimeDocument(servers: [], listen: listen)
+      .replacingACL(.direct(at: runtimeStore.aclFileURL))
+    try writeContract(directDocument)
+
+    for local in directDocument.locals {
+      XCTAssertEqual(
+        EndpointHealthProbe.probe(host: local.probeHost, port: local.localPort, timeout: 0.2),
+        .reachable,
+        "旧实例应让 \(local.inboundProtocol) 端口可连通")
+    }
+
+    let wrapper = try launchWrapper(behavior: "run")
+
+    XCTAssertTrue(
+      try waitUntil { self.stateLog().contains("invoked:") },
+      "等待候选子进程启动后验证监听归属")
+
+    let server = try XCTUnwrap(ProxyRuntimeFixture.makeDocument().servers.first)
+    let serverReload = SslocalRuntimeDocument(
+      servers: [server], listen: listen, acl: directDocument.aclRuntime)
+    try writeContract(serverReload)
+    XCTAssertEqual(kill(wrapper.processIdentifier, SIGUSR1), 0, "server-only reload 应送达")
+
+    XCTAssertTrue(
+      try waitUntil { self.agentLog().contains("reload deferred until listeners are ready") },
+      "未就绪的直连实例应推迟 server-only reload")
+    XCTAssertFalse(stateLog().contains("SIGUSR1"), "旧监听不能让候选通过就绪门并转发重载")
+    XCTAssertTrue(
+      pidAlive(wrapper.processIdentifier),
+      "候选 wrapper 应继续监管；agent log: " + agentLog() + "; child log: " + stateLog())
+    XCTAssertNil(
+      runtimeStore.readRuntimeReceipt(),
+      "候选没有绑定端口时，旧监听和 server-only reload 都不能发布直连回执")
+    XCTAssertTrue(
+      try waitUntil(timeout: 20) { self.agentLog().contains("check=ownership") },
+      "超时日志应区分端口可连接但不属于当前子进程：\(agentLog())")
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+    XCTAssertTrue(agentLog().contains("endpoint=socks 127.0.0.1:\(staleSocksListener.port)"))
+  }
+}
+
+final class AgentLifecycleListenDeadlineTests: AgentLifecycleTests {
+  // MARK: 监听建立判定
+
+  func testListenDeadlinePersistsFailureAndStopsChild() throws {
+    // stub sslocal 不监听任何端点：超时日志应包含失败检查与等待耗时。
+    try writeContract(ProxyRuntimeFixture.makeDocument())
+    let wrapper = try launchWrapper(behavior: "run")
+
+    let agentLogURL = workDir.appendingPathComponent("agent.log")
+    XCTAssertTrue(
+      try waitUntil(timeout: 20) {
+        guard let log = try? String(contentsOf: agentLogURL, encoding: .utf8) else {
+          return false
+        }
+        return log.contains("listen not established within deadline")
+      },
+      "15 秒未建立监听应以 error 日志点名，实际 agent.log：\(agentLog())")
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+    let log = try XCTUnwrap(
+      agentLog().components(separatedBy: "\n").first {
+        $0.contains("listen not established within deadline")
+      })
+    XCTAssertTrue(log.contains("endpoint=socks 127.0.0.1:"), log)
+    XCTAssertTrue(log.contains("check=connect outcome=refused"), log)
+    XCTAssertTrue(log.contains("pid="), log)
+    XCTAssertTrue(log.contains("elapsed="), log)
+    XCTAssertTrue(log.contains("deadline=15.000s"), log)
+    XCTAssertNotNil(RuntimeFileStore(fileURL: contractURL).readFailure())
+    XCTAssertTrue(stateLog().contains("SIGTERM"))
+  }
+}
+
+private final class TCPListenerFixture {
+  let port: Int
+  private let source: DispatchSourceRead
+
+  init() throws {
+    let socketDescriptor = socket(AF_INET, SOCK_STREAM, 0)
+    guard socketDescriptor >= 0 else { throw POSIXError(.ENOTSOCK) }
+
+    var address = sockaddr_in()
+    address.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_addr.s_addr = inet_addr("127.0.0.1")
+    address.sin_port = 0
+    let bindResult = withUnsafePointer(to: &address) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        Darwin.bind(
+          socketDescriptor, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    guard bindResult == 0, listen(socketDescriptor, 4) == 0 else {
+      close(socketDescriptor)
+      throw POSIXError(.EADDRINUSE)
+    }
+
+    var boundAddress = sockaddr_in()
+    var length = socklen_t(MemoryLayout<sockaddr_in>.size)
+    let nameResult = withUnsafeMutablePointer(to: &boundAddress) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        getsockname(socketDescriptor, $0, &length)
+      }
+    }
+    guard nameResult == 0 else {
+      close(socketDescriptor)
+      throw POSIXError(.EINVAL)
+    }
+
+    guard fcntl(socketDescriptor, F_SETFL, O_NONBLOCK) == 0 else {
+      close(socketDescriptor)
+      throw POSIXError(.EINVAL)
+    }
+    port = Int(CFSwapInt16BigToHost(boundAddress.sin_port))
+    source = DispatchSource.makeReadSource(fileDescriptor: socketDescriptor, queue: .global())
+    source.setEventHandler {
+      while true {
+        let connection = accept(socketDescriptor, nil, nil)
+        guard connection >= 0 else { return }
+        close(connection)
+      }
+    }
+    source.setCancelHandler { close(socketDescriptor) }
+    source.resume()
+  }
+
+  func closeListener() {
+    source.cancel()
+  }
+
+  deinit {
+    closeListener()
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/AgentLifecycleTests+CrashRecovery.swift b/ShadowsocksX-NG2/Tests/Smoke/AgentLifecycleTests+CrashRecovery.swift
new file mode 100644
index 000000000..8471eb4b7
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/AgentLifecycleTests+CrashRecovery.swift
@@ -0,0 +1,96 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension AgentLifecycleChangeProtocolTests {
+  // MARK: 崩溃恢复
+
+  func testStartupFailurePersistsAndAgentRestartCannotRetrySameDeployment() throws {
+    try writeContract(ProxyRuntimeFixture.makeDocument())
+    let store = RuntimeFileStore(fileURL: contractURL)
+    let wrapper = try launchWrapper(behavior: "crash")
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+    let failure = try XCTUnwrap(store.readFailure())
+    let launches = stateLog().components(separatedBy: "invoked:").count
+    let replay = try launchWrapper(behavior: "run")
+    XCTAssertEqual(try waitForExit(replay), 0)
+    XCTAssertEqual(stateLog().components(separatedBy: "invoked:").count, launches)
+    XCTAssertEqual(store.readFailure(), failure)
+    try writeContract(ProxyRuntimeFixture.makeDocument(serverAddress: "198.51.100.9"))
+    let next = try launchWrapper(behavior: "run")
+    XCTAssertTrue(
+      try waitUntil { self.stateLog().components(separatedBy: "invoked:").count > launches })
+    kill(next.processIdentifier, SIGTERM)
+    XCTAssertEqual(try waitForExit(next), 0)
+  }
+
+  func testUnexpectedExitBeforeHealthyIsPersistentFailureEvenWithZeroExitCode() throws {
+    try writeContract(ProxyRuntimeFixture.makeDocument())
+    let wrapper = try launchWrapper(behavior: "exit0")
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+    XCTAssertNotNil(RuntimeFileStore(fileURL: contractURL).readFailure())
+  }
+}
+
+extension AgentLifecycleChangeProtocolTests {
+  func testUnconfirmedLivingChildPreventsAnySecondLaunch() throws {
+    try writeContract(ProxyRuntimeFixture.makeDocument())
+    // 模拟 Agent 崩溃后子进程仍活着；监管者不得冒险拉起第二实例或杀错进程。
+    let pidURL = workDir.appendingPathComponent("sslocal.pid")
+    try Data(String(getpid()).utf8).write(to: pidURL)
+    let wrapper = try launchWrapper(behavior: "run")
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+    XCTAssertFalse(stateLog().contains("invoked:"))
+    XCTAssertNotNil(RuntimeFileStore(fileURL: contractURL).readFailure())
+    XCTAssertTrue(FileManager.default.fileExists(atPath: pidURL.path))
+  }
+
+  func testOnlyOneAgentCanOwnTheChildLifecycle() throws {
+    try writeContract(ProxyRuntimeFixture.makeDocument())
+    let owner = try launchWrapper(behavior: "run")
+    XCTAssertTrue(try waitUntil { self.stateLog().contains("invoked:") })
+    let second = try launchWrapper(behavior: "run")
+    XCTAssertEqual(try waitForExit(second), 0)
+    XCTAssertEqual(stateLog().components(separatedBy: "invoked:").count, 2)
+    XCTAssertTrue(owner.isRunning)
+    kill(owner.processIdentifier, SIGTERM)
+    XCTAssertEqual(try waitForExit(owner), 0)
+  }
+}
+
+extension AgentLifecycleChangeProtocolTests {
+  func testReloadWaitsForTermIgnoringChildBeforeStartingReplacement() throws {
+    try writeContract(ProxyRuntimeFixture.makeDocument())
+    let wrapper = try launchWrapper(behavior: "ignore-term-once")
+    XCTAssertTrue(try waitUntil { self.stateLog().contains("invoked:") })
+    try writeContract(ProxyRuntimeFixture.makeDocument(localPort: 2086))
+    kill(wrapper.processIdentifier, SIGUSR1)
+    XCTAssertTrue(try waitUntil { self.stateLog().contains("SIGTERM ignored") })
+    XCTAssertEqual(
+      stateLog().components(separatedBy: "invoked:").count, 2,
+      "优雅停止尚未成功时不能拉起新实例")
+    XCTAssertTrue(
+      try waitUntil(timeout: 16) {
+        self.stateLog().components(separatedBy: "invoked:").count == 3
+      })
+    XCTAssertFalse(stateLog().contains("OVERLAPPING CHILD"))
+    kill(wrapper.processIdentifier, SIGTERM)
+    XCTAssertEqual(try waitForExit(wrapper, timeout: 16), 0)
+  }
+}
+
+extension AgentLifecycleChangeProtocolTests {
+  func testResourceLossDuringStartupStillPersistsDeploymentFailure() throws {
+    let store = RuntimeFileStore(fileURL: contractURL)
+    try writeContract(
+      ProxyRuntimeFixture.makeDocument().replacingACL(.direct(at: store.aclFileURL)))
+    let wrapper = try launchWrapper(behavior: "drop-acl")
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+    XCTAssertNotNil(store.readFailure(), "资源丢失不能阻止明确失败落盘")
+    XCTAssertFalse(FileManager.default.fileExists(atPath: store.aclFileURL.path))
+    let replay = try launchWrapper(behavior: "run")
+    XCTAssertEqual(try waitForExit(replay), 0)
+    XCTAssertEqual(stateLog().components(separatedBy: "invoked:").count, 2)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/AgentLifecycleTests.swift b/ShadowsocksX-NG2/Tests/Smoke/AgentLifecycleTests.swift
new file mode 100644
index 000000000..3f478facf
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/AgentLifecycleTests.swift
@@ -0,0 +1,292 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 薄 I/O 缝 ②（spec Testing Decisions）：以 stub sslocal 二进制驱动真实
+/// wrapper 可执行文件，验证启停协议次序、SIGTERM 链、崩溃恢复、文件清理与
+/// SIGUSR1 变更协议。stub 经环境变量编排行为，全部等待有界。
+class AgentLifecycleTests: XCTestCase {
+  var workDir: URL!
+  var contractURL: URL!
+  private var stubStateURL: URL!
+  private var stubURL: URL!
+  private var wrappers: [Process] = []
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-agent-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    contractURL = workDir.appendingPathComponent("sslocal-active.json")
+    stubStateURL = workDir.appendingPathComponent("stub-state.log")
+    stubURL = workDir.appendingPathComponent("stub-sslocal.sh")
+    try FileManager.default.createDirectory(
+      at: childPIDDirectory, withIntermediateDirectories: true)
+    try writeStubScript()
+  }
+
+  override func tearDownWithError() throws {
+    defer {
+      try? FileManager.default.removeItem(at: workDir)
+      try? super.tearDownWithError()
+    }
+    try cleanupWrappers()
+  }
+
+  // MARK: 夹具
+
+  private var wrapperURL: URL {
+    get throws {
+      let url = AppArtifact.bundleURL.appendingPathComponent("Contents/MacOS/ShadowsocksX-NG2Agent")
+      return try XCTUnwrap(
+        FileManager.default.fileExists(atPath: url.path) ? url : nil,
+        "wrapper 未嵌入 app bundle（Contents/MacOS/ShadowsocksX-NG2Agent）")
+    }
+  }
+
+  private func writeStubScript() throws {
+    // stub 记录调用参数与收到的信号；行为由 SSLOCAL_STUB_BEHAVIOR 编排。
+    let script = """
+      #!/bin/sh
+      child_pid_file="$SSLOCAL_STUB_PID_DIR/$$"
+      trap 'rm -f "$child_pid_file"' EXIT
+      trap 'echo "SIGTERM" >> "$SSLOCAL_STUB_STATE"; exit 0' TERM
+      trap 'echo "SIGUSR1" >> "$SSLOCAL_STUB_STATE"' USR1
+      trap 'echo "SIGUSR2" >> "$SSLOCAL_STUB_STATE"' USR2
+      for other in "$SSLOCAL_STUB_PID_DIR"/*; do
+        if [ -f "$other" ] && kill -0 "${other##*/}" 2>/dev/null; then
+          echo "OVERLAPPING CHILD" >> "$SSLOCAL_STUB_STATE"
+        fi
+      done
+      echo "$$" > "$child_pid_file"
+      echo "dns-force-builtin: ${SS_SYSTEM_DNS_RESOLVER_FORCE_BUILTIN:-unset}" >> "$SSLOCAL_STUB_STATE"
+      echo "invoked: $*" >> "$SSLOCAL_STUB_STATE"
+      case "$SSLOCAL_STUB_BEHAVIOR" in
+        crash) exit 7 ;;
+        exit0) exit 0 ;;
+        drop-acl) rm -f "$SSXNG_RUNTIME_DIR"/acl-0*.ini
+          exit 7 ;;
+        ignore-term-once) if [ ! -f "$SSLOCAL_STUB_PID_DIR/term-ignored" ]; then
+          touch "$SSLOCAL_STUB_PID_DIR/term-ignored"
+          trap 'echo "SIGTERM ignored" >> "$SSLOCAL_STUB_STATE"' TERM
+          fi
+          while :; do sleep 0.05; done ;;
+        *) while :; do sleep 0.05; done ;;
+      esac
+      """
+    try script.write(to: stubURL, atomically: true, encoding: .utf8)
+    try FileManager.default.setAttributes(
+      [.posixPermissions: 0o755], ofItemAtPath: stubURL.path)
+  }
+
+  func launchWrapper(behavior: String) throws -> Process {
+    let wrapper = try wrapperURL
+    let process = Process()
+    process.executableURL = wrapper
+    var environment = ProcessInfo.processInfo.environment
+    environment["SSXNG_CONTRACT_PATH"] = contractURL.path
+    environment["SSXNG_SSLOCAL_PATH"] = stubURL.path
+    environment["SSXNG_RUNTIME_DIR"] = workDir.path
+    environment["SSXNG_SYSTEM_LOG"] = "0"
+    environment["SSLOCAL_STUB_STATE"] = stubStateURL.path
+    environment["SSLOCAL_STUB_PID_DIR"] = childPIDDirectory.path
+    environment["SSLOCAL_STUB_BEHAVIOR"] = behavior
+    process.environment = environment
+    try process.run()
+    wrappers.append(process)
+    return process
+  }
+
+  func writeContract(_ document: SslocalRuntimeDocument) throws {
+    try RuntimeFileStore(fileURL: contractURL).write(document)
+  }
+
+  func stateLog() -> String {
+    (try? String(contentsOf: stubStateURL, encoding: .utf8)) ?? ""
+  }
+
+  func pidAlive(_ pid: Int32) -> Bool {
+    kill(pid, 0) == 0
+  }
+
+  @discardableResult
+  func waitUntil(
+    timeout: TimeInterval = 10, _ condition: () throws -> Bool
+  ) throws -> Bool {
+    let deadline = DispatchTime.now() + timeout
+    while DispatchTime.now() < deadline {
+      if try condition() { return true }
+      Thread.sleep(forTimeInterval: 0.05)
+    }
+    return try condition()
+  }
+
+  /// 断言 wrapper 在超时内退出并返回退出码。
+  func waitForExit(_ process: Process, timeout: TimeInterval = 10) throws -> Int32 {
+    guard try waitUntil(timeout: timeout, { !process.isRunning }) else {
+      throw LifecycleWaitError.exitTimedOut(process.processIdentifier)
+    }
+    return process.terminationStatus
+  }
+
+  private var childPIDDirectory: URL {
+    workDir.appendingPathComponent("child-pids", isDirectory: true)
+  }
+
+  /// 即使用例中途抛错，也先停止所有 wrapper，再清理仍存活的 stub。
+  func cleanupWrappers() throws {
+    let running = wrappers.filter(\.isRunning)
+    for process in running { kill(process.processIdentifier, SIGTERM) }
+    _ = try waitUntil(timeout: 12) { running.allSatisfy { !$0.isRunning } }
+
+    let childFiles = try FileManager.default.contentsOfDirectory(
+      at: childPIDDirectory, includingPropertiesForKeys: nil)
+    let childPIDs = childFiles.compactMap { Int32($0.lastPathComponent) }.filter { $0 > 0 }
+    for pid in childPIDs { kill(pid, SIGKILL) }
+    for process in running where process.isRunning {
+      kill(process.processIdentifier, SIGKILL)
+    }
+    guard
+      try waitUntil(
+        timeout: 2,
+        {
+          running.allSatisfy { !$0.isRunning } && childPIDs.allSatisfy { !self.pidAlive($0) }
+        })
+    else {
+      throw LifecycleWaitError.cleanupTimedOut
+    }
+  }
+
+  func agentLog() -> String {
+    (try? String(contentsOf: workDir.appendingPathComponent("agent.log"), encoding: .utf8)) ?? ""
+  }
+}
+
+private enum LifecycleWaitError: Error {
+  case exitTimedOut(Int32)
+  case cleanupTimedOut
+}
+
+final class AgentLifecycleCoreTests: AgentLifecycleTests {
+  // MARK: 启动协议与 SIGTERM 链
+
+  func testStartProtocolSpawnsSslocalWithAbsoluteConfigPathThenStopsOnSIGTERM() throws {
+    try writeContract(ProxyRuntimeFixture.makeDocument())
+    let wrapper = try launchWrapper(behavior: "run")
+    let expectedInvocation = "invoked: -c \(contractURL.path) --log-without-time"
+
+    XCTAssertTrue(
+      try waitUntil {
+        self.stateLog().components(separatedBy: .newlines).contains(expectedInvocation)
+      },
+      "wrapper 应以契约绝对路径及无上游时间参数调用 sslocal，实际：\(stateLog())")
+    XCTAssertTrue(pidAlive(wrapper.processIdentifier), "sslocal 运行期间 wrapper 应保持常驻")
+
+    XCTAssertThrowsError(try waitForExit(wrapper, timeout: 0.01))
+    XCTAssertTrue(wrapper.isRunning, "等待超时应返回错误，不影响被测进程")
+
+    kill(wrapper.processIdentifier, SIGTERM)
+    let exitStatus = try waitForExit(wrapper)
+
+    XCTAssertEqual(exitStatus, 0, "显式停止后 wrapper 干净退出（不触发 KeepAlive 重启）")
+    XCTAssertTrue(stateLog().contains("SIGTERM"), "SIGTERM 链：wrapper 转发给 sslocal")
+    XCTAssertTrue(
+      FileManager.default.fileExists(atPath: contractURL.path),
+      "停止路径不动契约文件（删除由 GUI 的停止协议末端负责）")
+  }
+
+  /// macOS resolv.conf 可能含带 zone id 的链路本地 nameserver，hickory 解析
+  /// 失败只会刷 ERROR 后回退：wrapper 应直接注入强制 builtin 的环境变量。
+  func testSpawnForcesBuiltinDnsResolverEnvironment() throws {
+    try writeContract(ProxyRuntimeFixture.makeDocument())
+    let wrapper = try launchWrapper(behavior: "run")
+
+    XCTAssertTrue(
+      try waitUntil { self.stateLog().contains("invoked:") },
+      "wrapper 应拉起 sslocal，实际：\(stateLog())")
+    XCTAssertTrue(
+      stateLog().contains("dns-force-builtin: 1"),
+      "sslocal 子进程应收到 SS_SYSTEM_DNS_RESOLVER_FORCE_BUILTIN=1，实际：\(stateLog())")
+
+    kill(wrapper.processIdentifier, SIGTERM)
+    XCTAssertEqual(try waitForExit(wrapper), 0)
+  }
+
+  // MARK: 契约缺失 / 无效 → 停止并清理
+
+  func testMissingContractExitsCleanlyWithoutSpawning() throws {
+    let wrapper = try launchWrapper(behavior: "run")
+
+    let exitStatus = try waitForExit(wrapper)
+
+    XCTAssertEqual(exitStatus, 0, "无契约干净退出，KeepAlive（SuccessfulExit:false）不重启")
+    XCTAssertFalse(stateLog().contains("invoked"), "不应拉起 sslocal")
+  }
+
+  func testInvalidSupervisionIsPreservedAndExitsWithoutSpawn() throws {
+    try Data("not valid json {".utf8).write(
+      to: workDir.appendingPathComponent("agent-supervision.json"))
+    let wrapper = try launchWrapper(behavior: "run")
+
+    let exitStatus = try waitForExit(wrapper)
+
+    XCTAssertEqual(exitStatus, 0)
+    XCTAssertTrue(
+      FileManager.default.fileExists(
+        atPath: workDir.appendingPathComponent("agent-supervision.json").path))
+    XCTAssertFalse(stateLog().contains("invoked"))
+  }
+
+  func testLegacyConfigurationIsNeverDecodedOrDeleted() throws {
+    // 可解码但本地端口无效：wrapper 校验拒绝，不给 sslocal 反复失败的机会。
+    // 空 `servers` 是合法契约——无活动目标时也可部署本地监听。
+    try SslocalRuntimeDocument(
+      servers: [], listen: ProxyListeningConfiguration(socksPort: 0)
+    ).jsonData().write(to: contractURL)
+    let wrapper = try launchWrapper(behavior: "run")
+
+    let exitStatus = try waitForExit(wrapper)
+
+    XCTAssertEqual(exitStatus, 0)
+    XCTAssertTrue(FileManager.default.fileExists(atPath: contractURL.path))
+  }
+
+  /// 空服务器契约是合法部署：wrapper 接受并照常拉起 sslocal，
+  /// 由本地入站提供无目标的本地监听。
+  func testEmptyServerContractIsValidAndRunsSslocal() throws {
+    try writeContract(SslocalRuntimeDocument(servers: [], listen: ProxyListeningConfiguration()))
+    let wrapper = try launchWrapper(behavior: "run")
+
+    XCTAssertTrue(
+      try waitUntil { self.stateLog().contains("invoked:") },
+      "空服务器契约应照常拉起 sslocal")
+    XCTAssertTrue(pidAlive(wrapper.processIdentifier), "空监听会话 wrapper 应保持常驻")
+
+    kill(wrapper.processIdentifier, SIGTERM)
+    XCTAssertEqual(try waitForExit(wrapper), 0, "显式停止干净退出")
+  }
+
+  // MARK: pid 文件契约
+
+  func testWrapperWritesAndRemovesPIDFile() throws {
+    let pidURL = workDir.appendingPathComponent("agent.pid")
+    try writeContract(ProxyRuntimeFixture.makeDocument())
+    let wrapper = try launchWrapper(behavior: "run")
+
+    XCTAssertTrue(
+      try waitUntil { FileManager.default.fileExists(atPath: pidURL.path) },
+      "wrapper 启动即写 pid 文件（GUI 判活与 SIGUSR1 投递依据）")
+    let recordedPID = Int32(
+      String(data: try Data(contentsOf: pidURL), encoding: .utf8)?.trimmingCharacters(
+        in: .whitespacesAndNewlines
+      ) ?? "")
+    XCTAssertEqual(recordedPID, wrapper.processIdentifier, "pid 文件记录 wrapper 自身 pid")
+
+    XCTAssertTrue(try waitUntil { self.stateLog().contains("invoked:") })
+    kill(wrapper.processIdentifier, SIGTERM)
+    _ = try waitForExit(wrapper)
+    XCTAssertFalse(
+      FileManager.default.fileExists(atPath: pidURL.path), "退出路径清理 pid 文件")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/ConnectivityMeasurementSmokeTests.swift b/ShadowsocksX-NG2/Tests/Smoke/ConnectivityMeasurementSmokeTests.swift
new file mode 100644
index 000000000..ef0a92ded
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/ConnectivityMeasurementSmokeTests.swift
@@ -0,0 +1,110 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// Real sslocal forwards a fixed-address HTTP probe to a local, unencrypted
+/// Shadowsocks fixture. This checks process/protocol wiring, not remote egress.
+@MainActor
+struct ConnectivityMeasurementSmokeTests {
+  @Test func realSslocalPreservesHostForCandidateAndThreeSamplesThenCleansUp() async throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: root) }
+    let fixture = try startHTTPFixture(in: root)
+    defer { fixture.stop() }
+    let environments = root.appendingPathComponent("environments")
+    let runtime = ConnectivityRuntime(
+      executable: AppArtifact.bundleURL.appendingPathComponent("Contents/Helpers/sslocal"),
+      measurement: ConnectivityMeasurement(resolve: { _, _, _ in ["192.0.2.1"] }),
+      temporaryRoot: environments)
+    let server = SslocalServerDocument(
+      id: "fixture", server: "127.0.0.1", serverPort: fixture.port, password: "fixture",
+      method: "none", plugin: nil, pluginOpts: nil)
+    let outcome = await runtime.measure(
+      server, url: URL(string: "http://target.invalid:8080/check?token=private")!,
+      preparationDeadline: .now.advanced(by: .seconds(30)))
+    guard case .success = outcome else {
+      Issue.record("Expected success through real sslocal: \(outcome)")
+      return
+    }
+    let lines = try String(contentsOf: fixture.requests, encoding: .utf8).split(separator: "\n")
+    #expect(lines.count == 4)
+    for line in lines {
+      let request = try #require(
+        try JSONSerialization.jsonObject(with: Data(line.utf8)) as? [String: Any])
+      #expect(request["address"] as? String == "192.0.2.1")
+      #expect(request["port"] as? Int == 8080)
+      let http = try #require(request["request"] as? String)
+      #expect(http.lowercased().contains("host: target.invalid:8080\r\n"))
+      #expect(http.contains("/check?token=private"))
+    }
+    #expect(try FileManager.default.contentsOfDirectory(atPath: environments.path).isEmpty)
+  }
+}
+
+private let connectivityMeasurementFixtureScript = """
+  import socket, sys, threading, json
+  server = socket.socket()
+  server.bind(('127.0.0.1', 0)); server.listen()
+  print(server.getsockname()[1], flush=True)
+  lock = threading.Lock()
+  def read(connection, size):
+      result = b''
+      while len(result) < size:
+          data = connection.recv(size - len(result))
+          if not data: raise EOFError()
+          result += data
+      return result
+  def serve(connection):
+      try:
+          atyp = read(connection, 1)[0]
+          if atyp == 1: address = socket.inet_ntop(socket.AF_INET, read(connection, 4))
+          elif atyp == 4: address = socket.inet_ntop(socket.AF_INET6, read(connection, 16))
+          else: address = read(connection, read(connection, 1)[0]).decode()
+          port = int.from_bytes(read(connection, 2), 'big')
+          request = b''
+          while b'\\r\\n\\r\\n' not in request:
+              request += read(connection, 1)
+          with lock:
+              with open(sys.argv[1], 'a') as output:
+                  output.write(json.dumps({'address': address, 'port': port, 'request': request.decode()}) + '\\n')
+          connection.sendall(b'HTTP/1.1 204 No Content\\r\\n\\r\\n')
+      finally: connection.close()
+  while True:
+      connection, _ = server.accept()
+      threading.Thread(target=serve, args=(connection,), daemon=True).start()
+  """
+
+private struct RunningHTTPFixture {
+  let process: Process
+  let port: Int
+  let requests: URL
+
+  func stop() {
+    process.terminate()
+    process.waitUntilExit()
+  }
+}
+
+private func startHTTPFixture(in root: URL) throws -> RunningHTTPFixture {
+  let script = root.appendingPathComponent("fixture.py")
+  let requests = root.appendingPathComponent("requests.jsonl")
+  try connectivityMeasurementFixtureScript.write(to: script, atomically: true, encoding: .utf8)
+  let process = Process()
+  process.executableURL = URL(fileURLWithPath: "/usr/bin/env")
+  process.arguments = ["python3", script.path, requests.path]
+  let output = Pipe()
+  process.standardOutput = output
+  process.standardError = FileHandle.nullDevice
+  try process.run()
+  var line = Data()
+  while let byte = try output.fileHandleForReading.read(upToCount: 1), byte != Data([10]),
+    !byte.isEmpty
+  {
+    line.append(byte)
+  }
+  let portText = try #require(String(data: line, encoding: .utf8))
+  return RunningHTTPFixture(
+    process: process, port: try #require(Int(portText)), requests: requests)
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/ConnectivityRuntimeTests.swift b/ShadowsocksX-NG2/Tests/Smoke/ConnectivityRuntimeTests.swift
new file mode 100644
index 000000000..621195e27
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/ConnectivityRuntimeTests.swift
@@ -0,0 +1,44 @@
+import Darwin
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct ConnectivityRuntimeTests {
+  @Test func preparationTimeoutKillsProcessGroupAndRemovesSecretsBeforeCompleting() async throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    let environments = root.appendingPathComponent("environments")
+    let pidFile = root.appendingPathComponent("pid")
+    let script = root.appendingPathComponent("fake-sslocal")
+    // Ignore TERM so this test exercises the two-second force termination path.
+    let text = "#!/bin/sh\ntrap '' TERM\necho $$ > '\(pidFile.path)'\nsleep 60 &\nwait\n"
+    try text.write(to: script, atomically: true, encoding: .utf8)
+    try FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: script.path)
+    let adapter = ConnectivityRuntime(executable: script, temporaryRoot: environments)
+    let id = NodeID.fresh()
+    let server = SslocalServerDocument(
+      id: id.rawValue, server: "example.com", serverPort: 443,
+      password: "private", method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+    let module = ServerConnectivity(
+      configuration: { _ in server },
+      measure: { server, url, _ in
+        await adapter.measure(
+          server, url: url, preparationDeadline: .now.advanced(by: .milliseconds(100)))
+      })
+    let started = ContinuousClock.now
+    await module.wait(for: module.test([id]))
+    #expect(module.history(for: id).first?.outcome == .preparationTimeout)
+    #expect(ContinuousClock.now - started >= .seconds(2))
+    #expect(try FileManager.default.contentsOfDirectory(atPath: environments.path).isEmpty)
+    let pid = try #require(
+      Int32(
+        String(contentsOf: pidFile, encoding: .utf8).trimmingCharacters(in: .whitespacesAndNewlines)
+      ))
+    #expect(kill(pid, 0) != 0)
+    #expect(module.testing.isEmpty)
+    #expect(module.isCooling(id))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/LoopbackDNSResponder.swift b/ShadowsocksX-NG2/Tests/Smoke/LoopbackDNSResponder.swift
new file mode 100644
index 000000000..f90fe6bc0
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/LoopbackDNSResponder.swift
@@ -0,0 +1,87 @@
+import Darwin
+import Foundation
+
+/// Test-owned UDP DNS: A records point at the local echo service; AAAA has no data.
+/// This keeps domain ACL probes independent of system DNS and external networking.
+final class LoopbackDNSResponder {
+  private let descriptor: Int32
+  let port: Int
+
+  init() throws {
+    let descriptor = socket(AF_INET, SOCK_DGRAM, 0)
+    guard descriptor >= 0 else { throw POSIXError(.ENOTSOCK) }
+    var address = sockaddr_in()
+    address.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_addr.s_addr = INADDR_LOOPBACK.bigEndian
+    let bound = withUnsafePointer(to: &address) {
+      $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        Darwin.bind(descriptor, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    guard bound == 0 else {
+      close(descriptor)
+      throw POSIXError(.EADDRINUSE)
+    }
+    var length = socklen_t(MemoryLayout<sockaddr_in>.size)
+    let named = withUnsafeMutablePointer(to: &address) {
+      $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        getsockname(descriptor, $0, &length)
+      }
+    }
+    guard named == 0 else {
+      close(descriptor)
+      throw POSIXError(.EINVAL)
+    }
+    self.descriptor = descriptor
+    port = Int(UInt16(bigEndian: address.sin_port))
+    DispatchQueue.global().async {
+      while true {
+        var packet = [UInt8](repeating: 0, count: 4096)
+        var peer = sockaddr_storage()
+        var peerLength = socklen_t(MemoryLayout<sockaddr_storage>.size)
+        let received = withUnsafeMutablePointer(to: &peer) {
+          $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+            recvfrom(descriptor, &packet, packet.count, 0, $0, &peerLength)
+          }
+        }
+        guard received > 0 else { return }
+        guard let response = Self.response(to: Array(packet.prefix(received))) else { continue }
+        response.withUnsafeBytes { buffer in
+          withUnsafePointer(to: &peer) {
+            $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+              _ = sendto(descriptor, buffer.baseAddress, buffer.count, 0, $0, peerLength)
+            }
+          }
+        }
+      }
+    }
+  }
+
+  deinit {
+    shutdown(descriptor, SHUT_RDWR)
+    close(descriptor)
+  }
+
+  private static func response(to query: [UInt8]) -> [UInt8]? {
+    guard query.count >= 17, query[4...5].elementsEqual([0, 1]) else { return nil }
+    var end = 12
+    while end < query.count, query[end] != 0 {
+      let length = Int(query[end])
+      guard length <= 63 else { return nil }
+      end += length + 1
+    }
+    guard end + 5 <= query.count else { return nil }
+    let isIPv4 = query[end + 1...end + 4].elementsEqual([0, 1, 0, 1])
+    var result = Array(query.prefix(end + 5))
+    result[2] = 0x81
+    result[3] = 0x80
+    result[6] = 0
+    result[7] = isIPv4 ? 1 : 0
+    result[8...11] = [0, 0, 0, 0]
+    if isIPv4 {
+      result += [0xc0, 0x0c, 0, 1, 0, 1, 0, 0, 0, 60, 0, 4, 127, 0, 0, 1]
+    }
+    return result
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+ACLRouting.swift b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+ACLRouting.swift
new file mode 100644
index 000000000..e472da406
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+ACLRouting.swift
@@ -0,0 +1,331 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class RealSslocalACLRoutingSmokeTests: RealSslocalSmokeTests {
+  func testDirectACLRoutesSOCKSAndHTTPLocallyWithoutServers() throws {
+    let echoServer = try LoopbackEchoServer()
+    let selectedPorts = try grabThreeListenPorts(excluding: [echoServer.port])
+    let listen = ProxyListeningConfiguration(
+      socksPort: selectedPorts[0], httpPort: selectedPorts[1])
+    let document = SslocalRuntimeDocument(
+      servers: [],
+      listen: listen,
+      acl: .direct(at: aclFileURL))
+    XCTAssertTrue(document.isWellFormed)
+    let wrapper = try launchWrapper(document)
+    defer {
+      if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) }
+    }
+
+    XCTAssertTrue(
+      try waitForCondition(timeout: 15) {
+        EndpointHealthProbe.probe(host: "127.0.0.1", port: listen.socksPort, timeout: 1)
+          == .reachable
+          && EndpointHealthProbe.probe(host: "127.0.0.1", port: listen.httpPort, timeout: 1)
+            == .reachable
+      }, "直连模式应绑定 SOCKS 和 HTTP 入站")
+    try assertReceiptOwnsListeners(document: document)
+
+    let socksPayload = Array("socks direct\n".utf8)
+    XCTAssertEqual(
+      try performDirectSocksEcho(
+        socksPort: listen.socksPort, targetPort: echoServer.port, payload: socksPayload),
+      socksPayload,
+      "空服务器列表下 SOCKS 应通过 bypass_all 直连回环目标")
+
+    let httpPayload = Array("http direct\n".utf8)
+    XCTAssertEqual(
+      try performDirectHTTPEcho(
+        httpPort: listen.httpPort, targetPort: echoServer.port, payload: httpPayload),
+      httpPayload,
+      "HTTP 入站应应用同一 ACL 并直连回环目标")
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "direct wrapper exits")
+    XCTAssertNil(
+      RuntimeFileStore(fileURL: contractURL).readRuntimeReceipt(), "停止后应清除运行回执")
+  }
+
+  /// 全局模式 ACL 路由：proxy_all + 固定本地绕过。本地目标经
+  /// SOCKS/HTTP 直连（不触 SS 出口），公网目标默认走代理（SS 出口被连接）。
+  /// 两个入站共用同一 ACL；IPv6 系统例外的局限由 ACL 路由兜底（见 ADR）。
+  func testGlobalACLRoutesLocalDirectAndPublicThroughProxyOnSOCKSAndHTTP() throws {
+    let echoServer = try LoopbackEchoServer()
+    let fakeSSServer = try ConnectionCountingServer()
+    let selectedPorts = try grabThreeListenPorts(excluding: [echoServer.port, fakeSSServer.port])
+    let listen = ProxyListeningConfiguration(
+      socksPort: selectedPorts[0], httpPort: selectedPorts[1])
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "global-smoke-server",
+          server: "127.0.0.1",
+          serverPort: fakeSSServer.port,
+          password: "smoke-password",
+          method: "aes-256-gcm",
+          plugin: nil,
+          pluginOpts: nil)
+      ],
+      listen: listen,
+      acl: .global(at: aclFileURL))
+    XCTAssertTrue(document.isWellFormed)
+    let wrapper = try launchWrapper(document)
+    defer {
+      if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) }
+    }
+
+    try awaitGlobalInboundsReady(listen: listen, document: document)
+
+    try assertLocalTargetsBypass(listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+    try assertPublicTargetsProxy(listen: listen, fakeSS: fakeSSServer)
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "global wrapper exits")
+    // Isolate host exceptions from the loopback IP bypass checked above.
+    let hostACL = ProxyACLDocument(
+      path: aclFileURL.path, summary: "fixed-host-probe",
+      content: document.aclRuntime!.content.replacingOccurrences(of: "127.0.0.0/8\n", with: ""))
+    let hostDocument = SslocalRuntimeDocument(
+      servers: document.servers, listen: listen, acl: hostACL)
+    let hostWrapper = try launchWrapper(hostDocument)
+    try awaitGlobalInboundsReady(listen: listen, document: hostDocument)
+    try assertHostnameAndIPv6Bypass(listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+    stopWrapperAndAssertCleanExit(hostWrapper, description: "fixed host wrapper exits")
+    XCTAssertNil(
+      RuntimeFileStore(fileURL: contractURL).readRuntimeReceipt(),
+      "停止后应清除运行回执")
+  }
+
+  /// 规则模式 ACL 路由：「未匹配时代理」→ proxy_all + 中国域名
+  /// 直连候选。`.cn` 目标经本地 DNS 解析到 echo；非中国公网目标默认走代理。
+  /// 专用规则探针去除回环绕过，固定本地绕过由全局模式用例覆盖。
+  func testRuleProxyDefaultACLRoutesChinaDirectAndRestThroughProxy() throws {
+    let echoServer = try LoopbackEchoServer()
+    let fakeSSServer = try ConnectionCountingServer()
+    let selectedPorts = try grabThreeListenPorts(excluding: [echoServer.port, fakeSSServer.port])
+    let listen = ProxyListeningConfiguration(
+      socksPort: selectedPorts[0], httpPort: selectedPorts[1])
+    let chinaRules = [
+      ProxyRule(
+        action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn"))
+    ]
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "rule-smoke-server",
+          server: "127.0.0.1",
+          serverPort: fakeSSServer.port,
+          password: "smoke-password",
+          method: "aes-256-gcm",
+          plugin: nil,
+          pluginOpts: nil)
+      ],
+      listen: listen,
+      acl: ruleProbeACL(
+        defaultAction: .proxyWhenUnmatched,
+        rules: chinaRules))
+    XCTAssertTrue(document.isWellFormed)
+    let wrapper = try launchWrapper(document)
+    defer {
+      if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) }
+    }
+
+    try awaitGlobalInboundsReady(listen: listen, document: document)
+
+    try assertRuleModeRouting(listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "rule wrapper exits")
+  }
+
+  /// 规则模式 ACL 路由：中国 IPv4 CIDR 直连候选。命中 CIDR 的
+  /// 目标不触达 SS 出口；未命中 CIDR 的公网目标默认走代理；SOCKS 与 HTTP
+  /// 入站共用同一 ACL。CIDR 判定可能触发本地 DNS 查询（文档已声明）。
+  func testRuleProxyDefaultACLRoutesChinaCIDRHitDirectAndMissThroughProxy() throws {
+    let echoServer = try LoopbackEchoServer()
+    let fakeSSServer = try ConnectionCountingServer()
+    let selectedPorts = try grabThreeListenPorts(excluding: [echoServer.port, fakeSSServer.port])
+    let listen = ProxyListeningConfiguration(
+      socksPort: selectedPorts[0], httpPort: selectedPorts[1])
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "cidr-smoke-server",
+          server: "127.0.0.1",
+          serverPort: fakeSSServer.port,
+          password: "smoke-password",
+          method: "aes-256-gcm",
+          plugin: nil,
+          pluginOpts: nil)
+      ],
+      listen: listen,
+      acl: ruleProbeACL(
+        defaultAction: .proxyWhenUnmatched,
+        rules: try chinaCIDRSmokeRules()))
+    XCTAssertTrue(document.isWellFormed)
+    let wrapper = try launchWrapper(document)
+    defer {
+      if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) }
+    }
+
+    try awaitGlobalInboundsReady(listen: listen, document: document)
+    try assertCIDRModeRouting(listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "cidr rule wrapper exits")
+  }
+
+  /// 冒烟夹具：`.cn` 域名 + 测试用 `127.0.0.1/32` CIDR 直连候选
+  /// （仅验证命中/未命中路由，不代表真实中国 IP 归属）。
+  private func chinaCIDRSmokeRules() throws -> [ProxyRule] {
+    return [
+      ProxyRule(
+        action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn")),
+      ProxyRule(
+        action: .direct, match: try RuleMatch(ipv4CIDR: "127.0.0.1/32")),
+    ]
+  }
+
+  /// CIDR 路由断言：命中 `127.0.0.1/32` 完成回显；未命中目标走代理。
+  private func assertCIDRModeRouting(
+    listen: ProxyListeningConfiguration, echoPort: Int, fakeSS: ConnectionCountingServer
+  ) throws {
+    let beforeHit = fakeSS.connectionCount
+    let payload = Array("cidr direct\n".utf8)
+    XCTAssertEqual(
+      try performDirectSocksEcho(
+        socksPort: listen.socksPort, targetPort: echoPort, payload: payload),
+      payload)
+    XCTAssertEqual(
+      fakeSS.connectionCount, beforeHit,
+      "命中中国 IPv4 CIDR 的目标应直连，不得触达 Shadowsocks 出口")
+
+    _ = performSocksConnectReply(
+      socksPort: listen.socksPort, targetHost: "1.1.1.1", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > beforeHit },
+      "未命中 CIDR 的公网目标应连接 Shadowsocks 出口")
+
+    let afterSocks = fakeSS.connectionCount
+    performHTTPConnect(httpPort: listen.httpPort, targetHost: "9.9.9.9", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > afterSocks },
+      "HTTP 入站应应用同一规则 ACL")
+  }
+
+}
+
+extension RealSslocalSmokeTests {
+  func awaitGlobalInboundsReady(
+    listen: ProxyListeningConfiguration, document: SslocalRuntimeDocument
+  ) throws {
+    XCTAssertTrue(
+      try waitForCondition(timeout: 15) {
+        EndpointHealthProbe.probe(host: "127.0.0.1", port: listen.socksPort, timeout: 1)
+          == .reachable
+          && EndpointHealthProbe.probe(host: "127.0.0.1", port: listen.httpPort, timeout: 1)
+            == .reachable
+      }, "全局模式应绑定 SOCKS 和 HTTP 入站")
+    let runtimeStore = RuntimeFileStore(fileURL: contractURL)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 30) {
+        guard let receipt = runtimeStore.readRuntimeReceipt() else { return false }
+        return receipt.deploymentID == runtimeStore.receiptIdentity(for: document)
+          && kill(receipt.processID, 0) == 0
+      }, "应发布仍存活的 sslocal 子进程回执")
+  }
+
+  /// 规则模式路由断言：`.cn` 直连候选不触 SS 出口；未匹配公网目标经 SS 出口
+  /// （SOCKS 与 HTTP 入站同样生效）。
+  func assertRuleModeRouting(
+    listen: ProxyListeningConfiguration, echoPort: Int, fakeSS: ConnectionCountingServer
+  ) throws {
+    // .cn 域名候选直连：SOCKS CONNECT example.cn 不应触达 SS 出口。
+    let beforeCN = fakeSS.connectionCount
+    try assertDirectDomain("example.cn", listen: listen, echoPort: echoPort, exit: fakeSS)
+    XCTAssertEqual(
+      fakeSS.connectionCount, beforeCN,
+      "规则模式的 .cn 直连候选不得触达 Shadowsocks 出口")
+
+    // 非中国公网目标默认代理。
+    let publicReply = performSocksConnectReply(
+      socksPort: listen.socksPort, targetHost: "8.8.8.8", targetPort: 53)
+    XCTAssertNotNil(publicReply, "未匹配目标应走代理路径")
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > beforeCN },
+      "未匹配的公网目标应连接 Shadowsocks 出口")
+
+    // HTTP 入站对未匹配目标同样走代理。
+    let afterSocks = fakeSS.connectionCount
+    performHTTPConnect(httpPort: listen.httpPort, targetHost: "1.1.1.1", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > afterSocks },
+      "HTTP 入站应应用同一规则 ACL")
+  }
+
+  func assertLocalTargetsBypass(
+    listen: ProxyListeningConfiguration, echoPort: Int, fakeSS: ConnectionCountingServer
+  ) throws {
+    let socksPayload = Array("socks local\n".utf8)
+    XCTAssertEqual(
+      try performDirectSocksEcho(
+        socksPort: listen.socksPort, targetPort: echoPort, payload: socksPayload),
+      socksPayload,
+      "全局 ACL 的本地绕过应让 SOCKS 直连回环目标")
+    let httpPayload = Array("http local\n".utf8)
+    XCTAssertEqual(
+      try performDirectHTTPEcho(
+        httpPort: listen.httpPort, targetPort: echoPort, payload: httpPayload),
+      httpPayload,
+      "HTTP 入站应应用同一 ACL 并直连回环目标")
+    XCTAssertEqual(fakeSS.connectionCount, 0, "本地绕过不得触达 Shadowsocks 出口")
+  }
+
+  func assertPublicTargetsProxy(
+    listen: ProxyListeningConfiguration, fakeSS: ConnectionCountingServer
+  ) throws {
+    let publicSocksReply = performSocksConnectReply(
+      socksPort: listen.socksPort, targetHost: "8.8.8.8", targetPort: 53)
+    XCTAssertNotNil(publicSocksReply, "公网目标应走代理路径")
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount >= 1 },
+      "公网目标应连接 Shadowsocks 出口，而不是直连")
+    let afterSocks = fakeSS.connectionCount
+
+    performHTTPConnect(httpPort: listen.httpPort, targetHost: "1.1.1.1", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > afterSocks },
+      "HTTP 入站的公网目标应同样连接 Shadowsocks 出口")
+    XCTAssertTrue(
+      fakeSS.connectionCount >= 2,
+      "SOCKS 与 HTTP 对公网目标遵循同一 ACL 路由")
+  }
+
+  /// 主机名固定绕过与 IPv6 回环：本地 DNS 将主机名解析到 echo，
+  /// 成功回显证明直连完成；IPv6 回环无监听时验证失败应答且不触达 SS。
+  func assertHostnameAndIPv6Bypass(
+    listen: ProxyListeningConfiguration, echoPort: Int, fakeSS: ConnectionCountingServer
+  ) throws {
+    let afterPublic = fakeSS.connectionCount
+    XCTAssertEqual(
+      try performSocksEcho(
+        socksPort: listen.socksPort,
+        request: socksDomainConnectRequest(host: "localhost", port: echoPort),
+        payload: Array("localhost\n".utf8),
+        successMessage: "localhost 应绕过并直连"),
+      Array("localhost\n".utf8))
+    for host in ["printer.local", "nas"] {
+      try assertDirectDomain(host, listen: listen, echoPort: echoPort, exit: fakeSS)
+    }
+    XCTAssertEqual(
+      fakeSS.connectionCount, afterPublic,
+      "localhost/*.local/无点主机名的固定绕过不得触达 Shadowsocks 出口")
+
+    let afterHostnames = fakeSS.connectionCount
+    XCTAssertNotNil(
+      performSocksConnectReply(
+        socksPort: listen.socksPort,
+        request: socksIPv6ConnectRequest(port: echoPort)))
+    XCTAssertEqual(
+      fakeSS.connectionCount, afterHostnames,
+      "IPv6 本地目标不得触达 Shadowsocks 出口，由 ACL 路由兜底")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+CustomRules.swift b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+CustomRules.swift
new file mode 100644
index 000000000..888a7f0c9
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+CustomRules.swift
@@ -0,0 +1,184 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class RealSslocalCustomRuleSmokeTests: RealSslocalSmokeTests {
+  /// 自定义规则真实 sslocal 路由：「未匹配时代理」下自定义
+  /// 域名直连不触 SS 出口，未匹配目标走代理；SOCKS 与 HTTP 入站共用 ACL。
+  func testCustomRulesRouteOnSOCKSAndHTTPInProxyDefaultMode() throws {
+    let echoServer = try LoopbackEchoServer()
+    let fakeSSServer = try ConnectionCountingServer()
+    let selectedPorts = try grabThreeListenPorts(excluding: [echoServer.port, fakeSSServer.port])
+    let listen = ProxyListeningConfiguration(
+      socksPort: selectedPorts[0], httpPort: selectedPorts[1])
+    let customRules = [
+      ProxyRule(
+        action: .direct, match: try RuleMatch(domainSuffix: "direct.example")),
+      ProxyRule(
+        action: .direct, match: try RuleMatch(domainExact: "exact.other.example")),
+    ]
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "custom-smoke-server",
+          server: "127.0.0.1",
+          serverPort: fakeSSServer.port,
+          password: "smoke-password",
+          method: "aes-256-gcm",
+          plugin: nil,
+          pluginOpts: nil)
+      ],
+      listen: listen,
+      acl: ruleProbeACL(
+        defaultAction: .proxyWhenUnmatched,
+        rules: customRules))
+    XCTAssertTrue(document.isWellFormed)
+    let wrapper = try launchWrapper(document)
+    defer {
+      if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) }
+    }
+
+    try awaitGlobalInboundsReady(listen: listen, document: document)
+    try assertCustomDirectRulesBypass(
+      listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+    try assertCustomUnmatchedProxies(
+      listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "custom rule wrapper exits")
+    try assertCustomCIDRBypass(
+      servers: document.servers, listen: listen, echo: echoServer, exit: fakeSSServer)
+  }
+
+  private func assertCustomCIDRBypass(
+    servers: [SslocalServerDocument], listen: ProxyListeningConfiguration,
+    echo: LoopbackEchoServer, exit: ConnectionCountingServer
+  ) throws {
+    let cidrDocument = SslocalRuntimeDocument(
+      servers: servers, listen: listen,
+      acl: ruleProbeACL(
+        defaultAction: .proxyWhenUnmatched,
+        rules: [
+          ProxyRule(action: .direct, match: try RuleMatch(ipv4CIDR: "127.0.0.1/32"))
+        ]))
+    let cidrWrapper = try launchWrapper(cidrDocument)
+    try awaitGlobalInboundsReady(listen: listen, document: cidrDocument)
+    let beforeCIDR = exit.connectionCount
+    let payload = Array("custom cidr direct\n".utf8)
+    XCTAssertEqual(
+      try performDirectSocksEcho(
+        socksPort: listen.socksPort, targetPort: echo.port, payload: payload), payload)
+    XCTAssertEqual(exit.connectionCount, beforeCIDR)
+    stopWrapperAndAssertCleanExit(cidrWrapper, description: "custom CIDR wrapper exits")
+  }
+
+  /// 后缀与完整域名使用互不覆盖的夹具，分别证明直连完成。
+  private func assertCustomDirectRulesBypass(
+    listen: ProxyListeningConfiguration, echoPort: Int, fakeSS: ConnectionCountingServer
+  ) throws {
+    let beforeDirect = fakeSS.connectionCount
+    for host in ["sub.direct.example", "exact.other.example"] {
+      try assertDirectDomain(host, listen: listen, echoPort: echoPort, exit: fakeSS)
+      XCTAssertEqual(fakeSS.connectionCount, beforeDirect)
+    }
+  }
+
+  /// 未匹配目标默认代理；HTTP 入站应用同一自定义规则 ACL。
+  private func assertCustomUnmatchedProxies(
+    listen: ProxyListeningConfiguration, echoPort: Int, fakeSS: ConnectionCountingServer
+  ) throws {
+    let beforeHit = fakeSS.connectionCount
+    _ = performSocksConnectReply(
+      socksPort: listen.socksPort, targetHost: "unmatched.example.org", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > beforeHit },
+      "未匹配目标应走代理并连接 Shadowsocks 出口")
+    let beforeExactBoundary = fakeSS.connectionCount
+    XCTAssertNotNil(
+      performSocksConnectReply(
+        socksPort: listen.socksPort, targetHost: "sub.exact.other.example", targetPort: echoPort))
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > beforeExactBoundary },
+      "完整域名规则不得覆盖子域名")
+
+    let afterSocks = fakeSS.connectionCount
+    let payload = Array("http domain direct\n".utf8)
+    XCTAssertEqual(
+      try performDirectHTTPEcho(
+        httpPort: listen.httpPort, targetHost: "other.direct.example", targetPort: echoPort,
+        payload: payload), payload)
+    XCTAssertEqual(
+      fakeSS.connectionCount, afterSocks,
+      "HTTP 入站的自定义直连规则不得触达 Shadowsocks 出口")
+
+    performHTTPConnect(httpPort: listen.httpPort, targetHost: "8.8.8.8", targetPort: 53)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > afterSocks },
+      "HTTP 入站未匹配目标应走代理")
+  }
+
+  /// 自定义规则真实 sslocal 路由：「未匹配时直连」下自定义
+  /// 域名代理命中 SS 出口，未匹配目标直连。
+  func testCustomRulesRouteOnSOCKSAndHTTPInDirectDefaultMode() throws {
+    let echoServer = try LoopbackEchoServer()
+    let fakeSSServer = try ConnectionCountingServer()
+    let selectedPorts = try grabThreeListenPorts(excluding: [echoServer.port, fakeSSServer.port])
+    let listen = ProxyListeningConfiguration(
+      socksPort: selectedPorts[0], httpPort: selectedPorts[1])
+    let customRules = [
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example"))
+    ]
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "custom-direct-smoke-server",
+          server: "127.0.0.1",
+          serverPort: fakeSSServer.port,
+          password: "smoke-password",
+          method: "aes-256-gcm",
+          plugin: nil,
+          pluginOpts: nil)
+      ],
+      listen: listen,
+      acl: ruleProbeACL(
+        defaultAction: .directWhenUnmatched,
+        rules: customRules))
+    XCTAssertTrue(document.isWellFormed)
+    let wrapper = try launchWrapper(document)
+    defer {
+      if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) }
+    }
+
+    try awaitGlobalInboundsReady(listen: listen, document: document)
+    try assertCustomProxyCandidatesHitSS(
+      listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "custom direct-default wrapper exits")
+  }
+
+  /// 自定义代理候选命中 SS；未匹配直连；HTTP 入站共用 ACL。
+  private func assertCustomProxyCandidatesHitSS(
+    listen: ProxyListeningConfiguration, echoPort: Int, fakeSS: ConnectionCountingServer
+  ) throws {
+    let beforeHit = fakeSS.connectionCount
+    _ = performSocksConnectReply(
+      socksPort: listen.socksPort, targetHost: "sub.blocked.example", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > beforeHit },
+      "自定义代理候选应连接 Shadowsocks 出口")
+
+    let afterHit = fakeSS.connectionCount
+    try assertDirectDomain(
+      "unmatched.example.org", listen: listen, echoPort: echoPort, exit: fakeSS)
+    XCTAssertEqual(
+      fakeSS.connectionCount, afterHit,
+      "未匹配目标在 bypass_all 下应直连")
+
+    performHTTPConnect(
+      httpPort: listen.httpPort, targetHost: "cdn.blocked.example", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > afterHit },
+      "HTTP 入站应应用同一自定义规则 ACL")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+GFWListACL.swift b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+GFWListACL.swift
new file mode 100644
index 000000000..db84c1642
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+GFWListACL.swift
@@ -0,0 +1,196 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class RealSslocalGFWListSmokeTests: RealSslocalSmokeTests {
+  /// 规则＋未匹配时直连：bypass_all + GFWList 代理候选。命中
+  /// GFWList 域名走代理；未匹配域名与 IP 字面目标直连；SOCKS 与 HTTP 共用 ACL。
+  func testRuleDirectDefaultACLRoutesGFWListProxyAndUnmatchedDirect() throws {
+    let echoServer = try LoopbackEchoServer()
+    let fakeSSServer = try ConnectionCountingServer()
+    let selectedPorts = try grabThreeListenPorts(excluding: [echoServer.port, fakeSSServer.port])
+    let listen = ProxyListeningConfiguration(
+      socksPort: selectedPorts[0], httpPort: selectedPorts[1])
+    let gfwRules = [
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example")),
+      ProxyRule(
+        action: .proxy, match: try RuleMatch(domainSuffix: "cdn.blocked.example")),
+    ]
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "gfw-smoke-server",
+          server: "127.0.0.1",
+          serverPort: fakeSSServer.port,
+          password: "smoke-password",
+          method: "aes-256-gcm",
+          plugin: nil,
+          pluginOpts: nil)
+      ],
+      listen: listen,
+      acl: ruleProbeACL(
+        defaultAction: .directWhenUnmatched,
+        rules: gfwRules))
+    XCTAssertTrue(document.isWellFormed)
+    let wrapper = try launchWrapper(document)
+    defer {
+      if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) }
+    }
+
+    try awaitGlobalInboundsReady(listen: listen, document: document)
+    try assertLocalTargetsBypass(listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+    try assertGFWListDirectDefaultRouting(
+      listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "gfwlist rule wrapper exits")
+  }
+
+  /// 原版 sslocal ACL 域名/IP 优先级：域名 proxy_list 先于
+  /// bypass_list，IP bypass_list 先于 proxy_list；两个入站共用同一 ACL。
+  func testRealSslocalDomainAndIPACLPriorityOnSOCKSAndHTTP() throws {
+    let echoServer = try LoopbackEchoServer()
+    let fakeSSServer = try ConnectionCountingServer()
+    let selectedPorts = try grabThreeListenPorts(excluding: [echoServer.port, fakeSSServer.port])
+    let listen = ProxyListeningConfiguration(
+      socksPort: selectedPorts[0], httpPort: selectedPorts[1])
+    let acl = priorityProbeACL()
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "priority-smoke-server",
+          server: "127.0.0.1",
+          serverPort: fakeSSServer.port,
+          password: "smoke-password",
+          method: "aes-256-gcm",
+          plugin: nil,
+          pluginOpts: nil)
+      ],
+      listen: listen,
+      acl: acl)
+    XCTAssertTrue(document.isWellFormed)
+    let wrapper = try launchWrapper(document)
+    defer {
+      if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) }
+    }
+
+    try awaitGlobalInboundsReady(listen: listen, document: document)
+    try assertDomainPriorityBeatsBypassList(listen: listen, fakeSS: fakeSSServer)
+    try assertIPPriorityBeatsProxyList(
+      listen: listen, echoPort: echoServer.port, fakeSS: fakeSSServer)
+
+    let afterHTTPBase = fakeSSServer.connectionCount
+    performHTTPConnect(httpPort: listen.httpPort, targetHost: "sub.example.com", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSSServer.connectionCount > afterHTTPBase },
+      "HTTP 入站应应用同一域名优先级")
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "priority wrapper exits")
+  }
+
+  /// 双列表优先级探针 ACL：域名与 IP 各有冲突项，用于观测 sslocal 真实匹配顺序。
+  private func priorityProbeACL() -> ProxyACLDocument {
+    let aclContent = """
+      [proxy_all]
+      [bypass_list]
+      10.0.0.0/8
+      172.16.0.0/12
+      192.168.0.0/16
+      169.254.0.0/16
+      ::1/128
+      fe80::/10
+      fc00::/7
+      ||localhost
+      ||local
+      ^[^.]+$
+      127.0.0.1/32
+      ||sub.example.com
+      [proxy_list]
+      ||example.com
+      127.0.0.0/8
+      """
+    let acl = ProxyACLDocument(
+      path: aclFileURL.standardizedFileURL.path,
+      summary: "priority-probe",
+      content: aclContent)
+    XCTAssertTrue(acl.isWellFormed)
+    return acl
+  }
+
+  /// 域名：proxy_list 的 `||example.com` 覆盖 bypass_list 的 `||sub.example.com`。
+  private func assertDomainPriorityBeatsBypassList(
+    listen: ProxyListeningConfiguration, fakeSS: ConnectionCountingServer
+  ) throws {
+    let beforeDomain = fakeSS.connectionCount
+    _ = performSocksConnectReply(
+      socksPort: listen.socksPort, targetHost: "sub.example.com", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > beforeDomain },
+      "域名优先级：proxy_list 应优先于 bypass_list")
+  }
+
+  /// IP：bypass_list 的 `127.0.0.1/32` 覆盖 proxy_list 的 `127.0.0.0/8`；
+  /// 同 CIDR 内未单列直连的 IP 仍走 proxy_list。
+  private func assertIPPriorityBeatsProxyList(
+    listen: ProxyListeningConfiguration, echoPort: Int, fakeSS: ConnectionCountingServer
+  ) throws {
+    let beforeIP = fakeSS.connectionCount
+    let payload = Array("priority direct\n".utf8)
+    XCTAssertEqual(
+      try performDirectSocksEcho(
+        socksPort: listen.socksPort, targetPort: echoPort, payload: payload),
+      payload)
+    XCTAssertEqual(
+      fakeSS.connectionCount, beforeIP,
+      "IP 优先级：bypass_list 应优先于 proxy_list")
+
+    _ = performSocksConnectReply(
+      socksPort: listen.socksPort,
+      request: socksIPv4ConnectRequest([127, 0, 0, 2], port: echoPort))
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > beforeIP },
+      "未在 bypass_list 单列的 IP 应命中 proxy_list CIDR")
+  }
+
+  /// GFWList「未匹配时直连」路由断言：命中代理候选走 SS；未匹配域名与 IP
+  /// 字面目标不触达 SS（bypass_all 默认直连）。
+  func assertGFWListDirectDefaultRouting(
+    listen: ProxyListeningConfiguration, echoPort: Int, fakeSS: ConnectionCountingServer
+  ) throws {
+    let beforeHit = fakeSS.connectionCount
+    _ = performSocksConnectReply(
+      socksPort: listen.socksPort, targetHost: "blocked.example", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > beforeHit },
+      "GFWList 代理候选应连接 Shadowsocks 出口")
+
+    let afterHit = fakeSS.connectionCount
+    _ = performSocksConnectReply(
+      socksPort: listen.socksPort, targetHost: "cdn.blocked.example", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > afterHit },
+      "GFWList 子域代理候选应连接 Shadowsocks 出口")
+
+    let afterMatched = fakeSS.connectionCount
+    try assertDirectDomain(
+      "unmatched.example.org", listen: listen, echoPort: echoPort, exit: fakeSS)
+    XCTAssertEqual(
+      fakeSS.connectionCount, afterMatched,
+      "未匹配域名在 bypass_all 下应直连，不得触达 Shadowsocks 出口")
+
+    let payload = Array("unmatched IP direct\n".utf8)
+    XCTAssertEqual(
+      try performDirectSocksEcho(
+        socksPort: listen.socksPort, targetPort: echoPort, payload: payload),
+      payload)
+    XCTAssertEqual(
+      fakeSS.connectionCount, afterMatched,
+      "未命中规则的 IP 字面目标应直连")
+
+    performHTTPConnect(httpPort: listen.httpPort, targetHost: "blocked.example", targetPort: 443)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 5) { fakeSS.connectionCount > afterMatched },
+      "HTTP 入站应应用同一 GFWList ACL")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+Loopback.swift b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+Loopback.swift
new file mode 100644
index 000000000..f951fea70
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+Loopback.swift
@@ -0,0 +1,400 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension RealSslocalSmokeTests {
+  private func connectLoopback(port: Int) throws -> Int32 {
+    let socketFD = socket(AF_INET, SOCK_STREAM, 0)
+    guard socketFD >= 0 else { throw POSIXError(.ENOTSOCK) }
+    var timeout = timeval(tv_sec: 5, tv_usec: 0)
+    _ = setsockopt(
+      socketFD, SOL_SOCKET, SO_RCVTIMEO, &timeout, socklen_t(MemoryLayout<timeval>.size))
+
+    var address = sockaddr_in()
+    address.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_addr.s_addr = INADDR_LOOPBACK.bigEndian
+    address.sin_port = in_port_t(port).bigEndian
+    let connectResult = withUnsafePointer(to: &address) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        connect(socketFD, sockaddrPointer, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    guard connectResult == 0 else {
+      Darwin.close(socketFD)
+      throw POSIXError(.ECONNREFUSED)
+    }
+    return socketFD
+  }
+
+  func performDirectSocksEcho(
+    socksPort: Int, targetPort: Int, payload: [UInt8]
+  ) throws -> [UInt8] {
+    let socketFD = try connectLoopback(port: socksPort)
+    defer { Darwin.close(socketFD) }
+    let greeting: [UInt8] = [0x05, 0x01, 0x00]
+    _ = try greeting.withUnsafeBytes { try writeAll(socketFD, $0) }
+    XCTAssertEqual(try readExactly(socketFD, count: 2), [0x05, 0x00])
+
+    let portBytes = UInt16(targetPort).bigEndian
+    var request: [UInt8] = [0x05, 0x01, 0x00, 0x01, 127, 0, 0, 1]
+    withUnsafeBytes(of: portBytes) { request.append(contentsOf: $0) }
+    _ = try request.withUnsafeBytes { try writeAll(socketFD, $0) }
+    let reply = try readExactly(socketFD, count: 10)
+    XCTAssertEqual(reply[1], 0, "空服务器直连模式应连接本地回环目标")
+
+    _ = try payload.withUnsafeBytes { try writeAll(socketFD, $0) }
+    return try readExactly(socketFD, count: payload.count)
+  }
+
+  func performDirectHTTPEcho(
+    httpPort: Int, targetHost: String = "127.0.0.1", targetPort: Int, payload: [UInt8]
+  ) throws -> [UInt8] {
+    let socketFD = try connectLoopback(port: httpPort)
+    defer { Darwin.close(socketFD) }
+    let request =
+      "CONNECT \(targetHost):\(targetPort) HTTP/1.1\r\n"
+      + "Host: \(targetHost):\(targetPort)\r\n\r\n"
+    let requestBytes = Array(request.utf8)
+    _ = try requestBytes.withUnsafeBytes { try writeAll(socketFD, $0) }
+
+    var response: [UInt8] = []
+    while response.count < 4 || Array(response.suffix(4)) != [13, 10, 13, 10] {
+      response.append(contentsOf: try readExactly(socketFD, count: 1))
+      guard response.count < 4096 else { throw NSError(domain: "smoke", code: 3) }
+    }
+    let header = String(bytes: response, encoding: .utf8) ?? ""
+    XCTAssertTrue(header.contains(" 200 "), "HTTP CONNECT 应答成功：\(header)")
+    _ = try payload.withUnsafeBytes { try writeAll(socketFD, $0) }
+    return try readExactly(socketFD, count: payload.count)
+  }
+
+  /// 对公网目标发起 SOCKS5 CONNECT，返回应答码；代理出口不可用时应答非 0
+  /// 也算完成路由观测（不直连真实目标）。
+  func performSocksConnectReply(
+    socksPort: Int, targetHost: String, targetPort: Int
+  ) -> UInt8? {
+    var request: [UInt8] = [0x05, 0x01, 0x00, 0x03, UInt8(targetHost.utf8.count)]
+    request.append(contentsOf: targetHost.utf8)
+    let portBytes = UInt16(targetPort).bigEndian
+    withUnsafeBytes(of: portBytes) { request.append(contentsOf: $0) }
+    return performSocksConnectReply(socksPort: socksPort, request: request)
+  }
+
+  func performSocksConnectReply(socksPort: Int, request: [UInt8]) -> UInt8? {
+    guard let socketFD = try? connectLoopback(port: socksPort) else { return nil }
+    defer { Darwin.close(socketFD) }
+    do {
+      let greeting: [UInt8] = [0x05, 0x01, 0x00]
+      _ = try greeting.withUnsafeBytes { try writeAll(socketFD, $0) }
+      _ = try readExactly(socketFD, count: 2)
+      _ = try request.withUnsafeBytes { try writeAll(socketFD, $0) }
+      let reply = try readExactly(socketFD, count: 4)
+      return reply[1]
+    } catch {
+      return nil
+    }
+  }
+
+  /// 按给定 CONNECT 请求完成 SOCKS 会话并回显载荷；`successMessage` 用于
+  /// 断言失败时点名场景。
+  func performSocksEcho(
+    socksPort: Int, request: [UInt8], payload: [UInt8], successMessage: String
+  ) throws -> [UInt8] {
+    let socketFD = try connectLoopback(port: socksPort)
+    defer { Darwin.close(socketFD) }
+    let greeting: [UInt8] = [0x05, 0x01, 0x00]
+    _ = try greeting.withUnsafeBytes { try writeAll(socketFD, $0) }
+    XCTAssertEqual(try readExactly(socketFD, count: 2), [0x05, 0x00])
+    _ = try request.withUnsafeBytes { try writeAll(socketFD, $0) }
+    let reply = try readExactly(socketFD, count: 10)
+    XCTAssertEqual(reply[1], 0, successMessage)
+    _ = try payload.withUnsafeBytes { try writeAll(socketFD, $0) }
+    return try readExactly(socketFD, count: payload.count)
+  }
+
+  func socksDomainConnectRequest(host: String, port: Int) -> [UInt8] {
+    var request: [UInt8] = [0x05, 0x01, 0x00, 0x03, UInt8(host.utf8.count)]
+    request.append(contentsOf: host.utf8)
+    let portBytes = UInt16(port).bigEndian
+    withUnsafeBytes(of: portBytes) { request.append(contentsOf: $0) }
+    return request
+  }
+
+  /// SOCKS5 CONNECT 到 IPv6 回环（ATYP=0x04）。
+  func socksIPv6ConnectRequest(port: Int) -> [UInt8] {
+    var request: [UInt8] = [0x05, 0x01, 0x00, 0x04]
+    request.append(contentsOf: Array(repeating: 0, count: 15))
+    request.append(1)  // ::1
+    let portBytes = UInt16(port).bigEndian
+    withUnsafeBytes(of: portBytes) { request.append(contentsOf: $0) }
+    return request
+  }
+
+  /// SOCKS5 CONNECT 到 IPv4 字面量（ATYP=0x01），用于域名/IP 优先级断言。
+  func socksIPv4ConnectRequest(_ octets: [UInt8], port: Int) -> [UInt8] {
+    precondition(octets.count == 4, "IPv4 request needs 4 octets")
+    var request: [UInt8] = [0x05, 0x01, 0x00, 0x01]
+    request.append(contentsOf: octets)
+    let portBytes = UInt16(port).bigEndian
+    withUnsafeBytes(of: portBytes) { request.append(contentsOf: $0) }
+    return request
+  }
+
+  /// 对公网目标发起 HTTP CONNECT（应答头读到即返回，不要求成功）。
+  func performHTTPConnect(
+    httpPort: Int, targetHost: String, targetPort: Int
+  ) {
+    guard let socketFD = try? connectLoopback(port: httpPort) else { return }
+    defer { Darwin.close(socketFD) }
+    do {
+      let request =
+        "CONNECT \(targetHost):\(targetPort) HTTP/1.1\r\n"
+        + "Host: \(targetHost):\(targetPort)\r\n\r\n"
+      let requestBytes = Array(request.utf8)
+      _ = try requestBytes.withUnsafeBytes { try writeAll(socketFD, $0) }
+      var response: [UInt8] = []
+      while response.count < 4 || Array(response.suffix(4)) != [13, 10, 13, 10] {
+        response.append(contentsOf: try readExactly(socketFD, count: 1))
+        guard response.count < 4096 else { return }
+      }
+    } catch {
+      return
+    }
+  }
+
+  /// 抓取三个互不冲突且避开给定端口的临时回环端口。
+  func grabThreeListenPorts(excluding occupied: [Int] = []) throws -> [Int] {
+    var ports = Set<Int>()
+    while ports.count < 3 {
+      let port = try grabEphemeralLoopbackPort()
+      if !occupied.contains(port) { ports.insert(port) }
+    }
+    return Array(ports)
+  }
+
+  /// Domain/CIDR probes must not pass through the fixed loopback bypass instead.
+  /// Dedicated global-ACL tests cover that bypass separately.
+  func ruleProbeACL(defaultAction: RuleDefaultAction, rules: [ProxyRule]) -> ProxyACLDocument {
+    let compiled = ProxyACLDocument.rule(at: aclFileURL, defaultAction: defaultAction, rules: rules)
+    let content =
+      compiled.content.split(separator: "\n").filter { $0 != "127.0.0.0/8" }
+      .joined(separator: "\n") + "\n"
+    return ProxyACLDocument(path: compiled.path, summary: compiled.summary, content: content)
+  }
+
+  func assertDirectDomain(
+    _ host: String, listen: ProxyListeningConfiguration, echoPort: Int,
+    exit: ConnectionCountingServer
+  ) throws {
+    let before = exit.connectionCount
+    let payload = Array("direct domain\n".utf8)
+    XCTAssertEqual(
+      try performSocksEcho(
+        socksPort: listen.socksPort,
+        request: socksDomainConnectRequest(host: host, port: echoPort), payload: payload,
+        successMessage: "Domain must connect directly: \(host)"), payload)
+    XCTAssertEqual(exit.connectionCount, before)
+  }
+
+  /// 优雅停止 wrapper 并断言干净退出（退出码 0）。
+  func stopWrapperAndAssertCleanExit(_ wrapper: Process, description: String) {
+    guard wrapper.isRunning else {
+      XCTAssertEqual(wrapper.terminationStatus, 0, description)
+      return
+    }
+    let descendants = descendantPIDs(of: wrapper.processIdentifier)
+    kill(wrapper.processIdentifier, SIGTERM)
+    let exited = (try? waitForCondition(timeout: 10) { !wrapper.isRunning }) == true
+    XCTAssertTrue(exited, description)
+    if !exited {
+      for child in descendants.reversed() where kill(child, 0) == 0 { kill(child, SIGKILL) }
+      kill(wrapper.processIdentifier, SIGKILL)
+      XCTAssertTrue((try? waitForCondition(timeout: 2) { !wrapper.isRunning }) == true)
+    }
+    if !wrapper.isRunning { XCTAssertEqual(wrapper.terminationStatus, 0, description) }
+  }
+
+  /// 断言运行回执已发布、进程存活且拥有契约内全部本地监听。
+  func assertReceiptOwnsListeners(document: SslocalRuntimeDocument) throws {
+    let runtimeStore = RuntimeFileStore(fileURL: contractURL)
+    let receiptPublished = try waitForCondition(timeout: 30) {
+      guard let receipt = runtimeStore.readRuntimeReceipt() else { return false }
+      return receipt.deploymentID == runtimeStore.receiptIdentity(for: document)
+        && kill(receipt.processID, 0) == 0
+    }
+    guard receiptPublished else {
+      let logURL = workDir.appendingPathComponent("agent.log")
+      let log = (try? String(contentsOf: logURL, encoding: .utf8)) ?? "agent.log unavailable"
+      throw NSError(
+        domain: "RuntimePublicationSmoke", code: 1,
+        userInfo: [NSLocalizedDescriptionKey: "未发布当前部署的存活子进程回执；\(log)"])
+    }
+    let receipt = try XCTUnwrap(runtimeStore.readRuntimeReceipt())
+    for local in document.locals {
+      XCTAssertTrue(
+        RuntimeSocketOwnershipProbe.process(
+          receipt.processID, ownsTCPListenerOn: local.localPort),
+        "回执对应的 sslocal 应拥有 \(local.inboundProtocol) TCP 监听")
+    }
+    XCTAssertEqual(
+      runtimeStore.readRuntimeReceipt()?.deploymentID,
+      runtimeStore.receiptIdentity(for: document))
+  }
+}
+
+final class LoopbackEchoServer {
+  private let descriptor: Int32
+  let port: Int
+
+  init() throws {
+    let listener = try Self.listenOnLoopback()
+    self.descriptor = listener.descriptor
+    port = listener.port
+    Self.echoForever(on: listener.descriptor)
+  }
+
+  deinit {
+    shutdown(descriptor, SHUT_RDWR)
+    Darwin.close(descriptor)
+  }
+
+  /// 建立监听 socket 并返回其描述符与实际绑定端口。
+  private static func listenOnLoopback() throws -> (descriptor: Int32, port: Int) {
+    let descriptor = socket(AF_INET, SOCK_STREAM, 0)
+    guard descriptor >= 0 else { throw POSIXError(.ENOTSOCK) }
+
+    var address = sockaddr_in()
+    address.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_addr.s_addr = INADDR_LOOPBACK.bigEndian
+    address.sin_port = 0
+    let bindResult = withUnsafePointer(to: &address) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        Darwin.bind(descriptor, sockaddrPointer, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    guard bindResult == 0, Darwin.listen(descriptor, 4) == 0 else {
+      Darwin.close(descriptor)
+      throw POSIXError(.EADDRINUSE)
+    }
+
+    var boundAddress = sockaddr_in()
+    var length = socklen_t(MemoryLayout<sockaddr_in>.size)
+    let nameResult = withUnsafeMutablePointer(to: &boundAddress) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        getsockname(descriptor, sockaddrPointer, &length)
+      }
+    }
+    guard nameResult == 0 else {
+      Darwin.close(descriptor)
+      throw POSIXError(.EINVAL)
+    }
+    return (descriptor, Int(CFSwapInt16BigToHost(boundAddress.sin_port)))
+  }
+
+  /// 常驻 echo 循环：逐行读入并原样写回。
+  private static func echoForever(on descriptor: Int32) {
+    DispatchQueue.global().async { [descriptor] in
+      while true {
+        let connection = accept(descriptor, nil, nil)
+        guard connection >= 0 else { return }
+        var bytes: [UInt8] = []
+        while !bytes.contains(10) {
+          var chunk = [UInt8](repeating: 0, count: 512)
+          let received = chunk.withUnsafeMutableBytes { buffer in
+            read(connection, buffer.baseAddress!, buffer.count)
+          }
+          guard received > 0 else { break }
+          bytes.append(contentsOf: chunk.prefix(received))
+        }
+        if !bytes.isEmpty {
+          bytes.withUnsafeBytes { buffer in
+            _ = write(connection, buffer.baseAddress!, buffer.count)
+          }
+        }
+        shutdown(connection, SHUT_RDWR)
+        Darwin.close(connection)
+      }
+    }
+  }
+}
+
+/// 只接受 TCP 连接并计数的假 SS 服务器：证明目标被路由进代理出口，而非
+/// 真实完成 Shadowsocks 握手（数据面属发布门槛人工验收）。
+final class ConnectionCountingServer {
+  private let descriptor: Int32
+  let port: Int
+  private let counter = CounterBox()
+
+  var connectionCount: Int { counter.value }
+
+  init() throws {
+    let descriptor = socket(AF_INET, SOCK_STREAM, 0)
+    guard descriptor >= 0 else { throw POSIXError(.ENOTSOCK) }
+
+    var address = sockaddr_in()
+    address.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_addr.s_addr = INADDR_LOOPBACK.bigEndian
+    address.sin_port = 0
+    let bindResult = withUnsafePointer(to: &address) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        Darwin.bind(descriptor, sockaddrPointer, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    guard bindResult == 0, Darwin.listen(descriptor, 8) == 0 else {
+      Darwin.close(descriptor)
+      throw POSIXError(.EADDRINUSE)
+    }
+
+    var boundAddress = sockaddr_in()
+    var length = socklen_t(MemoryLayout<sockaddr_in>.size)
+    let nameResult = withUnsafeMutablePointer(to: &boundAddress) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        getsockname(descriptor, sockaddrPointer, &length)
+      }
+    }
+    guard nameResult == 0 else {
+      Darwin.close(descriptor)
+      throw POSIXError(.EINVAL)
+    }
+
+    self.descriptor = descriptor
+    port = Int(CFSwapInt16BigToHost(boundAddress.sin_port))
+    let counter = self.counter
+    DispatchQueue.global().async { [descriptor] in
+      while true {
+        let connection = accept(descriptor, nil, nil)
+        guard connection >= 0 else { return }
+        counter.increment()
+        // 立刻断开：sslocal 的 SS 握手会失败，但 TCP 连接已被观察到。
+        shutdown(connection, SHUT_RDWR)
+        Darwin.close(connection)
+      }
+    }
+  }
+
+  deinit {
+    shutdown(descriptor, SHUT_RDWR)
+    Darwin.close(descriptor)
+  }
+
+  private final class CounterBox: @unchecked Sendable {
+    private let lock = NSLock()
+    private var count = 0
+
+    var value: Int {
+      lock.lock()
+      defer { lock.unlock() }
+      return count
+    }
+
+    func increment() {
+      lock.lock()
+      count += 1
+      lock.unlock()
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+Plugin.swift b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+Plugin.swift
new file mode 100644
index 000000000..9265b4971
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+Plugin.swift
@@ -0,0 +1,90 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class RealSslocalPluginSmokeTests: RealSslocalSmokeTests {
+  // MARK: - 受管插件端到端
+
+  /// 受管插件端到端边界：契约携带 bundle 内插件绝对路径 → sslocal
+  /// 拉起 → SIP003 插件进程建立 → 停止链随 sslocal 一并退出。插件进程退出会
+  /// 连带 sslocal 退出（以 sslocal 信号为准）；真实服务器数据面验证属发布
+  /// 真实服务器数据面验证属于发布门槛人工项；此处只验证进程边界。
+  func testRealSslocalLaunchesManagedV2rayPluginProcess() throws {
+    let pluginURL = AppArtifact.bundleURL.appendingPathComponent(
+      "Contents/Helpers/Plugins/v2ray-plugin")
+    _ = try XCTUnwrap(
+      FileManager.default.isExecutableFile(atPath: pluginURL.path) ? pluginURL : nil,
+      "v2ray-plugin 未嵌入 app bundle（先跑 fetch-external-binaries.sh）")
+    var ports = Set<Int>()
+    while ports.count < 2 {
+      ports.insert(try grabEphemeralLoopbackPort())
+    }
+    let selectedPorts = Array(ports)
+    let socksPort = selectedPorts[0]
+    let httpPort = selectedPorts[1]
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "smoke-plugin-server",
+          server: "127.0.0.1",
+          serverPort: 1,  // 远端必然拒绝：只验证本地链路与插件进程边界
+          password: "smoke-password",
+          method: "aes-256-gcm",
+          plugin: pluginURL.path,
+          pluginOpts: "mode=websocket")
+      ],
+      listen: ProxyListeningConfiguration(
+        socksPort: socksPort, httpPort: httpPort))
+    let wrapper = try launchWrapper(document)
+    let store = RuntimeFileStore(fileURL: contractURL)
+    XCTAssertTrue(try waitForCondition(timeout: 15) { store.readRuntimeReceipt() != nil })
+    let child = try XCTUnwrap(store.readRuntimeReceipt()).processID
+
+    var pluginPIDs: [Int32] = []
+
+    // 插件进程建立：sslocal 按 SIP003 拉起 bundle 内 v2ray-plugin 并保持运行
+    // （sslocal 先等插件就绪再绑定本地监听，进程先于端口出现）。
+    XCTAssertTrue(
+      try waitForCondition(timeout: 15) {
+        pluginPIDs = self.pluginProcessIDs(path: pluginURL.path, parent: child)
+        return !pluginPIDs.isEmpty
+      },
+      "sslocal 应拉起 bundle 内 v2ray-plugin 进程")
+
+    XCTAssertTrue(
+      try waitForCondition(timeout: 15) {
+        EndpointHealthProbe.probe(host: "127.0.0.1", port: socksPort, timeout: 1) == .reachable
+      },
+      "15 秒内本地 SOCKS 端口应完成监听绑定")
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "wrapper exits")
+    XCTAssertTrue(
+      try waitForCondition(timeout: 8) {
+        pluginPIDs.allSatisfy { kill($0, 0) != 0 }
+      },
+      "停止链应连带结束插件进程")
+  }
+
+  /// 按完整可执行路径检索进程（pgrep 全命令行匹配）。
+  private func pluginProcessIDs(path: String, parent: Int32) -> [Int32] {
+    let pgrep = Process()
+    pgrep.executableURL = URL(fileURLWithPath: "/usr/bin/pgrep")
+    pgrep.arguments = ["-P", String(parent), "-f", path]
+    let pipe = Pipe()
+    pgrep.standardOutput = pipe
+    pgrep.standardError = FileHandle.nullDevice
+    do {
+      try pgrep.run()
+    } catch {
+      return []
+    }
+    guard (try? waitForCondition(timeout: 2) { !pgrep.isRunning }) == true else {
+      kill(pgrep.processIdentifier, SIGKILL)
+      return []
+    }
+    let data = pipe.fileHandleForReading.readDataToEndOfFile()
+    return (String(data: data, encoding: .utf8) ?? "")
+      .split(whereSeparator: \.isWhitespace).compactMap { Int32($0) }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+RulePresets.swift b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+RulePresets.swift
new file mode 100644
index 000000000..e480ef11f
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+RulePresets.swift
@@ -0,0 +1,70 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension RealSslocalACLRoutingSmokeTests {
+  func testChinaProxyPresetRoutesChinaTargetsThroughProxyAndOtherTargetsDirect() throws {
+    let echo = try LoopbackEchoServer()
+    let exit = try ConnectionCountingServer()
+    let ports = try grabThreeListenPorts(excluding: [echo.port, exit.port])
+    let listen = ProxyListeningConfiguration(socksPort: ports[0], httpPort: ports[1])
+    let metadata = try BuiltinRuleCatalog.loadGeolocationCN(from: AppArtifact.bundle).metadata
+    let snapshot = RuleSnapshot(
+      metadata: metadata,
+      rules: [
+        ProxyRule(action: .direct, match: try RuleMatch(nationalDomainSuffix: "cn")),
+        ProxyRule(action: .direct, match: try RuleMatch(domainSuffix: "china-target.example.org")),
+        ProxyRule(action: .direct, match: try RuleMatch(ipv4CIDR: "127.0.0.1/32")),
+      ])
+    let preset = RulePreset.chinaProxy
+    for probeCIDR in [false, true] {
+      let candidates = preset.rules(from: snapshot).filter { rule in
+        if case .ipv4CIDR = rule.match.pattern { return probeCIDR }
+        return true
+      }
+      let acl =
+        probeCIDR
+        ? ruleProbeACL(defaultAction: preset.defaultAction, rules: candidates)
+        : ProxyACLDocument.rule(
+          at: aclFileURL, defaultAction: preset.defaultAction, rules: candidates)
+      let document = SslocalRuntimeDocument(
+        servers: [
+          SslocalServerDocument(
+            id: "china-proxy", server: "127.0.0.1", serverPort: exit.port,
+            password: "smoke-password", method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+        ],
+        listen: listen, acl: acl)
+      let wrapper = try launchWrapper(document)
+      defer { if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) } }
+      try awaitGlobalInboundsReady(listen: listen, document: document)
+      try assertReceiptOwnsListeners(document: document)
+      for host in probeCIDR ? ["127.0.0.1"] : ["example.cn", "china-target.example.org"] {
+        let before = exit.connectionCount
+        _ = performSocksConnectReply(
+          socksPort: listen.socksPort, targetHost: host, targetPort: echo.port)
+        XCTAssertTrue(try waitForCondition(timeout: 5) { exit.connectionCount > before })
+        let afterSOCKS = exit.connectionCount
+        performHTTPConnect(httpPort: listen.httpPort, targetHost: host, targetPort: echo.port)
+        XCTAssertTrue(try waitForCondition(timeout: 5) { exit.connectionCount > afterSOCKS })
+      }
+      if !probeCIDR { try assertChinaPresetDirectTargets(listen: listen, echo: echo, exit: exit) }
+      stopWrapperAndAssertCleanExit(wrapper, description: "China proxy preset wrapper exits")
+    }
+  }
+}
+
+extension RealSslocalACLRoutingSmokeTests {
+  private func assertChinaPresetDirectTargets(
+    listen: ProxyListeningConfiguration, echo: LoopbackEchoServer, exit: ConnectionCountingServer
+  ) throws {
+    let before = exit.connectionCount
+    try assertDirectDomain("unmatched.example.org", listen: listen, echoPort: echo.port, exit: exit)
+    let payload = Array("default direct\n".utf8)
+    XCTAssertEqual(
+      try performDirectHTTPEcho(
+        httpPort: listen.httpPort, targetHost: "unmatched.example.org", targetPort: echo.port,
+        payload: payload), payload)
+    XCTAssertEqual(exit.connectionCount, before)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+RuleSemantics.swift b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+RuleSemantics.swift
new file mode 100644
index 000000000..c799dca5c
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests+RuleSemantics.swift
@@ -0,0 +1,117 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class RealSslocalRuleSemanticsSmokeTests: RealSslocalSmokeTests {
+  override var usesLocalDNS: Bool { false }
+  func testRuleSemanticsWithProxyDefaultAndReversedOrder() throws {
+    try assertRuleSemantics(defaultHeader: "[proxy_all]", unmatchedProxies: true)
+  }
+
+  func testRuleSemanticsWithDirectDefaultAndReversedOrder() throws {
+    try assertRuleSemantics(defaultHeader: "[bypass_all]", unmatchedProxies: false)
+  }
+
+  /// Test-only dual-list ACL: product proxy-default intentionally omits proxy_list.
+  /// Only loopback IPs and reserved .invalid domains are requested. Opposite
+  /// defaults distinguish actual rule hits from an unmatched default result.
+  private func assertRuleSemantics(defaultHeader: String, unmatchedProxies: Bool) throws {
+    let echo = try LoopbackEchoServer()
+    let exit = try ConnectionCountingServer()
+    let bypass = [
+      "||overlap.invalid", "||partial.invalid",
+    ]
+    let proxy = [
+      "127.0.0.0/8", "::ffff:127.0.0.0/120",
+      "||overlap.invalid", "|a.partial.invalid",
+      "|exact.invalid", "||suffix.invalid",
+    ]
+    for reversed in [false, true] {
+      let ports = try grabThreeListenPorts(excluding: [echo.port, exit.port])
+      let listen = ProxyListeningConfiguration(socksPort: ports[0], httpPort: ports[1])
+      let bypass = bypass + [reversed ? "::ffff:127.0.0.1/128" : "127.0.0.1/32"]
+      let lines =
+        [defaultHeader, "[bypass_list]"]
+        + (reversed ? Array(bypass.reversed()) : bypass) + ["[proxy_list]"]
+        + (reversed ? Array(proxy.reversed()) : proxy)
+      let document = SslocalRuntimeDocument(
+        servers: [
+          SslocalServerDocument(
+            id: "rule-semantics", server: "127.0.0.1", serverPort: exit.port,
+            password: "smoke-password", method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+        ],
+        listen: listen,
+        acl: ProxyACLDocument(
+          path: aclFileURL.path, summary: "rule-semantics",
+          content: lines.joined(separator: "\n") + "\n"))
+      let wrapper = try launchWrapper(document)
+      defer { if wrapper.isRunning { kill(wrapper.processIdentifier, SIGTERM) } }
+      try awaitGlobalInboundsReady(listen: listen, document: document)
+      try assertDomainRuleSemantics(
+        listen: listen, exit: exit, port: echo.port, unmatchedProxies: unmatchedProxies)
+      let before = exit.connectionCount
+      XCTAssertEqual(
+        performSocksConnectReply(
+          socksPort: listen.socksPort,
+          request: mappedConnectRequest([127, 0, 0, 1], port: echo.port)), 0)
+      XCTAssertEqual(
+        performSocksConnectReply(
+          socksPort: listen.socksPort,
+          request: socksIPv4ConnectRequest([127, 0, 0, 1], port: echo.port)), 0)
+      XCTAssertEqual(exit.connectionCount, before, "Mapped and IPv4 bypass both protect loopback")
+      try assertRuleRoute(
+        socksPort: listen.socksPort, exit: exit,
+        request: mappedConnectRequest([127, 0, 0, 2], port: echo.port), proxies: true,
+        description: "IP overlap keeps remaining proxy targets")
+      stopWrapperAndAssertCleanExit(wrapper, description: "rule semantics wrapper exits")
+    }
+  }
+
+  private func assertDomainRuleSemantics(
+    listen: ProxyListeningConfiguration, exit: ConnectionCountingServer, port: Int,
+    unmatchedProxies: Bool
+  ) throws {
+    for host in [
+      "overlap.invalid", "a.overlap.invalid", "a.partial.invalid",
+      "exact.invalid", "suffix.invalid", "a.suffix.invalid",
+    ] {
+      try assertRuleRoute(
+        socksPort: listen.socksPort, exit: exit,
+        request: socksDomainConnectRequest(host: host, port: port), proxies: true,
+        description: host)
+    }
+    try assertRuleRoute(
+      socksPort: listen.socksPort, exit: exit,
+      request: socksDomainConnectRequest(host: "b.partial.invalid", port: port),
+      proxies: false, description: "partial overlap keeps remaining direct targets")
+    for host in ["a.exact.invalid", "notsuffix.invalid"] {
+      try assertRuleRoute(
+        socksPort: listen.socksPort, exit: exit,
+        request: socksDomainConnectRequest(host: host, port: port),
+        proxies: unmatchedProxies, description: "unmatched boundary: \(host)")
+    }
+  }
+
+  private func assertRuleRoute(
+    socksPort: Int, exit: ConnectionCountingServer, request: [UInt8],
+    proxies: Bool, description: String
+  ) throws {
+    let before = exit.connectionCount
+    let reply = performSocksConnectReply(socksPort: socksPort, request: request)
+    XCTAssertNotNil(reply, "SOCKS routing request completed: \(description)")
+    if proxies {
+      XCTAssertTrue(try waitForCondition(timeout: 5) { exit.connectionCount > before }, description)
+    } else {
+      Thread.sleep(forTimeInterval: 0.2)
+      XCTAssertEqual(exit.connectionCount, before, description)
+    }
+  }
+
+  private func mappedConnectRequest(_ octets: [UInt8], port: Int) -> [UInt8] {
+    var request: [UInt8] = [5, 1, 0, 4]
+    request += Array(repeating: 0, count: 10) + [255, 255] + octets
+    withUnsafeBytes(of: UInt16(port).bigEndian) { request.append(contentsOf: $0) }
+    return request
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests.swift b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests.swift
new file mode 100644
index 000000000..8df0a2ed7
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/RealSslocalSmokeTests.swift
@@ -0,0 +1,303 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 真实 sslocal 冒烟：wrapper 驱动 bundle 内 sslocal v1.26.0——本地 SOCKS 端口
+/// 完成监听绑定，并完成一次完整 SOCKS5 握手（方法
+/// 协商 + CONNECT 请求得到按协议的应答）。远端服务器不可达只影响应答码，不
+/// 影响握手本身（真实服务器功能验证属发布门槛人工检查项）。
+class RealSslocalSmokeTests: XCTestCase {
+  private var wrappers: [Process] = []
+  private var dns: LoopbackDNSResponder!
+  var usesLocalDNS: Bool { true }
+  var workDir: URL!
+  var contractURL: URL!
+
+  override func setUpWithError() throws {
+    try super.setUpWithError()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-smoke-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    contractURL = workDir.appendingPathComponent("sslocal-active.json")
+    if usesLocalDNS { dns = try LoopbackDNSResponder() }
+  }
+
+  override func tearDownWithError() throws {
+    for wrapper in wrappers where wrapper.isRunning {
+      stopWrapperAndAssertCleanExit(wrapper, description: "teardown wrapper exits")
+    }
+    wrappers.removeAll()
+    dns = nil
+    try? FileManager.default.removeItem(at: workDir)
+    try super.tearDownWithError()
+  }
+
+  /// `RuntimeFileStore.write` 校验的 ACL sidecar 路径：ACL 文档的 `path` 必须
+  /// 严格等于它，否则契约写入即抛「ACL sidecar path or digest is invalid」。
+  var aclFileURL: URL {
+    RuntimeFileStore(fileURL: contractURL).aclFileURL
+  }
+
+  private var sslocalURL: URL {
+    get throws {
+      let url = AppArtifact.bundleURL.appendingPathComponent("Contents/Helpers/sslocal")
+      return try XCTUnwrap(
+        FileManager.default.fileExists(atPath: url.path) ? url : nil,
+        "sslocal 未嵌入 app bundle（先跑 fetch-external-binaries.sh）")
+    }
+  }
+
+  /// 绑定回环临时端口拿到空闲端口号后释放。
+  func grabEphemeralLoopbackPort() throws -> Int {
+    let socketFD = socket(AF_INET, SOCK_STREAM, 0)
+    guard socketFD >= 0 else { throw POSIXError(.ENOTSOCK) }
+    defer { close(socketFD) }
+
+    var address = sockaddr_in()
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_addr.s_addr = INADDR_LOOPBACK.bigEndian
+    address.sin_port = 0
+    let bindResult = withUnsafePointer(to: &address) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        Darwin.bind(socketFD, sockaddrPointer, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    XCTAssertEqual(bindResult, 0)
+    XCTAssertEqual(listen(socketFD, 1), 0)
+
+    var boundAddress = sockaddr_in()
+    var length = socklen_t(MemoryLayout<sockaddr_in>.size)
+    let nameResult = withUnsafeMutablePointer(to: &boundAddress) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        getsockname(socketFD, sockaddrPointer, &length)
+      }
+    }
+    XCTAssertEqual(nameResult, 0)
+    return Int(CFSwapInt16BigToHost(boundAddress.sin_port))
+  }
+
+  /// 写入给定契约并拉起 wrapper（契约内容由调用方构造：无插件与插件场景各异）。
+  func launchWrapper(
+    _ document: SslocalRuntimeDocument, publish: Bool = true, startupDelay: TimeInterval = 0
+  ) throws -> Process {
+    if publish { try RuntimeFileStore(fileURL: contractURL).write(document) }
+
+    let wrapperURL = AppArtifact.bundleURL.appendingPathComponent(
+      "Contents/MacOS/ShadowsocksX-NG2Agent")
+    let process = Process()
+    process.executableURL = wrapperURL
+    var environment = ProcessInfo.processInfo.environment
+    environment["SSXNG_CONTRACT_PATH"] = contractURL.path
+    if usesLocalDNS || startupDelay > 0 {
+      // exec preserves the PID supervised by the real wrapper, including delayed startup.
+      let launcher = workDir.appendingPathComponent("sslocal-with-local-dns")
+      let executable = try sslocalURL.path.replacingOccurrences(of: "'", with: "'\"'\"'")
+      let dnsArguments = usesLocalDNS ? " --dns udp://127.0.0.1:\(dns.port)" : ""
+      let delay = startupDelay > 0 ? "sleep \(startupDelay)\n" : ""
+      let script = "#!/bin/sh\n\(delay)exec '\(executable)'\(dnsArguments) \"$@\"\n"
+      try script.write(to: launcher, atomically: true, encoding: .utf8)
+      try FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: launcher.path)
+      environment["SSXNG_SSLOCAL_PATH"] = launcher.path
+    } else {
+      environment["SSXNG_SSLOCAL_PATH"] = try sslocalURL.path
+    }
+    environment["SSXNG_RUNTIME_DIR"] = workDir.path
+    environment["SSXNG_SYSTEM_LOG"] = "0"
+    process.environment = environment
+    try process.run()
+    wrappers.append(process)
+    return process
+  }
+
+  /// 对本地 SOCKS 端口做完整握手，返回 CONNECT 应答首字节（版本, 应答码）。
+  func performSocksHandshake(port: Int) throws -> (version: UInt8, reply: UInt8)? {
+    let socketFD = socket(AF_INET, SOCK_STREAM, 0)
+    guard socketFD >= 0 else { throw POSIXError(.ENOTSOCK) }
+    defer { close(socketFD) }
+    var timeout = timeval(tv_sec: 5, tv_usec: 0)
+    _ = setsockopt(
+      socketFD, SOL_SOCKET, SO_RCVTIMEO, &timeout, socklen_t(MemoryLayout<timeval>.size))
+
+    var address = sockaddr_in()
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_addr.s_addr = INADDR_LOOPBACK.bigEndian
+    address.sin_port = in_port_t(port).bigEndian
+    let connectResult = withUnsafePointer(to: &address) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPointer in
+        connect(socketFD, sockaddrPointer, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    guard connectResult == 0 else { return nil }
+
+    // 方法协商：X'05' X'01' X'00'（一个无需认证的方法）。
+    let greeting: [UInt8] = [0x05, 0x01, 0x00]
+    XCTAssertEqual(try greeting.withUnsafeBytes { try writeAll(socketFD, $0) }, greeting.count)
+    let methodReply = try readExactly(socketFD, count: 2)
+    XCTAssertEqual(
+      methodReply, [0x05, 0x00], "sslocal 应选定 NO-AUTH 方法", file: #filePath, line: #line)
+
+    // CONNECT 127.0.0.1:1。
+    let request: [UInt8] = [0x05, 0x01, 0x00, 0x01, 127, 0, 0, 1, 0x00, 0x01]
+    _ = try request.withUnsafeBytes { try writeAll(socketFD, $0) }
+    let replyHead = try readExactly(socketFD, count: 4)
+    return (replyHead[0], replyHead[1])
+  }
+
+  func writeAll(_ descriptor: Int32, _ buffer: UnsafeRawBufferPointer) throws -> Int {
+    var total = 0
+    while total < buffer.count {
+      let written = write(descriptor, buffer.baseAddress!.advanced(by: total), buffer.count - total)
+      guard written > 0 else { throw NSError(domain: "smoke", code: 1) }
+      total += written
+    }
+    return total
+  }
+
+  func readExactly(_ descriptor: Int32, count: Int) throws -> [UInt8] {
+    var bytes: [UInt8] = []
+    bytes.reserveCapacity(count)
+    while bytes.count < count {
+      var scratch: [UInt8] = Array(repeating: 0, count: count - bytes.count)
+      let received = read(descriptor, &scratch, scratch.count)
+      guard received > 0 else { throw NSError(domain: "smoke", code: 2) }
+      bytes.append(contentsOf: scratch[0..<received])
+    }
+    return bytes
+  }
+
+  func descendantPIDs(of parent: Int32) -> [Int32] {
+    let query = Process()
+    query.executableURL = URL(fileURLWithPath: "/usr/bin/pgrep")
+    query.arguments = ["-P", String(parent)]
+    let pipe = Pipe()
+    query.standardOutput = pipe
+    query.standardError = FileHandle.nullDevice
+    guard (try? query.run()) != nil else { return [] }
+    guard (try? waitForCondition(timeout: 2) { !query.isRunning }) == true else {
+      kill(query.processIdentifier, SIGKILL)
+      return []
+    }
+    let children =
+      (String(data: pipe.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? "")
+      .split(whereSeparator: \.isWhitespace).compactMap { Int32($0) }
+    return children + children.flatMap { descendantPIDs(of: $0) }
+  }
+
+  func waitForCondition(
+    timeout: TimeInterval, _ condition: () throws -> Bool
+  ) throws -> Bool {
+    let deadline = DispatchTime.now().uptimeNanoseconds + UInt64(timeout * 1_000_000_000)
+    while DispatchTime.now().uptimeNanoseconds < deadline {
+      if try condition() { return true }
+      Thread.sleep(forTimeInterval: 0.1)
+    }
+    return try condition()
+  }
+}
+
+final class RealSslocalDelayedStartupTests: RealSslocalSmokeTests {
+  func testListenersBecomingReadyAfterFiveSecondsRemainRunning() throws {
+    let ports = try grabThreeListenPorts(excluding: [])
+    let document = SslocalRuntimeDocument(
+      servers: [], listen: ProxyListeningConfiguration(socksPort: ports[0], httpPort: ports[1]),
+      acl: .direct(at: aclFileURL))
+    let store = RuntimeFileStore(fileURL: contractURL)
+    let started = Date()
+    let wrapper = try launchWrapper(document, startupDelay: 6)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 12) {
+        store.readRuntimeReceipt() != nil || store.readFailure() != nil
+      })
+    XCTAssertNil(store.readFailure(), "延迟启动不能被旧的 5 秒期限终止")
+    _ = try XCTUnwrap(store.readRuntimeReceipt())
+    XCTAssertGreaterThanOrEqual(Date().timeIntervalSince(started), 6)
+    try assertReceiptOwnsListeners(document: document)
+    XCTAssertTrue(wrapper.isRunning)
+    stopWrapperAndAssertCleanExit(wrapper, description: "delayed startup wrapper exits")
+  }
+}
+
+final class RealSslocalListenerSmokeTests: RealSslocalSmokeTests {
+  func testRealSslocalBindsSOCKSAndHTTPPortsAndCompletesHandshake() throws {
+    var ports = Set<Int>()
+    while ports.count < 2 {
+      ports.insert(try grabEphemeralLoopbackPort())
+    }
+    let selectedPorts = Array(ports)
+    let socksPort = selectedPorts[0]
+    let httpPort = selectedPorts[1]
+    let document = SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "smoke-server",
+          server: "127.0.0.1",
+          serverPort: 1,  // 远端必然拒绝：只验证本地握手与 SSLOCAL 配置格式
+          password: "smoke-password",
+          method: "aes-256-gcm",
+          plugin: nil,
+          pluginOpts: nil)
+      ],
+      listen: ProxyListeningConfiguration(
+        socksPort: socksPort, httpPort: httpPort))
+    let wrapper = try launchWrapper(document)
+
+    // 两个端口同时就绪：验证 locals[] 被官方 sslocal 接受并实际绑定。
+    var socksReachable = false
+    var httpReachable = false
+    let deadline = Date().addingTimeInterval(15)
+    while (!socksReachable || !httpReachable) && Date() < deadline {
+      socksReachable =
+        EndpointHealthProbe.probe(host: "127.0.0.1", port: socksPort, timeout: 1) == .reachable
+      httpReachable =
+        EndpointHealthProbe.probe(host: "127.0.0.1", port: httpPort, timeout: 1) == .reachable
+      if !socksReachable || !httpReachable {
+        Thread.sleep(forTimeInterval: 0.2)
+      }
+    }
+    XCTAssertTrue(socksReachable, "15 秒内本地 SOCKS 端口应完成监听绑定")
+    XCTAssertTrue(httpReachable, "15 秒内本地 HTTP 端口应完成监听绑定")
+
+    // 完整 SOCKS5 握手。
+    let handshake = try performSocksHandshake(port: socksPort)
+    let reply = try XCTUnwrap(handshake, "连接成功建立后应能完成握手")
+    XCTAssertEqual(reply.version, 0x05, "应答版本应为 SOCKS5")
+    // 远端不可达允许失败应答码；关键在于 sslocal 按协议给出 CONNECT 应答。
+
+    // 显式停止：SIGTERM 链对真实 sslocal 同样成立。
+    stopWrapperAndAssertCleanExit(wrapper, description: "wrapper exits")
+  }
+
+  /// 无活动服务器监听：空 `servers` 契约是合法部署——上游
+  /// sslocal v1.26.0 接受空服务器列表并照常绑定 SOCKS/HTTP 入站。真实运行时
+  /// 证据（系统代理写入属真实宿主验收，不在替身/回环测试范围内）。
+  func testRealSslocalBindsLocalsWithEmptyServerList() throws {
+    var ports = Set<Int>()
+    while ports.count < 2 {
+      ports.insert(try grabEphemeralLoopbackPort())
+    }
+    let selectedPorts = Array(ports)
+    let document = SslocalRuntimeDocument(
+      servers: [],
+      listen: ProxyListeningConfiguration(
+        socksPort: selectedPorts[0], httpPort: selectedPorts[1]))
+    XCTAssertTrue(document.isWellFormed, "空服务器列表契约有效")
+    let wrapper = try launchWrapper(document)
+
+    XCTAssertTrue(
+      try waitForCondition(timeout: 15) {
+        EndpointHealthProbe.probe(host: "127.0.0.1", port: selectedPorts[0], timeout: 1)
+          == .reachable
+      },
+      "空服务器列表下本地 SOCKS 端口应完成监听绑定")
+    XCTAssertTrue(
+      try waitForCondition(timeout: 15) {
+        EndpointHealthProbe.probe(host: "127.0.0.1", port: selectedPorts[1], timeout: 1)
+          == .reachable
+      },
+      "空服务器列表下本地 HTTP 端口应完成监听绑定")
+
+    stopWrapperAndAssertCleanExit(wrapper, description: "wrapper exits")
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Smoke/RuntimePublicationSmokeTests.swift b/ShadowsocksX-NG2/Tests/Smoke/RuntimePublicationSmokeTests.swift
new file mode 100644
index 000000000..2dfbf2c96
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Smoke/RuntimePublicationSmokeTests.swift
@@ -0,0 +1,315 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+final class RuntimePublicationSmokeTests: RealSslocalSmokeTests {
+  func testStableConfigLinkReloadChangesActualProxyEgressWithoutReplacingChild() throws {
+    let firstExit = try ConnectionCountingServer()
+    let secondExit = try ConnectionCountingServer()
+    let ports = try grabThreeListenPorts(excluding: [firstExit.port, secondExit.port])
+    let listen = ProxyListeningConfiguration(socksPort: ports[0], httpPort: ports[1])
+    func document(_ port: Int) -> SslocalRuntimeDocument {
+      SslocalRuntimeDocument(
+        servers: [
+          .init(
+            id: "reload", server: "127.0.0.1", serverPort: port,
+            password: "smoke", method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+        ], listen: listen, acl: .global(at: aclFileURL))
+    }
+    let first = document(firstExit.port)
+    let wrapper = try launchWrapper(first)
+    try assertReceiptOwnsListeners(document: first)
+    let store = RuntimeFileStore(fileURL: contractURL)
+    let pid = try XCTUnwrap(store.readRuntimeReceipt()?.processID)
+    try assertPublicTargetsProxy(listen: listen, fakeSS: firstExit)
+    let before = firstExit.connectionCount
+    let next = document(secondExit.port)
+    try store.write(next)
+    XCTAssertEqual(kill(wrapper.processIdentifier, SIGUSR1), 0)
+    try assertReceiptOwnsListeners(document: next)
+    XCTAssertEqual(store.readRuntimeReceipt()?.processID, pid)
+    // Receipt is only Agent evidence. Actual requests must use the second exit.
+    XCTAssertTrue(
+      try waitForCondition(timeout: 8) {
+        self.performHTTPConnect(httpPort: listen.httpPort, targetHost: "8.8.8.8", targetPort: 53)
+        return secondExit.connectionCount > 0
+      })
+    try assertPublicTargetsProxy(listen: listen, fakeSS: secondExit)
+    XCTAssertLessThanOrEqual(firstExit.connectionCount, before + 1)
+    stopWrapperAndAssertCleanExit(wrapper, description: "reload wrapper exits")
+  }
+
+  func testLargeACLReuseAndModeReloadWithoutReplacingChild() throws {
+    let echo = try LoopbackEchoServer()
+    let proxy = try ConnectionCountingServer()
+    let ports = try grabThreeListenPorts(excluding: [echo.port, proxy.port])
+    let listen = ProxyListeningConfiguration(socksPort: ports[0], httpPort: ports[1])
+    let large = ProxyACLDocument(
+      path: aclFileURL.path, summary: "rule-proxy-default",
+      content: "[proxy_all]\n[bypass_list]\n"
+        + (0..<20000).map { "||unused-\($0).example\n" }.joined())
+    let source = SslocalRuntimeDocument(
+      servers: [
+        .init(
+          id: "acl", server: "127.0.0.1", serverPort: proxy.port,
+          password: "smoke", method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+      ], listen: listen, acl: large)
+    let wrapper = try launchWrapper(source)
+    let store = RuntimeFileStore(fileURL: contractURL)
+    try assertReceiptOwnsListeners(document: source)
+    let snapshot = try XCTUnwrap(RuntimePublication.load(at: store.supervisionFileURL))
+    let acl = try XCTUnwrap(snapshot.acl)
+    let aclURL = workDir.appendingPathComponent(acl.file)
+    let inode =
+      try FileManager.default.attributesOfItem(atPath: aclURL.path)[.systemFileNumber] as? NSNumber
+    try assertACLModeReloads(
+      ACLModeReloadContext(
+        wrapper: wrapper, store: store, source: source, listen: listen,
+        echo: echo, proxy: proxy, acl: acl, aclURL: aclURL, inode: inode, large: large))
+    stopWrapperAndAssertCleanExit(wrapper, description: "mode wrapper exits")
+  }
+
+  private func assertACLModeReloads(_ context: ACLModeReloadContext) throws {
+    let wrapper = context.wrapper
+    let store = context.store
+    let source = context.source
+    let listen = context.listen
+    let echo = context.echo
+    let proxy = context.proxy
+    let acl = context.acl
+    let aclURL = context.aclURL
+    let inode = context.inode
+    let large = context.large
+    for _ in 0..<2 {
+      let oldPID = try XCTUnwrap(store.readRuntimeReceipt()?.processID)
+      let direct = source.replacingACL(.direct(at: aclFileURL))
+      try store.write(direct)
+      XCTAssertEqual(kill(wrapper.processIdentifier, SIGUSR1), 0)
+      try assertReceiptOwnsListeners(document: direct)
+      XCTAssertEqual(store.readRuntimeReceipt()?.processID, oldPID)
+      // 回执不证明上游已应用 ACL；实际路由收敛后再验证两个入口。
+      XCTAssertTrue(
+        try waitForCondition(timeout: 8) {
+          self.performSocksConnectReply(
+            socksPort: listen.socksPort, targetHost: "127.0.0.1", targetPort: echo.port) == 0
+        })
+      let payload = Array("direct\n".utf8)
+      XCTAssertEqual(
+        try performDirectSocksEcho(
+          socksPort: listen.socksPort, targetPort: echo.port, payload: payload), payload)
+      XCTAssertEqual(
+        try performDirectHTTPEcho(
+          httpPort: listen.httpPort, targetPort: echo.port, payload: payload), payload)
+      try store.write(source)
+      XCTAssertEqual(kill(wrapper.processIdentifier, SIGUSR1), 0)
+      try assertReceiptOwnsListeners(document: source)
+      XCTAssertEqual(store.readRuntimeReceipt()?.processID, oldPID)
+      let before = proxy.connectionCount
+      XCTAssertTrue(
+        try waitForCondition(timeout: 8) {
+          self.performHTTPConnect(
+            httpPort: listen.httpPort, targetHost: "127.0.0.1", targetPort: echo.port)
+          return proxy.connectionCount > before
+        })
+      try assertPublicTargetsProxy(listen: listen, fakeSS: proxy)
+      XCTAssertEqual(RuntimePublication.load(at: store.supervisionFileURL)?.acl, acl)
+      XCTAssertEqual(
+        try FileManager.default.attributesOfItem(atPath: aclURL.path)[.systemFileNumber]
+          as? NSNumber, inode)
+      XCTAssertEqual(try Data(contentsOf: aclURL), Data(large.content.utf8))
+    }
+  }
+
+  func testCombinedServerAndRuleReloadAndDefaultActionChangesKeepChild() throws {
+    let echo = try LoopbackEchoServer()
+    let firstExit = try ConnectionCountingServer()
+    let secondExit = try ConnectionCountingServer()
+    let ports = try grabThreeListenPorts(excluding: [echo.port, firstExit.port, secondExit.port])
+    let listen = ProxyListeningConfiguration(socksPort: ports[0], httpPort: ports[1])
+    let source = ruleProbeDocument(
+      port: firstExit.port, listen: listen,
+      acl: ruleProbeACL(defaultAction: .directWhenUnmatched, rules: []))
+    let wrapper = try launchWrapper(source)
+    let store = RuntimeFileStore(fileURL: contractURL)
+    try assertReceiptOwnsListeners(document: source)
+    let pid = try assertRuleInsertionAndRemoval(
+      wrapper: wrapper, store: store, listen: listen, echo: echo, secondExit: secondExit)
+    try assertRuleDefaultActionReloads(
+      RuleReloadContext(
+        wrapper: wrapper, store: store, listen: listen, echo: echo,
+        secondExit: secondExit, processID: pid))
+    stopWrapperAndAssertCleanExit(wrapper, description: "rule reload wrapper exits")
+  }
+
+  private func ruleProbeDocument(
+    port: Int, listen: ProxyListeningConfiguration, acl: ProxyACLDocument
+  ) -> SslocalRuntimeDocument {
+    SslocalRuntimeDocument(
+      servers: [
+        .init(
+          id: "rules", server: "127.0.0.1", serverPort: port,
+          password: "smoke", method: "aes-256-gcm", plugin: nil, pluginOpts: nil)
+      ], listen: listen, acl: acl)
+  }
+
+  private func assertRuleInsertionAndRemoval(
+    wrapper: Process, store: RuntimeFileStore, listen: ProxyListeningConfiguration,
+    echo: LoopbackEchoServer, secondExit: ConnectionCountingServer
+  ) throws -> Int32 {
+    let processID = try XCTUnwrap(store.readRuntimeReceipt()?.processID)
+    let custom = ruleProbeDocument(
+      port: secondExit.port, listen: listen,
+      acl: ruleProbeACL(
+        defaultAction: .directWhenUnmatched,
+        rules: [ProxyRule(action: .proxy, match: try RuleMatch(domainSuffix: "blocked.example"))]))
+    try store.write(custom)
+    XCTAssertEqual(kill(wrapper.processIdentifier, SIGUSR1), 0)
+    try assertReceiptOwnsListeners(document: custom)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 8) {
+        self.performHTTPConnect(
+          httpPort: listen.httpPort, targetHost: "blocked.example", targetPort: echo.port)
+        return secondExit.connectionCount > 0
+      })
+    XCTAssertEqual(store.readRuntimeReceipt()?.processID, processID)
+
+    let removed = ruleProbeDocument(
+      port: secondExit.port, listen: listen,
+      acl: ruleProbeACL(defaultAction: .directWhenUnmatched, rules: []))
+    try store.write(removed)
+    XCTAssertEqual(kill(wrapper.processIdentifier, SIGUSR1), 0)
+    try assertReceiptOwnsListeners(document: removed)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 8) {
+        self.performSocksConnectReply(
+          socksPort: listen.socksPort, targetHost: "blocked.example", targetPort: echo.port) == 0
+      })
+    let payload = Array("reloaded rule\n".utf8)
+    XCTAssertEqual(
+      try performDirectHTTPEcho(
+        httpPort: listen.httpPort, targetHost: "blocked.example", targetPort: echo.port,
+        payload: payload), payload)
+    return processID
+  }
+
+  private func assertRuleDefaultActionReloads(_ context: RuleReloadContext) throws {
+    let wrapper = context.wrapper
+    let store = context.store
+    let listen = context.listen
+    let echo = context.echo
+    let secondExit = context.secondExit
+    let processID = context.processID
+    for (acl, proxiesDomain) in [
+      (ruleProbeACL(defaultAction: .proxyWhenUnmatched, rules: []), true),
+      (ProxyACLDocument.global(at: aclFileURL), false),
+    ] {
+      let next = ruleProbeDocument(port: secondExit.port, listen: listen, acl: acl)
+      let before = secondExit.connectionCount
+      try store.write(next)
+      XCTAssertEqual(kill(wrapper.processIdentifier, SIGUSR1), 0)
+      try assertReceiptOwnsListeners(document: next)
+      XCTAssertTrue(
+        try waitForCondition(timeout: 8) {
+          if proxiesDomain {
+            self.performHTTPConnect(
+              httpPort: listen.httpPort, targetHost: "blocked.example", targetPort: echo.port)
+            return secondExit.connectionCount > before
+          }
+          return self.performSocksConnectReply(
+            socksPort: listen.socksPort, targetHost: "blocked.example", targetPort: echo.port) == 0
+        })
+      XCTAssertEqual(store.readRuntimeReceipt()?.processID, processID)
+    }
+  }
+
+}
+
+private struct ACLModeReloadContext {
+  let wrapper: Process
+  let store: RuntimeFileStore
+  let source: SslocalRuntimeDocument
+  let listen: ProxyListeningConfiguration
+  let echo: LoopbackEchoServer
+  let proxy: ConnectionCountingServer
+  let acl: RuntimeSupervision.ACL
+  let aclURL: URL
+  let inode: NSNumber?
+  let large: ProxyACLDocument
+}
+
+private struct RuleReloadContext {
+  let wrapper: Process
+  let store: RuntimeFileStore
+  let listen: ProxyListeningConfiguration
+  let echo: LoopbackEchoServer
+  let secondExit: ConnectionCountingServer
+  let processID: Int32
+}
+
+extension RuntimePublicationSmokeTests {
+  func testRejectedACLReloadKeepsPreviousRulesWithoutReplacingChild() throws {
+    let echo = try LoopbackEchoServer()
+    let ports = try grabThreeListenPorts(excluding: [echo.port])
+    let listen = ProxyListeningConfiguration(socksPort: ports[0], httpPort: ports[1])
+    let source = SslocalRuntimeDocument(
+      servers: [], listen: listen, acl: .direct(at: aclFileURL))
+    let wrapper = try launchWrapper(source)
+    let store = RuntimeFileStore(fileURL: contractURL)
+    try assertReceiptOwnsListeners(document: source)
+    let pid = try XCTUnwrap(store.readRuntimeReceipt()?.processID)
+    let next = source.replacingACL(
+      ruleProbeACL(defaultAction: .proxyWhenUnmatched, rules: []))
+    try store.write(next)
+    let snapshot = try XCTUnwrap(RuntimePublication.load(at: store.supervisionFileURL))
+    let acl = try XCTUnwrap(snapshot.acl)
+    // 模拟发布后磁盘损坏；上游解析拒绝，Agent 回执无法识别这种内部失败。
+    try AtomicFileWriter.write(Data("[\n".utf8), to: workDir.appendingPathComponent(acl.file))
+    XCTAssertEqual(kill(wrapper.processIdentifier, SIGUSR1), 0)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 8) {
+        let log = try String(
+          contentsOf: self.workDir.appendingPathComponent("agent.log"), encoding: .utf8)
+        return log.contains("ACL reload failed") && log.contains("keeping the previous rules")
+      })
+    try assertReceiptOwnsListeners(document: next)
+    XCTAssertEqual(store.readRuntimeReceipt()?.processID, pid)
+    XCTAssertNil(store.readFailure())
+    let payload = Array("previous rules\n".utf8)
+    XCTAssertEqual(
+      try performDirectSocksEcho(
+        socksPort: listen.socksPort, targetPort: echo.port, payload: payload), payload)
+    stopWrapperAndAssertCleanExit(wrapper, description: "rejected ACL wrapper exits")
+  }
+
+  func testHealthyCrashReplaysCurrentDeploymentAndRecoveryFailureDoesNotLoop() throws {
+    let ports = try grabThreeListenPorts(excluding: [])
+    let document = SslocalRuntimeDocument(
+      servers: [],
+      listen: ProxyListeningConfiguration(socksPort: ports[0], httpPort: ports[1]),
+      acl: .direct(at: aclFileURL))
+    let wrapper = try launchWrapper(document)
+    try assertReceiptOwnsListeners(document: document)
+    let store = RuntimeFileStore(fileURL: contractURL)
+    let oldPID = try XCTUnwrap(store.readRuntimeReceipt()?.processID)
+    XCTAssertEqual(kill(oldPID, SIGKILL), 0)
+    XCTAssertTrue(
+      try waitForCondition(timeout: 10) {
+        guard let receipt = store.readRuntimeReceipt() else { return false }
+        return receipt.processID != oldPID
+          && RuntimeSocketOwnershipProbe.process(receipt.processID, ownsTCPListenerOn: ports[0])
+      })
+    let recoveredPID = try XCTUnwrap(store.readRuntimeReceipt()?.processID)
+    let snapshot = try XCTUnwrap(RuntimePublication.load(at: store.supervisionFileURL))
+    // 模拟磁盘损坏，上游拒绝配置；监管资料仍完整且指向当前部署。
+    try AtomicFileWriter.write(
+      Data("invalid upstream JSON".utf8), to: workDir.appendingPathComponent(snapshot.configuration)
+    )
+    XCTAssertEqual(kill(recoveredPID, SIGKILL), 0)
+    XCTAssertTrue(try waitForCondition(timeout: 10) { !wrapper.isRunning })
+    XCTAssertNotNil(store.readFailure())
+    let replay = try launchWrapper(document, publish: false)
+    XCTAssertTrue(try waitForCondition(timeout: 5) { !replay.isRunning })
+    XCTAssertNil(store.readRuntimeReceipt())
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateParserTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateParserTests.swift
new file mode 100644
index 000000000..0c5043adb
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateParserTests.swift
@@ -0,0 +1,68 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct SubscriptionAutoUpdateParserTests {
+  @Test(arguments: SubscriptionUpdateMode.allCases, [false, true])
+  func acceptsOnlyCompletePolicies(mode: SubscriptionUpdateMode, allowsOverride: Bool) throws {
+    let snapshot = try parse(
+      #"{"schema_version":1,"auto_update":{"mode":"\#(mode.rawValue)","allow_user_override":\#(allowsOverride)}}"#
+    )
+    #expect(
+      snapshot.autoUpdatePolicy == .valid(.init(mode: mode, allowUserOverride: allowsOverride)))
+  }
+
+  @Test(arguments: [
+    #"{}"#, #"null"#, #"false"#, #"[]"#,
+    #"{"mode":"daily"}"#, #"{"allow_user_override":true}"#,
+    #"{"mode":"hourly","allow_user_override":true}"#,
+    #"{"mode":1,"allow_user_override":true}"#,
+    #"{"mode":"daily","allow_user_override":1}"#,
+    #"{"mode":"daily","allow_user_override":"true"}"#,
+  ])
+  func malformedPoliciesDoNotRejectServers(policy: String) throws {
+    let snapshot = try parse(#"{"schema_version":1,"auto_update":\#(policy)}"#)
+    #expect(snapshot.autoUpdatePolicy == .invalid)
+    #expect(snapshot.root.children.count == 1)
+  }
+
+  @Test func invalidTreeAndPolicyAreIndependent() throws {
+    let validPolicy = try parse(
+      #"{"schema_version":1,"groups":false,"auto_update":{"mode":"weekly","allow_user_override":false}}"#
+    )
+    #expect(validPolicy.autoUpdatePolicy == .valid(.init(mode: .weekly, allowUserOverride: false)))
+    #expect(validPolicy.root.children.count == 1)
+    let validTree = try parse(
+      #"""
+      {"schema_version":1,
+      "root_group_id":"root",
+      "groups":[{"id":"root",
+      "name":"Provider tree",
+      "children":[]}],
+      "auto_update":{}}
+      """#
+    )
+    #expect(validTree.root.name == "Provider tree")
+    #expect(validTree.autoUpdatePolicy == .invalid)
+  }
+
+  @Test func unsupportedVersionDoesNotAdoptPolicyAndMissingPolicyWithdraws() throws {
+    #expect(
+      try parse(#"{"schema_version":2,"auto_update":{"mode":"daily","allow_user_override":false}}"#)
+        .autoUpdatePolicy == .invalid)
+    #expect(try parse(#"{"schema_version":1}"#).autoUpdatePolicy == .absent)
+    let absent = try SubscriptionDocumentParser.parse(
+      Data(#"{"version":1,"servers":[]}"#.utf8), subscriptionID: .fresh())
+    #expect(absent.autoUpdatePolicy == .absent)
+  }
+
+  private func parse(_ namespace: String) throws -> SubscriptionSnapshot {
+    let data = Data(
+      """
+      {"version":1,"servers":[{"server":"example.com","server_port":8388,
+      "method":"aes-256-gcm","password":"password"}],"x_shadowsocksx_ng":\(namespace)}
+      """.utf8)
+    return try SubscriptionDocumentParser.parse(data, subscriptionID: .fresh())
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdatePresentationTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdatePresentationTests.swift
new file mode 100644
index 000000000..d265f6014
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdatePresentationTests.swift
@@ -0,0 +1,63 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct SubscriptionAutoUpdatePresentationTests {
+  @Test(
+    arguments: SubscriptionUpdateMode.allCases,
+    [(false, false), (false, true), (true, false), (true, true)])
+  func detailsShowEffectiveModeRestrictionsAndPlanInOrder(
+    mode: SubscriptionUpdateMode, flags: (Bool, Bool)
+  ) async throws {
+    let (allowsOverride, hasSucceeded) = flags
+    try await withAutoUpdateFixture { fixture in
+      fixture.respond(mode: mode, allowsOverride: allowsOverride)
+      var summary = try await fixture.create()
+      if !hasSucceeded { summary.lastSucceededAt = nil }
+      summary.information = SubscriptionInformation(bytesUsed: 100)
+      let node = try #require(fixture.workflow.tree.node(withID: summary.groupID))
+      let detail = NodeDetailPresentation(
+        node: node, server: nil, eligibility: nil, isActiveTarget: false, subscription: summary)
+      let rows = try #require(detail.properties.first { $0.id == .subscription }).items
+      var labels: [String] = []
+      if hasSucceeded { labels.append("最后更新时间") }
+      labels.append("自动更新")
+      if !allowsOverride { labels.append("配置限制") }
+      if mode != .off { labels.append("下次更新时间") }
+      labels.append("已用流量")
+      #expect(rows.map(\.label) == labels)
+      #expect(rows.first { $0.label == "自动更新" }?.value == mode.displayName)
+      #expect(rows.first { $0.label == "配置限制" }?.value == (allowsOverride ? nil : "供应商禁止覆盖自动更新设置"))
+    }
+  }
+
+  @Test func fileImportAndGroupShareDoNotPropagateAutomaticUpdates() async throws {
+    try await withAutoUpdateFixture { fixture in
+      let data = Data(
+        #"""
+        {"version":1,
+        "servers":[{"server":"example.com",
+        "server_port":8388,
+        "method":"aes-256-gcm",
+        "password":"p"}],
+        "x_shadowsocksx_ng":{"schema_version":1,
+        "auto_update":{"mode":"daily",
+        "allow_user_override":false}}}
+        """#
+        .utf8)
+      fixture.fetcher.setBehavior(.success(data))
+      let summary = try await fixture.create()
+      let draft = try fixture.workflow.configurationGroupExportDraft(for: summary.groupID)
+      let json = try #require(String(data: draft.data, encoding: .utf8))
+      #expect(!json.contains("auto_update"))
+      #expect(!json.contains("nextUpdateAt"))
+      let imported = await fixture.workflow.importServers(
+        from: [.file(name: "provider.json", data: data)], into: nil)
+      let groupID = try #require(imported.sources.first?.result.importedGroupID)
+      #expect(fixture.workflow.tree.node(withID: groupID)?.isManual == true)
+      #expect(fixture.workflow.subscriptions.count == 1)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateTests.swift
new file mode 100644
index 000000000..d8b35a8da
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateTests.swift
@@ -0,0 +1,53 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct SubscriptionAutoUpdateTests {
+  @Test func savingSettingsPreservesPlanUntilEffectiveModeChanges() {
+    let now = Date(timeIntervalSince1970: 1_700_000_000)
+    var state = SubscriptionAutoUpdate()
+    state.save(.init(userOverride: .daily, interval: .off), at: now, jitter: 0.1)
+    #expect(state.interval == .daily)
+    #expect(state.nextUpdateAt == now.addingTimeInterval(95_040))
+    state.save(.init(userOverride: .daily, interval: .weekly), at: now, jitter: 0)
+    #expect(state.interval == .weekly)
+    #expect(state.nextUpdateAt == now.addingTimeInterval(95_040))
+    state.save(.init(userOverride: .off, interval: .weekly), at: now, jitter: 0)
+    #expect(state.nextUpdateAt == nil)
+    #expect(state.interval == .weekly)
+  }
+
+  @Test func changingSourceReleasesPolicyAndRetainsTheLockedUserChoice() {
+    let now = Date(timeIntervalSince1970: 1_700_000_000)
+    var state = SubscriptionAutoUpdate()
+    state.save(.init(userOverride: .weekly, interval: .weekly), at: now, jitter: 0)
+    state.refreshSucceeded(
+      policy: .valid(.init(mode: .daily, allowUserOverride: false)), at: now, jitter: 0)
+    state.save(
+      .init(userOverride: .off), sourceChanged: true,
+      at: now.addingTimeInterval(100), jitter: 0)
+    #expect(state.provider == nil)
+    #expect(state.userOverride == .weekly)
+    #expect(state.interval == .weekly)
+    #expect(state.nextUpdateAt == now.addingTimeInterval(604_900))
+  }
+
+  @Test func refreshResultsDistinguishWithdrawalFromInvalidPolicyAndFailure() {
+    let now = Date(timeIntervalSince1970: 1_700_000_000)
+    let policy = SubscriptionUpdatePolicy(mode: .daily, allowUserOverride: false)
+    var state = SubscriptionAutoUpdate()
+    state.refreshSucceeded(policy: .valid(policy), at: now, jitter: 0)
+    #expect(state.nextUpdateAt == now.addingTimeInterval(86_400))
+    state.refreshSucceeded(policy: .invalid, at: now.addingTimeInterval(100), jitter: 0.1)
+    #expect(state.provider == policy)
+    #expect(state.nextUpdateAt == now.addingTimeInterval(95_140))
+    state.refreshFailed(at: now.addingTimeInterval(200), jitter: 0)
+    #expect(state.provider == policy)
+    #expect(state.nextUpdateAt == now.addingTimeInterval(86_600))
+    state.refreshSucceeded(policy: .absent, at: now.addingTimeInterval(300), jitter: 0)
+    #expect(state.provider == nil)
+    #expect(state.nextUpdateAt == nil)
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateWorkflowTests+Lifecycle.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateWorkflowTests+Lifecycle.swift
new file mode 100644
index 000000000..94330f8e7
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateWorkflowTests+Lifecycle.swift
@@ -0,0 +1,115 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+extension SubscriptionAutoUpdateWorkflowTests {
+  @Test(arguments: [true, false])
+  func failedSaveWaitsForWakeOrCommittedChangesBeforeRetry(wake: Bool) async throws {
+    try await withAutoUpdateFixture { fixture in
+      let first = try await fixture.create(settings: .init(userOverride: .daily))
+      fixture.now = fixture.now.addingTimeInterval(1_000)
+      let second = try await fixture.create(settings: .init(userOverride: .daily))
+      fixture.now = fixture.now.addingTimeInterval(85_400)
+      let scheduled = TestAsyncGate("future plan scheduled after failed save")
+      let workflow = fixture.makeWorkflow(wait: { delay in
+        if delay > 0 {
+          scheduled.release()
+          try await Task.sleep(for: .seconds(delay))
+        }
+      })
+      defer { workflow.stopSubscriptionAutomaticUpdates() }
+      let before = workflow.subscriptions
+      let requests = fixture.fetcher.requestCount
+      try FileManager.default.removeItem(at: fixture.directory)
+      try Data().write(to: fixture.directory)
+      workflow.startSubscriptionAutomaticUpdates()
+      try #require(await scheduled.wait())
+      #expect(workflow.subscriptions == before)
+      #expect(workflow.subscriptionRefreshFailure(for: first.id) == .commit)
+      #expect(fixture.fetcher.requestCount == requests + 1)
+      #expect(workflow.refreshingSubscriptionIDs.isEmpty)
+
+      try FileManager.default.removeItem(at: fixture.directory)
+      try FileManager.default.createDirectory(
+        at: fixture.directory, withIntermediateDirectories: true)
+      if wake {
+        workflow.subscriptionAutomaticUpdatesDidWake()
+      } else {
+        try await workflow.saveSubscription(second.id, urlString: "https://example.com/sub")
+      }
+      try await requireTestCondition("overdue plan succeeds after external event") {
+        workflow.subscriptions.first?.autoUpdate.nextUpdateAt
+          == fixture.now.addingTimeInterval(86_400)
+          && workflow.refreshingSubscriptionIDs.isEmpty
+      }
+      #expect(fixture.fetcher.requestCount == requests + 2)
+      #expect(workflow.subscriptionRefreshFailure(for: first.id) == nil)
+    }
+  }
+
+  @Test func stoppingCancelsManualRequestsAndPreservesTheirCommittedPlan() async throws {
+    try await withAutoUpdateFixture { fixture in
+      let first = try await fixture.create(settings: .init(userOverride: .daily))
+      let fetcher = GatedFetcher()
+      let waiting = TestAsyncGate("automatic update waiting")
+      var waitCount = 0
+      let workflow = fixture.makeWorkflow(
+        fetcher: fetcher,
+        wait: { delay in
+          waitCount += 1
+          waiting.release()
+          try await Task.sleep(for: .seconds(delay))
+        })
+      defer { workflow.stopSubscriptionAutomaticUpdates() }
+      workflow.startSubscriptionAutomaticUpdates()
+      try #require(await waiting.wait())
+      let before = workflow.subscriptions
+      let request = Task { await workflow.refreshSubscription(first.id) }
+      try await withTestTask(request, release: fetcher.releaseAll) {
+        try await requireTestCondition("manual refresh entered") { fetcher.didEnterFetch }
+        #expect(workflow.refreshingSubscriptionIDs == [first.id])
+        workflow.stopSubscriptionAutomaticUpdates()
+        workflow.stopSubscriptionAutomaticUpdates()
+        workflow.subscriptionAutomaticUpdatesDidWake()
+        #expect(workflow.refreshingSubscriptionIDs.isEmpty)
+      }
+      #expect(workflow.subscriptions == before)
+      #expect(workflow.subscriptionRefreshCompletions.isEmpty)
+      #expect(workflow.subscriptionRefreshFailure(for: first.id) == nil)
+      #expect(waitCount == 1)
+    }
+  }
+
+  @Test func stoppedBatchDoesNotReadTheClockAfterItsRequestReturns() async throws {
+    try await withAutoUpdateFixture { fixture in
+      _ = try await fixture.create(settings: .init(userOverride: .daily))
+      fixture.now = fixture.now.addingTimeInterval(1_000)
+      _ = try await fixture.create(settings: .init(userOverride: .daily))
+      fixture.now = fixture.now.addingTimeInterval(85_400)
+      let fetcher = GatedFetcher()
+      var clockReads = 0
+      var workflow: CatalogWorkflow? = makeCatalogWorkflow(
+        coordinator: fixture.coordinator, subscriptionFetcher: fetcher,
+        subscriptionNow: {
+          clockReads += 1
+          return fixture.now
+        })
+      let workflowIsReleased = { [weak workflow] in workflow == nil }
+      defer {
+        workflow?.stopSubscriptionAutomaticUpdates()
+        fetcher.releaseAll()
+      }
+      workflow?.startSubscriptionAutomaticUpdates()
+      try await requireTestCondition("automatic request entered") { fetcher.didEnterFetch }
+      let readsBeforeStop = clockReads
+      workflow?.stopSubscriptionAutomaticUpdates()
+      workflow = nil
+      fetcher.releaseAll()
+      try await requireTestCondition(
+        "stopped batch released its workflow", condition: workflowIsReleased)
+      #expect(clockReads == readsBeforeStop)
+    }
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateWorkflowTests+Races.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateWorkflowTests+Races.swift
new file mode 100644
index 000000000..f7ac1f0ff
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateWorkflowTests+Races.swift
@@ -0,0 +1,212 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+extension SubscriptionAutoUpdateWorkflowTests {
+  @Test func inFlightSettingsUseLatestModeAndCancellationPreservesPlan() async throws {
+    try await withAutoUpdateFixture { fixture in
+      let first = try await fixture.create(settings: .init(userOverride: .daily))
+      let fetcher = GatedFetcher()
+      let workflow = fixture.makeWorkflow(fetcher: fetcher)
+      let request = Task { await workflow.refreshSubscription(first.id) }
+      try await withTestTask(request, release: fetcher.releaseAll) {
+        try await requireTestCondition("fetch entered") { fetcher.didEnterFetch }
+        await workflow.refreshSubscription(first.id)
+        #expect(fetcher.requestCount == 1)
+        fixture.now = fixture.now.addingTimeInterval(100)
+        try await workflow.saveSubscription(
+          first.id, urlString: "https://example.com/sub", autoUpdate: .init(userOverride: .weekly))
+        fixture.now = fixture.now.addingTimeInterval(200)
+      }
+      #expect(
+        workflow.subscriptions.first?.autoUpdate.nextUpdateAt
+          == fixture.now.addingTimeInterval(604_800))
+      let cancelling = GatedFetcher()
+      let reloaded = fixture.makeWorkflow(fetcher: cancelling)
+      let before = reloaded.subscriptions
+      let cancelled = Task { await reloaded.refreshSubscription(first.id) }
+      try await withTestTask(cancelled, release: cancelling.releaseAll) {
+        try await requireTestCondition("cancelled fetch entered") { cancelling.didEnterFetch }
+        cancelled.cancel()
+      }
+      #expect(reloaded.subscriptions == before)
+    }
+  }
+
+  @Test func changingURLRejectsOldResponseAndClearsPolicyEvenWhenNewFetchFails() async throws {
+    try await withAutoUpdateFixture { fixture in
+      fixture.respond(mode: .daily, allowsOverride: false)
+      let first = try await fixture.create(
+        settings: .init(userOverride: .weekly, interval: .weekly))
+      let fetcher = URLChangeFetcher()
+      let workflow = fixture.makeWorkflow(fetcher: fetcher)
+      let request = Task { await workflow.refreshSubscription(first.id) }
+      var current: [SubscriptionSummary] = []
+      try await withTestTask(request, release: fetcher.release.release) {
+        try #require(await fetcher.entered.wait())
+        try await workflow.saveSubscription(first.id, urlString: "https://new.example.com/sub")
+        #expect(workflow.subscriptions.first?.id == first.id)
+        #expect(workflow.subscriptions.first?.groupID == first.groupID)
+        #expect(workflow.subscriptions.first?.autoUpdate.provider == nil)
+        #expect(workflow.subscriptions.first?.autoUpdate.userOverride == .weekly)
+        #expect(workflow.subscriptions.first?.lastSucceededAt == first.lastSucceededAt)
+        current = workflow.subscriptions
+      }
+      #expect(workflow.subscriptions == current)
+      #expect(try workflow.subscriptionURL(for: first.id) == "https://new.example.com/sub")
+    }
+  }
+
+  @Test func deletionRejectsLateResponse() async throws {
+    try await withAutoUpdateFixture { fixture in
+      let first = try await fixture.create()
+      let fetcher = GatedFetcher()
+      let workflow = fixture.makeWorkflow(fetcher: fetcher)
+      let request = Task { await workflow.refreshSubscription(first.id) }
+      try await withTestTask(request, release: fetcher.releaseAll) {
+        try await requireTestCondition("deleting fetch entered") { fetcher.didEnterFetch }
+        _ = try await workflow.removeSubscription(first.id)
+      }
+      #expect(workflow.subscriptions.isEmpty)
+      #expect(workflow.refreshingSubscriptionIDs.isEmpty)
+    }
+  }
+
+  @Test func dueSubscriptionsRunSequentiallyAndOverlapWithManualRefreshIsSkipped() async throws {
+    try await withAutoUpdateFixture { fixture in
+      let first = try await fixture.create(settings: .init(userOverride: .daily))
+      _ = try await fixture.create(settings: .init(userOverride: .daily))
+      fixture.now = fixture.now.addingTimeInterval(100_000)
+      let fetcher = GatedFetcher()
+      let workflow = fixture.makeWorkflow(fetcher: fetcher)
+      defer {
+        workflow.stopSubscriptionAutomaticUpdates()
+        fetcher.releaseAll()
+      }
+      workflow.startSubscriptionAutomaticUpdates()
+      try await requireTestCondition("batch fetch entered") { fetcher.didEnterFetch }
+      #expect(fetcher.requestCount == 1)
+      await workflow.refreshSubscription(first.id)
+      #expect(fetcher.requestCount == 1)
+      fetcher.releaseAll()
+      try await requireTestCondition("automatic batch completed") {
+        fetcher.requestCount == 2 && workflow.refreshingSubscriptionIDs.isEmpty
+      }
+      #expect(fetcher.requestCount == 2)
+    }
+  }
+
+  @Test func subscriptionsBecomingDueDuringABatchAreNotMissed() async throws {
+    try await withAutoUpdateFixture { fixture in
+      _ = try await fixture.create(settings: .init(userOverride: .daily))
+      fixture.now = fixture.now.addingTimeInterval(1_000)
+      _ = try await fixture.create(settings: .init(userOverride: .daily))
+      fixture.now = fixture.now.addingTimeInterval(85_400)
+      let fetcher = GatedFetcher()
+      let workflow = fixture.makeWorkflow(fetcher: fetcher)
+      defer {
+        workflow.stopSubscriptionAutomaticUpdates()
+        fetcher.releaseAll()
+      }
+      workflow.startSubscriptionAutomaticUpdates()
+      try await requireTestCondition("first due fetch entered") { fetcher.didEnterFetch }
+      #expect(fetcher.requestCount == 1)
+      fixture.now = fixture.now.addingTimeInterval(1_000)
+      fetcher.releaseAll()
+      try await requireTestCondition("automatic batch completed") {
+        fetcher.requestCount == 2 && workflow.refreshingSubscriptionIDs.isEmpty
+      }
+      #expect(fetcher.requestCount == 2)
+    }
+  }
+
+  @Test func schedulerStartsWithOverduePlanAndStopsBeforeFurtherRequests() async throws {
+    try await withAutoUpdateFixture { fixture in
+      _ = try await fixture.create(settings: .init(userOverride: .daily))
+      fixture.now = fixture.now.addingTimeInterval(1_000_000)
+      let fetcher = GatedFetcher()
+      let scheduled = TestAsyncGate("next automatic update scheduled")
+      let workflow = fixture.makeWorkflow(
+        fetcher: fetcher,
+        wait: { delay in
+          if delay > 0 {
+            scheduled.release()
+            try await Task.sleep(for: .seconds(delay))
+          }
+        })
+      defer {
+        fetcher.releaseAll()
+        workflow.stopSubscriptionAutomaticUpdates()
+      }
+      workflow.startSubscriptionAutomaticUpdates()
+      try await requireTestCondition("automatic fetch entered") { fetcher.didEnterFetch }
+      workflow.subscriptionAutomaticUpdatesDidWake()
+      #expect(fetcher.requestCount == 1)
+      fetcher.releaseAll()
+      try #require(await scheduled.wait())
+      #expect(
+        workflow.subscriptions.first?.autoUpdate.nextUpdateAt
+          == fixture.now.addingTimeInterval(86_400))
+      workflow.stopSubscriptionAutomaticUpdates()
+      fixture.now = fixture.now.addingTimeInterval(1_000_000)
+      workflow.subscriptionAutomaticUpdatesDidWake()
+      #expect(fetcher.requestCount == 1)
+    }
+  }
+
+  @Test func timerAndWakeRefreshOnlyAfterThePersistedDeadline() async throws {
+    try await withAutoUpdateFixture { fixture in
+      _ = try await fixture.create(settings: .init(userOverride: .daily))
+      let sleeping = TestAsyncGate("scheduler waiting for deadline")
+      let advance = TestAsyncGate("clock advances")
+      let fetcher = GatedFetcher()
+      let workflow = fixture.makeWorkflow(
+        fetcher: fetcher,
+        wait: { _ in
+          sleeping.release()
+          _ = await advance.wait()
+        })
+      defer {
+        advance.release()
+        fetcher.releaseAll()
+        workflow.stopSubscriptionAutomaticUpdates()
+      }
+      workflow.startSubscriptionAutomaticUpdates()
+      try #require(await sleeping.wait())
+      #expect(fetcher.requestCount == 0)
+      fixture.now = fixture.now.addingTimeInterval(86_400)
+      advance.release()
+      try await requireTestCondition("timer fires at deadline") { fetcher.didEnterFetch }
+      workflow.stopSubscriptionAutomaticUpdates()
+      fetcher.releaseAll()
+      // A fresh workflow resumes the still-overdue persisted plan on wake.
+      let resumedFetcher = GatedFetcher()
+      let resumed = fixture.makeWorkflow(fetcher: resumedFetcher)
+      defer {
+        resumedFetcher.releaseAll()
+        resumed.stopSubscriptionAutomaticUpdates()
+      }
+      resumed.startSubscriptionAutomaticUpdates()
+      resumed.subscriptionAutomaticUpdatesDidWake()
+      try await requireTestCondition("wake fetch entered") { resumedFetcher.didEnterFetch }
+      #expect(resumedFetcher.requestCount == 1)
+    }
+  }
+}
+
+private struct URLChangeFetcher: SubscriptionFetching {
+  let entered = TestAsyncGate("old URL request entered")
+  let release = TestAsyncGate("old URL response released")
+
+  func fetch(_ url: URL) async throws -> Data {
+    if url.host == "new.example.com" { throw SubscriptionFetchError.httpStatus(code: 503) }
+    entered.release()
+    _ = await release.wait()
+    return Data(
+      #"""
+      {"version":1,"servers":[],"x_shadowsocksx_ng":{"schema_version":1,
+      "auto_update":{"mode":"daily","allow_user_override":false}}}
+      """#.utf8)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateWorkflowTests.swift
new file mode 100644
index 000000000..f1d49fbdf
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionAutoUpdateWorkflowTests.swift
@@ -0,0 +1,233 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct SubscriptionAutoUpdateWorkflowTests {
+  @Test func newSubscriptionsDefaultToOffAndDailyWithoutAPlan() async throws {
+    try await withAutoUpdateFixture { fixture in
+      let summary = try await fixture.create()
+      #expect(summary.autoUpdate.effectiveMode == .off)
+      #expect(summary.autoUpdate.interval == .daily)
+      #expect(summary.autoUpdate.nextUpdateAt == nil)
+    }
+  }
+
+  @Test func providerPolicyEnablesUpdatesWithoutAGroupTree() async throws {
+    try await withAutoUpdateFixture { fixture in
+      fixture.respond(mode: .daily, allowsOverride: false)
+      let summary = try await fixture.create()
+      #expect(summary.autoUpdate.effectiveMode == .daily)
+      #expect(!summary.autoUpdate.allowsUserOverride)
+      #expect(summary.autoUpdate.nextUpdateAt == fixture.now.addingTimeInterval(86_400))
+    }
+  }
+
+  @Test(arguments: [SubscriptionUpdateMode.daily, .weekly], [0.0, 0.1])
+  func schedulesFromCompletionAndRetainsPlanAcrossReload(
+    mode: SubscriptionUpdateMode, jitter: Double
+  ) async throws {
+    try await withAutoUpdateFixture { fixture in
+      fixture.jitter = jitter
+      let first = try await fixture.create()
+      try await fixture.workflow.saveSubscription(
+        first.id, urlString: "https://example.com/sub", autoUpdate: .init(userOverride: mode))
+      let seconds: TimeInterval =
+        mode == .daily ? (jitter == 0 ? 86_400 : 95_040) : (jitter == 0 ? 604_800 : 665_280)
+      #expect(fixture.summary.autoUpdate.nextUpdateAt == fixture.now.addingTimeInterval(seconds))
+      fixture.now = fixture.now.addingTimeInterval(100)
+      await fixture.workflow.refreshSubscription(first.id)
+      let success = fixture.summary
+      #expect(success.autoUpdate.nextUpdateAt == fixture.now.addingTimeInterval(seconds))
+      fixture.now = fixture.now.addingTimeInterval(200)
+      fixture.fetcher.setBehavior(.failure(.httpStatus(code: 503)))
+      await fixture.workflow.refreshSubscription(first.id)
+      #expect(fixture.summary.autoUpdate.nextUpdateAt == fixture.now.addingTimeInterval(seconds))
+      #expect(fixture.summary.lastSucceededAt == success.lastSucceededAt)
+      let reloaded = fixture.makeWorkflow()
+      #expect(reloaded.subscriptions == fixture.workflow.subscriptions)
+    }
+  }
+
+  @Test func forcedPolicyPreservesOverrideThenFollowingClearsIt() async throws {
+    try await withAutoUpdateFixture { fixture in
+      let first = try await fixture.create()
+      try await fixture.workflow.saveSubscription(
+        first.id, urlString: "https://example.com/sub",
+        autoUpdate: .init(userOverride: .weekly, interval: .weekly))
+      fixture.respond(mode: .off, allowsOverride: false)
+      await fixture.workflow.refreshSubscription(first.id)
+      #expect(fixture.summary.autoUpdate.effectiveMode == .off)
+      #expect(fixture.summary.autoUpdate.userOverride == .weekly)
+      try await fixture.workflow.saveSubscription(
+        first.id, urlString: "https://example.com/sub", autoUpdate: .init(userOverride: .daily))
+      #expect(fixture.summary.autoUpdate.userOverride == .weekly)
+      fixture.respond(mode: .daily, allowsOverride: true)
+      await fixture.workflow.refreshSubscription(first.id)
+      #expect(fixture.summary.autoUpdate.effectiveMode == .weekly)
+      try await fixture.workflow.saveSubscription(
+        first.id, urlString: "https://example.com/sub", autoUpdate: .init())
+      #expect(fixture.summary.autoUpdate.userOverride == nil)
+      #expect(fixture.summary.autoUpdate.effectiveMode == .daily)
+      fixture.fetcher.setBehavior(.success(SubscriptionDocs.flat(serverCount: 0)))
+      await fixture.workflow.refreshSubscription(first.id)
+      #expect(fixture.summary.autoUpdate.provider == nil)
+      #expect(fixture.summary.autoUpdate.effectiveMode == .off)
+      #expect(fixture.summary.autoUpdate.nextUpdateAt == nil)
+    }
+  }
+
+  @Test func invalidOrFailedResponseRetainsPolicyButMissingPolicyWithdrawsIt() async throws {
+    try await withAutoUpdateFixture { fixture in
+      fixture.respond(mode: .daily, allowsOverride: false)
+      let first = try await fixture.create()
+      let policy = fixture.summary.autoUpdate.provider
+      fixture.fetcher.setBehavior(
+        .success(
+          Data(
+            #"{"version":1,"servers":[],"x_shadowsocksx_ng":{"schema_version":1,"auto_update":{}}}"#
+              .utf8)))
+      await fixture.workflow.refreshSubscription(first.id)
+      #expect(fixture.summary.autoUpdate.provider == policy)
+      if case .succeeded = fixture.summary.status {
+      } else {
+        Issue.record("Valid servers must still commit")
+      }
+      fixture.fetcher.setBehavior(.failure(.httpStatus(code: 503)))
+      await fixture.workflow.refreshSubscription(first.id)
+      #expect(fixture.summary.autoUpdate.provider == policy)
+      fixture.fetcher.setBehavior(.success(SubscriptionDocs.flat(serverCount: 0)))
+      await fixture.workflow.refreshSubscription(first.id)
+      #expect(fixture.summary.autoUpdate.provider == nil)
+    }
+  }
+
+  @Test func settingsOnlyReplanWhenEffectiveModeChangesAndNeverConvergeRuntime() async throws {
+    try await withAutoUpdateFixture { fixture in
+      fixture.respond(mode: .daily, allowsOverride: true)
+      let first = try await fixture.create()
+      for _ in 0..<100 {
+        if case .syncing = fixture.coordinator.syncStatus { await Task.yield() } else { break }
+      }
+      if case .syncing = fixture.coordinator.syncStatus { Issue.record("Runtime did not settle") }
+      let converges = fixture.runtime.convergeCount
+      let plan = fixture.summary.autoUpdate.nextUpdateAt
+      let requests = fixture.fetcher.requestCount
+      fixture.now = fixture.now.addingTimeInterval(100)
+      try await fixture.workflow.saveSubscription(
+        first.id, urlString: "https://example.com/sub", autoUpdate: .init(userOverride: .daily))
+      #expect(fixture.summary.autoUpdate.nextUpdateAt == plan)
+      try await fixture.workflow.saveSubscription(
+        first.id, urlString: "https://example.com/sub",
+        autoUpdate: .init(userOverride: .weekly, interval: .weekly))
+      #expect(fixture.summary.autoUpdate.nextUpdateAt == fixture.now.addingTimeInterval(604_800))
+      try await fixture.workflow.saveSubscription(
+        first.id, urlString: "https://example.com/sub",
+        autoUpdate: .init(userOverride: .off, interval: .weekly))
+      #expect(fixture.summary.autoUpdate.nextUpdateAt == nil)
+      #expect(fixture.summary.autoUpdate.interval == .weekly)
+      #expect(fixture.fetcher.requestCount == requests)
+      #expect(fixture.runtime.convergeCount == converges)
+    }
+  }
+
+  @Test func dueRefreshRunsOnceAfterManyMissedCyclesAndFailuresDoNotBlockOthers() async throws {
+    try await withAutoUpdateFixture { fixture in
+      let first = try await fixture.create(settings: .init(userOverride: .daily))
+      let second = try await fixture.create(settings: .init(userOverride: .daily))
+      let requests = fixture.fetcher.requestCount
+      fixture.workflow.startSubscriptionAutomaticUpdates()
+      #expect(fixture.fetcher.requestCount == requests)
+      fixture.now = fixture.now.addingTimeInterval(1_000_000)
+      fixture.fetcher.setBehavior(.failure(.httpStatus(code: 503)))
+      fixture.workflow.subscriptionAutomaticUpdatesDidWake()
+      try await requireTestCondition("all overdue updates completed") {
+        fixture.fetcher.requestCount == requests + 2
+          && fixture.workflow.refreshingSubscriptionIDs.isEmpty
+      }
+      fixture.workflow.subscriptionAutomaticUpdatesDidWake()
+      #expect(fixture.fetcher.requestCount == requests + 2)
+      #expect(fixture.workflow.subscriptions.map(\.id) == [first.id, second.id])
+      #expect(
+        fixture.workflow.subscriptions.allSatisfy {
+          $0.autoUpdate.nextUpdateAt == fixture.now.addingTimeInterval(86_400)
+        })
+    }
+  }
+
+  @Test func legacyRecordWithoutEnvelopeLoadsDisabledWithoutFetching() async throws {
+    try await withAutoUpdateFixture { fixture in
+      let first = try await fixture.create()
+      let record = try #require(fixture.coordinator.committedSubscriptions.first)
+      var json = try #require(
+        JSONSerialization.jsonObject(with: JSONEncoder().encode(record)) as? [String: Any])
+      json.removeValue(forKey: "autoUpdateState")
+      let old = try JSONDecoder().decode(
+        SubscriptionRecord.self, from: JSONSerialization.data(withJSONObject: json))
+      #expect(old.autoUpdate.effectiveMode == .off)
+      #expect(old.autoUpdate.interval == .daily)
+      let requests = fixture.fetcher.requestCount
+      let reload = fixture.makeWorkflow()
+      reload.startSubscriptionAutomaticUpdates()
+      reload.subscriptionAutomaticUpdatesDidWake()
+      reload.stopSubscriptionAutomaticUpdates()
+      #expect(reload.subscriptions.first?.id == first.id)
+      #expect(fixture.fetcher.requestCount == requests)
+    }
+  }
+}
+
+@MainActor
+func withAutoUpdateFixture(_ body: (AutoUpdateFixture) async throws -> Void) async throws {
+  let fixture = AutoUpdateFixture()
+  defer {
+    fixture.workflow.stopSubscriptionAutomaticUpdates()
+    try? FileManager.default.removeItem(at: fixture.directory)
+  }
+  try await body(fixture)
+}
+
+@MainActor
+final class AutoUpdateFixture {
+  let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+  var now = Date(timeIntervalSince1970: 1_700_000_000)
+  var jitter = 0.0
+  let runtime = FakeCatalogRuntime()
+  let fetcher = FakeSubscriptionFetcher(behavior: .success(SubscriptionDocs.flat(serverCount: 0)))
+  lazy var store = makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.json"))
+  lazy var coordinator = CatalogCommitCoordinator(fileStore: store, runtime: runtime)
+  lazy var workflow = makeWorkflow(coordinator: coordinator)
+  var summary: SubscriptionSummary { workflow.subscriptions[0] }
+
+  func makeWorkflow(
+    coordinator: CatalogCommitCoordinator? = nil, fetcher: SubscriptionFetching? = nil,
+    wait: @escaping (TimeInterval) async throws -> Void = {
+      try await Task.sleep(for: .seconds($0))
+    }
+  ) -> CatalogWorkflow {
+    makeCatalogWorkflow(
+      coordinator: coordinator
+        ?? CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime()),
+      subscriptionFetcher: fetcher ?? self.fetcher,
+      subscriptionNow: { [unowned self] in self.now },
+      subscriptionJitter: { [unowned self] in self.jitter }, subscriptionWait: wait)
+  }
+
+  func create(settings: SubscriptionAutoUpdateSettings = .init()) async throws
+    -> SubscriptionSummary
+  {
+    try await workflow.createSubscription(
+      urlString: "https://example.com/sub", autoUpdate: settings)
+  }
+
+  func respond(mode: SubscriptionUpdateMode, allowsOverride: Bool) {
+    fetcher.setBehavior(
+      .success(
+        Data(
+          """
+          {"version":1,"servers":[],"x_shadowsocksx_ng":{"schema_version":1,
+          "auto_update":{"mode":"\(mode.rawValue)","allow_user_override":\(allowsOverride)}}}
+          """.utf8)))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionDocumentParserTests+SchemaValidation.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionDocumentParserTests+SchemaValidation.swift
new file mode 100644
index 000000000..a3ce4e254
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionDocumentParserTests+SchemaValidation.swift
@@ -0,0 +1,96 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension SubscriptionDocumentParserTests {
+  // MARK: schema 与记录校验失败（整份拒绝）
+
+  func testUnsupportedVersionThrows() {
+    let data = Data(#"{"version": 2, "servers": []}"#.utf8)
+
+    XCTAssertThrowsError(try parse(data)) { error in
+      XCTAssertEqual(error as? SubscriptionParseError, .unsupportedSchemaVersion)
+    }
+  }
+
+  func testMissingVersionThrows() {
+    XCTAssertThrowsError(try parse(Data(#"{"servers": []}"#.utf8))) { error in
+      XCTAssertEqual(error as? SubscriptionParseError, .unsupportedSchemaVersion)
+    }
+  }
+
+  func testMissingServersThrows() {
+    XCTAssertThrowsError(try parse(Data(#"{"version": 1}"#.utf8))) { error in
+      XCTAssertEqual(error as? SubscriptionParseError, .missingServers)
+    }
+  }
+
+  func testMalformedJSONThrowsDecodingFailure() {
+    XCTAssertThrowsError(try parse(Data(#"{"version": 1, "servers": ["#.utf8))) { error in
+      XCTAssertEqual(error as? SubscriptionParseError, .decodingFailure)
+    }
+  }
+
+  func testServersNotAnArrayThrowsDecodingFailure() {
+    XCTAssertThrowsError(try parse(Data(#"{"version": 1, "servers": "nope"}"#.utf8))) { error in
+      XCTAssertEqual(error as? SubscriptionParseError, .decodingFailure)
+    }
+  }
+
+  func testRecordValidationFailuresThrowWithIndex() {
+    let cases: [(String, String)] = [
+      (#"{"server": "h", "server_port": 8388, "password": "p"}"#, "method"),
+      (#"{"server": "h", "server_port": 8388, "method": "m"}"#, "password"),
+      (#"{"server_port": 8388, "password": "p", "method": "m"}"#, "server"),
+      (#"{"server": "", "server_port": 8388, "password": "p", "method": "m"}"#, "server"),
+      (#"{"server": "h", "server_port": 0, "password": "p", "method": "m"}"#, "server_port"),
+      (#"{"server": "h", "server_port": 65536, "password": "p", "method": "m"}"#, "server_port"),
+      (#"{"server": "h", "server_port": 8388, "password": "", "method": "m"}"#, "password"),
+      (
+        #"{"id": "not-a-uuid", "server": "h", "server_port": 8388, "password": "p", "method": "m"}"#,
+        "id",
+      ),
+    ]
+    for (record, expectedField) in cases {
+      let data = Data("{\"version\": 1, \"servers\": [\(record)]}".utf8)
+      XCTAssertThrowsError(try parse(data), expectedField) { error in
+        guard case .recordValidation(let index, let reason) = error as? SubscriptionParseError
+        else {
+          return XCTFail("\(expectedField): 应报 recordValidation，实际 \(error)")
+        }
+        XCTAssertEqual(index, 0)
+        XCTAssertTrue(reason.contains(expectedField), "\(expectedField): \(reason)")
+      }
+    }
+  }
+
+  func testDuplicateServerIDThrows() {
+    let data = Data(
+      """
+      {"version": 1, "servers": [
+        {"id": "aaaaaaaa-0000-4000-8000-00000000000a", "server": "203.0.113.1", "server_port": 8388,
+         "password": "p", "method": "m"},
+        {"id": "aaaaaaaa-0000-4000-8000-00000000000a", "server": "203.0.113.9", "server_port": 9999,
+         "password": "q", "method": "n"}]}
+      """.utf8)
+
+    XCTAssertThrowsError(try parse(data)) { error in
+      XCTAssertEqual(
+        error as? SubscriptionParseError,
+        .duplicateServerID(id: "id:aaaaaaaa-0000-4000-8000-00000000000a"))
+    }
+  }
+
+  func testIdenticalIdLessRecordsAreDuplicateIdentity() {
+    let record =
+      #"{"server": "203.0.113.1", "server_port": 8388, "password": "p", "method": "m"}"#
+    let data = Data("{\"version\": 1, \"servers\": [\(record), \(record)]}".utf8)
+
+    XCTAssertThrowsError(try parse(data)) { error in
+      guard case .duplicateServerID(let id) = error as? SubscriptionParseError else {
+        return XCTFail("应报 duplicateServerID，实际 \(error)")
+      }
+      XCTAssertTrue(id.hasPrefix("content:"), "无稳定 ID 用内容指纹判重")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionDocumentParserTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionDocumentParserTests.swift
new file mode 100644
index 000000000..0edb74a78
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionDocumentParserTests.swift
@@ -0,0 +1,282 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// SIP-008 v1 + 私有扩展解析（验收：解码/schema/重复 ID/环/记录校验
+/// 失败逐项覆盖；扩展缺失/未知/无效回退标准列表）。
+final class SubscriptionDocumentParserTests: XCTestCase {
+  private let subscriptionID = NodeID(rawValue: "sub-test")
+
+  // MARK: 文档夹具
+
+  private func flatDoc(serverCount: Int = 2) -> Data {
+    let servers = (1...serverCount).map { index in
+      """
+      {"id": "00000000-0000-4000-8000-00000000000\(index)",
+       "remarks": "节点 \(index)",
+       "server": "203.0.113.\(index)", "server_port": \(8387 + index),
+       "password": "pw\(index)", "method": "aes-256-gcm"}
+      """
+    }.joined(separator: ",")
+    return Data(
+      """
+      {"version": 1, "servers": [\(servers)]}
+      """.utf8)
+  }
+
+  private func treeDoc(
+    schemaVersion: Int = 1,
+    serverRefIDs: [String] = ["aaaaaaaa-0000-4000-8000-00000000000a"],
+    groups: String? = nil,
+    rootGroupID: String = "root"
+  ) -> Data {
+    let groupJSON: String
+    if let groups {
+      groupJSON = groups
+    } else {
+      let refs =
+        serverRefIDs
+        .map { #"{"type": "server", "id": "\#($0)"}"# }
+        .joined(separator: ",")
+      groupJSON = """
+        {"id": "root", "name": "Example subscription", "children": [
+           {"type": "group", "id": "jp"}\(refs.isEmpty ? "" : ", \(refs)")]},
+        {"id": "jp", "name": "Japan", "children": [{"type": "server", "id": "bbbbbbbb-0000-4000-8000-00000000000b"}]}
+        """
+    }
+    return Data(
+      """
+      {"version": 1,
+       "servers": [
+         {"id": "aaaaaaaa-0000-4000-8000-00000000000a", "server": "203.0.113.1", "server_port": 8388,
+          "password": "p1", "method": "aes-256-gcm"},
+         {"id": "bbbbbbbb-0000-4000-8000-00000000000b", "server": "203.0.113.2", "server_port": 8389,
+          "password": "p2", "method": "aes-256-gcm"}],
+       "x_shadowsocksx_ng": {"schema_version": \(schemaVersion), "root_group_id": "\(rootGroupID)",
+         "groups": [\(groupJSON)]}}
+      """.utf8)
+  }
+
+  func parse(_ data: Data) throws -> SubscriptionSnapshot {
+    try SubscriptionDocumentParser.parse(data, subscriptionID: subscriptionID)
+  }
+
+  private func serverIDs(_ group: SubscriptionSnapshot.Group) -> [String] {
+    group.children.compactMap {
+      if case .server(let leaf) = $0 { return leaf.id.rawValue }
+      return nil
+    }
+  }
+
+  private func serverRecords(_ group: SubscriptionSnapshot.Group) -> [RemoteServerRecord] {
+    group.children.compactMap {
+      if case .server(let leaf) = $0 { return leaf.record }
+      return nil
+    }
+  }
+
+  // MARK: 标准列表与扩展树
+
+  func testFlatDocumentParsesServersInArrayOrder() throws {
+    let snapshot = try parse(flatDoc())
+
+    XCTAssertEqual(
+      snapshot.root.children.filter { if case .group = $0 { return true } else { return false } }
+        .count, 0, "扁平回退无嵌套分组")
+    XCTAssertEqual(serverIDs(snapshot.root).count, 2)
+    XCTAssertTrue(serverIDs(snapshot.root).allSatisfy { $0.hasPrefix("sub-test:id:") })
+    let records = serverRecords(snapshot.root)
+    XCTAssertEqual(records[0].address, "203.0.113.1")
+    XCTAssertEqual(records[0].port, 8388)
+    XCTAssertEqual(records[0].remark, "节点 1")
+    XCTAssertEqual(records[1].password, "pw2")
+  }
+
+  func testExtensionTreeParsesNestedGroupsAndOrder() throws {
+    let snapshot = try parse(treeDoc())
+
+    XCTAssertEqual(snapshot.root.name, "Example subscription")
+    // 根分组子序 = [嵌套组 Japan, 服务器 a]（远端交错顺序原样保留）。
+    XCTAssertEqual(snapshot.root.children.count, 2)
+    guard case .group(let japan) = snapshot.root.children[0] else {
+      return XCTFail("首子应为嵌套组")
+    }
+    guard case .server(let rootServer) = snapshot.root.children[1] else {
+      return XCTFail("次子应为服务器")
+    }
+    XCTAssertEqual(japan.name, "Japan")
+    XCTAssertEqual(rootServer.record.address, "203.0.113.1")
+    XCTAssertEqual(serverRecords(japan).map(\.address), ["203.0.113.2"])
+    // 分组身份按订阅作用域限定且跨刷新稳定。
+    XCTAssertTrue(japan.id.rawValue.hasPrefix("sub-test:g:jp"))
+  }
+
+  func testEmptyServersIsValidEmptySnapshot() throws {
+    let snapshot = try parse(Data(#"{"version": 1, "servers": []}"#.utf8))
+
+    XCTAssertEqual(snapshot.root.children.count, 0)
+  }
+
+  func testPluginFieldsCarriedVerbatim() throws {
+    let data = Data(
+      """
+      {"version": 1, "servers": [
+        {"id": "aaaaaaaa-0000-4000-8000-00000000000a", "server": "203.0.113.1", "server_port": 443,
+        "password": "p", "method": "aes-256-gcm",
+        "plugin": "v2ray-plugin", "plugin_opts": "mode=websocket;host=example.com"}]}
+      """.utf8)
+
+    let snapshot = try parse(data)
+
+    let records = serverRecords(snapshot.root)
+    XCTAssertEqual(records[0].pluginProgram, "v2ray-plugin")
+    XCTAssertEqual(records[0].pluginOptions, "mode=websocket;host=example.com")
+  }
+
+  // MARK: 扩展缺失/未知/无效 → 回退扁平
+
+  func testMissingExtensionFallsBackToFlat() throws {
+    let snapshot = try parse(flatDoc())
+
+    XCTAssertEqual(snapshot.root.name, "", "扁平回退无根名（由调用方以 host 兜底）")
+    XCTAssertEqual(serverIDs(snapshot.root).count, 2)
+  }
+
+  func testUnknownSchemaVersionFallsBackToFlat() throws {
+    let snapshot = try parse(treeDoc(schemaVersion: 2))
+
+    XCTAssertEqual(snapshot.root.name, "")
+    XCTAssertEqual(serverIDs(snapshot.root).count, 2, "标准服务器不因扩展版本未知而丢失")
+    XCTAssertEqual(
+      snapshot.root.children.filter { if case .group = $0 { return true } else { return false } }
+        .count, 0)
+  }
+
+  func testExtensionNotAnObjectFallsBackToFlat() throws {
+    let data = Data(
+      """
+      {"version": 1, "servers": [], "x_shadowsocksx_ng": "broken"}
+      """.utf8)
+
+    let snapshot = try parse(data)
+
+    XCTAssertEqual(serverIDs(snapshot.root).count, 0)
+  }
+
+  func testUnknownServerRefFallsBackToFlat() throws {
+    let snapshot = try parse(treeDoc(serverRefIDs: ["ghost"]))
+
+    XCTAssertEqual(snapshot.root.name, "")
+    XCTAssertEqual(serverIDs(snapshot.root).count, 2, "引用损坏时保留标准服务器")
+  }
+
+  func testCycleFallsBackToFlat() throws {
+    let groups = """
+      {"id": "root", "name": "R", "children": [{"type": "group", "id": "jp"}]},
+      {"id": "jp", "name": "J", "children": [{"type": "group", "id": "root"}]}
+      """
+    let snapshot = try parse(treeDoc(groups: groups))
+
+    XCTAssertEqual(snapshot.root.name, "", "环使扩展无效 → 回退扁平")
+    XCTAssertEqual(serverIDs(snapshot.root).count, 2)
+    XCTAssertEqual(
+      snapshot.root.children.filter { if case .group = $0 { return true } else { return false } }
+        .count, 0)
+  }
+
+  func testSharedParentFallsBackToFlat() throws {
+    let groups = """
+      {"id": "root", "name": "R", "children": [
+        {"type": "group", "id": "x"}, {"type": "group", "id": "y"}]},
+      {"id": "x", "name": "X", "children": [{"type": "group", "id": "shared"}]},
+      {"id": "y", "name": "Y", "children": [{"type": "group", "id": "shared"}]},
+      {"id": "shared", "name": "S", "children": []}
+      """
+    let snapshot = try parse(treeDoc(groups: groups))
+
+    XCTAssertEqual(snapshot.root.name, "", "同一分组被两个父引用 → 扩展无效")
+  }
+
+  func testDuplicateGroupIDFallsBackToFlat() throws {
+    let groups = """
+      {"id": "root", "name": "R", "children": []},
+      {"id": "root", "name": "R2", "children": []}
+      """
+    let snapshot = try parse(treeDoc(groups: groups))
+
+    XCTAssertEqual(snapshot.root.name, "")
+  }
+
+  func testGroupIDCollidingWithServerIDFallsBackToFlat() throws {
+    let groups = """
+      {"id": "aaaaaaaa-0000-4000-8000-00000000000a", "name": "冒充服务器 ID", "children": []},
+      {"id": "root", "name": "R", "children": [{"type": "group", "id": "aaaaaaaa-0000-4000-8000-00000000000a"}]}
+      """
+    let snapshot = try parse(treeDoc(groups: groups))
+
+    XCTAssertEqual(snapshot.root.name, "")
+  }
+
+  func testMissingRootGroupFallsBackToFlat() throws {
+    let snapshot = try parse(treeDoc(rootGroupID: "ghost"))
+
+    XCTAssertEqual(snapshot.root.name, "")
+    XCTAssertEqual(serverIDs(snapshot.root).count, 2)
+  }
+
+  func testUnreferencedServersAppendedToRootInArrayOrder() throws {
+    let groups = """
+      {"id": "root", "name": "R", "children": [{"type": "server", "id": "aaaaaaaa-0000-4000-8000-00000000000a"}]}
+      """
+    let data = Data(
+      """
+      {"version": 1,
+       "servers": [
+         {"id": "bbbbbbbb-0000-4000-8000-00000000000b", "server": "203.0.113.2", "server_port": 8389,
+          "password": "p2", "method": "m"},
+         {"id": "aaaaaaaa-0000-4000-8000-00000000000a", "server": "203.0.113.1", "server_port": 8388,
+          "password": "p1", "method": "m"}],
+       "x_shadowsocksx_ng": {"schema_version": 1, "root_group_id": "root",
+         "groups": [\(groups)]}}
+      """.utf8)
+
+    let snapshot = try parse(data)
+
+    XCTAssertEqual(serverIDs(snapshot.root).count, 2, "未引用服务器不丢弃")
+    XCTAssertEqual(serverRecords(snapshot.root)[0].address, "203.0.113.1", "树引用在前")
+    XCTAssertEqual(serverRecords(snapshot.root)[1].address, "203.0.113.2", "未引用按数组序追加")
+  }
+
+  // MARK: 身份延续规则（无稳定 ID 按地址端口精确匹配延续）
+
+  func testIdLessRecordIdentityIsStableForIdenticalContent() throws {
+    let record =
+      #"{"server": "203.0.113.1", "server_port": 8388, "password": "p", "method": "m"}"#
+    let first = try parse(Data("{\"version\": 1, \"servers\": [\(record)]}".utf8))
+    let second = try parse(Data("{\"version\": 1, \"servers\": [\(record)]}".utf8))
+
+    XCTAssertEqual(serverIDs(first.root)[0], serverIDs(second.root)[0])
+  }
+
+  func testIdLessRecordIdentitySurvivesRemoteRename() throws {
+    let base =
+      #"{"server": "203.0.113.1", "server_port": 8388, "password": "p", "method": "m", "remarks": "r"}"#
+    let original = try parse(Data("{\"version\": 1, \"servers\": [\(base)]}".utf8))
+    // 仅改 remarks（远端改名）：显示元数据不参与端点指纹。
+    let renamed =
+      #"{"server": "203.0.113.1", "server_port": 8388, "password": "p", "method": "m", "remarks": "r2"}"#
+    let changed = try parse(Data("{\"version\": 1, \"servers\": [\(renamed)]}".utf8))
+
+    XCTAssertEqual(serverIDs(original.root)[0], serverIDs(changed.root)[0])
+  }
+
+  func testIdentityScopedPerSubscription() throws {
+    let data = flatDoc()
+    let other = try SubscriptionDocumentParser.parse(
+      data, subscriptionID: NodeID(rawValue: "sub-other"))
+
+    XCTAssertTrue(serverIDs(other.root).allSatisfy { $0.hasPrefix("sub-other:id:") })
+    let baseline = try parse(data)
+    XCTAssertNotEqual(serverIDs(other.root)[0], serverIDs(baseline.root)[0])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionFetcherTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionFetcherTests.swift
new file mode 100644
index 000000000..ef58fa5c6
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionFetcherTests.swift
@@ -0,0 +1,183 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 订阅获取缝（验收「HTTP 缝夹具」的传输侧）：HTTPS 门禁先于任何
+/// 网络行为、状态码与 Content-Type 契约、传输失败点名、错误文案脱敏。
+final class SubscriptionFetcherTests: XCTestCase {
+  private let fetcher = HTTPSSubscriptionFetcher()
+
+  // MARK: URL 门禁（发起连接之前）
+
+  func testNonHTTPSRejectedBeforeAnyNetwork() async {
+    // 端口 1 无监听：若实现先连网会得到 transport 错误；断言精确错误即证明
+    // 门禁在连接之前。
+    let url = URL(string: "http://127.0.0.1:1/sub.json")!
+
+    do {
+      _ = try await fetcher.fetch(url)
+      XCTFail("HTTP 地址必须被拒绝")
+    } catch let error as SubscriptionFetchError {
+      XCTAssertEqual(error, .unsupportedScheme)
+    } catch {
+      XCTFail("应报 unsupportedScheme，实际 \(error)")
+    }
+  }
+
+  func testFTPRejected() async {
+    let url = URL(string: "ftp://127.0.0.1/sub.json")!
+    do {
+      _ = try await fetcher.fetch(url)
+      XCTFail("非 HTTPS 必须被拒绝")
+    } catch let error as SubscriptionFetchError {
+      XCTAssertEqual(error, .unsupportedScheme)
+    } catch {
+      XCTFail("应报 unsupportedScheme，实际 \(error)")
+    }
+  }
+
+  func testURLWithoutHostRejected() async {
+    let url = URL(string: "https:///path")!
+    do {
+      _ = try await fetcher.fetch(url)
+      XCTFail("无主机地址必须被拒绝")
+    } catch let error as SubscriptionFetchError {
+      XCTAssertEqual(error, .invalidURL)
+    } catch {
+      XCTFail("应报 invalidURL，实际 \(error)")
+    }
+  }
+
+  // MARK: 传输失败（连接被拒；TLS 校验走系统默认、从不忽略）
+
+  func testTransportErrorOnUnreachableHost() async throws {
+    let port = try ProxyRuntimeFixture.unusedLoopbackPort()
+    let url = URL(string: "https://127.0.0.1:\(port)/sub.json")!
+
+    do {
+      _ = try await fetcher.fetch(url)
+      XCTFail("无监听端口必须报传输失败")
+    } catch let error as SubscriptionFetchError {
+      guard case .transport = error else {
+        return XCTFail("应报 transport，实际 \(error)")
+      }
+    } catch {
+      XCTFail("应报 transport，实际 \(error)")
+    }
+  }
+
+  // MARK: 响应契约（纯函数）
+
+  func testValidateAcceptsExactContentType() {
+    XCTAssertNoThrow(
+      try HTTPSSubscriptionFetcher.validate(
+        statusCode: 200, contentType: "application/json; charset=utf-8"))
+  }
+
+  func testValidateIsCaseAndWhitespaceInsensitive() {
+    XCTAssertNoThrow(
+      try HTTPSSubscriptionFetcher.validate(
+        statusCode: 200, contentType: "Application/JSON ;  charset=UTF-8"))
+  }
+
+  func testValidateRejectsContractViolations() {
+    struct Case {
+      let status: Int
+      let type: String?
+      let expected: SubscriptionFetchError
+    }
+    let cases: [Case] = [
+      Case(status: 404, type: "application/json; charset=utf-8", expected: .httpStatus(code: 404)),
+      Case(status: 500, type: "application/json; charset=utf-8", expected: .httpStatus(code: 500)),
+      Case(status: 301, type: "application/json; charset=utf-8", expected: .httpStatus(code: 301)),
+      Case(status: 200, type: nil, expected: .contentType(received: nil)),
+      Case(
+        status: 200, type: "text/plain; charset=utf-8",
+        expected: .contentType(received: "text/plain; charset=utf-8")),
+      Case(
+        status: 200, type: "application/json",
+        expected: .contentType(received: "application/json")),
+      Case(
+        status: 200, type: "application/json; charset=latin1",
+        expected: .contentType(received: "application/json; charset=latin1")),
+      Case(
+        status: 200, type: "application/json; charset=utf-8; boundary=x",
+        expected: .contentType(received: "application/json; charset=utf-8; boundary=x")),
+    ]
+    for violation in cases {
+      XCTAssertThrowsError(
+        try HTTPSSubscriptionFetcher.validate(
+          statusCode: violation.status, contentType: violation.type),
+        String(describing: violation.expected)
+      ) { error in
+        XCTAssertEqual(error as? SubscriptionFetchError, violation.expected)
+      }
+    }
+  }
+
+  // MARK: 重定向策略（纯函数）与脱敏
+
+  func testRedirectPolicyOnlyAllowsHTTPS() {
+    XCTAssertTrue(HTTPSSubscriptionFetcher.allowsRedirect(to: "https"))
+    XCTAssertTrue(HTTPSSubscriptionFetcher.allowsRedirect(to: "HTTPS"))
+    XCTAssertFalse(HTTPSSubscriptionFetcher.allowsRedirect(to: "http"))
+    XCTAssertFalse(HTTPSSubscriptionFetcher.allowsRedirect(to: nil))
+  }
+
+  func testTransportDetailNeverCarriesURL() {
+    let error = URLError(.cannotFindHost)
+    let detail = HTTPSSubscriptionFetcher.redactedTransportDetail(error)
+
+    XCTAssertFalse(detail.contains("sub.json"), "传输错误细节不得携带 URL：\(detail)")
+    XCTAssertFalse(detail.contains("example.com"), "传输错误细节不得携带主机：\(detail)")
+    XCTAssertTrue(detail.contains("URLError"), "点名错误类型：\(detail)")
+  }
+}
+
+/// 获取缝夹具：按 URL 返回预设结果并记录请求（VM 语义测试用）。
+final class FakeSubscriptionFetcher: SubscriptionFetching, @unchecked Sendable {
+  enum Behavior {
+    case success(Data)
+    case failure(SubscriptionFetchError)
+  }
+
+  private let lock = NSLock()
+  private var behavior: Behavior
+  private var requests: [URL] = []
+
+  init(behavior: Behavior) {
+    self.behavior = behavior
+  }
+
+  /// 中途切换预设结果（工作流不再暴露可替换的获取器属性）。
+  func setBehavior(_ behavior: Behavior) {
+    lock.lock()
+    defer { lock.unlock() }
+    self.behavior = behavior
+  }
+
+  var lastURL: URL? {
+    lock.lock()
+    defer { lock.unlock() }
+    return requests.last
+  }
+
+  var requestCount: Int {
+    lock.lock()
+    defer { lock.unlock() }
+    return requests.count
+  }
+
+  func fetch(_ url: URL) async throws -> Data {
+    let behavior = lock.withLock {
+      requests.append(url)
+      return self.behavior
+    }
+    switch behavior {
+    case .success(let data):
+      return data
+    case .failure(let error):
+      throw error
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionInformationParserTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionInformationParserTests.swift
new file mode 100644
index 000000000..95d44d383
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionInformationParserTests.swift
@@ -0,0 +1,192 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct SubscriptionInformationParserTests {
+  @Test func subscriptionInformationUsesStandardRootAndNamespacedDateFields() throws {
+    let snapshot = try SubscriptionDocumentParser.parse(
+      Data(
+        #"""
+        {"version":1,
+        "servers":[],
+        "bytes_used":25,
+        "bytes_remaining":75,
+        "x_shadowsocksx_ng":{"schema_version":1,
+        "expires_at":"2026-10-04T08:30:00+08:00",
+        "traffic_reset_at":"2026-10-05T00:00:00.125Z"}}
+        """#
+        .utf8),
+      subscriptionID: .fresh())
+
+    #expect(snapshot.information.bytesUsed == 25)
+    #expect(snapshot.information.bytesRemaining == 75)
+    #expect(snapshot.information.expiresAt == Date(timeIntervalSince1970: 1_791_073_800))
+    #expect(snapshot.information.trafficResetAt == Date(timeIntervalSince1970: 1_791_158_400.125))
+  }
+  @Test func rfc3339OffsetOutsideTimeZoneFactoryRangeIsAccepted() throws {
+    let snapshot = try SubscriptionDocumentParser.parse(
+      Data(
+        #"{"version":1,"servers":[],"x_shadowsocksx_ng":{"schema_version":1,"expires_at":"2026-10-04T23:59:00+23:59"}}"#
+          .utf8),
+      subscriptionID: .fresh())
+    #expect(snapshot.information.expiresAt == Date(timeIntervalSince1970: 1_791_072_000))
+  }
+  @Test(arguments: [
+    "true", "false", "\"25\"", "-1", "1.5", "1.0", "1e3", "1e999", "18446744073709551616", "null",
+    "[]",
+    "{}",
+  ])
+  func invalidByteCountsDoNotDiscardValidInformation(_ literal: String) throws {
+    let snapshot = try parse(
+      #"""
+      "bytes_used":\#(literal),
+      "bytes_remaining":75,
+      "x_shadowsocksx_ng":{"schema_version":1,
+      "expires_at":"1970-01-01T00:00:00Z"}
+      """#
+    )
+    #expect(snapshot.information.bytesUsed == nil)
+    #expect(snapshot.information.bytesRemaining == 75)
+    #expect(snapshot.information.expiresAt == Date(timeIntervalSince1970: 0))
+  }
+
+  @Test func fullUnsignedRangeAndZeroAreAccepted() throws {
+    let snapshot = try parse(#""bytes_used":18446744073709551615,"bytes_remaining":0"#)
+    #expect(snapshot.information.bytesUsed == UInt64.max)
+    #expect(snapshot.information.bytesRemaining == 0)
+  }
+
+  @Test(arguments: [
+    #""2026-02-30T12:30:00Z""#, #""2026-10-04T24:00:00Z""#,
+    #""2026-10-04T00:00:00""#, #""2026-10-04T00:00:00Zjunk""#,
+    #""2026-10-04""#, #""2026-10-04T23:59:60Z""#, #""not a date""#,
+    "1791072000", "null", "true", "{}", "[]",
+  ])
+  func invalidDateDoesNotAffectOtherFields(_ literal: String) throws {
+    let snapshot = try parse(
+      #"""
+      "bytes_used":0,
+      "x_shadowsocksx_ng":{"schema_version":1,
+      "expires_at":\#(literal),
+      "traffic_reset_at":"2026-10-04T00:00:00Z"}
+      """#
+    )
+    #expect(snapshot.information.expiresAt == nil)
+    #expect(snapshot.information.trafficResetAt == Date(timeIntervalSince1970: 1_791_072_000))
+    #expect(snapshot.information.bytesUsed == 0)
+  }
+
+  @Test func rfc3339CaseOffsetsAndLeapSecondPreserveInstants() throws {
+    let snapshot = try parse(
+      #"""
+      "x_shadowsocksx_ng":{"schema_version":1,
+      "expires_at":"2026-10-03t19:00:00-05:00",
+      "traffic_reset_at":"2016-12-31T23:59:60Z"}
+      """#
+    )
+    #expect(snapshot.information.expiresAt == Date(timeIntervalSince1970: 1_791_072_000))
+    #expect(snapshot.information.trafficResetAt == Date(timeIntervalSince1970: 1_483_228_800))
+  }
+
+  @Test func informationAndGroupingValidityAreIndependent() throws {
+    let treeText = try #require(String(bytes: SubscriptionDocs.tree(), encoding: .utf8))
+      .trimmingCharacters(in: .whitespacesAndNewlines)
+    let validTree = try SubscriptionDocumentParser.parse(
+      Data(
+        (treeText.replacingOccurrences(
+          of: "\"schema_version\": 1", with: "\"schema_version\": 1,\"expires_at\":123"
+        ).dropLast() + #","bytes_used":25}"#).utf8),
+      subscriptionID: .fresh())
+    #expect(validTree.root.name == "Example subscription")
+    #expect(validTree.information.bytesUsed == 25)
+    #expect(validTree.information.expiresAt == nil)
+
+    let invalidTree = try parse(#""bytes_remaining":75,"x_shadowsocksx_ng":{"schema_version":99}"#)
+    #expect(invalidTree.root.name.isEmpty)
+    #expect(invalidTree.information.bytesRemaining == 75)
+  }
+
+  @Test func onlyExpectedPathsAreReadAcrossNestedEscapedAndUnrepresentableValues() throws {
+    let snapshot = try SubscriptionDocumentParser.parse(
+      Data(
+        #"""
+        {"version":1,"servers":[{"server":"203.0.113.7","server_port":8388,
+        "password":"{\"bytes_used\":999},\\tail","method":"aes-256-gcm","bytes_remaining":999}],
+        "ignored":1e999,"other":{"expires_at":"1970-01-01T00:00:00Z"},
+        "bytes_\u0075sed":25,"bytes_remaining":75,"expires_at":"1970-01-01T00:00:00Z",
+        "x_shadowsocksx_ng":{"schema_version":1,"ignored":1e999,"bytes_used":999,
+        "expires_\u0061t":"2026-10-04T00:00:00Z","other":{"traffic_reset_at":"1970-01-01T00:00:00Z"}}}
+        """#.utf8), subscriptionID: .fresh())
+    #expect(snapshot.information.bytesUsed == 25)
+    #expect(snapshot.information.bytesRemaining == 75)
+    #expect(snapshot.information.expiresAt == Date(timeIntervalSince1970: 1_791_072_000))
+    #expect(snapshot.information.trafficResetAt == nil)
+    #expect(snapshot.root.children.count == 1)
+  }
+
+  @Test func utf8BOMPreservesValidSubscriptionInformation() throws {
+    let data =
+      Data([0xEF, 0xBB, 0xBF])
+      + Data(#"{"version":1,"servers":[],"bytes_used":25,"bytes_remaining":75}"#.utf8)
+    let snapshot = try SubscriptionDocumentParser.parse(data, subscriptionID: .fresh())
+    #expect(snapshot.information.bytesUsed == 25)
+    #expect(snapshot.information.bytesRemaining == 75)
+  }
+
+  @Test(arguments: [
+    "null", "[]", "true", "1", #""text""#, "{}",
+    #"{"schema_version":99}"#, #"{"schema_version":null}"#,
+    #"{"schema_version":true}"#, #"{"schema_version":"1"}"#,
+    #"{"schema_version":1e999}"#,
+    #"{"expires_at":"1970-01-01T00:00:00Z"}"#,
+    #"{"schema_version":99,"expires_at":"1970-01-01T00:00:00Z"}"#,
+  ])
+  func invalidNamespaceOrVersionDoesNotReadDatesOrDiscardTraffic(_ literal: String) throws {
+    let snapshot = try parse(
+      #"""
+      "bytes_used":25,
+      "bytes_remaining":75,
+      "expires_at":"1970-01-01T00:00:00Z",
+      "traffic_reset_at":"1970-01-01T00:00:00Z",
+      "x_shadowsocksx_ng":\#(literal)
+      """#
+    )
+    #expect(snapshot.information.bytesUsed == 25)
+    #expect(snapshot.information.bytesRemaining == 75)
+    #expect(snapshot.information.expiresAt == nil)
+    #expect(snapshot.information.trafficResetAt == nil)
+  }
+
+  @Test func rootDatesAreIgnoredWithoutNamespaceFallback() throws {
+    let snapshot = try parse(
+      #""expires_at":"1970-01-01T00:00:00Z","traffic_reset_at":"1970-01-01T00:00:00Z""#)
+    #expect(snapshot.information.isEmpty)
+    let invalidDate = try parse(
+      #""expires_at":"1970-01-01T00:00:00Z","x_shadowsocksx_ng":{"schema_version":1,"expires_at":null}"#
+    )
+    #expect(invalidDate.information.isEmpty)
+  }
+
+  @Test func invalidTreeAndPolicyDoNotDiscardValidDates() throws {
+    let snapshot = try parse(
+      #"""
+      "x_shadowsocksx_ng":{"schema_version":1,
+      "groups":false,
+      "auto_update":false,
+      "expires_at":"1970-01-01T00:00:00Z",
+      "traffic_reset_at":"1970-01-02T00:00:00Z"}
+      """#
+    )
+    #expect(snapshot.information.expiresAt == Date(timeIntervalSince1970: 0))
+    #expect(snapshot.information.trafficResetAt == Date(timeIntervalSince1970: 86_400))
+    #expect(snapshot.root.children.isEmpty)
+    #expect(snapshot.autoUpdatePolicy == .invalid)
+  }
+
+  private func parse(_ fields: String) throws -> SubscriptionSnapshot {
+    try SubscriptionDocumentParser.parse(
+      Data("{\"version\":1,\"servers\":[],\(fields)}".utf8), subscriptionID: .fresh())
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionInformationPresentationTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionInformationPresentationTests.swift
new file mode 100644
index 000000000..29343eb59
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionInformationPresentationTests.swift
@@ -0,0 +1,24 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+struct SubscriptionInformationPresentationTests {
+  @Test func usageRequiresBothCountsAndNonzeroTotal() {
+    #expect(SubscriptionInformation(bytesUsed: 25, bytesRemaining: 75).usedFraction == 0.25)
+    #expect(SubscriptionInformation(bytesUsed: 0, bytesRemaining: 0).usedFraction == nil)
+    #expect(SubscriptionInformation(bytesUsed: 25).usedFraction == nil)
+    #expect(SubscriptionInformation(bytesRemaining: 75).usedFraction == nil)
+    #expect(SubscriptionInformation(bytesUsed: 0, bytesRemaining: 75).usedFraction == 0)
+    #expect(SubscriptionInformation(bytesUsed: 25, bytesRemaining: 0).usedFraction == 1)
+    #expect(
+      SubscriptionInformation(bytesUsed: .max, bytesRemaining: .max).usedFraction == 0.5)
+  }
+  @Test func byteCountFormattingUsesLocaleAndDoesNotClampToSignedRange() {
+    let locale = Locale(identifier: "en_US")
+    #expect(SubscriptionInformation.byteCountText(0, locale: locale) == "0 bytes")
+    #expect(SubscriptionInformation.byteCountText(1024, locale: locale) == "1 kB")
+    #expect(SubscriptionInformation.byteCountText(.max, locale: locale) == "16,384 PB")
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionInformationWorkflowTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionInformationWorkflowTests.swift
new file mode 100644
index 000000000..faea9b4db
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionInformationWorkflowTests.swift
@@ -0,0 +1,192 @@
+import Foundation
+import Security
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct SubscriptionInformationWorkflowTests {
+  @Test func successfulInformationSurvivesFailureAndReload() async throws {
+    try await withWorkflow { workflow, store, fetcher in
+      let summary = try await workflow.createSubscription(urlString: "https://p.example.com/sub")
+      #expect(summary.information?.bytesUsed == 25)
+      #expect(summary.information?.bytesRemaining == 75)
+      #expect(summary.information?.expiresAt == Date(timeIntervalSince1970: 0))
+      #expect(summary.information?.trafficResetAt == Date(timeIntervalSince1970: 86_400))
+      let succeededAt = try #require(summary.lastSucceededAt)
+      if case .succeeded(let attemptAt) = summary.status {
+        #expect(succeededAt == attemptAt)
+      } else {
+        Issue.record("应成功提交")
+      }
+      fetcher.setBehavior(.failure(.httpStatus(code: 503)))
+      await workflow.refreshSubscription(summary.id)
+      let failed = try #require(workflow.subscriptions.first)
+      #expect(failed.information == summary.information)
+      #expect(failed.lastSucceededAt == succeededAt)
+      let reloaded = makeCatalogWorkflow(
+        coordinator: CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime()))
+      #expect(reloaded.subscriptions.first?.information == summary.information)
+      #expect(reloaded.subscriptions.first?.lastSucceededAt == succeededAt)
+    }
+  }
+
+  @Test func successfulRefreshReplacesMissingAndInvalidFields() async throws {
+    try await withWorkflow { workflow, _, fetcher in
+      let first = try await workflow.createSubscription(urlString: "https://p.example.com/sub")
+      fetcher.setBehavior(
+        .success(
+          Data(
+            #"""
+            {"version":1,
+            "servers":[],
+            "bytes_used":50,
+            "bytes_remaining":-1,
+            "expires_at":"1970-01-01T00:00:00Z",
+            "x_shadowsocksx_ng":{"schema_version":1,
+            "expires_at":123}}
+            """#
+            .utf8)))
+      await workflow.refreshSubscription(first.id)
+      let replaced = try #require(workflow.subscriptions.first)
+      #expect(replaced.information?.bytesUsed == 50)
+      #expect(replaced.information?.bytesRemaining == nil)
+      #expect(first.information?.expiresAt != nil)
+      #expect(first.information?.trafficResetAt != nil)
+      #expect(replaced.information?.expiresAt == nil)
+      #expect(replaced.information?.trafficResetAt == nil)
+
+      fetcher.setBehavior(.success(Data(#"{"version":1,"servers":[]}"#.utf8)))
+      await workflow.refreshSubscription(first.id)
+      let empty = try #require(workflow.subscriptions.first)
+      #expect(empty.information == nil)
+      if case .succeeded(let date) = empty.status {
+        #expect(empty.lastSucceededAt == date)
+        #expect(date >= first.lastSucceededAt!)
+      } else {
+        Issue.record("无资料响应仍应成功")
+      }
+    }
+  }
+
+  @Test func cancelledRefreshCannotCommitEvenIfFetcherReturnsData() async throws {
+    try await withWorkflow { workflow, store, _ in
+      let first = try await workflow.createSubscription(urlString: "https://p.example.com/sub")
+      let bytes = try Data(contentsOf: store.fileURL)
+      let fetcher = InformationGateFetcher()
+      let reloaded = makeCatalogWorkflow(
+        coordinator: CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime()),
+        subscriptionFetcher: fetcher)
+      let refresh = Task { await reloaded.refreshSubscription(first.id) }
+      await fetcher.entered.wait()
+      refresh.cancel()
+      fetcher.release.release()
+      await refresh.value
+      #expect(reloaded.subscriptions.first == first)
+      #expect(try Data(contentsOf: store.fileURL) == bytes)
+    }
+  }
+
+  @Test func persistenceFailureDoesNotPublishNewInformation() async throws {
+    try await withWorkflow { workflow, store, fetcher in
+      let first = try await workflow.createSubscription(urlString: "https://p.example.com/sub")
+      let tree = workflow.tree
+      // 只破坏本夹具的文件路径，让原子替换失败，不影响其他 runner。
+      let directory = URL(fileURLWithPath: store.fileURL.deletingLastPathComponent().path)
+      try FileManager.default.removeItem(at: directory)
+      try Data().write(to: directory)
+      fetcher.setBehavior(.success(Data(#"{"version":1,"servers":[],"bytes_used":100}"#.utf8)))
+      await workflow.refreshSubscription(first.id)
+      #expect(workflow.subscriptions.first?.information == first.information)
+      #expect(workflow.subscriptions.first?.lastSucceededAt == first.lastSucceededAt)
+      #expect(workflow.tree == tree)
+    }
+  }
+
+  @Test func encryptedDocumentHidesSecretsAndRetainsOnlyAllowlistedInformation() async throws {
+    try await withWorkflow { workflow, store, fetcher in
+      fetcher.setBehavior(
+        .success(
+          Data(
+            #"""
+            {"version":1,
+            "servers":[{"server":"203.0.113.7",
+            "server_port":8388,
+            "method":"aes-256-gcm",
+            "password":"RAW-SERVER-PASSWORD",
+            "plugin":"v2ray-plugin",
+            "plugin_opts":"RAW-PLUGIN-OPTIONS"}],
+            "bytes_used":18446744073709551615,
+            "provider_token":"RAW-PROVIDER-TOKEN"}
+            """#
+            .utf8)))
+      let first = try await workflow.createSubscription(
+        urlString: "https://p.example.com/sub?secret=RAW-URL-TOKEN")
+      #expect(first.information?.bytesUsed == UInt64.max)
+      let raw = try Data(contentsOf: store.fileURL)
+      for secret in [
+        "RAW-SERVER-PASSWORD", "RAW-PLUGIN-OPTIONS", "RAW-PROVIDER-TOKEN", "RAW-URL-TOKEN",
+      ] {
+        #expect(raw.range(of: Data(secret.utf8)) == nil)
+      }
+      let reloaded = makeCatalogWorkflow(
+        coordinator: CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime()))
+      #expect(reloaded.subscriptions.first?.information?.bytesUsed == UInt64.max)
+    }
+  }
+
+  @Test func oldDocumentWithoutInformationOrSuccessfulTimeLoadsWithoutGuessing() async throws {
+    try await withWorkflow { workflow, store, _ in
+      _ = try await workflow.createSubscription(urlString: "https://p.example.com/sub")
+      var document = try store.load()
+      document.subscriptions[0].information = nil
+      document.subscriptions[0].lastSucceededAt = nil
+      try store.save(document)
+      let reloaded = makeCatalogWorkflow(
+        coordinator: CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime()))
+      #expect(reloaded.subscriptions.count == 1)
+      #expect(reloaded.subscriptions.first?.information == nil)
+      #expect(reloaded.subscriptions.first?.lastSucceededAt == nil)
+    }
+  }
+
+  private func withWorkflow(
+    _ body:
+      @MainActor (
+        CatalogWorkflow, CatalogFileStore, FakeSubscriptionFetcher
+      ) async throws -> Void
+  ) async throws {
+    let directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("subscription-information-\(UUID().uuidString)", isDirectory: true)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let store = makeTestCatalogStore(fileURL: directory.appendingPathComponent("catalog.json"))
+    let fetcher = FakeSubscriptionFetcher(
+      behavior: .success(
+        Data(
+          #"""
+          {"version":1,
+          "servers":[],
+          "bytes_used":25,
+          "bytes_remaining":75,
+          "x_shadowsocksx_ng":{"schema_version":1,
+          "expires_at":"1970-01-01T00:00:00Z",
+          "traffic_reset_at":"1970-01-02T00:00:00Z"}}
+          """#
+          .utf8)))
+    let workflow = makeCatalogWorkflow(
+      coordinator: CatalogCommitCoordinator(fileStore: store, runtime: FakeCatalogRuntime()),
+      subscriptionFetcher: fetcher)
+    try await body(workflow, store, fetcher)
+  }
+}
+
+private struct InformationGateFetcher: SubscriptionFetching {
+  let entered = AsyncGate()
+  let release = AsyncGate()
+
+  func fetch(_ url: URL) async throws -> Data {
+    entered.release()
+    await release.wait()
+    return Data(#"{"version":1,"servers":[],"bytes_used":100}"#.utf8)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionRefreshFailureTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionRefreshFailureTests.swift
new file mode 100644
index 000000000..70e14d0d2
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionRefreshFailureTests.swift
@@ -0,0 +1,59 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 订阅刷新失败的 durable seam：只观察可演进的安全事实，不观察文案或
+/// transient Error 的实现细节。
+final class SubscriptionRefreshFailureTests: XCTestCase {
+  func testAllDurableFailureFactsRoundTrip() throws {
+    let failures: [SubscriptionRefreshFailure] = [
+      .invalidURL,
+      .unsupportedScheme,
+      .insecureRedirect,
+      .transport(.timedOut),
+      .transport(.tls),
+      .transport(.connection),
+      .transport(.unknown),
+      .httpStatus(code: 503),
+      .contentType(.missing),
+      .contentType(.unsupported),
+      .decodingFailure,
+      .unsupportedSchemaVersion,
+      .missingServers,
+      .recordValidation(index: 3, field: .address),
+      .recordValidation(index: 3, field: .port),
+      .recordValidation(index: 3, field: .method),
+      .recordValidation(index: 3, field: .password),
+      .recordValidation(index: 3, field: .identity),
+      .duplicateIdentity,
+      .commit,
+      .unknown,
+    ]
+
+    for failure in failures {
+      let data = try JSONEncoder().encode(failure)
+      XCTAssertEqual(try JSONDecoder().decode(SubscriptionRefreshFailure.self, from: data), failure)
+    }
+  }
+
+  func testHTTPStatusFailurePayloadOmitsInternalReason() throws {
+    let failure = SubscriptionRefreshFailure.httpStatus(code: 503)
+
+    let data = try JSONEncoder().encode(failure)
+
+    let json = String(bytes: data, encoding: .utf8) ?? ""
+    XCTAssertFalse(json.contains("reason"))
+  }
+
+  func testPartialRollbackIsCoarseAndContainsNoCredentialReferences() throws {
+    let failure = SubscriptionRefreshFailure.commit
+
+    let data = try JSONEncoder().encode(failure)
+
+    let json = String(bytes: data, encoding: .utf8) ?? ""
+    XCTAssertFalse(json.contains("credential"))
+    XCTAssertFalse(json.contains("reference"))
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionRefreshFeedbackTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionRefreshFeedbackTests.swift
new file mode 100644
index 000000000..3377afe01
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionRefreshFeedbackTests.swift
@@ -0,0 +1,107 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct SubscriptionRefreshFeedbackTests {
+  @Test func successfulRefreshPublishesSessionResultWithoutReplayingOnReload() async throws {
+    let fixture = try Fixture()
+    defer { fixture.removeFiles() }
+    let summary = try await fixture.workflow.createSubscription(
+      urlString: "https://example.com/sub.json")
+    let completion = try #require(fixture.workflow.subscriptionRefreshCompletions[summary.id])
+    #expect(completion.failure == nil)
+    #expect(fixture.workflow.refreshingSubscriptionIDs.isEmpty)
+    #expect(fixture.reload().subscriptionRefreshCompletions.isEmpty)
+    await fixture.workflow.refreshAllSubscriptions()
+    let next = try #require(fixture.workflow.subscriptionRefreshCompletions[summary.id])
+    #expect(next.id != completion.id)
+  }
+
+  @Test func failedRefreshPublishesSafeFailureAndNextRefreshReplacesIt() async throws {
+    let fixture = try Fixture()
+    defer { fixture.removeFiles() }
+    let summary = try await fixture.workflow.createSubscription(
+      urlString: "https://example.com/sub.json")
+    fixture.fetcher.setBehavior(.failure(.httpStatus(code: 503)))
+    await fixture.workflow.refreshSubscription(summary.id)
+    let failure = try #require(fixture.workflow.subscriptionRefreshCompletions[summary.id])
+    #expect(failure.failure == .httpStatus(code: 503))
+    fixture.fetcher.setBehavior(.success(SubscriptionDocs.flat(serverCount: 1)))
+    try await fixture.workflow.saveSubscription(
+      summary.id, urlString: "https://example.com/new.json")
+    let success = try #require(fixture.workflow.subscriptionRefreshCompletions[summary.id])
+    #expect(success.failure == nil)
+    #expect(success.id != failure.id)
+    _ = try await fixture.workflow.removeSubscription(summary.id)
+    #expect(fixture.workflow.subscriptionRefreshCompletions[summary.id] == nil)
+  }
+
+  @Test func failureFeedbackSurvivesFailureToPersistStatus() async throws {
+    let fixture = try Fixture()
+    defer { fixture.removeFiles() }
+    let summary = try await fixture.workflow.createSubscription(
+      urlString: "https://example.com/sub.json")
+    try FileManager.default.removeItem(at: fixture.directory)
+    try Data("not a directory".utf8).write(to: fixture.directory)
+    fixture.fetcher.setBehavior(.failure(.httpStatus(code: 503)))
+    await fixture.workflow.refreshSubscription(summary.id)
+    #expect(
+      fixture.workflow.subscriptionRefreshCompletions[summary.id]?.failure == .httpStatus(code: 503)
+    )
+    #expect(fixture.workflow.subscriptions.first?.status == summary.status)
+  }
+
+  @Test func cancellationAndDuplicateRequestDoNotPublishCompletion() async throws {
+    let fixture = try Fixture()
+    defer { fixture.removeFiles() }
+    let summary = try await fixture.workflow.createSubscription(
+      urlString: "https://example.com/sub.json")
+    let gated = GatedFetcher()
+    let workflow = fixture.reload(fetcher: gated)
+    let task = Task { await workflow.refreshSubscription(summary.id) }
+    for _ in 0..<1000 {
+      if gated.didEnterFetch { break }
+      await Task.yield()
+    }
+    #expect(gated.didEnterFetch)
+    #expect(workflow.refreshingSubscriptionIDs.contains(summary.id))
+    #expect(workflow.subscriptionRefreshCompletions[summary.id] == nil)
+    await workflow.refreshSubscription(summary.id)
+    #expect(gated.requestCount == 1)
+    task.cancel()
+    gated.releaseAll()
+    await task.value
+    #expect(workflow.subscriptionRefreshCompletions[summary.id] == nil)
+    #expect(workflow.refreshingSubscriptionIDs.isEmpty)
+  }
+
+  @MainActor
+  private final class Fixture {
+    let directory: URL
+    let fetcher = FakeSubscriptionFetcher(behavior: .success(SubscriptionDocs.flat(serverCount: 1)))
+    let workflow: CatalogWorkflow
+
+    init() throws {
+      directory = FileManager.default.temporaryDirectory
+        .appendingPathComponent("subscription-feedback-\(UUID().uuidString)")
+      try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+      workflow = makeCatalogWorkflow(
+        coordinator: CatalogCommitCoordinator(
+          fileStore: makeTestCatalogStore(
+            fileURL: directory.appendingPathComponent("catalog.json")),
+          runtime: FakeCatalogRuntime()), subscriptionFetcher: fetcher)
+    }
+
+    func reload(fetcher override: SubscriptionFetching? = nil) -> CatalogWorkflow {
+      makeCatalogWorkflow(
+        coordinator: CatalogCommitCoordinator(
+          fileStore: makeTestCatalogStore(
+            fileURL: directory.appendingPathComponent("catalog.json")),
+          runtime: FakeCatalogRuntime()), subscriptionFetcher: override ?? fetcher)
+    }
+
+    func removeFiles() { try? FileManager.default.removeItem(at: directory) }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Subscription/SubscriptionSnapshotApplicationTests.swift b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionSnapshotApplicationTests.swift
new file mode 100644
index 000000000..d6c178d1b
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Subscription/SubscriptionSnapshotApplicationTests.swift
@@ -0,0 +1,178 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 订阅快照的目录应用语义：固定分组身份保留；远端删除不留
+/// 墓碑；结构、字段与顺序远端权威，不存在本地启用覆盖层。
+final class SubscriptionSnapshotApplicationTests: XCTestCase {
+  private let groupID = NodeID(rawValue: "sub1:fixed-group")
+
+  private func makeCatalog() throws -> ConfigurationCatalog {
+    var catalog = ConfigurationCatalog()
+    try catalog.addGroup("订阅分组", source: .subscription, id: groupID)
+    let nested = NodeID(rawValue: "sub1:g:jp")
+    try catalog.addGroup("日本", source: .subscription, id: nested, to: groupID)
+    let serverA = NodeID(rawValue: "sub1:id:a")
+    try catalog.addServer(
+      CatalogFixtures.serverFields(remark: "香港 01"), source: .subscription, id: serverA,
+      to: groupID)
+    let serverB = NodeID(rawValue: "sub1:id:b")
+    try catalog.addServer(
+      CatalogFixtures.serverFields(remark: "日本 02"), source: .subscription, id: serverB,
+      to: nested)
+    return catalog
+  }
+
+  private func leaf(_ id: String, fields: ServerFields = CatalogFixtures.serverFields(remark: ""))
+    -> CatalogSubscriptionSnapshot.Child
+  {
+    .server(CatalogSubscriptionSnapshot.ServerLeaf(id: NodeID(rawValue: id), fields: fields))
+  }
+
+  private func group(_ id: String, _ name: String, children: [CatalogSubscriptionSnapshot.Child])
+    -> CatalogSubscriptionSnapshot.Child
+  {
+    .group(
+      CatalogSubscriptionSnapshot.Group(id: NodeID(rawValue: id), name: name, children: children))
+  }
+
+  // MARK: 快照应用
+
+  func testSnapshotReplacesSubtreeWithoutLocalEnableOverlay() throws {
+    var catalog = try makeCatalog()
+
+    let document = CatalogSubscriptionSnapshot(
+      name: "远端新名",
+      root: .init(
+        id: groupID, name: "ignored-root",
+        children: [
+          leaf("sub1:id:b"),
+          group(
+            "sub1:g:jp", "JP", children: [leaf("sub1:id:a"), leaf("sub1:id:new")]),
+        ]))
+    let removed = try catalog.applySubscriptionSnapshot(document, into: groupID)
+
+    XCTAssertEqual(removed.count, 2, "旧树两台服务器全部视为移除（b 从嵌套组移到根）")
+    // 固定分组身份保持不变，名称跟随远端；远端子序原样落目录。
+    let fixed = try XCTUnwrap(catalog.entry(for: groupID))
+    XCTAssertEqual(
+      try catalog.children(of: groupID),
+      [NodeID(rawValue: "sub1:id:b"), NodeID(rawValue: "sub1:g:jp")])
+    guard case .group(let fields) = fixed.kind else { return XCTFail("固定分组应存在") }
+    XCTAssertEqual(fields.name, "远端新名")
+    XCTAssertEqual(fixed.source, .subscription)
+    // 旧树已重建，无墓碑：固定分组 + 根序 b + 嵌套组 + a + 新节点。
+    XCTAssertEqual(catalog.entries.count, 5)
+  }
+
+  func testRemovedRemoteMembersLeaveNoTombstone() throws {
+    var catalog = try makeCatalog()
+    let removedTarget = NodeID(rawValue: "sub1:id:b")
+
+    let document = CatalogSubscriptionSnapshot(
+      name: "订阅分组", root: .init(id: groupID, name: "", children: [leaf("sub1:id:a")]))
+    _ = try catalog.applySubscriptionSnapshot(document, into: groupID)
+
+    XCTAssertNil(catalog.entry(for: removedTarget), "远端删除即移除")
+    XCTAssertNil(catalog.entry(for: NodeID(rawValue: "sub1:g:jp")), "空嵌套组一并移除")
+    XCTAssertEqual(catalog.entries.count, 2)
+  }
+
+  func testFixedGroupStateIsFullyRemoteOwnedOnRefresh() throws {
+    var catalog = try makeCatalog()
+
+    let document = CatalogSubscriptionSnapshot(
+      name: "新名", root: .init(id: groupID, name: "", children: [leaf("sub1:id:a")]))
+    _ = try catalog.applySubscriptionSnapshot(document, into: groupID)
+
+    XCTAssertEqual(try XCTUnwrap(catalog.entry(for: groupID)).displayName, "新名")
+  }
+
+  func testApplyToManualGroupRejected() throws {
+    var catalog = ConfigurationCatalog()
+    let manual = try catalog.addGroup("手动组")
+    let document = CatalogSubscriptionSnapshot(
+      name: "x", root: .init(id: groupID, name: "", children: []))
+
+    XCTAssertThrowsError(try catalog.applySubscriptionSnapshot(document, into: manual))
+  }
+
+  func testApplyToMissingGroupRejected() throws {
+    var catalog = ConfigurationCatalog()
+    let document = CatalogSubscriptionSnapshot(
+      name: "x", root: .init(id: groupID, name: "", children: []))
+
+    XCTAssertThrowsError(
+      try catalog.applySubscriptionSnapshot(document, into: NodeID(rawValue: "ghost")))
+  }
+
+  // MARK: 订阅子树删除
+
+  func testRemoveSubscriptionSubtreeRemovesEverythingAndReportsCredentials() throws {
+    var catalog = try makeCatalog()
+    let manual = try catalog.addGroup("手动组", id: NodeID(rawValue: "manual:g"))
+    _ = try catalog.addTestServer("手动服务器", id: NodeID(rawValue: "manual:s"), to: manual)
+
+    let removed = try catalog.removeSubscriptionSubtree(of: groupID)
+
+    XCTAssertEqual(removed.count, 4, "固定分组 + 嵌套组 + 两台服务器")
+    XCTAssertEqual(catalog.entries.count, 2, "手动子树不受影响")
+    XCTAssertFalse(catalog.rootChildren.contains(groupID))
+    XCTAssertTrue(removed.allSatisfy { $0.source == .subscription })
+    // 返回条目带凭据引用供调用方清理。
+    let credentialRefs = removed.compactMap { entry -> String? in
+      if case .server(let fields) = entry.kind { return fields.password }
+      return nil
+    }
+    XCTAssertEqual(credentialRefs.count, 2)
+  }
+
+  func testRemoveMissingSubscriptionRejected() {
+    var catalog = ConfigurationCatalog()
+    XCTAssertThrowsError(
+      try catalog.removeSubscriptionSubtree(of: NodeID(rawValue: "ghost")))
+  }
+
+  // MARK: 订阅子树变更后重展开（接线语义： 验收 4）
+
+  func testActiveTargetInsideRefreshedSubtreeStillExpandsAfterSnapshot() throws {
+    var catalog = try makeCatalog()
+    var machine = ActivationStateMachine(activeTargetID: NodeID(rawValue: "sub1:id:a"))
+
+    // 快照后 a 仍在（身份不变）→ 目标有效，重展开产出部署效应。叶子无插件，
+    // 激活校验只依赖凭据解析；快照重建后按目录里的真实引用解析秘密。
+    let document = CatalogSubscriptionSnapshot(
+      name: "订阅分组",
+      root: .init(
+        id: groupID, name: "",
+        children: [
+          .server(
+            CatalogSubscriptionSnapshot.ServerLeaf(
+              id: NodeID(rawValue: "sub1:id:a"),
+              fields: ServerFields(
+                address: "203.0.113.1", port: 8388,
+                encryptionMethod: "aes-256-gcm", password: "password")))
+        ]))
+    _ = try catalog.applySubscriptionSnapshot(document, into: groupID)
+
+    let effect = machine.catalogDidCommit(
+      catalog, plugins: NoManagedPluginProvider(),
+      options: RuntimeDocumentOptions(listen: ProxyListeningConfiguration()))
+    guard case .deployed(let configuration) = try XCTUnwrap(effect) else {
+      return XCTFail("身份未变的活动目标应部署而非清除")
+    }
+    XCTAssertEqual(configuration.targetID, NodeID(rawValue: "sub1:id:a"))
+
+    // 快照清空该目标 → 清除并停止。
+    let empty = CatalogSubscriptionSnapshot(
+      name: "订阅分组", root: .init(id: groupID, name: "", children: []))
+    _ = try catalog.applySubscriptionSnapshot(empty, into: groupID)
+    let cleared = machine.catalogDidCommit(
+      catalog, plugins: NoManagedPluginProvider(),
+      options: RuntimeDocumentOptions(listen: ProxyListeningConfiguration()))
+    guard case .clearedAndStopped = try XCTUnwrap(cleared) else {
+      return XCTFail("目标随远端删除消失后应清除并停止")
+    }
+    XCTAssertNil(machine.activeTargetID)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/ActivationFixture.swift b/ShadowsocksX-NG2/Tests/Support/ActivationFixture.swift
new file mode 100644
index 000000000..347871e49
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/ActivationFixture.swift
@@ -0,0 +1,113 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 激活缝测试共享夹具：受管插件替身与完整记录、无插件叶子、
+/// 激活与重展开的便捷调用、原子失败断言。
+enum ActivationFixture {
+  /// 受管插件测试集：只提供表内程序，值即写入文档的 bundle 内路径。
+  struct TestManagedPlugins: PluginExecutableResolving {
+    let pathsByProgram: [String: String]
+
+    func resolve(program: String) -> ResolvedPlugin? {
+      pathsByProgram[program].map { ResolvedPlugin(path: $0, arguments: []) }
+    }
+  }
+
+  static let plugins = TestManagedPlugins(pathsByProgram: [
+    "v2ray-plugin": "/bundle/Helpers/Plugins/v2ray-plugin"
+  ])
+
+  static let listen = ProxyListeningConfiguration()
+
+  /// 无插件叶子字段（插件语义单独覆盖）。
+  static func plainFields(remark: String, password: String = "password") -> ServerFields {
+    ServerFields(
+      address: "203.0.113.7", port: 8388, encryptionMethod: "aes-256-gcm",
+      password: password, remark: remark)
+  }
+
+  @discardableResult
+  static func addPlainServer(
+    _ remark: String, to parent: NodeID? = nil, in catalog: inout ConfigurationCatalog
+  ) throws -> NodeID {
+    try catalog.addServer(plainFields(remark: remark, password: "pw-\(remark)"), to: parent)
+  }
+
+  static func activate(
+    _ machine: inout ActivationStateMachine,
+    _ target: NodeID,
+    in catalog: ConfigurationCatalog
+  ) throws -> RuntimeConfiguration {
+    try machine.activate(
+      target, in: catalog, plugins: plugins,
+      options: RuntimeDocumentOptions(listen: listen))
+  }
+
+  static func commit(
+    _ machine: inout ActivationStateMachine,
+    _ catalog: ConfigurationCatalog
+  ) -> ActivationEffect? {
+    machine.catalogDidCommit(
+      catalog, plugins: plugins,
+      options: RuntimeDocumentOptions(listen: listen))
+  }
+
+  /// 断言激活以指定原因原子失败（错误类型与值都点名）。
+  static func assertThrows(
+    _ expected: ActivationFailure,
+    _ activation: () throws -> RuntimeConfiguration,
+    file: StaticString = #filePath,
+    line: UInt = #line
+  ) {
+    do {
+      _ = try activation()
+      XCTFail("应被拒绝：\(expected)", file: file, line: line)
+    } catch let failure as ActivationFailure {
+      XCTAssertEqual(failure, expected, file: file, line: line)
+    } catch {
+      XCTFail("错误应为 ActivationFailure，实际 \(error)", file: file, line: line)
+    }
+  }
+
+  enum FixtureError: Error {
+    case unexpectedEffect
+  }
+
+  /// 解包「原子更新」效应；否则 XCTFail 并抛错终止用例。
+  static func requireDeployed(
+    _ effect: ActivationEffect?, file: StaticString = #filePath, line: UInt = #line
+  ) throws -> RuntimeConfiguration {
+    guard case .deployed(let configuration)? = effect else {
+      XCTFail("应产出原子更新，实际 \(String(describing: effect))", file: file, line: line)
+      throw FixtureError.unexpectedEffect
+    }
+    return configuration
+  }
+
+  /// 解包「清除并停止」效应的点名原因；否则 XCTFail 并抛错终止用例。
+  static func requireCleared(
+    _ effect: ActivationEffect?, file: StaticString = #filePath, line: UInt = #line
+  ) throws -> ActivationFailure {
+    guard case .clearedAndStopped(let failure)? = effect else {
+      XCTFail("应清除并停止，实际 \(String(describing: effect))", file: file, line: line)
+      throw FixtureError.unexpectedEffect
+    }
+    return failure
+  }
+
+  /// 取叶子当前的服务器字段（非叶子即夹具错误）。
+  static func serverFields(
+    of leaf: NodeID,
+    in catalog: ConfigurationCatalog,
+    file: StaticString = #filePath,
+    line: UInt = #line
+  ) throws -> ServerFields {
+    let kind = try XCTUnwrap(catalog.entry(for: leaf)?.kind, file: file, line: line)
+    guard case .server(let fields) = kind else {
+      XCTFail("夹具应是服务器叶子", file: file, line: line)
+      throw FixtureError.unexpectedEffect
+    }
+    return fields
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/AppArtifact.swift b/ShadowsocksX-NG2/Tests/Support/AppArtifact.swift
new file mode 100644
index 000000000..ae47830a8
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/AppArtifact.swift
@@ -0,0 +1,35 @@
+import Foundation
+
+/// 构建产物定位：从测试 bundle 落盘位置向上逐层查找 app 产物。覆盖两种布局
+/// ——TEST_HOST 过渡期 `.xctest` 嵌于 app bundle 的 `Contents/PlugIns/`（app
+/// 是祖先），去宿主化后 `.xctest` 与 `.app` 平级同在 `Build/Products/<config>/`
+/// （app 是某层祖先的子项）。测试需要 app 产物（嵌入二进制、Info.plist 打包面
+/// 断言）时一律经此定位，不得用 `Bundle.main`（去宿主化后它是 xctest runner
+/// 的 bundle）。
+enum AppArtifact {
+  static let bundleURL: URL = {
+    let testBundleURL = Bundle(for: Marker.self).bundleURL
+    var directory = testBundleURL
+    while directory.path != "/" {
+      if directory.lastPathComponent == "ShadowsocksX-NG2.app" {
+        return directory
+      }
+      directory.deleteLastPathComponent()
+      let candidate = directory.appendingPathComponent(
+        "ShadowsocksX-NG2.app", isDirectory: true)
+      if FileManager.default.fileExists(atPath: candidate.path) {
+        return candidate
+      }
+    }
+    // 定位失败时返回原目录让用例以「产物缺失」失败并暴露实际路径，不炸进程。
+    return testBundleURL
+  }()
+
+  /// `bundleURL` 的 Bundle 形态：注入按 Bundle 取资源的生产缝（如
+  /// ProxyRuntimeController 的内置规则快照 bundle）。定位失败时退回测试
+  /// bundle，让资源缺失以用例失败呈现。
+  static let bundle: Bundle = Bundle(url: bundleURL) ?? Bundle(for: Marker.self)
+
+  /// `Bundle(for:)` 需要类对象；marker 只为取得测试 bundle 的落盘位置。
+  private final class Marker {}
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/BoundedTestWait.swift b/ShadowsocksX-NG2/Tests/Support/BoundedTestWait.swift
new file mode 100644
index 000000000..3466235b1
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/BoundedTestWait.swift
@@ -0,0 +1,137 @@
+import Foundation
+import Testing
+import XCTest
+
+enum TestWaitError: Error {
+  case timedOut(String)
+}
+
+/// A phase failure must leave the test body before it can issue another gated command.
+@MainActor
+func requireTestPhase(_ expectations: [XCTestExpectation], timeout: TimeInterval = 5) async throws {
+  guard await XCTWaiter.fulfillment(of: expectations, timeout: timeout) == .completed else {
+    throw TestWaitError.timedOut(expectations.map(\.expectationDescription).joined(separator: ", "))
+  }
+}
+
+@MainActor
+func requireTestCondition(
+  _ description: String, timeout: Duration = .seconds(5), condition: () -> Bool
+) async throws {
+  let deadline = ContinuousClock.now.advanced(by: timeout)
+  while !condition() {
+    try Task.checkCancellation()
+    guard ContinuousClock.now < deadline else { throw TestWaitError.timedOut(description) }
+    try await Task.sleep(for: .milliseconds(10))
+  }
+}
+
+/// Release fixtures before joining a cancelled task, including on a phase failure.
+@MainActor
+func withTestTask<Value: Sendable>(
+  _ task: Task<Value, Never>, release: () -> Void, finish: () async -> Void = {},
+  body: () async throws -> Void
+) async throws {
+  do {
+    try await body()
+  } catch {
+    release()
+    task.cancel()
+    _ = await task.value
+    await finish()
+    throw error
+  }
+  release()
+  _ = await task.value
+  await finish()
+}
+
+/// Broadcast async release is remembered, and timed-out waiters do not occupy a worker thread.
+final class TestAsyncGate: @unchecked Sendable {
+  private struct Waiter {
+    let continuation: CheckedContinuation<Bool, Never>
+    var timeoutTask: Task<Void, Never>?
+  }
+
+  private let lock = NSLock()
+  private var released = false
+  private var waiters: [UUID: Waiter] = [:]
+  private let onTimeout: @Sendable () -> Void
+
+  init(
+    _ description: String = "test worker release", file: StaticString = #filePath,
+    line: UInt = #line, fileID: String = #fileID, column: Int = #column,
+    onTimeout: (@Sendable () -> Void)? = nil
+  ) {
+    if let onTimeout {
+      self.onTimeout = onTimeout
+    } else if let test = Test.current {
+      let message = Comment(
+        rawValue: "Timed out waiting for \(description) (created by \(test.name))")
+      let location = SourceLocation(
+        fileID: fileID, filePath: String(describing: file), line: Int(line), column: column)
+      self.onTimeout = { Issue.record(message, sourceLocation: location) }
+    } else {
+      self.onTimeout = { XCTFail("Timed out waiting for \(description)", file: file, line: line) }
+    }
+  }
+
+  func wait(timeout: Duration = .seconds(10)) async -> Bool {
+    let id = UUID()
+    return await withCheckedContinuation { continuation in
+      lock.lock()
+      guard !released else {
+        lock.unlock()
+        continuation.resume(returning: true)
+        return
+      }
+      waiters[id] = Waiter(continuation: continuation)
+      lock.unlock()
+
+      let timeoutTask = Task { [weak self] in
+        do {
+          try await Task.sleep(for: timeout)
+          self?.expire(id)
+        } catch {
+          // Release cancels the timer after resuming the waiter.
+        }
+      }
+
+      lock.lock()
+      if var waiter = waiters[id] {
+        waiter.timeoutTask = timeoutTask
+        waiters[id] = waiter
+        lock.unlock()
+      } else {
+        lock.unlock()
+        timeoutTask.cancel()
+      }
+    }
+  }
+
+  func release() {
+    lock.lock()
+    guard !released else {
+      lock.unlock()
+      return
+    }
+    released = true
+    let pending = Array(waiters.values)
+    waiters.removeAll()
+    lock.unlock()
+
+    for waiter in pending {
+      waiter.timeoutTask?.cancel()
+      waiter.continuation.resume(returning: true)
+    }
+  }
+
+  private func expire(_ id: UUID) {
+    lock.lock()
+    let waiter = waiters.removeValue(forKey: id)
+    lock.unlock()
+    guard let waiter else { return }
+    onTimeout()
+    waiter.continuation.resume(returning: false)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/CatalogFixtures.swift b/ShadowsocksX-NG2/Tests/Support/CatalogFixtures.swift
new file mode 100644
index 000000000..8a834d6d7
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/CatalogFixtures.swift
@@ -0,0 +1,216 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 订阅子树夹具：固定分组 + 嵌套分组 + 两个服务器叶子。
+struct SubscriptionFixture {
+  let catalog: ConfigurationCatalog
+  let groupID: NodeID
+  let nestedGroupID: NodeID
+  let serverIDs: [NodeID]
+}
+
+/// 目录树测试夹具。订阅子树在这里仅用于测试刷新语义。
+enum CatalogFixtures {
+  /// 订阅节点身份采用「订阅前缀:供应商稳定 ID」作用域限定形式。
+  static func makeSubscriptionFixture(prefix: String = "sub1") throws -> SubscriptionFixture {
+    var catalog = ConfigurationCatalog()
+    let groupID = NodeID(rawValue: "\(prefix):group")
+    try catalog.addGroup("订阅分组", source: .subscription, id: groupID)
+    let nestedGroupID = NodeID(rawValue: "\(prefix):nested-group")
+    try catalog.addGroup("嵌套分组", source: .subscription, id: nestedGroupID, to: groupID)
+    let serverA = NodeID(rawValue: "\(prefix):server-a")
+    try catalog.addServer(
+      serverFields(remark: "香港 01"), source: .subscription, id: serverA, to: groupID)
+    let serverB = NodeID(rawValue: "\(prefix):server-b")
+    try catalog.addServer(
+      serverFields(remark: "日本 02"), source: .subscription, id: serverB, to: nestedGroupID)
+    return SubscriptionFixture(
+      catalog: catalog,
+      groupID: groupID,
+      nestedGroupID: nestedGroupID,
+      serverIDs: [serverA, serverB]
+    )
+  }
+
+  /// 服务器叶子夹具。地址用文档保留段（RFC 5737），不指向真实主机。
+  static func serverFields(remark: String) -> ServerFields {
+    ServerFields(
+      address: "203.0.113.7",
+      port: 8388,
+      encryptionMethod: "aes-256-gcm",
+      password: "password",
+      remark: remark,
+      pluginProgram: "v2ray-plugin",
+      pluginOptions: "options"
+    )
+  }
+}
+
+/// 测试便捷扩展：省去每次填字段。
+extension ConfigurationCatalog {
+  @discardableResult
+  mutating func addTestServer(
+    _ remark: String,
+    source: NodeSource = .manual,
+    id: NodeID? = nil,
+    to parent: NodeID? = nil,
+    index: Int? = nil,
+    now: Date = Date()
+  ) throws -> NodeID {
+    try addServer(
+      CatalogFixtures.serverFields(remark: remark), source: source, id: id, to: parent,
+      index: index, now: now
+    )
+  }
+}
+
+/// `XCTAssertThrowsError` 的 async 版本（表达式在 await 之后才能检查）。
+@MainActor
+func expectThrowsAsync(
+  _ expression: @MainActor () async throws -> Void,
+  onThrow errorHandler: @MainActor (Error) -> Void = { _ in },
+  file: StaticString = #filePath,
+  line: UInt = #line
+) async {
+  do {
+    _ = try await expression()
+    XCTFail("预期抛错，但成功返回", file: file, line: line)
+  } catch {
+    errorHandler(error)
+  }
+}
+
+// MARK: - 目录工作流测试夹具
+
+/// 中性激活替身：不关心激活语义的测试场景，激活命令原子拒绝（原因任意）。
+final class RejectingActivator: Activating {
+  func activate(_ target: NodeID) async throws -> ActivationCommandOutcome {
+    .rejectedActivation(.noActiveTarget)
+  }
+}
+
+/// 永不提供快照的 Legacy 来源替身（测试不读用户 Legacy 偏好）。
+struct EmptyLegacySnapshotProvider: LegacySnapshotProviding {
+  func readSnapshot() throws -> LegacySnapshot? { nil }
+}
+
+/// 固定快照提供缝替身（可中途改写快照，供重读场景断言）。
+final class FixedLegacySnapshotProvider: LegacySnapshotProviding {
+  var snapshot: LegacySnapshot?
+
+  init(snapshot: LegacySnapshot?) {
+    self.snapshot = snapshot
+  }
+
+  func readSnapshot() throws -> LegacySnapshot? { snapshot }
+}
+
+/// 内存完成标记替身（测试不写 UserDefaults）。
+final class InMemoryLegacyImportMarker: LegacyImportMarkerStoring {
+  private(set) var completed = false
+
+  func isCompleted() throws -> Bool { completed }
+
+  func setCompleted(_ completed: Bool) throws {
+    self.completed = completed
+  }
+}
+
+/// 目录工作流测试组装缝：经依赖束显式装配全部 hermetic fake，
+/// 不触碰生产 Keychain、UserDefaults、网络或激活边界。各测试按需覆盖任一
+/// adapter；未指定 Legacy 服务时用「空快照 + 内存标记」的组合（工作流 init
+/// 的发现状态读取仍被观察，但只触替身）。
+@MainActor
+func makeCatalogWorkflow(
+  coordinator: CatalogCommitCoordinator,
+  plugins: PluginExecutableResolving = NoManagedPluginProvider(),
+  subscriptionFetcher: SubscriptionFetching = FakeSubscriptionFetcher(
+    behavior: .success(Data())),
+  legacyImportService: LegacyImportService? = nil,
+  postLegacyImport: ((LegacyImportOutcome) async -> Void)? = nil,
+  activator: Activating = RejectingActivator(),
+  subscriptionNow: @escaping () -> Date = { Date() },
+  subscriptionJitter: @escaping () -> Double = { Double.random(in: 0...0.1) },
+  subscriptionWait: @escaping (TimeInterval) async throws -> Void = {
+    try await Task.sleep(for: .seconds($0))
+  }
+) -> CatalogWorkflow {
+  CatalogWorkflow(
+    dependencies: CatalogWorkflowDependencies(
+      coordinator: coordinator,
+      plugins: plugins,
+      subscriptionFetcher: subscriptionFetcher,
+      legacyImportService: legacyImportService
+        ?? LegacyImportService(
+          source: EmptyLegacySnapshotProvider(),
+          catalogStore: coordinator.fileStore,
+          marker: InMemoryLegacyImportMarker()),
+      postLegacyImport: postLegacyImport,
+      activator: activator,
+      subscriptionNow: subscriptionNow,
+      subscriptionJitter: subscriptionJitter,
+      subscriptionWait: subscriptionWait))
+}
+
+// MARK: - 统一导入结果取用助手
+
+extension ImportSourceResult {
+  /// `.imported` 的添加数（非该 case 为 nil）。
+  var importedCount: Int? {
+    if case .imported(let count, _) = self { return count }
+    return nil
+  }
+
+  /// `.imported` 的落点/新建分组（非该 case 或目录根为 nil）。
+  var importedGroupID: NodeID? {
+    if case .imported(_, let groupID) = self { return groupID }
+    return nil
+  }
+
+  /// `.partial` 的添加数与失败行（非该 case 为 nil）。
+  var partialFacts: (addedCount: Int, failures: [ImportLineFailure])? {
+    if case .partial(let addedCount, let failures) = self { return (addedCount, failures) }
+    return nil
+  }
+
+  /// `.failed` 的原因（非该 case 为 nil）。
+  var sourceFailure: ImportSourceFailure? {
+    if case .failed(let failure) = self { return failure }
+    return nil
+  }
+}
+
+/// Isolated encrypted file fixture; process-private keys permit reopening without Keychain.
+func makeTestCatalogStore(
+  fileURL: URL, library: ServerLibraryStorage? = nil
+) -> CatalogFileStore {
+  let store = CatalogFileStore(
+    fileURL: fileURL,
+    library: library ?? ServerLibraryStorage(keys: FixtureLibraryKeys(namespace: fileURL.path)))
+  _ = try? store.load()
+  return store
+}
+
+private final class FixtureLibraryKeys: CredentialKeyStoring {
+  private static let lock = NSLock()
+  nonisolated(unsafe) private static var values: [String: [UUID: Data]] = [:]
+  private let namespace: String
+
+  init(namespace: String) { self.namespace = namespace }
+
+  func ids() throws -> [UUID] {
+    Self.lock.withLock { Array(Self.values[namespace, default: [:]].keys) }
+  }
+  func read(_ id: UUID, allowingInteraction: Bool) throws -> Data? {
+    Self.lock.withLock { Self.values[namespace]?[id] }
+  }
+  func create(_ data: Data, id: UUID, allowingInteraction: Bool) throws {
+    Self.lock.withLock { Self.values[namespace, default: [:]][id] = data }
+  }
+}
+
+func makeTestListeningStore(fileURL: URL) -> ProxyListeningFileStore {
+  ProxyListeningFileStore(fileURL: fileURL, keys: FixtureLibraryKeys(namespace: fileURL.path))
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/DiagnosticsWorkflowFixture.swift b/ShadowsocksX-NG2/Tests/Support/DiagnosticsWorkflowFixture.swift
new file mode 100644
index 000000000..48215fe2d
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/DiagnosticsWorkflowFixture.swift
@@ -0,0 +1,169 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 诊断工作流测试共享夹具：runtime 事实替身、投毒事件集、聚合
+/// 目录事实与 workflow 构造（事实源全部注入，时钟固定，轮询 10ms）。
+@MainActor
+class DiagnosticsWorkflowTestCase: XCTestCase {
+  let password = "SECRET-PASSWORD"
+  let address = "203.0.113.7"
+  let remark = "香港 01"
+  let home = "/Users/SECRETUSER"
+  let lanAddress = "192.0.2.77"
+
+  /// 投毒事件 detail：白名单必须整体清洗，不得进入报告。
+  let poisonDetails = [
+    "SECRET-PERSIST-DETAIL", "SECRET-PROBE-DETAIL",
+    "SECRET-LISTEN-DETAIL", "SECRET-AGENT-DETAIL", "SECRET-UNREADABLE-DETAIL",
+  ]
+
+  lazy var secrets: [String] = {
+    [password, "SECRET-PLUGIN-OPTIONS", address, remark, home, lanAddress] + poisonDetails
+  }()
+
+  var workDir: URL!
+  var facts: FakeRuntimeFacts!
+  var events: RuntimeEventStore!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    workDir = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-diagwf-\(UUID().uuidString)", isDirectory: true)
+    try? FileManager.default.createDirectory(at: workDir, withIntermediateDirectories: true)
+    facts = FakeRuntimeFacts()
+    events = RuntimeEventStore()
+    // 导出完成事件经 RuntimeLog 发射：测试期间把替身缓冲注册为接收缝。
+    RuntimeLog.setSink(events)
+  }
+
+  override func tearDown() async throws {
+    RuntimeLog.setSink(RuntimeEventStore.shared)
+    try? FileManager.default.removeItem(at: workDir)
+    try await super.tearDown()
+  }
+
+  /// 标准 workflow：事实源注入替身、固定时钟（报告生成时间可精确断言）。
+  func makeWorkflow(
+    catalog: @escaping @MainActor () -> DiagnosticCatalogFacts? = { nil },
+    agentLog: @escaping () -> String? = { nil },
+    fileFacts: @escaping @MainActor () -> [DiagnosticFileFacts] = { [] },
+    managedPlugins: @escaping @MainActor () -> [DiagnosticPluginFacts] = { [] },
+    homePath: @escaping () -> String? = { nil },
+    render: @escaping (DiagnosticSnapshot) -> String? = {
+      DiagnosticReportBuilder.markdown(from: $0)
+    },
+    capture: ((DiagnosticSnapshot) -> Void)? = nil
+  ) -> DiagnosticsWorkflow {
+    DiagnosticsWorkflow(
+      runtimeFacts: facts,
+      events: events,
+      catalogFacts: catalog,
+      agentLogTail: {
+        agentLog().map { DiagnosticLogTail(text: $0, fileID: 0, offset: 0) }
+      },
+      fileFacts: fileFacts,
+      managedPlugins: managedPlugins,
+      homePath: homePath,
+      clock: { Date(timeIntervalSince1970: 1_758_000_000) },
+      reportRendering: { snapshot in
+        capture?(snapshot)
+        return render(snapshot)
+      },
+      pollInterval: .milliseconds(10))
+  }
+
+  func waitUntil(
+    _ condition: @autoclosure () -> Bool,
+    timeout: TimeInterval = 2,
+    file: StaticString = #filePath,
+    line: UInt = #line
+  ) async {
+    let deadline = Date().addingTimeInterval(timeout)
+    while !condition() && Date() < deadline {
+      try? await Task.sleep(for: .milliseconds(10))
+    }
+    XCTAssertTrue(condition(), "等待条件超时", file: file, line: line)
+  }
+
+  func assertNoSecrets(
+    _ text: String, file: StaticString = #filePath, line: UInt = #line
+  ) {
+    for secret in secrets {
+      XCTAssertFalse(
+        text.contains(secret),
+        "诊断报告不得包含敏感值「\(secret)」\n实际：\(text)",
+        file: file, line: line)
+    }
+    XCTAssertFalse(text.contains("{"), "诊断报告不得携带 JSON 内容", file: file, line: line)
+  }
+
+  /// 投毒目录：地址、备注、分组名全为敏感值（聚合后这些值在结构上进不了
+  /// facts）。
+  func poisonedCatalogFacts() throws -> DiagnosticCatalogFacts {
+    var catalog = ConfigurationCatalog()
+    let group = try catalog.addGroup("SECRET-GROUP")
+    _ = try catalog.addServer(
+      ServerFields(
+        address: address, port: 8388, encryptionMethod: "aes-256-gcm",
+        password: password,
+        remark: remark,
+        pluginProgram: "v2ray-plugin",
+        pluginOptions: "SECRET-PLUGIN-OPTIONS"),
+      to: group)
+    let subscriptionGroup = try catalog.addGroup("SECRET-GROUP-sub", source: .subscription)
+    _ = try catalog.addServer(
+      ServerFields(
+        address: address, port: 8389, encryptionMethod: "chacha20-ietf-poly1305",
+        password: password, remark: remark),
+      source: .subscription,
+      to: subscriptionGroup)
+    return DiagnosticCatalogFacts(counts: DiagnosticReportBuilder.counts(in: catalog))
+  }
+
+  /// 投毒事件集：白名单内类别 + 自由 detail 携带敏感值。
+  func appendPoisonedEvents() {
+    let stamp = Date(timeIntervalSince1970: 1_758_000_000)
+    events.append(event: .contractWritten(serverCount: 3), timestamp: stamp)
+    events.append(
+      event: .runtimePersistFailed(detail: "\(home): SECRET-PERSIST-DETAIL"), timestamp: stamp)
+    events.append(
+      event: .endpointProbeFailed(host: lanAddress, port: 11086, detail: "SECRET-PROBE-DETAIL"),
+      timestamp: stamp)
+    events.append(event: .listenNotEstablished(detail: "SECRET-LISTEN-DETAIL"), timestamp: stamp)
+    events.append(
+      event: .agentRegisterFailed(detail: "SECRET-AGENT-DETAIL"), timestamp: stamp)
+    events.append(
+      event: .settingsUnreadable(detail: "SECRET-UNREADABLE-DETAIL"), timestamp: stamp)
+    // 激活原因是领域点名文案（显式白名单决策）：可在场，但只允许
+    // 这类固定文本。
+    events.append(
+      event: .activationFailed(reason: "激活目标 leaf-9 的插件 simple-obfs 未随 app 提供"),
+      timestamp: stamp)
+  }
+
+  func reportText(_ outcome: DiagnosticReportOutcome) throws -> String {
+    guard case .ready(let draft) = outcome else {
+      XCTFail("应产出 ready 报告，实际 \(outcome)")
+      throw XCTSkip("无报告文本")
+    }
+    return try XCTUnwrap(String(data: draft.data, encoding: .utf8))
+  }
+
+  static func reportTimestamp(_ date: Date) -> String {
+    let formatter = DateFormatter()
+    formatter.locale = Locale(identifier: "en_US_POSIX")
+    formatter.dateFormat = "yyyy-MM-dd HH:mm:ss"
+    return formatter.string(from: date)
+  }
+}
+
+/// runtime 事实替身：可编程的安全事实值。
+@MainActor
+final class FakeRuntimeFacts: ProxyRuntimeDiagnosticFacts {
+  var proxyState: DiagnosticProxyState = .off
+  var hasActiveTarget = false
+  var listen = RuntimeListenFacts(listen: ProxyListeningConfiguration())
+  var contractSummary: String?
+  var customRuleSummary: CustomRuleSummary?
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/FakeLocalInterfaceFacts.swift b/ShadowsocksX-NG2/Tests/Support/FakeLocalInterfaceFacts.swift
new file mode 100644
index 000000000..ee1793121
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/FakeLocalInterfaceFacts.swift
@@ -0,0 +1,78 @@
+import Combine
+import Foundation
+
+@testable import ShadowsocksX_NG2
+
+/// 测试专用地址便捷构造（数组字面量内以 `.ipv4("…")` 使用）。
+extension LocalInterfaceAddress {
+  static func ipv4(_ text: String) -> LocalInterfaceAddress {
+    LocalInterfaceAddress(address: text, family: .ipv4, isIPv6LinkLocal: false, v6Flags: nil)
+  }
+
+  static func ipv6(
+    _ text: String, linkLocal: Bool = false, flags: LocalInterfaceV6Flags? = nil
+  ) -> LocalInterfaceAddress {
+    LocalInterfaceAddress(address: text, family: .ipv6, isIPv6LinkLocal: linkLocal, v6Flags: flags)
+  }
+}
+
+/// 可编程本机接口事实替身：原始接口事实可编程（含枚举失败
+/// nil），变化通知同步手动发值。替身只提供原始事实，让生产策略实际完成
+/// 过滤、排序、名称回退与地址选择。
+@MainActor
+final class FakeLocalInterfaceFacts: LocalInterfaceFactsReading {
+  var interfaces: [LocalInterfaceFacts]?
+  private let changeSubject = PassthroughSubject<Void, Never>()
+  var changes: AnyPublisher<Void, Never> { changeSubject.eraseToAnyPublisher() }
+
+  init(interfaces: [LocalInterfaceFacts]? = []) {
+    self.interfaces = interfaces
+  }
+
+  func emitChange() { changeSubject.send() }
+
+  // MARK: - 事实构造辅助
+
+  /// Wi-Fi 接口事实（类型 IEEE80211）。
+  static func wifi(
+    bsdName: String = "en0", localizedName: String? = "Wi-Fi",
+    addresses: [LocalInterfaceAddress]
+  ) -> LocalInterfaceFacts {
+    LocalInterfaceFacts(
+      bsdName: bsdName, isLoopback: false, interfaceType: "IEEE80211",
+      localizedName: localizedName, addresses: addresses)
+  }
+
+  /// Ethernet 接口事实（类型 Ethernet，名称缺失回退 BSD 名的常见形态）。
+  static func ethernet(
+    bsdName: String = "en1", localizedName: String? = nil,
+    addresses: [LocalInterfaceAddress]
+  ) -> LocalInterfaceFacts {
+    LocalInterfaceFacts(
+      bsdName: bsdName, isLoopback: false, interfaceType: "Ethernet",
+      localizedName: localizedName, addresses: addresses)
+  }
+
+  /// VPN 接口事实（utun，无 SystemConfiguration 类型映射）。
+  static func vpn(bsdName: String = "utun4") -> LocalInterfaceFacts {
+    LocalInterfaceFacts(
+      bsdName: bsdName, isLoopback: false, interfaceType: nil, localizedName: nil,
+      addresses: [.ipv4("198.18.0.1")])
+  }
+
+  /// 非白名单虚拟接口事实（如桥接，通用 Ethernet 类型不可采信的场景以
+  /// 其他类型呈现）。
+  static func virtual(bsdName: String = "bridge0") -> LocalInterfaceFacts {
+    LocalInterfaceFacts(
+      bsdName: bsdName, isLoopback: false, interfaceType: "VirtualInterface",
+      localizedName: nil, addresses: [.ipv4("192.168.9.1")])
+  }
+
+  /// 回环接口事实（IFF_LOOPBACK；无类型映射）。策略不消费回环事实——
+  /// 回环候选由策略合成，此事实仅用于验证白名单不误收。
+  static func loopback() -> LocalInterfaceFacts {
+    LocalInterfaceFacts(
+      bsdName: "lo0", isLoopback: true, interfaceType: nil, localizedName: nil,
+      addresses: [.ipv4("127.0.0.1"), .ipv6("::1"), .ipv6("fe80::1", linkLocal: true)])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/InMemoryExporters.swift b/ShadowsocksX-NG2/Tests/Support/InMemoryExporters.swift
new file mode 100644
index 000000000..d04a923d3
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/InMemoryExporters.swift
@@ -0,0 +1,35 @@
+import Foundation
+
+@testable import ShadowsocksX_NG2
+
+/// 导出缝的测试替身：记录收到的 draft，但不打开保存面板、不写文件。
+@MainActor
+final class InMemoryDiagnosticReportExporter: DiagnosticReportExporter {
+  var result: DiagnosticReportExportResult
+  private(set) var drafts: [DiagnosticReportDraft] = []
+
+  init(result: DiagnosticReportExportResult = .cancelled) {
+    self.result = result
+  }
+
+  func export(draft: DiagnosticReportDraft) -> DiagnosticReportExportResult {
+    drafts.append(draft)
+    return result
+  }
+}
+
+/// 配置组文件导出缝的测试替身：同上，只记录 draft 并返回预设结果。
+@MainActor
+final class InMemoryConfigurationGroupFileExporter: ConfigurationGroupFileExporter {
+  var result: ConfigurationGroupFileExportResult
+  private(set) var drafts: [ConfigurationGroupExportDraft] = []
+
+  init(result: ConfigurationGroupFileExportResult = .cancelled) {
+    self.result = result
+  }
+
+  func export(draft: ConfigurationGroupExportDraft) -> ConfigurationGroupFileExportResult {
+    drafts.append(draft)
+    return result
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/PluginFixtureHelpers.swift b/ShadowsocksX-NG2/Tests/Support/PluginFixtureHelpers.swift
new file mode 100644
index 000000000..9518ec0d3
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/PluginFixtureHelpers.swift
@@ -0,0 +1,72 @@
+import Foundation
+
+@testable import ShadowsocksX_NG2
+
+// Fixture conveniences keep older behavior tests on the record-based catalog interface.
+extension PluginCatalog {
+  var testMappings: [String: String] {
+    Dictionary(
+      uniqueKeysWithValues: userRecords.flatMap { record in
+        record.names.map { ($0, record.path) }
+      })
+  }
+
+  @MainActor func addPlugin(program: String, path: String) throws {
+    try commit([.save(UserPluginRecord(names: [program], path: path))])
+  }
+
+  @MainActor func updatePlugin(program: String, path: String) throws {
+    guard var record = userRecords.first(where: { $0.names.contains(program) }) else {
+      throw PluginMappingError.nameMissing
+    }
+    record.path = path
+    try commit([.save(record)])
+  }
+
+  @MainActor func removePlugin(program: String) throws {
+    guard let record = userRecords.first(where: { $0.names.contains(program) }) else {
+      throw PluginMappingError.nameMissing
+    }
+    try commit([.remove(record.id)])
+  }
+
+  @MainActor func renamePlugin(program: String, newProgram: String, path: String) throws {
+    guard var record = userRecords.first(where: { $0.names.contains(program) }) else {
+      throw PluginMappingError.nameMissing
+    }
+    record.names = [newProgram]
+    record.path = path
+    try commit([.save(record)])
+  }
+
+  @MainActor func replaceTestMappings(_ mappings: [String: String]) throws {
+    try replaceConfiguration(PluginConfiguration(mappings: mappings))
+  }
+}
+
+extension PluginConfiguration {
+  init(mappings: [String: String]) {
+    self.init(
+      userPlugins: mappings.sorted { $0.key < $1.key }.map {
+        UserPluginRecord(names: [$0.key], path: $0.value)
+      })
+  }
+}
+
+extension PluginMappingFileStore {
+  func save(_ mappings: [String: String]) throws {
+    try save(PluginConfiguration(mappings: mappings))
+  }
+}
+
+extension PluginCatalogSnapshot {
+  init(
+    mappings: [String: String],
+    managed: BundleManagedPluginProvider = BundleManagedPluginProvider(),
+    generation: Int = 0, mappingsUnreadable: Bool = false
+  ) {
+    self.init(
+      configuration: PluginConfiguration(mappings: mappings), managed: managed,
+      generation: generation, mappingsUnreadable: mappingsUnreadable)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/ProcessSigningIdentifier.swift b/ShadowsocksX-NG2/Tests/Support/ProcessSigningIdentifier.swift
new file mode 100644
index 000000000..799a8cdc2
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/ProcessSigningIdentifier.swift
@@ -0,0 +1,21 @@
+import Foundation
+import Security
+
+/// 本进程的代码签名 identifier（与生产 SystemProxyClientValidator 同一
+/// SecCode 查询路径，对自身用 SecCodeCopySelf 取 code）。去宿主化（ADR 0021）
+/// 后单测运行于 xctest runner，XPC 连接方身份随宿主改变；helper XPC 装配
+/// 测试以本值注入期望客户端身份，无需 launchd。
+enum ProcessSigningIdentifier {
+  static func current() -> String? {
+    var code: SecCode?
+    guard SecCodeCopySelf([], &code) == errSecSuccess, let code else { return nil }
+    var staticCode: SecStaticCode?
+    guard SecCodeCopyStaticCode(code, [], &staticCode) == errSecSuccess, let staticCode
+    else { return nil }
+    var information: CFDictionary?
+    guard SecCodeCopySigningInformation(staticCode, SecCSFlags(), &information) == errSecSuccess,
+      let information
+    else { return nil }
+    return (information as NSDictionary)[kSecCodeInfoIdentifier] as? String
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/ProxyRuntimeBlockingFixtures.swift b/ShadowsocksX-NG2/Tests/Support/ProxyRuntimeBlockingFixtures.swift
new file mode 100644
index 000000000..945ebcb3e
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/ProxyRuntimeBlockingFixtures.swift
@@ -0,0 +1,86 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+extension ProxyRuntimeFixture {
+  /// 可暂停探测替身：arm 后的下一次探测异步等待测试放行，在启动健康门的
+  /// await 窗口内确定性插入交错命令，不占用线程池工作线程。
+  final class BlockingProbe: EndpointProbing, @unchecked Sendable {
+    private let lock = NSLock()
+    private var gate: TestAsyncGate?
+    private var started: XCTestExpectation?
+
+    func arm(started: XCTestExpectation) {
+      lock.lock()
+      defer { lock.unlock() }
+      precondition(gate == nil, "上一次 arm 尚未 release")
+      gate = TestAsyncGate("runtime fixture release")
+      self.started = started
+    }
+
+    func release() {
+      lock.lock()
+      let gate = self.gate
+      self.gate = nil
+      self.started = nil
+      lock.unlock()
+      gate?.release()
+    }
+
+    func probe(host: String, port: Int, timeout: TimeInterval) async
+      -> EndpointHealthProbe.Outcome
+    {
+      let (gate, started) = armedGate()
+      if let gate {
+        started?.fulfill()
+        _ = await gate.wait()
+      }
+      return .reachable
+    }
+
+    private func armedGate() -> (TestAsyncGate?, XCTestExpectation?) {
+      lock.lock()
+      let gate = self.gate
+      let started = self.started
+      lock.unlock()
+      return (gate, started)
+    }
+  }
+
+  /// 按调用序返回预设结果，并可在指定调用处异步等待测试放行。
+  final class BlockingFirewallChecker: FirewallStatusChecking, @unchecked Sendable {
+    private let lock = NSLock()
+    private var callCount = 0
+    private let outcomes: [FirewallBlockStatus]
+    private let blockOnCall: Int
+    private let started: XCTestExpectation
+    private let gate = TestAsyncGate("runtime fixture release")
+
+    init(outcomes: [FirewallBlockStatus], blockOnCall: Int, started: XCTestExpectation) {
+      precondition(!outcomes.isEmpty)
+      self.outcomes = outcomes
+      self.blockOnCall = blockOnCall
+      self.started = started
+    }
+
+    func release() { gate.release() }
+
+    func status(for executableURL: URL) async -> FirewallBlockStatus {
+      let call = nextCall()
+      if call == blockOnCall {
+        started.fulfill()
+        _ = await gate.wait()
+      }
+      return outcomes[min(call, outcomes.count) - 1]
+    }
+
+    private func nextCall() -> Int {
+      lock.lock()
+      callCount += 1
+      let call = callCount
+      lock.unlock()
+      return call
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/ProxyRuntimeFixture+Document.swift b/ShadowsocksX-NG2/Tests/Support/ProxyRuntimeFixture+Document.swift
new file mode 100644
index 000000000..a4fc4e8c2
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/ProxyRuntimeFixture+Document.swift
@@ -0,0 +1,89 @@
+import Darwin
+import Foundation
+
+@testable import ShadowsocksX_NG2
+
+enum ProxyRuntimeFixture {
+  static func unusedLoopbackPort() throws -> Int {
+    let descriptor = socket(AF_INET, SOCK_STREAM, 0)
+    guard descriptor >= 0 else { throw POSIXError(.ENOTSOCK) }
+    defer { close(descriptor) }
+    var address = sockaddr_in()
+    address.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    address.sin_family = sa_family_t(AF_INET)
+    address.sin_port = 0
+    address.sin_addr = in_addr(s_addr: inet_addr("127.0.0.1"))
+    let result = withUnsafePointer(to: &address) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        Darwin.bind(descriptor, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    guard result == 0 else { throw POSIXError(.EADDRINUSE) }
+    var bound = sockaddr_in()
+    var length = socklen_t(MemoryLayout<sockaddr_in>.size)
+    let nameResult = withUnsafeMutablePointer(to: &bound) { pointer in
+      pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        getsockname(descriptor, $0, &length)
+      }
+    }
+    guard nameResult == 0 else { throw POSIXError(.EINVAL) }
+    return Int(CFSwapInt16BigToHost(bound.sin_port))
+  }
+
+  /// 夹具默认监听端口：测试进程内一次性分配的空闲端口对。不能固定 11086/
+  /// 11087（与 app 默认监听相同）：宿主 app 在跑时其 sslocal 占住这两个端口，
+  /// wrapper 健康探测会误判「监听已建立」。进程内共享同一对端口而非逐调用
+  /// 分配，保证两次默认构造之间除显式参数外无差异——「仅服务器变化」类
+  /// 变更协议语义依赖这一点。
+  private static let defaultListenPorts: (socks: Int, http: Int) = {
+    func freePort() -> Int {
+      guard let port = try? unusedLoopbackPort() else {
+        preconditionFailure("夹具端口分配失败：socket 不可用（fd 耗尽？）")
+      }
+      return port
+    }
+    let socks = freePort()
+    var http = freePort()
+    while http == socks {
+      http = freePort()
+    }
+    return (socks, http)
+  }()
+
+  static func makeDocument(
+    serverAddress: String = "203.0.113.7",
+    password: String = "resolved-password",
+    pluginOpts: String? = nil,
+    listenerMode: ListenerMode = .disabled,
+    localPort: Int? = nil,
+    inboundProtocol: String = "socks"
+  ) -> SslocalRuntimeDocument {
+    precondition(inboundProtocol == "socks")
+    let socksPort: Int
+    let httpPort: Int
+    if let localPort {
+      socksPort = localPort
+      httpPort = ProxyListeningConfiguration.defaultHTTPPort
+    } else {
+      socksPort = defaultListenPorts.socks
+      httpPort = defaultListenPorts.http
+    }
+    return SslocalRuntimeDocument(
+      servers: [
+        SslocalServerDocument(
+          id: "server-1",
+          server: serverAddress,
+          serverPort: 8388,
+          password: password,
+          method: "aes-256-gcm",
+          plugin: nil,
+          pluginOpts: pluginOpts
+        )
+      ],
+      listen: ProxyListeningConfiguration(
+        listenerMode: listenerMode,
+        socksPort: socksPort,
+        httpPort: httpPort))
+  }
+
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/ProxyRuntimeFixture.swift b/ShadowsocksX-NG2/Tests/Support/ProxyRuntimeFixture.swift
new file mode 100644
index 000000000..931e9f014
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/ProxyRuntimeFixture.swift
@@ -0,0 +1,239 @@
+import Darwin
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 代理运行时测试共享夹具：临时运行时目录、契约文档构造、LaunchAgent
+/// 与探测替身。
+/// 跨替身共享的有序事件记录：断言「先清理系统代理、再停止监听」等次序。
+final class ProxyRuntimeEventLog: @unchecked Sendable {
+  private let lock = NSLock()
+  private var items: [String] = []
+
+  func record(_ item: String) {
+    lock.lock()
+    defer { lock.unlock() }
+    items.append(item)
+  }
+
+  var events: [String] {
+    lock.lock()
+    defer { lock.unlock() }
+    return items
+  }
+}
+
+extension ProxyRuntimeFixture {
+  /// 在临时目录中建一套隔离的运行时文件组（不触碰真实 ~/Library）。
+  struct TemporaryRuntime {
+    let directory: URL
+    let contract: URL
+    let pidFile: URL
+  }
+
+  static func makeTemporaryRuntime(file: StaticString = #filePath, line: UInt = #line)
+    -> TemporaryRuntime
+  {
+    let directory = FileManager.default.temporaryDirectory
+      .appendingPathComponent("ssxng-tests-\(UUID().uuidString)", isDirectory: true)
+    try? FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    return TemporaryRuntime(
+      directory: directory,
+      contract: directory.appendingPathComponent("sslocal-active.json"),
+      pidFile: directory.appendingPathComponent("agent.pid"))
+  }
+
+  @MainActor
+  static func catalogSnapshotReader(at fileURL: URL) -> RuntimeCatalogSnapshotReading {
+    CatalogCommitCoordinator.bootstrap(fileStore: makeTestCatalogStore(fileURL: fileURL))
+      .catalogSnapshotReader
+  }
+
+  /// LaunchAgent 注册态可编程替身，记录全部调用。
+  final class FakeLaunchAgent: LaunchAgentControlling {
+    private(set) var currentStatus: LaunchAgentStatus
+    private(set) var registerCount = 0
+    private(set) var unregisterCount = 0
+    var registerError: Error?
+    /// register 成功后自动迁移到的状态（模拟 launchd 拉起）。
+    var statusAfterRegister: LaunchAgentStatus = .registered
+    /// 测试用的运行回执。生产 wrapper 对 ACL 实例需等 sslocal 绑定监听后才写。
+    var onRegister: (() -> Void)?
+    var onUnregister: (() -> Void)?
+    /// 可选共享事件日志（次序断言用）。
+    weak var eventLog: ProxyRuntimeEventLog?
+
+    init(initialStatus: LaunchAgentStatus = .notRegistered) {
+      currentStatus = initialStatus
+    }
+
+    var status: LaunchAgentStatus { currentStatus }
+
+    func setStatus(_ status: LaunchAgentStatus) {
+      currentStatus = status
+    }
+
+    func register() throws {
+      registerCount += 1
+      eventLog?.record("register")
+      if let registerError {
+        currentStatus = .registered
+        throw registerError
+      }
+      currentStatus = statusAfterRegister
+      onRegister?()
+    }
+
+    func unregister() throws {
+      unregisterCount += 1
+      eventLog?.record("unregister")
+      currentStatus = .notRegistered
+      onUnregister?()
+    }
+  }
+
+  /// 探测替身：按预设序列返回，序列耗尽后停留在最后一项。
+  final class FakeProbe: EndpointProbing, @unchecked Sendable {
+    private let lock = NSLock()
+    private var outcomes: [EndpointHealthProbe.Outcome]
+    private var requestedPorts: [Int] = []
+    private(set) var callCount = 0
+
+    init(outcomes: [EndpointHealthProbe.Outcome]) {
+      self.outcomes = outcomes
+    }
+
+    static func reachable() -> FakeProbe {
+      FakeProbe(outcomes: [.reachable])
+    }
+
+    static func refusing() -> FakeProbe {
+      FakeProbe(outcomes: [.refused(detail: "Connection refused")])
+    }
+
+    /// 运行中改写探测序列（「条件恢复后自动收敛」类测试用）。
+    func setOutcomes(_ newOutcomes: [EndpointHealthProbe.Outcome]) {
+      lock.lock()
+      defer { lock.unlock() }
+      outcomes = newOutcomes
+    }
+
+    var ports: [Int] {
+      lock.lock()
+      defer { lock.unlock() }
+      return requestedPorts
+    }
+
+    func probe(host: String, port: Int, timeout: TimeInterval) async
+      -> EndpointHealthProbe.Outcome
+    {
+      recordProbe(port: port)
+    }
+
+    private func recordProbe(port: Int) -> EndpointHealthProbe.Outcome {
+      lock.lock()
+      defer { lock.unlock() }
+      callCount += 1
+      requestedPorts.append(port)
+      guard let outcome = outcomes.first else { return .timedOut }
+      if outcomes.count > 1 {
+        outcomes.removeFirst()
+      }
+      return outcome
+    }
+  }
+
+  final class FakeFirewallChecker: FirewallStatusChecking, @unchecked Sendable {
+    private let lock = NSLock()
+    private var outcomes: [FirewallBlockStatus]
+    private var recordedURLs: [URL] = []
+
+    var checkedURLs: [URL] {
+      lock.lock()
+      defer { lock.unlock() }
+      return recordedURLs
+    }
+
+    init(_ result: FirewallBlockStatus = .permitted) {
+      outcomes = [result]
+    }
+
+    init(outcomes: [FirewallBlockStatus]) {
+      precondition(!outcomes.isEmpty)
+      self.outcomes = outcomes
+    }
+
+    func status(for executableURL: URL) async -> FirewallBlockStatus {
+      recordStatus(for: executableURL)
+    }
+
+    private func recordStatus(for executableURL: URL) -> FirewallBlockStatus {
+      lock.lock()
+      defer { lock.unlock() }
+      recordedURLs.append(executableURL)
+      let outcome = outcomes[0]
+      if outcomes.count > 1 { outcomes.removeFirst() }
+      return outcome
+    }
+  }
+
+}
+
+/// 每个夹具使用独立 defaults 域，最后一个引用释放时清理持久值。
+private final class TestProxyUserDefaults: UserDefaults, @unchecked Sendable {
+  private let domain: String
+
+  init() {
+    domain = "ng2-proxy-control-tests-\(UUID().uuidString)"
+    super.init(suiteName: domain)!
+  }
+
+  deinit { removePersistentDomain(forName: domain) }
+}
+
+func makeTestProxyControlPreferences() -> ProxyControlPreferences {
+  ProxyControlPreferences(defaults: TestProxyUserDefaults())
+}
+
+final class InMemoryProxyListeningStore: ProxyListeningStoring {
+  var saved: ProxyListeningConfiguration?
+
+  func load() throws -> ProxyListeningConfiguration { saved ?? ProxyListeningConfiguration() }
+
+  func save(_ configuration: ProxyListeningConfiguration) throws {
+    try configuration.enforcePersistenceConstraints()
+    saved = configuration
+  }
+}
+
+extension ProxyRuntimeFixture {
+  static func controlFlowRuleSnapshot(_ source: RulesSource) throws
+    -> RuleSnapshot
+  {
+    switch source {
+    case .geolocationCN:
+      return rulesFixture(
+        source,
+        rules: [
+          ProxyRule(action: .direct, match: try RuleMatch(domainExact: "direct.example")),
+          ProxyRule(
+            action: .direct, match: try RuleMatch(domainSuffix: "fixture-direct.example")),
+        ])
+    case .chinaIPv4:
+      return rulesFixture(
+        source,
+        rules: [
+          ProxyRule(action: .direct, match: try RuleMatch(ipv4CIDR: "1.0.0.0/24"))
+        ])
+    case .gfwlist:
+      return rulesFixture(
+        source,
+        rules: [
+          ProxyRule(action: .proxy, match: try RuleMatch(domainSuffix: "proxy.example")),
+          ProxyRule(action: .direct, match: try RuleMatch(domainExact: "safe.proxy.example")),
+        ])
+    case .custom, .fixed:
+      throw RuleSnapshotError.missing
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/RuleRuntimeDelayGate.swift b/ShadowsocksX-NG2/Tests/Support/RuleRuntimeDelayGate.swift
new file mode 100644
index 000000000..e64001524
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/RuleRuntimeDelayGate.swift
@@ -0,0 +1,84 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// Pause one retry/debounce phase; subsequent passes remain asynchronous without wall-clock delay.
+@MainActor
+final class RuleRuntimeDelayGate {
+  private let started: XCTestExpectation
+  private let onTimeout: () -> Void
+  private var didPause = false
+  private let stream: AsyncStream<Void>
+  private let continuation: AsyncStream<Void>.Continuation
+
+  init(
+    started: XCTestExpectation,
+    onTimeout: @escaping () -> Void = {
+      XCTFail("Timed out waiting for rule runtime delay release")
+    }
+  ) {
+    self.started = started
+    self.onTimeout = onTimeout
+    (stream, continuation) = AsyncStream<Void>.makeStream()
+  }
+
+  func wait(timeout: Duration = .seconds(10)) async throws {
+    try Task.checkCancellation()
+    guard !didPause else {
+      await Task.yield()
+      return
+    }
+    didPause = true
+    started.fulfill()
+    // AsyncStream ends its iterator on cancellation, so the timer race can drain both children.
+    do {
+      try await withThrowingTaskGroup(of: Void.self) { group in
+        group.addTask { [stream] in
+          for await _ in stream {}
+          try Task.checkCancellation()
+        }
+        group.addTask {
+          try await Task.sleep(for: timeout)
+          throw TestWaitError.timedOut("rule runtime delay release")
+        }
+        defer { group.cancelAll() }
+        try await group.next()
+      }
+    } catch let error as TestWaitError {
+      onTimeout()
+      throw error
+    }
+  }
+
+  func resume() {
+    continuation.finish()
+  }
+}
+
+/// Rule application can replace its task handle while an earlier save is finishing.
+@MainActor
+func withRuleApplicationTask<Value: Sendable>(
+  _ task: Task<Value, Never>, controller: ProxyRuntimeController, release: () -> Void,
+  body: () async throws -> Void
+) async throws {
+  try await withTestTask(
+    task, release: release,
+    finish: {
+      controller.ruleApplicationTask?.cancel()
+      await controller.ruleApplicationTask?.value
+    }, body: body)
+}
+
+final class PausedRuntimeRuleSource: @unchecked Sendable {
+  let started: XCTestExpectation
+  private let release = TestAsyncGate("rule source release")
+  init(started: XCTestExpectation) { self.started = started }
+  func resume() { release.release() }
+  func load(_ source: RulesSource) async -> RuleSnapshot {
+    if source == .geolocationCN {
+      started.fulfill()
+      _ = await release.wait()
+    }
+    return rulesFixture(source)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/RuntimeReceiptFixture.swift b/ShadowsocksX-NG2/Tests/Support/RuntimeReceiptFixture.swift
new file mode 100644
index 000000000..60ac63496
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/RuntimeReceiptFixture.swift
@@ -0,0 +1,83 @@
+import Foundation
+
+@testable import ShadowsocksX_NG2
+
+/// 测试支持：模拟 wrapper 写入部署收据。生产唯一收据写者是 Agent wrapper
+/// （AgentContract.writeRuntimeReceipt），GUI 侧只有读（readRuntimeReceipt）；
+/// 收据格式知识由 Domain 的 RuntimeDeploymentReceipt 类型承载，此处只复刻
+/// wrapper 的「写动作」供夹具布置磁盘状态。
+extension RuntimeFileStore {
+  func writeRuntimeReceipt(for document: SslocalRuntimeDocument, processID: Int32) throws {
+    guard receiptIdentity(for: document) != nil else {
+      throw PersistenceError.ioFailure(detail: "Runtime contract digest is unavailable")
+    }
+    try writePublishedRuntimeReceipt(processID: processID)
+  }
+}
+
+/// 测试观察真实发布文件；不把上游输出反向重建为 GUI 运行意图。
+struct PublishedRuntimeConfiguration: Equatable {
+  let configuration: SslocalConfigurationDocument
+  let snapshot: RuntimeSupervision
+  let intentSHA256: String
+
+  var servers: [SslocalServerDocument] { configuration.servers }
+  var locals: [SslocalLocalDocument] { configuration.locals }
+  var socksPort: Int { locals.first { $0.inboundProtocol == "socks" }?.localPort ?? 0 }
+  var httpPort: Int { locals.first { $0.inboundProtocol == "http" }?.localPort ?? 0 }
+  var aclRuntime: ProxyACLDocument? {
+    guard let acl = snapshot.acl,
+      let summary = snapshot.aclVariants.first(where: { $0.value == acl })?.key,
+      let path = configuration.aclFilePath
+    else { return nil }
+    return ProxyACLDocument(path: path, summary: summary, content: "", sha256: acl.sha256)
+  }
+
+  static func == (lhs: Self, rhs: Self) -> Bool {
+    lhs.configuration == rhs.configuration && lhs.intentSHA256 == rhs.intentSHA256
+  }
+}
+
+extension RuntimeFileStore {
+  func loadDocument() -> PublishedRuntimeConfiguration? {
+    guard let snapshot = RuntimePublication.load(at: supervisionFileURL),
+      let data = try? Data(contentsOf: directoryURL.appendingPathComponent(snapshot.configuration)),
+      let configuration = try? JSONDecoder().decode(SslocalConfigurationDocument.self, from: data),
+      let intentData = try? Data(
+        contentsOf: directoryURL.appendingPathComponent(snapshot.intentMetadata)),
+      let intent = try? JSONDecoder().decode(PublishedRuntimeIntent.self, from: intentData)
+    else { return nil }
+    return PublishedRuntimeConfiguration(
+      configuration: configuration, snapshot: snapshot, intentSHA256: intent.sha256)
+  }
+
+  func readData() -> Data? {
+    guard let snapshot = RuntimePublication.load(at: supervisionFileURL) else { return nil }
+    return try? Data(contentsOf: directoryURL.appendingPathComponent(snapshot.configuration))
+  }
+
+  func receiptIdentity(for document: PublishedRuntimeConfiguration) -> String? {
+    guard let current = loadDocument(), current.intentSHA256 == document.intentSHA256 else {
+      return nil
+    }
+    return current.snapshot.deploymentID
+  }
+
+  func writeRuntimeReceipt(for document: PublishedRuntimeConfiguration, processID: Int32) throws {
+    guard receiptIdentity(for: document) != nil else { throw POSIXError(.EINVAL) }
+    try writePublishedRuntimeReceipt(processID: processID)
+  }
+}
+
+extension RuntimeFileStore {
+  func writePublishedRuntimeReceipt(processID: Int32) throws {
+    guard let snapshot = RuntimePublication.load(at: supervisionFileURL) else {
+      throw POSIXError(.EINVAL)
+    }
+    try RuntimePublication.select(snapshot, configurationLink: fileURL, aclLink: aclFileURL)
+    try AtomicFileWriter.write(
+      JSONEncoder().encode(
+        RuntimeDeploymentReceipt(processID: processID, deploymentID: snapshot.deploymentID)),
+      to: runtimeStatusFileURL)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/SettingsWorkflowTestSupport.swift b/ShadowsocksX-NG2/Tests/Support/SettingsWorkflowTestSupport.swift
new file mode 100644
index 000000000..fbd61c681
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/SettingsWorkflowTestSupport.swift
@@ -0,0 +1,270 @@
+import Combine
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 轮询等待异步投影落定（设置工作流测试共享）。
+@MainActor
+func waitUntil(
+  _ condition: @autoclosure () -> Bool,
+  timeout: TimeInterval = 2,
+  file: StaticString = #filePath,
+  line: UInt = #line
+) async {
+  let deadline = Date().addingTimeInterval(timeout)
+  while !condition() && Date() < deadline {
+    try? await Task.sleep(nanoseconds: 10_000_000)
+  }
+  XCTAssertTrue(condition(), file: file, line: line)
+}
+
+/// 等待工作流发布探测结果；发布前订阅，避免依赖轮询与线程调度耗时。
+/// 调用方用测试框架的 timeLimit 保护永不发布的回归。
+@MainActor
+func waitForPortEditorOccupancy(
+  _ workflow: SettingsWorkflow, draft: SettingsPortDraft, port: SettingsPortID
+) async {
+  let (events, continuation) = AsyncStream<Void>.makeStream(bufferingPolicy: .bufferingNewest(1))
+  let observation = workflow.objectWillChange.sink { continuation.yield(()) }
+  defer {
+    observation.cancel()
+    continuation.finish()
+  }
+  continuation.yield(())
+  for await _ in events
+  where workflow.portFieldState(for: port, editorDraft: draft).occupancy != nil {
+    return
+  }
+}
+
+/// 设置工作流测试的写入缝替身：记录提交调用，可注入失败；
+/// 不触碰真实偏好文件、钥匙串或运行时。
+@MainActor
+final class FakeSettingsCommitter: SettingsCommitting {
+  var committedSettings: ProxyRuntimeSettings = ProxyRuntimeSettings()
+  var runtimeListenFacts: RuntimeListenFacts?
+  var runtimeListenerProcessID: Int32?
+  var updateError: Error?
+  var updateGate: AsyncGate?
+  private(set) var updateCalls: [ProxyRuntimeSettings] = []
+
+  var isProxyRunning: Bool {
+    get { runtimeListenFacts != nil }
+    set {
+      runtimeListenFacts = newValue ? RuntimeListenFacts(listen: committedSettings.listen) : nil
+    }
+  }
+
+  func updateListening(_ proposed: ProxyListeningConfiguration) async throws {
+    if let updateError { throw updateError }
+    try proposed.enforcePersistenceConstraints()
+    if let updateGate { await updateGate.wait() }
+    committedSettings.listen = proposed
+    updateCalls.append(committedSettings)
+  }
+
+  func updateProxyExceptions(_ value: String) async {
+    if let updateGate { await updateGate.wait() }
+    committedSettings.proxyExceptions = value
+    updateCalls.append(committedSettings)
+  }
+
+  func updateListenerMode(_ mode: ListenerMode) async throws {
+    var proposed = committedSettings.listen
+    proposed.listenerMode = mode
+    try await updateListening(proposed)
+  }
+
+}
+
+/// 可重复使用的异步门闩，用于证明 workflow 在提交等待期间拒绝第二次命令。
+final class AsyncGate: @unchecked Sendable {
+  private let lock = NSLock()
+  private var released = false
+  private var waiters: [CheckedContinuation<Void, Never>] = []
+
+  func wait() async {
+    await withCheckedContinuation { continuation in
+      lock.lock()
+      if released {
+        lock.unlock()
+        continuation.resume()
+      } else {
+        waiters.append(continuation)
+        lock.unlock()
+      }
+    }
+  }
+
+  func release() {
+    lock.lock()
+    released = true
+    let waiters = self.waiters
+    self.waiters.removeAll()
+    lock.unlock()
+    for waiter in waiters {
+      waiter.resume()
+    }
+  }
+}
+
+/// 占用探测替身：按端口预设占用/不可判定，记录全部探测请求。
+final class FakeOccupancyProbe: PortOccupancyProbing, @unchecked Sendable {
+  private let lock = NSLock()
+  private let occupiedPorts: Set<Int>
+  private let unknownPorts: Set<Int>
+  private let occupierName: String
+  private let occupierIPv4ProcessIDs: Set<Int32>
+  private let occupierIPv6ProcessIDs: Set<Int32>
+  private let explicitOccupiedFamilies: Set<PortOccupancyAddressFamily>?
+  private let unverifiedFamilyDetail: String?
+  private var requestedPorts: [Int] = []
+  private var requestedRequests: [PortOccupancyProbeRequest] = []
+  private var answerOverride: PortOccupancy?
+
+  init(
+    occupiedPorts: Set<Int> = [], unknownPorts: Set<Int> = [], occupierName: String = "other-app",
+    occupierProcessIDs: Set<Int32> = [], occupierIPv6ProcessIDs: Set<Int32> = [],
+    occupiedFamilies: Set<PortOccupancyAddressFamily>? = nil,
+    unverifiedFamilyDetail: String? = nil
+  ) {
+    self.occupiedPorts = occupiedPorts
+    self.unknownPorts = unknownPorts
+    self.occupierName = occupierName
+    occupierIPv4ProcessIDs = occupierProcessIDs
+    self.occupierIPv6ProcessIDs = occupierIPv6ProcessIDs
+    explicitOccupiedFamilies = occupiedFamilies
+    self.unverifiedFamilyDetail = unverifiedFamilyDetail
+  }
+
+  var requested: [Int] {
+    lock.lock()
+    defer { lock.unlock() }
+    return requestedPorts
+  }
+
+  var callCount: Int {
+    lock.lock()
+    defer { lock.unlock() }
+    return requestedPorts.count
+  }
+
+  var requests: [PortOccupancyProbeRequest] {
+    lock.lock()
+    defer { lock.unlock() }
+    return requestedRequests
+  }
+
+  /// 覆盖全部端口的应答（占用代际测试用）。
+  func setAnswer(_ answer: PortOccupancy?) {
+    lock.lock()
+    defer { lock.unlock() }
+    answerOverride = answer
+  }
+
+  func occupancy(for request: PortOccupancyProbeRequest) async -> PortOccupancy {
+    occupancySynchronously(for: request)
+  }
+
+  private func occupancySynchronously(for request: PortOccupancyProbeRequest) -> PortOccupancy {
+    lock.lock()
+    defer { lock.unlock() }
+    requestedPorts.append(request.port)
+    requestedRequests.append(request)
+    if let answerOverride { return answerOverride }
+    if unknownPorts.contains(request.port) {
+      return .unknown(detail: "无法判定")
+    }
+    return occupiedPorts.contains(request.port)
+      ? .occupied(
+        PortOccupancyFacts(
+          occupier: occupierName, ipv4ProcessIDs: occupierIPv4ProcessIDs,
+          ipv6ProcessIDs: occupierIPv6ProcessIDs,
+          occupiedFamilies: explicitOccupiedFamilies
+            ?? occupiedFamilies(for: request.listenerMode),
+          verifiedFamilies: Set(PortOccupancyAddressFamily.allCases),
+          unverifiedFamilyDetail: unverifiedFamilyDetail)) : .free
+  }
+
+  private func occupiedFamilies(for mode: ListenerMode) -> Set<PortOccupancyAddressFamily> {
+    switch mode {
+    case .disabled, .allIPv4Interfaces:
+      [.ipv4]
+    case .allIPv4AndIPv6Interfaces:
+      [.ipv4, .ipv6]
+    case .allIPv6Interfaces:
+      [.ipv6]
+    }
+  }
+}
+
+/// 分阶段占用探测替身（占用代际测试用）：门闩阶段的调用先记下自己的应答再
+/// 被扣住，`passThrough` 之后的调用立即返回新应答。用于把「旧一轮」结果钉在
+/// 新一轮之后落盘，验证过期结果不得覆盖。
+final class GatedOccupancyProbe: PortOccupancyProbing, @unchecked Sendable {
+  private struct Invocation {
+    let isFirstEntry: Bool
+    let isGated: Bool
+    let answer: PortOccupancy
+  }
+
+  private let lock = NSLock()
+  private let gate = TestAsyncGate("occupancy probe release")
+  private var isGated = true
+  private var enteredCount = 0
+  private let entry = XCTestExpectation(description: "occupancy probe entered")
+  private var gatedAnswer: PortOccupancy
+  private var passThroughAnswer: PortOccupancy
+
+  init(gatedAnswer: PortOccupancy, passThroughAnswer: PortOccupancy) {
+    self.gatedAnswer = gatedAnswer
+    self.passThroughAnswer = passThroughAnswer
+  }
+
+  /// 已进入探测的调用数（按端口标识序，socks 先于 http）。
+  var entered: Int {
+    lock.lock()
+    defer { lock.unlock() }
+    return enteredCount
+  }
+
+  func waitUntilEntered() async throws {
+    try await requireTestPhase([entry])
+  }
+
+  /// 之后的调用立即返回 `answer`；已进入且被扣住的调用仍持有各自应答。
+  func passThrough(_ answer: PortOccupancy) {
+    lock.lock()
+    defer { lock.unlock() }
+    isGated = false
+    passThroughAnswer = answer
+  }
+
+  /// 放行全部被扣住的调用（广播门闩）。
+  func releaseGatedCalls() {
+    lock.lock()
+    isGated = false
+    lock.unlock()
+    gate.release()
+  }
+
+  func occupancy(for request: PortOccupancyProbeRequest) async -> PortOccupancy {
+    let invocation = record(request)
+    if invocation.isFirstEntry { entry.fulfill() }
+    if invocation.isGated, !(await gate.wait()) {
+      return .unknown(detail: "Test fixture release timed out")
+    }
+    return invocation.answer
+  }
+
+  private func record(_ request: PortOccupancyProbeRequest) -> Invocation {
+    lock.lock()
+    enteredCount += 1
+    let firstEntry = enteredCount == 1
+    let gated = isGated
+    let answer = gated ? gatedAnswer : passThroughAnswer
+    lock.unlock()
+    return Invocation(isFirstEntry: firstEntry, isGated: gated, answer: answer)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/SleepGateRecorder.swift b/ShadowsocksX-NG2/Tests/Support/SleepGateRecorder.swift
new file mode 100644
index 000000000..4752cc8b9
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/SleepGateRecorder.swift
@@ -0,0 +1,28 @@
+import Foundation
+
+/// 顺序虚拟 sleep 记录器：调用前先 `armNextCall()` 预约一对门闩，下一次
+/// sleep 记录延迟、报到后挂起在预约门闩上；测试据此按调用序推进虚拟时钟，
+/// 不轮询、不真实等待。
+@MainActor
+final class SleepGateRecorder {
+  private(set) var delays: [TimeInterval] = []
+  private var armedEntered: AsyncGate?
+  private var armedRelease: AsyncGate?
+
+  func sleep(_ delay: TimeInterval) async {
+    delays.append(delay)
+    let entered = armedEntered ?? AsyncGate()
+    let release = armedRelease ?? AsyncGate()
+    armedEntered = nil
+    armedRelease = nil
+    entered.release()
+    await release.wait()
+  }
+
+  func armNextCall() -> (entered: AsyncGate, release: AsyncGate) {
+    let pair = (entered: AsyncGate(), release: AsyncGate())
+    armedEntered = pair.entered
+    armedRelease = pair.release
+    return pair
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/SystemProxyFakes.swift b/ShadowsocksX-NG2/Tests/Support/SystemProxyFakes.swift
new file mode 100644
index 000000000..0a965628d
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/SystemProxyFakes.swift
@@ -0,0 +1,148 @@
+@testable import ShadowsocksX_NG2
+
+/// 系统代理相关替身：从 ProxyRuntimeFixture 主文件分出，
+/// 保持 `ProxyRuntimeFixture.` 限定名不变。
+extension ProxyRuntimeFixture {
+  @MainActor
+  final class FakeSystemProxy: SystemProxyControlling {
+    private(set) var applied: [SystemProxyConfiguration] = []
+    private(set) var clearCount = 0
+    var services: [SystemProxyServiceState] = [
+      SystemProxyServiceState(
+        identifier: SystemProxyServiceIdentifier(locationID: "home", serviceID: "wifi"),
+        configuration: nil, name: "Wi-Fi")
+    ]
+    var readError: Error?
+    var beforeRead: (@MainActor () async -> Void)?
+    private(set) var readCount = 0
+    private(set) var repairedServices: [SystemProxyServiceIdentifier] = []
+    var beforeRepair: (@MainActor () async -> Void)?
+    var preserveConfigurationOnApply = false
+    var applyError: Error?
+    var clearError: Error?
+    var onClear: (@MainActor () -> Void)?
+    /// 注入返回值：模拟系统值已与期望等价的免授权跳过路径。
+    var applyOutcome: SystemProxyWriteOutcome = .written
+    /// 可选共享事件日志（次序断言用）。
+    weak var eventLog: ProxyRuntimeEventLog?
+
+    func apply(
+      _ configuration: SystemProxyConfiguration
+    ) async throws -> SystemProxyWriteOutcome {
+      eventLog?.record("apply")
+      if let applyError { throw applyError }
+      applied.append(configuration)
+      if !preserveConfigurationOnApply {
+        let plan = try SystemProxyPlanner.makeApplyPlan(
+          services: services, configuration: configuration)
+        for write in plan.writes {
+          if let index = services.firstIndex(where: { $0.identifier == write.identifier }) {
+            services[index] = SystemProxyServiceState(
+              identifier: write.identifier, configuration: write.configuration,
+              name: services[index].name)
+          }
+        }
+      }
+      return applyOutcome
+    }
+
+    func readServices() async throws -> [SystemProxyServiceState] {
+      readCount += 1
+      if let readError { throw readError }
+      let snapshot = services
+      await beforeRead?()
+      return snapshot
+    }
+
+    func repair(_ configuration: SystemProxyConfiguration) async throws {
+      await beforeRepair?()
+      let plan = try SystemProxyPlanner.makeApplyPlan(
+        services: services, configuration: configuration)
+      repairedServices = plan.writes.map(\.identifier)
+      _ = try await apply(configuration)
+    }
+
+    func clear() async throws {
+      clearCount += 1
+      eventLog?.record("clear")
+      onClear?()
+      if let clearError { throw clearError }
+      services = services.map {
+        SystemProxyServiceState(identifier: $0.identifier, configuration: nil, name: $0.name)
+      }
+    }
+  }
+
+  /// 特权 helper 注册/审批状态可编程替身。
+  @MainActor
+  final class FakeSystemProxyHelperService: SystemProxyHelperServicing {
+    private(set) var currentStatus: SystemProxyHelperStatus
+    private(set) var registerCount = 0
+    private(set) var unregisterCount = 0
+    private(set) var registerError: Error?
+    private(set) var unregisterError: Error?
+    private(set) var openApprovalPathCount = 0
+    /// register 成功后迁移到的状态（模拟 BTM 批准立即达成）。
+    var statusAfterRegister: SystemProxyHelperStatus = .approved
+
+    init(initialStatus: SystemProxyHelperStatus = .approved) {
+      currentStatus = initialStatus
+    }
+
+    var status: SystemProxyHelperStatus { currentStatus }
+
+    func setStatus(_ status: SystemProxyHelperStatus) {
+      currentStatus = status
+    }
+
+    func setRegisterError(_ error: Error?) {
+      registerError = error
+    }
+
+    func setUnregisterError(_ error: Error?) {
+      unregisterError = error
+    }
+
+    func register() throws {
+      registerCount += 1
+      if let registerError { throw registerError }
+      currentStatus = statusAfterRegister
+    }
+
+    func unregister() throws {
+      unregisterCount += 1
+      if let unregisterError { throw unregisterError }
+      currentStatus = .notRegistered
+    }
+
+    func openApprovalPath() {
+      openApprovalPathCount += 1
+    }
+  }
+
+  @MainActor
+  final class FakeSystemProxyNetworkChangeMonitor: SystemProxyNetworkChangeMonitoring {
+    private(set) var startCount = 0
+    private(set) var stopCount = 0
+    private(set) var isObserving = false
+    private var handler: (@MainActor @Sendable (SystemProxyNetworkChange) -> Void)?
+
+    func start(
+      handler: @escaping @MainActor @Sendable (SystemProxyNetworkChange) -> Void
+    ) {
+      startCount += 1
+      isObserving = true
+      self.handler = handler
+    }
+
+    func stop() {
+      stopCount += 1
+      isObserving = false
+      handler = nil
+    }
+
+    func emit(_ change: SystemProxyNetworkChange) {
+      handler?(change)
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Support/TestSourceTree.swift b/ShadowsocksX-NG2/Tests/Support/TestSourceTree.swift
new file mode 100644
index 000000000..4804a49d6
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Support/TestSourceTree.swift
@@ -0,0 +1,26 @@
+import Foundation
+
+/// 测试源码树位置。
+///
+/// 断言需要读源码树（`Vendor/` 快照、`App/`、`Domain/`）时，把 `#filePath` 交给
+/// 这里定位：从该文件所在目录沿父目录上溯，返回含 `project.yml` 的目录，即
+/// `ShadowsocksX-NG2/`。
+///
+/// 刻意不写死 `deletingLastPathComponent` 的层数：那等于把「测试文件在
+/// `Tests/` 根层」编进代码，文件移进子目录后会静默指错；而测试文件处于不同
+/// 深度时（`Tests/Agent/` 与 `Tests/Rules/Custom/`）也无法共用一个层数。
+enum TestSourceTree {
+  /// `#filePath` 作为默认参数在**调用点**求值，因此拿到的是调用者所在文件。
+  static func ng2Root(filePath: String = #filePath) -> URL {
+    var directory = URL(fileURLWithPath: filePath).deletingLastPathComponent()
+    while directory.path != "/" {
+      if FileManager.default.fileExists(
+        atPath: directory.appendingPathComponent("project.yml").path)
+      {
+        return directory
+      }
+      directory = directory.deletingLastPathComponent()
+    }
+    preconditionFailure("从 \(filePath) 沿父目录上溯未找到 project.yml（ShadowsocksX-NG2/）")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyHelperContractTests.swift b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyHelperContractTests.swift
new file mode 100644
index 000000000..33b250609
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyHelperContractTests.swift
@@ -0,0 +1,122 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// helper XPC 契约测试：引擎应答编码、typed 失败归并与串行
+/// last-writer 语义，全部用确定性替身，不触真实 XPC 与 SystemConfiguration。
+final class SystemProxyHelperContractTests: XCTestCase {
+  private let configuration = SystemProxyConfiguration(
+    socks: .init(host: "127.0.0.1", port: 1086),
+    http: .init(host: "127.0.0.1", port: 1087),
+    https: .init(host: "127.0.0.1", port: 1087),
+    exceptions: ["localhost"])
+
+  /// 并发闭包与断言之间的线程安全值交接。
+  private final class LockedArray<Element>: @unchecked Sendable {
+    private let lock = NSLock()
+    private var items: [Element] = []
+
+    func append(_ item: Element) {
+      lock.lock()
+      items.append(item)
+      lock.unlock()
+    }
+
+    var all: [Element] {
+      lock.lock()
+      defer { lock.unlock() }
+      return items
+    }
+  }
+
+  func testEngineAnswersApplyWithTypedOutcome() throws {
+    let observed = LockedArray<SystemProxyHelperEngine.Request>()
+    let response = SystemProxyHelperEngine.response(
+      request: .success(.apply(configuration)),
+      perform: { request in
+        observed.append(request)
+        return .applied(.written)
+      })
+
+    XCTAssertEqual(observed.all, [.apply(configuration)], "helper 收到 closed typed 配置")
+    XCTAssertEqual(response, .applied(.written))
+  }
+
+  func testEngineAnswersClearWithTypedOutcome() {
+    let response = SystemProxyHelperEngine.response(
+      request: .success(.clear), perform: { _ in .cleared })
+    XCTAssertEqual(response, .cleared)
+  }
+
+  func testEngineEncodesTypedFailuresAndInvalidPayloads() throws {
+    let failure = SystemProxyHelperEngine.response(
+      request: .failure(SystemProxyError.commitFailed("busy")),
+      perform: { _ in .cleared })
+    XCTAssertEqual(failure, .failure(.commitFailed("busy")))
+
+    let genericFailure = SystemProxyHelperEngine.response(
+      request: .failure(ProxyListeningStoreError.corrupt(detail: "bad")),
+      perform: { _ in .cleared })
+    XCTAssertEqual(
+      genericFailure, .failure(.helperUnavailable("corrupt(detail: \"bad\")")),
+      "非 SystemProxyError 归并为 helperUnavailable")
+
+    XCTAssertThrowsError(
+      try SystemProxyHelperWire.decodeConfiguration(Data("not json".utf8))
+    ) { error in
+      guard case SystemProxyError.invalidRequest = error else {
+        return XCTFail("无效 payload 应为 invalidRequest，实际 \(error)")
+      }
+    }
+  }
+
+  /// 串行 last-writer：注入的假写入器在共享串行队列上按
+  /// 接受顺序执行，最后接受的请求决定最终结果。
+  func testEngineProcessesRequestsSeriallyWithLastWriterWins() async throws {
+    let recorder = LockedArray<String>()
+    let queue = DispatchQueue(label: "test.system-proxy-helper.serial")
+    let engine = SystemProxyHelperEngine(
+      perform: { request in
+        switch request {
+        case .apply(let applied):
+          recorder.append("apply:\(applied.socks.port)")
+        case .clear:
+          recorder.append("clear")
+        }
+        return .applied(.written)
+      },
+      queue: queue)
+
+    let first = try SystemProxyHelperWire.encodeConfiguration(configuration)
+    let second = try SystemProxyHelperWire.encodeConfiguration(
+      SystemProxyConfiguration(
+        socks: .init(host: "127.0.0.1", port: 2086),
+        http: .init(host: "127.0.0.1", port: 2087),
+        https: .init(host: "127.0.0.1", port: 2087),
+        exceptions: ["localhost"]))
+
+    let replies = LockedArray<Data>()
+    let replyExpectation = expectation(description: "replies")
+    replyExpectation.expectedFulfillmentCount = 3
+    engine.apply(first) {
+      replies.append($0)
+      replyExpectation.fulfill()
+    }
+    engine.clear {
+      replies.append($0)
+      replyExpectation.fulfill()
+    }
+    engine.apply(second) {
+      replies.append($0)
+      replyExpectation.fulfill()
+    }
+    await fulfillment(of: [replyExpectation], timeout: 5)
+
+    XCTAssertEqual(recorder.all, ["apply:1086", "clear", "apply:2086"], "逐个串行执行")
+    XCTAssertEqual(replies.all.count, 3)
+    for reply in replies.all {
+      XCTAssertEqual(
+        try SystemProxyHelperWire.decode(reply), .applied(.written), "每个请求都有 typed 应答")
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyHelperLogTests.swift b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyHelperLogTests.swift
new file mode 100644
index 000000000..58ce7a8b3
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyHelperLogTests.swift
@@ -0,0 +1,216 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 特权 helper 事件的统一日志路由与发射缝测试（ADR-0047）：route 是纯
+/// 函数，断言 level/category/公开文本与 privacy 拆分；engine 与 listener
+/// 经注入替身断言发射调用。测试不写真实系统日志 store（scheme 注入
+/// SSXNG_SYSTEM_LOG=0），也不触真实 SystemConfiguration。
+@Suite struct SystemProxyHelperLogTests {
+  private let configuration = SystemProxyConfiguration(
+    socks: .init(host: "127.0.0.1", port: 1086),
+    http: .init(host: "127.0.0.1", port: 1087),
+    https: .init(host: "127.0.0.1", port: 1087),
+    exceptions: ["localhost"])
+
+  /// 并发闭包与断言之间的线程安全事件交接。
+  private final class EventRecorder: @unchecked Sendable {
+    private let lock = NSLock()
+    private var events: [SystemProxyHelperLogEvent] = []
+
+    func append(_ event: SystemProxyHelperLogEvent) {
+      lock.lock()
+      events.append(event)
+      lock.unlock()
+    }
+
+    var all: [SystemProxyHelperLogEvent] {
+      lock.lock()
+      defer { lock.unlock() }
+      return events
+    }
+  }
+
+  // MARK: - route（纯函数）
+
+  @Test func lifecycleEventsRouteToSystemProxyCategory() {
+    let ready = SystemProxyHelperLogEvent.listenerReady.logRoute
+    #expect(ready.level == .default)
+    #expect(ready.category == "system-proxy")
+    #expect(ready.text == "system proxy helper listening")
+    #expect(ready.privateDetail == nil)
+
+    let accepted = SystemProxyHelperLogEvent.connectionAccepted(pid: 42).logRoute
+    #expect(accepted.level == .default)
+    #expect(accepted.text == "system proxy helper connection accepted (pid=42)")
+    #expect(accepted.privateDetail == nil)
+
+    let rejected = SystemProxyHelperLogEvent.connectionRejected(pid: 7).logRoute
+    #expect(rejected.level == .error)
+    #expect(rejected.text == "system proxy helper connection rejected (pid=7)")
+    #expect(rejected.privateDetail == nil)
+  }
+
+  @Test func requestResultsRouteAsMilestones() {
+    let written = SystemProxyHelperLogEvent.applyCompleted(.written).logRoute
+    #expect(written.level == .default)
+    #expect(written.text == "system proxy helper apply completed (outcome=written)")
+
+    let unchanged = SystemProxyHelperLogEvent.applyCompleted(.unchanged).logRoute
+    #expect(unchanged.level == .default)
+    #expect(unchanged.text == "system proxy helper apply completed (outcome=unchanged)")
+
+    let cleared = SystemProxyHelperLogEvent.clearCompleted.logRoute
+    #expect(cleared.level == .default)
+    #expect(cleared.text == "system proxy helper clear completed")
+  }
+
+  @Test func requestFailureKeepsFreeDetailPrivate() {
+    let event = SystemProxyHelperLogEvent.requestFailed(
+      .commitFailed("SCPreferencesCommitChanges: busy"))
+    let route = event.logRoute
+    #expect(route.level == .error)
+    #expect(route.category == "system-proxy")
+    #expect(route.text == "system proxy helper request failed: commit failed: ")
+    #expect(route.privateDetail == "SCPreferencesCommitChanges: busy")
+    #expect(route.text + route.privateDetail! == event.description, "text+detail == description")
+  }
+
+  @Test func requestFailureWithoutDetailHasNoPrivateSegment() {
+    let event = SystemProxyHelperLogEvent.requestFailed(.preferencesBusy)
+    #expect(event.logRoute.text == "system proxy helper request failed: preferences busy")
+    #expect(event.logRoute.privateDetail == nil)
+    #expect(event.description == "system proxy helper request failed: preferences busy")
+  }
+
+  @Test func errorCasesSplitDetailFromPublicText() {
+    #expect(SystemProxyError.unreadableService("svc-1").logParts.text == "unreadable service")
+    #expect(SystemProxyError.unreadableService("svc-1").logParts.detail == "svc-1")
+    #expect(SystemProxyError.invalidRequest("bad json").logParts.detail == "bad json")
+    #expect(SystemProxyError.helperUnavailable("timeout").logParts.detail == "timeout")
+    #expect(SystemProxyError.preferencesUnavailable.logParts.detail == nil)
+    #expect(SystemProxyError.noProxyServices.logParts.detail == nil)
+    #expect(SystemProxyError.noCurrentNetworkSet.logParts.detail == nil)
+    #expect(SystemProxyError.noNetworkLocations.logParts.detail == nil)
+    #expect(SystemProxyError.invalidStoredConfiguration("svc-2").logParts.detail == "svc-2")
+    #expect(SystemProxyError.cannotWriteService("svc-3").logParts.detail == "svc-3")
+    #expect(SystemProxyError.applyFailed("SCError").logParts.detail == "SCError")
+  }
+
+  @Test func eventsDeriveFromTypedResponses() {
+    #expect(SystemProxyHelperLogEvent(response: .applied(.written)) == .applyCompleted(.written))
+    #expect(SystemProxyHelperLogEvent(response: .cleared) == .clearCompleted)
+    #expect(
+      SystemProxyHelperLogEvent(response: .failure(.noProxyServices))
+        == .requestFailed(.noProxyServices))
+  }
+
+  // MARK: - 发射缝（engine 注入替身）
+
+  @Test func engineEmitsTypedApplyResult() async throws {
+    let recorder = EventRecorder()
+    let engine = SystemProxyHelperEngine(perform: { _ in .applied(.written) }, log: recorder.append)
+    let payload = try SystemProxyHelperWire.encodeConfiguration(configuration)
+    await withCheckedContinuation { (continuation: CheckedContinuation<Void, Never>) in
+      engine.apply(payload) { _ in continuation.resume() }
+    }
+    #expect(recorder.all == [.applyCompleted(.written)])
+  }
+
+  @Test func engineEmitsClearResult() async {
+    let recorder = EventRecorder()
+    let engine = SystemProxyHelperEngine(perform: { _ in .cleared }, log: recorder.append)
+    await withCheckedContinuation { (continuation: CheckedContinuation<Void, Never>) in
+      engine.clear { _ in continuation.resume() }
+    }
+    #expect(recorder.all == [.clearCompleted])
+  }
+
+  @Test func engineEmitsFailureForUndecodablePayload() async {
+    let recorder = EventRecorder()
+    let engine = SystemProxyHelperEngine(perform: { _ in .cleared }, log: recorder.append)
+    await withCheckedContinuation { (continuation: CheckedContinuation<Void, Never>) in
+      engine.apply(Data("not json".utf8)) { _ in continuation.resume() }
+    }
+    guard case .requestFailed(let error) = recorder.all.first else {
+      Issue.record("无效 payload 应发射 requestFailed，实际 \(recorder.all)")
+      return
+    }
+    #expect(error.logParts.text == "invalid request")
+    #expect(error.logParts.detail != nil)
+  }
+
+  // MARK: - 发射缝（listener 注入替身，真实匿名 XPC）
+
+  @Test func listenerEmitsAcceptedConnectionBeforeRequestResult() async throws {
+    let recorder = EventRecorder()
+    let engine = SystemProxyHelperEngine(perform: { _ in .cleared }, log: recorder.append)
+    let delegate = SystemProxyHelperListenerDelegate(
+      engine: engine,
+      expectedClientIdentifier: try #require(ProcessSigningIdentifier.current()),
+      log: recorder.append)
+    let listener = NSXPCListener.anonymous()
+    listener.delegate = delegate
+    listener.resume()
+    defer { listener.invalidate() }
+
+    let connection = NSXPCConnection(listenerEndpoint: listener.endpoint)
+    connection.remoteObjectInterface = NSXPCInterface(with: SystemProxyHelperControlling.self)
+    connection.resume()
+    defer { connection.invalidate() }
+
+    let proxy = try #require(
+      connection.remoteObjectProxyWithErrorHandler { _ in } as? SystemProxyHelperControlling)
+    await withCheckedContinuation { (continuation: CheckedContinuation<Void, Never>) in
+      proxy.clear { _ in continuation.resume() }
+    }
+    #expect(recorder.all == [.connectionAccepted(pid: getpid()), .clearCompleted])
+  }
+
+  @Test func listenerEmitsRejectedConnection() async {
+    let recorder = EventRecorder()
+    let engine = SystemProxyHelperEngine(perform: { _ in .cleared }, log: recorder.append)
+    let delegate = SystemProxyHelperListenerDelegate(
+      engine: engine,
+      expectedClientIdentifier: "com.example.not-the-client",
+      log: recorder.append)
+    let listener = NSXPCListener.anonymous()
+    listener.delegate = delegate
+    listener.resume()
+    defer { listener.invalidate() }
+
+    let connection = NSXPCConnection(listenerEndpoint: listener.endpoint)
+    connection.remoteObjectInterface = NSXPCInterface(with: SystemProxyHelperControlling.self)
+    // XPC 惰性连接：发一条消息才触发服务端签名校验；被拒绝的连接以失效
+    // （或代理错误回调）告终。超时兜底避免挂死，超时后事件断言自然失败。
+    await withCheckedContinuation { (continuation: CheckedContinuation<Void, Never>) in
+      let once = ResumeOnce(continuation)
+      connection.invalidationHandler = { once.resume() }
+      connection.resume()
+      let proxy = connection.remoteObjectProxyWithErrorHandler { _ in once.resume() }
+      (proxy as? SystemProxyHelperControlling)?.clear { _ in }
+      DispatchQueue.global().asyncAfter(deadline: .now() + 10) { once.resume() }
+    }
+    connection.invalidate()
+    #expect(recorder.all == [.connectionRejected(pid: getpid())])
+  }
+}
+
+/// 只恢复一次的 continuation 装箱：失效回调与超时兜底竞争同一恢复权。
+private final class ResumeOnce: @unchecked Sendable {
+  private let lock = NSLock()
+  private var continuation: CheckedContinuation<Void, Never>?
+
+  init(_ continuation: CheckedContinuation<Void, Never>) {
+    self.continuation = continuation
+  }
+
+  func resume() {
+    lock.lock()
+    let taken = continuation
+    continuation = nil
+    lock.unlock()
+    taken?.resume()
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyHelperXPCRoundTripTests.swift b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyHelperXPCRoundTripTests.swift
new file mode 100644
index 000000000..371824f64
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyHelperXPCRoundTripTests.swift
@@ -0,0 +1,71 @@
+import Foundation
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 真实 XPC 装配层的契约 round-trip：匿名监听器挂真实 listener
+/// delegate（注入假特权写入器，不触真实系统设置）+ listenerEndpoint 连接，覆盖
+/// fakes 与纯逻辑单测覆盖不到的层：NSXPCInterface 方法签名、客户端签名
+/// identifier 校验、Data payload 传输与 XPC 内部队列应答路径。去宿主化
+/// （ADR 0021）后连接方是 xctest runner 本进程，delegate 期望身份按本进程
+/// 实际签名 identifier 注入，无需 launchd。
+/// 注意：NSXPCListener.delegate 是弱引用，delegate 必须由测试强持有。
+final class SystemProxyHelperXPCRoundTripTests: XCTestCase {
+  func testTypedApplyAndClearRoundTripThroughRealXPCConnection() async throws {
+    let engine = SystemProxyHelperEngine(perform: { request in
+      switch request {
+      case .apply: return .applied(.written)
+      case .clear: return .cleared
+      }
+    })
+    let delegate = SystemProxyHelperListenerDelegate(
+      engine: engine,
+      expectedClientIdentifier: try XCTUnwrap(ProcessSigningIdentifier.current()))
+    let listener = NSXPCListener.anonymous()
+    listener.delegate = delegate
+    listener.resume()
+    defer { listener.invalidate() }
+
+    let connection = NSXPCConnection(listenerEndpoint: listener.endpoint)
+    connection.remoteObjectInterface = NSXPCInterface(with: SystemProxyHelperControlling.self)
+    connection.resume()
+    defer { connection.invalidate() }
+
+    let proxy = try XCTUnwrap(
+      connection.remoteObjectProxyWithErrorHandler { (error: Error) in
+        XCTFail("XPC 错误回调不应触发：\(error)")
+      } as? SystemProxyHelperControlling)
+
+    let configuration = SystemProxyConfiguration(
+      socks: .init(host: "127.0.0.1", port: 1086),
+      http: .init(host: "127.0.0.1", port: 1087), https: .init(host: "127.0.0.1", port: 1087),
+      exceptions: ["localhost"])
+    let payload = try SystemProxyHelperWire.encodeConfiguration(configuration)
+
+    let applyReplied = expectation(description: "apply reply")
+    var appliedResponse: SystemProxyHelperResponse?
+    proxy.apply(payload) { data in
+      do {
+        appliedResponse = try SystemProxyHelperWire.decode(data)
+      } catch {
+        XCTFail("apply 应答无法解码：\(error)")
+      }
+      applyReplied.fulfill()
+    }
+    await fulfillment(of: [applyReplied], timeout: 10)
+    XCTAssertEqual(appliedResponse, .applied(.written))
+
+    let clearReplied = expectation(description: "clear reply")
+    var clearedResponse: SystemProxyHelperResponse?
+    proxy.clear { data in
+      do {
+        clearedResponse = try SystemProxyHelperWire.decode(data)
+      } catch {
+        XCTFail("clear 应答无法解码：\(error)")
+      }
+      clearReplied.fulfill()
+    }
+    await fulfillment(of: [clearReplied], timeout: 10)
+    XCTAssertEqual(clearedResponse, .cleared)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyObserverTests.swift b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyObserverTests.swift
new file mode 100644
index 000000000..86d6d805f
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyObserverTests.swift
@@ -0,0 +1,167 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 系统代理观察机 interface 驱动测试（ADR-0022 策略机抽取后）：不经控制器
+/// 夹具，直接以三条缝的替身驱动 cleanup-until-quiet 循环与操作互斥。
+@MainActor
+final class SystemProxyObserverTests: XCTestCase {
+  func testCleanupRescansWhileNetworkKeepsChangingThenGoesQuiet() async throws {
+    let proxy = ProxyRuntimeFixture.FakeSystemProxy()
+    let monitor = ProxyRuntimeFixture.FakeSystemProxyNetworkChangeMonitor()
+    let observer = makeObserver(
+      proxy: proxy, monitor: monitor, cleanupSettleNanoseconds: 1_000_000)
+    // 第一次 clear 期间到达的网络变化触发整轮重扫；随后安静，循环收敛。
+    var emittedChange = false
+    proxy.onClear = {
+      guard !emittedChange else { return }
+      emittedChange = true
+      monitor.emit([.networkConfiguration, .proxyConfiguration])
+    }
+
+    let outcome = await observer.clearAndStopSystemProxyObservation()
+
+    XCTAssertEqual(outcome, .idle)
+    XCTAssertEqual(proxy.clearCount, 2, "清理期内的网络变化必须触发整轮重扫")
+    XCTAssertTrue(emittedChange)
+    XCTAssertEqual(monitor.startCount, 1)
+    XCTAssertEqual(monitor.stopCount, 1)
+    XCTAssertEqual(observer.systemProxyObservationMode, .stopped)
+    XCTAssertEqual(observer.systemProxyState, .idle)
+    XCTAssertFalse(observer.systemProxyInspection.isBusy)
+  }
+
+  func testConvergeWaitsForInFlightOperationInsteadOfSkipping() async throws {
+    let proxy = ProxyRuntimeFixture.FakeSystemProxy()
+    let observer = makeObserver(proxy: proxy, cleanupSettleNanoseconds: 1_000_000)
+    // 拉长首次读服务的窗口，制造进行中的操作。
+    proxy.beforeRead = { _ = try? await Task.sleep(nanoseconds: 30_000_000) }
+
+    let first = Task { await observer.convergeSystemProxy(forceApply: true) }
+    try await Task.sleep(nanoseconds: 10_000_000)
+    await observer.convergeSystemProxy(forceApply: true)
+    await first.value
+
+    XCTAssertEqual(proxy.applied.count, 2, "并发收敛必须等操作收尾后执行而非被跳过")
+  }
+
+  func testEnableIntentAppliesFreshAndStartsObservation() async throws {
+    let proxy = ProxyRuntimeFixture.FakeSystemProxy()
+    let monitor = ProxyRuntimeFixture.FakeSystemProxyNetworkChangeMonitor()
+    let observer = makeObserver(proxy: proxy, monitor: monitor, cleanupSettleNanoseconds: 1_000_000)
+
+    await observer.enableSystemProxyIntent()
+
+    XCTAssertEqual(proxy.applied.count, 1, "开启意图必须真实应用一次（清理期可能已清空系统设置）")
+    XCTAssertEqual(observer.systemProxyState, .applied)
+    XCTAssertEqual(observer.systemProxyObservationMode, .enabled)
+    XCTAssertEqual(monitor.startCount, 1)
+  }
+
+  func testDisableIntentClearsStopsObservationAndPublishesOutcome() async throws {
+    let proxy = ProxyRuntimeFixture.FakeSystemProxy()
+    let monitor = ProxyRuntimeFixture.FakeSystemProxyNetworkChangeMonitor()
+    let observer = makeObserver(proxy: proxy, monitor: monitor, cleanupSettleNanoseconds: 1_000_000)
+    await observer.enableSystemProxyIntent()
+
+    await observer.disableSystemProxyIntent()
+
+    XCTAssertEqual(proxy.clearCount, 1)
+    XCTAssertEqual(observer.systemProxyState, .idle)
+    XCTAssertEqual(observer.systemProxyObservationMode, .stopped)
+    XCTAssertEqual(monitor.stopCount, 1)
+    XCTAssertFalse(observer.systemProxyApprovalRequired)
+  }
+
+  func testAgentStopPresentationFollowsProxyIntent() async throws {
+    let proxy = ProxyRuntimeFixture.FakeSystemProxy()
+    let monitor = ProxyRuntimeFixture.FakeSystemProxyNetworkChangeMonitor()
+    let intent = IntentState(enabled: true)
+    let observer = makeObserver(
+      proxy: proxy, monitor: monitor, cleanupSettleNanoseconds: 1_000_000,
+      isIntentEnabled: { intent.enabled })
+
+    observer.agentDidStop()
+    XCTAssertEqual(observer.systemProxyState, .pending, "代理意图仍在开时，agent 停机保持待应用（issue #71）")
+    XCTAssertEqual(observer.systemProxyObservationMode, .stopped)
+    XCTAssertEqual(monitor.stopCount, 1)
+
+    intent.enabled = false
+    observer.agentDidStop()
+    XCTAssertEqual(observer.systemProxyState, .idle, "代理意图已关时，agent 停机呈现空闲")
+  }
+
+  func testModeTransitionAwaitingRuntimeStampsPendingOnlyUnderIntent() async throws {
+    let intent = IntentState(enabled: false)
+    let observer = makeObserver(
+      proxy: ProxyRuntimeFixture.FakeSystemProxy(), cleanupSettleNanoseconds: 1_000_000,
+      isIntentEnabled: { intent.enabled })
+
+    observer.modeTransitionAwaitingRuntime()
+    XCTAssertEqual(observer.systemProxyState, .idle, "代理意图关闭时不打待应用图章")
+
+    intent.enabled = true
+    observer.modeTransitionAwaitingRuntime()
+    XCTAssertEqual(observer.systemProxyState, .pending)
+  }
+
+  func testSettleLaunchAfterConvergedInspectsWithoutReapplying() async throws {
+    let proxy = ProxyRuntimeFixture.FakeSystemProxy()
+    let observer = makeObserver(proxy: proxy, cleanupSettleNanoseconds: 1_000_000)
+
+    await observer.settleLaunchAfterAgentConverged()
+
+    XCTAssertEqual(proxy.applied.count, 0, "健康的 GUI 启动只巡检，不强推应用")
+    XCTAssertGreaterThanOrEqual(proxy.readCount, 1)
+    XCTAssertEqual(observer.systemProxyObservationMode, .enabled)
+    XCTAssertFalse(observer.systemProxyStartupInProgress)
+    // 播种 lastDesired 后，后续收敛（如网络变化回调）不得因相等而重新应用。
+    await observer.convergeSystemProxy()
+    XCTAssertEqual(proxy.applied.count, 0, "播种 lastDesired 后收敛不得重新应用")
+  }
+
+  func testStartupSuppressionBlocksConvergeUntilSettled() async throws {
+    let proxy = ProxyRuntimeFixture.FakeSystemProxy()
+    let observer = makeObserver(proxy: proxy, cleanupSettleNanoseconds: 1_000_000)
+    observer.beginStartupResync()
+
+    await observer.convergeSystemProxy(forceApply: true)
+    XCTAssertEqual(proxy.applied.count, 0, "launch 重同步抑制期 converge 必须被拒绝")
+
+    await observer.settleLaunchWithAgentOff()
+    XCTAssertFalse(observer.systemProxyStartupInProgress)
+    XCTAssertEqual(observer.systemProxyState, .paused, "抑制解除后按意图挂起残留配置")
+    XCTAssertEqual(observer.systemProxyObservationMode, .enabled)
+  }
+
+  @MainActor
+  private final class IntentState {
+    var enabled: Bool
+
+    init(enabled: Bool) { self.enabled = enabled }
+  }
+
+  private func makeObserver(
+    proxy: ProxyRuntimeFixture.FakeSystemProxy,
+    monitor: SystemProxyNetworkChangeMonitoring =
+      ProxyRuntimeFixture.FakeSystemProxyNetworkChangeMonitor(),
+    cleanupSettleNanoseconds: UInt64,
+    isIntentEnabled: @escaping @MainActor () -> Bool = { true }
+  ) -> SystemProxyObserver {
+    SystemProxyObserver(
+      systemProxy: proxy,
+      systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService(),
+      systemProxyNetworkChangeMonitor: monitor,
+      appBundle: AppArtifact.bundle,
+      helperRefreshDelayNanoseconds: 1_000_000,
+      cleanupSettleNanoseconds: cleanupSettleNanoseconds,
+      isIntentEnabled: isIntentEnabled,
+      isExitAvailable: { true },
+      desiredConfiguration: {
+        ProxyMode.direct.systemProxyConfiguration(
+          for: SslocalRuntimeDocument(servers: [], listen: ProxyListeningConfiguration()),
+          exceptions: [])
+      },
+      systemProxyHealthObservationLoop: {})
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyTests.swift b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyTests.swift
new file mode 100644
index 000000000..925d96b6a
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/SystemProxy/SystemProxyTests.swift
@@ -0,0 +1,254 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// System proxy mode mapping and declarative planning are pure/testable seams;
+/// no test in this file writes the host's real SystemConfiguration state.
+/// Closed typed 配置覆盖 HTTPS/PAC/自动发现/简单主机名与例外列表，
+/// 无条件清理计划与 helper XPC 契约（含序列化 last-writer）都在此验证。
+final class SystemProxyTests: XCTestCase {
+  func testSupportedModesProjectTheSameLocalEndpoints() {
+    let document = ProxyRuntimeFixture.makeDocument(
+      listenerMode: .allIPv4Interfaces, localPort: 2086)
+
+    let expected = SystemProxyConfiguration(
+      socks: .init(host: "127.0.0.1", port: 2086),
+      http: .init(host: "127.0.0.1", port: ProxyListeningConfiguration.defaultHTTPPort),
+      https: .init(host: "127.0.0.1", port: ProxyListeningConfiguration.defaultHTTPPort),
+      exceptions: FixedLocalProxyRanges.systemProxyExceptions)
+    XCTAssertEqual(
+      ProxyMode.rule.systemProxyConfiguration(for: document),
+      expected)
+    XCTAssertEqual(
+      ProxyMode.global.systemProxyConfiguration(for: document),
+      expected,
+      "全局模式的系统例外使用固定本地范围，与 ACL 安全策略一致")
+  }
+
+  func testIPv6LANModeKeepsSystemProxyOnLocalIPv4Loopback() {
+    let document = SslocalRuntimeDocument(
+      servers: [], listen: ProxyListeningConfiguration(listenerMode: .allIPv6Interfaces))
+
+    let configuration = ProxyMode.rule.systemProxyConfiguration(for: document)
+
+    XCTAssertEqual(configuration.socks.host, "127.0.0.1")
+    XCTAssertEqual(configuration.http.host, "127.0.0.1")
+    XCTAssertEqual(configuration.https.host, "127.0.0.1", "HTTPS 显式赋值，与 HTTP 同端点")
+  }
+
+  func testMissingHTTPInboundIsRejectedInsteadOfPointingAtAWildcardPort() throws {
+    var document = SslocalRuntimeDocument(servers: [], listen: ProxyListeningConfiguration())
+    document.locals.removeAll { $0.inboundProtocol == "http" }
+    XCTAssertFalse(document.isWellFormed, "每组必须同时提供 SOCKS 与 HTTP")
+  }
+
+  func testModeProjectionCarriesClosedTypedPolicyDefaults() {
+    let document = ProxyRuntimeFixture.makeDocument(localPort: 2086)
+
+    let configuration = ProxyMode.rule.systemProxyConfiguration(
+      for: document, exceptions: ["example.com"])
+
+    XCTAssertTrue(configuration.pacEnabled == false, "PAC 显式关闭")
+    XCTAssertTrue(configuration.autoDiscoveryEnabled == false, "自动发现显式关闭")
+    XCTAssertTrue(configuration.excludeSimpleHostnames, "简单主机名排除由 GUI 拥有，默认开")
+    XCTAssertEqual(
+      configuration.exceptions,
+      FixedLocalProxyRanges.systemProxyExceptions(including: ["example.com"]),
+      "例外列表 = 固定本地范围 + 用户补充项，全量给出")
+  }
+
+  // MARK: - Property-list projection
+
+  private let configuration = SystemProxyConfiguration(
+    socks: .init(host: "127.0.0.1", port: 1086),
+    http: .init(host: "127.0.0.1", port: 1087),
+    https: .init(host: "127.0.0.1", port: 1087),
+    exceptions: ["localhost", "127.0.0.1"])
+
+  func testSystemConfigurationProjectionEnablesSOCKSHTTPAndHTTPS() {
+    let original: [String: Any] = [
+      SystemProxyPropertyList.httpEnabled: 1,
+      SystemProxyPropertyList.httpsEnabled: 1,
+      SystemProxyPropertyList.socksEnabled: 1,
+      SystemProxyPropertyList.pacEnabled: 1,
+      SystemProxyPropertyList.pacURL: "http://127.0.0.1:1089/v1/proxy.pac",
+      "ExceptionsList": ["stale.example"],
+    ]
+
+    let applied = SystemProxyPropertyList.applying(configuration, to: original)
+    XCTAssertEqual(applied[SystemProxyPropertyList.pacEnabled] as? Int, 0)
+    XCTAssertNil(applied[SystemProxyPropertyList.pacURL])
+    XCTAssertNil(applied[SystemProxyPropertyList.pacJavaScript])
+    XCTAssertEqual(applied[SystemProxyPropertyList.socksEnabled] as? Int, 1)
+    XCTAssertEqual(applied[SystemProxyPropertyList.socksProxy] as? String, "127.0.0.1")
+    XCTAssertEqual(applied[SystemProxyPropertyList.socksPort] as? Int, 1086)
+    XCTAssertEqual(applied[SystemProxyPropertyList.httpEnabled] as? Int, 1)
+    XCTAssertEqual(applied[SystemProxyPropertyList.httpProxy] as? String, "127.0.0.1")
+    XCTAssertEqual(applied[SystemProxyPropertyList.httpPort] as? Int, 1087)
+    XCTAssertEqual(applied[SystemProxyPropertyList.httpsEnabled] as? Int, 1)
+    XCTAssertEqual(applied[SystemProxyPropertyList.httpsProxy] as? String, "127.0.0.1")
+    XCTAssertEqual(applied[SystemProxyPropertyList.httpsPort] as? Int, 1087)
+    XCTAssertEqual(applied[SystemProxyPropertyList.excludeSimpleHostnames] as? Int, 1)
+    XCTAssertEqual(applied[SystemProxyPropertyList.autoDiscoveryEnabled] as? Int, 0)
+    XCTAssertEqual(
+      applied[SystemProxyPropertyList.exceptionsList] as? [String],
+      ["localhost", "127.0.0.1"],
+      "例外列表全量覆盖，不保留旧值")
+  }
+
+  /// 显式简单主机名排除值：GUI 拥有该策略（当前恒开），helper 只翻译。
+  func testSimpleHostnameExclusionFollowsExplicitFlag() {
+    let withFlagOn = SystemProxyPropertyList.applying(configuration, to: [:])
+    XCTAssertEqual(withFlagOn[SystemProxyPropertyList.excludeSimpleHostnames] as? Int, 1)
+
+    var flagOff = configuration
+    flagOff.excludeSimpleHostnames = false
+    let withFlagOff = SystemProxyPropertyList.applying(
+      flagOff, to: [SystemProxyPropertyList.excludeSimpleHostnames: 1])
+    XCTAssertEqual(withFlagOff[SystemProxyPropertyList.excludeSimpleHostnames] as? Int, 0)
+  }
+
+  /// 空例外列表也是显式值：写入空数组而非保留旧列表。
+  func testEmptyExceptionListIsWrittenExplicitly() {
+    var withoutExceptions = configuration
+    withoutExceptions.exceptions = []
+    let applied = SystemProxyPropertyList.applying(
+      withoutExceptions, to: ["ExceptionsList": ["stale.example"]])
+    XCTAssertEqual(applied[SystemProxyPropertyList.exceptionsList] as? [String], [])
+  }
+
+  /// 未建模键保留：typed 字段集之外的 Proxies 键不被擦除。
+  func testUnmodeledKeysArePreservedOnApply() {
+    let original: [String: Any] = [
+      "ThirdPartyKey": "third-party value",
+      SystemProxyPropertyList.socksEnabled: 0,
+    ]
+    let applied = SystemProxyPropertyList.applying(configuration, to: original)
+    XCTAssertEqual(applied["ThirdPartyKey"] as? String, "third-party value")
+  }
+
+  /// PAC 显式关闭时移除 URL 与 JavaScript 残值。
+  func testDisabledPACRemovesURLAndJavaScriptValues() {
+    let original: [String: Any] = [
+      SystemProxyPropertyList.pacEnabled: 1,
+      SystemProxyPropertyList.pacURL: "http://proxy.example/proxy.pac",
+      SystemProxyPropertyList.pacJavaScript: "function FindProxyForURL() {}",
+    ]
+    let applied = SystemProxyPropertyList.applying(configuration, to: original)
+    XCTAssertEqual(applied[SystemProxyPropertyList.pacEnabled] as? Int, 0)
+    XCTAssertNil(applied[SystemProxyPropertyList.pacURL])
+    XCTAssertNil(applied[SystemProxyPropertyList.pacJavaScript])
+  }
+
+  // MARK: - Declarative planner
+
+  private func serialized(_ dictionary: [String: Any]) throws -> Data {
+    try PropertyListSerialization.data(fromPropertyList: dictionary, format: .binary, options: 0)
+  }
+
+  /// 字典等价：断言「写出什么」，不与生产的语义归一（semanticallyNormalized）混用。
+  private func plistsEqual(_ lhs: Data?, _ rhs: Data?) -> Bool {
+    guard let lhs, let rhs else { return lhs == nil && rhs == nil }
+    guard
+      let left = try? PropertyListSerialization.propertyList(from: lhs, options: [], format: nil)
+        as? NSDictionary,
+      let right = try? PropertyListSerialization.propertyList(from: rhs, options: [], format: nil)
+        as? NSDictionary
+    else { return lhs == rhs }
+    return left.isEqual(right)
+  }
+
+  private func service(
+    _ id: String, location: String = "location-1", configuration data: Data?
+  ) -> SystemProxyServiceState {
+    SystemProxyServiceState(
+      identifier: SystemProxyServiceIdentifier(locationID: location, serviceID: id),
+      configuration: data)
+  }
+
+  func testApplyPlannerWritesEveryActiveServiceToDesiredValues() throws {
+    let applied = try serialized(SystemProxyPropertyList.applying(configuration, to: [:]))
+    let foreign = try serialized(["HTTPEnable": 1, "HTTPProxy": "proxy.example"])
+
+    let plan = try SystemProxyPlanner.makeApplyPlan(
+      services: [
+        service("service-1", configuration: applied),
+        service("service-2", configuration: foreign),
+      ], configuration: configuration)
+
+    XCTAssertEqual(plan.writes.map(\.identifier.serviceID), ["service-2"], "等值服务零写入")
+    XCTAssertEqual(plan.outcome, .written)
+    let projected = try XCTUnwrap(plan.writes.first?.configuration)
+    XCTAssertTrue(plistsEqual(projected, applied))
+  }
+
+  func testEquivalentDisabledFlagsAndExceptionOrderProduceNoDifference() throws {
+    var values = SystemProxyPropertyList.applying(configuration, to: ["Unmanaged": "keep"])
+    values.removeValue(forKey: "ProxyAutoConfigEnable")
+    values.removeValue(forKey: "ProxyAutoDiscoveryEnable")
+    values["ExceptionsList"] = ["127.0.0.1", "localhost", "localhost"]
+    let plan = try SystemProxyPlanner.makeApplyPlan(
+      services: [service("wifi", configuration: serialized(values))], configuration: configuration)
+    XCTAssertTrue(plan.writes.isEmpty, "系统语义等价，不报告差异也不写入")
+  }
+
+  func testApplyPlannerIsIdempotentWhenAllServicesMatch() throws {
+    let applied = try serialized(SystemProxyPropertyList.applying(configuration, to: [:]))
+
+    let plan = try SystemProxyPlanner.makeApplyPlan(
+      services: [service("service-1", configuration: applied)], configuration: configuration)
+
+    XCTAssertTrue(plan.writes.isEmpty)
+    XCTAssertEqual(plan.outcome, .unchanged, "重试不产生无谓的 SC 写入（issue #71 AC31）")
+  }
+
+  /// 清理计划无条件：凡持有 Proxies 实体的服务（跨位置、不校验端点或来源）
+  /// 都整字典移除。
+  func testCleanupPlannerClearsWholeDictionaryEverywhereUnconditionally() throws {
+    let ng2Values = try serialized(SystemProxyPropertyList.applying(configuration, to: [:]))
+    let foreignValues = try serialized([
+      "HTTPEnable": 1, "HTTPProxy": "proxy.example", "HTTPPort": 9090,
+    ])
+    let services = [
+      service("same-id", location: "location-a", configuration: ng2Values),
+      service("same-id", location: "location-b", configuration: foreignValues),
+      service("bare-service", location: "location-b", configuration: nil),
+    ]
+
+    let plan = SystemProxyPlanner.makeClearPlan(services: services)
+
+    XCTAssertEqual(
+      Set(plan.writes.map(\.identifier)),
+      [services[0].identifier, services[1].identifier],
+      "不校验来源：NG2 与其他应用写入的服务都被清空")
+    XCTAssertTrue(plan.writes.allSatisfy { $0.configuration == nil }, "清除完整 Proxies 字典")
+    XCTAssertFalse(
+      plan.writes.contains { $0.identifier == services[2].identifier },
+      "没有 Proxies 实体的服务无需写入")
+  }
+
+  // MARK: - 注册清单漂移指纹
+
+  /// launchd 沿用注册提交时的 job 定义快照，清单变更须注销重注才生效；
+  /// 指纹检测决定是否重注。
+  func testRegistrationStampDriftDetection() {
+    let data = Data("plist-content".utf8)
+    XCTAssertTrue(
+      SystemProxyHelperRegistrationStamp.drifted(plistData: data, storedStamp: nil),
+      "无指纹（首次带检测代码启动）视为漂移")
+    XCTAssertTrue(
+      SystemProxyHelperRegistrationStamp.drifted(plistData: data, storedStamp: "outdated"),
+      "清单内容变更视为漂移")
+    XCTAssertFalse(
+      SystemProxyHelperRegistrationStamp.drifted(
+        plistData: data, storedStamp: SystemProxyHelperRegistrationStamp.stamp(data)),
+      "指纹一致不漂移")
+    XCTAssertFalse(
+      SystemProxyHelperRegistrationStamp.drifted(plistData: nil, storedStamp: nil),
+      "清单不可读无基准，不判漂移")
+    XCTAssertNotEqual(
+      SystemProxyHelperRegistrationStamp.stamp(Data("a".utf8)),
+      SystemProxyHelperRegistrationStamp.stamp(Data("b".utf8)),
+      "不同清单内容指纹不同")
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/TestSupport/BoundedTestWaitTests.swift b/ShadowsocksX-NG2/Tests/TestSupport/BoundedTestWaitTests.swift
new file mode 100644
index 000000000..26a50eec4
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/TestSupport/BoundedTestWaitTests.swift
@@ -0,0 +1,70 @@
+import Testing
+import XCTest
+
+@MainActor
+struct BoundedTestWaitTests {
+  @Test func missingPhaseStopsTheBodyAndDrainsItsTask() async throws {
+    let entered = XCTestExpectation(description: "worker entered")
+    let gate = RuleRuntimeDelayGate(started: entered)
+    var exited = false
+    var continued = false
+    let task = Task {
+      try? await gate.wait()
+      exited = true
+    }
+    try await requireTestPhase([entered])
+    await #expect(throws: TestWaitError.self) {
+      try await withTestTask(
+        task, release: { gate.resume() },
+        body: {
+          try await requireTestPhase(
+            [XCTestExpectation(description: "phase never reached")], timeout: 0.02)
+          continued = true
+        })
+    }
+    #expect(!continued)
+    #expect(exited)
+  }
+
+  @Test func missingConditionHasADeadline() async {
+    await #expect(throws: TestWaitError.self) {
+      try await requireTestCondition("never true", timeout: .milliseconds(20)) { false }
+    }
+  }
+
+  @Test func cancelledConditionWaitStops() async {
+    let task = Task {
+      withUnsafeCurrentTask { $0?.cancel() }
+      try await requireTestCondition("never true") { false }
+    }
+    await #expect(throws: CancellationError.self) { try await task.value }
+  }
+
+  @Test func asyncGateTimesOutWithoutBlockingAWorker() async {
+    let gate = TestAsyncGate(onTimeout: {})
+    #expect(await gate.wait(timeout: .milliseconds(20)) == false)
+  }
+
+  @Test func asyncGateRemembersEarlyAndRepeatedRelease() async {
+    let gate = TestAsyncGate()
+    gate.release()
+    gate.release()
+    #expect(await gate.wait(timeout: .zero))
+  }
+
+  @Test func asyncGateReleasesEveryWorker() async throws {
+    let gate = TestAsyncGate()
+    let entered = XCTestExpectation(description: "workers entered")
+    entered.expectedFulfillmentCount = 4
+    let workers = (0..<4).map { _ in
+      Task.detached {
+        entered.fulfill()
+        return await gate.wait()
+      }
+    }
+    try await requireTestPhase([entered])
+    gate.release()
+    gate.release()
+    for worker in workers { #expect(await worker.value) }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Workspace/AppPresentationTests.swift b/ShadowsocksX-NG2/Tests/Workspace/AppPresentationTests.swift
new file mode 100644
index 000000000..121b95107
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Workspace/AppPresentationTests.swift
@@ -0,0 +1,107 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// Presentation edge coverage: typed facts are asserted independently from the
+/// wording owned by the App layer, and unknown descriptions never leak through.
+final class AppPresentationTests: XCTestCase {
+  func testSubscriptionFailureFactsAllHaveSafePresentation() {
+    let failures: [SubscriptionRefreshFailure] = [
+      .invalidURL,
+      .unsupportedScheme,
+      .insecureRedirect,
+      .transport(.timedOut),
+      .transport(.tls),
+      .transport(.connection),
+      .transport(.unknown),
+      .httpStatus(code: 503),
+      .contentType(.missing),
+      .contentType(.unsupported),
+      .decodingFailure,
+      .unsupportedSchemaVersion,
+      .missingServers,
+      .recordValidation(index: 2, field: .address),
+      .recordValidation(index: 2, field: .port),
+      .recordValidation(index: 2, field: .method),
+      .recordValidation(index: 2, field: .password),
+      .recordValidation(index: 2, field: .identity),
+      .duplicateIdentity,
+      .commit,
+      .unknown,
+    ]
+
+    for failure in failures {
+      let message = AppPresentation.message(for: failure)
+      XCTAssertFalse(message.isEmpty, "每个 durable failure fact 都应有呈现：\(failure)")
+      XCTAssertFalse(message.contains("https://"))
+      XCTAssertFalse(message.contains("credential"))
+      XCTAssertFalse(message.contains("reference"))
+    }
+
+  }
+
+  func testRuntimeAndSettingsFactsUseCentralPresentation() {
+    // 系统代理应用状态：独立状态面同样走中央呈现。
+    let systemProxyApplications: [SystemProxyApplicationFacts] = [
+      .idle,
+      .pending,
+      .applied,
+      .failed(.operation(.applyFailed)),
+      .failed(.operation(.helperUnavailable)),
+      .failed(.unknown),
+    ]
+    for application in systemProxyApplications {
+      let message = AppPresentation.message(for: application)
+      XCTAssertFalse(message.isEmpty, "每个系统代理应用态都应有呈现：\(application)")
+    }
+
+    let runtimeFailures: [RuntimeFailureFacts] = [
+      .firewallBlocked(FirewallBlockedFacts(executableName: "sslocal")),
+      .launch(
+        .localEndpoint(endpoint: "SOCKS", host: "127.0.0.1", port: 11086, cause: .refused)),
+      .launch(.missingRuntimeDocument),
+      .launch(.unreadableSettings),
+      .service(.runtimeFile),
+      .service(.agent),
+      .service(.missingDocument),
+      .service(.persistence),
+      .service(.unknown),
+      .requiresApproval,
+    ]
+    for failure in runtimeFailures {
+      XCTAssertFalse(
+        AppPresentation.message(for: failure).isEmpty,
+        "每个 typed runtime failure fact 都应有呈现：\(failure)")
+    }
+
+    let issues: [SettingsFieldIssue] = [
+      .port(.socks, error: .portOutOfRange(endpoint: .socks, port: 0))
+    ]
+    for issue in issues {
+      XCTAssertFalse(AppPresentation.message(for: issue).isEmpty)
+    }
+  }
+
+  func testUnknownErrorUsesFixedFallback() {
+    struct SecretError: Error, CustomStringConvertible {
+      var description: String { "secret-token https://provider.example/sub.json" }
+    }
+
+    XCTAssertEqual(AppPresentation.message(for: SecretError()), AppPresentation.unknownError)
+  }
+
+  func testPlatformEffectFailuresHaveStableSafePresentation() {
+    let failures: [Error] = [
+      TextClipboardFailure.writeFailed,
+      DiagnosticReportFailure.encodingFailed,
+      DiagnosticReportExportFailure.writeFailed,
+    ]
+
+    for failure in failures {
+      let message = AppPresentation.message(for: failure)
+      XCTAssertFalse(message.isEmpty, "平台 effect failure 必须有安全呈现：\(failure)")
+      XCTAssertFalse(message.contains("secret"))
+      XCTAssertFalse(message.contains("/Users/"))
+    }
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Workspace/HomeTargetBrowserTests.swift b/ShadowsocksX-NG2/Tests/Workspace/HomeTargetBrowserTests.swift
new file mode 100644
index 000000000..956fc1437
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Workspace/HomeTargetBrowserTests.swift
@@ -0,0 +1,107 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+@MainActor
+struct HomeTargetBrowserTests {
+  @Test
+  func firstEntryRevealsCurrentTargetOnlyOnceAndPersistsAncestors() throws {
+    let domain = UUID().uuidString
+    let defaults = UserDefaults(suiteName: domain)!
+    defer { defaults.removePersistentDomain(forName: domain) }
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    let tree = CatalogTreeSnapshot.build(
+      from: fixture.catalog, plugins: NoManagedPluginProvider())
+    let browser = HomeTargetBrowser(defaults: defaults)
+    #expect(browser.rows(in: tree, favorites: []).map(\.id) == [fixture.groupID])
+
+    #expect(
+      browser.enterHome(current: fixture.serverIDs[1], in: tree, favorites: [])
+        == fixture.serverIDs[1])
+    #expect(browser.selection == fixture.serverIDs[1])
+    #expect(
+      browser.rows(in: tree, favorites: []).map(\.id)
+        == [fixture.groupID, fixture.nestedGroupID, fixture.serverIDs[1], fixture.serverIDs[0]])
+    browser.select(fixture.groupID)
+    #expect(browser.enterHome(current: fixture.serverIDs[0], in: tree, favorites: []) == nil)
+    #expect(browser.selection == fixture.groupID)
+
+    let restored = HomeTargetBrowser(defaults: defaults)
+    #expect(restored.selection == nil)
+    #expect(restored.rows(in: tree, favorites: []).count == 4)
+  }
+
+  @Test
+  func collapsingAncestorSelectsGroupWithoutChangingOtherGroups() throws {
+    let domain = UUID().uuidString
+    let defaults = UserDefaults(suiteName: domain)!
+    defer { defaults.removePersistentDomain(forName: domain) }
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    let tree = CatalogTreeSnapshot.build(
+      from: fixture.catalog, plugins: NoManagedPluginProvider())
+    let browser = HomeTargetBrowser(defaults: defaults)
+    browser.enterHome(current: fixture.serverIDs[1], in: tree, favorites: [])
+
+    browser.toggleGroup(fixture.groupID, in: tree)
+
+    #expect(browser.selection == fixture.groupID)
+    #expect(browser.rows(in: tree, favorites: []).map(\.id) == [fixture.groupID])
+    #expect(browser.expandedGroupIDs == [fixture.nestedGroupID])
+    browser.toggleGroup(fixture.groupID, in: tree)
+    #expect(browser.selection == fixture.groupID)
+    #expect(browser.rows(in: tree, favorites: []).count == 4)
+  }
+
+  @Test
+  func favoritesAreFlatAndSwitchingClearsHiddenSelectionWhileLocateRestoresAll() throws {
+    let domain = UUID().uuidString
+    let defaults = UserDefaults(suiteName: domain)!
+    defer { defaults.removePersistentDomain(forName: domain) }
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    let tree = CatalogTreeSnapshot.build(
+      from: fixture.catalog, plugins: NoManagedPluginProvider())
+    let favorites = [fixture.groupID, fixture.serverIDs[0]].compactMap { tree.node(withID: $0) }
+    let browser = HomeTargetBrowser(defaults: defaults)
+    browser.enterHome(current: fixture.serverIDs[1], in: tree, favorites: favorites)
+    browser.setMode(.favorites, in: tree, favorites: favorites)
+    #expect(browser.selection == nil)
+    #expect(
+      browser.rows(in: tree, favorites: favorites).map(\.id)
+        == [fixture.groupID, fixture.serverIDs[0]])
+    #expect(browser.rows(in: tree, favorites: favorites).allSatisfy { $0.depth == 0 })
+    #expect(HomeTargetBrowser(defaults: defaults).mode == .favorites)
+
+    browser.locate(fixture.serverIDs[1], in: tree, favorites: favorites)
+    #expect(browser.mode == .all)
+    #expect(browser.selection == fixture.serverIDs[1])
+    #expect(HomeTargetBrowser(defaults: defaults).mode == .all)
+    browser.setMode(.favorites, in: tree, favorites: favorites)
+    browser.locate(fixture.groupID, in: tree, favorites: favorites)
+    #expect(browser.mode == .favorites)
+    #expect(browser.selection == fixture.groupID)
+  }
+
+  @Test
+  func catalogChangesPruneRemovedExpansionAndHiddenSelection() throws {
+    let domain = UUID().uuidString
+    let defaults = UserDefaults(suiteName: domain)!
+    defer { defaults.removePersistentDomain(forName: domain) }
+    let fixture = try CatalogFixtures.makeSubscriptionFixture()
+    let tree = CatalogTreeSnapshot.build(
+      from: fixture.catalog, plugins: NoManagedPluginProvider())
+    let browser = HomeTargetBrowser(defaults: defaults)
+    browser.enterHome(current: fixture.serverIDs[1], in: tree, favorites: [])
+    let reduced = CatalogTreeSnapshot(roots: [])
+
+    browser.reconcile(in: reduced, favorites: [])
+
+    #expect(browser.selection == nil)
+    #expect(browser.expandedGroupIDs.isEmpty)
+    #expect(HomeTargetBrowser(defaults: defaults).expandedGroupIDs.isEmpty)
+    browser.select(fixture.groupID)
+    browser.setMode(.favorites, in: tree, favorites: [tree.roots[0]])
+    browser.reconcile(in: tree, favorites: [])
+    #expect(browser.selection == nil)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Workspace/StatusCardModelTests.swift b/ShadowsocksX-NG2/Tests/Workspace/StatusCardModelTests.swift
new file mode 100644
index 000000000..19ea01e0e
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Workspace/StatusCardModelTests.swift
@@ -0,0 +1,183 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 侧栏底部状态卡的呈现政策：行结构、语义色调
+/// 与活动目标回退文案从代理控制工作流的整体 snapshot 派生；文本与状态菜单
+/// 共用 StatusMenuModel 的同一映射。
+final class StatusCardModelTests: XCTestCase {
+  private struct RuntimeToneCase {
+    let facts: ProxyRuntimeFacts
+    let expectedTone: StatusCardModel.Tone
+  }
+
+  private static let runtimeToneCases: [RuntimeToneCase] = [
+    RuntimeToneCase(
+      facts: ProxyRuntimeFacts(status: .starting, isOn: true),
+      expectedTone: .neutral),
+    RuntimeToneCase(
+      facts: ProxyRuntimeFacts(status: .running, isOn: true),
+      expectedTone: .positive),
+    RuntimeToneCase(
+      facts: ProxyRuntimeFacts(status: .off, isOn: false),
+      expectedTone: .neutral),
+    RuntimeToneCase(
+      facts: ProxyRuntimeFacts(status: .firewallBlocked, isOn: true),
+      expectedTone: .attention),
+    RuntimeToneCase(
+      facts: ProxyRuntimeFacts(status: .requiresApproval, isOn: true),
+      expectedTone: .attention),
+    RuntimeToneCase(
+      facts: ProxyRuntimeFacts(status: .launchFailed, isOn: false),
+      expectedTone: .failure),
+    RuntimeToneCase(
+      facts: ProxyRuntimeFacts(status: .serviceFailed, isOn: false),
+      expectedTone: .failure),
+  ]
+
+  /// 从运行时事实构造最小 snapshot（其余字段与本组用例无关；与
+  /// StatusMenuModelTests 的夹具同形状）。
+  private func makeSnapshot(
+    facts: ProxyRuntimeFacts,
+    activationFailure: ActivationFailure? = nil,
+    systemProxyApplication: SystemProxyApplicationFacts = .idle,
+    mode: ProxyMode = .rule,
+    activeTarget: ProxyActiveTargetFacts? = nil
+  ) -> ProxyControlSnapshot {
+    ProxyControlSnapshot(
+      runtime: facts,
+      agentIntentEnabled: true,
+      activationFailure: activationFailure,
+      systemProxyIntentEnabled: false,
+      systemProxyApplication: systemProxyApplication,
+      systemProxyApprovalRequired: false,
+      proxyMode: mode,
+      rulePreset: .chinaDirect,
+      availableModes: ProxyMode.availableModes,
+      activeTarget: activeTarget,
+      skippedInvalidServerCount: 0,
+      httpExport: HTTPExportCapability(
+        copyableLine:
+          "export http_proxy=http://127.0.0.1:11087;export https_proxy=http://127.0.0.1:11087;"),
+      commandAddressPicker: TerminalCommandAddressPicker(
+        isVisible: false,
+        candidates: [
+          TerminalCommandAddress(bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")
+        ],
+        selected: TerminalCommandAddress(bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")),
+      terminalProxyEnvironmentCommands: TerminalProxyEnvironmentCommands(
+        listen: RuntimeListenFacts(listen: ProxyListeningConfiguration()),
+        commandAddress: TerminalCommandAddress(
+          bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")))
+  }
+
+  // MARK: - agent 运行状态行
+
+  func testRuntimeRowUsesSemanticTone() {
+    for testCase in Self.runtimeToneCases {
+      let card = StatusCardModel.card(from: makeSnapshot(facts: testCase.facts))
+      XCTAssertEqual(card.runtimeRow.tone, testCase.expectedTone)
+    }
+  }
+
+  /// agent 点名原因色调：运行失败跟随运行状态色调（受阻=警示红系跟随橙），
+  /// 激活点名失败独立显红，无失败无 detail。
+  func testRuntimeDetailToneFollowsRuntimeFailureThenActivationFailure() {
+    let firewallBlocked = StatusCardModel.card(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(
+          status: .firewallBlocked,
+          isOn: true,
+          failure: .firewallBlocked(FirewallBlockedFacts(executableName: "sslocal")))))
+    XCTAssertEqual(firewallBlocked.runtimeDetail?.tone, .attention, "运行失败跟随运行状态色调")
+
+    let activationRejected = StatusCardModel.card(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .running, isOn: true),
+        activationFailure: .targetNotFound(NodeID(rawValue: "manual:gone"))))
+    XCTAssertEqual(activationRejected.runtimeDetail?.tone, .failure, "激活点名失败独立显红")
+    XCTAssertEqual(
+      activationRejected.runtimeDetail?.text,
+      AppPresentation.message(
+        for: ActivationFailure.targetNotFound(NodeID(rawValue: "manual:gone"))))
+
+    let healthy = StatusCardModel.card(
+      from: makeSnapshot(facts: ProxyRuntimeFacts(status: .running, isOn: true)))
+    XCTAssertNil(healthy.runtimeDetail)
+  }
+
+  // MARK: - 系统代理行
+
+  func testSystemProxyRowUsesSemanticToneAndFailureDetail() {
+    let idle = StatusCardModel.card(
+      from: makeSnapshot(facts: ProxyRuntimeFacts(status: .off, isOn: false)))
+    XCTAssertEqual(idle.systemProxyRow.tone, .neutral)
+    XCTAssertNil(idle.systemProxyDetail)
+
+    let pending = StatusCardModel.card(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .running, isOn: true),
+        systemProxyApplication: .pending))
+    XCTAssertEqual(pending.systemProxyRow.tone, .attention)
+
+    let applied = StatusCardModel.card(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .running, isOn: true),
+        systemProxyApplication: .applied))
+    XCTAssertEqual(applied.systemProxyRow.tone, .positive)
+
+    let failed = StatusCardModel.card(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .running, isOn: true),
+        systemProxyApplication: .failed(.operation(.applyFailed))))
+    XCTAssertEqual(failed.systemProxyRow.tone, .failure)
+    XCTAssertEqual(failed.systemProxyDetail?.tone, .failure)
+    XCTAssertEqual(
+      failed.systemProxyDetail?.text,
+      AppPresentation.message(
+        for: RuntimeFailureFacts.systemProxy(.operation(.applyFailed))))
+  }
+
+  // MARK: - 活动目标与模式行
+
+  func testTargetPresentationUsesPathThenFallsBackByMode() {
+    let targetPath = "订阅分组 / 嵌套分组 / 日本 02"
+    let withTarget = StatusCardModel.card(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .running, isOn: true),
+        activeTarget: ProxyActiveTargetFacts(
+          id: NodeID(rawValue: "manual:server"), pathSummary: targetPath)))
+    XCTAssertEqual(withTarget.target.text, targetPath)
+    XCTAssertFalse(withTarget.target.help.isEmpty)
+
+    let direct = StatusCardModel.card(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .off, isOn: false),
+        mode: .direct))
+    XCTAssertFalse(direct.target.text.isEmpty)
+    XCTAssertFalse(direct.target.help.isEmpty)
+
+    let inactive = StatusCardModel.card(
+      from: makeSnapshot(facts: ProxyRuntimeFacts(status: .off, isOn: false)))
+    XCTAssertFalse(inactive.target.text.isEmpty)
+    XCTAssertFalse(inactive.target.help.isEmpty)
+  }
+
+  /// 模式行与状态菜单同一份 modeLabel（规则模式带子选项），视图不再自行重组。
+  func testModeTextMatchesMenuModeLabel() {
+    let rule = StatusCardModel.card(
+      from: makeSnapshot(facts: ProxyRuntimeFacts(status: .running, isOn: true)))
+    XCTAssertEqual(
+      rule.modeText,
+      StatusMenuModel.summary(
+        from: makeSnapshot(
+          facts: ProxyRuntimeFacts(status: .running, isOn: true))
+      ).modeLabel)
+
+    let global = StatusCardModel.card(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .running, isOn: true),
+        mode: .global))
+    XCTAssertFalse(global.modeText.isEmpty)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Workspace/StatusDisplayModelTests.swift b/ShadowsocksX-NG2/Tests/Workspace/StatusDisplayModelTests.swift
new file mode 100644
index 000000000..565a33372
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Workspace/StatusDisplayModelTests.swift
@@ -0,0 +1,158 @@
+import Combine
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 状态显示 debounce 呈现模型：代理服务与系统代理两个意图的呈现 payload
+/// 从整体 snapshot 派生后经瞬态门控发布。断言用语义色调与结构（detail 空
+/// 非空、hint 变化），不断言具体本地化文案。
+@MainActor
+struct StatusDisplayModelTests {
+  private let runningFacts = ProxyRuntimeFacts(status: .running, isOn: true)
+
+  /// 快速模式切换：applying 短命即回 applied，「应用中」整段不得上屏。
+  @Test func fastModeSwitchNeverShowsTransientSystemProxyState() async {
+    let snapshots = CurrentValueSubject<ProxyControlSnapshot, Never>(
+      makeSnapshot(systemProxyApplication: .applied))
+    let clock = SleepGateRecorder()
+    let now: TimeInterval = 0
+    let model = StatusDisplayModel(
+      snapshots: snapshots, interval: 0.4, now: { now },
+      sleep: { delay in await clock.sleep(delay) })
+    #expect(model.systemProxy.row.tone == .positive)
+    let armed = clock.armNextCall()
+    snapshots.send(makeSnapshot(systemProxyApplication: .applying))
+    let transientTask = model.scheduledSystemProxyDisplayTask
+    #expect(model.systemProxy.row.tone == .positive, "瞬态「应用中」不得立即上屏")
+    snapshots.send(makeSnapshot(systemProxyApplication: .applied))
+    #expect(model.systemProxy.row.tone == .positive, "快路径完成后瞬态从未上屏")
+    armed.release.release()
+    await transientTask?.value
+    #expect(clock.delays == [0.4])
+  }
+
+  /// applying 持续存在时（真正慢的写入）延迟后要上屏，不能永远藏住。
+  @Test func persistentSystemProxyTransientDisplaysAfterDelay() async {
+    let snapshots = CurrentValueSubject<ProxyControlSnapshot, Never>(
+      makeSnapshot(systemProxyApplication: .applied))
+    let clock = SleepGateRecorder()
+    var now: TimeInterval = 0
+    let model = StatusDisplayModel(
+      snapshots: snapshots, interval: 0.4, now: { now },
+      sleep: { delay in await clock.sleep(delay) })
+    let armed = clock.armNextCall()
+    snapshots.send(makeSnapshot(systemProxyApplication: .applying))
+    let task = model.scheduledSystemProxyDisplayTask
+    await armed.entered.wait()
+    #expect(model.systemProxy.row.tone == .positive)
+    now = 0.4
+    armed.release.release()
+    await task?.value
+    #expect(model.systemProxy.row.tone == .attention)
+  }
+
+  /// pending（待应用/待批准）是 resting 态：立即可见，不经门控。
+  @Test func pendingApplicationStateIsNotGated() async {
+    let snapshots = CurrentValueSubject<ProxyControlSnapshot, Never>(
+      makeSnapshot(systemProxyApplication: .applied))
+    let clock = SleepGateRecorder()
+    let model = StatusDisplayModel(
+      snapshots: snapshots, interval: 0.4, now: { 0 },
+      sleep: { delay in await clock.sleep(delay) })
+    let pending = makeSnapshot(systemProxyApplication: .pending)
+    snapshots.send(pending)
+    #expect(
+      StatusDisplayModel.systemProxyStatus(from: pending).row.tone == .attention,
+      "派生口径：待应用 = attention")
+    #expect(model.systemProxy.row.tone == .attention)
+    #expect(clock.delays.isEmpty)
+    #expect(model.scheduledSystemProxyDisplayTask == nil)
+  }
+
+  /// 代理服务侧瞬态 = 启动中：同样延迟上屏。
+  @Test func agentStartingStateIsGated() async {
+    let snapshots = CurrentValueSubject<ProxyControlSnapshot, Never>(
+      makeSnapshot(systemProxyApplication: .idle))
+    let clock = SleepGateRecorder()
+    var now: TimeInterval = 0
+    let model = StatusDisplayModel(
+      snapshots: snapshots, interval: 0.4, now: { now },
+      sleep: { delay in await clock.sleep(delay) })
+    let armed = clock.armNextCall()
+    snapshots.send(
+      makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .starting, isOn: true),
+        systemProxyApplication: .idle))
+    let task = model.scheduledAgentDisplayTask
+    #expect(model.agent.row.tone == .positive, "运行中保持可见")
+    await armed.entered.wait()
+    now = 0.4
+    armed.release.release()
+    await task?.value
+    #expect(model.agent.row.tone == .neutral, "启动中延迟后上屏")
+  }
+
+  /// 点名原因不随 payload 抑制：无法检查（面板与首页都渲染）与已暂停
+  /// （payload 携带暂停事实，首页据此抑制、面板渲染作暂停说明）并存。
+  @Test func pausedStateCarriesDetailAndPauseFlag() async {
+    let snapshots = CurrentValueSubject<ProxyControlSnapshot, Never>(
+      makeSnapshot(systemProxyApplication: .applied))
+    let model = StatusDisplayModel(
+      snapshots: snapshots, interval: 0.4, now: { 0 }, sleep: { _ in })
+    snapshots.send(makeSnapshot(systemProxyApplication: .unreadable(.unknown)))
+    #expect(model.systemProxy.detail != nil, "无法检查的点名原因立即可见")
+    #expect(model.systemProxy.row.tone == .failure)
+    #expect(!model.systemProxy.isPaused)
+    snapshots.send(makeSnapshot(systemProxyApplication: .paused))
+    #expect(model.systemProxy.detail != nil, "暂停说明保留在 detail（面板渲染）")
+    #expect(model.systemProxy.isPaused, "首页据此抑制 detail（hint 已是暂停说明）")
+    #expect(model.systemProxy.row.tone == .attention)
+  }
+
+  /// hint 文案随系统代理流派生：批准阻塞提示立即生效（稳定态）。
+  @Test func approvalRequirementChangesHintImmediately() async {
+    let snapshots = CurrentValueSubject<ProxyControlSnapshot, Never>(
+      makeSnapshot(systemProxyApplication: .idle))
+    let model = StatusDisplayModel(
+      snapshots: snapshots, interval: 0.4, now: { 0 }, sleep: { _ in })
+    let idleHint = model.systemProxy.hint
+    snapshots.send(makeSnapshot(systemProxyApplication: .idle, approvalRequired: true))
+    #expect(model.systemProxy.hint != idleHint)
+    #expect(model.systemProxy.row.tone == .neutral)
+  }
+
+  /// 从运行时事实构造最小 snapshot（其余字段与本组用例无关；与
+  /// StatusCardModelTests 的夹具同形状）。
+  private func makeSnapshot(
+    facts: ProxyRuntimeFacts = ProxyRuntimeFacts(status: .running, isOn: true),
+    systemProxyApplication: SystemProxyApplicationFacts,
+    approvalRequired: Bool = false
+  ) -> ProxyControlSnapshot {
+    ProxyControlSnapshot(
+      runtime: facts,
+      agentIntentEnabled: true,
+      activationFailure: nil,
+      systemProxyIntentEnabled: false,
+      systemProxyApplication: systemProxyApplication,
+      systemProxyApprovalRequired: approvalRequired,
+      proxyMode: .rule,
+      rulePreset: .chinaDirect,
+      availableModes: ProxyMode.availableModes,
+      activeTarget: nil,
+      skippedInvalidServerCount: 0,
+      httpExport: HTTPExportCapability(
+        copyableLine:
+          "export http_proxy=http://127.0.0.1:11087;export https_proxy=http://127.0.0.1:11087;"),
+      commandAddressPicker: TerminalCommandAddressPicker(
+        isVisible: false,
+        candidates: [
+          TerminalCommandAddress(bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")
+        ],
+        selected: TerminalCommandAddress(bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")),
+      terminalProxyEnvironmentCommands: TerminalProxyEnvironmentCommands(
+        listen: RuntimeListenFacts(listen: ProxyListeningConfiguration()),
+        commandAddress: TerminalCommandAddress(
+          bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")))
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Workspace/StatusMenuModelTests.swift b/ShadowsocksX-NG2/Tests/Workspace/StatusMenuModelTests.swift
new file mode 100644
index 000000000..edee717d3
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Workspace/StatusMenuModelTests.swift
@@ -0,0 +1,159 @@
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// 状态菜单呈现逻辑：头部状态摘要从代理
+/// 控制工作流的整体 snapshot 派生，agent 与系统代理两个状态面分开呈现。不
+/// 持有 AppKit 类型；HTTP 导出行与目标路径摘要分别在代理控制与目录 module
+/// 测试覆盖。
+final class StatusMenuModelTests: XCTestCase {
+  private struct RuntimeSummaryCase {
+    let facts: ProxyRuntimeFacts
+    let expectedIsOn: Bool
+  }
+
+  private static let runtimeSummaryCases: [RuntimeSummaryCase] = [
+    RuntimeSummaryCase(
+      facts: ProxyRuntimeFacts(status: .starting, isOn: true),
+      expectedIsOn: true),
+    RuntimeSummaryCase(
+      facts: ProxyRuntimeFacts(status: .running, isOn: true),
+      expectedIsOn: true),
+    RuntimeSummaryCase(
+      facts: ProxyRuntimeFacts(
+        status: .firewallBlocked,
+        isOn: true,
+        failure: .firewallBlocked(FirewallBlockedFacts(executableName: "sslocal"))),
+      expectedIsOn: true),
+    RuntimeSummaryCase(
+      facts: ProxyRuntimeFacts(
+        status: .launchFailed,
+        isOn: false,
+        failure: .launch(
+          .localEndpoint(
+            endpoint: "http", host: "127.0.0.1", port: 11087, cause: .refused))),
+      expectedIsOn: false),
+    RuntimeSummaryCase(
+      facts: ProxyRuntimeFacts(
+        status: .requiresApproval, isOn: true, failure: .requiresApproval),
+      expectedIsOn: true),
+    RuntimeSummaryCase(
+      facts: ProxyRuntimeFacts(
+        status: .serviceFailed,
+        isOn: false,
+        failure: .service(.persistence)),
+      expectedIsOn: false),
+  ]
+
+  /// 从运行时事实构造最小 snapshot（其余字段与本组用例无关）。
+  private func makeSnapshot(
+    facts: ProxyRuntimeFacts,
+    agentIntent: Bool = true,
+    activationFailure: ActivationFailure? = nil,
+    systemProxyIntent: Bool = false,
+    systemProxyApplication: SystemProxyApplicationFacts = .idle,
+    systemProxyApprovalRequired: Bool = false,
+    mode: ProxyMode = .rule,
+    activeTarget: ProxyActiveTargetFacts? = nil
+  ) -> ProxyControlSnapshot {
+    ProxyControlSnapshot(
+      runtime: facts,
+      agentIntentEnabled: agentIntent,
+      activationFailure: activationFailure,
+      systemProxyIntentEnabled: systemProxyIntent,
+      systemProxyApplication: systemProxyApplication,
+      systemProxyApprovalRequired: systemProxyApprovalRequired,
+      proxyMode: mode,
+      rulePreset: .chinaDirect,
+      availableModes: ProxyMode.availableModes,
+      activeTarget: activeTarget,
+      skippedInvalidServerCount: 0,
+      httpExport: HTTPExportCapability(
+        copyableLine:
+          "export http_proxy=http://127.0.0.1:11087;export https_proxy=http://127.0.0.1:11087;"),
+      commandAddressPicker: TerminalCommandAddressPicker(
+        isVisible: false,
+        candidates: [
+          TerminalCommandAddress(bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")
+        ],
+        selected: TerminalCommandAddress(bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")),
+      terminalProxyEnvironmentCommands: TerminalProxyEnvironmentCommands(
+        listen: RuntimeListenFacts(listen: ProxyListeningConfiguration()),
+        commandAddress: TerminalCommandAddress(
+          bsdName: "lo0", address: "127.0.0.1", displayName: "lo0")))
+  }
+
+  // MARK: - 头部状态摘要
+
+  func testSummaryRunningStateIsOnWithNoDetail() {
+    let summary = StatusMenuModel.summary(
+      from: makeSnapshot(facts: ProxyRuntimeFacts(status: .running, isOn: true)))
+    XCTAssertTrue(summary.agentIntentEnabled)
+    XCTAssertTrue(summary.isOn)
+    XCTAssertNil(summary.detail)
+  }
+
+  func testSummaryOffStateIsOff() {
+    let summary = StatusMenuModel.summary(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .off, isOn: false),
+        agentIntent: false,
+        mode: .global))
+    XCTAssertFalse(summary.agentIntentEnabled, "开关意图独立于运行状态")
+    XCTAssertFalse(summary.isOn)
+    XCTAssertNil(summary.detail)
+  }
+
+  func testSummaryProjectsEveryStableRuntimeState() {
+    for testCase in Self.runtimeSummaryCases {
+      let summary = StatusMenuModel.summary(from: makeSnapshot(facts: testCase.facts))
+      XCTAssertEqual(summary.isOn, testCase.expectedIsOn)
+      XCTAssertEqual(
+        summary.detail,
+        testCase.facts.failure.map { AppPresentation.message(for: $0) })
+    }
+  }
+
+  /// 激活拒绝/目标清除的点名原因独立于运行状态呈现：agent 仍
+  /// 在监听时也必须可读。
+  func testSummaryCarriesActivationFailureAlongsideRunningState() {
+    let summary = StatusMenuModel.summary(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .running, isOn: true),
+        activationFailure: .targetNotFound(NodeID(rawValue: "manual:gone"))))
+    XCTAssertEqual(
+      summary.detail,
+      AppPresentation.message(
+        for: ActivationFailure.targetNotFound(
+          NodeID(rawValue: "manual:gone"))))
+  }
+
+  /// 系统代理状态面：意图与实际应用分开，失败携带点名原因。
+  func testSummaryProjectsSystemProxyIntentAndFailureDetail() {
+    let failed = StatusMenuModel.summary(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .running, isOn: true),
+        systemProxyIntent: true,
+        systemProxyApplication: .failed(.operation(.applyFailed))))
+    XCTAssertTrue(failed.systemProxyIntentEnabled)
+    XCTAssertEqual(
+      failed.systemProxyDetail,
+      AppPresentation.message(
+        for: RuntimeFailureFacts.systemProxy(.operation(.applyFailed))))
+  }
+
+  func testSummaryCarriesTargetPathFromSnapshot() {
+    let summary = StatusMenuModel.summary(
+      from: makeSnapshot(
+        facts: ProxyRuntimeFacts(status: .running, isOn: true),
+        activeTarget: ProxyActiveTargetFacts(
+          id: NodeID(rawValue: "manual:server"), pathSummary: "订阅分组 / 嵌套分组 / 日本 02")))
+    XCTAssertEqual(summary.targetPath, "订阅分组 / 嵌套分组 / 日本 02")
+  }
+
+  func testSummaryTargetPathIsNilWithoutActiveTarget() {
+    let summary = StatusMenuModel.summary(
+      from: makeSnapshot(facts: ProxyRuntimeFacts(status: .off, isOn: false)))
+    XCTAssertNil(summary.targetPath)
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Workspace/TransientDelayGateTests.swift b/ShadowsocksX-NG2/Tests/Workspace/TransientDelayGateTests.swift
new file mode 100644
index 000000000..76ca285cf
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Workspace/TransientDelayGateTests.swift
@@ -0,0 +1,175 @@
+import Foundation
+import Testing
+
+@testable import ShadowsocksX_NG2
+
+/// 瞬态门控裁决表：稳定值立即可见、瞬态值延迟上屏、短命瞬态被吞、
+/// 已上屏瞬态保持最短时长。时间经注入的 now/sleep 虚拟化，不真实等待。
+@MainActor
+struct TransientDelayGateTests {
+  @Test func firstValueDisplaysImmediatelyWithoutDelay() {
+    var displayed: [String] = []
+    let gate = TransientDelayGate<String>(
+      interval: 0.4,
+      now: { 0 },
+      sleep: { _ in })
+    gate.display = { displayed.append($0) }
+    gate.update("applied", isTransient: false)
+    #expect(displayed == ["applied"])
+  }
+
+  @Test func transientValueDisplaysOnlyAfterDelayInterval() async {
+    var now: TimeInterval = 0
+    var displayed: [String] = []
+    var delays: [TimeInterval] = []
+    let sleepEntered = AsyncGate()
+    let sleepRelease = AsyncGate()
+    let gate = TransientDelayGate<String>(
+      interval: 0.4,
+      now: { now },
+      sleep: { delay in
+        delays.append(delay)
+        sleepEntered.release()
+        await sleepRelease.wait()
+      })
+    gate.display = { displayed.append($0) }
+    gate.update("applied", isTransient: false)
+    gate.update("applying", isTransient: true)
+    let task = gate.scheduledDisplayTask
+    await sleepEntered.wait()
+    #expect(delays == [0.4])
+    #expect(displayed == ["applied"])
+    now = 0.4
+    sleepRelease.release()
+    await task?.value
+    #expect(displayed == ["applied", "applying"])
+  }
+
+  @Test func shortLivedTransientIsSupersededAndNeverDisplayed() async {
+    let clock = SleepGateRecorder()
+    var now: TimeInterval = 0
+    var displayed: [String] = []
+    let gate = TransientDelayGate<String>(
+      interval: 0.4,
+      now: { now },
+      sleep: { delay in await clock.sleep(delay) })
+    gate.display = { displayed.append($0) }
+    gate.update("applied", isTransient: false)
+    let transientSleep = clock.armNextCall()
+    gate.update("applying", isTransient: true)
+    let transientTask = gate.scheduledDisplayTask
+    await transientSleep.entered.wait()
+    now = 0.2
+    gate.update("failed", isTransient: false)
+    #expect(displayed == ["applied", "failed"])
+    transientSleep.release.release()
+    await transientTask?.value
+    #expect(displayed == ["applied", "failed"])
+  }
+
+  @Test func displayedTransientHoldsForMinimumInterval() async {
+    let clock = SleepGateRecorder()
+    var now: TimeInterval = 0
+    var displayed: [String] = []
+    let gate = TransientDelayGate<String>(
+      interval: 0.4,
+      now: { now },
+      sleep: { delay in await clock.sleep(delay) })
+    gate.display = { displayed.append($0) }
+    gate.update("applied", isTransient: false)
+    let transientSleep = clock.armNextCall()
+    gate.update("applying", isTransient: true)
+    let transientTask = gate.scheduledDisplayTask
+    await transientSleep.entered.wait()
+    now = 0.4
+    transientSleep.release.release()
+    await transientTask?.value
+    #expect(displayed == ["applied", "applying"])
+    let heldSleep = clock.armNextCall()
+    gate.update("failed", isTransient: false)
+    let heldTask = gate.scheduledDisplayTask
+    #expect(displayed == ["applied", "applying"])
+    await heldSleep.entered.wait()
+    #expect(clock.delays == [0.4, 0.4])
+    now = 0.8
+    heldSleep.release.release()
+    await heldTask?.value
+    #expect(displayed == ["applied", "applying", "failed"])
+  }
+
+  @Test func transientAfterDisplayedTransientWaitsForDelayAndHold() async {
+    let clock = SleepGateRecorder()
+    var now: TimeInterval = 0
+    var displayed: [String] = []
+    let gate = TransientDelayGate<String>(
+      interval: 0.4,
+      now: { now },
+      sleep: { delay in await clock.sleep(delay) })
+    gate.display = { displayed.append($0) }
+    gate.update("applied", isTransient: false)
+    let applyingSleep = clock.armNextCall()
+    gate.update("applying", isTransient: true)
+    let applyingTask = gate.scheduledDisplayTask
+    await applyingSleep.entered.wait()
+    now = 0.4
+    applyingSleep.release.release()
+    await applyingTask?.value
+    #expect(displayed == ["applied", "applying"])
+    let repairingSleep = clock.armNextCall()
+    now = 0.5
+    gate.update("repairing", isTransient: true)
+    let repairingTask = gate.scheduledDisplayTask
+    #expect(displayed == ["applied", "applying"])
+    await repairingSleep.entered.wait()
+    #expect(clock.delays == [0.4, 0.4])
+    now = 0.9
+    repairingSleep.release.release()
+    await repairingTask?.value
+    #expect(displayed == ["applied", "applying", "repairing"])
+  }
+
+  @Test func duplicatePendingPayloadKeepsOriginalSchedule() async {
+    let clock = SleepGateRecorder()
+    var now: TimeInterval = 0
+    var displayed: [String] = []
+    let gate = TransientDelayGate<String>(
+      interval: 0.4,
+      now: { now },
+      sleep: { delay in await clock.sleep(delay) })
+    gate.display = { displayed.append($0) }
+    gate.update("applied", isTransient: false)
+    let applyingSleep = clock.armNextCall()
+    gate.update("applying", isTransient: true)
+    let applyingTask = gate.scheduledDisplayTask
+    await applyingSleep.entered.wait()
+    now = 0.1
+    gate.update("applying", isTransient: true)
+    now = 0.4
+    applyingSleep.release.release()
+    await applyingTask?.value
+    #expect(displayed == ["applied", "applying"])
+    #expect(clock.delays == [0.4])
+  }
+
+  @Test func valueEqualToDisplayedCancelsPendingDisplay() async {
+    let clock = SleepGateRecorder()
+    let now: TimeInterval = 0
+    var displayed: [String] = []
+    let gate = TransientDelayGate<String>(
+      interval: 0.4,
+      now: { now },
+      sleep: { delay in await clock.sleep(delay) })
+    gate.display = { displayed.append($0) }
+    gate.update("applied", isTransient: false)
+    let applyingSleep = clock.armNextCall()
+    gate.update("applying", isTransient: true)
+    let applyingTask = gate.scheduledDisplayTask
+    await applyingSleep.entered.wait()
+    gate.update("applied", isTransient: false)
+    #expect(displayed == ["applied"])
+    applyingSleep.release.release()
+    await applyingTask?.value
+    #expect(displayed == ["applied"])
+    #expect(clock.delays == [0.4])
+  }
+}
diff --git a/ShadowsocksX-NG2/Tests/Workspace/WindowActivationPolicyTests.swift b/ShadowsocksX-NG2/Tests/Workspace/WindowActivationPolicyTests.swift
new file mode 100644
index 000000000..186718623
--- /dev/null
+++ b/ShadowsocksX-NG2/Tests/Workspace/WindowActivationPolicyTests.swift
@@ -0,0 +1,399 @@
+import AppKit
+import XCTest
+
+@testable import ShadowsocksX_NG2
+
+/// Anchored app windows share activation policy; foreign windows are ignored.
+/// Notifications, an injected spy, and a manually driven tick queue keep these
+/// tests independent of presentation and wall-clock timing.
+@MainActor
+final class WindowActivationPolicyTests: XCTestCase {
+  private var spy: SpyApplier!
+  private var tickScheduler: SpyTickScheduler!
+  private var coordinator: WindowActivationPolicyCoordinator!
+  private var window: NSWindow!
+  private var foreignWindow: NSWindow!
+
+  override func setUp() async throws {
+    try await super.setUp()
+    spy = SpyApplier()
+    tickScheduler = SpyTickScheduler()
+    coordinator = WindowActivationPolicyCoordinator(
+      applying: spy,
+      tickScheduler: tickScheduler)
+    // 离屏裸窗口仅作通知对象身份：不呈现、不抢 key，创建本身不触碰
+    // WindowServer 的窗口呈现。
+    window = Self.makeOffscreenWindow()
+    foreignWindow = Self.makeOffscreenWindow()
+    coordinator.anchorDidAttach(to: window)
+    // 消化首个不可见锚点安排的兜底重扫（此时无可见窗口，必然空转），
+    // 后续用例的 pending 队列保持确定。
+    tickScheduler.drainOne()
+  }
+
+  override func tearDown() async throws {
+    window = nil
+    foreignWindow = nil
+    try await super.tearDown()
+  }
+
+  /// 策略与激活落点 spy（ADR 0017）：只记录调用，不触碰真实 NSApp。
+  /// `isActive`/`ownsMenuBar` 默认为真：启动激活重试首拍即短路，既有用例
+  /// 不受异步影响。
+  @MainActor
+  private final class SpyApplier: WindowActivationPolicyApplying {
+    var applied: [NSApplication.ActivationPolicy] = []
+    var isActive = true
+    var ownsMenuBar = true
+    var isPolicyRegular = true
+    var activationCalls = 0
+    /// 第 N 次 activate 后视为激活成功（模拟稍后才成功）。
+    var becomesActiveAfterCalls: Int?
+
+    func apply(_ policy: NSApplication.ActivationPolicy) {
+      applied.append(policy)
+    }
+
+    var isAppActive: Bool { isActive }
+
+    func activateApp() {
+      activationCalls += 1
+      if let becomesActiveAfterCalls, activationCalls >= becomesActiveAfterCalls {
+        isActive = true
+      }
+    }
+  }
+
+  /// 收集重试节拍的手动调度 spy：按需逐拍驱动，不依赖墙钟。
+  @MainActor
+  private final class SpyTickScheduler: ActivationTickScheduling {
+    var pending: [@MainActor @Sendable () -> Void] = []
+
+    func scheduleTick(
+      after interval: TimeInterval, _ tick: @escaping @MainActor @Sendable () -> Void
+    ) {
+      pending.append(tick)
+    }
+
+    /// 手动驱动一拍已排定的重试；无待执行拍时返回 false。执行该拍可能
+    /// 在队尾续排下一拍。
+    @discardableResult
+    func drainOne() -> Bool {
+      guard !pending.isEmpty else { return false }
+      pending.removeFirst()()
+      return true
+    }
+  }
+
+  private static func makeOffscreenWindow() -> NSWindow {
+    NSWindow(
+      contentRect: NSRect(x: 0, y: 0, width: 10, height: 10),
+      styleMask: [.titled],
+      backing: .buffered,
+      defer: false)
+  }
+
+  private func post(_ name: Notification.Name, on target: NSWindow) {
+    NotificationCenter.default.post(name: name, object: target)
+  }
+
+  // MARK: 随窗收敛
+
+  func testAttachToNotYetVisibleWindowAppliesNothing() {
+    XCTAssertTrue(
+      spy.applied.isEmpty,
+      "静默启动预建未呈现的窗口不得触发 regular：启动应停留在 accessory")
+  }
+
+  func testDidBecomeKeyAppliesRegular() {
+    post(NSWindow.didBecomeKeyNotification, on: window)
+
+    XCTAssertEqual(spy.applied, [.regular])
+  }
+
+  func testWillCloseAppliesAccessory() {
+    post(NSWindow.willCloseNotification, on: window)
+
+    XCTAssertEqual(spy.applied, [.accessory])
+  }
+
+  // MARK: 身份过滤
+
+  func testForeignWindowNotificationsAreIgnored() {
+    post(NSWindow.didBecomeKeyNotification, on: foreignWindow)
+    post(NSWindow.willCloseNotification, on: foreignWindow)
+
+    XCTAssertTrue(spy.applied.isEmpty, "非锚定窗口（sheet/辅助窗口）不得驱动策略")
+  }
+
+  func testClosingOneOfTwoWindowsKeepsRegularUntilLastCloses() {
+    coordinator.anchorDidAttach(to: foreignWindow)
+    post(NSWindow.didBecomeKeyNotification, on: window)
+    post(NSWindow.didBecomeKeyNotification, on: foreignWindow)
+    spy.applied.removeAll()
+    post(NSWindow.willCloseNotification, on: window)
+    XCTAssertFalse(spy.applied.contains(.accessory))
+    post(NSWindow.willCloseNotification, on: foreignWindow)
+    XCTAssertEqual(spy.applied.last, .accessory)
+  }
+
+  func testClosedWindowCanReopenWhileOtherWindowRemainsTracked() {
+    coordinator.anchorDidAttach(to: foreignWindow)
+    post(NSWindow.didBecomeKeyNotification, on: window)
+    post(NSWindow.willCloseNotification, on: window)
+    post(NSWindow.didBecomeKeyNotification, on: window)
+    post(NSWindow.didBecomeKeyNotification, on: foreignWindow)
+    spy.applied.removeAll()
+    post(NSWindow.willCloseNotification, on: foreignWindow)
+    XCTAssertFalse(spy.applied.contains(.accessory))
+    post(NSWindow.willCloseNotification, on: window)
+    XCTAssertEqual(spy.applied.last, .accessory)
+  }
+
+  func testWindowShownWithoutBecomingKeyParticipatesInLastClosePolicy() {
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    coordinator.anchorDidAttach(to: visible)
+    visible.pretendVisible = true
+    post(NSWindow.didChangeOcclusionStateNotification, on: visible)
+    XCTAssertEqual(spy.applied.last, .regular)
+    XCTAssertEqual(visible.orderFrontCalls, 1, "首次可见化必须置前成 key")
+    post(NSWindow.didBecomeKeyNotification, on: window)
+    spy.applied.removeAll()
+    post(NSWindow.willCloseNotification, on: window)
+    XCTAssertFalse(spy.applied.contains(.accessory))
+    post(NSWindow.willCloseNotification, on: visible)
+    XCTAssertEqual(spy.applied.last, .accessory)
+  }
+
+  func testCloseIncludesVisibleSiblingWhenPresentationNotificationWasMissed() {
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    coordinator.anchorDidAttach(to: visible)
+    visible.pretendVisible = true
+    post(NSWindow.didBecomeKeyNotification, on: window)
+    spy.applied.removeAll()
+    post(NSWindow.willCloseNotification, on: window)
+    XCTAssertFalse(spy.applied.contains(.accessory))
+    visible.pretendVisible = false
+    post(NSWindow.willCloseNotification, on: visible)
+    XCTAssertEqual(spy.applied.last, .accessory)
+  }
+
+  // MARK: 首次参与收敛置前
+
+  func testVisibleAttachAppliesRegularAndOrdersFront() {
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    visible.pretendVisible = true
+
+    coordinator.anchorDidAttach(to: visible)
+
+    XCTAssertEqual(spy.applied, [.regular])
+    XCTAssertEqual(visible.orderFrontCalls, 1)
+  }
+
+  func testOcclusionInsertionOrdersFrontOnce() {
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    coordinator.anchorDidAttach(to: visible)
+    visible.pretendVisible = true
+    post(NSWindow.didChangeOcclusionStateNotification, on: visible)
+    post(NSWindow.didChangeOcclusionStateNotification, on: visible)
+
+    XCTAssertEqual(visible.orderFrontCalls, 1, "重复可见化不得反复置前")
+  }
+
+  // MARK: 启动激活重试
+
+  func testLaunchRetryRunsOncePerProcess() {
+    spy.isActive = false
+    let first = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    first.pretendVisible = true
+    let second = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    second.pretendVisible = true
+    coordinator.anchorDidAttach(to: first)
+    coordinator.anchorDidAttach(to: second)
+
+    XCTAssertEqual(tickScheduler.pending.count, 1, "后续窗口参与不得再启动一轮重试")
+  }
+
+  /// 激活假象（实测失败场景）：isActive 与 frontmost 均指向本应用、重试即停，
+  /// 但菜单栏仍归此前台应用——双信号不齐必须继续行动。
+  func testActivationIllusionKeepsRetryingUntilMenuBarReturns() {
+    spy.isActive = true
+    spy.ownsMenuBar = false
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    visible.pretendVisible = true
+    coordinator.anchorDidAttach(to: visible)
+
+    tickScheduler.drainOne()
+    XCTAssertEqual(visible.orderRegardlessCalls, 1, "active=true 但菜单栏未归位也要抬窗")
+    spy.ownsMenuBar = true
+    while tickScheduler.drainOne() {}
+
+    XCTAssertEqual(visible.orderRegardlessCalls, 1, "菜单栏归位后不得再行动")
+    XCTAssertTrue(tickScheduler.pending.isEmpty)
+  }
+
+  // MARK: 启动期次序兜底
+
+  /// 锚点附着时窗口尚未可见、其可见化通知又早于附着被错过：延迟重扫补上
+  /// 参与与激活重试（实测失败场景启动期无任何事件即此序）。
+  func testDeferredRescanRecoversWindowVisibleAfterAttach() {
+    spy.isActive = false
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    coordinator.anchorDidAttach(to: visible)
+    visible.pretendVisible = true
+
+    tickScheduler.drainOne()
+    XCTAssertEqual(spy.applied, [.regular], "重扫对已可见窗口补上参与并拉起重试")
+    XCTAssertEqual(visible.orderFrontCalls, 1)
+    while tickScheduler.drainOne() {}
+  }
+
+  func testDeferredRescanSkipsStillInvisibleWindow() {
+    let silent = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    coordinator.anchorDidAttach(to: silent)
+
+    while tickScheduler.drainOne() {}
+
+    XCTAssertTrue(spy.applied.isEmpty, "静默启动的不可见窗口不得由重扫触发参与")
+  }
+
+  /// 链在窗口呈现完成前启动、首拍因不可见静默终结后，可见化事件必须能
+  /// 重新拉起（re-arm），直到真正收敛。
+  func testVisibilityEventRearmsChainEndedBeforeWindowVisible() {
+    spy.isActive = false
+    spy.becomesActiveAfterCalls = 1
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    visible.pretendVisible = true
+    coordinator.anchorDidAttach(to: visible)
+    visible.pretendVisible = false
+
+    while tickScheduler.drainOne() {}
+    XCTAssertEqual(spy.activationCalls, 0, "首拍窗口不可见时链静默终结")
+
+    visible.pretendVisible = true
+    post(NSWindow.didChangeOcclusionStateNotification, on: visible)
+    tickScheduler.drainOne()
+    XCTAssertEqual(spy.activationCalls, 1, "可见化事件必须能重启已终结的链")
+    while tickScheduler.drainOne() {}
+    XCTAssertTrue(tickScheduler.pending.isEmpty)
+  }
+}
+
+private final class VisibilityWindow: NSWindow {
+  var pretendVisible = false
+  override var isVisible: Bool { pretendVisible }
+
+  /// 离屏拦截：真实置前会在测试宿主呈现窗口，只记录调用。
+  var orderFrontCalls = 0
+  override func makeKeyAndOrderFront(_ sender: Any?) {
+    orderFrontCalls += 1
+  }
+
+  var orderRegardlessCalls = 0
+  override func orderFrontRegardless() {
+    orderRegardlessCalls += 1
+  }
+}
+
+extension WindowActivationPolicyTests {
+  func testMenuBarMismatchNeverBouncesPolicyOrRestartsExhaustedRetries() {
+    spy.isActive = true
+    spy.ownsMenuBar = false
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    visible.pretendVisible = true
+    coordinator.anchorDidAttach(to: visible)
+
+    while tickScheduler.drainOne() {}
+
+    XCTAssertFalse(spy.applied.contains(.accessory), "窗口仍打开时不得通过策略弹跳反复注册 Dock 图标")
+    let activationCalls = spy.activationCalls
+    for _ in 0..<3 {
+      post(NSWindow.didBecomeKeyNotification, on: visible)
+      post(NSWindow.didChangeOcclusionStateNotification, on: visible)
+      while tickScheduler.drainOne() {}
+    }
+    XCTAssertEqual(spy.activationCalls, activationCalls, "重试用尽后窗口事件不得重置预算并抢焦点")
+  }
+
+  func testLaunchRetryReactivatesWhileInactiveAndStopsAtLimit() {
+    spy.isActive = false
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    visible.pretendVisible = true
+    coordinator.anchorDidAttach(to: visible)
+
+    XCTAssertEqual(tickScheduler.pending.count, 1)
+    tickScheduler.drainOne()
+    XCTAssertEqual(spy.activationCalls, 1)
+    while tickScheduler.drainOne() {}
+    XCTAssertEqual(spy.activationCalls, 5, "默认上限 5 次激活")
+    XCTAssertEqual(spy.applied, [.regular], "重试只激活，不改变随窗策略")
+    XCTAssertEqual(visible.orderFrontCalls, 6, "attach 置前一次，每次激活后再置前")
+    XCTAssertEqual(visible.orderRegardlessCalls, 5)
+    XCTAssertTrue(tickScheduler.pending.isEmpty, "终态检查拍后不得再排")
+  }
+
+  func testLaunchRetryStopsOnceAppActive() {
+    spy.isActive = false
+    spy.becomesActiveAfterCalls = 2
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    visible.pretendVisible = true
+    coordinator.anchorDidAttach(to: visible)
+
+    while tickScheduler.drainOne() {}
+
+    XCTAssertEqual(spy.activationCalls, 2, "已激活后的检查不得再激活")
+    XCTAssertEqual(spy.applied, [.regular], "激活重试不得弹跳策略")
+    XCTAssertTrue(tickScheduler.pending.isEmpty, "已激活后不得再排下一拍")
+  }
+
+  func testLaunchRetryStopsWhenWindowCloses() {
+    spy.isActive = false
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    visible.pretendVisible = true
+    coordinator.anchorDidAttach(to: visible)
+    visible.pretendVisible = false
+
+    tickScheduler.drainOne()
+
+    XCTAssertEqual(spy.activationCalls, 0, "窗口已不可见不得再激活")
+    XCTAssertTrue(tickScheduler.pending.isEmpty)
+  }
+
+  func testLaunchRetryPreservesBudgetAcrossVisibilityChanges() {
+    spy.isActive = false
+    let visible = VisibilityWindow(
+      contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+    visible.pretendVisible = true
+    coordinator.anchorDidAttach(to: visible)
+    tickScheduler.drainOne()
+    tickScheduler.drainOne()
+    XCTAssertEqual(spy.activationCalls, 2)
+    visible.pretendVisible = false
+
+    while tickScheduler.drainOne() {}
+
+    XCTAssertEqual(spy.activationCalls, 2, "窗口不可见时不得再激活")
+    XCTAssertEqual(spy.applied, [.regular])
+
+    visible.pretendVisible = true
+    post(NSWindow.didChangeOcclusionStateNotification, on: visible)
+    while tickScheduler.drainOne() {}
+
+    XCTAssertEqual(spy.activationCalls, 5, "恢复可见后仅消耗剩余 3 次预算")
+    XCTAssertEqual(spy.applied, [.regular])
+  }
+}
diff --git a/ShadowsocksX-NG2/Vendor/AgeSwift/LICENSE-APACHE b/ShadowsocksX-NG2/Vendor/AgeSwift/LICENSE-APACHE
new file mode 100644
index 000000000..d64569567
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/AgeSwift/LICENSE-APACHE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/ShadowsocksX-NG2/Vendor/AgeSwift/LICENSE-MIT b/ShadowsocksX-NG2/Vendor/AgeSwift/LICENSE-MIT
new file mode 100644
index 000000000..d9c92de7a
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/AgeSwift/LICENSE-MIT
@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 Qiu Yuzhou
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/AgeSwift/THIRD-PARTY-NOTICES b/ShadowsocksX-NG2/Vendor/AgeSwift/THIRD-PARTY-NOTICES
new file mode 100644
index 000000000..de85b9bc6
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/AgeSwift/THIRD-PARTY-NOTICES
@@ -0,0 +1,71 @@
+Third-party notices for AgeSwift.
+
+AgeSwift (pin in `../../ShadowsocksX-NG2.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved`: `0.1.0`, revision [`f29b609d5a20acabbb009c2884e9580fe960db96`](https://github.com/qiuyuzhou/AgeSwift/commit/f29b609d5a20acabbb009c2884e9580fe960db96); source `Rust/age-swift-ffi/Cargo.toml`; both `aarch64-apple-darwin` and `x86_64-apple-darwin`).
+The direct AgeSwift package and FFI crate are handled separately. This file covers external Rust crates from the pinned FFI package graph.
+Complete license terms are stored once per SPDX identifier in `../third-party-licenses/`; entries below group components and retain their copyright/attribution notices without repeating license bodies.
+
+## Apache-2.0
+
+License text: `../third-party-licenses/Apache-2.0.txt`
+
+Components: aead, aes, aes-gcm, age, age-core, arc-swap, base16ct, base64, block-buffer,
+  cfg-if, chacha20, chacha20poly1305, cipher, const-oid, cpufeatures, crypto-bigint,
+  crypto-common, ctr, der, digest, elliptic-curve, ff, fluent, fluent-bundle, fluent-langneg,
+  fluent-syntax, futures, futures-channel, futures-core, futures-executor, futures-io,
+  futures-sink, futures-task, futures-util, getrandom, ghash, group, hkdf, hmac, hpke,
+  hybrid-array, inout, intl-memoizer, intl_pluralrules, io_tee, keccak, kem, lazy_static,
+  libc, lock_api, log, ml-kem, opaque-debug, p256, parking_lot, parking_lot_core, pbkdf2,
+  pin-project, pin-project-lite, poly1305, polyval, ppv-lite86, primeorder, rand, rand_chacha,
+  rand_core, rustc-hash, salsa20, scopeguard, scrypt, sec1, secrecy, self_cell, sha2, sha3,
+  smallvec, thiserror, type-map, typenum, unic-langid, unic-langid-impl, universal-hash,
+  zerocopy, zeroize.
+
+- Copyright (c) 2019-2026 The RustCrypto Project Developers (aead).
+- Copyright (c) 2019 MobileCoin, LLC (aead).
+
+## BSD-3-Clause
+
+License text: `../third-party-licenses/BSD-3-Clause.txt`
+
+Components: curve25519-dalek, subtle, x25519-dalek.
+
+- Copyright (c) 2016-2017 Isis Agora Lovecruft, Henry de Valence. All rights reserved.
+- Copyright (c) 2016-2024 Isis Agora Lovecruft. All rights reserved.
+- Copyright (c) 2017-2021 isis agora lovecruft. All rights reserved.
+- Copyright (c) 2019-2021 DebugSteven. All rights reserved.
+
+## MIT
+
+License text: `../third-party-licenses/MIT.txt`
+
+Components: bech32, cookie-factory, generic-array, i18n-embed, memchr, nom, rust-embed,
+  rust-embed-utils, same-file, slab, walkdir.
+
+- Copyright (c) 2014-2019 Geoffroy Couprie
+- Copyright (c) 2015 Andrew Gallant
+- Copyright (c) 2015 Austin Bonander
+- Copyright (c) 2015 Bartłomiej Kamiński
+- Copyright (c) 2015 Danny Guo
+- Copyright (c) 2016 Titus Wormer <tituswormer@gmail.com>
+- Copyright (c) 2017 Andrew Gallant
+- Copyright (c) 2017 Clark Moody
+- Copyright (c) 2018 Akash Kurdekar
+- Copyright (c) 2018 pyros2097
+- Copyright (c) 2019 Carl Lerche
+- Copyright 2020 Luke Frisken
+
+## Unicode-3.0
+
+License text: `../third-party-licenses/Unicode-3.0.txt`
+
+Components: tinystr.
+
+- Copyright © 1991-2023 Unicode, Inc.
+- Copyright © 2020-2024 Unicode, Inc.
+- ICU 1.8.1 to ICU 57.1 © 1995-2016 International Business Machines Corporation and others.
+
+## Additional upstream notices
+
+- `tinystr` carries the ICU4X adaptation notice `../third-party-licenses/additional-notices/AgeSwift-ICU4X-attribution.txt`.
+- `group` retains contributor copyright and its Apache-2.0-or-MIT choice; see `../third-party-licenses/additional-notices/AgeSwift-group-COPYRIGHT.txt`. The shared Rand copyright statement is at `../third-party-licenses/additional-notices/rust-rand-COPYRIGHT.txt`.
+- `memchr`, `same-file`, and `walkdir` also offer Unlicense as an alternative to MIT; the report selected their MIT branch.
diff --git a/ShadowsocksX-NG2/Vendor/DEPENDENCY-METADATA.md b/ShadowsocksX-NG2/Vendor/DEPENDENCY-METADATA.md
new file mode 100644
index 000000000..cdbd1defd
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/DEPENDENCY-METADATA.md
@@ -0,0 +1,17 @@
+# Offline dependency metadata
+
+`dependency-metadata.json` adds display names, project/source URLs and local text references to existing authoritative pins. It contains no version table. Binary versions and distribution URLs come from `*/manifest.json`; rule pins come from `rules/*/manifest.json`; AgeSwift's URL and exact version come from `project.yml`, which XcodeGen uses for SwiftPM resolution. Plugin aliases and default arguments live in their binary manifests. Rule update scripts also read their manifests rather than maintaining separate pins.
+
+`xcodegen generate` (including `task gen:prj`) runs `Scripts/dependency-metadata.py` before collecting resources. It generates `.build/dependency-metadata/ThirdParty/` and `Domain/Plugin/ManagedPluginDefinitions.generated.swift`. Do not edit these outputs. The generated Swift contains only executable contracts, not display facts. Build phases reject stale outputs and verify the actual app's catalog and every referenced text before signing. Normal generation and checks use only local files.
+
+`BundledDependencyCatalog` enumerates direct dependencies and reads their associated texts. Inject an app bundle URL in hostless tests. Relative references from aggregate notices to shared license texts retain the Vendor directory layout. Plugin display metadata can fail independently of executable lookup.
+
+## Updating dependencies
+
+1. Update the authoritative pin and fetch/resolve the selected artifact. For rule snapshots, edit the manifest's `upstreamVersion`, `upstreamURL` and `upstreamArchiveSHA256`, then run its update script to regenerate the snapshot and integrity hash.
+2. Review the actual artifact and matching source graph; refresh direct licenses and aggregate notices using the process in `THIRD-PARTY-NOTICES.md`. Keep original copyright lines and additional notices. Full texts are pinned locally, not fetched by the build. Update supplemental project facts only when they change.
+3. Run `task gen:prj`, `task test:metadata`, and the applicable validation gates. A future viewer can reuse the catalog and text reader; this change adds no About viewer.
+
+The direct license files were collected from the selected manifest release/commit (`LICENSE`, or GFWList's `COPYING.txt`). AgeSwift's MIT and Apache texts come from its resolved package checkout. The `domain-list-custom` data license includes its own MIT text and the inherited v2fly/domain-list-community MIT text at the matching `20260925234224` release tag; the selected build workflow consumes that community data. The existing rule NOTICE files retain conversion attribution. The sslocal record distinguishes the original Shadowsocks project from the actual qiuyuzhou fork source and release asset.
+
+Existence and consistency validation is not a legal compliance audit. Aggregate notice coverage still requires artifact/source review when a dependency changes; the catalog does not fulfill other distribution duties such as corresponding-source delivery.
diff --git a/ShadowsocksX-NG2/Vendor/THIRD-PARTY-NOTICES.md b/ShadowsocksX-NG2/Vendor/THIRD-PARTY-NOTICES.md
new file mode 100644
index 000000000..77495464c
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/THIRD-PARTY-NOTICES.md
@@ -0,0 +1,63 @@
+# 已分发组件的传递依赖许可材料
+
+`sslocal/THIRD-PARTY-NOTICES`、`v2ray-plugin/THIRD-PARTY-NOTICES`、`ck-client/THIRD-PARTY-NOTICES` 和 `AgeSwift/THIRD-PARTY-NOTICES` 按实际分发组件列出传递依赖。完整许可文本按 SPDX 标识集中保存在 `third-party-licenses/<SPDX-ID>.txt`；各组件声明只保留依赖分组、版权/归属信息和必须单独保留的 NOTICE 或例外条款。因此，同一种许可文本只维护一份，不按 crate/module 重复复制。
+
+## 覆盖基线
+
+- 组件版本的唯一依据是同目录的 `manifest.json`，或 Xcode 工程共享的 SwiftPM `Package.resolved`。每份组件声明同时记录对应上游源码修订；不要在此目录另建传递依赖版本表。
+- `sslocal` 按其发布工作流的 `full` 特性和已分发的 `aarch64-apple-darwin` 目标检查。Cargo build/dev-only 和仅用于生成代码的 proc-macro 依赖不计入。
+- AgeSwift 按锁定的 `Rust/age-swift-ffi` 依赖图和 XCFramework 的 arm64、x86_64 macOS 目标检查；AgeSwift 本身及其 FFI crate 是直接组件，不列入传递依赖组。
+- Go 组件按实际二进制入口运行 `go-licenses`，并用 `go version -m` 核对二进制记录的 Go 版本、目标、模块图和源码修订。Go 标准库许可不由 `go-licenses` 输出，所以另按二进制所用的 Go 版本加入共享 BSD-3-Clause 文本及 Go Authors 归属。
+- Go YAML 的独立 NOTICE、Go 标准库和其他同 SPDX 标识但措辞不同的条件、Cloak `juju/ratelimit` 的 LGPL-3.0 链接例外、Rust/AWS-LC 组件的额外 NOTICE/COPYRIGHT，以及 Cloak 内嵌 ecdh 归属均单独保留；不能用共享 SPDX 文本替代这些材料。
+- 系统框架/系统库、开发与测试工具、用户自行安装的插件，以及没有随应用分发的规则数据不在此传递代码依赖清单内。规则数据的直接声明仍由其自身 NOTICE 管理。
+
+以上是基于当前二进制和锁定源码图的覆盖说明，不构成完整法律审计，也不能证明没有遗漏。`go-licenses` 对非 Go 文件及无法解析的来源 URL 会发出警告；更新时须检查相应源码目录及 LICENSE/NOTICE 文件，不能把工具输出视为完整性证明。
+
+## 更新流程
+
+更新只在维护者工作站执行；正常应用构建不得联网下载许可材料。
+
+1. 从已有 manifest 或 `Package.resolved` 解析已分发组件的版本和来源。取对应标签/修订的源码，并用 `go version -m`、发布工作流及构建目标确认源码图和二进制一致。
+2. 使用固定版本的 `cargo-about`（0.9.2）和本目录的 `cargo-about.toml` 生成 Rust 原始报告。示例：
+
+   ```sh
+   cargo about generate --format json --config ShadowsocksX-NG2/Vendor/cargo-about.toml \
+     --manifest-path /path/to/shadowsocks-rust/Cargo.toml \
+     --target aarch64-apple-darwin --features full --locked --fail \
+     > /tmp/sslocal-about.json
+
+   cargo about generate --format json --config ShadowsocksX-NG2/Vendor/cargo-about.toml \
+     --manifest-path /path/to/AgeSwift/Rust/age-swift-ffi/Cargo.toml \
+     --target aarch64-apple-darwin x86_64-apple-darwin --locked --fail \
+     > /tmp/ageswift-about.json
+   ```
+
+   Cargo-about 用于生成许可候选报告；组件范围以对应 Cargo 目标图为准。再用 `cargo tree --edges normal,no-proc-macro` 排除 build/dev-only 和仅由 proc-macro 使用的包，并从候选报告排除直接组件、workspace crate 和不在该图中的 crate。示例：
+
+   ```sh
+   cargo tree --manifest-path /path/to/shadowsocks-rust/Cargo.toml \
+     --features full --target aarch64-apple-darwin --edges normal,no-proc-macro
+   cargo tree --manifest-path /path/to/AgeSwift/Rust/age-swift-ffi/Cargo.toml \
+     --target aarch64-apple-darwin --edges normal,no-proc-macro
+   cargo tree --manifest-path /path/to/AgeSwift/Rust/age-swift-ffi/Cargo.toml \
+     --target x86_64-apple-darwin --edges normal,no-proc-macro
+   ```
+
+   对每个 SPDX 标识复用一份完整文本；保留每个已纳入组件的版权行和额外 NOTICE/COPYRIGHT。
+3. 使用固定版本的 `go-licenses`（`github.com/google/go-licenses/v2@v2.0.1`），分别从 v2ray-plugin 根包及 Cloak `./cmd/ck-client` 生成 `report` 和 `save` 输出。例：
+
+   ```sh
+   cd /path/to/v2ray-plugin
+   GOPROXY=off go-licenses report . > /tmp/v2ray-plugin.csv
+   GOPROXY=off go-licenses save . --save_path /tmp/v2ray-plugin-notices
+
+   cd /path/to/Cloak
+   GOPROXY=off go-licenses report ./cmd/ck-client > /tmp/ck-client.csv
+   GOPROXY=off go-licenses save ./cmd/ck-client --save_path /tmp/ck-client-notices
+   ```
+
+   按 `report` 中的 SPDX 类型归组；从实际二进制 Go 版本对应的 Go 源码 `LICENSE` 核对 Go 标准库文本和归属。不要把直接产品本身的许可混进传递依赖组。
+4. 比较报告中的许可类型及组件名与现有分组。只有在类型尚未出现时才新增共享文本；相同 SPDX 标识不得复制完整正文。检查所有额外 NOTICE、COPYRIGHT、许可选择分支、自定义例外（包括同 SPDX 标识下不同的条件/免责声明措辞）和非 Go 源码；把新增材料放入 `third-party-licenses/additional-notices/` 并在对应组件声明中引用。
+5. 更新之后核对组件 pin、源码 revision、目标/feature、二进制构建信息及系统依赖边界；检查每个相对链接均指向离线存在的文件，再运行 `git diff --check`。只更新审阅后的本地静态材料，不能把扫描工具或网络下载加入正常构建步骤。上层 bundle 资源配置须同时复制这些声明和其引用的共享文本，并保留相对目录关系。生成与打包流程见 `DEPENDENCY-METADATA.md`。
+
+工具文档：[`cargo-about`](https://github.com/EmbarkStudios/cargo-about)、[`go-licenses`](https://github.com/google/go-licenses)。二进制所用 Go 工具链的源许可可从对应 Go 标签的 [`LICENSE`](https://go.googlesource.com/go/+/refs/tags/go1.27.3/LICENSE) 核对；Cloak 当前二进制对应的 [Go 1.24.5 LICENSE](https://go.googlesource.com/go/+/refs/tags/go1.24.5/LICENSE) 也按同一方式核对。
diff --git a/ShadowsocksX-NG2/Vendor/cargo-about.toml b/ShadowsocksX-NG2/Vendor/cargo-about.toml
new file mode 100644
index 000000000..b16a2d461
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/cargo-about.toml
@@ -0,0 +1,24 @@
+accepted = [
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "MIT",
+  "ISC",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "Unicode-3.0",
+  "MPL-2.0",
+  "CDLA-Permissive-2.0",
+  "CC0-1.0",
+  "0BSD",
+  "OpenSSL",
+  "WTFPL",
+  "Zlib",
+  "Unicode-DFS-2016",
+]
+targets = ["aarch64-apple-darwin", "x86_64-apple-darwin"]
+ignore-build-dependencies = true
+ignore-dev-dependencies = true
+workarounds = ["ring", "rustls"]
+
+[private]
+ignore = false
diff --git a/ShadowsocksX-NG2/Vendor/ck-client/LICENSE b/ShadowsocksX-NG2/Vendor/ck-client/LICENSE
new file mode 100644
index 000000000..f288702d2
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/ck-client/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
diff --git a/ShadowsocksX-NG2/Vendor/ck-client/NOTICE b/ShadowsocksX-NG2/Vendor/ck-client/NOTICE
new file mode 100644
index 000000000..fb49e5aaa
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/ck-client/NOTICE
@@ -0,0 +1,8 @@
+Cloak v2.12.0 — cbeuw/Cloak
+https://github.com/cbeuw/Cloak/tree/v2.12.0
+
+The bundled ck-client is the unmodified official darwin-arm64 release binary,
+re-signed for this application. Cloak is distributed under GPL-3.0; see LICENSE.
+Corresponding source: https://github.com/cbeuw/Cloak/archive/refs/tags/v2.12.0.tar.gz
+Build instructions: https://github.com/cbeuw/Cloak/blob/v2.12.0/release.sh
+Additional upstream copyright notices are included in THIRD-PARTY-NOTICES.
diff --git a/ShadowsocksX-NG2/Vendor/ck-client/THIRD-PARTY-NOTICES b/ShadowsocksX-NG2/Vendor/ck-client/THIRD-PARTY-NOTICES
new file mode 100644
index 000000000..7f1f10022
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/ck-client/THIRD-PARTY-NOTICES
@@ -0,0 +1,67 @@
+Third-party notices for ck-client.
+
+Cloak `ck-client` (manifest: `manifest.json`; release `v2.12.0`; source commit [`c3d5470ef76bba68d7812f5d06e4181dc1b1a5d6`](https://github.com/cbeuw/Cloak/commit/c3d5470ef76bba68d7812f5d06e4181dc1b1a5d6); binary metadata: Go `go1.24.5`, darwin/arm64, clean VCS revision).
+The direct Cloak license is in `LICENSE` and upstream notice/source data are in `NOTICE`; this file covers external Go modules reported for the shipped client, its Go standard library, and a separately credited internal/ecdh implementation.
+Go standard-library source text: [go1.24.5 LICENSE](https://go.googlesource.com/go/+/refs/tags/go1.24.5/LICENSE).
+Complete license terms are stored once per SPDX identifier in `../third-party-licenses/`; entries below group components and retain their copyright/attribution notices without repeating license bodies.
+
+## Apache-2.0
+
+License text: `../third-party-licenses/Apache-2.0.txt`
+
+Components: github.com/klauspost/compress.
+
+- Copyright (c) 2012 The Go Authors. All rights reserved.
+- Copyright (c) 2019 Klaus Post. All rights reserved.
+
+## BSD-2-Clause
+
+License text: `../third-party-licenses/BSD-2-Clause.txt`
+
+Components: github.com/gorilla/websocket.
+
+- Copyright (c) 2013 The Gorilla WebSocket Authors. All rights reserved.
+
+## BSD-3-Clause
+
+License text: `../third-party-licenses/BSD-3-Clause.txt`
+
+Components: Cloak internal/ecdh (wsddn/go-ecdh), Go standard library (go1.24.5),
+  github.com/klauspost/compress, github.com/klauspost/compress/internal/snapref,
+  github.com/refraction-networking/utls, github.com/refraction-networking/utls/dicttls,
+  golang.org/x/crypto, golang.org/x/sys.
+
+- Copyright (c) 2009 The Go Authors. All rights reserved.
+- Copyright (c) 2011 The Snappy-Go Authors. All rights reserved.
+- Copyright (c) 2012 The Go Authors. All rights reserved.
+- Copyright (c) 2014, tang0th.
+- Copyright (c) 2019 Klaus Post. All rights reserved.
+- Copyright (c) 2023, Gaukas Wang
+- Copyright 2009 The Go Authors.
+
+## LGPL-3.0
+
+License text: `../third-party-licenses/LGPL-3.0.txt`
+
+Components: github.com/juju/ratelimit.
+
+## MIT
+
+License text: `../third-party-licenses/MIT.txt`
+
+Components: github.com/andybalholm/brotli, github.com/klauspost/compress,
+  github.com/klauspost/compress/zstd/internal/xxhash, github.com/sirupsen/logrus.
+
+- Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors.
+- Copyright (c) 2012 The Go Authors. All rights reserved.
+- Copyright (c) 2014 Simon Eskildsen
+- Copyright (c) 2015 Klaus Post
+- Copyright (c) 2016 Caleb Spare
+- Copyright (c) 2019 Klaus Post. All rights reserved.
+- Copyright 2016-2017 The New York Times Company
+
+## Additional upstream notices
+
+- Cloak `internal/ecdh` has a source-specific BSD-3-Clause condition 3 naming tang0th; see `../third-party-licenses/additional-notices/ck-client-ecdh-BSD-3-Clause-variation.txt`.
+- The Go standard library and `golang.org/x/crypto` / `golang.org/x/sys` use the Google LLC BSD-3-Clause condition 3 variation; `klauspost/compress`, its `internal/snapref` package, and `refraction-networking/utls` use the Google Inc variation. Both clauses are preserved at `../third-party-licenses/additional-notices/Go-BSD-3-Clause-source-variations.txt`.
+- `juju/ratelimit` adds a special static/dynamic linking exception to LGPL-3.0. The exception is reproduced separately at `../third-party-licenses/additional-notices/ck-client-ratelimit-linking-exception.txt`; read it together with the shared LGPL-3.0 text.
diff --git a/ShadowsocksX-NG2/Vendor/ck-client/manifest.json b/ShadowsocksX-NG2/Vendor/ck-client/manifest.json
new file mode 100644
index 000000000..e88e45168
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/ck-client/manifest.json
@@ -0,0 +1,17 @@
+{
+  "project": "Cloak",
+  "release": "v2.12.0",
+  "target": "darwin-arm64",
+  "asset": "ck-client-darwin-arm64-v2.12.0",
+  "url": "https://github.com/cbeuw/Cloak/releases/download/v2.12.0/ck-client-darwin-arm64-v2.12.0",
+  "archiveSHA256": "dbef5cd5dd1b551a046c422e07854eb4736fc958e684c6532eb7e809b593ad5c",
+  "assetFormat": "binary",
+  "binary": "ck-client",
+  "bundleSubpath": "Helpers/Plugins",
+  "signIdentifier": "com.qiuyuzhou.ShadowsocksX-NG2.plugin.ck-client",
+  "pluginNames": [
+    "cloak",
+    "cloak-v2"
+  ],
+  "defaultArguments": []
+}
diff --git a/ShadowsocksX-NG2/Vendor/dependency-metadata.json b/ShadowsocksX-NG2/Vendor/dependency-metadata.json
new file mode 100644
index 000000000..e5af2c840
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/dependency-metadata.json
@@ -0,0 +1,78 @@
+{
+  "sslocal": {
+    "manifest": "sslocal/manifest.json",
+    "projectURL": "https://github.com/shadowsocks/shadowsocks-rust",
+    "licenses": [
+      "sslocal/LICENSE"
+    ],
+    "notices": [
+      "sslocal/THIRD-PARTY-NOTICES"
+    ],
+    "sourceURL": "https://github.com/qiuyuzhou/shadowsocks-rust"
+  },
+  "v2ray-plugin": {
+    "manifest": "v2ray-plugin/manifest.json",
+    "projectURL": "https://github.com/shadowsocks/v2ray-plugin",
+    "licenses": [
+      "v2ray-plugin/LICENSE"
+    ],
+    "notices": [
+      "v2ray-plugin/THIRD-PARTY-NOTICES"
+    ]
+  },
+  "ck-client": {
+    "manifest": "ck-client/manifest.json",
+    "projectURL": "https://github.com/cbeuw/Cloak",
+    "licenses": [
+      "ck-client/LICENSE"
+    ],
+    "notices": [
+      "ck-client/NOTICE",
+      "ck-client/THIRD-PARTY-NOTICES"
+    ]
+  },
+  "AgeSwift": {
+    "package": "AgeSwift",
+    "licenses": [
+      "AgeSwift/LICENSE-MIT",
+      "AgeSwift/LICENSE-APACHE"
+    ],
+    "notices": [
+      "AgeSwift/THIRD-PARTY-NOTICES"
+    ]
+  },
+  "china-ipv4": {
+    "manifest": "rules/china-ipv4/manifest.json",
+    "name": "china-operator-ip",
+    "projectURL": "https://github.com/gaoyifan/china-operator-ip",
+    "licenses": [
+      "rules/china-ipv4/LICENSE"
+    ],
+    "notices": [
+      "rules/china-ipv4/NOTICE"
+    ]
+  },
+  "geolocation-cn": {
+    "manifest": "rules/geolocation-cn/manifest.json",
+    "name": "domain-list-custom",
+    "projectURL": "https://github.com/Loyalsoldier/domain-list-custom",
+    "licenses": [
+      "rules/geolocation-cn/LICENSE",
+      "rules/geolocation-cn/LICENSE-v2fly"
+    ],
+    "notices": [
+      "rules/geolocation-cn/NOTICE"
+    ]
+  },
+  "gfwlist": {
+    "manifest": "rules/gfwlist/manifest.json",
+    "name": "gfwlist",
+    "projectURL": "https://github.com/gfwlist/gfwlist",
+    "licenses": [
+      "rules/gfwlist/LICENSE"
+    ],
+    "notices": [
+      "rules/gfwlist/NOTICE"
+    ]
+  }
+}
diff --git a/ShadowsocksX-NG2/Vendor/rules/china-ipv4/LICENSE b/ShadowsocksX-NG2/Vendor/rules/china-ipv4/LICENSE
new file mode 100644
index 000000000..9d4ad836d
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/china-ipv4/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Yifan Gao
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/rules/china-ipv4/NOTICE b/ShadowsocksX-NG2/Vendor/rules/china-ipv4/NOTICE
new file mode 100644
index 000000000..baf6fa61f
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/china-ipv4/NOTICE
@@ -0,0 +1,19 @@
+china-ipv4 rule snapshot
+========================
+
+Upstream: gaoyifan/china-operator-ip china.txt (ip-lists branch)
+Upstream commit: 75f2eb035cb53a7a4af3437e2c2110d0f73cf14a
+Upstream URL: https://raw.githubusercontent.com/gaoyifan/china-operator-ip/75f2eb035cb53a7a4af3437e2c2110d0f73cf14a/china.txt
+Upstream archive SHA-256: 98493d3ec7f2c77b9f191600dc741df731cfbaef775201594d0bda66b0181479
+
+License: MIT
+
+China mainland IPv4 CIDR derived from gaoyifan/china-operator-ip china.txt
+(ip-lists branch) at commit 75f2eb035cb53a7a4af3437e2c2110d0f73cf14a.
+BGP/ASN-derived candidate routing data; not a guarantee of geographic
+ownership or reachability.
+
+This list is candidate routing data. It is not a guarantee of network
+reachability, geographic ownership, or privacy. IP-CIDR matching may cause
+sslocal to issue local DNS queries for unmatched hostnames; the product does
+not promise that all DNS queries travel through the remote Shadowsocks server.
diff --git a/ShadowsocksX-NG2/Vendor/rules/china-ipv4/manifest.json b/ShadowsocksX-NG2/Vendor/rules/china-ipv4/manifest.json
new file mode 100644
index 000000000..54489a6e6
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/china-ipv4/manifest.json
@@ -0,0 +1,8 @@
+{
+  "converterVersion": "2.0.0",
+  "name": "china-ipv4",
+  "snapshotSHA256": "cb5f9974973bf4b2e8c609105ae15c96924ee5bfd8c85753fc091f8cc13380dd",
+  "upstreamArchiveSHA256": "98493d3ec7f2c77b9f191600dc741df731cfbaef775201594d0bda66b0181479",
+  "upstreamURL": "https://raw.githubusercontent.com/gaoyifan/china-operator-ip/75f2eb035cb53a7a4af3437e2c2110d0f73cf14a/china.txt",
+  "upstreamVersion": "75f2eb035cb53a7a4af3437e2c2110d0f73cf14a"
+}
diff --git a/ShadowsocksX-NG2/Vendor/rules/china-ipv4/snapshot.json b/ShadowsocksX-NG2/Vendor/rules/china-ipv4/snapshot.json
new file mode 100644
index 000000000..79c9def30
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/china-ipv4/snapshot.json
@@ -0,0 +1 @@
+{"lossReport":{"absorbedCount":0,"convertedCount":6206,"rejected":{},"skipped":{}},"metadata":{"attribution":"China mainland IPv4 CIDR derived from gaoyifan/china-operator-ip china.txt (ip-lists branch) at commit 75f2eb035cb53a7a4af3437e2c2110d0f73cf14a. BGP/ASN-derived candidate routing data; not a guarantee of geographic ownership or reachability.","converterVersion":"2.0.0","fetchedAt":"2026-10-02T18:17:42Z","inputDigest":"98493d3ec7f2c77b9f191600dc741df731cfbaef775201594d0bda66b0181479","license":"MIT","source":{"kind":"china-ipv4","label":"china-operator-ip","upstreamVersion":"75f2eb035cb53a7a4af3437e2c2110d0f73cf14a"},"upstreamReference":"https://raw.githubusercontent.com/gaoyifan/china-operator-ip/75f2eb035cb53a7a4af3437e2c2110d0f73cf14a/china.txt @ 75f2eb035cb53a7a4af3437e2c2110d0f73cf14a"},"rules":[{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.1.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.0.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.1.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.1.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.1.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.1.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.1.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.1.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.2.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.2.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.2.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.2.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.2.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.2.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.2.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.3.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.4.1.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.4.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.4.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.4.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.4.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.4.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.4.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.8.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.10.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.10.8.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.10.11.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.10.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.10.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.10.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.10.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.12.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.24.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.45.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.48.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.56.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.68.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.80.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.116.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.37.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.38.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.118.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.119.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.180.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.184.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.188.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.192.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.202.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"1.204.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"5.10.138.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"5.10.140.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"5.10.143.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.128.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.128.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.128.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.128.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.129.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.130.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.132.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.136.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.144.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.148.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.148.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.148.41.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.148.43.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.148.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.148.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.149.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.150.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.150.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.150.64.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.152.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.160.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.162.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.163.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.164.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.168.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.176.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"8.176.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.0.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.0.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.1.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.1.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.1.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.16.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.102.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.102.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.103.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.104.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.112.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.130.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.134.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.144.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.192.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.192.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.196.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.204.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"14.208.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"16.2.142.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.0.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.0.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.0.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.0.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.0.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.8.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.16.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.34.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.36.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.40.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.50.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.50.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.54.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.54.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.54.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.98.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.98.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.99.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.103.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.106.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.106.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.109.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.109.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.112.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.112.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.112.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.113.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.115.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.116.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.121.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.121.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.128.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.131.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.144.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.148.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.152.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.184.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.192.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"27.224.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.0.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.0.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.0.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.0.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.0.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.0.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.1.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.4.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.16.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.32.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.36.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.37.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.37.36.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.37.39.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.37.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.37.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.40.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.48.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.50.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.50.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.51.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.56.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.96.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.128.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.136.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.140.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.140.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.140.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.140.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.140.216.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.140.218.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.140.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.140.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.141.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.142.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.144.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.160.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.192.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.248.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.254.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.255.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.255.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.255.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.255.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"36.255.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.0.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.0.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.0.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.0.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.0.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.0.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.0.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.0.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.64.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.96.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.97.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.97.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.97.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.97.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.97.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.97.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.98.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.100.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.104.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.108.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"39.128.0.0/10"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"40.72.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"40.125.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"40.126.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"40.162.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.201.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.0.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.1.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.1.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.1.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.1.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.1.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.4.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.48.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.56.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.62.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.62.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.62.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.62.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.62.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.63.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.80.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.83.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.83.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.83.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.83.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.83.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.84.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.88.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.96.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.96.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.96.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.96.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.96.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.97.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.99.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.99.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.99.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.99.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.99.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.100.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.120.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.122.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.123.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.123.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.123.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.123.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.123.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.123.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.128.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.156.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.156.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.156.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.156.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.156.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.156.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.157.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.158.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.160.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.176.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.184.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.186.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.187.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.187.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.187.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.187.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.187.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.187.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.192.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.201.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.202.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.204.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.208.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.224.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.240.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.240.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.240.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.240.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.240.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.240.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.242.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.244.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"42.248.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.136.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.144.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.148.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.176.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.192.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.196.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.224.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.175.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.225.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.226.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.227.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.228.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.229.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.230.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.230.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.230.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.230.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.230.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.230.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.230.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.231.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.231.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.231.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.231.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.231.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.231.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.231.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.236.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.237.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.237.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.237.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.237.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.237.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.237.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.238.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.239.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.239.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.239.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.239.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.239.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.239.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.239.176.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.239.179.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.240.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.241.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.53.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.54.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.242.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.243.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.246.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.246.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.246.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.246.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.246.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.247.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.248.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.249.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.249.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.249.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.249.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.249.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.249.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.249.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.249.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.249.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.180.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.250.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.251.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.251.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.251.118.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.251.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.251.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.251.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.252.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.252.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.254.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"43.255.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"44.30.120.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.40.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.65.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.112.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.112.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.112.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.112.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.112.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.113.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.114.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.18.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.115.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.116.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.116.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.116.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.116.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.116.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.116.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.116.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.116.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.117.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.117.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.117.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.117.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.117.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.119.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.119.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.119.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.119.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.119.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.119.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.120.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.120.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.120.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.120.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.121.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.121.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.121.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.121.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.121.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.121.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.121.215.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.121.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.122.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.123.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.124.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.125.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.125.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.125.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.125.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.125.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.125.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.125.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.125.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.126.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.126.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.126.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.126.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.126.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.126.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.126.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.127.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.127.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.127.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.127.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.248.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.248.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.248.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.248.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.248.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.248.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.248.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.249.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.249.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.249.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.249.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.249.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.249.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.249.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.249.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.250.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.251.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.9.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.10.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.252.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.253.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.254.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"45.255.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"47.92.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"47.96.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.4.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.4.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.4.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.4.178.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.4.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.4.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.4.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.5.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.6.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.51.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.51.54.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.51.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.51.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.51.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.51.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.52.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.64.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.112.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.120.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.128.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.128.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.128.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.140.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.152.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.208.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.213.60.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.220.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.232.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.239.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.239.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.246.224.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.246.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.246.232.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.246.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"49.246.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"52.80.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"52.130.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"54.222.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"57.176.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.14.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.14.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.14.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.14.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.14.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.15.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.16.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.24.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.30.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.32.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.65.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.67.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.68.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.82.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.83.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.87.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.99.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.100.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.116.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.128.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.144.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.154.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.192.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"58.240.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.32.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.64.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.80.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.82.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.83.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.83.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.83.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.83.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.83.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.83.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.107.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.107.226.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.107.255.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.108.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.151.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.152.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.152.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.152.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.152.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.173.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.174.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.153.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.155.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.172.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.191.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"59.192.0.0/10"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.0.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.55.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.63.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.160.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.194.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.200.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.208.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.232.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.235.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.245.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.247.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.252.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.253.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"60.255.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.4.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.4.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.8.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.14.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.14.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.14.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.28.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.29.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.29.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.29.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.45.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.45.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.47.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.48.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.87.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.128.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.160.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.176.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.184.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.186.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.186.3.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.186.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.186.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.186.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.186.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.186.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.186.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.187.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.188.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.232.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.236.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"61.240.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"62.234.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"63.140.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"63.140.3.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"66.102.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"66.102.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"66.102.251.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"66.102.252.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"66.102.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"68.79.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"69.163.104.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"69.163.106.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"69.163.123.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"69.230.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"69.231.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"69.234.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"69.235.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"71.131.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"71.132.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"71.136.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"71.137.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"81.68.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"81.173.18.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"81.173.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"81.173.28.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"82.156.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"94.191.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.0.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.1.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.2.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.4.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.16.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.33.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.34.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.36.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.36.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.36.82.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.36.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.36.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.36.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.37.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.38.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.40.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.48.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.50.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.50.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.52.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.53.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.54.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.55.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.64.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.72.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.76.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.78.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.78.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.80.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.96.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.96.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.96.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.96.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.99.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.101.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.101.100.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.101.102.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.101.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.101.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.102.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.102.100.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.102.102.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.102.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.102.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.104.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.110.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.110.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.110.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.110.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.120.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.124.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.126.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.128.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.128.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.128.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.128.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.129.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.130.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.132.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.144.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.192.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.192.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.192.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.192.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.192.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.192.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.192.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.192.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.192.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.193.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.194.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.196.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.200.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.203.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.203.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.203.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.203.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.204.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.224.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.232.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.232.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.232.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.232.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.232.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.232.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.232.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.232.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.233.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.234.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.234.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.234.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.234.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.236.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.230.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.243.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.244.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.246.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.250.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.237.253.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.238.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.240.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.248.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.251.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.251.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.251.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.251.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.251.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.251.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.252.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"101.254.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.1.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.1.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.1.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.1.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.1.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.1.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.2.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.2.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.2.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.2.188.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.2.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.2.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.3.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.3.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.3.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.3.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.3.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.3.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.4.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.4.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.4.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.4.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.5.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.5.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.5.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.5.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.5.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.5.192.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.5.194.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.5.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.6.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.6.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.7.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.7.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.7.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.8.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.8.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.8.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.8.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.8.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.8.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.8.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.8.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.8.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.9.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.9.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.9.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.9.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.9.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.10.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.10.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.10.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.10.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.11.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.11.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.11.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.12.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.12.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.12.98.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.12.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.12.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.12.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.13.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.13.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.13.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.13.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.14.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.14.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.14.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.14.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.14.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.15.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.15.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.15.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.15.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.15.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.16.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.16.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.16.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.16.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.16.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.17.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.17.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.17.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.17.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.17.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.17.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.17.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.18.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.18.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.18.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.18.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.19.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.19.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.19.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.19.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.19.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.20.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.20.32.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.20.34.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.20.46.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.20.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.20.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.20.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.20.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.20.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.21.98.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.21.102.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.21.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.21.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.21.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.22.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.22.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.22.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.22.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.22.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.22.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.22.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.22.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.23.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.23.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.23.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.23.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.23.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.24.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.24.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.24.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.24.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.24.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.24.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.24.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.24.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.24.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.9.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.25.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.26.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.26.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.26.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.26.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.26.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.26.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.26.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.26.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.27.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.27.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.27.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.27.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.27.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.27.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.27.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.28.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.28.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.28.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.28.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.28.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.29.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.29.24.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.29.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.29.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.29.236.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.30.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.30.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.30.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.30.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.30.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.30.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.31.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.31.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.31.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.31.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.31.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.31.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.31.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.31.242.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.32.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.34.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.35.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.35.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.35.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.35.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.35.117.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.35.119.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.35.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.35.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.36.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.37.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.38.252.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.39.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.39.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.39.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.39.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.39.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.39.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.39.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.39.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.39.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.173.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.174.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.40.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.41.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.42.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.42.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.42.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.42.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.42.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.42.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.43.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.196.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.199.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.44.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.45.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.45.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.45.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.45.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.45.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.45.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.45.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.45.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.46.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.47.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.48.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.48.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.48.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.48.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.48.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.48.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.48.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.48.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.49.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.49.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.49.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.49.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.49.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.49.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.49.197.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.50.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.52.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.53.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.54.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.54.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.54.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.54.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.54.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.55.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.55.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.55.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.55.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.55.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.55.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.55.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.55.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.94.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.56.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.57.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.57.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.57.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.57.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.57.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.57.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.58.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.59.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.59.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.59.120.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.59.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.59.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.59.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.59.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.59.168.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.60.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.60.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.60.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.60.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.61.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.61.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.61.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.61.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.61.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.61.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.61.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.61.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.53.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.55.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.62.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.63.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.64.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.64.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.64.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.64.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.64.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.64.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.64.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.64.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.64.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.65.224.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.66.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.66.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.66.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.66.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.66.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.67.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.68.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.68.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.68.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.68.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.69.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.69.62.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.70.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.70.14.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.70.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.70.224.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.70.227.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.70.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.70.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.71.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.233.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.234.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.72.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.73.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.74.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.74.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.74.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.74.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.74.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.74.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.74.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.74.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.74.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.75.82.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.75.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.75.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.75.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.75.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.75.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.75.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.75.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.76.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.76.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.76.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.76.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.76.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.76.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.77.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.77.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.77.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.77.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.77.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.77.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.77.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.78.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.78.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.78.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.78.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.78.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.78.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.78.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.79.228.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.80.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.80.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.80.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.80.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.80.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.80.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.80.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.184.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.81.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.82.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.82.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.82.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.82.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.82.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.82.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.83.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.83.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.83.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.83.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.83.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.83.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.84.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.84.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.84.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.84.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.84.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.84.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.84.170.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.85.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.85.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.85.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.85.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.85.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.85.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.85.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.85.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.85.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.86.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.86.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.86.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.86.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.86.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.86.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.87.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.87.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.87.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.87.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.87.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.87.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.87.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.88.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.89.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.89.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.89.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.89.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.89.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.89.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.89.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.89.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.56.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.90.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.112.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.138.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.91.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.86.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.92.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.93.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.93.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.93.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.93.142.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.93.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.93.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.93.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.94.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.94.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.94.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.94.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.94.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.94.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.94.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.94.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.95.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.96.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.96.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.96.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.96.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.96.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.96.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.96.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.96.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.96.224.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.60.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.97.229.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.98.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.53.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.54.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.62.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.99.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.62.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.100.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.101.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.101.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.101.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.101.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.101.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.101.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.102.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.102.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.102.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.102.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.102.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.102.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.102.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.102.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.103.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.104.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.104.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.104.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.104.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.104.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.104.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.104.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.104.198.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.104.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.133.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.134.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.105.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.202.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.106.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.107.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.108.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.108.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.108.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.108.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.108.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.108.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.109.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.109.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.109.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.109.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.110.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.110.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.110.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.110.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.110.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.110.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.110.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.111.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.111.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.111.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.112.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.112.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.112.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.112.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.112.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.113.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.113.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.113.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.113.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.156.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.114.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.115.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.115.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.115.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.115.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.115.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.115.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.138.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.150.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.116.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.117.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.117.73.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.117.74.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.117.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.117.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.117.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.118.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.118.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.118.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.118.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.118.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.118.210.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.118.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.118.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.118.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.119.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.119.115.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.119.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.119.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.119.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.120.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.120.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.120.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.120.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.120.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.120.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.120.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.121.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.121.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.121.250.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.121.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.122.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.122.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.122.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.123.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.123.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.123.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.123.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.123.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.123.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.123.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.124.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.124.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.124.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.124.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.124.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.125.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.125.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.125.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.125.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.125.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.125.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.125.249.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.125.250.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.126.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.126.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.126.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.126.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.126.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.130.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.130.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.130.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.131.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.131.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.131.138.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.131.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.131.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.131.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.131.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.22.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.161.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.132.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.133.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.133.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.133.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.133.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.134.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.134.232.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.135.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.135.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.135.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.135.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.135.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.135.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.135.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.135.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.135.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.136.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.136.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.137.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.137.60.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.137.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.137.136.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.137.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.137.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.138.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.138.134.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.138.208.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.138.220.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.138.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.139.22.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.139.92.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.139.134.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.139.172.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.139.204.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.139.212.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.140.14.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.140.140.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.140.144.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.140.192.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.141.10.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.141.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.141.128.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.141.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.141.242.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.82.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.96.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.128.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.154.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.156.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.172.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.180.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.234.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.238.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.142.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.143.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.143.74.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.143.120.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.143.124.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.143.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.143.174.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.143.228.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.144.41.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.144.66.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.144.70.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.144.72.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.144.136.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.144.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.145.42.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.145.93.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.145.98.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.145.188.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.146.72.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.146.91.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.146.126.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.146.138.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.146.236.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.147.124.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.147.206.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.148.174.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.149.6.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.149.17.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.149.44.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.149.210.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.149.214.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.149.220.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.149.242.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.149.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.10.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.24.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.66.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.72.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.126.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.146.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.164.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.172.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.200.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.216.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.150.244.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.151.142.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.151.148.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.151.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.56.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.76.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.152.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.168.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.192.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.200.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.208.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.224.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.152.250.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.153.114.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.153.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.153.132.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.153.146.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.153.160.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.154.18.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.154.30.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.154.32.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.154.40.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.154.66.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.154.162.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.154.164.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.154.168.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.155.14.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.155.34.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.155.48.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.155.76.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.155.101.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.155.214.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.156.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.156.68.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.156.104.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.156.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.156.174.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.156.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.156.228.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.157.30.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.157.174.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.157.212.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.157.234.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.157.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.158.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.158.8.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.158.16.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.158.200.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.158.224.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.159.124.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.159.134.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.159.142.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.160.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.160.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.160.244.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.160.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.161.14.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.161.102.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.161.208.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.161.220.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.161.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.162.10.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.162.32.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.162.116.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.163.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.163.32.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.163.46.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.163.74.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.163.180.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.164.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.164.32.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.164.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.164.64.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.164.76.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.164.178.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.165.44.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.165.52.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.165.82.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.165.110.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.166.20.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.166.50.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.166.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.166.84.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.166.138.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.167.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.167.36.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.167.100.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.168.98.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.168.170.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.169.50.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.169.62.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.169.108.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.169.162.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.169.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.169.216.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.170.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.170.134.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.170.212.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.171.32.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.171.166.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.171.214.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.172.32.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.172.160.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.173.102.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.173.182.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.173.184.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.174.94.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.175.114.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.175.118.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.175.197.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.176.52.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.176.222.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.176.244.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.177.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.177.44.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.177.71.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.177.162.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.178.240.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.179.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.180.108.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.180.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.181.234.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.183.26.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.183.66.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.183.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.183.124.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.184.46.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.184.60.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.185.78.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.185.80.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.186.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.186.108.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.186.162.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.186.228.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.189.92.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.189.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.190.20.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.190.71.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.190.104.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.190.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.190.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.191.102.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.191.242.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.192.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.193.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.193.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.193.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.193.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.193.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.193.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.193.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.193.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.193.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.194.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.195.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.195.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.195.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.195.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.196.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.196.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.196.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.196.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.196.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.197.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.197.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.197.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.198.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.199.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.199.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.199.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.199.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.200.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.200.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.200.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.200.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.200.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.200.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.200.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.200.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.201.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.60.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.62.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.68.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.152.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.154.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.202.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.203.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.216.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.204.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.162.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.205.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.206.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.206.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.206.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.207.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.207.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.207.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.207.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.207.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.207.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.207.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.208.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.208.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.208.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.208.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.208.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.209.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.209.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.209.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.209.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.209.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.210.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.210.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.210.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.210.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.211.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.211.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.211.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.211.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.211.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.211.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.211.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.212.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.213.232.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.214.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.214.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.214.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.214.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.215.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.215.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.215.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.215.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.215.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.215.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.215.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.215.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.156.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.216.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.217.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.217.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.217.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.217.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.217.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.178.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.218.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.219.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.219.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.219.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.219.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.219.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.219.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.219.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.219.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.220.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.221.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.221.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.221.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.221.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.222.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.223.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.224.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.224.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.224.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.224.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.224.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.224.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.225.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.57.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.116.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.226.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.227.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.228.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.228.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.228.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.228.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.228.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.228.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.228.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.228.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.228.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.229.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.229.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.229.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.229.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.229.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.229.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.229.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.229.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.229.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.230.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.230.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.230.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.230.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.230.110.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.230.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.230.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.230.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.230.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.231.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.231.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.231.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.231.185.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.231.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.231.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.232.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.232.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.232.166.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.232.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.233.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.233.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.233.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.233.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.233.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.233.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.233.162.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.233.178.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.233.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.234.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.234.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.234.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.234.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.234.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.234.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.234.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.85.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.235.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.116.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.250.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.236.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.237.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.237.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.237.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.237.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.237.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.237.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.237.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.18.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.46.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.152.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.238.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.239.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.42.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.201.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.240.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.241.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.241.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.241.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.241.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.241.172.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.241.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.241.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.242.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.242.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.242.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.242.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.242.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.242.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.242.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.242.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.242.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.243.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.243.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.26.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.119.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.244.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.245.23.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.245.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.245.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.245.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.245.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.245.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.246.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.246.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.246.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.246.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.247.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.247.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.247.191.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.247.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.247.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.248.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.248.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.248.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.248.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.248.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.248.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.248.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.248.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.249.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.250.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.250.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.250.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.250.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.250.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.250.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.250.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.250.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.250.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.251.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.252.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.253.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.253.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.253.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.253.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.253.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.253.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.254.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.254.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.254.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.254.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.254.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.254.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.254.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.255.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.255.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.255.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.255.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.255.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.255.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"103.255.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"104.192.108.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"104.192.110.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.0.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.0.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.0.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.0.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.0.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.0.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.0.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.2.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.2.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.2.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.2.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.2.156.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.2.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.2.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.3.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.3.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.3.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.3.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.3.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.3.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.4.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.8.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.11.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.12.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.16.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.32.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.48.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.50.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.52.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.56.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.74.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.75.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.75.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.75.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.75.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.75.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.80.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.108.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.112.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"106.224.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"109.244.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.6.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.16.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.34.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.40.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.42.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.42.16.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.42.18.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.42.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.42.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.42.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.42.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.42.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.43.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.44.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.44.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.48.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.51.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.52.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.56.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.64.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.72.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.75.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.76.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.76.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.76.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.76.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.76.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.77.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.80.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.88.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.92.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.93.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.94.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.96.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.98.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.100.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.104.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.112.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.120.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.121.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.121.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.121.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.121.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.121.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.121.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.122.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.124.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.152.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.156.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.165.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.166.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.172.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.173.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.173.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.173.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.173.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.176.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.192.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.228.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.232.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.236.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"110.240.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.0.0.0/10"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.176.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.178.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.66.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.67.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.68.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.72.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.85.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.92.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.112.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.116.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.118.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.119.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.119.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.120.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.124.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.126.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.128.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.160.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.170.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.172.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.176.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.186.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.192.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.208.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.221.28.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.221.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.222.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.223.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.223.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.223.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.223.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.223.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.224.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.235.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.235.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"111.235.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.0.0.0/10"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.64.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.73.232.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.74.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.80.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.96.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.109.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.111.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.112.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.116.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.122.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.124.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.128.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.132.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.137.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.192.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"112.224.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.0.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.8.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.11.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.12.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.16.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.18.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.21.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.24.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.31.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.44.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.48.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.52.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.52.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.54.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.56.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.58.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.59.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.59.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.62.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.64.0.0/10"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.128.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.130.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.130.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.132.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.136.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.192.40.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.194.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.197.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.200.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.202.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.204.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.208.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.208.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.209.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.212.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.212.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.212.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.213.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.214.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.218.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.220.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.224.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.240.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"113.248.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.193.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.194.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.197.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.198.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.201.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.203.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.205.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.206.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.208.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.210.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.216.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.220.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.225.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.230.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.232.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.235.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.236.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.239.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.28.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.31.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.54.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.60.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.64.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.66.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.66.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.66.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.66.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.67.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.68.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.79.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.80.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.96.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.104.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.110.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.110.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.111.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.111.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.111.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.111.190.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.12.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.16.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.228.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.230.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.234.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.240.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.245.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.247.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.112.252.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.242.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.246.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.113.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.114.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.116.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.118.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.119.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.119.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.119.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.119.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.119.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.132.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.135.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.138.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.141.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.141.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.141.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.142.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.196.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.198.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.208.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"114.224.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.24.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.28.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.31.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.32.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.42.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.44.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.48.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.69.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.84.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.85.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.100.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.104.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.120.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.124.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.148.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.152.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.166.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.168.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.180.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.187.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.190.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.192.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"115.224.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.0.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.0.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.1.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.2.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.4.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.8.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.13.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.16.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.50.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.52.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.56.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.58.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.58.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.60.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.66.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.68.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.68.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.69.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.70.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.76.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.85.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.89.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.90.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.90.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.95.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.112.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.116.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.128.0.0/10"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.192.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.193.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.193.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.193.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.194.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.196.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.196.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.196.12.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.196.14.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.196.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.196.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.196.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.196.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.197.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.198.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.199.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.199.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.199.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.204.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.205.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.207.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.208.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.212.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.213.44.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.213.46.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.213.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.213.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.214.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.214.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.214.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.215.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.216.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.224.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.242.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.244.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.248.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.252.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.254.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.254.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"116.255.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.8.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.21.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.22.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.24.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.32.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.40.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.44.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.48.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.50.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.51.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.53.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.53.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.57.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.58.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.59.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.60.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.64.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.72.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.74.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.74.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.75.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.76.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.80.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.100.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.103.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.103.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.103.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.103.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.104.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.106.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.112.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.120.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.120.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.120.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.120.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.120.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.120.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.120.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.121.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.121.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.121.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.122.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.124.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.128.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.132.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.134.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.134.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.134.207.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.134.208.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.134.212.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.134.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.134.222.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.134.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.134.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.135.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.136.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.144.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"117.160.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.24.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.133.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.134.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.26.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.28.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.64.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.66.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.67.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.72.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.80.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.84.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.88.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.88.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.88.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.89.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.91.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.102.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.102.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.103.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.103.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.103.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.112.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.120.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.124.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.126.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.127.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.132.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.144.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.178.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.180.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.184.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.186.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.188.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.190.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.192.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.193.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.193.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.193.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.193.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.194.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.194.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.194.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.194.227.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.194.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.195.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.196.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.202.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.204.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.212.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.215.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.224.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.228.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.230.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.239.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.242.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.244.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"118.248.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.0.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.2.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.2.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.3.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.4.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.10.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.15.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.16.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.18.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.18.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.18.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.19.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.20.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.27.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.27.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.28.28.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.28.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.29.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.30.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.31.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.32.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.40.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.40.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.40.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.41.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.42.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.42.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.42.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.44.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.48.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.57.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.58.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.59.128.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.59.130.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.59.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.59.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.59.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.59.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.59.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.60.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.62.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.63.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.75.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.78.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.80.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.82.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.84.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.88.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.96.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.108.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.112.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.128.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.144.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.148.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.151.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.160.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.161.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.161.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.161.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.161.152.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.161.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.161.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.162.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.164.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.176.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.232.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.235.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.248.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.252.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.252.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.252.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.252.250.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.252.252.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.252.255.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.253.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"119.254.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.0.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.24.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.30.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.32.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.48.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.52.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.64.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.72.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.72.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.76.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.80.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.88.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.90.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.92.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.94.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.128.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.136.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.136.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.137.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.143.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"120.192.0.0/10"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.0.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.0.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.4.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.8.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.16.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.32.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.40.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.46.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.46.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.46.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.46.141.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.46.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.46.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.47.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.48.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.50.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.51.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.52.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.52.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.52.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.54.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.55.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.56.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.58.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.58.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.58.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.58.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.36.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.39.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.101.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.102.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.104.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.107.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.108.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.110.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.121.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.123.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.125.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.126.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.141.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.142.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.59.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.60.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.68.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.76.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.79.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.89.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.91.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.100.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.101.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.101.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.192.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.200.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.201.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.204.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.224.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.248.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"121.255.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.0.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.0.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.4.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.57.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.60.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.80.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.8.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.9.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.132.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.136.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.205.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.206.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.10.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.11.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.12.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.148.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.150.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.152.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.155.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.157.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.14.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.48.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.49.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.51.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.64.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.96.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.102.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.102.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.112.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.112.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.112.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.112.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.112.120.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.112.125.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.112.126.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.112.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.113.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.113.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.113.48.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.113.51.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.113.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.113.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.113.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.113.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.114.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.115.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.115.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.115.70.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.115.72.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.115.74.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.115.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.115.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.115.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.115.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.119.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.128.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.128.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.136.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.144.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.152.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.156.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.188.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.192.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.198.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.200.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.200.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.201.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.204.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.224.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.240.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.248.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.248.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"122.255.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.0.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.4.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.8.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.192.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.194.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.197.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.198.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.236.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.240.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.242.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.49.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.50.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.52.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.56.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.58.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.58.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.58.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.59.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.60.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.62.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.64.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.96.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.98.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.98.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.98.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.98.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.98.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.99.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.99.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.99.164.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.99.166.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.99.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.99.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.99.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.100.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.101.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.103.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.108.88.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.108.130.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.108.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.108.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.108.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.112.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.128.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.136.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.137.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.138.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.144.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.160.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.176.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.176.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.177.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.178.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.180.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.184.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.196.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.199.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.206.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.232.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.242.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.242.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.244.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.249.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.253.52.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"123.254.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.6.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.14.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.16.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.20.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.21.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.21.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.21.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.22.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.28.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.29.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.31.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.40.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.40.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.40.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.40.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.42.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.47.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.64.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.66.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.67.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.68.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.68.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.68.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.68.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.68.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.68.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.69.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.70.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.71.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.71.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.71.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.71.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.71.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.71.250.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.71.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.72.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.88.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.108.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.108.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.109.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.112.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.126.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.128.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.147.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.150.137.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.151.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.152.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.160.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.172.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.172.88.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.172.91.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.172.93.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.172.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.173.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.173.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.173.205.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.174.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.192.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.196.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.197.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.200.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.220.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.224.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.240.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.240.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.242.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.243.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.248.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.249.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.250.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"124.254.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.31.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.32.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.58.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.61.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.62.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.64.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.80.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.88.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.92.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.93.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.93.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.93.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.93.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.93.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.93.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.94.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.96.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.98.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.104.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.112.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.169.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.171.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.208.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.210.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.213.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.214.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.215.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.216.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"125.254.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"128.108.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"129.28.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"129.204.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"129.211.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"132.232.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"132.237.134.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"134.49.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"134.175.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"137.59.59.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"137.59.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"138.252.72.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"138.252.78.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"138.252.96.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"138.252.118.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"138.252.162.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.5.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.5.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.5.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.5.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.5.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.5.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.5.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.5.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.5.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.9.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.129.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.148.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.155.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.116.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.159.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.170.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.176.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.101.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.102.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.208.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.211.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.183.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.186.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.189.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.189.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.189.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.189.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.189.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.189.124.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.189.126.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.189.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.196.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.198.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.198.66.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.198.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.198.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.198.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.198.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.198.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.199.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.200.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.208.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.217.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.219.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.220.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.224.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"139.226.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.75.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.143.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.179.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.205.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.206.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.210.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.210.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.210.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.210.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.210.30.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.210.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.210.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.210.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.224.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.237.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.240.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.243.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.246.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.249.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.250.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"140.255.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"142.86.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"142.86.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"142.86.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"142.86.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"142.86.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"143.64.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.0.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.7.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.12.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.36.147.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.48.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.48.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.48.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.48.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.48.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.48.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.48.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.52.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.79.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.79.10.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.79.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.79.42.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.79.54.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.79.84.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.79.148.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.123.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"144.255.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"145.14.71.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"145.14.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"145.14.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"145.14.82.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"145.14.84.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"145.14.86.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"145.14.88.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"145.14.90.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.56.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.196.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.196.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.196.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.196.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.196.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.196.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.222.79.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.222.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"146.222.94.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"147.78.132.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"147.78.134.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"148.70.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"149.41.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"149.41.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.0.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.115.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.121.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.122.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.129.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.129.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.129.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.138.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.158.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.223.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.156.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.192.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.212.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.215.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.224.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.242.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.248.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"150.255.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"151.158.14.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"151.158.78.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"151.158.80.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"151.158.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"152.104.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"152.136.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"153.0.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"153.3.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"153.34.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"153.36.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"153.99.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"153.101.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"153.118.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"154.8.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"154.72.44.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"154.72.47.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"155.126.176.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"156.107.160.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"156.107.170.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"156.107.179.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"156.107.181.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.0.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.10.34.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.10.36.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.10.112.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.10.118.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.10.130.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.10.218.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.10.220.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.10.246.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.15.74.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.15.94.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.15.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.15.104.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.18.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.20.136.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.20.194.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.20.246.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.61.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.66.42.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.66.70.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.66.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.66.164.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.66.244.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.192.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.119.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.122.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.148.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.156.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"157.255.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"158.60.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"158.79.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"158.140.252.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"158.140.255.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"159.27.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"159.75.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"159.226.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.19.76.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.19.82.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.19.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.19.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.20.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.20.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.20.130.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.22.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.22.82.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.22.148.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.22.188.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.22.224.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.22.230.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.22.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.25.10.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.25.12.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.25.194.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.30.40.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.30.194.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.30.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.30.230.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.83.110.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.187.223.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.187.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.191.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.191.104.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.191.110.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.202.60.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.202.62.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.202.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.202.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.202.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.202.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.202.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.236.78.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.236.148.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.236.162.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.236.235.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.236.250.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.14.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.16.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.84.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.90.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.102.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.104.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.160.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.170.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.214.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"160.250.252.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.163.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.163.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.189.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.207.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.248.20.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.248.42.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.248.92.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.248.110.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.248.112.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"161.248.136.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.4.54.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.4.168.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.4.198.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.4.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.4.230.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.14.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.14.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.14.43.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.14.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.14.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.14.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.14.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.14.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"162.105.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.0.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.47.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.52.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.52.76.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.52.108.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.52.246.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.36.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.64.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.53.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.61.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.61.178.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.61.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.61.214.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.125.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.128.30.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.128.152.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.128.236.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.128.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.142.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.177.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.179.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.204.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.223.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.223.32.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.223.72.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.223.124.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.223.217.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.223.222.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.227.34.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.227.40.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.227.74.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.227.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.227.80.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.228.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"163.244.246.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"164.52.5.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"164.52.61.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"164.52.66.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"164.52.75.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"164.52.78.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"164.52.85.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"164.52.99.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"165.101.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"165.101.66.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"165.101.70.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"165.101.144.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"165.101.170.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"165.101.208.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"165.101.244.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"166.111.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"167.139.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"167.189.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"167.220.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"168.160.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"170.179.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"171.8.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"171.34.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"171.36.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"171.40.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"171.80.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"171.104.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"171.112.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"171.208.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"172.81.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.0.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.16.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.24.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.30.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.42.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.44.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.46.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.48.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.64.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.102.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.106.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.111.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.111.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.111.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.146.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.148.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.152.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.158.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.160.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.176.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.176.176.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.176.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.178.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.184.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.185.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.186.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"175.188.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"177.201.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"177.203.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"177.203.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"178.236.234.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"179.236.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.76.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.76.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.76.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.76.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.77.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.78.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.84.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.86.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.88.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.94.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.94.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.94.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.95.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.96.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.129.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.130.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.136.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.148.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.148.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.148.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.148.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.149.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.150.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.152.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.160.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.178.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.178.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.184.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.188.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.189.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.200.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.201.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.202.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.208.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.210.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.212.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.222.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.233.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.233.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.233.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.235.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"180.235.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.16.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.16.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.18.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.23.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.23.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.32.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.48.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.49.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.50.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.50.6.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.50.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.50.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.51.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.54.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.54.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.61.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.61.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.61.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.80.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.88.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.92.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.96.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.128.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.144.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.157.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.160.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.174.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.200.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.236.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.237.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.238.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.239.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.240.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.254.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"182.255.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.0.0.0/10"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.64.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.78.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.78.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.81.172.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.81.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.84.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.37.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.39.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.48.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.50.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.56.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.61.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.91.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.92.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.128.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.160.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.168.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.170.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.172.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.182.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.182.8.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.182.11.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.182.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.182.16.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.182.23.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.182.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.184.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"183.192.0.0/10"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"185.2.48.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"185.75.173.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"185.75.174.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"185.192.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"188.131.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.51.172.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.55.46.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.55.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.102.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.124.154.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.140.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.140.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.140.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.140.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.140.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.140.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.144.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.163.11.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.232.34.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.232.44.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"192.232.97.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"193.112.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"193.119.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"194.138.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"194.138.245.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"198.175.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"198.208.17.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"198.208.19.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"198.208.30.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"198.208.61.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"198.208.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"198.208.67.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"198.208.112.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"199.182.239.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"199.244.144.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.0.100.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.0.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.0.176.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.0.178.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.3.128.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.4.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.4.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.5.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.5.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.6.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.66.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.72.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.88.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.92.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.103.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.108.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.110.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.114.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.6.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.8.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.8.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.8.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.8.12.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.8.24.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.8.77.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.8.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.8.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.9.32.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.9.34.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.9.48.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.9.51.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.9.52.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.9.54.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.9.57.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.9.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.10.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.10.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.1.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.17.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.72.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.84.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.96.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.98.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.106.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.111.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.12.116.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.64.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.69.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.73.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.74.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.76.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.78.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.88.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.97.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.104.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.108.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.111.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.114.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.118.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.124.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.127.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.135.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.136.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.149.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.151.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.157.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.169.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.170.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.172.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.176.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.184.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.208.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.213.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.219.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.220.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.222.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.225.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.231.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.235.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.246.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.14.251.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.66.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.79.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.88.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.90.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.94.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.114.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.117.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.120.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.125.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.20.126.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.132.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.141.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.142.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.147.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.148.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.150.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.152.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.154.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.21.156.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.22.248.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.27.12.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.27.14.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.27.136.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.36.226.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.136.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.146.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.149.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.150.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.156.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.168.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.170.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.176.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.38.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.7.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.15.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.135.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.136.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.140.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.143.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.144.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.150.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.155.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.156.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.40.162.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.8.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.11.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.12.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.128.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.130.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.192.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.200.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.41.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.43.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.43.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.44.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.44.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.44.67.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.44.74.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.44.97.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.44.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.44.132.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.44.146.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.45.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.45.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.45.15.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.45.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.16.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.20.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.35.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.36.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.38.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.40.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.43.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.44.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.46.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.128.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.46.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.47.82.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.47.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.47.126.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.47.128.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.47.130.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.52.33.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.52.34.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.52.47.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.52.143.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.53.140.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.53.143.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.55.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.55.4.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.55.18.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.55.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.55.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.55.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.55.31.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.57.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.57.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.57.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.57.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.58.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.58.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.58.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.59.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.59.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.59.236.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.59.240.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.60.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.60.96.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.60.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.60.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.60.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.60.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.61.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.61.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.61.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.61.123.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.61.127.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.62.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.62.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.62.252.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.62.255.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.63.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.63.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.63.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.63.253.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.65.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.65.8.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.65.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.66.169.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.66.170.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.67.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.69.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.69.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.70.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.70.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.70.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.71.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.72.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.72.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.72.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.73.128.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.73.240.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.74.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.74.36.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.74.42.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.74.52.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.74.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.74.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.75.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.75.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.76.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.77.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.77.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.78.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.79.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.79.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.80.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.81.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.81.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.83.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.84.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.84.16.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.84.22.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.84.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.85.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.86.249.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.86.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.87.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.88.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.89.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.89.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.89.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.89.119.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.89.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.90.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.90.37.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.90.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.90.193.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.90.196.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.90.205.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.90.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.91.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.91.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.91.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.91.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.92.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.92.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.92.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.93.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.94.74.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.94.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.94.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.95.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.95.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.95.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.95.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.96.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.112.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.120.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.122.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.122.32.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.122.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.122.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.122.132.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.123.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.123.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.123.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.124.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.124.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.125.107.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.125.109.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.125.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.125.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.40.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.127.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.129.208.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.130.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.130.39.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.130.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.131.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.131.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.131.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.133.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.134.58.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.134.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.134.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.136.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.136.72.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.136.80.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.136.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.136.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.136.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.136.255.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.137.231.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.140.140.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.140.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.141.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.142.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.143.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.143.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.143.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.143.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.143.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.143.104.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.144.196.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.144.198.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.146.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.146.184.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.146.186.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.146.188.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.146.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.146.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.147.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.148.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.148.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.149.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.149.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.149.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.149.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.149.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.149.252.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.149.255.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.150.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.150.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.150.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.150.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.150.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.151.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.151.33.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.151.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.152.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.153.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.153.7.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.153.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.157.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.158.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.158.242.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.160.140.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.160.143.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.160.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.162.67.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.162.75.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.164.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.164.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.165.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.165.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.165.239.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.165.240.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.165.243.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.165.245.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.165.251.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.165.252.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.166.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.168.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.168.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.168.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.170.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.170.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.170.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.171.216.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.171.232.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.171.235.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.172.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.172.7.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.173.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.173.6.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.173.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.173.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.173.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.174.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.174.124.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.176.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.179.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.179.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.180.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.180.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.181.8.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.181.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.181.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.182.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.182.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.189.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.189.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.189.184.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.191.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.191.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.191.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.191.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"202.192.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.10.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.24.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.42.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.45.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.46.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.82.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.90.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.96.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.114.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.122.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.128.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.130.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.137.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.142.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.144.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.146.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.148.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.150.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.152.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.177.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.0.224.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.26.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.65.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.66.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.70.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.76.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.90.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.97.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.98.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.108.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.253.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.1.254.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.73.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.126.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.140.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.150.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.156.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.160.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.180.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.196.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.209.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.214.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.229.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.2.236.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.68.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.72.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.75.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.105.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.112.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.120.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.123.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.135.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.139.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.3.143.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.132.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.134.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.151.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.152.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.174.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.180.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.186.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.205.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.227.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.4.230.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.7.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.8.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.11.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.21.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.22.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.44.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.46.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.52.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.56.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.60.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.114.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.118.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.120.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.172.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.180.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.182.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.185.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.186.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.188.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.190.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.195.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.214.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.5.218.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.6.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.6.136.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.6.138.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.6.142.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.6.150.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.6.157.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.6.159.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.6.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.6.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.7.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.7.138.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.7.147.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.7.150.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.7.158.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.7.192.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.7.200.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.8.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.23.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.25.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.70.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.82.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.86.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.91.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.110.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.115.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.166.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.169.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.173.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.184.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.190.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.192.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.197.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.198.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.203.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.209.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.210.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.212.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.217.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.8.220.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.32.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.36.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.57.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.65.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.70.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.72.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.75.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.76.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.100.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.108.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.9.158.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.10.34.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.10.56.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.10.74.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.10.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.10.88.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.10.95.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.10.125.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.70.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.76.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.82.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.84.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.100.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.109.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.117.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.122.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.126.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.141.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.142.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.11.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.16.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.19.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.24.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.57.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.65.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.66.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.70.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.91.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.93.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.95.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.100.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.103.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.114.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.118.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.130.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.137.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.211.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.219.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.226.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.12.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.24.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.44.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.88.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.173.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.224.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.227.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.13.233.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.24.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.33.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.56.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.61.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.62.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.104.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.114.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.118.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.162.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.192.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.194.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.214.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.231.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.14.246.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.20.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.22.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.88.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.105.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.112.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.114.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.119.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.130.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.149.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.151.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.174.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.227.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.240.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.15.246.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.10.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.12.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.27.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.38.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.49.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.50.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.58.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.133.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.161.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.162.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.228.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.238.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.240.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.16.245.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.28.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.39.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.56.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.74.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.88.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.136.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.164.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.187.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.190.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.231.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.233.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.17.255.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.4.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.7.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.31.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.37.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.48.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.52.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.72.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.80.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.100.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.105.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.107.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.110.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.132.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.144.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.153.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.199.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.208.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.211.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.18.215.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.1.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.24.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.30.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.36.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.39.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.41.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.44.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.46.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.58.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.60.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.64.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.68.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.72.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.101.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.111.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.133.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.144.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.147.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.149.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.156.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.176.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.178.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.208.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.233.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.242.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.19.255.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.17.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.40.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.44.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.48.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.61.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.65.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.84.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.89.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.106.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.115.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.117.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.118.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.122.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.126.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.135.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.138.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.150.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.230.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.232.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.20.236.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.8.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.10.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.33.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.34.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.41.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.44.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.68.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.82.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.124.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.136.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.145.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.21.206.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.24.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.28.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.31.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.68.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.76.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.78.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.84.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.99.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.106.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.163.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.166.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.170.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.194.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.242.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.245.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.246.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.22.252.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.47.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.61.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.62.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.73.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.85.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.98.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.107.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.112.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.130.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.140.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.172.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.182.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.192.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.197.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.198.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.224.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.249.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.23.251.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.13.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.18.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.27.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.43.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.56.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.58.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.67.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.74.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.79.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.80.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.84.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.86.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.90.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.111.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.112.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.116.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.145.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.152.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.157.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.161.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.167.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.199.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.202.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.212.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.217.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.219.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.24.244.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.19.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.20.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.46.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.64.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.91.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.99.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.100.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.106.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.135.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.138.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.147.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.153.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.154.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.164.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.166.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.174.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.180.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.182.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.191.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.199.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.200.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.229.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.235.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.236.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.25.242.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.12.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.34.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.49.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.50.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.55.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.56.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.60.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.65.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.68.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.76.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.80.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.84.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.97.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.102.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.115.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.116.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.143.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.144.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.148.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.154.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.170.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.173.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.176.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.185.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.210.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.214.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.222.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.224.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.228.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.26.232.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.0.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.10.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.15.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.16.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.20.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.22.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.40.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.45.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.53.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.65.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.66.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.88.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.102.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.109.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.117.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.121.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.125.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.200.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.202.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.233.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.241.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.27.250.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.10.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.12.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.33.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.34.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.43.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.44.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.54.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.56.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.73.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.74.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.76.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.86.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.88.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.112.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.136.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.140.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.145.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.165.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.169.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.170.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.178.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.185.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.187.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.196.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.28.239.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.8.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.13.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.14.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.28.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.46.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.57.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.61.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.69.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.73.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.90.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.95.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.100.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.103.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.112.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.120.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.182.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.187.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.189.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.190.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.205.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.210.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.217.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.227.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.231.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.233.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.234.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.248.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.29.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.16.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.25.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.27.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.29.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.66.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.87.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.111.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.121.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.123.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.152.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.156.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.162.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.173.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.175.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.187.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.194.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.217.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.220.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.222.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.232.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.235.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.240.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.246.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.30.250.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.45.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.46.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.49.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.51.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.54.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.69.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.72.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.80.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.85.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.97.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.105.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.106.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.108.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.124.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.162.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.174.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.177.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.181.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.187.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.189.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.204.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.220.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.222.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.225.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.229.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.248.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.31.253.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.20.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.48.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.56.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.60.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.62.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.68.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.76.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.81.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.84.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.95.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.102.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.105.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.130.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.133.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.140.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.152.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.186.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.192.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.196.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.203.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.204.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.32.212.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.4.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.7.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.11.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.21.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.26.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.32.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.64.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.67.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.68.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.73.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.79.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.100.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.122.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.145.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.156.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.174.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.185.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.200.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.202.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.204.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.206.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.214.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.224.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.226.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.233.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.243.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.33.250.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.4.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.21.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.27.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.39.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.48.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.54.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.56.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.67.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.69.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.76.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.92.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.106.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.113.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.147.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.150.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.152.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.161.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.162.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.187.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.192.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.195.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.198.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.232.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.240.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.242.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.245.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.34.251.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.2.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.4.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.10.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.13.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.22.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.30.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.93.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.101.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.109.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.110.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.116.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.119.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.128.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.146.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.192.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.196.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.218.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.221.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.55.224.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.1.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.4.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.12.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.24.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.38.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.40.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.46.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.48.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.51.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.52.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.54.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.68.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.82.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.84.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.95.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.110.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.121.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.161.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.169.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.172.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.175.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.183.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.185.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.187.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.192.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.198.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.201.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.208.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.210.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.214.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.216.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.227.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.228.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.231.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.232.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.240.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.252.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.56.254.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.5.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.6.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.12.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.28.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.39.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.46.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.58.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.61.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.66.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.69.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.70.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.73.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.90.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.101.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.109.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.123.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.157.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.200.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.202.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.206.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.222.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.246.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.249.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.253.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.57.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.62.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.62.131.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.62.139.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.62.161.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.62.197.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.62.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.62.234.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.62.246.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.65.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.76.160.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.76.168.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.76.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.76.216.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.76.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.77.180.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.78.48.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.78.156.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.79.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.80.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.80.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.80.57.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.80.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.80.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.80.140.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.80.142.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.80.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.81.1.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.81.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.81.5.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.81.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.81.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.82.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.82.16.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.82.20.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.82.22.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.82.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.82.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.83.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.83.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.83.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.83.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.100.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.102.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.104.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.107.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.108.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.110.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.112.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.114.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.116.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.120.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.250.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.86.254.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.88.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.88.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.89.8.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.89.13.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.89.14.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.89.133.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.89.136.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.89.144.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.90.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.90.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.90.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.91.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.91.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.91.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.92.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.92.6.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.92.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.93.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.94.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.95.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.95.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.95.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.95.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.95.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.95.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.99.8.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.99.12.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.99.14.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.99.16.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.99.19.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.99.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.99.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.99.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.48.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.53.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.55.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.58.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.60.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.63.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.100.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.104.32.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.105.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.105.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.69.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.70.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.107.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.110.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.110.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.110.232.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.110.234.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.114.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.114.244.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.118.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.118.241.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.118.248.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.24.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.80.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.83.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.85.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.113.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.114.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.121.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.122.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.126.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.119.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.123.58.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.128.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.128.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.128.225.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.128.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.128.228.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.128.231.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.129.8.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.129.10.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.129.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.130.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.132.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.134.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.135.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.135.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.142.219.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.142.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.144.96.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.144.100.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.144.102.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.144.106.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.144.108.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.144.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.145.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.148.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.148.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.148.80.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.148.86.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.149.92.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.152.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.152.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.153.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.156.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.158.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.160.104.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.160.129.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.160.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.161.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.161.183.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.161.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.166.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.167.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.168.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.170.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.171.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.171.208.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.171.224.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.174.4.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.174.6.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.174.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.175.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.175.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.176.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.176.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.176.168.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.184.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.185.189.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.187.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.189.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.189.6.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.189.112.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.189.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.189.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.190.96.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.190.249.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.191.0.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.191.2.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.191.5.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.191.7.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.191.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.191.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.191.133.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.191.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.192.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.193.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.194.120.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.195.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.195.112.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.195.114.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.195.116.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.195.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.196.0.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.196.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.201.181.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.201.182.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.202.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.130.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.132.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.148.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.152.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.154.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.156.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.158.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.176.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.189.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.190.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.208.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.216.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.225.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.226.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.228.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.205.240.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.207.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.207.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.208.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.209.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.212.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.212.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.215.232.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.217.164.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.223.16.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.223.21.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"203.223.22.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"206.109.70.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"206.109.75.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.2.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.5.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.5.56.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.5.58.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.5.60.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.5.128.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.7.56.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.12.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.14.64.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.14.112.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.14.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.15.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.15.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.16.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.21.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.22.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.23.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.25.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.26.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.28.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.32.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.51.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.52.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.56.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.72.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.76.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.78.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.79.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.79.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.82.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.87.72.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.87.114.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.87.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.185.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"210.192.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.64.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.80.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.96.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.98.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.99.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.99.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.99.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.100.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.102.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.102.128.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.102.144.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.102.160.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.102.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.103.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.136.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.144.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.148.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.149.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.149.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.149.64.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.149.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.149.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.149.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.150.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.152.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.152.128.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.152.144.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.152.150.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.152.152.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.152.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.152.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.153.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.154.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.155.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.155.66.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.155.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.155.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.155.80.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.155.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.155.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.155.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.155.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.156.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.160.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.164.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.166.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.167.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.167.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"211.167.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"212.64.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"212.129.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.0.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.16.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.24.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.28.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.0.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.32.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.36.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.38.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.40.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.45.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.46.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.48.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.56.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.60.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.30.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.31.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.56.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.64.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.96.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.97.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.97.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.97.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.98.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.100.88.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.100.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.100.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.104.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.108.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.185.192.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.185.240.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.185.242.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.185.244.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.185.246.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.192.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.240.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.244.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.246.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.247.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.247.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.247.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"218.249.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.72.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.82.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.83.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.90.68.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.90.72.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.128.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.216.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.224.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.232.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.234.10.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.234.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.234.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.234.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.234.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.235.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.236.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.242.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"219.244.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.101.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.112.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.152.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.154.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.158.240.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.160.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.168.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.172.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.0.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.16.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.24.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.64.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.80.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.88.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.92.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.96.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.174.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.175.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.176.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.192.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.231.0.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.231.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.232.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.234.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.242.0.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.242.4.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.242.6.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.242.8.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.242.16.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.242.32.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.242.64.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.242.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.243.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.247.136.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.247.142.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.248.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"220.252.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.0.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.8.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.12.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.12.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.13.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.14.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.122.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.132.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.136.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.144.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.192.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.194.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.200.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.224.0/21"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.232.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.128.238.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.129.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.130.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.133.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.136.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.172.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.176.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.192.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.196.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.198.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.199.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.199.128.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.199.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.199.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.200.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.208.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"221.224.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.16.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.32.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.64.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.125.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.126.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.128.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.160.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.168.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.176.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.192.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.240.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"222.248.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.0.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.20.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.27.184.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.29.208.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.29.252.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.29.255.0/24"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.64.0.0/11"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.96.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.112.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.116.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.121.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.122.4.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.122.12.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.122.18.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.122.20.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.122.26.0/23"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.122.28.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.123.196.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.123.204.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.123.208.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.123.224.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.124.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.128.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.144.0.0/12"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.160.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.166.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.192.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.198.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.201.0.0/16"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.202.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.208.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.220.0.0/15"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.223.176.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.223.192.0/20"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.240.0.0/13"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.248.0.0/14"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.252.128.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.254.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.254.160.0/19"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.254.192.0/18"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.255.0.0/17"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.255.236.0/22"}},{"action":"direct","match":{"kind":"ipv4CIDR","value":"223.255.252.0/23"}}],"schemaVersion":2}
diff --git a/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/LICENSE b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/LICENSE
new file mode 100644
index 000000000..f42c4c20c
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Loyalsoldier
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/LICENSE-v2fly b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/LICENSE-v2fly
new file mode 100644
index 000000000..1f086538b
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/LICENSE-v2fly
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018-2019 V2Ray
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/NOTICE b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/NOTICE
new file mode 100644
index 000000000..fb218a438
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/NOTICE
@@ -0,0 +1,19 @@
+geolocation-cn rule snapshot
+============================
+
+Upstream: Loyalsoldier/domain-list-custom geosite.dat 20260925234224
+Upstream URL: https://github.com/Loyalsoldier/domain-list-custom/releases/download/20260925234224/geosite.dat
+Upstream archive SHA-256: db12e746ef387c34c9e1be8194d772a0606ef09c236815555af5ba2595f3741f
+
+Based on v2fly/domain-list-community data. The upstream geosite.dat export of
+domain-list-custom already omits @ads and @!cn attribute rules from
+geolocation-cn; this distribution consumes that filtered export.
+
+License: MIT
+
+geolocation-cn derived from Loyalsoldier/domain-list-custom geosite.dat
+20260925234224 (based on v2fly/domain-list-community). The upstream export
+applies domain-list-custom attribute filtering (@ads and @!cn omitted).
+
+This list is candidate routing data. It is not a guarantee of network
+reachability, geographic ownership, or privacy.
diff --git a/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/manifest.json b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/manifest.json
new file mode 100644
index 000000000..6e52f1ba9
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/manifest.json
@@ -0,0 +1,8 @@
+{
+  "converterVersion": "2.0.0",
+  "name": "geolocation-cn",
+  "snapshotSHA256": "c3157d61e7bb25f39486974a937c97967872ffe82d79e91364ee5db5022e7f39",
+  "upstreamArchiveSHA256": "db12e746ef387c34c9e1be8194d772a0606ef09c236815555af5ba2595f3741f",
+  "upstreamURL": "https://github.com/Loyalsoldier/domain-list-custom/releases/download/20260925234224/geosite.dat",
+  "upstreamVersion": "20260925234224"
+}
diff --git a/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/snapshot.json b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/snapshot.json
new file mode 100644
index 000000000..d5bb15ac2
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/geolocation-cn/snapshot.json
@@ -0,0 +1 @@
+{"lossReport":{"absorbedCount":1138,"convertedCount":4241,"rejected":{"invalidDomain":6},"skipped":{"regexp":3}},"metadata":{"attribution":"geolocation-cn derived from Loyalsoldier/domain-list-custom geosite.dat 20260925234224 (based on v2fly/domain-list-community). The upstream export applies domain-list-custom attribute filtering (@ads and @!cn omitted).","converterVersion":"2.0.0","fetchedAt":"2026-10-02T18:17:27Z","inputDigest":"db12e746ef387c34c9e1be8194d772a0606ef09c236815555af5ba2595f3741f","license":"MIT","source":{"kind":"geolocation-cn","label":"geolocation-cn","upstreamVersion":"20260925234224"},"upstreamReference":"20260925234224"},"rules":[{"action":"direct","match":{"kind":"domainSuffix","value":"cn"}},{"action":"direct","match":{"kind":"domainExact","value":"api.blipsandchitz.me"}},{"action":"direct","match":{"kind":"domainExact","value":"ctdsb.clouddiffuse.xyz"}},{"action":"direct","match":{"kind":"domainExact","value":"hellofontpreview.oss-cn-beijing.aliyuncs.com"}},{"action":"direct","match":{"kind":"domainExact","value":"hellowebfonts.oss-cn-beijing.aliyuncs.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p3-novel.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p6-novel.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"end-api.shallow.ink"}},{"action":"direct","match":{"kind":"domainExact","value":"end.shallow.ink"}},{"action":"direct","match":{"kind":"domainExact","value":"study.163.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p1-juejin.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p2-juejin.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p3-juejin.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p4-juejin.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p5-juejin.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p6-juejin.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p7-juejin.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p8-juejin.byteimg.com"}},{"action":"direct","match":{"kind":"domainExact","value":"p9-juejin.byteimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mgtv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fnjiasu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baicaf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cpicfunds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daikuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dulupay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"helipay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hsqh.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iboxpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"joinpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"keruyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lehuipay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lianlian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lianlianpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lufax.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lufaxcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rong360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qudian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shfft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shouqianba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wosaimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"100ycdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"admincdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cravatar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenpai.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"windfonts.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wpcy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baijiayun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cjjd19.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fdcyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mingyuanyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mypaas.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zjzsa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"myypark.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jikeiot.cloud"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jsdmirror.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaipuyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhonshian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaipuyun.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pkoplink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"suufun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"suu-fun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yisu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zstatic.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhizhuma.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinamcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cjyun.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"topthink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"newaircloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"quklive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rainyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ronghub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"szhdy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thefastfile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thefastimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51selling.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aigefurniture.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aihuishou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"appsimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"appvipshop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vipstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"azz.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"btghotels.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bthhotels.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"homeinns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cncn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"didachuxing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"didapinche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dmall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dmallcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"soufun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"soufunimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feiniu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fn-mart.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zgzsa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"findlawimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geilicdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weidian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goofish.pro"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hualv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huazhu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huazhucorp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hworld.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huotan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinjiang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zgxytc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinjiangonline.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jjtravel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jmstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jumei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kongfz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kfzimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kujiale.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hangzhouyq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"linkheer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lawtimeimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lbdj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lingxing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lumiai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"manmanbuy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maxonesoft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meiwulist.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nbdeli.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ozonbigsell.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pupuapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pupumall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qyer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qyerstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ruseer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51sole.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"solepic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"to8to.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuniu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuniu.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuniucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucppt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiamai.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiujiadian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yaduo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuge.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ziniao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"178linux.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"antpedia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anywlan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinadsl.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinafix.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chiphell.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chongbuluo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"erji.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ezpro.pro"}},{"action":"direct","match":{"kind":"domainSuffix","value":"itpub.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"itsk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jandan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kanxue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kdslife.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"klpbbs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mcbbs.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"netbig.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pcbeta.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianya.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"touying.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"txrjy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uiwow.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wuyou.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"znds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51cto.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"edgemonix.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"monika.love"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cdnmama.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"423down.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acwifi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"appinn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chongdiantou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ghxi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iplaysoft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moyubuluo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"upe.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"winos.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"39.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ahfda.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxycdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"boohee.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chaonei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chunyu.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chunyuyisheng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haodf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hdfimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jkzlrs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yihu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yihuimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jsehealth.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"39yst.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mfk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaoshou.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaoshoucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mingxuan.store"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sxyygh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenwo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wkimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xywy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xyxy.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yayi360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhongliujie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acftu.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aizgtc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fnrrc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aitcfw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"robomaster.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"skypixel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sqqmtj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"djiservice.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"airchangan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"airguilin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ceair.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ch.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"china-sss.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"springairlines.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaexpressair.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csair.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"flycua.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gxairlines.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"djiops.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jdair.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juneyaoair.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"luckyair.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shenzhenair.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sichuanair.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianjin-air.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"djiits.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"urumqi-air.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiamenair.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"djigate.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"djicdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ruubypay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sctcd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sptcc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shenzhentong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"snowballtech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dji.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dji.ink"}},{"action":"direct","match":{"kind":"domainSuffix","value":"umetrip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uucl.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"variflight.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ccrgt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uslk.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gtgjtrip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuajing84.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mygolbs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ningtingche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zzdtec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guoxuedashi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guoxuemi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lubiao.wiki"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sckg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wkepu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zgbk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zyh365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"160.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"53kf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"7moor-fs1.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"7moor.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"air-matters.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"alookweb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anixplayer.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"antutu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"antutu.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"appchina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yingyonghui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"asklib.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unaming.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bblmw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bosszhipin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhipin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"caoliao.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"clewm.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cli.im"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chuimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiachufang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dangbei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dangbei.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dcloud.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unaming.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"deepepg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kookong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dida365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"digitaling.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douguo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douguo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duanshu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dui88.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"easyliao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"faceid.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"finclip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"foundertype.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fxbaogao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gongxiangjizhang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hapjs.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lbtp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uhasadmin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lebo.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hwwlyz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"i8tq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ugslb2.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ugslb.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weatherdt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iguopin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ireader.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhangyue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhangyue01.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhangyuecdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jobui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meishichina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meishitx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaotixing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moseeker.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ntalker.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"paidui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ugslb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sencdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"seniverse.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shixiseng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sxsimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoyuanzhao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sobot.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"soboten.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tacool.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianqistatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"viayoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weimob.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weimobdc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenjuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xbext.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yinxiang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunpian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yupao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yupaowang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zaih.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhaopin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zmtqsh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuimeitianqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ewdcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"webterren.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"95598pay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"echargenet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ugslb.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ugslb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"poweremarket.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ufileos.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"winxuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"winxuancdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xhmedia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xhsd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xhsdzd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinhuashudian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51togic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"avlyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dreame.tech"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uewaf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ibaotu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"insta360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jamcz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jmgo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mediastory.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucnaming.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"roborock.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucnaming.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shipin520.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"socpk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"suzuki-china.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucnaming.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ysjf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunxi.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"allday.work"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cangpeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"erp198.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anquan.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hackernews.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"knownsec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunaq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudufile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ishijue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vcg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vcgapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cvte.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maxhub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"seewo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daotudashi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xunjiepdf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fnnas.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fnnas.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fnos.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gongniukaiguan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gugudata.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"2345.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"2345.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"2345cdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hao774.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huaban.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huabanimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dancf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hlgdata.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huanleguang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudstor.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juziwulian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaadas.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ugnas.cloud"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ugnas.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ninebot.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"segwayrobotics.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"onedns.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shellpub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"threatbook.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58pic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiantucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"saicmobility.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"skyworth.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"skyworthdigital.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaolachuxing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinpianchang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xpccdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baimiao.tech"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baimiaoapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shinescan.tech"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xgzb.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anytocopy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"osbdf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"boce.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chaziyu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fofa.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"icplishi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ip138.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ipchaxun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ipchaxun.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ipplus360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ipshu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ipshudi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iwangding.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rdnsdb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shipxy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tol.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youbianku.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51kim.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuye.kim"}},{"action":"direct","match":{"kind":"domainSuffix","value":"6-u.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cilisouou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jigecili.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wsjqnmmrmv.world"}},{"action":"direct","match":{"kind":"domainSuffix","value":"imsyy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"infinitynewtab.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"inftab.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jgtab.link"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kekeniu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moulem.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qzhuye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chugou360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ycrx360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"0123456789.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"0379home.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"055110.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"05sun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"0759job.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"100bt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"100offer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"11467.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"114chn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"114piaowu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"114shouji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"119you.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123juzi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123juzi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123u.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"1637.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"16888.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"16rd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17989.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17house.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17van.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"19yxw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"1nongjing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"1ting.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"1zhe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"20130123.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"2265.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"2288.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"258.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"25mao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"263.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"289.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"2cto.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"2dfire.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3000.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"310win.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"315che.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3234.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"32r.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3322.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3387.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"33lc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3454.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3456.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"35.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3533.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360aiyi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360jq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360zhyx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"365azw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"365dmp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3733.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3d66.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3dwhere.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3h3.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3yx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"40407.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4paradigm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"500.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"500d.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"50bang.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"510you.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51credit.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51eshop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51gaifang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51hejia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51jingying.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51kandianshi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51meishu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51yes.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5253.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"52hxw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"52jiawei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"52miji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"52muban.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"52pk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"52youzai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"52z.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"55.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"55555.ink"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5577.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"55bbs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"56tvc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5bite.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5ddd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5fun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5gzm.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5khouse.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5you.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"66wz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"68h5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"714.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"7230.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"72byte.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"7down.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"7po.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"7sef.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"7x24cc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"7xdown.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"818ps.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"8264.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"84399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"885.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"8m2.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"900.la"}},{"action":"direct","match":{"kind":"domainSuffix","value":"900cha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"917.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"91danji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"91shenfan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"95508.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"9553.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"962.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"9718.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"99166.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"998.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"998tool.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"999d.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"99danji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"9ht.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"9xu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"a9vg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acetaffy.club"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acepanel.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acgdraw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"adhuanxiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"adosmo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"adxvip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"afeica.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"afzhan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"agrantsem.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aidream.website"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aiemy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aigodlike.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aiketour.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aiops.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aipai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aiskycn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aizhan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aldwx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"alittle-tea.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"allyes.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anfensi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anruan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anvnjmc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anycubic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aotrip.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aoyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"apk3.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"apk8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aplaybox.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"appracle.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"arpun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"atticus.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"awstme.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"babytree.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"babytreeimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baidufree.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baifendian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baixing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baixing.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baiyishequ.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bamenzhushou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bangongziyuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baoxianshichang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"batchat.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bearychat.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"beihaidc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"beijing-lipin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bendibao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bengbeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"benmi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"berui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bestopview.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biancheng.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biaoda.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bibaodao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bidchance.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biddingx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bihu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bio360.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bio4p.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bio-equip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biodiscover.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bishijie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bitecoin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bjcathay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bobo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bochaai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bojianger.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bokecc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"boosj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bowenkj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"boyuemobile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"btgtravel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bvmlt.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cabbagebox.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"caijingwu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"caiyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"canghaiip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cardbaobao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"carnoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cdut.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cecdc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cecport.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"centanet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cerambath.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cg3da.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chachaba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"changba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chaojituzi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chashebao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chazhengla.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chazidian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"che168.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chememall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chessease.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"china-chair.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"china-nengyuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinacache.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinacache.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinachugui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinadongchu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinafph.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinakaoyan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinalawedu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinapp.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinapubmed.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinasspp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinatranslation.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaunix.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaweiyu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinawutong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinazns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chouti.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chuangxin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chuansong.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chuansongme.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chujingapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chushi.cool"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chushou.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chuyu.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"city8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cjol.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"clangcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"clouddn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudxns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnanzhi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnepub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnlaw.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnppa.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cocodiy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"code666.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"codeloop.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cofeed.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coffee-iot.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cofool.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coindog.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"comfylink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cone-x.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"contentchina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coros.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cpppf.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cr173.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"crsky.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csbew.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csmjzs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csqaq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csslcloud.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctiforum.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctsbw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cubead.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cwxzx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cyagen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cybtc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cydiabc.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cyts.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dadajiasu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dadighost.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daguzhe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dajiabao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dajie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dajieimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dalongyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"danji100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"danji6.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daocloud.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daocloud.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daovoice.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dayukaoshi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dazijia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dcdkjx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dd373.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ddooo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ddzn.tech"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dedecms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"deepinos.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"develenv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dginfo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dgphospital.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dianchacha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"diandian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"diandianqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dianwannan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dingxiang-inc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"diopic.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"divoiotcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"diyiyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dj99.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dockerone.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dockone.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dogedoge.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dongao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dongguantoday.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dopa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dothantech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douxie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"downcc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"downxia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"downyi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dreams-travel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"drvceo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duomai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duoshuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duote.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxpmedia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dyhjw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dzdvip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dzsc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dzw3.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eagsen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"easesale.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"easiu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eastsoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eayyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebico.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eceshi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ecjobhome.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eeyy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eflycloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"emarbox.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"emumax.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"englibrary.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"enterdesk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eoeandroid.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eolink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"erocraft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"et0731.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"excelbbx.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"excelhome.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"exiliumgf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"extfans.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"f.cx"}},{"action":"direct","match":{"kind":"domainSuffix","value":"famulei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanli.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fangxiaoer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanxian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fastapi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feiniaomy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feizhiyi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fengsutb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fengxian110.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fffff.games"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fhldns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fimmu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"finchina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fixdown.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fofuai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fqjob.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fsjiaoyubang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fugetech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"funmob.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fuwj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fxxz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fzaqjy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fzwqq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gaishitongshu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"game234.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gamepp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gaodun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gaojiua.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gaoshouyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gaoxiaojob.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gdjdxy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gdliontech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gdrc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geektool.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gei6.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gelaiyun.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gezida.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ghoxz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"giecds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gifpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"globrand.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gm86.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gmoj.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gmz88.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gobasearcher.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gold678.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"golue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gongxiangcj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"googoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goosail.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gootho.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goufw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"greenxiazai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gseen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gtags.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guabu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guaiguai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guanaitong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guanhaobio.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guanyierp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gucheng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guoxinmac.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gupzs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gushiwen.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guzhangting.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gvgoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gwdang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gxb.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gzcqs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gzjkoa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gzwanju.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"h5uc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hack520.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hackhome.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hackinn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haishun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hanboshi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"handanjob.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hangjiayun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hanqiuming888.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haojieyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haolietou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haote.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haoyouyinxiang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"halvie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hefei.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"heisha.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hellobike.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hello-inc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"henha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"henkuai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"herostart.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hezuvip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"higgsweb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hiido.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hijin.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hiocloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hiyd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hktheone.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hn-cbec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hnchasing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hnrcsc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hnyuyuhui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hollycrm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"homekoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hongsanban.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hongyuanqh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"houdao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"houyuantuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hprtupgrade.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hteacher.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huashengdaili.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huize.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hujia.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huochepiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huocheso.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hwbim.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hwzuku.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hxfy888.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hxsd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hybiome.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iask.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ibuychem.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"icaidao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ichangtou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"idazhe.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"idongdong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ifengmap.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"igpsport.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ijiandao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ijingyi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ikafan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"im2maker.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"im-cc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"imacos.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"imooc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"indeedpower.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"indienova.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"infini-fantasy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iposl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iranshao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"irs01.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"istoreos.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"it165.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"it610.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"itjuzi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"itmop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iyiou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iyunmu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jb51.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jb51.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jduoduo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jfcoop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiameng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jianbihua.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiangningwater.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jianzhi8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiaodong.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiasuhui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiathis.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiazhao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiemeng8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jikexueyuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jingheiot.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinianbi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinse.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinti.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jisuxia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiucaishuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiuzhilan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jj20.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jkbl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"job5588.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"job910.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jobjm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jsrdgg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jsyks.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juefeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"julebu.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"julive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juwan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juxia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jyimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"k366.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaifubiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaijiacloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaipanhong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaixin001.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kameng98.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kantianqi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kanzhun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaopu001.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kcttpa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kejet.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"keyoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kf5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kimiss.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kingdee.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kiwiot.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kiyuu.club"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kkzj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kmeila.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kouclo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"koudai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"koudai8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kq7.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaaa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaicha888.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaihou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaiji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kudashi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kukongjian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuqin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuyiso.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lady8844.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanhuapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanyun.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"laomaotao.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"laomaotao.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lascn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lawxp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leangoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leanote.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leelen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leiting.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leju.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leturich.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lianmishu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liantu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lianzhuli.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liaoxuefeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"libaclub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lieyunwang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lightmake.site"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lightonus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"likuso.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"linkvans.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"linsn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"linuxidc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liqucn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liulanqi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liunn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liuxiaoer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"live800.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liweijia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lixinger.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lkkbrand.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"longhoo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"longmenshuju.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"longre.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"longzhu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lotpc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"loupan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"loveutips.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lsbj365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lunwengo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"luyouqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lvfapiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lvmama.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lvsexitong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lxway.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lyihub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maisanqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"manhuatai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mapbar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mashangfangxin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mayi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mayihr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mblyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mcbang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mdpda.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mechina.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"megawords.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meifang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meijian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meika360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meilishuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meimingteng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meiqia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"metax-tech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meloong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mengtuoshi.wang"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaobolive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaozhen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mifeng.plus"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mifon.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mijisou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mikecrm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"minhangshi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miusi.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miyatech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mjia.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mmbang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mmbang.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"modaiyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mofang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mofazhu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mokahr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moleecel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moocollege.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mrtdephoto.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"msanjia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mscbsc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mslmc.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mukewang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mumayi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"muomou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"muzhiwan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mydown.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mykuaidi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"myshopex.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"myshow360.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"myyx618.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"naixuecha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"neihang.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"netbian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"netzz.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"newasp.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"newbandeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"newyx.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nicezhuanye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nlyd.club"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nowscore.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nruan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nvsheng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nx-sc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nxog.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nzbdw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oadz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"officese.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oicq88.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"okooo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ol-cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ol-img.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oneapm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"onegreen.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oneyac.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"onlinedown.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"onlinesjtu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"onlylady.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"opdown.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"openevai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"orence.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oupeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ourschool.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"p2peye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"p5w.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"paipaibang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"paopaoche.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"paperang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pc6.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pcwatch.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"peccn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pgzs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pharmacodia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"piaoliang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"piedaochuan.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pingplusplus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pingxx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pintu360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pipaw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pipaw.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pixcheese.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ppt28.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pptbest.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pubyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pwithe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qc188.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qcds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qd8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qd-metro.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qh24.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiangbus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianjia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianlima.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianuni.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiaobutang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qie.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qifeiye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qijiayoudao.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingjiansoft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qinglue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingsongchou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiumibao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qizuang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qjmotorlink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qqddc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qqgexingqianming.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qqrizhi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qqshuoshuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qschou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qtmojo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qudong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qugame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qunjielong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"redenmc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rockyenglish.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"royqh.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rtbasia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ruan8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ruiwen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"runoob.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rzrc114.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"saibo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sanwen.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sast.fun"}},{"action":"direct","match":{"kind":"domainSuffix","value":"scbaijia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"scdng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"scoregg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"scratch5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"scyol.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sczsxx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"senachina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"senlinjimore.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"senmuse.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shang360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shangc.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shanghairc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shanghongbei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shangshi360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shangzhibo.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shanshuihotel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sharejs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shebiaotm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shelter-china.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shelterdome.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shengdaosoft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shenmayouxi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sheui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shijiexia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shineacc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shmetro.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shoujihuifu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shouyoubus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shssp.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuidichou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuidihuzhu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shumensy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuoshuokong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shutcm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"simei8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"simuwang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sinesafe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sjwyx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"skimit.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"skycn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sllssrq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"snimay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sofreight.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"softwhy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sojson.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"somode.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"souqian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sparkletour.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"springtour.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ssports.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"starbaby.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"starbaby.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"stkfanli.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sun0769.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sunrtb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"supermap.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"supermapcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sys321.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"szfw.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"szzfgjj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"t1y5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taihuoniao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tajiduo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"talk-cloud.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tangeche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tao123.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taoche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tcp5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"te5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tenxcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tggfl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thinkerride.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thispx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thmnet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"threep.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianlailive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianlala.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianruo.xyz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tietuku.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tiexue.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"timbrd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"timedoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tingyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"titanar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tjjt360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tmcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tmwanba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tobosu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tom.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tongdun.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tongkask.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tool56.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"touqikan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"touzid.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trjcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trunktech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trustexporter.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trustutn.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tshell.online"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ttshitu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuicool.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuiwen.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tujia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tumukaoyan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tutuapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuwan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuwanjun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tvmao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tvzhe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"u.tools"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucbug.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ugediao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uggame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ulife.group"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uoko.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"urselect.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"useso.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uuu9.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uzzf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"v5875.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"value500.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vamaker.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vanjee.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vdolady.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"veryhuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"veryzhun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vic18.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"videojj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vobao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vpgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vpsjyz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vpsvs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wangyangyang.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wannianli8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wanplus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wanwushuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wanyiwang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wanyx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"warmheart.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wdzj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weand.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weavatar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"webportal.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weicaifu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weilaicaijing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weixing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weiyangx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"welltrend-edu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"whlovehome.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wicresoft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wildfirechat.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"win007.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"win8.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"windows10zj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"windows7en.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"windowszj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"winwin7.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wishdown.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wmzhe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wnhuifu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wodingche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"womai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wondercv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wonnder.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wooyun.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wowgf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"woyaogexing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"woyoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wqiis.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wrating.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wtown.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wumii.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wuming.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wuuxiang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wuximediaglobal.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wxdw.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wywyx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"x-gpu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xafc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xbiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xboxfan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xdqtech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xdtool.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xdwan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xfdown.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiankabao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaobaixitong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaochuanyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoe-tech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaogouh5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoka.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaokaxiu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaolianhb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaomaicn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaomingtaiji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoting.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoxiongxitong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoyuxitong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiayx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiazaiba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiberia.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xingjiesj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinrenxinshi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xingtan001.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xitong8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xitu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiu8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiucai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiziwang.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xmhouse.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xnpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xopenbeta.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xpgod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xsa239.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xuanchuanyi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xue51.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xuekanba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xuexicha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xundupdf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xxrsm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xzking.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yahui.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yaolan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yaoyl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yaozh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yeepay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yh31.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yibanbianji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yigao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yigoonet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yihedoors.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yikaochacha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yikexue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yingjia360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yinhang123.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yinyuetai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yinzhaowang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yiqifa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yiqifa.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yitaifang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yiwan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yixc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yixi.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yizhibo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yjbys.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ynhr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ynsj001.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yocajr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youboy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youke.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youshang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youxiake.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youxihezi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youxila.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youxigt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youzhiyouxing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youzu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yoyojie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yoyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yrz.name"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yslyhr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ysten.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuanzhiyijiantong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunba.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yundun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunkanpan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunqishi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunshipei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunzhijia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yupoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuzua.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yxbao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yyshub.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yytcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yzcsoft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"z-tek.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"z28j.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"z6e.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zampda.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zampdsp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zctnet.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zczj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zdfans.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zgjm.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zglxw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zgzcw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhanbuba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhangyoubao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhanzhang.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhaodanji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhaokao.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhcw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhi10.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhidx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhifang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhiziyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhongancloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuangjiba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuanyewanjia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuayoukong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zixiaomao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zixuntop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zjjslawyer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zjxhedu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zllinks.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zmengzhu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"znnu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"znztv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zpb365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuhaowan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zysou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zyyct.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zzclass.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zztfly.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zzzcaculator.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zzzmap.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdcat.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdmozon.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"educoder.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trustie.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gzyowin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hitevision-solutions.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hrsecn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jslife.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jsw118.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juwinmedia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xdplt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"merach.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nanhaicorp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ozonabc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingping.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cleargrass.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qunliao.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shanxijianzhuzizhi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sxcxldjy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taichuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taichuan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vhengdata.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vxhcm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudstack.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yebinnet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sjfls6.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guokr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guokr.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"funjsq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"golink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leigodjsq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leigod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nnbooster.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"waifushangcheng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tmjiasuqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"99jiasu.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xunyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xunyou.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guaiku.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biubiu001.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"golinkapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"golinkcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"steampp.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rmbgame.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"steam302.xyz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"benfuip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gangwan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xxghh.biz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bohejiasuqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"htjsq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"htjsq.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fhyx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"akspeedy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yebaojiasu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liuxing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lxjiasu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ggkuai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuelun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gijsq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kk1.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3dmjiasu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jianshu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lorhf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oojsq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"et001.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"et-api.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudstack.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meitu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meitudata.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meitustat.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaipai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meipai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meituxiuxiu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meiyan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miraclevision.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"roboneo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"whee.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudoss.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tendcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"talkingdata.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"talkinggame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cpatrk.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"china-tower.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tower0788.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudnaming.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guazistatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yccdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"autohome.tel"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yiche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"byd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geely.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cheyisou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lixiang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaopeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nio.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"niohome.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zeekrgroup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zeekrlife.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guazi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guazi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"autohome.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"12365auto.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wkzuche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"izuche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"izuchebao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuchecdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dcarapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dcarimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dcarlive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dcarstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dcarvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dcdapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dongchedi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dongchediapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bitauto.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bitautoimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudnaming.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudnaming.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudgda.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinhuaxmt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ourl.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goodq.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haowenti.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"admin5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ahcjw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ahcaijing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anhuinews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anhuiyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"askci.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"banyuetan.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bianews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bkeconomy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianlong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"btime.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ynet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xueqiu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"snowballsecurities.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"imedao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"caixin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cankaoxiaoxi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ckxx.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cbinews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ccidcom.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"danjuanfunds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aiganggu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tfcaijing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"time-weekly.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanjinger.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jingpt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cheaa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chenshipin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiemian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"china.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"imgcdc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaaet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinabyte.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jianshu.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yesky.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chnfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cailianpress.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cih-index.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"minapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnfol.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnfolimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnhubei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hubeidaily.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnmo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnstock.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnwest.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sxtvs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cqcb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cqliving.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cqnews.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cqsjb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ifanrx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ifanrusercontent.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctdsb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctoutiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ifanr.in"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cyol.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cyol.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cztv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cztvcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cztvcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zjstv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daheapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"datasheet5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eefcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eefocus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dayoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dili360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dutenews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ifanr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yundzh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dgtle.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"donews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dzng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dzwww.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eastday.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebrun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coolbuy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"egsea.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"stcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"expreview.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fjsen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"freebuf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fromgeek.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geekbang.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geekpark.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gfan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guigu.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gxxw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"livechina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gxxmt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gztv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"heimadata.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iheima.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moonvy.cool"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ths123.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hexun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hnol.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hntv.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hndt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dianzhenkeji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huashangtop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huanqiu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huxiu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huxiucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hxnews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"icpcw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"icswb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"idcquan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"igao7.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ikanchai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"infzm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nfpeople.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iqilu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"it168.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jfdaily.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ipanda.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shobserver.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jianyuweb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"newssc.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wallstreetcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jin10.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiqizhixin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jsbc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jstv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jxpp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jztvnews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kankanews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kankannews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kksmg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"statickksmg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kanshangjie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cctv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"stdaily.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mydrivers.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"knewsmart.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"latepost.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leikeji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leiphone.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sdxjpc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miercn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"myzaker.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nanyuenews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"36linkr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"71shi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wallstcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oeeee.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ofweek.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ourjiangsu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pchome.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pchpic.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3conline.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xn--fiq53l6wcx3kp9bc7joo6apn8a.xn--fiqs8s"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pcpop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"peopleapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pingwest.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qbitai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiluyidian.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ql1d.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingdaonews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianzhan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingdaochina.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qzwb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"scgchc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sctv-tf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sctv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"secrss.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sfccn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shangyexinzhi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shedunews.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"snxw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"solidot.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sootoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"southcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"southmoney.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sspai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"stockstar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"szhk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sznews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"szpgm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"takungpao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaott.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"techwalker.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinalive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"toodaylab.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vcbeat.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"woshipm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xhby.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xilu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xn--kprv4ewxfr9cpxcc7joo6apn8a.xn--fiqs8s"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yangtse.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yzwb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ycwb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yicai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zealer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zgjtb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhichanli.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cctvpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"36dianping.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinhuanet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"36kr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"36krcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"36krcnd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinanews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaqw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnsimg.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jwview.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinmeng.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"landian.news"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lancdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"landiannews.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"landian.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"landian.xyz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"21jingji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wsoso.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fengcx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ifeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ifengimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fengedu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ifengweekly.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"6655.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cooldock.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ithome.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lapin365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ruanmei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"saayaa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"win7china.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"win8china.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuihuimai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3elife.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sohu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sohucs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"56.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"56img.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaizhan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17173.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17173cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"changyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"playcool.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yeyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yeyoucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tmtpost.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chaindd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"72whys.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"checkzeit.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tivitv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tmtsmartlife.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tmtsmartrun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fengimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weiphone.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wfdata.club"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ottcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"icntvcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cctv4g.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloudadmin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloud365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucloud-edm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucgslb.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucgslb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucgslb.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ucgslb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"u-cdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"slk1.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"me1.ltd"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ipssh.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iprdp.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ecloud-gdu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"clk1.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cdndo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"apimkt.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"narwaltech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"narwal.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sinopecsales.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sinopecgroup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sinopec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sinopec-usa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"renren-inc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"renren.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qixin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"camcard.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"camscanner.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"intsig.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"intsig.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctzcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctyunwaf1.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctyunwaf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctyuninner.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kanimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sandai.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thunderurl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xunlei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"00cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"88cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"p2cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thundercdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xycloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xycdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guangyacdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guangyapan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dangdang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17u.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17usoft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17usoft.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"elong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"elongstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ly.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"saraba1st.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"stage1st.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ihuman.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hongen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hainanairlines.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hnacargo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hnair.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"agora.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"agoralab.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"flyme.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"flymeauto.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meizu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mzres.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hlzqgs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ytzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ajzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"avicsec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ccnew.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cczq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cczq.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lufunds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cfzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cgws.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinalions.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"howbuy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cicc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ciccwm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cindasc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cjsc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnhbstock.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5ifund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csfounder.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctsec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zofund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dfham.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ydamc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xqfunds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xf-fund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxzq.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ubssdic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tongtaiamc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"swsmu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fzfinancing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"py-axa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"orient-fund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nffund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mfcteda.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"grzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gszq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gtja.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guodu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtamc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hazq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hczq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"igwfmc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sseinfo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bosera.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huayingsc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hongdefund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"htsec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huajingsec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hsfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hftfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iztzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gowinamc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jpmorganchina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jzsec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lczq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lhzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"morganstanleyhuaxin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mszq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"galaxyasset.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nomuraoi-sec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shgsec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shhxzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ftfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"swhysc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fsfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"founderff.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tfzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tpyzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"west95582.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"foresightfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wxzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xcsc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fadfunds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ykzq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hongtastock.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cryuantafund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zszq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ztfsec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"changanfunds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"99fund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"abc-ca.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bobbns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cfund108.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cthcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctxirang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctxcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctxcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctrender.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctovcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctlcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctlcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cthcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctgcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctdns.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctdcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctcdnov.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctbcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctycdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinapay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wxsbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ymbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"newupbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xa-bank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"suningbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaums.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"z-bank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yillionbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zgcbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xwbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaunionpay.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csxbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"webankcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"webank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wbweilicai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ziroom.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ziroomapartment.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hanyi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hellowebfont.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shrbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"forface3d.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wch-ic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"boe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bouffalolab.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cxmt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"elecfans.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hqchip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hqdoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hqpcb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gosinoic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"h3c.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moedu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thunis.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-3dp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tsingtengms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unicloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ymtc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unisdigital.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unisemicon.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unisoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unispc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uniswdc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"listenai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zxhgroup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iotronic.tech"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rock-chips.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"seeed.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zs-jlc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"szlcsc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sipeed.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maixhub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fa-part.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"analog.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tsinghuaic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-bbs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-cad.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-cam.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-cnc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-dfm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-drm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-ecad.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-erp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-fpc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-gw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-jh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-layout.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-pcb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-smt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc-zh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlccad.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlccam.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlccnc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlcdfm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlcecad.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlceda.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlcerp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlcfa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlcops.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlcsj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jlcsmt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lckfb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oshwhub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sanweihou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sz-jlc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kcbebank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"whccb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"psbc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"abchina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unionpayintl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yili.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"telunsu.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haidilao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hdlcdns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kiwa-tech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"heytea.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anlaiye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yyds.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"imcoming.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"imcome.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meican.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meicanstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nongfuspring.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"luckincoffeecdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lkcoffee.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"whhhealth.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuxinyc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mxbc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mxbc.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lppzimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lppz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hwwt8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yumchina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qmai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vipbcw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"517lppz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"micun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cofco.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuanghui.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinabdh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4008117117.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"brightdairy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"brighticecream.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinacow.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3songshu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"junlebaoruye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"95516.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"95516.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unionpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cebbank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unionpay.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"unionpaysecure.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bankcomm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaunionpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tctpwebankcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gio.ren"}},{"action":"direct","match":{"kind":"domainSuffix","value":"giocdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"growingio.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taikang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taikanglife.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taikangzhijia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tkhealthcare.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"szbdyd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"snodehome.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"smzdm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"smzdmimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zdmimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhidemai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"instreet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liblib.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rwkv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tapnow.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianwen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianwenai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qwen.ai"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qwenlm.ai"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tongyi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"antafu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"antaq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaomimimo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mcpworld.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"z.ai"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhipucn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kimi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoaiassist.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaibox.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hailuoai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"minimaxi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xingyeai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trae.guru"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tcwqqdy.guru"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baichuan-ai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"namiso.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaoyanai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"faxingbao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kechuangai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kling-ai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"klingai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meta.law"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiezuocat.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aispeech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dui.ai"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duiopen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"clawhub-mirror.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liblib.cloud"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liblib.art"}},{"action":"direct","match":{"kind":"domainSuffix","value":"linka2a.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yzsgo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shunjing.xin"}},{"action":"direct","match":{"kind":"domainSuffix","value":"askdiandian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"diandianlife.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"deepseek.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"deepseeksvc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coze-dns-01.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coze.email"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coze.site"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cozeapp.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cozebuild.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cozecdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cozedeploy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cozesdk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dbbuilding.fun"}},{"action":"direct","match":{"kind":"domainSuffix","value":"building.fun"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhiexa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"doubao-dev.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"doubao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"doubaocdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maoxiangai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"myparallelstory.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oceancloudapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"obriccloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"obricclouddw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pixeldance.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"api-building.fun"}},{"action":"direct","match":{"kind":"domainSuffix","value":"doudou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mcbaas.work"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mcdemo.show"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mchost.guru"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vemic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trademessenger.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"micstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"made-in-china.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"focuschina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yksdks.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tec73.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mobsdks.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hiaiabc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moonvy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ipanda.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cpiccdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianjimedia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jianshuapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"calorietech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gotokeep.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"keep.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"keepcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dutils.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aocde.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chuangcache.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chuangcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"funcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hydun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiashule.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiasule.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bootcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bootcss.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"phpcomposer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fastcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bbbcdns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dlgslb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dwion.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acadn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"flxdns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tlgslb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qbox.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiniu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiniucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiniudn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiniudns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiniup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qnsdk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qnssl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"staticfile.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"staticfile.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aicdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"upai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"upaiyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"upcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"upyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oncdp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"8686c.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cdn20.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cdn30.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cdnmg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinanetcenter.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lxdns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lxdns.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lxdns.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lxdns.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mwcdns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mwcloudcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"npsv6.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ourdvsss.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qtlcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qtlcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"speedws.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"speedws.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wangsu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wscdns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wscdns.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wscdns.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wsdvs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wsglb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wsglb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wswebcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wswebpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trpcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anmo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"djdjapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dongjiao.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dongjiaoapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"b3log.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"b3logfile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hacpai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ld246.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tongxianghuicn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lnlib.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"apabi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bjinfobank.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"blyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinabooktrading.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaxiv.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnbksy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cspro.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnsciedu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ibcet.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"medicexam.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"umajor.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vipexam.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnthinkers.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cqvip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"crggcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xuexi365.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"er07.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xxtmail.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ersjk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sbsjk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gtarsc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"htcases.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51ccd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"incopat.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lawyee.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"libvideo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"neohytung.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nmrdata.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uonline-sh.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uonline-sh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"superlib.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pkulaw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rdfybk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"resset.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hwshu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duxiu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenxin-ge.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"superlib.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yiigle.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"twscholar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnki.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chndoi.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ylike.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wf.pub"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zaifan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhihang100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5read.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xuexi365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aichaoxing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chaoxing.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chaoxing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chaoxingv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cxbiji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dayainfo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hongbo100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mndqlib.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mti100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nihaoafrica.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sslawy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sslibrary.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mob.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianyancha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jindidata.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qichacha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qcc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qichamao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinchacha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"x315.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aiqicha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wanliniu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"newniu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hupun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hecdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"heweather.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qweather.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qweather.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qweatherapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wamawama.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wiwide.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"emoriko.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tclai.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tcl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tcltech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leiniao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"my7v.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huijiwiki.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jikipedia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mbalib.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sec-wiki.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shidianbaike.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fgo.wiki"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chaz.fun"}},{"action":"direct","match":{"kind":"domainSuffix","value":"allhistory.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huijistatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moegirl.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zdic.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pwsannong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiuwen.wiki"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhijidoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"315dian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"doucang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"drp321.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"erp321.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"erp321.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jugongdan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jushuitan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jushuitan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jushuitan-inc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juxieyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"scm121.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shopss.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuiyaohuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"surerp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sursung.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jutongbao.online"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jutongbao.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"irsnp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"midea.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mideaepayuat.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"msmartlife.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"smartmidea.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ypppt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"laoban100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shengyi.ai"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shengyizhuanjia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuanbei.biz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fuwai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yctdyy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"smuszh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cd120.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cd120.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hnxzctec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ba-hospital.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenkub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feidee.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feidee.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ssjlicai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sojump.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wjx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wjx.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"beisen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"beisenapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"beisencloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"beisenpaas.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bsurl.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhiye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gree.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"greeyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kinghomechina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhlyen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenkeju.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taodocs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovomm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cftsupport.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ileapcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovocloudos.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovoeservice.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lxzjjt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thinkcloudlab.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thinkpad.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovopoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovofile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"filez.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bestrhy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lecoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"blurdev.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lx.run"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fm365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juhuiwan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"thinkprinter.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juhuiwan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenauth.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovogame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chainedbox.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovoprinter.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lx.pub"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovomobile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovonetapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dayin8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovoimage.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovoprinter.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"safewk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"renrendoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lazyer.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinchutou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haohaodoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goldhoe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"docin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"doc88.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daodoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"book118.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"linakesi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lazycat.cloud"}},{"action":"direct","match":{"kind":"domainSuffix","value":"heiyu.space"}},{"action":"direct","match":{"kind":"domainSuffix","value":"polyv.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"videocc.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vaptcha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vaptcha.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hf-aw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huafengaw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weathercn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vancl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vanclimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vcimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"178.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ngabbs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ngacn.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51job.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51jobcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yingjiesheng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yingjiesheng.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"badou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianpeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zbj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zbjdev.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zbjimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhubajie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nubia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"redmagic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ztedevices.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ztemall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ztems.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"777ppt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frontwize.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingcache.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingstor.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"routewize.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunify.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wss.zone"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123278.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123294.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123624.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123641.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123842.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123860.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123912.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123952.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123957.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123pan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123panpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cowtransfer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctfile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feimaoyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jianguoyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cowcs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"c-t.work"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aliyundrive.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"share123.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weiyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aliyundrive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunpan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baidupan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ilanzou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzoup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanrar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzoub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzoue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzoug.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzoui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzoul.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzoum.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123254.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanosso.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzous.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzout.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzoux.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzov.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"woozooo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenshushu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenxiaozhan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenxiaozhan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wss.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wss.email"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wss.ink"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wss.pet"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wss.show"}},{"action":"direct","match":{"kind":"domainSuffix","value":"123245.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lanzouo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"115.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"115cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"115cdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"115cloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"115cloud.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"115img.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"115meta.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"115vod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"116cd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"116cd.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anxia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sq.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"alicloudccp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"alipan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aliyundrive.cloud"}},{"action":"direct","match":{"kind":"domainSuffix","value":"52ppt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51wendang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51pptmoban.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360doc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"1ppt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51ping.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dianping.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dpfile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maoyan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meituan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meituan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mtyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sankuai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"100.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ddcorp.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ddfresh.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ddimg.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ddmaicai.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ddmc.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dduser.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ddxq.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"imaicai.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ehaier.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haier.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haier.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haiersmarthomes.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kingsoft-office-service.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kingsoft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ks-live.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ksmobile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ksord.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ksosoft.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kcdnvip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ks-cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ks-cdn1.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ksyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ksyuncdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ksyungslb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cheetahfun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cmcm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cmcmcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhhainiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"drivergenius.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duba.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ijinshan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"keniu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuanqidesk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"seasungames.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"seasunwbl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xishanju.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xoyo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xoyocdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cbjq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wps.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wpscdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kimxz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51dzt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iciba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"docer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wpsmail.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"papocket.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mogu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mogucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mogujie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coolab.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ubuntukylin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"openkylin.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coding.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coding.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnb.cool"}},{"action":"direct","match":{"kind":"domainSuffix","value":"8btc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bystack.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chainnode.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"matpool.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"matpool.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"asklink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feihengip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oray.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oray.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"orayer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"orayimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sunlogin.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"privateapi.xyz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"todesk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nlark.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuque.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shimo.im"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shimonote.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tower.im"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tritoninfo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiumi.us"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiumius.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"worktile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xedge.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"glxcc.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xn0.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ganjiangvpn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wolai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wol.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hisense-home.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hisense.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hisensehitachi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hisensekf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hismarttv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juhaokan.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"95015.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianxin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianxincdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"seclab.online"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianshucup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weui.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weixinbridge.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tieba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baihe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dandan818.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dandanvoice.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duoduo.link"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uboxs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanfou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"immomo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"momocdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"izuiyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuiyou.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiayuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianliaowang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qlchat.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tancdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tantanapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uneed.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uneedx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zastatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhenai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zsxq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douban.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douban.fm"}},{"action":"direct","match":{"kind":"domainSuffix","value":"doubanio.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ivwen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"meipian.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jike.city"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jikecdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"okjike.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"okjk.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ruguoapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhihu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"laiyagushi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vzuu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coolapk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coolapkmarket.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"coolapkmarket.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gracg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hupu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hupucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wegamedeveloper.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tjstats.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lianjia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ljcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"beckyroom.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bkzhibo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ke.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnsuning.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"suning.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"suningcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"suningestate.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"suningholdings.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"afdian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"afdian.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"afdiancdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ifdian.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"geetest.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hik-cloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hik-express.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hikiot.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hikmall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hikvision.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eziot.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ezviz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ys7.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399wanju.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-dad.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yeshen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aisee.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"atianqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cibn.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cibntv.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"172mix.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17k.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"1958xy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51zmt.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"6rooms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"b612kaji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kajicam.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baofeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baofeng.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baozou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baozoumanhua.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bemanicn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bgwxc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bsbsb.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ccw.site"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cdkeynogap.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"colorv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"diyring.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuyin123.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuyinxiu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuyinyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dmzj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"muwai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dongdianqiu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dongqiudi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duoduocdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhibo8.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhibo8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"faloo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fengniao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"img-space.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goka.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haidubooks.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"heiyan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"heiyanimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hongshu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hotread.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huajiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ituchong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuchong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jjwxc.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kjcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kujiang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"laifeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"1905.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"m1905.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mamecn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"manmankan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mfuns.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaopai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"motie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"motieimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mtime.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pearvideo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qqtf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rrmj.plus"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rrsp.app"}},{"action":"direct","match":{"kind":"domainSuffix","value":"v3mh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qwapp.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qwdjapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yichengwlkj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sfacg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuhai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tadu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaikanmanhua.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vsread.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xcz.im"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xczim.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinlishumeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xyys.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xzw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yamibo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yiyouliao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youxibao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youxiniao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yxdown.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhanqi.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhulang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zongheng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"18183.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3dmgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ali213.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cgames.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chuapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dataeye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kkmh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gameres.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gamewower.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gcores.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wtzw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nadianshi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"quehu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sgamer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shoutanjjj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youxichaguan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youxiputao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youxituoluo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"accxiaoheihe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chat.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"max-c.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maxjia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"activity-zhendingtech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"changdunovel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqiecopyright.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqienovel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqieopen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqieopenpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqieopenstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqieopenvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqiesdk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqiesdkpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqiesdkstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanqiesdkvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fqnovel-op.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fqnovel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fqnovelim.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fqnovelop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fqnovelpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fqnovelstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fqnovelvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fqopenplatform.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ihaohaoxuexi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"muyewx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"novelfm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"novelfmpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"novelfmstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"novelfmvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qznovel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qznovelpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qznovelstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qznovelvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gamersky.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eckwai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ecukwai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gifshow.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"inkuai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"inkwai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ksapisrv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kskwai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kspkg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaishou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaishouapps.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaishoupay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaishouzt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kwaicdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kwaishop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kwaixiaodian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kwaiying.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kwaizt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kwimgs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mojidoc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"viviv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wskwai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wsukwai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yximgs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ac.fun"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acfun.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acfunchina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acfunchina.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aixifan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"le.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leautolink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lecloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lecloudapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lemall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"letv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"letvcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"letvimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pplive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pptv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"61.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taomee.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ddmogo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"igetget.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"luojilab.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mogoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"saolife.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"umiwi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fspcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fun.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"funshion.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"funshion.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ibidian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qmniu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"1kkk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cdndm5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dm5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dm9.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gmanhua.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hkmanga.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"manben.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"manbenapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"manhuaren.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingting.fm"}},{"action":"direct","match":{"kind":"domainSuffix","value":"13a.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"natfrp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-air.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-all.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-arm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-bag.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-bid.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-dog.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-egg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-era.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-fan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-fee.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-fog.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-fox.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-gas.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-gym.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-hat.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-hen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-hip.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-hub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-ice.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-jar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-key.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-kit.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-lab.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-leg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-mad.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-mix.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-mom.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-nut.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-one.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-own.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-pen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-rug.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-run.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-say.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-shy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-sun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-tag.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-act.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-any.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-bar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-box.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-boy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-bus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ldmnq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-end.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-fun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-gap.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-net.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-now.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-off.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-oil.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-put.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-rib.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-sea.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-six.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frp-ski.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"91q.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dmhmusic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"showstart.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"taihe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"th-music.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yingxiong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"37.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"37wanimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"7k7k.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"9xgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"astral-vector.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mhystatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cgyouxi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duoyi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duoyiwangluo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ygduoyi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feihuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"forevernine.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fxt365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gameabc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gamemei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"happyelements.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leyuansu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"heavenlywind.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"laohu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wanmei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wmupd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ledu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"longtugame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"morefreegame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuyoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"papegames.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sdo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shengqugames.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zjshulong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tanwan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"twyxh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tgpro.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tgprocs.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"winegame.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wo1wan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ycgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3304399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3304399.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3839.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3839app.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3839app.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3839img.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3839pay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3839pic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3839vc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3839video.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399api.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399api.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399biule.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399dmw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399er.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399hdhh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399hhh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399inc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399mail.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399pk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qm989.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vrzwk.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lsplayer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399youpai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399youxi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399yyy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5054399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5054399.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5wyxi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"71acg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"71acg.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"abdf002.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"appeeres.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"buke999.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bx1k.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"edu4399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"funnycore.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guoping123.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haohaowan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"i3839.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ihykb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"img4399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mail4399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maindown4399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"me4399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"my4399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mysiteres.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nzsiteres.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qq163.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qq163.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuer123.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wanwan4399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"we4399.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"webgame163.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youba.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yxhapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yxhhdl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yxhimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bilibiligame.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bilibiligame.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biligame.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biligame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biligame.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cowlevel.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cdncl.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tiancity.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tiancitycdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aligames.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiaoyimao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lingxigames.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hero.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"herogame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"heroesports.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shyxhy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"66rpg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"37wan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"3839apk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mihayo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mihayou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mihoyo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mihoyocg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mihoyogift.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mihoyomall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miyoushe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"benghuai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bh3.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bhsr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"themisweeps.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuanshen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juequling.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"videoxiaoyouxi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wegame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gameloop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gcloudcs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gcloudcstest.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gcloudcstestonly.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gclouddolphin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gcloudsdk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gcloudsvcs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yxdmgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goto-game.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goto-game.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goto-game.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"happyhlddz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hdyxgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hkgcloudcs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ihappystudio.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"in.th"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ludoworld.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mahjongai.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"battlecare.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mahjongcup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mahjongcup.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"metalrevolution.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"midasbuy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nagcloudcs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"proximabeta.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pubghelper.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pubgtool.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qqgameapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rmwxgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"syxlgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tencent-gcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tencentstart.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"texasholdemcup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"texasholdemcup.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"timibase.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gameitop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gdtimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yxwsgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yzyxgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zcjbgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuoyuegame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nextstudios.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nextworkshop.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mszdld.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mszdld.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gamebonfire.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ffbuddy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gotolink.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17roco.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gtgres.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"realcybertron.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wcbygame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anticheatexpert.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tcfmglobal.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bcfmglobal.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wegameplus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"codm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sl916.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399swf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vrzwk.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vrzwk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuoyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yokaverse.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dobest.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"langrenclub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sanguosha.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xhlsgs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinwuji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qimao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiuyue919.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4399sj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wasu.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hzman.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hzdtv.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gzlzfm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lizhi.fm"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lizhifm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lizhiinc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lz310.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lzpipi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aliwx.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ishuqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"newstjk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuqi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuqiapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuqiread.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuqireader.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shuqistat.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sqreader.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugou.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xmcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ximalaya.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lrts.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mting.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wting.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qqmusic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tingmall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanxingliveshow.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kgimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tencentmusic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ktv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"97ting.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugouaudio.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugouipv6.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugoukid.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugouliveshow.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugouringtone.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugousenior.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugoustore.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugouvoice.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kugouyouth.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"koowo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"edgesrv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyutv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyuscdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yystatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duowan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dwstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bestvcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bestvcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vgtime.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ciweimao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hbooker.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuangxiangit.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dtstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duitang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ku6.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ku6cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ku6img.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huya.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"msstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xyzfm.space"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xyzfm.link"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xyzcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoyuzhoufm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"podcast.xyz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gitv.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hifuntv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hitv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hnbntv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hunaniptv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hunantv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"imgo.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"linkflowtech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tgbus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aamgame.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aamgame.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aamgame.mobi"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aamsmart.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"singworld.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"activity-wbsj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aihst8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"amemv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"amemv.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"awemeughun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"awemeuglang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"awemeugsoul.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"awemeugwave.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"boxdouyin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cookicut.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinact.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinact.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyincdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinfe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinliving.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinmusicpromotion.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duoshan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshancdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshangroup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshanimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshanlive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshanparty.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshanstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshante8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshanvideo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshanvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshanxiaoshipin.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshanzhibo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huoshanzhibo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hypercachenode.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"idouyinliving.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"idouyinpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"idouyinstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"idouyinvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iesdouyin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iesdouyin.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ieshuodong.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ihst8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ihuoshanimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ihuoshanlive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ihuoshanstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ihuoshanvod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nextvid.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ppkankan01.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qishui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"supercachenet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"supercachenode.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ultracachenode.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"woaihuoshan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wohst8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyinpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ulpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lifexue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"open-douyin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyu.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"douyu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tencentcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tencent.design"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tencent-cloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qqgamedesign.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qq.design"}},{"action":"direct","match":{"kind":"domainSuffix","value":"openmidas.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gitee.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gitee.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oschina.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xitu.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"apifox.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baltamatica.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baltamatica.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"juejin.im"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huaweiapaas.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"owsgo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hisilicon.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hikunpeng.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebtrust.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebscn-am.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eb-ind.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebasset.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebchina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebchinaintl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ceblease.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebfortune.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sunlife-everbright.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebfcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ebscn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"everbright.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"secec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"saasops.tech"}},{"action":"direct","match":{"kind":"domainSuffix","value":"airnut.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moji001.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moji002.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mojicdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mojichina.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnmstl.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fofa.so"}},{"action":"direct","match":{"kind":"domainSuffix","value":"t00ls.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"t00ls.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tools.team"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pddcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pddim.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pddpic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pddugc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pinduoduo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pinduoduo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yangkeduo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mihuashi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"caiyunai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"caiyunapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"caiyuncdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"colorfulclouds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"colorfulclouds.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaomengai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"95504.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"95504test.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hikunpeng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gneec7.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"openinstall.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhimgs1.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"woxihuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360-jr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360chou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360daikuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360huzhubao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360jie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360jinrong.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360kan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360kuai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360os.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360qhcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360safe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360scdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360shouji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360so.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhimgs4.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360sou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wztsy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360sou.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360taojin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360totalsecurity.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360tpcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360tres.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360webcache.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360zqaq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anquanke.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"appjiagu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baomitu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haoso.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haosou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhimgs3.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haosou.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"i360mall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ludashi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nicaifu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nzwgs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qh-cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhimgs0.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhimgs2.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhimgs6.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhmsg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhres.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhres2.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qihoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qihoo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qihucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"so.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoluyouxuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoluzhidian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xjietiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youhua.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhaomishijie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qhimgs5.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360-g.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"360-game.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qikoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiku.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qikucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"starworldgames.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yiwanzhushou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hiclc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jzfz.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sumkoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sumkoo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"veeqi.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wenmingban.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gneec4.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"openinstall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"91.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aipage.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"antpcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"apollo.auto"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baidu-cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baidu-cdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baidu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baiduapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baidubce.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baidubcr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baiducontent.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baidupcs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baidustatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baiduyuncdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baiduyuncdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baifae.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baifubao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bce-cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bce-cdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bcebos.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bcelive.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdcloudapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdtjrcv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdurl.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdycdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdydns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bdydns.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chuanke.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dlnel.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dlnel.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duapp.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duapps.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hao123.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hao123img.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hao222.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haokan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jomocdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jomodns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jomodns.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jomoxc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mipcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nuomi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"quyaoya.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shifen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tiebaimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xdrtc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xianfae.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaodutv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yoojia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"combofin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duxiaoman-int.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duxiaoman.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duxiaomanfintech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duxiaomanfund.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duxiaomantech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxm-cdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxm-int.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxmbaoxian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxmjinr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxmlcf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxmlcfintech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxmpay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxmstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dxmyqh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"paydxm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gneec3.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pwrd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"perfectlingo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pwcinema.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"111.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"88.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"newcoder.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nowcoder.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nowcoder.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nowcoder.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5566ua.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"easytomessage.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jchat.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jmlk.co"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jpush.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jpushoa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pushcfg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinshuju.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinshujucdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jsj.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liepin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lietou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lietou-static.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bluepoch.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ahitv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cqccn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sc96655.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"isxtv.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sdgdwljt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"teleows.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gneec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gepush.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"getui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"getui.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"igehuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"igetui.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"igexin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"capitalonline.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"devui.design"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mafengwo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mafengwo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kechuang.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kexinshe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iflyink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iflyrec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iflysec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iflytek.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ets100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhixue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"changyan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xunfeixxj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51ssl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"litessl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"myssl-uri.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"myssl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trustasia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"trustasia.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"harmonyos.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jbcz.tv"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jibencaozuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hiascend.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"114blog.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"4thworkshop.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aloys233.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fanmingming.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huangyuhui.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gmya.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lg3000.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lovestu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"misaka-net.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"moliranran.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mryys.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mysqil.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mystery0.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pljzy.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"runningcheese.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"soulteary.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianhw.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"topwd.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vtdd.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zway.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yfcache.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yfcalc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yfcdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yfcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yfdts.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yfp2p.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yfscdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunfancdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daojia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"diandao.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jxedt.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58antenna.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ganjistatic1.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58che.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58corp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58dns.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58lovepet.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58uxd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58xinghuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58xueche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anjuke.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"anjukestatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinahr.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chrstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ganji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"5858.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jxksw.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58ganji-corp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinchong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xueche.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuancorp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuaninc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuanspirit.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuanstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhuanzhuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaoshibao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zaixiankaoshi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"58ganji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"teachblog.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"phpweblog.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cppblog.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maimemostatus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"markji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yushiyan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xuetangx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chesicc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chesicc.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pmphmooc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"openlearning.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"icourse163.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnmooc.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinesemooc.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaiduizuoye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zybang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuoyebang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gfbzb.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuoyebang.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fenbilantian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gfbzb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fenbike.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qgzb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fenbi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zbbm.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuantiku.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuansouti.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"21cnjy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"91yunxiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aiyunxiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"haofenshu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iyunxiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunxiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baicizhan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baicizhan.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bczcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"banxiaoer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"banxiaoer.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"beie.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"biyehome.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"burningvocabulary.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"centuryenglish.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dcshfu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dearedu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dgjy.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"duifene.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eduei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eoffcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinrongren.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"offcn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zggqzp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zgjsks.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zgsydw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gaojidata.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gk100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guojibk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gzasc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huatu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sydw8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"huijiaoyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ictbda.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuanfudao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"j-test.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nattest-china.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jyeoo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jyeoo.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jzagile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"keboyunxiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ketangpai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"liulishuo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"llsapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"llscdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"llsserver.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuowen8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weilaiyunxiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maimemo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mddclass.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sksight.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"neoscholar.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"neoschool.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oldboyedu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pigai.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qingtingai.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"quyixian.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ybccode.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"saduck.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tesoon.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"winyoungreading.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wjwai.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zysn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"x-cloud.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiyouyingyu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xkw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zxxk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunzhuxue.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ystbds.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yooc.me"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zggx100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhihuishu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zjzs.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"magedu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuowenjun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuowenku.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuowenwang.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianxuecloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianxueyunke.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhixingyunke.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17zuoye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"17zuoye.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"applysquare.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"applysquare.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"schoopia.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tongxuepie.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rainclassroom.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hugecore.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shareintelli.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mojidict.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cctalk.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hjapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hujiang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yeshj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"koocdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"koolearn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"koopass.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baydn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"shanbay.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"100tal.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aoshu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eduu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"eduuu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gaokao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"speiyou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tal.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xesimg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xueersi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youjiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zhongkao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuowen.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"banmaaike.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiaoyuankousuan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tipdm.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cocos.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnblogs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"blogjava.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"apipost.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aardio.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"goproxy.io"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sxlcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sifou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"segmentfault.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rubyconfchina.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ruby-china.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"frontjs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hihocoder.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kidsccshow.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lingkou.xyz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lingkou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"51nod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"acwing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"adacpp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"leetcode-cn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jisuanke.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xmoj.tech"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oi-wiki.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uoj.ac"}},{"action":"direct","match":{"kind":"domainSuffix","value":"vijos.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tracup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bjyouth.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sqqnh.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pgyer.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zdnscloud.biz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zdnscloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zdnscloud.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zdnscloud.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinglingbiaozhu.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"houyicaiji.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dengguobi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nnthink.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"aixcoder.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tikv.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yto.xin"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zt-express.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guoocang.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianyierp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"800best.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youyiwms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"800best.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"800bestapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"800bestapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"baishinetwork.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"best-inc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bestcrossborder.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bestdataclub.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bestincapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"56laile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"linliyz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qiancangwms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"t1tms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"t8tms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"t9tms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tnettms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"wangniuwms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinyuanfin.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youyierp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youyitms.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ztoyh.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"56xiniao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cainiao-inc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cainiao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cainiaoyizhan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"danniao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dianwoda.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"guoguo-app.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ztogroup.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"deppon.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dpma.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ztoglobal.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fcbox.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fcboxmall.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ckd.im"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kd100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaidi100.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaidilab.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sto-express.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"stointl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"stosolution.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"95311.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yt0.cc"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yto-jsd.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kjwugx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mamayz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mumbuy365.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuantongyizhan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nellit.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nellit.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"nellit.xyz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tianxiajiameng.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gpall.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yto-lgs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ytokj.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yto-lgs.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ytoluohan.xin"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yto.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yto.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"bestincapi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kuaidi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yl-scm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yto56test.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ytocargo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ytoexpress.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ytoholding.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ytokj.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zto.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zto.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ytoluohan.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tuxi.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"izto.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ztoapp.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sfcar.hk"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sfbuy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yundaex.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yundasys.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunda56.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yundalog.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yundaltl.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"udalogistic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"upfos.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtexpress.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtfulfillment.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtjms-ae.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtjms-br.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtjms-eg.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtjms-mx.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cr-cts.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ytoluohan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtjms-sa.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"crscm.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jet-ego.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jet-logistics.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jetlogistic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtg2g.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jtexpress.top"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sf-international.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sfgy.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"feng1.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sf-financial.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"rongechain.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sf-airlines.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sf-cityrush.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sf-express.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ibobscs.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"sf-saas.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tidbcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tidb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tidb.ai"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pingcap.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"asktug.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"atomgit.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gitcode.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csto.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"codechina.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnitblog.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csdn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"csdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gitcode.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"iteye.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"zuidaima.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaz.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ishumei.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fengkongbao.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"fengkongcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tebiefuza.cloud"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tongfangpc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mechrevo.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"weboss.hk"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maoyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"maoyuncloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaomiaoz.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"miaomiaozhe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"daogou.ai"}},{"action":"direct","match":{"kind":"domainSuffix","value":"koudaitong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xinlingshou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youzan.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"youzanyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinaso.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lagou.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lgstatic.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chnppmuseum.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ctvpost.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ulecdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"chinapost-life.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ule.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnpsec.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnweblog.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"pingcode.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"openvela.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"oend.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaihong.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jinrishici.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dingdachuxing.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"dingdatech.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jintdev.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"xiangbababus.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hihonor.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hihonorcdn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hihonorcloud.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"honor.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"honorfile.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"ejoy.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cnblogs.vip"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kaifayun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"media.paperclipclub.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"news.yxrb.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"roblox.qq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"gouhuo.qq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"roco.qq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"music.qq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"kg.qq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"y.qq.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yunpan.aliyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yun.139.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"qianwen.aliyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"tongyi.aliyun.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"hunyuan.tencent.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuanbao.tencent.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"yuanqi.tencent.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mirrors.yun-idc.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"uu.163.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"jiasu.bohe.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"lenovo.com.cdn.cloudflare.net"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp.aliyun.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp1.aliyun.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp2.aliyun.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp3.aliyun.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp4.aliyun.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp5.aliyun.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp6.aliyun.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp7.aliyun.com"}},{"action":"direct","match":{"kind":"domainExact","value":"time.izatcloud.net"}},{"action":"direct","match":{"kind":"domainExact","value":"time.xtracloud.net"}},{"action":"direct","match":{"kind":"domainExact","value":"izattime.qcomgeo2.com"}},{"action":"direct","match":{"kind":"domainExact","value":"xtratime.qcomgeo2.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp.tencent.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp1.tencent.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp2.tencent.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp3.tencent.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp4.tencent.com"}},{"action":"direct","match":{"kind":"domainExact","value":"ntp5.tencent.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cn.pool.ntp.org"}},{"action":"direct","match":{"kind":"domainSuffix","value":"mcdchina.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cf-china.info"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cf-ns.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cf-ns.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cf-ns.site"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cf-ns.tech"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cftest7.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cftest8.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudflare-cn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudflareanycast.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudflarecn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudflareglobal.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudflareinsights-cn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudflareperf.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudflareprod.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudflarestaging.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudflarestoragegw.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"cloudfront-cn.net"}},{"action":"direct","match":{"kind":"domainSuffix","value":"amzndns-cn.biz"}},{"action":"direct","match":{"kind":"domainSuffix","value":"amzndns-cn.com"}},{"action":"direct","match":{"kind":"domainSuffix","value":"amzndns-cn.net"}}],"schemaVersion":2}
diff --git a/ShadowsocksX-NG2/Vendor/rules/gfwlist/LICENSE b/ShadowsocksX-NG2/Vendor/rules/gfwlist/LICENSE
new file mode 100644
index 000000000..4362b4915
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/gfwlist/LICENSE
@@ -0,0 +1,502 @@
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+           How to Apply These Terms to Your New Libraries
+
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+  To apply these terms, attach the following notices to the library.  It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the library's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+  <signature of Ty Coon>, 1 April 1990
+  Ty Coon, President of Vice
+
+That's all there is to it!
diff --git a/ShadowsocksX-NG2/Vendor/rules/gfwlist/NOTICE b/ShadowsocksX-NG2/Vendor/rules/gfwlist/NOTICE
new file mode 100644
index 000000000..c268a86dc
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/gfwlist/NOTICE
@@ -0,0 +1,19 @@
+gfwlist rule snapshot
+=====================
+
+Upstream: gfwlist/gfwlist gfwlist.txt
+Upstream commit: c19292511da4c5af8f6193fd32d666eaaa0312f9
+Upstream URL: https://raw.githubusercontent.com/gfwlist/gfwlist/c19292511da4c5af8f6193fd32d666eaaa0312f9/gfwlist.txt
+Upstream archive SHA-256: 750d34564363075fafa12d8ab9739f269e2fbd2bf3c5f4ab8cfd859bfd3441df
+
+License: LGPL-2.1
+
+GFWList AutoProxy rules derived from gfwlist/gfwlist gfwlist.txt at commit c19292511da4c5af8f6193fd32d666eaaa0312f9. Official Base64 AutoProxy 0.2.9 list. Only rules losslessly expressible as target domains are converted; URL-path, protocol, wildcard, and regex conditions are reported as losses and never expanded into whole-domain rules. List is candidate routing data, not a guarantee of reachability or completeness.
+
+This list is candidate routing data. It is not a guarantee of network
+reachability, geographic ownership, or privacy. Rules that cannot be expressed
+losslessly as target domains (URL paths, protocol conditions, wildcards, regex)
+are counted and reported as conversion losses and are never expanded into
+whole-domain proxy rules. `@@` exceptions shadowed by a broader proxy rule are
+reported item by item and omitted from the generated ACL because sslocal would
+ignore them.
diff --git a/ShadowsocksX-NG2/Vendor/rules/gfwlist/manifest.json b/ShadowsocksX-NG2/Vendor/rules/gfwlist/manifest.json
new file mode 100644
index 000000000..63028a5e8
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/gfwlist/manifest.json
@@ -0,0 +1,8 @@
+{
+  "converterVersion": "2.0.0",
+  "name": "gfwlist",
+  "snapshotSHA256": "dc79a7205cbfd04e598aba9db6dd97ce75a618709111175b20a0aeec5bde58f8",
+  "upstreamArchiveSHA256": "750d34564363075fafa12d8ab9739f269e2fbd2bf3c5f4ab8cfd859bfd3441df",
+  "upstreamURL": "https://raw.githubusercontent.com/gfwlist/gfwlist/c19292511da4c5af8f6193fd32d666eaaa0312f9/gfwlist.txt",
+  "upstreamVersion": "c19292511da4c5af8f6193fd32d666eaaa0312f9"
+}
diff --git a/ShadowsocksX-NG2/Vendor/rules/gfwlist/snapshot.json b/ShadowsocksX-NG2/Vendor/rules/gfwlist/snapshot.json
new file mode 100644
index 000000000..ebbb944ba
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/rules/gfwlist/snapshot.json
@@ -0,0 +1 @@
+{"lossReport":{"absorbedCount":31,"convertedCount":4046,"rejected":{},"skipped":{"blank":2,"comment":112,"header":1,"plainText":2,"regexp":1,"singleLabelPrefix":3,"urlPath":2,"urlPrefix":279,"wildcard":5}},"metadata":{"attribution":"GFWList AutoProxy rules derived from gfwlist/gfwlist gfwlist.txt at commit c19292511da4c5af8f6193fd32d666eaaa0312f9. Official Base64 AutoProxy 0.2.9 list. Only rules losslessly expressible as target domains are converted; URL-path, protocol, wildcard, and regex conditions are reported as losses and never expanded into whole-domain rules. List is candidate routing data, not a guarantee of reachability or completeness.","converterVersion":"2.0.0","fetchedAt":"2026-10-02T18:17:43Z","inputDigest":"24a1b9c8f5d0e767ed59560a42ed8106017cb68275ec3603526696100587c6d4","license":"LGPL-2.1","source":{"kind":"gfwlist","label":"GFWList","upstreamVersion":"c19292511da4c5af8f6193fd32d666eaaa0312f9"},"upstreamReference":"gfwlist/gfwlist gfwlist.txt @ c19292511da4c5af8f6193fd32d666eaaa0312f9"},"rules":[{"action":"proxy","match":{"kind":"domainSuffix","value":"blogjav.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zoominfo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ptwxz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"miuipolska.pl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"piaotia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wunderground.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"500px.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"500px.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"afreecatv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"agnesb.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"airitilibrary.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"abematv.akamaized.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"linear-abematv.akamaized.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vod-abematv.akamaized.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"akiba-web.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"altrec.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"amazonvideo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"angela-merkel.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"angola.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"anthropic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apartmentratings.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apartments.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"arena.taipei"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"assets.bwbx.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"assimp.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"athenaeizou.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bankmobilevibe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"banorte.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"beeg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"global.bing.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"booktopia.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"boysmaster.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bynet.co.il"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"byrut.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"carfax.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"casinobellini.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"centauro.com.br"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chobit.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ciciai.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cici.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"claude.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"clearsurance.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cnbeta.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"counter.social"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"costco.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coze.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crossfire.co.kr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crunchyroll.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"d2pass.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"darpa.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dawangidc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deezer.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"desipro.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"discord.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"discord.gg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"discordapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"discordapp.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dish.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dm530.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dmhy.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dmm.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dnvod.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dubox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dvdpac.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eesti.ee"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"esurance.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"expekt.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"expressnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"extmatrix.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fakku.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fastpic.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"filesor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"financetwitter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flipboard.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flitto.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fnac.be"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fnac.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"funkyimg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fxnetworks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"g-area.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"get.dappcdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gettyimages.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gettyimages.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gettyimages.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gettyimages.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gettyimages.ae"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gettyimages.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gettyimages.it"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getuploader.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ghidra-sre.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"glass8.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"glype.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"go141.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hautelook.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hautelookcdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wego.here.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"grok.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hmoegirl.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hmvdigital.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hmvdigital.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"homedepot.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hoovers.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hulu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huluim.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hybrid-analysis.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ilbe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ilovelongtoes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imlive.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javhub.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javhuge.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javlibrary.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jcpenney.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jims.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tv.jtbc.joins.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jukujo-club.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"juliepost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kawaiikawaii.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kendatire.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"khatrimaza.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kkbox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"leisurepro.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lifemiles.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lih.kg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longtoes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lovetvshow.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lpsg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lrfz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"macgamestore.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"madonna-av.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mandiant.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mangafox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mangafox.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"manta.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"matome-plus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"matome-plus.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mattwilcox.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"metarthunter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mfxmedia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"miraheze.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mojim.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kb.monitorware.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"monster.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moodyz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moonbingo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mos.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"msha.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.msn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"muzu.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mvg.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mybet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mypikpak.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nationwide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"neo-miracle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"netflix.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"netflix.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nflximg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nflximg.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nflxext.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nflxso.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nflxvideo.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nic.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"purpose.nike.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"noxinfluencer.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nordstrom.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nordstromimage.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nordstromrack.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nottinghampost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"npsboost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ntdtv.cz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nusatrip.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nuuvem.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbs.nyinfor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"olehdtv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"omni7.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"onapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ontrac.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openai.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pandora.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"parkansky.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"phmsociety.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"podcast.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"popai.pro"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"primevideo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"proyectoclubes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pure18.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qq.co.za"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"r18.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ramcity.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rateyourmusic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rd.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sadistic-v.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"isc.sans.edu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shiksha.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"slacker.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sm-miracle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spotify.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spreadshirt.es"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"springboardplatform.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"superpages.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"swagbucks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"switch1.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tapanwap.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gsp.target.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"login.target.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rcam.target.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"technews.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freeterabox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"terabox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thinkgeek.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thebodyshop-usa.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tma.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tracfone.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tryheart.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"turntable.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twerkingbutt.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ulop.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uukanshu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vegasred.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vevo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vip-enterprise.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vmpsoft.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wanz-factory.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ssl.webpack.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"weebly.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wheretowatch.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wingamestore.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wizcrafts.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wowhead.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vod.wwe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xfinity.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xiaomi.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youwin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ytn.co.kr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zamimg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zattoo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zim.vn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zozotown.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"c3pool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unmineable.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"666pool.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"antpool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crazypool.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cruxpool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"miningpoolhub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huobipool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"poolbinance.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hiveon.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sparkpool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flypool.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nanopool.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xnpool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"beepool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhizhu.top"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spiderpool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uupool.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flexpool.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"beepool.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dpool.top"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"okpool.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"binancezh.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"r-pool.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"w-pool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--kcrv3utim32hx9f6qe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--1jqvh729avzfcy2d8ummib.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--9iqy04a7fi01l.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--u2u927b.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--11xs86f.icu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--4gq171p.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--czq75pvv1aj5c.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--i2ru8q2qg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--noss43i.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--oiq.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--p8j9a0d9c9a.xn--q9jyb4c"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--9pr62r24a.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--ngstr-lra8j.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xn--vuqv2cf7wzyig79c.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"s3.dualstack.us-west-2.amazonaws.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"music.amazon.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdn-images.mailchimp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"abebooks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"9cache.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"9gag.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"agro.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"share.america.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apkmirror.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"arte.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"artstation.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bangdream.space"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"behance.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bird.so"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitterwinter.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bnn.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"businessinsider.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bwgyhw.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"castbox.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"clyp.it"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cmcn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cmx.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dailyview.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"daum.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"depositphotos.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"disconnect.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"documentingreality.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doubibackup.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"encyclopedia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fangeqiang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fanqiangdang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"feedx.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flyzy2005.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"foreignpolicy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"free-ss.site"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freehongkong.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.fuckgfw233.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"g0v.social"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"globalvoices.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"glorystar.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goregrish.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hanime.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hbo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spaces.hightail.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkgalden.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkgolden.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hudson.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ipfs.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"japantimes.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jiji.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jintian.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jinx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"joinmastodon.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"liangzhichuanmei.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lighti.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lightyearvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lihkg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"line-scdn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"i.lithium.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cloud.mail.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mastodon.cloud"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mastodon.host"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mastodon.social"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mastodon.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"matters.news"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"me.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"metart.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mohu.club"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"msa-it.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goo.ne.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nikkei.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nitter.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nitter.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"niu.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"now.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openvpn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"onejav.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"paste.ee"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"my.pcloud.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"picacomic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pincong.rocks"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pixiv.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pixiv.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pixivsketch.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"potato.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"premproxy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"prism-break.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"proton.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"protonvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"api.pureapk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"quora.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"quoracdn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdn.seatguru.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"redd.it"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"redditspace.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"reddit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"reddithelp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"redditmedia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"redditstatic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rixcloud.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rixcloud.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rsdlmonitor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shadowsocks.be"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tn1.shemalez.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tn2.shemalez.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tn3.shemalez.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"static.shemalez.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"six-degrees.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"softfamous.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sosreader.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sspanel.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"supchina.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"teddysun.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"textnow.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tineye.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"top10vpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tubepornclassic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uku.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unseen.is"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uraban.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vrsmash.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vultryhw.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ssr.tools"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"steemit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taiwanjustice.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tinc-vpn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"u15.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"washingtonpost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wenzhao.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whatsonweibo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wire.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xm.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xuehua.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yes-news.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yigeni.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"you-get.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zzcloud.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"allcoin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"adcex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bcex.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bibox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"big.one"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bigone.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"binance.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bit-z.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitz.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitbay.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitcoinworld.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitfinex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bithumb.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitmex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bnbstatic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btc98.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btcbank.bank"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btctrade.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bybit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"c2cx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chaoex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cobinhood.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coinbase.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coinbene.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coinex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coingecko.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coingi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coinmarketcap.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coinrail.co.kr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cointiger.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cointobe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coinut.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"discoins.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dragonex.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ebtcbank.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"etherdelta.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ethermine.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"etherscan.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"exmo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"exrates.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"f2pool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fatbtc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ftx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gate.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gatecoin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hbg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hitbtc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hotcoin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"htx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huobi.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huobi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huobi.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huobi.li"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huobi.pro"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huobi.sc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huobipro.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bx.in.th"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kraken.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kspcoin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kucoin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lbank.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"liquiditytp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"livecoin.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"localbitcoins.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mercatox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oanda.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"obyte.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"okex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"okx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"opensea.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"otcbtc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"paxful.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"poolin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"simpleswap.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"solv.finance"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"topbtc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tronscan.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xbtce.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yobit.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zb.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuhk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu.link"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futunn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuhn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu0.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu1.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu2.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu3.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu4.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu5.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu6.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu7.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu8.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu9.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuinc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuniuniu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futu.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futufin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuhk2.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuholdings.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuesop.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futubull.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuchain.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moomoo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lbctrl.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lbkrs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wbrks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longportapp.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longportapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longbridgeapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longbridge.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longbridgehk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longbridge.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longbridge.global"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"itiger.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"itigerup.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"laohu8.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tigerbbs.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tigerbbs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tigerfintech.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tradeup.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xiaohu8.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhijianfengyi.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhijianfengyi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"schwab.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"schwab.com.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"schwab.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"schwab.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futustatic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuau.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuhkapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fututrade.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fututrustee.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"api.moomoobull.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moomooequity.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moomootrustee.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"9oju31.launches.appsflyersdk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sgqt0j.launches.appsflyersdk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shortconn.im.qcloud.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longbridge.cloud"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longbridge.sg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tigerbrokers.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tigerbrokers.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tigerbrokers.nz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"quote.longbridge.global"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openapi.longbridge.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openapi-quote.longbridge.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openapi-trade.longbridge.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cg.play-analytics.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"read01.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kknews.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"china-mmm.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bgme.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"o3o.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"go5.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"me.ns.ci"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moresci.sale"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"social.edu.ci"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mstdn.social"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"douchi.space"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"slashine.onl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"social.datalabour.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mastodon.online"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"payments-jp.amazon.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"amazon.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"s3-ap-northeast-1.amazonaws.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"video.aol.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"search.aol.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avmo.pw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avmoo.pw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbc.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbci.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbcchinese.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bloomberg.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bloomberg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bloomberg.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bloombergview.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cloudflarestatus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"workers.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"one.one.one.one"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cloudflare-dns.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dns.cloudflare.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dynu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"accountkit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdninstagram.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"f8.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facebook.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facebook.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facebook.design"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"connect.facebook.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facebook.hu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facebook.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facebook.nl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facebook.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facebookmail.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fb.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fb.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fb.watch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fbcdn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fbsbx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fbaddins.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fbworkmail.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"instagram.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"m.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"messenger.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"meta.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oculus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oculuscdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rocksdb.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"parse.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thefacebook.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"threads.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whatsapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whatsapp.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fandom.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ftchinese.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ai.studio"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"issues.chromium.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doc.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"form.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"forms.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sheet.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sheets.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spreadsheet.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"site.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sites.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"website.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"slides.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deck.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"presentation.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleapis.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1e100.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"466453.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"abc.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"admob.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"adsense.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"advertisercommunity.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"agoogleaday.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ampproject.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"android.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"androidify.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"androidtv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"api.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"appspot.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"autodraw.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blogblog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"business.page"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"certificate-transparency.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chrome.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chromecast.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chromeexperiments.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chromestatus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cloudfunctions.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crbug.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"creativelab5.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crrev.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"data-vocabulary.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"debug.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deepmind.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deja.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"digisfera.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"docker.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"docs.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"duck.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"feedburner.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"firebaseio.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crashlytics.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"g.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gcr.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"get.app"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"get.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"get.how"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"get.page"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getmdl.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getoutline.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ggpht.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gmail.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gmodules.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"godoc.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"golang.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goo.gl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ac"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ad"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ae"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.af"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.al"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.am"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.as"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.at"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.az"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ba"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.be"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.bf"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.bg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.bi"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.bj"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.bs"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.bt"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.by"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.cat"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.cd"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.cf"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.cg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ci"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.cl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.cm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.ao"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.bw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.ck"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.cr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.id"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.il"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.ke"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.kr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.ls"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.ma"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.mz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.nz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.th"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.tz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.ug"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.uz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.ve"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.vi"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.za"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.zm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.co.zw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.af"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.ag"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.ar"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.bd"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.bh"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.bn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.bo"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.br"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.bz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.cu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.cy"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.do"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.ec"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.eg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.et"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.fj"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.gh"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.gi"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.gt"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.jm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.kh"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.kw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.lb"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.ly"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.mm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.mt"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.mx"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.my"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.na"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.nf"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.ng"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.ni"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.np"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.om"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.pa"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.pe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.pg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.ph"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.pk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.pr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.py"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.qa"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.sa"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.sb"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.sg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.sl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.sv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.tj"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.tr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.ua"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.uy"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.vc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.com.vn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.cv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.cz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.dk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.dm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.dz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ee"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.es"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.fi"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ga"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ge"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.gg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.gl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.gm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.gp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.gr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.gy"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.hn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.hr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ht"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.hu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ie"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.iq"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.is"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.it"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.it.ao"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.je"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.jo"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.kg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ki"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.kz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.la"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.li"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.lk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.lt"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.lu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.lv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.md"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.mg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.mk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ml"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.mn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ms"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.mu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.mv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.mw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.mx"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ne"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.nl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.no"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.nr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.nu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.pl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.pn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ps"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.pt"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ro"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.rs"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.rw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.sc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.sh"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.si"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.sk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.sm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.sn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.so"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.sr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.st"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.td"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.tg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.tk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.tl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.tm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.tn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.tt"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.vg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.vn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.vu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"google.ws"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleapps.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleartproject.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleblog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlebot.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlechinawebmaster.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlecode.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlecommerce.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googledomains.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlearth.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleearth.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googledrive.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlefiber.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlegroups.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlehosted.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleideas.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleinsidesearch.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlemail.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlemashups.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlepagecreator.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleplay.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleplus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlescholar.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlesource.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleusercontent.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlevideo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googleweblight.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"googlezip.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gstatic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gvt1.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gvt3.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gwtproject.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"html5rocks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iam.soy"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"igoogle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"itasoftware.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"like.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"madewithcode.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"material.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"on2.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"panoramio.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"picasaweb.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pki.goog"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"plus.codes"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"polymer-project.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"questvisual.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"admin.recaptcha.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"api.recaptcha.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"api-secure.recaptcha.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"api-verify.recaptcha.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"redhotlabs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"savethedate.foo"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"schema.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shattered.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"snapseed.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"synergyse.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"teachparentstech.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tensorflow.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tfhub.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thinkwithgoogle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiltbrush.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"translate.goog"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ua5v.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"urchin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"usercontent.goog"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"waveprotocol.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"waymo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"web.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"webmproject.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"webpkgcache.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"webrtc.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whatbrowser.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whats.new"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"widevine.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"withgoogle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"withyoutube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"x.company"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youtu.be"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youtube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youtube-nocookie.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youtubeeducation.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youtubegaming.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youtubekids.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yt.be"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ytimg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zynamics.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"copilot.microsoft.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"naughtyamerica.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nyt.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nytcn.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nytco.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nytimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nytimg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nytstyle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"steamcommunity.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"store.steampowered.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"api.steampowered.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"steamstatic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tx.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tg.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"telega.one"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdn-telegram.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"comments.app"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"graph.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"legra.ph"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"quiz.directory"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"t.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"updates.tdesktop.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"telegram.dog"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"telegram.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"telegram.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"telegram.space"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"telegramdownload.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"telegra.ph"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"telesco.pe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiktok.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiktokv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiktokv.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiktokcdn-us.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiktokcdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiktokcdn-eu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jtvnw.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ttvnw.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitch.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitchcdn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"periscope.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pscp.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"t.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweetdeck.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twimg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitpic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitter.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vine.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"x.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taiwanembassy.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"roc-taiwan.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twgov.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gov.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gov.taipei"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"li.taipei"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"teco-hk.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"teco-mo.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kinmen.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spaceforce.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"airuniversity.af.edu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"supremecourt.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"americorps.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dma.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jpl.nasa.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pds.nasa.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pacom.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"soc.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"solarsystem.nasa.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uscg.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"usfk.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tsdr.uspto.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"v2ex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voacambodia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voachineseblog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voacantonese.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voachinese.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voaindonesia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voanews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voatibetan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voatibetanenglish.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zh.ecdm.wikia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"evchk.wikia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mediawiki.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikidata.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikimedia.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikibooks.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikiversity.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikisource.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zh.wikiquote.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikinews.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikivoyage.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wiktionary.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikipedia.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wmfusercontent.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shopping.yahoo.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"auctions.yahoo.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"search.yahoo.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yahoo.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yahoo.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yahoo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"123av.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"123av.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"18comic.vip"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"18mh.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"24hbook.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"996.icu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ipfs.4everland.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"91dasai.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"i.111666.best"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1lib.sk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"2047.one"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"69shuba.cx"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"2049bbs.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"611study.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"18comic.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"000webhost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1-apple.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1000giri.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"10beasts.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"10musume.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"12bet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"12vpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"12vpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1337x.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"141jj.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1688.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"173ng.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"18board.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhao.1984.city"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1984bbs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1991way.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1point3acres.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"1pondo.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"2008xianzhang.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"2021hkcharter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"2047.name"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"233abc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"24hrs.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"32red.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"36rain.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"404museum.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"4bluestones.biz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"4everproxy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"4rbtv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"4shared.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"51.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"51jav.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"51luoben.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"5278.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"611study.icu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"63i.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"6do.news"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"6do.world"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"6park.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"6parkbbs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"6parker.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"6parknews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"7capture.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"881903.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"89-64.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"8964museum.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"8z1.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"91porn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"91porny.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"91vps.club"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"99btgc01.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"9bis.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"9bis.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"9news.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"livingatlas.arcgis.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"basemaps.arcgis.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"experience.arcgis.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aihub.top"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"accountboy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"acg.mn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"asiasociety.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avistaz.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"annas-archive.gd"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"annas-archive.gl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"annas-archive.pk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archive-it.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aave.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"arweave.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"arena.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"akile.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aljazeera.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"anuneko.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ai.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"adguard-vpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aoxvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"asianfanfics.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"amuletmc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"abplive.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdn.arstechnica.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aomedia.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aljazeera.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"akinator.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"av01.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"acg.rip"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"a-normal-day.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"abc.net.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"abebooks.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aboluowang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"about.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"acast.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"acevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"acgbox.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"acgkj.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"acgnx.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"activpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aculo.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"addictedtocoffee.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"addyoutube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"adult-sex-games.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"advanscene.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"advertfan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aei.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aenhancers.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"af.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"afr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aiosearch.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aiph.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"airconsole.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"airvpn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ait.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aiweiweiblog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.ajsands.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"a248.e.akamai.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"akiba-online.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"akow.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alabout.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alasbarricadas.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alforattv.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alive.bar"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alkasir.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"all4mom.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"allconnected.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alldrawnsex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"allfinegirls.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"allinfa.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"allmovie.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alternate-tools.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alwaysdata.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alwaysdata.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"alwaysvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"am730.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ameblo.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"americangreencard.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"amiblockedornot.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"amnesty.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"amnesty.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"amnestyusa.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"anchor.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"anchorfree.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ancsconf.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"andfaraway.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"android-x86.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"androidapksfree.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"angularjs.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aniscartujo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"anobii.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"anonfiles.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"anonymouse.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"anthonycalzadilla.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ao3.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aobo.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aomiwang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apat1989.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apiary.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apigee.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apk.support"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apkcombo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apkmonk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apkplz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apkpure.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apkpure.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"appadvice.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"appbrain.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"appledaily.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"appledaily.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"appsocks.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"appsto.re"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aptoide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archives.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archive.fo"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archive.vn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archive.is"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archive.li"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archive.md"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archive.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archive.ph"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archive.today"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archiveofourown.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"archiveofourown.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"arctosia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"areca-backup.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"arethusa.su"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"arlingtoncemetery.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"as.mr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"asacp.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"asiaharvest.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"asianage.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"asianews.it"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"asiansexdiary.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"asiaone.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ask.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"askstudent.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"askynz.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aspi.org.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"aspistrategist.org.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"assembla.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"astrill.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"atc.org.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"atlanta168.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"atnext.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"audacy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"av.movie"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avaaz.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avdb.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avdb.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avgle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avidemux.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"avoision.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"axios.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"axureformac.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"azirevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"briarproject.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bilinovel.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"boomplay.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bleepingcomputer.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bellingcat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bittorrent.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"help.byspotify.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitbaby.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bettergpt.chat"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bt4gprx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bt4g.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"betterhash.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"binance.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitget.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blackmagicdesign.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bearteach.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btbtt.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btbtt.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btbit.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"betaclouds.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blocktempo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blockcast.it"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.bing.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bangumi.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"b-ok.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"babylonbee.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"backchina.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bad.news"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"badiucao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"baidu.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"baijie.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bailandaily.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"baixing.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"baizhi.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"banana-vpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"band.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bandcamp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bandwagonhost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bangkokpost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bangumi.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bangyoulater.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bannedbook.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"barnabu.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"barton.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bastillepost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bayvoice.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbchat.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bb-chat.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bebo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"beevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"beijing1989.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"beijing2022.art"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"beijingspring.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"berlinerbericht.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"berlintwitterwall.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bestvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bestvpnanalysis.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bestvpnforchina.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bestvpnserver.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bestvpnservice.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bestvpnusa.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bet365.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"betternet.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bettervpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bettween.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"betvictor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bfnn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bfsh.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bgm.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bgvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"biblesforamerica.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpl.bibliocommons.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"biedian.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bigjapanesesex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bignews.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bild.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitchute.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitcointalk.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitshare.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bitvise.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bl-doujinsouko.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bjzc.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blacked.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blackvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blinkx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blip.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blockcn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blockedbyhk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blockless.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blogcatalog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blogcity.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blogger.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bloglines.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bloglovin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bloodshed.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bootstrapcdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bloomfortune.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blubrry.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bmdru.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bnext.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bnrmetal.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"boardreader.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bod.asia"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bolehvpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"boobstagram.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"book.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bookdepository.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"books.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bookwalker.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"borgenmagazine.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"botanwang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bowenpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"app.box.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dl.box.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"boxpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"boxun.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"boxun.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"br.st"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"braumeister.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"brave.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bravotube.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"brazzers.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"breached.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"break.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"breakgfw.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"breakingtweets.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"breakwall.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"brill.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"brizzly.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"broadpressinc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"brookings.edu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"brutaltgp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bsky.app"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bsky.network"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bsky.social"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bt95.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btdig.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btguard.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btku.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"btku.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"budaedu.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"buffered.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bullguard.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bullog.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bullogger.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bumingbai.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bunbunhk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"business-humanrights.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"businesstoday.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"buzzorange.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"buzzsprout.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bwh1.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bypasscensorship.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chineseposters.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ctee.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chatgpt.site"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cht.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cerebras.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"circle19.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"clashyun.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chonglangtv.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ctinsider.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cia.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"claude.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"clementine-player.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"backend-v2.crixet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cchostvps.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"canva.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chatpdf.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ctinets.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"covenantswatch.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cpu-monkey.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coffeemanga.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ctinews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cachefly.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cachefly.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cutout.pro"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cixiaoya.club"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"campaign-archive.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinauncensored.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"catbox.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crosswall.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"clipconverter.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zh-hans.cfsh99.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"colacloud.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ci-en.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"c-span.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"c-spanvideo.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"c-est-simple.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cableav.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cablegatesearch.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cactusvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"calendarz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"camfrog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"campaignforuyghurs.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cams.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"canyu.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"caobian.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"caochangqing.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cap.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"caoporn.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"posts.careerengine.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"carrd.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cartoonmovement.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cari.com.my"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"caribbeancom.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"carousell.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"catch22.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"catholic.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"catholic.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cato.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cattt.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"caus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cbc.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"southpark.cc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cccat.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cccat.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ccfd.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cchere.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cclife.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cclifefl.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ccthere.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ccthere.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdbook.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdef.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdig.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdjp.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdp1998.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdp2006.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdpeu.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdpuk.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdpweb.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdpwu.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdw.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cecc.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cellulo.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cenews.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"centerforhumanreprod.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"centralnation.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cfr.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"change.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"changp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"channelnewsasia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chanworld.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chaos.social"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"character.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chatgpt.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chaturbate.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"checkgfw.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chengmingmag.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chenguangcheng.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chenpokong.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chenpokongvip.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cherrysave.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chhongbi.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chii.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"china-week.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"china101.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"china18.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"china21.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"china21.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"china5000.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinaaffairs.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinaaid.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinaaid.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinaaid.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinachange.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinachannel.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinademocrats.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinadialogue.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinadigitaltimes.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinaelections.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinafile.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinafreepress.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinagfw.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinahorizon.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinamule.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinapress.com.my"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinasocialdemocraticparty.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinasoul.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinatopsex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinaworker.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinese-memorial.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinesedailynews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinesedemocracy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinesegay.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinesen.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinesenews.net.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chineseradioseattle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chineseupress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chingcheong.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cnnews.chosun.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"christianfreedom.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"christianstudy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"christiantimes.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chrlawyers.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cirosantilli.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"citizencn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"citizenlab.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"citizenlab.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"citypopulation.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"civicparty.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"civilhrfront.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"civilmedia.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"civitai.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ck101.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"classicalguitarblog.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"clinica-tibet.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"app.cloudcone.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cloudflare-ipfs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"club1069.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"clubhouseapi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cmegroup.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cmi.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cmule.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cms.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cna.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cnd.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cnpolitics.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coat.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cochina.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"codeshare.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"codeskulptor.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cofacts.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"conoha.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"comefromchina.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"commentshk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"communistcrimes.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"communitychoicecu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"comparitech.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"compileheart.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cool18.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coolaler.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coolder.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coolloud.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coolstuffinc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cotweet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"coursehero.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cpj.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crackle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crazyshit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crchina.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"creader.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"creaders.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cristyli.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"croxyproxy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crossvpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"crucial.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.cryptographyengineering.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"csdparty.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"csis.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"csmonitor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"csuchen.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"csw.org.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ct.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ctitv.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ctowc.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cts.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ctwant.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cuiweiping.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"culture.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cumlouder.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"curvefish.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cusp.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cutscenes.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cw.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cyberghostvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cynscribe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ifan.cz.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mike.cz.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nic.cz.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"divdyn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"data18.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dt18.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dns.sb"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doh.sb"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dot.sb"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"download.dappcdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dazn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"darmau.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dockerstatus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doom9.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dweb.link"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"docker.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"disneyplus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ddex.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"d.cash"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doubiyunbackup.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cloud.dify.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"d100.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dabr.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dabr.mobi"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dabr.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dadazim.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dailymail.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dailymotion.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dailysabah.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dajiyuan.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dalailama.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dalailamaworld.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dalianmeng.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"daliulian.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"danke4china.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"darrenliuwei.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dashlane.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"daxa.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"db.tt"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dbgjd.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dcard.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ddc.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deadhouse.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deadline.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deepai.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"decodet.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"delcamp.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"demosisto.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"desc.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dessci.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deutsche-welle.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deviantart.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"deviantart.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"devio.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"devpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"devv.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"diaoyuislands.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"diigo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"directcreative.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"discuss.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"disp.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"disqus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dit-inc.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"diyin.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dizhuzhishang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dl-laby.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dlive.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dlsite.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dlyoutube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dmc.nico"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dmcdn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dnscrypt.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dns2go.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dnssec.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dolc.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dolf.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dongtaiwang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dongtaiwang.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"danbooru.donmai.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doosho.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doourbest.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dotplane.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dotsub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dotvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doub.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doublethinklab.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dougscripts.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"doujincafe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dowjones.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dpp.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dpr.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dragonsprings.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"drgan.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dropbooks.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dropbox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dropboxapi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dropboxusercontent.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dtiblog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dtic.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"duckduckgo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"duckmylife.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"duihua.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"duihuahrjournal.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"duplicati.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"duyaoss.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dvorak.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dw.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dw.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dw-world.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dwnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dwnews.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dynawebinc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dysfz.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"edigest.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"app.element.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"economist.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"e621.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"edx-cdn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"everipedia.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"etherscan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"elconfidencial.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"e-classical.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"e-gold.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"e-hentai.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"e123.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"earthvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eastasiaforum.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eastturkistangovernmentinexile.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fnc.ebc.net.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"news.ebc.net.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ecfa.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ecimg.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"edgecastcdn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"edubridge.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eic-av.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eireinikotaerukai.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eksisozluk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"elgoog.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"elpais.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"encrypt.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"enewstree.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinese.engadget.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"englishfromengland.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"entermap.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochhk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes-bg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes-romania.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.co.il"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.co.kr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.it"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimes.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochtimestr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochweek.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"epochweekly.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eporner.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"erights.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ernestmandel.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"erodaizensyu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"erodoujinlog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"erodoujinworld.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eromanga-kingdom.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eromangadouzin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eslite.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"etizer.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"etokki.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"etsy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eurekavpt.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"euronews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"apps.evozi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"evschool.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"exchristian.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"exhentai.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"exmormon.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"expatshield.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"expecthim.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"exploader.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"expressvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eyevio.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eyny.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freedom.gov"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hyperbeam.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flowgpt.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"forefront.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flexclip.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freegpt.tech"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freegpt.es"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"feedly.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fuckccp.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fuckccp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"furrybar.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"forbes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"financialexpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fast.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"factchecklab.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ft.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fuchsia.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freess.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fril.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"free.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"froth.zone"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fanbox.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"free.bg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"f-droid.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facebookquotes4u.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"faceless.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"facesofnyfw.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"factpedia.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"faiththedog.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fallenark.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"falsefire.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"falunasia.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"falundafa-florida.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"falundafa-nc.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"falundafa-pa.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"falundafaindia.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"falunhr.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fanglizhi.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fangong.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fanhaolou.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fanqianghou.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fanqiangzhe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fantv.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"famunion.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fanqiang.network"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fanswong.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"en.favotter.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"global.ssl.fastly.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freetls.fastly.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nytimes.map.fastly.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fast.wistia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fastestvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fastssh.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"faststone.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"favstar.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"faz.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fc2cn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"feeder.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"feelssh.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"feixiaohao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"feministteacher.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fengzhenghu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fengzhenghu.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"figprayer.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fileflyer.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"finchvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"findyoutube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"findyoutube.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"relay.firefox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fireofliberty.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fireofliberty.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"firetweet.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"open.firstory.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"firstpost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"firstrade.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fish.audio"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flgjustice.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flickr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"staticflickr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flipkart.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flog.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flowhongkong.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flyvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fringenetwork.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"flecheinthepeche.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fochk.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"focustaiwan.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fofg.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fooooo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"foreignaffairs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fountmedia.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fourthinternational.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"foxsub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fpmtmexico.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fqrouter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"frank2019.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"franklc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freebrowser.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freedomhouse.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freedomsherald.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freegao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freekazakhs.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freelotto.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freeoz.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freessh.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freebeacon.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freechinaweibo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freenetproject.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freetibet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freetribe.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freewallpaper4.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freewechat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freeweibo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freezhihu.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"friendfeed.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"friends-of-tibet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"friendsoftibet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fring.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"frommel.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"frontlinedefenders.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"frootvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fscked.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ftv.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ftvnews.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fullerconsideration.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fullservicegame.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"furinkan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"futuremessage.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fw.cm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fxcm-chinese.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"f95zone.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"c.go-mpulse.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getmonero.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gate.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"guangming.com.my"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"g.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gmgn.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"grokipedia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfwbao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"greatfirevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"garudalinux.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"about.gitlab.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gitlab.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getsession.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gdaily.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfwatch.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"go-to-zlibrary.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gitbook.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"g-queen.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gab.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gabocorp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gagaoolala.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"galenwu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"game735.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gamer.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gamez.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gaoming.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ganjing.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ganjingworld.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gartlive.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gather.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gaymap.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"images-gaytube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gazotube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gcc.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gclubs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gcmasia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"geek-art.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gekikame.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gencraft.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"generated.photos"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"genius.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"geph.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getastrill.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getcloak.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getfoxyproxy.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getgom.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"geti2p.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getlantern.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getmalus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"getsync.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gettr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfsale.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw.press"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gfw.report"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ggssl.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ghostpath.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ghut.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"giga-web.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"girlbanker.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"git.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"raw.githack.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"github.blog"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"github.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"githubcopilot.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"github.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"githubusercontent.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"githubassets.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gizlen.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gjczz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"glarity.app"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"globaljihad.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"globalrescue.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"globalvoicesonline.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"globalvpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gmgard.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"suche.gmx.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gnci.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gnews.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goagent.biz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"godaddy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"godfootsteps.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gofundme.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gohappy.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goldbetsports.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"golden-ages.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goldeneyevault.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goldenfrog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goldwave.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gongm.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gooday.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goodhope.school"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goodnewsnetwork.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goodreads.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goodreaders.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goofind.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gopetition.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"goreforum.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gotquestions.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gotrusted.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gotw.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"grammaly.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"graphis.ne.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"graphql.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gravatar.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"greatfirewallofchina.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"greenpeace.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"greasyfork.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"greenvpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"grindr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ground.news"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gsearch.media"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gtricks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gutteruncensored.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gvm.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gwins.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gzone-anime.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gospelherald.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"greatfire.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gtv.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gtv1.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"guishan.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gumroad.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gunsamerica.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hentai.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkej.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkong.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hive.blog"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"v2.hysteria.network"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hembed.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.hoyolab.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hbomax.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hicairo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"herominers.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hinet.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hindustantimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hanime1.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"halktv.com.tr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"haiwaikan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"home.saxo"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hoy.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"h-china.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hackmd.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hackthatphone.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"haijiao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hakkatv.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hardsextube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"b.hatena.ne.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hdtvb.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ordns.he.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"heartyit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hecaitou.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hechaji.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"heeact.edu.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"helixstudios.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"helloandroid.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"helloqueer.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"helpeachpeople.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"helpster.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"id.heroku.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"herokuapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"heqinglian.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"heritage.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hexieshe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hexieshe.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hexxeh.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"heyuedi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hiccears.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hidden-advent.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hiddify.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hide.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hideipvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hideman.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hidemy.name"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hidemyass.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hidemycomp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"highrockmedia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hiitch.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hikinggfw.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"himalayan-foundation.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"himemix.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hk01.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkbookcity.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkchronicles.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkcnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkcoc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkdc.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hket.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkfaa.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkgpao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hklts.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkmap.live"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkopentv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkpeanut.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkreporter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hnjhj.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hojemacau.com.mo"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hola.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hola.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"holyspiritspeaks.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hongkongfp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hongzhi.li"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"honven.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hootsuite.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hoover.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"horrorporn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hostloc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hotair.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hotspotshield.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hottg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hotvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"howtoforge.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hoxx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hpjav.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hqcdp.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hqjapanesesex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hrichina.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hrntt.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hrw.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hsex.men"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hsjp.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hsselite.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hst.net.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"htkou.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huaglad.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huanghuagang.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huaren.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huayuworld.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huffingtonpost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huffpost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huggingface.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hugoroy.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huhaitai.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huhamhire.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huhangfei.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"humanparty.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"humanrightspressawards.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hung-ya.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"huping.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hutianyi.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hwayue.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hxwk.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hyperrate.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hypothes.is"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ebook.hyread.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"infosec.exchange"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"investing.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"idcflare.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"interseclab.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ipify.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"itch.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"infura.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"president.ir"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gov.ir"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"irna.ir"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"arvanstorage.ir"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"irangov.ir"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"india.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"indiatoday.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"invidio.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"improd.works"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"illawarramercury.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imago-images.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"i2p2.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"i818hk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iask.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iavian.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ibvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"icedrive.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"icij.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"icl-fi.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"icoco.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"furbo.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iconpaper.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"icu-project.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"identi.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"idiomconnection.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"idope.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ift.tt"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ifcss.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ifreewares.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"igcd.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"igfw.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"igvita.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iicns.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ilhamtohtiinstitute.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"illusionfactory.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ilove80.be"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"im88.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imgchili.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imagefap.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imageflea.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imageglass.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imageshack.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imagevenue.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imagezilla.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"img.ly"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imgasd.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imgur.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"imkev.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"incloak.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"incredibox.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"independent.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"indiablooms.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"indiandefensenews.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"indianarrative.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"timesofindia.indiatimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"indiemerch.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"info-graf.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inherit.live"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"initiativesforchina.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inkbunny.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inkui.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inmediahk.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inoreader.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inote.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"insecam.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inside.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"insidevoa.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"institut-tibetain.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"interactivebrokers.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"internet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"internetfreedom.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"internetpopculture.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inthenameofconfuciusmovie.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inxian.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ipdefenseforum.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ipfire.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iphone4hongkong.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iphonetaiwan.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iphonix.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ipicture.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ipjetable.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ippotv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ipredator.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iptvbin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ipvanish.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ironpython.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ironsocket.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ishr.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"islamhouse.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"isaacmao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"isgreat.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ismaelan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ismprofessional.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"israbox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"issuu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oversea.istarshine.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"isupportuyghurs.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"italiatibet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"itemfix.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"itshidden.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iuhrdf.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ivacy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ivonblog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ivpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iwara.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ixquick.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iyouport.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"iyouport.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jhelab.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"justmysockscn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"justmysocks.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jav321.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javdb.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jifangge.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"j.mp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jable.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.jackjia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jamestown.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jamyangnorbu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jan.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"japan-whores.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"japanhdv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javakiba.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javbus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javfinder.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javfor.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javmobile.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"javseen.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jgoodies.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jiangweiping.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jiaoyou8.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hk.jiepang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tw.jiepang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jingpin.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jinrizhiyi.news"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jitouch.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jma.go.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jmsc.hku.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"joachims.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"joinclubhouse.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jornaldacidadeonline.com.br"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"journalofdemocracy.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jsdelivr.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"fiddle.jshell.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"juliereyc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"junauza.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbs.junglobal.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"justhost.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"justmysocks1.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"juziyue.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdn.jwplayer.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kards.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kfor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kathmandupost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kingkong.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kanald.com.tr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kpkuang.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ka-wai.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kadokawa.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kagyu.org.za"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kagyuoffice.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kagyuoffice.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kakao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kannewyork.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kanshifang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kantie.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kaotic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"karayou.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kawase.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kebrum.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kenengba.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kepard.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"keycdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kichiku-doujinko.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kik.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kingdomsalvation.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kingstone.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kinokuniya.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"killwall.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kindle4rss.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kinmen.travel"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kk-whys.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"knowyourmeme.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kobo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kobobooks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kompozer.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"konachan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"koolsolutions.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"koornk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"koranmandarin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kqes.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ktzhk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kuaichedao.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kukuku.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kurtmunger.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kwcg.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kwongwah.com.my"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kxsw.life"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kzaobao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kzeng.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"linux.sb"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"level-plus.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"libgen.is"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lemonde.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lantern.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lovart.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"library-access.sk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"linux.do"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lmarena.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lexica.art"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"luckymobile.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ludepress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lingualeo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ldplayer.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ldplayer.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ltn.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"litenews.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.lorenzetti.com.br"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"linktr.ee"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"labiennale.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lagranepoca.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lala.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lama.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lamayeshe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lamnia.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"landofhope.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"laogai.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"laogairesearch.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"laqingdan.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"larsgeorge.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lastfm.es"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lausan.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"le-vpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"leafyvpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ledger.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"left21.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lematin.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lenwhite.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lesoir.be"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"letscorp.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"liangyou.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"liaowangxizang.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"liberal.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"libertysculpturepark.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"libertytimes.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"libredd.it"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lighten.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lightnovel.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lilaoshibushinilaoshi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"line.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"line-apps.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lingvodics.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"linkedin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"linux.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"liquidvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"greatfire.us7.list-manage.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"listennotes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"listentoyoutube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"liuxiaobo.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"liuxiaotong.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"liveleak.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"livemint.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"livestream.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"livingstream.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"livevideo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chat.lmsys.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"localdomain.ws"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lockestek.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"secure.logmein.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"logos.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"longtermly.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lookpic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lrip.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lsd.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lsm.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lsmchinese.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lsmkorean.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"luckydesigner.space"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lupm.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lushstories.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lvhai.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lvv2.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lzjscript.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lzmtnews.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"leonardo.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"historylines.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"kiwix.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mceindex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mhwindow.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mas.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mjj.today"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mediamatters.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mistral.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"manus.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"meee.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mosavi.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"dcs-spotify.megaphone.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mij.rip"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mji.rip"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mjj.rip"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mcusercontent.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"metamask.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"missav.ws"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"news.mt.co.kr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"musixmatch.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mergersandinquisitions.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"m.moegirl.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"myjs.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mercari.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mercari.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mirror.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mywife.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"c.mi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"missav.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"madou.club"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mahjongsoul.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mangabz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mad-ar.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"madrau.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"madthumbs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mangmang.run"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"manyvoices.news"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"marc.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"makemymood.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"martau.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.martinoei.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"marxist.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"marxists.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"matainja.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"matrix.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"matters.town"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mcadforums.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"md-t.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"meansys.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mediachinese.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mediafreakcity.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"medium.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mega.co.nz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mega.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mega.nz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"megalodon.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"megaproxy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"megurineluka.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"meizhong.blog"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"meizhong.report"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"memehk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"memes.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mercdn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mercyprophet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"meridian-trust.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"meripet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"merit-times.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wiki.metacubex.one"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"metafilter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"meteorshowersonline.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"metro.taipei"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"metrolife.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"metroradio.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mewe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mgoon.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mgstage.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mh4u.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbs.mikocon.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"microvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mihua.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mikanani.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mikesoltys.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mingdemedia.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"minghui.or.kr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"minghui.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"minghui-school.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mingjinglishi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mingjingnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mingjingtimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mingpao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mingpaocanada.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mingpaomonthly.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mingpaonews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mingshengbao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"minhhue.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ministrybooks.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"minzhuzhongguo.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"miroguide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mirrorbooks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mirrormedia.mg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thecenter.mit.edu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"scratch.mit.edu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mitbbs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mixero.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mixi.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mixx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mizzmona.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mlc.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mlzs.work"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mmaaxx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mobatek.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mobile01.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mobileways.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mod.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"modernchinastudies.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moeerolibrary.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moeshare.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mohu.rocks"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"momoshop.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mondex.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"money-link.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moon.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moonbbs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moptt.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moneydj.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"monica.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"monitorchina.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"monocloud.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"morningsun.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"movements.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"moviefap.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.moztw.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mpettis.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mpfinance.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mpinews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mrtweet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mthruf.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mubi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"multiply.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mullvad.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"muzi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"muzi.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"my-private-network.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"myaudiocast.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbs.mychat.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mychinanews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mycnnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mykomica.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"myeclipseide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"myiphide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mymoe.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"myparagliding.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mypopescu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"myspacecdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"note.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nthlink.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"neodb.social"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nfscofficial.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nfsc.press"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newstimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newshub.co.nz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"assets.nxtrace.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nephobox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"namu.wiki"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nirsoft.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"naver.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"maven.neoforged.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nftstorage.link"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newindianexpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"news18.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbs.naixi.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nikke.hotcool.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nikke-kr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nikke-jp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nikke-en.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"netlify.app"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nightswatch.top"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nbyy.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newthuhole.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"naacoalition.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"naitik.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nakido.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nalandabodhi.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nalandawest.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nanyang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nanyangpost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nat.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"national-lottery.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nationalawakening.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nationalinterest.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nationalreview.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"line.naver.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"navyfamily.navy.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"navyreserve.navy.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"usno.navy.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nbcnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nchrd.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ncn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"etools.ncol.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ndi.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nekoslovakia.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"neowin.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"netalert.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"netflav.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"netme.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"netsarang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newchen.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newhighlandvision.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newmitbbs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"news1.kr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newsancai.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newsblur.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newsmax.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newstamago.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newstapa.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newstatesman.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newsweek.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newtalk.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"newyorker.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nexon.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nextdigital.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nexton-net.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nexttv.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"co.ng.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nga.mil"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nhentai.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nicoseiga.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nicovideo.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ninjaproxy.ninja"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"niusnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"njactb.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nlfreevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nmsl.website"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nnews.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"gotdns.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nobel.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nodeseek.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nokogiri.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nokola.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nordvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nos.nl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"notepad-plus-plus.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nownews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"npa.go.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nrk.no"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ntd.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ntdtv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ntdtv.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cbs.ntu.edu.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"media.nu.nl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nuexpo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nurgo-software.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nutaku.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nutsvpn.work"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nvdst.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nyaa.si"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nybooks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nypost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oldmapsonline.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"umap.openstreetmap.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"overdrive.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openart.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"osmand.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oklink.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"okcoin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"opencritic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ooni.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ooni.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"files.oaiusercontent.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"octocaptcha.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oojj.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"onevps.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"onedrive.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"olelive.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oann.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"october-review.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"odysee.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"officeoftibet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ogaoga.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ogate.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ohmyrss.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ok.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"okayfreedom.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"okk.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"olevod.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"olumpo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"omct.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"omnitalk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"omnitalk.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"omny.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"on.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"onedrive.live.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"onion.city"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"onion.ly"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"onlineyoutube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"onlygayvideo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"opendemocracy.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openid.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openleaks.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openstreetmap.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"opentech.fund"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openvpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"openwebster.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oricon.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"orient-doll.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"orientaldaily.com.my"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"orn.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"osfoora.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"otto.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ourdearamy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oursteps.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ourtv.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"overcast.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"overdaily.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"overplay.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ovpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"owltail.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"oxfordscholarship.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ow.ly"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ozvoice.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"perma.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pcgamesn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"penguin.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"prompthero.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pdst.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"static.pocketcasts.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"partnerstack.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"podwise.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"picsart.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"images.prismic.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"api.palworldgame.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pewresearch.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"privacyguides.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pancakeswap.finance"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"img.picgo.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pornmate.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"polymarket.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pandafan.pub"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"proxz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"potatso.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pendrivelinux.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"paimon.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"photonmedia.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"points-media.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pkuanvil.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pachosting.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pacopacomama.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"page.link"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"eriversoft.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pandapow.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pandavpn-jp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pandavpnpro.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pao-pao.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"parler.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"parsevideo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"passion.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pastie.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.pathtosharepoint.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"patreon.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"patreonusercontent.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pawoo.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pbs.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pbworks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"developers.box.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wiki.oauth.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wiki.phonegap.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wiki.jqueryui.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pbxes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pbxes.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pcgamestorrents.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pcij.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pct.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pdproxy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"peace.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"peing.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pekingduck.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pen.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.pentalogic.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pentoy.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"peoplenews.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"peopo.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"perfect-privacy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"perplexity.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"phayul.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"phncdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"photodharma.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"photofocus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"picacomiccn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"picuki.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pigav.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pin-cong.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pin6.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ping.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinimg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinoy-n.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.com.mx"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.cl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.at"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.es"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.ie"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.it"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.nz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.ph"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.pt"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pinterest.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pixeldrain.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pixelqi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"css.pixnet.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pixnet.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pkqjiasu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"placemix.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"play-asia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"playboy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"playboyplus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"player.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"playno1.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"playpcesor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"plexvpn.pro"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"plurk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pmatehunter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"po2b.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"podbean.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"podictionary.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"poe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pokerstars.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pokerstars.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zh.pokerstrategy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"politicalchina.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"poloniex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"polymerhk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"popvote.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"popxi.click"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"popyard.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pornhd.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pornhub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pornrapidshare.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pornstarbyface.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pornstarclub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"porntvblog.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"poskotanews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"post76.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"post852.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"potvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pourquoi.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"powercx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.powerpointninja.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ppy.sh"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"presidentlee.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdn.printfriendly.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"provpnaccounts.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"proxfree.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"proxynetwork.org.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pubu.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"puffinbrowser.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pureinsight.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"putty.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"calebelston.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.fizzik.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nf.id.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sogrady.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vatn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ventureswell.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whereiswerner.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"power.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"powerapple.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"prayforchina.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"prcleader.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"presentationzen.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"prestige-av.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pritunl.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"privacybox.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"private.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"privateinternetaccess.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"privatepaste.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"privatetunnel.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"privatevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"privoxy.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"procopytips.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"project-syndicate.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"prosiben.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"proxomitron.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"proxpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pshvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"psiphon.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"psiphon3.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pstatic.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pt.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ptt.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pttgame.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"main-ecnpaper-economist.content.pugpig.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pullfolio.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pureconcepts.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"purepdf.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"purevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pursuestar.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"pximg.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"python.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qobuz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"quakemachinex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qianmo.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qbittorrent.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qgirl.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qianbai.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qiandao.today"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qianglie.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qiangwaikan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qi-gong.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qiangyou.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qiwen.lu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qoos.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"efksoft.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qstatus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"qtrac.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"quitccp.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"roushuwo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"esim.redteago.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"restofworld.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rts.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rawstory.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"recordedfuture.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"roblox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radio.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rustdesk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rentry.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radmin-vpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rule34video.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"r10s.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rakuten.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"r0.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radio-canada.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radio-en-ligne.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rael.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radio.garden"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radioaustralia.net.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radiohilight.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radioline.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radiovaticana.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"radiovncr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"raggedbanner.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"raidcall.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rapidmoviez.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rapidvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rarbgprx.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rationalwiki.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rawgit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rawgithub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rcinet.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"reabble.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"readingtimes.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"readmoo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"realcourage.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"realitykings.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"reason.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"recoveryversion.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"red-lang.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"redbubble.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"redchinacn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"referer.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"reflectivecode.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.reimu.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"religionnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"renminbao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"renyurenquan.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"resilio.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"reuters.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"reutersmedia.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"resistchina.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"retweetrank.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rfa.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rferl.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rfi.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rfi.my"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"riku.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ritter.vg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rlwlw.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rmbl.ws"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"robustnessiskey.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rocket.chat"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rocket-inc.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rojo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ronjoneswriter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rolfoundation.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rolia.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rolsociety.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rou.video"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rsf.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rsf-chinese.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rsshub.app"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"phosphation13.rssing.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rssmeme.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rtalabel.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rthk.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rthk.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rti.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rti.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rule34.xxx"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rumble.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rusvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ruten.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rutracker.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rutracker.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"raphael.app"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rule34.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"supjav.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"api.shuaiapi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sb.sb"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sysub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sider.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sinchew.com.my"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"softether.co.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shitjournal.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spacex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"stephaniered.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"simianx.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"steamladder.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sora.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lt.sntp.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"solscan.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sina.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"swapspace.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"storry.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"standard.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"simplex.chat"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"soundon.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ssrtool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ssrshare.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"secure.shadowsocks.nu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"synapse.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"south-plus.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"silvergatebank.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"share-videos.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdn.statically.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"slides.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"suno.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sydney.bing.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sehuatang.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"singlelogin.se"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"suno.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"syosetu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"s-cute.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sacks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sacom.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sadpanda.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"safechat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"safeguarddefenders.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"safervpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sakuralive.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"salvation.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cn.sandscotaicentral.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sankakucomplex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sankei.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sanmin.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"savethesounds.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"savetibet.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"savetibet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"savetibetstore.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"saveuighur.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"scmp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"scramble.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"scribd.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"scriptspot.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"search.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"searx.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"seattlefdc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"secretchina.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"secretgarden.no"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"secretsline.biz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"secureservercdn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"securetunnel.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"securitykiss.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"seed4.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"news.seehua.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"seevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"seezone.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sehuatang.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sensortower.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sesawe.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sethwklein.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"setn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sevenload.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sex3.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sex8.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sexinsex.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sfshibao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sftuk.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shadeyouvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.shadowsocks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shadowsocks.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shadowsocks.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shahit.biz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sharecool.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shellfire.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shenyunperformingarts.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shenyunshop.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shenzhoufilm.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shenzhouzhengdao.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shixiao.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shizhao.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shodanhq.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shooshtime.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shopee.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"showwe.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shutterstock.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"shwchurch.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sidelinesnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"signal.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"simbolostwitter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"simplecd.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"simplecd.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"singaporepools.com.sg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"singtao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"singtaousa.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sinoca.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sinocast.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sinoants.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sinoinsider.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sinyalee.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sis001.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sitekreator.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sitemaps.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sketchappsources.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"skimtube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lab.skk.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"skybet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"skyvegas.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xskywalker.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"skyxvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sleazyfork.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"slheng.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"slideshare.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"slickvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"smartdnsproxy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"app.smartmailcloud.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"smh.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"smn.news"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sndcdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"socialblade.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"socks-proxy.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sockslist.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"softether.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cdn.softlayer.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sogclub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sohcradio.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sorting-algorithms.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"soup.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sobees.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"softwarebychuck.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"soh.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sohfrance.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"solana.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"somee.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"songjianjun.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"nakedsecurity.sophos.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sos.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sosad.fun"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"soulcaliburhentai.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"soundcloud.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"soundofhope.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"south-plus.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"southmongolia.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"southnews.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sowers.org.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spankbang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spatial.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spb.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"speakerdeck.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"speedcat.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"speedify.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spencertipping.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spendee.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spicevpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spideroak.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spotflux.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spreaker.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"spring4u.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"springwood.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sproutcore.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"squirrelvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ss-link.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ssrshare.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sstm.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sstmlt.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sstmlt.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"standupfortibet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"standwithhk.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"starp2p.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"startpage.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"static-economist.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"stboy.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"stc.com.sa"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"steel-storm.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"steganos.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sthoo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"stitcher.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"storagenewsletter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"storm.mg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"stoptibetcrisis.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"storj.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"stoweboyd.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"straitstimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"straplessdildo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"streamable.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"streamate.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"streamingthe.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"strongvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"studentsforafreetibet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"stumbleupon.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"substack.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"subhd.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sugarsync.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sugumiru18.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"suissl.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sumrando.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sundayguardianlive.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sunmedia.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sunporno.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"supervpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"surfeasy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"surfshark.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"surrenderat20.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"suyingtv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"swissinfo.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"swissvpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"switchvpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sydneytoday.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sylfoundation.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"syncback.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sotwe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taiav.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tryai.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theintercept.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"trtworld.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twstalker.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tvdy1.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tgstat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"the-sun.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theweek.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"techbang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thinkchina.sg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tor.eff.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tails.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"bbc.pdn.tritondigital.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"terobox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"temu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"trustwallet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tap.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taptap.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"talkatone.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tanks.gg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thehansindia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"rtm.tnt-ea.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tellapart.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"threads.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tg-me.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twkan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tunein.streamguys1.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tou.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tinyurl.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"textnow.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"token.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tokenlon.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tokenplus.app"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tardigrade.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"torrentgalaxy.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tomp3.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tukaani.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thetatoken.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"typeset.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thechasernews.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hole.thu.monster"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thuhole.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"t-g.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"t66y.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"esg.t91y.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taaze.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taedp.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tagwalk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taipeisociety.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taipeitimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taisounds.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taiwanhot.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taiwanncf.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taiwannews.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taiwantt.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"talkboxapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"talkcc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"talkonly.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tanc.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tapatalk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taup.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"taweet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tbcollege.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tbsec.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tbsn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"techviz.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"teck.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tehrantimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tenor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tenzinpalmo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tew.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tfc-taiwan.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tfiflve.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theatlantic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theatrum-belli.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cn.theaustralian.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thebcomplex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theblaze.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thebobs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thechinacollection.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theconversation.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thediplomat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thedw.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theepochtimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theguardian.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thegay.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thehindu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thehun.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theinitium.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thenewslens.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thepiratebay.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theporndude.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theportalwiki.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"theprint.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"threadreaderapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thesaturdaypaper.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thestandnews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thetibetpost.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thetvdb.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thewgo.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thewirechina.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thinkingtaiwan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thirdmill.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thisav.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thomasbernhard.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"throughnightsfire.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"thywords.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiananmenduizhi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiananmenuniv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiananmenuniv.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiandixing.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tianti.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiantibooks.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibet.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibet.nu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibet.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibet.to"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibet-envoy.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibet-initiative.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetaction.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetanbuddhistinstitute.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetancommunity.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetanentrepreneurs.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetanhealth.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetanliberation.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetanyouthcongress.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetcorps.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetexpress.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetfocus.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetfund.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetgermany.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibethouse.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibethouse.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibethouse.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetmuseum.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetnetwork.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetoffice.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetoffice.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetonline.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetoffice.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetonline.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetoralhistory.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetpolicy.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetrelieffund.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetsociety.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetsun.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetsupportgroup.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetswiss.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibettelegraph.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibettimes.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibettruth.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tibetwrites.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tigervpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"time.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"timesnownews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"timtales.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.tiney.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tingtalk.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tiny.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tinychat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tinypaste.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tipas.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tkcs-collins.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tmagazine.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tnaflix.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"to-porno.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"togetter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tokyo-porn-tube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tokyocn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"toptoon.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"torguard.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"top.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"topsy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"toptip.ca"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"torlock.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"torproject.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"torrentkitty.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"torrentprivacy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"torrenty.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tortoisesvn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"torvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"totalvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tpi.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tradingview.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"transparency.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"treemall.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"trendsmap.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"trouw.nl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"trt.net.tr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"truebuddha-md.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"truthsocial.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tt1069.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tttan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ttv.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tube8.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tube911.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tubewolf.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tuidang.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tumview.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tunnelbear.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tunnelblick.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tunnelr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tunsafe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"turbobit.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"turbohide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"turkistantimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tuvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"use.typekit.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tumblr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"lecloud.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"slutmoonbeam.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"mytvsuper.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tvbanywhere.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"akamai.tvb.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"inews-api.tvb.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"news.tvbs.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tvboxnow.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tvunetworks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twapperkeeper.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twaud.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twblogger.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweepml.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweetbackup.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweetboard.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweetedtimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweetphoto.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweetree.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweettunnel.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweetwally.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twelve.today"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twftp.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twgreatdaily.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twibble.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twibs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twiffo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twipple.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twip.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twishort.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twister.net.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twiggit.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitiq.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitlonger.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitoaster.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitonmsn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitstat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tweepguide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ads-twitter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twttr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitter4j.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twittercounter.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twittergadget.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitterkr.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twittermail.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitterrific.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twittertim.es"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitturk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twitturly.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"twreporter.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"tycool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"typepad.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"blog.expofutures.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"contests.twilio.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"typora.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"upsangel.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sbti.unun.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uniswap.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"up.audio"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"udomain.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"upbit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"demo.unlock-music.dev"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"u9un.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uberproxy.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uc-japan.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"udn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"udn.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uforadio.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uhdwallpapers.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uhrp.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uighur.nl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ultrasurf.us"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ultravpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ultravpn.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unblock.cn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unblock-us.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unblocksit.es"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"underwoodammo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unholyknight.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cldr.unicode.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unirule.cloud"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unknownspace.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unstable.icu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"unwire.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uocn.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"upghsbc.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"upmedia.mg"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uproxy.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uptodown.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"urbandictionary.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"urbansurvival.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"urlborg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"urlparser.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"usacn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"usaip.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uscnpm.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uscardforum.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"usma.edu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ustibetcommittee.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ustream.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"utopianpal.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uujiasu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uvwxyz.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uwants.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uyghur-j.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uyghuraa.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uyghuramerican.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uyghurbiz.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uyghurcongress.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uyghurpen.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uyghurstudies.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"uyghurtribunal.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"v.recipes"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vox.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vimeocdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpsxb.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vilanet.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"veed.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vewas.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"v2.help"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vocaroo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vern.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"v2fly.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"v2ray.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"v2raycn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"valeursactuelles.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vansky.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vaticannews.va"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vcf-online.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vcfbuilder.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"venetianmacao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vercel.app"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"verybs.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"viber.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"victimsofcommunism.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vid.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vidble.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"videobam.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"videomega.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vilavpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vimeo.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vimperator.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vincnd.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vinniev.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"virtualrealporn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"viu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vivaldi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vivthomas.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vjav.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vmixcore.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vnet.link"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vocus.cc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voicettank.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vot.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"voxer.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpn.ac"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpn4all.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnaccounts.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpncup.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpndada.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnforgame.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpngate.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpngate.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnhub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnmaster.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnmentor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpninja.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnjack.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnpick.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnpop.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnpronet.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnproxymaster.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnreactor.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnreviewz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnsecure.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnshazam.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnshieldapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpntunnel.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnuk.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnunlimitedapp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vpnvip.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vporn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vrchat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vrporn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vtunnel.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wtfpass.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"write.as"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"windy.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"washingtontimes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"worldjournal.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wispbyte.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"walletconnect.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wallzhihu.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikis.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"weights.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikiunblocked.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"websdr.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"webshare.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikipedia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wxw.moe"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wxw.cat"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"walletconnect.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"work2icu.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikiless.funami.tech"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"waffle1999.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wainao.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wallmama.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wallpapercasa.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wallsttv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"waltermartin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"waltermartin.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.wan-press.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wanderinghorse.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wangafu.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wangjinbo.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wango.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"want-daily.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"warroom.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"waselpro.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"watchinese.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"watchout.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wattpad.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"watchmygf.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wav.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"waybig.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wd.bible"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wealth.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wearn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hudatoriq.web.id"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"web2project.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wechatlawsuit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wefightcensorship.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"weijingsheng.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"weiming.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"welt.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wengewang.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wenxuecity.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wenyunchao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"westca.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"westernwolves.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"westpoint.edu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wezone.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wforum.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whatblocked.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wheelockslatin.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whoer.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whyx.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikileaks.ch"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikileaks.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikileaks.de"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikileaks.eu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikileaks.lu"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikileaks.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikileaks.pl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wilsoncenter.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"collateralmurder.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"collateralmurder.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikimapia.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wikiwand.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"casino.williamhill.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sports.williamhill.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"vegas.williamhill.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"willw.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"windscribe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wingy.site"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wionews.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wiredbytes.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wiredpen.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wireguard.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wisevid.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"whispersystems.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"witopia.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wjbk.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wmflabs.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wnacg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wnacg.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wo.tc"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"woeser.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wokar.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wolfax.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wombo.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"woolyss.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"woopie.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"woopie.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"workatruna.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"workerempowerment.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"worldvpn.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"videopress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chenshan20042005.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"chinaview.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"cnbbnews.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"freedominfonetweb.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hka8964.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hkanews.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hqsbnet.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"hqsbonline.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"investigating.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"jobnewera.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"matthewdgreen.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"minghuiyw.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wo3ttt.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"sujiatun.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xijie.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"ifreechina.wordpress.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wp.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wplace.live"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wowporn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wowgirls.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wpoforum.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"writesonic.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wsj.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wsj.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wufafangwen.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wufi.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wujieliulan.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wuw.red"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"wwitv.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"x86.fr"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xuan.com.my"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xdaforums.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xcancel.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"www.xicons.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"x.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xt.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xt.pub"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"x.co"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"x-berry.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"x-art.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"x-wall.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"x3guide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xbabe.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xbookcn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xcafe.in"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xcity.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xerotica.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xfxssr.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xgmyd.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xhamster.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xiaolan.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xiaoma.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xiaohexie.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xiaxiaoqiang.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xinjiangpolicefiles.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xinmiao.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xjtravelguide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xml-training-guide.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xnxx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xpud.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xtube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xuchao.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xuchao.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xvideos.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xvideos-cdn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xvideos.es"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xvbelink.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xvinlink.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xsden.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xxx.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"xxxx.com.au"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yfsp.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youmind.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yangzhi.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"storage.yandex.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"y2mate.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yadi.sk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yakbutterblues.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yam.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yam.org.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yande.re"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"disk.yandex.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"disk.yandex.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yasni.co.uk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yasukuni.or.jp"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"news.ycombinator.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yeahteentube.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yecl.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yeelou.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yeeyi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yegle.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yes123.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yesasia.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yesasia.com.hk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yespornplease.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yhcw.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yibaochina.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"s.yimg.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yipub.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yizhihongxing.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yobt.tv"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yogichen.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"you.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youxu.info"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youjizz.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youmaker.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youpai.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yourepeat.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yousendit.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youporn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youporngay.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yourlisten.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yourlust.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"youversion.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yulghun.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yunchao.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yunomi.tokyo"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yvesgeleyn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yyii.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yyjlymb.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yysub.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"yzzk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zenmux.ai"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhangzhehan.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zaochenbao.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"z-library.ec"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"z-library.sk"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"z-lib.fm"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"z-lib.gd"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"z-lib.gl"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"z-lib.fo"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zodgame.xyz"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhongzidi.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zooqle.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"z-lib.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"z-lib.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zalmos.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zdnet.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zello.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zenmate.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zenmate.com.ru"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zerohedge.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zeronet.io"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhangtianliang.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhanlve.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhengjian.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhengwunet.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhongguotese.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhuatieba.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zhuichaguoji.org"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zi.media"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zillionk.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zinio.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zmedia.com.tw"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zmw.cn"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zonaeuropa.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zonghexinwen.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zoogvpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zootool.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zophar.net"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zorrovpn.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zpn.im"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zspeeder.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zuo.la"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zuobiao.me"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zuola.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zvereff.com"}},{"action":"proxy","match":{"kind":"domainSuffix","value":"zyxel.com"}}],"schemaVersion":2}
diff --git a/ShadowsocksX-NG2/Vendor/sslocal/LICENSE b/ShadowsocksX-NG2/Vendor/sslocal/LICENSE
new file mode 100644
index 000000000..879f67816
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/sslocal/LICENSE
@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Y. T. CHUNG <zonyitoo@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/sslocal/THIRD-PARTY-NOTICES b/ShadowsocksX-NG2/Vendor/sslocal/THIRD-PARTY-NOTICES
new file mode 100644
index 000000000..e96a7cd06
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/sslocal/THIRD-PARTY-NOTICES
@@ -0,0 +1,169 @@
+Third-party notices for sslocal.
+
+Shadowsocks-Rust `sslocal` (manifest: `manifest.json`; release `v1.26.0`; source commit [`e83d0d2b18cd5fa922c610270932e01d0fe0646f`](https://github.com/qiuyuzhou/shadowsocks-rust/commit/e83d0d2b18cd5fa922c610270932e01d0fe0646f); the [release workflow](https://github.com/qiuyuzhou/shadowsocks-rust/blob/v1.26.0/.github/workflows/build-release.yml) uses `full`; target `aarch64-apple-darwin`).
+The direct Shadowsocks-Rust/workspace crates are handled separately. This file covers external Rust crates in the locked `full` target dependency graph.
+Complete license terms are stored once per SPDX identifier in `../third-party-licenses/`; entries below group components and retain their copyright/attribution notices without repeating license bodies.
+
+## 0BSD
+
+License text: `../third-party-licenses/0BSD.txt`
+
+Components: managed, mock_instant, smoltcp.
+
+- Copyright (C) 2017 whitequark@whitequark.org
+- Copyright (C) 2020 by museun <museun@outlook.com>
+- Copyright (C) smoltcp contributors
+
+## Apache-2.0
+
+License text: `../third-party-licenses/Apache-2.0.txt`
+
+Components: adler2, aead, aes, aes-gcm, anstream, anstyle, anstyle-parse, anstyle-query,
+  anyhow, arc-swap, arrayvec, atomic-waker, aws-lc-sys, base64, bitflags, blake3,
+  block-buffer, byte_string, camellia, cfg-if, chacha20, chacha20poly1305, chrono, cipher,
+  clap, clap_builder, clap_lex, cmov, colorchoice, const-oid, constant_time_eq,
+  core-foundation, core-foundation-sys, cpubits, cpufeatures, crc32fast, critical-section,
+  crossbeam-channel, crossbeam-epoch, crossbeam-utils, crypto-common, ctr, ctutils, deranged,
+  destructure_traitobject, digest, directories, dirs-sys, dynosaur, either, equivalent, errno,
+  etherparse, flate2, fnv, form_urlencoded, futures, futures-channel, futures-core,
+  futures-executor, futures-io, futures-sink, futures-task, futures-util, getrandom, ghash,
+  hash32, hashbrown, heapless, hickory-net, hickory-proto, hickory-resolver, hkdf, hmac, http,
+  httparse, httpdate, humantime, hybrid-array, iana-time-zone, idna, idna_adapter, indexmap,
+  inout, ipnet, is_terminal_polyfill, itoa, lazy_static, libc, lock_api, log, log-mdc, log4rs,
+  md-5, mime, miniz_oxide, moka, notify-types, num-conv, num-traits, num_threads, once_cell,
+  parking_lot, parking_lot_core, percent-encoding, pin-project, pin-project-lite, poly1305,
+  polyval, portable-atomic, powerfmt, ppv-lite86, prefix-trie, qrcode, rand, rand_chacha,
+  rand_core, regex, regex-automata, regex-syntax, resolv-conf, rpassword, rtoolbox, rustix,
+  rustls, rustls-native-certs, rustls-pki-types, ryu, scopeguard, security-framework,
+  security-framework-sys, sendfd, serde, serde_core, serde_json, serde_urlencoded, serde_yaml,
+  sha1, signal-hook-registry, smallvec, socket2, stable_deref_trait, symlink, sysexits,
+  system-configuration, system-configuration-sys, tagptr, terminal_size, thiserror, thread-id,
+  thread_local, time, time-core, tinyvec, tinyvec_macros, tokio-rustls, typenum, ucd-trie,
+  unicode-segmentation, universal-hash, url, utf8_iter, utf8parse, uuid, xdg, zerocopy,
+  zeroize.
+
+- Copyright (c) 2012-2013 Mozilla Foundation (core-foundation and core-foundation-sys).
+- Copyright (c) 2014, Kang Seonghoon.
+- Copyright (c) 2019-2026 The RustCrypto Project Developers (aead).
+- Copyright (c) 2019 MobileCoin, LLC (aead).
+
+## BSD-3-Clause
+
+License text: `../third-party-licenses/BSD-3-Clause.txt`
+
+Components: alloc-no-stdlib, alloc-stdlib, aws-lc-sys, brotli, subtle, zstd, zstd-safe,
+  zstd-sys.
+
+- Copyright (c) 2016 Dropbox, Inc.
+- Copyright (c) 2016-2017 Isis Agora Lovecruft, Henry de Valence. All rights reserved.
+- Copyright (c) 2016-2024 Isis Agora Lovecruft. All rights reserved.
+- Copyright (c) 2026, Alexandre Bury
+- Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved.
+
+## CC0-1.0
+
+License text: `../third-party-licenses/CC0-1.0.txt`
+
+Components: aws-lc-sys, notify.
+
+## CDLA-Permissive-2.0
+
+License text: `../third-party-licenses/CDLA-Permissive-2.0.txt`
+
+Components: webpki-roots.
+
+## ISC
+
+License text: `../third-party-licenses/ISC.txt`
+
+Components: aws-lc-rs, aws-lc-sys, rustls-webpki, untrusted.
+
+- Copyright (c) 1995-2003 by Internet Software Consortium
+- Copyright (c) 2004-2010 by Internet Systems Consortium, Inc. ("ISC")
+- Copyright 2015 Brian Smith.
+
+## MIT
+
+License text: `../third-party-licenses/MIT.txt`
+
+Components: aho-corasick, aws-lc-sys, brotli, brotli-decompressor, byteorder, bytes,
+  data-encoding, derive_more, fsevent-sys, h2, http-body, http-body-util, hyper, iprange,
+  json5, lru_time_cache, matchers, memchr, mio, nix, nu-ansi-term, ordered-float, same-file,
+  serde-value, shadowsocks-crypto, sharded-slab, simd-adler32, slab, spin, strsim,
+  syslog-tracing, tokio, tokio-tfo, tokio-util, tracing, tracing-appender, tracing-core,
+  tracing-log, tracing-subscriber, try-lock, typemap-ors, unsafe-any-ors, unsafe-libyaml,
+  walkdir, want, zmij.
+
+- Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors.
+- Copyright (c) 2014 Benjamin Sago
+- Copyright (c) 2014 Carl Lerche and other MIO contributors
+- Copyright (c) 2014 Mathijs van de Nes
+- Copyright (c) 2014-2026 Sean McArthur
+- Copyright (c) 2015 Andrew Gallant
+- Copyright (c) 2015 Carl Lerche + nix-rust Authors
+- Copyright (c) 2015 Danny Guo
+- Copyright (c) 2015 Jonathan Reem
+- Copyright (c) 2015 Pierre Baillet
+- Copyright (c) 2015-2020 Julien Cretin
+- Copyright (c) 2016 Alex Crichton
+- Copyright (c) 2016 arcnmx
+- Copyright (c) 2016 Jelte Fennema
+- Copyright (c) 2016 Titus Wormer <tituswormer@gmail.com>
+- Copyright (c) 2017 Andrew Gallant
+- Copyright (c) 2017 h2 authors
+- Copyright (c) 2017 Y. T. CHUNG <zonyitoo@gmail.com>
+- Copyright (c) 2017 Yilin Chen
+- Copyright (c) 2017-2020 Google Inc.
+- Copyright (c) 2018 Akash Kurdekar
+- Copyright (c) 2018 Carl Lerche
+- Copyright (c) 2018-2019 Sean McArthur
+- Copyright (c) 2018-2023 Sean McArthur
+- Copyright (c) 2019 Carl Lerche
+- Copyright (c) 2019 Eliza Weisman
+- Copyright (c) 2019 Tokio Contributors
+- Copyright (c) 2019 Yoshua Wuyts
+- Copyright (c) 2019-2026 Sean McArthur & Hyper Contributors
+- Copyright (c) 2020 寧靜
+- Copyright (c) 2021 Y. T. ZHONG
+- Copyright (c) 2021-2022 The Nushell Project Developers
+- Copyright (c) 2025 Callum Oakley
+- Copyright (c) [2021] [Marvin Countryman]
+- Copyright (c) Tokio Contributors
+- Copyright 2016 Nika Layzell
+- Copyright 2018 MaidSafe.net limited.
+
+## MPL-2.0
+
+License text: `../third-party-licenses/MPL-2.0.txt`
+
+Components: option-ext.
+
+## Unicode-3.0
+
+License text: `../third-party-licenses/Unicode-3.0.txt`
+
+Components: icu_collections, icu_locale_core, icu_normalizer, icu_normalizer_data,
+  icu_properties, icu_properties_data, icu_provider, litemap, potential_utf, tinystr,
+  writeable, yoke, zerofrom, zerotrie, zerovec.
+
+- Copyright © 1991-2023 Unicode, Inc.
+- Copyright © 2020-2024 Unicode, Inc.
+- ICU 1.8.1 to ICU 57.1 © 1995-2016 International Business Machines Corporation and others.
+
+## WTFPL
+
+License text: `../third-party-licenses/WTFPL.txt`
+
+Components: tun.
+
+## Additional upstream notices
+
+- `moka` source files `src/common/frequency_sketch.rs` and `src/common/timer_wheel.rs` are Apache-2.0-only (the remaining Moka library is MIT/Apache-2.0); see `../third-party-licenses/additional-notices/sslocal-moka-NOTICE.txt`.
+- `rand` COPYRIGHT applies to Rand, rand_chacha, and rand_core; the shared upstream statement is in `../third-party-licenses/additional-notices/rust-rand-COPYRIGHT.txt`. `symlink` has its own copyright notice at `../third-party-licenses/additional-notices/sslocal-symlink-COPYRIGHT.txt`.
+- `aws-lc-sys` has additional compiled-code attributions and license-branch details at `../third-party-licenses/additional-notices/sslocal-aws-lc-COPYRIGHTS.txt`. Its `Keccak / AES Reference Implementations` section identifies CC0 code, included above with the shared CC0-1.0 text; `s2n-bignum` permits Apache-2.0, ISC, or MIT-0, and the report uses the accepted Apache-2.0/ISC branches; Amazon elects BSD-3-Clause rather than GPL-2.0 for Jitter Entropy. The upstream file marks Google Test, its Go test runner, and Wycheproof vectors as not compiled into libcrypto/libssl; those are excluded.
+- AWS-LC uses an ISC warranty clause with `AUTHOR` wording; preserve that source variant at `../third-party-licenses/additional-notices/sslocal-aws-lc-ISC-variation.txt`.
+- `untrusted` and `rustls-webpki` use an ISC-style warranty clause with `AUTHORS` wording; preserve that source variant at `../third-party-licenses/additional-notices/sslocal-rustls-ISC-variation.txt`. The `rustls-webpki` package's `include` list excludes the `third-party/chromium` path mentioned in its source LICENSE.
+- `zstd`, `zstd-safe`, and `zstd-sys` have a source-specific BSD-3-Clause condition 3 at `../third-party-licenses/additional-notices/sslocal-zstd-BSD-3-Clause-variation.txt`.
+- `rustix` reports some Rust standard-library-derived files and permits Apache-2.0-with-LLVM-exception, Apache-2.0, or MIT; the generated graph selected the Apache-2.0 branch. Preserve the upstream copyright guidance: `../third-party-licenses/additional-notices/sslocal-rustix-COPYRIGHT.txt`.
+- `utf8_iter` documents Rust standard-library-derived code and its designated test-code public-domain exception; preserve its full upstream notice: `../third-party-licenses/additional-notices/sslocal-utf8_iter-COPYRIGHT.txt`.
+- `aho-corasick`, `byteorder`, `memchr`, `same-file`, and `walkdir` also offer Unlicense as an alternative to MIT; the report selected their MIT branch. The `COPYING` statements are selection guidance, not additional license bodies.
diff --git a/ShadowsocksX-NG2/Vendor/sslocal/manifest.json b/ShadowsocksX-NG2/Vendor/sslocal/manifest.json
new file mode 100644
index 000000000..e8498edd2
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/sslocal/manifest.json
@@ -0,0 +1,12 @@
+{
+  "project": "shadowsocks-rust",
+  "release": "v1.26.0",
+  "target": "aarch64-apple-darwin",
+  "asset": "shadowsocks-v1.26.0.aarch64-apple-darwin.tar.xz",
+  "url": "https://github.com/qiuyuzhou/shadowsocks-rust/releases/download/v1.26.0/shadowsocks-v1.26.0.aarch64-apple-darwin.tar.xz",
+  "archiveSHA256": "deda5c3591dd08ec1cd72acdec07c18c33c93ca2d40c6e9fc68121b3e9fa3707",
+  "archiveMember": "sslocal",
+  "binary": "sslocal",
+  "bundleSubpath": "Helpers",
+  "signIdentifier": "com.qiuyuzhou.ShadowsocksX-NG2.sslocal"
+}
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/0BSD.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/0BSD.txt
new file mode 100644
index 000000000..c7ffe153f
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/0BSD.txt
@@ -0,0 +1,10 @@
+Permission to use, copy, modify, and/or distribute this software for
+any purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
+AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/Apache-2.0.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/Apache-2.0.txt
new file mode 100644
index 000000000..cdf3b7b1c
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/Apache-2.0.txt
@@ -0,0 +1,201 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2021 Jacob Pratt
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/BSD-2-Clause.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/BSD-2-Clause.txt
new file mode 100644
index 000000000..474c771c6
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/BSD-2-Clause.txt
@@ -0,0 +1,20 @@
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+  Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+  Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/BSD-3-Clause.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/BSD-3-Clause.txt
new file mode 100644
index 000000000..f80c58a18
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/BSD-3-Clause.txt
@@ -0,0 +1,27 @@
+BSD 3-Clause License
+
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/CC0-1.0.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/CC0-1.0.txt
new file mode 100644
index 000000000..dc9fa75ba
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/CC0-1.0.txt
@@ -0,0 +1,41 @@
+Creative Commons CC0 1.0 Universal
+
+<<beginOptional;name=ccOptionalIntro>> CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED HEREUNDER.  <<endOptional>>
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer exclusive Copyright and Related Rights (defined below) upon the creator and subsequent owner(s) (each and all, an "owner") of an original work of authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for the purpose of contributing to a commons of creative, cultural and scientific works ("Commons") that the public can reliably and without fear of later claims of infringement build upon, modify, incorporate in other works, reuse and redistribute as freely as possible in any form whatsoever and for any purposes, including without limitation commercial purposes. These owners may contribute to the Commons to promote the ideal of a free culture and the further production of creative, cultural and scientific works, or to gain reputation or greater distribution for their Work in part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any expectation of additional consideration or compensation, the person associating CC0 with a Work (the "Affirmer"), to the extent that he or she is an owner of Copyright and Related Rights in the Work, voluntarily elects to apply CC0 to the Work and publicly distribute the Work under its terms, with knowledge of his or her Copyright and Related Rights in the Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be protected by copyright and related or neighboring rights ("Copyright and Related Rights"). Copyright and Related Rights include, but are not limited to, the following:
+
+     i. the right to reproduce, adapt, distribute, perform, display, communicate, and translate a Work;
+
+     ii. moral rights retained by the original author(s) and/or performer(s);
+
+     iii. publicity and privacy rights pertaining to a person's image or likeness depicted in a Work;
+
+     iv. rights protecting against unfair competition in regards to a Work, subject to the limitations in paragraph 4(a), below;
+
+     v. rights protecting the extraction, dissemination, use and reuse of data in a Work;
+
+     vi. database rights (such as those arising under Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, and under any national implementation thereof, including any amended or successor version of such directive); and
+
+     vii. other similar, equivalent or corresponding rights throughout the world based on applicable law or treaty, and any national implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention of, applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer's Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer's heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason be judged legally invalid or ineffective under applicable law, then the Waiver shall be preserved to the maximum extent permitted taking into account Affirmer's express Statement of Purpose. In addition, to the extent the Waiver is so judged Affirmer hereby grants to each affected person a royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional license to exercise Affirmer's Copyright and Related Rights in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "License"). The License shall be deemed effective as of the date CC0 was applied by Affirmer to the Work. Should any part of the License for any reason be judged legally invalid or ineffective under applicable law, such partial invalidity or ineffectiveness shall not invalidate the remainder of the License, and in such case Affirmer hereby affirms that he or she will not (i) exercise any of his or her remaining Copyright and Related Rights in the Work or (ii) assert any associated claims and causes of action with respect to the Work, in either case contrary to Affirmer's express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+     a. No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.
+
+     b. Affirmer offers the Work as-is and makes no representations or warranties of any kind concerning the Work, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non infringement, or the absence of latent or other defects, accuracy, or the present or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.
+
+     c. Affirmer disclaims responsibility for clearing rights of other persons that may apply to the Work or any use thereof, including without limitation any person's Copyright and Related Rights in the Work. Further, Affirmer disclaims responsibility for obtaining any necessary consents, permissions or other rights required for any use of the Work.
+
+     d. Affirmer understands and acknowledges that Creative Commons is not a party to this document and has no duty or obligation with respect to this CC0 or use of the Work.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/CDLA-Permissive-2.0.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/CDLA-Permissive-2.0.txt
new file mode 100644
index 000000000..8e84169cf
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/CDLA-Permissive-2.0.txt
@@ -0,0 +1,61 @@
+# Community Data License Agreement - Permissive - Version 2.0
+
+This is the Community Data License Agreement - Permissive, Version
+2.0 (the "agreement"). Data Provider(s) and Data Recipient(s) agree
+as follows:
+
+## 1. Provision of the Data
+
+1.1. A Data Recipient may use, modify, and share the Data made
+available by Data Provider(s) under this agreement if that Data
+Recipient follows the terms of this agreement.
+
+1.2. This agreement does not impose any restriction on a Data
+Recipient's use, modification, or sharing of any portions of the
+Data that are in the public domain or that may be used, modified,
+or shared under any other legal exception or limitation.
+
+## 2. Conditions for Sharing Data
+
+2.1. A Data Recipient may share Data, with or without modifications, so
+long as the Data Recipient makes available the text of this agreement
+with the shared Data.
+
+## 3. No Restrictions on Results
+
+3.1. This agreement does not impose any restriction or obligations
+with respect to the use, modification, or sharing of Results.
+
+## 4. No Warranty; Limitation of Liability
+
+4.1. All Data Recipients receive the Data subject to the following
+terms:
+
+THE DATA IS PROVIDED ON AN "AS IS" BASIS, WITHOUT REPRESENTATIONS,
+WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED
+INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+NO DATA PROVIDER SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING
+WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE DATA OR RESULTS,
+EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+## 5. Definitions
+
+5.1. "Data" means the material received by a Data Recipient under
+this agreement.
+
+5.2. "Data Provider" means any person who is the source of Data
+provided under this agreement and in reliance on a Data Recipient's
+agreement to its terms.
+
+5.3. "Data Recipient" means any person who receives Data directly
+or indirectly from a Data Provider and agrees to the terms of this
+agreement.
+
+5.4. "Results" means any outcome obtained by computational analysis
+of Data, including for example machine learning models and models'
+insights.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/ISC.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/ISC.txt
new file mode 100644
index 000000000..f2dc93d9c
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/ISC.txt
@@ -0,0 +1,3 @@
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/LGPL-3.0.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/LGPL-3.0.txt
new file mode 100644
index 000000000..6600f1c98
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/LGPL-3.0.txt
@@ -0,0 +1,165 @@
+GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/MIT.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/MIT.txt
new file mode 100644
index 000000000..73e41b1f6
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/MIT.txt
@@ -0,0 +1,17 @@
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/MPL-2.0.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/MPL-2.0.txt
new file mode 100644
index 000000000..d0a1fa148
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/MPL-2.0.txt
@@ -0,0 +1,373 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/Unicode-3.0.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/Unicode-3.0.txt
new file mode 100644
index 000000000..da0d243b9
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/Unicode-3.0.txt
@@ -0,0 +1,37 @@
+UNICODE LICENSE V3
+
+
+
+NOTICE TO USER: Carefully read the following legal agreement. BY
+DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR
+SOFTWARE, YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
+TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT
+DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of data files and any associated documentation (the "Data Files") or
+software and any associated documentation (the "Software") to deal in the
+Data Files or Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, and/or sell
+copies of the Data Files or Software, and to permit persons to whom the
+Data Files or Software are furnished to do so, provided that either (a)
+this copyright and permission notice appear with all copies of the Data
+Files or Software, or (b) this copyright and permission notice appear in
+associated Documentation.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
+KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+THIRD PARTY RIGHTS.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE
+BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES,
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA
+FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall
+not be used in advertising or otherwise to promote the sale, use or other
+dealings in these Data Files or Software without prior written
+authorization of the copyright holder.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/WTFPL.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/WTFPL.txt
new file mode 100644
index 000000000..7a3094a82
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/WTFPL.txt
@@ -0,0 +1,11 @@
+DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+Version 2, December 2004
+
+Copyright (C) 2004 Sam Hocevar <sam@hocevar.net>
+
+Everyone is permitted to copy and distribute verbatim or modified copies of this license document, and changing it is allowed as long as the name is changed.
+
+DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. You just DO WHAT THE FUCK YOU WANT TO.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/AgeSwift-ICU4X-attribution.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/AgeSwift-ICU4X-attribution.txt
new file mode 100644
index 000000000..3e76fde8f
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/AgeSwift-ICU4X-attribution.txt
@@ -0,0 +1 @@
+SPDX-License-Identifier: Unicode-3.0 — Portions of ICU4X may have been adapted from ICU4C and/or ICU4J.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/AgeSwift-group-COPYRIGHT.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/AgeSwift-group-COPYRIGHT.txt
new file mode 100644
index 000000000..849e32747
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/AgeSwift-group-COPYRIGHT.txt
@@ -0,0 +1,14 @@
+Copyrights in the "group" library are retained by their contributors. No
+copyright assignment is required to contribute to the "group" library.
+
+The "group" library is licensed under either of
+
+ * Apache License, Version 2.0, (see ./LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license (see ./LICENSE-MIT or http://opensource.org/licenses/MIT)
+
+at your option.
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual licensed as above, without any additional terms or
+conditions.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/Go-BSD-3-Clause-source-variations.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/Go-BSD-3-Clause-source-variations.txt
new file mode 100644
index 000000000..62424554b
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/Go-BSD-3-Clause-source-variations.txt
@@ -0,0 +1,13 @@
+Several Go sources use source-specific condition 3 wording in place of condition 3 in the shared BSD-3-Clause text.
+
+For the Go standard libraries (`go1.24.5` and `go1.27.3`) and the `golang.org/x/crypto`, `golang.org/x/exp/constraints`, `golang.org/x/net`, `golang.org/x/sys`, and `golang.org/x/text` modules, condition 3 is:
+
+   * Neither the name of Google LLC nor the names of its contributors may be
+     used to endorse or promote products derived from this software without
+     specific prior written permission.
+
+For `github.com/golang/protobuf`, `google.golang.org/protobuf`, `github.com/klauspost/compress`, `github.com/klauspost/compress/internal/snapref`, and `github.com/refraction-networking/utls`, condition 3 is:
+
+   * Neither the name of Google Inc. nor the names of its contributors may be
+     used to endorse or promote products derived from this software without
+     specific prior written permission.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/ck-client-ecdh-BSD-3-Clause-variation.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/ck-client-ecdh-BSD-3-Clause-variation.txt
new file mode 100644
index 000000000..50d69972c
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/ck-client-ecdh-BSD-3-Clause-variation.txt
@@ -0,0 +1,5 @@
+For Cloak's embedded `internal/ecdh` implementation (`wsddn/go-ecdh`), the upstream BSD-3-Clause text uses this source-specific condition 3 in place of condition 3 in the shared BSD-3-Clause text:
+
+    * Neither the name of tang0th nor the names of its contributors may be
+      used to endorse or promote products derived from this software without
+      specific prior written permission.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/ck-client-ratelimit-linking-exception.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/ck-client-ratelimit-linking-exception.txt
new file mode 100644
index 000000000..084e81f5d
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/ck-client-ratelimit-linking-exception.txt
@@ -0,0 +1,24 @@
+All files in this repository are licensed as follows. If you contribute
+to this repository, it is assumed that you license your contribution
+under the same license unless you state otherwise.
+
+All files Copyright (C) 2015 Canonical Ltd. unless otherwise specified in the file.
+
+This software is licensed under the LGPLv3, included below.
+
+As a special exception to the GNU Lesser General Public License version 3
+("LGPL3"), the copyright holders of this Library give you permission to
+convey to a third party a Combined Work that links statically or dynamically
+to this Library without providing any Minimal Corresponding Source or
+Minimal Application Code as set out in 4d or providing the installation
+information set out in section 4e, provided that you comply with the other
+provisions of LGPL3 and provided that you meet, for the Application the
+terms and conditions of the license(s) which apply to the Application.
+
+Except as stated in this special exception, the provisions of LGPL3 will
+continue to comply in full to this Library. If you modify this Library, you
+may apply this exception to your version of this Library, but you are not
+obliged to do so. If you do not wish to do so, delete this exception
+statement from your version. This exception does not (and cannot) modify any
+license terms which apply to the Application, with which you must still
+comply.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/rust-rand-COPYRIGHT.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/rust-rand-COPYRIGHT.txt
new file mode 100644
index 000000000..468d907ca
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/rust-rand-COPYRIGHT.txt
@@ -0,0 +1,12 @@
+Copyrights in the Rand project are retained by their contributors. No
+copyright assignment is required to contribute to the Rand project.
+
+For full authorship information, see the version control history.
+
+Except as otherwise noted (below and/or in individual files), Rand is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
+
+The Rand project includes code from the Rust project
+published under these same licenses.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-aws-lc-COPYRIGHTS.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-aws-lc-COPYRIGHTS.txt
new file mode 100644
index 000000000..d0305cc06
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-aws-lc-COPYRIGHTS.txt
@@ -0,0 +1,141 @@
+AWS Libcrypto (AWS-LC)
+
+AWS-LC is a fork of BoringSSL, which is itself a fork of OpenSSL.
+Content from these and other sources retains their original licensing,
+as described below. New files from AWS-LC are made available under the Apache-2.0 license OR the ISC
+license. These licenses are reproduced at the bottom of this file.
+
+```
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+SPDX-License-Identifier: Apache-2.0 OR ISC
+```
+
+
+================================================================================
+BoringSSL
+================================================================================
+
+BoringSSL is a Google-maintained fork of OpenSSL. Historically, code
+authored by Google for BoringSSL was licensed under the ISC License.
+BoringSSL has since relicensed upstream to Apache License 2.0. Existing
+AWS-LC code originating from BoringSSL retains its ISC license, while
+newer code taken from BoringSSL is licensed under Apache License 2.0.
+
+```
+Copyright (c) 2014-2024 Google Inc.
+SPDX-License-Identifier: ISC
+```
+
+Additional individual contributions to BoringSSL-derived code are
+covered under the ISC license:
+
+  - Brian Smith (Copyright 2016)
+  - Robert Nagy (Copyright 2022)
+  - Arm Ltd (Copyright 2020)
+
+```
+Copyright (c) 2025-2026 Google Inc.
+SPDX-License-Identifier: Apache-2.0
+```
+
+================================================================================
+OpenSSL
+================================================================================
+
+Code derived from the OpenSSL project is licensed under the
+Apache License, Version 2.0.
+
+```
+Copyright (c) 1998-2011 The OpenSSL Project. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+```
+
+Some OpenSSL-derived files also carry the original SSLeay copyright:
+
+```
+Copyright (c) 1995-1998 Eric Young (eay@cryptsoft.com). All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+```
+
+Portions of OpenSSL-derived code include contributions from:
+
+  - Sun Microsystems, Inc. (Copyright 2002)
+  - Nokia (Copyright 2005)
+  - Intel Corporation (Copyright 2012-2021)
+
+These contributions are covered under the Apache-2.0 license.
+
+================================================================================
+mlkem-native
+================================================================================
+
+Code from the mlkem-native project is licensed under Apache License 2.0 or MIT or ISC.
+
+```
+Copyright (c) The mlkem-native project authors.
+SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+```
+
+================================================================================
+mldsa-native
+================================================================================
+
+Code from the mldsa-native project is licensed under Apache License 2.0 or MIT or ISC
+
+```
+Copyright (c) The mldsa-native project authors.
+SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+```
+
+================================================================================
+Third-Party Libraries (compiled into libcrypto/libssl)
+================================================================================
+
+Fiat Cryptography
+-----------------
+Synthesizing Correct-by-Construction Code for Cryptographic Primitives.
+See third_party/fiat/LICENSE.
+
+```
+Copyright (c) 2015-2020 the fiat-crypto authors.
+SPDX-License-Identifier: MIT
+```
+
+s2n-bignum
+----------
+Integer arithmetic routines for cryptography.
+See third_party/s2n-bignum/s2n-bignum-imported/LICENSE.
+
+```
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0
+```
+
+Note: ML-KEM/SHA3 code within s2n-bignum is licensed as
+Apache-2.0 OR ISC OR MIT (with attribution), sourced from the
+mlkem-native project.
+
+Jitter Entropy RNG
+-------------------
+CPU Jitter Random Number Generator Library.
+See third_party/jitterentropy/jitterentropy-library/LICENSE.
+
+The Jitter Entropy library is dual-licensed under a BSD-style license
+and the GNU General Public License Version 2. Amazon expressly elects
+to distribute the package under the 3-Clause BSD License and NOT under
+GNU General Public License Version 2.
+
+```
+Copyright (C) 2017 - 2025, Stephan Mueller <smueller@chronox.de>.
+SPDX-License-Identifier: BSD-3-Clause
+```
+
+Keccak / AES Reference Implementations
+---------------------------------------
+Public domain (CC0) contributions.
+https://creativecommons.org/public-domain/cc0
+
+Code from sources and by authors listed in comments on top of the respective files.
+
+
+================================================================================
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-aws-lc-ISC-variation.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-aws-lc-ISC-variation.txt
new file mode 100644
index 000000000..264402d83
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-aws-lc-ISC-variation.txt
@@ -0,0 +1,10 @@
+For AWS-LC code selected under ISC, its upstream `LICENSE` uses the following source-specific warranty/disclaimer wording in place of the final warranty/disclaimer paragraph in the shared SPDX ISC text:
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-moka-NOTICE.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-moka-NOTICE.txt
new file mode 100644
index 000000000..46400ce78
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-moka-NOTICE.txt
@@ -0,0 +1,14 @@
+Additional Notices for Moka
+
+The majority of the Moka library is dual-licensed under the MIT and Apache 2.0
+licenses.
+
+However, the following files are an exception and are licensed solely under
+the Apache License 2.0:
+
+- src/common/frequency_sketch.rs
+- src/common/timer_wheel.rs
+
+These files were ported from the Java Caffeine library and are not dual-licensed.
+
+Please refer to the LICENSE-APACHE file for more details on the Apache License 2.0.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-rustix-COPYRIGHT.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-rustix-COPYRIGHT.txt
new file mode 100644
index 000000000..a841525ef
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-rustix-COPYRIGHT.txt
@@ -0,0 +1,29 @@
+Short version for non-lawyers:
+
+`rustix` is triple-licensed under Apache 2.0 with the LLVM Exception,
+Apache 2.0, and MIT terms.
+
+
+Longer version:
+
+Copyrights in the `rustix` project are retained by their contributors.
+No copyright assignment is required to contribute to the `rustix`
+project.
+
+Some files include code derived from Rust's `libstd`; see the comments in
+the code for details.
+
+Except as otherwise noted (below and/or in individual files), `rustix`
+is licensed under:
+
+ - the Apache License, Version 2.0, with the LLVM Exception
+   <LICENSE-Apache-2.0_WITH_LLVM-exception> or
+   <http://llvm.org/foundation/relicensing/LICENSE.txt>
+ - the Apache License, Version 2.0
+   <LICENSE-APACHE> or
+   <http://www.apache.org/licenses/LICENSE-2.0>,
+ - or the MIT license
+   <LICENSE-MIT> or
+   <http://opensource.org/licenses/MIT>,
+
+at your option.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-rustls-ISC-variation.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-rustls-ISC-variation.txt
new file mode 100644
index 000000000..dde186dab
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-rustls-ISC-variation.txt
@@ -0,0 +1,9 @@
+The upstream `untrusted` and `rustls-webpki` ISC-style notices use the following package-specific warranty/disclaimer wording instead of the final warranty/disclaimer paragraph in the shared SPDX ISC text:
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-symlink-COPYRIGHT.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-symlink-COPYRIGHT.txt
new file mode 100644
index 000000000..55c8f9f73
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-symlink-COPYRIGHT.txt
@@ -0,0 +1,3 @@
+This project is dual-licensed under the terms of the MIT and Apache (version 2.0) licenses.
+
+Copyright (c) 2014 Chris Morgan and the Teepee project developers
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-utf8_iter-COPYRIGHT.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-utf8_iter-COPYRIGHT.txt
new file mode 100644
index 000000000..b5e945740
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-utf8_iter-COPYRIGHT.txt
@@ -0,0 +1,42 @@
+Copyright Mozilla Foundation
+
+Licensed under the Apache License (Version 2.0), or the MIT license,
+(the "Licenses") at your option. You may not use this file except in
+compliance with one of the Licenses. You may obtain copies of the
+Licenses at:
+
+   https://www.apache.org/licenses/LICENSE-2.0
+   https://opensource.org/licenses/MIT
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the Licenses is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the Licenses for the specific language governing permissions and
+limitations under the Licenses.
+
+--
+
+Test code is dedicated to the Public Domain when so designated (see
+the individual files for PD/CC0-dedicated sections).
+
+--
+
+The implementation for Utf8CharIndices was adapted from the
+CharIndices implementation of the Rust standard library at revision
+ab32548539ec38a939c1b58599249f3b54130026
+(https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/library/core/src/str/iter.rs).
+
+Excerpt from https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/COPYRIGHT ,
+which refers to
+https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-APACHE
+and
+https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-MIT
+:
+
+For full authorship information, see the version control history or
+https://thanks.rust-lang.org
+
+Except as otherwise noted (below and/or in individual files), Rust is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-zstd-BSD-3-Clause-variation.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-zstd-BSD-3-Clause-variation.txt
new file mode 100644
index 000000000..f428ec248
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/sslocal-zstd-BSD-3-Clause-variation.txt
@@ -0,0 +1,5 @@
+For `zstd`, `zstd-safe`, and `zstd-sys`, the upstream Zstandard BSD-3-Clause text uses this source-specific condition 3 in place of condition 3 in the shared BSD-3-Clause text:
+
+ * Neither the name Facebook, nor Meta, nor the names of its contributors may
+   be used to endorse or promote products derived from this software without
+   specific prior written permission.
diff --git a/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/v2ray-plugin-yaml-NOTICE.txt b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/v2ray-plugin-yaml-NOTICE.txt
new file mode 100644
index 000000000..866d74a7a
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/third-party-licenses/additional-notices/v2ray-plugin-yaml-NOTICE.txt
@@ -0,0 +1,13 @@
+Copyright 2011-2016 Canonical Ltd.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/ShadowsocksX-NG2/Vendor/v2ray-plugin/LICENSE b/ShadowsocksX-NG2/Vendor/v2ray-plugin/LICENSE
new file mode 100644
index 000000000..c5b282dfc
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/v2ray-plugin/LICENSE
@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2019 by Max Lv <max.c.lv@gmail.com>
+Copyright (C) 2019 by Mygod Studio <contact-v2ray-plugin@mygod.be>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/ShadowsocksX-NG2/Vendor/v2ray-plugin/THIRD-PARTY-NOTICES b/ShadowsocksX-NG2/Vendor/v2ray-plugin/THIRD-PARTY-NOTICES
new file mode 100644
index 000000000..342080341
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/v2ray-plugin/THIRD-PARTY-NOTICES
@@ -0,0 +1,68 @@
+Third-party notices for v2ray-plugin.
+
+v2ray-plugin (manifest: `manifest.json`; release `v1.5.0`; source commit [`7466d1f3a124a0e9f98184a5e0b2d766371c2d84`](https://github.com/shadowsocks/v2ray-plugin/commit/7466d1f3a124a0e9f98184a5e0b2d766371c2d84); binary metadata: Go `go1.27.3`, darwin/arm64, clean VCS revision).
+The direct v2ray-plugin project license is handled separately. This file covers external Go modules reported for the shipped darwin-arm64 binary and its Go standard library.
+Go standard-library source text: [go1.27.3 LICENSE](https://go.googlesource.com/go/+/refs/tags/go1.27.3/LICENSE).
+Complete license terms are stored once per SPDX identifier in `../third-party-licenses/`; entries below group components and retain their copyright/attribution notices without repeating license bodies.
+
+## Apache-2.0
+
+License text: `../third-party-licenses/Apache-2.0.txt`
+
+Components: github.com/pires/go-proxyproto, go.yaml.in/yaml/v3.
+
+- Copyright 2011-2016 Canonical Ltd.
+
+## BSD-2-Clause
+
+License text: `../third-party-licenses/BSD-2-Clause.txt`
+
+Components: github.com/gorilla/websocket.
+
+- Copyright (c) 2013 The Gorilla WebSocket Authors. All rights reserved.
+
+## BSD-3-Clause
+
+License text: `../third-party-licenses/BSD-3-Clause.txt`
+
+Components: Go standard library (go1.27.3), github.com/golang/protobuf, github.com/miekg/dns,
+  github.com/stretchr/testify/internal/difflib, golang.org/x/crypto, golang.org/x/exp/constraints,
+  golang.org/x/net, golang.org/x/sys, golang.org/x/text, google.golang.org/protobuf.
+
+- Copyright (c) 2009, The Go Authors. Extensions copyright (c) 2011, Miek Gieben.
+- Copyright (c) 2013, Patrick Mezard
+- Copyright (c) 2018 The Go Authors. All rights reserved.
+- Copyright 2009 The Go Authors.
+- Copyright 2010 The Go Authors.  All rights reserved.
+
+## ISC
+
+License text: `../third-party-licenses/ISC.txt`
+
+Components: github.com/stretchr/testify/internal/spew.
+
+- Copyright (c) 2012-2016 Dave Collins <dave@davec.name>
+
+## MIT
+
+License text: `../third-party-licenses/MIT.txt`
+
+Components: github.com/adrg/xdg, github.com/apernet/quic-go, github.com/quic-go/qpack,
+  github.com/quic-go/quic-go, github.com/stretchr/objx, github.com/stretchr/testify,
+  github.com/v2fly/hysteria/core/v2, github.com/v2fly/v2ray-core/v5, go.yaml.in/yaml/v3.
+
+- Copyright (c) 2006-2010 Kirill Simonov
+- Copyright (c) 2006-2011 Kirill Simonov
+- Copyright (c) 2012-2020 Mat Ryer, Tyler Bunnell and contributors.
+- Copyright (c) 2014 Adrian-George Bostan <adrg@epistack.com>
+- Copyright (c) 2014 Stretchr, Inc.
+- Copyright (c) 2015-2025 V2Fly Community
+- Copyright (c) 2016 the quic-go authors & Google, Inc.
+- Copyright (c) 2017-2018 objx contributors
+- Copyright 2019 Marten Seemann
+- Copyright 2023 Toby
+
+## Additional upstream notices
+
+- The Go standard library and `golang.org/x/crypto`, `golang.org/x/exp/constraints`, `golang.org/x/net`, `golang.org/x/sys`, and `golang.org/x/text` use the Google LLC BSD-3-Clause condition 3 variation; `github.com/golang/protobuf` and `google.golang.org/protobuf` use the Google Inc variation. Both clauses are preserved at `../third-party-licenses/additional-notices/Go-BSD-3-Clause-source-variations.txt`.
+- `go.yaml.in/yaml/v3` is reported as MIT, and its distinct NOTICE also identifies Apache-2.0 material; its text and Canonical copyright attribution are retained separately at `../third-party-licenses/additional-notices/v2ray-plugin-yaml-NOTICE.txt`.
diff --git a/ShadowsocksX-NG2/Vendor/v2ray-plugin/manifest.json b/ShadowsocksX-NG2/Vendor/v2ray-plugin/manifest.json
new file mode 100644
index 000000000..34868e079
--- /dev/null
+++ b/ShadowsocksX-NG2/Vendor/v2ray-plugin/manifest.json
@@ -0,0 +1,19 @@
+{
+  "project": "v2ray-plugin",
+  "release": "v1.5.0",
+  "target": "darwin-arm64",
+  "asset": "v2ray-plugin-darwin-arm64-v1.5.0.tar.gz",
+  "url": "https://github.com/shadowsocks/v2ray-plugin/releases/download/v1.5.0/v2ray-plugin-darwin-arm64-v1.5.0.tar.gz",
+  "archiveSHA256": "75812dddb360aed4148b5860998e5e9c4f7a7e622a4ab235fd6b26c068b4f571",
+  "archiveMember": "v2ray-plugin_darwin_arm64",
+  "binary": "v2ray-plugin",
+  "bundleSubpath": "Helpers/Plugins",
+  "signIdentifier": "com.qiuyuzhou.ShadowsocksX-NG2.plugin.v2ray-plugin",
+  "pluginNames": [
+    "v2ray-plugin",
+    "v2ray-plugin-v1"
+  ],
+  "defaultArguments": [
+    "-disableAccessLog"
+  ]
+}
diff --git a/ShadowsocksX-NG2/project.yml b/ShadowsocksX-NG2/project.yml
new file mode 100644
index 000000000..28521778f
--- /dev/null
+++ b/ShadowsocksX-NG2/project.yml
@@ -0,0 +1,342 @@
+name: ShadowsocksX-NG2
+options:
+  createIntermediateGroups: true
+  preGenCommand: python3 Scripts/dependency-metadata.py
+  developmentLanguage: zh-Hans
+  deploymentTarget:
+    macOS: "15.0"
+settings:
+  base:
+    ARCHS: arm64
+    SWIFT_VERSION: "6.0"
+    # 关闭所有源码本地化抽取路径及构建后的 String Catalog 自动同步。
+    # 本地化目录由仓库手工维护。
+    LOCALIZATION_EXPORT_SUPPORTED: NO
+    CODE_SIGN_STYLE: Manual
+    ENABLE_HARDENED_RUNTIME: YES
+  configs:
+    Release:
+      # 发布基线：签名 entitlements 必须只来自项目 entitlements 文件（保持最小）。
+      CODE_SIGN_INJECT_BASE_ENTITLEMENTS: NO
+# 签名身份注入：证书与 Team 都不入库（开源仓库；写死会让 fork 与贡献者的构建去
+# 找维护者的证书）。Debug 基线是 ad-hoc，无证书即可构建并跑单测；Release 基线是
+# Developer ID，发布产物必须真签名。两者的本机 Team / 身份都来自 gitignore 的
+# Configs/Signing.local.xcconfig，见 Configs/Signing-Debug.xcconfig 与
+# Configs/Signing-Release.xcconfig。
+# 所有 target 一律不设置 CODE_SIGN_IDENTITY：pbxproj 构建设置优先于 project
+# xcconfig，写在 target 上会静默盖掉两个基线（实测）。该约束由
+# Tests/Architecture/SigningConfigurationTests.swift 守卫。
+configFiles:
+  Debug: Configs/Signing-Debug.xcconfig
+  Release: Configs/Signing-Release.xcconfig
+packages:
+  AgeSwift:
+    url: https://github.com/qiuyuzhou/AgeSwift
+    exactVersion: 0.1.0
+targets:
+  ShadowsocksX-NG2:
+    type: application
+    platform: macOS
+    sources:
+      # 目录即分层：Composition（组合根）/ Application（工作流与运行时适配）/
+      # Presentation（跨功能表现层）/ UI（视图，按子视图分目录）/
+      # PlatformEffects（平台效应 seam）/ Resources（plist、entitlements、资源）。
+      # 分层边界由 Tests/Architecture/SkeletonTests.swift 的 UI 圈定守卫断言；
+      # 取舍与约束见 ADR 0029。
+      - path: App
+        excludes:
+          # 文档不属于 target 源码：App/ 下任何非源码文件都会被 XcodeGen 收进
+          # Resources 阶段并封进签名后的 app bundle（实测），因此显式排除。
+          - "**/*.md"
+          - "**/*.xcstrings-mcp.lock"
+      # 领域核心。目录即主题，根下不留平铺文件，子目录按
+      # GLOSSARY.md 的章节口径命名：Catalog（配置目录树与身份）/
+      # Subscription（订阅）/ Rules（代理规则，自定义规则在 Rules/Custom）/
+      # Runtime（代理运行服务：运行时文档、路径、日志、端点与探针）/
+      # Activation（激活候选与状态机）/ Settings（用户设置持久化）/
+      # SystemProxy（系统代理 typed 配置与特权 helper 契约）/
+      # Plugin（托管插件与用户映射）/ Credentials / LegacyImport / Diagnostics。
+      # 该约定由 Tests/Architecture/SkeletonTests.swift 的 Domain 布局守卫断言，
+      # 取舍与约束见 ADR 0029。
+      - path: Domain
+      # LaunchAgent 注册清单：SMAppService.agent(plistName:) 从 bundle 内
+      # Contents/Library/LaunchAgents/ 读取；ProgramArguments 用 bundle 相对路径
+      - path: LaunchAgent/com.qiuyuzhou.ShadowsocksX-NG2.agent.plist
+        buildPhase:
+          copyFiles:
+            destination: wrapper
+            subpath: Contents/Library/LaunchAgents
+      # 特权系统代理 helper 的 LaunchDaemon 注册清单：
+      # SMAppService.daemon(plistName:) 从 bundle 内
+      # Contents/Library/LaunchDaemons/ 读取；可执行路径用 BundleProgram 键
+      # （bundle 相对；ProgramArguments 的相对路径按 PATH 解析会 spawn 失败）；
+      # MachServices 键支撑 on-demand 激活。
+      - path: LaunchDaemons/com.qiuyuzhou.ShadowsocksX-NG2.systemproxy.plist
+        buildPhase:
+          copyFiles:
+            destination: wrapper
+            subpath: Contents/Library/LaunchDaemons
+      # 外部二进制（Vendor/<name>/manifest.json 固定 tag+URL+SHA-256）。必须先跑
+      # Scripts/fetch-external-binaries.sh 再 xcodegen generate：文件在生成时必须已存在，
+      # 否则 Copy Files 阶段会被静默丢弃。构建内的 preBuildScripts 只做增量复验，
+      # 哈希或清单漂移会在构建时失败。
+      - path: Vendor/sslocal/sslocal
+        buildPhase:
+          copyFiles:
+            destination: wrapper
+            subpath: Contents/Helpers
+      - path: Vendor/v2ray-plugin/v2ray-plugin
+        buildPhase:
+          copyFiles:
+            destination: wrapper
+            subpath: Contents/Helpers/Plugins
+      - path: Vendor/ck-client/ck-client
+        buildPhase:
+          copyFiles:
+            destination: wrapper
+            subpath: Contents/Helpers/Plugins
+      # Generated offline catalog and license/notice tree; preserve relative references.
+      - path: .build/dependency-metadata/ThirdParty
+        buildPhase: resources
+        type: folder
+      # 内置规则快照：普通构建只读本地已固定快照，离线且不重新
+      # 抓取或转换；缺失、损坏或版本不匹配时 verify-rule-snapshots.sh 使构建失败。
+      # folder reference 保留 rules/<source>/snapshot.json 结构，避免多个
+      # snapshot.json 在 bundle 根目录撞名。
+      - path: Vendor/rules
+        buildPhase: resources
+        type: folder
+    preBuildScripts:
+      - name: Verify dependency metadata
+        basedOnDependencyAnalysis: false
+        script: |
+          set -e
+          python3 "$SRCROOT/Scripts/dependency-metadata.py" --check
+      - name: Fetch & verify external binaries
+        basedOnDependencyAnalysis: false
+        script: |
+          set -e
+          "$SRCROOT/Scripts/fetch-external-binaries.sh"
+      - name: Verify rule snapshots
+        basedOnDependencyAnalysis: false
+        script: |
+          set -e
+          "$SRCROOT/Scripts/verify-rule-snapshots.sh"
+    postBuildScripts:
+      - name: Verify bundled dependency metadata
+        basedOnDependencyAnalysis: false
+        script: |
+          set -e
+          python3 "$SRCROOT/Scripts/dependency-metadata.py" --bundle "$TARGET_BUILD_DIR/$UNLOCALIZED_RESOURCES_FOLDER_PATH/ThirdParty"
+      # 必须在 app 自身签名之前逐二进制 DevID 重签；Xcode 在所有脚本阶段之后
+      # 完成 app 外层签名，封存重签后的嵌套代码。
+      - name: Sign embedded helpers
+        basedOnDependencyAnalysis: false
+        script: |
+          set -e
+          "$SRCROOT/Scripts/sign-embedded-helpers.sh"
+    settings:
+      base:
+        PRODUCT_BUNDLE_IDENTIFIER: com.qiuyuzhou.ShadowsocksX-NG2
+        PRODUCT_NAME: ShadowsocksX-NG2
+        # 模块名让位给 Core 镜像库（ShadowsocksX_NG2）：两者 swiftmodule 都落
+        # 共享 Products 目录，重名会互相覆盖；app 可执行自身不 import 任何
+        # 消费方，改名零影响。
+        SWIFT_OBJC_BRIDGING_HEADER: App/Application/Connectivity/ConnectivityHTTPTransport.h
+        PRODUCT_MODULE_NAME: ShadowsocksX_NG2App
+        ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
+        MARKETING_VERSION: "2.0.0"
+        # 必须 > 旧版 1.x 已发布构建的 CFBundleVersion（始终为 1），保证 build 号严格递增。
+        CURRENT_PROJECT_VERSION: 2
+    info:
+      path: App/Resources/Info.plist
+      properties:
+        CFBundleShortVersionString: $(MARKETING_VERSION)
+        CFBundleVersion: $(CURRENT_PROJECT_VERSION)
+        NSHumanReadableCopyright: "Copyright © Qiu Yuzhou"
+        LSMinimumSystemVersion: "15.0"
+        LSUIElement: true
+        NSPrincipalClass: NSApplication
+        LSApplicationCategoryType: public.app-category.utilities
+    entitlements:
+      path: App/Resources/ShadowsocksX-NG2.entitlements
+      properties: {}
+    dependencies:
+      - package: AgeSwift
+      # 代理运行时 wrapper（BundleProgram）：以独立可执行文件装入
+      # Contents/MacOS，由 LaunchAgent plist 以 bundle 相对路径引用。
+      - target: ShadowsocksX-NG2Agent
+        copy:
+          destination: wrapper
+          subpath: Contents/MacOS
+      # 特权系统代理 helper：独立可执行文件装入 Contents/MacOS，
+      # 由 LaunchDaemon plist 以 bundle 相对路径引用，SMAppService.daemon 注册。
+      - target: ShadowsocksX-NG2SystemProxyHelper
+        copy:
+          destination: wrapper
+          subpath: Contents/MacOS
+  ShadowsocksX-NG2Core:
+    type: library.static
+    platform: macOS
+    # 测试专用 app 源码镜像（去宿主化，ADR 0021）：与 app target 同源编译
+    # （除 @main 组合根 MainApp.swift），模块名沿用 ShadowsocksX_NG2，全部
+    # 测试的 @testable import 零改动。测试 bundle 改链本库后不再生成
+    # TEST_HOST：xcodebuild test 只构建 app、不再启动 app 进程，与安装版
+    # 运行实例零接触。同源双编译沿用 Agent/Helper 共享 Domain 文件的既定
+    # 模式；Core 只被测试 target 依赖，发布链与普通构建不编译它。
+    sources:
+      - path: App
+        excludes:
+          # 递归 glob（`**/`）而非裸文件名：XcodeGen 的 exclude 不跨 `/`，裸名只
+          # 匹配 App 根层。文件下移后裸名会静默失效，把 @main 组合根编进测试镜像。
+          - "**/MainApp.swift"
+          - "**/Info.plist"
+          - "**/ShadowsocksX-NG2.entitlements"
+          - "**/Assets.xcassets"
+          - "**/*.xcstrings-mcp.lock"
+      - path: Domain
+    settings:
+      base:
+        PRODUCT_NAME: ShadowsocksX-NG2Core
+        SWIFT_OBJC_BRIDGING_HEADER: App/Application/Connectivity/ConnectivityHTTPTransport.h
+        PRODUCT_MODULE_NAME: ShadowsocksX_NG2
+        # 静态库产物不签名（app 的 DevID 身份不适用）。
+        CODE_SIGNING_ALLOWED: NO
+    dependencies:
+      - package: AgeSwift
+  ShadowsocksX-NG2Agent:
+    type: tool
+    platform: macOS
+    sources:
+      - path: Agent
+      # Agent 只共享非秘密监管协议、路径、探针、统一日志发射单元与
+      # sslocal 输出 intake，不编译 sslocal 配置或凭据类型。显式文件路径
+      # 变动必须同步本清单并重新生成工程。
+      - path: Domain/Settings/ApplicationSupportPaths.swift
+      - path: Domain/Runtime/RuntimePaths.swift
+      - path: Domain/Runtime/AtomicFileWriter.swift
+      - path: Domain/Runtime/RuntimeSupervision.swift
+      - path: Domain/Runtime/RuntimeReloadState.swift
+      - path: Domain/Runtime/RuntimeLog.swift
+      - path: Domain/Runtime/SystemLog.swift
+      - path: Domain/Runtime/LogLine.swift
+      - path: Domain/Runtime/SslocalOutputIntake.swift
+      - path: Domain/Runtime/EndpointHealthProbe.swift
+      - path: Domain/Runtime/RuntimeSocketOwnershipProbe.swift
+    settings:
+      base:
+        PRODUCT_NAME: ShadowsocksX-NG2Agent
+        PRODUCT_BUNDLE_IDENTIFIER: com.qiuyuzhou.ShadowsocksX-NG2.agent
+  ShadowsocksX-NG2SystemProxyHelper:
+    type: tool
+    platform: macOS
+    sources:
+      - path: SystemProxyHelper
+      # helper 与 GUI 共享的 typed 契约与纯逻辑：closed typed 配置、property
+      # list 映射、计划器、XPC 协议、请求引擎、helper 侧日志事件与统一日志
+      # 发射单元（helper 日志只进统一日志，ADR-0047）。helper 不含产品
+      # 策略：不在这些文件之外做任何域判断。以下 8 条同为显式路径，移动需同步。
+      - path: Domain/SystemProxy/SystemProxyConfiguration.swift
+      - path: Domain/SystemProxy/SystemProxyPlan.swift
+      - path: Domain/SystemProxy/SystemProxyPropertyList.swift
+      - path: Domain/SystemProxy/SystemProxyHelperContract.swift
+      - path: Domain/SystemProxy/SystemProxyHelperEngine.swift
+      - path: Domain/SystemProxy/SystemProxyHelperListenerDelegate.swift
+      - path: Domain/SystemProxy/SystemProxyHelperLog.swift
+      - path: Domain/Runtime/SystemLog.swift
+    settings:
+      base:
+        PRODUCT_NAME: ShadowsocksX-NG2SystemProxyHelper
+        PRODUCT_BUNDLE_IDENTIFIER: com.qiuyuzhou.ShadowsocksX-NG2.systemproxy.helper
+  ShadowsocksX-NG2Tests:
+    type: bundle.unit-test
+    platform: macOS
+    sources:
+      - path: Tests
+        # 真实进程冒烟归 SmokeTests target，不进默认 task test 快车道。
+        excludes:
+          - "Smoke"
+          - "Fixtures"
+      - path: Tests/Fixtures/RuleSnapshots
+        type: folder
+        buildPhase: resources
+    settings:
+      base:
+        PRODUCT_BUNDLE_IDENTIFIER: com.qiuyuzhou.ShadowsocksX-NG2.Tests
+        # 身份随 config 基线走（Debug ad-hoc / Release DevID，见 configFiles）：
+        # 去宿主化（ADR 0021）后 xctest 包不再注入宿主 app，ad-hoc 可加载执行
+        # （实测），因此测试不再需要证书，CI 无需签名密钥。
+    info:
+      path: Tests/Info.plist
+      properties: {}
+    dependencies:
+      # 去宿主化（ADR 0021）：单测链 Core 静态库镜像而非 app 可执行，测试在
+      # 独立 xctest runner 中运行，宿主 app 不再被启动。
+      - target: ShadowsocksX-NG2Core
+      - package: AgeSwift
+  ShadowsocksX-NG2SmokeTests:
+    type: bundle.unit-test
+    platform: macOS
+    sources:
+      - path: Tests/Smoke
+      # app 产物定位 helper（与单测 target 共享，见 Tests/Support/AppArtifact.swift）。
+      # 同样是显式文件路径：移动它必须同步此处，否则 xcodegen 以缺文件失败。
+      - path: Tests/Support/AppArtifact.swift
+      - path: Tests/Support/ProxyRuntimeFixture+Document.swift
+    settings:
+      base:
+        PRODUCT_BUNDLE_IDENTIFIER: com.qiuyuzhou.ShadowsocksX-NG2.SmokeTests
+        # 身份理由同 ShadowsocksX-NG2Tests：随 config 基线，Debug 无证书可跑。
+    info:
+      path: Tests/Smoke/Info.plist
+      properties: {}
+    dependencies:
+      # 去宿主化（ADR 0021）：smoke 同样链 Core 镜像库；真实 sslocal/agent 从
+      # scheme 构建的 app 产物取（AppArtifact），宿主 app 不再被启动。
+      - target: ShadowsocksX-NG2Core
+      - package: AgeSwift
+schemes:
+  # app 主 scheme。测试动作注入 SSXNG_SYSTEM_LOG=0 关闭统一日志写入：
+  # 测试进程与其拉起的子进程不把测试日志灌进系统日志 store（stderr 与
+  # agent.log 不受影响）。Run/Profile 不带该变量——从 Xcode 调试运行时
+  # 系统日志照常输出。开关实现见 RuntimeLog.systemLogEnabled。
+  ShadowsocksX-NG2:
+    build:
+      targets:
+        ShadowsocksX-NG2: [run, test, profile, archive, analyze]
+    run:
+      config: Debug
+    test:
+      config: Debug
+      targets:
+        # 单测多 runner 并行执行：夹具均为进程私有资源（运行时空闲端口、
+        # UUID 后缀的 UserDefaults suite 与 Keychain service、匿名 XPC
+        # listener、临时目录），跨 runner 无共享状态。
+        - name: ShadowsocksX-NG2Tests
+          parallelizable: true
+      environmentVariables:
+        - variable: SSXNG_SYSTEM_LOG
+          value: "0"
+          isEnabled: true
+    profile:
+      config: Release
+    analyze:
+      config: Debug
+    archive:
+      config: Release
+  # 真实进程冒烟独立 scheme（task test:smoke）：拉起真实 sslocal，按需执行；
+  # 发布门槛要求与 packaging-gate 一起全绿。
+  ShadowsocksX-NG2Smoke:
+    build:
+      targets:
+        ShadowsocksX-NG2: [run, test]
+        ShadowsocksX-NG2SmokeTests: [test]
+    test:
+      targets:
+        - name: ShadowsocksX-NG2SmokeTests
+          parallelizable: true
+      # 同主 scheme：冒烟进程与其拉起的真实 sslocal/agent 关闭统一日志写入。
+      environmentVariables:
+        - variable: SSXNG_SYSTEM_LOG
+          value: "0"
+          isEnabled: true
diff --git a/ShadowsocksX-NGTests/Info.plist b/ShadowsocksX-NGTests/Info.plist
deleted file mode 100644
index 64d65ca49..000000000
--- a/ShadowsocksX-NGTests/Info.plist
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>$(DEVELOPMENT_LANGUAGE)</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
-	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
-	<key>CFBundleVersion</key>
-	<string>1</string>
-</dict>
-</plist>
diff --git a/ShadowsocksX-NGTests/ServerProfileTests.swift b/ShadowsocksX-NGTests/ServerProfileTests.swift
deleted file mode 100644
index 793244411..000000000
--- a/ShadowsocksX-NGTests/ServerProfileTests.swift
+++ /dev/null
@@ -1,178 +0,0 @@
-//
-//  ServerProfileTests.swift
-//  ShadowsocksX-NG
-//
-//  Created by Rainux Luo on 07/01/2017.
-//  Copyright © 2017 qiuyuzhou. All rights reserved.
-//
-
-import XCTest
-@testable import ShadowsocksX_NG
-
-class ServerProfileTests: XCTestCase {
-
-    var profile: ServerProfile!
-
-    override func setUp() {
-        super.setUp()
-
-        profile = ServerProfile.fromDictionary(["ServerHost": "example.com",
-                                                "ServerPort": 8388,
-                                                "Method": "aes-256-cfb",
-                                                "Password": "password",
-                                                "Remark": "Protoss Prism",
-                                                "OTA": true])
-        XCTAssertNotNil(profile)
-    }
-
-    override func tearDown() {
-        // Put teardown code here. This method is called after the invocation of each test method in the class.
-        super.tearDown()
-    }
-
-    func testInitWithSelfGeneratedURL() {
-        let newProfile = ServerProfile.init(url: profile.URL()!)
-
-        XCTAssertEqual(newProfile?.serverHost, profile.serverHost)
-        XCTAssertEqual(newProfile?.serverPort, profile.serverPort)
-        XCTAssertEqual(newProfile?.method, profile.method)
-        XCTAssertEqual(newProfile?.password, profile.password)
-        XCTAssertEqual(newProfile?.remark, profile.remark)
-    }
-
-    func testInitWithBase64EncodedURL() {
-        // "ss://aes-256-cfb:password@example.com:8388"
-        let url = URL(string: "ss://YWVzLTI1Ni1jZmI6cGFzc3dvcmRAZXhhbXBsZS5jb206ODM4OA")!
-
-        let profile = ServerProfile(url: url)
-
-        XCTAssertNotNil(profile)
-
-        XCTAssertEqual(profile?.serverHost, "example.com")
-        XCTAssertEqual(profile?.serverPort, 8388)
-        XCTAssertEqual(profile?.method, "aes-256-cfb")
-        XCTAssertEqual(profile?.password, "password")
-        XCTAssertEqual(profile?.remark, "")
-    }
-
-    func testInitWithBase64EncodedURLandQuery() {
-        // "ss://aes-256-cfb:password@example.com:8388?Remark=Prism&OTA=true"
-        let url = URL(string: "ss://YWVzLTI1Ni1jZmI6cGFzc3dvcmRAZXhhbXBsZS5jb206ODM4OD9SZW1hcms9UHJpc20mT1RBPXRydWU")!
-
-        let profile = ServerProfile(url: url)
-
-        XCTAssertNotNil(profile)
-
-        XCTAssertEqual(profile?.serverHost, "example.com")
-        XCTAssertEqual(profile?.serverPort, 8388)
-        XCTAssertEqual(profile?.method, "aes-256-cfb")
-        XCTAssertEqual(profile?.password, "password")
-        XCTAssertEqual(profile?.remark, "Prism")
-    }
-    
-    func testInitWithLegacyBase64EncodedURLWithTag() {
-        let url = URL(string: "ss://YmYtY2ZiOnRlc3RAMTkyLjE2OC4xMDAuMTo4ODg4Cg#example-server")!
-        
-        let profile = ServerProfile(url: url)
-        
-        XCTAssertNotNil(profile)
-        XCTAssertEqual(profile?.remark, "example-server")
-    }
-    
-    func testInitWithLegacyBase64EncodedURLWithSymboInPassword() {
-        // Note that the legacy URI doesn't follow RFC3986. It means the password here
-        // should be plain text, not percent-encoded.
-        // Ref: https://shadowsocks.org/en/config/quick-guide.html
-        // `ss://bf-cfb:test/!@#:@192.168.100.1:8888`
-        let url = URL(string: "ss://YmYtY2ZiOnRlc3QvIUAjOkAxOTIuMTY4LjEwMC4xOjg4ODg#example")!
-        
-        let profile = ServerProfile(url: url)
-        
-        XCTAssertNotNil(profile)
-        XCTAssertEqual(profile?.password, "test/!@#:")
-    }
-    
-    func testInitWithLegacyURLWithEscapedChineseRemark() {
-        let url = URL(string: "ss://YmYtY2ZiOnRlc3RAMTkyLjE2OC4xMDAuMTo4ODg4#%e4%bd%a0%e5%a5%bd")!
-        let profile = ServerProfile(url: url)
-        XCTAssertNotNil(profile)
-        XCTAssertEqual(profile?.remark, "你好")
-    }
-
-    func testInitWithEmptyURL() {
-        let url = URL(string: "ss://")!
-
-        let profile = ServerProfile(url: url)
-
-        XCTAssertNil(profile)
-    }
-
-    func testInitWithBase64EncodedInvalidURL() {
-        // "ss://invalid url"
-        let url = URL(string: "ss://aW52YWxpZCB1cmw")!
-
-        let profile = ServerProfile(url: url)
-
-        XCTAssertNil(profile)
-    }
-
-    func testInitWithSIP002URL() {
-        // "ss://aes-256-cfb:password@example.com:8388?Remark=Prism&OTA=true"
-        let url = URL(string: "ss://YWVzLTI1Ni1jZmI6cGFzc3dvcmQ=@example.com:8388/?Remark=Prism&OTA=true")!
-
-        let profile = ServerProfile(url: url)
-
-        XCTAssertNotNil(profile)
-
-        XCTAssertEqual(profile?.serverHost, "example.com")
-        XCTAssertEqual(profile?.serverPort, 8388)
-        XCTAssertEqual(profile?.method, "aes-256-cfb")
-        XCTAssertEqual(profile?.password, "password")
-        XCTAssertEqual(profile?.remark, "Prism")
-    }
-
-    func testInitWithSIP002URLProfileName() {
-        let url = URL(string: "ss://YWVzLTI1Ni1jZmI6cGFzc3dvcmQ=@example.com:8388/#Name")!
-
-        let profile = ServerProfile(url: url)
-
-        XCTAssertNotNil(profile)
-        XCTAssertEqual(profile?.remark, "Name")
-    }
-
-    func testInitWithSIP002URLProfileNameOverride() {
-        let url = URL(string: "ss://YWVzLTI1Ni1jZmI6cGFzc3dvcmQ=@example.com:8388/?Remark=Name#Overriden")!
-
-        let profile = ServerProfile(url: url)
-
-        XCTAssertNotNil(profile)
-        XCTAssertEqual(profile?.remark, "Overriden")
-    }
-    
-    func testInitWithSIP002URLProfileWithSIP003PluginNoPluginOpts() {
-        let url = URL(string: "ss://YWVzLTI1Ni1jZmI6cGFzc3dvcmQ=@134.209.56.100:8088/?plugin=v2ray-plugin;#moon-v2ray")!
-        
-        let profile = ServerProfile(url: url)
-        
-        XCTAssertNotNil(profile)
-        XCTAssertEqual(profile?.plugin, "v2ray-plugin")
-    }
-    
-    func testInitWithSIP002URLProfileWithSIP003Plugin() {
-        let url = URL(string: "ss://YWVzLTI1Ni1jZmI6cGFzc3dvcmQ=@134.209.56.100:8088/?plugin=v2ray-plugin;tls#moon-v2ray")!
-        
-        let profile = ServerProfile(url: url)
-        
-        XCTAssertNotNil(profile)
-        XCTAssertEqual(profile?.plugin, "v2ray-plugin")
-    }
-
-    func testPerformanceExample() {
-        // This is an example of a performance test case.
-        self.measure {
-            // Put the code you want to measure the time of here.
-        }
-    }
-    
-
-}
diff --git a/ShadowsocksX-NGTests/ShadowsocksX_NGTests.swift b/ShadowsocksX-NGTests/ShadowsocksX_NGTests.swift
deleted file mode 100644
index fbd393fef..000000000
--- a/ShadowsocksX-NGTests/ShadowsocksX_NGTests.swift
+++ /dev/null
@@ -1,33 +0,0 @@
-//
-//  ShadowsocksX_NGTests.swift
-//  ShadowsocksX-NGTests
-//
-//  Created by 邱宇舟 on 2021/6/24.
-//  Copyright © 2021 qiuyuzhou. All rights reserved.
-//
-
-import XCTest
-
-class ShadowsocksX_NGTests: XCTestCase {
-
-    override func setUpWithError() throws {
-        // Put setup code here. This method is called before the invocation of each test method in the class.
-    }
-
-    override func tearDownWithError() throws {
-        // Put teardown code here. This method is called after the invocation of each test method in the class.
-    }
-
-    func testExample() throws {
-        // This is an example of a functional test case.
-        // Use XCTAssert and related functions to verify your tests produce the correct results.
-    }
-
-    func testPerformanceExample() throws {
-        // This is an example of a performance test case.
-        measure {
-            // Put the code you want to measure the time of here.
-        }
-    }
-
-}
diff --git a/_config.yml b/_config.yml
deleted file mode 100644
index c74188174..000000000
--- a/_config.yml
+++ /dev/null
@@ -1 +0,0 @@
-theme: jekyll-theme-slate
\ No newline at end of file
diff --git a/codegraph.json b/codegraph.json
new file mode 100644
index 000000000..37bce3d98
--- /dev/null
+++ b/codegraph.json
@@ -0,0 +1,3 @@
+{
+  "deprioritize": ["ShadowsocksX-NG2/Scripts/"]
+}
\ No newline at end of file
diff --git a/docs/adr/0001-remove-node-enable-state.md b/docs/adr/0001-remove-node-enable-state.md
new file mode 100644
index 000000000..c05282d97
--- /dev/null
+++ b/docs/adr/0001-remove-node-enable-state.md
@@ -0,0 +1,19 @@
+# Remove node enable state and use activation preflight candidates
+
+The 2.0 configuration catalog no longer stores or exposes an enable/disable state on servers or groups. Imported and subscribed records with structurally complete but unsupported encryption methods or plugins remain visible as invalid activation candidates, while malformed records are rejected at their source boundary; activation preflight filters invalid group members and requires at least one usable server. This preserves recoverable user data without treating opaque plugin options or remote connectivity as app-verifiable facts, and keeps the active target identity separate from proxy runtime health.
+
+## Status
+
+Accepted.
+
+## Considered options
+
+- Keep the old state as a hidden compatibility flag: rejected because it would preserve a second eligibility model with no user-facing meaning.
+- Reject an entire group when any descendant is invalid: rejected because one broken imported or subscribed record would hide otherwise usable servers.
+- Reject every unsupported method or plugin at import time: rejected because users need to see and repair recoverable configuration data.
+
+## Consequences
+
+- Catalog persistence migrates old `enabled` values away and writes the next document version without them.
+- Group activation can succeed with a subset of descendants, but surfaces the skipped invalid records and fails when none remain.
+- App validation reports only known local blockers; opaque plugin options and remote reachability remain runtime concerns.
diff --git a/docs/adr/0002-independent-app-not-legacy-upgrade.md b/docs/adr/0002-independent-app-not-legacy-upgrade.md
new file mode 100644
index 000000000..c1b16ecfe
--- /dev/null
+++ b/docs/adr/0002-independent-app-not-legacy-upgrade.md
@@ -0,0 +1,19 @@
+# Treat 2.0 as an independent application, not a Legacy upgrade
+
+2.0 ships under its own bundle identity (`com.qiuyuzhou.ShadowsocksX-NG2`), making it and the frozen Legacy app two independently installed applications that can run side by side. We therefore drop the planned smooth transition: the Legacy handoff flow (retiring Legacy launchd jobs, cleaning Legacy-owned system proxy values, gating on Legacy port release, quitting the old app) is removed entirely, and a Legacy import brings over only server configurations — no mode, target, login-item, or other preferences. 2.0's factory-default local endpoint ports (SOCKS 11086 / HTTP 11087 / PAC 11089) differ from Legacy's (1086 / 1087 / 1089) so both apps' defaults can listen concurrently.
+
+## Status
+
+Accepted; the system-proxy ownership and conflict clauses are superseded by ADR-0019.
+
+## Considered options
+
+- Keep the handoff flow delivered in #37 (commit 8d1cdf2): rejected because it couples 2.0 to Legacy's runtime specifics (launchd labels, proxy signature fingerprints, port takeover) for a one-time transition, while the new bundle id already makes coexistence the primary state the product must support.
+- Reuse Legacy's default ports and take them over on conflict: rejected because concurrent operation — the state the bundle id split creates — would then require a conflict on every launch.
+- Migrate more Legacy preferences along with server records: rejected because 2.0's preference semantics differ (e.g. mode availability); partial translation would import stale meanings.
+
+## Consequences
+
+- Removes the #37 deliverable and voids decision D12 of spec #21; the live-fire research doc `docs/research/legacy-handoff-bootout-live-fire.md` is retained as history.
+- This ADR originally kept 2.0 from cleaning Legacy launchd residues or system proxy values and relied on ownership-conflict reporting; ADR-0019 supersedes only the system-proxy part. The decision not to clean Legacy launchd residues remains.
+- No releases exist yet, so the port-default change burdens only development machines; their already-persisted port settings remain in force unchanged.
diff --git a/docs/adr/0003-remove-system-level-shortcuts.md b/docs/adr/0003-remove-system-level-shortcuts.md
new file mode 100644
index 000000000..5b4b9d21d
--- /dev/null
+++ b/docs/adr/0003-remove-system-level-shortcuts.md
@@ -0,0 +1,14 @@
+# Remove system-level shortcuts from NG2
+
+NG2 no longer provides user-configurable system-level shortcuts for toggling the proxy or cycling proxy modes. We remove the `KeyboardShortcuts` integration and keep status-menu controls and window-local default action shortcuts; Legacy remains frozen, and existing stored shortcut preferences are neither migrated nor proactively cleaned up.
+
+## Considered options
+
+- Keep the feature or replace it with another global shortcut library: rejected because the product now has an explicit menu-driven interaction boundary and no approved replacement gesture.
+- Remove only the UI while retaining the dependency and handlers: rejected because it would leave an invisible system-level behavior and dead configuration state.
+
+## Consequences
+
+- Proxy enablement and mode selection remain available from the status menu. Settings/window flows remain available for configuration and window-local default action shortcuts.
+- The `nextMode` helper and its tests are removed because no remaining product behavior needs implicit mode cycling.
+- Historical Legacy research and prior ADRs remain unchanged as historical records.
diff --git a/docs/adr/0004-persist-proxy-mode-selector.md b/docs/adr/0004-persist-proxy-mode-selector.md
new file mode 100644
index 000000000..7aef99503
--- /dev/null
+++ b/docs/adr/0004-persist-proxy-mode-selector.md
@@ -0,0 +1,20 @@
+# Persist the proxy mode selector and drop enabled-modes
+
+The proxy mode selector (status menu, the single entry point since the settings-page selector was removed) persists its choice with the settings snapshot, so a GUI restart restores the selected mode instead of reverting to PAC. A persistence failure keeps the previous mode in force and names the reason rather than switching silently. While the live mode is external PAC, saving settings resolves the mode from the new snapshot before persisting, so the mode kind and its URL commit as one logical change. The `enabledModes` set is removed from the persisted snapshot: since ADR-0002 dropped Legacy preference migration it had no writer, and 2.0 exposes no editing UI for it. The built-in modes (PAC, global, manual) are always available; the external PAC mode requires a configured valid URL.
+
+## Status
+
+Superseded by [ADR-0007](0007-remove-manual-and-external-pac.md). (2026-09: the holistic preferences reset referenced below has since been removed from the product; the reset and PAC wording here is historical — the factory mode was rule before that removal.)
+
+## Considered options
+
+- Keep mode switches as transient runtime state: rejected because the selector is the common control for how macOS traffic is routed; losing the choice on every GUI restart contradicts its persisted-snapshot slot (`preferredMode`) and surprises users.
+- Persist the mode in a separate preference key: rejected because the mode already belongs to the settings snapshot (an external PAC mode resolves its URL from it); a second key would split one logical change into two stores.
+- Keep `enabledModes` as read-only legacy data: rejected because a persisted set with no writer is dead state that still gates the menu for no product meaning.
+
+## Consequences
+
+- `setProxyMode` writes the settings snapshot before switching the live mode; on write failure it presents a service failure and leaves the mode unchanged.
+- `updateSettings` re-resolves an external-PAC mode from the incoming snapshot before persisting; clearing the URL falls back to PAC and persists that fallback.
+- Resetting preferences returns the mode to PAC, consistent with the factory snapshot.
+- The persisted settings document no longer contains `enabledModes`; existing files simply stop reading it, and no migration is needed because no release shipped with it populated by any 2.0 path.
diff --git a/docs/adr/0005-independent-opt-in-login-item.md b/docs/adr/0005-independent-opt-in-login-item.md
new file mode 100644
index 000000000..71147075a
--- /dev/null
+++ b/docs/adr/0005-independent-opt-in-login-item.md
@@ -0,0 +1,18 @@
+# Independent opt-in login item
+
+The GUI's login-item registration is its own preference domain, separate from proxy preferences. It is off until the user explicitly enables it: no registration happens at launch. The system's login-item registration status (`SMAppService.mainApp.status`) is the only source of truth — there is no UserDefaults mirror — and a pending-approval registration counts as enabled because both states come from that system query. Resetting preferences never touches the login item.
+
+## Status
+
+Accepted. (2026-09: the holistic preferences reset referenced below has since been removed from the product; the statements about it describe a capability that no longer exists.)
+
+## Considered options
+
+- Keep the persisted-intent mirror (`launchAtLogin.enabled`, default on) and reconcile at launch: rejected because the mirror can disagree with the system after the user edits the login item in System Settings, producing a toggle that lies about the actual state.
+- Drop the mirror but keep default-on via a one-time launch registration: rejected because opting the user's machine into a background login item without an explicit action is not 2.0's default posture; the status-menu app is deliberately explicit.
+
+## Consequences
+
+- `LaunchAtLoginController` reads `isEnabled` from the system status only; enabling and disabling issue the corresponding system call and re-read the status.
+- The toggle reflects external changes only after the controller re-reads the status (on init, on toggle, and when approval completes); no continuous observation is added.
+- Resetting preferences in the settings window no longer calls into the login-item domain; its confirmation message already names only ports, listen scope, and PAC settings.
diff --git a/docs/adr/0006-diagnostic-report-redaction.md b/docs/adr/0006-diagnostic-report-redaction.md
new file mode 100644
index 000000000..247910572
--- /dev/null
+++ b/docs/adr/0006-diagnostic-report-redaction.md
@@ -0,0 +1,18 @@
+# Keep raw diagnostic logs separate from diagnostic reports
+
+## Status
+
+Accepted.
+
+The diagnostic log view may expose raw wrapper `agent.log` text and raw GUI event detail only through an explicit view/copy action, while a diagnostic report is built exclusively from safe diagnostic facts and allowlisted, field-cleaned event projections. Reports never include raw logs, the configuration catalog, server addresses or remarks, credential references, URLs or tokens, runtime JSON, paths, or free-form failure detail. This preserves useful local troubleshooting without turning user-shared export files into an uncontrolled disclosure channel.
+
+## Considered options
+
+- Include the raw log tail in the exported report: rejected because wrapper output and future event details are not guaranteed to satisfy the report's sensitive-information policy.
+- Remove raw log viewing entirely: rejected because explicit local viewing and copying is useful for troubleshooting and is a narrower exposure than an exported report.
+
+## Consequences
+
+- Diagnostics must maintain separate raw-log and safe-report projections.
+- Adding a new event field does not automatically make it eligible for export; the report allowlist must be updated deliberately.
+- Export completion is recorded only after the user-selected report file is successfully written.
diff --git a/docs/adr/0007-remove-manual-and-external-pac.md b/docs/adr/0007-remove-manual-and-external-pac.md
new file mode 100644
index 000000000..c64f632f7
--- /dev/null
+++ b/docs/adr/0007-remove-manual-and-external-pac.md
@@ -0,0 +1,9 @@
+# Remove manual proxy mode, external PAC, and local PAC
+
+**Status**: accepted; mode-set scope superseded by ADR-0009
+
+Remove `ProxyMode.manual`, `ProxyMode.externalPAC`, and `ProxyMode.pac`, including the external PAC URL setting, local PAC HTTP service and port, PAC user-rule editing, GFW List URL setting, PAC URL system-proxy projection, PAC health probing, and related UI, logs, diagnostics, and presentation surfaces. The product exposes rule / global / direct modes only, all projected as a local SOCKS system-proxy target.
+
+Retained: manual catalog groups and servers, subscriptions, Legacy server-record import, independent local SOCKS and HTTP inbounds, and the built-in rule snapshots (geolocation-cn, china-ipv4, gfwlist). The affected NG2 version has not shipped, so no persisted-settings migration or upgrade transition is required.
+
+ADR-0009 added direct ACL mode and ADR-0010 added global ACL mode while keeping these removals in force. This ADR's title and body now record the full PAC removal completed by issue #67.
diff --git a/docs/adr/0008-fixed-socks5-udp-relay.md b/docs/adr/0008-fixed-socks5-udp-relay.md
new file mode 100644
index 000000000..44973d2ec
--- /dev/null
+++ b/docs/adr/0008-fixed-socks5-udp-relay.md
@@ -0,0 +1,5 @@
+# Use a fixed TCP+UDP mode for the local SOCKS5 endpoint
+
+**Status**: accepted; fixed UDP applies to local listening under ADR-0034.
+
+NG2 no longer exposes SOCKS5 UDP relay as a user preference. The local SOCKS5 endpoint always uses `tcp_and_udp`, while the HTTP endpoint remains `tcp_only`; stale `udpRelayEnabled` keys in unreleased NG2 JSON are ignored without migration or cleanup, and Legacy remains frozen. This keeps the runtime capability available without presenting a misleading system-wide UDP proxy control.
diff --git a/docs/adr/0009-direct-mode-with-acl.md b/docs/adr/0009-direct-mode-with-acl.md
new file mode 100644
index 000000000..d75755752
--- /dev/null
+++ b/docs/adr/0009-direct-mode-with-acl.md
@@ -0,0 +1,19 @@
+# Add direct proxy mode with an ACL
+
+**Status**: accepted; system-proxy rollback clause superseded by ADR-0019. Runtime and mode rollback remain.
+
+## Context
+
+The proxy mode selector needs a direct option that does not require an active Shadowsocks server. Local SOCKS and HTTP proxy clients still enter through the existing `sslocal` listeners, so direct routing must be enforced by the shared runtime rather than by a separate listener or process.
+
+## Decision
+
+- Add persisted `direct` as a third system proxy mode. When applied, macOS points at the existing local SOCKS endpoint. Rule and global modes remain available; manual and external PAC modes remain removed as decided in ADR-0007. Local PAC is removed entirely by issue #67.
+- Direct mode deploys an `sslocal` ACL with `[bypass_all]` and an explicit bypass list for loopback, private, link-local, unique-local, localhost, `.local`, and no-dot destinations. It needs no active target and produces an empty server list when no target is selected. SOCKS and HTTP use the same ACL.
+- Keep the fixed local exceptions in the SystemConfiguration bypass list as well. Do not add carrier-grade NAT ranges to the fixed list.
+- Treat ACL path, content, digest, and summary as runtime identity. An ACL change restarts `sslocal`; server-only changes use the existing hot-reload path, deferred until a direct-mode child owns its configured listeners if startup is still in progress.
+- The runtime receipt identifies the child PID and contract digest. For ACL deployments the wrapper publishes it only after the child owns every configured TCP listener and the endpoints answer. Before accepting direct mode, the controller requires a matching digest and live PID, and rechecks both after endpoint probes. On verification failure it restores the previous mode and runtime; the former system-proxy restoration behavior is superseded by ADR-0019.
+
+## Consequences
+
+Direct mode remains within the existing SOCKS and HTTP runtime. ACL state lives in a protected sidecar and is validated against the runtime contract before launch. A stale listener cannot verify a candidate: the wrapper ties the receipt to the process that owns each configured TCP listener, and the controller checks that process throughout its health probes.
diff --git a/docs/adr/0010-global-mode-with-acl.md b/docs/adr/0010-global-mode-with-acl.md
new file mode 100644
index 000000000..3ed771172
--- /dev/null
+++ b/docs/adr/0010-global-mode-with-acl.md
@@ -0,0 +1,21 @@
+# Implement global mode with a minimal ACL
+
+**Status**: accepted; system-proxy rollback clause superseded by ADR-0019. Runtime and mode rollback remain.
+
+**ACL reload superseded (2026-10-20)**: [ADR-0048](0048-reload-sslocal-acl-by-signal.md) replaces restart-on-ACL-change with `SIGUSR2` reload. Listener and authentication changes still require restart.
+
+## Context
+
+Global mode previously projected only the system SOCKS endpoint and relied on sslocal's default proxy-everything behaviour. That left local-network targets without a product-owned direct guarantee: LAN-sharing clients, IPv6 destinations whose system-proxy exceptions macOS does not reliably honour, and any request that reaches the SOCKS/HTTP inbounds still needed a defined routing policy. The ACL work (spec #59) requires global mode to mean "public targets default through Shadowsocks, local targets stay direct", using only the fixed local safety rules.
+
+## Decision
+
+- Global mode deploys an `sslocal` ACL with `[proxy_all]` and a `[bypass_list]` containing only the fixed local safety rules: IPv4 loopback, RFC 1918, link-local; IPv6 loopback, link-local, and ULA; `localhost`, `*.local`, and no-dot hostnames. No China list, GFWList, or custom rules enter this ACL. CGNAT is excluded.
+- The same ACL is the routing policy for the local SOCKS inbound, the local HTTP inbound, and LAN-sharing clients that connect to those listeners directly. It is not a substitute for the system proxy exception list; both use the same fixed local scope, but the ACL is the verified bypass for requests that already entered `sslocal`.
+- IPv6 CIDR strings in the macOS SystemConfiguration exceptions list are not a verified bypass guarantee (only exact IPv6 addresses were observed to match). The ACL's IPv6 rules are the routing guarantee; this limitation is recorded rather than papered over by the exception list.
+- ACL path, content, digest, and summary are runtime identity, exactly as in ADR-0009. Switching into or out of global mode changes the ACL and therefore requires a full `sslocal` restart through the wrapper — never a bare SIGUSR1 server-list reload. On verification failure it restores the previous mode and runtime document; the former system-proxy restoration behavior is superseded by ADR-0019.
+- Without a valid active target the agent still listens with an empty server list under the global ACL; local targets remain reachable, public targets have no exit. System proxy intent stays pending and converges automatically once an active target is valid and the local endpoints are healthy.
+
+## Consequences
+
+Global mode and direct mode share one fixed local safety policy and one ACL deployment path. Global is no longer "no ACL": it is a minimal `proxy_all` ACL. System proxy writes still require the system proxy switch, agent health, and an available exit (an active target for global). PAC mode remains unchanged until the rules-mode work replaces it.
diff --git a/docs/adr/0011-per-variant-acl-files-stable-link.md b/docs/adr/0011-per-variant-acl-files-stable-link.md
new file mode 100644
index 000000000..e7f17ff0c
--- /dev/null
+++ b/docs/adr/0011-per-variant-acl-files-stable-link.md
@@ -0,0 +1,35 @@
+# Per-variant ACL files behind a stable active link
+
+**Status**: accepted
+
+**Partially superseded (2026-10-19)**: [ADR-0038](0038-separate-agent-supervision-and-sslocal-input.md) replaces mutable fixed variant names and GUI link switching with immutable generation files, atomic supervision publication and Agent-owned links. Variant reuse, the stable ACL entry and restart-on-ACL-change remain.
+
+(2026-09: the holistic preferences reset referenced below has since been removed from the product.)
+
+**Supersedes in part**: ADR-0009 and ADR-0010's "ACL path, content, digest, and summary are runtime identity" — content is no longer carried in the contract, and the ACL path is a stable link that does not change across mode switches. The restart-on-change rule itself stands.
+
+**ACL reload superseded (2026-10-20)**: [ADR-0048](0048-reload-sslocal-acl-by-signal.md) replaces restart-on-ACL-change with `SIGUSR2` reload. Listener and authentication changes still require restart.
+
+## Context
+
+sslocal's routing policy is one of four ACL shapes — `direct`, `global`, `rule-proxy-default`, `rule-direct-default` — but all four were written into a single `sslocal-active.acl`, overwritten on every proxy mode switch and on every deploy even when the ACL body had not changed. The contract JSON also embedded the full ACL body (`x_shadowsocksx_ng_acl.content`), so a rule-mode switch paid roughly the same large write twice. Upstream sslocal is gaining signal-triggered ACL reload; mode switches should be cheap now and restart-free later.
+
+## Decision
+
+- Keep one ACL file per shape: `acl-direct.ini`, `acl-global.ini`, `acl-rule-proxy-default.ini`, `acl-rule-direct-default.ini`. The `.ini` extension names the actual format for debugging; content remains the sslocal ACL section syntax.
+- Point sslocal at a stable symlink, `acl-active.ini`, atomically re-pointed to the variant in force. The contract's `acl` field is that link path and does not change across mode switches.
+- The contract carries only the ACL path, summary, and sha256 — never the ACL body. The agent never reads ACL bytes; it checks only that the link resolves inside the runtime directory.
+- The GUI materializes a variant file only for the ACL actually being deployed: mode and rule-default-action switches re-point the link, and a rule change rewrites only the active variant. Unchanged content is skipped via a small digest manifest (sha256 + size); a manifest miss falls back to hashing the file once.
+- ACL summary or digest change still restarts sslocal in full, as in ADR-0009 and ADR-0010. The agent switch defaults to off and is not resettable via preferences reset. No migration is provided; the product is unreleased.
+
+## Considered Options
+
+- Rewrite a single `sslocal-active.acl` on every switch (previous behaviour): simple, but each switch paid a large redundant write.
+- Point the contract at the variant file path directly: saves the write, but the ACL path is runtime identity and would change on every switch, forcing a restart and blocking a future signal-only reload.
+- Content-addressed filenames (`acl-<sha256>.ini`): deduplicates naturally, but needs orphan garbage collection.
+
+## Consequences
+
+- When upstream sslocal supports ACL reload by signal, a mode switch becomes a link re-point plus a signal — no restart. Until then, digest changes restart sslocal exactly as before.
+- Integrity relies on the GUI's write order (variant file, then link, then contract) and the digest manifest; agent-side content verification is deliberately absent, consistent with the credential exposure boundary.
+- Stale `sslocal-active.acl` files from earlier builds are removed as ordinary runtime cleanup, not migrated.
diff --git a/docs/adr/0012-system-proxy-covers-http-https.md b/docs/adr/0012-system-proxy-covers-http-https.md
new file mode 100644
index 000000000..38ef03a47
--- /dev/null
+++ b/docs/adr/0012-system-proxy-covers-http-https.md
@@ -0,0 +1,7 @@
+# Write HTTP and HTTPS system proxies alongside SOCKS
+
+**Status**: accepted; ownership snapshot and restore clauses superseded by ADR-0019.
+
+Enabling the system proxy switch writes the macOS HTTP and HTTPS proxy entries in addition to the SOCKS entry (ADR-0007 had disabled the HTTP/HTTPS families and projected a SOCKS target only). All three families point at 2.0's own local inbounds: SOCKS at the SOCKS5 listener, and HTTP and HTTPS at the always-on local HTTP inbound — shadowsocks-rust serves HTTP CONNECT directly, so no Privoxy-style bridge returns. HTTPS and HTTP share one endpoint because both are served by the same CONNECT-capable inbound. Exceptions and PAC/auto-discovery suppression remain; the ownership snapshot/restore protocol retained here was superseded by ADR-0019.
+
+The launch health gate already probes every configured inbound, so the HTTP endpoint must be reachable before any system proxy write happens. A runtime document without a usable HTTP inbound port is rejected at the runtime-document contract (`isWellFormed`) instead of pointing the system at an invalid port; the mode projection itself is total over any document. At the time of this decision NG2 had not shipped, so no migration was planned; ADR-0019 later replaced pre-app snapshot restoration with endpoint-matched cleanup.
diff --git a/docs/adr/0013-save-settings-as-independent-items.md b/docs/adr/0013-save-settings-as-independent-items.md
new file mode 100644
index 000000000..61122d9c4
--- /dev/null
+++ b/docs/adr/0013-save-settings-as-independent-items.md
@@ -0,0 +1,5 @@
+# Save settings as independent items
+
+**Status**: accepted; port range and listener items amended by ADR-0034
+
+Settings editing is moving gradually from one form-level commit to independently saved setting items. Saving an item persists and applies only that item's complete value, while unrelated unsaved settings remain pending; the first item is the SOCKS5 and HTTP port pair, saved together because the values are cross-validated and restricted to 1000–65535. Runtime convergence remains separate from persistence: a saved port change is not rolled back after a runtime failure, and the settings item does not need a separate runtime-error message.
diff --git a/docs/adr/0014-delegate-runtime-defaults.md b/docs/adr/0014-delegate-runtime-defaults.md
new file mode 100644
index 000000000..fd0e3c2d1
--- /dev/null
+++ b/docs/adr/0014-delegate-runtime-defaults.md
@@ -0,0 +1,3 @@
+# Delegate timeout and log level to sslocal defaults
+
+NG2 removes the user settings that overrode `sslocal`'s connection timeout and log level, omits those values from its runtime document, and no longer injects `RUST_LOG=warn` or `debug`; an explicitly inherited `RUST_LOG` remains effective. Stale `timeoutSeconds` and `verboseLogging` preference keys are ignored on load and omitted by later saves, with no migration. This keeps these controls with the bundled `sslocal` version while internal application timeouts and the diagnostic log view remain independent; upstream default logs may include server addresses in the raw `agent.log`.
diff --git a/docs/adr/0015-four-way-listener-mode.md b/docs/adr/0015-four-way-listener-mode.md
new file mode 100644
index 000000000..528a459fe
--- /dev/null
+++ b/docs/adr/0015-four-way-listener-mode.md
@@ -0,0 +1,20 @@
+# Four-way listener mode
+
+**Status**: superseded by ADR-0034
+
+Replace the former loopback/host choice with one independently saved listener mode shared by the SOCKS and HTTP inbounds. The dialog uses these labels and bindings:
+
+| Option | Binding | `ipv6_only` | Default terminal command address |
+| --- | --- | --- | --- |
+| 仅本机 | `127.0.0.1` | — | `127.0.0.1` |
+| 所有 IPv4 接口 | `0.0.0.0` | — | `127.0.0.1` |
+| 所有 IPv4 与 IPv6 接口 | `::` | `false` | `127.0.0.1` |
+| 仅所有 IPv6 接口 | `::` | `true` | `::1` (bracketed in a URL) |
+
+The dialog's outer row shows only the selected label; each choice includes a subdued binding-address hint. Saving commits this item alone and requests runtime application. If the agent is running, listener changes restart `sslocal`; if it is off, saving does not start it. A known external port conflict blocks saving, the current runtime's own listener is eligible for replacement by the restart, and unknown occupancy warns but does not block. The IPv6 occupancy probe must cover the selected family.
+
+The pinned `sslocal` v1.25.0 exposes `ipv6_only` as a top-level option for listeners bound to `::`, so the two IPv6 modes set it explicitly. Include this setting in runtime identity so switching dual-stack and IPv6-only restarts listeners even though the address remains `::`. Update local health checks and system-proxy targets to use an address family accepted by the selected mode; IPv6-only uses `::1`. Verify the dual-stack and IPv6-only behavior on supported macOS versions before claiming runtime support. [Upstream configuration](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md), [configuration source](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs), [listener source](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/mod.rs).
+
+The terminal proxy environment commands are local-terminal convenience by default, not a device-sharing feature: they use `127.0.0.1` for the first three modes and `::1` for IPv6-only. In the three non-loopback modes the home command card adds a session-scoped command address picker (issue #72) whose candidates are limited to loopback and the unicast addresses of enabled Wi-Fi and Ethernet interfaces in the mode's accepted address families. Selecting an address changes only the copied commands — never the listener binding, system proxy targets, or health checks, which all remain determined by the listener mode — and the selection is not persisted across app restarts. Remove the manual advertised IPv4 address because no remaining feature consumes it. Show a no-auth, all-interfaces exposure warning in the dialog for the three non-loopback modes, without an extra confirmation.
+
+Persistence success and runtime convergence remain separate. A saved mode is retained after restart failure; the settings view and editor handle persistence outcomes only, while the proxy status UI reports whether the agent restarted and its current state.
diff --git a/docs/adr/0016-menu-bar-only-app-form.md b/docs/adr/0016-menu-bar-only-app-form.md
new file mode 100644
index 000000000..77278ee9a
--- /dev/null
+++ b/docs/adr/0016-menu-bar-only-app-form.md
@@ -0,0 +1,21 @@
+# Menu-bar-only app form; workspace window as a scene
+
+The GUI is a menu-bar-only app at all times: `LSUIElement` stays in effect and the app never switches its activation policy at runtime. The main workspace window is a SwiftUI `Window` scene presented automatically at every launch (`defaultLaunchBehavior(.presented)`); the status menu's "open main window" item reopens it after it is closed. Closing the window never terminates the GUI process — the status menu (and the launchd-hosted proxy agent with it) stays available.
+
+## Status
+
+Accepted (2026-09-28). Superseded by ADR-0017 (2026-09-29), which replaces the constant menu-bar-only form with the adaptive app form (window-following activation policy plus an opt-out silent launch); the scene model, launch presentation, and status-menu reopening below carry over unchanged. Supersedes the earlier hybrid form (2026-09-24): `LSUIElement` plus runtime accessory⇄regular activation-policy switching, launch-time auto-presentation implemented through an AppKit-owned `NSWindow`, and the window-opening intents built around it.
+
+## Considered options
+
+- Keep the hybrid form (activation-policy switching plus AppKit window ownership): rejected because the AppKit window adapter existed only to serve the policy dance and the launch intents; the plain scene model provides both launch presentation and reopening without it.
+- Menu-bar-only with no launch presentation (window opens only from the status menu): considered as an intermediate step on 2026-09-28 and reversed the same day — scene-based launch presentation was verified to work under `LSUIElement` (`defaultLaunchBehavior(.presented)`), so the launch-presentation behavior returns without bringing the AppKit adapter back.
+- Keep an AppKit-direct window adapter solely to reuse a retained window across close/open: rejected; the scene window survives close by being re-shown with its content state intact, so the adapter's remaining value was the activation-policy switching this decision removes.
+
+## Consequences
+
+- The app never gains a Dock icon or app-switcher presence, including while the workspace window is open; launch presents the window without a Dock icon appearing.
+- Reopening from the status menu activates the app before `openWindow`, so the window lands above the frontmost app.
+- Keyboard shortcuts that rely on owning the menu bar (for example ⌘W or Edit-menu shortcuts) are unavailable while the workspace window is frontmost; the close button and mouse interaction are unaffected. If this proves unacceptable, the fix is a product decision to re-introduce a foreground form, not a partial AppKit adapter.
+- The launch intent, reopen intent, presentation intents, and the `WorkspaceWindowOpening` seam are removed; `WorkspaceRoute` is navigation state only, and the scene id is defined once there.
+- Window title follows the workspace destination via `navigationTitle` instead of an AppKit title binding.
diff --git a/docs/adr/0017-adaptive-app-form.md b/docs/adr/0017-adaptive-app-form.md
new file mode 100644
index 000000000..5f6cbb124
--- /dev/null
+++ b/docs/adr/0017-adaptive-app-form.md
@@ -0,0 +1,62 @@
+# Adaptive app form: window-following activation policy with an opt-out silent launch
+
+The GUI returns to runtime activation-policy switching, this time driven entirely by the workspace window's own NSWindow lifecycle: while the workspace window is open the app presents as a regular app (Dock icon, app switcher, default menu bar); when it closes the app returns to the menu-bar accessory baseline. `LSUIElement` stays in the Info.plist so launches never flash a Dock icon and the unit-test host stays clean; the policy is applied from `didBecomeKey` (→ regular) and `willClose` (→ accessory) notifications of the window captured by a zero-size anchor view embedded in the scene content, so the target window is matched by object identity and sheets or auxiliary windows can never drive the switch. `NSApp.setActivationPolicy` is the only AppKit surface. A new inline-toggled **silent launch** preference (off by default, persisted in the app's standard UserDefaults domain since the 2026-09-29 amendment; originally its own file) suppresses launch presentation so launches start in the menu-bar baseline; it takes effect on the next launch.
+
+## Status
+
+Accepted (2026-09-29). Supersedes ADR-0016's constant menu-bar-only form. The scene model, launch presentation, and status-menu reopening from 0016 carry over unchanged; only the "never a Dock icon" rule is replaced. The 2026-09-24 hybrid's AppKit window adapter stays gone — no window ownership, no opening-intent adapter, no delegate.
+
+(2026-09-29 amendment: silent launch persistence has moved from its own JSON file to the app's standard UserDefaults domain (key `silentLaunch`), the platform's canonical KV store for GUI-scalar preferences. The separation rationale stands unchanged — it stays out of settings.json, whose record the proxy controller whole-writes from its in-memory snapshot, and the runtime controller chain still never consumes it. The file-form consequence "a persistence failure keeps the toggle at its previous value and names the reason" is dropped: `UserDefaults.set` reports no failure, so persistence for this presentation-only preference is best-effort. The legacy file never shipped in any release; a one-shot migration preserves its value and deletes it.)
+
+## Considered options
+
+- Drive the switch from the window scene's `scenePhase`: attempted first and rejected after real-machine testing — on macOS `scenePhase` follows the application, not the window; closing the window (close button or ⌘W alike) fires no phase event, so the Dock icon never returned to accessory.
+- Keep the constant accessory form (ADR-0016): rejected — the user wants a Dock icon exactly while the workspace window is open, and the window is presented at every launch by default, so the constant-accessory rule no longer matches the product.
+- Distinguish login-item launches from manual launches and present the window only for the latter: rejected — `SMAppService.mainApp` launches are indistinguishable in-process, so the distinction would need unreliable launch-reason machinery. The silent-launch preference replaces it as an explicit user choice that applies to every launch.
+- Persist silent launch as a field of settings.json: rejected — the proxy controller persists settings as whole in-memory snapshots, so any parallel writer's field would be clobbered by the controller's next write; a separate one-purpose store follows the `ActivationStateFileStore` precedent and keeps the runtime controller chain from consuming a GUI presentation preference.
+
+## Consequences
+
+- While the workspace window is open the app gains a Dock icon, app-switcher and Cmd-Tab presence, and the default SwiftUI menu bar (⌘W/⌘Q come with it; no custom commands are added yet).
+- With silent launch off, every launch — including login-item launches — presents the window and therefore the Dock icon until the user closes it; with silent launch on, launches start silent and proxy runtime restoration still happens at every launch.
+- ⌘H hiding orders the window out without posting `willClose`, so hiding is never mistaken for closing: the current form is kept and the Dock icon stays available to unhide.
+- With silent launch on, the scene's pre-built but unpresented window triggers no policy change (not visible, never key): launches start and stay accessory until the user opens the window.
+- The preference is inline-toggled and persisted immediately; it affects only the next launch. (2026-09-29: with the UserDefaults migration the failure clause is historical — `UserDefaults.set` reports no failure, so persistence is best-effort and the toggle simply reflects the attempted value.)
+
+## 2026-10-02 amendment: independent rule-report window
+
+The user-confirmed rule-browser simplification adds a single independent conversion-report window. It may remain open after the workspace closes. Activation policy therefore follows all explicitly anchored application windows through one shared coordinator: any open workspace or report window keeps the regular form, and closing the last one returns to accessory. Unanchored sheets and system panels still do not participate; hiding remains distinct from closing. Report launch presentation is suppressed and restoration is disabled, since its contents are an explicitly opened, session-only snapshot.
+
+## 2026-10-06 补充：独立诊断窗口
+
+诊断从工作区移至唯一独立窗口，入口位于菜单栏“打开主窗口…”之后。诊断窗口共享既有窗口激活协调器，可在工作区关闭后独立存续；最后一个受管窗口关闭才回到 accessory。启动呈现被抑制，会话恢复被禁用，重复打开恢复并前置已有窗口。
+
+诊断轮询按宿主 NSWindow 的真实开关状态运行：打开立即采样，失焦、遮挡、隐藏或最小化时继续每秒刷新，关闭后停止；不依赖 SwiftUI scenePhase 或视图销毁。日志来源选择仅在进程内保留，关闭清理导出成功提示与错误弹窗。诊断功能和 ADR-0006 的原始日志与脱敏报告边界不变。
+
+## 2026-10-21 补充：启动窗口前置
+
+静默启动关闭时，`Window` scene 会自动呈现主窗口；窗口激活协调器切换应用为 `.regular` 后调用 `NSApp.activate(ignoringOtherApps:)`，确保应用与主窗口进入前台。静默启动开启时，窗口不呈现，不触发此激活，仍以 accessory 形态启动。
+
+## 2026-10-22 补充：启动激活重试
+
+键盘启动器（Raycast、Spotlight 回车启动）没有关联的点击事件，启动瞬间发出的 activate 请求是否被系统的焦点抢占保护忽略，随当时前台应用而变——实测窗口可见、应用却经常进不了前台（鼠标双击启动因关联点击获得激活许可，不受影响；单次补 `makeKeyAndOrderFront` 亦不足以稳定解决）。为此协调器在窗口首次参与收敛的两条路径（启动呈现时的锚点 attach、不经 key 事件的首次可见化）上采取两层措施：其一，与 `.regular` 策略同拍调用 `NSApp.activate(ignoringOtherApps:)` 并对该窗口 `makeKeyAndOrderFront`；其二，进程内一次性的激活重试——默认每 0.2 秒检查 `NSApp.isActive`，未激活则重试 activate 并置前，应用激活、次数用尽（默认 5 次，约 1 秒窗口）或窗口关闭即止。双击启动首拍已激活，第一次检查即短路退出，不产生额外激活请求。
+
+激活查询与请求经 applier 协议注入（生产为 NSApp 落点），延迟调度经初始化注入（生产为 Task+sleep），单测以收集回调的手动驱动获得确定性；`didBecomeKey` 路径（已是 key）不参与重试，重复可见化不反复置前。
+
+实测重试后结果仍随前台应用分化（Xcode、Safari 等让位后激活成功；Finder、Chrome 持续不让位，重试全程被拒）——macOS 14 起 activate 为协作式激活，让位与否由前台应用决定。为此每拍重试在 activate 之外追加 `orderFrontRegardless`：激活持续被拒时也把主窗口抬到可见层（无键盘焦点，用户点击即完成激活）。每拍同时发射 `launchActivationRetry` 事件（拍数、激活状态、前台应用 bundle id、窗口是否在当前空间）进应用内日志查看器与统一日志（新 category `window`；前台应用属用户环境事实，不进共享诊断报告），用于定位残余失败场景。
+
+诊断事件的首轮实测推翻了 isActive 单信号判据：失败场景 #1 即 active=true、policy=regular、frontmost=本应用，重试当即短路——与成功场景日志完全一致，而视觉上 Dock 图标缺失、窗口在后。即 isActive 可能呈现“激活假象”，真相要看菜单栏归属。收敛判据改为双信号：`isAppActive && menuBarOwningApplication == 本应用`；不齐则继续行动（首拍即重置窗口置前，弹跳序列补注册），诊断事件相应记录 menubar 归属。
+
+GUI 日志的时序定位到启动路径的真正缺陷：重试链从未在启动时启动——首条 retry 事件距启动 8 秒（用户打开诊断窗口才由其锚点触发）；此前轮次观察到的事件均可能是诊断窗口触发的，工作区窗口在启动期一次参与事件都没发出，或链启动后首拍窗口尚未可见、被 isVisible 守卫静默终结且一次性标志已耗尽无法重启。据此三改：其一，链改为可 re-arm——未真正收敛（双信号齐备）前由任何参与/可见化事件重新拉起，收敛后永久闩死，防止会话中抢焦点；其二，锚点附着时尚未可见的窗口安排一次 0.5 秒兜底重扫，覆盖“可见化通知早于附着被错过”的次序（静默启动的窗口届时仍不可见，自然不触发）；其三，锚点附着本身发诊断事件（当时的可见/key 状态）、retry 事件补 visible 位，启动期次序从此可观测。
+
+再实测锁定真正根因：失败场景中 Dock 图标从未出现，进入调度中心才显示——启动早期的 `setActivationPolicy(.regular)` 未注册到 WindowServer/Dock（进程本地已 regular、系统侧仍视作 accessory），activate 因此全程被拒，此前观察到的“前台应用差异”只是该注册竞态的不同结果。重试序列据此两级设计：首拍仍走普通 activate（重开等点击上下文足以生效，避免无谓的 Dock 图标闪烁）；第二拍起走强制弹跳序列。同拍 accessory→regular 弹跳实测会被系统合并吞掉，故拆成有真实间隔的三跳（降 accessory → 沉淀 0.1s → 回 regular 迫使重新注册 → 沉淀 0.15s → 激活置前），末跳续排主链保持单线调度。窗口先于 attach/可见化成为 key 的呈现次序（didBecomeKey 首参路径）同样启动重试，否则失败场景弹跳永不执行；诊断事件补充进程本地策略位（本地 regular 而 Dock 图标缺失即系统侧注册滞后的直接证据）。行动拍用尽后追加一拍只检查拍记录终态。
+
+## 2026-10-24 补充：应用菜单诊断入口
+
+regular 形态的默认菜单栏在应用名称菜单（`CommandGroup(after: .appInfo)`）加入“诊断…”命令，与状态菜单入口同开唯一诊断窗口；应用处于 accessory 形态（无受管窗口）时不出现该菜单栏，入口自然缺席。诊断命令实现为独立视图文件（`App/UI/Diagnostics/DiagnosticsCommands.swift`）。同日移除按源码扫描 openWindow 调用点的守卫（原为文件豁免登记制）：豁免清单的维护成本高于其拦截价值。开窗纪律改由事实保证——全部 `Window` scene 集中在组合根（MainApp）一处声明，窗口激活协调只经 `.modifier(WindowActivationPolicy(...))` 挂在这些受管 scene 上。
+
+## 2026-10-25 补充：取消启动策略弹跳并限制重试预算
+
+用户报告启动重试期间 Dock 出现多个重复应用图标，日志显示菜单栏仍归 Xcode、重试多轮从 #1 重新开始。此前通过 accessory → regular 弹跳补注册的方案撤回：窗口打开期间保持 regular，重试只调用 activate、makeKeyAndOrderFront 和 orderFrontRegardless，不再反复触发 Dock 注册。真实 AppKit 落点仅在策略值变化时调用 setActivationPolicy。
+
+默认 5 次激活预算由协调器在进程内共享。窗口尚未可见或暂时不可见时结束当前链，后续窗口事件可续排剩余预算；双信号收敛或预算用尽后永久停止重试，避免开诊断窗口、切换焦点或可见化事件重新启动整轮。0.5 秒启动可见性重扫、双信号收敛检查及末拍诊断日志保留。系统拒绝协作式激活时，仍通过 orderFrontRegardless 抬窗，用户点击窗口完成激活；不再以反复改变应用形态强制争取焦点。
diff --git a/docs/adr/0018-export-configuration-groups-as-sip-008.md b/docs/adr/0018-export-configuration-groups-as-sip-008.md
new file mode 100644
index 000000000..e5a956627
--- /dev/null
+++ b/docs/adr/0018-export-configuration-groups-as-sip-008.md
@@ -0,0 +1,19 @@
+# Export configuration groups as SIP-008 snapshots
+
+Status: Accepted (2026-09-29)
+
+Export any manual or subscription configuration group as a SIP-008 v1 JSON file, with the selected group as the root and all descendant servers and nested groups included. The standard `servers` array contains every server configuration in depth-first sibling order; the `x_shadowsocksx_ng` v1 extension preserves the selected root, group names, nesting, and child order. This keeps a flat list available to standard consumers while allowing NG2 to retain the group tree.
+
+Preserve provider UUIDs for subscription servers and local UUIDs for manual servers. Derive IDs for subscription servers without a provider UUID, and opaque IDs for extension groups, deterministically from node identity using UUIDv5 and the fixed namespace `0d89e9f8-8f0e-4a55-941a-77d61736eaa3`; IDs remain stable when a node is exported alone or under an ancestor. The export action is in every group row's context menu and is disabled when its subtree has no server configuration. A system save panel proposes `<group name>.json`. The export contains resolved passwords and configured plugin options without a separate warning prompt. If any server cannot be emitted completely—including unresolved credentials or `plugin_opts` without a plugin name—the entire export fails without writing a partial file. Servers that are not activation candidates remain exportable when their SIP-008 fields can be emitted.
+
+## Considered options
+
+- A standard flat list alone would be simpler for consumers but would discard the selected group's names and nested structure.
+- Fresh IDs on every export would break server identity for clients that use `servers[].id` to retain per-server state. A persisted export-ID map would add redundant durable state. Deterministic IDs preserve continuity without another stored mapping.
+- Omitting unrepresentable plugin options would silently lose imported configuration; emitting `plugin_opts` without a plugin name would violate the SIP-008 plugin-field contract. Failing the whole export makes the problem visible and preserves all-or-nothing behavior.
+
+## Consequences
+
+- The selected group is the export root; its ancestors and siblings are excluded. Empty groups and subtrees with no server configurations cannot be exported.
+- SIP-008 consumers that ignore the private extension still receive the flat server list. SIP-008 does not guarantee every client will accept custom fields.
+- The exported file contains plaintext server passwords and plugin options. The explicit export action and save panel are the user-facing controls; no additional confirmation is shown.
diff --git a/docs/adr/0019-declarative-system-proxy-lifecycle.md b/docs/adr/0019-declarative-system-proxy-lifecycle.md
new file mode 100644
index 000000000..fdf808485
--- /dev/null
+++ b/docs/adr/0019-declarative-system-proxy-lifecycle.md
@@ -0,0 +1,9 @@
+# Make system-proxy application declarative and network-aware
+
+**Status**: superseded for system-proxy lifecycle policy by [ADR-0020](0020-privileged-system-proxy-writer.md) and [ADR-0022](0022-observe-system-proxy-differences-and-repair.md). ADR-0020 replaced endpoint-signature cleanup; ADR-0022 replaces passive-network reapplication, launch application, external-change handling, and health-gate behavior. The text below records the historical decision, not current policy.
+
+The system proxy switch manages the values 2.0 applies, not another application's prior configuration: enabling writes 2.0's SOCKS, HTTP, and HTTPS endpoints, PAC/auto-discovery suppression, and exception settings to every service in the active network location when the local runtime passes its existing health and exit gate; disabling scans every network location and clears the complete `Proxies` dictionary for each service whose enabled SOCKS and HTTP/HTTPS endpoints exactly match the most recent endpoint signature 2.0 tried to apply. If the health or exit gate closes while enabled, matching 2.0 endpoint settings are cleared until the gate recovers. Persist only that endpoint signature for cleanup, before attempting the write so partial failures remain identifiable—never the prior per-service dictionaries—and do not detect or report external edits. The signature is a cleanup selector, not proof of exclusive ownership.
+
+While enabled and the GUI is running, a network-location, service, or app-visible network-path update triggers reapplication to the active location; a proxy-configuration-only change is ignored to avoid competing software entering a write loop. Network path updates are observed with Apple's [`NWPathMonitor`](https://developer.apple.com/documentation/network/nwpathmonitor). Startup reconciles once before observation begins. During a disable cleanup, location, service, and proxy-configuration changes trigger another scan; observation stops when the cleanup attempt completes, including on failure. Launching with the switch off performs one cleanup scan and stops. An unsuccessful cleanup may leave settings for the user to handle manually or overwrite with another proxy app.
+
+This deliberately chooses last-writer behavior: enabling can replace another app's values in the active location, and disabling can clear a dictionary written by another app if it has the same endpoint signature. Applying to the active location covers all its network services, not only the interface currently carrying traffic. Changes that occur while the GUI is closed are reconciled on its next launch. This supersedes the system-proxy ownership, conflict, snapshot, restore, and rollback clauses of ADR-0002, ADR-0009, ADR-0010, and ADR-0012; their unrelated decisions remain in force.
diff --git a/docs/adr/0020-privileged-system-proxy-writer.md b/docs/adr/0020-privileged-system-proxy-writer.md
new file mode 100644
index 000000000..04d3b6bcb
--- /dev/null
+++ b/docs/adr/0020-privileged-system-proxy-writer.md
@@ -0,0 +1,35 @@
+# Delegate privileged system-proxy writes to a LaunchDaemon
+
+**Status**: accepted; lifecycle trigger and apply-scope clauses are partially superseded by [ADR-0022](0022-observe-system-proxy-differences-and-repair.md). Its passive observation, explicit repair, and health-driven suspension policy was implemented in commit `4a0a72c` for Issue #73. Privileged execution, registration, typed values, and unconditional all-location cleanup remain in force.
+
+## Context
+
+macOS system proxy configuration is device-wide, while each account has an independent 2.0 system proxy intent. Multiple 2.0 instances therefore write the same configuration; the latest serialized request wins. The existing per-user Agent continues to own only the local tunnel runtime.
+
+System proxy writes require privileged SystemConfiguration access. The GUI must also make the domain decisions: whether proxying is intended, whether the runtime is healthy, which network changes should trigger application, and what complete values should be applied. The privileged process should execute that intent without reconstructing it or deciding when cleanup is appropriate.
+
+## Decision
+
+The lifecycle paragraphs below preserve the original ADR-0020 decision. For when to apply or clear, repair scope, and approval/retry behavior, use ADR-0022; its exceptions replace the original “only on-to-off” cleanup restriction and automatic network/launch reapplication.
+
+Package a root LaunchDaemon with the app and register it through `SMAppService.daemon`. The GUI registers the service when an enabled intent first needs it: on the first explicit system-proxy enable, and again from launch reconciliation if the registration was lost (for example after reinstalling the app). It presents the macOS Login Items approval path when needed. The daemon is activated on demand and remains registered when the agent switch or the system proxy switch is off. The existing per-user proxy Agent remains separate. The GUI does not fall back to direct Authorization Services writes.
+
+The LaunchDaemon property list references the helper executable with the `BundleProgram` key. A relative path inside `ProgramArguments` is resolved against the standard `PATH`, not the bundle, so launchd can never spawn the program and the job enters an `EX_CONFIG` retry loop; `BundleProgram` is the only bundle-relative form launchd supports for SMAppService-submitted jobs. launchd also keeps the job definition it imported at registration time: when the property list content changes across app updates, the GUI compares a content fingerprint of the plist against the one recorded at registration, unregisters the service, waits out the launchd minimum-runtime throttle window, and registers again. Re-registering immediately after unregistering silently keeps the stale definition because launchd removes the throttled job asynchronously. Approval is bound to the bundle signature, so this refresh never prompts again.
+
+The XPC listener accepts a client whose code-signing identifier matches the 2.0 bundle identifier. It does not require a particular Team ID or user ID. This permits open-source builds signed by other teams and requests from 2.0 instances in other accounts. The helper processes requests serially; the last accepted request determines the device-wide configuration.
+
+The GUI sends a closed typed apply configuration containing explicit values for SOCKS, HTTP, and HTTPS enablement and endpoints; PAC disabled with its URL and JavaScript values removed; auto-discovery disabled; the simple-hostname exclusion value; and the complete exceptions list. HTTPS is explicitly supplied even when it shares the HTTP endpoint. The GUI owns the simple-hostname default, which is on. The exceptions list is never optional and never means “preserve the current list.” The helper maps the supplied values to SystemConfiguration mechanically and does not fill in product defaults.
+
+Apply targets every service in the active network location. It changes only keys represented by the typed configuration and preserves other `Proxies` keys. Cleanup is a separate typed command: it removes the complete `Proxies` dictionary for every service in every network location, without checking the source. There is no endpoint signature, snapshot, ownership marker, or restore path. Any endpoint-signature files left by an older build are ignored, not read, migrated, or removed. Users coordinate 2.0 with other proxy apps and handle any configurations they do not want removed.
+
+Only an on-to-off transition of the system-proxy intent may request cleanup. A direct system-proxy switch-off causes this transition. Turning off the Agent switch also turns off system-proxy intent if it was on, and that intent transition causes cleanup; if system-proxy intent was already off, turning off the Agent does not clean system settings. When the Agent action changes both intents, persist both as off, request cleanup, then stop the local listeners. Starting the Agent later does not turn system-proxy intent back on. Neither switch being off at GUI launch, an automatic health or exit-gate change, an invalid target, nor a passive network event requests cleanup. A clear attempt watches location, service, and proxy-configuration changes and rescans until that attempt finishes; observation then stops, including if the request fails. If the daemon cannot execute an explicit clear, the GUI reports the failure and does not retry it in the background. No additional per-toggle confirmation or explanation of all network locations is shown.
+
+If daemon approval or availability is missing, an enabled system proxy intent remains pending, the GUI presents the approval path, and current system settings remain untouched. A clear failure is not deferred. On app update, the GUI uses the existing `SMAppService` registration state and surfaces approval again if required. Removing the app does not clear system proxy settings; users must turn the system proxy off before removal or handle remaining settings manually.
+
+The GUI retains the current network policy: when enabled and its health and exit gates pass, it applies to the active location; location, service, and app-visible network-path changes trigger reapplication, while proxy-configuration-only changes do not. GUI launch performs one reconciliation before observation starts. A gate closure leaves existing system settings in place; recovery can reapply the enabled intent. Replacing automatic observation and reapplication with a passive notice and user-triggered repair remains a separate decision.
+
+## Consequences
+
+Unconditional cleanup can remove another app's values across network locations. The user is responsible for coordinating proxy apps. The switch itself remains a direct action without an added confirmation step or an adjacent explanation about network locations.
+
+This proposal supersedes ADR-0019's endpoint-signature matching and persistence, startup cleanup, and health-gate cleanup. It retains ADR-0019's current enabled-state network observation, reapplication, and finite cleanup-attempt observation. If accepted, implementation must distinguish an explicit switch-off command from launch-time runtime reconciliation so an already-off preference never triggers cleanup.
diff --git a/docs/adr/0021-hostless-unit-tests.md b/docs/adr/0021-hostless-unit-tests.md
new file mode 100644
index 000000000..1fb796423
--- /dev/null
+++ b/docs/adr/0021-hostless-unit-tests.md
@@ -0,0 +1,25 @@
+# Run unit tests without launching the app (hostless tests)
+
+**Status**: accepted
+
+## Context
+
+The unit test bundle is a macOS unit-test bundle whose target depends on the application target, so xcodegen sets `TEST_HOST` and every `task test` run boots the full app executable as the test host before any test executes. The host process carries the production bundle identifier `com.qiuyuzhou.ShadowsocksX-NG2`. When the installed release app is running, a test run therefore creates a second same-identifier process: SwiftUI presents the 960×640 workspace window at launch (the silent-launch preference defaults to off), a second identical status item appears in the menu bar, and LaunchServices registers the DerivedData build path under the production identifier. A hermetic-composition guard (`ApplicationDependencies.isUnitTesting`) swapped in ephemeral stores and suppressed side effects at app startup, but it could not suppress the process itself, its scenes, or the LaunchServices registration, and it kept roughly 140 lines of test-only scaffolding inside the composition root.
+
+Three production code paths resolved packaged resources through `Bundle.main` or the host process identity and therefore depended on the app being the test host: the built-in rule snapshots (`BuiltinRuleCatalog`, default `Bundle.main`), the LaunchDaemon plist fingerprint baseline (`SystemProxyHelperIdentity.launchDaemonPlistData`), and the XPC listener's expected client code-signing identifier (matching because the connecting process was the app itself). Tests that located embedded binaries used `Bundle.main.bundleURL`.
+
+## Decision
+
+Unit tests run hostless. A `ShadowsocksX-NG2Core` static-library target compiles the same sources as the application target (`App/` except the `@main` composition root `MainApp.swift`, plus `Domain/`) and keeps the module name `ShadowsocksX_NG2`, so every test file's `@testable import` is unchanged. Both test bundles depend on the Core target instead of the application target; xcodegen no longer emits `TEST_HOST`, and `xcodebuild test` builds the app but never launches it. The application target keeps compiling everything itself and renames its module to `ShadowsocksX_NG2App` so the two targets' swiftmodules do not collide in the shared products directory. Duplicated compilation follows the existing pattern in which the Agent and SystemProxyHelper targets compile shared `Domain/` files by path; Core is linked only by test targets and is never built by the release chain.
+
+With the host gone, the composition-root test scaffolding is deleted outright rather than guarded: `isUnitTesting`, the testing dependency composition, the noop services, and the ephemeral stores. The app process can no longer run under XCTest, so the guards have no trigger condition.
+
+Packaged-resource lookups become explicit seams instead of `Bundle.main` reads. The controller gains an `appBundle` dependency (production default `Bundle.main`) that both the rule-snapshot loader and the LaunchDaemon plist fingerprint use; the plist reader becomes `launchDaemonPlistData(in:)`. The XPC listener delegate takes its expected client identifier as an injected value (production default remains the 2.0 bundle identifier), and the round-trip test supplies its own process identifier obtained through the same SecCode query the validator uses. Tests locate the built app product through a shared `AppArtifact` helper that walks upward from the test bundle's on-disk location looking for `ShadowsocksX-NG2.app`; this works both while a host embeds the test bundle in `Contents/PlugIns/` and after, when the test bundle and the app sit as siblings in `Build/Products/<config>/`. Bundle-identity assertions in `SkeletonTests` read the located product's `Info.plist` instead of `Bundle.main`.
+
+## Consequences
+
+A test run no longer creates any process with the production bundle identifier, so it cannot collide with a running installed app: no window, no status item, no LaunchServices registration, no focus stealing. Test failures caused by host side effects are structurally impossible rather than guarded against, and the composition root no longer carries test-only branches.
+
+The cost is one extra compile of the shared sources whenever tests are built, and a convention to maintain: production code must not read `Bundle.main` for packaged resources that tests exercise — such lookups go through the `appBundle` seam (or another explicit injection), with `Bundle.main` only as the production default. Tests that need app-bundle content must use `AppArtifact`, never `Bundle.main`, which is the xctest runner's bundle. The XPC listener's injected expected identifier is a test-only relaxation; the production default still accepts only the 2.0 bundle identifier.
+
+This decision supersedes the hermetic test-host convention recorded during ADR-0017's implementation (the `isUnitTesting` startup guard), which existed only because the app was the test host.
diff --git a/docs/adr/0022-observe-system-proxy-differences-and-repair.md b/docs/adr/0022-observe-system-proxy-differences-and-repair.md
new file mode 100644
index 000000000..a22c38f1c
--- /dev/null
+++ b/docs/adr/0022-observe-system-proxy-differences-and-repair.md
@@ -0,0 +1,21 @@
+# Observe system proxy differences and repair explicitly
+
+**Status**: accepted on 2026-10-01; implemented in commit `4a0a72c` for Issue #73. Hostless tests and fixture-based card rendering were verified; real-host system proxy writes, approval, and observation notifications were not validated.
+
+Automatic reapplication after passive network changes can overwrite another application's deliberate proxy settings. Replace that policy with read-only observation of current semantic differences and an explicit repair action, while retaining automatic application after the user saves relevant settings and automatic suspension/recovery when the background runtime or the current mode's exit becomes unavailable/available. This balances user control over external edits with avoiding an unusable local proxy endpoint.
+
+The agent and system proxy switches express persisted intent, independent of runtime health and observed configuration. Failure, external changes, and suspension do not turn either intent off. Explicitly turning off the agent still cascades an enabled system proxy intent to off, clears settings, and then stops the listeners.
+
+Enabling system proxy applies the desired values to all services in the active network location once the runtime is ready. Saving app settings that change desired proxy values also applies automatically when enabled and usable. Passive proxy, service, location, and network-path events only re-read settings. A healthy GUI launch only checks differences; an enabled but unusable runtime at launch requests cleanup. A subsequent unusable-to-usable transition applies automatically while intent remains enabled. Ordinary loss of network connectivity alone is not runtime failure; rule/global modes require an available active target, while direct mode does not.
+
+Both explicit switch-off and enabled-state runtime/exit failure request the existing unconditional cleanup across all network locations and services. Cleanup removes the complete proxy dictionaries, regardless of their source. Successful health-driven cleanup suspends system proxy use without changing intent; failed cleanup remains a visible failure. Recovery and app-setting application can overwrite external values, including changes made while suspended. A failed operation is not automatically retried; a new health-recovery event remains an independent automatic application trigger.
+
+Repair re-reads the current location and applies only to currently differing services, including disconnected services. Compare only app-managed fields, ignore equivalent writes and unmodeled fields, and preserve unmodeled fields during apply/repair. This narrows repair scope; other application triggers retain all-service scope in the active location. There is no prior-value restoration, exclusive ownership claim, or source attribution. Notices disappear as services become consistent and distinguish changed settings from services that have not received the current settings.
+
+Observation and health-driven system proxy actions run only while the GUI process is running, including when its workspace window is closed. This decision does not add observation to the background agent or privileged helper. Quitting the GUI leaves those actions unavailable until the next launch.
+
+Operation results and actionable blockers are separate presentation facts: helper approval must remain visible alongside apply, repair, or cleanup failure. Approval resumes an initial enable request that has not executed, but does not retry an already failed operation. After approval, show the corresponding repair or cleanup retry action. Read failures offer a read-only check action and cannot establish that settings are applied.
+
+This decision supersedes ADR-0019's external-change suppression and passive reapplication and ADR-0020's network/launch application, health-gate preservation, cleanup-only-on-intent-off, and all-service scope for repair. ADR-0020's privileged helper boundary, registration, typed configuration, field preservation, and unconditional cleanup mechanism remain. The accepted UI states, copy, and review scenarios are recorded in [System proxy runtime control](../design/system-proxy-runtime-control.md).
+
+[ADR-0049](0049-agent-owned-runtime-failure-observation.md) narrows steady-state runtime failure observation to Agent-confirmed deployment failures, with a five-second read-only poll. It removes periodic inbound connections and independent receipt/PID failure inference; explicit deployment readiness and successful convergence remain responsible for recovery.
diff --git a/docs/adr/0023-rule-identity-and-offline-testing.md b/docs/adr/0023-rule-identity-and-offline-testing.md
new file mode 100644
index 000000000..55b31c110
--- /dev/null
+++ b/docs/adr/0023-rule-identity-and-offline-testing.md
@@ -0,0 +1,9 @@
+# Rule identity across sources and independent offline testing
+
+**Status**: accepted and implemented. [ADR-0039](0039-rule-values-and-independent-storage-models.md) consolidates the rule value representation while preserving the identity and disablement semantics below.
+
+[ADR-0051](0051-explicit-rule-preset-modeling.md) supersedes the preset-independent disablement and complete-source offline-test scope as an accepted, not-yet-implemented design. Rule identity and within-preset cross-source disablement remain unchanged.
+
+Equivalent entries from multiple rule sources share a normalized match-and-action identity. Disablement applies to that identity across sources and persists even when no source currently contains it; deleting or editing a custom entry does not implicitly enable the old identity. Fixed local bypass rules remain immutable. This avoids duplicate sources silently defeating disablement and preserves the user's exclusion intent through source updates.
+
+Offline testing evaluates all enabled rule sources and the fixed local policy, returning proxy, direct, or no matching rule. It reads no proxy mode, default action, or runtime state, performs no DNS resolution, and is unaffected by browsing filters. This deliberately explains the complete rule collection rather than predicting current traffic: runtime source selection remains a separate policy and can use a different subset. Domain inputs explicitly leave DNS-dependent IP rules untested.
diff --git a/docs/adr/0024-snapshot-drops-absorbed-and-forensics.md b/docs/adr/0024-snapshot-drops-absorbed-and-forensics.md
new file mode 100644
index 000000000..48bba1cf7
--- /dev/null
+++ b/docs/adr/0024-snapshot-drops-absorbed-and-forensics.md
@@ -0,0 +1,15 @@
+# Built-in rule snapshots drop absorbed candidates and conversion forensics
+
+**Status**: accepted.
+
+The custom-rule source-metadata and schema preservation clause is superseded by [ADR-0039](0039-rule-values-and-independent-storage-models.md). Built-in snapshot decisions remain in force.
+
+Snapshots previously shipped every converted entry: effective rules plus same-action absorbed candidates (for example geolocation-cn domains covered by the synthesized `.cn` suffix) and GFWList `@@` exceptions shadowed by a broader proxy rule, each carrying conversion forensics (`originalEntry`, `absorbedBy`, per-rule notes). Runtime analysis recomputes absorption and shadowing from matches alone and never read those forensics, so the extra payload only widened the snapshot interface and slowed browsing and offline matching.
+
+Maintainer updates now omit absorbed and shadowed entries from the snapshot entirely. The conversion report keeps numeric totals only (`convertedCount`, `absorbedCount`, per-reason `skipped`/`rejected`); individual upstream strings go to converter stdout, not into the shipped artifact. Each rule is just an action and a match; the source identity lives once at snapshot level. We accept that disabling a broader built-in rule (such as `.cn`) no longer restores narrower built-in candidates — a rare recovery path not worth carrying thousands of extra rows on every load. Custom-rule disablement, offline testing, and ACL compilation continue to work from the shipped effective set.
+
+The artifact contract is schema version 2 with converter version 2.0.0 and compact JSON. `rules` contains only `{action, match}`; source identity appears only in `metadata.source`. `lossReport` contains `convertedCount`, `absorbedCount`, `skipped`, and `rejected`, with no notes or individual entries. Shadowed GFWList exceptions contribute only to `absorbedCount`, without a second count under `skipped`. Unsupported syntax retains its category count. Detailed conversion evidence is printed to maintainer stdout and is not saved as a sidecar.
+
+The loader rejects old schema/converter versions and rule counts outside the generator limits: 100–200000 for geolocation-cn and 100–50000 for china-ipv4 and gfwlist. Source validation uses snapshot metadata; custom-rule documents keep their existing source metadata and schema. Browsing and independent offline matching consume only shipped rules, while relationships among surviving built-in and saved custom rules are still computed dynamically. Disabling `.cn` also removes the omitted domains from offline explanations; disabling a GFWList blocker does not bring back its omitted `@@` exceptions.
+
+This supersedes the preserved-candidate recovery invariant in `CONTEXT.md`. Converter consolidation was outside this change. ADR-0025 subsequently makes Python the sole upstream conversion path and removes the duplicate Swift converters.
diff --git a/docs/adr/0025-single-rule-conversion-path.md b/docs/adr/0025-single-rule-conversion-path.md
new file mode 100644
index 000000000..e79711860
--- /dev/null
+++ b/docs/adr/0025-single-rule-conversion-path.md
@@ -0,0 +1,17 @@
+# ADR-0025: One rule conversion path
+
+Status: Accepted
+
+The three explicit maintainer updates already generate snapshots through Python. The Swift converters had only test callers and duplicated parsing, normalization, absorption and update guards. In particular, the Swift geolocation converter read source text and resolved includes, while the shipped path reads the upstream's already filtered geosite protobuf release. Those tests did not exercise the artifact generator.
+
+Python remains the sole upstream conversion implementation. Remove the Swift converters, their dedicated parsers and conversion-only CN absorption helper. Swift retains RuleMatch validation, snapshot loading, collection analysis, offline matching and ACL generation; these are product responsibilities.
+
+Test conversion behavior directly in Python, including protobuf selection, typed entries, GFW classification and shadowing, CIDR normalization, duplicate handling, rejection and scale guards, and CLI failure preserving an existing output. Source-text include expansion and inherited attribute filtering are removed with the unused source-text input path; the published geosite release remains upstream-filtered.
+
+Deterministic fixtures generated by those same Python entry points are committed and checked byte for byte by the Python test suite. Hostless Swift tests load the fixtures from their test bundle, then verify collection, offline disablement, ACL and snapshot-store behavior. No conversion algorithm is duplicated in Swift tests.
+
+This change does not alter the Python algorithms, pinned snapshots, schema or converter version. The geolocation Python domain validator still accepts some Unicode letters that Swift RuleMatch rejects; tightening that input contract is a separate behavior change requiring artifact and version review. This consolidation does not claim to resolve that pre-existing discrepancy.
+
+ADR-0024's snapshot slimming contract and explicit-update/offline-build boundary remain in force. The earlier exclusion of converter consolidation applied to that change's scope; this decision handles it separately. A Swift generation CLI or general conversion framework adds build and migration cost without a current product requirement.
+
+The GFWList path now also extracts literal domain hosts from URL prefixes with an empty or root (`/`) path and no query, fragment or user information; other paths remain unsupported. It emits exact-domain matches and preserves the proxy/direct action, deliberately discarding scheme and any valid port. Wildcard hosts, IP literals, invalid URLs and remaining URL conditions stay in the `urlPrefix` loss category. Exact proxy matches only shadow equal exact exceptions; suffix proxy matches can cover either match kind. This extends conversion behavior without changing the schema 2 / converter 2.0.0 artifact contract or regenerating the pinned distribution snapshots. Generated consumer fixtures cover the new match kind.
diff --git a/docs/adr/0026-saved-rule-intent-and-deferred-projections.md b/docs/adr/0026-saved-rule-intent-and-deferred-projections.md
new file mode 100644
index 000000000..8c54ae62d
--- /dev/null
+++ b/docs/adr/0026-saved-rule-intent-and-deferred-projections.md
@@ -0,0 +1,24 @@
+# Saved rule intent and deferred projections
+
+**Status**: accepted (2026-10-03).
+
+The runtime-only recovery decision below is superseded by [ADR-0037](0037-runtime-failure-preserves-latest-intent.md) (2026-10-19). That replacement is implemented; the remaining decisions continue to apply.
+
+## Context
+
+Enabling, disabling, adding, editing, and deleting rules previously waited for ACL compilation, sslocal restart and verification, and then complete browsing analysis. The computations already ran outside the UI actor, but the rule operation remained busy until all phases finished. A failed deployment restored the older rule document as well as the runtime, making persistence success depend on runtime health.
+
+## Decision
+
+- Validation and atomic persistence determine rule-operation success. Once saved, the document remains the user's intent even if analysis, deployment, or runtime recovery fails.
+- Browsing immediately reflects saved entries, source memberships, enablement, counts, and version. Existing coverage explanations remain visible until their replacement is ready; there is no pending-analysis or stale-explanation UI state. Offline matching uses current saved entries and enablement and does not wait for coverage analysis.
+- Browsing analysis and ACL application independently debounce nearby saves. Persistence itself is never delayed by debounce. Each consumes immutable captured facts, and late analysis cannot replace newer saved facts.
+- Rule deployments are serialized. A save while a deployment is underway remains accepted and schedules application of the latest document after the in-flight operation settles. Preparation retains the existing revision, mode, target, and runtime-intent checks.
+- ACL application failures after publication stop the runtime and suspend the system proxy while retaining saved intent and a persistent deployment failure (ADR-0037). They appear through proxy runtime status while the rule page continues to show successful persistence. A new runtime intent or an explicit agent-on retry can attempt application again.
+- Remove user-controlled display sorting and retain deterministic first-source-occurrence order. Content versions and ACL bytes retain their own deterministic ordering. Rule ordering continues to carry no routing priority.
+
+## Consequences
+
+Saved rules and the active ACL can temporarily differ during preparation or after a failed publication. A confirmed failure after publication stops the service rather than replaying an older ACL. This is preferable to silently discarding the user's saved change or keeping rule controls busy through runtime verification. Existing absorption and shadowing explanations may briefly describe an earlier saved document; that small inconsistency is accepted without adding user-visible state tracking.
+
+This replaces the prior whole-rule-document rollback contract recorded in CONTEXT.md and associated tests. ADR-0023 identity, disablement, and offline matching semantics, ADR-0024 snapshot slimming, and ADR-0011 restart-on-ACL-change remain in force. No converter or snapshot format changes are involved.
diff --git a/docs/adr/0027-import-servers-with-fresh-local-identities.md b/docs/adr/0027-import-servers-with-fresh-local-identities.md
new file mode 100644
index 000000000..54d7ed999
--- /dev/null
+++ b/docs/adr/0027-import-servers-with-fresh-local-identities.md
@@ -0,0 +1,17 @@
+# 导入的服务器一律获得全新本地身份
+
+Status: Accepted (2026-10-04)
+
+从 SIP-008 文件（以及 `ss://` 文本、二维码负载）导入服务器配置时，产出的手动目录节点一律使用全新生成的身份。来源文档中的标识——`servers[].id` 的供应商 UUID、`x_shadowsocksx_ng` 扩展中按 UUIDv5 派生的分组 ID——只作为文档内装配键，用于建树时解析子引用，永不成为目录节点身份。重复导入同一份文件产生相互独立的副本，而不是合并、去重或刷新先前导入的分组。
+
+这与订阅侧「订阅固定分组身份客户端所有」同构：目录身份属于本客户端，文档身份属于文档本身。导入是快照复制；订阅刷新才是远端数据的身份延续机制。Legacy 导入保留自己的条件采纳规则（`reusableLegacyID`），因为其来源是同一用户旧客户端的状态——是迁移，不是可分享文档。
+
+## Considered options
+
+- 按 Legacy 导入门禁采纳文档 ID（合法 UUID、批内唯一、目录无冲突）可让备份恢复往返保持身份连续。被否：同一文件重复导入会撞 `duplicateID`，或被迫引入与「手动节点每次新建全新身份」不变量冲突的去重语义；且分组导出 ID 是从节点身份按 UUIDv5 派生的，采纳后再导出仍会二次哈希，完全的往返稳定本来就无法达成。
+- 按端点或凭据与既有目录节点去重同样被否：ss:// 与二维码导入已是逐条新建身份、不按内容匹配（GLOSSARY「服务器导入」），导入不得静默改动既有节点。
+
+## Consequences
+
+- 不持久化文档 ID 与目录身份的映射。导出再导入会产生与原文件不同的 ID（服务器拿到新的手动 UUID，分组拿到新的 UUIDv5 派生值）；跨往返跟踪每台服务器状态的外部消费者会看到新身份。导出中携带的订阅供应商 UUID 在导入后不还原——导入产物是手动子树，按跨来源不变量与原订阅断开。
+- SIP-008 文档的失败粒度是单个导入来源整份拒绝（共享解析器对任一无效记录拒绝整份），`ss://` 文本来源则接受有效行并逐行点名失败。两种情况下失败来源都不产生部分提交。
diff --git a/docs/adr/0028-disable-system-password-autofill-in-server-form.md b/docs/adr/0028-disable-system-password-autofill-in-server-form.md
new file mode 100644
index 000000000..d121fcea3
--- /dev/null
+++ b/docs/adr/0028-disable-system-password-autofill-in-server-form.md
@@ -0,0 +1,20 @@
+# 服务器表单密码字段关掉系统密码自动填充
+
+Status: Accepted (2026-10-05)
+
+服务器表单（新建表单与详情页表单共用同一栅格）的密码字段关掉 macOS 的密码自动填充入口：`PasswordAutofillOptOut` 背景探针按同帧认领承载密码控件的 `NSTextField`，再写字段级私有开关 `_setPasswordAutofillEnabled:`（KVC 键 `passwordAutofillEnabled`，`responds(to:)` 守卫）。
+
+系统对 `NSSecureTextField` 默认提供钥匙串/密码 App 的自动填充入口，且不取决于字段语义：实测底层字段 `contentType` 已是 `nil`（既有 `.textContentType(nil)` 确实生效），入口照旧出现。AppKit 没有公开开关，唯一可用的是这个私有字段位。
+
+## Considered options
+
+- 只用 `.textContentType(nil)` 或改语义类型（`.oneTimeCode`）：前者已实测无效；后者把密码框谎报成一次性验证码字段，语义错误，且会引入空的自动填充弹层。
+- 在密码框前放一个不可见的安全输入框吸收入口（纯公开 API）：要自己维护隐藏字段的焦点与制表顺序，还依赖「系统只给窗口里第一个安全输入框加入口」这条未文档化行为，比私有开关更脆。
+- 自绘掩码输入框（普通 `NSTextField` 加自绘圆点）：零私有 API，但失去安全输入（键盘记录防护），光标、选区与输入法都要重做，代价大于收益。
+- 维持现状：入口一直出现在新建服务器表单里（详情页只因字段只读或已预填，看起来没有该入口）。
+
+## Consequences
+
+- 这是本仓库第一处私有 API。Apple 换实现（方法消失）时探针静默回退到系统默认行为、不会崩溃；`PasswordAutofillOptOutTests` 会失败，提示重做这个缝。
+- 关闭范围是字段级而非全局：同一表单的名称、服务器地址、端口等字段保持系统默认，新建表单与详情页表单共用这一份实现。
+- 明文/密文切换会换掉承载的文本框，认领必须跟着新实例重做；该行为已由用例固定。
diff --git a/docs/adr/0029-source-layout-declares-layer-and-theme.md b/docs/adr/0029-source-layout-declares-layer-and-theme.md
new file mode 100644
index 000000000..0bbd9bc68
--- /dev/null
+++ b/docs/adr/0029-source-layout-declares-layer-and-theme.md
@@ -0,0 +1,27 @@
+# 源码目录即分层与主题，边界由守卫断言
+
+Status: Accepted (2026-10-05)
+
+`App/` 按分层组织（Composition / Application / Presentation / UI / PlatformEffects / Resources），`Domain/` 按主题组织，主题名取自 `GLOSSARY.md` 的章节划分（配置与订阅、代理规则、代理控制与网络、设置、凭据与诊断），避免同一概念在文档与目录里有两个名字。两个目录的根层只放子目录、不放平铺文件——目录本身就是架构声明。
+
+边界由 `Tests/SkeletonTests.swift` 的守卫断言，且一律**正面圈定**而非禁令加豁免登记：视图层的守卫只扫 `App/UI/`（不得引用运行时控制器、工作流实现协作者、原始目录/凭据存储类型），`Domain/` 的守卫只断言根下无平铺 `.swift`、树下只有 `.swift`。把文件放进 `Application/`、`PlatformEffects/` 或某个主题目录，即自动落在扫描范围之外，无需登记豁免；新增主题目录也不需要改断言。
+
+各目录的划分与各自职责由 [工程结构文档](../project-structure.zh.md)维护——本 ADR 只固定组织原则，不维护清单。
+
+## Considered options
+
+- **平铺 + 禁令表 + 豁免登记**：守卫默认扫描整个目录，再逐个登记要放行的例外。每加一个运行时适配器都要改守卫，豁免清单本身成了需要维护的知识，而「这个文件属于哪一层／哪个主题」仍然无处声明。
+- **feature-first（按功能纵向切分）**：把某个功能的领域类型、工作流与视图放进同一个目录。与既有分层冲突——工作流依赖的运行时控制器与目录存储会变成视图的同层邻居，边界退化成不可断言的约定。
+- **`Domain/` 也照搬分层**：领域内部不存在 `App/` 那样的层间依赖方向（没有「领域视图」），照搬只会得到一个叫 Services 的杂物箱。
+- **让守卫锁定主题目录集合**：即正向列举「允许的目录」。未采纳——断言应当固定「不留平铺文件」这条不变量，而不是把主题划分冻结成一份需要同步维护的清单；新增主题目录是正常演进。
+
+## Consequences
+
+XcodeGen 带来两条**在代码里不可见**的约束：
+
+- 源路径的 `excludes` glob **不跨 `/`**：裸文件名只匹配被扫描目录的根层。Core 测试镜像因此必须用 `**/MainApp.swift` 这类递归形式；文件下移后旧写法会**静默**失效，把 `@main` 组合根编进测试镜像。
+- `App/`、`Domain/` 整目录是 source path，其中任何非源码文件都会被 XcodeGen 收进 Resources 阶段并封进签名后的 app bundle。因此文档不放 `App/`（`project.yml` 排除 `**/*.md`），`Domain/` 则由守卫禁止出现非 `.swift` 文件。
+
+跨进程契约按**文件**引用而非按目录：wrapper 与 system proxy helper 两个 target 各自显式列出所需的 `Domain/` 文件，因为它们只该拿到跨进程契约，而不是整个领域层。代价是目录内移动文件必须同步 `project.yml`；漏改时 xcodegen 以 `missing source directory` 直接失败，不静默。
+
+在目录内移动文件因此是低代价操作：模块名、类型名与 import 均不变，`task format` 与 lint 基线不变，版本历史可继续追溯。这条约定分散记录在 `project.yml` 的分层注释、[工程结构文档](../project-structure.zh.md)与本 ADR；新增主题目录时只需同步前两处（`DomainLayoutTests` 失败信息里列举的目录名会过期，断言本身不会失败）。
diff --git a/docs/adr/0030-server-detail-reads-plugin-options-separately.md b/docs/adr/0030-server-detail-reads-plugin-options-separately.md
new file mode 100644
index 000000000..3e94e07fd
--- /dev/null
+++ b/docs/adr/0030-server-detail-reads-plugin-options-separately.md
@@ -0,0 +1,11 @@
+# 服务器详情与编辑凭据装载分离
+
+Status: Accepted (2026-10-06).
+
+后续决定：[ADR-0035](0035-encrypt-persistent-server-library.md) 接受持久服务器库整体解密并在应用进程内保留明文至退出，调整本文的密码按需装载与参数会话保留边界。详情不显示密码、编辑草稿与详情展示分离的要求继续有效。
+
+服务器详情展示已保存连接资料和插件参数，不展示或读取密码；完整编辑草稿只在编辑 sheet 中装载。详情通过独立的参数读取 interface 获取插件参数，读取失败仅影响参数区。这使密码不可读时普通资料仍可浏览，也避免详情为展示参数而依赖完整编辑草稿。
+
+插件参数仍属于敏感信息，但用户明确选择在只读详情中直接查看，以支持订阅服务器及未知插件的参数核对。参数明文仅在详情会话中持有，不加入非秘密展示投影或持久快照。相较于只显示“已配置”，这里接受主动浏览详情时读取参数的取舍；相较于复用编辑装载，这里保留密码与参数各自独立的读取范围和失败处理。
+
+ADR-0028 的密码自动填充关闭策略继续适用于新建与编辑 sheet 中共用的密码输入字段；原有详情页表单被只读呈现替代。
diff --git a/docs/adr/0031-node-creation-and-modification-timestamps.md b/docs/adr/0031-node-creation-and-modification-timestamps.md
new file mode 100644
index 000000000..591a9f451
--- /dev/null
+++ b/docs/adr/0031-node-creation-and-modification-timestamps.md
@@ -0,0 +1,17 @@
+# 配置目录节点记录创建时间与修改时间
+
+Status: Accepted (2026-10-09)
+
+配置目录的每个节点（服务器配置与配置组）增加创建时间与修改时间事实，目录文档版本升至 v5（读取兼容 v1–v5，写入始终 v5）。修改时间采用结构敏感语义（类比目录 mtime）：节点自身资料变化（服务器的连接字段与名称、分组的名称）更新自身；分组的直接子节点集合或顺序变化（增删子节点、子节点移入移出、重排）更新该分组；被移动节点自身内容不变、修改时间不动；内容未变的写操作（同名重命名、同值字段提交、内容未变的订阅刷新）不更新任何时间戳。时间一律由调用方传入（`now: Date`），领域层保持无时钟纯值类型；一次逻辑变更（导入、复制、订阅快照应用）共享同一时刻。
+
+订阅子树同样维护时间戳：订阅刷新以快照整体重建，但逐节点与旧载荷比较——延续且内容未变的节点保留双时间戳，内容变化的保留创建时间、更新修改时间，新出现的节点双时间戳为写入时刻；固定分组身份客户端所有，其创建时间跨刷新保留。复制、URI/文件导入与 Legacy 导入产生的新节点，创建时间即操作时刻，与「全新本地身份」规则一致（ADR-0027）。历史文档（v1–v4）没有时间戳，读取为未知（nil）且不回填，与订阅 `lastSucceededAt` 的「旧文件缺失时不猜测」原则一致。
+
+## Considered options
+
+- 最窄语义（仅节点自身资料变化才更新，结构变化完全不动时间戳）：实现最简，但把服务器移入/移出分组、组内重排不会在任何节点留下痕迹，与「分组内容被改过」的用户直觉不符。被否。
+- 写入即更新（不比较内容，任何写操作都刷新相关节点）：无需比较逻辑，但内容未变的订阅刷新会刷新整棵子树的修改时间，同名重命名与同值保存也会伪造变化，事实失真。被否。
+
+## Consequences
+
+- v5 文档中未知的时间戳省略键；`CatalogEntry` 的 `Equatable` 包含时间戳，跨时间构造的目录夹具做整体相等比较时必须用受控时刻。
+- 展示 UI 不在本次范围内；后续直接读取节点的创建/修改时间即可，语义以本 ADR 与 GLOSSARY「节点时间戳」为准。
diff --git a/docs/adr/0032-ordered-favorites-reference-catalog-nodes.md b/docs/adr/0032-ordered-favorites-reference-catalog-nodes.md
new file mode 100644
index 000000000..6dae1036b
--- /dev/null
+++ b/docs/adr/0032-ordered-favorites-reference-catalog-nodes.md
@@ -0,0 +1,9 @@
+# 收藏按节点身份保存独立顺序
+
+Status: Accepted (2026-10-09)
+
+收藏是用户对配置目录节点的独立选择，支持手动与订阅来源的服务器配置和配置组。收藏以节点身份组成的去重有序序列保存，不复制节点资料、不展开组的后代、不改变目录位置。收藏顺序独立于目录顺序；新收藏以及取消后重新添加的收藏追加到末尾。改名和移动保留收藏，复制和导入产生的新节点不继承收藏。
+
+收藏序列与目录、订阅记录保存于同一目录文档，节点删除和失效收藏清理作为一次原子保存。订阅刷新后仍存在的节点保留收藏；消失节点的收藏立即清除，同身份再次出现不恢复收藏。相比单独保存偏好或保留失效引用，该选择省去跨文件一致性和墓碑状态，但不提供远端节点短暂消失后的自动恢复。
+
+收藏命令集中在现有 `CatalogWorkflow`，持久化成功后发布新状态；失败保持原状态并显示错误。仅改变收藏或收藏顺序不得触发运行状态收敛，也不得更新节点时间戳。目录内容变化仍遵循现有提交与运行状态收敛规则。收藏不是配置组成员变更，不能借用目录移动或目录排序命令表达。
diff --git a/docs/adr/0033-plugin-records-own-aliases-and-local-arguments.md b/docs/adr/0033-plugin-records-own-aliases-and-local-arguments.md
new file mode 100644
index 000000000..9b9460055
--- /dev/null
+++ b/docs/adr/0033-plugin-records-own-aliases-and-local-arguments.md
@@ -0,0 +1,19 @@
+# 插件记录拥有别名与本地启动参数
+
+插件记录以名称集合、可执行程序选择、有序本地启动参数与插件传输模式表达同一个插件版本。服务器继续保存原始引用名称；名称精确区分大小写，不解析版本后缀、不探测二进制版本。无版本名称指向最新大版本是记录维护者的显式选择，带版本名称用于固定大版本。这样同一版本的多个引用共享本机配置，而目录解析 module 集中承担名称归属与程序选择。
+
+用户记录具有独立持久身份，可编辑名称集合。不同用户记录禁止重名；用户只覆盖明确声明的内置名称，失效覆盖不回退内置程序。删除或移动名称不改写服务器和订阅引用。无版本名称通过先从旧记录删除并保存、再加入新记录并保存转移，接受中间暂时不可解析，以免增加专门的跨记录转移流程。
+
+内置记录的固定身份、引用名称与打包文件名分开维护。当前 v2ray-plugin 同时提供 `v2ray-plugin` 与 `v2ray-plugin-v1`，仍使用同一二进制。内置名称由应用发布维护；本机可以设置内置记录的启动参数与插件传输模式，不必覆盖路径。仍使用内置记录的名称共享这些参数与模式，被用户覆盖的名称使用用户记录自己的参数与模式。
+
+本地启动参数按普通配置保存，不额外接入凭据存储或增加敏感信息处理。每项是一个完整 argument，保留顺序、空格与空字符串，不执行 shell 解析，拒绝无法传给进程的 NUL。运行配置生成时写入 `plugin_args`，与服务器 `plugin_opts` 独立；本地路径和启动参数不进入服务器分享、导出或订阅资料。
+
+`plugins.json` v1 的每项迁移为独立用户记录，保留名称和路径，启动参数为空，不因路径相同而合并；后续保存为 v2。读取失败继续阻止修改，不自动清空。保存成功才发布目录快照并启动异步运行状态收敛，失败不发布，运行失败不撤销已保存配置。单服务器不可用时拒绝激活，组内跳过不可用服务器。
+
+设置列表按记录显示全部名称、路径、来源与可用性，内置记录标记被覆盖的名称。编辑器以列表编辑用户名称与启动参数，参数可调整顺序；服务器选择器显示每个可引用名称并保存所选原文。删除用户记录删除其全部名称，并恢复同名内置选择。
+
+验证覆盖目录与运行配置 seam、持久化迁移、失败不发布及源码界面。此次不运行真实 sslocal 参数传递验证，按用户确认的验收范围执行。
+
+插件传输模式提供 `tcp_only` 与 `tcp_and_udp`，由用户判断插件是否支持 SIP003u，不探测二进制能力、不维护支持清单。默认 `tcp_only`，运行配置省略 `plugin_mode`；`tcp_and_udp` 则显式写入该值。它只决定流量是否经过插件，不改变本地 SOCKS5 UDP 中继能力，也不保证插件自身支持 UDP。模式属于本机记录，不进入分享或订阅。旧 v1、v2 文件缺少模式时使用默认值；未知值按读取失败处理，保留原文件并阻止修改。内置记录的模式按固定身份保存，与用户覆盖独立。
+
+编辑器显示「插件传输模式」。内置入口为「设置」，标题为「内置插件设置」。「清空参数」移入编辑器，只清空草稿中的启动参数并保留模式，点击「保存」才提交，点击「取消」放弃。模式与参数一次保存并沿用既有提交后运行更新流程。本次模式验收不包含真实 SIP003u 通信。
diff --git a/docs/adr/0034-separate-local-and-lan-listeners.md b/docs/adr/0034-separate-local-and-lan-listeners.md
new file mode 100644
index 000000000..e3fb81064
--- /dev/null
+++ b/docs/adr/0034-separate-local-and-lan-listeners.md
@@ -0,0 +1,49 @@
+# 分离本地监听与局域网监听
+
+后续修订：监听认证的持久化与读取失败重置方向见 [ADR-0042](0042-encrypt-proxy-listening-configuration.md)；该修订已实施。
+
+**状态**：已接受。
+
+2026-10-13 修订：局域网启用状态与监听模式独立。
+
+现有单组监听将本机使用与网络设备共享耦合在同一对端口上。改为始终提供本地入口，并允许独立开启局域网入口，使局域网的地址族、身份验证和 UDP 开关不改变本机入口。
+
+## 已确认的决策
+
+- 后台代理客户端运行时，本地 SOCKS 与 HTTP 始终在 `127.0.0.1` 监听；不增加本地监听开关。
+- 本地默认端口为 SOCKS `11086`、HTTP `11087`；本地 SOCKS 固定 `tcp_and_udp`，HTTP 固定 `tcp_only`。
+- 局域网默认端口为 SOCKS `11088`、HTTP `11089`；启用状态为独立 Bool 开关，默认关闭。
+- 局域网监听模式为所有 IPv4 接口、所有 IPv4 与 IPv6 接口、所有 IPv6 接口，默认所有 IPv4 接口。三项分别绑定 `0.0.0.0`、`::` 配合 `ipv6_only=false`、`::` 配合 `ipv6_only=true`。关闭不覆盖已选监听模式，重新启用沿用所保存的模式。
+- 四个端口限制为 `1025...65535`，且全部互异；关闭局域网监听时也校验这些配置约束。
+- 局域网 SOCKS UDP 默认关闭，用户可以开启；表单说明身份验证无法可靠保护 UDP 中继。
+- 仅检查 TCP 端口占用。局域网关闭时不检查其端口占用。配置不显式指定 UDP 端口，使用 sslocal 的默认行为。
+- 局域网 SOCKS 与 HTTP 共用一组用户名和密码；身份验证默认关闭。
+- 首次编辑预填用户名 `user`，并生成 10 位小写字母和数字密码。未保存的密码随取消操作丢弃；保存后不重新生成。
+- 用户名和密码均为 1–255 字节的可打印 ASCII；用户名不得包含 `:`；不自动删除首尾空格。
+- 身份验证关闭时保留凭据，并禁用凭据输入框。局域网关闭时保留全部配置，并禁用监听方式、端口、UDP、身份验证与凭据控件；取消与保存仍按原有规则可用。
+- 密码保存在现有 Keychain 凭据存储中。保存失败保留旧配置；复制命令时读取失败停止复制并显示错误。运行时认证文件仅允许当前用户读写，配置摘要不包含密码。wrapper 隐藏上游认证失败日志中客户端提交的密码；超长日志丢弃到下一个换行，防止分块输入泄露尾部。
+- 设置使用“本地监听”和“局域网监听”两个入口，每项独立 sheet；每个 sheet 的完整值独立保存。
+- 局域网 sheet 切换启用开关只修改草稿；保存成功后才改变实际监听。关闭草稿时保留本次尚未保存的所有修改，重新启用恢复编辑并重新检查 TCP 端口占用；过期探测结果不能影响保存。取消丢弃本次全部修改。
+- 外层局域网设置项始终显示已保存的状态；关闭时只显示“关闭”，不显示监听方式、端口、UDP 或身份验证详情。
+- 界面使用 `SOCKS`、`HTTP 代理端口`、`所有 IPv6 接口`。
+- 首页默认命令地址为 `127.0.0.1`，使用本地端口且不加入凭据。其他候选来自现有 Wi-Fi/Ethernet 地址策略，按局域网模式过滤；选择这些地址时使用局域网端口，必要时加入凭据。
+- 局域网关闭时不提供局域网命令地址候选，原局域网地址选择回退 `127.0.0.1`，不执行局域网防火墙观察；所保留的监听模式不影响有效本地入口。
+- 首页移除 `::1` 候选。地址失效时回退 `127.0.0.1`；选择仍仅属于当前会话。
+- URL 特殊字符编码后再生成 shell 命令；tooltip 与复制内容都包含完整命令和真实密码。
+- NG2 尚未正式发版，不迁移旧监听配置，新安装使用默认值；本次独立启用开关调整不要求兼容旧局域网记录。
+
+## Module 设计
+
+- 扩展现有监听 Module：`SslocalListenSettings` 包含本地与局域网的明确类型；负责四端口校验和有效入口派生，不引入任意数量的通用监听数组模型。
+- 复用 `SettingsWorkflow` 的独立编辑与保存 Interface。认证文件格式和凭据提交留在现有持久化与运行配置 Implementation 内，UI 不拼接运行时 JSON。
+- 从单组监听改为本地与局域网独立监听时，旧监听字段与旧监听文件不再作为新监听的输入；其他偏好与服务器资料保留。
+- 系统代理、健康检查的本机目标、菜单 HTTP 环境命令始终使用本地入口；运行时同时检查所有启用入口是否建立 TCP 监听。
+- 保存成功后，运行中的后台代理客户端按需重启；关闭状态下保存不启动客户端。运行失败不回滚保存的配置，代理状态界面报告失败。
+
+## 与已有决策的关系
+
+本决策取代 ADR-0015 的单组监听设计；ADR-0008 的固定 UDP 约束保留在本地监听；ADR-0013 的独立保存原则保留，但端口范围改为 `1025...65535`。历史 ADR 正文不作语言迁移。
+
+## 上游默认行为
+
+sslocal v1.26.0 未设置独立 UDP 地址与端口时，SOCKS UDP 中继沿用该入口的地址与端口，并非每次 UDP ASSOCIATE 随机分配中继监听端口。本设计不设置独立 UDP 端口，也不增加 UDP 占用检查。[默认地址派生](https://github.com/qiuyuzhou/shadowsocks-rust/blob/v1.26.0/crates/shadowsocks-service/src/local/socks/server/mod.rs#L121)、[UDP ASSOCIATE 回复](https://github.com/qiuyuzhou/shadowsocks-rust/blob/v1.26.0/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs#L301)。
diff --git a/docs/adr/0035-encrypt-persistent-server-library.md b/docs/adr/0035-encrypt-persistent-server-library.md
new file mode 100644
index 000000000..3e0226a4d
--- /dev/null
+++ b/docs/adr/0035-encrypt-persistent-server-library.md
@@ -0,0 +1,65 @@
+# 持久服务器库整体加密与主密钥恢复边界
+
+后续修订：加密格式、文件名、identity 存储和匹配方式按 [ADR-0050](0050-age-encrypted-configuration-storage.md) 执行；范围外的监听配置采用独立主密钥整体加密，见 [ADR-0042](0042-encrypt-proxy-listening-configuration.md)；该修订已实施，服务器库自身的恢复规则保持不变。
+
+Status: Accepted（2026-10-18）。
+
+实施状态：整体加密、记录直接携带秘密及移除 NG2 历史格式兼容均已实施。当前实现以代码为准，验证结果见对应交付记录。
+
+持久服务器库采用标准 age 文件格式整体加密，通过 AgeSwift 使用 X25519 identity，详见 [ADR-0050](0050-age-encrypted-configuration-storage.md)。密码、完整插件参数、订阅 URL 与配置目录、订阅关联、收藏共同进入密文；服务器库专用 Keychain 项只保存标准 age identity 私钥文本，不再逐项保存这些凭据。监听认证等范围外凭据保持独立存储；测试 URL 按 ADR-0036 保存为非敏感偏好。`sslocal-active.json` 与派生认证文件的加密另案处理。
+
+主密钥采用经典登录钥匙串，并以严格 ACL 限制获准应用访问。该选择优先考虑开源分发中的维护者签名变更和用户自行编译；不通过放宽到任意应用访问来换取兼容。更换签名后的前台重新授权与迁移路径仍须设计，并在真实签名构建中验证，不能承诺静默读取旧密钥。
+
+启动和后台读取不得主动触发授权弹窗；遇到需要交互的状态时显示可重试的错误，只有用户主动解锁时请求系统授权。当前进程成功读取过密钥后继续使用内存资料。签名变更后的重新授权沿用该显式入口，实际系统授权结果以真机验证为准。
+
+首版不提供完整服务器库的独立密码加密备份。用户接受主密钥丢失后通过重新导入或订阅恢复资料；未另存的手动资料无法保证恢复。ADR-0018 的 SIP-008 明文配置组导出保持其原有用途，不等同于完整服务器库的加密备份。
+
+## 内存与加载失败
+
+应用成功解密后，主密钥与服务器库明文在当前应用进程内保留至退出；首版不增加手动锁定功能。此后锁定钥匙串不撤销当前进程已经读取的资料，当前应用继续工作。应用重新启动后重新读取主密钥。
+
+整体解密使服务器密码随服务器库进入内存，因此调整 ADR-0030 的按需读取边界：不再承诺只有打开编辑界面才装载密码，也不再承诺插件参数明文只在详情会话中持有。详情界面仍不显示密码，编辑草稿仍与详情展示分离。非秘密展示投影、诊断与日志不得因整体解密而包含秘密。
+
+加载失败时保留原文件，阻止服务器库写入，并提供重试入口；已有后台代理服务继续运行。不得将解密失败、密钥不可用、格式不支持或文件损坏自动视为空库。加载失败后，只有用户明确确认放弃原配置时，才进入新建流程。
+
+用户可以在加载失败后明确确认创建空库，并覆盖旧文件。该操作必须独立于重试，确认文案必须说明覆盖将放弃旧服务器库；取消操作不得修改旧文件。此授权是产品行为决定，不是本次设计讨论中立即删除本机数据的授权。重置时创建新主密钥，成功保存新空库后清除活动目标并撤下原服务器出口，保留代理服务开关意图，沿用现有空库收敛行为。新空库保存失败时保留旧文件与原运行状态。
+
+加载失败状态不得作为空库传入启动时的活动目标重展开流程。当前活动目标独立持久化；以空库重展开会清除目标并部署无服务器出口的运行配置，违背失败时保留已有代理运行的决定。加载失败状态必须与真正空库明确区分。
+
+## 记录与提交
+
+服务器记录直接保存密码与可选的完整插件参数，订阅记录直接保存订阅 URL。不再保留库内凭据引用、独立秘密字典或按引用读取秘密的存储。主密钥仍独立保存在 Keychain；范围外凭据存储不因此改变。
+
+目录、订阅与收藏组成完整工作副本，秘密随所属记录一起修改。提交执行「修改副本 → 校验 → 整体加密并原子保存 → 发布完整已提交值」。失败时丢弃副本，保留旧字段与旧秘密，不再为服务器库执行逐项凭据补偿。运行时收敛仍在持久化成功后进行，运行时失败不回滚已提交服务器库。
+
+复制记录时复制凭据值并生成新节点身份，后续修改互不影响；订阅刷新保留既定节点身份与顺序规则，不再复用或清理凭据引用。订阅 URL 编辑必须先持久化成功再请求刷新，且不因 URL 编辑本身重展开服务器出口。
+
+生产服务器库存储只提供加密写入，移除未注入加密存储时的明文 JSON 写入路径。显式配置组导出与分享保持原有用途；非秘密展示投影、诊断与日志不得直接携带完整记录。
+
+## 历史格式与旧版导入
+
+NG2 尚未发版，不再支持其历史数据迁移，包括旧 `catalog.json` 与逐项 Keychain 凭据，以及已实现的「目录 + 引用秘密表」加密格式。新记录格式使用明确的新版本，只读取当前格式；移除旧版本兼容解码、自动迁移与迁移清理，不读取或清理旧逐项 Keychain 凭据。
+
+持久文件路径按 ADR-0050 改为 `catalog.age`。发现旧自研 `catalog.enc` 或旧格式库时报告不支持的格式，阻止写入，不自动转换、不退回其他旧文件，也不静默当作新安装。只有当前库与历史 `.enc`、`.json` 均不存在时才按全新空库处理；旧 `catalog.json` 的存在检查只用于识别旧库，不读取其内容。用户仍可明确确认放弃旧库并创建空库；该操作只提交新的 `catalog.age`，不增加对旧文件或旧 Keychain 项的清理。
+
+保留用户主动执行的旧版 ShadowsocksX-NG 服务器导入与再次导入。这是 ADR-0002 确定的产品功能，不属于 NG2 内部格式迁移。导入直接构造携带凭据值的手动记录，保留既定身份、完成标记和失败恢复语义；不导入旧版偏好或改写旧版数据。
+
+## 主密钥生命周期
+
+首版不提供手动或定期轮换入口。正常保存沿用匹配的 identity，每次生成新的 age 密文；用户明确重置服务器库时创建新主密钥。密钥创建与首份文件提交的失败保护属于实现契约，不得先删除旧密钥再尝试写入新文件。
+
+## 实施与验收
+
+实现保持单应用进程、串行保存与单个已匹配 identity 的内存模型；Keychain 保留重置前的 identity，不引入多进程迁移协调、自动轮换或历史密文恢复系统。采用标准 age v1，不附加自研文件头；JSON 结构版本在密文内，读取兼容二进制和 ASCII armor。服务器库保存过程只写密文临时文件，不向日志或诊断报告增加秘密。主密钥不写入普通文件、日志或诊断报告；运行契约沿用本文开头规定的范围。磁盘权限沿用目录 0700、文件 0600。
+
+验收集中于本次实际改变的路径：
+
+- 文件与加密：完整资料往返不丢字段；多次保存生成不同密文；错误密钥、篡改与不支持版本返回错误；文件不含样本资料明文。
+- 格式与失败：历史明文库与旧加密格式均报告不支持，不转换、不覆盖、不清理旧凭据；提交失败保留旧文件和完整已提交内存值；只有明确确认重置才创建空库。
+- 记录与提交：创建、编辑、导入与订阅刷新同时提交字段和秘密；复制后凭据修改互不影响；订阅 URL 保存失败不请求刷新；新存储不存在生产明文写入路径；保留诊断与展示投影脱敏。
+- 产品行为：加载失败不写空库、不重展开原活动目标；授权仅由用户主动触发；取消重置保留旧数据，确认且保存成功后清除目标；现有导入、编辑、订阅与激活兼容。
+- 真机：验证实际构建下的主密钥保存和读取、退出重启、钥匙串锁定与前台授权；运行进程验证与纯文件测试分别记录。没有实际执行的签名身份变更或跨机恢复测试标为未验证，不扩展为首版完整签名组合测试矩阵。
+
+用户通过 implement 指令确认实施本次修订。上述验收条件是实施检查清单，实际执行结果见对应提交与交付记录。
+
+研究依据见 [服务器配置文件整体加密方案研究](../research/server-configuration-encryption.md)。该报告是候选方案与调研记录，本 ADR 仅采纳上述明确列出的决定。
diff --git a/docs/adr/0036-store-connectivity-test-url-in-user-defaults.md b/docs/adr/0036-store-connectivity-test-url-in-user-defaults.md
new file mode 100644
index 000000000..a3501b8ee
--- /dev/null
+++ b/docs/adr/0036-store-connectivity-test-url-in-user-defaults.md
@@ -0,0 +1,13 @@
+# 测试 URL 作为非敏感偏好存入 UserDefaults
+
+Status: Accepted（2026-10-18，用户已通过 implement 指令确认实施）。
+
+测试 URL 是非敏感偏好，以明文存入 UserDefaults，不再通过 Keychain 和代理设置中的凭据引用保存。展示、日志、诊断报告及其他路径均不要求对测试 URL 脱敏，包括其路径与查询参数；这修订 ADR-0006 对 URL 的一概排除规则，仅限测试 URL。订阅 URL、服务器密码及其他凭据的保护边界保持不变。ADR-0035 对测试 URL 的范围外凭据描述由本决定替代。
+
+不迁移已有自定义值，不访问或清理对应旧 Keychain 项，移除旧测试 URL 引用的使用。没有新偏好时使用默认值 `http://www.gstatic.com/generate_204`；旧 Keychain 条目可能残留，不再影响测试功能。
+
+UserDefaults 键缺失、类型错误或保存的字符串不符合现有 URL 校验时，统一使用默认 URL。保存时保留现有校验：仅允许 HTTP，要求非空主机，禁止用户名、密码与 fragment，显式端口须在 1…65535 范围内，允许路径与查询参数。合法值按项目现有 UserDefaults 方式保存并立即生效，不承诺原文件保存路径的落盘错误报告与回滚保证。
+
+URL 变化后沿用现有行为：清空历史测试结果并取消正在执行的测试，不重启代理。界面布局、测试协议、测量算法及其他设置的存储不在本次调整范围内。
+
+实施验收覆盖独立 UserDefaults 测试域中的自定义值往返、默认值与异常值处理、无效输入拒绝、旧引用被忽略且不访问 Keychain，以及 URL 变化的发布行为。核查测试 URL 相关脱敏规则与诊断输出，使其符合非敏感分类，同时保持其他凭据的保护。
diff --git a/docs/adr/0037-runtime-failure-preserves-latest-intent.md b/docs/adr/0037-runtime-failure-preserves-latest-intent.md
new file mode 100644
index 000000000..7a57102f6
--- /dev/null
+++ b/docs/adr/0037-runtime-failure-preserves-latest-intent.md
@@ -0,0 +1,17 @@
+# 运行部署失败保留最新意图，不自动恢复旧配置
+
+**Status**：accepted（2026-10-19）。已实施；当前行为以代码为准。
+
+运行部署失败不再通过恢复旧模式或重新部署旧运行配置来恢复服务。保留最新已保存意图和失败状态，防止用户选择与实际提供服务的配置静默分离。此决定统一适用于普通部署、模式切换和保存规则后的部署。
+
+发布监管资料之前失败时，不发布半成品，原监管资料保持不变。这不属于发布后的自动恢复。监管资料发布后检测到部署失败时，停止仍存活的 sslocal 子进程，暂停系统代理，保留代理服务开关、系统代理开关及最新模式和规则意图；停止或系统代理清理失败必须继续报告失败，不得宣称服务已停止或系统代理已暂停。
+
+本决定取代 ADR-0026 中 ACL 应用失败后尝试恢复旧运行配置的规则，以及当前代码中的模式切换失败恢复旧模式、规则默认动作与旧运行配置的行为。ADR-0026 的规则保存成功与运行状态收敛分离、串行部署及过期计算保护继续保留。ADR-0022 的系统代理意图与实际健康状态分离继续保留。
+
+明确的部署失败只允许用户显式重试或新的运行意图触发再次部署。GUI 重新启动、普通状态轮询或 launchd 重启不得自行重试已失败的同一部署。失败状态及其所属部署必须在进程重启后仍可识别；代理服务开关保持开启不等同于再次部署授权。
+
+健康运行后的子进程意外退出保留自动恢复，重放当前部署，不选择历史成功部署。恢复尝试若形成明确的部署失败，进入上述失败状态，不通过 launchd 无限重试同一失败部署。实现必须区分健康运行后的意外退出与启动、重载或重启过程中确认的部署失败。
+
+运行文件清理不再为自动恢复旧配置保留历史部署；当前子进程仍使用的文件和各 ACL 变体的最新文件仍必须保留。停止完成前不得删除仍使用的文件。文件发布过程中失败的具体处理仍须在实现设计中明确，本决定不将这些路径默认为自动重新部署旧配置。
+
+失败身份保存在 `agent-deployment-failure.json`，对应随机部署身份。GUI 收敛在分配新代次前比较当前意图；Agent 启动也检查该失败身份。显式开启重试会清除失败授权屏障；新运行配置可以发布新身份。健康运行后的子进程退出在 Agent 内重放当前监管资料，恢复启动或监听建立失败后记录失败并干净退出，不交给 launchd 形成无限重试。回执只记录 Agent 操作和监听证据，不声称上游已确认重载。
diff --git a/docs/adr/0038-separate-agent-supervision-and-sslocal-input.md b/docs/adr/0038-separate-agent-supervision-and-sslocal-input.md
new file mode 100644
index 000000000..7783739b4
--- /dev/null
+++ b/docs/adr/0038-separate-agent-supervision-and-sslocal-input.md
@@ -0,0 +1,45 @@
+# 分离 Agent 监管资料与 sslocal 输入
+
+**Status**：accepted（2026-10-19）。已实施；验证结果见对应实现提交。
+
+后续修订：GUI 与上游配置的单向输出及私有意图比较见 [ADR-0043](0043-one-way-sslocal-configuration-output.md)。ACL 变化改用信号热重载见 [ADR-0048](0048-reload-sslocal-acl-by-signal.md)，取代下文 ACL 变化必须重启的规定。
+
+## 职责
+
+GUI 派生并写入 sslocal 配置、LAN 认证文件和 ACL 文件，再原子替换独立的非秘密监管资料。Agent 只解码监管资料，不再从 sslocal 配置读取服务器列表或 LAN 凭据，也不再生成认证文件。本次为后续 age 加密准备职责分离，不引入 age、Agent 密钥或 sslocal 解密能力。
+
+监管资料描述部署身份、探测端点、重启判定所需的非秘密身份、具体文件引用和各 ACL 变体的保留引用。不得包含服务器密码、完整插件参数、LAN 用户名或密码，以及凭据引用；不得复制包含认证秘密的现有监听指纹，或用低熵凭据的无盐摘要充当公开身份。
+
+## 发布与运行
+
+配置按部署生成不同文件名，发布后保持不变。认证和 ACL 文件只在内容变化时新建；未变内容复用已有文件，切换模式不重写大型规则 ACL。监管资料的原子替换是部署意图的发布点，不代表 sslocal 已应用该部署。
+
+Agent 独占运行目录内共享稳定配置链接和 `acl-active.ini` 的切换权。sslocal 以稳定配置链接路径启动，配置中的 ACL 路径始终指向稳定 ACL 链接。仅服务器变化时，Agent 切换配置链接并发送 SIGUSR1。上游 fork v1.26.0 已支持通过 SIGUSR2 热重载 ACL，但 NG2 Agent 尚未接入；ACL 变化仍按当前协议完整重启。本次只升级 sslocal 来源，不接入该信号。[上游实现](https://github.com/qiuyuzhou/shadowsocks-rust/blob/v1.26.0/src/service/local.rs#L1152-L1165)。
+
+监听、认证和 ACL 变化要求重启。Agent 必须停止旧子进程、确认其退出、切换链接，再启动新子进程，不安排新旧子进程重叠运行。链接目标必须是运行目录内的受管文件，保留路径防逃逸和过期准备结果保护。
+
+两个链接分别原子切换，不承诺配置与 ACL 同时生效。现有 SIGUSR1 回执也不能证明 sslocal 已完成配置应用；本次不将信号投递成功解释为上游应用确认。
+
+## 代次与清理
+
+以持久、单调递增的 UInt64 整数代次标识部署，文件名使用固定宽度十进制字符串；不依赖文件时间戳或时钟顺序。GUI 分配代次并串行发布，新代发布后不得发布过期准备结果，回收的文件名不得复用。高水位保存在 `runtime-generation`，预留允许留空号，损坏或溢出时拒绝发布，停止服务不删除高水位。
+
+Agent 在完成切换后清理旧文件。以同一份监管资料内的代次和引用判断保留集合；未来代次及当前代次不清理，旧代文件仅在没有保留引用时清理。保留当前部署、当前子进程仍使用的文件，以及各 ACL 变体的最新文件。不能仅因文件代次较旧就删除复用的 ACL 或认证文件。
+
+GUI 不得重新引用退出保留集合的旧文件；准备文件必须先获得新代次保护。GUI 清理本次取消或失败的未发布文件。清理过程必须覆盖并发发布，不得删除下一代正在准备或已发布的文件。GUI 准备、分配和发布，以及 Agent 的扫描、最新引用合并和删除，共享运行目录中的 `runtime.lock`（flock）。GUI 只从锁内读取的已发布保留集合复用文件。Agent 清理同时保护自身快照、子进程使用过的引用和锁内读取的最新发布引用。旧快照清理不能与 GUI 复用已退休文件交错；GUI 准备文件的代次始终高于 Agent 清理边界。单一 Agent 在运行期还持有 `agent.lock`，避免并发启动。
+
+配置、认证和 ACL 文件名均包含 20 位十进制代次。认证身份使用随机 UUID；只在凭据变化时换身份和文件，不公开凭据摘要。GUI 为每份配置准备同代 `config-<generation>-intent.json`，保存 GUI 私有意图摘要、最终配置字节摘要与脱敏汇总，用于配置损坏后仍能识别失败意图并独立提供诊断事实；Agent 只保留该引用，不读取正文。该 GUI 私有摘要不进入监管资料、回执或诊断。
+
+监管资料格式第 2 版以必填的 `configuration` 和 `intentMetadata` 分别记录配置与 GUI 私有元数据的具体文件引用，不通过配置文件名推导元数据位置。两个引用必须不同，均以 `config-` 开头并属于本次部署代次；监管校验不限定这两个文件的格式后缀。当前发布端继续生成 `sslocal.json`、`intent.json` 后缀，稳定链接仍为 `sslocal-active.json`。认证与 ACL 的命名和复用规则保持不变。元数据与配置同样必须是已存在的普通文件，缺失时整份部署不可用。发布与回收只依赖显式引用、受管文件名和代次，不解析配置正文。
+
+本次格式变更不提供旧监管资料兼容、迁移或残留处理；开发环境切换前已停止后台进程并清理旧运行产物。未实现密文输入、密钥交接或通用资源框架。
+
+`sslocal.pid` 保留尚未确认退出的子进程身份；Agent 崩溃后若该 PID 仍存在，则拒绝启动第二个实例并报告失败。无法确认退出的进程和保守 PID 复用阻断需要用户检查并显式重试。没有可靠活跃准备者证据时，崩溃遗留的未来代文件暂不回收。
+
+## 失败与验证
+
+采用 ADR-0037：发布前失败不替换监管资料；发布后确认部署失败则停止子进程、暂停系统代理并保留最新意图与失败记录，不自动恢复旧部署。只允许显式重试或新运行意图再次部署；健康运行后的意外退出重放当前部署。
+
+本决定部分替代 ADR-0011 的固定可覆写 ACL 变体及 GUI 切换活动链接方式，保留按变体复用、未变内容免写、稳定 ACL 入口和 Agent 不读 ACL 正文。
+
+验证范围为定向行为测试、完整 hostless 测试、Debug 构建及真实 sslocal smoke：覆盖监管资料无秘密、稳定链接服务器热重载、ACL 文件复用、重启端口交接、并发发布与清理、发布失败、失败记录跨重启保留及崩溃恢复。SIGUSR2 和 age 不属于此次验证范围，真实系统代理与原生界面验收不得由 hostless 或 smoke 结果替代。
diff --git a/docs/adr/0039-rule-values-and-independent-storage-models.md b/docs/adr/0039-rule-values-and-independent-storage-models.md
new file mode 100644
index 000000000..a81d85d42
--- /dev/null
+++ b/docs/adr/0039-rule-values-and-independent-storage-models.md
@@ -0,0 +1,25 @@
+# 规则值与独立存储模型
+
+**状态**：已接受（2026-10-19）。
+
+## 背景
+
+自定义规则逐条保存来源类别、上游版本和标签，但浏览直接根据文档归属赋予 `.custom`，运行规则不使用这些元数据。编辑仅透传来源，读取仅校验类别，额外字段没有保留必要事实。
+
+`CustomRule`、`ProxyRule` 和 `RuleIdentity` 重复表达动作与匹配条件。原始 `RuleMatch` 枚举允许绕过校验，只有转换为规则身份时再次尝试规范化；同一条规则可能同时存在原始匹配条件与规范化匹配条件。领域类型直接实现 `Codable`，又使其表示与自定义文件、内置快照的格式绑定。
+
+## 决定
+
+- `ProxyRule` 是唯一的规范化动作与匹配条件值，其相等性用于规则身份、去重、停用与分析。不保留独立 `RuleIdentity` 类型。自定义条目的 UUID 仍是独立的持久编辑身份，符合 ADR-0023。
+- `RuleMatch` 封闭构造入口。动态输入必须经校验和规范化；调用者只能读取匹配模式，不能用原始字符串直接组装领域值。移除规则身份中的再次规范化及失败后保留原值的路径。IPv4 与 mapped IPv6 仍保留不同身份，覆盖判定保持既有语义。
+- 固定本地后缀 `local`、`localhost` 通过受控常量表示，存储转换支持其往返。普通自定义输入和自定义文档仍拒绝这两个后缀；不开放任意单标签后缀，保留显式允许 `cn` 的入口。
+- 自定义文档与内置快照均使用独立存储 DTO。领域规则值、条目与集合不承担 JSON 编解码职责，也不携带 schema 版本。文件 adapter 管理版本、历史格式与领域转换，使领域模型和磁盘格式可以独立演化。来源归属仍由浏览集合表达，内置快照仍保留上游、许可、归属和转换报告等事实。
+- 自定义条目不再保存 `source`。自定义文件写入 schema 3，读取兼容 schema 1/2，忽略旧来源字段；schema 1 没有停用集合。加载不重写文件，下次正常原子保存才写新格式。保留 UUID、条目顺序与孤立停用身份。旧客户端拒绝 schema 3，不支持降级读取。
+- 存储 DTO 保持自定义条目的平铺 `id/action/match`、停用集合的 `action/match` 以及内置快照 schema 2 / converter 2.0.0 的磁盘形状。条目重复 UUID、重复规则身份、重复停用身份与无效匹配条件仍拒绝，不改写损坏文件。
+- 内容 token 显式保持历史字符串格式，不依赖 Swift 类型调试描述。内容摘要、确定性排序和 ACL 字节不随内部表示变化而改变。保存意图、延迟投影及运行失败处理继续遵循 ADR-0026 与 ADR-0037。
+
+## 取舍
+
+存储 DTO 带来显式转换代码，但隔离了真实存在的两个文件契约，避免以后领域变化被迫迁移磁盘格式。没有为此引入通用存储协议或额外 adapter 抽象。
+
+此决定取代 ADR-0024 中“自定义文档保留来源元数据与原 schema”的条款；内置快照的精简格式与其他决定继续有效。
diff --git a/docs/adr/0040-keep-settings-recovery-simple.md b/docs/adr/0040-keep-settings-recovery-simple.md
new file mode 100644
index 000000000..1a776e075
--- /dev/null
+++ b/docs/adr/0040-keep-settings-recovery-simple.md
@@ -0,0 +1,9 @@
+# 设置损坏接受人工恢复，保持处理简单
+
+**状态**：已接受（2026-10-19）。
+
+代理设置的加载、校验、保存与失败处理职责应集中，避免各调用路径重复解释同一状态；集中职责不意味着新增恢复 module、通用存储抽象或恢复流程。仅在能够消除实际重复时收拢实现，不为此机械拆分 `settings.json`。
+
+对极端的设置文件损坏，接受应用无法继续工作，必要时由用户手动清空配置目录后恢复；不要求应用内提供部分恢复、自动修复、备份或重置向导，也不要求主动让应用崩溃。我们接受这一人工恢复成本，避免为低概率场景增加复杂的状态、交互和测试组合，长期承担维护成本。
+
+正常输入校验，以及保存与运行状态收敛分离的保证继续保留。文件保存继续保证原子替换、保存失败不发布新快照；按 ADR-0041 分离到 UserDefaults 的偏好采用普通偏好的保存语义，不再保留文件写入失败的报错与回滚路径。测试聚焦这些日常契约，不为极端损坏建设复杂恢复场景矩阵。本决定仅约束代理设置的恢复设计，不修改服务器库等其他存储的既有恢复约定。
diff --git a/docs/adr/0041-separate-preferences-from-proxy-listening-configuration.md b/docs/adr/0041-separate-preferences-from-proxy-listening-configuration.md
new file mode 100644
index 000000000..a4f622b40
--- /dev/null
+++ b/docs/adr/0041-separate-preferences-from-proxy-listening-configuration.md
@@ -0,0 +1,15 @@
+# 分离独立偏好，将 JSON 限定为代理监听配置
+
+后续修订：监听配置整体加密与确认重置方向见 [ADR-0042](0042-encrypt-proxy-listening-configuration.md)；该修订已实施，本 ADR 的存储范围分离继续有效。
+
+**状态**：已接受并实施（2026-10-19）。
+
+当前 `settings.json` 同时保存监听配置和独立偏好，模式与开关等修改需要重写整份快照。将独立偏好直接分离，以缩小文件存储 module 的职责；不另建通用设置仓库，也不为原整快照保存路径专门建设集中管理 module。
+
+- JSON 仅保存代理监听配置：本地端口、局域网启用状态、监听模式、端口、UDP 中继、身份验证用户名及密码引用；密码继续独立保存在 Keychain。保留四端口联合校验、凭据提交、原子保存与写入失败处理。
+- 代理模式、规则默认动作、代理服务开关、系统代理开关与附加系统代理例外改用 UserDefaults。修改后执行现有运行或系统代理动作；不再为这些值提供 JSON 写入失败的报错与回滚路径。部署失败仍保留最新意图，遵循 ADR-0037；开关级联与系统代理行为不因更换存储而改变。
+- 领域类型、文件 adapter 和文件路径均使用代理监听配置的专用命名，不保留通用 `settings` 名称来承载此文件职责。新增设置只有属于代理监听配置、需要其关联约束时才能加入；其他场景的偏好由所属 module 管理。
+- 运行状态收敛仍可捕获一致的内存快照，用于配置派生和过期结果检查；该快照不定义统一持久化范围。现有轻量偏好、服务器库、自定义规则、活动目标及插件映射的存储不收拢到监听配置中。
+- 不迁移旧 `settings.json`：新监听配置文件与新增 UserDefaults 偏好在没有保存值时使用各自默认值，现有开发配置需要重新设置。旧文件不读取、不删除，遗留 Keychain 条目不访问、不清理；用户重新保存的监听凭据继续按正常流程管理。此前已独立保存的 UserDefaults 偏好保持不变，不做整体重置。
+
+分离后仅收拢实际仍存在的重复实现，不以统一持久化方式或恢复职责为目标增加抽象。极端文件损坏接受人工恢复，沿用 ADR-0040。本决定修订 ADR-0040 对保存失败保证的适用范围。
diff --git a/docs/adr/0042-encrypt-proxy-listening-configuration.md b/docs/adr/0042-encrypt-proxy-listening-configuration.md
new file mode 100644
index 000000000..787e41136
--- /dev/null
+++ b/docs/adr/0042-encrypt-proxy-listening-configuration.md
@@ -0,0 +1,31 @@
+# 代理监听配置整体加密与确认重置
+
+**状态**：已接受并实施（2026-10-19）。
+
+代理监听配置改用与服务器库相同的主密钥加密方法，但保留独立文件和独立主密钥。按 [ADR-0050](0050-age-encrypted-configuration-storage.md) 复用 AgeSwift 的标准 age 文件加密与经典 Keychain identity 存储的实现，不共用服务器库当前的实际密钥。服务器库重置不改变监听配置及其密钥，监听配置重置也不改变服务器库。
+
+用户名和密码随所属监听配置整体加密保存。移除逐项凭据存储、密码引用及跨存储提交补偿；保留完整配置校验、原子保存、保存失败不发布，以及保存成功后再执行运行状态收敛的契约。运行配置准备、编辑与终端命令从已解密内存读取所需值；状态投影、日志与诊断不得因此携带密码。
+
+## 读取失败与重置
+
+读取失败时保留原文件并阻断正常启动，不进入可操作的工作区，也不允许普通监听保存覆盖原配置。显示说明性错误 alert，只提供“重置监听配置”选项，不提供取消或退出选项。提示重置将放弃原监听配置，包括端口和局域网认证资料，并关闭局域网监听。不要求判断密钥是否永久丢失，不提供找回密钥或人工删除文件的恢复分支。
+
+静默启动遇到相同错误时也直接显示该 alert，不等待用户打开主窗口。正常启动的静默行为保持不变。
+
+只有用户明确确认重置后，才创建独立的新主密钥并原子保存默认监听配置。保存成功后发布默认值并解除监听配置读取失败的运行阻断。保存失败则保留原文件，不发布默认值，继续报告错误。默认配置关闭局域网监听，避免保留原共享入口却移除身份验证。
+
+读取失败、等待确认及重置失败期间，保留已有后台代理和系统代理，不执行停止、重部署或系统代理修改。GUI 无法读取监听配置，不代表后台代理已经使用的独立运行配置失效；正常启动的运行状态收敛必须等待监听配置可用。重置成功后，再按默认监听配置、现有活动目标和已保存的代理服务与系统代理开关意图执行正常收敛，不重置这些独立意图。
+
+不新增恢复页面、恢复向导或复杂的错误恢复状态机。相较于要求用户定位并删除配置文件，错误 alert 中的确认重置能以有限交互成本降低恢复成本。这是对 ADR-0040 人工恢复取舍的局部修订。
+
+启动组合根在装配其他应用 module 前完成监听配置读取或确认重置。读取失败不会进入工作区或启动正常运行状态收敛；普通保存也不能绕过读取失败门禁。
+
+## 取舍与适用范围
+
+独立密钥使两个存储 module 保持各自的生命周期与恢复规则。共用实际密钥虽然减少一条 Keychain 记录，却要求协调两份密文的首次创建、读取和重置，收益不足。
+
+不迁移旧自研 `proxy-listening.enc` 或旧监听 JSON，也不读取或清理旧逐项 Keychain 凭据。检测到旧监听文件时报告格式不支持，由用户明确确认后重置，不静默忽略旧文件并使用默认值。
+
+本决定修订 ADR-0034、ADR-0035、ADR-0041 对监听密码继续独立保存于 Keychain 的规定。ADR-0041 对监听配置与独立偏好的存储范围分离继续有效。
+
+本 ADR 记录产品行为，不授权在设计讨论期间重置本机实际配置或 Keychain 项。
diff --git a/docs/adr/0043-one-way-sslocal-configuration-output.md b/docs/adr/0043-one-way-sslocal-configuration-output.md
new file mode 100644
index 000000000..3cb985b59
--- /dev/null
+++ b/docs/adr/0043-one-way-sslocal-configuration-output.md
@@ -0,0 +1,13 @@
+# sslocal 配置单向输出与运行意图比较
+
+**状态**：已接受（2026-10-19）。
+
+GUI 的内存运行意图与 sslocal JSON 输出分离。上游配置只包含上游字段，移除 `x_shadowsocksx_ng_acl` 和 `x_shadowsocksx_ng_listen`。GUI 不再解码该配置恢复派生输入、认证资料或诊断事实；不新增完整运行意图的持久副本。
+
+模式切换与规则保存共用从最新已保存目录、活动目标、监听配置及插件资料重新派生的路径。选择这一方式是为了减少快照状态与派生分支，不为极端并发场景增加恢复机制。目录或监听配置不可读时，继续遵循 ADR-0035、ADR-0042 的运行阻断与已有后台服务保留规则。
+
+运行发布 module 统一拥有意图比较、认证文件复用与文件准备。GUI 私有的同代 `intent.json` 保存意图摘要、最终配置字节摘要和脱敏诊断摘要，不保存完整配置或凭据。意图摘要用于等价判断和失败意图识别；最终字节摘要只用于检查输出文件漂移；随机部署身份继续关联 Agent 操作、回执与失败记录。三者不互相替代。GUI 可以读取输出字节计算摘要，但不解析其 JSON。私有意图摘要不进入监管资料、回执或诊断。
+
+LAN 认证仍写入现有受保护的明文认证文件。发布 implementation 比较本次内存生成的字节与当前监管资料引用的认证文件，相同则复用文件与随机认证身份，不同或不可读则重新准备。此比较不读取 sslocal 配置，也不增加凭据摘要、版本状态或完整秘密快照。未来认证文件是否加密仍开放；若编码形态变化，在发布 implementation 内调整比较方式，不提前引入通用加密框架。
+
+本决定补充 ADR-0038，沿用其代次、锁、不可变发布、稳定链接、ACL 复用与清理规则，以及 ADR-0037 的失败处理。本次不实施加密、密钥交接或 sslocal 应用确认协议。后续文件引用格式改造见 ADR-0038 的第 2 版监管资料：配置与私有元数据采用显式引用，监管校验不依赖配置格式后缀。当前回执仍不表示 sslocal 已确认应用重载。
diff --git a/docs/adr/0044-classify-application-support-files.md b/docs/adr/0044-classify-application-support-files.md
new file mode 100644
index 000000000..f005cba6f
--- /dev/null
+++ b/docs/adr/0044-classify-application-support-files.md
@@ -0,0 +1,9 @@
+# 应用支持目录按生命周期分类并共享运行路径规则
+
+**状态**：已接受（2026-10-19）。
+
+应用支持根目录下使用 `configuration/` 保存 GUI 持久资料、`runtime/` 保存跨进程部署和监管资料、`logs/` 保存 Agent 日志。共享目录让停止清理扫描 GUI 原子写入临时文件；拆分后运行清理只扫描运行目录。`ApplicationSupportPaths` 确定分类目录，`RuntimePaths` 集中同一部署的路径规则，GUI 发布和 Agent 监管共用，不新增通用存储框架。
+
+运行目录内不再细分：配置、GUI 私有意图摘要、认证、ACL 与监管资料参与同一发布和回收协议，继续遵循 ADR-0038、ADR-0043 的同目录引用、代次、锁和稳定链接约束。停止后高水位与两把锁保留。日志与运行目录分别创建并维护权限，不再依靠日志初始化顺带建立运行目录。目录 `0700`、普通文件 `0600`，加密和主密钥规则不变。
+
+应用尚未发布，本次不引入旧平铺布局的自动迁移、回退读取或清理；新目录缺少配置时按首次使用初始化。开发环境切换前须停止旧后台进程，手动搬移需要保留的当前格式 GUI 文件，运行产物重新生成。旧根目录原位保留，初版 `silent-launch.json` 的自动迁移随之移除，已保存的 UserDefaults 偏好不变；本条修订 ADR-0017 中开发文件的一次性迁移行为。新目录内既有的旧格式拒绝规则继续保留。
diff --git a/docs/adr/0045-native-oslog-unified-log-routing.md b/docs/adr/0045-native-oslog-unified-log-routing.md
new file mode 100644
index 000000000..83fe167c4
--- /dev/null
+++ b/docs/adr/0045-native-oslog-unified-log-routing.md
@@ -0,0 +1,15 @@
+# 统一日志路由：原生 os.Logger 与封闭枚举 dispatch
+
+**状态**：已接受（2026-10-20）。
+
+日志去向收进发射缝统一路由到 macOS 统一日志，Console.app 按稳定 subsystem `com.qiuyuzhou.ShadowsocksX-NG2` 与 category 过滤查看；stderr 行式输出与事件缓冲降为另外两个去向，`RuntimeLog.emit(_:)` 仍是唯一发射 interface。实现用平台原生 `os.Logger`，不引第三方日志库：swift-log 及其 backend、CocoaLumberjack 会把 privacy 标注拍平成普通字符串，swift-log-oslog 自身也建议直接使用 os_log；本仓库保持零 SPM 依赖。不恢复用户日志级别设置（延续 ADR-0014），级别、category 与 privacy 全部由事件派生。
+
+`RuntimeLogEvent` 保持封闭枚举，脱敏由构造保证（延续 ADR-0006）。系统日志路由是枚举上的穷举 switch：level 三分（失败类 `.error`、里程碑 `.default`、冗长测量 `.info`），category 五分（runtime / supervision / system-proxy / connectivity / diagnostics），公开文本与 private detail 按 `text` + `privateDetail` == `description` 从 `description` 裁切派生，不手抄前缀。新增事件漏路由直接编译失败，privacy 决策必须显式作出。规则：枚举构造的文本标 public，自由形式的错误 detail 与连通性测量内容（含探测目标 IP）标 private；服务器地址与备注默认不进普通日志的基线不变。
+
+sslocal 的上游自由文本是进入统一日志的第二条流，不进 `RuntimeLogEvent`：`SslocalOutputIntake` 拥有 chunk-safe 分帧、密码脱敏与超长行丢弃，把脱敏后的行送两个去向——agent.log 文件（行格式见 ADR-0046，行正文为脱敏后的原始文本，供 ADR-0006 的本地查看面）与统一日志 category `sslocal`。上游行整行标 private（上游默认日志可能含服务器地址），级别按空白 token 探测 ERROR/WARN/WARNING，忽略大小写并支持 token 外的一对方括号，其余落 `.info`；统一日志只有五级、没有 warning，WARN/WARNING 落持久的 `.default`，级别名仍留在行文本里。上游改格式时优雅退化为全 `.info`，不丢行。agent.log 的保留策略（启动时超 1 MiB 截断）留在共写该文件的文件去向一侧，不并入 intake。
+
+考虑过但拒绝的选项：把上游自由文本塞进封闭枚举（破坏脱敏由构造保证的基线）；密码脱敏后把上游行标 public（服务器地址进持久 store）；再加一层地址形态正则脱敏后标 public（会漂移的正则防线）；让 intake 拥有 agent.log 截断策略（该策略属于 wrapper 事件行与 sslocal 行共写的文件去向）。`.info`/`.debug` 只在 stream 可见、不落盘，统一日志的持久面只收探测到的警告与错误，agent.log 才是完整持久面；private 字段对普通 Console 用户显示 `<private>`，正文阅读继续走 app 内诊断查看面。诊断报告的白名单投影独立于本路由，新增事件仍须显式决策（ADR-0006）。
+
+测试运行关闭统一日志写入：测试缝 `SSXNG_SYSTEM_LOG=0` 由 scheme 的测试动作注入、测试拉起的子进程在夹具显式设置，stderr 行与事件缓冲不受影响——测试不把日志灌进系统日志 store。这不是用户日志级别设置（ADR-0014 的口径不变）。
+
+**2026-10-20 补充**：统一日志的写入单元随后抽为 `SystemLog`（`Domain/Runtime/SystemLog.swift`），GUI/wrapper 的 `RuntimeLog.emit` 与特权系统代理 helper 共用它；helper 侧事件的边界（专属封闭枚举、无文件面）见 ADR-0047。
diff --git a/docs/adr/0046-uniform-log-line-format.md b/docs/adr/0046-uniform-log-line-format.md
new file mode 100644
index 000000000..207aaaa6e
--- /dev/null
+++ b/docs/adr/0046-uniform-log-line-format.md
@@ -0,0 +1,13 @@
+# 统一日志行格式与日志视图 intake
+
+**状态**：已接受（2026-10-20）。
+
+「一行日志是什么」收口到 `LogLine`（时间戳 + 级别 + 来源 + 正文），渲染与解析各一处，agent.log 文件与诊断日志视图共用同一格式：`yyyy-MM-dd HH:mm:ss.SSS Z [error|warning|info] [gui|wrapper|sslocal] 正文`，时间戳固定 POSIX locale，并携带 UTC 偏移（例如 `+0800`），避免夏令时回拨或进程时区不同造成归并错序。采用写侧富化：wrapper 事件行与 sslocal 行在写入时带上时间戳与级别（sslocal 级别沿 ADR-0045 的空白 token 探测），旧 `ssxng:` 事件标记吸收为来源列。升级前不带偏移的统一格式行继续按本地时间读取并保留级别与来源，但无法恢复原先缺失的时区信息。其他旧格式行解析失败时降级保留原文、级别尽力探测、时间未知，raw capture 不改写。
+
+诊断日志查看器由一个 intake（`DiagnosticLogIntake`）提供行：tail 窗口逻辑（有限字节、起始半行丢弃）收在 intake，GUI 事件缓冲与 agent.log 尾部行按时间戳归并为一个列表（旧格式行排最前并保持文件内顺序），提供级别（全部 / 警告+错误 / 仅错误）与来源（全部 / GUI / wrapper / sslocal）双维过滤，复制跟随可见行。级别用经典三级 error / warning / info——里程碑事件归 info、上游 WARN/WARNING 归 warning；统一日志的五级投影（ADR-0045）是另一个口径，两者的映射规则在 `LogLine` 同一处。
+
+LF 分帧按字节或 Unicode scalar 匹配，避免 Swift 把 CRLF 视为一个 Character 后漏掉行界。CRLF 中的 CR 仍保留在正文，不影响下一行的级别与来源。
+
+边界不变：诊断报告的白名单投影零改动，日志行仍只经显式查看/复制呈现、永不进入诊断报告（ADR-0006）；统一日志继续只做 Console 面。agent.log 的保留策略（启动时超 1 MiB 截断）仍留在文件去向一侧。
+
+考虑过但拒绝的选项：从 OSLogStore 回读喂查看器（统一日志是跨进程共同事实源，但 private 字段回读为 `<private>`，恰好毁掉查看器展示正文的职责；测试回读须真写系统日志，与测试静默缝相撞）——该路径留给特权 helper 事件（唯一没有文件面、且枚举文本公开）；读侧推导元数据（agent.log 行无时间戳，归并排序与过滤残缺）；保留双 tab 只统一行格式（GUI 与 wrapper 时间线仍无法对照）。
diff --git a/docs/adr/0047-privileged-helper-unified-log-only.md b/docs/adr/0047-privileged-helper-unified-log-only.md
new file mode 100644
index 000000000..4182d795c
--- /dev/null
+++ b/docs/adr/0047-privileged-helper-unified-log-only.md
@@ -0,0 +1,15 @@
+# 特权 helper 事件只进统一日志
+
+**状态**：已接受（2026-10-20）。
+
+特权系统代理 helper（root LaunchDaemon）此前是日志黑洞：launchd 丢弃其 stdout/stderr，进程内零输出，helper 侧失败上下文只剩随 XPC 应答回传的 typed 错误、由 GUI 进程转述成 `.systemProxyWriteFailed`。GUI 视角不完整的场景完全没有痕迹：GUI 超时后 helper 实际做了什么、连接中途失效、helper 被 launchd 杀死或拉起失败、签名校验拒绝的连接（谁在敲门）。
+
+helper 复用统一日志的最小发射单元 `SystemLog`（`Domain/Runtime/SystemLog.swift`），与 GUI、wrapper 共用 subsystem `com.qiuyuzhou.ShadowsocksX-NG2`，category 沿用 `system-proxy`——root 侧事件与 GUI 侧 XPC detail 在 Console.app 同一过滤下按时间相邻对照。特权进程的编译面只增加两个文件：发射单元 `SystemLog` 与 helper 侧事件枚举 `SystemProxyHelperLogEvent`。
+
+helper 事件是专属封闭枚举 `SystemProxyHelperLogEvent`，不扩 `RuntimeLogEvent`：GUI 事件枚举（含连通性测量内容）不进特权进程。事件面是生命周期最小集：拉起就绪、连接接受/拒绝（含对端 pid，本机事实字段）、每个 apply/clear 请求的 typed 结果（written/unchanged/cleared 或失败 case + detail）；不记 payload 内容（例外列表等不入日志）。privacy 口径沿 ADR-0045：typed 枚举文本标 public，自由 detail 段（服务标识、SC/XPC 错误文本）标 private。
+
+事件没有文件面：不写 stderr、不进 agent.log、诊断日志视图与诊断报告（ADR-0006 不新增披露面），root 侧细节的查看路径就是 Console.app。诊断日志视图里系统代理的行仍是 GUI 侧转述。发射缝可注入（engine 与 listener 的构造参数，生产默认 `SystemProxyHelperLog.emit`），测试注入替身断言发射内容；`SSXNG_SYSTEM_LOG=0` 测试静默缝照旧。
+
+考虑过但拒绝的选项：扩 `RuntimeLogEvent` 并让 helper 编译 `RuntimeLog.swift`（特权进程背上 GUI 全事件面，编译面扩大）；helper 直写 `os.Logger`（privacy 拆分与测试缝两处重复）；OSLogStore 回读并入诊断日志视图（helper 事件文本公开、回读可读全，但引入读系统日志的测试面与真实 store 写入，与测试静默缝相互作用，复杂度不值当前失败面）；GUI 在失败应答时把 root 事件转记进视图（只覆盖应答成功的场景，超时与断连仍缺，恰是本决策要补的面）。
+
+helper 与 GUI 的 XPC 契约不变，不加请求关联 id：helper 请求串行执行，同一 subsystem 下的时间戳与串行顺序足以对照两侧事件。
diff --git a/docs/adr/0048-reload-sslocal-acl-by-signal.md b/docs/adr/0048-reload-sslocal-acl-by-signal.md
new file mode 100644
index 000000000..401216f2b
--- /dev/null
+++ b/docs/adr/0048-reload-sslocal-acl-by-signal.md
@@ -0,0 +1,19 @@
+# 通过信号热重载 sslocal ACL
+
+**状态**：已接受并实施（2026-10-20）。
+
+使用已固定的 sslocal fork v1.26.0 的 `SIGUSR2` 能力，让规则修改、规则默认动作变化，以及规则／全局／直连模式切换产生的 ACL 更新在原子切换稳定 ACL 链接后热重载，减少子进程重启造成的中断。GUI 继续向 Agent 发送 `SIGUSR1` 通知新部署，Agent 根据变化向 sslocal 发送相应信号。监听、IPv6 监听设置或认证变化仍按原协议停止旧子进程、确认退出后重新启动。
+
+监管资料通过随机 `configurationID` 表示 sslocal 配置字节的身份，GUI 在旧配置字节及其私有完整性摘要均与本次输出一致时复用该身份。Agent 只比较身份，配置变化时发送 `SIGUSR1`，ACL 变化时发送 `SIGUSR2`；仅切换代理模式或更新 ACL 不重载服务器配置。身份不包含服务器或凭据摘要，Agent 仍不读取秘密配置。第 2 版监管资料允许缺失此字段，遇到旧资料时保守发送 `SIGUSR1`。服务器与 ACL 同时变化时分别发送 `SIGUSR1` 和 `SIGUSR2`，接受两者先后生效的短暂窗口，不为组合变化单独重启，也不承诺原子应用。上游 `SIGUSR1` 仅刷新服务器，不能代替 ACL 重载。
+
+Agent 对已经健康、无需重启的同一子进程沿用已建立的监听事实，不在热重载前后重复连接端口，也不因信号重载将其降为未就绪。首次启动或重启仍验证新子进程的监听归属。启动监听尚未就绪时合并保留待发信号，监听就绪后发送，防止后续仅服务器更新覆盖之前待发的 ACL 更新。正式 Agent 部署在所有代理模式下始终生成 ACL，不为模型允许的 ACL 空值增加产品转换场景。
+
+GUI 以仅保存在内存中的非 ACL 意图摘要识别纯 ACL 更新；前提是已处于健康运行态、Agent 已注册、wrapper 与当前回执对应的子进程仍存活。更新期间保持运行状态，不呈现“正在启动代理”，等待当前部署回执但不重复探测未变监听。回执对应子进程 PID 变化时恢复启动状态与完整端口检查；缺少回执、持久失败或进程消失仍报告失败。后台健康轮询避开正在执行的热重载，周期性健康检查在更新完成后继续运行。
+
+沿用现有回执的证据范围：它只记录 Agent 操作及监听证据，不代表 sslocal 已确认应用新规则。上游在 ACL 读取或解析失败时保留旧规则并记录日志；信号发送成功不能排除这种情况。本次接受此限制，不增加上游应用确认协议或根据日志推断部署成功。链接切换、信号投递或监听检查等可检测的失败继续遵循 ADR-0037，停止服务、暂停系统代理并保留最新意图，不自动恢复旧部署。
+
+本决定部分替代 ADR-0010、ADR-0011、ADR-0038 中 ACL 变化要求重启的规定；稳定链接的 Agent 独占切换、不可变文件、代次与锁、子进程引用的保守保留及失败屏障继续适用。当前实现仍以代码为准。
+
+上游依据：[信号处理](https://github.com/qiuyuzhou/shadowsocks-rust/blob/v1.26.0/src/service/local.rs#L1078-L1165)、[ACL 重新加载及原子替换](https://github.com/qiuyuzhou/shadowsocks-rust/blob/v1.26.0/crates/shadowsocks-service/src/acl/mod.rs#L687-L738)。
+
+验证通过：1150 项 hostless 测试、19 项真实进程 smoke、Lint 与 Debug 构建。定向覆盖模式切换保持运行状态且不重复探测端口、回执缺失与子进程替换、连续模式切换、配置身份复用与旧监管资料保守重载、Agent 热重载前后实际 TCP 连接计数不增加、启动期间待发信号合并、组合服务器与 ACL 更新、规则增删与默认动作变化、模式切换时子进程 PID 保持不变且实际路由变化，以及上游 ACL 解析失败保留旧规则的回执边界。未执行原生界面与真实系统代理验收。
diff --git a/docs/adr/0049-agent-owned-runtime-failure-observation.md b/docs/adr/0049-agent-owned-runtime-failure-observation.md
new file mode 100644
index 000000000..37dd96579
--- /dev/null
+++ b/docs/adr/0049-agent-owned-runtime-failure-observation.md
@@ -0,0 +1,9 @@
+# 稳定运行期间由 Agent 独占故障判定
+
+系统代理的稳定期观察不再主动连接 SOCKS 或 HTTP 入站，也不再根据 PID 存活、运行回执缺失或身份不匹配独立判定运行故障。Agent 已负责 sslocal 子进程监管、自动重启与明确部署失败记录；GUI 重复连接入站会持续触发 sslocal 的 SOCKS5 EOF 日志，又可能把正常重启期间的回执空窗当成故障。本决定细化 ADR-0022 的运行故障观察与暂停边界，延续 ADR-0037 的明确失败屏障。
+
+GUI 运行期间，系统代理意图开启时，每 5 秒读取与当前部署匹配的明确失败记录。发现明确失败后，呈现运行失败并暂停系统代理，保留开启意图；清理失败仍须显式重试，不因轮询反复清理。没有失败记录只表示尚无明确失败结论，不构成健康证明；不增加连续失败计数、宽限窗口或额外的回执/PID 故障检查。后台自动重启期间保留系统代理设置，不因远端服务器或网络波动暂停系统代理。
+
+启动、重启及显式部署的就绪确认保留，仍可能产生少量 EOF 日志。明确失败后的显式重试或新部署，沿用现有成功收敛路径恢复系统代理；失败记录被删除本身不代表恢复，不触发周期性自动重应用。用户主动关闭代理服务时，仍直接清理系统代理并关闭其意图，然后停止后台服务，不等待轮询。观察循环继续刷新 helper 批准状态与操作入口，并继续处理待批准后尚未执行的首次应用。
+
+代价是 GUI 不再检测“进程仍存活但监听端口消失”，也不兜底推断 Agent 未能持久记录的故障。例如 Agent 异常退出或监管资料缺失/损坏不保证产生失败记录；Agent 异常退出的恢复交给现有 launchd 策略。5 秒是失败记录产生后的常规检查间隔，不是从子进程退出起算的严格暂停完成时限，GUI 退出后也不执行检查。拒绝协议或远端连通性探测来扩大健康含义，避免把请求路径的暂时波动升级为系统代理设置变更。
diff --git a/docs/adr/0050-age-encrypted-configuration-storage.md b/docs/adr/0050-age-encrypted-configuration-storage.md
new file mode 100644
index 000000000..bf329a289
--- /dev/null
+++ b/docs/adr/0050-age-encrypted-configuration-storage.md
@@ -0,0 +1,47 @@
+# 使用 age 标准格式保存敏感配置
+
+**状态**：已接受并实施（2026-10-21）；用户通过 implement 指令确认实施。验证结果见交付记录。
+
+敏感配置的加密存储采用标准 [age 文件格式](https://age-encryption.org/)，使用 [AgeSwift](https://github.com/qiuyuzhou/AgeSwift) 实现。目的是减少自研加密协议与文件容器的维护成本，让维护者能够使用标准 age 兼容命令行工具解密检查配置，并使配置文件长期独立于特定语言、实现与维护者。此选择的主要目标不是提高现有方案的密码学强度。
+
+该决定修订 [ADR-0035](0035-encrypt-persistent-server-library.md) 与 [ADR-0042](0042-encrypt-proxy-listening-configuration.md) 中涉及的加密方法和文件封装规定。当前行为仍以代码为准。
+
+## 已确认的范围与兼容边界
+
+服务器库和代理监听配置同时替换自研加密格式。运行配置与 LAN 认证文件不在本次范围内，其加密另案处理。
+
+延续 NG2 尚未发版、不迁移历史格式的决定。现有自研加密文件属于不支持的历史格式：保留原文件并阻止普通写入，不自动转换，不静默按新安装处理。沿用各自既有的用户明确确认重置流程；未确认重置不覆盖数据。此决定不授权在设计讨论期间重置本机配置或 Keychain 项。
+
+## 已确认的格式与密钥
+
+直接保存标准二进制 age 文件，不在 age 文件外增加自定义文件头。服务器库文件名改为 `catalog.age`，代理监听配置文件名改为 `proxy-listening.age`；配置结构版本放在加密后的 JSON 内。检测到旧 `.enc` 文件时，仍按不支持的历史格式处理，不因新路径不存在而创建空配置。
+
+两个存储分别生成独立的 X25519 identity，将标准 `AGE-SECRET-KEY-1...` 私钥文本保存在经典登录钥匙串中，继续限制获准应用访问。正常保存复用 identity，用户明确确认重置时生成新的 identity。
+
+按存储分别建立新的 age Keychain 命名空间，读取其中的 identity，由 AgeSwift 尝试匹配解密，不增加密钥索引文件。成功加载后缓存匹配的 identity，正常保存继续使用它。重置时先保存并回读新 identity，再原子替换密文，保留旧 identity；写盘失败或中途退出时，旧文件仍能用旧 identity 解密。密钥记录随重置次数增加，接受相应读取成本。
+
+保留既有加载失败后的用户确认重置入口，涵盖文件损坏、格式不支持和密钥不可用等情况，不收窄为仅 identity 丢失才能重置。加载失败不自动判定 identity 丢失，也不自动重置。
+
+## 标准工具与可读格式
+
+开发文档说明如何使用系统 Keychain 工具取得 identity，再使用标准 `age` CLI 解密；不新增应用内私钥导出界面。保留系统授权要求，私钥不进入日志或诊断报告。
+
+应用接受二进制与 ASCII armor 两种标准 age 文件，保存时统一写二进制。解密仍使用对应存储的 identity，解密后的 JSON 必须通过原有结构与内容校验。不增加口令加密、SSH 密钥或多接收方管理功能。
+
+## 沿用的行为与失败保护
+
+两个存储继续拥有独立的密钥与恢复生命周期：服务器库加载失败时保留原文件、阻止写入并提供重试或确认创建空库；监听配置加载失败时阻断正常工作区启动，用户确认重置成功后才解除阻断。失败或等待确认期间，保留既有后台代理和系统代理；成功保存后再按原有规则收敛运行状态。
+
+保留后台读取不触发 Keychain 授权弹窗、显式交互入口控制授权、成功读取后在当前进程缓存的规则。Keychain 某个候选 identity 不可读取时，不将其视为文件损坏或自动新建密钥；能否用其他可访问候选正常读取，应以实际解密结果为准。没有可用匹配 identity 时报告读取失败并保留文件。
+
+保留完整值校验、串行保存、仅写密文临时文件、同目录原子替换和保存成功后才发布内存值的契约。目录权限仍为 0700，文件为 0600。服务器库和监听配置的明文大小上限分别保持 64 MiB 和 1 MiB，读取前限制密文大小并考虑 age 分块与 armor 开销，解密后再次检查明文大小。AgeSwift 提供内存加解密 API，不承担文件提交、Keychain 或大小限制。
+
+不迁移、读取或清理旧 AES 密钥记录；不增加自动密钥清理、轮换、完整库加密备份或手动锁定功能。用户主动执行的旧版 ShadowsocksX-NG 导入与现有配置组导出、分享保持既有用途。
+
+## 实施与验收要求
+
+通过 Swift Package Manager 精确固定 AgeSwift 0.1.0；其 Swift API 底层使用 Rust age 与预编译 XCFramework。实际接入时核实发布产物、校验和及应用和测试目标的链接，不以本地同名仓库作为交付依赖。移除生产自研 AES 文件封装读写，更新相关格式文档及 ADR-0035、ADR-0042 的现行描述，历史研究报告保留原时点内容。
+
+验收覆盖两个存储的完整字段往返、重复保存密文不同、错误或缺失 identity、篡改与截断、大小限制、JSON 结构版本与内容校验，以及二进制和 armor 读取。使用标准 age CLI 与应用实现做双向互操作验证，不仅验证库内自行加解密。
+
+验证旧 `.enc` 和旧 JSON 的存在不会触发静默初始化；新 `.age` 存在时以新文件为准，不回退到旧文件。验证提交失败与重置中断保留旧文件和旧 identity 的可读性、两个存储恢复互不影响，以及启动恢复门禁。真机核实 Keychain ACL、后台非交互读取、显式授权和退出重启后的读取，并验证文档中的系统 Keychain 工具与 age CLI 操作；未执行的验证如实标为未验证。
diff --git a/docs/adr/0051-explicit-rule-preset-modeling.md b/docs/adr/0051-explicit-rule-preset-modeling.md
new file mode 100644
index 000000000..ba2d10127
--- /dev/null
+++ b/docs/adr/0051-explicit-rule-preset-modeling.md
@@ -0,0 +1,31 @@
+# 将隐式路由策略显式建模为规则预设
+
+**状态**：已接受，已实现（2026-10-24；默认项与展示顺序于 2026-10-25 调整）。
+
+[ADR-0055](0055-preset-owned-custom-rule-actions.md) 已接受、已实现：将产品术语统一为“规则方案”，取代下文“自定义规则保留自身行动”的约定，并规定现有方案自定义规则的迁移方式。
+
+## 决定
+
+规则、全局、直连仍是代理模式。规则模式内使用三种规则预设，展示顺序为“仅GFW列表内目标代理”“中国大陆目标直连”“中国大陆目标代理”。预设一起确定内置来源、命中行动和默认动作，替代原来的默认动作选择入口，不另设独立默认动作开关。新预设复用中国域名、`.cn` 和中国 IPv4 数据，将其用于代理，其余目标默认直连；固定本地目标仍直连，不维护视频专用集合，也不承诺平台内容可播放。
+
+每项预设独立拥有自定义规则集合和规则停用选择。自定义规则保留自身行动，沿用现有冲突机制，用于补充规则而不保证覆盖内置规则。预设内继续使用“匹配条件＋行动”的规则身份及跨来源停用语义，修改不影响其他预设。不增加共享自定义层或同一条目的多预设归属。
+
+规则预设是规则工作区的顶层范围。浏览只展示所选预设的来源及该预设下的行动；搜索、来源筛选、其他过滤和地址测试按预设独立。启停操作明确限定于本预设，并区分启用状态与遮蔽状态。
+
+代理规则页面仅负责管理。查看或编辑某项预设不切换实际路由，页面不显示预设使用状态，也不提供“使用此预设”操作；实际路由选择属于代理控制入口。保留现有来源侧栏及筛选方式，移除“全部规则”项，不增加“全部来源”汇总入口。
+
+页面顶部使用常驻分段选择控件展示三个规则预设，位于地址测试上方。地址测试下方保留来源侧栏与规则列表，搜索、行动及启用状态过滤作用于当前选中来源，来源资料继续在侧栏下方展示。各预设独立记住所选来源、搜索、过滤和测试状态，首次进入默认选中“自定义规则”。
+
+地址测试依据所选预设的完整规则和默认动作解释代理或直连结论，区分规则命中与未匹配时采用默认动作，并展示决定行动的规则。结果不受搜索、过滤、实际代理模式或运行状态影响，不要求该预设正在使用。测试输入和结果按预设独立保留；测试不解析 DNS、不测试连通性，域名测试明确说明未检查 DNS 解析后的 IP 规则。
+
+没有显式保存的预设或旧版默认动作偏好时，默认选第一项“仅GFW列表内目标代理”；显式保存的预设继续生效，旧版默认动作继续映射到等价预设。旧自定义规则和规则启用／禁用用户配置均不迁移，不按行动拆分，也不复制到新预设。新预设工作区不继承旧自定义条目或旧停用选择，按默认启用状态初始化；发版时明确说明这两项不兼容变化。
+
+## 取舍与替代
+
+原设计共享自定义规则，通过行动与默认动作的关系隐式区分用途，不能保证这些规则适用于回国场景。独立集合增加预设范围状态，但避免切换场景时人工重新启停规则。规则来源降为预设内部的筛选维度，避免将未参与该预设的来源或原始行动误认为当前策略。
+
+本决定取代 ADR-0023 中“规则停用不区分预设”和“离线测试完整来源集合、不读取规则策略”的范围约定；固定本地保护、规则身份、预设内跨来源停用和孤立停用身份保留原则不变。
+
+## 实现
+
+`RulePreset` 集中确定来源、有效行动和默认动作。`RulesWorkspaces` 为每个预设保留独立 `RulesWorkflow`，异步操作始终发布到所属工作区。运行控制器按实际预设选择 `RuleDocumentSession`，只为当前预设的保存安排运行收敛。新规则文件位于原规则目录下的 `rule-presets/<preset>/`；旧共享文件保留，不读入新集合。
diff --git a/docs/adr/0052-gui-scoped-subscription-automatic-updates.md b/docs/adr/0052-gui-scoped-subscription-automatic-updates.md
new file mode 100644
index 000000000..390086db0
--- /dev/null
+++ b/docs/adr/0052-gui-scoped-subscription-automatic-updates.md
@@ -0,0 +1,11 @@
+# 订阅自动更新由 GUI 应用运行期间执行
+
+订阅自动更新由 GUI 应用负责，仅保留菜单栏或静默启动时也执行；不交由生命周期独立的后台代理服务执行，也不为更新唤醒电脑。应用重新启动或电脑唤醒时，已到期订阅只补更新一次，以满足 GUI 存活边界并避免追赶多个错过周期。
+
+供应商可提供关闭、每天或每周的设置，并决定是否允许用户覆盖；禁止覆盖时供应商设置生效，允许覆盖时用户可显式覆盖或恢复跟随供应商。供应商未提供配置时默认关闭，默认间隔为每天；供应商要求开启时，首次成功获取该配置即可启用，无需用户再次开启。
+
+供应商策略与用户覆盖分别保存。供应商暂时禁止覆盖时保留用户选择，重新允许覆盖后恢复；成功响应缺失策略视为撤回，格式错误或更新失败则保留上次有效策略。修改订阅 URL 时清除旧供应商策略、保留用户选择，避免把旧地址的约束施加到新地址。
+
+在现有 `x_shadowsocksx_ng`、`schema_version: 1` 中增加可选 `auto_update` 对象；自动更新策略与分组树独立解析，避免一个扩展功能的错误破坏另一个功能。
+
+每天、每周分别表示本次更新结束后 24 小时、7 天，再加入基础间隔 0～10% 的随机延后。手动和自动更新无论成功或失败，都重新安排下一次，不额外短时重试；关闭时不产生自动计划。下次计划时间持久保存，重启不重新抽取抖动；最后更新时间仍仅表示最后成功更新。
diff --git a/docs/adr/0053-namespace-subscription-custom-fields.md b/docs/adr/0053-namespace-subscription-custom-fields.md
new file mode 100644
index 000000000..5fb32e536
--- /dev/null
+++ b/docs/adr/0053-namespace-subscription-custom-fields.md
@@ -0,0 +1,17 @@
+---
+status: accepted
+---
+
+# 订阅自定义字段统一使用项目扩展命名空间
+
+订阅协议的自定义字段集中于根对象的 `x_shadowsocksx_ng`，以明确项目扩展与 SIP008 标准字段的边界。已确认将 `expires_at` 与 `traffic_reset_at` 从根对象移入该对象，今后本项目新增的扩展字段也归入该命名空间；标准字段 `version`、`servers`、`bytes_used`、`bytes_remaining` 保持原位。
+
+NG2 尚未正式发布，选择直接统一输入格式，不保留根层时间字段的兼容读取。旧位置按未知字段忽略，即使新位置缺失或无效也不回读旧位置；仅提供旧位置的订阅仍可更新服务器，但不再提供这两个时间信息。
+
+沿用 `schema_version: 1`，两个时间字段直接置于 `x_shadowsocksx_ng` 下，不再增加资料子对象。该对象可以只包含版本与时间字段，无需提供分组树。今后本项目新增的自定义字段均放在根对象的这个命名空间内，不在根层或 `servers[]` 中另设项目扩展字段；未来字段的具体结构在引入对应功能时决定。
+
+时间字段仍使用现有 RFC 3339 格式并逐项解析。扩展对象缺失、不是对象、版本缺失或不支持时，不读取其中的时间字段。受支持版本内，分组树、自动更新策略与时间字段独立解析，一项功能内容错误不影响其他有效功能；标准流量字段也不受扩展错误影响。
+
+每次成功刷新以本次解析结果替换订阅资料，缺失或无效的时间字段清除对应旧值；网络、文档解析或保存失败时保留原资料。不采用自动更新策略的「无效时保留上次有效值」规则，避免时间资料继续呈现供应方本次未有效提供的旧事实。
+
+本地已保存的时间资料保留到下次成功刷新，不迁移持久化格式。配置组导出继续只包含标准服务器列表与分组扩展，不携带订阅时间、流量或供应商自动更新策略；文件导入仍只创建独立手动子树。
diff --git a/docs/adr/0054-bundle-offline-dependency-metadata.md b/docs/adr/0054-bundle-offline-dependency-metadata.md
new file mode 100644
index 000000000..35339ced0
--- /dev/null
+++ b/docs/adr/0054-bundle-offline-dependency-metadata.md
@@ -0,0 +1,13 @@
+# 随应用提供离线依赖元信息
+
+随应用分发的第三方可执行程序、链接库与规则数据，其项目 URL、版本和完整 License 文本随当前应用版本固定打包；仅用于开发、测试或构建的工具不在收录范围。展示这些资料不联网获取，也不运行依赖程序探测版本，以保证离线可用且资料对应当前安装包；用户显式点击项目 URL 时打开浏览器。
+
+插件设置与后续的开源项目及 License 查看入口复用随包资料。关于窗口的查看功能另案实现；托管插件的元信息只描述随应用发布的程序，不用于声明用户自备同名程序的版本或来源。
+
+插件设置保留现有版本与可点击项目 URL 的展示形式，改为读取统一的随包元信息。版本标识采用实际分发的 tag、commit 或上游发布标识；使用 fork 时，同时保留原项目 URL 与实际源码及发布来源，避免把 fork 产物描述为上游原版。
+
+只有直接依赖建立 URL、版本与 License 的结构化条目。传递依赖不逐个建立条目，优先原样附带上游对应版本的 `THIRD-PARTY-NOTICES` 等聚合声明；上游未提供时，针对实际分发产物补齐必要声明，优先在上游构建流程中生成，避免手工维护完整依赖树。后续关于窗口按直接依赖展示，其附带声明作为整份文本查看；收录二进制时仍需核查声明覆盖范围，不能仅依据顶层项目的 License 判断。
+
+每项事实只保留一个人工维护的权威来源。沿用现有依赖 manifest、SPM 固定版本等来源，补充项目 URL 与声明文件引用，自动生成统一随包清单；依赖获取或解析与元信息生成使用同一权威来源，不能另设一份手工版本表再以比较校验代替唯一事实来源。随包清单与生成代码属于派生产物，不独立编辑；插件设置与后续关于窗口从同一随包清单读取展示资料，Swift 不再重复硬编码版本与项目 URL。
+
+声明文本在依赖引入或升级时获取并固定保存，正常构建不联网下载。必填资料或声明文件缺失、引用无效、生成结果与权威来源不一致时，构建校验失败；引入或升级依赖时另行核查声明对实际分发产物的覆盖范围，文件存在检查不能替代这项核查。运行时清单意外读取失败时，插件设置显示“版本信息不可用”，不猜测版本、不阻断代理功能；可执行程序选择与可用性继续遵循既有插件目录规则。
diff --git a/docs/adr/0055-preset-owned-custom-rule-actions.md b/docs/adr/0055-preset-owned-custom-rule-actions.md
new file mode 100644
index 000000000..eae0d4353
--- /dev/null
+++ b/docs/adr/0055-preset-owned-custom-rule-actions.md
@@ -0,0 +1,27 @@
+# 规则方案统一决定自定义规则行动
+
+**状态**：已接受，已实现（2026-10-30）。
+
+## 决定与原因
+
+产品术语统一为“规则方案”，替代“规则预设”。每项方案固定定义匹配后行动与未匹配行动；内置规则和自定义规则的匹配后行动由所属方案统一决定。固定本地目标仍始终直连，不受方案行动影响。
+
+| 规则方案 | 匹配后行动 | 未匹配行动 |
+| --- | --- | --- |
+| 仅GFW列表内目标代理 | 代理 | 直连 |
+| 中国大陆目标直连 | 直连 | 代理 |
+| 中国大陆目标代理 | 代理 | 直连 |
+
+新增和编辑自定义规则只允许编辑匹配类型与匹配内容，行动以只读说明呈现。预览、保存、加载、离线测试和运行配置生成均遵守所属方案的行动约束，不能仅通过隐藏表单控件实现。各方案仍独立拥有自定义规则集合，查看或编辑方案不切换实际路由。
+
+这一约束有意收紧上游 ACL 能力，降低用户理解成本。项目固定使用的 [sslocal v1.26.0](https://github.com/qiuyuzhou/shadowsocks-rust/blob/v1.26.0/crates/shadowsocks-service/src/acl/mod.rs) 对 IP 字面地址先检查直连列表，再检查代理列表，最后采用模式默认行动；未命中域名规则而检查 DNS 解析结果时，则按模式选择一个方向的 IP 列表。允许每条自定义规则独立选择行动，会把这些差异带入用户模型。产品选择统一的方案语义，不要求用户理解这些差异。
+
+## 迁移与兼容边界
+
+迁移现有各方案的自定义规则集合：移除行动与该方案未匹配行动相同的自定义规则，保留行动与匹配后行动一致的条目及其 UUID、匹配条件和相对顺序。被移除条目不翻转行动，也不迁往其他方案。schema 1–3 文档在读取时迁移，不重写原文件，下次正常原子保存写入 schema 4；schema 4 文档中的反向行动视为无效并拒载。旧客户端拒绝 schema 4，避免降级后重新写入反向行动。
+
+该迁移不承诺保持所有旧流量行为。例如“中国大陆目标代理”方案中，自定义直连 IP 规则可以优先于覆盖该 IP 的内置代理规则；移除后，直接访问该 IP 可能从直连变为代理。接受旧反向例外失效，以换取规则方案对 IP 与域名一致的用户语义。发布说明应说明移除规则及可能的路由变化。
+
+规则身份仍按匹配条件与行动共同确定。规则停用仍作用于方案内跨来源的规则身份；沿用现有孤立停用记录保留原则，删除自定义条目不隐式清除其停用记录，也不改变其他身份的启用状态。固定本地保护及损坏文件不覆盖原则保持有效。
+
+本决定取代 [ADR-0051](0051-explicit-rule-preset-modeling.md) 中“自定义规则保留自身行动”的约定，以及旧自定义文档直接保留反向行动的加载行为；其他方案归属、规则身份和停用语义保持有效。
diff --git a/docs/agents/domain.md b/docs/agents/domain.md
new file mode 100644
index 000000000..4032de016
--- /dev/null
+++ b/docs/agents/domain.md
@@ -0,0 +1,51 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+
+## Before exploring, read these
+
+- **`GLOSSARY.md`** at the repo root, or
+- **`GLOSSARY-MAP.md`** at the repo root if it exists: it points at one `GLOSSARY.md` per context. Read each one relevant to the topic.
+- **`docs/adr/`**: read ADRs that touch the area you're about to work in. In multi-context repos, also check `src/<context>/docs/adr/` for context-scoped decisions.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The `/domain-modeling` skill (reached via `/grill-with-docs` and `/improve-codebase-architecture`) creates them lazily when terms or decisions actually get resolved.
+
+## File structure
+
+Single-context repo (most repos):
+
+```
+/
+├── GLOSSARY.md
+├── docs/adr/
+│   ├── 0001-event-sourced-orders.md
+│   └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+Multi-context repo (presence of `GLOSSARY-MAP.md` at the root):
+
+```
+/
+├── GLOSSARY-MAP.md
+├── docs/adr/                          ← system-wide decisions
+└── src/
+    ├── ordering/
+    │   ├── GLOSSARY.md
+    │   └── docs/adr/                  ← context-specific decisions
+    └── billing/
+        ├── GLOSSARY.md
+        └── docs/adr/
+```
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `GLOSSARY.md`. Don't drift to synonyms the glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal: either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/domain-modeling`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders), but worth reopening because…_
diff --git a/docs/agents/triage-labels.md b/docs/agents/triage-labels.md
new file mode 100644
index 000000000..b716855d4
--- /dev/null
+++ b/docs/agents/triage-labels.md
@@ -0,0 +1,15 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
+
+Edit the right-hand column to match whatever vocabulary you actually use.
diff --git a/docs/configuration.md b/docs/configuration.md
new file mode 100644
index 000000000..e2036817f
--- /dev/null
+++ b/docs/configuration.md
@@ -0,0 +1,59 @@
+# Subscriptions, Plugins, and Listener Configuration
+
+[Project home](../ShadowsocksX-NG2/README.md) | [简体中文](configuration.zh.md)
+
+## Subscription information
+
+See the [SIP-008 subscription extension guide](subscription-provider-extension.md) for field formats, the nested-group extension, and response requirements for subscription providers.
+
+A SIP-008 JSON root may contain `bytes_used` and `bytes_remaining` (non-negative integers up to UInt64), with the custom fields `expires_at` (service expiration time) and `traffic_reset_at` (traffic reset time) inside the root-level `x_shadowsocksx_ng` object with `schema_version: 1`. Root-level date fields are ignored. A missing or invalid namespace, or a missing or unsupported version, provides no date information; standard traffic fields remain independently available. Date values use RFC 3339 strings; an omitted field or `null` means no value was provided. An invalid item is ignored without affecting valid server or group information.
+
+A successful refresh replaces all allowlisted subscription information. Omitted or invalid fields clear their previous values; a failure or cancellation preserves the last successful information and its separate success timestamp. Information and the catalog record are saved atomically in the same document. The app does not separately save the raw response or a plaintext snapshot of server data containing passwords. Passwords and plugin parameters continue to use Keychain storage. If an older catalog file has no success timestamp, the app does not infer one.
+
+Subscription cards show valid information returned by the provider. A usage progress indicator appears only when both traffic values are valid and the total is greater than zero. Dates use the user's current language and time zone. Expiration and reset information do not change proxy start, stop, or activation behavior.
+
+## User plugin catalog
+
+`PluginCatalog` combines the current managed manifest with user records from the local `plugins.json`; names are case-sensitive. A user mapping takes precedence. If an override is invalid, the app does not fall back to the managed program; deleting the override restores the app's current default. A file-read error remains a blocking fact and is not treated as an empty mapping. User paths, local launch arguments, and plugin transport modes are not included in server information, subscriptions, or share files. User paths are also excluded from diagnostic reports.
+
+The **Plugins** section at the bottom of Settings shows built-in and user plugins together. It displays all names for each record and supports adding records, editing their name sets and paths, overriding built-ins by name, deleting records, and restoring a same-named built-in. User and built-in records can use the `tcp_only` or `tcp_and_udp` plugin transport mode. The default is `tcp_only`; generated sslocal configuration omits `plugin_mode` in that case. The app does not probe whether a plugin supports SIP003u.
+
+In the built-in editor, **Clear parameters** clears only the draft launch arguments and preserves the transport mode; the change takes effect when saved. Names and launch arguments are edited as lists. Launch arguments preserve their order and complete strings. Paths can be entered manually or selected from a file chooser. When reading fails, the UI hides the entries and offers a read-only retry; plugin management has no global reset. At the composition root, mapping commits and the explicit repair interface are wired into the form, activation, and diagnostics. After a successful save, the app refreshes activation candidates and converges asynchronously; a runtime failure does not undo the save. The app does not monitor files for replacement. Each `plugins.json` v1 entry migrates independently into a user record with persistent identity; the next save writes v2, with no merging by path. The existing built-in program is available as both `v2ray-plugin` and `v2ray-plugin-v1`. See [ADR-0033](adr/0033-plugin-records-own-aliases-and-local-arguments.md).
+
+`MacOSPluginInspection` reads only download-quarantine, signature, and system-assessment facts. It does not launch user plugins or change system policy. A failed or inapplicable check is unknown; a policy assessment that denies execution does not prove that execution is actually prohibited and does not block saving a mapping or activating it. Hostless test doubles do not prove that macOS will block a plugin in practice.
+
+## Managed Cloak plugin
+
+The app includes the official darwin-arm64 `ck-client` from [Cloak v2.12.0](https://github.com/cbeuw/Cloak/releases/tag/v2.12.0). Servers refer to it by the name `cloak` or `cloak-v2`; both names share one built-in record. `ck-client` is the packaged filename, not a reference name. A same-named user plugin still takes precedence, and an invalid override does not fall back automatically to the built-in program.
+
+Server plugin options are passed upstream unchanged; the app does not validate Cloak option semantics. Options may be semicolon-separated `Key=value` arguments or an absolute path to an external JSON configuration file. The user maintains an external file; the app does not copy it or manage its credentials or lifecycle. Shared paths do not include file contents, so recipients must provide the corresponding file themselves. Local launch arguments are stored separately and are not shared with server information.
+
+The [configuration parser at the pinned version](https://github.com/cbeuw/Cloak/blob/v2.12.0/internal/client/state.go) has these limitations: a string is recognized as an argument list only if it contains both `;` and `=`, so a single `Key=value` is treated as a file path; escaped semicolons are still split; quotes and backslashes cannot be reliably passed using generic SIP003 escaping; and an empty segment stops further parsing. For complex values, maintain a JSON file yourself. Provide `UID`, `PublicKey`, `ServerName`, and `EncryptionMethod`; set `NumConn=4` explicitly if needed. Do not rely on the README's stated default of 4: the pinned implementation disables connection reuse when this value is omitted. Explicit endpoint fields override SIP003 environment variables, so usually omit `LocalHost`, `LocalPort`, `RemoteHost`, and `RemotePort`.
+
+The default plugin transport mode is `tcp_only`. Upstream `UDP=true` switches to a UDP listener; it does not indicate SIP003u support for carrying TCP and UDP at the same time. The app still lets users set the existing transport mode; this integration is verified for TCP configuration only. Cloak's GPL-3.0 license, source, and third-party notices are bundled at `Contents/Resources/ThirdParty/Cloak/`; see the NOTICE there for source and build entry points.
+
+## Local and LAN listeners
+
+While the background proxy client is running, local SOCKS and HTTP always listen on `127.0.0.1`, using ports `11086` and `11087` by default. Local SOCKS always enables UDP relay. The LAN entry point is disabled by default and uses separate ports `11088` and `11089`. It supports IPv4, dual-stack, and IPv6-only modes. All four ports must be in `1025...65535` and must be distinct.
+
+UDP relay for LAN SOCKS and authentication shared by SOCKS/HTTP have independent settings. The username and password are stored together in the encrypted listener configuration; Keychain stores only the listener-specific master key. At runtime, the app derives an authentication file specific to the current user. Passwords in upstream authentication-failure logs are redacted. Settings check TCP port use only and do not configure a separate UDP port. The home-page command uses a local or LAN port according to the selected address. When LAN authentication is enabled, it includes encoded credentials; the tooltip shows the full command.
+
+Listener settings use the standard age file format and a separate X25519 identity. They are encrypted in `proxy-listening.age` and contain only local and LAN listener values. Proxy mode, the default rule action, proxy-service enablement, system-proxy enablement, and additional system-proxy exceptions are stored separately in UserDefaults under keys prefixed with `proxyControl.`. An in-memory snapshot of runtime calculations is not a unified persistent document. Listener settings are still jointly validated and saved atomically; UserDefaults preferences do not report or roll back a failed synchronized disk write.
+
+The app does not migrate the old `settings.json`. Missing values in the new listener file and added preferences use defaults, so existing development configuration must be set again. The old file is not read or deleted, and legacy Keychain entries are not accessed or cleaned up. Existing independent preferences such as language, silent launch, and test URL, as well as server information, remain unchanged. A listener-read failure blocks normal startup, including silent launch, and shows an explanatory alert with only the **Reset listener configuration** action. After the user confirms, the app creates a new listener master key and atomically saves default settings, with LAN listening disabled. Until reset succeeds, the old file and any existing background proxy or system proxy are preserved. After success, the app converges using the defaults and the original enablement intent. The app does not migrate old `proxy-listening.enc` or `proxy-listening.json` files and does not read or clean up old per-item Keychain credentials; if an old file is found, the user is likewise asked to confirm a reset. See [ADR-0034](adr/0034-separate-local-and-lan-listeners.md), [ADR-0040](adr/0040-keep-settings-recovery-simple.md), [ADR-0041](adr/0041-separate-preferences-from-proxy-listening-configuration.md), [ADR-0042](adr/0042-encrypt-proxy-listening-configuration.md), and [ADR-0050](adr/0050-age-encrypted-configuration-storage.md).
+
+## Application Support directory
+
+The root directory is `~/Library/Application Support/ShadowsocksX-NG2/`, organized by lifecycle:
+
+| Subdirectory | Files and purpose |
+| --- | --- |
+| `configuration/` | `catalog.age`, `proxy-listening.age`, `activation.json`, `custom-rules.json`, and `plugins.json`: persistent information managed by the GUI |
+| `runtime/` | Supervision data, runtime receipts, failure records, PID, stable links, and generation-named configuration, GUI-private intent summaries, authentication, and ACL files |
+| `logs/` | `agent.log`, retained after the background proxy stops |
+
+`runtime-generation`, `runtime.lock`, and `agent.lock` are in `runtime/` and remain after service shutdown. Do not implement stopping the service by deleting the whole runtime directory. Directory permissions are `0700`; regular-file permissions are `0600`. Runtime configuration and authentication files may still contain plaintext secrets. UserDefaults, Keychain, LaunchAgent plists, and bundled rules and plugins keep their respective locations.
+
+This layout change does not provide automatic migration. Files under the old root are not read, moved, or deleted, including the initial `silent-launch.json`; saved UserDefaults preferences are unchanged. Before switching a development environment, quit the GUI and stop the old Agent and sslocal. After confirming that the processes have exited, move the five GUI files listed above to `configuration/` unchanged if you need to keep them; do not move runtime artifacts. Current age files can reuse the Keychain identity stored under the service for the same user. Historical custom `.enc` files are not migrated and cannot be reused by only changing their extension. Do not assume that copying ciphertext to another machine will make it decryptable. Set directory permissions to `0700` and file permissions to `0600`, then launch the new build so it can derive runtime artifacts at the new paths. If the files are not moved, the new directory initializes on first use and does not read anything from the old root. The rejection rules for old formats inside the new directory still apply.
+
+Path rules are centralized in `ApplicationSupportPaths` and `RuntimePaths`. In Agent tests, `SSXNG_CONTRACT_PATH` takes precedence over `SSXNG_RUNTIME_DIR`, and all paths for one deployment are derived from the directory containing that contract. If only the runtime directory is set, the standard configuration-link name is used. `SSXNG_LOG_PATH` can independently select the log location. If a test contract or runtime directory is set without a log path, logs remain in the overridden runtime directory so tests do not write to production logs.
diff --git a/docs/configuration.zh.md b/docs/configuration.zh.md
new file mode 100644
index 000000000..6c0a54ba0
--- /dev/null
+++ b/docs/configuration.zh.md
@@ -0,0 +1,57 @@
+# 订阅、插件与监听配置
+
+[English](configuration.md) | [返回工程首页](../ShadowsocksX-NG2/README.zh.md)
+
+## 订阅资料
+
+面向订阅服务提供方的字段格式、嵌套分组扩展和响应要求见 [SIP-008 订阅扩展说明](subscription-provider-extension.zh.md)。
+
+订阅可在 SIP-008 JSON 根级提供 `bytes_used`、`bytes_remaining`（非负整数，最大为 UInt64），并在根层 `x_shadowsocksx_ng` 对象中以 `schema_version: 1` 提供自定义的 `expires_at`（服务到期时间）、`traffic_reset_at`（流量重置时间）。根层时间字段不再读取。命名空间缺失或无效、版本缺失或不支持时，视为未提供时间资料；标准流量字段仍独立可用。日期值使用 RFC 3339 字符串，省略或 `null` 表示未提供；无效资料仅忽略该项，不影响有效服务器或分组资料。
+
+成功刷新完整替换白名单订阅资料，省略或无效的字段清除旧值；失败或取消保留最后成功资料与独立成功时间。资料和目录记录同文档原子保存，不另存原始响应或含密码的服务器明文快照；密码和插件参数沿用 Keychain 存储。旧目录文件缺少成功时间时不猜测。
+
+订阅卡片显示返回的有效资料；仅在两项流量都有效且总量大于零时显示消耗进度。日期按用户当前语言与时区显示，到期和重置资料不改变代理启停或激活行为。
+
+## 用户插件目录
+
+`PluginCatalog` 合成当前托管清单与本机 `plugins.json` 用户记录，名称精确区分大小写。用户映射优先，失效 override 不退回托管程序；删除 override 恢复当前 app 默认值。文件读取错误保留阻断事实，不按空映射处理。用户路径、本地启动参数与插件传输模式不进入服务器资料、订阅或分享文件。用户路径也不进入诊断报告。
+
+设置页底部的“插件”区域统一展示内置与用户插件，按记录展示全部名称，支持新增、编辑名称集合与路径、逐名称覆盖内置、删除记录与恢复同名内置。用户与内置记录可以设置插件传输模式 `tcp_only` 或 `tcp_and_udp`；默认 `tcp_only`，生成 sslocal 配置时省略 `plugin_mode`。应用不探测插件的 SIP003u 支持。内置编辑器中的“清空参数”只清空草稿启动参数并保留模式，保存后生效。名称与启动参数使用列表编辑，启动参数保留顺序和完整字符串；路径支持手动输入与文件选择。读取失败时隐藏条目并提供只读重试，管理 UI 不提供整体重置。映射提交与显式修复 interface 在组合根统一接入表单、激活与诊断。保存成功后刷新激活候选并异步收敛，运行失败不撤销保存。没有文件替换监控。`plugins.json` v1 每项独立迁移为带持久身份的用户记录，下一次保存写入 v2，不按相同路径合并。现有内置程序同时提供 `v2ray-plugin` 和 `v2ray-plugin-v1`。详见 [ADR-0033](adr/0033-plugin-records-own-aliases-and-local-arguments.md)。
+
+`MacOSPluginInspection` 只读取下载隔离、签名与系统评估事实，不启动用户插件、不修改系统策略。检查失败或不适用为未知；策略评估拒绝不等于实际执行禁令，也不阻止映射保存或激活。真实 macOS 拦截提示不由 hostless 替身测试证明。
+
+## Cloak 托管插件
+
+随应用提供官方 [Cloak v2.12.0](https://github.com/cbeuw/Cloak/releases/tag/v2.12.0) 的 darwin-arm64 `ck-client`，服务器引用名称为 `cloak` 或 `cloak-v2`，两者共享一条内置记录。`ck-client` 是打包文件名，不是可引用名称。同名用户插件仍优先；失效覆盖不会自动回退到内置程序。
+
+服务器插件选项原样传给上游，不进行 Cloak 字段语义校验。可以使用分号分隔的 `Key=value` 参数，或使用外部 JSON 配置文件的绝对路径。外部文件由用户维护，应用不复制文件、不管理文件凭据或生命周期；分享路径不包含文件内容，接收方需要自行提供对应文件。本地启动参数仍独立保存，不随服务器资料分享。
+
+[固定版本配置解析](https://github.com/cbeuw/Cloak/blob/v2.12.0/internal/client/state.go)存在以下限制：只有同时含 `;` 和 `=` 的字符串才被识别为参数列表，单个 `Key=value` 会被当作文件路径；转义分号仍会被切分，引号和反斜杠也不能按通用 SIP003 转义方式可靠传递；空段会终止后续解析。需要复杂值时可自行维护 JSON 文件。提供 `UID`、`PublicKey`、`ServerName`、`EncryptionMethod`，并按需显式设置 `NumConn=4`，不能依赖 README 所述的默认 4；省略时固定版本实现关闭连接复用。显式端点字段会覆盖 SIP003 环境变量，因此通常应省略 `LocalHost`、`LocalPort`、`RemoteHost`、`RemotePort`。
+
+默认插件传输模式为 `tcp_only`。上游 `UDP=true` 切换为 UDP 监听，不代表同时承载 TCP 与 UDP 的 SIP003u 支持；应用仍允许用户设置现有传输模式，本次只验收 TCP 配置接入。托管程序的 GPL-3.0 许可证、来源与第三方声明随应用装入 `Contents/Resources/ThirdParty/Cloak/`，源码与构建入口见其中 NOTICE。
+
+## 本地与局域网监听
+
+后台代理客户端运行时，本地 SOCKS/HTTP 始终监听 `127.0.0.1`，默认端口为 `11086`/`11087`；本地 SOCKS 固定开启 UDP 中继。局域网入口默认关闭，使用独立端口 `11088`/`11089`，支持 IPv4、双栈和仅 IPv6 三种方式。四端口必须在 `1025...65535` 内且全部不同。
+
+局域网 SOCKS 的 UDP 中继和 SOCKS/HTTP 共用的身份验证独立设置。用户名与密码随监听配置整体加密保存，Keychain 仅保存监听专用主密钥；运行时派生当前用户专用的认证文件；上游认证失败日志中的密码会隐藏。设置只检查 TCP 占用，不设置独立 UDP 端口。首页命令按选择地址使用本地或局域网端口，局域网身份验证开启时加入编码后的凭据；tooltip 显示完整命令。
+
+监听配置使用标准 age 文件格式与独立 X25519 identity，单独加密保存在 `proxy-listening.age`，只包含本地与局域网监听相关值。代理模式、规则默认动作、代理服务开关、系统代理开关和附加系统代理例外以 `proxyControl.` 前缀的独立键保存在 UserDefaults；运行计算的内存快照不代表统一持久化文档。监听仍采用联合校验与原子文件保存；UserDefaults 偏好不提供同步落盘失败的报错与回滚。
+
+不迁移旧 `settings.json`：新监听文件与新增偏好缺值时使用默认值，需要重新设置现有开发配置；旧文件不读取、不删除，遗留 Keychain 条目不访问、不清理。已有语言、静默启动、测试 URL 等独立偏好及服务器资料保持原状。监听读取失败会阻断正常启动，包括静默启动，并显示只含“重置监听配置”的说明性 alert。用户确认后创建新监听主密钥并原子保存默认配置，默认关闭局域网监听。重置成功前保留原文件及已有后台代理和系统代理；成功后按默认配置与原有开关意图收敛。不迁移旧 `proxy-listening.enc` 或 `proxy-listening.json`，不读取或清理旧逐项 Keychain 凭据；发现旧文件时同样提示确认重置。设计见 [ADR-0034](adr/0034-separate-local-and-lan-listeners.md)、[ADR-0040](adr/0040-keep-settings-recovery-simple.md)、[ADR-0041](adr/0041-separate-preferences-from-proxy-listening-configuration.md)、[ADR-0042](adr/0042-encrypt-proxy-listening-configuration.md) 和 [ADR-0050](adr/0050-age-encrypted-configuration-storage.md)。
+
+## 应用支持目录
+
+文件根目录为 `~/Library/Application Support/ShadowsocksX-NG2/`，按生命周期分类：
+
+| 子目录 | 文件与用途 |
+| --- | --- |
+| `configuration/` | `catalog.age`、`proxy-listening.age`、`activation.json`、`custom-rules.json`、`plugins.json`，由 GUI 管理的持久资料 |
+| `runtime/` | 监管资料、运行回执、失败记录、PID、稳定链接，以及代次命名的配置、GUI 私有意图摘要、认证与 ACL 文件 |
+| `logs/` | `agent.log`，停止后台代理后保留 |
+
+`runtime-generation`、`runtime.lock`、`agent.lock` 位于 `runtime/`，停止服务仍保留。不能把停止操作实现为删除整个运行目录。目录权限为 `0700`，普通文件权限为 `0600`；运行配置和认证文件仍可能包含明文秘密。UserDefaults、Keychain、LaunchAgent plist 及 bundle 内规则与插件继续使用各自的位置。
+
+此次布局调整不提供自动迁移。旧根目录文件不读取、不移动、不删除，包括初版 `silent-launch.json`；已保存的 UserDefaults 偏好不变。开发环境切换前，退出 GUI 并停止旧 Agent 与 sslocal，确认进程退出后，将需要保留的上述五份 GUI 文件原样搬到 `configuration/`，不要搬移运行产物。当前 age 文件可沿用同一用户对应 service 中的 Keychain identity；历史自研 `.enc` 文件不迁移，不能只改扩展名继续使用。不应只复制密文到另一台机器并假定能够解密。设置目录权限为 `0700`、文件权限为 `0600`，再启动新构建，由新路径重新派生运行产物。未搬移配置时，新目录按首次使用初始化；不会从旧根目录补读。新目录内旧格式文件的拒绝规则仍保留。
+
+路径规则集中在 `ApplicationSupportPaths` 与 `RuntimePaths`。Agent 的测试覆盖中，`SSXNG_CONTRACT_PATH` 优先于 `SSXNG_RUNTIME_DIR`，同一部署全部路径由该契约所在目录派生；仅设置运行目录时使用标准配置链接名。`SSXNG_LOG_PATH` 可独立指定日志位置。指定测试契约或运行目录且未指定日志时，日志留在被覆盖的运行目录，避免测试写入生产日志。
diff --git a/docs/design/app-language-selection.md b/docs/design/app-language-selection.md
new file mode 100644
index 000000000..24ed8080d
--- /dev/null
+++ b/docs/design/app-language-selection.md
@@ -0,0 +1,40 @@
+# 应用语言选择
+
+## 范围
+
+在设置的「常规」末尾新增语言下拉框，提供自动检测、简体中文、英文。
+默认自动检测。保存后下次启动生效，不自动退出或重启应用。
+本文件记录本次需求与实现取舍，不作为项目当前状态的持续维护文档。
+
+## 展示
+
+- 收起时显示所选项的单个名称：自动检测使用当前界面语言，语言项使用自称。
+- 展开时显示「自称 · 当前界面语言名称」。重复名称保留。
+- 自动检测的固定前缀为 `Auto Detect`。
+- 顺序为自动检测、简体中文、英文。
+- 行标题为「语言」/ `Language`，说明为「下次启动生效」/ `Takes effect next launch`。
+
+| 选项 | 中文界面 | 英文界面 |
+| --- | --- | --- |
+| 自动检测 | Auto Detect · 自动检测 | Auto Detect · Auto Detect |
+| 简体中文 | 简体中文 · 简体中文 | 简体中文 · Simplified Chinese |
+| 英文 | English · 英文 | English · English |
+
+## 偏好与生效
+
+语言选择只影响本应用。显式选择写入应用级 `AppleLanguages`，自动检测移除该覆盖。
+自动检测沿用 macOS 对应用支持语言的匹配；开发语言为简体中文。
+不改全局语言、地区格式、代理设置或代理运行状态。
+应用现有 SwiftUI 与 Foundation 本地化在下次启动读取同一应用偏好。
+本次不迁移既有未本地化文案。
+
+## Module 与测试 seam
+
+`AppLanguagePreferences` 的 Interface 提供当前选择与保存选择。
+该 Module 隐藏应用偏好域的读取及语言覆盖的写入。
+`AppLanguage` 提供收起名称与双语菜单名称。
+使用系统原生 Picker，独立提供当前值标签。
+
+测试通过上述 Interface 检查缺失偏好、持久化往返、清除覆盖与双语名称。
+测试使用进程私有 UserDefaults 域。
+启动解析另外通过隔离的小型应用 bundle 验证，覆盖自动检测与显式覆盖。
diff --git a/docs/design/configuration-group-share-popover.md b/docs/design/configuration-group-share-popover.md
new file mode 100644
index 000000000..e6984c5f2
--- /dev/null
+++ b/docs/design/configuration-group-share-popover.md
@@ -0,0 +1,22 @@
+# 配置组分享 popover（2026-10-05）
+
+本文件记录本轮用户确认的需求和规格；当前实现以代码为准。
+
+## 已确认规格
+
+- 选中配置组时使用服务器分区工具栏「分享」，在按钮旁显示原生 popover。风格与服务器分享一致；点击外部或按 Esc 关闭，切换选中项立即关闭。
+- 顶部为组名（单行尾部截断）、全部后代服务器数量，之后是分隔线与三个左对齐操作行，带 SF Symbol 和圆角悬停底色。
+- 操作依次为「保存 SIP008 JSON 文件」（square.and.arrow.down）、「保存 URI 链接列表文本文件」（doc.text）、「拷贝 URI 链接列表文本」（doc.on.doc）。拷贝成功显示约 2 秒「已复制」。
+- 手动组和订阅组均支持；包含选中组全部嵌套子组的服务器，按深度优先、同级目录顺序排列，排除祖先与兄弟。计数包含不具备激活资格的服务器，空子树禁用分享。
+- JSON 延续 SIP-008 v1 及项目分组扩展；URI 列表每行一个 ss:// URI，保留服务器名称、密码和插件参数，不保留组结构。文本文件为 UTF-8，建议名为 <组名>.txt。
+- 任一服务器不能完整生成分享资料时整个准备失败，不跳过、不输出部分列表。用户点击操作时沿用既有失败提示；准备失败不打开保存面板、不写剪贴板。
+- 分享资料和两种格式在打开时从同一已保存快照生成并冻结。无额外秘密确认弹窗。文件名中的 / 与 : 替换为空格，空名回退 ss-servers。
+- 保留已有组右键菜单「导出为 SIP-008 JSON…」。
+
+## Module 与 Interface
+
+CatalogWorkflow.configurationGroupShareDraft(for:) 是调用方与测试使用的 interface，内部复用既有完整 SIP-008 校验和遍历，返回 JSON 草稿、URI 文本及文件草稿。Popover 不拥有遍历、凭据解析或序列化规则。
+
+ConfigurationGroupFileExporter seam 继续承载保存面板与原子写入，草稿格式区分 JSON 和纯文本；生产及内存 adapter 均复用。TextClipboard seam 承载完整列表拷贝。无需引入通用分享框架。
+
+GLOSSARY 增补配置组分享定义。既有 ADR-0018 的 SIP-008 导出合同保持适用；新增格式与呈现可逆，不新增 ADR。
diff --git a/docs/design/home-target-card.md b/docs/design/home-target-card.md
new file mode 100644
index 000000000..a87d72f28
--- /dev/null
+++ b/docs/design/home-target-card.md
@@ -0,0 +1,53 @@
+# 首页活动目标卡片
+
+本文件记录 2026-10-14 确认的需求。当前实现以代码为准。
+
+## 呈现与交互
+
+- 卡片位于首页左栏、代理模式卡片上方。
+- 头部显示活动目标名称、完整目录路径和「定位当前」。
+- 工具栏提供「全部／收藏」和「测试全部」。
+- 全部视图保留目录层级。收藏按已有顺序平铺，组不展开。
+- 目录区最高 360 点，超出后内部滚动。底部操作区独立于内部滚动区。
+- 行只显示名称，不额外显示连接地址或端口。悬停显示完整路径。
+- 单击只选择。分组箭头只展开或收起。双击不激活。
+- 浏览选择使用系统语义选中色。活动目标使用闪电标记，活动组只标记自身。
+- 底部显示所选名称与路径。组显示可激活配置数和已知无效配置的跳过数。
+- 没有选择、当前项已激活、本地激活条件不满足时，禁用激活并说明原因。
+- 测试结果不参与激活资格判断。
+- 激活期间显示「激活中…」，冻结当前卡片，页面导航保留，已有测试继续。
+- 沿用现有激活语义，活动标记跟随活动目标。部署成功不作为标记更新条件。
+- 不新增激活错误提示，沿用首页其他卡片的现有提示。
+- 首页只提供查看、测试和激活，不增加管理、搜索和目录行键盘导航。
+
+## 测试结果与范围
+
+- 两页共享 ServerConnectivity、ConnectivityCell 与测试按钮行为，不新增缓存或调度器。
+- 未测试显示「—」，悬停显示「尚未测试」。两页统一此规则。
+- 服务器显示最近一次结果。组显示「最快 128 ms」，悬停显示服务器名称和测试时间。
+- 组有结果但没有成功结果时显示「—」，悬停显示「无成功结果」。
+- 测试时显示小型进度指示，保留此前结果。
+- 沿用五分钟与网络变化失效规则。过期结果使用次要颜色，悬停注明「已过期」。
+- 沿用现有组汇总规则：优先新鲜成功；仅有过期成功时显示过期最快值；每台服务器只取最近一次结果。
+- 底部测试选择的服务器或组内全部后代服务器。
+- 全部视图的批次覆盖全目录。收藏视图的批次覆盖收藏节点及全部后代。
+- 批次按点击时的目标去重，不受折叠影响，沿用任务复用、冷却与进度。
+- 只手动触发测试。测试期间仍可浏览、选择和激活。
+- 不按延迟排序或切换目标，保持目录及收藏顺序。
+
+## 浏览状态
+
+- 主工作区为唯一窗口。窗口持有首页浏览 Module，切页保留状态。
+- 首页独立持久化视图模式和展开分组；浏览选择只存于窗口会话。
+- 无持久化记录时所有组收起。
+- 本窗口首次进入首页时选择并定位当前目标。必要时切换全部、展开祖先。
+- 之后仅「定位当前」主动定位。定位产生的模式和展开状态也落盘。
+- 收起所选项的祖先组时选择该组。
+- 切换视图后选择不可见时清空。目录更新时清理失效节点状态。
+- 空目录与空收藏分别说明，并引导前往服务器页添加或收藏。
+- 复用现有目录与激活 Interface，不修改领域 Interface。
+
+## 验证 seam
+
+- 首页浏览 Module 的 Interface：首次进入、定位、选择、折叠、切换视图、目录更新和测试范围。
+- 既有 ServerConnectivity Interface：继续由现有测试验证调度、失效及汇总语义。
diff --git a/docs/design/http-latency-phases.md b/docs/design/http-latency-phases.md
new file mode 100644
index 000000000..e1d3621eb
--- /dev/null
+++ b/docs/design/http-latency-phases.md
@@ -0,0 +1,34 @@
+# HTTP 延迟分阶段测量
+
+本文件记录 2026-10-15 确认的实现规格。当前行为以代码、GLOSSARY.md 和 ADR 为准。
+
+## 测量契约
+
+- 仅正式测速使用手写 HTTP/1.1；接受 HTTP/1.0 响应。不支持 HTTPS 测速。
+- 主数值从开始连接隔离代理的本地 HTTP 入口，到收完最终响应头。
+- 2xx 成功，不跟随重定向，不等待响应体；保留配置失效、冷却、历史和结果过期语义。
+- 每节点一个隔离 sslocal，节点之间串行；不改变正式运行配置或系统代理。
+- 准备阶段通过同一节点的系统 HTTPS 查询 DoH。Google 失败后尝试 Cloudflare；A/AAAA 查询共用每解析器 3 秒绝对时限。
+- 每批重新解析，不复用跨轮次 DNS 缓存；IP 字面量目标跳过 DoH。
+- 去重后最多测试 2 个 IPv4、2 个 IPv6 候选，逐个执行最多 3 秒的 HTTP 请求；固定完整响应头最快的成功 IP，保留原 Host 与路径、查询参数。
+- 同一进程下连续正式采样 3 次，每次新建本地 TCP 连接，时限各 5 秒；至少 2 次成功才返回成功样本中位数，2 个样本取算术平均。
+- 准备总上限 30 秒，启动子阶段上限 10 秒；所有准备步骤受剩余总预算约束。
+
+## 观测与日志
+
+一个测量 module 通过一个 interface 返回总结果与阶段记录。调用方不操作 DNS、socket 或 HTTP 解析状态。测试覆盖测量 interface、现有 ServerConnectivity 调度 seam 和 HTTP 请求 seam。
+
+应用内诊断日志记录：启动；每次 DoH（含解析器和回退）；候选与选定 IP；每次正式样本；本地 TCP、发送、等待首字节、首字节到完整响应头的耗时；结果和失败阶段。时间戳使用单调时钟测量。数值有测量标识与样本编号。未到达阶段无数值，不伪造 0。
+
+不记录 URL、域名、查询 token、凭据、原始错误或插件参数。目标 IP 只出现在显式诊断日志查看/复制，安全诊断报告不导出这些事件。
+
+DoH 时间包含整次代理查询，不称为纯 DNS 耗时。远程 TCP、代理服务器域名解析与插件握手不可独立观测，归入代理请求的混合耗时。发送完成表示本地写入完成，不证明远端收到。
+
+## 证据与验收
+
+- 固定 IP 的代理请求保留原 Host，IPv4/IPv6 URL 和查询编码正确。
+- 分片/临时响应头、失败状态、大小限制、超时、取消、无响应体等待通过受控代理验证。
+- 准备回退、候选限制、最快成功地址、固定地址采样、中位数和失败阈值通过测量 interface 验证。
+- DoH 必须经过指定本地代理，拒绝不可信 TLS 和重定向，不回落直连；解析失败不启动正式采样。
+- 调度串行、失效结果抑制、进程所有权、清理与取消保留验证。
+- 全量 hostless 测试、构建与真实 sslocal 进程 smoke 分别报告。不把它们当作远程互通或手机端一致性的证明。
diff --git a/docs/design/managed-cloak-plugin.md b/docs/design/managed-cloak-plugin.md
new file mode 100644
index 000000000..3cb63a095
--- /dev/null
+++ b/docs/design/managed-cloak-plugin.md
@@ -0,0 +1,42 @@
+# 新增 Cloak 托管插件
+
+日期：2026-10-12。状态：实施、验证与审查完成。本文记录本次任务的需求与决定，不代表当前实现。
+
+## 已确认决定
+
+- 将 Cloak 客户端作为随应用发布的托管 SIP003 插件接入。
+- 沿用现有插件选择器、通用参数编辑器与插件管理界面，不新增 Cloak 专用表单。
+- 固定记录身份及打包文件名为 `ck-client`；服务器可引用的名称仅为 `cloak`、`cloak-v2`。
+- 使用上游 v2.12.0 的官方 darwin-arm64 二进制，固定下载来源及 SHA-256；扩展现有下载脚本以支持直接二进制，沿用内嵌签名与打包验证流程。
+- 本次只接入和验收 TCP，默认 `tcp_only`；沿用现有插件传输模式设置。Cloak UDP 选项不作为 SIP003u 支持依据。
+- 用户同名覆盖、本地启动参数与服务器插件选项的边界沿用现有插件记录模型。
+- 沿用现有原文透传，不增加 Cloak 专属字段校验、参数改写或配置文件管理。外部配置文件由用户维护；分享文件路径不包含文件内容，接收方自行提供对应文件。使用说明记录上游字符串解析限制。
+
+## 验收范围
+
+- 自动化验证别名解析、用户覆盖、配置生成、下载校验与打包流程，并执行适用于本次改动的仓库检查。
+- 使用当前源码构建的原生界面验证插件选择、参数编辑与内置设置。
+- 不运行真实 sslocal 与 ck-client 本地冒烟（启动、监听和停止清理）。用户说明已经通过用户自定义插件方式验证过；该验证属于用户提供的既有证据，不作为此次托管打包的新增验收结果。
+- 本次不验收远端 Cloak 数据通信，结果标记为未验证。
+
+## 实施授权
+
+用户调用 implement 技能，授权按以上范围实施、审查并在当前分支创建本地提交。
+
+## 上游依据
+
+- [v2.12.0 发布](https://github.com/cbeuw/Cloak/releases/tag/v2.12.0)。
+- [客户端入口](https://github.com/cbeuw/Cloak/blob/v2.12.0/cmd/ck-client/ck-client.go)。
+- [配置解析](https://github.com/cbeuw/Cloak/blob/v2.12.0/internal/client/state.go)。
+
+现有领域术语已覆盖本次接入，不新增词条。当前已确认决定沿用既有插件模型，暂不另建 ADR；若后续改变配置所有权或验证边界，再记录相应取舍。
+
+## 本次验收结果
+
+- `task test`：1011 项 hostless 测试通过，0 失败、0 跳过；包括参数化共 1107 次执行。另有 5 项外部二进制下载测试与 21 项规则转换测试通过。
+- 下载测试覆盖直接二进制安装、缓存命中、缓存漂移、资产哈希不符、非 Mach-O 拒绝、旧 tar 清单兼容与未知格式拒绝。测试只编译本地夹具，不运行 sslocal 或 ck-client。
+- 当前源码构建的应用包含 arm64 `ck-client` 和 Cloak 许可证、来源、第三方声明。`packaging-gate.sh` 通过，覆盖 Developer ID 签名、Hardened Runtime、固定签名标识与 Helpers 文件清单。
+- 当前源码插件组件的隔离原生预览通过：选择器显示 `cloak`、`cloak-v2`；选择版本别名；参数列表输入后切换原始文本；Cloak 内置设置默认 `tcp_only`；本地启动参数保存后重新打开保持。预览只使用临时配置与可执行占位文件，不读取实际用户配置或启动代理。
+- 修改的 Swift 文件通过 `swift format lint --strict`；Shell 语法检查与 `git diff --check` 通过。全仓 SwiftLint 为 29 项警告、0 项严重违规；Xcode 的 AppIntents 元数据跳过与 IDE 启动诊断警告不阻断测试。
+- 对任务起点 `686fa4cd5c87c6f34fd78c3fc3f84e6d95cbe594` 后的工作分别执行 Standards 与 Spec 审查，最终各 0 项可操作问题。
+- 真实 sslocal 与 ck-client 本地冒烟按用户要求未运行；用户此前通过自定义插件方式验证的结果不冒充本次新增证据。远端数据通信未验证。
diff --git a/docs/design/ng2-process-architecture.md b/docs/design/ng2-process-architecture.md
new file mode 100644
index 000000000..97f301857
--- /dev/null
+++ b/docs/design/ng2-process-architecture.md
@@ -0,0 +1,175 @@
+# NG2 process architecture: GUI, Agent, Helper, and sslocal
+
+English | [简体中文](ng2-process-architecture.zh.md)
+
+Implementation snapshot: 2026-10-24. Use the source code for subsequent implementation changes, the [ADRs](../adr/) for accepted designs, and [GLOSSARY.md](../../GLOSSARY.md) for terminology.
+
+The GUI saves user intent, generates runtime configuration, and coordinates system proxy settings. The Agent runs in the user session and starts and supervises sslocal. sslocal accepts proxy requests, routes traffic, and forwards it through Shadowsocks. SystemProxyHelper runs as root and changes macOS system proxy settings at the GUI's request.
+
+## Processes and responsibilities
+
+| Component | Identity and lifecycle | Responsibilities |
+| --- | --- | --- |
+| GUI: `ShadowsocksX-NG2` | Graphical application running as the current user | Manages the server library, active target, rules, plugins, and listener settings; derives and publishes runtime configuration; decides when to apply, suspend, or clear system proxy settings |
+| Agent: `ShadowsocksX-NG2Agent` | LaunchAgent in the current user session, managed by launchd | Reads supervision metadata without secrets, switches stable links, starts, reloads, and stops sslocal, and records deployment receipts and failures |
+| Helper: `ShadowsocksX-NG2SystemProxyHelper` | Root LaunchDaemon in the system domain, activated on demand through its MachService | Accepts XPC requests from the GUI and writes or clears system proxy settings through SystemConfiguration |
+| `sslocal` | User process started by the Agent | Provides SOCKS5 and HTTP inbounds, reads server configuration and ACLs, and handles direct and proxied traffic |
+| SIP003 plugins | Started by sslocal according to server configuration | Provide plugin transport for the corresponding server; executables come from bundled managed plugins or user plugin mappings |
+
+`Domain/` contains shared source compiled into the relevant targets. It has no separate process. The GUI application layer, workflows, and SwiftUI views also run in the same GUI process.
+
+### Control relationships
+
+```mermaid
+flowchart TB
+    GUI["GUI: user intent and configuration derivation"]
+    LD["launchd"]
+    Files["Runtime directory: configuration, ACLs, supervision metadata"]
+    Agent["Agent: user process supervisor"]
+    SL["sslocal: proxy traffic handling"]
+    Plugin["SIP003 plugins"]
+    Helper["SystemProxyHelper: root"]
+    SC["macOS system proxy settings"]
+
+    GUI -->|"bootstrap / bootout"| LD
+    LD -->|"User session service"| Agent
+    GUI -->|"Prepare files and publish supervision metadata"| Files
+    GUI -->|"SIGUSR1: notify of a new deployment"| Agent
+    Agent -->|"Read metadata, switch links, write receipts"| Files
+    Agent -->|"Start / signal reload / stop"| SL
+    Files -->|"Configuration, ACLs, authentication files"| SL
+    SL -->|"Start and use"| Plugin
+    GUI -->|"Register with SMAppService.daemon"| LD
+    LD -->|"Activate on MachService request"| Helper
+    GUI -->|"XPC: apply / clear"| Helper
+    Helper -->|"Write through SystemConfiguration"| SC
+    SC -->|"GUI observes through read-only access"| GUI
+```
+
+The GUI and Agent coordinate through files and signals. The GUI and Helper use XPC. The Agent and Helper do not call each other, and the Helper does not start or supervise sslocal.
+
+The production Agent registration implementation writes a manifest with an absolute executable path under `~/Library/LaunchAgents/`, then runs `launchctl bootstrap gui/<uid>`. It uses `bootout` to stop the service. `SMAppService.agent` supplies background item approval status. The Helper is registered through `SMAppService.daemon` using the LaunchDaemon manifest bundled with the application.
+
+## Responsibilities within the GUI
+
+`App/Composition/` assembles dependencies and lifecycle objects. SwiftUI views read facts and submit user actions through workflows such as `CatalogWorkflow`, `ProxyControlWorkflow`, `SettingsWorkflow`, and `RulesWorkflow`.
+
+`ProxyRuntimeController` derives runtime intent from the latest saved configuration catalog, active target, proxy mode, rules, listener configuration, and effective plugin catalog. It then publishes configuration and starts or stops the Agent. `SystemProxyObserver` handles system proxy approval requirements, difference observation, application, repair, and suspension. Both make their decisions in the GUI process.
+
+Shared domain code handles catalog invariants, storage, rule computation, runtime plans, and interprocess contracts. The Agent and Helper compile only the shared files they need. [`project.yml`](../../ShadowsocksX-NG2/project.yml) defines these compilation boundaries.
+
+## From saved configuration to deployment
+
+The persistent server library and the runtime configuration consumed by sslocal have different lifecycles. The library retains the full configuration catalog and credentials. Runtime configuration is derived from the active target and contains only the information needed for that deployment.
+
+### Persistent configuration and secrets
+
+The default application support directory is `~/Library/Application Support/ShadowsocksX-NG2/`:
+
+| Location | Contents and access |
+| --- | --- |
+| `configuration/catalog.age` | Encrypted server library, read and written by the GUI |
+| `configuration/proxy-listening.age` | Encrypted listener configuration, including LAN authentication settings, read and written by the GUI |
+| Rule, active target, and plugin data under `configuration/` | Separate configuration files managed by the GUI |
+| `runtime/` | Runtime files published by the GUI, plus process identities, receipts, and failure records written by the Agent |
+| `logs/agent.log` | Agent events and sslocal logs processed by the output intake |
+
+The server library and listener configuration use separate age identities, with private keys stored in the login keychain. The GUI obtains the plaintext it needs when deriving runtime configuration. sslocal configuration and LAN authentication files currently remain plaintext in the protected runtime directory. Directory permissions are `0700`; regular file permissions are `0600`.
+
+The Agent decodes only `agent-supervision.json`. This contains the deployment identity, generation, listener endpoints, random configuration and authentication identities, file references, and ACL metadata. The Agent does not parse server passwords, plugin arguments, LAN credentials, or private GUI intent metadata. This boundary limits the Agent's processing responsibilities; the Agent and sslocal still run as the same user.
+
+### Publication protocol
+
+1. The GUI builds `SslocalRuntimeDocument` from saved data and outputs sslocal JSON, ACLs, and any required LAN authentication files.
+2. Under `runtime.lock`, `RuntimeFileStore` allocates a monotonically increasing generation and writes immutable files named with that generation. Unchanged authentication files and ACLs can be reused.
+3. Once all referenced files are prepared and validated, the GUI atomically replaces `agent-supervision.json`. This publishes the deployment intent.
+4. On the first run, the GUI registers the Agent. If the Agent is already running, the GUI sends it `SIGUSR1`.
+5. The Agent validates the supervision metadata, switches the stable `sslocal-active.json` and `acl-active.ini` links, then starts or reloads sslocal.
+6. The Agent writes an `agent-runtime-status.json` receipt. During deployment confirmation, the GUI uses it to check local readiness before coordinating system proxy settings.
+
+The GUI does not decode its sslocal JSON output to recover user intent. It uses the private intent digest, output byte digest, and redacted summary in the same generation's `intent.json` for comparison, integrity checks, and diagnostics. The Agent retains only a reference to this file.
+
+Only the Agent switches stable links. GUI preparation and publication and Agent retirement of old files share `runtime.lock`. The Agent also holds `agent.lock` for its process lifetime to prevent two supervisors from starting listeners concurrently. File retirement preserves references from the latest publication and files still used by the current child process. Stopping the service preserves the generation high-water mark.
+
+### Updates and reloads
+
+`SIGUSR1` from the GUI to the Agent always means "read the new deployment." The Agent then chooses an operation for sslocal according to what changed:
+
+| Change | Agent operation on sslocal |
+| --- | --- |
+| Server or other configuration bytes change, changing the configuration identity | Switch the configuration link and send `SIGUSR1` |
+| ACL changes, including proxy mode or rule changes | Switch the ACL link and send `SIGUSR2` |
+| Configuration and ACL change together | Send both signals separately |
+| Listener endpoints, IPv6 listener settings, or authentication identity change | Stop the old child and confirm its exit before starting a new process |
+
+Each link is switched atomically on its own, so server configuration and ACL changes can take effect at different times. During initial listener establishment, the Agent accumulates pending reload signals and sends them once the listeners are ready.
+
+A deployment receipt associates `deploymentID` with the sslocal PID and records Agent operations and listener evidence. It does not prove that sslocal successfully parsed and applied a reload. For example, upstream may retain the old rules if ACL parsing fails. There is currently no upstream application acknowledgement protocol.
+
+## Request traffic paths
+
+```mermaid
+flowchart LR
+    App["Local apps using system proxy settings"] -->|"Read system proxy settings"| Local["sslocal local SOCKS5 / HTTP inbounds"]
+    Manual["Apps or terminals with explicit proxy configuration"] --> Local
+    LAN["LAN clients"] --> Network["sslocal LAN inbounds, optional authentication"]
+    Local --> ACL["sslocal ACL routing"]
+    Network --> ACL
+    ACL -->|"Direct"| Target["Destination service"]
+    ACL -->|"Proxy, no plugin"| SS["Shadowsocks server"]
+    ACL -->|"Proxy, plugin configured"| Plugin["SIP003 plugin transport"]
+    Plugin --> SS
+    SS --> Target
+```
+
+Local inbounds bind to `127.0.0.1`, with default ports `11086` for SOCKS5 and `11087` for HTTP. LAN inbounds are enabled independently, with default ports `11088` and `11089`. Their settings control address families, authentication, and SOCKS5 UDP relay. Local SOCKS5 supports TCP and UDP. sslocal provides the HTTP inbound directly.
+
+The system SOCKS proxy points to the local SOCKS5 inbound. The HTTP and HTTPS system proxies share the local HTTP inbound; HTTPS requests use its CONNECT support. System proxy settings affect applications that honor them. Explicit proxy configuration can also use the local inbounds directly.
+
+Rule, global, and direct modes are expressed through sslocal ACLs. Global mode retains the fixed local bypass policy. Direct mode keeps the sslocal inbounds running and has sslocal connect directly to destinations. The GUI, Agent, and Helper do not forward normal proxy requests.
+
+The Agent switch and system proxy switch save separate intents. When the service is enabled and system proxy settings are disabled, clients with explicit proxy configuration can still use the local proxy endpoints.
+
+## Helper privileges and system proxy scope
+
+The GUI decides whether to apply system proxy settings. It supplies explicit SOCKS, HTTP, and HTTPS endpoints, PAC and auto-discovery enablement, simple-hostname exclusion, and the complete exceptions list. The Helper decodes typed requests, executes them serially, and returns typed results.
+
+- `apply` handles every network service in the current network location. It changes only managed proxy fields, preserves unmodeled fields, and skips services whose values are already equivalent.
+- `clear` removes the complete `Proxies` dictionary from every service in every network location. It does not check the settings' origin or restore another application's previous values.
+
+The GUI observes current settings through read-only SystemConfiguration access. Normal startup and passive network changes primarily check for differences; repairs require an explicit user request. The Helper does not read the server library, obtain Shadowsocks passwords, observe runtime failures, or decide when to clear settings.
+
+The Helper accepts clients whose code-signing identifier is `com.qiuyuzhou.ShadowsocksX-NG2`. It currently places no restriction on Team ID or UID. Each user has independent proxy intent, while system proxy settings are shared across the device. Requests from multiple instances execute serially through the Helper; later writes determine the final values.
+
+## Lifecycle and failure handling
+
+After starting sslocal, the Agent checks that local endpoints accept connections. For regular deployments with an ACL, it also confirms that the TCP listeners belong to that child. If a previously healthy child exits unexpectedly, the Agent replays the current publication. Detectable failures, such as initial readiness failure, link switching failure, or signal delivery failure, produce a persistent failure record associated with the deployment identity and stop that deployment. The Agent does not automatically revert to historical configuration.
+
+launchd restarts the Agent after a nonzero exit under its `KeepAlive.SuccessfulExit = false` policy, with a 2-second throttle configured in the manifest. If the Agent crashes and the recorded old sslocal PID still exists, the next instance refuses to start a second listener process and records a failure.
+
+The GUI confirms readiness during startup, restart, and explicit deployment. During stable operation, while system proxy intent is enabled, it checks for an explicit failure record for the current deployment every 5 seconds. A recorded failure suspends system proxy settings while preserving enabled intent, pending an explicit retry or new runtime intent. Brief receipt gaps during automatic restart, PID changes, or remote connectivity fluctuations do not independently trigger suspension. Absence of a failure record does not prove health. The GUI no longer periodically connects to local ports to detect failures.
+
+When the user turns off the proxy service, the GUI disables system proxy intent and requests cleanup before stopping the background service. On a stop signal, the Agent terminates sslocal, escalating to forced termination if needed. The GUI cleans runtime files only after confirming that the Agent has exited. Helper registration can remain in place for future requests.
+
+When the GUI quits, its termination flow waits for connectivity tests to finish and clean up. The background Agent and normal proxy service continue running, and system proxy settings remain in place. The GUI's failure checks and system proxy suspension logic stop with it; the Helper does not take over these responsibilities. The GUI login item controls whether the graphical application opens at login and is independent of the Agent switch.
+
+### Separate connectivity test processes
+
+For server connectivity tests, the GUI's `ConnectivityRuntime` starts a temporary sslocal directly, using a separate temporary directory and a dynamically allocated loopback HTTP port. The test configuration contains only the server under test and no regular runtime ACL. Requests reach the test URL through that server. Completion or cancellation cleans up the process group and temporary directory.
+
+The test process therefore bypasses the regular Agent, leaves system proxy settings untouched, and does not use regular listener ports. A successful test describes the request result from the specified server to the test URL. It has a different meaning from a regular deployment readiness receipt.
+
+## Source entry points and related decisions
+
+| Area | Source entry points |
+| --- | --- |
+| GUI composition and workflows | [`App/Composition/MainApp.swift`](../../ShadowsocksX-NG2/App/Composition/MainApp.swift), [`App/Application/`](../../ShadowsocksX-NG2/App/Application/) |
+| Agent registration and runtime planning | [`LaunchAgentService.swift`](../../ShadowsocksX-NG2/App/Application/Services/LaunchAgentService.swift), [`ProxyRuntimePlan.swift`](../../ShadowsocksX-NG2/Domain/Runtime/ProxyRuntimePlan.swift) |
+| Configuration publication and supervision contract | [`RuntimeFileStore.swift`](../../ShadowsocksX-NG2/Domain/Runtime/RuntimeFileStore.swift), [`RuntimeSupervision.swift`](../../ShadowsocksX-NG2/Domain/Runtime/RuntimeSupervision.swift) |
+| Agent supervision loop and listener confirmation | [`Agent/main.swift`](../../ShadowsocksX-NG2/Agent/main.swift), [`AgentListening.swift`](../../ShadowsocksX-NG2/Agent/AgentListening.swift) |
+| System proxy policy and XPC client | [`SystemProxyObserver.swift`](../../ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyObserver.swift), [`SystemProxyHelperService.swift`](../../ShadowsocksX-NG2/App/Application/Services/SystemProxyHelperService.swift) |
+| Helper contract, validation, and writes | [`Domain/SystemProxy/`](../../ShadowsocksX-NG2/Domain/SystemProxy/), [`SystemProxyWriter.swift`](../../ShadowsocksX-NG2/SystemProxyHelper/SystemProxyWriter.swift) |
+| Failure observation during stable operation | [`ProxyRuntimeController+Health.swift`](../../ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Health.swift) |
+| Independent connectivity tests | [`ConnectivityRuntime.swift`](../../ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityRuntime.swift) |
+
+Related decisions: [privileged Helper](../adr/0020-privileged-system-proxy-writer.md), [system proxy differences and repair](../adr/0022-observe-system-proxy-differences-and-repair.md), [separate supervision metadata and configuration](../adr/0038-separate-agent-supervision-and-sslocal-input.md), [one-way configuration output](../adr/0043-one-way-sslocal-configuration-output.md), [ACL reload by signal](../adr/0048-reload-sslocal-acl-by-signal.md), [Agent ownership of failure observation](../adr/0049-agent-owned-runtime-failure-observation.md), and [age storage for persistent configuration](../adr/0050-age-encrypted-configuration-storage.md).
diff --git a/docs/design/ng2-process-architecture.zh.md b/docs/design/ng2-process-architecture.zh.md
new file mode 100644
index 000000000..9e8d490b1
--- /dev/null
+++ b/docs/design/ng2-process-architecture.zh.md
@@ -0,0 +1,175 @@
+# NG2 进程架构：GUI、Agent、Helper 与 sslocal
+
+[English](ng2-process-architecture.md) | 简体中文
+
+实现快照：2026-10-24。后续实现以源码为准，已接受的设计见 [ADR](../adr/)，术语见 [GLOSSARY.md](../../GLOSSARY.md)。
+
+GUI 保存用户意图、生成运行配置并协调系统代理。用户会话中的 Agent 启动和监管 sslocal；sslocal 接收代理请求，执行路由与 Shadowsocks 转发。具有 root 权限的 SystemProxyHelper 按 GUI 请求修改 macOS 系统代理设置。
+
+## 进程与职责
+
+| 组件 | 运行身份与生命周期 | 职责 |
+| --- | --- | --- |
+| GUI：`ShadowsocksX-NG2` | 当前用户的图形应用 | 管理服务器库、活动目标、规则、插件与监听设置；派生和发布运行配置；决定何时应用、暂停或清理系统代理 |
+| Agent：`ShadowsocksX-NG2Agent` | 当前用户会话的 LaunchAgent，由 launchd 管理 | 读取非秘密监管资料，切换稳定链接，启动、重载和停止 sslocal，记录部署回执与失败 |
+| Helper：`ShadowsocksX-NG2SystemProxyHelper` | 系统域 root LaunchDaemon，由 MachService 请求按需激活 | 接受 GUI 的 XPC 请求，通过 SystemConfiguration 写入或清除系统代理设置 |
+| `sslocal` | Agent 启动的用户态子进程 | 提供 SOCKS5 与 HTTP 入站，读取服务器配置与 ACL，处理直连和代理流量 |
+| SIP003 插件 | 按服务器配置由 sslocal 启动 | 为对应服务器提供插件传输路径；程序可来自随应用发布的托管插件或用户插件映射 |
+
+`Domain/` 是编入相应 target 的共享源码，没有独立进程。GUI 的应用层、工作流和 SwiftUI 视图也都位于同一个 GUI 进程。
+
+### 控制关系
+
+```mermaid
+flowchart TB
+    GUI["GUI：用户意图与配置派生"]
+    LD["launchd"]
+    Files["运行目录：配置、ACL、监管资料"]
+    Agent["Agent：用户态监管进程"]
+    SL["sslocal：代理流量处理"]
+    Plugin["SIP003 插件"]
+    Helper["SystemProxyHelper：root"]
+    SC["macOS 系统代理设置"]
+
+    GUI -->|"bootstrap / bootout"| LD
+    LD -->|"用户会话服务"| Agent
+    GUI -->|"准备文件并发布监管资料"| Files
+    GUI -->|"SIGUSR1：通知新部署"| Agent
+    Agent -->|"读取监管资料、切换链接、写回执"| Files
+    Agent -->|"启动 / 信号重载 / 停止"| SL
+    Files -->|"配置、ACL、认证文件"| SL
+    SL -->|"启动与使用"| Plugin
+    GUI -->|"SMAppService.daemon 注册"| LD
+    LD -->|"MachService 按需激活"| Helper
+    GUI -->|"XPC：apply / clear"| Helper
+    Helper -->|"SystemConfiguration 写入"| SC
+    SC -->|"GUI 只读观察"| GUI
+```
+
+GUI 与 Agent 通过文件和信号协作。GUI 与 Helper 使用 XPC。Agent 和 Helper 之间没有直接调用关系，Helper 也不启动或监管 sslocal。
+
+Agent 的生产注册实现会在 `~/Library/LaunchAgents/` 写入带可执行文件绝对路径的清单，再执行 `launchctl bootstrap gui/<uid>`；停止使用 `bootout`。`SMAppService.agent` 用于读取后台项目批准状态。Helper 则通过 `SMAppService.daemon` 注册应用内的 LaunchDaemon 清单。
+
+## GUI 内部的分工
+
+`App/Composition/` 装配依赖和生命周期对象。SwiftUI 视图通过 `CatalogWorkflow`、`ProxyControlWorkflow`、`SettingsWorkflow`、`RulesWorkflow` 等工作流读取事实、提交用户操作。
+
+`ProxyRuntimeController` 将最新保存的配置目录、活动目标、代理模式、规则、监听配置和有效插件目录派生为运行意图，再执行配置发布和 Agent 启停。`SystemProxyObserver` 负责系统代理的批准门禁、差异观察、应用、修复与暂停。两者的决策都发生在 GUI 进程。
+
+共享领域代码负责目录不变量、存储、规则计算、运行计划和跨进程契约。Agent 和 Helper 只编入各自需要的共享文件；具体编译边界由 [`project.yml`](../../ShadowsocksX-NG2/project.yml) 定义。
+
+## 配置从保存到生效
+
+用户持久保存的服务器库与供 sslocal 使用的运行配置具有不同生命周期。前者保留完整配置目录和凭据；后者由活动目标派生，只包含本次运行所需的信息。
+
+### 持久配置与秘密边界
+
+默认应用支持目录是 `~/Library/Application Support/ShadowsocksX-NG2/`：
+
+| 位置 | 内容与读写方 |
+| --- | --- |
+| `configuration/catalog.age` | GUI 读写的加密服务器库 |
+| `configuration/proxy-listening.age` | GUI 读写的加密监听配置，包含 LAN 认证设置 |
+| `configuration/` 下的规则、活动目标和插件资料 | GUI 管理的独立配置文件 |
+| `runtime/` | GUI 发布的运行文件，以及 Agent 写入的进程身份、回执和失败记录 |
+| `logs/agent.log` | Agent 事件及经过输出 intake 处理的 sslocal 日志 |
+
+服务器库与监听配置分别使用独立的 age identity，私钥保存在登录钥匙串。GUI 在派生运行配置时取得所需明文。当前 sslocal 配置和 LAN 认证文件仍以明文保存于受保护的运行目录，目录权限为 `0700`，普通文件为 `0600`。
+
+Agent 只解码 `agent-supervision.json`，其中包含部署身份、代次、监听端点、随机配置身份与认证身份、文件引用和 ACL 元数据。Agent 不解析服务器密码、插件参数、LAN 凭据或 GUI 私有意图元数据。这个边界限制的是 Agent 的处理职责；Agent 与 sslocal 仍以同一用户身份运行。
+
+### 发布协议
+
+1. GUI 从已保存的资料生成 `SslocalRuntimeDocument`，输出 sslocal JSON、ACL 和必要的 LAN 认证文件。
+2. `RuntimeFileStore` 在 `runtime.lock` 内分配单调递增的代次，写入带代次的不可变文件。内容未变的认证文件与 ACL 可以复用。
+3. 所有引用文件准备并校验完成后，GUI 原子替换 `agent-supervision.json`。这是部署意图的发布点。
+4. 首次运行时，GUI 注册 Agent；Agent 已运行时，GUI 向其发送 `SIGUSR1`。
+5. Agent 校验监管资料，切换 `sslocal-active.json` 与 `acl-active.ini` 稳定链接，再启动或重载 sslocal。
+6. Agent 写入 `agent-runtime-status.json` 回执，GUI 在部署确认阶段据此检查本地就绪状态，再协调系统代理。
+
+GUI 不会解码已输出的 sslocal JSON 来恢复用户意图。它使用同代 `intent.json` 中的私有意图摘要、输出字节摘要与脱敏汇总完成比较、完整性检查和诊断。Agent 只保留该文件的引用。
+
+稳定链接由 Agent 独占切换。GUI 准备和发布、Agent 回收旧文件共用 `runtime.lock`；Agent 另持有进程期的 `agent.lock`，防止两个监管实例同时启动监听进程。回收会保留最新发布与当前子进程仍使用的文件，停止服务也保留代次高水位。
+
+### 更新与重载
+
+GUI 发给 Agent 的 `SIGUSR1` 统一表示“读取新部署”。Agent 再按变化决定给 sslocal 的操作：
+
+| 变化 | Agent 对 sslocal 的操作 |
+| --- | --- |
+| 服务器等配置字节变化，配置身份改变 | 切换配置链接，发送 `SIGUSR1` |
+| ACL 变化，包括代理模式与规则变化 | 切换 ACL 链接，发送 `SIGUSR2` |
+| 配置与 ACL 同时变化 | 分别发送上述两个信号 |
+| 监听端点、IPv6 监听设置或认证身份变化 | 停止旧子进程并确认退出，再启动新进程 |
+
+两个链接分别原子切换，服务器配置与 ACL 可以先后生效。Agent 在初次监听尚未就绪时合并待发信号，待就绪后发送。
+
+部署回执关联 `deploymentID` 和 sslocal PID，记录 Agent 操作及监听证据。它不能证明 sslocal 已成功解析和应用热重载内容；例如 ACL 解析失败时，上游可能继续使用旧规则。当前没有上游应用确认协议。
+
+## 请求流量经过哪里
+
+```mermaid
+flowchart LR
+    App["使用系统代理的本机应用"] -->|"读取系统代理设置"| Local["sslocal 本机 SOCKS5 / HTTP 入站"]
+    Manual["显式配置代理的应用或终端"] --> Local
+    LAN["局域网客户端"] --> Network["sslocal LAN 入站，可选认证"]
+    Local --> ACL["sslocal ACL 路由"]
+    Network --> ACL
+    ACL -->|"直连"| Target["目标服务"]
+    ACL -->|"代理，无插件"| SS["Shadowsocks 服务器"]
+    ACL -->|"代理，配置了插件"| Plugin["SIP003 插件传输"]
+    Plugin --> SS
+    SS --> Target
+```
+
+本机入站绑定 `127.0.0.1`，默认 SOCKS5 端口为 `11086`，HTTP 端口为 `11087`。LAN 入站独立启用，默认端口分别为 `11088` 和 `11089`，可选择地址族、认证与 SOCKS5 UDP 中继设置。本机 SOCKS5 支持 TCP 与 UDP；HTTP 入站由 sslocal 直接提供。
+
+系统 SOCKS 代理指向本机 SOCKS5 入站，HTTP 和 HTTPS 系统代理共用本机 HTTP 入站。HTTPS 请求使用该 HTTP 代理的 CONNECT 能力。系统代理设置影响遵循这些设置的应用；显式代理配置也可以直接使用本地入站。
+
+规则、全局和直连模式通过 sslocal ACL 表达。全局模式仍包含固定本地绕过策略；直连模式仍保留 sslocal 入站，由 sslocal 直接连接目标。GUI、Agent 和 Helper 均不转发正常代理请求。
+
+代理服务开关与系统代理开关分别保存意图。服务开启而系统代理关闭时，本地代理入口仍可供显式配置代理的客户端使用。
+
+## Helper 的权限与系统代理范围
+
+GUI 决定是否应用系统代理，并显式提供 SOCKS、HTTP、HTTPS 端点、PAC 与自动发现启停、简单主机名排除及完整例外列表。Helper 解码类型化请求、串行执行，再返回类型化结果。
+
+- `apply` 处理当前网络位置的所有网络服务，只修改受管代理字段，保留未建模的字段，并跳过值已等价的服务。
+- `clear` 移除所有网络位置、所有网络服务的完整 `Proxies` 字典，不判断设置来源，也不恢复其他软件的旧值。
+
+GUI 通过只读 SystemConfiguration 访问观察当前设置。正常启动和被动网络变化以检查差异为主；差异修复由用户明确请求。Helper 不读取服务器库、不获取 Shadowsocks 密码，也不自行观察运行故障或决定清理时机。
+
+Helper 接受代码签名 identifier 为 `com.qiuyuzhou.ShadowsocksX-NG2` 的客户端，当前不限制 Team ID 或 UID。各用户拥有独立代理意图，但系统代理设置是设备级共享状态；多个实例的请求经 Helper 串行执行，后执行的写入决定最终值。
+
+## 生命周期与失败处理
+
+Agent 启动 sslocal 后检查本地端点可连接，并在正式带 ACL 的部署中确认 TCP 监听属于该子进程。已健康子进程意外退出时，Agent 重放当前发布。首次启动未就绪、链接切换或信号投递失败等可检测故障，会形成与部署身份关联的持久失败记录，停止该部署，不自动切回历史配置。
+
+Agent 非零退出时由 launchd 的 `KeepAlive.SuccessfulExit = false` 策略重启，清单配置了 2 秒节流。Agent 崩溃后若记录中的旧 sslocal PID 仍存在，下一实例拒绝启动第二个监听实例，并记录失败。
+
+GUI 在启动、重启和显式部署时执行就绪确认。稳定运行期间，系统代理意图开启时，GUI 每 5 秒检查当前部署的明确失败记录；发现失败后暂停系统代理并保留开启意图，等待显式重试或新运行意图。自动重启中的短暂回执空窗、PID 变化或远端波动不会单独触发暂停。没有失败记录也不能证明服务健康，GUI 不再周期性连接本地端口来判定故障。
+
+关闭代理服务时，GUI 关闭系统代理意图并请求清理，再停止后台服务。Agent 收到停止信号后终止 sslocal，必要时升级为强制终止；GUI 确认 Agent 退出后才清理运行文件。Helper 的注册可以继续保留，供后续按需调用。
+
+退出 GUI 时，退出流程等待连通性测试结束与清理，后台 Agent 和正常代理服务继续运行，系统代理设置保留。此时 GUI 中的故障检查和系统代理暂停逻辑也随之停止；Helper 不接管这些职责。GUI 登录项只控制是否在登录时打开图形应用，与代理服务开关独立。
+
+### 连通性测试的独立进程
+
+服务器连通性测试由 GUI 的 `ConnectivityRuntime` 直接启动临时 sslocal，使用独立临时目录和动态分配的回环 HTTP 端口。测试配置只含待测服务器，不带正式运行 ACL，请求通过该服务器访问测试 URL。测试完成或取消后清理进程组与临时目录。
+
+因此，测试进程不经过正式 Agent，也不修改系统代理或占用正式监听端口。测试成功描述指定服务器到测试 URL 的请求结果，与正式部署的就绪回执具有不同含义。
+
+## 源码入口与相关决定
+
+| 关注点 | 源码入口 |
+| --- | --- |
+| GUI 装配与工作流 | [`App/Composition/MainApp.swift`](../../ShadowsocksX-NG2/App/Composition/MainApp.swift)、[`App/Application/`](../../ShadowsocksX-NG2/App/Application/) |
+| Agent 注册与运行计划 | [`LaunchAgentService.swift`](../../ShadowsocksX-NG2/App/Application/Services/LaunchAgentService.swift)、[`ProxyRuntimePlan.swift`](../../ShadowsocksX-NG2/Domain/Runtime/ProxyRuntimePlan.swift) |
+| 配置发布与监管契约 | [`RuntimeFileStore.swift`](../../ShadowsocksX-NG2/Domain/Runtime/RuntimeFileStore.swift)、[`RuntimeSupervision.swift`](../../ShadowsocksX-NG2/Domain/Runtime/RuntimeSupervision.swift) |
+| Agent 主循环与监听确认 | [`Agent/main.swift`](../../ShadowsocksX-NG2/Agent/main.swift)、[`AgentListening.swift`](../../ShadowsocksX-NG2/Agent/AgentListening.swift) |
+| 系统代理策略与 XPC 客户端 | [`SystemProxyObserver.swift`](../../ShadowsocksX-NG2/App/Application/ProxyRuntime/SystemProxyObserver.swift)、[`SystemProxyHelperService.swift`](../../ShadowsocksX-NG2/App/Application/Services/SystemProxyHelperService.swift) |
+| Helper 契约、校验与写入 | [`Domain/SystemProxy/`](../../ShadowsocksX-NG2/Domain/SystemProxy/)、[`SystemProxyWriter.swift`](../../ShadowsocksX-NG2/SystemProxyHelper/SystemProxyWriter.swift) |
+| 稳定期失败观察 | [`ProxyRuntimeController+Health.swift`](../../ShadowsocksX-NG2/App/Application/ProxyRuntime/ProxyRuntimeController+Health.swift) |
+| 独立连通性测试 | [`ConnectivityRuntime.swift`](../../ShadowsocksX-NG2/App/Application/Connectivity/ConnectivityRuntime.swift) |
+
+相关设计依据：[特权 Helper](../adr/0020-privileged-system-proxy-writer.md)、[系统代理差异与修复](../adr/0022-observe-system-proxy-differences-and-repair.md)、[监管与配置分离](../adr/0038-separate-agent-supervision-and-sslocal-input.md)、[配置单向输出](../adr/0043-one-way-sslocal-configuration-output.md)、[ACL 信号重载](../adr/0048-reload-sslocal-acl-by-signal.md)、[Agent 故障观察职责](../adr/0049-agent-owned-runtime-failure-observation.md)、[age 持久配置](../adr/0050-age-encrypted-configuration-storage.md)。
diff --git a/docs/design/plugin-transport-mode.md b/docs/design/plugin-transport-mode.md
new file mode 100644
index 000000000..2f6c5586e
--- /dev/null
+++ b/docs/design/plugin-transport-mode.md
@@ -0,0 +1,47 @@
+# 插件记录的传输模式
+
+日期：2026-10-11。状态：实施与验收完成。本文记录本次设计，不代表当前代码行为。
+
+## 需求与已确认决定
+
+- 插件记录增加 `plugin_mode`，候选值仅为 `tcp_only` 和 `tcp_and_udp`。
+- 默认值为 `tcp_only`；生成 sslocal 配置时省略该值。
+- `tcp_and_udp` 使 TCP 与 UDP 经过插件，用于用户自行配置支持 SIP003u 的插件。应用不探测支持情况，不维护支持清单。
+- 用户与内置插件记录均可以配置传输模式。同一记录的别名共享模式；用户覆盖使用用户记录自己的模式。
+- 模式仅保存在本机插件配置，不进入服务器资料、分享或订阅。
+- 旧文件缺少字段时使用 `tcp_only`；未知值使读取失败，保留原文件，并沿用读取失败时阻止修改的行为。
+- 保存成功后发布目录快照，并更新活动运行配置。保存失败不发布；运行更新失败不撤销成功保存的配置。
+- 本次验收包含配置与源码构建的界面，不包含真实 SIP003u 通信。
+
+## 界面
+
+- 编辑器新增「插件传输模式」，选项原样显示 `tcp_only` 与 `tcp_and_udp`。
+- 内置记录入口从「启动参数」改为「设置」，编辑器标题改为「内置插件设置」。
+- 将内置记录的「清空参数」从设置列表移入编辑器的「本地启动参数」区域。
+- 「清空参数」只清空当前编辑草稿的启动参数，保留传输模式；点击「保存」才写入配置，点击「取消」放弃草稿。参数为空时禁用按钮。
+- 不增加列表模式摘要或单独的恢复默认操作。
+
+## 验收
+
+- 新记录默认使用 `tcp_only`；旧 v1、v2 文件可以读取，缺少模式时保持原行为。
+- 两种模式保存后可以重新读取；未知模式触发读取失败。
+- `tcp_only` 的 sslocal 服务器配置省略 `plugin_mode`；`tcp_and_udp` 写入 `plugin_mode: "tcp_and_udp"`；无插件时省略全部插件字段。
+- 用户记录、内置记录、同记录别名与用户覆盖使用正确模式。
+- 保存失败不发布新模式；保存成功触发既有运行更新流程。
+- 源码构建的界面验证模式选择、草稿清空、取消与保存行为，并验证列表不再显示「清空参数」。
+- 真实 SIP003u 通信标记为未验证。
+
+## 上游依据
+
+- 固定 shadowsocks-rust v1.25.0 的[配置解析](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2192-L2217)：缺少 `plugin_mode` 时使用 `TcpOnly`。
+- 固定版本的[地址选择](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/config.rs#L712-L728)：插件模式控制 TCP 与 UDP 是否使用插件地址。`tcp_only` 不关闭本地 SOCKS5 UDP 中继；`tcp_and_udp` 不保证插件自身支持 UDP。
+
+## 本次验收结果
+
+- 定向插件测试：22 项通过，0 失败，0 跳过。
+- `task test`：1007 项 hostless 测试通过，0 失败，0 跳过；规则转换测试 21 项通过。该命令构建当前 app、Core 与 Agent。
+- 现有真实 sslocal 插件进程冒烟测试：1 项通过；只验证默认 TCP 插件进程启动、监听与退出，不代表 SIP003u 通信验收。
+- 修改文件的 `swift format lint --strict` 与 `git diff --check` 通过；全仓 SwiftLint 为 29 项警告，0 严重违规。
+- 当前仓库源码编译的隔离原生预览通过：列表入口、两种模式、保存后重新打开、清空草稿、取消保留原参数、保存清空后保留模式、用户记录默认模式。夹具使用临时目录，不读取实际用户插件配置。
+- Standards 审查：0 项标准违规；将内置编辑入口改名为 `beginManagedSettings`，对应当前职责。Spec 审查：0 项缺陷。
+- 真实 SIP003u 通信未验证，按确认的验收范围执行。
diff --git a/docs/design/proxy-rules-ui-simplification.md b/docs/design/proxy-rules-ui-simplification.md
new file mode 100644
index 000000000..7014ea7fd
--- /dev/null
+++ b/docs/design/proxy-rules-ui-simplification.md
@@ -0,0 +1,29 @@
+# 代理规则浏览 UI 简化
+
+状态：已按用户确认设计实现；本文记录本次调整，实现现状以当前代码为准。
+
+## 已确认
+
+- 右侧规则列表顶部不再展示来源详情。
+- 有元信息的选中来源在左侧来源列表下半部自动展示版本摘要、许可证和报告入口；全部规则、自定义规则、固定本地策略不预留空白详情区域。完整版本、上游出处和归属说明放在报告窗口，保留完整可复制内容。
+- 快照制作时的转换报告改为独立窗口展示，正文可滚动、可选择复制，窗口标题标明来源。
+- 只保留一个报告窗口。主列表切换来源不改变已打开报告；明确打开另一来源的报告时，复用窗口并切换内容。
+- 底部关系解释仅在单选规则存在同行动覆盖或相反行动遮蔽时展示，包含部分重叠及固定本地策略覆盖；无关系或多选时隐藏。
+- 每种关系标题只出现一次，下方列出相关规则的匹配内容、类型和行动；固定策略仅列出相关范围。不重复选中规则的列信息，也不级联展示来源元信息或转换报告。
+- 主窗口关闭后，报告窗口可以继续存在；最后一个应用窗口关闭后才回到菜单栏形态。
+- 报告保持打开时的快照，主页面刷新不自动替换内容；再次点击报告入口时更新并置前。
+
+## 实现前代码核实
+
+- 列表已有匹配内容、类型、行动、来源与状态；底部额外提供具体覆盖者及固定策略范围。
+- 自定义规则和固定本地策略没有快照元信息，但当前仍占用 160 点顶部区域。
+- 当前转换报告包含制作时统计和说明，不是当前集合分析或运行时状态。
+
+本轮不建立新 ADR；已有 ADR-0017 追加独立报告窗口的生命周期修订。领域术语沿用并补充到 CONTEXT.md。
+
+## 本次验证
+
+- 750 项 hostless 测试通过，无签名 Debug 构建通过，格式与 lint 检查通过（保留既有文件长度警告）。
+- 隔离的原生 SwiftUI 窗口验证使用打包来源快照：报告打开、切换内容时复用、查询与刷新不替换报告、关闭后重开，以及两个关闭顺序均通过；没有创建代理控制器或写入系统代理。
+- 原生验证仍记录已有 NSTableView 重入警告，未发生崩溃。单元测试与本次窗口验证不作为真实代理运行验证。
+- Standards 与 Spec 两轴审查无剩余发现。
diff --git a/docs/design/server-favorites.md b/docs/design/server-favorites.md
new file mode 100644
index 000000000..528a27203
--- /dev/null
+++ b/docs/design/server-favorites.md
@@ -0,0 +1,35 @@
+# 服务器收藏
+
+日期：2026-10-09。状态：设计与实施范围已确认，实现与验证见本次提交。
+
+本文记录本次任务的需求与验收条件，不代表代码当前具备这些能力。领域术语见根目录 `GLOSSARY.md`；持久化决定见 ADR-0032。
+
+## 列表与入口
+
+- 入口位于服务器页面内部边栏首位，顺序为「收藏／本地／订阅」。现有初始「本地」选择保持不变。
+- 收藏列表使用平面 Table，仅有「名称」「路径」两列，无层级展开、列排序或排序工具栏入口。
+- 名称显示当前节点自身名称；配置组显示组名。名称列沿用节点类型、有效性与活动目标的现有呈现。
+- 路径使用 `/` 分隔，包含「本地／订阅」来源名称、全部祖先和节点自身名称，例如 `订阅/机场/香港/HK01`。
+- 名称中的 `/` 原样显示，不转义。改名或移动后路径随目录更新；截断时悬停显示完整路径。
+- 每个节点最多出现一次；收藏配置组仅增加该组一行，不自动收藏或展示后代。父组与后代可以分别收藏。
+- 新收藏追加至末尾；取消后重新收藏也追加至末尾。收藏与顺序跨应用重启保留。
+- 列表拖动只改变收藏顺序，不改变配置目录的位置或顺序。拒绝目录移动语义和外部拖入。
+
+## 选择与命令
+
+- 选择收藏行留在收藏列表，右侧复用原节点详情。配置组通过现有「激活」按钮激活。
+- 详情增加「收藏／取消收藏」按钮；英文为 `Favorite / Unfavorite`。
+- 「本地／订阅」列表在「名称」与「创建时间」之间增加「收藏」列；该列无排序，使用 `star.fill` 与 `star` 显示状态，仅展示、不响应点击。
+- 当前收藏取消后，清除选择与详情，不自动选择相邻行；删除或订阅刷新导致选中节点消失时同样清除选择。
+- 收藏行保留原节点右键菜单与资格限制。收藏列表隐藏「排序」「新建服务器」「新建分组」工具栏项，其余已有节点命令保持现有行为。
+- 「分享」按当前节点提供；全局「导入」入口保留。导入成功产生节点后切换到「本地」并选中新节点，新节点不自动收藏。现有复制或新建回调同样切换至「本地」并选择新节点。
+- 失效服务器与空组可以收藏；收藏不改变激活资格。侧栏切换继续清除节点选择。
+
+## 保存与验收
+
+- 用节点身份保存收藏顺序，不持久化派生名称、路径或凭据。
+- 目录文档升级到 v6，兼容读取 v1–v5，历史文档默认为空收藏；写入使用 v6。
+- 删除节点、移除订阅及订阅刷新消失节点时，同次保存清除失效收藏。刷新失败保留原目录及收藏。
+- 收藏变化不触发代理运行状态收敛，不改变节点创建或修改时间。保存失败保持此前列表和顺序，并显示错误。
+- 通过公共命令验证收藏唯一性、追加与重排、保存失败、重启恢复、旧文档兼容、订阅身份延续及消失、递归清理、不继承收藏、无运行状态收敛与时间戳变化。
+- 用原生应用验证平面 Table、列位置、详情按钮、选择清理、拖动落点、路径悬停和工具栏。自动测试与原生界面证据分别汇报。
diff --git a/docs/design/server-read-only-detail-and-edit-sheet.md b/docs/design/server-read-only-detail-and-edit-sheet.md
new file mode 100644
index 000000000..cfa19ccd0
--- /dev/null
+++ b/docs/design/server-read-only-detail-and-edit-sheet.md
@@ -0,0 +1,33 @@
+# 服务器只读详情与编辑 sheet
+
+日期：2026-10-06。交互决策与实现范围已确认。本文件记录本次任务规格，不代表当前代码现状。
+
+## 已确认交互
+
+- 详情显示已保存资料，采用分区标题与标签／值排版，不使用禁用表单控件。顶部显示名称、来源与活动目标标记；连接信息显示地址、端口和加密方式，文本可选择复制；插件区显示插件名称、可用性及参数；已知阻塞问题独立呈现。详情移除密码、保存与重置操作。
+- 插件参数沿用只读 table 的“参数名／值／类型”列，保留顺序、重复参数、开关与空值的区别。保留“参数列表／原始文本”切换，长值可从原始文本完整查看；不可解析时显示原始文本。未知或未安装插件仍显示已保存参数。
+- 详情不读取密码。参数在进入详情及当前服务器保存或对应订阅刷新成功后加载；读取失败仅影响参数区，提供“重新加载”，其他信息继续展示。切换服务器时不得显示上一服务器的参数。
+- 工具栏增加 `pencil` 图标编辑按钮，仅选中手动服务器时可用；手动服务器右键菜单增加“编辑…”，作用于被点击的服务器。订阅服务器工具栏编辑禁用，菜单省略编辑项。已知有阻塞问题的手动服务器仍可编辑。
+- 编辑 sheet 共用新建表单的字段布局、草稿映射与校验。底部为“取消／重置／保存”；有修改且成功装载可编辑服务器时才允许保存；重置恢复已保存值。保留已有凭据加载失败提示、重载和保存门禁。
+- 新建与编辑共用的表单滚动内容留出 8pt padding，避免焦点框被裁切；sheet 最小宽度为 580pt、建议宽度为 640pt，为参数列表留出更多空间。插件可用性分支与警告文案共用一份映射，未知引用的操作说明由各视图保留。
+- 保存成功关闭 sheet 并更新详情；失败保留草稿。提交期间禁止重复提交、重置和关闭。
+- 新建与编辑统一处理未保存修改：取消或 Escape 在有修改时显示“放弃更改？”，按钮为“继续编辑／放弃更改”；无修改直接关闭。其他可关闭 sheet 的路径采用相同放弃规则。
+- 编辑目标在打开时固定。每次重新打开读取最新保存值，关闭后不保留草稿；目录更新不覆盖当前编辑内容。目标被删除时禁止保存并提示。
+
+## Module 与 seam
+
+只读详情与编辑表单具有独立生命周期。详情从已提交配置获取展示事实，通过单独的参数读取 interface 获取已保存插件参数；参数读取失败不阻断普通事实展示。不得用读取完整 `ServerEditForm` 的方式满足详情需求。
+
+新建与编辑共用 `ServerFormFields` 和字段栅格；共用 sheet 的布局、提交门禁与放弃修改行为，创建／更新命令保持各自意图。sheet 在 `ServersView` 中持有固定的编辑身份，工具栏和右键菜单调用同一个编辑入口。避免为两种操作各复制一套校验和关闭规则，也避免建立仅转发既有命令的 adapter。
+
+只读参数视图复用解析与呈现能力，不复用编辑动作；保留旧数据的无损表示。参数明文仅在当前详情会话中持有，不加入非秘密投影或持久快照。
+
+## 验证范围
+
+验证详情不读取密码、参数独立加载及失败隔离、未知插件参数可见、切换服务器与订阅刷新行为。验证编辑目标固定、手动／订阅资格、草稿保留与重载、创建／保存成功关闭、失败保留以及放弃修改行为。按仓库要求执行格式、lint、相关 hostless 测试和构建；原生布局、table、sheet 与 Escape 交互需单独验证，不能以 hostless 测试代替。
+
+## 本次验证记录
+
+2026-10-06：格式化、lint 与 diff 检查完成；lint 有长度和复杂度等非阻断警告。全量 arm64 hostless 测试通过 958 个测试、1,038 次执行，零失败、零跳过；两组离线规则转换检查共 21 个测试通过。ad-hoc 应用构建通过。
+
+原生详情布局、table、sheet、Escape 与其他关闭路径尚未人工验证；上述测试与构建结果不等于原生 UI 或真实系统代理行为验证。本次不涉及 sslocal 运行契约调整，未运行 smoke。
diff --git a/docs/design/server-share-popover.md b/docs/design/server-share-popover.md
new file mode 100644
index 000000000..2df2c20f5
--- /dev/null
+++ b/docs/design/server-share-popover.md
@@ -0,0 +1,19 @@
+# 服务器分享 popover（2026-10-05）
+
+本文件记录本轮用户确认的规格。替代前一轮分享 sheet 的呈现设计；当前实现以代码为准。
+
+## 已确认决策
+
+- 点击服务器分区工具栏「分享」，在按钮旁打开原生 popover。移除「完成」按钮，点击外部或按 Esc 关闭；切换选中服务器时立即关闭。
+- 顶部依次显示已保存的服务器名称、地址与端口、加密方式、可选插件程序名。无插件时隐藏插件行；名称和地址单行显示、尾部截断。不显示密码或插件参数。
+- 打开时冻结顶部资料、分享 URI 和保存面板建议文件名；不读取编辑中的未保存草稿。
+- 布局为资料、分隔线、二维码、分隔线、三个操作。二维码保持 280×280 和白底衬底。
+- 操作采用系统分享菜单式左对齐整行按钮，悬停显示圆角底色，顺序为「保存二维码图片」（square.and.arrow.down）、「拷贝二维码图片」（doc.on.doc）、「拷贝 URI 链接」（link）。
+- 两个拷贝操作成功后保留约 2 秒「已复制」反馈；保存继续使用系统保存面板。图片未就绪时禁用图片操作；链接可直接拷贝。
+- 分享入口的可用性、二维码生成、图片剪贴板格式、PNG 保存和失败提示继续沿用现有行为。
+
+## 实现边界
+
+CatalogWorkflow 提供不包含秘密的 ServerSharePresentation 查询。ServersView 在显式分享命令中捕获资料和 URI；ShareServerPopover 自持二维码与反馈状态。平台效果继续经过 ImageClipboard、TextClipboard 和 QrImageSaver。
+
+现有 GLOSSARY「服务器分享」定义适用，无新增领域术语。这是可逆的 UI 呈现调整，不新增 ADR。
diff --git a/docs/design/server-share-sheet.md b/docs/design/server-share-sheet.md
new file mode 100644
index 000000000..650e5c56f
--- /dev/null
+++ b/docs/design/server-share-sheet.md
@@ -0,0 +1,26 @@
+# 服务器分享 sheet（2026-10-05）
+
+本文件记录本轮已确认规格（按用户提供的草图方向实现），现状以代码为准。
+
+## 需求
+
+服务器分区的「分享」由工具栏 popover（220×220 二维码 + 复制 ss:// 链接）升级为窗口 sheet，按草图布局：顶部说明文字、大幅二维码、三个纵向按钮（复制二维码图片 / 保存二维码图片 / 复制 ss:// 链接）。入口与可用性判据不变：仅服务器分区工具栏「分享」按钮，作用于选中的服务器叶子，无有效载荷即禁用。
+
+## 已确认决策
+
+- 呈现：popover 整体替换为 `.sheet(item:)`；打开时冻结分享载荷与建议文件名（`ShareContext`），sheet 生命周期内不随选择漂移；选中项变化时立即收起。Esc 与「完成」按钮均可关闭。
+- 二维码：显示 280×280，白底圆角衬底保证深色外观下的扫码对比度；后台线程生成，就绪前呈进度，图片动作禁用。生成参数不变（`QrCodeCodec.generatePNG`，CIQRCodeGenerator，纠错级 M，scale 8）。
+- 复制二维码图片：同一 pasteboard 写 PNG（规范类型）+ TIFF（兼容类型，附加失败不影响 PNG 已写入）；不附带 ss:// 文本。
+- 保存二维码图片：只提供 PNG，走 NSSavePanel；默认文件名取服务器显示名，路径非法字符（/ 与 :)替换为空格并去首尾空白，清洗后为空回退 `ss-qrcode`，统一追加 `.png`。
+- 复制反馈：两个复制动作成功后按钮文案短暂变为「✓ 已复制」约 2 秒，重复点击重置计时；保存由系统面板反馈，不做额外提示。
+- 按钮：四枚按钮（三个动作 + 完成）标签统一最小宽 260pt（略窄于二维码块，最长标签与反馈态均小于该值），居中排布，宽度不随文案切换跳变。
+- 术语：保存二维码图片文件属于「分享」，不叫导出（GLOSSARY.md 的导出保留给配置组/诊断报告文件快照）；新 seam 命名用 saver。GLOSSARY「服务器分享」条目已更新。
+
+## 设计
+
+- 新增平台 seam（与既有 TextClipboard / ConfigurationGroupFileExporter 同法，协议 + InMemory + AppKit adapter，`NSPasteboard`/`NSSavePanel`/文件写入仍集中在聚焦 adapter，守卫见 `PlatformEffectsArchitectureTests`）：
+  - `ImageClipboard` / `InMemoryImageClipboard` / `AppKitImageClipboard`：图片剪贴板写入。
+  - `QrImageSaver` / `InMemoryQrImageSaver` / `AppKitQrImageSaver`（含 `QrImageSaveDraft.suggestedFileName(from:)` 命名清洗）：二维码图片保存面板与原子写入。
+- `ShareServerSheet`（`ServersView+Share.swift`）自持二维码与反馈状态；错误沿用共享 `ErrorAlertPresenter` 呈现边缘（与 NewGroupSheet 同法）。
+- 注入链：组合根 `ApplicationDependencies` → `MainWindowView` → `ServersView` → sheet。
+- typed failure 在 `AppPresentation.message(for:)` 白名单登记：图片剪贴板写入失败、二维码图片写入失败。
diff --git a/docs/design/server-three-column-table.md b/docs/design/server-three-column-table.md
new file mode 100644
index 000000000..ecfa6a1e2
--- /dev/null
+++ b/docs/design/server-three-column-table.md
@@ -0,0 +1,79 @@
+# 服务器三栏视图
+
+状态：实现与自动检查完成（2026-10-09）；视觉及原生交互交给人工验证。
+日期：2026-10-09。
+
+本文记录本次任务的需求与设计决定，不代表当前实现。
+
+## 确定要求
+
+- 服务器页面使用三栏 `HSplitView`：左栏为来源边栏，中栏为服务器列表，右栏为原详情视图。用户后续要求用 `HSplitView` 替换最初批准的 `NavigationSplitView`。
+- 不修改原服务器详情与配置组详情。
+- 来源边栏只有「本地」和「订阅」。主窗口原「订阅」管理页面保留。
+- 「本地」展示手动来源的根层节点与后代，不展示虚拟目录根。
+- 「订阅」展示订阅组与后代。
+- Content 用 SwiftUI `Table` 展示层级，类似 Finder 列表大纲。
+- 三列为「名称」「创建时间」「修改时间」。名称列含配置组／服务器图标、左对齐的名称，以及右对齐的活动目标图标。
+- 活动目标图标只标记目标节点本身，包含配置组目标，不级联标记后代。保留无效服务器与包含无效后代的配置组的警告图标。
+- 单击选择节点，激活继续使用现有命令。列表保持单选。
+- 切换来源清空节点选择，详情显示原有空状态。
+- 默认展示目录顺序。列头排序只改变展示顺序，不改写目录；每组的直接子节点分别排序。
+- 拖动仅改变父分组，不提供同级重排。移除右键菜单「移动到…」。其余现有操作保留，继续调用 `CatalogWorkflow`。
+- 时间采用系统本地化日期和时间，精度到分钟；未知时间显示「—」。时间事实遵循 GLOSSARY「节点时间戳」与 ADR-0031。
+- 拖放仅接受手动分组与「本地」列表空白；空白代表目录根。新父分组不同才执行移动，移动后追加到目标目录顺序末尾。服务器、订阅节点、自身及后代均不接受落点。
+- 列头排序时，分组和服务器一起排序；未知时间始终排在最后，相等值保持目录顺序。
+- 折叠包含选中节点的配置组时，选择切换到收起的配置组，详情同步切换。
+- 创建、导入或订阅组复制产生手动节点后，切换到「本地」，展开其祖先并选择新节点。
+- 支持列宽调整，固定显示三列。名称列占剩余宽度，时间列初始宽度按日期文本确定。
+- 三栏保持显示；改用 `HSplitView` 后不提供 `NavigationSplitView` 的系统边栏显隐按钮。
+- 来源、排序与展开状态在本次运行内跨主窗口页面切换保留，不落盘。重启恢复「本地」、目录顺序和全部展开。来源切换仍清空节点选择。
+- 英文文案为 `Local`、`Subscriptions`、`Name`、`Date Created`、`Date Modified`。
+- 增加列表排序菜单；「无」表示不施加展示排序、按目录顺序展示。英文为 `None`。列头继续切换对应列的升序与降序。
+- 拖动移动成功后展开目标的祖先和目标分组，选择移动的节点，详情同步显示该节点。移到根层时无需展开目标分组。
+
+## 实施前代码核实
+
+- `ServersView` 使用 `HSplitView` 和扁平可见行 `List`。
+- `CatalogTreeNode` 已包含来源、父节点与子树，但尚未包含创建时间与修改时间。
+- `CatalogEntry` 已保存两个可空时间戳，无需重新定义时间语义。
+- 现有目录移动命令支持同父重排；新列表必须拒绝同父拖放。
+- 当前服务器管理的展开状态跨工作区页面切换保留，不落盘，重启全部展开。
+
+## 最终确认
+
+用户确认全部交互决定，并批准「无」的英文 `None`。用户要求使用 implement 流程，完成后提交当前分支；视觉验证交给人工，不由 Agent 执行。
+
+## Module 方向
+
+沿用 `CatalogWorkflow` 的 Interface 提供目录事实与变更命令。列表展示排序不进入目录持久化。树投影补充非敏感时间事实。视图持有来源、排序、展开和选择的呈现状态。具体 Interface 在交互规则确定后核实，不增加仅转发调用的 Module。
+
+浏览状态需由跨工作区页面切换仍存续的持有者管理；不能只放入随页面卸载的 `ServersView` 局部状态。来源与排序属于服务器页面呈现，不加入工作区顶层路由或持久配置。新 Table 直接使用节点身份驱动选择与展开，替换原扁平 List 呈现。保留原详情 View 与现有变更工作流。
+
+## 文档范围
+
+本次沿用配置目录、服务器配置、配置组、手动组、订阅组、活动目标与节点时间戳的既有定义，不新增领域术语。本次布局与呈现决定可以局部修改，不新增 ADR。
+
+## 实现验证范围
+
+- 核实非敏感树投影中的时间戳与来源筛选。
+- 验证每层排序、未知时间、相等值及目录顺序恢复。
+- 验证同父拖放不提交目录变更，跨父移动仍使用现有工作流。
+- 构建 macOS App，检查原详情与现有操作的编译集成。
+- 视觉与原生交互由人工验证：三栏、层级 Table、列宽、选择、展开、排序菜单与拖放。Agent 不执行视觉验证，构建与 hostless 测试不替代该证据。
+
+## 实现期间的补充决定
+
+- 排序按钮直接展开字段列表；Picker 使用 inline 样式，不产生额外「排序」子菜单。
+- 用户要求只给树展开图标设置最小宽度。名称列的展开按钮设置最小宽度 24 点、最小高度 28 点；图标不放大。
+- Table 的行由树投影按来源、每层展示排序与展开状态生成，名称列按深度缩进。展开按钮显式绑定既有展开状态，以控制点击宽度和折叠选择规则。
+- `TableRowContent.dropDestination` 不提供拒绝返回值，因此不使用该行级接口。统一 `DropDelegate` 借用原生 `NSTableView.row(at:)` 区分行与空白；无效行不得回退为根落点。AppKit Adapter 不替换 Table 或其 delegate。
+- 目录节点拖放使用本进程专用载荷类型，释放时再次核对载荷身份与移动资格。
+
+## 验证记录（2026-10-09）
+
+- 定向验证树投影时间戳、来源筛选、每层排序、未知时间最后、相等值稳定、折叠选择和同父移动拒绝。
+- Debug 构建通过；全量 hostless 摘要为 976 个测试通过、0 失败、0 跳过，包含 1062 次参数化执行。
+- 两组 Python 离线检查分别通过 4 项与 17 项。
+- 格式化和 diff 检查通过；SwiftLint 为 22 条非严重警告，严重违规为 0。ServersView 文件长度仍有警告。
+- code-review 的 Standards 与 Spec 两轴最终均为 0 项发现；初次发现的无效行落点问题在复核中关闭。
+- 原生拖放命中、菜单呈现、展开按钮点击区域与三栏视觉未验证，按用户要求由人工验证。
diff --git a/docs/design/server-tree-selection-and-creation.md b/docs/design/server-tree-selection-and-creation.md
new file mode 100644
index 000000000..b64ee9287
--- /dev/null
+++ b/docs/design/server-tree-selection-and-creation.md
@@ -0,0 +1,42 @@
+# 服务器树取消选择与新增入口
+
+日期：2026-10-04
+状态：交互约定已整体确认并授权实现；代码验证与审查完成情况见提交说明。
+
+本文记录本次任务的交互决定，不代表当前实现。领域术语沿用根目录 GLOSSARY.md。
+
+## 已确认决定
+
+1. 仅调整服务器管理页面的树列表和手动新建服务器／分组入口。首页树、导入入口和移动节点流程维持现有交互。
+2. 两个新增按钮单击直接按当前选择确定添加位置：手动组对应组内，服务器对应其手动父组，其余情况对应根。添加到根时可先清空选择。用户确认菜单增加了常用组内添加的操作成本，已要求移除菜单双路径方案。
+3. 点击列表中没有节点的空白区域取消选择。再次点击已选中行仍保持选择。
+4. 仅树列表有焦点时按 Esc 取消选择。文本编辑、表单与弹窗继续处理各自的 Esc。
+5. 取消选择显示已有的“未选择节点”详情，不改变活动目标。
+6. 取消选择沿用当前离开服务器详情的规则，直接丢弃未保存草稿，不自动保存、不增加确认弹窗。统一草稿保护不属于本次范围。
+7. 打开新增窗口保留原选择及原服务器编辑草稿；取消新增返回原详情。
+8. 添加位置在点击新增按钮或右键新增动作时固定。目标组随后失效时，提交报错并保留输入，不自动改到根。
+9. 新建服务器与新建分组成功后，统一选中新节点并展开其祖先组。离开原详情时遵循上述草稿丢弃规则。
+10. 已启动的保存继续作用于原服务器，不因取消选择或打开新增而取消。完成后不恢复旧选择、不抢占当前详情，失败按现有方式呈现错误。
+
+## 已确认文案
+
+工具栏按钮名称继续使用“新建服务器／新建分组”，英文沿用对应现有按钮名称。
+
+移除菜单双路径方案后，其专用的根级／组内新增中英文文案也一并移除。
+
+## 实现前代码事实
+
+- 新增目标规则：手动组对应组内；服务器对应其手动父组；无选择、根级服务器和订阅节点对应配置目录根。
+- 切换服务器会清空旧表单草稿并装载新值，没有未保存确认。取消选择退出详情分支，按当前草稿状态归属推断会丢弃草稿；尚未进行原生界面验证。
+- 新建服务器成功会选中新节点；新建分组成功保持原选择。
+- 新建分组显式记录打开时的父组；新建服务器父组目前在 sheet 构建时由选择计算。
+
+## 验证范围
+
+- 行为验证覆盖新增目标规则、打开时固定目标、目标失效拒绝、成功后的选择与祖先展开，以及晚保存完成不覆盖新详情。
+- 编译与静态检查验证源代码和本地化资源。
+- 用户明确要求本次不使用 computer-use、不做视觉验证。空白点击、树焦点下 Esc、文本／弹窗 Esc 优先级、新增按钮交互、打开并取消新增后原草稿保留，以及实际展开与选中效果保留为未验证的原生界面行为；代码测试与编译通过不代表这些交互已经通过人工验收。
+
+## 文档边界
+
+现有术语“配置目录”“配置组”“服务器表单草稿”和“活动目标”已足以表达本次需求，当前不新增术语。入口与取消选择方式容易调整，当前不另建 ADR。
diff --git a/docs/design/system-proxy-runtime-control.md b/docs/design/system-proxy-runtime-control.md
new file mode 100644
index 000000000..420b54306
--- /dev/null
+++ b/docs/design/system-proxy-runtime-control.md
@@ -0,0 +1,123 @@
+# 首页系统代理提示与修复
+
+**状态**：2026-10-01 已确认设计，已在提交 `4a0a72c` 实现（Issue #73）。领域决策见 [ADR-0022](../adr/0022-observe-system-proxy-differences-and-repair.md)，术语见根目录 [CONTEXT.md](../../CONTEXT.md)。
+
+## 目标与现状边界
+
+首页 RuntimeControlCard 的系统代理开关表达用户意图，旁边的状态与下方提示表达实际配置；外部修改不自动修复。提示提供用户解决当前问题所需的操作，不把失败结果与助手批准入口互相排斥。
+
+实现前，代码会在网络位置、服务和路径变化后自动应用，忽略单独的代理配置事件；健康失效时保留现有系统代理配置，卡片没有接口差异提示或修复按钮。提交 `4a0a72c` 已实现本文规则；717 项 hostless 单测通过，并通过替身渲染检查了卡片的长名称换行、批准入口与修复进度。以上不证明真实主机系统代理写入、权限批准或观察通知已通过验收。
+
+## 操作规则
+
+| 事件 | 目标行为 |
+| --- | --- |
+| 用户开启系统代理 | 后台入口与当前模式出口可用后，应用到当前网络位置的全部服务；等待就绪属于该次开启操作的延续 |
+| 用户关闭系统代理 | 清除所有网络位置、所有服务的完整代理配置，不恢复历史值 |
+| 用户关闭后台代理 | 系统代理意图若开启，则一并关闭，先清除再停止监听；系统代理意图已关闭时不清除 |
+| 外部修改代理配置 | 只检查、提示；不自动修复 |
+| 网络位置、服务或路径变化 | 只检查当前位置；不因这些事件自动应用 |
+| 保存本 App 的端口、系统代理例外等相关设置 | 系统代理开启且后台可用时自动应用；允许覆盖外部修改。未保存的编辑不触发应用 |
+| 后台失效或当前模式无可用出口 | 系统代理意图开启时，自动清除全部系统代理配置；保留两个开关的开启意图 |
+| 后台恢复健康且当前模式出口可用 | 系统代理意图仍开启时自动应用；允许覆盖暂停期间的外部修改 |
+| GUI 启动且系统代理意图开启 | 后台健康时只检查；后台不可用时自动清除，后续恢复健康再自动应用 |
+| GUI 启动且系统代理意图关闭 | 不应用、不清除 |
+
+普通断网本身不算后台失效。规则／全局模式要求可用活动目标；直连模式不要求活动服务器。已暂停或失败不会自动关闭开关。用户在暂停期间关闭系统代理后，后台恢复也不再应用。
+
+监控只在 GUI **进程运行期间**进行；关闭工作区窗口、保留菜单栏进程仍属于运行期间。退出 GUI 后不提供即时差异检测、提示或健康变化引发的系统代理操作；后台代理运行不因此停止。
+
+失败的应用、修复或清除不在后台反复重试。新的用户操作或健康恢复事件是新的触发；被动网络事件不是重试入口。
+
+## 接口差异
+
+“网络接口”文案指当前网络位置中的 macOS 网络服务，包括未连接的服务，并不采用终端命令地址选择器的 Wi-Fi／Ethernet 白名单。使用系统设置里可识别、可重命名的服务名称；名单完整换行，不用省略号隐藏接口。
+
+仅比较本 App 管理的代理字段：SOCKS、HTTP、HTTPS 的启用状态、地址和端口，以及 PAC、自动发现、简单主机名排除与例外等值。等价写入和不管理字段的变化不产生提示，也不判断修改者是谁。
+
+提示反映当前差异，不累积历史事件。外部恢复一致后移除对应名称，全部一致后撤下提示。新网络位置或新增服务尚未应用当前配置时，使用“尚未应用”文案，避免误称为外部修改；两类情况同时存在时分段列出，共用一个修复按钮。
+
+修复前重新读取当前位置与配置，只处理当时仍有差异的服务，跳过已经一致的服务，保留本 App 不管理的字段。修复完成后再次读取；写入成功本身不足以撤下提示或显示“已应用”。
+
+## 状态与操作
+
+| 当前状态 | 开关旁文字 | 开关下方内容 | 操作 |
+| --- | --- | --- | --- |
+| 关闭，且无操作失败 | 未应用 | 现有开启说明 | 无 |
+| 首次开启，等待入口就绪 | 待应用 | 等待本地入口与当前模式出口就绪 | 无 |
+| 当前配置一致 | 已应用 | 系统代理已指向本地入口 | 无 |
+| 外部修改，仍存在差异 | 配置已改变 | 已改变的接口名单 | 修复 |
+| 新位置／新增服务尚未应用 | 待应用 | 尚未应用的接口名单 | 修复 |
+| 正在应用／修复 | 应用中／修复中 | 保留相关接口名单 | 进度指示，禁止重复操作 |
+| 应用／修复失败 | 应用失败／修复失败 | 保留差异名单及失败原因 | 修复 |
+| 后台不可用，清除成功 | 已暂停 | 已清除，恢复后自动应用 | 无 |
+| 清除失败 | 清除失败 | 失败原因；后台不可用时点明后台状态 | 重试清除 |
+| 配置读取失败 | 无法检查 | 读取失败原因；不得继续声称已应用 | 重新检查（只读） |
+| 助手待批准，尚无失败结果 | 待批准 | 批准说明与路径 | 在登录项中批准… |
+
+失败结果可以在开关关闭后保留，特别是关闭操作清除失败时，不能用“未应用”掩盖残留设置。尚有差异而无操作错误时继续显示差异名单；读取失败时不能用缓存名单冒充已确认的当前事实。
+
+当前最需要处理的结果决定主要状态：清除失败优先于后台暂停，后台不可用时隐藏配置修复入口。后台恢复后重新检查实际配置。不额外弹通知，也不提供关闭差异提示的按钮。
+
+## 助手批准与失败组合
+
+操作结果说明发生了什么，阻塞原因提供解决入口。助手等待批准时，无论主要状态是清除失败、应用失败还是修复失败，都始终保留批准说明及按钮。隐藏当前无法执行的修复／重试按钮；若错误原因只是未批准，不重复展示同一错误。
+
+批准完成后的行为：
+
+- 已经失败的操作：移除批准说明，恢复“修复”或“重试清除”，不自动重试；结果保留至成功解决。
+- 首次开启且尚未执行的请求：继续原先用户发起的应用，仍受当前意图、健康与出口条件约束。
+- 新发生的后台健康恢复：按自动应用例外执行。
+
+## 布局与文案
+
+保留系统代理开关与右侧状态，在其下展示警告图标、提示、完整接口名单和操作。警告采用橙色，同时以图标与文字表达状态；按钮采用小尺寸原生按钮，放在名单下一行，不采用醒目的主操作样式。点击修复直接执行，不弹确认；修复中保留名单，按钮显示“修复中…”及进度并禁止重复点击。
+
+```text
+设置系统代理       [开启]   配置已改变
+
+⚠ 以下网络接口的代理配置已被改变：
+  Wi-Fi、USB Ethernet
+  [修复]
+```
+
+```text
+设置系统代理       [开启]   修复失败
+
+⚠ 以下网络接口的代理配置仍有差异：
+  Wi-Fi
+
+系统代理助手等待批准。
+请在系统设置 → 登录项与扩展中允许。
+[在登录项中批准…]
+```
+
+| 场景 | 中文文案 |
+| --- | --- |
+| 外部修改 | 以下网络接口的代理配置已被改变：{名称列表} |
+| 尚未应用 | 以下网络接口尚未应用当前系统代理配置：{名称列表} |
+| 修复失败后仍有差异 | 以下网络接口的代理配置仍有差异：{名称列表} |
+| 后台不可用，清除成功 | 后台代理不可用，已清除系统代理配置。恢复后将自动应用。 |
+| 后台不可用，清除失败 | 后台代理不可用，系统代理配置未能清除。 |
+| 修复失败原因 | 无法修复系统代理配置：{原因} |
+| 无法读取 | 无法读取网络接口的代理配置：{原因} |
+| 助手待批准 | 系统代理助手等待批准。请在系统设置 → 登录项与扩展中允许。 |
+| 操作 | 修复／修复中…／重试清除／重新检查／在登录项中批准… |
+
+英文候选已在设计访谈中展示；此文档先记录确认后的中文设计，不修改本地化目录。
+
+## 验收场景
+
+以下保留设计验收场景；已执行的验证范围见上方状态说明，不将替身测试或卡片渲染等同于真实主机验收：
+
+1. 外部修改一个或多个服务，仅出现一次实时差异提示，不产生自动写入；恢复一致后对应名称消失。
+2. 不管理字段变化或等价写入不产生提示；本 App 自身应用产生的变化不留下误报。
+3. 切换网络位置或新增服务只显示“尚未应用”；未连接服务仍参与检查与修复。
+4. 修复前某服务已恢复一致或当前位置已变化，操作基于重新读取的当前差异；成功后重新读取确认。
+5. 保存相关设置自动应用；失败保留结果，修复由用户重试，不由被动事件触发。
+6. 后台失效时清除全部位置且保留意图；清除失败不显示成功暂停；恢复后自动应用可覆盖外部值。
+7. 暂停期间关闭系统代理，恢复健康不再应用；关闭后台代理保留现有级联关闭行为。
+8. 健康启动仅检查；不健康且意图开启的启动清除；意图关闭的启动不写系统设置。
+9. 任意操作失败与助手待批准共存时，批准入口可见；批准后已失败操作不自动重试，未执行的首次开启可继续。
+10. 读取失败显示“无法检查”，重新检查不写配置；读取恢复后再呈现真实状态。
+11. 关闭工作区窗口仍监控，退出 GUI 不监控；再次启动按启动规则检查。
diff --git a/docs/design/terminal-command-address.md b/docs/design/terminal-command-address.md
new file mode 100644
index 000000000..d6c585fa9
--- /dev/null
+++ b/docs/design/terminal-command-address.md
@@ -0,0 +1,45 @@
+# 首页代理环境变量命令地址选择
+
+日期：2026-10-01。
+状态：已实现（issue #72）；交互设计与测试边界来自 grill-with-docs 会话，spec 已发布为 [Issue #72](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/72)。
+
+## 功能范围
+
+首页“复制代理环境变量设置命令”卡片在非“仅本机”监听方式下，在 zsh / bash 和 fish 两个复制按钮上方显示一个单选下拉框。仅本机模式隐藏下拉框并使用 IPv4 回环地址。
+
+所选地址同时用于两种 shell 命令的 HTTP、HTTPS 和 SOCKS 端点。端口取已保存的监听设置，现有 shell 语法、变量集合和 no_proxy 内容保持不变。IPv6 在 URL 中使用方括号。选择只改变生成的命令，不改变监听配置或系统代理。
+
+## 候选地址
+
+仅包含 loopback，以及本机当前启用的 Wi-Fi、Ethernet 接口的单播 IP。VPN、其他虚拟接口和其他接口类型排除；不能仅依据 BSD 接口前缀或通用 Ethernet 链路类型来接受虚拟接口。无法确认是允许类型的非回环接口不纳入列表。
+
+不提供手动输入，不提供通配绑定地址，IPv6 链路本地地址排除；IPv6 地址经 `SIOCGIFAFLAG_IN6` 查询内核标志，`IN6_IFF_TEMPORARY`（RFC 4941 隐私临时地址，会轮换）不进候选。IPv4 链路本地地址属于允许接口的单播地址时可以列出。候选列表不表示网络连通性已验证。
+
+| 已保存的监听方式 | 地址族 | 默认地址 |
+| --- | --- | --- |
+| 仅本机 | IPv4 回环；隐藏下拉框 | 127.0.0.1 |
+| 所有 IPv4 接口 | IPv4 | 127.0.0.1 |
+| 所有 IPv4 与 IPv6 接口 | IPv4、IPv6，包含两个回环地址 | 127.0.0.1 |
+| 仅所有 IPv6 接口 | IPv6 | ::1 |
+
+下拉菜单项主行显示 `{IP}`，副标题行显示「注记 - 接口名称」（无注记时仅接口名称；菜单项经 adaptive-controls 机制把两个 `Text` 桥接为 `NSMenuItem` 的原生 title/subtitle，注记与 ifconfig 同源，如 `autoconf secured`、`dynamic`）。收起状态只显示当前选中项的 `{IP}`，其下以说明行展示「接口：{接口名称}」与「地址类型：{注记}」（有注记时），便于识别地址稳定性。接口名称优先取 `SCNetworkInterfaceGetLocalizedDisplayName(interface)`；名称缺失或无法映射到 SystemConfiguration 接口时，回退到 BSD 接口名，但不会因此放宽接口类型过滤。回环项回退名称为 lo0。
+
+回环项置顶，双栈时 127.0.0.1 在 ::1 前。其余按接口名称排序，同一接口先 IPv4 后 IPv6，再按地址稳定排序。同一接口的重复 IP 合并；不同接口即使 IP 相同也保留接口身份。
+
+## 选择生命周期与刷新
+
+选择在本次应用运行期间保留，包括离开首页后返回；不跨应用重启持久化。进入首页、网络变化以及复制前刷新候选地址。监听方式变化时立即重新过滤候选。
+
+所选地址消失，或监听方式不再支持该地址时，回退到对应监听方式的默认回环地址。复制前刷新发现地址失效时，本次复制使用回退后的地址，界面与命令一致。
+
+地址枚举失败时仅保留兼容的回环项，继续允许复制。代理未运行时也允许复制；生成命令不承诺端点当前可连接。
+
+## 实现与验证边界
+
+地址枚举、接口名称及类型识别通过可注入的事实来源提供，UI 不自行访问底层控制器拼接命令。应用会话状态持有选中地址的接口身份和地址值，不使用界面显示名称作为身份。
+
+需要验证四种监听方式的候选过滤和默认地址、Wi-Fi/Ethernet/loopback 类型过滤、VPN/虚拟接口排除、名称回退、IPv6 URL、两种 shell 的共享选中地址、离开首页后保留、应用重启后重置、网络变化和复制前失效回退，以及枚举失败时的回环退化行为。用户明确不做视觉验收；系统接口映射通过非视觉验证核实。
+
+## 现有决策调整
+
+此设计扩展 ADR-0015 中“命令始终面向本机回环”的旧约定。实现时同步更新该 ADR 的命令地址段落以及 CONTEXT.md 中对应定义和约束；健康检查和系统代理目标仍由监听方式确定，不受命令地址选择影响。此项是可逆的首页交互调整，不新增 ADR。
diff --git a/docs/design/terminal-proxy-command-shell-formats.md b/docs/design/terminal-proxy-command-shell-formats.md
new file mode 100644
index 000000000..3ed5cb56b
--- /dev/null
+++ b/docs/design/terminal-proxy-command-shell-formats.md
@@ -0,0 +1,82 @@
+# 首页终端代理环境命令格式扩展
+
+日期：2026-10-14。
+
+本文记录本次设计访谈与实现验证，不作为持续更新的现状依据。当前地址、端口和身份验证规则以代码与 ADR-0034 为准。
+
+## 需求
+
+- 首页复制代理环境变量设置命令支持 Nushell。
+- 局域网监听开启且选择局域网 IP 时，支持 Windows：CMD 和 Windows：PowerShell。
+
+## 已确认的决策
+
+用户在第一轮访谈中选择全部推荐项。
+
+- Nushell 始终显示，支持本地地址与局域网地址。
+- Windows 格式仅在局域网监听开启且选择局域网 IP 时显示；条件不满足时隐藏。
+- 代理停止时仍允许复制，沿用已保存的监听设置。
+- 命令供用户直接粘贴到当前终端会话执行；不增加持久化命令，不支持 CMD `.bat` 文件。
+- 新格式沿用四个小写变量：`http_proxy`、`https_proxy`、`all_proxy`、`no_proxy`。
+- `no_proxy` 沿用 `localhost,127.0.0.1,::1,.local`。
+- 局域网命令沿用现有端口与凭据规则；IPv6 URL 使用方括号。
+- 保留纵向复制按钮。顺序为 `zsh / bash`、`fish`、`Nushell`、`Windows：CMD`、`Windows：PowerShell`，最多五个按钮。
+- 保留完整命令 tooltip 和按钮内“已复制”反馈。
+- 第二轮用户指定：复制前刷新发现所选 IP 失效时，所有格式统一停止本次复制，保留剪贴板，并提示重新选择 IP。不得把回退后的本地地址静默写入剪贴板。地址候选刷新和 Windows 格式显隐仍按最新监听事实更新。
+- 第二轮用户选择本地验证：执行本地测试与构建，覆盖格式生成、显示条件、凭据编码和地址失效。真实 Windows 执行与跨设备代理连接标为未验证，不列入本次完成条件。
+
+## 验收条件
+
+- 本地地址下提供 zsh/bash、fish、Nushell 三个按钮。
+- 局域网监听开启且选择有效局域网 IP 时，额外提供两个 Windows 格式按钮；代理停止不影响这一条件。
+- 新格式复制四个小写变量，HTTP/HTTPS 与 SOCKS 使用对应入口，`no_proxy` 内容不变。
+- 启用局域网认证时，URL 保留完整且正确编码的凭据；读取失败停止复制。
+- 所选 IP 在复制前失效时，每一种格式都停止本次复制，不改写剪贴板，不显示“已复制”，提示“命令地址已失效，请重新选择 IP。”。
+- tooltip 与对应格式的复制内容一致。
+- 本地测试与构建通过；终端执行与跨设备连接按实际证据分别汇报。
+
+## 实现前代码事实
+
+- `HomeView+Cards.swift` 提供 zsh/bash 和 fish 复制按钮；复制前刷新命令地址。
+- `TerminalCommandAddress.swift` 在地址失效时回退 `127.0.0.1`。
+- `ProxyControlAdapters.swift` 按命令地址选择本地或局域网端口；认证 URL 对凭据中的特殊字符作百分号编码。
+- 凭据读取失败时，现有命令返回失败，界面禁用复制。
+- ADR-0034 规定 tooltip 与复制内容均包含完整命令和真实密码。
+
+## 实现约束与验证边界
+
+- CMD 交互命令必须保留认证 URL 的百分号编码，不能让已有环境变量改变凭据。生成方式属于实现问题，不降低认证要求。
+- Nushell 与 PowerShell 使用各自的环境变量赋值语法；CMD 使用其交互语法，不采用 `.bat` 百分号转义规则。
+- 当前环境未找到 `nu` 和 `pwsh`。`wine --version` 执行失败，输出为 `zsh:1: bad CPU type in executable: wine`。这些事实不代表目标终端执行通过。
+- CMD 对含百分号编码的 URL 使用交互 `for %P in ("%") do set "NAME=VALUE"`，以 `%~P` 插入百分号；各变量分行赋值，不写临时环境变量。普通 URL 使用四个 `set` 以 ` & ` 连接。分行方案限制最长允许凭据下的单行长度。
+- 上述 CMD 输出通过命令字符串测试与静态审查；官方文档说明 `%~P` 移除外围引号、环境变量展开不递归。原生 Windows 的完整解析行为与同名变量干扰仍未验证，不把字符串断言视为终端执行证据。
+- 用户调用 `implement` 技能，授权按本文实现、审查并提交到当前分支。
+
+## 测试边界
+
+本地验证沿用第一轮与第二轮确认的格式、显示条件、凭据编码和地址失效范围：
+
+- `TerminalProxyEnvironmentCommands` 投影：精确命令、监听端口、IPv6 与凭据编码。
+- `ProxyControlWorkflow` 的 snapshot 与复制前准备：格式显隐、代理关闭、网络/监听变化及旧 IP 失效。
+- 测试通过公开投影与工作流动作观察结果，不调用私有生成器或 SwiftUI 私有方法。
+
+## 文档来源
+
+- [Nushell 环境变量](https://www.nushell.sh/book/environment.html)：`$env.NAME = 'value'`。
+- [PowerShell 环境变量](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_environment_variables)：`$env:NAME = 'value'`。
+- [CMD set](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1)：当前命令解释器的环境变量赋值。
+- [CMD](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/cmd)：命令连接与变量展开。
+- [CMD for](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/for)：交互循环变量与引号移除修饰符。
+- [CMD 命令行长度限制](https://learn.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/command-line-string-limitation)：单行最大长度为 8191 个字符。
+
+本变更为可逆的命令格式与界面扩展，不新建 ADR。
+
+## 本次实现与验证
+
+- 实现五种命令格式、按地址条件显示 Windows 按钮，以及所有格式共用的复制前地址身份检查。
+- Standards 与 Spec 两项只读代码审查均未发现问题。
+- 使用 `CODE_SIGN_IDENTITY=-` 执行 macOS arm64 全量 hostless 测试：1,059 个测试、1,162 次执行，0 失败、0 跳过。
+- 同配置 Debug 构建通过。
+- 外部二进制离线检查 5 个测试、规则快照检查 4 个测试、规则转换行为检查 17 个测试通过。
+- 修改的 Swift 文件通过严格格式检查；仓库 SwiftLint 返回 31 条警告、0 条严重问题。
+- 真实 Nushell、Windows CMD、Windows PowerShell、跨设备代理连接与原生界面交互未验证。剪贴板保留和失败反馈路径经静态审查，不将其描述为原生交互测试。
diff --git a/docs/design/third-party-components-window.md b/docs/design/third-party-components-window.md
new file mode 100644
index 000000000..7834a9473
--- /dev/null
+++ b/docs/design/third-party-components-window.md
@@ -0,0 +1,41 @@
+# 第三方组件与许可证窗口
+
+本文记录 2026-10-26 设计讨论中已确认的产品要求。用户随后授权按本设计实现；当前行为以代码为准。
+
+## 已确认的界面设计
+
+关于对话框的入口与新窗口统一命名为“第三方组件与许可证”。
+
+窗口采用双栏布局：左侧组件列表显示名称和版本；右侧展示元数据、可点击的来源链接，以及可选择、复制的完整 License 和附加声明。同一组件关联多份文本时分别展示，保留原文。
+
+使用应用自定义的简洁关于对话框替换系统默认关于面板，保留应用图标、名称、版本和版权信息，并加入“第三方组件与许可证…”按钮。点击后打开独立窗口。
+
+状态栏菜单也提供“关于 ShadowsocksX-NG2”入口，与应用菜单打开同一个关于窗口。
+
+关于对话框和组件窗口各保留一个实例，重复打开时置前。打开组件窗口后保留关于对话框，两者独立关闭；均不随启动自动打开。任一窗口仍开启时保留 Dock 图标，最后一个应用窗口关闭后回到菜单栏形态。
+
+组件按名称排序，默认选中第一项，支持键盘选择。第一版只提供浏览和文本选择复制，不增加列表搜索、正文搜索、筛选和导出。
+
+右侧使用单个连续滚动区域，依次展示元数据、License 和附加声明。每份文本保留标题或文件名及完整原文；长版本号和 URL 允许换行。聚合声明内的文件路径按原文展示，不解析成跳转链接。
+
+聚合声明引用的公共 License 全文在所属组件详情中单列“引用的公共许可证”小节，以文件名作为每份文本的标题，保留原文并支持选择复制。同一公共文件在当前组件详情中只展示一次；切换组件后，仍可在该组件详情中阅读其引用的公共文本。公共许可证不单独加入左侧组件列表，随包文件继续共享一份。额外的 NOTICE、版权或例外条款也完整展示。
+
+清单或关联文本读取失败时，整个窗口显示“第三方组件信息不可用”，沿用现有读取器的整体校验行为，不展示不完整清单或猜测资料；错误不影响代理运行，关于对话框仍正常使用。
+
+## 已核对的数据基础
+
+现有 `BundledDependencyCatalog` 提供统一随包清单与 UTF-8 文本读取能力，组件条目包含名称、版本、项目 URL、源码来源 URL、分发来源 URL、多份 License 和多份附加声明。版本可能是 tag 或完整 commit。
+
+依据 ADR-0054，仅直接依赖拥有结构化条目，传递依赖通过所属组件的聚合声明查看；资料离线读取，用户主动点击链接时才打开浏览器。窗口与插件设置复用该数据来源。
+
+当前读取器在加载时校验全部条目及关联文本，任意一项损坏会导致整个清单加载失败。
+
+元信息生成器已解析聚合声明引用的 `../third-party-licenses/*.txt`，将公共 License 正文及额外声明加入对应组件的 `notices` 引用，并去重；公共文本可直接通过现有读取入口获取。其存储在多个组件之间共享，不意味着需要在组件列表中创建独立条目。
+
+## 验收范围
+
+从关于对话框打开唯一组件窗口，重复打开置前；窗口可独立关闭，并参与现有应用形态管理。七个随包组件均离线展示元数据、完整 License、聚合声明和所引用的公共全文。检查共享文本去重、长标识换行、选择复制与数据损坏提示。界面沿用项目本地化方式，声明保留原文。
+
+自动测试覆盖生产展示数据入口的真实随包资源读取、去重和损坏资源拒绝；窗口布局、缩放、键盘操作与选择复制另行视觉验证。实施运行格式检查、lint、hostless 测试与 Debug 构建。
+
+关于对话框的版权信息按用户要求显示 `Copyright © Qiu Yuzhou`。
diff --git a/docs/design/unified-server-import.md b/docs/design/unified-server-import.md
new file mode 100644
index 000000000..d0ade5625
--- /dev/null
+++ b/docs/design/unified-server-import.md
@@ -0,0 +1,59 @@
+# 统一服务器导入入口
+
+日期：2026-10-04。
+状态：设计已确认（grill-with-docs 会话）；覆盖「SIP-008 文件导入」新增需求与既有三个导入入口的重构。
+
+## 需求与范围
+
+新增从 SIP-008 JSON 文件导入服务器配置，并把既有导入入口（ss:// 文本、二维码图片、旧版 Legacy 导入）收敛为一个统一导入面板。工具栏「导入」由三项 Menu 收敛为单个 Button（「导入服务器配置」，无省略号），直开统一面板。共通部分（来源分派、解码器复用、事务提交、结果聚合）构成一个共用深模块；成功与错误反馈统一。
+
+退役项：`ImportURLSheet`（含 TextEditor）、`QRImportSheet`（含识别列表确认态）、`LegacyImportSheet`、应用首次打开时主动弹出 Legacy 导入的特性（`WorkspaceHomeView` 的 onAppear 门控与 `LegacyImportAvailability.shouldOffer`）。
+
+## 统一导入面板（UI 规格）
+
+面板结构对齐草图：标题「导入Shadowsocks服务器配置」、右上角关闭（X）、拖放区、底部两个按钮。
+
+- **拖放区**：虚线圆角区域，图标 +「拖动文件到这里」+ 类型提示（二维码图片 / SIP008 JSON 文件 / 包含 ss:// 链接的 txt 文件）。支持多文件拖入；点击区域弹 `.fileImporter`（`.image`、`.json`、`.plainText`，允许多选）。
+- **落点提示**：拖放区上方显示「将导入到：{目录根 / 分组路径}」，随侧栏选中实时变化。
+- **按钮一「从剪贴板中导入 ss:// 链接」**：一键读取剪贴板文本、按行解析导入；不做 JSON 嗅探（按钮语义即 ss:// 链接）。
+- **按钮二「从旧版本 ShadowsocksX-NG 导入」**：按 `legacyImportState.completed` 显示为「再次导入旧版本服务器」；`snapshotFound == false` 时隐藏。点击直接执行 `workflow.importLegacy(reimport:)`（原 LegacyImportSheet「导入/再次导入」按钮行为），不再有中转确认表单。
+- **结果区**：面板下方，每次导入动作追加逐来源结果行：来源名（文件名/剪贴板/Legacy）+ 结构化结果。面板不自动关闭，成功与失败同位呈现。
+
+## 深模块接缝
+
+`CatalogWorkflow` 单一入口（UI 只认识这一个方法与结果类型）：
+
+```
+func importServers(from sources: [ImportSource], into parent: NodeID?) async -> ImportRunOutcome
+```
+
+- `ImportSource` = `.clipboardText(String)` | `.file(name: String, data: Data)`。
+- 来源分派按内容优先：可解码位图（ImageIO 事实，`CGImageSource`）→ 二维码；内容为 JSON 对象 → SIP-008；其余按文本逐行提取 `ss://`。JSON 判定为否后不再降级回 SIP-008 语义（版本不支持等按整份失败报出，不当作文本行）。
+- 解码器全部复用 Domain 既有实现：`SubscriptionDocumentParser`（SIP-008，传一次性导入会话 UUID 作作用域）、`QrCodeCodec`（二维码）、`SsUri`（文本行）。文本行的空白行跳过不报；失败行以原始切分下标点名。
+- 提交：每来源独立事务，凭据统一经 `CredentialWriteJournal`，目录提交失败整体回滚并报 `CommitError.credentialRollback` 语义。
+- 结果：`ImportRunOutcome` 逐来源携带成功（导入数、落点/新建根分组身份）/ 部分成功（添加数 + 逐行失败，沿用行号点名风格）/ 整体失败（typed 原因）。失败来源不产生任何目录变更。
+- Legacy 入口沿用 `importLegacy` seam，返回值由报告扩展为含新建分组身份的 `LegacyImportOutcome`（供成功后选中）；报告发布缝（`legacyImportReport`）随之移除。
+
+现有 `createServers(fromURIs:into:)` seam 被本入口吸收并删除，其凭据写入方式从「先写后删」改为 journal；对应测试迁移到新入口。
+
+## SIP-008 文件导入语义（ADR-0027）
+
+- 复用 `SubscriptionDocumentParser` 整份校验：任一记录无效整份拒绝，复用 `SubscriptionParseError` 文案。
+- 文档 ID（`servers[].id` 供应商 UUID、扩展分组 UUIDv5 ID）只作装配键解析树结构，目录身份全部 `.fresh()`；重复导入产生独立副本，不合并去重。
+- 文件根分组整棵挂入选中落点（`importTargetParent`：选中手动组→组内；选中服务器→其手动父组；无选中/订阅子树→目录根），来源为 `.manual`。
+- 根组名：扩展根组名 → 文件名去扩展名兜底 → 重名加「 2」「 3」后缀（沿用 Legacy 导入 `nextGroupName` 风格）；扁平回退（无扩展或扩展无效）时根组内容为全部服务器按文档顺序平铺。嵌套分组名为空时以「未命名分组」兜底。
+- 插件参数保真：`plugin_opts` 非空即建凭据引用并存入，即使 `plugin` 为空（激活语义按 `pluginNotProvided` 点名，用户可修复）。
+
+## 统一反馈
+
+- 成功：「已导入 N 台服务器到『{分组名}』」（Legacy 来源映射 `LegacyImportReport`：导入数、跳过记录、身份重生成统计）。
+- 部分成功：「已添加 N 台服务器」+ 失败明细逐条点名（文本来源按行号；二维码来源按图片点名「未识别到 ss:// 二维码」）。
+- 整体失败：typed 原因文案（SIP-008 解析错误复用订阅解析文案族；文件不可读、剪贴板无可识别内容等新增原因）。
+- 任一来源成功后，侧栏选中切换到该来源新建的根分组（多来源全成功时选最后一个成功的分组）。
+- Legacy 反馈走同一结果区，但 seam 不变（直连 `importLegacy`），其报告语义与统计口径保持原有定义。
+
+## 测试边界
+
+- 深模块接口测试：三种来源的解码分派、SIP-008 整树导入（嵌套分组、顺序、命名兜底与后缀）、整份拒绝、部分成功的行级点名、来源间独立性（一个失败不影响其他来源提交）、凭据 journal 回滚、落点规则。
+- 迁移：原 `createServers(fromURIs:)` 测试改走 `importServers` 的文本来源路径。
+- 退役路径删除测试随实现一并移除（deletion check）；Legacy 工作流测试（`importLegacy` 语义）不变。
diff --git a/docs/design/user-plugin-catalog.md b/docs/design/user-plugin-catalog.md
new file mode 100644
index 000000000..3c5760cf6
--- /dev/null
+++ b/docs/design/user-plugin-catalog.md
@@ -0,0 +1,139 @@
+# 有效插件目录：实现规格
+
+日期：2026-10-04。
+
+状态：候选 1 的领域规则已确认并授权实现。当前交付范围为目录、持久化、接线与安全检查事实；用户明确选择管理 UI 后续实现。候选 2 的表单接入与候选 3 的提交接入是功能落地所需的相邻工作，不表示通用架构重构。此文记录本任务规格，当前实现仍以代码为准。
+
+## 已确认的行为
+
+- 用户维护当前 macOS 用户的本机插件名称到可执行文件路径的映射；只持久化用户新增与 override，不复制 managed 默认值。
+- 名称区分大小写、精确匹配。新增名称去除首尾空白并拒绝空名称；导入的名称引用保持原样。
+- 用户映射优先于同名托管插件。override 不可用仍阻断该名称，不静默退回 managed；删除 override 恢复当前 app 的 managed 默认值。
+- 路径必须为绝对文件路径，允许符号链接。保存新增或修改的路径时要求目标当前存在且可执行；不运行插件，不解析 shell 命令、PATH 查找、相对路径或带参数的命令。
+- 用户映射的有效来源不继承 managed 文件的版本、许可证或签名声明。
+- 改名视为删除旧映射、添加新映射，不改写服务器配置与订阅。路径修改影响引用同一名称的所有服务器，包括订阅服务器。
+- 保存后发布有效目录、刷新激活候选并异步收敛。运行失败不撤销已保存映射。
+- 不监控同路径二进制替换，不据此自动重启。新的激活或代理启动重新检查文件；用户可关闭再开启代理使用同路径的新文件。
+- 安全检查异步提供隔离标记、签名与策略评估事实；不因这些事实拒绝保存或激活，不自动移除隔离标记、重签或修改系统策略。检查失败或不适用不等于安全或禁止运行。
+
+## 当前代码的摩擦
+
+| 当前位置 | 当前事实 | 需要改变的内容 |
+| --- | --- | --- |
+| `Domain/ManagedPluginProviding.swift` | 名称到路径的现有 seam 已被校验和激活使用；bundle adapter 检查文件可执行性 | 保留窄解析 seam，托管供应链事实不承担整个有效目录的职责 |
+| `Domain/ActivationStateMachine.swift` | 校验和生成运行条目分别调用 provider | 同一次派生读取同一个捕获快照，避免两次查询读到不同映射或文件检查事实 |
+| `App/CatalogWorkflow/CatalogWorkflow.swift` | 直接以静态 managed 集合分类、加载参数和校验保存 | 改为有效目录事实；未知引用仍可保留，已映射引用可编辑参数 |
+| `App/CatalogWorkflow/CatalogWorkflow+URI.swift` | `.unknown` 不更新插件引用及选项 | 不再用托管身份代表可编辑性；保留未解析引用的无损编辑行为 |
+| `App/MainApp.swift`、`App/ProxyRuntimeController.swift`、`App/DiagnosticsWorkflow/DiagnosticsWorkflow.swift` | 生产读取者独立构造 bundle provider | 组合根装配一次插件目录 module，并向各读取者提供相同已提交映射来源 |
+| `App/CatalogCommitCoordinator.swift` | 捕获服务器目录快照；只在目录提交时安排同步 | 映射变更有自己的保存入口；复用运行时，不伪造服务器目录提交 |
+| `App/ProxyRuntimeController+Convergence.swift` | preparation 代次使旧派生失效；运行配置字节不变可跳过部署 | 发布映射时使旧插件派生失效，保留有效值不变的幂等行为 |
+
+## Module 与 interface 提案
+
+以下名称为拟议代码标识符；实际文件布局可随实现收敛。目标是让覆盖、文件事实与提交时序获得 locality，而非给每条规则创建 shallow module。
+
+### 有效插件目录 module
+
+拟议 `PluginCatalog` 是组合根拥有的单一 module。只向调用者提供：
+
+1. 捕获当前有效目录快照，供表单、校验、激活及诊断读取。
+2. 保存一组明确的用户映射变更，包括新增、更新、删除与改名组合。
+3. 观察已提交目录变更及安全检查事实。
+
+调用者不自行合并 managed 与用户映射，不直接改磁盘文件，也不拼接保存、刷新 projection 和运行重启步骤。存储与 macOS 检查 adapter 在 module 内接线；生产文件 adapter 和测试确定性 adapter 构成实际 seam。
+
+拟议 `PluginCatalogSnapshot` 是只读值，包含已提交映射代次与各已知名称的有效来源、路径可用性及独立的托管发布事实。快照不表示文件永久可执行，也不表示远端连接、SIP003 兼容性或系统许可得到保证。
+
+名称到路径的 interface 仍保持一个查询。建议把 `ManagedPluginProviding` 一次性改名为 `PluginExecutableResolving`，并让快照满足该 interface；不长期保留一层兼容转发 module。已有 `NoManagedPluginProvider` 与测试 provider 按同一 seam 调整。
+
+解析结果由有效目录保留原因事实：未映射、文件缺失、非可执行文件、文件检查失败。现有激活 interface 可以继续把失败归入本地插件不可用原因；细化原因不要求改动 sslocal 的运行配置结构。
+
+### 快照与文件事实
+
+- 捕获快照时对已知名称的有效路径检查一次；查询仅查捕获结果。校验与运行条目生成共享该快照。
+- 已有快照用于一次 projection 或派生，不缓存成整个会话的永久可用性结论。
+- 新激活、代理启动和映射发布后的重校验捕获新快照；只检查有效路径，不因为用户 override 失效而检查并选用 managed 路径。
+- 符号链接保存用户选定的路径；文件检查跟随链接，不能用链接本身的存在性替代目标的可执行性。
+- “存在且可执行”还必须排除目录；路径作为进程参数或系统调用参数传递，不能拼入 shell 命令。
+- 不通过快照承诺消除文件检查与实际执行之间的文件变化；最终执行结果仍属于运行时事实。
+
+## 持久化与提交
+
+建议增加独立 `plugins.json`，放在既有用户配置目录，通过 `AtomicFileWriter` 原子写入。文件只包含格式版本和用户名称—路径条目；managed 清单仍随 app 发布。
+
+一组变更作为一次保存单位：规范化并验证本次新增或修改条目 → 在已提交副本上应用变更 → 原子写盘 → 发布新映射代次 → 重建有效目录与服务器 projection → 安排异步运行收敛。
+
+- 同名新增不得静默覆盖已有用户条目；更新已有条目必须由明确更新操作表达。对 managed 名称新增用户条目就是 override。
+- 改名包含旧名删除和新名新增，作为一次原子变更；新名称冲突不允许悄悄覆盖另一用户条目。
+- 只校验本次新增或修改路径。既有失效映射允许保留，也允许删除，不能因为另一个文件失效就阻止用户修复无关条目。
+- 文件可执行性检查失败拒绝本次新增或修改；安全预检不延迟或决定保存成功。
+- 存储失败不发布快照、不刷新 projection、不安排运行收敛。运行失败保留保存结果。
+- 无变化保存可以不产生新代次；重新激活与重新开启代理仍检查当前文件。
+
+读取异常的实现建议：文件不存在表示没有用户映射；文件损坏、不可读或未知格式版本不能伪装成空映射，因为这可能意外启用被覆盖的 managed 文件。应保留错误事实，阻断依赖插件的自动派生并允许用户显式修复；不使用插件的服务器不受此错误影响。此失败处理已由用户确认。
+
+## 映射变更与运行状态收敛
+
+- 映射发布立即让后续读取捕获新代次，并使旧的运行派生失效；仅在异步任务结束时忽略结果不足以保护旧运行契约写入。
+- 复用 `ProxyRuntimeController` 现有 preparation 代次与收敛入口。映射、服务器目录、规则及代理意图变化仍受同一运行时失效检查约束，不能为插件另造一套独立进程部署逻辑。
+- 最新保存发生在运行任务中途时，保存可完成；在途任务不能晚到写入旧路径，随后安排最新目录的收敛。
+- 目录重校验使用最新已提交服务器目录和本次插件快照；不修改订阅字段、服务器身份、凭据引用或分享格式。
+- 未受影响的活动目标不因新增无关名称而重启；有效运行配置不变时沿用现有幂等判断。
+- 活动组仍可跳过失效成员；目标没有可用服务器时沿用现有目标失效处理，不引入静默服务器替代。
+- 表单只更新插件事实，不重载并覆盖未保存的服务器字段或参数草稿。
+
+## macOS 安全检查 adapter
+
+拟议 `MacOSPluginInspection` 把系统检查输出转换成结构化事实，而非把命令输出直接呈现或导出。
+
+- 文件下载隔离标记：存在、未发现、读取失败。
+- 签名：有效、未签名、签名无效、检查不适用、无法判断。脚本及其解释器不等同于一个 Mach-O 文件，不能默认要求所有可执行文件都有 Developer ID 签名。
+- 系统策略评估：接受、评估拒绝、不适用、检查失败。独立工具的评估上下文限制必须保留，不能把 `spctl` 的非零退出统一映射成实际执行禁令。
+- 只读检查在后台执行，带超时与受控输出大小，不随每次视图重绘重复执行；无须新建定时轮询或文件监控。
+- 结果绑定映射代次、名称和所检查的目标文件事实。映射或目标文件变化后，旧结果不得显示在新目标上；检查完成时重新核对相关事实，不能把文件身份未确认的结果当成当前结果。
+- 保存后可安排检查；新的激活 / 启动检查及启动失败后的复查不得直接执行用户插件作为探测。
+- 普通退出、超时或被 signal 终止不足以证明安全策略阻止。仅有明确证据才能显示确认阻止；证据不足显示启动失败和辅助检查事实。
+- 插件由 sslocal 启动，现有 GUI / agent 不一定直接得到其系统执行拒绝原因；本轮不为了强行归因解析任意原始日志，也不修改上游 sslocal。
+- 本机 UI 可显示路径并提供 Finder 定位；诊断报告仍不导出路径、原始检查输出或插件参数。用户插件没有自报版本验证，因此有效来源不能继承 managed 的版本声明。
+
+依据（2026-10-04 查阅，属于外部能力资料，不表示已有实现）：
+
+- [Apple TN2206：签名验证与 Gatekeeper 的区别](https://developer.apple.com/library/archive/technotes/tn2206/)
+- [Apple Code Signing Tasks：系统策略评估](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html)
+- [Apple：安全打开 Mac 软件](https://support.apple.com/en-nz/102445)
+
+## 相邻 module 的接入范围
+
+候选 2：调整 `PluginSelection` 与 `PluginSectionState`，让服务器引用与实际来源独立；读取有效目录的名称选择和可用性。未知引用无损保留；对应映射新增后加载原有参数；映射删除后不删除引用及钥匙串参数。保留现有 `PluginOptionsDraft` 与 `CredentialWriteJournal`。
+
+候选 3：映射提交 module 负责保存、发布与安排收敛；复用现有原子写盘与运行时，不先建立跨所有设置的通用协调框架。具体管理页面位置、编辑交互与中英文提示文案尚未确认，不属于当前已确认的候选 1 领域合同。
+
+## 验证矩阵
+
+测试通过调用者使用的 interface 观察行为，新增 hostless 测试默认使用 Swift Testing；临时目录及文件只占用进程私有资源。
+
+| 验证面 | 必须观察到的行为 |
+| --- | --- |
+| 有效目录 interface | managed 默认值、新名称、大小写区分、同名 override、删除恢复当前 managed、失效 override 不回退 |
+| 文件 adapter | 普通可执行文件、目录拒绝、缺文件、权限丢失、符号链接可用及失效、文件检查失败 |
+| 保存 interface | 路径规范与名称冲突、改名原子性、只校验改动条目、保存失败不发布、无变化幂等、重新加载恢复用户映射 |
+| 读取异常 | 缺文件与损坏不同；损坏不使 managed override 消失；显式修复后恢复插件派生 |
+| 服务器表单 interface | 用户插件创建 / 编辑、unknown 映射后参数可见、删除映射保留引用和参数、订阅仍只读、刷新不覆盖草稿 |
+| 激活 interface | 快照路径进入运行配置、组跳过失效成员、无有效成员沿用失败处理、不修改分享与订阅内容 |
+| 收敛 interface | 保存完成不等待运行健康；运行失败不撤销保存；A→B 连续保存旧运行写入受抑制；无关映射不重启；关闭代理期间旧任务不复活代理 |
+| 检查 adapter 的确定性替身 | 隔离 / 未签名 / 拒绝为提示；不适用及失败不误报；超时不挂起保存；旧结果不覆盖新目标 |
+| 诊断 interface | 来源与有效路径选择一致；用户文件不继承 managed 版本；路径与原始输出不进入报告 |
+
+继续保留有价值的 bundle 文件检查与清单锚点测试；新增有效目录行为覆盖后，移除仅固化静态 managed 分类的重复断言，不叠加一套测试保留相互矛盾的旧合同。
+
+hostless 测试不证明真实 Gatekeeper 行为。实现后需单独用本机受控夹具核实签名、隔离与独立工具评估的呈现；实际 sslocal 子进程、native UI 与系统安全提示分别报告，不能用 fake 检查通过替代。
+
+## 实施顺序与审阅点
+
+1. 有效目录值、用户映射模型、文件 adapter 与持久化；先证明解析优先级、文件事实和读取异常。
+2. 在组合根统一注入；校验与激活捕获固定快照，诊断读取相同来源事实。
+3. 表单引用接入与提交发布；证明异步过期任务不能写回旧运行配置。
+4. macOS 检查 adapter 与提示事实；管理 UI 布局和本地化另行确认后接入。
+5. 聚焦测试、既有相关回归、构建与独立本机证据。若新增工程结构，遵循 XcodeGen 的 `project.yml`，不手改 `.xcodeproj`。
+
+本文没有引入插件下载 / 安装 / 升级、插件参数语义验证、文件监控、自动重签或系统安全策略修改；没有修改 frozen Legacy，也没有发布 GitHub Issue 或推送。实现按用户授权在当前分支作本地提交。
diff --git a/docs/design/user-plugin-form.md b/docs/design/user-plugin-form.md
new file mode 100644
index 000000000..655a08c83
--- /dev/null
+++ b/docs/design/user-plugin-form.md
@@ -0,0 +1,17 @@
+# 用户插件表单目录事实
+
+2026-10-05 候选 2 的已确认实施范围，基线 `128efcc`。本文记录本次任务规格，不代表持续维护的项目现状。
+
+- 表单只接收目录派生的名称、来源和可用性事实，不依赖 managed 发布清单、不保留兼容回退，不携带本机可执行文件路径。
+- 来源不参与服务器引用身份，不增加来源标签，用户覆盖不继承托管版本信息。
+- 新建、编辑和订阅只读表单都根据当前所选名称展示缺文件、不可执行、文件检查失败或映射读取失败的提示；不可用映射仍可保存服务器引用，激活校验负责阻断。
+- 未解析引用和已保存参数沿用现行保留规则；映射新增、删除或同名覆盖切换不得覆盖未保存参数和其他服务器字段。
+- 非敏感 presentation 保留完整目录事实，但参数明文为空。
+- 未解析引用提示采用：未找到插件“%@”。引用和已保存参数将保留；可添加同名用户插件，或改选其他插件或“无”。
+- 文件缺失提示采用：插件文件不存在，请检查用户插件路径或应用安装。
+- 不可执行提示采用：插件文件不可执行，请检查文件类型和执行权限。
+- 文件检查失败提示采用：无法读取插件文件信息，请检查路径和访问权限。
+- 映射读取失败提示采用：无法读取用户插件映射，插件暂不可用。请修复映射后重试。
+- 对应英文采用本次对话已批准的五组文案，维护于 Localizable.xcstrings。
+- 验证 seam 为 CatalogWorkflow 的新建/编辑/展示 interface 及 ServerFormFields 的装载、草稿编辑与展示刷新 interface。
+- 本轮不实现插件管理 UI、来源标签或系统安全检查提示展示。
diff --git a/docs/design/user-plugin-management-ui.md b/docs/design/user-plugin-management-ui.md
new file mode 100644
index 000000000..a04bb0a0b
--- /dev/null
+++ b/docs/design/user-plugin-management-ui.md
@@ -0,0 +1,16 @@
+# 用户插件管理 UI（2026-10-05）
+
+本文件记录本轮已确认规格，现状以代码为准。
+
+- 设置视图底部新增“插件”区域，统一展示内置与用户插件；同名覆盖占一行，区分内置、用户添加、用户覆盖。
+- 行展示名称、来源、单行中间截断路径（悬停完整内容）及异常；直接提供覆盖、编辑、删除或恢复内置按钮，无只有删除的更多菜单。
+- 新增、编辑和覆盖使用 sheet。新增名称/路径为空；编辑名称只读、路径预填；覆盖名称只读、路径为空。选择文件仅填路径。
+- 字段为插件名称 / Plugin name、可执行文件路径 / Executable path；按钮选择文件… / Choose File…、取消 / Cancel、保存 / Save。
+- 不支持改名。空名称、用户重名、非绝对路径在字段旁提示；保存重新检查文件存在且可执行。同名内置允许覆盖并提示。
+- 保存失败保留 sheet 与草稿；写入成功关闭。运行时异步应用，失败不回滚映射，沿用运行时错误入口。
+- 取消/Escape 直接丢弃草稿，再次打开读取已保存值。
+- 删除与恢复内置都需确认；说明服务器配置保留，删除可能令原名称不可用，恢复后使用内置插件。
+- 安全提示给出隔离、签名、策略的具体证据，允许展开详情；不声称能保证是否允许运行、不阻止保存、不自动解除隔离。检查无法判定时明确提示。
+- 映射读取失败隐藏列表与修改按钮，展示错误与重试读取。重试仅读取配置，不整体重置。
+- 进入设置、设置可见时应用重新激活、保存/删除后刷新文件可用性及安全事实；另提供刷新按钮。不添加文件监听。
+- 复用组合根现有 PluginCatalog，不另建持久化目录实例。
diff --git a/docs/design/user-plugin-mapping-commit.md b/docs/design/user-plugin-mapping-commit.md
new file mode 100644
index 000000000..140748ae9
--- /dev/null
+++ b/docs/design/user-plugin-mapping-commit.md
@@ -0,0 +1,20 @@
+# 用户插件映射提交回归（候选 3）
+
+本文件记录 2026-10-05 用户确认的任务范围，基线为 `e74f8df`，仅作任务历史，不代表后续代码现状。
+
+## 已定范围
+
+保留 `PluginCatalog` 为映射提交 module，通过其 `commit` interface 验证验证、原子保存、发布、重校验与后续运行收敛。目录工作流和运行控制器作为集成观察面，不新增提交框架或进程启动 adapter。
+
+- 保存失败不得改变已提交映射、代次或目录投影，也不得触发运行应用。
+- 运行应用失败不得撤销保存；重建目录后仍恢复用户保存的映射。
+- 连续 A→B 保存以 B 为最终意图；尚未开始的旧任务不得应用 A，已在运行的旧任务不得覆盖 B 的最终运行状态或契约。
+- 映射变化立即重校验配置组成员；无效成员不参与运行，仍有有效成员时保留活动组目标。
+- 无关映射变化与相同映射提交不得重启健康且契约一致的代理。
+- 同一快照指同一已提交映射代次；文件可用性在每次激活或运行派生时重新检查。
+
+只修复回归揭示的问题。不增加文件监听、文件替换自动重启、逐次映射保存的应用结果记录或管理 UI。运行失败继续由既有控制器状态呈现。
+
+## 验证
+
+采用进程私有临时目录、真实映射和运行文件存储、注入的 LaunchAgent 与可控健康探测。测试不会运行用户插件或修改真实系统代理。新增测试默认 Swift Testing；异步交错用已有 gate，不使用任意等待。
diff --git a/docs/development.md b/docs/development.md
new file mode 100644
index 000000000..8985bb38e
--- /dev/null
+++ b/docs/development.md
@@ -0,0 +1,121 @@
+# Development, Build, and Testing
+
+[Project home](../ShadowsocksX-NG2/README.md) | [简体中文](development.zh.md)
+
+Unless noted otherwise, run commands from `ShadowsocksX-NG2/`; paths in this document are relative to that directory.
+
+## Unified validation
+
+Run the unified validation workflow from the repository root:
+
+```bash
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml validate
+# Run only the requested stages, in the specified order:
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml validate -- format:check lint test
+```
+
+From the project directory, use `task --exit-code validate`. From any directory, use `task --exit-code --taskfile /path/to/ShadowsocksX-NG/ShadowsocksX-NG2/Taskfile.dist.yml validate`. The entry point locates the project directory relative to the Taskfile and invokes individual tasks from the distribution Taskfile.
+
+By default, stages run in this order: `lint → test → build`. Real-process smoke tests remain available as the explicit `test:smoke` stage. Formatting is not part of the default validation loop; pre-commit controls local formatting, and CI invokes `task --exit-code validate -- format:check` in a separate step on the Xcode 27 arm64 runner to match the Swift 6.4 formatter baseline. You can select a subset in a specified order; each stage can appear at most once. Execution stops on the first failure, marks later stages `not_run`, and exits nonzero. `--exit-code` makes Task pass through the stage's exit code. Without it, Task still exits nonzero but may use its own error code. The entry point does not retry automatically, change test parallelism, or run formatters that modify source files.
+
+### Validation artifacts and evidence
+
+Each local `validate` run creates a separate `.build/validation/<UTC time>-<random suffix>/` directory and prints its absolute path at the start and end. `summary.txt` records each stage's status, exit code, and evidence status. For every executed stage, the corresponding subdirectory contains a combined stdout/stderr `raw.log` and a `status.txt` (`test:smoke` uses `test-smoke/`); Xcode stages also save `result.xcresult`. The console shows progress and a summary. Read the corresponding logs for complete errors. All artifacts are inside existing ignored directories. `task clean` deletes them, so copy anything you need to keep.
+
+CI runs three independent jobs on Xcode 27 arm64: `style` checks formatting then lint, `build-test` builds the app then runs hostless tests and offline checks, and `smoke` runs real-process tests. Each check is a separate step through `task --exit-code validate -- <gate>`, with its own retained run directory. A failed step skips later steps in the same job without stopping the other jobs. The build and test steps share DerivedData, and compiler warnings are errors. A local composite action prepares dependencies; `style` installs only Task and SwiftLint and does not fetch external binaries. Failed jobs upload retained validation logs, summaries, and result bundles for seven days under `validation-<job-id>`. Read the uploaded `summary.txt` and `test-summary.json` first; complete gate output is retained in `raw.log`.
+
+For test stages, the workflow uses the local `xcrun xcresulttool get test-results summary` and system `plutil` to read test counts on a best-effort basis; it adds no scripts or tool dependencies. `test-summary.json` stores the raw summary, `test-summary.stderr.log` stores xcresulttool errors, and `count-reader.log` stores count-reading errors. The summary shows passed, failed, skipped, expected-failure, and total counts using Xcode's summary semantics; parameterized tests may have a different actual execution count. Stage and overall exit codes come from the original command, and a failed command always remains a failure. A missing result bundle or unreadable summary is marked `evidence incomplete`, with counts shown as unknown. This does not change the command result, and missing counts are never reported as zero. Build stages do not read test counts; a stage that did not run is not the same as a skipped test.
+
+A successful unified run means the selected stage commands passed; still check that the evidence is complete. Acceptance boundaries remain separate for hostless tests, real-process smoke tests, native UI, and the real system proxy. See [Signing and distribution](distribution.md#release-gate) for release packaging requirements.
+
+`task test` and `task test:smoke` explicitly enable the Xcode per-test timeout: 120 seconds by default, with a 300-second maximum. This is a runner fallback. It does not guarantee normal test-task cleanup and is not a performance threshold. If a rule-stage wait fails, the test body throws and exits. Protected test tasks release their fixtures before cancellation and wait for task completion. Rule-delay gates and synchronous blocking fixtures have a default wait limit of 10 seconds and must report a failure on timeout. The shared `AsyncGate` preserves cancellation semantics controlled by each test. Swift Testing detached-worker timeout reports retain the creating test's name and source location. Check both the command exit code and test counts; a passing count for one test alone does not establish success.
+
+## Common tasks
+
+For routine formatting, static checks, project generation, builds, and tests, prefer the tasks defined in `Taskfile.dist.yml` and run them from the project directory:
+
+```bash
+task format
+task format:check  # Check formatting without modifying source files.
+task lint
+task lint:fix  # Use for automatic SwiftLint fixes; run task lint afterward.
+task gen:prj   # Generate the Xcode project.
+task build     # Build the Debug app; compiler warnings are errors.
+task test      # Run unit tests; compiler warnings are errors.
+task test:smoke  # Run real-process smoke tests (launches real sslocal; see the release gate in the signing and distribution guide).
+```
+
+All check, build, and test tasks use strict options directly. `lint` and `lint:fix` use SwiftLint's `--strict`, so warnings fail those tasks. `test`, `test:smoke`, `build`, and `build:release`, including calls from `package`, set `SWIFT_TREAT_WARNINGS_AS_ERRORS=YES` and `GCC_TREAT_WARNINGS_AS_ERRORS=YES`. They also set `SWIFT_SUPPRESS_WARNINGS=NO` to avoid conflicting Swift compiler options in package dependencies, whose warnings are checked too. `format:check` uses `swift format lint --strict`. These options cannot be disabled through a Taskfile variable. Diagnostics explicitly suppressed with `@diagnose` remain suppressed. Xcode tool messages, such as AppIntents metadata warnings, are outside this compiler policy.
+
+`task format` formats Swift files under `App/`, `Tests/`, `Domain/`, and `Agent/`. `task format:check` runs the same configuration in strict, read-only mode. `task lint:fix` modifies source files; inspect and review the diff afterward.
+
+## First-time setup and test scope
+
+After a fresh clone or a manifest change, fetch the external binaries before generating the project. Run these commands from the project directory, in this order:
+
+```bash
+Scripts/fetch-external-binaries.sh
+task gen:prj
+```
+
+Swift Package Manager resolves the pinned release of AgeSwift from `project.yml` and verifies its release XCFramework. Network access is needed for the first resolution; consumers do not need to install Rust. `Vendor/AgeSwift/LICENSE-MIT` comes from the pinned release and is bundled in the app at `Resources/ThirdParty/AgeSwift/`. Encryption-storage interoperability tests also require `brew install age` and an accessible login keychain. Tests use a UUID-isolated service and clean it up without changing real app configuration. See the [encryption format guide](server-library-encryption-format.md) for command-line debugging.
+
+You can build and run unit tests without a certificate: the Debug baseline uses ad-hoc signing and does not require `Configs/Signing.local.xcconfig`. Create that file only when signing with Developer ID, either for release or to make a local Debug build pass the packaging gate. See [Signing and runtime baseline](distribution.md#signing-and-runtime-baseline) for its contents.
+
+`Tests/Smoke/` contains real-process smoke tests. A wrapper launches real `sslocal` to verify startup, handshake, ACL routing, and plugin supervision. Agent lifecycle tests use the packaged Agent with shell stubs to verify signals, restart ordering, startup deadlines, and persisted failures. Connectivity runtime cleanup tests also run here. These tests are not part of the default `task test`; run them locally with their separate scheme. CI runs them as an independent job. Pending reload-signal accumulation is tested without child processes in `RuntimeReloadStateTests`; real signal delivery and combined server/ACL routing remain covered by `RuntimePublicationSmokeTests`.
+
+## Writing and optimizing tests
+
+### Hostless tests and packaged resources
+
+Unit tests run without the app as a host ([ADR-0021](adr/0021-hostless-unit-tests.md)):
+
+- Tests that need the app product, such as embedded binaries or packaged `Info.plist` assertions, locate it through `Tests/Support/AppArtifact.swift`.
+- Production code reads packaged resources, such as rule snapshots and LaunchDaemon manifests, through explicit dependency injection. Controllers use an `appBundle` parameter with `Bundle.main` as the production default; test fixtures inject `AppArtifact.bundle`.
+
+See ADR-0021 for the background and the three resource seams.
+
+### Test framework and isolation
+
+- Use Swift Testing (`import Testing`) for new tests by default. UI and performance tests continue to use XCTest for its exclusive APIs (`XCUIApplication` and `measure`). Existing XCTest cases stay in XCTest.
+- Unit tests run in parallel across multiple runners. New fixtures use process-private resources: dynamically allocated ports, temporary directories, and UUID-suffixed namespaces instead of shared paths or fixed names.
+
+### Fixtures and execution cost
+
+- Choose input size from the assertion's purpose. Behavior integration tests for starting, stopping, saving, deploying, rolling back, and state projection use small deterministic inputs while retaining the real workflow and compilation path. Prefer `ProxyRuntimeFixture.controlFlowRuleSnapshot` for rule behavior fixtures.
+- Dedicated tests for packaged resources, complete rule semantics, large-data boundaries, or performance explicitly inject complete data. Behavior tests reduce inputs through rule-data injection; retain `AppArtifact.bundle` when packaged resources such as manifests are still needed.
+- Small fixtures preserve scenario relationships, including overrides, shadowing, disabled entries, and orphaned records. Keep unrelated domains in shared fixtures outside the test's own rules, so accidental absorption or duplication does not turn an expected deployment into a no-op. Test doubles implement lifecycle behavior required by the tested workflow, including registration, exit, and receipts.
+- Observe asynchronous interleaving with expectations, gates, or controllable clocks. Shorten production delays unrelated to assertions through injection. Preserve timeouts, health windows, process-supervision waits, and data boundaries that a case deliberately tests.
+- Split existing XCTest cases by behavior into concrete classes that can be scheduled independently. Shared fixture base classes contain only state and factories; keep `test*` methods in concrete classes to avoid inherited cases running more than once. After splitting classes or changing fixtures, compare test inventories for omissions, duplicates, and newly skipped cases.
+- Before optimizing duration, record the full-suite wall time and the slowest classes and cases under the same configuration. Then measure individual segments to distinguish computation from waiting. First remove repeated computation outside the test's purpose; then assess parallel scheduling through class splits or separate production performance changes. Summed case durations divided by wall time measure execution overlap, not CPU utilization.
+
+## Code style tools
+
+- `swift format` is included with the Xcode/Swift toolchain and does not need a separate installation (baseline: Apple Swift 6.4). Install SwiftLint with `brew install swiftlint` (baseline: 0.65.0), and install the hook manager with `brew install pre-commit`. If a required tool is missing, pre-commit rejects a commit that contains NG2 Swift files.
+- `.swift-format` is a snapshot of the Swift 6.4 toolchain's default rules, checked in so the rules do not drift on toolchain upgrades. `.swiftlint.yml` starts with the default rules and declares only exclusions and individual opt-outs that conflict with the format baseline; comments in the file show triggering examples.
+- The repository-level hook configuration is `.pre-commit-config.yaml`. See [Development hooks](#development-hooks) for how to install it and what it checks.
+- Adjust rules only to address concrete problems. A PR that changes `.swift-format` or `.swiftlint.yml` must include a triggering example and update the baseline versions in this section.
+
+## Development hooks
+
+After cloning, install the hooks from the repository root:
+
+```bash
+brew install pre-commit  # Skip if already installed.
+pre-commit install
+```
+
+If you previously enabled the old `.githooks` setup, remove its local Git setting before installing the new hook:
+
+```bash
+git config --local --unset core.hooksPath
+pre-commit install
+```
+
+The hooks run when a commit stages `.swift` files under `ShadowsocksX-NG2/`; other files are skipped. `swift format` formats those staged files in the working tree, and pre-commit stops that commit when formatting changes them. Review and stage the formatting changes, then commit again. The read-only `task format:check` hook then checks all NG2 Swift source directories, including lint-only rules the formatter cannot fix automatically. SwiftLint checks the staged files; errors reject the commit and warnings do not. If no NG2 Swift files are staged, these hooks are skipped. If NG2 Swift files are staged and a required tool is missing, the corresponding hook fails. See [Code style tools](#code-style-tools) for tool installation and versions.
+
+## Language of domain documents
+
+The project's [glossary](../GLOSSARY.md) and new [architecture decision records (ADRs)](adr/) are written in Simplified Chinese, while code identifiers and necessary English technical terms remain in English. Existing ADRs retain their original language and are not translated.
+
+As AI generates more documents, communication between people and machines can become a collaboration bottleneck: people's reading, comprehension, and review speed determines whether documentation can support development effectively. Simplified Chinese reduces the cognitive load for maintainers and makes communication and review more efficient.
diff --git a/docs/development.zh.md b/docs/development.zh.md
new file mode 100644
index 000000000..b75e621cb
--- /dev/null
+++ b/docs/development.zh.md
@@ -0,0 +1,120 @@
+# 开发、构建与测试
+
+[English](development.md) | [返回工程首页](../ShadowsocksX-NG2/README.zh.md)
+
+除特别说明外，命令从 `ShadowsocksX-NG2/` 执行，文中工程路径也相对于该目录。
+
+## 统一验证
+
+统一验证入口（从仓库根目录调用）：
+
+```bash
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml validate
+# 按指定顺序只运行所需关卡：
+task --exit-code --taskfile ShadowsocksX-NG2/Taskfile.dist.yml validate -- format:check lint test
+```
+
+在工程目录内可用 `task --exit-code validate`。从任意目录可用 `task --exit-code --taskfile /path/to/ShadowsocksX-NG/ShadowsocksX-NG2/Taskfile.dist.yml validate`。入口按 Taskfile 所在位置定位工程目录，内部调用发行 Taskfile 中的单项任务。
+
+默认按 `lint → test → build` 执行；真实进程冒烟测试仍可显式选择 `test:smoke`。格式检查不属于默认验证循环：本地由 pre-commit 控制格式；CI 在 Xcode 27 arm64 runner 上以独立 step 运行 `task --exit-code validate -- format:check`，与 Swift 6.4 格式工具基线一致。也可按指定顺序选择子集，每关最多一次；任一关失败立即停止，后续关标记 `not_run`，进程返回非零。`--exit-code` 让 Task 透传关卡退出码；省略时 Task 仍返回非零，但可能使用自己的错误码。入口不自动重试，不修改测试并行设置，也不执行会修改源码的格式化。
+
+### 验证产物与证据
+
+每次运行创建独立的 `.build/validation/<UTC时间>-<随机后缀>/`，开始与结束均输出结果绝对路径。`summary.txt` 保存各关状态、退出码与证据状态；每个已执行关卡在同名子目录下保留合并 stdout/stderr 的 `raw.log` 和 `status.txt`（`test:smoke` 对应 `test-smoke/`），Xcode 关卡显式保存 `result.xcresult`。本地验证保留全部证据；CI 上传策略见下文。控制台只显示进度和摘要，需要完整错误时直接读取对应日志。所有产物均在现有忽略目录内；`task clean` 会删除它们，需要长期留存时先复制出去。
+
+CI 在 Xcode 27 arm64 上运行三个独立 job：`style` 依次检查格式和 lint；`build-test` 先构建应用，再执行 hostless 测试和离线检查；`smoke` 执行真实进程测试。每项检查都是独立 step，通过 `task --exit-code validate -- <gate>` 执行，各自保留独立的结果目录。任一步失败会跳过同一 job 的后续步骤，不影响其他 job。构建和测试共用 DerivedData，编译警告视为错误。公共依赖准备由本地 composite action 完成；`style` 只安装 Task 和 SwiftLint，不下载外部二进制。失败 job 将日志、摘要和结果包上传为 `validation-<job-id>`，保留七天。优先读取 `summary.txt` 和 `test-summary.json`，完整关卡输出保存在 `raw.log`。
+
+测试关通过本机 `xcrun xcresulttool get test-results summary` 和系统 `plutil` 尽力读取计数，无需新增脚本或工具依赖。`test-summary.json` 保存原始摘要，`test-summary.stderr.log` 保存 xcresulttool 错误，`count-reader.log` 保存计数读取错误。汇总展示通过、失败、跳过、预期失败及总数（Xcode 汇总口径，参数化测试的实际执行次数可能不同）。关卡与总体退出码由原命令决定，命令失败始终保留失败。结果包缺失或摘要不可读时显著标注 `evidence incomplete`（证据不完整）、计数未知，不改变命令结果，也不把缺失计数写成零。构建关不读取测试计数；未执行的关卡不等同于测试跳过。
+
+统一入口成功表示所选关卡的命令通过，仍需核对证据是否完整；hostless、真实进程 smoke、原生 UI 和真实系统代理的验收边界仍分别成立，发布打包门槛见[签名与分发](distribution.zh.md#发布门槛)。
+
+`task test` 与 `task test:smoke` 显式启用 Xcode 单测试超时：默认 120 秒，上限 300 秒。这是 runner 兜底，不保证测试任务正常清理，也不是性能门槛。规则阶段等待失败会抛错退出测试体；受保护的测试任务先释放夹具，再取消并等待结束。规则延迟 gate 和同步阻塞夹具的默认等待上限为 10 秒，超时必须报告失败。共享 `AsyncGate` 保留由用例控制的取消语义。Swift Testing 的 detached worker 超时报告保留创建用例名称和源码位置；应同时核对命令退出码与测试计数，不能仅凭单例通过数判断成功。
+
+## 常用任务
+
+在工程目录内，日常格式化、静态检查、工程生成、构建和测试优先使用 `Taskfile.dist.yml` 定义的任务：
+
+```bash
+task format
+task format:check  # 只检查格式，不改写源文件
+task lint
+task lint:fix  # 需要自动修复 SwiftLint 违规时使用；执行后再运行 task lint
+task gen:prj   # 生成 Xcode 工程
+task build     # 构建 Debug 版本 app
+task test      # 运行单元测试（不含真实进程冒烟）
+task test:smoke  # 运行真实进程冒烟测试（拉起真实 sslocal，见签名与分发文档的发布门槛）
+```
+
+`task format` 会格式化 `App/`、`Tests/`、`Domain/` 和 `Agent/` 下的 Swift 文件；`task format:check` 使用同一配置严格检查且不修改文件。`task lint:fix` 会修改源文件，执行后检查并复核 diff。
+
+## 首次准备与测试范围
+
+新 clone 或清单变更后，在工程目录内先取外部二进制，再生成工程（顺序不可颠倒）：
+
+```bash
+Scripts/fetch-external-binaries.sh
+task gen:prj
+```
+
+Swift Package Manager 从 `project.yml` 固定的正式版本解析 AgeSwift，并校验其发布 XCFramework。首次解析需要网络，消费者无需安装 Rust。`Vendor/AgeSwift/LICENSE-MIT` 来自固定版本，随应用打包到 `Resources/ThirdParty/AgeSwift/`。加密存储互操作测试还需要 `brew install age` 和可访问的登录钥匙串；测试使用 UUID 隔离的 service 并清理，不修改真实应用配置。命令行调试方法见[加密格式文档](server-library-encryption-format.zh.md)。
+
+无证书也能构建与跑单测：Debug 基线是 ad-hoc，不需要 `Configs/Signing.local.xcconfig`。只有要做 Developer ID 签名（发布，或让本机 Debug 产物过打包门槛）时才写该文件，内容见[签名与运行形态基线](distribution.zh.md#签名与运行形态基线)。
+
+`Tests/Smoke/` 是真实进程冒烟（经 wrapper 拉起真实 sslocal 验证启动、握手、
+ACL 路由与插件监管），不在默认 `task test` 内，由独立 scheme 按需运行。
+
+## 编写与优化测试
+
+### Hostless 与打包资源
+
+单测不以 app 为宿主（ADR-0021）。两条约定：
+
+- 测试需要 app 产物（嵌入二进制、打包面 Info.plist 断言）时，一律经 `Tests/Support/AppArtifact.swift` 定位。
+- 生产代码读取 app bundle 内打包资源（规则快照、LaunchDaemon 清单等）时，走注入缝——控制器的 `appBundle` 参数（生产默认 `Bundle.main`），测试夹具注入 `AppArtifact.bundle`。
+
+背景与三处资源缝的由来见 [ADR-0021](../docs/adr/0021-hostless-unit-tests.md)。
+
+### 测试框架与隔离
+
+- 新增测试默认用 Swift Testing（`import Testing`）；UI 测试与性能测试依赖 XCTest 专属 API（`XCUIApplication`、`measure` 计时），继续用 XCTest；存量 XCTest 用例不回迁。
+- 单测多 runner 并行执行：新夹具只占用进程私有资源——运行时分配端口、临时目录、UUID 后缀命名空间，不写共享路径与固定名。
+
+### 夹具与执行成本
+
+- 输入规模由断言目标决定。启停、保存、部署、回滚、状态投影等行为集成测试使用小型确定性输入，保留真实的被测工作流与编译路径；规则行为夹具优先复用 `ProxyRuntimeFixture.controlFlowRuleSnapshot`。
+- 验证打包资源、完整规则语义、大数据边界或性能的专用用例，显式注入完整数据。行为测试通过规则数据注入缝缩小输入；仍需清单等打包资源时保留 `AppArtifact.bundle`。
+- 小夹具保留场景依赖：覆盖、遮蔽、禁用、孤立记录等关系按用例构造；公共夹具中无关的域名避开用例自身的规则，避免意外吸收或重复使预期部署变成无操作。替身实现被测流程依赖的注册、退出、回执等生命周期语义。
+- 异步穿插优先用 expectation、gate 或可控时钟观测阶段；与断言无关的生产延迟通过注入缩短。保留用例刻意验证的超时、健康窗、进程监督等待与数据边界。
+- 存量 XCTest 按行为拆为可独立调度的具体测试类；共享夹具基类只放状态和工厂，不含 `test*` 方法，避免子类重复执行继承用例。拆类或调整夹具后核对用例清单，确认无遗漏、重复或新增跳过。
+- 优化耗时先记录同一配置下的全量墙钟、最慢类和用例，再分段测量定位计算与等待。优先消除测试目标之外的重复计算，再评估拆类并行或独立的生产性能优化；用例耗时合计除以墙钟表示执行重叠，不能当作 CPU 使用率。
+
+## 代码风格工具
+
+- `swift format` 随 Xcode/Swift 工具链提供，无需单独安装（基线：Apple Swift 6.4）；SwiftLint 需 `brew install swiftlint`（基线 0.65.0），钩子管理器需 `brew install pre-commit`。缺少必需工具时，暂存了 NG2 Swift 文件的提交会被拒绝。
+- 配置文件：`.swift-format` 是 Swift 6.4 工具链默认规则的快照（固定成文件，工具链升级不漂移）；`.swiftlint.yml` 默认规则起步，只声明排除项与个别和 format 基线冲突的关闭项（文件内有触发案例注释）。
+- 仓库级 hook 配置位于 `.pre-commit-config.yaml`；安装方式和检查范围见下节「开发钩子」。
+- 调整规则只针对实际痛点：修改 `.swift-format` / `.swiftlint.yml` 的 PR 须给出触发案例，并同步更新本节中的基线版本。
+
+## 开发钩子
+
+新 clone 后，在仓库根目录安装 hooks：
+
+```bash
+brew install pre-commit  # 已安装时跳过
+pre-commit install
+```
+
+如果之前启用过旧版 `.githooks`，先清除本地 Git 设置，再安装新 hook：
+
+```bash
+git config --local --unset core.hooksPath
+pre-commit install
+```
+
+提交中包含 `ShadowsocksX-NG2/` 下的 `.swift` 文件时才会运行这些 hook，其他文件跳过。`swift format` 会在工作区格式化暂存的文件；如果文件发生变化，pre-commit 会拦下本次提交。检查并暂存格式化结果后再提交。随后只读的 `task format:check` 会检查全部 NG2 Swift 源码目录，也会覆盖 formatter 无法自动修复的 lint-only 规则。SwiftLint 检查暂存文件；error 级违规拒绝提交，warning 不阻止提交。没有暂存 NG2 Swift 文件时这些 hook 会跳过；暂存了 NG2 Swift 文件但缺少必需工具时，对应 hook 会失败。工具安装与版本见上节「代码风格工具」。
+
+## 领域文档语言
+
+本项目的 [术语表](../GLOSSARY.md) 和新建 [架构决策记录（ADR）](adr/) 使用简体中文，代码标识符与必要的英文术语保留原文；已有 ADR 保留原文，不作语言迁移。
+
+AI 生成大量文档后，人与机器之间的沟通成为协作瓶颈：人的阅读、理解和审阅速度决定了文档能否有效推动开发。使用简体中文可以降低维护者的认知负荷，提高沟通与审阅效率。
diff --git a/docs/distribution.md b/docs/distribution.md
new file mode 100644
index 000000000..f96797176
--- /dev/null
+++ b/docs/distribution.md
@@ -0,0 +1,139 @@
+# External Binaries, Signing, and Distribution
+
+[Project home](../ShadowsocksX-NG2/README.md) | [简体中文](distribution.zh.md)
+
+Unless noted otherwise, run commands from `ShadowsocksX-NG2/`; paths in this document are relative to that directory.
+
+## External binary supply chain
+
+External binaries come only from fixed-version upstream releases: the [`sslocal` manifest](../ShadowsocksX-NG2/Vendor/sslocal/manifest.json) (installed in `Contents/Helpers/`), the [`v2ray-plugin` manifest](../ShadowsocksX-NG2/Vendor/v2ray-plugin/manifest.json), and the [`ck-client` manifest](../ShadowsocksX-NG2/Vendor/ck-client/manifest.json) (both plugins are installed in `Contents/Helpers/Plugins/`). The manifests record each release and hash. The build pipeline is as follows (spec #21 D6/D10):
+
+1. **fetch** — `Scripts/fetch-external-binaries.sh` obtains the asset from the URL pinned in its manifest, verifies `archiveSHA256` byte for byte, processes tar archives according to `assetFormat` (the default; extracts `archiveMember`) or copies a raw binary (`binary`), verifies arm64, places the result in `Vendor/<name>/`, and writes a stamp. A hash mismatch fails immediately. A changed local binary cache triggers an automatic download and re-verification. CI may set `EXTERNAL_BINARY_CACHE_DIR` to reuse downloaded archives; each cached archive is checked against the manifest hash before use, and an invalid cache entry is deleted and fetched again.
+2. **generate** — `xcodegen generate` adds each manifest binary as a Copy Files item under `Contents/Helpers[/Plugins]`. Order matters: **fetch before generate**. The files must exist when the project is generated; otherwise, the Copy Files phase may be silently omitted (or generation may report the missing file).
+3. **verify on every build** — a pre-build script runs the fetch script again. On a cache hit, it quickly rechecks the local stamp. A hash or manifest change fails the build.
+4. **sign** — in the post-build phase, `Scripts/sign-embedded-helpers.sh` re-signs every binary with Developer ID using `--options runtime --timestamp --identifier <manifest signIdentifier>` (plugin identifiers use the form `<bundle-id>.plugin.<name>`). Xcode then signs the outer app and seals the re-signed nested code.
+5. **gate** — the built app must pass `Scripts/packaging-gate.sh <App.app>`. It strictly verifies nested-code signatures, requires Developer ID and Hardened Runtime on the main app with no App Sandbox entitlement, and checks manifest coverage for each binary (every Mach-O under Helpers must be in a manifest and pass Developer ID re-signing). Tampering with any binary is detected because its signature is invalid.
+
+## Signing and runtime baseline
+
+- Bundle ID: `com.qiuyuzhou.ShadowsocksX-NG2`, distinct from Legacy (`com.qiuyuzhou.ShadowsocksX-NG`). Runtime data is stored in `~/Library/Application Support/ShadowsocksX-NG2/`. The app targets macOS 15+ / arm64.
+- Hardened Runtime is required for the Developer ID release path; ad-hoc Debug builds are exempt because they need no certificate (see the configuration below). App Sandbox is disabled, entitlements are an empty dictionary, and the signing style is fixed to `Manual`.
+- **Certificates and Team IDs are not checked in** (this is an open-source repository). `project.yml` does not set `CODE_SIGN_IDENTITY` or `DEVELOPMENT_TEAM`; the project xcconfig injects both settings at build time according to the configuration:
+  - The checked-in `Configs/Signing-Debug.xcconfig` baseline is **ad-hoc (`-`)**. A fresh clone and CI need no certificate to run `task build` or `task test`. On arm64, code must have at least an ad-hoc signature to load, so “no certificate” does not mean “unsigned.” Ad-hoc builds do not use Hardened Runtime (Xcode does not pass `-o runtime` for ad-hoc signing, as verified; the ad-hoc branch of `Scripts/sign-embedded-helpers.sh` does the same). Hardened Runtime is enforced by the Developer ID release path and packaging gate.
+  - The checked-in `Configs/Signing-Release.xcconfig` baseline is **Developer ID Application**. Release artifacts must be signed; there is no certificate-free path.
+  - Both configurations may optionally include `Configs/Signing.local.xcconfig` (gitignored). Developers with a certificate, including maintainers, can use it to set a local identity, for example to use Developer ID for Debug builds:
+
+    ```bash
+    cat > Configs/Signing.local.xcconfig <<'EOF'
+    DEVELOPMENT_TEAM = YOUR_TEAM_ID
+    CODE_SIGN_IDENTITY = Developer ID Application
+    EOF
+    ```
+
+  - If this file is absent, Debug builds use ad-hoc signing and can run unit tests. Release builds fail explicitly in Xcode with “Signing for … requires selecting either a development team or a provisioning profile”; they do not silently fall back.
+  - Test targets (unit and smoke tests) use the same baseline. After tests became hostless (ADR-0021), the xctest bundle no longer injects the host app and can load and run with ad-hoc signing (verified), so tests need no certificate.
+  - If these two settings are added back to `project.yml`, the generated pbxproj build settings override the xcconfig. `Tests/Architecture/SigningConfigurationTests.swift` guards this constraint.
+- The Release configuration disables `CODE_SIGN_INJECT_BASE_ENTITLEMENTS` so release entitlements come only from project files.
+- The Release configuration passes `OTHER_CODE_SIGN_FLAGS = $(inherited) --timestamp` so Xcode requests secure timestamps for the main app and two native tools it signs. The packaging gate checks these timestamps before notarization upload; a timestamp on the DMG cannot replace timestamps on the executables inside it.
+
+## Release gate
+
+### Signed and notarized DMG
+
+Run these commands from `ShadowsocksX-NG2/`. See above for initial external-binary setup and Developer ID signing configuration. The keychain must contain the matching certificate and private key.
+
+First, use Apple's tool to save notarization credentials. This command interactively requests the app-specific password and stores the credentials in the keychain, not in the repository or Taskfile:
+
+```bash
+xcrun notarytool store-credentials shadowsocks-release \
+  --apple-id YOUR_APPLE_ID --team-id YOUR_TEAM_ID
+```
+
+Full packaging entry point:
+
+```bash
+task package NOTARY_PROFILE=shadowsocks-release \
+  MARKETING_VERSION=2.1.0 CURRENT_PROJECT_VERSION=21
+```
+
+`task package`, `task build:release`, and `task i:release` require non-empty `MARKETING_VERSION` and `CURRENT_PROJECT_VERSION`; they do not use the project defaults. Supply parameters on the command line, through environment variables, or in a local `.env` file. They override only the current Release build and do not rewrite `project.yml`. `MARKETING_VERSION` accepts three dot-separated numbers, an optional `v` prefix, and an optional prerelease suffix beginning with `-`. Identifiers in the suffix use ASCII letters, digits, or hyphens and are separated by dots; examples include `v2.0.0-alpha-1`, `2.0.0-beta.2`, and `v2.0.0-rc.1`. `CURRENT_PROJECT_VERSION` accepts one to three dot-separated numbers. `package:notarize` reuses an existing DMG and does not require the version parameters again.
+
+Example prerelease build:
+
+```bash
+task package NOTARY_PROFILE=shadowsocks-release \
+  MARKETING_VERSION=v2.0.0-alpha-1 CURRENT_PROJECT_VERSION=22
+```
+
+The DMG filename retains the complete release version: `ShadowsocksX-NG2-v2.0.0-alpha-1-22-arm64.dmg`. Task extracts `2.0.0` and passes it to Xcode, so the app's `CFBundleShortVersionString` remains in Apple's three-number format. The prerelease suffix is not written to this field; prerelease builds inside the app are distinguished by the increasing `CURRENT_PROJECT_VERSION`. Continue incrementing the build number for every alpha, beta, rc, and final build.
+
+`Taskfile.package.yml` orchestrates the flow: check notarization credentials → fetch external binaries → real-process smoke test → Release build → app packaging gate → create a compressed DMG → sign the DMG → notarize with Apple → staple the ticket → check signature, ticket, and Gatekeeper → publish to `dist/`. Builds support arm64 only. The DMG contains only the app and a shortcut to `/Applications`; it does not add a background image or depend on Finder automation.
+
+The DMG is signed using the SHA-1 fingerprint of the certificate that actually signed the app, with a secure timestamp. Notarization uses only the keychain profile named by `NOTARY_PROFILE`. An example release artifact is `dist/ShadowsocksX-NG2-2.1.0-21-arm64.dmg`. The filename retains the supplied full release version. The build number is always read from the app's Info.plist. Before packaging, the numeric part of the release version is checked against the app version to prevent a mismatch between the filename and the version inside the app. If an artifact with the same name already exists, the process fails explicitly and does not overwrite it.
+
+Before tool checks, notarization-credential checks, smoke tests, or builds, `package` checks for an existing artifact with the required versioned filename. Overwrite protection also remains in place when creating the disk image, notarizing, and publishing, to prevent concurrent packaging runs from overwriting one another.
+
+Each build uses a separate `.build/packaging/run-*/` directory that retains the signed DMG, build artifacts, and smoke-test results. Each notarization uses `.build/notarization/run-*/` to retain the submission response, submission ID, wait results, and Apple's diagnostic logs. The console prints both directories. Submission and waiting are separate operations, so the submission ID remains available if waiting is interrupted. Notarization waits for up to 30 minutes; Apple may continue processing after the local wait ends.
+
+After notarization fails, you can retry the retained signed DMG without rebuilding:
+
+```bash
+task package:notarize \
+  DMG_PATH=/absolute/path/to/ShadowsocksX-NG2-2.1.0-21-arm64.dmg \
+  NOTARY_PROFILE=shadowsocks-release
+```
+
+This entry point submits the DMG to Apple again. If only the wait timed out, query Apple with the retained submission ID first to avoid a duplicate submission:
+
+```bash
+xcrun notarytool info SUBMISSION_ID --keychain-profile shadowsocks-release
+```
+
+`package:notarize` staples the DMG ticket only after Apple returns `Accepted`. The complete file is published to `dist/` only after signature, ticket, and Gatekeeper checks pass. A failure does not publish a new file. This workflow staples a ticket to the DMG; it does not distribute a separate app. The retry entry point does not replace the smoke test or app packaging gate from the full release entry point; it accepts a signed DMG produced by that full flow.
+
+`task clean` deletes intermediate artifacts and logs under `.build/` but preserves `dist/`. Both output locations are ignored by Git. After `task package` completes, use the separate entry point below to upload a GitHub Release.
+
+See Apple's [notarization workflow](https://developer.apple.com/documentation/security/customizing-the-notarization-workflow) and [software packaging for distribution](https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution) for tool usage.
+
+### Create a GitHub Release draft
+
+After packaging, run from a clean `develop` branch that matches `origin/develop`. Install Git, Task 3.47+ (for command-level `if`), and an authenticated GitHub CLI (`gh auth login`). The release repository comes from `origin`; its fetch and push URLs must identify the same GitHub repository.
+
+```bash
+task publish MARKETING_VERSION=2.1.0 CURRENT_PROJECT_VERSION=21 \
+  RELEASE_NOTES_FILE=/absolute/path/to/release-notes.md
+```
+
+Both version parameters must exactly match those used for package. This entry point selects only `dist/ShadowsocksX-NG2-{MARKETING_VERSION}-{CURRENT_PROJECT_VERSION}-arm64.dmg`. It does not rebuild the package or select the newest file. The release note file is optional:
+
+```bash
+task publish MARKETING_VERSION=v2.1.0-rc.1 CURRENT_PROJECT_VERSION=22
+```
+
+When creating a new draft with `RELEASE_NOTES_FILE` omitted, Task's `prompt` asks for confirmation before any push to use GitHub-generated notes. Declining cancels the task; confirmation fails without a terminal. An explicit `task --yes publish ...` accepts automatically, following Task's standard behavior. Supplying a file or reusing an existing Release skips this prompt.
+
+`Taskfile.publish.yml` orchestrates internal tasks in order: check the working tree, branches, tag, existing Release, and DMG → create and push a tag on the `develop` commit → merge `develop` into `master` with `--no-ff` and push → create a draft with `gh release create --draft` and upload the DMG → open the browser for review. Successful runs return to `develop`. If local `master` does not exist, it is created as a tracking branch from `origin/master`. An existing local `master` must match the remote, except for the exact pending merge left by this workflow after a failed push.
+
+Tags have exactly one `v` prefix and omit the build number: for example, `v2.1.0`, `v2.1.0-beta.2`, or `v2.1.0-rc.1`. Any prerelease suffix sets GitHub's prerelease flag. Notes come from the supplied file or `gh --generate-notes`. In the browser, review the notes, DMG, and prerelease flag, then publish the draft manually.
+
+Task uses `preconditions` to reject conflicts, `status` to skip completed steps, `if` to select commands, and `defer` to clean up downloads and the publish lock and restore the branch. Retry interrupted runs with the same parameters. Tags pointing to the current `develop` commit, a remote `master` that already contains that commit, and a draft with the same target can be reused. An existing DMG is downloaded to a temporary directory and compared byte for byte with `cmp`; only a missing DMG is uploaded, preserving notes already edited in the draft. A published Release with a matching target and asset is reported as complete. A conflicting tag, release target, prerelease flag, or DMG stops the task without overwriting assets or force-pushing history. Merge conflicts are retained on `master`; resolve them or run `git merge --abort`, then return to `develop` before retrying.
+
+The publish lock is the `ng2-publish.lock/` directory under the shared Git directory. If a process is forcibly terminated before cleanup, remove that empty directory after confirming no other publish process is running, then retry.
+
+### Check an app separately
+
+When a build artifact already exists, run the release gate separately:
+
+```bash
+# Release gate (both stages must pass): real-process smoke test and packaging gate.
+task test:smoke
+task build:release MARKETING_VERSION=2.1.0 CURRENT_PROJECT_VERSION=21
+Scripts/packaging-gate.sh \
+  .build/derivedData/Build/Products/Release/ShadowsocksX-NG2.app
+```
+
+The packaging gate accepts only Developer ID-signed artifacts. It gets the expected Team ID from `Configs/Signing.local.xcconfig` (or an explicit `EXPECTED_TEAM_ID=<Team ID>` override). If neither is available, the assertion fails; it is not silently skipped. An ad-hoc Debug artifact without a certificate fails here explicitly (`gate: hint` explains why), as expected.
+
+## Dependency upgrades
+
+Upgrading an external binary is an explicit supply-chain action: manually re-verify the new release (download the archive and inspect its hash, architecture, and signature without executing it), then update the manifest's release, asset, URL, and `archiveSHA256` and the corresponding test anchors in the same PR. Do not use `latest`, build the binary in this repository, or add an in-app update channel; upgrades ship only with an app release.
diff --git a/docs/distribution.zh.md b/docs/distribution.zh.md
new file mode 100644
index 000000000..d3dcf4533
--- /dev/null
+++ b/docs/distribution.zh.md
@@ -0,0 +1,139 @@
+# 外部二进制、签名与分发
+
+[English](distribution.md) | [返回工程首页](../ShadowsocksX-NG2/README.zh.md)
+
+除特别说明外，命令从 `ShadowsocksX-NG2/` 执行，文中工程路径也相对于该目录。
+
+## 外部二进制供应链
+
+外部二进制只用固定版本的上游 release 构建产物：[`sslocal` 清单](../ShadowsocksX-NG2/Vendor/sslocal/manifest.json)（装于 `Contents/Helpers/`）、[`v2ray-plugin` 清单](../ShadowsocksX-NG2/Vendor/v2ray-plugin/manifest.json) 与 [`ck-client` 清单](../ShadowsocksX-NG2/Vendor/ck-client/manifest.json)（两个插件均装于 `Contents/Helpers/Plugins/`）。清单记录各 release 与哈希；构建链如下（spec #21 D6/D10）：
+
+1. **fetch** — `Scripts/fetch-external-binaries.sh` 获取清单固定 URL 的资产、逐字节校验 `archiveSHA256`，按 `assetFormat` 处理 tar 归档（默认，提取 `archiveMember`）或直接二进制（`binary`），并确认 arm64，落盘 `Vendor/<name>/` 并记录戳。资产哈希不符 → 立即失败；本地二进制缓存漂移 → 自动重新下载复验。CI 可设置 `EXTERNAL_BINARY_CACHE_DIR` 复用已下载归档；每个缓存归档使用前都会按清单哈希校验，缓存损坏时会删除并重新下载。
+2. **generate** — `xcodegen generate` 把清单对应二进制作为 Copy Files 项装入 `Contents/Helpers[/Plugins]`。注意顺序：**先 fetch 再 generate**，文件在生成时必须已存在，否则 Copy Files 阶段会被静默丢弃（generate 也会直接报缺文件）。
+3. **verify on every build** — 预构建脚本阶段重跑 fetch 脚本（缓存命中时只对本地戳快速复验），哈希或清单漂移使构建即失败。
+4. **sign** — `Scripts/sign-embedded-helpers.sh`（post-build 阶段）对每个二进制 Developer ID 重签：`--options runtime --timestamp --identifier <清单 signIdentifier>`（插件形如 `<bundle-id>.plugin.<name>`）；随后 Xcode 完成 app 外层签名，封存重签后的嵌套代码。
+5. **gate** — 构建产物必须过 `Scripts/packaging-gate.sh <App.app>`：嵌套代码签名严格校验、主应用 DevID + Hardened Runtime 且无 App Sandbox entitlement、逐二进制清单覆盖（Helpers 下每个 Mach-O 都在清单内且 DevID 重签通过）。篡改任一二进制会因签名失效被断言发现。
+
+## 签名与运行形态基线
+
+- bundle id `com.qiuyuzhou.ShadowsocksX-NG2`，与 Legacy（`com.qiuyuzhou.ShadowsocksX-NG`）区分；运行时数据落 `~/Library/Application Support/ShadowsocksX-NG2/`。macOS 15+ / arm64。
+- Hardened Runtime（DevID 发布路径；免证书的 ad-hoc Debug 例外，详见下面的配置说明）；不启用 App Sandbox，entitlements 为空 dict；签名样式固定 `Manual`。
+- **证书与 Team 都不入库**（开源仓库）：`project.yml` 不含 `CODE_SIGN_IDENTITY` / `DEVELOPMENT_TEAM`，两个键由 project xcconfig 按 config 在构建期注入：
+  - `Configs/Signing-Debug.xcconfig`（入库）基线是 **ad-hoc（`-`）**：新 clone 与 CI 不需要任何证书就能 `task build` / `task test`。arm64 要求代码至少有 ad-hoc 签名才会被加载，所以「免证书」不是「不签名」。ad-hoc 产物不带 Hardened Runtime（Xcode 对 ad-hoc 签名不传 `-o runtime`，实测；`Scripts/sign-embedded-helpers.sh` 的 ad-hoc 分支同样不加），Hardened Runtime 由 DevID 发布路径与打包门槛断言。
+  - `Configs/Signing-Release.xcconfig`（入库）基线是 **Developer ID Application**：发布产物必须真签名，这里不给免证书路径。
+  - 两者都可选包含 `Configs/Signing.local.xcconfig`（gitignore）。有证书的人（含维护者）用它升级本机身份，例如让 Debug 也走 Developer ID：
+
+    ```bash
+    cat > Configs/Signing.local.xcconfig <<'EOF'
+    DEVELOPMENT_TEAM = YOUR_TEAM_ID
+    CODE_SIGN_IDENTITY = Developer ID Application
+    EOF
+    ```
+
+  - 该文件缺失时 Debug 构建为 ad-hoc（可跑单测），Release 构建以 Xcode 的「Signing for … requires selecting either a development team or a provisioning profile」明确失败，不静默降级。
+  - 测试 target（单测与冒烟）身份随同一基线：去宿主化（ADR-0021）后 xctest 包不再注入宿主 app，ad-hoc 也能加载执行（实测），因此测试无需证书。
+  - 注意 `project.yml` 一旦重新设置这两个键，pbxproj 构建设置会盖掉 xcconfig（`Tests/Architecture/SigningConfigurationTests.swift` 守卫该约束）。
+- Release 配置关闭 `CODE_SIGN_INJECT_BASE_ENTITLEMENTS`，保证发布产物 entitlements 只来自项目文件。
+- Release 配置通过 `OTHER_CODE_SIGN_FLAGS = $(inherited) --timestamp` 为 Xcode 签名的主程序和两个原生工具请求安全时间戳。打包门槛在上传公证前检查这些时间戳；DMG 的时间戳不能替代包内可执行文件的时间戳。
+
+## 发布门槛
+
+### 签名并公证的 DMG
+
+从 `ShadowsocksX-NG2/` 执行。首次准备外部二进制及 Developer ID 签名配置的方法见上文。钥匙串中必须有对应证书及私钥。
+
+先用 Apple 的工具保存公证凭据。此命令交互输入 App 专用密码；凭据保存在钥匙串中，不写入仓库或 Taskfile：
+
+```bash
+xcrun notarytool store-credentials shadowsocks-release \
+  --apple-id YOUR_APPLE_ID --team-id YOUR_TEAM_ID
+```
+
+完整打包入口：
+
+```bash
+task package NOTARY_PROFILE=shadowsocks-release \
+  MARKETING_VERSION=2.1.0 CURRENT_PROJECT_VERSION=21
+```
+
+`task package`、`task build:release` 和 `task i:release` 必须提供非空的 `MARKETING_VERSION` 与 `CURRENT_PROJECT_VERSION`，不使用工程默认版本。参数可以通过命令行、环境变量或本机 `.env` 提供，只覆盖本次 Release 构建，不改写 `project.yml`。`MARKETING_VERSION` 接受三个以点分隔的数字、可选的 `v` 前缀和以 `-` 开头的预发布后缀。后缀中的标识符使用 ASCII 字母、数字或连字符，以点分隔，例如 `v2.0.0-alpha-1`、`2.0.0-beta.2` 和 `v2.0.0-rc.1`。`CURRENT_PROJECT_VERSION` 接受一至三个以点分隔的数字。`package:notarize` 复用已有 DMG，不要求重新提供版本参数。
+
+预发布构建示例：
+
+```bash
+task package NOTARY_PROFILE=shadowsocks-release \
+  MARKETING_VERSION=v2.0.0-alpha-1 CURRENT_PROJECT_VERSION=22
+```
+
+DMG 文件名保留完整发布版本：`ShadowsocksX-NG2-v2.0.0-alpha-1-22-arm64.dmg`。Task 用计算变量提取 `2.0.0` 传给 Xcode，因此 App 的 `CFBundleShortVersionString` 仍符合 Apple 的三段数字格式。预发布后缀不写入这个字段；App 内的预发布构建用递增的 `CURRENT_PROJECT_VERSION` 区分。不同 alpha、beta、rc 和正式构建都应继续递增构建号。
+
+流程由 `Taskfile.package.yml` 编排：检查公证凭据 → 获取外部二进制 → 真实进程冒烟 → Release 构建 → App 打包门槛 → 制作压缩 DMG → DMG 签名 → Apple 公证 → 装订票据 → 签名、票据及 Gatekeeper 检查 → 发布到 `dist/`。构建只支持 arm64。DMG 只包含 App 和指向 `/Applications` 的快捷方式，不增加背景图或 Finder 自动化依赖。
+
+DMG 复用 App 实际签名证书的 SHA-1 指纹选择签名身份，使用安全时间戳。公证仅接收 `NOTARY_PROFILE` 指定的钥匙串配置名称。发布产物示例为 `dist/ShadowsocksX-NG2-2.1.0-21-arm64.dmg`。名称保留传入的完整发布版本。构建号始终从 App 的 Info.plist 读取。打包前校验发布版本的数字部分与 App 版本一致，防止文件名与包内版本不符。已有同名发布产物时明确失败，不覆盖文件。
+
+`package` 根据必填版本参数，在工具检查、公证凭据检查、冒烟和构建之前检查同名产物。制盘、公证和最终发布时仍保留覆盖保护，防止并发打包产生覆盖。
+
+每次构建使用独立的 `.build/packaging/run-*/`，其中保留签名 DMG、构建产物与冒烟结果。每次公证在 `.build/notarization/run-*/` 保存提交响应、提交编号、等待结果与 Apple 诊断日志。控制台打印这两个目录。提交和等待分别执行，等待中断时仍保留提交编号。公证等待上限为 30 分钟；本地等待结束后 Apple 仍可能继续处理。
+
+公证失败后，可以直接重跑保留的签名 DMG，无须重新构建：
+
+```bash
+task package:notarize \
+  DMG_PATH=/absolute/path/to/ShadowsocksX-NG2-2.1.0-21-arm64.dmg \
+  NOTARY_PROFILE=shadowsocks-release
+```
+
+此入口会重新提交公证。若此前仅等待超时，可以先用保留的提交编号查询 Apple 状态，避免重复提交：
+
+```bash
+xcrun notarytool info SUBMISSION_ID --keychain-profile shadowsocks-release
+```
+
+`package:notarize` 仅在 Apple 返回 `Accepted` 后装订 DMG 票据。签名、票据和 Gatekeeper 检查全部通过后，才发布完整文件到 `dist/`。失败时不发布新文件。此流程只装订 DMG 票据，不另外分发独立 App。公证重跑入口不代替完整入口中的冒烟和 App 打包门槛；它接收此前完整入口生成的签名 DMG。
+
+`task clean` 删除 `.build/` 中间产物及日志，保留 `dist/`。仓库忽略这两类产物。`task package` 完成后使用下面的独立入口上传 GitHub Release。
+
+工具用法见 Apple 的[公证流程](https://developer.apple.com/documentation/security/customizing-the-notarization-workflow)与[分发打包说明](https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution)。
+
+### 创建 GitHub Release 草稿
+
+打包完成后，从干净且与 `origin/develop` 同步的 `develop` 分支执行。需要 Git、Task 3.47+（使用命令级 `if`）和已登录的 GitHub CLI（`gh auth login`）。发布目标取自 `origin`，其 fetch 与 push URL 必须指向同一个 GitHub 仓库。
+
+```bash
+task publish MARKETING_VERSION=2.1.0 CURRENT_PROJECT_VERSION=21 \
+  RELEASE_NOTES_FILE=/absolute/path/to/release-notes.md
+```
+
+两个版本参数必须与 package 时完全相同。入口只接受对应的 `dist/ShadowsocksX-NG2-{MARKETING_VERSION}-{CURRENT_PROJECT_VERSION}-arm64.dmg`，不会重新打包或猜测最新文件。Release note 文件可省略：
+
+```bash
+task publish MARKETING_VERSION=v2.1.0-rc.1 CURRENT_PROJECT_VERSION=22
+```
+
+创建新草稿且省略 `RELEASE_NOTES_FILE` 时，Task 的 `prompt` 会在任何推送之前询问是否使用 GitHub 自动生成的说明。拒绝则取消；无终端时确认失败。显式使用 `task --yes publish ...` 会自动确认，符合 Task 的标准行为。提供文件或复用已有 Release 时不再询问。
+
+流程由 `Taskfile.publish.yml` 编排，按顺序执行内部任务：核对工作区、分支、tag、既有 Release 与 DMG → 在 `develop` 提交上创建并推送 tag → 将 `develop` 以 `--no-ff` 合并到 `master` 并推送 → 使用 `gh release create --draft` 创建草稿并上传 DMG → 打开浏览器审核。成功后回到 `develop`。本地没有 `master` 时从 `origin/master` 创建跟踪分支；已有本地 `master` 必须与远端同步，或恰好是本流程在推送失败后留下的待推送合并提交。
+
+Tag 始终只有一个 `v` 前缀，不包含 build number，例如 `v2.1.0`、`v2.1.0-beta.2`、`v2.1.0-rc.1`。任何预发布后缀都会设置 GitHub prerelease 标记。草稿说明来自显式文件或 `gh --generate-notes`；浏览器打开后，维护者审核说明、DMG 和预发布标记，再手动正式发布。
+
+Task 用 `preconditions` 检查冲突、`status` 跳过已完成步骤、`if` 选择需要执行的命令、`defer` 清理下载目录及发布锁并恢复分支。中途失败可以使用相同参数重跑。指向本次 `develop` 提交的 tag、已经包含该提交的远端 `master` 和目标一致的 draft 可复用。已有同名 DMG 会下载到临时目录并用 `cmp` 逐字节比较；仅缺少 DMG 时补传，保留草稿中已编辑的说明。同 tag 的正式 Release 若目标与资产都匹配，报告已完成。Tag 指向、Release 目标、预发布标记或 DMG 不匹配时停止，不覆盖资产或强推历史。合并冲突会保留在 `master`，需先解决冲突或执行 `git merge --abort`，再回到 `develop` 重跑。
+
+发布锁位于 Git 公共目录下的 `ng2-publish.lock/`。若进程被强制终止而未执行清理，确认没有其他发布进程后，删除这个空目录即可重跑。
+
+### 单独检查 App
+
+已有构建产物时，可以单独运行发布门槛检查：
+
+```bash
+# 发布门槛（必须全绿）：真实进程冒烟 + 打包门槛
+task test:smoke
+task build:release MARKETING_VERSION=2.1.0 CURRENT_PROJECT_VERSION=21
+Scripts/packaging-gate.sh \
+  .build/derivedData/Build/Products/Release/ShadowsocksX-NG2.app
+```
+
+打包门槛只接受 Developer ID 签名的产物：Team 期望值取自 `Configs/Signing.local.xcconfig`（可用 `EXPECTED_TEAM_ID=<Team ID>` 显式覆盖），两者都没有时该断言直接失败，不静默跳过。无证书的 ad-hoc Debug 产物会在此明确失败（`gate: hint` 会说明原因），这是预期行为。
+
+## 依赖升级
+
+升级任一外部二进制是显式供应链动作：人工复验新 release（下载归档、静态观测哈希/架构/签名，不执行），随后在一次 PR 中同时改 `Vendor/<name>/manifest.json` 的 release/asset/url/archiveSHA256 与对应测试锚点。不接受 `latest`，不在仓库内构建，不做应用内更新通道（升级仅随 app 发版）。
diff --git a/docs/project-structure.md b/docs/project-structure.md
new file mode 100644
index 000000000..950403b91
--- /dev/null
+++ b/docs/project-structure.md
@@ -0,0 +1,63 @@
+# Project Structure and Source Search
+
+[Project home](../ShadowsocksX-NG2/README.md) | [简体中文](project-structure.zh.md)
+
+Unless noted otherwise, run commands from `ShadowsocksX-NG2/`; paths in this document are relative to that directory.
+
+## Project structure
+
+- `project.yml` — XcodeGen project definition and single source of truth. `.xcodeproj`, `App/Resources/Info.plist`, `*.entitlements`, and `Tests/Info.plist` are generated and gitignored. Change the project structure in `project.yml`, then regenerate the project.
+- `App/` — app target source code (a SwiftUI menu bar app with `LSUIElement`). Directories define layers; files within each layer are grouped by feature:
+  - `Composition/` — composition root and process lifecycle: `@main`, dependency assembly, app form, and window activation strategy.
+  - `Application/` — application layer without SwiftUI views: `*Workflow/` workflow modules (UI-facing interfaces and implementation collaborators), the `ProxyRuntime/` runtime-controller family and fact projections, and `Services/` for LaunchAgent, login item, helper, and firewall.
+  - `Presentation/` — cross-feature presentation: error presentation and state models shared by multiple views.
+  - `UI/` — view layer, organized by subview (`Workspace/`, `Home/`, `Servers/`, `Subscriptions/`, `Rules/`, `Settings/`, `Diagnostics/`, and `StatusMenu/`); `Servers/Plugin/` contains plugin-management views.
+  - `PlatformEffects/` — platform-effect seams (protocols and AppKit adapters; test doubles are in `Tests/Support/`); access to system frameworks is centralized here.
+  - `Resources/` — generated `Info.plist` and entitlements, plus checked-in `Assets.xcassets` and `*.xcstrings`.
+
+  `Tests/Architecture/SkeletonTests.swift` enforces layer boundaries with an allowlist guard that scans only `App/UI/`. The view layer must not reference runtime controllers, workflow implementation collaborators, or raw directory/credential storage types. New runtime adapters belong in `Application/`, which is outside the scan scope and needs no exemption. Note that XcodeGen includes any non-source file under `App/` in the Resources build phase and signs it into the bundle, so do not put documents there (`project.yml` excludes `**/*.md`). See [ADR-0029](adr/0029-source-layout-declares-layer-and-theme.md) for the layer and theme organization, why the guard uses an allowlist, and the XcodeGen constraint.
+- `Agent/` — standalone background-supervision executable, installed in `Contents/MacOS/` and kept running by a LaunchAgent. It reads only non-secret `agent-supervision.json`, switches stable configuration and ACL links, and launches and supervises `sslocal`; it does not parse sslocal configuration or LAN credentials. See ADR-0037 and ADR-0038 for release and failure handling, and ADR-0043 for one-way configuration output from the GUI.
+- `LaunchAgent/` — registration manifest for `SMAppService.agent(plistName:)`, installed in `Contents/Library/LaunchAgents/`. `ProgramArguments` uses bundle-relative paths, which launchd resolves from the registered app's bundle location.
+- `Domain/` — domain core for the configuration catalog tree, credential references, and persistence (spec #21 D3/D5), independent of the UI. Directories define topics; there are no flat files at the root. Child-directory boundaries follow the sections in the [glossary](../GLOSSARY.md):
+  - `Catalog/` — configuration catalog tree, structural invariant errors, catalog file storage, node and credential identities, and `SsUri` for `ss://` encoding and decoding.
+  - `Subscription/` — subscription document parsing, fetching, subscription records, and refresh failures.
+  - `Rules/` — proxy modes, rule identity and matching, bundled rule snapshots, rule collections/browsing/analysis, and offline rule tests; `Rules/Custom/` contains edit drafts, validation, and storage for user-defined rules.
+  - `Runtime/` — proxy runtime services: runtime documents and listener settings, ACLs and deployment receipts, paths, atomic writes, file storage, logs and events (`SystemLog` unified-log emitter, `LogLine` unified-log line, and sslocal-output intake), plus endpoint/port/socket probes.
+  - `Activation/` — activation-candidate validation, activation state machine, and `RuntimeConfiguration`.
+  - `Settings/` — proxy-listening configuration file, independent proxy-control preferences, in-memory snapshots of runtime calculations, and silent-launch preference.
+  - `SystemProxy/` — typed system-proxy configuration, property-list mapping, planner, privileged-helper XPC contract/request engine, and helper-side log events.
+  - `Plugin/` — managed plugins, user-plugin mappings, and plugin security inspection.
+  - `Credentials/`, `LegacyImport/`, and `Diagnostics/` — master-key storage and encrypted-file commits, legacy import, and diagnostic reports.
+
+  Cross-process contracts are compiled into other targets file by file: nine files from `Runtime/` and `Settings/ApplicationSupportPaths.swift` are also compiled into the wrapper (`RuntimePaths`, `RuntimeSupervision`, `RuntimeLog`, `SystemLog`, `LogLine`, `SslocalOutputIntake`, and others); all seven files from `SystemProxy/`, together with `Runtime/SystemLog.swift`, are compiled into the privileged helper (helper logs go only to the unified log; see ADR-0047). These 18 entries are explicit paths in `project.yml`. Moving a file under `Domain/` requires updating the project definition too; otherwise, `xcodegen generate` fails immediately because a file is missing. The layout guard (`DomainLayoutTests` in `Tests/Architecture/SkeletonTests.swift`) asserts that there are no flat `.swift` files at the root and that the tree contains only `.swift` files. XcodeGen would otherwise include non-source files in the Resources build phase and sign them into the bundle.
+- `Tests/` — unit-test target, run with the `ShadowsocksX-NG2` scheme. Directories define topics; there are no flat test files at the root:
+  - `Architecture/` — guards for cross-cutting project constraints (layers and layout, platform-effect seams, window entry points, and manifest completeness). They scan source or build artifacts without driving behavior.
+  - `TestSupport/` — regression tests for test-wait and cleanup helpers.
+  - `Support/` — fixtures, doubles, and helpers, with no test cases (`CatalogFixtures`, `ProxyRuntimeFixture`, `SystemProxyFakes`, `AppArtifact`, `TestSourceTree`, and others).
+  - `Agent/`, `Activation/`, `Catalog/` (workflow tests are in `Catalog/Workflow/`), `Subscription/`, `Rules/` (custom rules are in `Rules/Custom/`), `ProxyRuntime/`, `ProxyControl/`, `Runtime/`, `Settings/`, `SystemProxy/`, `Plugin/`, `Diagnostics/`, `Credentials/`, `Workspace/`, and `Servers/` — feature-domain tests aligned with production domain topics and `*Workflow` boundaries.
+  - `Smoke/` — real-process smoke tests in a separate target and scheme (`task test:smoke`).
+  - `Fixtures/RuleSnapshots/` — generated fixtures for bundled rule snapshots, distributed as folder resources in the test bundle and read by `GeneratedRuleSnapshotTests` with `subdirectory:`.
+
+  When an assertion needs to read the source tree (`Vendor/` manifests, `App/`, or `Domain/`), use `Support/TestSourceTree.swift` to locate `ShadowsocksX-NG2/` by walking up from `#filePath`. Do not hard-code the number of parent directories: test files are at different depths, and a move could make the path silently point elsewhere. `TestsLayoutTests` only asserts that there are no flat `.swift` files at the root. This is weaker than the `Domain/` guard because the root `Info.plist` and JSON under `Fixtures/` are required. `Tests/Support/AppArtifact.swift` is also compiled into the Smoke target and is an explicit file path in `project.yml`; update it when moving the file.
+- `Vendor/<name>/manifest.json` — pinned supply-chain manifest for an external binary (tag, asset URL, asset SHA-256, location inside the bundle, and signing identifier). The binary itself and `.fetched.sha256` stamp are build cache and are not checked in.
+- `Vendor/rules/geolocation-cn/` — bundled snapshot of Chinese domain rules (issue #63): `snapshot.json` (normalized rules, metadata, and loss report), `manifest.json` (upstream version and snapshot SHA-256), and `NOTICE` (license and attribution). Normal builds read only the local snapshot; they never fetch or convert rules.
+- `Vendor/rules/china-ipv4/` — bundled snapshot of Chinese IPv4 CIDRs considered for direct routing (issue #64): the same three files, sourced from a pinned commit of `china.txt` in [gaoyifan/china-operator-ip](https://github.com/gaoyifan/china-operator-ip). The rule-mode `proxy_all` ACL includes both Chinese-domain and IPv4-CIDR direct-routing candidates.
+- `Vendor/rules/gfwlist/` — bundled snapshot of GFWList proxy candidates (issue #65): the same three files, sourced from the official Base64 AutoProxy `gfwlist.txt` in [gfwlist/gfwlist](https://github.com/gfwlist/gfwlist) at a pinned commit. Domain anchors are converted to suffix matching. Eligible URL prefixes with an empty or root path are converted to exact-domain matching. The `bypass_all` ACL for “direct when unmatched” includes these proxy candidates.
+- `Scripts/` — supply-chain scripts (see [External binary supply chain](distribution.md#external-binary-supply-chain)) and packaging-gate assertions. `update-geolocation-cn.sh`, `update-china-ipv4.sh`, and `update-gfwlist.sh` are explicit maintenance actions that fetch pinned upstream versions and convert them. `verify-rule-snapshots.sh` checks snapshot integrity offline before a build.
+
+## Source search
+
+First use `rg --files` to locate files based on the directory layers above, then search content in the relevant directory or file type. If there are no matches, expand the search gradually. Run these commands from `ShadowsocksX-NG2/`:
+
+```sh
+# Find the external-binary version and source by locating its manifest first.
+rg --files Vendor/sslocal -g 'manifest.json'
+# Search relevant Swift source for runtime responsibilities.
+rg -n -g '*.swift' 'sslocal|reload' Agent Domain/Runtime App/Application/ProxyRuntime
+# List files matching a rule term before displaying matches.
+rg -l 'keyword' Vendor/rules Tests/Fixtures/RuleSnapshots
+# Display matching lines while limiting long lines and retaining match context.
+rg -n -M 300 'keyword' Vendor/rules
+```
+
+`Vendor/rules/*/snapshot.json` and `Tests/Fixtures/RuleSnapshots/*.json` are generated, single-line JSON files. `-M 300` limits the displayed length of a line in bytes; it does not limit total output. `-m` and `head -n` limit line counts but do not prevent one long line from producing too much output. To inspect complete rules, locate the specific snapshot and read the relevant JSON fields. Manifests and `NOTICE` files remain in their respective `Vendor` directories and can be searched separately as needed.
diff --git a/docs/project-structure.zh.md b/docs/project-structure.zh.md
new file mode 100644
index 000000000..93f81ec58
--- /dev/null
+++ b/docs/project-structure.zh.md
@@ -0,0 +1,63 @@
+# 工程结构与源码搜索
+
+[English](project-structure.md) | [返回工程首页](../ShadowsocksX-NG2/README.zh.md)
+
+除特别说明外，命令从 `ShadowsocksX-NG2/` 执行，文中工程路径也相对于该目录。
+
+## 工程结构
+
+- `project.yml` — XcodeGen 工程定义，唯一事实来源。`.xcodeproj` 与 `App/Resources/Info.plist`、`*.entitlements`、`Tests/Info.plist` 都是生成物（已 gitignore），改工程结构一律改 `project.yml` 后重新生成。
+- `App/` — app target 源码（SwiftUI 菜单栏 app，LSUIElement）。目录即分层，层内按功能分组：
+  - `Composition/` — 组合根与进程生命周期：`@main`、依赖装配、应用形态与窗口激活策略。
+  - `Application/` — 应用层（无 SwiftUI 视图）：`*Workflow/` 工作流 module（UI-facing interface 与实现协作者）、`ProxyRuntime/` 运行时控制器家族与事实投影、`Services/` LaunchAgent/登录项/helper/防火墙。
+  - `Presentation/` — 跨功能表现层：错误呈现、被多个界面共用的状态模型。
+  - `UI/` — 视图层，按子视图分目录（`Workspace/`、`Home/`、`Servers/`、`Subscriptions/`、`Rules/`、`Settings/`、`Diagnostics/`、`StatusMenu/`，`Servers/Plugin/` 为插件管理子视图）。
+  - `PlatformEffects/` — 平台效应 seam（协议 + AppKit adapter；测试替身在 `Tests/Support/`），系统框架访问集中于此。
+  - `Resources/` — `Info.plist`、`entitlements`（生成物）与 `Assets.xcassets`、`*.xcstrings`（入库）。
+
+  分层边界由 `Tests/Architecture/SkeletonTests.swift` 的正向圈定守卫断言：只扫描 `App/UI/`，视图层不得引用运行时控制器、工作流实现协作者或原始目录/凭据存储类型；新增运行时适配器放进 `Application/` 即自动落在扫描范围外，无需登记豁免。注意 `App/` 下任何非源码文件都会被 XcodeGen 收进 Resources 阶段并封进签名后的 bundle，因此文档不放 `App/`（`project.yml` 已排除 `**/*.md`）。分层与主题的组织方式、守卫为何取正面圈定、以及 XcodeGen 的上述约束见 [ADR-0029](adr/0029-source-layout-declares-layer-and-theme.md)。
+- `Agent/` — 独立的后台监管可执行文件，装入 `Contents/MacOS/`，由 LaunchAgent 常驻。只读取非秘密 `agent-supervision.json`，切换稳定配置与 ACL 链接，启动和监管 sslocal；不解析 sslocal 配置或 LAN 凭据。发布与失败处理见 ADR-0037、ADR-0038，GUI 单向配置输出见 ADR-0043。
+- `LaunchAgent/` — `SMAppService.agent(plistName:)` 的注册清单，装入 `Contents/Library/LaunchAgents/`；`ProgramArguments` 用 bundle 相对路径，由 launchd 按注册 app 的 bundle 位置解析。
+- `Domain/` — 领域核心（配置目录树、凭据引用与持久化，spec #21 D3/D5），与 UI 无关。目录即主题，根下不留平铺文件，子目录口径取自 [术语表](../GLOSSARY.md) 的章节划分：
+  - `Catalog/` — 配置目录树、结构不变量错误、目录文件存储、节点与凭据身份，以及 `ss://` 编解码 `SsUri`。
+  - `Subscription/` — 订阅文档解析、抓取、订阅记录与刷新失败。
+  - `Rules/` — 代理模式、规则身份与匹配、内置规则快照、规则集合/浏览/分析、离线规则测试；`Rules/Custom/` 为用户自定义规则的编辑草稿、校验与存储。
+  - `Runtime/` — 代理运行服务：运行时文档与监听设置、ACL 与部署收据、路径、原子写入、文件存储、日志与事件（统一日志发射单元 `SystemLog`、统一日志行 `LogLine`、sslocal 输出 intake）、端点/端口/socket 探针。
+  - `Activation/` — 激活候选校验、激活状态机与 `RuntimeConfiguration`。
+  - `Settings/` — 代理监听配置文件、独立代理控制偏好、运行计算的内存快照与静默启动偏好。
+  - `SystemProxy/` — 系统代理 typed 配置、property list 映射、计划器、特权 helper 的 XPC 契约/请求引擎与 helper 侧日志事件。
+  - `Plugin/` — 托管插件、用户插件映射与插件安全校验。
+  - `Credentials/`、`LegacyImport/`、`Diagnostics/` — 主密钥存储与加密文件提交、旧版导入、诊断报告。
+
+  跨进程契约按**文件**编入其它 target：`Runtime/` 的 9 个文件和 `Settings/ApplicationSupportPaths.swift` 同时编入 wrapper（`RuntimePaths`、`RuntimeSupervision`、`RuntimeLog`、`SystemLog`、`LogLine`、`SslocalOutputIntake` 等），`SystemProxy/` 全部 7 个文件连同 `Runtime/SystemLog.swift` 编入特权 helper（helper 侧日志只进统一日志，ADR-0047）。`project.yml` 里这 18 条是显式路径，在 `Domain/` 内移动文件必须同步，漏改会让 `xcodegen generate` 以缺文件直接失败。布局守卫（`Tests/Architecture/SkeletonTests.swift` 的 `DomainLayoutTests`）断言根下无平铺 `.swift`、树下只有 `.swift`（非源码文件会被 XcodeGen 收进 Resources 阶段并封进签名后的 bundle）。
+- `Tests/` — 单元测试 target，随 `ShadowsocksX-NG2` scheme 运行。目录即主题，根下不留平铺测试文件：
+  - `Architecture/` — 跨切面工程约束守卫（分层与布局、平台效应 seam、开窗落点、清单完整性），扫源码或构建产物而不驱动行为。
+  - `TestSupport/` — 测试等待与清理 helper 的故障回归用例。
+  - `Support/` — 夹具、替身与 helper，不含用例（`CatalogFixtures`、`ProxyRuntimeFixture`、`SystemProxyFakes`、`AppArtifact`、`TestSourceTree` 等）。
+  - `Agent/`、`Activation/`、`Catalog/`（工作流用例在 `Catalog/Workflow/`）、`Subscription/`、`Rules/`（自定义规则在 `Rules/Custom/`）、`ProxyRuntime/`、`ProxyControl/`、`Runtime/`、`Settings/`、`SystemProxy/`、`Plugin/`、`Diagnostics/`、`Credentials/`、`Workspace/`、`Servers/` — 按功能领域的用例，与生产代码的领域主题和 `*Workflow` 同名同界。
+  - `Smoke/` — 真实进程冒烟，独立 target 与 scheme（`task test:smoke`）。
+  - `Fixtures/RuleSnapshots/` — 生成的内置规则快照夹具，作为 folder resource 随测试 bundle 发布（`GeneratedRuleSnapshotTests` 按 `subdirectory:` 读）。
+
+  断言需要读源码树（`Vendor/` 清单、`App/`、`Domain/`）时一律经 `Support/TestSourceTree.swift` 从 `#filePath` 沿父目录上溯定位 `ShadowsocksX-NG2/`，不写死父目录层数——测试文件处于不同深度，写死层数会在文件移动后静默指错。布局守卫 `TestsLayoutTests` 只断言根层无平铺 `.swift`（比 `Domain/` 那条弱一档：根层的 `Info.plist` 与 `Fixtures/` 下的 JSON 都必须在）。`Tests/Support/AppArtifact.swift` 同时编入 Smoke target，是 `project.yml` 里的显式文件路径，移动需同步。
+- `Vendor/<name>/manifest.json` — 外部二进制的固定供应链清单（tag + 资产 URL + 资产 SHA-256 + bundle 内位置 + 签名 identifier）；二进制本体与 `.fetched.sha256` 戳是构建缓存，不入库。
+- `Vendor/rules/geolocation-cn/` — 内置中国域名规则快照（issue #63）：`snapshot.json`（规范化规则 + 元数据 + 损失报告）、`manifest.json`（上游版本与快照 SHA-256）、`NOTICE`（许可证与归属）。普通构建只读本地快照，绝不抓取或转换。
+- `Vendor/rules/china-ipv4/` — 内置中国 IPv4 CIDR 直连候选快照（issue #64）：同上三件套，来源为 [gaoyifan/china-operator-ip](https://github.com/gaoyifan/china-operator-ip) `china.txt` 固定 commit。规则模式的 `proxy_all` ACL 同时编入中国域名与 IPv4 CIDR 直连候选。
+- `Vendor/rules/gfwlist/` — 内置 GFWList 代理候选快照（issue #65）：同上三件套，来源为 [gfwlist/gfwlist](https://github.com/gfwlist/gfwlist) 官方 Base64 AutoProxy `gfwlist.txt` 固定 commit。域名锚点转换为后缀匹配，满足条件的空路径或根路径 URL 前缀转换为精确域名匹配；「未匹配时直连」的 `bypass_all` ACL 编入这些代理候选。
+- `Scripts/` — 供应链脚本（见[外部二进制供应链](distribution.zh.md#外部二进制供应链)）与打包门槛断言；另有 `update-geolocation-cn.sh` / `update-china-ipv4.sh` / `update-gfwlist.sh`（显式维护动作，抓取固定版上游并转换）与 `verify-rule-snapshots.sh`（构建前离线校验快照完整性）。
+
+### 源码搜索
+
+先按上面的目录分层用 `rg --files` 定位，再限定目录或文件类型搜索内容；未找到时逐步扩大范围。以下命令从 `ShadowsocksX-NG2/` 执行：
+
+```sh
+# 查外部二进制版本与来源，先定位对应清单
+rg --files Vendor/sslocal -g 'manifest.json'
+# 查运行职责，限定相关 Swift 源码
+rg -n -g '*.swift' 'sslocal|reload' Agent Domain/Runtime App/Application/ProxyRuntime
+# 查规则内容时先只列出命中文件
+rg -l '关键词' Vendor/rules Tests/Fixtures/RuleSnapshots
+# 需要显示匹配行时，省略超长行并保留命中提示
+rg -n -M 300 '关键词' Vendor/rules
+```
+
+`Vendor/rules/*/snapshot.json` 与 `Tests/Fixtures/RuleSnapshots/*.json` 是生成的单行 JSON。`-M 300` 按字节限制长行显示，不限制总输出量；`-m` 和 `head -n` 只限制行数，不能防止单条长行撑大输出。需要完整规则时，定位具体快照后按 JSON 字段读取。清单与 `NOTICE` 也保留在各自的 Vendor 目录中，可按需单独搜索。
diff --git a/docs/research/acl-system-proxy-host-acceptance.md b/docs/research/acl-system-proxy-host-acceptance.md
new file mode 100644
index 000000000..8bbb9383a
--- /dev/null
+++ b/docs/research/acl-system-proxy-host-acceptance.md
@@ -0,0 +1,38 @@
+# ACL 系统代理路径宿主验收证据（issue #67）
+
+- 记录日期：2026-09-26
+- 记录人：Qiu Yuzhou（agent 辅助执行）
+- 环境：macOS 26（Darwin 27.0.0）arm64；Xcode DerivedData Debug 构建；随包 sslocal v1.25.0（`aarch64-apple-darwin`，Vendor 清单固定版本，构建期哈希复验 + Developer ID 重签）。
+- 证据规则：以下每一条都对应可重复执行的自动化测试或本记录中的命令输出摘要；未实测的系统行为不写成事实，统一列在「未验证边界」。
+
+## 自动化回归覆盖（fake / 回环，不写真实 SystemConfiguration）
+
+以下类别由 `ShadowsocksX-NG2/Tests/` 中的确定性 fake 与回环测试覆盖，不启动真实 LaunchAgent、不写用户真实系统代理字典：
+
+| 类别 | 覆盖位置 | 要点 |
+| --- | --- | --- |
+| 模式切换与持久化 | `ProxyRuntimeControllerTests+Mode`、`ProxyControlWorkflowIntegrationTests` | 规则/全局/直连三模式切换、子选项切换、偏好持久化、GUI 重启后恢复 |
+| 出口待配置 | `ProxyRuntimeControllerTests+AgentAndSystemProxy`、`+Mode` | 无活动目标时 agent 仍监听；规则/全局不写系统代理；直连可用 |
+| ownership | `ProxyRuntimeControllerTests+AgentAndSystemProxy`、`SystemProxyTests` | ownership 冲突报告而不强制覆盖；恢复顺序（先恢复系统代理再注销 agent） |
+| 失败回滚 | `ProxyRuntimeControllerTests+Mode`、`+GlobalMode` | 模式切换失败恢复旧模式、旧 ACL、旧系统代理应用状态 |
+| GUI 重同步 | `ProxyRuntimeControllerTests+ResyncAndSettings`、`+AgentAndSystemProxy` | `resyncOnLaunch` 注册态重校验、目标失效后 agent 保持监听但系统代理撤回 |
+| ACL 路由（真实 sslocal 回环） | `RealSslocalSmokeTests+ACLRouting`、`+GFWListACL`、`+CustomRules` | `proxy_all`/`bypass_all`、域名与 IP 优先级、SOCKS/HTTP 共用 ACL、无服务器直连 |
+| 规则快照与许可证 | `BuiltinRuleCatalogTests`、`Scripts/verify-rule-snapshots.sh`（构建期门） | 快照来源/许可证/归因随分发物；缺失或损坏使构建失败 |
+
+## 已在真实宿主观察到的行为
+
+1. **构建产物签名与打包门**：`Scripts/packaging-gate.sh` 在构建后对 `ShadowsocksX-NG2.app` 做嵌套代码签名严格校验、DevID + Hardened Runtime 断言、逐二进制清单覆盖。本机 Debug 构建通过该门（`task build` 成功）。
+2. **规则快照许可证/归因随分发**：`Vendor/rules/{gfwlist,geolocation-cn,china-ipv4}/` 各含 `NOTICE`（许可证、上游 URL/commit、归因声明）与 `manifest.json`（输入摘要、转换器版本）；`verify-rule-snapshots.sh` 在构建期断言二者齐备。
+3. **真实 sslocal ACL 路由（回环）**：`RealSslocalSmokeTests` 以随包 sslocal 做有界回环验证——`proxy_all`/`bypass_all` 骨架、中国域名/CIDR 直连候选、GFWList 代理候选、自定义规则合并、SOCKS 与 HTTP 入站共用同一 ACL、空服务器列表仍绑定本地监听。
+
+## 未验证边界（不写成事实）
+
+以下项目需要在真实 macOS 宿主上单独验收，本记录不作声称：
+
+1. **真实 SystemConfiguration 写入**：`SystemConfigurationProxyController` 对 SCPreferences 的授权、写入、提交、ownership 冲突检测在自动化测试中全部走 fake。真实 `SCPreferencesCommitChanges` 行为、多网络位置切换、授权对话框流程未在本机做端到端实测。
+2. **系统 SOCKS 设置的跨应用遵守程度**：产品只承诺「已遵守系统 SOCKS 设置或明确连接本地入口的流量被规则处理」。哪些应用真正遵守 macOS 系统 SOCKS 代理、哪些绕过，未做跨应用矩阵实测。
+3. **IPv6 系统例外匹配**：CONTEXT.md 已记录「IPv6 CIDR 字符串写入系统例外不构成已验证的绕过保证」。只读 CFNetwork 验证仅证明本机观察：IPv4 CIDR 与 `*.local` 匹配，IPv6 CIDR 的裸写/尖括号/方括号写法未按预期匹配，精确 IPv6 地址可匹配。跨 macOS 版本行为未验证。
+4. **DNS 覆盖**：CIDR 判定可能触发 sslocal 本地 DNS 查询；产品不承诺 DNS 查询均经远端。真实 DNS 泄漏边界未做抓包验证。
+5. **UDP 流量覆盖**：SOCKS5 UDP ASSOCIATE 是本地入口能力，不等于系统级 UDP 代理。全应用 UDP 流量是否被拦截未验证。
+6. **签名/公证分发**：Developer ID 公证（notarytool）、 stapling、Gatekeeper 首次打开流程未在本记录环境完成（Debug 构建不走公证）。
+7. **GFWList 例外遮蔽**：被更宽代理规则遮蔽的 `@@` 例外不写入 ACL，已列入转换报告与已知问题；真实网络下这些目标的实际路由表现未做端到端确认。
diff --git a/docs/research/legacy-handoff-bootout-live-fire.md b/docs/research/legacy-handoff-bootout-live-fire.md
new file mode 100644
index 000000000..8da088af2
--- /dev/null
+++ b/docs/research/legacy-handoff-bootout-live-fire.md
@@ -0,0 +1,34 @@
+# Legacy bootout 实弹验证记录（issue #37 / Further Notes #5 闭环）
+
+- 验证日期：2026-09-21
+- 环境：macOS 27.0（Build 26A428，arm64），uid 501（Aqua gui 域）。研究报告 `wayfinder-issue-17-legacy-handoff.md` §9.2 要求的「受控环境 bootout 演练」在本机以假替身 job 完成：plist 使用与 Legacy 完全相同的 label 与结构（无 RunAtLoad/KeepAlive 的现行形态 + KeepAlive=true 的 2017 前残留形态），可执行体为 `/usr/bin/nc -l 1086`（模拟 ss-local 持有 SOCKS 端口）。Legacy 实际 ss-local/Privoxy 本体未参与（本机无 Legacy 安装）；label、plist 键、启动方式（`launchctl start`）与真实残留一致，launchd 侧行为不受可执行体影响。
+- 基线（验证前）：三个 label `launchctl print gui/501/…` 均退出码 113（未加载）；1086 无监听；`~/Library/LaunchAgents/` 无相关 plist；print-disabled 中已有 `.local`/`.http` 的历史 `=> enabled` 记录（研究报告 §2.1 所述残留）。
+
+## 结果摘要
+
+| # | 场景 | 命令 | 退出码 | 观测 |
+| --- | --- | --- | --- | --- |
+| 1a | 现行形态：job 已加载 + 进程持端口 | bootstrap（exit 0）→ `launchctl start`（exit 0）→ print=0，lsof 见 `nc *:1086 LISTEN`（pid 79755） | — | 无 RunAtLoad 的 plist 注册后不自动启动，须显式 start——与 Legacy 脚本行为一致 |
+| 1b | **bootout 运行中的 job** | `launchctl bootout gui/501/com.qiuyuzhou.shadowsocksX-NG.local` | **0**（wall ≈20ms） | +100ms 内：print→**113**、lsof 无监听、nc 进程消失。SIGTERM→等退出的等待期短到不可观测 |
+| 2a | KeepAlive 残留形态被外部杀死 | plist 带 `KeepAlive: true`，bootstrap 后 `kill -9` 持有进程 | — | ≤2s 内 launchd 重启新进程（pid 80094→80108），端口继续被持有——证实活跃残留会自我复活 |
+| 2b | **bootout KeepAlive job** | 同 1b | **0** | 进程退出、端口释放、print→113，连续 5s 无重启（KeepAlive 重启依据随 job 定义一并移除） |
+| 3a | **bootout 未加载的 label** | 同 1b | **3**（stderr `Boot-out failed: 3: No such process`） | **不是 print 的 113**——退出码语义按子命令而异，产品代码把 0/3 都按「已移除」处理 |
+| 3b | job 已加载但 plist 文件已删（错位形态） | bootstrap+start 后 `rm plist` 再 bootout | **0** | 按 service target bootout 不需要 plist 存在；print→113、端口释放 |
+| 3d | `launchctl kill 15` 后备 | `launchctl kill 15 gui/501/<label>` | **0** | 旧进程收到 SIGTERM 退出，但 **job 定义仍在（print=0）**，KeepAlive 形态下进程立即被重启——kill 只是终止不是移除，验证后仍须 bootout |
+| 3e | disable / enable 语义 | `launchctl disable gui/501/<dummy>` | **0**（幂等） | print-disabled 立即出现 `<dummy> => disabled`；disabled 状态下 bootstrap 该 label 失败（`5: Input/output error`）——disable 确实阻止加载且跨启动持久；`enable` 后记录变为 `=> enabled`（记录保留，状态翻转） |
+
+## 对产品实现的直接修正
+
+1. `LegacyHandoffService.removeJob` 把 bootout 退出码 **0 与 3** 都视为「已移除」（3 = print 与 bootout 之间自行退出的竞态，或检测后未再加载）。测试假实现同步改为 3。
+2. kill 后备的验证判据维持 print 退出码（kill 不改变注册态，print=0 ⇒ kill 未达成移除，继续升级为失败呈现）。
+
+## 清理与残留声明
+
+- 验证后：三个 label print 均 113；1086 空闲；`~/Library/LaunchAgents/` 无相关 plist；`/tmp` 临时 plist 已删。
+- print-disabled 中 `.local`/`.http` 的历史 `=> enabled` 记录与验证前一致（bootstrap/bootout 不写 override 记录）。
+- 唯一新痕迹：dummy label `com.qiuyuzhou.shadowsocksx-ng2.live-test-dummy` 在 print-disabled 留下一条 `=> enabled` 记录（enabled 即默认态，无行为影响；launchctl 无删除单条记录的接口）。
+
+## 遗留验证余项（不阻塞本票）
+
+- macOS 15 与 27 的 print-disabled 呈现细节、`statusForLegacyURL:` 对第三方 plist 的返回语义（研究报告 §9.1）。
+- 真实 Legacy ss-local（`--reuse-port`）的端口释放时序：本验证用 nc（无复用选项）替身；bind 探测「无 SO_REUSEPORT ⇒ 真占用」的语义已由研究报告 §2.3 论证，产品探测不设置任何复用选项。
diff --git a/docs/research/plugin-compat-record.md b/docs/research/plugin-compat-record.md
new file mode 100644
index 000000000..0cff24301
--- /dev/null
+++ b/docs/research/plugin-compat-record.md
@@ -0,0 +1,64 @@
+# 受管插件功能级兼容实测记录（spec #21 Further Notes #6，issue #38）
+
+- 实测日期：2026-09-21
+- 实测人：Qiu Yuzhou（agent 辅助执行）
+- 环境：macOS 26（Darwin 27.0.0）arm64；Xcode DerivedData Debug 构建；sslocal v1.25.0（`aarch64-apple-darwin`，归档 SHA-256 `58e0caf0…`）；v2ray-plugin v1.3.2（`darwin-arm64`，归档 SHA-256 `35747669…`），均为 Vendor 清单固定版本，构建期哈希复验 + Developer ID 重签（插件 identifier `com.qiuyuzhou.ShadowsocksX-NG.plugin.v2ray-plugin`，hardened runtime）。
+- 证据规则：以下每一条都对应可重复执行的测试或本记录中的命令输出摘要；未实测的系统行为不写成事实。
+
+## 已实测闭环
+
+### 1. 配置生成 → sslocal 拉起 → 插件进程建立（端到端边界）
+
+生产组合根已接线：`CatalogViewModel` / `ProxyRuntimeController` 的默认受管插件提供均为 `BundleManagedPluginProvider`（宿主 app bundle），激活派生、编辑器提供事实与诊断清单读同一事实源；`BundleManagedPluginProviderTests.testHostAppBundleProvidesManagedPlugin` 固化「bundle 内插件在位」防打包回归。
+
+`Tests/RealSslocalSmokeTests.testRealSslocalLaunchesManagedV2rayPluginProcess`：
+
+- 契约 `servers[0]` 携带 bundle 内插件绝对路径（`Contents/Helpers/Plugins/v2ray-plugin`）与 `plugin_opts: "mode=websocket"`；
+- wrapper 以真实 sslocal 拉起，SIP003 插件进程建立（`pgrep -f` 按完整路径确认，进程存活）；
+- 本地 SOCKS 端口完成监听绑定；
+- SIGTERM 停止链：wrapper 干净退出（0），插件进程随 sslocal 一并结束。
+
+无插件基线 `testRealSslocalBindsSOCKSAndHTTPPortsAndCompletesHandshake` 在同一套件中保持通过（SOCKS5 完整握手）。
+
+实测观察（补充两条对后续票有用的行为事实）：
+
+- **sslocal 在插件进程就绪前不绑定本地监听**。插件冷启动（首次 exec 触发签名校验）时，从 sslocal spawn 到端口可用可能明显超过 3 秒（本机 xcodebuild 冷环境实测出现过 6 秒级）。D10 的「3 秒未建立监听 → error 日志」在此场景是真实告警而非误报，GUI 健康门（15 秒）不受影响。
+- shadowsocks-rust 按 SIP003 以 `SS_LOCAL_HOST/SS_LOCAL_PORT` 环境变量让插件监听管道口；插件进程先于本地端口出现。
+
+### 2. 选择器全语义与保存语义
+
+`Tests/CatalogViewModelPluginTests`（9 例）与 `Tests/BundleManagedPluginProviderTests`（6 例）：
+
+- 「无 / 受管 / 集外」三态呈现；受管选中显示供应链事实（来源项目、许可证 MIT、固定版本 v1.3.2、重签标识）且只有受管选中出现参数输入；
+- 受管选择落盘：程序名入目录、参数入钥匙串（引用形态）；空参数删除引用与秘密；「无」整体清除；
+- 集外引用（如 Legacy/订阅带入的 `obfs-local`）显式渲染「本版本未提供」、原样保留引用与参数秘密，连接字段照常可编辑；
+- 受管集外程序名一律 `executablePath == nil`（含路径形态引用，绝不拼接用户输入），经状态机以 `pluginNotProvided` 原子拒绝；文件缺失/降级同语义。
+
+### 3. 激活失效路径接 #26 语义
+
+`Tests/ActivationStateMachineTests`（存量）+ `BundleManagedPluginProviderTests`（新增，以真实文件存在性驱动 provider）：
+
+- 组内一叶引用未提供插件 → 整组原子拒绝并点名；
+- 活动目标插件变为不可用（`catalogDidCommit` / `resyncOnLaunch`）→ 清除目标、停止代理、点名原因（`ProxyRuntimeControllerTests` 存量覆盖）。
+
+### 4. ss URI 往返
+
+`Tests/SsUriTests`（存量，逐字节同构语料）+ `CatalogViewModelPluginTests.testSharedSsUriRoundTripsThroughEditorEdit`（经编辑面保存 → 分享 → 再导入，`plugin=name;opts` 同构，与 #32 编解码一致）。
+
+### 5. 诊断页/导出
+
+`Tests/DiagnosticReportTests`（新增 2 例）：导出含「受管插件」清单（程序名 + 版本 + 提供/缺失），投毒夹具确认插件参数不进导出。
+
+### 6. wrapper 监听判定
+
+`Tests/AgentLifecycleTests.testListenNotEstablishedWithinDeadlineIsLoggedAndSupervisionContinues`：stub sslocal 不监听 → 拉起 3 秒后 `agent.log` 出现 `listen not established within deadline: <端点>`，监管循环继续，后续 SIGTERM 停止链不受影响（D10「运行期失败以 sslocal 信号为准，GUI 不猜测」）。插件进程退出不经 wrapper 直接观测——插件死亡连带 sslocal 退出（实测行为），由既有的 `sslocalExitedUnexpectedly` error 日志承接，与「以 sslocal 信号为准」一致。
+
+## 仍属发布门槛人工项（不能在本机自动化闭环）
+
+1. **真实服务器功能验证**：经 v2ray-plugin websocket 隧道访问真实远端的协议行为与性能（无真实服务器夹具；本记录只闭环到「插件进程建立 + 本地监听」边界）。
+2. **真实公证对嵌套重签插件的接受度**（Further Notes #3，需 notarytool 凭据，#39）。
+3. **Gatekeeper 首启/quarantine 实机弹窗形态**（Further Notes #1）与 Hardened Runtime 下两级子进程签名链在陌生机器上的表现（Further Notes #2 的实机部分）。
+
+## 结论
+
+#38 验收标准中「stub 边界验证或真实夹具」档位的功能级兼容实测已闭环并固化为本仓库测试；真实服务器配合、公证与陌生机器 Gatekeeper 行为按规格保留为发版前人工检查项。
diff --git a/docs/research/proxy-rule-sources-2026-09.md b/docs/research/proxy-rule-sources-2026-09.md
new file mode 100644
index 000000000..43d1fff1c
--- /dev/null
+++ b/docs/research/proxy-rule-sources-2026-09.md
@@ -0,0 +1,160 @@
+# 代理规则来源研究（2026-09-24）
+
+> 研究日期：2026-09-24。本文只记录在线核验到的源项目、原始数据、生成工具和分发物，不把任何列表描述为完整、实时准确或适合所有网络。访问状态以本次核验为准；上游可能在报告之后变化。
+
+## 结论先行
+
+推荐将规则链分成四层：
+
+1. **代理域名原始源**：继续以 [gfwlist/gfwlist](https://github.com/gfwlist/gfwlist) 的官方 `gfwlist.txt` 为可选的 GFWList 输入；必须解码、解析和转换，不能把该 URL 当作 PAC JavaScript 直接提供给客户端。
+2. **中国直连域名原始源**：优先使用 [v2fly/domain-list-community](https://github.com/v2fly/domain-list-community) 的 `cn` / `geolocation-cn` 数据；需要“更偏向大陆直连”的现成 `geosite.dat` 时再评估 [Loyalsoldier/domain-list-custom](https://github.com/Loyalsoldier/domain-list-custom)，但要锁定版本并记录它相对 v2fly 的删改。
+3. **中国大陆 IPv4 CIDR 原始/准原始源**：默认首选 [gaoyifan/china-operator-ip](https://github.com/gaoyifan/china-operator-ip) 的 `ip-lists` 分支；若优先考虑新鲜度，可把 [misakaio/chnroutes2](https://github.com/misakaio/chnroutes2) 作为 BGP 聚合备选；若要求可审计的注册分配基线，则直接消费 [APNIC delegated statistics](https://ftp.apnic.net/stats/apnic/delegated-apnic-latest)，自行从地址起点和数量换算 CIDR。不要把 IP 地理归属当作域名可达性证明。
+4. **转换与分发**：Clash/Surge/Quantumult/sing-box/V2Ray 的发布文件可使用 [Loyalsoldier/geoip](https://github.com/Loyalsoldier/geoip)、[Loyalsoldier/v2ray-rules-dat](https://github.com/Loyalsoldier/v2ray-rules-dat) 或 ACL4SSR 的相应产物，但它们是生成/分发层，不应替代上述源数据；NG2 应生成并缓存自己的本地 PAC 快照。
+
+对本仓库 NG2 的实际建议是：保留 GFWList URL 作为“远程源配置”，但将未来实现限定为“下载快照 → 校验/解码 → 解析可表达的规则 → 生成本地 PAC”；中国直连域名和 CIDR 不应未经转换直接塞入现有 PAC 用户规则字段。当前 NG2 的 `PACUserRules` 只把 `@@` 规则转换为 DIRECT，普通代理规则会保持默认 SOCKS，且 PAC 生成器没有 CIDR 匹配能力；这与完整 GFWList/PAC 编译器不是同一件事。
+
+## 评价标准与格式边界
+
+- **原始规则源**：维护者直接编辑或由公开注册/BGP数据直接产生的输入，如 GFWList 的源列表、v2fly `data/*`、APNIC delegated 文件、gaoyifan 的 BGP 结果。
+- **转换后的分发文件**：由源数据生成的 `geosite.dat`、`geoip.dat`、SRS/MRS、Clash/Surge 文本等；方便使用，但应保留上游版本、生成时间和校验值。
+- **生成工具**：负责解码、合并、过滤、格式转换或压缩的代码；工具本身不是规则正确性的来源。
+- **推荐组合**：为 NG2 选择的输入和转换路径，不等于把多个列表无条件并集。并集越大，CDN/云厂商共享地址导致的误直连越多。
+
+PAC 只能自然表达域名/URL匹配和 `DIRECT`/代理返回值；CIDR 需要额外的 IP 解析逻辑，且 PAC 的 `dnsResolve()` 会引入 DNS、性能和失败语义，不建议把整套中国 IP 段硬编码进 PAC。Clash、Surge、Quantumult 和 sing-box/V2Ray 则分别有自己的 `DOMAIN-SUFFIX`/`IP-CIDR`、`RULE-SET`、SRS/MRS 或 `geosite`/`geoip` 语义，不能只改文件扩展名。
+
+## 1. GFWList：需要代理的网站/域名
+
+### 原始源与规范
+
+- 源项目：[gfwlist/gfwlist](https://github.com/gfwlist/gfwlist)。官方 README 称其为官方 GFWList 仓库，并发布 GitHub raw、GitLab、Repo.or.cz 和 jsDelivr 地址；建议优先使用仓库源或官方 README 中的镜像入口。[README](https://github.com/gfwlist/gfwlist/blob/master/README-EN.md)
+- 当前原始分发物：[gfwlist.txt](https://raw.githubusercontent.com/gfwlist/gfwlist/master/gfwlist.txt)。本次读取到的编码头包含 `AutoProxy 0.2.9`、`Expires: 6h`、`Last Modified: Mon, 21 Sep 2026 12:27:46 +0000`，并声明 LGPL-2.1 URL；该文件是 Base64 编码的 AutoProxy 规则，不是 PAC JavaScript。[原始文件](https://raw.githubusercontent.com/gfwlist/gfwlist/master/gfwlist.txt)
+- 规范要点来自源文件头和维护工具关联：[gfwlist/apollyon](https://github.com/gfwlist/apollyon) 是 GFWList 官方 README 指向的维护脚本仓库，包含 checksum、规则检查和 CIDR 计算脚本。分发物解码后仍可能含 `@@` 例外、URL锚点、通配符和正则；转换器若只抽取域名会丢失语义。
+
+### 维护活跃度与风险
+
+- GitHub 组织页在本次访问时显示主仓库 past-year activity 有更新，搜索结果显示最近更新到 2026-08-09；原始文件头的 2026-09-21 修改时间说明源列表仍有较新的发布内容。[组织页](https://github.com/gfwlist)
+- 官方 README 明确说新提交不会实时进入列表，通常要经过可用性测试；因此它不是实时封锁状态 API，也不应宣称覆盖所有被阻断网站。[README](https://github.com/gfwlist/gfwlist/blob/master/README-EN.md)
+- 许可证/分发：源文件头指向 LGPL-2.1；分发时应保留许可证和上游归属。CDN/raw 镜像是传输层，不应被当作独立来源；锁定具体 commit 或保存 checksum，避免远程内容无提示漂移。
+- 误匹配/漏匹配：共享 CDN、第三方登录、国际化域名、URL路径规则和正则都可能导致误代理或漏代理。GFWList 目标是“需代理的候选规则”，不是中国境内直连白名单。
+
+### 适配矩阵
+
+- **PAC**：适合，但必须 Base64 解码、按 AutoProxy 语义解析并编译为 `FindProxyForURL`；`@@` 例外必须优先于代理规则。GFWList 官方 issue #2637 记录了用户请求直接提供 PAC JavaScript，状态为 closed as not planned，说明官方 URL 本身不是 PAC 成品。[issue #2637](https://github.com/gfwlist/gfwlist/issues/2637)
+- **Clash/Surge/Quantumult**：适合经过专用转换器生成目标规则；不要把原始 Base64 当作这些客户端的 `RULE-SET`。
+- **sing-box/V2Ray/geosite**：不应直接当作 geosite 输入；应转为目标格式，或使用 v2fly/Loyalsoldier 的原生 geosite 体系。
+- **NG2 local PAC**：适合作为一个代理规则输入，但应在本地快照编译；远程下载失败、解码失败、未知语法或校验失败时保留旧快照，不应生成“空规则即全部直连”的危险回退。
+
+## 2. 中国常用网站直连域名
+
+### v2fly/domain-list-community：首选原始域名体系
+
+- 源：[v2fly/domain-list-community](https://github.com/v2fly/domain-list-community)。项目明确说明它维护供路由使用的 domain lists，不主张某个域名必须被阻断或代理；`cn`、`geolocation-cn`、`tld-cn` 等是可组合的分类，不是“所有中国网站”的保证。[README](https://github.com/v2fly/domain-list-community/blob/master/README.md)
+- 访问/活跃度：本次访问看到 GitHub 页面显示约 5,819 commits、75 issues、59 PRs；V2Fly 组织页显示该仓库最近更新到 2026-09-22，属于持续维护的源项目。[仓库](https://github.com/v2fly/domain-list-community)、[组织页](https://github.com/v2fly)
+- 格式：`data/*` 支持 `domain:`、`full:`、`keyword:`、`regexp:`、`include:` 和 `@attr`；裸域名按 domain/root-domain 语义处理。官方生成器代码负责解析并生成 `dlc.dat`，工作流还导出 plaintext YAML 和 checksum。[生成器](https://github.com/v2fly/domain-list-community/blob/master/main.go)、[构建工作流](https://github.com/v2fly/domain-list-community/blob/master/.github/workflows/build.yml)
+- 分发：官方 release 提供 `dlc.dat`、plain YAML 和 SHA-256；V2Ray 文档定义 `geosite:cn` 为常见大陆网站域名与 `tld-cn` 的组合，并说明 `geolocation-cn` 是常见大陆网站域名。[官方路由文档](https://github.com/v2fly/v2fly-github-io/blob/master/docs/en_US/config/routing.md)
+- 许可证：仓库显示 MIT；数据条目仍可能有各自的事实/来源和第三方内容问题，不能把 MIT 自动解释成所有域名数据都无条件免审。[LICENSE](https://github.com/v2fly/domain-list-community/blob/master/LICENSE)
+- 风险：分类判断与“当前从某个网络访问一定直连”不同；多地部署、海外 CDN、同一公司不同地区服务会造成误直连或误代理。`regexp`/`keyword` 转 PAC 时尤其容易扩大匹配范围。
+- 适配：原生适合 V2Ray/Xray/geosite；可由工具转换为 sing-box、Clash、Surge/Quantumult；生成 PAC 前应只允许 `domain`/`full` 等可审计子集，明确丢弃/报告 `regexp`、`keyword`、属性和 include 的转换损失。
+
+### Loyalsoldier/domain-list-custom：偏大陆使用场景的转换版
+
+- 源/产物：[Loyalsoldier/domain-list-custom](https://github.com/Loyalsoldier/domain-list-custom)。README 明确它基于 v2fly/domain-list-community，并把 `dlc.dat` 重命名为 `geosite.dat`；它移除 `cn`、`geolocation-cn`、`geolocation-!cn` 中部分 `@ads`、`@cn`、`@!cn` 属性规则，目的之一是避免国区 Steam 等有大陆接入点的服务被不必要地代理。[README](https://github.com/Loyalsoldier/domain-list-custom)
+- 访问/活跃度：本次访问显示 62 commits、2 PR、0 issue；有持续产物发布，但项目规模和讨论面明显小于 v2fly。因此推荐它作为“有明确偏好后的分发版”，不作为唯一真相源。
+- 格式/适配：直接面向 geosite.dat 兼容客户端；其 README 列出 Hysteria、Shadowsocks-windows、Xray-core、Trojan-Go、Leaf 等兼容范围，并有 latest release 下载地址。要生成 PAC/Clash/Surge/Quantumult，仍需从源文本或可导出的 plaintext 规则再转换。
+- 许可证：仓库显示 MIT；但它是二次整理版，分发时仍需保留上游 v2fly 归属和版本链。误匹配/漏匹配风险来自主动删改属性和上游继承，必须记录基准 commit。
+- 推荐理由：如果产品目标是“大陆常用服务尽量直连”，它比直接把全部 `geosite:cn` 解释成 PAC 更接近该意图。Caveat：不能把“去掉部分属性”理解为网络可达性验证，也不能与 GFWList 无条件并集。
+
+### ACL4SSR：常用的聚合/转换分发层，不是唯一原始源
+
+- 源：[ACL4SSR/ACL4SSR](https://github.com/ACL4SSR/ACL4SSR)。README 直接列出 `ChinaDomain.list`（国内常见域名、直连 CDN）、`ChinaCompanyIp.list`（BAT及云厂商 IP）、`ChinaIp.list`，以及 `fullgfwlist.acl`、`gfwlist-banAD.acl` 等成品；同时说明 Clash 目录是可配合 subconverter 使用的规则碎片。[README](https://github.com/ACL4SSR/ACL4SSR/blob/master/README.md)
+- 访问/活跃度：本次访问显示约 6,441 commits、106 issues、24 PRs；搜索结果显示最近更新到 2026-07-31，仍在维护，但它把多种目的（去广告、GFW、国内直连、订阅转换）混在一个发行体系中。
+- 格式：ACL、Clash rule fragments、subconverter 配置及 Surge/Quantumult/V2Ray 等目标模板；使用前必须确认目标客户端支持的字段和规则顺序。`ChinaCompanyIp.list` 这类云厂商 IP 规则尤其不能等同于“中国 IP 段”。
+- 许可证/分发：README 标示 CC-BY-SA-4.0；若把规则或改编后的聚合物随应用分发，应保留署名、许可证和相同方式共享义务，且核对其嵌入来源的许可证。不能只复制 raw URL 而省略 notices。[README license section](https://github.com/ACL4SSR/ACL4SSR/blob/master/README.md)
+- 风险：聚合规则的云厂商/共享 CDN 误直连概率较高；去广告条目可能误伤；各成品的生成链和上游版本不一定与当前 GFWList/v2fly 同步。
+- 适配：Clash/Surge/Quantumult 最方便；可作为比较基线或人工挑选 `ChinaDomain`，不建议 NG2 直接依赖完整 ACL4SSR 成品，也不建议把它当成 PAC 的透明输入。
+
+### felixonmars/dnsmasq-china-list：DNS 分流源，不是代理规则源
+
+- 源：[felixonmars/dnsmasq-china-list](https://github.com/felixonmars/dnsmasq-china-list)。官方 README 的目标是改善中国域名的 DNS 解析速度/CDN选择，并明确提示这些配置“不稳定、风险自负”；仓库包含 `accelerated-domains.china.conf`、更新脚本和 dnsmasq/unbound/bind 生成路径。[README](https://github.com/felixonmars/dnsmasq-china-list)
+- 本次原始文件访问到约 110,460 行；格式是 `server=/example/114.114.114.114`，表达“该域名向某 DNS 服务器查询”，不是 `DIRECT`/`PROXY` 决策。[accelerated-domains.china.conf](https://raw.githubusercontent.com/felixonmars/dnsmasq-china-list/master/accelerated-domains.china.conf)
+- 访问/活跃度：GitHub 页面显示约 288,692 commits、31 issues、20 PRs；大量提交是自动生成/更新，维护活跃度高，但不代表每条域名都经过代理分流验证。
+- 许可证：WTFPL v2；许可证文本允许极宽泛的复制修改，但产品分发仍应保留来源说明，并审查其中使用的上游数据。[LICENSE](https://github.com/felixonmars/dnsmasq-china-list/blob/master/LICENSE)
+- 适配：适合 dnsmasq/Unbound/BIND 等 DNS 配置；不直接适合 PAC、Clash/Surge/Quantumult 或 geosite。转换成直连域名时会丢掉 DNS 服务器语义和更新意图。
+- Caveat：它可作为中国域名候选集或 DNS 旁证，但不推荐作为 NG2 的代理直连主源；域名量大、可能含加速/广告/临时域名，误直连风险高。
+
+## 3. 中国大陆 IPv4 CIDR
+
+### gaoyifan/china-operator-ip：推荐的可消费 CIDR 分发源
+
+- 源：[gaoyifan/china-operator-ip](https://github.com/gaoyifan/china-operator-ip)。项目说明以 BGP/ASN 数据生成中国运营商 IPv4/IPv6 库，CIDR 成品放在 `ip-lists` 分支，并由 GitHub Actions 每日更新；README 还明确提示覆盖率不可能等同商业库、部分骨干地址可能遗漏。[README](https://github.com/gaoyifan/china-operator-ip)
+- 格式/适配：`china.txt`/`china6.txt` 及运营商拆分文件是一行一个 CIDR，适合转换为 Clash/Surge/Quantumult 的 IP-CIDR 或 sing-box rule-set；也适合生成 NG2 外部构建时使用的 IP 数据，但不适合直接放进 PAC。
+- 活跃度：项目名和工作流承诺每日更新；本次页面显示 172 commits，持续有自动结果分支。其生成链依赖公开 BGP/RIB 工具，属于比手工维护更直接的动态来源。
+- 许可证：MIT。[README/license](https://github.com/gaoyifan/china-operator-ip)
+- 风险：BGP 宣告/ASN 归属是网络观察和运营商分类，不等于物理位置、当前网站服务位置或从用户所在地的直连可用性；共享云/Anycast/跨境宣告仍会误匹配，未宣告或新前缀会漏匹配。推荐保存每日 commit/hash，不直接追踪可变 raw 的“最新”。
+
+### misakaio/chnroutes2：高刷新率的 BGP 聚合备选
+
+- 源：[misakaio/chnroutes2](https://github.com/misakaio/chnroutes2)。README 说明它从多个 BGP feed 生成更及时的中国路由，并由 route collector 每小时更新；仓库直接发布 `chnroutes.txt` 和 `chnroutes.mmdb`。[README](https://github.com/misakaio/chnroutes2)
+- 其公开列出的 feed provider 是 AS917、AS906、AS131477 和 AS138195。它是多视角 BGP 观测的聚合结果，不是 APNIC 的注册分配快照；“每小时更新”表示数据刷新频率，不自动等于更准确或更完整。
+- 格式/适配：`chnroutes.txt` 可作为 CIDR 转换输入，`chnroutes.mmdb` 适合支持 MMDB 的客户端；生成 Clash/Surge/Quantumult/sing-box 规则前仍应固定抓取时间、hash 和解析结果。许可证为 CC-BY-SA-4.0，和 gaoyifan 的 MIT 许可不同，随应用分发时必须单独保留署名并审查相同方式共享义务。[LICENSE](https://github.com/misakaio/chnroutes2/blob/master/LICENSE)
+- 风险：有限 feed、路由收集点和当前 BGP 宣告会造成漏报/误报；未宣告但已注册的中国地址不会因为该项目“更实时”而出现。因此建议把它作为“新鲜度优先”的第二候选，与 gaoyifan 结果和 APNIC 注册基线做差异审计，不把它单独宣称为全部中国 IP。
+
+### APNIC delegated statistics：权威分配基线，但需要自己换算
+
+- 官方规范：[APNIC RIR statistics exchange format](https://www.apnic.net/about-apnic/corporate-documents/documents/resource-guidelines/rir-statistics-exchange-format/)。规范说明各 RIR 每日生成公开快照，稳定入口为 `delegated-<registry>-latest`；APNIC 当前入口是 [`delegated-apnic-latest`](https://ftp.apnic.net/stats/apnic/delegated-apnic-latest)。
+- 格式：记录为 `registry|cc|type|start|value|date|status`；IPv4 的 `value` 是地址数量，不保证天然是 CIDR，必须由起始地址和数量算法换算；规范还明确 `cc` 表示首次分配/分派给组织的国家代码，不是“当前实际使用地点”的权威声明。[格式说明](https://www.apnic.net/about-apnic/corporate-documents/documents/resource-guidelines/rir-statistics-exchange-format/)
+- 访问/更新：规范要求每日生产，并支持 `.md5` 和可选签名；本次 web 读取确认稳定入口存在，但二进制内容未由浏览器工具展开，未在报告中假报某个当日 serial。
+- 许可证/分发：规范页定义公开交换格式和验证方式，但没有在该页给出一个可直接套用的 SPDX 数据集许可证。若把派生 CIDR 随应用发布，应保留 APNIC 归属、抓取日期、serial/checksum，并另行核对 APNIC 数据使用条款。
+- 适配：最适合构建“注册分配审计基线”，不适合直接作为“今日中国公网可路由 IP”名单。建议和 BGP 结果交叉比对：APNIC 负责可解释的分配来源，gaoyifan 负责较接近实际宣告的可消费结果。
+
+### IPdeny：方便的聚合分发，不是首选源
+
+- 分发入口：[IPdeny country blocks](https://ipdeny.com/ipblocks/)，中国聚合文件为 [`cn-aggregated.zone`](https://www.ipdeny.com/ipblocks/data/aggregated/cn-aggregated.zone)。本次读取到的是一行一个 IPv4 CIDR 的文本，约 5,511 行，直接适合 shell 防火墙或转换器。
+- 活跃度/状态：文件可访问并有当前内容，但公开页面没有像 APNIC 那样的 RIR serial、分配状态、BGP 观测链或可审计生成提交；因此只能视为便利的二次聚合分发。
+- 许可证/分发风险：本次核验未找到与该 zone 文件绑定的清晰开源许可证或完整生成 provenance；在应用内再分发前应取得/核实其使用条件。不要用它替代 APNIC 或 BGP 源。
+- 误漏匹配：聚合会隐藏原始粒度，国家归属本身也不是服务位置；适合粗粒度 IP-CIDR 规则，不适合作为 PAC 依据。
+
+### RIPE/其他 RIR：用于交叉校验，不是中国大陆主源
+
+- RIR 规范定义的注册集合包含 `apnic`、`arin`、`ripencc` 等；RIPE 的稳定入口是 [`delegated-ripencc-latest`](https://ftp.ripe.net/ripe/stats/delegated-ripencc-latest)。它对 RIPE NCC 管理区域有用，但中国大陆主分配源仍应先看 APNIC；跨 RIR 转移时还要按规范处理移动记录和重叠。[APNIC 标准](https://www.apnic.net/about-apnic/corporate-documents/documents/resource-guidelines/rir-statistics-exchange-format/)
+- IANA 的 [IPv4 Address Space Registry](https://www.iana.org/assignments/ipv4-address-space) 适合解释 `/8` 分配主体，不是可直接用于中国直连的精细 CIDR 清单。
+
+## 4. Loyalsoldier/geoip 与其他转换分发物
+
+- [Loyalsoldier/geoip](https://github.com/Loyalsoldier/geoip) 明确提供每周自动生成的 V2Ray `dat`、MaxMind `mmdb`、sing-box `SRS`、mihomo `MRS`、Clash、Surge、Nginx 等格式。其 README 说明默认以 MaxMind GeoLite2 Country CSV 为基础，并特别用 gaoyifan 的 `china.txt`/`china6.txt` 替换中国大陆 IPv4/IPv6 数据。[README](https://github.com/Loyalsoldier/geoip)
+- 它是很好的“格式转换/发布层”：Clash 用 `clash/ipcidr/cn.txt`，Surge 用 `surge/cn.txt`，sing-box 用 `srs/cn.srs`，纯文本用 `text/cn.txt`。这些文件可直接给对应客户端使用，但应记录 release tag、sha256 和上游 MaxMind/gaoyifan 来源，不应称为 APNIC 原始数据。
+- 维护信号：README 声明每周四生成；release 页面能看到带 checksum 的成品和 2026-07-30 的 release 记录，发布签名页同时提示签名密钥已过期，因此需要把 checksum/来源审计与签名信任分开。[releases](https://github.com/Loyalsoldier/geoip/releases)
+- 许可证：仓库含 `LICENSE`，且产物混合了项目代码、MaxMind 数据和 gaoyifan 数据；分发前应分别遵守项目许可证、MaxMind/GeoLite 条款和嵌入源的归属要求，不能仅根据仓库页面的开源标签判断全部数据可自由再分发。[LICENSE](https://github.com/Loyalsoldier/geoip/blob/master/LICENSE)
+- 推荐理由：需要 sing-box/Clash/Surge 成品时，它减少自建转换器维护成本；Caveat：它的“CN”是地理/数据集分类，不保证站点直连，更不能直接进入 PAC。
+
+[Loyalsoldier/v2ray-rules-dat](https://github.com/Loyalsoldier/v2ray-rules-dat) 是另一层增强分发物，README/API 显示它面向 V2Ray、Xray、mihomo、Hysteria、Trojan-Go、Leaf 等，仓库许可证为 GPL-3.0，且工作流引用 `domain-list-custom` 的 `cn.txt` 等输入。[工作流](https://github.com/Loyalsoldier/v2ray-rules-dat/blob/master/.github/workflows/run.yml) 因此适合客户端生态分发，不适合作为 NG2 的原始证据或新的第三方数据源。
+
+## 5. 推荐组合与 NG2 适配建议
+
+### 推荐组合 A：NG2 local PAC 的最小可审计路径
+
+1. 输入：GFWList 官方 raw 或用户配置的 HTTPS URL；保存响应 hash、解码后的源版本/`Last Modified`，并限制大小、超时和重定向。
+2. 编译：只在本地把可表达的 GFWList 域名/URL规则编译为 PAC；保留 `@@` 优先级；对 regex、IP字面量、复杂路径规则逐项报告“未表达”而不是静默扩大或缩小。
+3. 直连：仅加入明确审计过的少量本机/局域网/用户例外。若未来引入 v2fly `cn` 或 `geolocation-cn`，应先转为明确的 `domain:`/`full:` 条目并生成独立快照，不能把 geosite 文件内容当作现有 `PACUserRules` 的同义输入。
+4. 服务：继续由 NG2 本地 PAC endpoint 提供生成文档，失败时保留上一个有效快照；不要让远程列表 URL成为系统代理 PAC URL。
+
+理由：与当前 NG2 的“local PAC / global SOCKS”边界一致，避免把远程规则获取、PAC编译和系统代理写入混成一个不可审计动作。Caveat：只靠 GFWList 会漏掉未收录的阻断域名，也不会自动生成完整中国直连白名单。
+
+### 推荐组合 B：Clash/Surge/Quantumult/sing-box/V2Ray 的外部规则链
+
+- 域名：v2fly `domain-list-community` 作为源；需要偏大陆直连语义时锁定 Loyalsoldier `domain-list-custom` 的 tag/commit。
+- IPv4：默认使用 gaoyifan `ip-lists/china.txt` 作为日更 BGP/CIDR 结果；若更看重刷新频率，评估 chnroutes2 的 `chnroutes.txt`，并与 gaoyifan 做差异检查；APNIC delegated 每日文件作为审计对照；Loyalsoldier/geoip 只作为目标格式发布物。
+- 目标客户端：优先使用对应生态的原生格式（geosite/geoip、SRS/MRS、Clash/Surge rule-set），不要把多套完整列表重复并入；使用明确的规则顺序，例如用户例外 → 私有地址 → 代理域名 → 中国域名/IP直连 → 默认策略。
+
+理由：源、生成和分发责任清楚，更新频率与校验可记录。Caveat：同一域名可能同时具有中国和海外接入点；IP-CIDR 直连会把共享云地址上的非中国服务一起直连，需提供按业务的例外覆盖。
+
+### 不推荐作为 NG2 主源的组合
+
+- 完整 ACL4SSR 成品：功能丰富，但混合 GFW、去广告、国内域名、云厂商 IP 和转换模板，许可证与上游链复杂，适合作为对照或人工挑选。
+- dnsmasq-china-list 直接转代理：它表达 DNS 服务器选择，不表达代理策略。
+- IPdeny 直接作为唯一中国 CIDR 源：方便但 provenance、RIR 状态和数据许可不如 APNIC/BGP 源可审计。
+- 把 `geosite:cn` 或 `GEOIP,CN` 直接声称为“全部中国网站/全部中国 IP”：这些是分类和路由数据，不是完整性或实时性承诺。
+
+## 6. 交付时应记录的最小元数据
+
+对任何进入产品构建的规则快照，至少保存：上游 URL、仓库和分支/commit 或 release tag、抓取时间（UTC）、HTTP `ETag`/`Last-Modified`（若有）、SHA-256、解码/转换工具版本、被丢弃的规则类型和许可证/归属文件。报告和产品文案都应使用“候选规则”“截至某次快照”，不要宣称列表完整或实时准确。
diff --git a/docs/research/server-configuration-encryption.md b/docs/research/server-configuration-encryption.md
new file mode 100644
index 000000000..4bd59f2d5
--- /dev/null
+++ b/docs/research/server-configuration-encryption.md
@@ -0,0 +1,199 @@
+# 服务器配置文件整体加密方案研究（2026-10-18）
+
+> 研究日期：2026-10-18。本文记录调研时点的一手资料与代码快照，并提出候选方案；不表示项目已采纳或实现。后续实现应再次核实代码、签名条件及支持的 macOS 版本。
+
+## 结论与推荐
+
+推荐以 **CryptoKit AES-256-GCM 对完整服务器库序列化结果加密，随机 256 位主密钥存于 Keychain**。服务器名称、地址、端口、加密方法、密码、插件参数、分组、订阅 URL 和相关元数据进入同一认证加密 payload；Keychain 不再按服务器拆分保存这些秘密。AES.GCM 同时提供加密和认证，并支持认证附加数据（AAD）；CryptoKit 是 Apple 推荐优先使用的高层密码学接口。[AES.GCM](https://developer.apple.com/documentation/cryptokit/aes/gcm)、[CryptoKit](https://developer.apple.com/documentation/cryptokit)
+
+对当前单个 JSON 文档，不建议增加数据库、SQLCipher、通用密钥管理系统或 KEK/DEK 双层封装。一个文档主密钥足够；用版本化文件头为后续格式迁移留边界。ChaCha20-Poly1305 同样合适，但当前没有互操作或性能证据要求选择它；AES-GCM 作为首选是本报告的工程判断，并非宣称另一算法不安全。[Apple ChaChaPoly](https://developer.apple.com/documentation/cryptokit/chachapoly)、[RFC 8439](https://datatracker.ietf.org/doc/html/rfc8439)
+
+本次任务范围已明确：
+
+- **本次范围：持久服务器库整体加密。** 密码、插件参数、订阅 URL 与服务器库其他资料一起进入密文；服务器库专用 Keychain 项只保存主密钥。监听认证、连通性检测 URL 等其他用途的凭据不自动纳入迁移。
+- **另案处理：运行时文件加密。** 用户已明确 `sslocal-active.json` 的加密需要改造上游 sslocal，本次不研究或实施该改造，也不将运行契约及派生认证文件无明文作为本次验收条件。
+
+考虑到开源项目可能更换签名 Team、用户也会自行编译，**本项目优先推荐经典登录钥匙串 + 严格 ACL + 显式加密导出/恢复**；换 Team 后可能需要前台重新授权，不能承诺静默访问。Apple 默认推荐的 data protection keychain 仍是候选，但其访问组身份与签名授权关联，不能仅凭相同 bundle ID 或用户弹窗读取旧 Team 的钥匙。详见第 4.3 节；算法和密文格式不因此改变。[TN3137](https://developer.apple.com/documentation/technotes/tn3137-on-mac-keychains)、[Keychain access groups](https://developer.apple.com/documentation/security/sharing-access-to-keychain-items-among-a-collection-of-apps)
+
+## 1. 调研时点代码快照
+
+以下以 HEAD `5fc5ddf` 为调研快照，仅用于说明改造接缝，不作为持续维护的现状文档。[GLOSSARY.md](../../GLOSSARY.md) 已将用户管理文档与运行配置区分，且已有威胁模型不承诺抵御同用户进程被控制、root 或历史快照；本报告不自动扩张这些保证。
+
+| 面 | 2026-10-18 核实结果（HEAD `5fc5ddf`） | 对加密的影响 |
+| --- | --- | --- |
+| 服务器库 | [CatalogFileStore.swift](../../ShadowsocksX-NG2/Domain/Catalog/CatalogFileStore.swift) 写 schema v6，读取兼容 v1–v6；JSON 包含整树 entries、rootChildren、subscriptions、favoriteIDs | 应加密整个文档，而非只加密 ServerFields 中部分字段 |
+| 服务器字段 | [CatalogModels.swift](../../ShadowsocksX-NG2/Domain/Catalog/CatalogModels.swift) 定义服务器数据；秘密通过 credential reference 关联 | 最终需新增包含真实秘密的持久 payload，不能只把原有引用 JSON 加密后声称秘密已整合 |
+| 现有 Keychain | [CredentialStore.swift](../../ShadowsocksX-NG2/Domain/Credentials/CredentialStore.swift) 使用 Generic Password，service 为 `com.qiuyuzhou.ShadowsocksX-NG2.credentials`，值为 UTF-8 String；订阅 URL 也已存 Keychain | 用户描述中的“仅密码和插件参数”需补上订阅 URL；新主密钥应使用二进制 Data 接口，避免沿用 String 秘密语义 |
+| Keychain 属性 | 同文件设置 AfterFirstUnlock，没有设置 `kSecUseDataProtectionKeychain` | 不能根据属性名或注释推断真实 macOS 锁定语义，详见第 4 节 |
+| 原子写 | [AtomicFileWriter.swift](../../ShadowsocksX-NG2/Domain/Runtime/AtomicFileWriter.swift) 使用 0700 目录、0600 同目录临时文件与替换；未实现 fsync | 可复用权限与替换路径，但必须先在内存加密，再写临时文件；不能宣称已有断电持久性保证 |
+| 加载失败 | [CatalogCommitCoordinator.swift](../../ShadowsocksX-NG2/App/Application/CatalogWorkflow/CatalogCommitCoordinator.swift) 存在 `(try? fileStore.load()) ?? CatalogDocument()` | 加密后不能把密钥不可用、认证失败或损坏当作空库，否则后续提交可能覆盖可恢复数据 |
+| 激活 | [LeafPreparation.swift](../../ShadowsocksX-NG2/Domain/Activation/LeafPreparation.swift) 读取凭据准备运行文档 | 秘密整合后需调整数据来源与凭据事务模型 |
+| 运行时 | [RuntimePaths.swift](../../ShadowsocksX-NG2/Domain/Runtime/RuntimePaths.swift) 区分 GUI 私有 `catalog.json` 与运行契约 `sslocal-active.json`；[SslocalRuntimeDocument.swift](../../ShadowsocksX-NG2/Domain/Runtime/SslocalRuntimeDocument.swift) 可编码真实 password/pluginOpts | 库文件加密不会自动覆盖运行契约 |
+| Agent | [AgentContract.swift](../../ShadowsocksX-NG2/Agent/AgentContract.swift) 读取明文 Data，向 sslocal 传 `-c <path>`，并写监听认证派生文件 | 运行时契约加密与上游 sslocal 改造另案处理 |
+| 签名 | [project.yml](../../ShadowsocksX-NG2/project.yml) 目标 macOS 15、arm64，Release 使用 Developer ID/hardened runtime；[entitlements](../../ShadowsocksX-NG2/App/Resources/ShadowsocksX-NG2.entitlements) 当前为空字典 | data protection keychain 及跨进程共享不能假定已经配置 |
+| 凭据事务 | [CredentialWriteJournal.swift](../../ShadowsocksX-NG2/Domain/Credentials/CredentialWriteJournal.swift) 处理逐项凭据回滚 | 单密文模型需重看事务边界，不能只替换 JSON encoder |
+
+## 2. 加密目标和边界
+
+本方案主要防止：服务器库被直接打开、误传、单独复制到其他机器或仅文件备份泄漏时暴露服务器地址、分组、订阅和秘密；同时检测文件内容被修改、截断、拼接等导致的认证失败。这一目标来自 AEAD 的保密与完整性能力；AAD 可认证不需要隐藏的文件头。[RFC 5116 §2](https://datatracker.ietf.org/doc/html/rfc5116#section-2)
+
+它不保证以下情况的安全，后续产品描述应保持这个边界：
+
+- 应用获准解密后，配置与密钥仍会进入进程内存；进程被控制、调试转储或应用主动泄漏不由磁盘加密解决。CryptoKit 的敏感内存处理有帮助，但业务层 Data、String、日志副本不因此自动消失。[CryptoKit](https://developer.apple.com/documentation/cryptokit)
+- 文件名、大小、修改时间、写入频率仍可见；整文件加密并不隐藏这些文件系统元数据。这是建议格式的直接推论。
+- 攻击者把整份合法旧密文替换回来时，普通 AEAD 仍会认证成功；防回滚需要额外可信状态，不能靠文件中的 revision 自证最新。[RFC 5116 §3](https://datatracker.ietf.org/doc/html/rfc5116#section-3)
+- 已有运行契约、日志、导出、剪贴板、分享二维码、旧备份及 APFS 快照不因新库文件加密而被追溯擦除。运行契约是否明文以第 1 节代码为依据；其余是后续需单独审计的输出路径。
+- 仅本机存钥降低单独拿到库文件的风险；它不是阻止所有同用户进程、管理员或已授权代码访问的绝对边界。安全性还取决于 Keychain ACL/access group、签名和运行环境。[TN3137](https://developer.apple.com/documentation/technotes/tn3137-on-mac-keychains)
+
+## 3. 候选加密方案比较
+
+| 方案 | 适配性与代价 | 判断 |
+| --- | --- | --- |
+| CryptoKit AES-256-GCM | 高层 AEAD；加密并验证 AAD；可直接覆盖序列化 Data；无需第三方依赖 | 推荐 |
+| CryptoKit ChaCha20-Poly1305 | 同样为 AEAD；256 位密钥、96 位 nonce；适合有对应协议互操作要求的情况 | 可接受备选，无需同时实现两套 |
+| AES-CBC + 自行 HMAC/填充/组合 | 要自行确定认证顺序、密钥分离及错误处理；本任务已有高层 AEAD 可用 | 不选 |
+| SQLCipher/数据库加密 | 需要改变存储模型、引入数据库及其维护；当前需求为单文档整体保护 | 目前不选，不否定其数据库场景价值 |
+| FileVault/文件权限 | 对应整卷静态保护与权限控制，不能取代应用所需“文件副本离开机器后仍为密文”的封装 | 作为互补措施 |
+| Secure Enclave 非对称钥匙 + 包装主密钥 | 增加硬件、访问控制、密钥封装与恢复设计；不是把 AES SymmetricKey 直接放进 Secure Enclave | 首版不选 |
+
+上述算法能力依据 [AES.GCM](https://developer.apple.com/documentation/cryptokit/aes/gcm)、[RFC 8439 §2.8](https://datatracker.ietf.org/doc/html/rfc8439#section-2.8)；优先高层接口依据 [CryptoKit](https://developer.apple.com/documentation/cryptokit)。CBC、数据库和分层密钥的取舍是针对本项目单文档规模的工程判断。FileVault 的作用范围见 [Apple FileVault](https://support.apple.com/guide/security/volume-encryption-with-filevault-sec4c6dc1b6e/web)。
+
+### 推荐参数与文件封装
+
+建议固定一套 v1 格式：
+
+| 部分 | 建议 |
+| --- | --- |
+| 主密钥 | `SymmetricKey(size: .bits256)` 生成；Keychain 存原始 32 字节，不使用用户密码、设备 ID 或硬编码字符串派生 |
+| 加密 | `AES.GCM.seal(payload, using: key, authenticating: headerBytes)`；每次保存新生成 nonce |
+| nonce/tag | 默认 12 字节随机 nonce、16 字节 tag；存储 `SealedBox.combined` |
+| 明文文件头 | magic、envelopeVersion、固定算法标识、随机 keyID；不放服务器名、URL、密码或主密钥 |
+| 认证文件头 | 对确切 header 字节做 AAD；不要依赖未定义顺序的 JSON 重新编码得出同一 AAD |
+| payload | 完整服务器库 DTO 的 JSON/其他现有序列化 Data；其 schemaVersion 与 envelopeVersion 分离 |
+| 写入 | 内存序列化 → 内存加密 → 0600 临时密文 → 替换；临时文件、恢复副本也只能写密文 |
+
+随机主密钥生成 API 见 [SymmetricKey.init(size:)](https://developer.apple.com/documentation/cryptokit/symmetrickey/init(size:))。Apple 文档确认 `combined` 在默认 nonce 下按 nonce、ciphertext、tag 排列；默认 nonce 为 12 字节随机数，且不可重复使用。AES-GCM 的 tag 长度依据 RFC 5116。本任务不应设计持久递增 nonce 计数器，以免文件回滚或并发保存导致重用；库大小及写入频率预计远低于大流量协议，但实施时仍应设定合理文件大小和生命周期上限。[combined](https://developer.apple.com/documentation/cryptokit/aes/gcm/sealedbox/combined)、[Nonce.init](https://developer.apple.com/documentation/cryptokit/aes/gcm/nonce/init())、[Nonce](https://developer.apple.com/documentation/cryptokit/aes/gcm/nonce)、[RFC 5116 §5.1–5.2](https://datatracker.ietf.org/doc/html/rfc5116#section-5.1)
+
+文件头属于本报告提出的应用封装，不是 CryptoKit 自带格式。v1 解码器只接受固定算法和支持的版本，不做失败后换算法或按明文重试；先限制头长度、文件大小并校验结构，再定位 keyID、验证认证，最后解析 payload。随机 keyID 只是主密钥查找标识，不能误当密钥材料。
+
+## 4. Keychain 选型与后台读取
+
+### 4.1 主密钥的存法
+
+Apple 的 CryptoKit Keychain 示例把 SymmetricKey 等不能直接作为 SecKey 表达的密钥存为 Generic Password 的二进制值。因此“主密钥存 Generic Password”是官方示范路径；无须为了名字里出现 password 而改用不匹配的 SecKey 包装。[Storing CryptoKit Keys in the Keychain](https://developer.apple.com/documentation/cryptokit/storing-cryptokit-keys-in-the-keychain)
+
+建议服务器库主密钥使用独立 service 命名空间，account 为 keyID；明确 `kSecAttrSynchronizable: false`。文件头可公开 keyID。不要把主密钥加入导出配置、UserDefaults、日志、崩溃诊断或普通备份清单。同步密钥也不等于同步文件，且 ThisDeviceOnly 与可同步属性不兼容。[kSecAttrSynchronizable](https://developer.apple.com/documentation/security/ksecattrsynchronizable)
+
+### 4.2 两种 macOS Keychain 不可混为一谈
+
+| 选择 | 官方机制 | 本项目需要验证 |
+| --- | --- | --- |
+| 经典 file-based / login keychain | ACL（SecAccess）控制；默认 keychain 与 search list 决定落点 | 正式签名升级后授权是否保留、用户手动锁定登录钥匙串、首次访问提示、安装位置变化 |
+| data protection keychain | 使用 `kSecUseDataProtectionKeychain: true` 显式选择；用户登录上下文；access groups 与签名 entitlement 相关 | App 在发布签名下增删读、权限配置与换 Team 迁移；本次无需 Agent 共享主密钥 |
+
+Apple 推荐默认选择 data protection keychain；无用户上下文的 launchd daemon 必须使用 file-based keychain。命令行程序即使通过 app-like bundle 承载 entitlement，也仍必须处在用户上下文。用户级 Agent 与系统 daemon 不能因都由 launchd 启动而视为相同环境。[TN3137](https://developer.apple.com/documentation/technotes/tn3137-on-mac-keychains)、[kSecUseDataProtectionKeychain](https://developer.apple.com/documentation/security/ksecusedataprotectionkeychain)
+
+特别注意：Apple 对 `kSecAttrAccessible` 明确要求 macOS 同时选择 data protection keychain 或 synchronizable。因此当前代码仅设置 AfterFirstUnlock，不能证明经典登录钥匙串执行了该保护类；应先确认实际后端，不能照搬 iOS 示例或代码注释。[kSecAttrAccessible](https://developer.apple.com/documentation/security/ksecattraccessible)
+
+对明确采用 data protection keychain 的方案，可在 `WhenUnlocked` 与 `AfterFirstUnlock` 之间按产品需求选择。Apple 把 `AfterFirstUnlockThisDeviceOnly` 描述为适合后台访问、首次解锁后直到重启可用、不可迁移新设备；但本报告不把该通用说明等同于所有 macOS 硬件/版本上的锁屏数据保护保证。Apple 平台安全文档明确指出 macOS 不直接以 Data Protection 实施这些保证；必须用目标 macOS 的真实登录/锁屏/重启情境验证。[AfterFirstUnlockThisDeviceOnly](https://developer.apple.com/documentation/security/ksecattraccessibleafterfirstunlockthisdeviceonly)、[Keychain data protection](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web)
+
+结合第 4.3 节的开源签名约束，建议本次验证 **App 单进程使用经典登录钥匙串** 的严格 ACL、升级授权与恢复；data protection keychain 作为签名团队稳定且迁移路径明确时的备选。本次 catalog 为 GUI 私有，无需向 Agent 扩大主密钥访问权限。
+
+### 4.3 开源分发、换 Team 与自编译
+
+**签名 Team 可能改变，会影响选型；两种 Keychain 都不能承诺换签名后静默读取旧钥。** 对本项目这种 Developer ID 开源分发，建议优先采用经典登录钥匙串、保留严格 ACL，并提供显式加密导出/恢复路径。这是考虑维护者变更和用户自编译后的工程取舍；Apple 的平台默认建议仍是 data protection keychain。
+
+DP keychain 的默认组与应用标识有关，通常包含 Team ID / App ID prefix；显式共享组同样受 entitlement 和 provisioning 授权约束。保持 bundle ID、service、account 不变，不能让新 Team 获得旧组的读取权；用户同意弹窗也不是跨组授权机制。这一点由组成员必须匹配的访问规则推导，不能套用经典钥匙串的“Always Allow”。旧版仍能读主密钥时，应先导出完整配置，或实施经验证的桥接迁移，再切换签名；不要等唯一旧读取路径消失后再处理。[Sharing access to keychain items](https://developer.apple.com/documentation/security/sharing-access-to-keychain-items-among-a-collection-of-apps)、[kSecAttrAccessGroup](https://developer.apple.com/documentation/security/ksecattraccessgroup)
+
+经典 file-based keychain 使用 ACL，并以代码签名 requirement 跟踪应用身份。常规 Developer ID designated requirement（DR）包含 Team 条件，因此换 Team 也可能不再匹配旧授权。区别是用户可显式批准新应用访问；Apple 的 Keychain Access 指南提供逐个添加应用和 Always Allow 的操作。项目可设计“前台请求重新授权 → 用户确认 → 重试读取”及 Keychain Access 修复指引，但不能保证每种 macOS、ACL 状态和签名变化都会自动弹窗或成功；后台拒绝交互时应停在可恢复错误状态。[TN2206](https://developer.apple.com/library/archive/technotes/tn2206/_index.html)、[TN3127](https://developer.apple.com/documentation/technotes/tn3127-inside-code-signing-requirements)、[Digital signing and encryption](https://support.apple.com/en-ie/guide/security/secd0da50a09/web)、[Allow apps to access your keychain](https://support.apple.com/en-gb/guide/mac-help/kychn002/26/mac/26)
+
+| 签名变化 | 预期与限制 |
+| --- | --- |
+| 同 Team 证书续期/换证书 | 与换 Team 不同。若 entitlement、应用标识和 DR 保持兼容，常规 DR 不绑定某张证书的指纹；不能因证书文件换了就认定必须丢钥。自定义 ACL 若钉住具体证书则另论 |
+| 换 Team、改签名身份 | DP 可能失去旧组访问；经典 ACL 可能失配。应准备旧版导出/迁移、前台重新授权与独立恢复路径，不能承诺静默升级 |
+| 用户用自己的 Team 自编译 | 属于不同身份；相同源码/仓库名不产生旧主密钥访问权。应按显式导入或重新授权处理 |
+| 无付费 Team / 自签名构建 | 不假定具备正式发行版的受限 entitlement。经典钥匙串可结合稳定自签名身份使用，但须独立验证；这不等于通过 Developer ID/Gatekeeper 分发检查 |
+| ad-hoc（Sign to Run Locally） | DR 绑定该次代码，重新构建可能再次触发授权；不能作为跨版本稳定身份。此处的 ad-hoc 指 macOS 本地签名，不是 iOS Ad Hoc 分发 |
+
+表中同 Team 续期属于依据标准 Developer ID DR 条件的推论，仍需比较实际构建签名；自签名支持依据 TN2206，ad-hoc 限制依据 TN3127。[TN3127](https://developer.apple.com/documentation/technotes/tn3127-inside-code-signing-requirements)、[TN2206](https://developer.apple.com/library/archive/technotes/tn2206/_index.html)
+
+安全 ACL 应继续限制到获准应用的完整签名身份。**不要为了跨 Team 兼容把 requirement 简化为仅 bundle ID，也不要设为任意应用可读。** 合法的新身份由用户显式授权或迁移，不应通过放宽所有调用方访问解决。主密钥一旦成为整库唯一解密入口，独立恢复导出的价值也高于当前可逐项重新输入密码的模型。
+
+### 4.4 无交互读取与失败语义
+
+自动启动、后台重连不应依赖 Touch ID/userPresence 等每次交互授权。禁交互只能让需要认证的操作失败，不会绕过保护。Apple 已弃用 `kSecUseAuthenticationUIFail`，建议在适用路径使用 `kSecUseAuthenticationContext` 搭配 `LAContext.interactionNotAllowed`；经典 file-based 后端须另外核实其行为，不能由 LAContext 文档推断通用兼容。[kSecUseAuthenticationUIFail](https://developer.apple.com/documentation/security/ksecuseauthenticationuifail)、[LAContext.interactionNotAllowed](https://developer.apple.com/documentation/localauthentication/lacontext/interactionnotallowed)
+
+实现应区分：不存在、被锁定/需要交互、缺 entitlement/无权访问、用户取消、文件认证失败、格式版本不支持。保留原密文、阻止自动写入，提示可恢复的状态；不要把所有错误归为“还没有配置”。
+
+### 4.5 Secure Enclave 为什么不作为首选
+
+Secure Enclave 的 P-256 接口处理签名/密钥协商，不能把现有任意 AES 对称主密钥导入后要求硬件直接完成文件 AES-GCM。Apple 对 P-256 路径说明须在 Enclave 内生成私钥且不可迁出；间接保护文档需要额外的密钥协商/封装方案，并增加设备绑定与恢复限制。这并不能消除业务明文进入 App 内存的事实。[Protecting keys with the Secure Enclave](https://developer.apple.com/documentation/security/protecting-keys-with-the-secure-enclave)、[SecureEnclave.P256](https://developer.apple.com/documentation/cryptokit/secureenclave/p256)
+
+若未来产品明确要求硬件绑定、限制私钥可导出或交互解锁，可再研究 envelope/key wrapping；对当前目标，Keychain 保存随机对称主密钥更直接。
+
+## 5. 密钥与文件生命周期建议
+
+本节是由 AEAD/Keychain 能力推导的应用事务建议，不是 Apple 提供的跨 Keychain/文件原子事务。
+
+### 初始化与并发
+
+- 只有确认没有已有库文件，才允许生成新库与新主密钥。已有密文但查不到 keyID 时必须进入恢复状态，禁止生成新钥后覆盖。
+- 单进程串行化保存；若可能多进程初始化，用稳定 bootstrap 定位方式和独占协调防止双库。`SecItemAdd` 返回 duplicate 时重读已有项，不能继续用自己尚未获持久保存的候选密钥；duplicate 的复合主键规则见 [kSecClassGenericPassword](https://developer.apple.com/documentation/security/ksecclassgenericpassword)。
+- Keychain 写入成功并重新读取校验后，才提交用该密钥加密的首份文件。文件提交失败可留下孤立密钥，后续辨认/清理；宁可留多余钥匙，也不能生成无钥可开的唯一密文。
+
+### 旧数据迁移
+
+1. 按原版本读取 catalog，解析全部密码、插件参数、订阅 URL。任意旧凭据缺失/被锁定就停止迁移，不能静默变空。
+2. 在内存构建完整新 payload；通过旧库与新 payload 的语义比对确认没有漏字段、排序、订阅状态或秘密。
+3. 创建并验证主密钥，在内存加密 payload，原子提交新格式，再重新打开并验证；迁移中断后能够根据磁盘与密钥状态重试。
+4. 只有新库可读且恢复策略落实后，才清理已迁入的逐项凭据；范围外的 Keychain 项保留。
+5. 是否临时保留旧明文备份须明确选择：默认建议不新增持久明文备份，安全提交前以旧文件作为唯一来源；安全提交后清理旧路径。若为了回退另存明文，会延长敏感元数据泄漏窗口，必须定义期限与说明。
+
+已存在的旧备份/快照无法靠删除当前路径保证消失；不承诺迁移后的“安全擦除”。旧版本程序对新密文应明确拒绝打开，不能再创建或覆盖同路径空库。
+
+### 损坏、轮换与恢复
+
+文件加载至少区分 missing、keyUnavailable、authenticationFailed、unsupportedVersion、malformedPayload；仅 missing 可进入新建流程。认证失败不尝试解码未经认证的明文，也不自动恢复空库。[AES.GCM.open](https://developer.apple.com/documentation/cryptokit/aes/gcm)
+
+轮换时先创建新 keyID/密钥，以新密钥生成并验证新文件，然后替换；旧钥保留到旧密文备份不再需要。不能先删除旧钥。若要保留多个历史密文，必须同时定义其 keyID/密钥保留期限；“轮换”不会让持有旧密钥和旧备份的攻击者失去旧数据。
+
+恢复政策必须在实施前明确：
+
+| 政策 | 收益 | 必须说明的后果 |
+| --- | --- | --- |
+| 本机绑定 / ThisDeviceOnly | 限制主密钥迁移 | 仅有密文备份、换机或钥匙串丢失时无法恢复；应提供受控导出/重新订阅路径 |
+| 可迁移但不同步的 Keychain 项 | 可配合系统迁移/备份场景 | 必须实测所支持的迁移/恢复方式，不能承诺复制 catalog 即可用 |
+| 显式密码加密导出 | 便于跨机器恢复，与本机主密钥解耦 | 需要独立 KDF、口令策略与导出格式研究，不应直接复用弱口令作为 AES key |
+| iCloud 同步主密钥 | 可能支持多机共享钥匙 | 文件并不同步；扩大恢复和同步状态空间，首版不推荐 |
+
+Apple 对 ThisDeviceOnly 明确规定不迁移到其他设备；对 synchronizable 明确规定其同步语义。经典 keychain 的文件级备份也不能作为未经验证的恢复承诺；产品应验证系统支持的迁移与恢复流程，避免依赖内部存储布局。[AfterFirstUnlockThisDeviceOnly](https://developer.apple.com/documentation/security/ksecattraccessibleafterfirstunlockthisdeviceonly)、[kSecAttrSynchronizable](https://developer.apple.com/documentation/security/ksecattrsynchronizable)、[TN3137](https://developer.apple.com/documentation/technotes/tn3137-on-mac-keychains)
+
+## 6. 已明确的任务边界
+
+本次只覆盖持久服务器库整体加密。`sslocal-active.json` 的加密及所需上游 sslocal 改造另案处理，不作为本次设计、实现或验收的前置条件。运行契约与派生认证文件沿用现有机制，本次不要求 Agent 读取服务器库主密钥。
+
+当前 wrapper 向 sslocal 传递 JSON 文件路径，服务器库与运行契约是两个独立存储边界；本次成果应表述为“服务器库整体加密”。保留该事实用于准确描述保护范围，不在本文继续展开运行时加密候选方案。[AgentContract.swift](../../ShadowsocksX-NG2/Agent/AgentContract.swift)、[RuntimePaths.swift](../../ShadowsocksX-NG2/Domain/Runtime/RuntimePaths.swift)
+
+## 7. 实施前验证与待决定事项
+
+本文仅完成源码与一手资料调研，未实现加密、未对真实 Keychain 写入或进行签名发布验证。
+
+建议后续采用以下有区分的证据：
+
+| 验证层 | 验收重点 |
+| --- | --- |
+| 纯函数/文件测试 | 完整 payload 往返、空库/大库、错误钥匙、篡改 nonce/tag/header、截断、未知版本；相同 payload 多次保存产生不同密文 |
+| 迁移故障注入 | 缺旧凭据、Keychain 写失败、duplicate 并发、写文件/替换失败、任一步退出；不覆盖旧数据、不丢钥匙、不把损坏当空库 |
+| 文件检查 | 新库及临时/恢复文件不含样本服务器名、地址、密码、插件参数和订阅 URL；权限保持；未进行安全擦除保证 |
+| 真机 Keychain | Debug 与正式 Developer ID 构建分别验证；新增、同 Team 续证、换 Team、自编译/ad-hoc 重建、前台重新授权、升级、撤销授权、锁钥匙串、锁屏、重启首次登录、退出 GUI、切换用户；记录 OSStatus，不泄漏值 |
+| 恢复验证 | 同机恢复、换机恢复、只有密文无钥匙、钥匙丢失、轮换后恢复旧备份；按选择的策略说明能否恢复 |
+| 运行进程 | 检查加密库加载及凭据来源调整后，现有激活与运行流程仍兼容；不要求运行契约或派生认证文件加密 |
+
+下一步需要确定的产品边界：
+
+1. 是否采用推荐的经典登录钥匙串 + 严格 ACL，换签名时如何授权或迁移？
+2. 希望默认本机绑定，还是支持迁移备份；丢钥匙时允许重新导入/订阅，还是必须提供独立加密导出？
+3. 钥匙串锁定后的 GUI 行为、内存密钥缓存期限，以及何时阻止编辑或重新生成运行配置？
+4. 迁移提交后旧凭据/旧明文与轮换历史钥匙保留多久？
+
+算法本身已有足够依据选择 AES-256-GCM。上述边界会影响恢复能力、库加载行为和授权体验，宜在实现前形成设计决定。
diff --git a/docs/research/sslocal-acl-vs-pac.md b/docs/research/sslocal-acl-vs-pac.md
new file mode 100644
index 000000000..26016e615
--- /dev/null
+++ b/docs/research/sslocal-acl-vs-pac.md
@@ -0,0 +1,271 @@
+# sslocal ACL 与当前 PAC 方案对比研究
+
+> 研究日期：2026-09-24  
+> 上游基线：`shadowsocks-rust` v1.25.0，commit `ab388c7466d21f979430e33cc9ef10e22fb05955`。  
+> 证据范围：上游仓库源码、上游 README/config schema、上游 release 与 issue；未使用博客或其他二手材料。本文只写研究结论，不修改 NG2 源码、配置或产品文档。
+
+## 结论摘要
+
+1. `sslocal` ACL 是本地入站代理收到目标地址后做的“直连 / 通过 Shadowsocks server”选择器。它支持默认黑名单/白名单、域名精确匹配、子域匹配、正则、IP 与 CIDR；它不是 macOS 系统代理配置器，也不是一个能直接输出 PAC 的规则引擎。
+2. ACL 不支持本地客户端侧的 `BLOCK` 动作。`[outbound_block_*]` 属于 `ssserver` 的远端出站阻断语义，不能当作 sslocal 的本地阻断规则。
+3. ACL 在启动/配置构造时读入并编译到内存。v1.25.0 的 `SIGUSR1` 重载路径只把新配置中的 `server` 列表交给 balancer，不替换已运行 local context 中的 ACL；修改 ACL 文件后需要重启 sslocal 才能可靠生效。
+4. 对本仓库而言，“macOS 全局 SOCKS + sslocal ACL”技术上可行，但不是当前 PAC 的等价替换。它会把决策点从系统 PAC 的 `FindProxyForURL` 移到 sslocal 收到的目标地址；URL 路径、端口、HTTP 方法、进程和未使用 SOCKS 的应用不在同一个能力边界内。
+5. 推荐把它作为一种新的、明确命名的“ACL 全局 SOCKS”运行模式进行验证；不要直接把现有 PAC 模式的产品语义改名为 ACL。至少应先验证域名/IP/DNS、UDP、多个 local、ACL 变更期间的重启收敛，以及真实 macOS SystemConfiguration 和应用兼容性。
+
+## 1. ACL 文件格式与规则语义
+
+### 1.1 上游定义的 section
+
+上游 README 和 `crates/shadowsocks-service/src/acl/mod.rs` 都把 local 与 remote 的 section 分开。对 `sslocal` 有效的是：
+
+| Section | 含义 |
+| --- | --- |
+| `[proxy_all]` | `BlackList`：未命中的目标默认走 Shadowsocks proxy；默认模式也是这个模式 |
+| `[bypass_all]` | `WhiteList`：未命中的目标默认直连 |
+| `[bypass_list]` | 命中后直连 |
+| `[proxy_list]` | 命中后走 Shadowsocks proxy |
+
+README 把 `[reject_all]`、`[accept_all]`、`[black_list]`、`[white_list]` 主要描述为 `ssserver` 客户端访问控制；但 v1.25.0 parser 同时把 `[black_list]` 当作 local 的 `bypass_list` 别名、把 `[white_list]` 当作 local 的 `proxy_list` 别名。`[outbound_block_all]`、`[outbound_allow_all]`、`[outbound_block_list]`、`[outbound_allow_list]` 才是明确的 `ssserver` 远端出站控制。NG2 生成 local ACL 时应只生成 `[proxy_all]`/`[bypass_all]` 与 `[bypass_list]`/`[proxy_list]`，避免复用有双重语义的 section 名。
+
+来源：
+
+- 上游 README 的 ACL 章节：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md#L1112-L1132>
+- 上游 ACL 源码的 section、mode 和 rule 注释：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/acl/mod.rs#L286-L337>
+
+### 1.2 单条规则
+
+解析顺序和语义如下：
+
+| 写法 | 语义 |
+| --- | --- |
+| `10.0.0.0/8`、`127.0.0.1`、`::1` | IP/CIDR 规则 |
+| `|example.com` | 精确域名匹配 |
+| `||example.com` | `example.com` 及其子域匹配 |
+| `(^|\\.)example\\.com$` | 正则域名匹配 |
+| `# comment` | 注释；源码只把行首就是 `#` 的行当作注释 |
+
+规则行必须是 ASCII；非 ASCII 行会记录 warning 后跳过。以 `|` 或 `||` 开头的规则先按精确/域名树处理；其他非 section 行先尝试 CIDR/IP，再作为正则保存。因此配置生成器不能把任意 Adblock 语法原样当作 ACL 语法。
+
+来源：
+
+- 规则形式的上游注释：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/acl/mod.rs#L328-L337>
+- 读取、ASCII 过滤、`||`/`|`、IP/CIDR 与正则分流：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/acl/mod.rs#L351-L465>
+
+### 1.3 命中优先级与 DNS
+
+对域名目标，`check_target_bypassed` 先检查域名规则：`proxy_list` 命中返回 proxy，`bypass_list` 命中返回直连。未命中且 ACL 中存在 IP 规则时，sslocal 会调用其 `Context` 的 DNS resolver，把解析到的 IP 再与对应 IP 规则比较；解析失败或没有 IP 命中时回到默认模式。
+
+对已经是 IP 的目标，不需要 DNS。源码中 IP 检查先看 `bypass_list`，再看 `proxy_list`，最后使用默认模式；因此“同一 IP 同时出现在两边”不是应该依赖的可移植配置，生成器应在生成前拒绝冲突。
+
+这意味着 ACL 的 DNS 行为不是“所有 DNS 都通过远端 Shadowsocks server”：它是为了决定某个目标是否 bypass 而可能进行本地 resolver 查询。另有独立的 `local-dns` 入站协议，它才是按照 ACL 在 local DNS 与 remote DNS 之间选择的 DNS relay。
+
+来源：
+
+- host/IP 命中与默认模式：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/acl/mod.rs#L475-L548>
+- 域名目标的 DNS fallback 与直连/代理结果：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/acl/mod.rs#L555-L589>
+- `local-dns` 的官方说明：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md#L41-L55>
+
+### 1.4 “直连 / proxy”在 sslocal 中如何落地
+
+TCP 路径调用 ACL 后，命中 bypass 就直接连接目标，未 bypass 才经 configured Shadowsocks server；UDP association 也在发送数据时调用同一个 `check_target_bypassed`。ACL 的结果不是返回给 macOS 的 `DIRECT`/`SOCKS` 字符串，而是由 sslocal 自己选择 outbound socket 路径。
+
+来源：
+
+- TCP auto-proxy：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/net/tcp/auto_proxy_stream.rs#L145-L161>
+- UDP association：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/net/udp/association.rs#L515-L522>
+
+## 2. sslocal 的加载、应用、重载与失败行为
+
+### 2.1 配置入口和作用域
+
+v1.25.0 有三种相关入口：
+
+- CLI `--acl PATH`：加载一个全局 ACL。
+- 配置顶层 `acl`：同样形成全局 local context 的 ACL。
+- `locals[]` 内的 `acl`：为单个 SOCKS/HTTP/DNS 等 local 实例指定 ACL；它会覆盖从全局 context clone 来的 ACL。
+
+上游 `SSConfig` 与 `SSLocalExtConfig` 都声明了 `acl: Option<String>`；`locals[]` 例子也明确展示了 instance-specific ACL。`ServiceContext` 内保存的是 `Option<Arc<AccessControl>>`，local server 创建时把解析好的 ACL 放进 context；因此运行期使用的是已加载的对象，不是每次请求重新读文件。
+
+来源：
+
+- 顶层与 `locals[]` schema：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L400-L428>、<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L419-L525>
+- 官方多 local 配置示例：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md#L620-L705>
+- ACL 加载失败被转成配置错误：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2078-L2096>
+- context 保存 ACL 以及 local-specific override：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/context.rs#L22-L39>、<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/mod.rs#L163-L180>、<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/mod.rs#L272-L285>
+
+### 2.2 初始加载失败行为
+
+可以确认的失败行为：
+
+- ACL 文件打不开、权限不足或路径不存在：`File::open` 返回错误，配置加载失败。
+- 正则无法编译：最终 `into_rules()?` 返回错误，配置加载失败。
+- 单条规则含非 ASCII：不是全局失败；记录 warning 并跳过该行。
+- 域名用于 IP 规则 fallback 时 DNS 解析失败：不把请求判为错误，而是回到该 ACL 的默认 proxy/bypass 策略。
+- 未知 section 不会被当作一个严格 schema 错误；解析器的默认分支会把它继续当作 IP/域名/正则规则处理。这是配置生成器应自行校验的风险，而不是可以依赖的容错协议。
+
+`--acl` CLI 入口同样直接调用 `AccessControl::load_from_file`，失败会变成 `LoadAclFailure`。因此 NG2 若生成 ACL，应先原子写完并自检，再把新路径交给 sslocal；不能把一个半写入或不可读文件交给正在重启的 child。
+
+来源：
+
+- ACL parser 的错误/警告路径：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/acl/mod.rs#L351-L465>
+- CLI `--acl` 的失败映射：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L888-L899>
+
+### 2.3 是否支持 ACL 热加载
+
+结论：**v1.25.0 的 sslocal 不提供 ACL 文件热加载。**
+
+上游的 reload task 只有 `config_path` 和 `balancer`。收到 Unix `SIGUSR1` 后，它重新读取配置文件，但只把 `source_config.server` 交给 `balancer.reset_servers(...)`；已运行的 `Server`/local context 不会因为 ACL 文件改变而重建。配置文件本身被重新解析时，如果新 ACL 已损坏，reload task 会记录加载失败并保留旧运行实例；如果新 ACL 有效，也只刷新服务器列表，旧 ACL 仍继续用于现有 local context。
+
+这与 NG2 当前 wrapper 的协议正好形成风险：`ShadowsocksX-NG2/Agent/main.swift:13-15` 把“仅 servers 变化”转成向 sslocal 转发 `SIGUSR1`，`main.swift:164-192` 也只在监听结构变化时重启。引入 ACL 后，ACL 内容/path/hash 必须成为 restart fingerprint；不能沿用“只 forward SIGUSR1”的分支。
+
+来源：
+
+- sslocal 建立一次 `Server`，再单独启动 reload task：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L1001-L1018>
+- reload task 只 reset servers：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L1068-L1111>
+- `SIGUSR1` 监听：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L1117-L1129>
+
+## 3. ACL 与 PAC 的能力边界
+
+这里的 PAC 对比以本仓库当前 NG2 实现为准，而不是把一个未实现的 PAC 规则子集算进产品能力。
+
+系统边界也不同：Apple 的 CFNetwork 文档把 PAC URL/JavaScript 自动配置和 SOCKS 作为不同的 proxy 类型；自动配置脚本由系统执行来决定某个 URL 使用什么 proxy，而 SOCKS 是一个固定的 proxy endpoint。Apple 的 `CFNetworkCopyProxiesForURL` 也明确以 URL 查询代理列表。因此，ACL 接入的系统形状应是“系统 SOCKS endpoint + sslocal 内部路由”，不是把 ACL 文件交给 macOS 当 PAC。
+
+当前 PAC 生成的返回链还包含 `SOCKS5`、`SOCKS` 和 `DIRECT`：当 PAC 客户端无法使用前两个代理时，客户端可能继续尝试 DIRECT。ACL 则是在 sslocal 内部选定 bypass 或 proxy outbound；它不会从 ACL 规则中自动产生同一个按请求的 PAC fallback。因此“可达性/失败时是否允许直连”必须作为迁移决策单独定义。
+
+来源：<https://developer.apple.com/documentation/cfnetwork/proxy-types>、<https://developer.apple.com/documentation/cfnetwork/global-proxy-settings-constants>。
+
+| 维度 | 当前 NG2 PAC | sslocal ACL |
+| --- | --- | --- |
+| macOS 系统入口 | PAC 模式把 PAC URL 交给系统代理；`ProxyMode.pac` 生成 PAC target | ACL 不写 macOS SystemConfiguration；需要把系统代理设为 `127.0.0.1:<SOCKS>`，即 NG2 已有的 global SOCKS 投影 |
+| 决策位置 | 应用请求 PAC 时按 URL 调用 `FindProxyForURL` | 请求进入 sslocal SOCKS/HTTP 后，按 target address 决定 outbound |
+| 当前默认策略 | NG2 的用户规则实现只提取 `@@` 例外为 DIRECT，其余规则维持 SOCKS 优先 | `[proxy_all]` 默认 proxy，或 `[bypass_all]` 默认直连 |
+| 域名 | 当前最小实现只保留可规范化的例外 host/suffix | 精确 `|`、子域 `||`、正则；域名未命中时还可能 DNS 后检查 IP |
+| IP/CIDR | 当前 PAC 用户规则适配器没有把普通规则编译成 IP ACL | 原生支持 IPv4/IPv6 地址与 CIDR |
+| 直连 | PAC 返回 DIRECT，应用自己直连；当前链还包含 proxy 失败后的 DIRECT fallback | sslocal 自己建立直连 outbound socket；没有同一个 PAC-style fallback |
+| 代理 | PAC 返回 SOCKS endpoint | sslocal 选择 configured Shadowsocks server/balancer |
+| 阻断 | 当前 NG2 PAC 生成器没有 BLOCK 分支 | local ACL 没有 block 动作； remote `[outbound_block_*]` 是 ssserver 语义 |
+| URL 路径/query/HTTP 方法 | PAC 输入是 URL，理论上可按这些信息编写 JS；当前 NG2 规则适配器没有实现这些规则 | ACL 只处理 target host/IP，不能表达 URL path、query、HTTP method |
+| 端口 | 当前 PAC 生成器没有端口策略 | ACL parser 的规则类型没有端口字段；不要把 `host:port` 当作已支持的 ACL 语法 |
+| 进程/应用 | PAC 也不会天然知道进程；由应用是否遵守 PAC 决定 | ACL 也没有进程维度；未使用 SOCKS 的应用不会经过它 |
+| UDP | PAC 本身是应用代理选择；NG2 当前 PAC/系统代理验证重点是 TCP | sslocal SOCKS UDP 在 `tcp_and_udp` 时也调用 ACL，但需真实测试 DNS/UDP 应用行为 |
+| DNS | PAC 与应用/系统 resolver 的交互由客户端实现决定 | ACL 为 IP 规则判断可能调用 sslocal resolver；`local-dns` 是另外的 DNS relay 功能 |
+
+本仓库证据：`PACRuleSet` 明确说只有 `@@` 例外变成 DIRECT，`ProxyMode` 只有 `.pac` 和 `.global`，其中 global 目标是本地 SOCKS；runtime document 当前也只把 PAC 放在 wrapper 自有的 `x_shadowsocksx_ng_pac` 区域。见 `ShadowsocksX-NG2/Domain/PACUserRules.swift:3-37`、`ShadowsocksX-NG2/Domain/ProxyMode.swift:3-80`、`ShadowsocksX-NG2/Domain/SslocalRuntimeDocument.swift:37-78`。
+
+当前 `gfwListURL` 已被设置模型持久化和校验，但 active source 中没有对应的下载/编译调用；当前运行时实际消费的是 `pacUserRules` 的最小 `@@` 例外适配。迁移研究不能把 GFW List 当成现成的 PAC 或 ACL 规则输入。见 [`ProxySettings.swift`](../../ShadowsocksX-NG2/Domain/ProxySettings.swift#L6-L19)、[`PACUserRules.swift`](../../ShadowsocksX-NG2/Domain/PACUserRules.swift#L3-L17)、[`SslocalRuntimeDocument.swift`](../../ShadowsocksX-NG2/Domain/SslocalRuntimeDocument.swift#L112-L127)。
+
+还要处理 SystemConfiguration 的 `ExceptionsList`：当前 controller 把 `settings.proxyExceptionList` 传给 PAC 和 global 两种模式；切到 global SOCKS 后，这些目标会在 macOS 层直接绕过 sslocal，ACL 不会看到它们。迁移时应明确例外项由系统代理还是 ACL 作为唯一事实来源，不要让两套规则悄悄产生不同结果。见 [`ProxyRuntimeController.swift`](../../ShadowsocksX-NG2/App/ProxyRuntimeController.swift#L771-L780)、[`ProxyMode.swift`](../../ShadowsocksX-NG2/Domain/ProxyMode.swift#L63-L80)、[`SystemProxyPropertyList.swift`](../../ShadowsocksX-NG2/Domain/SystemProxyPropertyList.swift#L18-L41)。
+
+上游 local ACL 的直连/代理实现见：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/net/tcp/auto_proxy_stream.rs#L155-L161>。远端 outbound block 的区别见：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/acl/mod.rs#L607-L625>。
+
+## 4. 版本、协议与 macOS 集成接口
+
+### 4.1 版本基线与 feature
+
+本仓库当前 vendor manifest 已固定：
+
+`ShadowsocksX-NG2/Vendor/sslocal/manifest.json:2-11`：官方 `shadowsocks-rust` v1.25.0、`aarch64-apple-darwin`、官方 release asset、SHA-256、bundle 内 `Helpers/sslocal`。
+
+上游 v1.25.0 的 Cargo facts：
+
+- package version `1.25.0`，Rust MSRV `1.91`；`sslocal` binary 需要 `local` feature。
+- `local-http` 才提供 HTTP local；`local-dns` 才提供 DNS relay；`local-tun` 是 TUN 相关功能。
+- 默认 `full` feature 包含 local、local-http、local-dns、local-tun 等；如果未来改为自编译精简 binary，必须显式保留实际使用的 feature。
+- ACL 只影响本地路由，不改变 Shadowsocks wire protocol；服务器端仍必须支持配置的 method、密码与插件组合。
+
+来源：<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/Cargo.toml#L1-L22>、<https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/Cargo.toml#L57-L97>、<https://github.com/shadowsocks/shadowsocks-rust/releases/tag/v1.25.0>。
+
+### 4.2 建议的配置形状
+
+如果使用全局 ACL，最小形状可以是：
+
+```json
+{
+  "acl": "/absolute/path/to/sslocal.acl",
+  "servers": [
+    {
+      "server": "example.invalid",
+      "server_port": 8388,
+      "password": "...",
+      "method": "aes-256-gcm"
+    }
+  ],
+  "locals": [
+    {
+      "protocol": "socks",
+      "local_address": "127.0.0.1",
+      "local_port": 11086,
+      "mode": "tcp_and_udp"
+    }
+  ]
+}
+```
+
+若 SOCKS 与 HTTP local 的规则需要独立，则应给每个 `locals[]` 项设置同一个或不同的 `acl`；`locals[].acl` 会覆盖 global ACL。NG2 当前 `SslocalLocalDocument` 没有 `acl` 字段，因此接入前必须扩展 runtime contract 和生成/校验边界；这不是现有 PAC 扩展字段可以隐式解决的事情。
+
+### 4.3 进程接口与重启策略
+
+上游没有用于变更 ACL 的 JSON-RPC 或 control socket。对 NG2 可用的接口仍是：
+
+- wrapper 以绝对路径启动 `sslocal -c <config>`；
+- SIGTERM 做 graceful stop；
+- SIGUSR1 仅用于上游实现的 server-list refresh；
+- ACL 变更应由 wrapper 完整重启 sslocal，再等待 SOCKS/HTTP listener 健康后让 macOS system proxy 指向新实例。
+
+当前 NG2 已有可复用的生命周期边界：`ShadowsocksX-NG2/Agent/main.swift:3-17` 说明 wrapper 管理 PAC endpoint 与 sslocal 生命周期，`main.swift:221-249` 负责停止 child；`ShadowsocksX-NG2/Tests/RealSslocalSmokeTests.swift:5-8,143-160` 已验证 bundled v1.25.0 的 local listener 与 SOCKS5 handshake。需要补充的是 ACL 真实 e2e，而不是把现有 handshake smoke 当成 ACL 证据。
+
+## 5. 对 NG2 替代当前 PAC 的可行性判断
+
+### 5.1 可行的目标定义
+
+可行目标是：
+
+> 将 macOS 系统代理设置为 NG2 的 local SOCKS；对所有确实把连接交给该 SOCKS 的 TCP/UDP 流量，由 sslocal ACL 决定直连或通过 Shadowsocks server。
+
+这与当前 global 投影相符：`ShadowsocksX-NG2/Domain/ProxyMode.swift:63-80` 把 global 映射到 `127.0.0.1:<socksPort>`。因此实现上可以保留 wrapper/LaunchAgent/health supervision，新增 ACL 文件生成、runtime schema 字段、ACL 变化检测和 restart classification。
+
+这里的“按配置”若是指“按域名规则选择直连或当前激活配置的 Shadowsocks server”，ACL 可以覆盖；若是指“不同规则选择 `servers[]` 中不同的服务器/目录配置”，ACL 不能覆盖。上游 ACL 只决定 bypass 或进入当前 balancer，NG2 当前则把活动目标展开成一个 `servers[]` 列表；规则到服务器的映射需要多实例、额外 dispatcher，或继续使用 PAC/其他路由层。见 [`ActivationStateMachine.swift`](../../ShadowsocksX-NG2/Domain/ActivationStateMachine.swift#L129-L138)、上游 [`AutoProxyClientStream`](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/net/tcp/auto_proxy_stream.rs#L130-L161)。
+
+### 5.2 不可直接承诺的目标
+
+以下说法不能从 v1.25.0 ACL 得出，也不应在 UI/文档中暗示：
+
+- “完全等价于 PAC”：不等价；决策输入从 URL 变成 target address。
+- “所有应用都按配置代理”：不成立；应用必须使用系统 SOCKS，或显式连接 NG2 的 local。
+- “ACL 可以阻断本机请求”：local ACL 没有这个动作；需要应用侧拒绝、网络过滤器或远端 `ssserver` outbound ACL。
+- “修改规则立即生效”：不成立；v1.25.0 需要重启 sslocal 才能可靠换掉 context 中的 ACL。
+- “把现有 GFW/Adblock 规则直接写入 ACL”：不安全；当前 NG2 只实现了极小的 `@@` 例外抽取，其他语法必须经过明确转换和校验。
+- “按规则选择不同的 Shadowsocks server”：不成立；ACL 只选择 bypass 或当前 `servers[]` balancer，不提供规则到 server 的映射。
+
+### 5.3 主要风险
+
+1. **规则语义漂移**：现有 PAC 规则和 ACL 的 exact/suffix/regex/默认模式不同；尤其是 `@@` 例外、普通 Adblock pattern、IP 规则、尾点/IDNA、冲突规则。
+2. **DNS 泄漏与决策不一致**：ACL 为 IP 规则可能进行 resolver 查询；应用把 hostname 交给 SOCKS、应用先自行解析、`local-dns` relay 和 fake DNS 又是不同路径。
+3. **重启窗口**：ACL 更新期间若先切换 system proxy 或删除旧 ACL，可能出现 SOCKS 不可用、旧规则继续生效或 launchd 反复拉起。
+4. **UDP/应用覆盖率**：`tcp_and_udp` 的源码路径存在，但系统 SOCKS、应用 UDP 使用方式和 DNS 行为仍需在真实 macOS 上验证。
+5. **安全默认值**：`[proxy_all]` 与 `[bypass_all]` 的选错会产生全量直连或全量代理；ACL 文件路径和生成过程还涉及权限、原子替换及崩溃恢复。
+6. **多 local 一致性**：如果 SOCKS 与 HTTP local 使用不同 ACL，用户看到的“按配置代理”会随入口而改变；如果使用全局 ACL，则应测试 local-specific override 不会被意外写入。
+
+### 5.4 必须先验证的未知点
+
+建议把下列项目列为实现前的验收矩阵：
+
+1. `proxy_all` + `bypass_list`、`bypass_all` + `proxy_list` 的域名 exact/suffix/regex 命中和同名冲突。
+2. IPv4/IPv6/CIDR、hostname 解析到多个 A/AAAA、解析失败、尾点域名与 IDNA。
+3. hostname 目标与已解析 IP 目标是否得到产品预期的相同结果；分别记录 resolver 来源。
+4. SOCKS TCP、SOCKS UDP、HTTP local 三条入口是否都使用预期 ACL；`local-dns` 是否按预期选择 local/remote DNS。
+5. 修改 ACL 后不重启只发 SIGUSR1 的结果，确认旧 ACL 保持；再做 wrapper 原子替换 + 完整重启，确认新 ACL 生效且 system proxy 无错误窗口。
+6. 真实 macOS SystemConfiguration 写入与恢复，以及 Safari、URLSession、浏览器、命令行、忽略系统代理的应用矩阵。现有 fake/unit 代理测试不能替代这项证据。
+7. 仍使用官方 v1.25.0 arm64 binary 时的签名、bundle、Gatekeeper 和 release packaging；若升级上游版本，应重新核对 ACL 源码、配置 schema、reload 行为和 release notes。
+
+## 6. 建议决策
+
+短期不建议删除当前 PAC 方案。建议先做一个隔离的 ACL 运行时实验：
+
+1. 仅在现有 `.global` system SOCKS 投影下接入生成的 ACL；
+2. 将 ACL 路径、内容 hash、生成器版本写入 runtime snapshot，ACL 变化触发完整 sslocal restart；
+3. 先支持一个受控的 `proxy_all`/`bypass_list` 子集，拒绝未知 Adblock 语法、非 ASCII、冲突 IP/域名规则；
+4. 通过真实 SOCKS/HTTP/UDP/DNS 和 macOS 应用矩阵后，再决定是否把它作为产品级“按配置代理”模式；
+5. PAC 与 ACL 若都保留，应明确其语义：PAC 适合需要系统 PAC 选择的场景，ACL 全局 SOCKS 适合把目标路由集中到 sslocal 的场景。
+
+在当前证据边界内，最终判断是：**可实现，但应作为“ACL 驱动的全局 SOCKS 路由”重新定义和验证，不能作为当前 PAC 的无损替换。**
diff --git a/docs/research/sslocal-password-environment.md b/docs/research/sslocal-password-environment.md
new file mode 100644
index 000000000..245247106
--- /dev/null
+++ b/docs/research/sslocal-password-environment.md
@@ -0,0 +1,185 @@
+# sslocal 通过环境变量传递 `password` 的安全边界研究
+
+> 研究日期：2026-09-25（Asia/Shanghai）  
+> 上游基线：官方 `shadowsocks-rust` v1.25.0，tag commit `ab388c7466d21f979430e33cc9ef10e22fb05955`；本仓库 vendor 清单也固定为该版本和 `aarch64-apple-darwin`。见 [`ShadowsocksX-NG2/Vendor/sslocal/manifest.json`](../../ShadowsocksX-NG2/Vendor/sslocal/manifest.json#L1-L11)。  
+> 证据范围：`shadowsocks-rust` 官方文档/源码、Rust/POSIX/Apple 一手文档、本仓库源码，以及本机对仓库内官方 v1.25.0 二进制的最小验证。没有使用博客、论坛或第三方教程。
+
+## 结论先行
+
+1. **可以，但限定于实现和版本。** 官方 `shadowsocks-rust` 的 `sslocal` 从 v1.12.3 起支持在配置文件的 `password` 字段使用完整形式 `${VAR}`；v1.12.2 尚不包含该配置文件能力。当前 v1.25.0 仍支持，官方 README 的示例就是 `"password": "${PASSWORD_FROM_ENV}"`。[README 示例](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md#L795-L805)、[v1.25.0 配置加载源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2137-L2179)。这不是所有名为 `sslocal` 的实现都必然支持的通用 JSON 语法。
+2. **它不是 shell 展开，也不是 JSON/Serde 的通用变量替换。** 只有整个字段恰好以 `${` 开头、以 `}` 结尾时，`shadowsocks-rust` 才取中间字符串作为环境变量名；嵌入式文本不会展开，且当前源码明确只对 `password` 使用该函数。[源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L3446-L3466)
+3. **密码值不进入 `sslocal` 的 argv，但会进入其进程环境和内存。** `sslocal` 的 JSON 配置路径仍在 argv 中，环境变量值由 `std::env::var` 读入，再用于创建内存中的 `ServerConfig` 和派生密钥；配置文件本身不会被 `sslocal` 回写。Rust/POSIX/Apple 文档都把 argv 与 environment 作为不同的进程启动输入。[sslocal 启动调用链](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L624-L638)、[ServerConfig 的 password 字段](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/config.rs#L403-L410)、[POSIX exec 环境说明](https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html)、[Apple Process.arguments](https://developer.apple.com/documentation/foundation/process/arguments?changes=_9)、[Apple Process.environment](https://developer.apple.com/documentation/foundation/process/environment?changes=_2)
+4. **安全性是“减少 argv/配置文件持久暴露”，不是秘密管理或不可观察。** 同一用户权限下的进程检查、调试/崩溃采集、父进程/启动器日志、以及 sslocal 启动的插件都可能接触环境或内存中的值。官方 SIP003 plugin 启动代码没有清空环境，因此 plugin 子进程默认继承包括该变量在内的父环境。[官方 plugin 启动源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/plugin/ss_plugin.rs#L7-L29)、[Rust Command 的默认继承规则](https://doc.rust-lang.org/std/process/struct.Command.html#method.new)
+5. **对当前 ShadowsocksX-NG2 不直接适用。** NG2 当前不生成 `${VAR}` 占位符，也不把 Keychain 密码注入 agent 环境；它在激活时从凭据存储解析密码，写入 `sslocal-active.json` 的明文 `password` 字段，再由 wrapper 以 `sslocal -c <path>` 启动。wrapper 会把自身环境整体传给 sslocal，但这并不等于它提供了某个服务器密码变量。[NG2 激活解析](../../ShadowsocksX-NG2/Domain/ActivationStateMachine.swift#L164-L223)、[NG2 runtime 文档](../../ShadowsocksX-NG2/Domain/SslocalRuntimeDocument.swift#L149-L210)、[NG2 wrapper spawn](../../ShadowsocksX-NG2/Agent/main.swift#L395-L406)
+
+## 1. `${VAR}` 是否由 sslocal 解析，在哪个版本/实现中
+
+### 1.1 当前实现的实际语义
+
+`shadowsocks-rust` v1.25.0 的配置加载器在两条 JSON 路径都调用 `read_variable_field_value`：
+
+- 标准单服务器配置的顶层 `password`：加载 `server/server_port/password/method` 后调用该函数，再创建 `ServerConfig`。[源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2137-L2179)
+- 扩展配置的 `servers[]` 条目：同样先解析 `svr.password`，再调用该函数。[源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2247-L2287)
+
+`sslocal` 以 `ConfigType::Local` 调用同一个配置加载器；命令行 `--password/-k` 也调用同一函数，因此命令行若传入字面量 `'${VAR}'` 也会解析，但命令行 shell 是否已先展开是另一层问题。[sslocal 源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L624-L638)
+
+解析函数的边界很窄：
+
+- `${PASSWORD_FROM_ENV}`：读取环境变量 `PASSWORD_FROM_ENV`。
+- `prefix${VAR}`、`${VAR}suffix`、`$VAR`、`{VAR}`：不替换，原样作为密码字符串。
+- 变量不存在，或环境变量不是有效 UTF-8：记录 warning，并返回原始 `${VAR}` 字符串；**不会自动变成空字符串，也不会把它当成硬错误**。因此部署器应在启动前验证变量存在，否则程序可能以错误的字面量密码继续初始化。[源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L3446-L3466)
+
+### 1.2 版本边界
+
+官方历史提交给出了可审计的版本边界：
+
+- 提交 `74e8a4f8f58ce60545d778f2f083caab72478eea`（2021-11-25）首次把配置文件 `password` 的 `${VAR_NAME}` 读取接入 `shadowsocks-service`，并同时加入 README 示例；提交说明明确写的是“Servers in configuration file `password` field support `${VAR_NAME}`”。[提交 diff](https://github.com/shadowsocks/shadowsocks-rust/commit/74e8a4f8f58ce60545d778f2f083caab72478eea)
+- v1.12.2 于 2021-11-16 发布，早于该提交；v1.12.3 于 2021-11-26 发布，并包含该代码。[v1.12.2 release](https://github.com/shadowsocks/shadowsocks-rust/releases/tag/v1.12.2) 与 [v1.12.3 release](https://github.com/shadowsocks/shadowsocks-rust/releases/tag/v1.12.3) 可固定版本；对比 [v1.12.2 `config.rs`](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.12.2/crates/shadowsocks-service/src/config.rs) 与 [v1.12.3 `config.rs`](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.12.3/crates/shadowsocks-service/src/config.rs) 可见，前者没有 `read_variable_field_value`，后者已在标准配置和 `servers[]` 两处调用它。
+- 提交 `7aec233271670cfc4053bc6cfa0e477baf722790`（2021-11-25）随后把同一语法扩展到命令行 `--password`，并修正变量不存在时保留原文而不是变成空字符串。[提交 diff](https://github.com/shadowsocks/shadowsocks-rust/commit/7aec233271670cfc4053bc6cfa0e477baf722790)
+
+所以本报告的“可用”结论适用于官方 `shadowsocks-rust` v1.12.3 及之后的该配置实现，且已在本仓库固定的 v1.25.0 上复核；不能外推到 `shadowsocks-libev`、其他语言实现或旧版 fork。
+
+## 2. 环境变量值如何进入进程，以及会出现在哪里
+
+### 2.1 进程入口
+
+环境变量必须在启动 `sslocal` 的父进程或服务管理器环境中存在。`std::env::var` 在 `sslocal` 已经启动后读取该进程的环境；它不会从配置文件、Keychain 或某个远程服务自动获取变量。
+
+对 macOS `Process`/`NSTask`，Apple 将 `arguments` 定义为传给 executable 的 `argv[]`，将 `environment` 定义为独立的环境字典；若不另设环境，子进程继承启动它的进程环境。[Apple arguments](https://developer.apple.com/documentation/foundation/process/arguments?changes=_9)、[Apple environment](https://developer.apple.com/documentation/foundation/process/environment?changes=_2)。POSIX `execve` 也明确把 `argv[]` 和 `envp[]` 作为分离的参数数组。[POSIX exec](https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html)
+
+因此典型配置：
+
+```sh
+export PASSWORD_FROM_ENV='secret'
+sslocal -c /path/to/config.json
+```
+
+其中 argv 只含 executable、`-c` 和配置文件路径；密码在 `envp` 中。若写成 `sslocal -k "$PASSWORD_FROM_ENV"`，shell 会先把密码替换进命令行，密码就会重新进入 argv；这不是 `${VAR}` 配置文件方案的安全形状。命令行值也可能进入 shell 历史或启动器审计记录，具体取决于启动方式。
+
+### 2.2 配置文件和内存
+
+`Config::load_from_file` 只读入文件文本，再交给 JSON/JSON5 解析和配置转换；环境替换发生在内存中。随后 `ServerConfig` 保存一个 `password: String`，并用它派生 `enc_key`。[读取文件](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2809-L2828)、[ServerConfig 字段](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/config.rs#L403-L414)、[密钥派生](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/config.rs#L447-L475)
+
+这意味着：
+
+- 原始配置文件可以只保存 `${PASSWORD_FROM_ENV}`，`sslocal` 不会把解析出的值回写到该文件；这是相对明文 JSON 的主要收益。
+- 解析后的密码仍会在 sslocal 的用户态内存中存在，至少存在于配置对象/密码字符串和派生过程相关数据中；环境变量没有让密码变成“只存在于内核”的秘密。
+- 文件权限、备份、APFS 快照、诊断收集等风险只在文件确实没有明文密码时减少；如果外层程序先把环境值写回 JSON，收益就消失。
+
+### 2.3 日志
+
+v1.25.0 的环境替换函数在失败时只记录变量名和错误，不把环境变量的值拼进 warning。[源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L3454-L3465)
+
+在当前 `sslocal` 启动路径中，显式 `trace!("{:?}", service_config)` 位于加载服务层配置之后、加载 Shadowsocks 配置对象之前；被 trace 的对象是外层 runtime/log 配置，不是已解析的 `ServerConfig` 列表。[源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L605-L627)
+
+但这不应被解释成“日志永远安全”：官方依赖中的 `ServerConfig` 是 `#[derive(Debug)]` 且包含 `password: String`，任何集成层、未来版本或调试代码如果直接打印该对象，都可能把密码写入日志。[依赖源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/config.rs#L403-L410) 因此建议把 `RUST_LOG=trace`、崩溃转储和第三方 wrapper/plugin 日志视为需要单独审计的面。
+
+### 2.4 子进程/plugin 环境
+
+SIP003 plugin 是重要例外。官方 v1.25.0 用 Tokio `Command::new(&plugin.plugin)` 启动 plugin，设置 `SS_REMOTE_*`、`SS_LOCAL_*`、可选 `SS_PLUGIN_OPTIONS`，但没有调用 `env_clear` 或移除未知变量；Rust `Command` 的默认行为是继承父进程环境。[官方 plugin 源码](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/plugin/ss_plugin.rs#L7-L29)、[Rust Command 文档](https://doc.rust-lang.org/std/process/struct.Command.html#method.new)
+
+所以若 `PASSWORD_FROM_ENV` 在 sslocal 环境中，官方启动的 plugin 默认也能读取它；plugin 若继续创建子进程，通常还会把它继续传递。受信任、受签名约束的 plugin 可以把这个面纳入产品边界；不受信任 plugin、插件参数中调用的脚本或诊断工具不能被视为隔离的秘密存储。
+
+## 3. 最小可复现验证（2026-09-25）
+
+使用本仓库已固定的 `ShadowsocksX-NG2/Vendor/sslocal/sslocal`，其二进制输出为 `shadowsocks 1.25.0`，架构为 arm64。临时配置的核心内容是：
+
+```jsonc
+{
+  "servers": [{
+    "server": "127.0.0.1",
+    "server_port": 1,
+    "method": "aes-256-gcm",
+    "password": "${SSXNG_RESEARCH_PASSWORD}"
+  }],
+  "locals": [{
+    "protocol": "socks",
+    "local_address": "127.0.0.1",
+    "local_port": 11986,
+    "mode": "tcp_only"
+  }]
+}
+```
+
+以 `SSXNG_RESEARCH_PASSWORD=ENV-ONLY-RESEARCH-MARKER` 启动，观察到：
+
+- sslocal 输出 v1.25.0，并成功监听 `127.0.0.1:11986`；这证明配置文件路径、`servers[].password` 的环境替换和后续配置初始化都通过。远端设置为本机端口 1，未发起真实服务器连接。
+- `ps -ww` 的命令行只有 `sslocal -c .sslocal-env-verification.jsonc`，没有 marker。
+- 同用户 `ps eww` 能看到该 marker 所在的环境变量；报告不复述其完整值。这是本机实证的环境暴露面，不把它夸大为跨用户/跨权限读取能力。
+- `agent`/sslocal 日志没有出现 marker；原始 JSON 在启动后仍只包含 `${SSXNG_RESEARCH_PASSWORD}`。
+- 首次在受限沙箱中运行时，系统配置读取/监听被 sandbox 拒绝；在获得一次受控执行许可后重复运行得到以上结果。该验证没有修改源代码，临时配置已删除，仓库仅保留本报告。
+
+验证命令的关键观察面是：
+
+```sh
+ps -ww -o pid=,command= -p <sslocal-pid>
+ps eww -p <sslocal-pid>
+```
+
+这项 CLI 验证只证明本仓库所固定的 v1.25.0 二进制实际接受该配置并启动，不证明任何特定系统服务管理器会安全提供环境变量，也不证明 plugin 会主动隐藏它。
+
+## 4. 安全边界和与其他方式的比较
+
+| 方式 | argv | 配置文件 | 进程环境 / 内存 | 主要结论 |
+| --- | --- | --- | --- | --- |
+| 配置文件 `"password": "${VAR}"` | 不含实际密码；只含 `-c path` | 只含变量名/占位符 | sslocal 必然读取并在内存中保存；plugin 默认继承环境 | 比 argv 和明文 JSON 少一个常见泄露面，但仍是可观察的运行期秘密 |
+| `sslocal -k 'secret'` | 实际密码在 argv；本机验证同类 `ps` 可见 | 不需要密码文件 | sslocal 仍会在内存中保存 | 不建议用于长期服务/GUI 启动；变量语法只有在 argv 中传的是字面量 `${VAR}` 时才避免实际密码进 argv |
+| 明文 JSON `"password": "secret"` | argv 只含配置路径 | 实际密码落盘，可能进入备份/快照/权限错误副本 | sslocal 仍会在内存中保存 | 运维简单，但持久化暴露面最大 |
+| Keychain/专用 secret store → 运行时配置 | 取决于交接方式 | 可不落盘；若生成运行时 JSON 则运行时文件仍可能是明文 | 读取方和子进程仍会看到运行期值 | 需要围绕交接文件权限、进程环境、plugin 和日志做完整设计；不是自动安全 |
+
+结论是：`${VAR}` **适合作为“避免把实际密码放进 argv 或静态配置文件”的部署接口**，但不应被描述为“安全传递密码”“无泄露风险”或“替代 Keychain”。最低限度的安全约束应是：
+
+- 变量由受控的同用户启动器提供，不把 secret 写进 shell 命令历史、LaunchAgent plist、CI 日志或调试输出；
+- 对启动器环境做白名单，避免无意把所有环境变量传给不需要它们的 plugin；官方 plugin 默认继承环境，因此这是实现责任，不是 sslocal 自动提供的隔离；
+- 启动前检查变量存在且非空；因为 sslocal 缺变量时保留 `${VAR}` 字面量并继续走后续配置构造，而不是明确失败；
+- 日志默认不打开会打印配置对象的 trace/debug；审计 wrapper、plugin、崩溃采集和诊断导出；
+- 配置文件、runtime 临时文件、备份和快照按“可能含秘密”处理，使用最小权限并接受普通删除不等于安全擦除。
+
+## 5. 对 ShadowsocksX-NG2 的适用性
+
+### 5.1 当前实现的事实
+
+NG2 的当前链路与官方环境变量示例不同：
+
+1. `ActivationStateMachine` 通过 `CredentialStoring` 解析 `passwordRef`，得到明文 password。[源码](../../ShadowsocksX-NG2/Domain/ActivationStateMachine.swift#L164-L223)
+2. `SslocalServerDocument` 的 `password` 是必填 `String`，`jsonData()` 将完整 runtime document 编码为 JSON。[源码](../../ShadowsocksX-NG2/Domain/SslocalRuntimeDocument.swift#L149-L210)
+3. `RuntimeFileStore` 通过 `AtomicFileWriter` 写 `sslocal-active.json`；目录基线是 0700，文件是 0600，但文件内容本身包含运行所需的明文密码。[源码](../../ShadowsocksX-NG2/Domain/RuntimeFileStore.swift#L25-L42)、[原子写入权限](../../ShadowsocksX-NG2/Domain/AtomicFileWriter.swift#L11-L42)
+4. wrapper 使用 `child.arguments = ["-c", contractURL.path]`，并把 agent 启动时的整个 `environment` 复制给 sslocal；它没有按 server 把 Keychain 值写入某个 `${VAR}` 名称。[源码](../../ShadowsocksX-NG2/Agent/main.swift#L22-L34)、[spawn](../../ShadowsocksX-NG2/Agent/main.swift#L395-L406)
+5. 当前 LaunchAgent plist 只声明 `ProgramArguments`，没有声明密码环境变量；因此在 NG2 现状下，`${VAR}` 只会是一个未提供变量的字面量，除非外部部署环境另行注入同名变量。[plist](../../ShadowsocksX-NG2/LaunchAgent/com.qiuyuzhou.ShadowsocksX-NG2.agent.plist#L10-L18)
+
+仓库上下文也明确区分“配置树只存 credential reference”和“runtime configuration file 是给外部 tunnel service 的派生文件”，并把 password/plugin options 定义为敏感信息。[`CONTEXT.md`](../../CONTEXT.md#L25-L29)。因此不能因为上游 `sslocal` 支持 `${VAR}`，就把 NG2 当前的 Keychain→runtime contract 交接自动改写成环境变量方案。
+
+### 5.2 适用性结论
+
+**本次不建议把环境变量方式直接接入 NG2，也不应把它写成当前产品能力。** 若未来专门设计该方案，至少要先决定并验证：
+
+- 谁在 GUI、LaunchAgent、wrapper、sslocal 之间拥有变量，如何避免变量进入 plist、日志和 crash report；
+- 多 server/group 激活时变量命名、生命周期和原子更新如何定义；
+- plugin 是否允许继承 password 环境，还是必须在 wrapper/sslocal/plugin 边界清理环境；
+- 缺失/空变量是否必须变成 NG2 的显式 activation failure，而不能接受上游“保留 `${VAR}` 并继续”的默认行为；
+- runtime 文件是否仍落盘明文，以及诊断/备份/崩溃路径怎样处理；
+- 环境变量变化是否要成为 wrapper 的 restart fingerprint，不能被当前“仅 servers 变化就转发 SIGUSR1”的重载协议静默吞掉。[NG2 wrapper 重载逻辑](../../ShadowsocksX-NG2/Agent/main.swift#L13-L17)、[重载分支](../../ShadowsocksX-NG2/Agent/main.swift#L164-L192)
+
+在这些边界没有被单独设计和验证前，针对 NG2 的准确说法是：**上游 sslocal 支持该机制；NG2 当前没有使用它，当前产品的凭据交接路径仍是 Keychain 解析后写入受权限保护的 runtime contract。**
+
+## 6. 来源索引
+
+### 官方 shadowsocks-rust
+
+- [v1.25.0 README 配置示例](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md#L795-L805)
+- [v1.25.0 `shadowsocks-service` 配置解析](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2137-L2179)、[扩展 `servers[]` 路径](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2247-L2287)、[变量函数](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L3446-L3466)
+- [v1.25.0 sslocal 入口](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L605-L638)
+- [v1.25.0 `ServerConfig`](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/config.rs#L403-L475)
+- [v1.25.0 SIP003 plugin 启动](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/plugin/ss_plugin.rs#L7-L29)
+- [首次引入配置文件 `${VAR}` 的提交](https://github.com/shadowsocks/shadowsocks-rust/commit/74e8a4f8f58ce60545d778f2f083caab72478eea)
+- [扩展到命令行 `--password` 的提交](https://github.com/shadowsocks/shadowsocks-rust/commit/7aec233271670cfc4053bc6cfa0e477baf722790)
+- [v1.12.2](https://github.com/shadowsocks/shadowsocks-rust/tree/v1.12.2)、[v1.12.3](https://github.com/shadowsocks/shadowsocks-rust/tree/v1.12.3)
+
+### 依赖/规范/平台一手来源
+
+- [Rust `std::process::Command` 环境继承](https://doc.rust-lang.org/std/process/struct.Command.html#method.new)
+- [POSIX `execve` 的 argv/envp 说明](https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html)
+- [Apple `Process.arguments`](https://developer.apple.com/documentation/foundation/process/arguments?changes=_9)
+- [Apple `Process.environment`](https://developer.apple.com/documentation/foundation/process/environment?changes=_2)
+
+> 以上结论和验证均截至 2026-09-25；上游未来版本可能改变缺失变量、日志、plugin 环境或重载行为，升级 vendor 版本时应重新核对相同源码边界。
diff --git a/docs/research/sslocal-runtime-age-encryption.md b/docs/research/sslocal-runtime-age-encryption.md
new file mode 100644
index 000000000..aa0de0967
--- /dev/null
+++ b/docs/research/sslocal-runtime-age-encryption.md
@@ -0,0 +1,75 @@
+# sslocal 运行时配置的 age 加密方案评估（2026-10-18）
+
+> 状态：研究与候选设计，不表示已采纳或实现。代码快照为 HEAD `b1b00d7`；后续实施前须重新核对代码、依赖版本和上游接口。
+
+## 结论
+
+**age v1 + X25519 适合作为运行时配置文件的候选加密格式。** Rust `age` crate 有内存与流式 API，可嵌入上游 `sslocal`；AgeKit 暴露 X25519 身份生成、公钥序列化和 age 文件加解密 API。两边按经典 X25519 recipient 互通在技术上可行，但本次没有找到跨实现测试证据，因此目前只能确认“候选匹配”，不能宣称已经互通。[age 文件格式规范](https://github.com/C2SP/C2SP/blob/main/age.md)、[Rust `age` crate](https://docs.rs/age/latest/age/)、[AgeKit](https://github.com/jamesog/AgeKit)
+
+建议的职责边界：
+
+1. Agent 首次运行时生成 X25519 identity；私钥只保存在 Agent 自己的 Keychain 项中，公钥 recipient 以带版本和 key ID 的文件发布给主程序。公钥不是秘密，但主程序必须能信任它确实属于当前 Agent。
+2. 主程序从已解锁的服务器库构造运行时 JSON，在内存中使用 AgeKit 加密，再原子写入密文文件。不要创建明文临时运行配置。
+3. Agent 从自己的 Keychain 取得私钥，通过专用继承文件描述符/管道交给 `sslocal`；不放进命令行参数、环境变量、日志或普通临时文件。修改后的 Rust `sslocal` 独自解密并解析运行配置。
+4. Agent 另读一个最小的非秘密监管清单，继续执行监听探测、ACL 路径检查、重启分类和部署回执。它不需要解密服务器配置。
+
+Agent 的运行时私钥是可重建的派生密钥。若 Agent 因签名身份变化无法继续访问旧私钥，可轮换 Agent 密钥并由主程序从持久服务器库重新生成运行时密文；只有主程序读取服务器库主密钥失败时，才需要按既定服务器库恢复流程重新授权。这个边界与已接受的服务器库 Keychain/恢复设计一致。[ADR-0035](../adr/0035-encrypt-persistent-server-library.md)
+
+## age 与两种实现的适配性
+
+age v1 采用带 recipient stanza 的二进制文件格式，并对文件头和加密内容提供完整性保护。X25519 recipient 使用临时 X25519 密钥和 HKDF-SHA256 包装随机文件密钥，再以 ChaCha20-Poly1305 加密数据。密文完整性可检测篡改和截断，但 age 公钥加密不认证发送方：任何持有公开 recipient 的进程都能产生该 recipient 可解密的有效密文。[C2SP age 规范](https://github.com/C2SP/C2SP/blob/main/age.md)
+
+为匹配当前 Swift 实现，首版应明确限定为 age v1 + 经典 X25519 recipient（`age1…`），不启用 age 插件 recipient、SSH recipient 或 PQ recipient。若以后要把发送方身份纳入保证，需要单独增加签名/授权机制；不能把 age 密文认证描述成“由主程序写入”。本项目现行凭据威胁边界不包含同一用户进程被攻破；目录 0700、文件 0600 继续用于隔离其他用户账户。[GLOSSARY.md](../../GLOSSARY.md#凭据与诊断)
+
+Rust crate 当前文档为 `age` 0.12.1，并明确所有 1.0 前版本仍是 beta/testing 发布。它提供 X25519 `Identity::generate()`、`to_public()`，以及小型数据的 `age::encrypt` / `age::decrypt` 和流式 `Encryptor` / `Decryptor`。运行 JSON 较小时可先评估内存 API；若用流式 API，解密必须读取到 EOF 才完成末块认证，写入端必须调用 `finish()`，然后才能原子替换活动配置。应固定确切 crate 版本与 features，不把 age 文件格式自行拆包或手工解析。[crate 文档](https://docs.rs/age/latest/age/)、[Encryptor](https://docs.rs/age/latest/age/struct.Encryptor.html)、[Decryptor](https://docs.rs/age/latest/age/struct.Decryptor.html)、[X25519 Identity](https://docs.rs/age/latest/age/x25519/struct.Identity.html)
+
+AgeKit 的当前 README 描述了 X25519 key/recipient 与 age 加解密路径，最低为 macOS 11，满足本项目当前 macOS 15 部署目标。它也记录 scrypt 互通限制和不支持 SSH；这些不影响仅使用 X25519 的方案。风险在于该 Swift 实现尚无可见的正式 release，README 指向 `main` 分支，Package.swift 还依赖 `swift-asn1` 的移动 `main` 分支，且现有测试主要是库内往返测试，未见 Rust/age CLI 跨实现夹具。`parseIdentities` 对导入的私钥文本还要求换行结尾。落地前应固定并审查 AgeKit 与全部传递依赖的具体提交；如果不能固定或审查，考虑 fork/vendor 后维护所需的 X25519 子集。[AgeKit README](https://github.com/jamesog/AgeKit/blob/main/README.md)、[Package.swift](https://github.com/jamesog/AgeKit/blob/main/Package.swift)、[identity parser](https://github.com/jamesog/AgeKit/blob/main/Sources/AgeKit/Parse.swift)、[AgeKit commits](https://github.com/jamesog/AgeKit/commits/main)、[releases](https://github.com/jamesog/AgeKit/releases)
+
+## 当前 Agent 是否读取 `sslocal-active.json`
+
+**当前实现中 Agent 和 sslocal 都读取它。** Agent 的 [loadContract()](../../ShadowsocksX-NG2/Agent/AgentContract.swift#L11) 读取整个文件并解码完整 `SslocalRuntimeDocument`；该结构含 `servers[].password`、插件选项和监听数据。[文档模型](../../ShadowsocksX-NG2/Domain/Runtime/SslocalRuntimeDocument.swift#L87) 明确将其定义为完整运行契约；Agent 随后用 `-c <路径>` 启动 sslocal，且上游通过 SIGUSR1 重读同一文件。[运行路径](../../ShadowsocksX-NG2/Domain/Runtime/RuntimePaths.swift#L13)
+
+Agent 解析该文档有现行用途，不只是重复检查：
+
+- 启动/重载时验证 schema 与监听配置，并比较 `listenFingerprint`，决定重启子进程还是转发 SIGUSR1；[重载逻辑](../../ShadowsocksX-NG2/Agent/main.swift#L234)
+- 检查 ACL 活动链接是否落在运行目录内；[AgentContract.swift](../../ShadowsocksX-NG2/Agent/AgentContract.swift#L14)
+- 按 `locals` 探测监听端点，并在 ACL 模式下检查子进程是否拥有 TCP listener；[AgentListening.swift](../../ShadowsocksX-NG2/Agent/AgentListening.swift#L41)
+- 从 `listen.authentication` 读取 LAN 用户名/密码并写入认证 sidecar；[认证 sidecar](../../ShadowsocksX-NG2/Agent/AgentContract.swift#L45)、[凭据结构](../../ShadowsocksX-NG2/Domain/Runtime/RuntimeListenerAuthentication.swift#L3)
+- 根据已解析文档计算部署回执摘要；[回执写入](../../ShadowsocksX-NG2/Agent/AgentContract.swift#L27)
+
+所以，**目标不是让 Agent 对所有运行文件都盲目**，而是把当前完整 JSON 拆成“只有 sslocal 读取的密文配置”和“Agent 可读的非秘密控制面”。只把现有 JSON 加密并让 Agent 继续 `loadContract()` 会失效；让 Agent 不读任何旁路数据也会丢失上述监管职责。
+
+## 建议拆分的控制面
+
+`sslocal-active.age` 保存上游 sslocal 所需的完整配置以及只有 sslocal/GUI 需要的扩展；Agent 只读取例如 `agent-runtime.json` 的精简监管清单。清单至少应表达：格式版本、活动 key ID/部署 generation、需要探测的监听协议与地址、一个不泄露 LAN 密码的监听配置 generation、ACL 是否启用及固定运行路径，以及 Agent 发布回执所需的部署标识。清单不得包含服务器密码、完整插件参数、LAN 用户名或密码。
+
+避免直接把 `listenFingerprint` 原样搬到清单：当前 fingerprint 包含 authentication 字段，含用户名/密码。应由 GUI 产生不暴露凭据的 opaque generation/token，或拆出只含非秘密监听字段的结构。也不要用低熵凭据的无盐散列代替秘密字段。
+
+LAN auth sidecar 是职责迁移的主要接缝：当前 Agent 从明文运行文档写出 sidecar。可由 GUI 在写密文时生成这些现有 0600 派生文件，或由修改后的 sslocal 根据解密配置生成；不要把 LAN 凭据复制进监管清单。两种方案都要保证旧进程仍使用的内容寻址 sidecar 不被覆盖。[RuntimeListenerAuthentication.swift](../../ShadowsocksX-NG2/Domain/Runtime/RuntimeListenerAuthentication.swift#L21)
+
+当前 Agent 在重载后会直接写入基于 JSON digest 的部署回执。改成密文加旁路清单后，回执不能只代表 Agent 成功读到了 manifest；最好由 sslocal 在成功解密、校验并应用指定 generation 后确认，Agent 再结合监听 ready 状态发布回执。否则 GUI 可能把“文件已写入”误判成“新配置已生效”。新旧 generation 与 ACL 变体/活动链接/运行契约的原子发布顺序也需重新定义，并保留现有的事务与代次防护。[RuntimeFileStore.swift](../../ShadowsocksX-NG2/Domain/Runtime/RuntimeFileStore.swift)
+
+## 失败语义与恢复
+
+加密文件认证失败、密钥不可用、文件格式未知或密文损坏时，应保留原密文并报告具体可恢复状态，不删除文件、不写空配置。当前 Agent 的无效 JSON 路径会删除 `sslocal-active.json`；加密后不能沿用这一语义。[启动失败路径](../../ShadowsocksX-NG2/Agent/main.swift#L85)、[重载失败路径](../../ShadowsocksX-NG2/Agent/main.swift#L242)
+
+运行中重载时，sslocal 应先完整解密并验证新 generation，再原子切换内存配置；失败则保留旧的有效配置。首次启动解密失败时不得启动空配置。加密文件应在同目录临时写出后原子替换，临时文件也只能是密文。Agent 的崩溃恢复仍需保留“意外退出后由 launchd 重放最近有效快照”的既有语义，且要避免永久解密错误造成无休止的重启循环。[LaunchAgentService.swift](../../ShadowsocksX-NG2/App/Application/Services/LaunchAgentService.swift)
+
+私钥从 Agent 到 sslocal 的传递仍然是秘密跨进程传递。age 只保护静态文件，不解决这段运行时密钥交接；使用独立管道/继承 FD 或受保护的本地 IPC，并核实 Swift `Process`/实际 spawn 路径不会意外把 FD 传给其他子进程。不要将私钥写入 argv、环境变量、日志或与密文并列的 0600 普通文件。若 Agent 私钥因签名变化不可用，优先按“重建派生密钥、从持久服务器库重生成运行文件”恢复；不要为保持派生文件而降低存储保护级别。
+
+## 实施前的互通与生命周期门槛
+
+尚未运行实现或测试。进入实现前至少需完成：
+
+1. AgeKit 加密 → Rust `age` 解密、Rust `age` 加密 → AgeKit 解密；并与参考 `age`/`rage` 做双向固定夹具验证。
+2. 错误 recipient、错误私钥、篡改头/内容、截断、未知格式、空配置与超大输入的失败验证；确保不会把认证失败当作空配置或删除原文件。
+3. 首次启动的公钥文件竞争、key rotation、Agent Keychain 项被拒绝/重建、主程序在 Agent 之前启动、GUI 重写密文与 Agent 同时重载等时序验证。
+4. 检查进程参数、环境、日志、临时文件和 Agent 控制清单不含私钥、服务器密码、插件秘密或 LAN 密码；检查密文与 sidecar 的 0600 权限和 0700 父目录。
+5. 验证 Agent 的 receipt 只在 sslocal 已应用相应 generation 且监听就绪后发布，并覆盖启动、SIGUSR1 重载、结构变化重启、子进程崩溃恢复与持久解密错误路径。
+
+## 一手资料
+
+- [C2SP age file encryption format](https://github.com/C2SP/C2SP/blob/main/age.md)
+- [Rust `age` crate API](https://docs.rs/age/latest/age/)
+- [AgeKit README](https://github.com/jamesog/AgeKit/blob/main/README.md)、[Package.swift](https://github.com/jamesog/AgeKit/blob/main/Package.swift)、[源码](https://github.com/jamesog/AgeKit/tree/main/Sources/AgeKit)、[测试](https://github.com/jamesog/AgeKit/tree/main/Tests/AgeKitTests)
+- [项目术语表中的凭据暴露边界](../../GLOSSARY.md#凭据与诊断)、[ADR-0035](../adr/0035-encrypt-persistent-server-library.md)
diff --git a/docs/research/wayfinder-issue-11.md b/docs/research/wayfinder-issue-11.md
new file mode 100644
index 000000000..d69a04d94
--- /dev/null
+++ b/docs/research/wayfinder-issue-11.md
@@ -0,0 +1,154 @@
+# Wayfinder issue 11：macOS 15+ PAC 代理模式的重实现方案
+
+- 票据：[研究：macOS 15+ PAC 代理模式的重实现方案](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/11)
+- 父地图：[Wayfinder: ShadowsocksX-NG 2.0 现代化重实现](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/1)
+- 研究日期：2026-09-20
+- 适用范围：macOS 15+、仅 arm64、ShadowsocksX-NG 2.0；Legacy 只读参考；不把产品扩大为 VPN、TUN 或 Network Extension 代理产品。
+- 证据规则：Legacy 源码和本机 SDK/工具是本项目证据；系统契约使用 Apple 官方文档、SDK 头文件和 Apple 官方设备管理 schema；所有实测结果都标注环境，未实测的系统行为不写成事实。
+
+## 决策摘要
+
+1. **2.0 应保留内置 PAC 作为代理模式，但替换 Legacy 的文件监视和状态切换设计。** 目前没有 Apple 提供的“把域名规则直接变成系统分流”的更高层 API。Apple 的公共边界仍是 PAC URL、PAC JavaScript 和 System Configuration 的 Proxies 配置。更好的方案是把规则编译、PAC 交付、系统配置和恢复分成独立的可验证组件，而不是把整个 PAC 生命周期绑在 GCDWebServer 快照和 setuid helper 上。
+2. **推荐的默认交付是受控的 loopback HTTP PAC endpoint。** PAC 服务只绑定 127.0.0.1，提供只读、固定 MIME、单一版本化路径的内存快照；每次成功编译产生新 generation URL，避免依赖缓存刷新。PAC 服务可以作为 per-user runtime service 的一部分，不需要 root；系统代理配置仍通过一个最小化、明确授权的 SystemConfiguration seam 写入。
+3. **继续使用 SystemConfiguration 的原生 Proxies 配置，不把 networksetup 当作 2.0 的核心 API。** Apple 的 SCPreferences/SCNetworkConfiguration API 明确提供代理配置、提交和应用操作；增强权限需要授权。networksetup 仍可用于诊断或手工恢复，但通过 shell 解析它会增加本地化、错误传播和权限处理风险。
+4. **内联 PAC JavaScript 是值得做的短期原型，不应在没有目标系统实测前替代 URL。** Apple SDK 和文档公开了 ProxyAutoConfigJavaScript key，以及 CFNetwork 对内存 PAC 脚本的执行 API；但公开资料没有承诺把该 key 写入每个 network service 后，macOS 27/15 上所有系统客户端都按系统 PAC 模式使用它。因此它是可验证的候选优化，不是本票据可以直接锁定的默认实现。
+5. **file URL 不作为默认方案。** Legacy 接受 file/http/https URL，但 Apple 的当前公开用户文档只保证“Automatic proxy configuration + PAC URL”这一配置边界，没有为本产品承诺 file URL 在 macOS 15+ 的所有系统客户端中可用。迁移时保留原值并做能力校验；未经目标版本实测，不应把 file PAC 宣传为支持能力。
+6. **Network Extension App Proxy、Transparent Proxy、Packet Tunnel 都不属于 PAC 替代方案。** Apple 将这些能力定义为 VPN/流量代理并要求 Network Extension entitlement；它们会扩大本地图的目标，不应作为 PAC 研究的默认逃生路线。
+
+## 1. Legacy 的真实 PAC 契约
+
+Legacy 的 PAC 是“规则编译 + 本机 HTTP 托管 + 特权系统代理写入”的组合，不是一个可以直接复制到 2.0 的静态文件。
+
+- PAC 状态目录是 ~/.ShadowsocksX-NG/；输出为 gfwlist.js，输入为 gfwlist.txt 和 user-rule.txt。首次运行从 bundle 复制规则资源，同时迁移旧的 ~/.ShadowsocksX-NE/ 目录。[PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L12-L17) [PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L51-L73)
+- GeneratePACFile() 对 Base64 GFWList 解码，把用户规则置前并去重，过滤空行/注释，再把规则和 SOCKS 地址/端口替换进 abp.js；结果用临时文件加 rename 原子替换 gfwlist.js。[PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L79-L150)
+- abp.js 的 FindProxyForURL 命中规则时返回 SOCKS5/SOCKS/DIRECT，否则返回 DIRECT。[abp.js](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/abp.js#L1-L6) [abp.js](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/abp.js#L768-L777)
+- 本地 PAC URL 固定为 http://localhost:<port>/proxy.pac；GCDWebServer 在启动时把文件读入 originalPACData，只注册 GET /proxy.pac，并返回 application/x-ns-proxy-autoconfig。[ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L136-L153) [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L206-L253)
+- 默认监听 localhost:1089，端口和绑定范围来自 UserDefaults；PAC 文件变更由 vnode 监视器触发 disableProxy 后 enablePACProxy。[AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L91-L115) [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L262-L294)
+- 系统代理由 /Library/Application Support/ShadowsocksX-NG/proxy_conf_helper 写入。安装脚本把 helper 设为 root:admin、a+rx 并加 setuid；helper 使用 AuthorizationCreate 和 SCPreferencesCreateWithAuthorization，处理 auto/global/off 以及网络服务、例外项。[install_helper.sh](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/install_helper.sh#L10-L14) [proxy_conf_helper/main.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/proxy_conf_helper/main.m#L105-L216)
+- 外部 PAC 直接把 ExternalPACURL 传给相同的 helper；PACURLFormatter 接受 file/http/https，但没有看到内容、可达性或来源完整性校验。[PACURLFormatter.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACURLFormatter.swift#L26-L52) [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L195-L221)
+
+源码盘点发现的具体风险边界：
+
+- PAC 服务失败的布尔结果未向上层传播，之后仍可能把不可用 URL 写入系统代理；用户端口允许 128–65535，但 URL/监听路径有 short 窄化，32768–65535 存在表示范围不一致。[ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L206-L215) [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L244-L252)
+- 原子替换会产生 vnode DELETE；监视器在 DELETE 事件中取消自身，而源码没有持续重装路径。后续规则更新并不保证仍会被观察到。[PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L146-L150) [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L273-L293)
+- helper 的 auto/global 路径从部分 key 新建 Proxies 字典，关闭时只在 PAC URL 或 SOCKS 值恰好匹配调用方参数时清除；它没有保存并恢复用户原有的完整代理字典。[proxy_conf_helper/main.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/proxy_conf_helper/main.m#L126-L216)
+- 外部 PAC 启用时传入外部 URL，但 disableProxy 始终传本地 getHttpPACUrl；外部 PAC 进入 manual/off 或退出的清理路径因此存在状态不对称。[ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L178-L203)
+- PAC 模板头部标注由 gfwlist2pac 生成并带 GPLv3 声明。2.0 若继续重用该模板，要把许可和生成器来源作为独立发布检查项；本票据不假定其上游维护状态。[abp.js](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/abp.js#L1-L22)
+
+## 2. Apple 当前的 PAC 和系统代理边界
+
+### 2.1 用户可见契约
+
+Apple 当前的 macOS 用户指南把 Automatic proxy configuration 定义为“使用 PAC 文件，并在 URL 字段输入 PAC 文件地址”，同时把 Auto proxy discovery、HTTP、HTTPS、SOCKS 和 bypass hosts/domains 列为不同选项。[Apple Support：Enter proxy server settings on Mac](https://support.apple.com/en-nz/guide/mac-help/mchlp25912/mac)
+
+这支持 2.0 继续把 PAC 视为一个独立 Proxy mode；它不支持把 PAC 误说成自动 TUN、VPN 或覆盖所有网络路径的系统替代品。
+
+### 2.2 SystemConfiguration 是写入系统配置的原生边界
+
+Apple 的 SystemConfiguration 文档公开了：
+
+- kSCPropNetProxiesProxyAutoConfigEnable：Proxies 字典中的 0/1 开关。[文档](https://developer.apple.com/documentation/systemconfiguration/kscpropnetproxiesproxyautoconfigenable-swift.var)
+- kSCPropNetProxiesProxyAutoConfigURLString：Proxies 字典中的 PAC URL 字符串。[文档](https://developer.apple.com/documentation/systemconfiguration/kscpropnetproxiesproxyautoconfigurlstring-swift.var)
+- SCNetworkServiceCopyAll、SCNetworkServiceCopyProtocol 和 SCNetworkProtocolSetConfiguration：读取 network services 并保存指定协议配置；SCNetworkConfiguration 总览要求通过 SCPreferencesCommitChanges 持久化。[SCNetworkConfiguration](https://developer.apple.com/documentation/systemconfiguration/scnetworkconfiguration) [SCNetworkProtocolSetConfiguration](https://developer.apple.com/documentation/systemconfiguration/scnetworkprotocolsetconfiguration%28_%3A_%3A%29)
+- SCPreferencesCreateWithAuthorization：访问需要增强权限的 per-system preferences session；SCPreferencesCommitChanges 持久化，SCPreferencesApplyChanges 请求应用到 active configuration。[创建授权 session](https://developer.apple.com/documentation/systemconfiguration/scpreferencescreatewithauthorization%28_%3A_%3A_%3A_%3A%29) [提交](https://developer.apple.com/documentation/systemconfiguration/scpreferencescommitchanges%28_%3A%29) [应用](https://developer.apple.com/documentation/systemconfiguration/scpreferencesapplychanges%28_%3A%29)
+
+这意味着“换成 Apple API”不能理解为“免权限”：2.0 可以把 Legacy 的 setuid root 全局 helper 收窄为只负责代理配置的授权边界，但仍必须明确授权、提交、应用、失败传播和原配置恢复。
+
+### 2.3 CFNetwork 能执行 PAC，但不是系统配置写入 API
+
+Apple CFNetwork 文档同时公开 CFNetworkCopySystemProxySettings、CFNetworkCopyProxiesForURL、CFNetworkCopyProxiesForAutoConfigurationScript 和 CFNetworkExecuteProxyAutoConfigurationURL；它们分别读取系统代理、计算某 URL 的代理、执行内存脚本或下载并执行 PAC URL。[CFNetwork](https://developer.apple.com/documentation/CFNetwork)
+
+Apple 还公开了两个相关 key：
+
+- kCFNetworkProxiesProxyAutoConfigURLString 的值是 PAC 文件 URL。[文档](https://developer.apple.com/documentation/cfnetwork/kcfnetworkproxiesproxyautoconfigurlstring)
+- kCFNetworkProxiesProxyAutoConfigJavaScript 的值是完整 PAC JavaScript；kCFProxyTypeAutoConfigurationJavaScript 表示由提供的脚本决定代理。[JavaScript key](https://developer.apple.com/documentation/cfnetwork/kcfnetworkproxiesproxyautoconfigjavascript) [Proxy type](https://developer.apple.com/documentation/cfnetwork/kcfproxytypeautoconfigurationjavascript)
+
+这确认“内存 PAC 脚本”是 CFNetwork 的真实能力，但这些页面没有承诺把 JavaScript key 写入每一个 network service 后，macOS 15+ 的所有系统客户端都像用户在 Network > Proxies 中启用 PAC URL 一样使用它。它必须先在目标版本的 disposable network service 上实测，不能仅凭 key 名称选型。
+
+### 2.4 Network Extension 是不同产品边界
+
+Apple 把 NEAppProxyProvider 描述为 app extension 中的透明网络代理；App Proxy provider 文档明确把它放在 flow-oriented custom VPN client 语境中，并要求 com.apple.developer.networking.networkextension entitlement。[NEAppProxyProvider](https://developer.apple.com/documentation/networkextension/neappproxyprovider) [App proxy provider](https://developer.apple.com/documentation/networkextension/app-proxy-provider) [Network Extensions entitlement](https://developer.apple.com/documentation/BundleResources/Entitlements/com.apple.developer.networking.networkextension)
+
+因此 App Proxy、Transparent Proxy、Packet Tunnel 不能作为本票据的 PAC 替代。选择它们会重画地图目的地，带来 entitlement、extension lifecycle、用户批准和 VPN/流量覆盖问题。
+
+## 3. 候选方案比较
+
+| 方案 | Apple 证据 | 兼容/迁移判断 | 决定 |
+| --- | --- | --- | --- |
+| Legacy 本机 HTTP + 文件快照 | macOS 用户契约明确接受 PAC URL；Legacy 已有可工作的交付路径 | 兼容性最高，但旧实现有端口、缓存、watcher、恢复和 setuid 风险 | 保留 PAC URL 形态，重写生命周期和安全边界 |
+| 受控 loopback HTTP + versioned endpoint | 同上；PAC URL 是公开系统边界 | 继续覆盖 Safari/CFNetwork 等使用系统 PAC 的客户端；服务可与 per-user runtime 同生命周期 | **2.0 默认推荐** |
+| file URL | Legacy formatter 接受 file；Apple 当前公开指南只说明 PAC URL，不保证 scheme/客户端覆盖 | 容易绕过 HTTP server，但目标系统兼容和缓存语义未证实 | 迁移保留，能力校验通过前不承诺 |
+| 内联 ProxyAutoConfigJavaScript | Apple SDK/API 明确有 key 和 CFNetwork 脚本执行能力 | 可能消除本地 server 和 URL cache，但没有公开的 system-wide client 契约；需要目标系统实验 | 做小型 prototype；不作为默认 |
+| networksetup shell | 本机 networksetup 1.8.4 提供 -setautoproxyurl/-getautoproxyurl/-setautoproxystate；help 明确改变网络设置至少需要 admin | 可作为诊断/恢复工具；shell、权限和输出格式不应成为核心状态机 | 不作为核心 API |
+| Network Extension App/Transparent/Packet Tunnel | Apple 官方支持，但定义为 VPN/流量代理并需要 entitlement | 超出 PAC 和当前地图目的地 | 明确排除 |
+
+### 本机观察（不是跨版本契约）
+
+研究机器的环境是 macOS 27.0（Build 26A428）、arm64，networksetup Version 1.8.4。2026-09-20 执行 networksetup -help 观察到：
+
+- 存在 -setautoproxyurl <networkservice> <url>、-getautoproxyurl 和 -setautoproxystate。
+- help 末尾说明 networksetup 改动 network settings 至少需要 admin privileges；执行 help 自身还打印 AuthorizationCreate() failed: -60008。
+- 当前 scutil --proxy 只有 HTTP/HTTPS/SOCKS 指向 127.0.0.1:64649，ProxyAutoConfigEnable 为 0；这只是本机当前状态，不是产品行为或最低系统保证。
+
+当前 SDK 的官方头文件也直接记录了 PAC schema：
+
+~~~text
+/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX27.0.sdk/System/Library/Frameworks/SystemConfiguration.framework/Headers/SCSchemaDefinitions.h
+  kSCPropNetProxiesProxyAutoConfigEnable             "ProxyAutoConfigEnable"        CFNumber (0 or 1)
+  kSCPropNetProxiesProxyAutoConfigJavaScript         "ProxyAutoConfigJavaScript"    CFString
+  kSCPropNetProxiesProxyAutoConfigURLString          "ProxyAutoConfigURLString"     CFString
+~~~
+
+头文件是编译期 API/schema 证据，不等于 JavaScript key 已在所有网络客户端上通过系统配置路径验证。
+
+## 4. 2.0 推荐的 PAC 设计约束
+
+### 4.1 规则编译器
+
+- 把 GFWList、用户规则和激活目标转成一个纯的 PAC snapshot；输入校验、规则去重、SOCKS host/IPv6 格式化和 JavaScript 字符串转义必须在编译阶段完成。
+- 编译失败时保留最后一个有效 snapshot，并把错误呈现为 stale/error 状态；不得把半成品或空 PAC 替换到系统配置。
+- 生成器不得依赖文件 vnode 事件来触发服务重启。成功编译产生不可变 generation；服务收到显式 publish 命令后切换快照。
+- 是否继续复用 gfwlist2pac 的 abp.js，必须另做 GPLv3/上游维护审查；本票据只决定交付和生命周期，不把第三方规则源写死成产品承诺。
+
+### 4.2 PAC endpoint
+
+- 只监听 127.0.0.1；不要把可配置的 “localhost” 解析结果或用户输入地址作为绑定地址。
+- 只允许 GET 一个固定路由族，例如 /v1/pac/<generation>；不提供任意文件路径、不回显 query 中的敏感信息。
+- 返回完整 JavaScript、application/x-ns-proxy-autoconfig，并显式返回 no-store；generation URL 变化是缓存失效的主机制，Cache-Control 只是额外防线。
+- server 启动失败、端口冲突、健康检查失败必须阻止把 URL 写入系统代理；已有有效 PAC 应继续使用或进入明确停止状态。
+- PAC endpoint 属于 per-user runtime 生命周期。显式停止时先清理自己拥有的系统配置再停 server；异常崩溃恢复时通过保存的 ownership URL/token 判断是否需要清理，不能按“当前是 PAC”盲目覆盖用户配置。
+
+### 4.3 系统代理事务
+
+- 为每个目标 network service 读取完整 Proxies 字典，只改 ProxyAutoConfigEnable、ProxyAutoConfigURLString（或经过实测的 JavaScript key）以及产品明确拥有的例外项。
+- 提交前保存原字典和 ownership record；SCPreferencesCommitChanges 成功后调用 SCPreferencesApplyChanges，并检查两个返回值。
+- 停止/切换到 global/manual/off 时，只有当前 URL 或 generation 仍匹配本产品 ownership 才恢复原字典；如果用户已经手动改过，报告冲突并保留用户最新状态。
+- 系统配置 helper 只负责授权的 network service/proxy 操作，不承载 PAC 编译、不读取服务器密码、不运行任意 URL；不要继续使用长期 setuid root 作为默认安全边界。
+- 用 service ID 而不是显示名称保存选择，并在网络服务增删/切换后重新解析当前 set。Apple 的 SCNetworkServiceCopyAll/SCNetworkSetCopyCurrent 是该查询边界。
+
+### 4.4 外部 PAC
+
+- External PAC 仍可作为独立 Proxy mode，但保存 URL 时至少做 scheme、长度和明显凭证泄漏校验；启用前做 URL 可达性/响应类型检查，失败不切系统代理。
+- 迁移 file/http/https 字符串时不静默改写。对于 file URL，显示“需要在当前 macOS 版本验证”的状态；若能力测试失败，提供迁移错误和人工修复入口。
+- 外部 PAC 的停用必须传入并匹配实际 external URL，修复 Legacy disableProxy 总是使用本地 URL 的不对称。
+
+## 5. 验证计划
+
+以下是进入实现前必须完成的 macOS 15+ arm64 验证，不把本报告中的推断当成已通过测试：
+
+1. 在 macOS 15 的干净测试账户和 macOS 27.0 Build 26A428 的测试账户各建立一个可回滚的网络 service；记录原始 Proxies 字典，不在日常网络配置上直接试验。
+2. 用最小 PAC 脚本分别验证 URL endpoint 和 ProxyAutoConfigJavaScript：GET 状态码、MIME、loopback 绑定、CFNetworkCopyProxiesForURL/CFNetworkCopyProxiesForAutoConfigurationScript 结果，以及 Safari/URLSession 的实际系统代理行为。
+3. 编译一个 generation，访问多个 URL，再发布第二个 generation；确认不重启 app 时系统客户端不会继续使用旧快照。分别测试 URL path 变化、ETag/no-store、服务重启和端口变化。
+4. 规则输入覆盖空列表、注释、重复项、Unicode、IPv4/IPv6 SOCKS 地址、引号/换行/反斜杠和超大规则集；对非法输入确认旧 snapshot 保留且错误可见。
+5. 测试 PAC server 启动失败、端口冲突、sslocal 崩溃、app/LaunchAgent 重启、网络服务增删和用户在外部手动改代理后的恢复/冲突语义。
+6. 对 PAC/global/manual/external PAC 循环切换，确认每个模式清理的是本产品拥有的 key，原 HTTP/HTTPS/SOCKS、例外项和其他 MDM 设置不被覆盖。
+7. 对外部 http、https、file PAC 分别记录“可用/不可用、适用客户端、缓存行为”；未在 macOS 15 和 27 都通过的 scheme 不进入稳定支持矩阵。
+8. 用 codesign/notarized 2.0 构建和实际 per-user runtime 运行一次；确认 PAC 服务无 root 权限也能工作，而只有系统代理写入需要用户授权的最小 helper。
+
+## 6. 对后续票据的明确约束
+
+- 「决策：Legacy 配置迁移与旧版功能边界」：迁移 PAC、外部 PAC URL、GFWList URL、用户规则和网络服务选择，但不迁移旧的 vnode watcher、固定 1089 端口、setuid helper 设计或不对称的 external PAC 清理逻辑；file URL 需要能力校验后再决定保留/报错。
+- 「决策：SwiftUI 菜单栏与配置管理界面信息架构」：PAC、global、manual、external PAC 仍是互斥的 Proxy mode；界面必须能呈现 PAC snapshot stale/error、系统代理授权失败、端口/服务冲突和外部 PAC 不可用，不把 PAC 描述为 VPN/TUN。
+- 「研究：macOS 15 arm64 外部服务与应用生命周期」的 per-user launchd 结论可用于 PAC runtime 的监督，但不自动授予修改系统网络配置的权限；两条生命周期仍需分开显示健康状态。
+
+本报告只新增研究文档；未修改 Legacy/ 或 2.0 生产代码。
diff --git a/docs/research/wayfinder-issue-12.md b/docs/research/wayfinder-issue-12.md
new file mode 100644
index 000000000..712947f36
--- /dev/null
+++ b/docs/research/wayfinder-issue-12.md
@@ -0,0 +1,193 @@
+# Wayfinder issue 12：PAC 本地 HTTP 服务实现方案（替代 GCDWebServer）
+
+- 票据：[研究：PAC 本地 HTTP 服务实现方案（替代 GCDWebServer）](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/12)
+- 父地图：[Wayfinder: ShadowsocksX-NG 2.0 现代化重实现](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/1)
+- 研究日期：2026-09-20
+- 适用范围：macOS 15+、仅 arm64、ShadowsocksX-NG 2.0；该服务只负责向系统客户端交付版本化 PAC 文件，HTTP 代理入站由外部 `sslocal` 直接提供，不经过此服务。
+- 监听范围约束（2026-09-20 确认）：监听范围是用户可配置的两态切换——回环（默认）或主机地址（如 `0.0.0.0` 通配绑定）。用户会把 PAC URL 复制给局域网其他机器使用，因此选定方案必须支持绑定到非回环地址。这与 Legacy 的 `PacServer.BindToLocalhost` 开关（ProxyConfHelper.m:246）相对应，是对 #11 “只监听 127.0.0.1” 默认值的显式放宽。
+- 证据规则：依赖候选以 GitHub API/仓库内容与 Swift Package Index 抓取结果为准（均标注查询日期）；API/系统能力以本机 SDK 为证据；未实测的行为不写成事实。
+
+## 决策摘要
+
+1. **推荐 2.0 用 Network.framework 自研一个最小本地 HTTP/1.1 服务来交付 PAC。** 该服务的全部职责是：绑定监听地址（默认 127.0.0.1，用户可切换为主机地址通配绑定）、响应一个版本化静态路径的 GET、返回固定 MIME 与 no-store。当前 SDK 已直接提供监听与绑定原语（`NWListener`、`NWParameters.requiredLocalEndpoint`，可绑定任意地址包括 `0.0.0.0` 与指定接口），而它并不提供任何公共 HTTP 服务器栈（见第 2 节 SDK 证据），缺的只是一层可以严格限定的最小 HTTP/1.1 解析。为这一个端点引入完整第三方服务器框架（或已归档的 GCDWebServer 系）会放大依赖面、线程模型与供应链风险，超出收益。
+2. **明确排除 GCDWebServer 本体：上游已归档、无 SwiftPM、只能经 CocoaPods 引入。** swisspol/GCDWebServer 仓库 `archived: true`，最后推送 2022-10-05，最后 tag 3.5.4，仓库内没有 `Package.swift`；Legacy 恰是通过 CocoaPods `pod "GCDWebServer", "~> 3.0"`（锁定 3.5.4）引入它的。沿用本体等于把 2.0 唯一遗留的 CocoaPods 时代依赖重新带回，并与 #6 的 SwiftPM 决策直接冲突。
+3. **明确排除 GCDWebServer 的 SwiftPM fork。** 提供 `Package.swift` 的活跃 fork（yene、readium、CaperWhite）都是单一维护者、低 star 的归档项目衍生分支，修复面集中在本仓库无关的平台杂项上，Swift 6 严格并发兼容未经验证。为单一静态端点把供应链押在一个 fork 上，是所有候选中风险/收益比最差的选择。
+4. **Swifter 排除：维护实质停滞。** 最后一个 release 1.5.0 发布于 2020-09-26，仓库最后推送 2024-03-17；基于 POSIX socket 的线程模型也不利于嵌入 per-user runtime。
+5. **Telegraph 是唯一保留的第三方备选，但不是默认。** MIT、纯 Swift、SwiftPM 原生、无外部依赖，功能面正好覆盖“嵌入式 TCP/HTTP 服务器”；但其最后发布 0.40.0 停在 2024-04-01，此后约两年半无发布。若实现阶段证明自研解析不可控，Telegraph 是回退首选。
+6. **swift-nio 是指定的升级路径，不是起点。** Apple 维护、Apache-2.0、活跃（最后推送 2026-09-17，最新 release 2.103.0）、SwiftPM 原生；但为“一个 GET 端点”引入整个 NIO 依赖树和 channel/pipeline 并发模型过度供给。若未来 PAC 服务需要真实 HTTP 语义（按请求鉴权、动态内容、可观测性），按本报告升级到 swift-nio，而不是中途换其他框架。
+7. **本票据不决定 PAC 服务的宿主进程归属与默认端口。** PAC 服务与 per-user LaunchAgent（#3）、GUI 的生命周期关系，以及默认端口与端口冲突策略，留给后续规格/实现票据；本票据只约束实现形态（见第 5 节）。
+
+## 1. Legacy 里 GCDWebServer 的真实用途
+
+Legacy 对 GCDWebServer 的使用确实只有一件事：在本地回环上交付 `/proxy.pac`。
+
+- 依赖来自 CocoaPods：`pod "GCDWebServer", "~> 3.0"`，Podfile.lock 锁定 3.5.4（GCDWebServer/Core）。[Podfile](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/Podfile#L11) [Podfile.lock](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/Podfile.lock#L4-L6)
+- 本地 PAC URL 固定拼为 `http://localhost:<port>/proxy.pac`，端口来自 `PacServer.ListenPort`，short 窄化。[ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L206-L215)
+- 启动服务时把 PAC 文件一次性读入内存 `originalPACData`，只注册 `GET /proxy.pac` 一个 handler，返回 `application/x-ns-proxy-autoconfig`；再以 `GCDWebServerOption_BindToLocalhost` + `GCDWebServerOption_Port` 启动——`PacServer.BindToLocalhost` 是 Legacy 已有的回环/主机两态开关，即“把 PAC URL 给局域网其他机器用”的场景在 Legacy 就被支持。[ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L223-L253)
+- 停止服务只是 `stop`，无错误传播；启动失败的 `error:nil` 也被丢弃——这正是 #11 已判定要重写的生命周期与失败语义。[ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L255-L260)
+
+结论：2.0 对这个组件的需求与 Legacy 完全同构（loopback + 单端点 + 固定 MIME），但生命周期、失败传播和版本化缓存（#11 §4.2）要求整体重写。GCDWebServer 在 Legacy 中的使用没有隐藏功能，替换它没有迁移负债。
+
+## 2. 2.0 对该 HTTP 服务的真实需求面
+
+把 #11 的结论落成选型需求，这个服务的完整契约是：
+
+- 绑定两态：默认绑定 127.0.0.1；用户显式切换“主机地址”时绑定通配地址（`0.0.0.0`）或指定接口地址。方案必须支持任意绑定地址；非回环暴露是显式 opt-in，不是默认态。
+- 只响应一个路由族 `GET /v1/pac/<generation>`；其余路径 404、非 GET 405。
+- 响应体是不可变快照的完整 JavaScript；`Content-Type: application/x-ns-proxy-autoconfig`；显式 `no-store`；generation 变化是缓存失效主机制。
+- 无 TLS、无路由、无动态内容、无上传、无 Cookie/session；请求频率极低（系统客户端在 PAC URL 变化或重启后拉取）。
+- 启动失败/端口冲突/健康检查失败必须阻止把 URL 写入系统代理（#11 §4.2）；服务属于 per-user runtime 生命周期，可显式启停。
+- 客户端与暴露面：回环态面向 macOS 系统代理栈（CFNetwork/Safari/URLSession），暴露对象限于本机同用户进程；主机地址态面向局域网客户端，暴露对象扩大到同一网段的任意主机。PAC 内容本身只是路由规则与本地代理地址，不含凭据（#10 的敏感信息边界不受影响），但非回环态下请求解析的健壮性约束（限长、限速、畸形输入断开）从“防御同用户进程”升级为“防御局域网可达的端口”。
+- 与 #11 §4.2 的差异说明：#11 把“只监听 127.0.0.1”写成默认推荐，其顾虑是“不要把可配置的 localhost 解析结果或用户输入地址作为绑定地址”。两态切换恰好消除自由文本绑定地址：用户只能在“回环”与“主机地址”之间选择，2.0 不提供任意地址输入框。该差异应在地图 #1 的 PAC 决策行上可见。
+
+由此，选型衡量的不是“谁功能强”，而是“谁在只做这一件事时依赖面最小、生命周期最可控”。
+
+## 3. 候选方案调研
+
+以下仓库状态均为 2026-09-20 通过 GitHub API 查询的结果；Swift Package Index（SPI）为同日抓取的页面信息。
+
+### 3.1 GCDWebServer 本体（swisspol/GCDWebServer）
+
+| 维度 | 事实 |
+| --- | --- |
+| 维护状态 | `archived: true`；最后推送 2022-10-05；最后 tag 3.5.4；SPM 请求 issue [#515](https://github.com/swisspol/GCDWebServer/issues/515) 自 2020 年开放未实现 |
+| SwiftPM | 无 `Package.swift`（contents API 404）；只能 CocoaPods/Carthage |
+| 许可证 | LICENSE 为 BSD-3 风格（"Copyright (c) 2012-2014, Pierre-Olivier Latour"），GitHub 归类 NOASSERTION |
+| 绑定能力 | `GCDWebServerOption_BindToLocalhost` 两态开关（回环/通配），满足两态监听需求——Legacy 正是用它实现的 |
+| 场景复杂度 | 功能匹配（legacy 已验证），但 ObjC/GCD 异步模型与 Swift 6 严格并发磨合无上游投入 |
+| 与 #11/#6 契合 | 与 #6 "SwiftPM 只管理必要依赖"冲突；需重新引入 CocoaPods |
+
+来源：[仓库](https://github.com/swisspol/GCDWebServer)、[tags API](https://api.github.com/repos/swisspol/GCDWebServer/tags)、[SPM 请求 issue](https://github.com/swisspol/GCDWebServer/issues/515)、[SPI 页面](https://swiftpackageindex.com/swisspol/GCDWebServer)。
+
+决定：排除。上游归档是硬事实；3.5.4 之后没有任何修复，包括对现代 Xcode 工具链的适配。
+
+### 3.2 GCDWebServer 的 SwiftPM fork
+
+GitHub 搜索stars 最高的携带 `Package.swift` 的 fork（2026-09-20 查询）：
+
+| Fork | 最后推送 | 附加内容 | star |
+| --- | --- | --- | --- |
+| [yene/GCDWebServer](https://github.com/yene/GCDWebServer) | 2025-02-04 | Package.swift、tvOS 支持、Privacy manifests、补 LICENSE | 51 |
+| [readium/GCDWebServer](https://github.com/readium/GCDWebServer) | 2024-12-11 | Package.swift（readium 项目自用） | 13 |
+| [CaperWhite/GCDWebServer](https://github.com/CaperWhite/GCDWebServer) | 2021-08-12 | Package.swift | 15 |
+
+共同问题：都从已归档上游分叉；单一维护者；提交内容是各自下游需求（隐私清单、tvOS），不是对 HTTP 栈的持续维护；Swift 6 严格并发适配无任何承诺；license 归类 NOASSERTION 需自行核对 BSD 条款。绑定能力继承上游的两态开关，满足监听需求，但不改变上述风险。
+
+决定：排除。选 fork 等于把上游归档的风险换一种记账方式，还叠加了 fork 存续风险。
+
+### 3.3 Swifter（httpswift/swifter）
+
+| 维度 | 事实 |
+| --- | --- |
+| 维护状态 | 未归档；最后推送 2024-03-17；最新 release 1.5.0 发布于 2020-09-26 |
+| SwiftPM | 有 `Package.swift`；默认分支 `stable` |
+| 许可证 | BSD-3-Clause |
+| 绑定能力 | 满足：`tcpSocketForListen(_:forceIPv4:maxPendingConnection:listenAddress:)` 接受任意 IPv4/IPv6 地址字符串，回环与通配均可（[Socket+Server.swift](https://github.com/httpswift/swifter/blob/stable/Xcode/Sources/Socket+Server.swift)） |
+| 场景复杂度 | API 简单，但基于 POSIX socket 的线程/阻塞模型；路由框架远超单一端点需要 |
+| 与 #11/#6 契合 | 依赖面小，但近六年只有一个 release，长期无 Swift 工具链验证承诺 |
+
+来源：[仓库](https://github.com/httpswift/swifter)、[releases API](https://api.github.com/repos/httpswift/swifter/releases/latest)、[SPI 页面](https://swiftpackageindex.com/httpswift/swifter)（SPI 列出 6.1–6.4 工具链兼容条目；本研究未逐项核验构建通过状态）。
+
+决定：排除。 stagnation 程度与 GCDWebServer 本体相当，且没有“已经在用”的存量理由。
+
+### 3.4 Telegraph（Building42/Telegraph）
+
+| 维度 | 事实 |
+| --- | --- |
+| 维护状态 | 未归档；最后推送 2024-06-08；main 最新提交 2024-04-01（"Release 0.40.0"）；最新 tag 0.40.0 |
+| SwiftPM | 有 `Package.swift`；零外部依赖的纯 Swift 服务器（TCP/TLS/HTTP/WebSocket） |
+| 许可证 | MIT |
+| 绑定能力 | 满足：`start(port:interface:)` 的 `interface: String?` 支持绑定指定地址/接口，回环与通配均可（Server.swift `start(port:interface:)`） |
+| 场景复杂度 | 正是“嵌入 app 的轻量 HTTP 服务器”定位；绑定、路由、响应控制齐全；对我们用不到 TLS/WebSocket 部分 |
+| 与 #11/#6 契合 | SwiftPM 原生，契合 #6；功能契合 #11；短板是 2024-04 后无发布，维护节奏由单一团队决定 |
+
+来源：[仓库](https://github.com/Building42/Telegraph)、[branches/tags API](https://api.github.com/repos/Building42/Telegraph/tags)、[SPI 页面](https://swiftpackageindex.com/Building42/Telegraph)（SPI 显示 0.40.0/main 有 6.1–6.4 工具链兼容条目）。
+
+决定：保留为**备选**。若实现阶段发现自研解析的边界情况处理成本超出预期（例如需要长连接 keep-alive 语义），Telegraph 是功能面最贴近、依赖面最干净的库方案；引入前须复核其 Swift 6 并发与 macOS 15+ 实测。
+
+### 3.5 swift-nio（apple/swift-nio，NIOHTTP1）
+
+| 维度 | 事实 |
+| --- | --- |
+| 维护状态 | 活跃；最后推送 2026-09-17；最新 release 2.103.0；Apple 官方维护 |
+| SwiftPM | 原生；core + NIOHTTP1 等模块 |
+| 许可证 | Apache-2.0 |
+| 绑定能力 | 满足：`bind(to:)` 原生接受任意 `SocketAddress`（回环、通配、接口地址） |
+| 场景复杂度 | 需要自组 pipeline（decoder/encoder/pipeline handler）；为单一端点引入整个事件循环依赖树 |
+| 与 #11/#6 契合 | 供应链最稳；依赖重量与 #6 “最小依赖面”精神相悖（对本场景） |
+
+来源：[仓库](https://github.com/apple/swift-nio)、[releases API](https://api.github.com/repos/apple/swift-nio/releases/latest)。
+
+决定：作为**升级路径**保留。若 PAC 服务需求演进到按请求鉴权、动态 generation 内容或更高并发语义，迁移到 swift-nio；不作为 2.0 首选。
+
+### 3.6 其他考虑过并排除的方案
+
+- **Hummingbird**（hummingbird-project/hummingbird）：Apache-2.0、非常活跃（2026-09-19 推送，2.26.0），绑定任意地址自然支持，但是完整服务器框架（swift-nio + swift-log/service-lifecycle 生态），比裸 swift-nio 更超出本场景。排除。
+- **Vapor**：同上且更重。排除。
+- **在 `sslocal` 前面挂现成 HTTP 文件服务（如独立进程 caddy/nginx）**：引入一个非 Swift 的第三方二进制违背 #6 的 helper 面收敛，且生命周期与签名发布复杂度完全不对称。排除。
+
+### 3.7 Network.framework 自研最小 HTTP/1.1 服务
+
+本机 SDK（macOS 27.0 SDK，Xcode 自带）证据：
+
+```text
+Network.framework/Versions/Current/Modules/Network.swiftmodule/arm64e-apple-macos.swiftinterface
+  line 616: final public class NWListener
+  line 653: final public var newConnectionHandler: (@Sendable (NWConnection) -> Void)?
+  line 710: final public func start(queue: DispatchQueue)
+  line 2543: final public var requiredLocalEndpoint: NWEndpoint?   (NWParameters)
+```
+
+- 同一 swiftinterface 中不存在任何公共 HTTP 协议/服务器类型（grep `NWProtocolHTTP` 无结果；Headers 目录亦无 `http_options.h`）。即 Network.framework 提供监听/连接/绑定原语，HTTP/1.1 解析必须自己写——这是本方案的唯一工作增量。
+- `requiredLocalEndpoint` 接受任意 `NWEndpoint.hostPort(host:port:)`：回环态绑 `127.0.0.1`，主机地址态绑 `0.0.0.0` 通配或指定接口地址；省略 `requiredLocalEndpoint` 时的默认行为即通配绑定。两态监听范围都是 SDK 原生表达，无需额外依赖。
+- handler 标注 `@Sendable`，与 Swift 6 严格并发天然兼容；无第三方线程模型。
+- 依赖面为零：无 SwiftPM 依赖、无 CocoaPods、无第三方许可证义务；与 #6 的供应链收敛一致。
+- 若将来 app 采用 App Sandbox，监听入站连接需要 `com.apple.security.network.server` entitlement（Xcode App Sandbox > Network > Incoming Connections）；通配绑定时该 entitlement 同样适用。这是任何监听方案共同的约束，应记入 #6 的打包清单。该 entitlement 属于 App Sandbox 体系，本研究未实测其行为。
+
+决定：**推荐**。
+
+## 4. 候选对比
+
+关于两态监听约束：**所有候选都满足“支持绑定非回环地址”**（见各节绑定能力行），因此该约束不构成区分项；真正的区分项仍是维护状态、依赖面与场景契合度。
+
+| 方案 | SwiftPM/依赖面 | 维护/许可证 | 绑定能力 | 单端点场景复杂度 | 与 #11/#6 契合 | 决定 |
+| --- | --- | --- | --- | --- | --- | --- |
+| GCDWebServer 本体 | 无 SPM，需 CocoaPods | 已归档（2022），BSD-3 风格 | 两态开关，满足 | 低（legacy 同构） | 冲突：重新引入 CocoaPods | 排除 |
+| GCDWebServer SPM fork | SPM（fork 提供） | 单维护者低星 fork | 继承上游，满足 | 低 | fork 存续风险叠加归档上游 | 排除 |
+| Swifter | SPM | 停滞（最后 release 2020），BSD-3 | 任意地址，满足 | 低-中（socket 线程模型） | 维护风险高 | 排除 |
+| Telegraph | SPM，零外部依赖 | 2024-04 后无发布，MIT | `interface:` 参数，满足 | 低（库承担解析/路由） | 契合；维护节奏存疑 | 备选 |
+| swift-nio | SPM，重量级依赖树 | Apple 活跃，Apache-2.0 | `bind(to:)`，满足 | 中（自组 pipeline） | 供应链稳但过度供给 | 升级路径 |
+| Network.framework 自研 | 零第三方依赖 | 随系统 SDK | `requiredLocalEndpoint`，满足 | 中（自写有界 HTTP/1.1 解析） | 完全契合 | **推荐** |
+
+## 5. 推荐方案的实现约束
+
+以下约束把 #11 §4.2 的 endpoint 要求翻译成自研服务的实现边界；实现票据应逐条验收。
+
+- **绑定（两态监听范围）**：`NWParameters.tcp` + `requiredLocalEndpoint`。回环态（默认）固定为 IPv4 `127.0.0.1` + 端口；用户显式选择“主机地址”态时绑定 `0.0.0.0` 通配（或指定接口地址）。监听范围是二选一开关，**不提供自由文本绑定地址输入**——这保留 #11 对“用户输入地址作为绑定地址”的顾虑，同时满足局域网共享 PAC URL 的需求。用户可配置项只有监听范围开关与端口。
+- **非回环态的安全语义**：PAC 内容是路由规则与本地代理地址，不含凭据，局域网暴露本身可接受；但非回环态下请求解析的健壮性约束（限长、畸形输入断开、慢速连接防护）面向的是局域网可达端口而非仅本机进程，实现不得因“回环默认”而省略这些边界。generation URL 路径仍是主要访问控制：非持有者只能拿到 PAC 内容本身。
+- **请求解析**：读取请求直到 CRLFCRLF，设硬性头部上限（如 16 KiB），超限即断开；只接受 GET；request-target 同时容忍 origin-form 与 absolute-form；路径不匹配 404，非 GET 405；解析失败一律断开连接，不回显输入。
+- **响应**：200 + 完整 JavaScript 快照；`Content-Type: application/x-ns-proxy-autoconfig`；`Cache-Control: no-store`；精确 `Content-Length`；每个响应后主动 `Connection: close`，把状态机压缩到“单请求单响应”。PAC 拉取频率极低，放弃 keep-alive 是合理交换；若实测发现某系统客户端依赖 keep-alive，再作为受控增强引入。
+- **失败语义**：listener 创建/启动失败、端口冲突必须以错误状态上抛；在失败未解除前不得发布/保留该 URL 的系统代理写入（#11 §4.2 的门禁由上层执行，服务必须可靠地报告失败而不是吞掉）。
+- **生命周期**：与 per-user runtime 同生命周期，支持显式 start/stop 与 generation 热切换（切换只是替换内存快照与当前 generation 值，不重启监听）。
+- **安全边界**：暴露面随监听范围两态变化（回环态限于本机进程，主机地址态扩展到局域网，见前两条）；不实现 TLS、不回显 query、日志脱敏（对齐 #10 的脱敏要求）。
+- **宿主进程、默认端口与端口冲突恢复策略**：不在本票据决定；实现票据必须先决定宿主（LaunchAgent 或 GUI 进程）再落地。
+- **测试**：解析器做成纯函数单元测试（畸形请求、超长头部、多请求管道、absolute-form、大小写头部）；再以真实 loopback socket 做集成测试；最终接入 #11 验证计划的 endpoint 项（MIME、no-store、generation 切换、系统客户端行为）。
+
+## 6. 验证计划
+
+进入实现前必须完成，不把本报告的推断当成已验证：
+
+1. 在 macOS 15 与本机（macOS 27.0 Build 26A428）各跑一个最小 `NWListener` + 手写解析原型，确认 `requiredLocalEndpoint` 分别绑定 `127.0.0.1` 与 `0.0.0.0` 的行为、端口占用时的错误类型与可恢复性。
+2. 非回环态实测：通配绑定后从同一局域网的另一台机器用浏览器/curl 拉取 PAC URL，确认可达性、响应头与 generation 切换；记录 macOS 应用防火墙（socketfilterfw）对入站监听的提示/放行行为——该行为未实测前不得写成事实。
+3. 用 Safari 与 `CFNetworkCopyProxiesForURL` 验证系统代理栈对 `Connection: close`、no-store、generation URL 切换的实际行为；记录是否存在需要 keep-alive 的客户端。
+4. 对解析器跑畸形输入矩阵（超长头部、空请求、二进制、慢速发送、并发连接），确认有界且不崩溃；矩阵在回环与非回环态下各跑一遍。
+5. 压测 generation 热切换：切换期间进行中的请求返回旧快照或失败但绝不返回混合内容。
+6. 若 2.0 决定启用 App Sandbox，实测 `com.apple.security.network.server` entitlement 下监听回环与通配的行为，并记入 #6 打包清单。
+
+## 7. 对后续票据的明确约束
+
+- 「SwiftUI 菜单栏与配置管理界面信息架构」：监听范围（回环/主机地址两态）与 PAC 服务的失败状态（端口冲突、监听失败）是用户可见状态的一部分；两态切换必须明确提示“主机地址会把 PAC 端点暴露给局域网”。界面契约按 #11 的呈现要求执行。
+- 「决策：Legacy 配置迁移与旧版功能边界」：`PacServer.BindToLocalhost` 开关按语义迁移为 2.0 的监听范围两态（回环默认）；迁移用户配置的 `PacServer.ListenPort` 端口值时，short 窄化表示必须换成完整端口范围校验。
+- 实现票据：先决定宿主进程与端口策略，再按第 5 节约束实现；若中途放弃自研，回退顺序是 Telegraph，然后 swift-nio，不得回到 GCDWebServer 系。
+
+本报告只新增研究文档；未修改 Legacy/ 或 2.0 生产代码。
diff --git a/docs/research/wayfinder-issue-16.md b/docs/research/wayfinder-issue-16.md
new file mode 100644
index 000000000..5de744e04
--- /dev/null
+++ b/docs/research/wayfinder-issue-16.md
@@ -0,0 +1,150 @@
+# Wayfinder issue 16：非回环监听态与 macOS 应用防火墙的交互
+
+- 票据：[研究：非回环监听态与 macOS 应用防火墙的交互](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/16)
+- 父地图：[Wayfinder: ShadowsocksX-NG 2.0 现代化重实现](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/1)
+- 研究日期：2026-09-20
+- 适用范围：macOS 15+、仅 arm64、ShadowsocksX-NG 2.0；监听范围「主机地址」态（`0.0.0.0` 通配绑定，#5/#12）下，应用防火墙对 PAC 本地 HTTP 服务（#12/#13）与 `sslocal` 入站的提示、放行与拒绝行为。
+- 证据规则：行为结论以本机实测为准，弹窗出现与否由用户实时目视确认（HITL）；系统能力与默认语义以 Apple 一手文档与系统设置页原文为准；版本偏移（本机 macOS 27.0 Build 26A428，地图目标 macOS 15+）不作外推，进入第 10 节验证计划。
+
+## 决策摘要
+
+1. **回环态（默认）零防火墙交互。** 绑定 `127.0.0.1` 的监听不触发弹窗、不产生防火墙条目（T1 实测）。2.0 的默认监听范围完全不受应用防火墙影响。
+2. **主机地址态下，官方 `sslocal` 二进制必触发防火墙弹窗。** 官方 v1.25.0 arm64 `sslocal` 实测为 `Signature=adhoc`（`flags=0x20002(adhoc,linker-signed)`，TeamIdentifier=not set）；launchd 语境（per-user LaunchAgent，即 #13 确定的生产宿主形态）下，防火墙按二进制归属，ad-hoc 二进制首次非回环监听即弹出「你要应用程序"sslocal"接受传入网络连接吗？」——弹窗显示的是**裸进程名**，与 GUI 应用无任何视觉关联。
+3. **首选缓解：用 Developer ID 重签 `sslocal`（含 wrapper），使两者落入「自动允许已下载的签名软件」豁免，用户全程无弹窗。** 实测：有效 CA 签名（Developer ID + Hardened Runtime）的二进制在本机默认配置（该开关开启）下静默放行（T4/L1）；ad-hoc 即使加 Hardened Runtime 仍弹窗（R1c）。#2 已确立「嵌入 app 后的 helper 会被本项目重新签名」，本建议与其一致；流程上先校验官方 SHA-256 再重签即可保留供应链校验。该建议由 DevID 探针实测外推到 sslocal 本体，重签后的 sslocal 未单独实测（第 10 节）。
+4. **弹窗应答按路径落库，升级不重弹。** 同一路径（app bundle 内路径稳定）替换为新哈希的二进制后不再弹窗（L6 实测：已允许路径换新哈希 → 静默；L4 的相反表象经用户指出混淆变量后修正——该路径的首个弹窗从未被应答，本无记录）。拒绝同理按路径静默维持（L5）。用户只需对每个固定路径应答一次。
+5. **防火墙拒绝不表现为本机自连失败——这是失败路径的主要盲区。** 全部轮次中，同机连接自身 LAN IP 在弹窗未决、已允许、已拒绝三种状态下一律成功（本机流量不经防火墙执法面）；Apple 文档明确「在您采取措施前，该消息会一直保留，且连接该应用的尝试都会被拒绝」指的是**网络侧**连接。因此「主机地址」态下，GUI 用 `127.0.0.1`/本机地址做健康检查无法发现防火墙拒绝，局域网侧实际已不可达。
+6. **拒绝的可检测性与修复路径存在且无需特权：** `socketfilterfw --getappblocked <path>` 与 `--listapps` 在无 sudo 的普通用户态可读（本机实测），GUI 可据此给出定向修复指引（系统设置 → 网络 → 防火墙 → 选项）。
+7. **签名/公证的分工：** 对防火墙起作用的是「有效证书颁发机构签名」身份（Developer ID）；Hardened Runtime 本身不豁免 ad-hoc；公证属 Gatekeeper 首启域而非防火墙判定输入。本机无 notarytool 钥匙串配置，公证差异未实测（第 10 节）。
+8. **GUI 宿主 vs LaunchAgent 宿主无行为差异**：弹窗归属只与被归属二进制自身相关（L1 vs T4 一致）；#13 的 LaunchAgent 宿主决策不引入额外防火墙负担。
+
+## 1. 生产形态的监听面映射
+
+监听范围两态（#12：回环默认，主机地址为显式 opt-in）同时约束两个监听面（#5）：
+
+| 监听面 | 宿主（#13） | 二进制来源与签名 | 回环态 | 主机地址态 |
+| --- | --- | --- | --- | --- |
+| PAC 本地 HTTP 服务（NWListener 自研，#12） | per-user LaunchAgent BundleProgram（wrapper） | 本项目代码，DevID + Hardened + 公证（#15/#6） | 无防火墙交互 | 触发防火墙评估；DevID 下静默放行 |
+| `sslocal` 入站（SOCKS/HTTP） | wrapper 以子进程监管 | 官方 Release 提取，**ad-hoc、linker-signed（第 7 节实测）** | 无防火墙交互 | **触发弹窗，点名 "sslocal"**；拒绝则局域网入站被拒 |
+
+因此本票据的核心问题收窄为：主机地址态下，ad-hoc 的 `sslocal` 会被弹窗点名，以及 GUI 如何提示、检测与恢复。
+
+## 2. 实测环境与方法
+
+- 机器：macOS 27.0 Build 26A428，arm64，LAN IP `192.168.2.89`（en0）。Xcode 27.0（27A266a），Swift 6.4。
+- 防火墙初始状态（全程未改动）：`--getglobalstate` = 1（开启）；block-all 关；「自动允许内建软件」开；「自动允许已下载的签名软件」开（系统设置原文：「允许由有效的证书颁发机构签名的软件提供可从网络访问的服务」）；隐身模式关。无 passwordless sudo，未做状态翻转测试。
+- 探针：单文件 Swift + Network.framework 最小 `NWListener`（TCP），参数化绑定（`127.0.0.1` / `0.0.0.0` / 指定接口地址）、生命周期与 `--spawnbin` 子进程拉起；源码、LaunchAgent 样例与全部运行日志存于本地分支 `research/firewall-nwlistener` @ `94829fe`（`prototype/`）。
+- 签名变体：ad-hoc（`codesign -f -s -`）、ad-hoc + `--options runtime`、Developer ID Application: Qiu Yu Zhou (S878RH3PA8) + `--options runtime`。
+- 启动语境：终端子进程（zsh）；per-user LaunchAgent（`launchctl bootstrap gui/$(id -u)` + `kickstart`）。
+- 观测通道：`socketfilterfw --listapps` / `--getappblocked`（实测均无需 sudo）；同机 `nc -vz` 连接 LAN IP；弹窗由用户目视确认（截图两次、问答确认六次）；防火墙守护进程在统一日志默认无输出（多谓词查询均空），不作为观测通道。
+- 局限：① 同机→自身 LAN IP 的连接不经防火墙执法面，因此「弹窗未决/拒绝是否阻断真实局域网客户端」未获本机实测（Apple 文档语义 + 库存状态为间接证据，第 10 节列入复测）；② macOS 15 未验证；③ 未应答弹窗对真实远端的拦截行为无法用同机连接区分。
+
+## 3. 实测矩阵
+
+| 轮次 | 签名 | 语境 | 绑定 | 弹窗 | 应答 | 库存结果 | 同机连接 |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| T1 | ad-hoc | 终端 | 127.0.0.1 | 无 | — | 无条目 | 成功 |
+| T2 | ad-hoc | 终端 | 0.0.0.0 | **有**（点名 fwprobe，悬置约 2 分钟） | 允许 | Allow（路径落库） | 未决期间成功 |
+| T3/R1b/R1c | ad-hoc+hardened | 终端 | 0.0.0.0 | 无 | — | 无条目 | 成功 |
+| RunA | ad-hoc 新哈希新路径 | 终端 | 0.0.0.0 | 无 | — | 无条目 | 成功 |
+| T4 | DevID+hardened | 终端 | 0.0.0.0 | 无 | — | 无条目 | 成功 |
+| L1 | DevID+hardened | LaunchAgent | 0.0.0.0 | 无 | — | 无条目 | 成功 |
+| L2 | ad-hoc（同 RunA 二进制） | LaunchAgent | 0.0.0.0 | **有**（点名 fwprobe-v2） | 允许 | Allow | 成功 |
+| L3 | DevID 父 + ad-hoc 子（fwprobe-v3） | LaunchAgent | 0.0.0.0 ×2 | **有，点名子进程 fwprobe-v3**，父静默 | 未应答 | 暂无 v3 条目 | 成功 |
+| L4 | fwprobe-v3 路径换新哈希（此前弹窗未应答） | LaunchAgent | 0.0.0.0 | **有**（点名 fwprobe-v3） | 允许 | Allow | 成功 |
+| L5 | ad-hoc 新路径（fwprobe-v5） | LaunchAgent | 0.0.0.0 | **有** | **拒绝** | **Block**；重启同二进制静默维持 | 成功（拒绝后仍成功） |
+| L6 | **已允许路径**（fwprobe-v2）换新哈希 | LaunchAgent | 0.0.0.0 | **无** | — | 原 Allow 维持 | 成功 |
+
+全部日志见 `research/firewall-nwlistener` @ `94829fe` `prototype/logs/`。
+
+## 4. 发现一：回环豁免与「评估触发面」
+
+T1（回环）零交互，所有非回环轮次（`0.0.0.0`、LAN IP）都触发评估或弹窗。结论：防火墙的触发条件是**监听地址超出回环**，与端口无关。对 2.0 的直接推论：默认回环态下防火墙维度可完全忽略；主机地址态是唯一需要 UI 与失败路径设计的状态——与 #12 把非回环定为显式 opt-in 的决策互相印证。
+
+## 5. 发现二：弹窗的形态与时序
+
+- 弹窗文案（中文系统）：「你要应用程序"\<二进制名\>"接受传入网络连接吗？点按"拒绝"可能会限制应用程序的行为。此设置可以在"网络"设置的"防火墙"面板中更改。」+「拒绝/允许」按钮。**显示名是被归属二进制的裸文件名**——T2 显示 `fwprobe`，L3 显示子进程 `fwprobe-v3`。生产环境中用户将看到的是 `sslocal`（或重签后的 wrapper 文件名），与"ShadowsocksX-NG"名字无关。
+- 弹窗出现有秒级异步延迟（监听后数秒内），且**未应答时长期悬置**（T2 悬置约 2 分钟直到用户应答；Apple 文档：「在您采取措施前，该消息会一直保留，且连接该应用的尝试都会被拒绝」）。
+- 弹窗出现后不对本机连接产生可见影响（全部轮次同机连接成功，见第 6 节盲区）。
+
+## 6. 发现三：归属模型与「本机执法盲区」
+
+**归属（谁被点名/记录）：** launchd 语境下按二进制逐个归属——DevID 父进程（wrapper 形态）拉起的 ad-hoc 子进程触发的是**子进程自己**的弹窗（L3），父进程的 Developer ID 签名不覆盖子进程。GUI 宿主与 LaunchAgent 宿主行为一致（T4 vs L1），#13 的宿主决策不改变防火墙语义。
+
+**执法（连接是否被断）：** 同机→自身 LAN IP 的连接在弹窗未决（T2/L2/L3/L4）、已允许（T2 后）、**已拒绝（L5 拒绝后，库存已确认 Block）**三种状态下全部成功。即本机流量不经防火墙执法面。Apple 文档所述「未应答期间连接被拒」只对网络侧客户端生效（本次未获真实远端实测，第 10 节）。
+
+**终端语境异常（非生产形态，仅记录）：** T2 应答一次后，同谱系（同一责任进程链）的后续全新 ad-hoc 二进制（T3/R1c/RunA）在终端语境下全部静默；同一 RunA 二进制切到 LaunchAgent 语境立即弹窗（L2）。解释为防火墙按「责任进程」放行了终端宿主应用的谱系。该现象解释了为什么开发期从终端起服务「从不弹窗」，也说明**不能用开发期体感推断生产行为**——生产判断只采信 launchd 语境数据。
+
+## 7. 发现四：官方 sslocal 的签名态（弹窗必然性的根据）
+
+官方 v1.25.0 arm64 归档（SHA-256 本地复验一致：`58e0caf0…55208`）提取的 `sslocal`：
+
+```text
+Executable=/private/tmp/fwresearch/sslocal
+Identifier=sslocal-f075032ba57bee22
+Format=Mach-O thin (arm64)
+CodeDirectory v=20400 size=73048 flags=0x20002(adhoc,linker-signed) hashes=2279+0 location=embedded
+Signature=adhoc
+TeamIdentifier=not set
+```
+
+即上游发布物由 Rust 链接器 ad-hoc 签名，无 CA 身份。结合 L2/L3/L5：主机地址态下 sslocal 首次监听**必然**触发点名 "sslocal" 的弹窗；且因 #2 规定每次跟随官方 Release 更新二进制，若按官方字节原样分发，每次更新前对路径的旧记录仍然有效（L6：按路径落库，升级不重弹）。
+
+## 8. 发现五：应答落库按路径键，升级不重弹；拒绝静默维持
+
+- **L6（决定性）**：已允许路径 `fwprobe-v2`（L2 应答「允许」）的内容整体替换为新哈希（fwprobe-v6）后，重新非回环监听**未弹窗**，原 Allow 记录继续生效。
+- **L4 的修正过程**：L4 曾显示「同路径换新哈希后再次弹窗」，初读为哈希键；经用户指出 L3 的首次弹窗从未被应答（该路径本无记录），L4 的弹窗是路径首次记录而非重弹。L6 在干净前提（确认允许的路径）上复测定案：**记录按路径键**。
+- **L5（拒绝路径）**：拒绝后 `--getappblocked` 返回 blocked、`--listapps` 显示「屏蔽传入连接」；重启同二进制**不再弹窗**、静默维持拒绝；恢复只能由用户在系统设置 → 网络 → 防火墙 → 选项中手工改回（或删除条目后重新弹窗授权）。
+- 生产含义：app 内固定路径（`Contents/Helpers/sslocal` 等）意味着**每个路径只需用户应答一次**，跟随版本更新不会反复打扰；但一次误点「拒绝」会让主机地址态静默失效，必须由 GUI 检测并给修复指引（第 9 节）。
+
+## 9. 对 2.0 的建议
+
+### 9.1 首选：Developer ID 重签 `sslocal`，把弹窗从用户路径上消掉
+
+- 依据：DevID + Hardened Runtime 二进制在本机默认配置（「自动允许已下载的签名软件」开）下静默放行（T4/L1）；ad-hoc 必弹窗（L2/L3/L5）。
+- 流程（与 #2/#6 已确立的「官方构建产物 + 嵌入后重新签名」一致）：发布脚本按固定 SHA-256 校验官方归档 → 提取 `sslocal` → `codesign -f -s "Developer ID Application: …" --options runtime --prefix <identifier> sslocal` → 装入 `Contents/Helpers`。供应链校验在重签前完成，不被破坏。
+- 效果：主机地址态全程无弹窗（前提是用户未关闭 allowsigned 开关）；wrapper（PAC 服务）同理已是 DevID，静默放行。
+- 未竟项：重签后的 sslocal 本体未实测；macOS 15 上 allowsigned 的判定口径需复测（第 10 节）。
+- 备选（不重签）：接受首次弹窗 + UI 预告知（9.2/9.3），升级不重弹（路径键），误拒绝靠 9.4 检测恢复。
+
+### 9.2 被点名名称的用户可读性
+
+弹窗显示的是二进制裸文件名。若按 9.1 重签 sslocal，主机地址态无弹窗，名称问题消失；若采纳备选方案，用户会看到一个陌生的 "sslocal" 弹窗——切换 UI 必须提前预告这个名字，否则极易被当成恶意进程点「拒绝」。wrapper 的 BundleProgram 文件名也应取用户可读名（如含 "ShadowsocksX-NG" 字样），使 allowsigned 关闭用户的弹窗可识别。
+
+### 9.3 监听范围切换 UI 的提示文案（草稿）
+
+切换到「主机地址」时的确认/提示文案：
+
+> 主机地址模式会把代理入站与 PAC 端点暴露给局域网设备。
+> 首次启用时，macOS 可能弹出防火墙确认：
+> - 若弹窗询问"sslocal"（或"ShadowsocksX-NG Helper"），请选择「允许」；
+> - 误点「拒绝」会导致局域网设备无法连接，可在 系统设置 → 网络 → 防火墙 → 选项 中改正。
+>
+> 本模式仅建议在可信局域网使用。
+
+（采用 9.1 后，第二条弹窗预告可视复测结果弱化为脚注；「暴露给局域网」的警示语保留——它来自 #12 §7 的既定约束，与防火墙无关。）
+
+### 9.4 失败路径：检测、呈现与恢复
+
+- **检测**：`socketfilterfw --getappblocked <path>` 与 `--listapps` 无需 sudo（本机实测）；GUI 可对 `sslocal` 与 wrapper 路径轮询/切换时查询，blocked 态即在设置页显示诊断项「macOS 防火墙已阻止代理接受连接」。CLI 属非公开工具，调用需容错（命令缺失/行为变化时静默降级为通用提示）。
+- **呈现**：诊断分类在 #12 §5 的端口冲突/监听失败之外新增「防火墙被拒」；代理整体状态不得因此显示为"正常"（局域网目标实际不可达），建议呈现为「等待授权/部分可用」中间态。
+- **修复指引文案**：「macOS 防火墙已阻止 sslocal 接受传入连接。前往 系统设置 → 网络 → 防火墙 → 选项，将 sslocal 设为"允许传入连接"；或在此处移除该条目后重启代理以重新触发授权。」
+- **健康检查盲区**：本机自连（127.0.0.1 或本机 LAN IP）不受防火墙执法（第 6 节），主机地址态的可达性自检**不能**只对本机发起；诊断页应引导用户「从局域网内另一台设备访问」做端到端验证（真实远端探测不在 GUI 内自动化的理由：无受控远端探测点）。
+
+## 10. 验证计划（进入实现前完成，不把本报告推断当已验证）
+
+1. **macOS 15 复测**：全矩阵（回环/通配 × ad-hoc/DevID × LaunchAgent；弹窗文案、归属、路径键、allowsigned 豁免、`--getappblocked` 可用性）。本报告全部数据来自 macOS 27.0。
+2. **重签 sslocal 实测**：按 9.1 流程重签官方 v1.25.0 sslocal，LaunchAgent 语境主机地址态监听，确认静默放行；同时验证重签后 Hardened Runtime 下 sslocal 功能无损。
+3. **allowsigned = off 行为**：关闭「自动允许已下载的签名软件」后 DevID 二进制是否弹窗（预期弹一次、路径键记忆）——需在系统设置人工切换后复测。
+4. **真实远端执法面**：从局域网另一设备实测弹窗未决与拒绝态下的可达性（验证 Apple 文档「未应答即拒绝」在本机版本的表现与拒绝的具体失败形态：超时还是拒连）。
+5. **公证差异**：在有 notarytool 凭据的环境验证公证与否是否影响防火墙（预期不影响，公证属 Gatekeeper 域）。
+6. **升级路径回归**：模拟 sslocal 版本更新（同路径新哈希、DevID 重签）确认不重弹（L6 的生产版复核）。
+
+## 11. 对后续票据的明确约束
+
+- **#5（UI 信息架构）**：监听范围切换的确认文案按 9.3 执行；设置/诊断页新增「防火墙被拒」状态与修复指引（9.4）；主机地址态的代理状态呈现需包含「等待授权/部分可用」中间态。
+- **#2/#6（打包与发布）**：发布脚本在官方 SHA-256 校验后、装入 Helpers 前插入 DevID 重签步骤（9.1）；打包清单加入「重签后 `codesign -dv` 抽检 + 防火墙静默放行断言」（对应 #15 追加的门槛断言风格）。
+- **#12（PAC 服务实现）**：§6.2「记录 socketfilterfw 对入站监听的提示/放行行为」由本报告完成；实现票据在失败语义中纳入 `--getappblocked` 检测（9.4），并保持回环默认的两态设计不变。
+- **#13（宿主）**：wrapper 的 BundleProgram 文件名取用户可读名（9.2）；宿主形态不引入额外防火墙负担（第 6 节），维持既有决策。
+- **地图 #1**：第 10 节验证计划为 macOS 15 门槛的一部分，进入实现阶段前复核。
+
+本报告只新增研究文档与本地原型分支；未修改 Legacy/ 或 2.0 生产代码。
diff --git a/docs/research/wayfinder-issue-17-legacy-handoff.md b/docs/research/wayfinder-issue-17-legacy-handoff.md
new file mode 100644
index 000000000..238dca8c6
--- /dev/null
+++ b/docs/research/wayfinder-issue-17-legacy-handoff.md
@@ -0,0 +1,242 @@
+# Wayfinder issue 17：Legacy 运行时交接的识别、卸载与恢复路径
+
+- 票据：[研究：Legacy 运行时交接（停止/卸载/端口释放/登录项/系统代理）](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/17)
+- 父地图：[Wayfinder: ShadowsocksX-NG 2.0 现代化重实现](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/1)
+- 研究日期：2026-09-20
+- 适用范围：macOS 15+、仅 arm64、ShadowsocksX-NG 2.0；落实 [#7 决议「Legacy 运行时交接」](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/7)：仅停止/卸载经正向识别的 `com.qiuyuzhou.shadowsocksX-NG.local` 与 `com.qiuyuzhou.shadowsocksX-NG.http`，不泛匹配、不自动删除 Legacy 数据。
+- 证据规则：系统契约以本机 man 页与 SDK 头文件为权威（Apple 网页为 JS 渲染，本次未取到正文，按票据规则以 man/头文件为准）；Legacy 侧事实来自冻结源码与全量 git 历史；本机实测标注环境。**本机验证在 macOS 27.0（Build 26A428, arm64）完成；macOS 15 行为以文档为准，差异进入「遗留验证」。**
+
+## 决策摘要
+
+1. **识别完全可行且无需泛匹配。** Legacy 的两个 job label、plist 文件名、登录项 helper bundle ID 全部是源码硬编码字符串，全量 619 提交历史中从未变更；识别 = 精确 label 的 `launchctl print gui/<uid>/<label>`（未加载返回退出码 113，本机实测）+ `~/Library/LaunchAgents/<plist>` 文件检查 + `launchctl print-disabled` 残留记录。本机还实测到第三条痕迹：print-disabled 中保留着两个 label 的 override 记录，即使 plist 与 job 都已不存在——它是「这台机器装过 Legacy」的正向信号。
+2. **停止与卸载用 `launchctl bootout gui/<uid>/<label>`（按 service target，不按路径）。** `load/unload` 在现行 man 页列为 LEGACY 子命令并明示推荐替代为 `bootstrap/bootout/enable/disable`；`bootout` 按 service identifier 定位不需要 plist 文件存在，恰好覆盖「job 已加载但 plist 缺失」的错位。bootout 的信号序列 man 页未文档化，需显式终止时的有文档后备是 `launchctl kill SIGTERM gui/<uid>/<label>`。
+3. **SMAppService 不能注销其他应用的 agent——这是 SDK 头文件的明文约束**：`agentServiceWithPlistName:` 要求 plist 位于「调用方 app 自己的 Contents/Library/LaunchAgents」。因此对 Legacy 这类第三方 per-user agent，launchctl 是唯一可用接口；`SMAppService.statusForLegacyURL:` 只提供只读状态查询，且未文档化是否可用于第三方 plist（遗留验证）。
+4. **残留 plist 不是无害的，必须看内容。** 2017-05-11（提交 `0f050f6`）之前的 Legacy plist 生成代码带 `KeepAlive: true`——该时代的残留 plist 会在每次登录时自动拉起 ss-local 并在退出后重启，即使 Legacy app 早已删除。残留处置必须先读 plist 内容判断活跃性，而不是假设它休眠。现行 Legacy plist 无 KeepAlive/RunAtLoad，登录时仅注册不启动。
+5. **端口释放确认有一个必须绕开的坑：Legacy ss-local 以 `--reuse-port` 运行。** 端口探测不得设置 `SO_REUSEPORT`，否则在 Legacy 仍持端口时 bind 也能成功、产生假「已释放」。推荐组合：对配置的具体端口做 lsof 监听者诊断（同用户进程无需 sudo，本机实测）+ 无 SO_REUSEPORT 的 bind 探测。另外 **PAC 端口 1089 的持有者是 Legacy GUI 进程内的 GCDWebServer，不是任何 launchd job**——bootout 两个 job 不会释放 1089，交接流程必须把「退出 Legacy app」纳入前置条件。
+6. **旧 SMLoginItem 登录项没有可靠的 2.0 侧编程停用路径。** `SMLoginItemSetEnabled` 自 macOS 13.0 起弃用（SDK 头文件明文）；`SMAppService.loginItem(identifier:)` 要求 identifier 对应「调用方 app 自己的 Contents/Library/LoginItems」中的 bundle。主路径是人工指引（系统设置 → 登录项，或经 Legacy app 自身开关）；`sfltool dumpbtm` 本机实测触发了管理员授权弹窗，不能作为 2.0 的无提示检测手段（详见 §7）。
+7. **系统代理确认无所有者标记**（`scutil --proxy` 本机实测输出只有代理键值），所以「切换到 2.0」的确认文案必须显式告知系统代理将被关闭/改写（#7 决议要求），失败路径按 #11 的 ownership record + #14 的健康门禁纪律执行。
+
+## 1. Legacy 运行时产物的精确清单（正向识别的基底）
+
+两个 launchd job 的全部标识字符串在冻结源码中硬编码，[LaunchAgentUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L11-L16)：
+
+| 产物 | 精确值 | 源码位置 |
+| --- | --- | --- |
+| ss-local job label | `com.qiuyuzhou.shadowsocksX-NG.local` | [LaunchAgentUtils.swift L66](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L66) |
+| ss-local plist 路径 | `~/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.local.plist` | [LaunchAgentUtils.swift L14/L34-36](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L14) |
+| Privoxy job label | `com.qiuyuzhou.shadowsocksX-NG.http` | [LaunchAgentUtils.swift L303](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L303) |
+| Privoxy plist 路径 | `~/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.http.plist` | [LaunchAgentUtils.swift L15/L287-289](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L15) |
+| 登录项 helper bundle ID | `com.qiuyuzhou.ShadowsocksX-NG.LaunchHelper`（注意大小写与 job label 不同） | [LaunchAtLoginController.m L69](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAtLoginController.m#L67-L81) |
+| 登录项 helper 安装位置 | `<Legacy app>/Contents/Library/LoginItems/LaunchHelper.app` | [project.pbxproj L131](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG.xcodeproj/project.pbxproj#L131)（`dstPath = Contents/Library/LoginItems`） |
+
+**跨版本稳定性（git 全历史查证）**：对全部 619 个提交做 `git grep` 扫描，出现过的 label 字符串只有 `.local`、`.http`、`.kcptun` 三种，无任何改名、变体或大小写漂移。2.0 可以安全地把这些字符串当作常量。
+
+**历史第三 job（识别面要覆盖、处置面要区分）**：`com.qiuyuzhou.shadowsocksX-NG.kcptun` job 连同 `generateKcptunLauchAgentPlist()` 存活到 2018-09-16（提交 `db81543` "Remove feature over kcptune."）。用过 2018 年前 Legacy 版本的用户机器上可能残留该 plist 甚至已加载 job。#7 决议只授权停止/卸载 `.local` 与 `.http` 两个 job；kcptun 残留应走「检测 + 提示用户处理」路线（识别序列仍按精确 label 检查它），其处置是否扩入停止名单需要一个小裁决（遗留裁决项，见 §9）。
+
+**两个 job 的 plist 关键形态**（现行冻结版）：只有 `Label`、`WorkingDirectory`、`StandardOutPath/StandardErrorPath`、`ProgramArguments`、`EnvironmentVariables`（ss-local），无 `RunAtLoad`、无 `KeepAlive`、无 Socket 定义——即登录时 launchd 只注册 job 不启动实例；ss-local 由 Legacy app 经脚本 `launchctl load -wF` + `launchctl start` 显式拉起（[start_ss_local.sh](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ss-local/start_ss_local.sh)、[stop_ss_local.sh](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ss-local/stop_ss_local.sh)，用旧式 `load/unload`）。ss-local 的 `ProgramArguments` 含 `--reuse-port`（[LaunchAgentUtils.swift L57](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L50-L58)），这对端口释放探测有直接约束（§2.3）。
+
+**端口归属映射（交接检查的对象清单）**：
+
+| 端口（默认） | 持有者 | 归属证据 | 释放条件 |
+| --- | --- | --- | --- |
+| 1086 SOCKS5 | ss-local job（`.local`） | plist `ProgramArguments` | bootout `.local` |
+| 1087 HTTP | Privoxy job（`.http`） | plist `ProgramArguments` | bootout `.http` |
+| 1089 PAC | **Legacy GUI 进程内 GCDWebServer**，非 launchd job | [ProxyConfHelper.m L16/L223-236](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L223-L236)（进程内全局对象） | **Legacy app 退出**；bootout 两个 job 不影响它 |
+
+注意 Legacy 的 LaunchAgent plist 内**没有端口字段**：端口写在 `~/Library/Application Support/ShadowsocksX-NG/ss-local-config.json`（`local_port`/`local_address`）与 `privoxy.config` 中，源头是 Legacy defaults `LocalSocks5.ListenPort`/`LocalHTTP.ListenPort`/`PacServer.ListenPort`（inventory §1）。因此端口释放检查不能从 LaunchAgent plist 读端口，而应：从 defaults 域 `com.qiuyuzhou.ShadowsocksX-NG` 与上述生成文件读取配置端口，再对每个具体端口探测。
+
+## 2. 识别：job、plist、端口
+
+### 2.1 已加载 job：`launchctl print gui/<uid>/<label>`
+
+- man launchctl：`print domain-target | service-target`「Prints information about the specified service or domain… Service output includes various properties of the service, including information about its origin on-disk, its current state, execution context, and last exit status」。
+- **本机实测（macOS 27.0）**：对未加载的精确 label 查询
+
+  ```text
+  $ launchctl print gui/501/com.qiuyuzhou.shadowsocksX-NG.local
+  Bad request.
+  Could not find service "com.qiuyuzhou.shadowsocksX-NG.local" in domain for user gui: 501
+  （退出码 113）
+  $ launchctl error 113
+  113: Could not find specified service
+  ```
+
+  即「job 是否已加载」的可靠判据是**退出码**（0 = 已加载；113 = 不存在），不是输出文本。
+- **诚实边界（man 明文）**：`print` 的输出「is NOT API in any sense at all. Do NOT rely on the structure or information emitted for ANY reason. It may change from release to release without warning」（man launchctl, CAVEATS/IMPROTANT 注记）。2.0 应把 `launchctl` 当作命令行工具用退出码驱动状态机，**不得解析 print 的输出结构**；需要属性明细（如 PID）时只用于诊断展示，不作为逻辑分支依据。
+- `launchctl print-disabled gui/<uid>`「Prints the list of disabled services in the specified domain」——列出该域 Disabled override 状态。本机实测两条 Legacy 记录仍在：
+
+  ```text
+  "com.qiuyuzhou.shadowsocksX-NG.http" => enabled
+  "com.qiuyuzhou.shadowsocksX-NG.local" => enabled
+  ```
+
+  按 man launchctl 对 `load -w` 的说明，Disabled 覆盖状态「stored elsewhere on-disk in a location that may not be directly manipulated by any process other than launchd」——所以即使 plist 与 job 都已消失，记录仍保留（本机正是此形态）。它的用途是「曾经注册过 Legacy」的正向信号，不是运行状态。
+
+### 2.2 磁盘残留 plist 与官方只读状态 API
+
+- 文件检查：`~/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.local.plist`、`.http.plist`（及历史的 `.kcptun.plist`）的 `FileManager.fileExists`。这是纯粹的正向识别——文件名即产品固定常量。
+- **`SMAppService.statusForLegacyURL:`（macOS 13+）**，SDK 头文件注释（SMAppService.h，本机 SDK 实读）：「Valid URLs have the prefix /Library/LaunchDaemons /Library/LaunchAgents or /Users/$USER/Library/LaunchAgents」「intended for apps that are unable to adopt the new daemon and agent packaging guidelines but still want to know when a user disables its legacy daemons or agents」。它返回 `SMAppServiceStatus`（notRegistered/enabled/requiresApproval/notFound），是对 `~/Library/LaunchAgents` 下 legacy plist 的官方只读状态查询。文档没有写明是否允许查询**第三方** plist；2.0 可以把「自家 plist 路径查询」作为快路径，把第三方 plist 的可用性列为遗留验证（§9），不能作为唯一判据。
+- 残留 plist 的**活跃性检查（必须做）**：读 plist 内容判断是否含 `KeepAlive`（历史版本曾生成，见 §1）与 `RunAtLoad`。含 KeepAlive 的残留会在每次登录自动拉起 ss-local 并在其退出后重启（launchd.plist(5)：KeepAlive=true 让 launchd 持续保持 job 运行，隐含 RunAtLoad）；无这两个 key 的残留（现行 Legacy 形态）登录时仅注册、不启动。两者都属「检测到残留时提示用户处理」（#7 决议），但前者要在提示中说明它在实际运行。
+
+### 2.3 监听端口：来源与探测
+
+- 端口值来源（按优先级）：① Legacy defaults 域 `com.qiuyuzhou.ShadowsocksX-NG` 的 `LocalSocks5.ListenPort`/`LocalHTTP.ListenPort`/`PacServer.ListenPort`（用户自定义值在这里，默认 1086/1087/1089，inventory §1）；② `~/Library/Application Support/ShadowsocksX-NG/ss-local-config.json` 的 `local_port` 与 `privoxy.config` 的 listen 地址（Legacy 实际生效值）。两者只读读取，均属 Legacy 数据——只读，不删改（#7 约束）。
+- 运行时确认用两层探测：
+  1. **lsof 监听者诊断**：`lsof -nP -iTCP:<port> -sTCP:LISTEN`。同用户进程无需 sudo（Legacy 两个 job 均为 per-user，本机实测三个默认端口均无监听、退出码 1、无输出）。它同时给出持有 PID，可反查是否为 `.local`/`.http` job 的实例（launchd job 的 PID 可由 `launchctl print` 输出对照，仅诊断用）。注意 lsof 对其他用户的进程不可见——Legacy job 与 2.0 同用户，此盲区不影响本场景；PAC 1089 的持有者是 Legacy GUI 进程，同为同用户，可见。
+  2. **bind 探测**：对具体端口做一次 `bind()` 后立即关闭。**探测 socket 不得设置 `SO_REUSEPORT`**：Legacy ss-local 带 `--reuse-port` 运行，BSD 语义下同端口多绑定要求所有 socket 都设了 `SO_REUSEPORT`；设置了它的探测会在 Legacy 仍持端口时假成功。普通 `SO_REUSEADDR` 不受影响、探得的 `EADDRINUSE` 是真占用。（这也是 2.0 自身运行时的约束：sslocal 不得启用 reuse-port 类选项，否则与「端口冲突一律显式失败」的 #14 决议冲突。）
+- `launchctl print` 的输出里没有端口信息（plist 无端口字段），所以「从 plist 字段读端口」不成立，必须走上述 defaults/生成文件 + 探测组合。
+
+## 3. 停止与卸载
+
+### 3.1 子命令选择与弃用状态
+
+- man launchctl 把 `load | unload` 放在 **LEGACY SUBCOMMANDS** 节，并明示「Recommended alternative subcommands: bootstrap | bootout | enable | disable」。未从系统移除（Legacy 自己仍在用），但 2.0 的生产代码不应继承旧式接口。
+- `bootout domain-target [service-path ...] | service-target`：「removes their definitions into the domain. Services may be specified as a series of paths or a **service identifier**」。**按 service target（`gui/<uid>/<label>`）bootout 不需要 plist 文件存在**，这正是「job 已加载但 plist 已缺失」错位情形的正确处置入口；按路径 bootout 则要求路径可解析。
+- **bootout 的信号序列 man 页未文档化**（只承诺移除定义）。通行行为是 SIGTERM、超时后 SIGKILL，但按证据规则不把它当文档事实。需要显式、有文档的终止时，man 有 `kill signal-name | signal-number service-target`（「Sends the specified signal to the specified service if it is running」）。推荐顺序见 §8。
+- `enable | disable`：「Once a service is disabled, it cannot be loaded in the specified domain until it is once again enabled. This state persists across boots」——仅用于显式需要「阻止再加载」的场景；#7 决议不要求，默认不做（多写一次 launchd 状态反而多一分与用户意图冲突的面）。
+- KeepAlive job 被 bootout 的行为：job 定义被移出 domain 后，launchd 不再持有重启依据（KeepAlive 是 plist 键，launchd.plist(5)，随定义一起被移除）。Legacy 现行 plist 无 KeepAlive，此问不存在于主线；仅 2017 前残留 plist（§2.2）需要它——对这类残留同样适用 bootout。
+- **SMAppService 注销不了第三方 agent（launchctl 是唯一接口的论证）**：SDK 头文件 SMAppService.h 明文——`agentServiceWithPlistName:`「The plistName must correspond to a plist in the **calling app's** Contents/Library/LaunchAgents directory」；`loginItemServiceWithIdentifier:`「must correspond to… the **calling app's** Contents/Library/LoginItems directory」。`unregister()` 是这些实例上的方法。即 SMAppService 的注册/注销面封闭在调用方 app 自己的 bundle 内，无法指向 `com.qiuyuzhou.shadowsocksX-NG.*` 这种手写在用户 LaunchAgents 目录的第三方 plist。（#3 研究已确立 2.0 自身走 SMAppService——那条结论不外推到 Legacy 卸载。）
+
+### 3.2 两种错位情形的正确动作
+
+| 情形 | 检测形态 | 2.0 的正确动作 |
+| --- | --- | --- |
+| job 已加载，plist 文件缺失 | `launchctl print gui/<uid>/<label>` 退出码 0；文件检查不存在 | `launchctl bootout gui/<uid>/<label>`（按 service target，无需路径）；随后按 §8 验证。**不**因文件缺失而跳过卸载——运行中的 job 正是占端口的那一个 |
+| plist 残留，job 未加载 | 文件存在；print 退出码 113 | **不做任何 launchctl 操作、不删 plist**（#7：不自动删除）。先读内容判活跃性（§2.2）：无 KeepAlive/RunAtLoad 的残留是休眠的（登录仅注册不启动），不阻塞 2.0 启动，记入残留提示；含 KeepAlive 的残留会实际运行/占端口，若其端口与 2.0 冲突则按 #14 显式失败 + 残留提示（提示用户可手动 `launchctl bootout` 并删除该 plist，或交由后续票据裁决是否提供一次性经确认的清理动作） |
+
+第三种组合（job 已加载且 plist 在）是主线：bootout 后 plist 留在磁盘，进入残留提示清单。
+
+## 4. 旧 SMLoginItem helper（登录项）
+
+### 4.1 现状与 API 边界（一手出处）
+
+- `SMLoginItemSetEnabled` 在 SDK 头文件（SMLoginItem.h，本机实读）标注 `__OSX_DEPRECATED(10.6, 13.0, "Please use SMAppService instead")`，注释「Enable a helper application located in the main application bundle's Contents/Library/LoginItems directory… If false, the helper application will no longer be kept running」。Apple 文档页（JS 渲染未取到正文）同口径：macOS 13.0 弃用。
+- `SMAppService.loginItem(identifier:)` 的 identifier「must correspond to the bundle identifier for a LoginItem that lives in the **calling app's** Contents/Library/LoginItems directory」（SMAppService.h）。**即 2.0 无法用现行 API 正向管理 Legacy helper（`com.qiuyuzhou.ShadowsocksX-NG.LaunchHelper`）的登录项**——它登记在 Legacy app 的 LoginItems 目录语境下。
+- 登记入口仍是系统设置：`SMAppService.openSystemSettingsLoginItems`（macOS 13+）「Opens System Settings to the Login Items panel」——这是 2.0 可以合法调用的人工指引直达入口。
+
+### 4.2 识别途径与诚实边界
+
+- 可正向识别的静态事实：Legacy app bundle 是否存在于常见安装位置（`/Applications/ShadowsocksX-NG.app` 等，LaunchHelper 的启动逻辑本身也按这些位置找主 app，[AppDelegate.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/LaunchHelper/LaunchHelper/AppDelegate.m)）；bundle 内 `Contents/Library/LoginItems/LaunchHelper.app` 是否存在；defaults 域 `com.qiuyuzhou.ShadowsocksX-NG` 的 `LaunchAtLogin` 布尔（[LaunchAtLoginController.m L76](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAtLoginController.m#L75-L77) 在 SMLoginItemSetEnabled 成功后写入，可作意图信号，但不是系统登记的真值）。
+- BTM 数据库（macOS 13+ 登录项统一存储）：`sfltool dumpbtm` 可列出记录（记录含 `Identifier`、`URL`、`Type`、`Disposition` 字段，第三方登录项按 bundle ID 可辨）。但本机实测该命令**触发了面向用户的系统管理员授权弹窗**（协调者确认），且 `man sfltool` 只把它描述为「tool for testing and debugging SharedFileList」，`dumpbtm` 子命令本身未文档化。**结论：sfltool 不能作为 2.0 应用内的无提示检测手段**——它需要管理员授权、输出格式无 API 承诺、子命令未文档化。
+- 因此 2.0 对旧登录项的编程能力边界是：只能做**静态正向识别**（Legacy bundle/helper 文件存在性 + defaults 意图信号），无法可靠地以编程方式读取或改变系统登记状态。停用动作走人工路径：
+  1. **首选（状态真值在系统设置）**：指引文案指向 系统设置 → 通用 → 登录项与扩展，在「登录时打开」/「允许在后台」中找到 ShadowsocksX-NG（或其 helper）条目并移除；可用 `openSystemSettingsLoginItems` 直达。
+  2. **替代（若 Legacy app 仍在）**：启动 Legacy app 并在其偏好中关闭「登录时启动」——它会以弃用 API 把自己登记为 false（[LaunchAtLoginController.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAtLoginController.m#L67-L82)）。语义上这是让「旧代码撤销旧登记」，最不容易误伤。
+- 不采用：从 2.0 调用 `SMLoginItemSetEnabled(helperID, false)` 的跨 app 摸底——弃用 API 对「非本 app LoginItems 目录中的 identifier」的行为未文档化，且无法在本机构造已登记环境验证（Legacy 已不在本机登记，见 §7）。若未来要试，必须先在装有 Legacy 且已开登录项的机器上验证（§9）。
+
+## 5. 系统代理：确认、改写与失败路径
+
+### 5.1 没有所有者标记（本机实测）
+
+`scutil --proxy` 的输出只有 `HTTPEnable/HTTPPort/HTTPProxy/HTTPSEnable/…/SOCKSEnable/ProxyAutoConfigEnable/ExceptionsList` 等配置键值，没有任何「由哪个应用写入」的标记：
+
+```text
+HTTPEnable : 1
+HTTPPort : 64649
+HTTPProxy : 127.0.0.1
+ProxyAutoConfigEnable : 0
+SOCKSEnable : 1
+SOCKSPort : 64649
+...
+```
+
+（本机当前指向 64649——是本机另一个代理软件的值，仅用于证明「系统代理可能是别的所有者写的」。）SystemConfiguration 公开 schema（SCSchemaDefinitions.h，#11 已引用）同样没有 ownership 键。**推论：2.0 无法从系统状态判断现有代理是不是 Legacy 写的**，所以「切换到 2.0」改写前必须：(a) 向用户明说将关闭/改写系统代理（#7 决议的告知义务）；(b) 按 #11 §4.3 的 ownership record 纪律——写入前保存原 Proxies 字典，只有当现有值与 Legacy 特征值匹配（如 PAC URL 恰为 `http://localhost:1089/proxy.pac` 或 SOCKS 指向 1086）时才按「Legacy 拥有」处理，不匹配则按「未知所有者」呈现冲突、请用户决定，而不是盲目覆盖。
+
+### 5.2 「切换到 2.0」确认文案要点（非定稿）
+
+- 说明系统代理的三个去向：关闭 Legacy 写入的代理（PAC/SOCKS/HTTP 键恢复为空或用户原值）；随后由 2.0 在代理健康时写入自己的配置（#11 的授权 SC 写入路径，需用户授权）。
+- 说明顺序：先停 Legacy（job 卸载 + 提示退出 Legacy app），系统代理短暂处于「无代理/直连」态，之后 2.0 启动成功才改写；启动失败则系统代理停在「已清理」态而非指向死端口。
+- 提示需要授权：改写系统代理会请求管理员授权（#11 的最小 helper 授权边界）。
+- 提示退出 Legacy app：PAC 端口 1089 由 Legacy app 进程持有（§1），不退出会继续占用且其 PAC server 仍在。
+
+### 5.3 失败路径（交叉引用 #11/#14）
+
+- **Legacy 已停但系统代理仍指向旧端口**：若交接流程先停 job 后清理代理时中途失败（如授权被拒），系统代理指向已死的 1089/1086——表现为全网「打不开网页」。检测：2.0 下一次启动/每次代理停止时，按 ownership record 与 Legacy 特征值（1089 PAC URL、1086 SOCKS）识别「指向已知死端口的代理配置」，在诊断页呈现「系统代理指向已停止的 Legacy 端口」并给一键清理（走 #11 授权写入）。这是正交于 #14 健康门禁的一条**Legacy 特征恢复规则**，特征值是固定的（§1 的常量），识别是正向的。
+- **2.0 自身异常退出后代理指向死端口**：#11 §4.2/§4.3 已定「崩溃恢复通过保存的 ownership URL/token 判断是否需要清理，不盲目覆盖」；#14 已定「绑定失败不写系统代理、健康门禁在 GUI」。2.0 重启时的门禁顺序：先健康检查端点，再决定改写系统代理——发现系统代理指向自己的旧 ownership 记录而端点不健康时，呈现「代理未运行，系统代理仍指向本应用（将无法上网）」并提供「关闭系统代理」或「启动代理」两键。
+- 残留 plist（含 KeepAlive 变体）在交接后复发占端口：属 #14 的「端口冲突显式失败 + 指名端点」正常路径，错误信息附残留提示（§3.2）。
+
+## 6. 显式排除的反模式（给理由）
+
+| 反模式 | 排除理由 |
+| --- | --- |
+| 按进程名匹配 / `pkill` | #7 决议明文禁止。技术上也不必要：两个 job 有精确 label，`launchctl bootout gui/<uid>/<label>` 即可定位并终止；名字匹配会误伤同名的用户自有进程（`ss-local`、`privoxy` 都是第三方生态常见名），且绕过 launchd 的停止语义、留下「job 仍注册但实例被外杀」的脏状态 |
+| 自动删除 Legacy 配置、二进制、日志、规则文件 | #7 决议明文（保留回退来源，CONTEXT.md「Legacy handoff…retaining Legacy data for rollback」）。且删除不可逆：`~/Library/Application Support/ShadowsocksX-NG/`、`~/.ShadowsocksX-NG/` 中含用户服务器凭据与规则，误删无法恢复。残留只提示、由用户处置 |
+| 自动删除残留 LaunchAgent plist | plist 是 launchd 配置文件，删除动作落在用户文件系统；#7 决议将其列入「不自动删除」清单。2.0 的动作上限是：bootout 已加载 job（决议授权的两个）+ 提示用户手动删除 |
+| 解析 `launchctl print` 输出结构作为 API | man launchctl 明文「This output is NOT API in any sense at all…may change from release to release without warning」。逻辑分支只允许依赖退出码（有 EXIT STATUS 文档承诺） |
+| 用带 `SO_REUSEPORT` 的探测判端口空闲 | 会在 Legacy `--reuse-port` 监听存续时假成功（§2.3），直接破坏「确认旧监听端口释放后才能启动 2.0」的门禁 |
+| `sfltool dumpbtm` 作为应用内检测 | 需管理员授权弹窗（本机实测）、子命令未文档化、输出无 API 承诺（§4.2） |
+
+## 7. 本机验证（macOS 27.0 Build 26A428，arm64；macOS 15 行为以文档为准）
+
+全部为只读操作；未 bootout/bootstrap/remove/kill 任何 job，未改系统状态。
+
+| 检查 | 命令 | 结果 |
+| --- | --- | --- |
+| 系统版本 | `sw_vers` | macOS 27.0 (26A428)；`launchctl managername` = Aqua；uid 501 |
+| 两个 job 加载态 | `launchctl print gui/501/com.qiuyuzhou.shadowsocksX-NG.local` 与 `.http` | 均未加载：stderr `Could not find service "…" in domain for user gui: 501`，**退出码 113** |
+| 错误码语义 | `launchctl error 113` | `113: Could not find specified service` |
+| Disabled 覆盖残留 | `launchctl print-disabled gui/501` | 含 `"com.qiuyuzhou.shadowsocksX-NG.http" => enabled` 与 `"com.qiuyuzhou.shadowsocksX-NG.local" => enabled`——plist 已不存在但记录仍在，证实 override 库独立于 plist 存续 |
+| LaunchAgents 目录 | `ls ~/Library/LaunchAgents/` | 无 `com.qiuyuzhou.shadowsocksX-NG*.plist`（本机无 plist 残留） |
+| 系统代理形态 | `scutil --proxy` | 仅配置键值（HTTP/HTTPS/SOCKS → 127.0.0.1:64649，PAC off），无所有者信息（§5.1） |
+| 端口监听诊断 | `lsof -nP -iTCP:1086/-iTCP:1087/-iTCP:1089 -sTCP:LISTEN` | 三者均无输出、退出码 1（无监听）；同用户诊断无需 sudo |
+| man 页 | `man launchctl` / `man launchd.plist` | LEGACY SUBCOMMANDS（load/unload 推荐替代 bootstrap/bootout/enable/disable）、print 非 API 注记、enable/disable 持久化、FILES 列出 `~/Library/LaunchAgents`（§2/§3 引用） |
+| SDK 头文件 | `xcrun --show-sdk-path` 下 ServiceManagement.framework/Headers | SMLoginItem.h：`SMLoginItemSetEnabled` `__OSX_DEPRECATED(10.6, 13.0, "Please use SMAppService instead")`；SMAppService.h：loginItem/agent 的「calling app's」限定、`statusForLegacyURL:` 合法前缀（§3.1/§4.1 引用） |
+| BTM 数据库 | `sfltool dumpbtm` | **触发系统管理员授权弹窗（用户侧目视确认）**；本会话内命令最终返回成功（1133 行），其中无任何 `shadowsocks`/`qiuyuzhou` 记录（与本机「Legacy 已卸载干净」一致），记录含 `Identifier`/`URL`/`Type`/`Disposition` 字段可辨第三方登录项。结论按 §6：不作为 2.0 检测手段 |
+
+与 macOS 15 的差异风险集中在：print-disabled/BTM 的呈现细节、sfltool 的授权模型、系统设置登录项面板结构——都只影响诊断展示层，不影响「退出码 + 精确 label + 文件存在性」的识别主干；列 §9 复核。
+
+## 8. 明确建议（可交后续实现）
+
+### 8.1 识别序列（用户选择「切换到 2.0」前展示状态用）
+
+对每个 label（`…-NG.local`、`…-NG.http`；`…-NG.kcptun` 仅检测展示）：
+
+1. `launchctl print gui/<uid>/<label>` → 退出码 0（已加载）/113（未加载），不解析输出文本。
+2. `FileManager.fileExists` 检查 `~/Library/LaunchAgents/com.qiuyuzhou.shadowsocksX-NG.{local,http,kcptun}.plist`；存在则读内容，标记 `KeepAlive`/`RunAtLoad` 活跃性。
+3. `launchctl print-disabled gui/<uid>` 查字符串包含（正向信号：曾注册过；仅提示用）。
+4. Legacy app 存在性：`/Applications/ShadowsocksX-NG.app` 与其 `Contents/Library/LoginItems/LaunchHelper.app`；defaults `com.qiuyuzhou.ShadowsocksX-NG` 读 `LaunchAtLogin` 意图信号。
+5. 端口来源：defaults 读 `LocalSocks5.ListenPort`/`LocalHTTP.ListenPort`/`PacServer.ListenPort`（缺省 1086/1087/1089）；再对每个具体端口跑 `lsof -nP -iTCP:<p> -sTCP:LISTEN`（展示持有 PID）。
+
+### 8.2 停止/卸载序列（用户确认后执行；只针对两个决议授权的 job）
+
+对每个 label（先 `.http` 后 `.local`，或逐个）：
+
+1. `launchctl bootout gui/<uid>/<label>`（按 service target；plist 缺失时同样有效）。
+2. 验证 job 卸载：`launchctl print gui/<uid>/<label>` 退出码 113。非 0 非 113 的失败原样呈现给用户（附 launchctl stderr）。
+3. 若 print 仍为 0（未按预期移除，如系统版本行为差异）：用有文档的显式终止 `launchctl kill SIGTERM gui/<uid>/<label>` 后重复第 2 步；仍失败则停止流程并呈现错误，不升级为任何名字匹配。
+4. bootout 的未文档化信号等待期内（§3.1）短暂轮询端口释放（下一步骤已覆盖，无需额外 sleep 逻辑上写死）。
+
+### 8.3 端口释放确认（两个 job 各自端口 + PAC 端口）
+
+1. 对 1086/1087（或 defaults 实际值）：`lsof -nP -iTCP:<p> -sTCP:LISTEN` 无输出，且无 `SO_REUSEPORT` 的 bind 探测成功后立即关闭（§2.3 语义约束）。
+2. 对 PAC 端口 1089：**前置条件是用户已退出 Legacy app**（确认文案 §5.2 明示）；检测同上。Legacy app 仍在运行时不满足启动 2.0 的门禁，呈现等待状态。
+3. 全部端口释放确认通过后，才允许 2.0 proxy runtime 绑定（衔接 #14 门禁：GUI 健康检查通过才写系统代理）。
+4. 中途失败：保持「已卸载的 job 不回滚、端口未释放则不启动 2.0」的显式失败呈现（#14 语义），不自动重试 bootout。
+
+### 8.4 旧登录项指引文案要点
+
+- 主动识别成功（Legacy bundle 存在）时提示：「旧版 ShadowsocksX-NG 的开机自启动需手动关闭：打开 系统设置 → 通用 → 登录项与扩展，在列表中移除 ShadowsocksX-NG（或其 LaunchHelper）条目。」可附「打开系统设置」按钮（`openSystemSettingsLoginItems`）。
+- 若 Legacy app 仍在：附替代路径「或打开旧版 ShadowsocksX-NG，在偏好设置中关闭『登录时启动』」。
+- 2.0 不声明已自动关闭旧登录项；未识别到 Legacy bundle 时也说明「若曾使用旧版的开机自启动，请按上述步骤检查」。
+
+### 8.5 系统代理确认/失败文案要点
+
+- 确认（切换前，§5.2）：告知将关闭/改写系统代理、期间短暂直连、需要管理员授权、需退出旧版 app（PAC 端口占用者）。
+- 失败（§5.3）：「系统代理指向已停止的旧版端口（127.0.0.1:1086/1089），可能导致无法上网」+ 一键清理（按 ownership/特征值识别后经授权写入清理）；2.0 自身异常退出后的恢复走 #11 ownership record + #14 健康门禁，不盲目覆盖未知所有者的代理配置。
+- 遇到与 Legacy 特征值不匹配的现有代理（未知所有者）：呈现冲突并请求用户决定，不静默改写。
+
+## 9. 遗留验证（实现前或首次接触真实 Legacy 环境时完成）
+
+1. **macOS 15 复核**：`launchctl print` 未加载 job 的退出码是否仍为 113；print-disabled 输出形态；系统设置登录项面板结构；`statusForLegacyURL:` 对第三方 plist 的返回语义（官方未文档化，须实测后才可进入实现）。本报告实测均在 macOS 27.0。
+2. **bootout 实弹验证**：在受控测试用户上安装 Legacy 并开启代理后执行 §8.2 序列，确认退出码序列、bootout 后进程退出、端口释放时序（本机无 Legacy job，无法演练）。
+3. **`SMLoginItemSetEnabled(helperID, false)` 跨 app 探针**：仅在装有 Legacy 且已登记登录项的机器上验证弃用 API 能否撤销他 app 登记（预期不可靠，见 §4.2；验证通过也不进主路径，只作人工指引之外的尽力而为）。
+4. **KeepAlive 时代残留 plist 实样**：构造一份带 `KeepAlive: true` 的 `.local.plist` 残留，验证 §2.2 的登录自动拉起行为与 §3.2 处置流程。
+5. **kcptun 残留处置裁决**：是否把 `com.qiuyuzhou.shadowsocksX-NG.kcptun` 扩入可停用名单（当前按决议只提示不停止），需一个小决议。
+6. **sfltool 授权行为**：macOS 15 上 `dumpbtm` 的授权要求是否与本机一致（本机已确认需要授权弹窗；该工具不进实现，仅记录）。
+
+## 10. 对后续票据的明确约束
+
+- 「决策：Legacy handoff 实现」（后续实现票据）：识别/停止/卸载/端口释放严格按 §8 序列；`launchctl` 只用退出码，不解析输出；探测 socket 禁用 `SO_REUSEPORT`；PAC 端口 1089 的释放以「用户退出 Legacy app」为前置。
+- #5（UI）：切换确认文案按 §5.2/§8.5 要点起草；残留提示含 plist 活跃性与登录项指引（§8.4）。
+- #11/#14 的所有权与门禁纪律不因交接而放宽：未知所有者的系统代理不覆盖；端口未释放不启动、不写系统代理。
+
+本报告只新增研究文档；未修改 `Legacy/`、2.0 生产代码或仓库其他文件，未执行任何变更系统状态的操作。
diff --git a/docs/research/wayfinder-issue-18.md b/docs/research/wayfinder-issue-18.md
new file mode 100644
index 000000000..69fa52f4c
--- /dev/null
+++ b/docs/research/wayfinder-issue-18.md
@@ -0,0 +1,178 @@
+# Wayfinder issue 18：macOS arm64 SIP003 插件的分发与验证边界
+
+- 票据：[研究：macOS arm64 SIP003 插件的分发与验证边界](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/18)
+- 父地图：[Wayfinder: ShadowsocksX-NG 2.0 现代化重实现](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/1)
+- 研究日期：2026-09-20（本节所有 GitHub/官方文档链接均于当日访问）
+- 适用范围：macOS 15+、仅 arm64、ShadowsocksX-NG 2.0；SIP003 客户端侧插件（由外部 `sslocal` 拉起的外部子进程，#2）
+- 证据规则：生态与版本事实以官方仓库 Release/源码与 shadowsocks.org 官方文档一手资料为准；签名/架构/哈希以本机下载静态实测为准（只做不启动代码的观测）；Gatekeeper quarantine 行为以 Apple 一手文档 + 一次用户目视 HITL 观察为准（第 6.1 节，该测试方法已停用，不复现）；版本偏移（本机 macOS 27.0 Build 26A428 vs 目标 macOS 15+）不作外推，列入第 10 节。
+
+## 决策摘要
+
+1. **原生 SIP003 且有官方 darwin arm64 资产的候选只有 5 个**：v2ray-plugin v1.3.2（2022-09）、xray-plugin v1.8.24（2026-02）、shadow-tls v0.2.25（2023-12）、Cloak v2.12.0（2025-07）、qtun v0.3.0（2024-12）。simple-obfs、kcptun、GoQuiet、simple-tls 无任何官方 darwin arm64 资产，只能归「暂不支持」（第 4.6 节）。
+2. **全部实测资产签名态与 `sslocal` 完全同一模式**：`Signature=adhoc`（`flags=0x20002(adhoc,linker-signed)`）、`TeamIdentifier=not set`、`spctl --assess` rejected。#16 对 sslocal 的结论（回环零交互、DevID 重签静默）逐条适用于插件；#6 的「官方哈希固定 → DevID 内向外重签 → 随 app 公证」流程无需修改即可扩展到插件。
+3. **上游校验和几乎不存在**：5 个候选中只有 qtun 发布了官方 SHA-256（zip 内 `.sha256`，本地比对一致）；其余全部无上游公布哈希。信任根只能是「进入清单时记录的本地复验哈希」，升级时以新 release 的本地复验值为准，无独立审计通道。
+4. **建议 2.0 第一版只走「受产品打包管理」路径**（第 7 节）：内嵌插件与 `sslocal` 同流程（固定版本+SHA-256 清单+DevID 重签+随 app 公证）；首版候选建议从 v2ray-plugin（shadowsocks 官方组织、MIT、生态事实标准）开始评估。「用户自行指定」因来源不可验证、quarantine 首启拦截无内联旁路（HITL 观察）而建议第一版不做。
+5. **kcptun 的上游已消失**：`xtaci/kcptun` 返回 404（仓库已删除，账号 xtaci 仍在且 kcp-go 库活跃）；官方 SIP003 文档指向的 `shadowsocks/kcptun` 是 fork，最新 release 停在 2017，且其源码不含任何 SIP003 环境变量读取（代码搜索 0 命中）——不构成可维护的依赖对象。
+6. **插件失败是 sslocal 侧可观测信号，不是 GUI 猜测**：sslocal 最多等 3 秒检查监听、插件退出写 error 日志、全部插件退出会触发插件监控 task panic（#2，引上游源码）；GUI 呈现应基于这些事实（第 8 节）。
+
+## 2. 候选清单对比表
+
+锚点：shadowsocks.org 官方 SIP003 文档「Known good SIP003 plugins」列出 GoQuiet、Cloak、Kcptun（指向 `shadowsocks/kcptun` fork）、v2ray-plugin（[SIP003 文档](https://shadowsocks.org/doc/sip003.html)）。在此基础上按票据补入生态主流的 simple-obfs、shadow-tls、xray-plugin、qtun、simple-tls。
+
+| 项目 | 语言 | 许可证 | 最新 release（日期） | 官方 darwin arm64 资产 | 上游校验和 | 原生 SIP003 | 维护状态 |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| [v2ray-plugin](https://github.com/shadowsocks/v2ray-plugin) | Go | MIT | v1.3.2（2022-09-08） | `v2ray-plugin-darwin-arm64-v1.3.2.tar.gz` | 无 | 是（`args.go` 读 `SS_*`） | 源码活跃（pushed 2026-07-09）但 4 年未发版 |
+| [xray-plugin](https://github.com/teddysun/xray-plugin) | Go | MIT | v1.8.24（2026-02-22） | `xray-plugin-darwin-arm64-v1.8.24.tar.gz` | 无 | 是（`args.go` 读 `SS_*`） | 活跃（pushed 2026-04-01）；个人维护者 |
+| [shadow-tls](https://github.com/ihciah/shadow-tls) | Rust | MIT | v0.2.25（2023-12-13） | `shadow-tls-aarch64-apple-darwin`（裸二进制） | 无 | 是（`main.rs` 读 `SS_*`） | release 停滞约 2.8 年（pushed 2025-04-25） |
+| [Cloak](https://github.com/cbeuw/Cloak) | Go | GPL-3.0 | v2.12.0（2025-07-23） | `ck-client-darwin-arm64-v2.12.0`（裸二进制） | 无 | 是（`ck-client.go` 读 `SS_*`） | 活跃（pushed 2026-05-29） |
+| [qtun](https://github.com/shadowsocks/qtun) | Rust | MIT（Cargo.toml 声明；GitHub 许可证 API 未检测到 LICENSE 文件） | v0.3.0（2024-12-31） | `qtun-aarch64-apple-darwin-v0.3.0.zip`（内含 tar.xz + `.sha256`） | **有** | 是（官方 SIP003 插件） | shadowsocks 官方组织，低频（pushed 2026-08-19） |
+| [simple-obfs](https://github.com/shadowsocks/simple-obfs) | C/C++ | GPL-3.0 | v0.0.5（2017-11-16） | **无**（唯一资产 `obfs-local.zip` 实测为 Windows PE32+ x86-64） | 无 | 是 | 仓库自述 Deprecated（pushed 2022-11-05） |
+| kcptun | Go | MIT（fork） | fork 最新 v20170718（2017-07-18） | **无**（仅 darwin 386/amd64） | 无 | **否**（`SS_*` 代码搜索 0 命中，需第三方 wrapper） | 上游 `xtaci/kcptun` 已 404；[官方文档所指 fork](https://github.com/shadowsocks/kcptun) pushed 2023-02-18 |
+| [GoQuiet](https://github.com/cbeuw/GoQuiet) | Go | GPL-3.0 | v1.2.2（2018-10-05） | **无**（仅 darwin 386/amd64） | 无 | 是 | 停更（pushed 2022-03-04） |
+| [simple-tls](https://github.com/IrineSistiana/simple-tls) | Go | GPL-3.0 | v0.8.0（2022-10-20） | **无**（v0.8.0 无 darwin 资产；v0.7.0 仅 darwin-amd64） | 无 | 是 | 停更（pushed 2022-10-20） |
+
+## 3. 逐项目证据
+
+### 3.1 v2ray-plugin（shadowsocks 官方组织）
+
+- [Release v1.3.2](https://github.com/shadowsocks/v2ray-plugin/releases/tag/v1.3.2)（2022-09-08）提供 12 个平台资产，含 [`v2ray-plugin-darwin-arm64-v1.3.2.tar.gz`](https://github.com/shadowsocks/v2ray-plugin/releases/download/v1.3.2/v2ray-plugin-darwin-arm64-v1.3.2.tar.gz)。无校验和资产。
+- 许可证 MIT（仓库元数据）。构建体系 `go build`（[README](https://github.com/shadowsocks/v2ray-plugin/blob/master/README.md)），符合「只接受官方构建产物」政策（官方已有构建产物，无需本仓库编 Go）。
+- SIP003 原生：`args.go` 读取 `SS_REMOTE_HOST` 等环境变量（GitHub 代码搜索确认）。
+- 风险：release 停滞 4 年而 master 持续演进（pushed 2026-07-09），发布物与源码漂移。
+
+### 3.2 xray-plugin（teddysun）
+
+- [Release v1.8.24](https://github.com/teddysun/xray-plugin/releases/tag/v1.8.24)（2026-02-22），含 [`xray-plugin-darwin-arm64-v1.8.24.tar.gz`](https://github.com/teddysun/xray-plugin/releases/download/v1.8.24/xray-plugin-darwin-arm64-v1.8.24.tar.gz)，16 个平台资产，无校验和。
+- MIT；个人维护者（teddysun，非 shadowsocks 组织）；内嵌完整 Xray-core，实测二进制 19 MB（本节尺寸来自第 4 节下载实测）。
+
+### 3.3 shadow-tls（ihciah）
+
+- [Release v0.2.25](https://github.com/ihciah/shadow-tls/releases/tag/v0.2.25)（2023-12-13），含 [`shadow-tls-aarch64-apple-darwin`](https://github.com/ihciah/shadow-tls/releases/download/v0.2.25/shadow-tls-aarch64-apple-darwin) 裸二进制（非归档），无校验和。
+- MIT，Rust。SIP003 原生：[`main.rs`](https://github.com/ihciah/shadow-tls/blob/master/src/main.rs) 读取 `SS_REMOTE_HOST/PORT`、`SS_LOCAL_HOST/PORT`、`SS_PLUGIN_OPTIONS`；其 README 与 v3 协议文档均无 SIP003hf 表述，shadowsocks-rust v1.25.0 插件模块亦仅标注 SIP003（[`plugin/mod.rs`](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/plugin/mod.rs) 头注释），两者代码搜索 `sip003hf` 均 0 命中。
+- 风险：约 2.8 年未发版；协议 v3 为其主要演进方向，与 SIP003 客户端侧的长期兼容性不明。
+
+### 3.4 Cloak（cbeuw）
+
+- [Release v2.12.0](https://github.com/cbeuw/Cloak/releases/tag/v2.12.0)（2025-07-23），含 [`ck-client-darwin-arm64-v2.12.0`](https://github.com/cbeuw/Cloak/releases/download/v2.12.0/ck-client-darwin-arm64-v2.12.0) 裸二进制，18 个平台资产，无校验和。官方 [SIP003 文档](https://shadowsocks.org/doc/sip003.html)列为 Known good。
+- **GPL-3.0**：随产品分发该二进制会触发许可证义务（对应源码提供等），与 MIT 候选相比增加分发合规成本；此为事实陈述，法律评估留给后续决策票据。
+
+### 3.5 qtun（shadowsocks 官方组织）
+
+- [Release v0.3.0](https://github.com/shadowsocks/qtun/releases/tag/v0.3.0)（2024-12-31），资产 [`qtun-aarch64-apple-darwin-v0.3.0.zip`](https://github.com/shadowsocks/qtun/releases/download/v0.3.0/qtun-aarch64-apple-darwin-v0.3.0.zip)，**zip 内含 `qtun-v0.3.0.aarch64-apple-darwin.tar.xz` 与官方 `.sha256`**——5 个候选中唯一提供上游公布哈希的项目（v0.2.0 曾以 companion asset 形式提供，v0.3.0 改为 zip 内嵌）。
+- 许可证 MIT（[Cargo.toml](https://github.com/shadowsocks/qtun/blob/v0.3.0/Cargo.toml) `license = "MIT"`；GitHub license API 未能自动检测 LICENSE 文件，如实记录）。
+- 低频维护（v0.2.0 → v0.3.0 间隔 3 年），生态占用小。
+
+### 3.6 无 darwin arm64 资产的候选（暂不支持的事实依据）
+
+- **simple-obfs**：仓库描述自带 "(Deprecated)"；[v0.0.5](https://github.com/shadowsocks/simple-obfs/releases/tag/v0.0.5)（2017-11-16）唯一资产 [`obfs-local.zip`](https://github.com/shadowsocks/simple-obfs/releases/download/v0.0.5/obfs-local.zip) 实测为 **Windows PE32+ x86-64**（`obfs-local.exe` + `libwinpthread-1.dll`），从未有 macOS 官方构建。C/C++ autotools 构建，纳入本仓库从源码构建违反项目政策。
+- **kcptun**：上游 `xtaci/kcptun` 已 404（浏览器级访问复核；账号 [xtaci](https://github.com/xtaci) 仍在、其 kcp-go 库活跃，故为仓库删除而非账号消失）；官方 [SIP003 文档](https://shadowsocks.org/doc/sip003.html)指向的 [shadowsocks/kcptun](https://github.com/shadowsocks/kcptun) 是 fork，最新 release [v20170718](https://github.com/shadowsocks/kcptun/releases/tag/v20170718) 仅 darwin 386/amd64，且源码无任何 `SS_*` 环境变量读取（代码搜索 0 命中）——原生不支持 SIP003，社区靠 [wrapper 脚本](https://github.com/zhanhb/kcptun-sip003-wrapper)拼装，不构成可审计依赖。
+- **GoQuiet**：最新 [v1.2.2](https://github.com/cbeuw/GoQuiet/releases)（2018-10-05）仅 darwin 386/amd64，停更约 8 年。
+- **simple-tls**：[v0.8.0](https://github.com/IrineSistiana/simple-tls/releases/tag/v0.8.0)（2022-10-20）无任何 darwin 资产（v0.7.0 仅 darwin-amd64），停更。
+
+## 4. 本机静态实测（全部为不启动代码的观测）
+
+方法：`curl -L` 下载官方 release 资产到 `mktemp -d` 临时目录，解包（`tar xzf` / `unzip`）后仅执行 `file`、`lipo -archs`、`codesign -dv --verbose=4`、`spctl --assess`、`xattr -l`、`shasum -a 256`；测毕删除临时目录。**未运行任何下载的二进制，未执行 `--version` 类命令。**
+
+### 4.1 实测结果汇总（arm64 二进制）
+
+| 资产（版本） | file / lipo | codesign | spctl | quarantine | SHA-256（本地复验值） |
+| --- | --- | --- | --- | --- | --- |
+| v2ray-plugin_darwin_arm64（v1.3.2） | Mach-O arm64 | `Signature=adhoc`，`flags=0x20002(adhoc,linker-signed)`，TeamIdentifier=not set，Identifier=`a.out` | rejected | 无 | `ec19068e4fa0b29c575012b836f4ee3703d286912620966300ee6f5df12fb107` |
+| shadow-tls（v0.2.25） | Mach-O arm64 | 同上，Identifier=`shadow_tls-be5b45739694c2a8` | rejected | 无 | `a7c39d70cfc5868f654b19766b768518413ac4ffd9532ea8534a36a1d447b5b1` |
+| ck-client（v2.12.0） | Mach-O arm64 | 同上，Identifier=`a.out` | rejected | 无 | `dbef5cd5dd1b551a046c422e07854eb4736fc958e684c6532eb7e809b593ad5c` |
+| xray-plugin_darwin_arm64（v1.8.24） | Mach-O arm64 | 同上，Identifier=`a.out` | rejected | 无 | `43e4c7f00a10c05c83ee4e0259e1eafe5b742426e87e249f771d48f011c4cfbb` |
+| qtun-client（v0.3.0） | Mach-O arm64 | 同上，Identifier=`qtun_client-7a4e4912c147b3a5` | rejected | 无 | `633ed28505e83d850d5e56a6b735fd59c27e3118920ab0d3e2f523e0c3de5ae9` |
+| qtun-server（v0.3.0） | Mach-O arm64 | 同上，Identifier=`qtun_server-514287e0951295bd` | rejected | 无 | `bc0fc629622c99ccff9f3c0cc628fe10d55886613fe4b4a506c0ef95ee33d05f` |
+
+附带：simple-obfs `obfs-local.exe`（v0.0.5）实测为 `PE32+ executable (console) x86-64, for MS Windows`，SHA-256 `e84f8b2b084ff565ebaa5b502b32f8542f29f476903f8a4e8c9e7910bfc860b5`。qtun 内嵌归档官方校验和 `65000f74fd3cbefe1b837d5b8e67e342a3bf8c3a8c2d798cdb8476bfc0dd388d  qtun-v0.3.0.aarch64-apple-darwin.tar.xz` 与本地 `shasum -a 256` 一致。
+
+### 4.2 观察
+
+- 六个二进制（含 sslocal，#16 §7）签名模式完全一致：上游链接器 adhoc 签名、无 CA 身份。**没有任何候选提供可验证上游身份的签名**，供应链验证只能靠「固定版本 + 哈希清单」，与 #6 的机制相同。
+- `xattr -l` 各资产仅见 `com.apple.provenance`（系统追加的来源追踪属性），无 `com.apple.quarantine`——`curl` 下载本就不设 quarantine；本节照实记录，不据此推断最终用户经浏览器下载后的属性状态（那属于第 6 节 quarantine 语义，引 Apple 文档）。
+- 裸可执行文件的 `spctl --assess` 一律 rejected，照实记录；该命令对非 bundle 裸二进制的评估本就受限，不作为额外证据。
+- 与 #16 防火墙结论交叉：客户端插件按 SIP003 在 `SS_LOCAL_HOST:SS_LOCAL_PORT` 监听、由 sslocal 连入（#2），2.0 生成的配置可将该面固定为回环（#12 回环默认）；插件的对外连接是出站流量。按 #16 实测（回环监听零交互、出站不经应用防火墙执法面），**打包插件在默认形态下不引入防火墙弹窗**，无需重复实测。
+
+### 4.3 本次下载过的资产 URL 清单（红线要求的留痕）
+
+```text
+https://github.com/shadowsocks/v2ray-plugin/releases/download/v1.3.2/v2ray-plugin-darwin-arm64-v1.3.2.tar.gz
+https://github.com/ihciah/shadow-tls/releases/download/v0.2.25/shadow-tls-aarch64-apple-darwin
+https://github.com/cbeuw/Cloak/releases/download/v2.12.0/ck-client-darwin-arm64-v2.12.0
+https://github.com/teddysun/xray-plugin/releases/download/v1.8.24/xray-plugin-darwin-arm64-v1.8.24.tar.gz
+https://github.com/shadowsocks/qtun/releases/download/v0.3.0/qtun-aarch64-apple-darwin-v0.3.0.zip
+https://github.com/shadowsocks/simple-obfs/releases/download/v0.0.5/obfs-local.zip
+```
+
+## 5. 与既有签名/公证/宿主决策的兼容性
+
+- **Developer ID 重签**：插件与 `sslocal` 一样无上游 CA 签名，#6 流程（先校验官方归档/二进制哈希 → `codesign --force --sign <DevID> --timestamp --options runtime --identifier …` → 外层 app 签名）逐字适用；重签使插件获得与 app 同源的 Team ID。
+- **公证对嵌套代码的要求**：Apple 公证常见问题文档要求签名校验覆盖嵌套代码（`codesign --verify --strict`「确保检查嵌套代码内容」、其严格度与公证要求一致，[Resolving common notarization issues](https://developer.apple.com/documentation/security/resolving-common-notarization-issues)），且公证必须启用 Hardened Runtime（[Hardened Runtime 文档](https://developer.apple.com/documentation/security/hardened-runtime)：「To upload a macOS app to be notarized, you must enable the Hardened Runtime capability.」）；嵌套代码先内后外的签名顺序见 #6 已引的 [TN2206](https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS10003709-CH1-SUBSECTION13)。打包插件因此必须与 sslocal 一样进入「先重签、后公证」链，随 app 公证后整体通过 Gatekeeper。
+- **Hardened Runtime 与子进程签名链**：Hardened Runtime 的保护与 entitlements 挂在被签可执行文件自身；文档原文「You add entitlements only to executables. Shared libraries, frameworks, and in-process plug-ins inherit the entitlements of their host executable.」——SIP003 插件是**独立子进程而非 in-process plug-in**，不继承宿主 entitlements；同时 #16 L3 实测已旁证 DevID(+runtime) 父进程可正常拉起 ad-hoc 子进程并令其监听。综合判断「DevID+Hardened 的 sslocal 拉起 adhoc 插件子进程不会被 Hardened Runtime 拦截」，但**无 Apple 一手文档逐字支撑**，列入第 10 节（打包插件经我们重签后该问题基本消失）。
+- **plugin_opts 的敏感性**：`plugin_opts` 经 `SS_PLUGIN_OPTIONS` 以明文环境变量传给插件进程（#2），属于 CONTEXT.md 定义的 **Sensitive information**（"plugin options that contain credentials"）；其生命周期按 #10 的凭据规则处理，不得进入日志与诊断转储。
+
+## 6. 三种分发路径
+
+### 6.1 用户自行指定（配置里填插件可执行路径）
+
+- **Gatekeeper 语义（Apple 一手文档）**：Gatekeeper「requests user approval before opening downloaded software for the first time」（[Platform Security: Gatekeeper and runtime protection](https://support.apple.com/guide/security/sec5599b66df/web)）；macOS 15 Sequoia 起「users will no longer be able to Control-click to override Gatekeeper … They'll need to visit System Settings > Privacy & Security」，见 [Apple Developer 新闻：Updates to runtime protection in macOS Sequoia](https://developer.apple.com/news/?id=saqachfa)（2024-08-06）；放行走系统设置 → 隐私与安全性 → Open Anyway（[Safely open apps on your Mac](https://support.apple.com/en-us/102445)）。
+- **HITL 观察（用户目视，macOS 27.0，该测试方法已停用）**：先前会话对带 `com.apple.quarantine` 的 shadow-tls 测试副本尝试启动，弹出系统模态「未打开 "shadow-tls-q"」/「Apple无法验证 …」，按钮仅「完成」与「移到废纸篓」，**无内联"打开"旁路**，启动在代码执行前被拦截——与上述 Sequoia 起的 Apple 官方描述一致（macOS 15 上的具体弹窗形态未测，第 10 节）。
+- **安全与供应链**：自定路径等于让产品为任意来源二进制背书执行；adhoc/未签名的插件无法验证作者、无法防替换、无更新安全通道。
+- **可维护性**：GUI 能做的只有第 8 节的静态事实校验（存在性/可执行位/架构/codesign/quarantine/SHA-256），无法提升信任级别。
+- **sslocal 子进程模型兼容性**：见第 5 节——大概率可运行（#16 L3 旁证），但属未验证判断。
+- **结论**：技术上可实现最小校验，但信任与体验俱差；**建议 2.0 第一版不做**，仅保留数据模型空间（`plugin` 字段本就是字符串，#2）。
+
+### 6.2 受产品打包管理（插件随 app 进 Contents/Helpers 等）
+
+- **机制**：与 #6 完全同构——对每个插件固定 release tag、资产 URL、SHA-256 清单 → 构建时校验 → DevID 重签 → 装入 bundle → 随 app 公证。对 6.1 的全部短板（不可验证、quarantine 拦截、防火墙不确定性）一次性消除：app 整体公证后 Gatekeeper 放行，回环监听零防火墙交互（第 4.2 节）。
+- **供应链责任**：我们替用户背书第三方插件的特定版本；在无上游校验和的 4 个候选上，信任根是本仓库清单中的本地复验哈希（第 3、4 节），升级须人工复验——这与 #2/#6 对 sslocal 的既有立场一致，并非新增负担。
+- **更新耦合**：插件升级必须随 app 发版；候选中 v2ray-plugin（4 年未发版）与 shadow-tls（2.8 年未发版）的实际风险是「长期无更新」而非「频繁被迫跟随」。
+- **许可证**：MIT 候选无额外义务；GPL-3.0（Cloak）分发须履行源码提供等义务（事实陈述，后续票据评估）。
+- **结论**：**唯一建议路径**。首版是否内嵌具体插件是独立决策；若内嵌，建议从 v2ray-plugin（官方组织、MIT、生态事实标准、SIP003 原生）开始评估，xray-plugin（活跃、MIT，但个人维护者）与 qtun（官方组织、MIT、唯一有上游校验和，但低频低占用）列为次选，shadow-tls/Cloak 暂缓（发版停滞 / GPL）。
+
+### 6.3 暂不支持
+
+- **事实归类**：simple-obfs（弃用 + 唯一资产是 Windows exe）、kcptun（上游 404 + 无原生 SIP003 + 官方 fork 停在 2017）、GoQuiet（2018 年后无 arm64）、simple-tls（无 darwin arm64 资产）——四者无官方 arm64 资产或无原生 SIP003，在「只接受官方构建产物」政策下不可纳入。
+- **UI 表达**：不支持就是不提供对应预设；若保留 `plugin` 自由输入（面向自备插件的未来路径），须在输入处明示「本版本不校验、不背书第三方插件」并阻断激活或明确警告，**不许诺、不静默失败**。
+
+## 7. 无法验证/无可执行文件时的呈现事实（给 #5 的输入）
+
+GUI 可静态采集的事实清单（全部无特权、不执行目标代码）：
+
+1. 路径存在性、可执行位（POSIX mode）；
+2. 架构是否 arm64（Mach-O header 可编程读取，等价于本报告 `file`/`lipo -archs`）；
+3. codesign 状态：unsigned / adhoc / Developer ID（含 TeamIdentifier 与 CDHash，等价于 `codesign -dv`）；
+4. `com.apple.quarantine` 有无（URL resource values 可读）；
+5. SHA-256；
+6. 与产品清单（打包插件）比对是否一致；上游是否公布校验和（仅 qtun 有）；
+7. sslocal 侧运行时失败信号（#2）：3 秒内未建立 TCP 监听 → 错误；插件进程退出 → error 日志；全部插件退出 → 插件监控 task panic；Unix 下销毁先 SIGTERM、10 ms 后 kill。日志经 LaunchAgent stdout/stderr 捕获（#13）。
+
+不能承诺的边界（UI 不得暗示）：adhoc/未签名插件无法验证作者与完整性；无自动更新的安全通道；`plugin_opts` 可能含凭据、以明文环境变量进入插件进程（敏感信息，#10/CONTEXT.md）；对被 quarantine 拦截的用户自备插件，产品无法代为放行（须用户自行走系统设置 Open Anyway，macOS 15+ 无右键旁路）。
+
+UI 文案要点：打包插件展示「来源项目、许可证、固定版本、由 ShadowsocksX-NG 开发者签名重签」；不支持项展示「无官方 arm64 构建 / 上游已停止维护」类事实原因；插件失败展示「插件未能在 3 秒内建立本地监听」或「插件进程已退出」并指向日志路径。
+
+## 8. 对后续决策的输入
+
+- **#2（配置契约）**：`servers[].plugin`/`plugin_opts` 直通 sslocal；2.0 的校验对象是插件**可执行文件**而非 opts 字符串；打包插件的 `plugin` 值应指向 bundle 内固定绝对路径。
+- **#5（UI）**：按第 7 节呈现事实与限制；插件选择器只列打包插件；「暂不支持」给事实原因。
+- **#6（打包）**：清单 schema 需支持多二进制（`Vendor/<plugin>/manifest` 同构扩展）；签名脚本按插件逐个重签，`--identifier` 建议沿用 `<bundle-id>.<plugin>` 形式。
+- **#10（敏感信息）**：`plugin_opts` 全量按敏感信息处理（含凭据引用化、日志脱敏、迁移不带走生成缓存）。
+- **#13（宿主）**：插件是 sslocal 的子进程（launchd 不感知），wrapper 生命周期管理只需管好 sslocal；插件随 sslocal 终止而终止（SIGTERM→kill 链，#2）。
+- **#16（防火墙）**：打包插件回环监听零交互，无需进入防火墙诊断面；若未来出现非回环插件场景须重开研究。
+
+## 9. 建议汇总（给后续 grilling 决策票，非最终裁决）
+
+1. 分发路径：只做「受产品打包管理」；「用户自行指定」第一版不做；「暂不支持」作为明确产品状态而非静默缺失。
+2. 首版候选评估顺序：v2ray-plugin → qtun → xray-plugin；shadow-tls、Cloak 暂缓；simple-obfs、kcptun、GoQuiet、simple-tls 不支持（事实原因见第 3.6 节）。
+3. 无论选谁：清单固定 tag/URL/SHA-256 + DevID 重签 + 随 app 公证；无上游校验和这一残余风险显式记入决策记录。
+
+## 10. 未验证项
+
+1. **macOS 15 实机**的 quarantine/Gatekeeper 弹窗形态与 Open Anyway 流程（HITL 观察来自 macOS 27.0；Apple 文档描述 Sequoia 起的行为，15 上的具体表现未测）。
+2. **Hardened Runtime 子进程签名链**：DevID+Hardened 的 sslocal → adhoc 插件子进程在 macOS 15 上的完整运行验证（#16 L3 提供旁证，未覆盖 sslocal→plugin 两级子进程链）。
+3. **真实公证流程**对重签后嵌套插件的接受度（本机无 notarytool 凭据，同 #16 遗留）。
+4. **功能级兼容性**（各插件协议行为、性能、与真实服务器配合）完全未测——本票据只覆盖分发与验证边界。
+5. **候选项目未来 release 行为**（资产命名、校验和引入与否）不受本报告约束；升级任何插件前须重做第 4 节静态清单。
+6. Cloak 等 GPL 项目的**分发合规评估**未做（本报告仅陈述许可证类型与义务存在）。
+
+本报告只新增研究文档；未修改 `Legacy/`、未实现 2.0 功能、未触碰工作树中其他会话的未提交文件。
diff --git a/docs/research/wayfinder-issue-2.md b/docs/research/wayfinder-issue-2.md
new file mode 100644
index 000000000..4117f7625
--- /dev/null
+++ b/docs/research/wayfinder-issue-2.md
@@ -0,0 +1,103 @@
+# Wayfinder issue 2：shadowsocks-rust arm64 发布物与 `sslocal` 配置契约
+
+- 票据：[研究：shadowsocks-rust arm64 发布物与 sslocal 配置契约](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/2)
+- 父地图：[Wayfinder: ShadowsocksX-NG 2.0 现代化重实现](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/1)
+- 研究日期：2026-09-20
+- 适用范围：macOS 15+、仅 arm64、ShadowsocksX-NG 2.0；只使用 `shadowsocks-rust` 官方仓库/源码/Release 和 Shadowsocks 官方 SIP 文档。
+
+## 决策摘要
+
+1. **2.0 首个上游依赖固定为 `shadowsocks-rust v1.25.0`。** 研究日观察到的最新 Release 是 `v1.25.0`，对应提交 [`ab388c7466d21f979430e33cc9ef10e22fb05955`](https://github.com/shadowsocks/shadowsocks-rust/commit/ab388c7466d21f979430e33cc9ef10e22fb05955)。使用官方 `aarch64-apple-darwin` 归档，不使用 `latest`、`master` 或本仓库自行编译。[官方 Release](https://github.com/shadowsocks/shadowsocks-rust/releases/tag/v1.25.0) [官方发布工作流](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/.github/workflows/build-release.yml#L142-L185)
+2. **固定归档 SHA-256，并在构建时验证。** 目标资产为 [`shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz`](https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.25.0/shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz)，期望值为 `58e0caf0cc9266c4ea226f38aa20fb28c1be12efc87a73cf5903197867555208`；同时保存并报告官方 [`.sha256` companion asset](https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.25.0/shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz.sha256)。上游构建脚本明确用 `shasum -a 256` 生成该文件。[构建脚本](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/build/build-host-release#L21-L25)[构建脚本](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/build/build-host-release#L86-L105)
+3. **GUI 启动显式配置文件：** `sslocal -c <absolute-config-path>`。不要依赖上游默认搜索路径，也不要把密码放进命令行参数；上游读取配置文件中的 `password`，并支持 `${VAR_NAME}` 环境变量占位符，但这不是一个独立的安全存储协议。[CLI 入口](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/bin/sslocal.rs#L7-L20)[默认路径与配置读取](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/config.rs#L14-L81)[密码读取](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2137-L2176)[环境变量占位符](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L3446-L3466)
+4. **激活分组时把该分组的有效服务器展开到 `servers`，交给上游自动选择。** `sslocal` 对 TCP/UDP 分别维护最佳服务器，按主动探测得到的延迟、失败率、波动和用户权重评分；GUI 不应自行实现第二套选路算法。空分组应由 GUI 拒绝激活，因为上游 balancer 的 `best_*_server` 在无服务器时会断言失败。[多服务器配置](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md#L315-L355)[选路实现](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/ping_balancer.rs#L63-L188)[空 balancer 行为](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/ping_balancer.rs#L217-L231)
+5. **订阅分组由 ShadowsocksX-NG 自己解析和持久化。** 上游 SIP-008 loader 只把响应解析成扁平 `servers`，然后替换 `ServerSource::OnlineConfig`；其配置结构没有嵌套分组模型。因此 2.0 应保留完整订阅文档/扩展树，再把当前激活分组翻译成 `sslocal` 配置，而不是把嵌套扩展交给 `sslocal --online-config-url`。[上游在线配置服务](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/online_config/mod.rs#L193-L243)[扁平服务器结构](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L535-L604)[SIP-008 自定义字段与服务器 UUID](https://shadowsocks.org/doc/sip008.html#json-document-format)
+
+## 1. 官方 arm64 发布物与升级策略
+
+### 1.1 当前发布物
+
+上游 README 将 GitHub Releases 作为发布构建下载位置，并明确列出 `aarch64-apple-darwin`；macOS Release job 使用 `macos-latest`、stable Rust 和 `aarch64-apple-darwin` target。[README：Download release](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md#L130-L136)[发布工作流](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/.github/workflows/build-release.yml#L142-L185)
+
+发布脚本从 `Cargo.toml` 读取版本，打包 `sslocal`、`ssserver`、`ssurl`、`ssmanager`、`ssservice`，再生成 `.tar.xz` 和 `.sha256`；因此 2.0 只需提取 `sslocal`，不应把其余可执行文件当作应用能力承诺。[Cargo target 定义](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/Cargo.toml#L17-L45)[macOS 打包脚本](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/build/build-host-release#L45-L105)
+
+本次对官方归档做了本地验证：归档包含 `sslocal` 等五个上游可执行文件；提取出的 `sslocal` 是 Mach-O arm64，`sslocal --version` 输出 `shadowsocks 1.25.0`；本地 `shasum -a 256` 与官方 `.sha256` 均得到上述 `58e0caf0...55208`。验证对象是未重新签名的官方归档；嵌入 app 后的 helper 会被本项目重新签名，不能再用归档哈希校验签名后的文件。[官方归档](https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.25.0/shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz)[官方 SHA-256](https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.25.0/shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz.sha256)
+
+### 1.2 2.0 的更新门槛
+
+- 在项目清单中同时固定 `release tag`、上游 commit、target triple、资产 URL、归档 SHA-256 和提取文件名；升级必须是显式变更，重新执行归档、架构、版本和启动检查。[版本来源](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/Cargo.toml#L1-L12)[Release tag](https://github.com/shadowsocks/shadowsocks-rust/releases/tag/v1.25.0)
+- 构建时以清单中的哈希为信任根，再用官方 `.sha256` 文件作独立审计；不要只下载 `releases/latest` 或远端 checksum 后信任同一次可变请求。[官方构建脚本](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/build/build-host-release#L94-L105)
+- 2.0 不需要上游 Rust toolchain 或源代码作为构建依赖；官方 Release 已提供目标架构归档，符合“外部开源可执行文件使用源项目构建产物”的项目约束。[官方 README](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md#L130-L136)
+
+## 2. `sslocal` CLI 与配置文件契约
+
+### 2.1 启动命令
+
+`sslocal` 是独立 binary，`-c/--config` 接收配置文件路径，`-b/--local-addr` 可直接指定本地监听地址；`--protocol` 默认 SOCKS5，完整官方构建还暴露 HTTP、tunnel、redir、DNS、TUN 等按 feature 编译的模式。[binary 定义](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/Cargo.toml#L17-L20)[CLI 参数](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L85-L216)[协议参数](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L713-L728)
+
+上游默认会依次搜索当前目录的 `local.json`/`config.json`、macOS `~/Library/Application Support/org.shadowsocks.shadowsocks-rust/config.json` 等位置；GUI 应始终传绝对路径，避免当前工作目录、旧配置和 launchd 工作目录造成歧义。[默认搜索实现](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/config.rs#L14-L81)
+
+本地配置通过 JSON5 解析，因此严格 JSON 是安全子集；SIP-008 在线响应路径则使用严格 JSON 解析。2.0 生成严格 JSON，避免把 JSON5 注释或尾逗号带入订阅/迁移边界。[本地 JSON5 解析](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2809-L2834)[在线 JSON 解析](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/online_config/mod.rs#L187-L202)
+
+### 2.2 推荐生成的最小配置
+
+```json
+{
+  "servers": [
+    {
+      "id": "stable-server-id",
+      "remarks": "Example",
+      "server": "example.com",
+      "server_port": 443,
+      "password": "redacted-at-documentation-time",
+      "method": "chacha20-ietf-poly1305",
+      "mode": "tcp_only"
+    }
+  ],
+  "local_address": "127.0.0.1",
+  "local_port": 1080,
+  "protocol": "socks",
+  "mode": "tcp_only"
+}
+```
+
+`servers[]` 的 `server`、`server_port`、`method` 和加密方法所需的 `password` 形成核心契约；`disabled: true` 的条目会被跳过，`remarks`/`id` 可用于显示和稳定身份，插件字段及 TCP/UDP 权重也由上游读取。[服务器字段](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L535-L604)[标准字段校验](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2137-L2237)[扩展服务器读取](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2239-L2245)
+
+上游会把 `password` 直接读入 `ServerConfig`；`${VAR_NAME}` 只是在解析阶段从进程环境取值。由于 2.0 仍必须让 `sslocal` 取得真实密码，Keychain 不能单独解决配置文件、进程环境、日志和崩溃驻留问题；本阶段不把 Keychain 作为必选安全边界，生成文件应限制权限、使用短生命周期/原子替换，并避免把秘密放入 argv 或日志。[密码装载](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2161-L2176)[环境变量实现](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L3446-L3466)[文件读取](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2821-L2834)
+
+### 2.3 配置更新与订阅边界
+
+带 `-c` 的 `sslocal` 会记录配置路径；Unix 上收到 `SIGUSR1` 时，上游会重新读取文件并只替换 `ServerSource::Configuration` 服务器。修改服务器列表可以采用“写临时文件—原子替换—发 `SIGUSR1`”的路径；监听地址、协议和本地端口变化仍应重启服务。[配置路径记录](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2821-L2834)[SIGUSR1 reload](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L1001-L1014)[reload 实现](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L1068-L1135)
+
+上游 `--online-config-url` 默认每 3600 秒更新，启动时先执行一次，要求响应状态 200、读取 JSON 并将在线来源服务器替换进 balancer；允许插件列表是字符串白名单。它不会保留 ShadowsocksX-NG 的嵌套分组树，因此订阅抓取、扩展解析、固定订阅分组和刷新合并必须属于 GUI 层。[在线配置参数](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L557-L581)[在线服务生命周期](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/online_config/mod.rs#L27-L80)[刷新与插件白名单](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/online_config/mod.rs#L104-L243)[SIP-008 HTTPS 与 JSON 契约](https://shadowsocks.org/doc/sip008.html#transport-and-delivery)
+
+## 3. 多服务器自动选择
+
+- `servers` 按配置顺序进入 `PingBalancer`；`disabled` 条目不进入，上游按 `mode` 和 `tcp_weight`/`udp_weight > 0` 分别判定 TCP/UDP 是否可用。[服务器过滤](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2240-L2245)[可用性判定](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/ping_balancer.rs#L343-L369)
+- 多服务器时主动探测 TCP 和 UDP；默认单次探测超时 5 秒、探测间隔 10 秒。TCP 与 UDP 各自保存最佳索引，不保证两者选择同一台服务器。[默认探测参数](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/server_stat.rs#L8-L11)[独立 TCP/UDP 选择](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/ping_balancer.rs#L205-L231)
+- 评分降低延迟中位数、失败率和 MAD 的影响，并除以用户权重；分数越低越好，探测失败计为错误。[评分公式](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/server_stat.rs#L87-L116)[探测失败处理](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/ping_balancer.rs#L811-L842)
+- 初始构建会先探测并选择最佳服务器；只有一个可用服务器时 checker task 不持续探测。GUI 的“激活分组”应保留稳定顺序和服务器 ID，但不把“当前最佳服务器”写回用户配置。[初始化](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/ping_balancer.rs#L304-L341)[单服务器 checker 行为](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/ping_balancer.rs#L351-L383)
+
+## 4. 插件进程
+
+SIP-003 规定插件是 Shadowsocks 的子进程，通过 `SS_REMOTE_HOST`、`SS_REMOTE_PORT`、`SS_LOCAL_HOST`、`SS_LOCAL_PORT` 和可选的 `SS_PLUGIN_OPTIONS` 传参；标准描述的通用插件转发目前是 TCP，插件本身不随 `shadowsocks-rust` Release 一起提供。[SIP-003 生命周期与环境变量](https://shadowsocks.org/doc/sip003.html#life-cycle-of-a-plugin)[SIP-003 限制](https://shadowsocks.org/doc/sip003.html#restrictions)[Rust 插件启动](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/plugin/ss_plugin.rs#L7-L29)
+
+Rust 实现为每个带插件的服务器启动外部 executable，最多等待 3 秒检查 TCP 监听；插件退出会写 error 日志，所有插件都退出时插件监控 task 会 panic。Unix 下销毁插件时先发 SIGTERM，最多等待 10ms，仍未退出则强制 kill。[插件启动与等待](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/plugin/mod.rs#L68-L165)[插件退出监控](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/loadbalancing/ping_balancer.rs#L243-L301)[插件终止](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks/src/plugin/mod.rs#L167-L244)
+
+因此 2.0 应把插件 executable 作为另一个有版本、有来源、有架构和签名要求的外部依赖；配置编辑器应校验路径/名称并明确插件是外部进程，不应假设仅凭 `plugin_opts` 就能安装插件。第一版不应向用户承诺所有插件的 UDP 兼容性；上游 CLI 虽接受 `tcp_only`、`udp_only`、`tcp_and_udp`，SIP-003 的标准兼容边界仍是 TCP。[Rust plugin_mode 解析](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs#L2192-L2217)[SIP-003 限制](https://shadowsocks.org/doc/sip003.html#restrictions)
+
+## 5. 日志、信号与退出
+
+- 默认日志 writer 是 console；`-v` 逐级提高日志等级，`RUST_LOG` 环境变量优先于默认过滤器；`--log-config` 已隐藏并标记为 deprecated。新 GUI 应优先捕获 LaunchAgent 的 stdout/stderr，或写入应用支持目录中的滚动日志，不要依赖 deprecated `log4rs` 文件配置。[日志配置](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/config.rs#L159-L180)[日志过滤](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/logging/tracing.rs#L23-L152)[CLI 日志参数](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L246-L271)
+- Unix 收到 SIGTERM 或 SIGINT 时，monitor 返回正常完成，`sslocal` 以成功退出；服务 future 意外结束或 listener 错误则返回错误。[信号 monitor](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/monitor/unix.rs#L1-L21)[主循环](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L1001-L1053)
+- 错误退出类别为：服务异常/中止 `EX_SOFTWARE`，配置或 ACL 失败 `EX_CONFIG`，参数不足 `EX_USAGE`；GUI 应把“用户主动停止”和“崩溃/配置失败”分开呈现。[退出码映射](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/error.rs#L6-L40)[主入口](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/src/service/local.rs#L1056-L1065)
+- 上游提供的 macOS launchd plist 以 `-c` 启动 `sslocal`，并把 stdout/stderr 重定向到文件；2.0 应改成随应用签名分发的 per-user LaunchAgent/`SMAppService` 路径和应用支持目录日志，不能直接复制其中的 `/usr/local`、`/tmp` 全局路径。[官方 macOS plist](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/configs/org.shadowsocks.shadowsocks-rust.plist#L8-L40)
+
+## 6. 对 2.0 实现的最终边界
+
+1. XcodeGen/发布脚本负责固定并校验官方 arm64 Release、提取 `sslocal`、再按项目签名流程嵌入；不编译 `shadowsocks-rust` 源码。[官方 Release 资产](https://github.com/shadowsocks/shadowsocks-rust/releases/tag/v1.25.0)[官方打包脚本](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/build/build-host-release#L86-L105)
+2. GUI 负责分组树、订阅扩展、迁移和敏感配置生命周期；运行时只生成一个当前激活目标的严格 JSON 配置，显式传给 `sslocal -c`。
+3. 单服务器激活生成单元素 `servers`；分组激活递归展开有效后代服务器；上游负责健康探测和 TCP/UDP 自动选择。
+4. 服务健康判定至少组合 launchd/`SMAppService` 状态、进程退出码、日志诊断和本地 SOCKS 监听检查；不能把进程存在误认为代理可用。
+
+本报告只新增研究文档，未修改 `Legacy/` 或生产代码。
diff --git a/docs/research/wayfinder-issue-29.md b/docs/research/wayfinder-issue-29.md
new file mode 100644
index 000000000..903c3285b
--- /dev/null
+++ b/docs/research/wayfinder-issue-29.md
@@ -0,0 +1,31 @@
+# Wayfinder issue 29：系统代理写入、四种模式与健康门禁
+
+## 实现结论
+
+2.0 现在把 PAC、全局、手动、外部 PAC 建模为互斥的 `ProxyMode`。控制器先确认本地 SOCKS 端口和本地 PAC endpoint 健康，再执行系统代理动作；外部 PAC 还必须通过同一 PAC 内容/响应检查。任一检查失败都不会调用 SystemConfiguration 写入。
+
+- PAC：写入当前监听范围派生出的 PAC URL。
+- 全局：只启用本机 `127.0.0.1:<SOCKS 端口>` 的 SOCKS 代理；HTTP 入站仍是独立运行时能力，不复活 Legacy Privoxy 或 `FollowGlobal` 语义。
+- 手动：恢复 2.0 最近一次接管前的完整 Proxies 字典，不再改写系统代理。
+- 外部 PAC：接受无凭据的 HTTP/HTTPS URL；启用前验证 URL、HTTP 响应 MIME 与 `FindProxyForURL` 内容。`file:` 暂不进入支持矩阵，因为本机目标系统未建立跨客户端契约。
+
+生产适配器以当前 network set 的 network service ID 为粒度读取和写入 `Proxies` entity。第一次写入保存完整原字典，切换模式只改变 2.0 控制的 enable/endpoint 字段；恢复前若发现当前字典已被用户或 MDM 改动，则报告所有权冲突并不覆盖。记录文件使用 v2 目录的 0700/0600 原子写入基线。
+
+正式模式菜单属于 #31，本票只提供控制器控制面和可验证的模式/写入 seam；外部 PAC 保留在核心模式模型中，待 #31 接线时按下述实测范围决定菜单暴露。
+
+## 本机实测
+
+环境：macOS 27.0（Build 26A428），arm64，2026-09-20。
+
+### 已通过
+
+- 本地 HTTP PAC endpoint 可由 `SystemPACHealthProbe` 获取并验证：HTTP 200、`application/x-ns-proxy-autoconfig`、内容包含 `FindProxyForURL`。对应测试使用真实 loopback socket，不写系统代理。
+- PAC URL 的 loopback/主机地址派生和 SOCKS 全局目标均由纯映射测试覆盖；四种模式不会同时启用 PAC、HTTP/HTTPS、SOCKS。
+
+### 未执行的破坏性操作与边界
+
+- 未对当前用户的 network service 做真实写入/恢复。`scutil --proxy` 显示当前机器已有其他本地代理（HTTP/HTTPS/SOCKS 均为 `127.0.0.1:64649`，PAC 关闭），不能在日常配置上覆盖它。
+- `networksetup` 的授权检查返回 `AuthorizationCreate() failed: -60008`；因此本轮没有伪造“真实 SystemConfiguration 写入已通过”的结论。生产路径仍使用 `SCPreferencesCreateWithAuthorization`，失败会呈现明确的系统代理授权错误。
+- 本机没有为 `file:` PAC 建立目标系统所有客户端的实测证据，所以外部 PAC 校验只允许 HTTP/HTTPS；正式菜单尚未在 #31 中接线。
+
+验证重点由单测覆盖：健康门禁前不写入、外部 PAC 不健康不写入、全局/手动切换立即生效、停止恢复系统代理、所有权冲突不覆盖用户改动，以及所有权记录的原子权限。
diff --git a/docs/research/wayfinder-issue-3.md b/docs/research/wayfinder-issue-3.md
new file mode 100644
index 000000000..feef3ca81
--- /dev/null
+++ b/docs/research/wayfinder-issue-3.md
@@ -0,0 +1,172 @@
+# Wayfinder 研究：macOS 15 arm64 外部服务与应用生命周期
+
+> 研究日期：2026-09-20  
+> 范围：ShadowsocksX-NG 2.0；SwiftUI 菜单栏 GUI；随 `.app` 分发的 arm64 `shadowsocks-rust` 外部进程。  
+> 约束：本报告只修改研究文档，不修改 `Legacy/` 或生产代码。
+
+## 结论先行
+
+推荐使用 **`SMAppService.agent(plistName:)` 注册一个随应用签名、位于应用包内的 LaunchAgent**；运行时仍由 `launchd` 管理，`SMAppService` 是现代的注册、授权和注销入口，不是另一个进程监督器。不要在 macOS 15 目标上把手写 `~/Library/LaunchAgents` plist 作为生产安装路径，也不要把不需要 root、开机前运行或跨用户服务的本地代理做成 LaunchDaemon。
+
+建议的边界是：
+
+1. `SMAppService.Status` 表示“服务是否已注册、是否获准运行”，不表示代理进程当前健康。
+2. LaunchAgent plist 使用 `BundleProgram` 指向应用包内的 `shadowsocks-rust`，使用 launchd 的 `KeepAlive` 策略恢复崩溃；GUI 通过本地健康检查和明确的生命周期协议判断代理是否真的可用。
+3. 用户主动停止或退出应用时，先执行代理的可选优雅停止协议，再注销服务；注销要使用 completion-handler 版本并等待完成，避免立即重新注册造成竞态。
+4. 应用退出策略必须明确：默认 Quit 应停止代理，或提供清晰的“退出但保留代理运行”选项。若允许代理留在后台，菜单栏/登录项设置中必须仍有可见的停止控制。
+
+这是一个**架构建议**，不是 Apple 对本项目的唯一规定。Apple 明确规定了 API 的注册、授权状态和 launchd plist 语义；“如何把代理健康度、连接开关和 GUI 状态组合起来”属于本项目设计选择。
+
+## Apple 文档确认的事实
+
+### 1. LaunchAgent 与 LaunchDaemon 的边界
+
+Apple 将 LaunchAgent 定义为代表当前登录用户运行的进程；LaunchDaemon 是可由 `launchd` 管理、以 root 身份运行、甚至在用户登录前运行的独立后台进程。[Service Management 总览](https://developer.apple.com/documentation/servicemanagement) 也将二者明确区分。对一个只服务当前用户、无需修改系统配置的本地 Shadowsocks 代理，LaunchAgent 的权限和生命周期边界更贴合需求；选择 LaunchDaemon 会引入系统级服务和管理员批准流程，这是设计推导，不是“代理必然不需要其他网络/防火墙权限”的保证。
+
+传统 launchd 配置由 plist 描述。Apple 的 Launchd 编程指南说明，LaunchAgent 可以放在用户的 `Library/LaunchAgents`，而 LaunchDaemon 放在系统级目录；`Label` 和 `ProgramArguments` 是基本配置，`KeepAlive` 控制是否持续保持运行。[Creating Launch Daemons and Agents](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html)
+
+当前 Darwin 的 Apple 开源 man page 进一步说明，LaunchAgent 应运行在用户 session；`Program` 要求绝对路径，而仅由 `SMAppService` 安装的 plist 可以使用相对应用包的 `BundleProgram`。[Apple `launchd.plist(5)`](https://github.com/apple-oss-distributions/launchd/blob/main/man/launchd.plist.5) 这使得服务可以随 `.app` 携带，而不必把安装后的绝对路径写死。
+
+### 2. `SMAppService` 是 macOS 15 应用应使用的注册层
+
+Apple 的 `SMAppService` 文档明确说：在 macOS 13 及更高版本，用它注册和控制 LoginItem、LaunchAgent、LaunchDaemon；对 LaunchAgent，它替代把 plist 手工安装到 `~/Library/LaunchAgents` 或 `/Library/LaunchAgents`。[SMAppService](https://developer.apple.com/documentation/servicemanagement/smappservice)
+
+LaunchAgent plist 必须位于主应用包的 `Contents/Library/LaunchAgents`。Apple 的迁移文档建议把 helper 放进应用包，并把 plist 中的 `Program` 替换为相对应用包的 `BundleProgram`；这样应用移动位置时仍可定位 helper。[Updating helper executables from earlier versions of macOS](https://developer.apple.com/documentation/servicemanagement/updating-helper-executables-from-earlier-versions-of-macos)
+
+注册时，`SMAppService.agent(plistName:)` 对应的 LaunchAgent 会立即 bootstrap，并在后续用户登录时再次 bootstrap；API 必须在目标用户正在运行应用时调用，不能从用户上下文之外替另一个用户注册。[register()](https://developer.apple.com/documentation/servicemanagement/smappservice/register%28%29)
+
+Apple 还明确要求使用 `SMAppService` 的应用经过代码签名；如果 LaunchAgent 的 plist 或可执行文件更新，需要重新注册，否则可能不会启动，Apple 建议可执行文件变化时先注销再注册。[SMAppService](https://developer.apple.com/documentation/servicemanagement/smappservice)
+
+因此，生产包建议类似以下结构（名称仅为设计示例）：
+
+```text
+ShadowsocksX-NG.app/
+└── Contents/
+    ├── Library/LaunchAgents/com.shadowsocksxng.proxy.plist
+    └── Resources/shadowsocks-rust       # arm64，随应用签名
+```
+
+plist 仍然是 launchd 配置；`SMAppService` 负责让它进入系统的 Service Management 生命周期。两者不是互斥方案。
+
+### 3. 授权和用户可见性
+
+`SMAppService.Status` 有四个有明确含义的状态：`notRegistered`、`enabled`、`requiresApproval`、`notFound`。[SMAppService.Status](https://developer.apple.com/documentation/servicemanagement/smappservice/status-swift.enum) 其中 `requiresApproval` 表示服务已注册，但用户需要在 System Settings 中采取行动，或用户已撤销允许运行的同意。[requiresApproval](https://developer.apple.com/documentation/servicemanagement/smappservice/status-swift.enum/requiresapproval)
+
+Apple 对 LaunchDaemon 明确要求管理员在 System Settings 中批准；对 LaunchAgent，文档描述的是当前用户上下文注册和登录时 bootstrap，而不是系统级管理员授权。[register()](https://developer.apple.com/documentation/servicemanagement/smappservice/register%28%29) 因此本项目应避免 LaunchDaemon，不应为了启动普通用户代理而设计提权流程。仍需在实际分发包上验证签名、Gatekeeper、用户关闭后台项后的行为，以及代理自身涉及的网络/防火墙权限；这些不是 `SMAppService` 文档可以替项目保证的事项。
+
+Apple 建议依赖 helper 的应用检查授权状态，并在用户同意后打开 Login Items 设置；可通过 `SMAppService.openSystemSettingsLoginItems()` 引导用户。[Updating helper executables from earlier versions of macOS](https://developer.apple.com/documentation/servicemanagement/updating-helper-executables-from-earlier-versions-of-macos)
+
+### 4. 崩溃恢复不是 `SMAppService.Status` 的职责
+
+对 LaunchAgent，`register()` 文档只承诺立即 bootstrap 和后续登录 bootstrap；它没有承诺“LaunchAgent 崩溃后自动重启”。重启策略来自 launchd plist。Apple 的 `launchd.plist(5)` 说明：
+
+- `KeepAlive=true` 会让 launchd 持续保持 job 运行，并隐含 `RunAtLoad`；快速、频繁退出的 job 会被 throttle。
+- `KeepAlive` 字典可以用 `Crashed` 只针对由典型 crash signal 退出的情况决定是否重启。
+- LaunchAgent 应处理 `SIGTERM`，快速结束未完成工作后退出。
+
+来源：[Apple `launchd.plist(5)`](https://github.com/apple-oss-distributions/launchd/blob/main/man/launchd.plist.5)。
+
+对 `shadowsocks-rust`，建议第一版采用下面的策略（**设计选择**）：
+
+- 如果“代理服务已启用”代表应持续运行，使用 `KeepAlive` 的 `Crashed=true`，让信号崩溃自动恢复，但不要把配置错误导致的普通非零退出变成无限重启循环。
+- 用户主动停止前先改变本项目的 desired state，再注销服务；否则 `KeepAlive` 可能把一次主动退出解释成需要再次启动。
+- 代理必须能响应 `SIGTERM`，或者由一个很薄的、能优雅处理信号的 wrapper 负责管理它；不要在 launchd 进程中自行 daemonize/fork。launchd man page 对这两点都有明确约束。[Apple `launchd.plist(5)`](https://github.com/apple-oss-distributions/launchd/blob/main/man/launchd.plist.5)
+
+不要把 LoginItem helper 的行为误套到 LaunchAgent 上：Apple 对 LoginItem 单独说明了 crash 或非零退出会被重新拉起；LaunchAgent 的恢复行为应由 plist 的 launchd 策略决定。[register()](https://developer.apple.com/documentation/servicemanagement/smappservice/register%28%29)
+
+### 5. 应用退出、重启与干净停止
+
+Apple 的后台进程指南要求：应用退出时，要终止自己启动的后台工作，或者给用户提供停止它的能力；如果长时间后台服务确实必要，应考虑用 `SMAppService` 注册 LaunchAgent，让用户能在 System Settings 中管理它。[Managing ongoing background processes in your Mac](https://developer.apple.com/documentation/appkit/managing-ongoing-background-processes-in-your-mac)
+
+这意味着“GUI 退出但代理无提示地继续运行”不是默认可忽略的实现细节。推荐把行为定义为：
+
+| 用户动作 | 推荐契约 |
+| --- | --- |
+| Stop Proxy | 发送代理自己的 graceful-stop 请求；随后注销 LaunchAgent；确认完成后展示 stopped。 |
+| Quit | 默认执行 Stop Proxy，再退出 GUI；若产品要支持保留代理，提供明确的“Keep proxy running”路径和之后可用的停止入口。 |
+| Relaunch | 读取 `SMAppService.status`，再做端口/IPC 健康检查；已有代理则复用，不重复注册或启动第二个实例。 |
+| App 更新 | 若 plist 或代理二进制变化，注销并重新注册；等待异步注销完成后再注册。 |
+
+`SMAppService.unregister()` 的文档保证服务不再由系统启动；异步 completion-handler 版本把完成结果交给调用方，适合把“停止完成”作为退出前的明确阶段。[unregister(completionHandler:)](https://developer.apple.com/documentation/servicemanagement/smappservice/unregister%28completionhandler%3A%29) GUI 若需要延迟退出，可使用 AppKit 的 `applicationShouldTerminate(_:)` 返回延迟结果，完成服务停止后再 `reply(toApplicationShouldTerminate:)`。[applicationShouldTerminate(_:)](https://developer.apple.com/documentation/appkit/nsapplicationdelegate/applicationshouldterminate%28_%3A%29)
+
+Apple 同时提醒，直接用 `posix_spawn()`、`fork()` 或 `system()` 启动的长期进程需要由应用自己保证退出；若进程要在 GUI 退出后继续运行，应该考虑用 SMAppService 管理的 LaunchAgent。[Managing ongoing background processes in your Mac](https://developer.apple.com/documentation/appkit/managing-ongoing-background-processes-in-your-mac) 这正是本项目不应把生产生命周期建立在 GUI 直接 spawn 上的主要理由。
+
+### 6. 日志和诊断
+
+Launchd plist 可以把 helper 的 stdout/stderr 定向到文件，使用 `StandardOutPath` 和 `StandardErrorPath`；Apple 的 Launchd 编程指南给出了这种调试配置示例。[Creating Launch Daemons and Agents](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html)
+
+SwiftUI GUI 及 Swift helper 的生命周期、注册错误、状态变化应使用 Apple Unified Logging。Apple 说明统一日志由 `Logger`/OSLog 写入，可用 Console、`log` 工具、Xcode 或 OSLog API 查看；它不是普通可读文本文件。[Logging](https://developer.apple.com/documentation/os/logging)；[Viewing Log Messages](https://developer.apple.com/documentation/os/viewing-log-messages)
+
+因此要区分两类证据（**设计选择**）：
+
+- `shadowsocks-rust` 的 stdout/stderr：落到应用专属的用户日志文件，GUI 可展示最近一段并保留路径。
+- GUI/生命周期管理器：写 Unified Log，带稳定 subsystem/category，便于 Console 和 `log show` 查询。
+
+服务状态的诊断入口可以使用 `launchctl print gui/$UID/<label>`。Apple 当前 `launchctl(1)` 说明 `print` 会显示服务的来源、当前状态、执行上下文和最后退出状态；`bootstrap`/`bootout` 管理服务定义，`kickstart` 可立即运行服务。[Apple `launchctl(1)`](https://github.com/apple-oss-distributions/launchd/blob/main/man/launchctl.1)
+
+但 GUI 不应把 `launchctl` 的人类可读输出当作稳定应用 API。运行时真值建议是：
+
+```text
+registration = SMAppService.status
+process      = launchd 负责的实例是否可观察
+health       = 本地 IPC/端口握手是否成功
+```
+
+后两项是本项目的健康模型；Apple 的 `SMAppService.status` 只表达注册/授权状态，并不等价于进程已运行或代理已可用。[status](https://developer.apple.com/documentation/servicemanagement/smappservice/status-swift.property)
+
+## 原始 per-user plist 与 `SMAppService` 对比
+
+| 维度 | 手写 `~/Library/LaunchAgents` + `launchctl` | `SMAppService.agent(plistName:)` |
+| --- | --- | --- |
+| 运行时监督 | 仍由 launchd；plist 直接表达 `KeepAlive` 等策略。[`launchd.plist(5)`](https://github.com/apple-oss-distributions/launchd/blob/main/man/launchd.plist.5) | 同样由 launchd；SMAppService 是注册/注销入口。[SMAppService](https://developer.apple.com/documentation/servicemanagement/smappservice) |
+| 安装/更新 | 要自行写入、bootstrap、卸载、处理 owner/权限和残留 | plist 与 helper 随签名 `.app`，注册状态由 API 管理；更新后按 Apple 要求重新注册。[迁移文档](https://developer.apple.com/documentation/servicemanagement/updating-helper-executables-from-earlier-versions-of-macos) |
+| 用户授权/可见性 | 手工路径本身不提供现代 API 的 status 模型 | `status` 暴露 enabled / requiresApproval 等状态，并接入 Login Items 设置。[Status](https://developer.apple.com/documentation/servicemanagement/smappservice/status-swift.enum) |
+| 应用移动 | 绝对 `Program` 路径容易失效 | `BundleProgram` 支持应用包相对路径。[迁移文档](https://developer.apple.com/documentation/servicemanagement/updating-helper-executables-from-earlier-versions-of-macos) |
+| 适合本项目吗 | 适合开发期诊断、迁移兼容和底层排障 | **推荐生产方案**；目标 macOS 15 已满足 API 可用范围 |
+
+结论不是“不要用 plist”，而是“不要把 plist 的安装/注册/授权生命周期自行实现一遍”。推荐的生产方案仍然需要一个最小 plist，但由 `SMAppService` 管理它。
+
+## 建议的可验证生命周期模型
+
+```text
+NotRegistered
+    │ register()
+    ▼
+RequiresApproval ──用户在 Login Items 中允许──▶ Enabled
+    │                                      │
+    │                                      ├─ launchd 启动 / 崩溃恢复
+    │                                      └─ IPC/端口健康检查
+    │
+    └─ 用户拒绝/关闭 ───────────────▶ RequiresApproval
+
+Enabled + unregister(completionHandler:)
+    └─ 停止服务、等待完成 ───────────▶ NotRegistered
+```
+
+实现验收至少应覆盖：注册后服务是否立即 bootstrap；注销后是否不会在下次登录自动启动；用户在 Login Items 中关闭后是否得到 `requiresApproval`；代理 SIGTERM 是否干净退出；崩溃后是否按 `KeepAlive` 策略恢复；GUI 重启时是否能区分“已授权但进程未健康”和“未授权”。前五项分别由 Apple API/launchd 语义和本项目测试共同验证，最后一项是本项目设计的状态组合。
+
+## GitHub #3 说明（只读核验）
+
+任务说明中的“numeric #3 是 closed historical PR”对 **upstream** 仓库成立：[`shadowsocks/ShadowsocksX-NG#3`](https://github.com/shadowsocks/ShadowsocksX-NG/pull/3) 是 2016 年关闭的 `Project skeleton optimization` PR。
+
+当前工作副本的 `origin` 是 `qiuyuzhou/ShadowsocksX-NG`，该仓库的 [`#3`](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/3) 当前则是 open 的 Wayfinder 研究 issue，标题为“研究：macOS 15 arm64 外部服务与应用生命周期”。本次只读核验没有执行任何 GitHub issue/PR 写操作。
+
+## Wayfinder resolution comment（简版）
+
+基于 Apple 的 Service Management、`SMAppService`、`launchd.plist(5)` 和 `launchctl(1)` 文档，2.0 应采用随签名 `.app` 分发的 per-user LaunchAgent，并通过 `SMAppService.agent(plistName:)` 注册/注销；不要生产环境手写 `~/Library/LaunchAgents` 安装流程，也不需要把普通用户代理升级为 LaunchDaemon。LaunchAgent 仍由 launchd 负责启动和崩溃恢复，`SMAppService.status` 只代表注册/授权，不代表代理健康。使用 `BundleProgram` 指向包内 arm64 `shadowsocks-rust`，用 `KeepAlive` 的明确策略处理 crash，GUI 用 IPC/端口健康检查补充状态；Quit/Stop 必须执行可验证的停止流程并让用户知道后台代理是否仍在运行。上游仓库的 numeric #3 是已关闭历史 PR；本次不修改 GitHub。
+
+## Apple 一手来源索引
+
+- [Service Management](https://developer.apple.com/documentation/servicemanagement)
+- [SMAppService](https://developer.apple.com/documentation/servicemanagement/smappservice)
+- [SMAppService.register()](https://developer.apple.com/documentation/servicemanagement/smappservice/register%28%29)
+- [SMAppService.Status](https://developer.apple.com/documentation/servicemanagement/smappservice/status-swift.enum)
+- [SMAppService.unregister(completionHandler:)](https://developer.apple.com/documentation/servicemanagement/smappservice/unregister%28completionhandler%3A%29)
+- [Updating helper executables from earlier versions of macOS](https://developer.apple.com/documentation/servicemanagement/updating-helper-executables-from-earlier-versions-of-macos)
+- [Managing ongoing background processes in your Mac](https://developer.apple.com/documentation/appkit/managing-ongoing-background-processes-in-your-mac)
+- [Creating Launch Daemons and Agents](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html)
+- [Apple `launchd.plist(5)` source](https://github.com/apple-oss-distributions/launchd/blob/main/man/launchd.plist.5)
+- [Apple `launchctl(1)` source](https://github.com/apple-oss-distributions/launchd/blob/main/man/launchctl.1)
+- [Logging](https://developer.apple.com/documentation/os/logging)
+- [Viewing Log Messages](https://developer.apple.com/documentation/os/viewing-log-messages)
+- [`applicationShouldTerminate(_:)`](https://developer.apple.com/documentation/appkit/nsapplicationdelegate/applicationshouldterminate%28_%3A%29)
diff --git a/docs/research/wayfinder-issue-4.md b/docs/research/wayfinder-issue-4.md
new file mode 100644
index 000000000..bce07f2c4
--- /dev/null
+++ b/docs/research/wayfinder-issue-4.md
@@ -0,0 +1,210 @@
+# Wayfinder issue 4：SIP-008 嵌套分组扩展与订阅兼容边界
+
+研究日期：2026-09-20  
+研究范围：只研究 SIP-008、官方 Shadowsocks 文档/源码和一手 JSON 规范；不修改 `Legacy/`，不修改生产代码。
+
+## 决策摘要
+
+1. **保持 SIP-008 外层协议不变。** 根对象继续使用 `"version": 1` 和扁平的 `"servers"` 数组；每个 `servers` 元素仍必须是有效的 Shadowsocks 服务器配置。
+2. **采用根级、项目命名空间扩展。** 使用 `"x_shadowsocksx_ng"` 作为 ShadowsocksX-NG 私有扩展字段，扩展对象内使用独立的 `"schema_version": 1`。SIP-008 要求自定义字段使用 snake_case，但没有定义扩展注册表或官方命名空间，因此该名称必须被视为产品私有协议，而不是 SIP-008 标准字段。
+3. **服务器身份复用 SIP-008 的 `servers[].id`。** 该字段本来就是用于在线更新时区分服务器并保留客户端侧信息的稳定 UUID；扩展分组只引用这个 ID，不复制服务器配置，也不使用数组下标、备注、地址或端口作为身份。
+4. **分组使用独立且持久的 UUID。** SIP-008 没有分组身份模型，因此扩展必须定义 `group.id`；刷新时只要分组仍代表同一逻辑分组，就必须保留该 ID，分组名称可以变化。
+5. **标准客户端降级为扁平列表。** 普通 SIP-008 客户端只需要读取根 `servers`；扩展感知客户端才读取 `x_shadowsocksx_ng` 的树。扩展缺失、版本不支持或树校验失败时，ShadowsocksX-NG 应保留并显示根 `servers` 的扁平结果，而不是丢弃整个订阅。
+6. **传输安全沿用 SIP-008 的硬约束。** 订阅必须使用 HTTPS，不能忽略证书或 TLS 握手错误；响应必须声明 `Content-Type: application/json; charset=utf-8`。扩展字段不提供额外的保密性，密码仍位于 SIP-008 的服务器对象中，不能把密码或其他凭据放进分组元数据。
+7. **暂不需要独立的公开标准化流程。** 只要扩展是 ShadowsocksX-NG 2.0 与受控订阅提供方之间的私有协议，仓库内的版本化协议文档即可。若将来要求第三方客户端或订阅服务互操作，则必须在实现前发布公开、版本化的扩展规范，并明确下面的身份、降级、校验和安全规则。
+
+## 一手来源与证据范围
+
+以下来源均为规范拥有者或官方实现；`shadowsocks-rust` 链接固定到 2026-09-20 读取的提交 `157cefa96d44de848ff218119dbec2047826c1bb`，`shadowsocks-org` 源文档链接固定到提交 `34598d65054dad975d330ff9d7317b0d41cf1efd`。
+
+- [SIP-008 Online Configuration Delivery（Shadowsocks 官方文档）](https://shadowsocks.org/doc/sip008.html)：定义 JSON 结构、服务器 UUID、自定义字段、HTTPS、TLS 错误处理和响应 Content-Type。
+- [SIP-008 源文档（shadowsocks-org）](https://github.com/shadowsocks/shadowsocks-org/blob/34598d65054dad975d330ff9d7317b0d41cf1efd/docs/doc/sip008.md)：官方文档源文件。
+- [shadowsocks-rust README：Configuration](https://github.com/shadowsocks/shadowsocks-rust/blob/157cefa96d44de848ff218119dbec2047826c1bb/README.md#configuration)：官方实现对多服务器配置和 `sslocal` 自动选择行为的说明。
+- [shadowsocks-rust 配置解析源码](https://github.com/shadowsocks/shadowsocks-rust/blob/157cefa96d44de848ff218119dbec2047826c1bb/crates/shadowsocks-service/src/config.rs)：`SSConfig`、`SSServerExtConfig` 和 SIP-008 `id`/`remarks` 字段的反序列化模型。
+- [shadowsocks-rust 核心服务器配置源码](https://github.com/shadowsocks/shadowsocks-rust/blob/157cefa96d44de848ff218119dbec2047826c1bb/crates/shadowsocks/src/config.rs)：`ServerConfig` 对 SIP-008 `id` 与备注的保存和访问。
+- [shadowsocks-rust SIP-008 在线配置源码](https://github.com/shadowsocks/shadowsocks-rust/blob/157cefa96d44de848ff218119dbec2047826c1bb/crates/shadowsocks-service/src/local/online_config/mod.rs)：官方客户端如何检查 HTTP 状态、Content-Type、解析 JSON 并加载在线服务器。
+- [RFC 8259 §4（JSON objects）](https://www.rfc-editor.org/rfc/rfc8259#section-4)：JSON 对象名称应唯一；这是命名空间避免碰撞的通用互操作性依据。
+
+## 规范约束
+
+### SIP-008 的标准部分必须保持可独立使用
+
+SIP-008 的标准文档要求根对象包含 `version`，当前版本值为 `1`；根对象的 `servers` 数组承载服务器配置；数组中的每个对象必须表示一个有效的 Shadowsocks 服务器。文档还允许根对象和服务器对象携带自定义字段，但明确说明这些字段不保证被所有客户端支持。
+
+因此，嵌套分组不能把 `servers` 改成分组对象，也不能只在自定义字段中传递服务器配置。正确的兼容基线是：
+
+- 根 `servers` 始终是完整、扁平、可导入的服务器列表。
+- 每个服务器对象保留 SIP-008 标准字段：至少包括 `id`、`remarks`、`server`、`server_port`、`password`、`method`；不使用分组对象替代这些字段。
+- 分组和树结构全部放在单独的根级自定义字段中。
+- 扩展感知客户端将树视为组织/呈现信息；标准客户端仍能看到所有服务器，只是看不到嵌套关系。
+
+这不能保证面对不遵循 SIP-008 的严格解析器时绝对不出错。SIP-008 只保证“自定义字段被允许”，并没有保证每个历史客户端都会忽略它们；因此不能把“普通客户端一定成功”写成协议承诺，只能把标准客户端的扁平降级作为设计目标和测试要求。
+
+### 自定义字段与命名空间
+
+SIP-008 建议自定义字段采用 snake_case，并允许在根对象增加自定义字段。文档没有给出扩展注册表、保留的 vendor prefix 或嵌套分组字段名。基于此，推荐只增加一个根级字段：
+
+```json
+"x_shadowsocksx_ng": {
+  "schema_version": 1,
+  "root_group_id": "...",
+  "groups": []
+}
+```
+
+选择根级单一对象有三个目的：
+
+1. `servers` 内的对象继续是标准服务器对象，便于没有扩展能力的客户端处理。
+2. 一个项目命名空间可以容纳未来的扩展字段，减少多个顶层字段与未来 SIP-008 字段冲突的机会。
+3. `x_` 只是本项目的私有约定，不应被描述为 SIP-008 官方保留前缀；公开互操作前需要在扩展规范中固定它的含义。
+
+不应复用 `bytes_used` 或 `bytes_remaining` 表达其他含义。SIP-008 对这两个流量字段有明确语义，并要求支持它们的客户端以标准字段为唯一数据源。
+
+### 稳定服务器身份
+
+SIP-008 的 `servers[].id` 是随机生成的 UUID，用于在线更新时区分服务器，使客户端可以保留该服务器的本地附加信息。因此：
+
+- 提供方创建服务器时生成一次 UUID，并在后续订阅刷新中保留它。
+- `x_shadowsocksx_ng` 中的 server 引用必须等于对应 `servers[].id`。
+- 服务器的显示名、地址、端口、密码、加密方法变化都不应自动产生新的 ID；只有“这是一个不同的逻辑服务器”时才生成新 ID。
+- 绝不能用数组下标、`remarks`、`server:server_port` 或配置内容哈希取代 SIP-008 ID；这些值会因排序、改名或配置更新而变化。
+- 本地应用应在订阅作用域内解释这些 ID；不同订阅源出现相同字符串时，不能因此合并成同一服务器。订阅本身的稳定身份和刷新合并规则留给 wayfinder issue 9 决定。
+
+### 稳定分组身份
+
+SIP-008 没有分组字段或分组 UUID。扩展必须自行定义分组身份：
+
+- `group.id` 使用随机 UUID 或同等不可变、不透明的字符串。
+- ID 只表示逻辑身份；`name` 是可变的显示名称。
+- 提供方刷新时保留同一逻辑分组的 ID；删除分组时删除该 ID，不能把它立即复用于其他分组。
+- 分组 ID 与服务器 ID 应在整个扩展文档内保持唯一；子引用仍通过 `type` 区分 `group` 和 `server`。
+- 分组必须形成有序、无环的树。父分组的 `children` 顺序是用户可见顺序；不能依赖 JSON 对象成员的顺序，因为 RFC 8259 明确指出对象成员顺序不应成为互操作基础。
+
+## 建议的 JSON 形状
+
+下面的文档仍是合法的 SIP-008 形状；新增部分只是项目私有自定义字段。示例中根标准列表包含全部叶子服务器，扩展树只保存身份引用和分组关系。
+
+```json
+{
+  "version": 1,
+  "servers": [
+    {
+      "id": "3c5e2af7-9f2c-4f42-bd1c-9e143d5f2d11",
+      "remarks": "Tokyo 1",
+      "server": "tokyo.example.com",
+      "server_port": 443,
+      "password": "example-secret-1",
+      "method": "chacha20-ietf-poly1305"
+    },
+    {
+      "id": "b9f08d65-8be7-4b09-bf94-4f2bb53e4199",
+      "remarks": "Osaka 1",
+      "server": "osaka.example.com",
+      "server_port": 443,
+      "password": "example-secret-2",
+      "method": "chacha20-ietf-poly1305"
+    }
+  ],
+  "x_shadowsocksx_ng": {
+    "schema_version": 1,
+    "root_group_id": "f6ad0a41-2a1d-4db8-9da0-b6f4f3dc889d",
+    "groups": [
+      {
+        "id": "f6ad0a41-2a1d-4db8-9da0-b6f4f3dc889d",
+        "name": "Example subscription",
+        "children": [
+          {
+            "type": "group",
+            "id": "a1e2b11c-2f53-4e39-bc36-95af6dbb5f1c"
+          },
+          {
+            "type": "server",
+            "id": "3c5e2af7-9f2c-4f42-bd1c-9e143d5f2d11"
+          }
+        ]
+      },
+      {
+        "id": "a1e2b11c-2f53-4e39-bc36-95af6dbb5f1c",
+        "name": "Japan",
+        "children": [
+          {
+            "type": "server",
+            "id": "b9f08d65-8be7-4b09-bf94-4f2bb53e4199"
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+### 字段语义
+
+| 字段 | 语义 | 兼容性要求 |
+| --- | --- | --- |
+| `version` | SIP-008 文档版本 | 固定为 `1`，不用于表示本扩展版本 |
+| `servers` | 完整扁平服务器列表 | 所有服务器必须仍是有效 SIP-008 服务器对象 |
+| `servers[].id` | SIP-008 服务器稳定 UUID | 扩展中的 `type: server` 引用必须指向它 |
+| `x_shadowsocksx_ng` | ShadowsocksX-NG 私有命名空间 | 未识别客户端可忽略；不能承载标准列表的唯一副本 |
+| `schema_version` | 私有扩展版本 | 初始值为 `1`；未知版本按扩展不可用处理 |
+| `root_group_id` | 唯一根分组 | 必须指向 `groups` 中的一个分组 |
+| `groups[].id` | 分组稳定身份 | 不使用名称或数组位置作为身份 |
+| `groups[].name` | 展示名称 | 可变，不参与身份匹配 |
+| `groups[].children` | 有序的分组/服务器引用 | 必须解析到现有 ID，且整棵树无环 |
+
+### 客户端校验与降级
+
+ShadowsocksX-NG 2.0 的扩展解析器应按以下顺序处理：
+
+1. 先按 SIP-008 解析并校验根 `version` 和 `servers`。
+2. 无论扩展是否存在，先建立根 `servers` 的扁平候选集。
+3. 只有 `schema_version` 支持、ID 唯一、引用完整、根存在且无环时，才建立嵌套树。
+4. 扩展失败时记录可诊断错误，并回退到同一响应中的扁平 `servers`；不能因为私有字段损坏而丢失标准服务器。
+5. 对于未被树引用但存在于 `servers` 的服务器，保留在一个本地“未分组”集合中，除非后续领域模型票据明确规定提供方必须做到严格一一引用。
+6. 下载到的密码只作为服务器配置数据处理；分组对象不得引入另一份密码、密钥或可执行内容。
+
+## 官方实现观察
+
+官方 `shadowsocks-rust` README 描述了扩展配置中的 `servers` 数组，并说明 `sslocal` 会依据延迟和可用性自动选择最佳服务器；这支持 ShadowsocksX-NG 在激活分组时把其后代服务器扁平化为 `shadowsocks-rust` 的多服务器配置。
+
+官方实现的配置模型 `SSConfig` 使用 `servers: Option<Vec<SSServerExtConfig>>`，服务器模型包含 `server`、`server_port`、`password`、`method`、`remarks`、`id` 等字段；这些结构派生 Serde 的 `Deserialize`，源码中没有为这些结构声明 `deny_unknown_fields`。因此，**对该实现而言**，根级未知扩展字段通常会被忽略；这是实现观察，不应扩大解释为所有 SIP-008 客户端都必须忽略未知字段。
+
+官方 `sslocal` 在线配置实现还会：
+
+- 检查 HTTP 状态为 200；
+- 检查 `Content-Type` 是否为 `application/json; charset=utf-8`；当前实现对缺失或不匹配的类型记录 warning，而不是在该检查处直接拒绝；
+- 将正文解析为在线配置，执行完整性检查，然后把在线服务器替换到在线配置来源的 balancer 中。
+
+因此，2.0 订阅实现应遵守 SIP-008 的规范要求，不能因为当前 `shadowsocks-rust` 对 Content-Type 采取 warning 行为，就把错误 Content-Type 当成协议上安全的输入。
+
+## 安全与兼容边界
+
+- **HTTPS 是要求，不是优化项。** 必须校验证书和 TLS 握手，不能为了“兼容订阅地址”忽略证书错误或降级到明文 HTTP。HTTP 仅适合明确的调试场景，并应向用户警告或拒绝。
+- **订阅 URL 仍然是敏感凭据。** SIP-008 建议在 URL 路径或查询参数中使用秘密以降低爬取风险；应用日志、错误信息和诊断报告不得无意记录完整订阅 URL。
+- **Content-Type 必须精确处理。** 服务端应发送 `application/json; charset=utf-8`；客户端可以容忍官方实现的实际 warning 行为，但 2.0 自己的服务端/测试应把它作为契约验证。
+- **扩展不改变凭据暴露面。** `password` 已在标准 `servers` 对象中，扩展只传 ID 和树关系；不要在分组中重复密码，不要把凭据放入 `name`、`id` 或其他可被 UI/日志展示的字段。
+- **自定义字段不可承载标准流量语义。** 流量计量必须使用 SIP-008 的 `bytes_used` 和 `bytes_remaining`，不要另定义同义字段。
+- **未知扩展必须可忽略。** 普通客户端至少应能按标准 `servers` 工作；扩展感知客户端也必须在扩展失败时保留标准列表。
+
+## 是否需要公开扩展规范
+
+### 2.0 私有订阅：不是当前阻塞项
+
+如果订阅提供方与 ShadowsocksX-NG 2.0 是明确的控制方/消费方，`x_shadowsocksx_ng` 可以作为私有 SIP-008 自定义字段使用。实现前只需在本仓库维护版本化协议文档，固定：字段名、UUID 生命周期、树不变量、未知版本处理、扁平回退、HTTPS/Content-Type 和安全日志策略。
+
+### 对外互操作：需要公开规范
+
+以下任一条件成立时，应先发布公开的扩展规范，而不是继续依靠实现代码作为唯一契约：
+
+- 第三方订阅服务需要生成嵌套分组；
+- 其他客户端需要显示或激活相同分组；
+- 需要承诺跨版本的刷新合并和本地元数据保留；
+- 需要由多个实现独立验证同一订阅文档。
+
+这份公开文档不一定要成为新的 SIP，也不应冒充 SIP-008 官方字段；它可以是 ShadowsocksX-NG 的公开 vendor extension spec，并明确“未实现该扩展的客户端按 SIP-008 扁平列表处理”。若未来希望让多个独立项目采用，应再评估向 Shadowsocks SIP 流程提交正式提案的价值。
+
+## 对后续票据的边界
+
+- 本票据确定扩展 JSON 的兼容与安全边界，不决定订阅 URL 的本地 canonicalization、订阅身份、刷新合并和失败恢复；这些属于 wayfinder issue 9。
+- 本票据不决定密码是否进入 Keychain、临时配置文件权限和删除时机；这些属于 shadowsocks-rust 配置生命周期票据。
+- 本票据不修改 Legacy、XcodeGen 工程、SwiftUI UI 或生产实现。
diff --git a/docs/research/wayfinder-issue-6.md b/docs/research/wayfinder-issue-6.md
new file mode 100644
index 000000000..d201b5f32
--- /dev/null
+++ b/docs/research/wayfinder-issue-6.md
@@ -0,0 +1,304 @@
+# Wayfinder Issue 6：XcodeGen、SwiftPM 与外部二进制打包发布
+
+- 票据：[研究：XcodeGen、SwiftPM 与外部二进制打包发布](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/6)
+- 父地图：[Wayfinder: ShadowsocksX-NG 2.0 现代化重实现](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/1)
+- 研究日期：2026-09-20
+- 适用范围：macOS 15+、arm64、ShadowsocksX-NG 2.0、外部 `shadowsocks-rust` 可执行文件
+
+## 决策摘要
+
+1. **不在本仓库构建 `shadowsocks-rust` 源码，也不把它作为 SwiftPM 源码依赖。** 采用 `shadowsocks-rust` 官方 GitHub Release 的 `aarch64-apple-darwin` 归档；仓库只保存版本、下载地址、归档 SHA-256 和要提取的二进制名称，构建/CI 在 XcodeGen 生成前下载并校验归档。
+2. **在 XcodeGen 中把 `sslocal` 表示为一个待复制的文件，而不是 SwiftPM target。** 将它放入 app bundle 的 `Contents/Helpers/sslocal`，使用 XcodeGen 的 `sources` 文件项和 `copyFiles` build phase；不要把 Mach-O 可执行文件放进 `Contents/Resources`。
+3. **先签内部 helper，再由 Xcode 签外层 app。** 在 Xcode 的最后一个构建脚本阶段调用 `codesign` 为 `sslocal` 使用 Developer ID Application、secure timestamp、Hardened Runtime 和独立的 code-signing identifier；随后让 Xcode 完成 app 签名。不要用 `codesign --deep` 作为签名方案，`--deep` 只用于递归验证。
+4. **校验对象是官方归档，而不是签名后的 `sslocal` 文件。** 先验证官方 `.tar.xz` 的 SHA-256，再解压并检查目标文件是 arm64、版本符合预期。重新签名会改变文件内容，因此不能在签名后继续拿官方归档哈希比较。
+5. **CI 分两层验证：** 普通 CI 做下载、哈希、归档内容、架构、版本、XcodeGen 和未/开发签名构建检查；受保护的 macOS arm64 发布任务做 Developer ID 签名、archive、Gatekeeper 风格验证、公证、staple 和最终包验证。
+
+## 1. 官方发布物事实
+
+### 1.1 选择的官方资产
+
+`shadowsocks-rust` README 将 GitHub Releases 作为静态链接构建的下载位置，并明确列出 macOS 目标 `aarch64-apple-darwin`。来源：
+
+- [shadowsocks-rust README：Download release](https://github.com/shadowsocks/shadowsocks-rust/blob/master/README.md#download-release)
+- [shadowsocks-rust 官方 Releases](https://github.com/shadowsocks/shadowsocks-rust/releases)
+- [v1.25.0 官方 Release](https://github.com/shadowsocks/shadowsocks-rust/releases/tag/v1.25.0)
+- [v1.25.0 官方 Release API](https://api.github.com/repos/shadowsocks/shadowsocks-rust/releases/tags/v1.25.0)
+
+截至本研究日，适用于本项目的资产是：
+
+```text
+release:       v1.25.0
+asset:         shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz
+target:        aarch64-apple-darwin
+archive sha256:58e0caf0cc9266c4ea226f38aa20fb28c1be12efc87a73cf5903197867555208
+asset URL:     https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.25.0/shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz
+checksum URL:  https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.25.0/shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz.sha256
+```
+
+官方配套 checksum 文件的内容是：
+
+```text
+58e0caf0cc9266c4ea226f38aa20fb28c1be12efc87a73cf5903197867555208  shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz
+```
+
+本地对该 Release 归档做了独立核验，结果如下：
+
+```text
+归档内容：sslocal、ssserver、ssurl、ssmanager、ssservice
+sslocal：Mach-O 64-bit executable arm64
+lipo -archs：arm64
+sslocal --version：shadowsocks 1.25.0
+归档 SHA-256：58e0caf0cc9266c4ea226f38aa20fb28c1be12efc87a73cf5903197867555208
+```
+
+这些结果是对当前 Release 的构建输入核验，不应把 `v1.25.0` 永久写死为“最新版本”。升级时必须通过一次显式依赖更新，连同新的 Release URL、归档哈希和验证结果一起变更。
+
+### 1.2 官方归档签名不是本项目发布签名
+
+当前 `v1.25.0` 归档中的 `sslocal` 可执行文件可以看到 ad-hoc/linker-signed 的 Mach-O 签名，没有 Developer ID team identity。它不能直接作为 ShadowsocksX-NG 的最终发布签名。发布流程必须在归档哈希校验之后、app 外层签名之前重新签署该 helper。
+
+这也解释了为什么“下载官方构建文件”和“由 ShadowsocksX-NG 对最终产品负责签名”是两个独立步骤：前者验证来源物的字节完整性，后者让 macOS Gatekeeper 和 Apple notarization 识别最终分发者。
+
+## 2. XcodeGen 工程落点
+
+### 2.1 推荐的目录和生成顺序
+
+建议把外部构建输入与应用源代码分开：
+
+```text
+ShadowsocksX-NG2/
+  project.yml
+  Sources/
+  Scripts/
+    fetch-shadowsocks-rust.sh
+    sign-embedded-helpers.sh
+  Vendor/
+    shadowsocks-rust/
+      manifest.json       # 版本、target、URL、归档 SHA-256、binary 名称
+      sslocal             # 下载/解压后生成；是否提交二进制由后续发布策略决定
+```
+
+更推荐将 `sslocal` 放到明确的构建产物目录，例如 `BuildArtifacts/shadowsocks-rust/sslocal`，而不是把一个未校验的二进制直接提交到源码树。关键约束是：
+
+- `fetch-shadowsocks-rust.sh` 只下载 Release 资产，不 checkout 或编译 `shadowsocks-rust` 源码。
+- 下载后先校验归档 SHA-256，再在隔离临时目录解压，只复制预期的 `sslocal`。
+- `xcodegen generate` 在依赖获取/校验成功后执行；不要让 XcodeGen 在没有输入时静默生成一个缺少代理核心的 app。
+- `manifest.json` 是变更审查入口；不能使用 `latest` URL，也不能根据运行时网络内容替换 app bundle 中的 helper。
+
+### 2.2 XcodeGen 表达方式
+
+XcodeGen 官方 `ProjectSpec` 将文件项的 `buildPhase` 支持为 `sources`、`resources`、`copyFiles` 或 `none`，而 `copyFiles` 支持 `wrapper` 目标和 `subpath`。因此可以用类似下面的工程描述表达外部 helper：
+
+```yaml
+targets:
+  ShadowsocksX-NG:
+    type: application
+    platform: macOS
+    sources:
+      - path: Sources
+      - path: BuildArtifacts/shadowsocks-rust/sslocal
+        type: file
+        buildPhase:
+          copyFiles:
+            destination: wrapper
+            subpath: Helpers
+    postBuildScripts:
+      - path: Scripts/sign-embedded-helpers.sh
+        name: Sign embedded shadowsocks-rust helper
+        inputFiles:
+          - $(BUILT_PRODUCTS_DIR)/$(CONTENTS_FOLDER_PATH)/Helpers/sslocal
+```
+
+这会把文件复制到 app bundle 的 `Contents/Helpers/sslocal`。`type: file` 是必要的意图声明：该路径是一个文件，不是 Swift 源目录或 folder reference。实际 `project.yml` 仍需按新工程的 target 名称、构建配置和签名设置调整。
+
+来源：[XcodeGen Project Specification：Sources / buildPhase / Copy Files](https://github.com/yonaskolb/XcodeGen/blob/master/Docs/ProjectSpec.md#sources)。XcodeGen 项目本身说明，YAML/JSON project spec 是生成 Xcode project 的单一描述来源：[XcodeGen README](https://github.com/yonaskolb/XcodeGen)。
+
+### 2.3 为什么选择 `Contents/Helpers`
+
+Apple TN2206 将 `Contents/Helpers` 和 `Contents/MacOS` 列为 bundle 中 helper apps/tools 的标准 code 位置，并提醒代码和普通资源必须放在正确的位置。它还特别建议把脚本和其他非 Mach-O 可执行文件放进 `Contents/Resources`，原因是非 Mach-O 签名可能依赖 extended attributes；当前 `sslocal` 是 Mach-O，因此应按嵌套代码放在 `Contents/Helpers`，而不是当作普通资源处理。
+
+来源：[TN2206：Nested Code](https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS10003709-CH1-SUBSECTION13)。
+
+这个位置也让 Swift 端的运行时路径明确：通过 app bundle 的 `Contents/Helpers/sslocal` 定位 helper，并且在启动服务前对该固定路径做存在性、架构和签名检查。不要在首次运行时下载或替换 bundle 内的可执行文件；Apple 明确要求签名后的 bundle 按只读内容处理。
+
+## 3. SwiftPM 的边界
+
+SwiftPM 确实支持：
+
+```swift
+.binaryTarget(
+    name: "SomeBinary",
+    url: "https://example.com/SomeBinary.zip",
+    checksum: "..."
+)
+```
+
+并要求使用 `swift package compute-checksum` 计算远程二进制归档的 SHA-256。来源：
+
+- [Apple PackageDescription `Target`](https://developer.apple.com/documentation/packagedescription/target)
+- [Apple PackageDescription `Target.checksum`](https://developer.apple.com/documentation/packagedescription/target/checksum)
+- [Swift Package Manager：Adding Dependencies / Precompiled Binary Targets](https://github.com/swiftlang/swift-package-manager/blob/main/Sources/PackageManagerDocs/Documentation.docc/Dependencies/AddingDependencies.md#precompiled-binary-targets-for-apple-platforms)
+- [SE-0272：Package Manager Binary Dependencies](https://github.com/swiftlang/swift-evolution/blob/main/proposals/0272-swiftpm-binary-dependencies.md)
+
+但本项目的 `sslocal` 是由 GUI 作为独立进程启动的命令行工具，不是被 Swift 编译器链接或 `import` 的 framework/module。官方 Release 是包含多个独立可执行文件的 `.tar.xz`，而不是供 SwiftPM 直接链接的 Swift binary target。将它包装成 SwiftPM binary target 会引入一个与进程生命周期无关的额外包层，并不能替代 app bundle 的嵌套代码签名。
+
+因此本票据的决定是：
+
+- SwiftPM 只管理真正被 Swift/Xcode 使用的库依赖。
+- `sslocal` 走“固定 Release 资产 + SHA-256 校验 + XcodeGen Copy Files + 自定义签名脚本”路径。
+- 如果未来要以 SwiftPM 分发某个可链接二进制，才使用 `.binaryTarget` 和 SwiftPM checksum；不要为了形式上的“二进制依赖”把 `sslocal` 塞入 SwiftPM。
+
+## 4. 签名顺序和命令约束
+
+### 4.1 签名顺序
+
+推荐顺序如下：
+
+```text
+官方归档
+  -> 校验 archive SHA-256
+  -> 解压并检查 sslocal
+  -> 复制到 Contents/Helpers/sslocal
+  -> 签名 sslocal（最内层）
+  -> Xcode 签名 ShadowsocksX-NG.app（外层）
+  -> 打包 DMG/ZIP
+  -> 公证并 staple 分发物
+```
+
+Apple 说明，嵌套代码在外层签名时已经必须正确签名；Xcode 的正常流程是从最内层向外层签名。Apple 也明确说，`codesign --deep` 适合验证嵌套代码，不推荐用它代替逐层签名。
+
+来源：
+
+- [TN2206：Nested Code](https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS10003709-CH1-SUBSECTION13)
+- [TN2206：Using the `codesign` Tool’s `--deep` Option Correctly](https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS10003709-CH1-SUBSECTION21)
+- [Apple：Creating distribution-signed code for macOS](https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac/)
+
+### 4.2 helper 的签名参数
+
+发布配置的签名脚本应等价于下面的意图：
+
+```sh
+codesign \
+  --force \
+  --sign "$EXPANDED_CODE_SIGN_IDENTITY" \
+  --timestamp \
+  --options runtime \
+  --identifier "${PRODUCT_BUNDLE_IDENTIFIER}.sslocal" \
+  "$BUILT_PRODUCTS_DIR/$CONTENTS_FOLDER_PATH/Helpers/sslocal"
+```
+
+注意事项：
+
+- 使用 `Developer ID Application` 身份，而不是开发证书、ad-hoc 或 Mac App Store 的其他分发身份。
+- `--timestamp` 添加 secure timestamp；Apple 的自定义签名示例也使用该选项。
+- `--options runtime` 为命令行 helper 启用 Hardened Runtime；如果将来需要例外能力，必须逐项评估并加入最小 entitlement。
+- `--identifier` 为无 bundle 的 helper 提供稳定的 code-signing identifier，例如 `com.qiuyuzhou.ShadowsocksX-NG.sslocal`。
+- 不使用 `sudo codesign`；Apple 文档指出签名过程依赖当前用户的 Keychain 和签名环境。
+- 该脚本只能签内部 helper，不应在它之后修改 app bundle；外层 app 由 Xcode 在所有构建阶段完成后签名。
+
+来源：[Apple：Creating distribution-signed code for macOS](https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac/)、[Apple：Hardened Runtime](https://developer.apple.com/documentation/security/hardened-runtime)、[Apple：Notarizing macOS software before distribution](https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution)。
+
+## 5. 版本和 SHA-256 策略
+
+### 5.1 版本清单
+
+建议提交一个可审查的清单，例如：
+
+```json
+{
+  "project": "shadowsocks-rust",
+  "release": "v1.25.0",
+  "target": "aarch64-apple-darwin",
+  "asset": "shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz",
+  "url": "https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.25.0/shadowsocks-v1.25.0.aarch64-apple-darwin.tar.xz",
+  "archiveSHA256": "58e0caf0cc9266c4ea226f38aa20fb28c1be12efc87a73cf5903197867555208",
+  "binary": "sslocal"
+}
+```
+
+这个版本号与 ShadowsocksX-NG 自己的 `2.0` app 版本分开：
+
+- `CFBundleShortVersionString` / `CFBundleVersion` 表示 ShadowsocksX-NG 产品版本。
+- 清单中的 `release` 表示代理核心的上游版本。
+- 可以把上游版本写入 About/diagnostics 或只作为构建元数据，但不能让 app 的产品版本随着上游版本隐式变化。
+
+### 5.2 校验时机
+
+构建脚本应在解压前做归档校验，概念上等价于：
+
+```sh
+curl --fail --location --output "$archive" "$url"
+printf '%s  %s\n' "$archive_sha256" "$archive" | shasum --algorithm 256 --check -
+tar --list --xz --file "$archive"
+```
+
+同时下载并核对官方 `.sha256` companion asset 是有益的审计步骤，但构建本身仍应以版本控制中的期望哈希为准；否则“下载 checksum 文件后信任它”会把版本更新和校验值更新绑定在同一次网络请求中。升级 PR 应同时改变 release、asset、URL 和 `archiveSHA256`，并重新执行架构/版本测试。
+
+归档哈希与提取后的 `sslocal` 哈希有不同用途：
+
+- 归档哈希验证官方发布物整体没有被替换。
+- 提取后的二进制可额外记录 SHA-256 供诊断，但它在 `codesign` 重新签名后会改变，不能作为最终 app 内 helper 的发布校验值。
+- 重新签名后验证的是 Apple code signature、Team ID、Hardened Runtime、secure timestamp 以及外层 bundle 的资源封印。
+
+## 6. CI 与发布验证门槛
+
+### 6.1 普通 CI（不需要发布证书）
+
+每次修改清单、XcodeGen 配置或依赖获取脚本时至少执行：
+
+1. 确认 URL 是精确的 `shadowsocks/shadowsocks-rust` Release 资产，拒绝 `latest`、未经固定的 branch 或用户可编辑下载地址。
+2. 下载归档并用清单中的 SHA-256 校验；再用官方 `.sha256` 文件做独立报告。
+3. 在干净临时目录解压，只接受预期的 `sslocal` 文件；拒绝路径穿越和意外文件覆盖。
+4. 用 `file`/`lipo -archs` 确认结果是单一 `arm64`，不要把 `x86_64` 或 universal 资产混入仅 arm64 产品。
+5. 执行 `sslocal --version`，确认输出的上游版本与清单一致；检查 `otool -L`，确保没有缺失的第三方动态库。
+6. 运行 `xcodegen generate`，再用 `xcodebuild` 构建测试配置；检查生成的 app 中存在 `Contents/Helpers/sslocal`，并检查 app bundle identifier 仍为 `com.qiuyuzhou.ShadowsocksX-NG`。
+7. 对 CI 构建的 helper/app 做递归签名验证；如果是无证书的 PR 构建，至少验证 bundle 结构和脚本顺序，Developer ID 相关断言放到发布任务。
+
+### 6.2 Release job
+
+发布任务必须使用 macOS arm64 runner，并在受保护环境中提供签名与公证凭据：
+
+1. 重复执行清单、SHA-256、归档内容、架构和版本检查，不复用未验证的普通 CI workspace。
+2. 通过 Xcode archive 生成 Release app；在 archive 的签名步骤中确认 helper 先签、app 后签。
+3. 使用 Apple 建议的递归检查：
+
+   ```sh
+   codesign --verify --deep --strict --verbose=2 ShadowsocksX-NG.app
+   spctl --assess --type exec --verbose=4 ShadowsocksX-NG.app
+   ```
+
+4. 用 `codesign --display --verbose=4` 检查 helper 和 app 的签名身份、Team ID、runtime option 和 secure timestamp；用 `lipo -archs` 再次确认最终 helper 仍是 arm64。
+5. 将 app 放进最终分发形态（通常是 DMG 或 ZIP）后，使用 `xcrun notarytool submit ... --wait` 提交；无论提交成功与否都读取 `notarytool log`，对错误失败，对 warning 做人工审查。
+6. 对可 staple 的 app/DMG 使用 `xcrun stapler staple` 和 `xcrun stapler validate`。Apple 明确说明不能直接对 ZIP staple；应先 staple ZIP 中的 app，再重新创建 ZIP。
+7. 最后对重新生成的分发物做哈希、签名、Gatekeeper 和启动冒烟测试；签名或 staple 之后不得再修改 app bundle。
+
+来源：
+
+- [Apple：Notarizing macOS software before distribution](https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution)
+- [Apple：Customizing the notarization workflow](https://developer.apple.com/documentation/security/customizing-the-notarization-workflow)
+- [Apple：Resolving common notarization issues](https://developer.apple.com/documentation/security/resolving-common-notarization-issues)
+- [TN2206：Checking Gatekeeper conformance](https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS10003709-CH1-SUBSECTION18)
+
+### 6.3 “不构建上游源代码”的 CI 证据
+
+CI 日志和脚本应能明确显示：
+
+- 输入是一个固定 Release URL 和固定 SHA-256；
+- 脚本执行的是下载、哈希校验、解压、架构/版本检查；
+- 没有 `cargo build`、上游源码 checkout 或本仓库内的 Rust 构建步骤；
+- 最终的本地构建只编译 SwiftUI GUI，并对下载的官方可执行文件执行复制和签名。
+
+这样既满足“使用源项目直接提供的构建好的文件”，又使依赖升级、供应链完整性和最终 Apple 发布签名分别可审查。
+
+## 7. 尚需后续票据决定的事项
+
+本票据只决定外部二进制的取得、表示、签名和发布验证，不决定以下内容：
+
+- `shadowsocks-rust` 配置文件中密码的生命周期和权限策略；
+- per-user `launchd` plist 的具体 label、重启策略和 GUI 退出语义；
+- 运行时是否为每次启动生成临时配置，以及配置文件删除时机；
+- 是否提交/缓存解压后的官方二进制，还是每次在构建前下载；
+- app 的 DMG/ZIP 制作工具和更新渠道。
+
+这些事项应由后续票据分别决定；它们不改变本票据关于“官方 Release 资产、固定 SHA-256、`Contents/Helpers`、内向外签名和 CI/公证门槛”的结论。
+
diff --git a/docs/research/wayfinder-issue-7-legacy-inventory.md b/docs/research/wayfinder-issue-7-legacy-inventory.md
new file mode 100644
index 000000000..14bf09925
--- /dev/null
+++ b/docs/research/wayfinder-issue-7-legacy-inventory.md
@@ -0,0 +1,117 @@
+# Wayfinder Issue 7：Legacy 配置迁移与旧版功能边界 — 事实盘点
+
+- 票据：决策：Legacy 配置迁移与旧版功能边界
+- 研究日期：2026-09-20
+- 范围：只读审计冻结的 `Legacy/` 源码、XIB、脚本和 README；不执行旧程序、不读取任何用户实际偏好文件，也不作产品或迁移决策。
+- 证据限界：以下是 Legacy 的历史实现事实，不是新实现的需求或技术规范。
+
+## 1. 应用拥有的 UserDefaults
+
+`applicationDidFinishLaunching` 中唯一的 `register(defaults:)` 调用注册了下列 21 个默认值。[AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L91-L114)
+
+| Key | 注册默认值 |
+| --- | --- |
+| `ShadowsocksOn` | `true` |
+| `ShadowsocksRunningMode` | `"auto"` |
+| `LocalSocks5.ListenPort` | `NSNumber(UInt16(1086))` |
+| `LocalSocks5.ListenAddress` | `"127.0.0.1"` |
+| `PacServer.BindToLocalhost` | `NSNumber(Bool(true))` |
+| `PacServer.ListenPort` | `NSNumber(UInt16(1089))` |
+| `LocalSocks5.Timeout` | `NSNumber(UInt(60))` |
+| `LocalSocks5.EnableUDPRelay` | `NSNumber(Bool(false))` |
+| `LocalSocks5.EnableVerboseMode` | `NSNumber(Bool(false))` |
+| `GFWListURL` | `"https://cdn.jsdelivr.net/gh/gfwlist/gfwlist/gfwlist.txt"` |
+| `AutoConfigureNetworkServices` | `NSNumber(Bool(true))` |
+| `LocalHTTP.ListenAddress` | `"127.0.0.1"` |
+| `LocalHTTP.ListenPort` | `NSNumber(UInt16(1087))` |
+| `LocalHTTPOn` | `true` |
+| `LocalHTTP.FollowGlobal` | `false` |
+| `ProxyExceptions` | `"127.0.0.1, localhost, 192.168.0.0/16, 10.0.0.0/8, FE80::/64, ::1, FD00::/8"` |
+| `ExternalPACURL` | `""` |
+| `EnableSwitchMode.PAC` | `true` |
+| `EnableSwitchMode.Global` | `true` |
+| `EnableSwitchMode.Manual` | `false` |
+| `EnableSwitchMode.ExternalPAC` | `false` |
+
+下列 key 被读写，但没有出现在这份注册默认值中：
+
+- `ServerProfiles` 是 Profile 字典数组，`ActiveServerProfileId` 是选中 Profile 的字符串 ID。[ServerProfileManager.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfileManager.swift#L18-L44)
+- `LocalSocks5.ListenAddress.Old` 和 `LocalSocks5.ListenPort.Old` 是 PAC 重生成的上次监听地址/端口缓存。[PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L20-L36)
+- `Proxy4NetworkServices` 是手选 System Configuration 网络服务 ID 的数组；未保存时 UI 使用空集合。[ProxyInterfacesViewCtrl.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyInterfacesViewCtrl.swift#L21-L32) [ProxyInterfacesViewCtrl.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyInterfacesViewCtrl.swift#L60-L74)
+- `LaunchAtLogin` 在 `SMLoginItemSetEnabled` 成功后写入；源中没有注册默认值。[LaunchAtLoginController.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAtLoginController.m#L43-L81)
+- `ToggleRunning` 与 `SwitchProxyMode` 是 `MASShortcutView` 的关联 defaults key，并由 MASShortcut 绑定；本应用源码未注册快捷键默认组合。[PreferencesWinController.xib](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Base.lproj/PreferencesWinController.xib#L36-L63) [ShortcutsController.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ShortcutsController.m#L16-L28)
+
+不确定性：这是一份应用源码层的 key 盘点；未实测某个用户的偏好域，也未审计 CocoaPods 内部可能持有的 framework 私有 key 或 MASShortcut 的序列化形状。
+
+## 2. ServerProfile 模型、UUID 与选中行为
+
+- 新建 `ServerProfile` 立即生成 `UUID().uuidString`；初始字段为 `serverHost = ""`、`serverPort = 8379`、`method = "aes-128-gcm"`，以及空的 `password`、`remark`、`plugin`、`pluginOptions`。空 `plugin` 表示禁用插件。[ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L12-L32)
+- 持久化字典字段精确为 `Id`、`ServerHost`、`ServerPort`、`Method`、`Password`、`Remark`、`Plugin`、`PluginOptions`。读取时前四个服务器字段和密码使用强制转换；缺少 `Id` 时会生成新 UUID。[ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L159-L198)
+- `ServerProfiles` 只写入 `isValid()` 的 Profile；有效性要求主机是 IPv4、IPv6 或匹配的域名，且密码非空。[ServerProfileManager.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfileManager.swift#L35-L49) [ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L233-L269)
+- `ActiveServerProfileId` 与 Profile 的 `uuid` 做精确字符串匹配；找不到匹配项时 `getActiveProfile()` 返回 `nil`。`setActiveProfiledId` 同时更新内存和 defaults。[ServerProfileManager.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfileManager.swift#L29-L33) [ServerProfileManager.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfileManager.swift#L64-L75)
+- `save()` 找不到活动 Profile 时只将内存 `activeProfileId` 置为 `nil`，该方法内没有移除或重写 `ActiveServerProfileId` 的 defaults 值。收到 `NOTIFY_SERVER_PROFILES_CHANGED` 后，应用仅在内存 ID 为 `nil` 且首个 Profile 有效时选择第一个 Profile 并写回 ID。[ServerProfileManager.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfileManager.swift#L35-L49) [AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L132-L145)
+- URL 导入由 `ServerProfile(url:)` 先调用默认构造器，再填充 URL 字段；`ss://` URL 输出也不包含 `Id`。因此该导入路径本身不携带原有 UUID。[ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L34-L144) [ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L295-L324)
+
+## 3. 迁移相关文件索引
+
+| 范围 | 主要历史证据 |
+| --- | --- |
+| 启动、默认值、运行模式、菜单动作 | [AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L76-L251)、[MainMenu.xib](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Base.lproj/MainMenu.xib#L32-L160) |
+| Profile schema、导入/导出、选中 ID | [ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L12-L324)、[ServerProfileManager.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfileManager.swift#L11-L104) |
+| PAC 规则文件、编译和 GFW List 下载 | [PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L12-L198)、[UserRulesController.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/UserRulesController.swift#L15-L52)、[abp.js](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/abp.js#L1-L22) |
+| 系统代理与本地 PAC 托管 | [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L103-L294)、[proxy_conf_helper/main.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/proxy_conf_helper/main.m#L45-L223) |
+| `ss-local`、Privoxy、插件安装和 launchd | [LaunchAgentUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L11-L202)、[LaunchAgentUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L281-L452)、各 `install_*.sh` 脚本 |
+| QR、文本/剪贴板导入与 Profile 分享 | [ImportWindowController.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ImportWindowController.swift#L11-L56)、[ShareServerProfilesWindowController.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ShareServerProfilesWindowController.swift#L47-L189)、[Utils.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Utils.m#L13-L199) |
+| 快捷键、登录启动、诊断 | [ShortcutsController.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ShortcutsController.m#L16-L28)、[LaunchAtLoginController.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAtLoginController.m#L43-L87)、[Diagnose.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Diagnose.swift#L28-L96) |
+
+## 4. 用户可见能力面（事实，不是保留范围）
+
+| 能力面 | Legacy 行为 | 证据 |
+| --- | --- | --- |
+| 内置 PAC 与 GFW List | 规则目录为 `~/.ShadowsocksX-NG/`，输入为 `gfwlist.txt` 和 `user-rule.txt`，输出为 `gfwlist.js`；首次可从 `~/.ShadowsocksX-NE/` 移动目录。编译时 Base64 解码 GFW List、将用户规则置前并去重、替换 JavaScript 模板的 SOCKS 地址/端口；更新动作通过 `GFWListURL` 下载并重编译。 | [PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L12-L17) [PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L51-L150) [PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L162-L198) |
+| PAC 用户规则 | 菜单有 “Edit User Rules For PAC...”；窗口读取/原子写入 `user-rule.txt`，随后调用 `GeneratePACFile()` 并发出成功或失败通知。 | [MainMenu.xib](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Base.lproj/MainMenu.xib#L111-L121) [UserRulesController.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/UserRulesController.swift#L15-L52) |
+| 自动 PAC 模式 | `ShadowsocksRunningMode == "auto"` 时启动本机 PAC server，并以 helper 的 `auto` 模式把 `http://localhost:<PacServer.ListenPort>/proxy.pac` 写入系统代理。server 只提供 `GET /proxy.pac`，MIME 为 `application/x-ns-proxy-autoconfig`，端口和是否绑定 localhost 来自 defaults。 | [AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L231-L250) [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L136-L153) [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L206-L253) |
+| 全局与手动模式 | `global` 调 helper 设置 SOCKS；启用 `LocalHTTPOn && LocalHTTP.FollowGlobal` 时一并传入 Privoxy 的 HTTP/HTTPS 地址和端口。`manual` 调 `disableProxy()`；README 描述它为不配置系统代理、由用户自行给应用配置 SOCKS5 的模式。 | [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L155-L193) [proxy_conf_helper/main.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/proxy_conf_helper/main.m#L154-L210) [README.md](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/README.md#L46-L49) |
+| 外部 PAC | `externalPAC` 将 `ExternalPACURL` 直接传给同一 helper 的 `auto` 模式；菜单仅在该值非空时启用。输入 formatter 允许空值或 `file`、`http`、`https` scheme。 | [AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L477-L503) [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L195-L221) [PACURLFormatter.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACURLFormatter.swift#L26-L52) |
+| 网络服务与例外项 | `AutoConfigureNetworkServices == false` 时，helper 接收 `Proxy4NetworkServices` 中的服务 ID；`ProxyExceptions` 按逗号、顿号、空白分割为多个 `-x` 参数。未手选服务时 helper 按 Wi-Fi/AirPort/Ethernet 判断。 | [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L103-L134) [ProxyInterfacesViewCtrl.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyInterfacesViewCtrl.swift#L21-L74) [proxy_conf_helper/main.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/proxy_conf_helper/main.m#L133-L170) |
+| 本地 HTTP/Privoxy | 安装/生成 `com.qiuyuzhou.shadowsocksX-NG.http` LaunchAgent；模板将 `{http}` 监听地址/端口和 `{socks5}` 替换后写入 `privoxy.config`，追加 `~/.ShadowsocksX-NG/user-privoxy.config`。仅在有活动 Profile 且 `LocalHTTPOn` 为真时启动。菜单可复制 `http_proxy` 和 `https_proxy` export 命令。 | [LaunchAgentUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L284-L317) [LaunchAgentUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L343-L452) [AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L411-L425) |
+| SIP003 插件 | Profile 含 `plugin` 与 `pluginOptions`；非空插件在 `ss-local` JSON 中写成 `plugins/<plugin>` 和 `plugin_opts`。安装脚本安装/链接 `simple-obfs`、`kcptun` adapter 和 `v2ray-plugin` 到应用支持目录的 `plugins/`。 | [ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L22-L24) [ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L201-L219) [install_simple_obfs.sh](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/simple-obfs/install_simple_obfs.sh#L7-L19) [install_kcptun.sh](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/kcptun/install_kcptun.sh#L9-L23) [install_v2ray_plugin.sh](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/v2ray-plugin/install_v2ray_plugin.sh#L17-L23) |
+| QR、URL 导入和分享 | 分享窗可复制单个 URL、二维码、全部 URL，保存二维码 GIF 或全部 URL 文本；二维码由 Profile 的 `ss://` URL 生成。导入窗口从剪贴板/文本行中接受 scheme 为 `ss` 的 URL。屏幕扫描先检查/请求屏幕录制权限，再扫描所有活动显示器的 QR，并只收集以 `ss://` 开头的消息。 | [ShareServerProfilesWindowController.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ShareServerProfilesWindowController.swift#L47-L132) [ShareServerProfilesWindowController.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ShareServerProfilesWindowController.swift#L171-L189) [ImportWindowController.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ImportWindowController.swift#L19-L55) [Utils.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Utils.m#L13-L47) [Utils.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Utils.m#L95-L159) [Info.plist](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Info.plist#L52-L53) |
+| 快捷键 | 两个 MASShortcut defaults key：`ToggleRunning` 发布运行开关通知，`SwitchProxyMode` 发布模式切换通知。模式切换按启用的 `EnableSwitchMode.*` 顺序循环，外部 PAC 还要求菜单当前可用。状态菜单另有运行开关和三种模式的 key equivalents，前十个动态 Profile 菜单项使用 `1` 至 `0`。 | [ShortcutsController.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ShortcutsController.m#L16-L28) [MainMenu.xib](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Base.lproj/MainMenu.xib#L37-L66) [AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L147-L199) [AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L591-L610) |
+| 登录时启动 | `LaunchAtLogin` 绑定到 `SMLoginItemSetEnabled`，helper bundle ID 为 `com.qiuyuzhou.ShadowsocksX-NG.LaunchHelper`；LaunchHelper 尝试在 `/Applications`、按名称、再按相对 bundle 路径启动主 app 后退出。 | [LaunchAtLoginController.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAtLoginController.m#L67-L87) [LaunchHelper AppDelegate.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/LaunchHelper/LaunchHelper/AppDelegate.m#L18-L35) |
+| 诊断和日志 | 菜单可打开 `~/Library/Logs/ss-local.log` 或将 `diagnose()` 输出写入用户选择的文本文件。诊断包含 Info.plist、列出的偏好、活动 Profile 的 `debugString()`、若干目录列表、监听端口、网卡和 launchctl 输出。 | [AppDelegate.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/AppDelegate.swift#L428-L465) [Diagnose.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Diagnose.swift#L28-L96) |
+
+README 也列出 SIP003 插件、GFW List PAC 更新、二维码/URL 分享、剪贴板导入、屏幕 QR 扫描、PAC 自定义规则和 Privoxy HTTP proxy；它同时说明 `ss-local` 通过 launchd 运行，退出 app 后仍可能继续运行。[README.md](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/README.md#L35-L49)
+
+## 5. 敏感字段与暴露位置
+
+| 字段/数据 | 源码中的位置和流向 | 明确边界 |
+| --- | --- | --- |
+| `Password`、服务器主机/端口、加密方法 | `ServerProfiles` 字典包含这些字段；活动 Profile 被 JSON 序列化为 `~/Library/Application Support/ShadowsocksX-NG/ss-local-config.json`。 | 源码显示直接 dictionary/JSON 序列化；本审计未对 macOS 实际文件权限或 UserDefaults 底层存储格式作实测。 |
+| Profile 分享 URL 与二维码 | `URL()` 对 `"<method>:<password>"` 进行 Base64 编码并组成 `ss://` URL；分享窗口把 URL 写入剪贴板/文本文件，或把它编码到 QR/GIF。 | URL 和二维码因包含该编码后的 user info 而属于凭据载体。 |
+| 屏幕扫描结果 | 每个发现的 QR `messageString` 会被 `NSLog`，并且以 `ss://` 开头的 URL 会进入导入通知。 | 日志是否被导出、保留多久或谁可访问，源码未说明。 |
+| `PluginOptions`、`ExternalPACURL`、`GFWListURL` | Plugin options 被写入 `ss-local` JSON；外部 PAC URL 传给 helper；GFW List URL 用于下载。 | 这些字段不一定含凭据，但其值可能含连接、路径或查询信息；是否敏感取决于具体值。 |
+
+对应一手证据：[ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L188-L219) [ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L295-L324) [LaunchAgentUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L133-L160) [ShareServerProfilesWindowController.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ShareServerProfilesWindowController.swift#L47-L132) [Utils.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Utils.m#L109-L118) [ProxyConfHelper.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ProxyConfHelper.m#L195-L221) [PACUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/PACUtils.swift#L172-L198)
+
+诊断对活动 Profile 的 `ServerHost` 与 `Password` 以同长度星号输出，但仍输出端口、method、plugin 和 `PluginOptions`；诊断偏好列表包含 `GFWListURL` 和代理例外项。[ServerProfile.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/ServerProfile.swift#L222-L230) [Diagnose.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/Diagnose.swift#L38-L70)
+
+## 6. 仅在 Legacy 中观察到的依赖/机制
+
+| Legacy 依赖或机制 | 已见用途 |
+| --- | --- |
+| CocoaPods：Alamofire、GCDWebServer、MASShortcut、RxSwift、RxCocoa、BRLOptionParser | 分别用于 GFW List 请求、本地 PAC server、全局快捷键、通知绑定，以及特权 helper 的命令行解析。 |
+| 打包二进制和安装脚本：`ss-local`、`privoxy`、`simple-obfs`、`kcptun`、`v2ray-plugin` | 脚本复制/链接到 `~/Library/Application Support/ShadowsocksX-NG/`，前两者使用 per-user LaunchAgent。README 标记 `ss-local` 为 shadowsocks-libev 3.2.5。 |
+| 特权 `proxy_conf_helper` | 安装到 `/Library/Application Support/ShadowsocksX-NG/`，脚本设置 `root:admin`、可执行和 setuid；helper 使用 Authorization 与 SystemConfiguration 写代理偏好。 |
+| `SMLoginItem` + `LaunchHelper.app` | 登录时启动依赖辅助 app 和 `SMLoginItemSetEnabled`。 |
+
+对应证据：[Podfile](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/Podfile#L3-L27) [LaunchAgentUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L31-L83) [LaunchAgentUtils.swift](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/LaunchAgentUtils.swift#L284-L378) [install_helper.sh](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/ShadowsocksX-NG/install_helper.sh#L10-L14) [proxy_conf_helper/main.m](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/proxy_conf_helper/main.m#L105-L218) [README.md](https://github.com/shadowsocks/ShadowsocksX-NG/blob/legacy-v1/README.md#L35-L49)
+
+“仅在 Legacy 中观察到”只描述本次审计范围内的实现构成；本报告没有审计或断言新实现是否使用、替换或保留其中任一依赖。
+
+## 7. 未由静态资料确定的事项
+
+- 没有运行 Legacy，因此没有证据证明上述旧二进制、脚本、权限请求、launchd job 或系统代理修改在当前 macOS 上仍可成功执行。
+- 没有实际偏好域样本，因此无法从源码外确认历史用户是否存在遗漏字段、错误类型、重复 UUID 或已失效的 `ActiveServerProfileId`。
+- 没有对外部 PAC、GFW List 或插件二进制进行联网或内容验证；本报告仅记录代码如何引用它们。
+- 源码没有定义新实现的配置映射、兼容承诺、弃用策略或安全存储方案；这些均不在本次事实盘点的结论内。
diff --git a/docs/rule-snapshots.md b/docs/rule-snapshots.md
new file mode 100644
index 000000000..c34fef544
--- /dev/null
+++ b/docs/rule-snapshots.md
@@ -0,0 +1,19 @@
+# Bundled Rule Snapshots
+
+[Project home](../ShadowsocksX-NG2/README.md) | [简体中文](rule-snapshots.zh.md)
+
+Bundled snapshots used by rule mode are explicitly maintained artifacts:
+
+- **geolocation-cn**: after manually reviewing the upstream source, run `Scripts/update-geolocation-cn.sh`. It parses typed entries from the pinned `geosite.dat` release of [Loyalsoldier/domain-list-custom](https://github.com/Loyalsoldier/domain-list-custom) and generates `Vendor/rules/geolocation-cn/snapshot.json`.
+- **china-ipv4**: run `Scripts/update-china-ipv4.sh` to normalize and deduplicate IPv4 CIDRs from the pinned `china.txt` version of [gaoyifan/china-operator-ip](https://github.com/gaoyifan/china-operator-ip), generating `Vendor/rules/china-ipv4/snapshot.json`.
+- **gfwlist**: run `Scripts/update-gfwlist.sh` to decode the official Base64 AutoProxy list from a pinned `gfwlist.txt` version of [gfwlist/gfwlist](https://github.com/gfwlist/gfwlist), generating `Vendor/rules/gfwlist/snapshot.json`. `||host` and `||host^` are converted to domain-suffix matches. A `|scheme://host` rule (optionally with a valid port) is converted to an exact-domain match when its path is empty or `/`, it has no query, fragment, or user information, and its host is a valid domain without wildcards; the scheme and port are ignored. Only a root path is eligible; rules with a specific path are skipped. `@@` retains the direct-routing action. Other URL prefixes, paths, wildcards, regular expressions, single-label prefixes, and IP-literal rules are counted by category in the loss report. A `@@` exception completely covered by proxy rules is not written as an ineffective ACL entry (`sslocal` domain matching gives `proxy_list` priority over `bypass_list`). The proxy rule is retained, and the number of shadowed exceptions is included only in `absorbedCount`. The maintenance script prints per-rule evidence to stdout.
+
+Snapshots use compact JSON with schema 2 / converter 2.0.0: each rule has only `action` and `match`; the source appears only in `metadata.source`; the conversion report retains counts only. Absorbed `.cn` entries and shadowed GFWList exceptions are not distributed in the snapshot and are not restored after a broad rule is disabled. See [ADR-0024](adr/0024-snapshot-drops-absorbed-and-forensics.md). Older snapshot versions are rejected.
+
+Domain values and file DTOs for rules evolve independently. `ProxyRule` represents both a normalized rule value and rule identity across sources; custom entries also retain a UUID. Custom-rule files use schema 4 and do not store `source` per rule. Each rule scheme fixes the matched and unmatched actions; custom-rule creation and editing show the matched action as read-only. Schema 1–3 documents remain readable: loading a scheme removes custom rules whose action equals its unmatched action, retaining the remaining UUIDs, order, and all disablement records. Reading leaves the original file intact; the next normal save writes schema 4. Schema 4 documents with reverse-action custom rules are rejected. Older clients cannot read schema 4. **Migration can change routing:** an old custom direct IP exception in the China-proxy scheme may previously have overridden a built-in proxy range; after removal, that IP follows the scheme's proxy rule. Fixed local targets still bypass the proxy. The bundled snapshot format is unchanged. See [ADR-0039](adr/0039-rule-values-and-independent-storage-models.md) and [ADR-0055](adr/0055-preset-owned-custom-rule-actions.md).
+
+Python is the only upstream conversion implementation. Swift loads, validates, and consumes snapshots; it does not parse upstream input independently. Run the offline regression checks for conversion scripts with `PYTHONDONTWRITEBYTECODE=1 python3 Scripts/test-rule-snapshot-converters.py`. The default `task test` also runs both Python checks; run `task test:rules` for just these checks. Also run `PYTHONDONTWRITEBYTECODE=1 python3 Scripts/test-rule-conversion-behavior.py` to verify conversion behavior and the fixed snapshot fixtures used by the unit-test bundle. After reviewing a conversion change, add `--write-fixtures` to the same command to rebuild the fixtures. Fixture timestamps are fixed, and normal tests compare generated output byte for byte. Check snapshot integrity with `Scripts/verify-rule-snapshots.sh`.
+
+If an update fails, the previous valid snapshot is kept. geolocation-cn conversion fails on unknown syntax or corrupted input. china-ipv4 conversion also fails on abnormal formats (when too many lines are rejected), when all entries are invalid, or when the snapshot size changes abnormally compared with the previous version. gfwlist conversion fails on unknown syntax, corrupted Base64, abnormal size, or an abnormal size change compared with the previous version. Normal builds run `Scripts/verify-rule-snapshots.sh` offline to check that snapshots exist, their digests match, and schema/converter versions agree; missing or corrupted snapshots fail the build. Distributed artifacts must include each source's `NOTICE` (license and attribution).
+
+In rule mode, “proxy when unmatched” generates a `proxy_all` ACL containing both Chinese-domain and Chinese IPv4-CIDR direct-routing candidates, with fixed local bypass taking priority. “Direct when unmatched” generates a `bypass_all` ACL containing only effective GFWList proxy candidates. The two default actions do not unconditionally union all bundled sources. Unmatched destinations and IP literals that match no available rule go direct. **CIDR checks may trigger local DNS queries:** when matching an unmatched domain by IP, sslocal may perform a local DNS query. The product does not promise that all DNS queries travel through the remote Shadowsocks server.
diff --git a/docs/rule-snapshots.zh.md b/docs/rule-snapshots.zh.md
new file mode 100644
index 000000000..387f1c630
--- /dev/null
+++ b/docs/rule-snapshots.zh.md
@@ -0,0 +1,21 @@
+# 内置规则快照
+
+[English](rule-snapshots.md) | [返回工程首页](../ShadowsocksX-NG2/README.zh.md)
+
+除特别说明外，命令从 `ShadowsocksX-NG2/` 执行，文中工程路径也相对于该目录。
+
+规则模式使用的内置快照是显式维护产物：
+
+- **geolocation-cn**：人工复验上游后运行 `Scripts/update-geolocation-cn.sh`，从固定版 [Loyalsoldier/domain-list-custom](https://github.com/Loyalsoldier/domain-list-custom) `geosite.dat` 解析 typed 条目并生成 `Vendor/rules/geolocation-cn/snapshot.json`。
+- **china-ipv4**：运行 `Scripts/update-china-ipv4.sh`，从固定版 [gaoyifan/china-operator-ip](https://github.com/gaoyifan/china-operator-ip) `china.txt` 规范化并去重 IPv4 CIDR，生成 `Vendor/rules/china-ipv4/snapshot.json`。
+- **gfwlist**：运行 `Scripts/update-gfwlist.sh`，从固定版 [gfwlist/gfwlist](https://github.com/gfwlist/gfwlist) `gfwlist.txt` 解码官方 Base64 AutoProxy 列表并生成 `Vendor/rules/gfwlist/snapshot.json`。`||host` / `||host^` 转换为域名后缀匹配；`|scheme://host`（可含合法端口）在路径为空或仅为 `/`，无查询、fragment 或用户信息，且 host 为无通配符的合法域名时，提取 host 转换为精确域名匹配，忽略协议和端口。仅含根路径 `/` 可转换，包含具体路径的规则继续跳过。`@@` 保留直连动作。其他 URL 前缀、路径、通配符、正则、单标签前缀与 IP 字面量规则逐类计入损失报告。被代理规则完全覆盖的 `@@` 例外不写入无效 ACL 项（sslocal 域名匹配 proxy_list 优先于 bypass_list），保留代理规则，遮蔽数只计入 `absorbedCount`；逐条取证输出到维护脚本 stdout。
+
+快照使用 schema 2 / converter 2.0.0 的紧凑 JSON：每条规则只有 `action` 和 `match`，来源只在 `metadata.source`，转换报告只保留计数。被吸收的 `.cn` 条目与被遮蔽的 GFWList 例外不随快照分发，禁用宽规则后不再恢复；详见 [ADR-0024](adr/0024-snapshot-drops-absorbed-and-forensics.md)。旧版本快照拒载。
+
+规则领域值与文件 DTO 独立演化。`ProxyRule` 同时表达规范化规则值与跨来源规则身份，自定义条目另外保留 UUID。自定义规则文件写入 schema 4，不逐条保存 `source`。每项规则方案固定匹配后行动与未匹配行动，新增和编辑自定义规则时只读展示所属方案的匹配后行动。兼容读取 schema 1–3：加载方案时移除行动等于未匹配行动的自定义规则，保留剩余条目的 UUID、顺序和全部停用记录；读取不重写原文件，下一次正常保存才写入 schema 4。schema 4 文档包含反向行动时拒载，旧客户端不能读取 schema 4。**迁移可能改变路由**：“中国大陆目标代理”方案中，旧自定义直连 IP 例外可能曾覆盖内置代理网段，移除后该 IP 按方案规则代理。固定本地目标仍始终直连。内置快照格式不变。见 [ADR-0039](adr/0039-rule-values-and-independent-storage-models.md) 和 [ADR-0055](adr/0055-preset-owned-custom-rule-actions.md)。
+
+Python 是唯一的上游转换实现；Swift 只加载、校验并消费快照，不另行解析上游输入。转换脚本的离线回归检查：`PYTHONDONTWRITEBYTECODE=1 python3 Scripts/test-rule-snapshot-converters.py`。默认 `task test` 也会运行两组 Python 检查；可单独运行 `task test:rules`。另运行 `PYTHONDONTWRITEBYTECODE=1 python3 Scripts/test-rule-conversion-behavior.py`，验证转换行为和单测 bundle 使用的固定快照夹具。审查转换变化后，可通过同一命令加 `--write-fixtures` 重建夹具。夹具时间固定，正常测试逐字节检查生成结果。快照完整性检查：`Scripts/verify-rule-snapshots.sh`。
+
+更新失败保留上一份有效快照。geolocation-cn 转换会因未知语法/损坏输入失败；china-ipv4 转换还会因异常格式（拒绝率过高）、全部失效或相对上一份快照的异常规模变化失败；gfwlist 转换因未知语法、损坏 Base64、异常规模或相对上一份快照的异常规模变化失败。普通构建由 `Scripts/verify-rule-snapshots.sh` 离线校验快照存在、摘要匹配且 schema/转换器版本一致，缺失或损坏即构建失败。分发物必须携带各自的 `NOTICE`（许可证与归属）。
+
+规则模式「未匹配时代理」生成的 `proxy_all` ACL 同时包含中国域名与中国 IPv4 CIDR 直连候选，固定本地绕过优先。规则模式「未匹配时直连」生成的 `bypass_all` ACL 只编入 GFWList 可生效代理候选；两种默认动作不把全部内置来源无条件并集。未匹配目标与无可用规则命中的 IP 字面目标直连。**CIDR 判定可能触发本地 DNS 查询**：sslocal 为未命中域名做 IP 匹配时可能发起本地 DNS 查询，产品不承诺 DNS 查询均经远端 Shadowsocks 服务器。
diff --git a/docs/server-library-encryption-format.md b/docs/server-library-encryption-format.md
new file mode 100644
index 000000000..2b634e0a5
--- /dev/null
+++ b/docs/server-library-encryption-format.md
@@ -0,0 +1,84 @@
+# Sensitive Configuration Encryption with age
+
+English | [简体中文](server-library-encryption-format.zh.md)
+
+The server library and proxy listening configuration use standard [age v1](https://age-encryption.org/v1) files through [AgeSwift](https://github.com/qiuyuzhou/AgeSwift). See [ADR-0050](adr/0050-age-encrypted-configuration-storage.md) for the decision and recovery boundaries.
+
+## Files and payloads
+
+Both files live in `~/Library/Application Support/ShadowsocksX-NG2/configuration/`:
+
+| File | Decrypted UTF-8 JSON | Maximum plaintext size |
+| --- | --- | --- |
+| `catalog.age` | Catalog schema v7: `version`, `rootChildren`, `entries`, `subscriptions`, `favoriteIDs` | 64 MiB |
+| `proxy-listening.age` | `{ "version": 1, "configuration": { "local": …, "lan": … } }` | 1 MiB |
+
+The server library contains the entire catalog, subscriptions and ordered favorites, including server passwords, complete plugin options and subscription URLs in their owning records. Listener credentials belong to the separate listening configuration. Runtime JSON, LAN authentication sidecars, user exports and sharing are outside this format's scope.
+
+Writers produce binary age v1, with a single X25519 recipient and no application header, UUID prefix, sidecar index, outer Base64 layer or custom cryptographic container. Readers also accept standard ASCII armor. Saving an armored input writes binary age. JSON schema versions are inside the encrypted payload, independent of the age format version. Readers validate the complete decoded model before publishing it.
+
+An empty catalog payload is:
+
+```json
+{
+  "entries": [],
+  "favoriteIDs": [],
+  "rootChildren": [],
+  "subscriptions": [],
+  "version": 7
+}
+```
+
+Catalog hierarchy and ordering come from `rootChildren` and group child arrays. Secrets remain ordinary record values, not credential references. Codable models define the full schema; whitespace and object key order carry no meaning.
+
+## Keychain identities
+
+Each store uses its own classic login Keychain Generic Password service:
+
+| File | Service |
+| --- | --- |
+| `catalog.age` | `com.qiuyuzhou.ShadowsocksX-NG2.server-library.age` |
+| `proxy-listening.age` | `com.qiuyuzhou.ShadowsocksX-NG2.proxy-listening.age` |
+
+Each account is a UUID; its value is the UTF-8 standard `AGE-SECRET-KEY-1...` identity, not raw AES bytes. Items do not synchronize and do not use the Data Protection Keychain. Creation grants access only to the current application through a classic Keychain ACL.
+
+The file contains no Keychain account locator. The reader enumerates accounts in the relevant service and tries identities until one decrypts the file. Inaccessible or unrelated candidates do not prevent an accessible matching identity from succeeding. Normal saves reuse the matched identity, cached in the current process. A confirmed reset stores and reads back a new identity before atomically replacing ciphertext; older identities remain available if the commit fails or the process exits midway. Records therefore grow with resets. Identity cleanup and manual rotation are not provided.
+
+Startup/background reads do not request authorization UI. Existing explicit application interaction controls remain in force. Losing a matching identity prevents decryption; changing the file format does not bypass Keychain authorization or provide independent recovery.
+
+## Inspect with standard tools
+
+Install the reference CLI with `brew install age`. In Keychain Access, search for the exact service above and inspect the account UUIDs. Use the system `security` tool to retrieve an identity after system authorization. Replace `ACCOUNT_UUID`; repeat with other accounts into the same identity file if the service contains several identities.
+
+```bash
+umask 077
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+security find-generic-password \
+  -s com.qiuyuzhou.ShadowsocksX-NG2.server-library.age \
+  -a ACCOUNT_UUID -w >> "$workdir/identities.txt"
+age --decrypt -i "$workdir/identities.txt" \
+  "$HOME/Library/Application Support/ShadowsocksX-NG2/configuration/catalog.age" | jq .
+```
+
+For listening configuration, substitute its service and `proxy-listening.age`. Choose one-time authorization when prompted; do not broaden the application's ACL. The identity file is a secret and the output contains configuration credentials. These commands deliberately export a temporary identity for maintenance; the application never writes identities to ordinary files, logs or diagnostic reports. Removal does not promise secure erasure.
+
+Standard age tools can also encrypt JSON to the corresponding `age1...` recipient. Such a file still has to satisfy the application's schema and size checks. Quit the GUI before manually replacing a persistent configuration, since the running app holds committed data in memory. No application-specific decryptor or private-key export UI is required.
+
+## Reads, writes and recovery
+
+Reads limit encoded file size before decryption, accounting for age chunk tags, header allowance and armor overhead; plaintext is checked against its original limit after decryption. Invalid age data, missing identities, authentication failures and invalid JSON fail loading. There is no plaintext fallback or automatic replacement with defaults.
+
+Writes encode and validate the entire value, encrypt in memory, then atomically replace the destination with a ciphertext-only temporary file in the same directory. Directories use `0700`; temporary and destination files use `0600`. The current writer does not explicitly `fsync`, so atomic replacement does not promise power-loss durability. Application state is published only after successful persistence.
+
+The `.age` file takes precedence when present. If absent, an existing corresponding `.enc` or legacy `.json` file causes an unsupported-format error, not fresh initialization. NG2 historical formats are not migrated, read, deleted or used as fallback; old AES and per-item Keychain records are not accessed or cleaned up. A confirmed reset creates the new `.age` file and leaves historical files untouched.
+
+The server library retains retry/unlock and confirmed empty-library creation. Listening configuration retains its startup gate and confirmed reset to defaults with LAN listening disabled. Loading failure or failed reset preserves existing files and running proxy/system-proxy state. The user-initiated legacy ShadowsocksX-NG import remains available.
+
+## Verification and limitations
+
+`AgeConfigurationStorageTests` exercises standard age CLI decryption and encryption in binary and armor for both stores, historical-file rejection, candidate identity selection, failed reset commits, schema/size checks and an isolated real Keychain. The test requires `age` on PATH or in a Homebrew bin directory and an accessible login Keychain.
+
+age protects stored content; file size and timestamps remain visible. It does not provide rollback protection, safe memory erasure, cross-machine identity recovery or an independent password-encrypted backup. The application retains decrypted values and the matching identity until exit.
+
+Source entry points: [EncryptedFileStorage](../ShadowsocksX-NG2/Domain/Credentials/EncryptedFileStorage.swift), [MasterKeyStore](../ShadowsocksX-NG2/Domain/Credentials/MasterKeyStore.swift), [CatalogFileStore](../ShadowsocksX-NG2/Domain/Catalog/CatalogFileStore.swift), [ProxyListeningFileStore](../ShadowsocksX-NG2/Domain/Settings/ProxyListeningFileStore.swift), [AtomicFileWriter](../ShadowsocksX-NG2/Domain/Runtime/AtomicFileWriter.swift).
diff --git a/docs/server-library-encryption-format.zh.md b/docs/server-library-encryption-format.zh.md
new file mode 100644
index 000000000..f810ead9e
--- /dev/null
+++ b/docs/server-library-encryption-format.zh.md
@@ -0,0 +1,84 @@
+# 使用 age 加密敏感配置
+
+[English](server-library-encryption-format.md) | 简体中文
+
+服务器库和代理监听配置通过 [AgeSwift](https://github.com/qiuyuzhou/AgeSwift) 使用标准 [age v1 文件格式](https://age-encryption.org/v1)。采用理由与恢复边界见 [ADR-0050](adr/0050-age-encrypted-configuration-storage.md)。
+
+## 文件与载荷
+
+两个文件均位于 `~/Library/Application Support/ShadowsocksX-NG2/configuration/`：
+
+| 文件 | 解密后的 UTF-8 JSON | 明文大小上限 |
+| --- | --- | --- |
+| `catalog.age` | 目录 schema v7：`version`、`rootChildren`、`entries`、`subscriptions`、`favoriteIDs` | 64 MiB |
+| `proxy-listening.age` | `{ "version": 1, "configuration": { "local": …, "lan": … } }` | 1 MiB |
+
+服务器库包含完整配置目录、订阅与有序收藏；服务器密码、完整插件参数、订阅 URL 直接保存在所属记录中。监听认证资料属于独立监听配置。运行 JSON、LAN 认证文件、用户主动导出与分享不属于本格式的范围。
+
+保存使用单个 X25519 recipient 的二进制 age v1，不增加应用文件头、UUID 前缀、旁路索引、外层 Base64 或自研密码容器。读取也接受标准 ASCII armor；再次保存统一写二进制。JSON 结构版本位于加密载荷中，与 age 格式版本独立。完整模型通过校验后才发布。
+
+空服务器库的载荷为：
+
+```json
+{
+  "entries": [],
+  "favoriteIDs": [],
+  "rootChildren": [],
+  "subscriptions": [],
+  "version": 7
+}
+```
+
+目录层级与顺序以 `rootChildren` 和分组子节点数组为准。秘密是记录中的普通值，不是凭据引用。完整结构以 Codable 模型为准，空白与对象键顺序不影响语义。
+
+## Keychain identity
+
+两个存储分别使用经典登录钥匙串中的 Generic Password service：
+
+| 文件 | Service |
+| --- | --- |
+| `catalog.age` | `com.qiuyuzhou.ShadowsocksX-NG2.server-library.age` |
+| `proxy-listening.age` | `com.qiuyuzhou.ShadowsocksX-NG2.proxy-listening.age` |
+
+每条记录的 account 是 UUID，值为 UTF-8 编码的标准 `AGE-SECRET-KEY-1...` identity 文本，不是 AES 原始字节。记录不同步、不使用 Data Protection Keychain；创建时通过经典 Keychain ACL 仅授权当前应用。
+
+文件不包含 Keychain account 定位信息。读取器枚举对应 service 的 account，尝试 identity 直至成功。存在无法访问或不匹配的候选时，其他可访问且匹配的 identity 仍能正常解密。正常保存复用匹配的 identity，并在当前进程缓存。确认重置时，先保存并回读新 identity，再原子替换密文；保留旧 identity，使提交失败或进程中断时旧文件仍可读取。记录随重置次数增加，不提供自动清理或手动轮换。
+
+启动和后台读取不请求系统授权弹窗，继续沿用既有显式交互入口。丢失匹配 identity 后无法解密；更换格式不绕过 Keychain 授权，也不提供独立恢复能力。
+
+## 使用标准工具检查
+
+通过 `brew install age` 安装参考 CLI。在“钥匙串访问”中搜索上表完整 service，查看 account UUID。使用系统 `security` 工具，经系统授权后取得 identity。将 `ACCOUNT_UUID` 替换为实际账户；有多条记录时，可重复执行导出命令，把其他 identity 追加到同一个文件。
+
+```bash
+umask 077
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+security find-generic-password \
+  -s com.qiuyuzhou.ShadowsocksX-NG2.server-library.age \
+  -a ACCOUNT_UUID -w >> "$workdir/identities.txt"
+age --decrypt -i "$workdir/identities.txt" \
+  "$HOME/Library/Application Support/ShadowsocksX-NG2/configuration/catalog.age" | jq .
+```
+
+检查监听配置时，替换 service 和文件名为监听对应值。系统提示时选择单次授权，不放宽应用 ACL。identity 文件属于秘密，输出包含配置凭据。这些命令是维护者主动导出临时 identity 的调试操作；应用自身不向普通文件、日志或诊断报告写出 identity。删除临时文件不代表安全擦除。
+
+标准 age 工具也能用对应的 `age1...` recipient 加密 JSON；应用仍会检查结构和大小。手动替换持久配置前退出 GUI，避免运行中的应用使用内存已提交值覆盖人工修改。无需项目专用解密器或应用内私钥导出界面。
+
+## 读取、提交与恢复
+
+读取前限制文件大小，计入 age 分块标签、文件头余量和 armor 开销；解密后再次检查明文上限。age 格式错误、identity 不可用、认证失败或 JSON 校验失败都会导致加载失败，不回退明文，不自动用默认值覆盖。
+
+保存先编码并校验完整值，再在内存加密，使用同目录的纯密文临时文件原子替换目标。目录权限为 `0700`，临时文件和目标文件为 `0600`。当前写入器不显式调用 `fsync`，原子替换不保证断电持久性。成功保存后才发布应用内存状态。
+
+新 `.age` 文件存在时优先使用它；不存在但对应 `.enc` 或历史 `.json` 存在时，报告不支持的格式，不按全新安装初始化。不迁移、读取、删除或回退到历史 NG2 文件，不访问或清理旧 AES 与逐项 Keychain 凭据。用户确认重置后创建新的 `.age` 文件，旧文件保持原样。
+
+服务器库保留重试、显式解锁和确认创建空库；监听配置保留启动门禁和确认重置，默认关闭局域网监听。加载失败或重置失败期间保留原文件、已有后台代理与系统代理。用户主动执行的旧版 ShadowsocksX-NG 导入仍保留。
+
+## 验证与限制
+
+`AgeConfigurationStorageTests` 覆盖两份配置与标准 age CLI 的二进制、armor 双向互操作，以及旧文件拒绝、候选 identity 匹配、重置提交失败、结构和大小检查、隔离的真实 Keychain 操作。运行该测试需要 PATH 或 Homebrew bin 目录内存在 `age`，并能够访问登录钥匙串。
+
+age 保护静态内容，文件大小与时间戳仍可见。它不提供回滚保护、安全内存擦除、跨机 identity 恢复或独立密码加密备份。应用持有已解密资料和匹配 identity 至退出。
+
+源码入口：[EncryptedFileStorage](../ShadowsocksX-NG2/Domain/Credentials/EncryptedFileStorage.swift)、[MasterKeyStore](../ShadowsocksX-NG2/Domain/Credentials/MasterKeyStore.swift)、[CatalogFileStore](../ShadowsocksX-NG2/Domain/Catalog/CatalogFileStore.swift)、[ProxyListeningFileStore](../ShadowsocksX-NG2/Domain/Settings/ProxyListeningFileStore.swift)、[AtomicFileWriter](../ShadowsocksX-NG2/Domain/Runtime/AtomicFileWriter.swift)。
diff --git a/docs/subscription-provider-extension.md b/docs/subscription-provider-extension.md
new file mode 100644
index 000000000..80ef8b9ff
--- /dev/null
+++ b/docs/subscription-provider-extension.md
@@ -0,0 +1,176 @@
+# SIP-008 subscription extensions: provider guide
+
+Use this guide to build SIP-008 responses compatible with ShadowsocksX-NG. It covers the supported standard fields, private extensions, and parsing rules.
+
+[简体中文](subscription-provider-extension.zh.md)
+
+## Response delivery
+
+The subscription endpoint must meet these requirements:
+
+- Use HTTPS. The client validates the system trust chain, does not accept plain HTTP, and does not relax certificate or TLS validation. HTTPS-to-HTTPS redirects are allowed; redirects to non-HTTPS are rejected.
+- Return HTTP status `200` for a successful response.
+- Send `Content-Type: application/json; charset=utf-8`. The client ignores case and whitespace, but the service should send this exact form. A missing header or a different media type or character set is rejected.
+- Return one valid JSON object, not JSON5, Base64, or a list of `ss://` links.
+
+SIP-008 subscription URLs often contain access tokens. Use unpredictable tokens, and avoid recording complete subscription URLs in access logs, error tracking, or analytics systems. The subscription body contains server passwords. HTTPS protects the response in transit; the extension fields do not encrypt the body.
+
+## SIP-008 v1 base document
+
+The root object must contain `version: 1` and a `servers` array. An empty array is valid. SIP-008 requires each server entry to include `id`, `remarks`, `server`, `server_port`, `password`, and `method`; include `plugin` and `plugin_opts` when using a plugin. Each entry must remain a complete Shadowsocks server record. Do not put the only copy of a server configuration in the grouping extension.
+
+| Field | Provider requirement and recommendation | Client behavior |
+| --- | --- | --- |
+| `version` | Must be the integer `1`. | A missing or different version rejects the entire document. |
+| `servers` | Must be an array. Each entry uses the SIP-008 server fields listed below. | A missing value or a non-array rejects the entire document. An empty array is valid. |
+| `servers[].id` | Required by SIP-008. Give each server a unique, canonical UUID and preserve it across refreshes for the same logical server. The grouping extension uses this field to reference servers. | The current parser tolerates a missing `id`, but any supplied value must be a valid UUID. Duplicate IDs reject the entire document. Entries without an ID cannot be referenced by the group tree and are handled as ungrouped servers. |
+| `servers[].remarks` | Required by SIP-008. Provide a string to use as the server's display name. | The current parser tolerates omission; the name is empty when omitted. |
+| `servers[].server` | Must be a non-empty string. | A missing or empty value rejects the entire document. |
+| `servers[].server_port` | Must be an integer from `1` through `65535`. | A missing, non-integer, or out-of-range value rejects the entire document. |
+| `servers[].password` | Must be a non-empty string. | A missing or empty value rejects the entire document. |
+| `servers[].method` | Must be a non-empty string. Provide a Shadowsocks cipher supported by the client. | A missing or empty value rejects the entire document. The proxy runtime determines whether the method is available. |
+| `servers[].plugin`, `servers[].plugin_opts` | Omit or leave both empty when no plugin is used. When using a plugin, provide its name and corresponding options as specified by SIP-008. | The client passes the values into the server configuration; subscription parsing does not validate plugin option semantics. |
+
+A server ID represents logical identity, not its array position. Preserve the ID when renaming a server, changing its address or port, or updating its credentials if it remains the same logical server. Assign a new ID to a new logical server. Use the canonical hyphenated UUID form, and keep the exact same string in the server entry and extension references.
+
+## Extension namespace and version
+
+All ShadowsocksX-NG private extensions belong in the root-level `x_shadowsocksx_ng` object. This includes expiration and traffic reset dates, automatic update settings, and the group tree. Future project-specific fields must also use this namespace, rather than being added directly to the document root or server records.
+
+These fields are not part of SIP-008. Clients that do not recognize them must still be able to obtain every server from the standard `servers` array. For SIP-008's provisions on custom fields, see [SIP-008 Online Configuration Delivery](https://shadowsocks.org/doc/sip008.html).
+
+| Field | Format and meaning |
+| --- | --- |
+| `x_shadowsocksx_ng` | A JSON object at the document root containing ShadowsocksX-NG private extensions. |
+| `x_shadowsocksx_ng.schema_version` | Required integer, currently `1`. If the version is missing or unsupported, the client does not accept new extension data from this object. |
+
+Dates, `auto_update`, and the group tree are optional and can be used in any combination. With a supported schema version, each is parsed independently. An invalid group tree does not prevent a valid `auto_update` value from being accepted; an invalid `auto_update` value does not invalidate groups or dates. The `auto_update` section below specifies how missing and invalid values affect previously accepted data.
+
+## Subscription information
+
+Use the SIP-008 standard fields for traffic usage and the private extension fields for dates. Values must use the following formats.
+
+| Field | Provider format | Meaning |
+| --- | --- | --- |
+| `bytes_used` | A non-negative JSON integer from `0` through `18446744073709551615`. | Number of bytes used by the user. Do not send a string, negative number, decimal, or exponent form. |
+| `bytes_remaining` | A non-negative JSON integer in the same range. Omit it when there is no data limit; include `bytes_used` as well when a limit is enforced. | Number of bytes remaining. Do not duplicate this information in a private field. |
+| `x_shadowsocksx_ng.expires_at` | An RFC 3339 date-time string, such as `2027-01-01T00:00:00Z` or `2027-01-01T08:00:00+08:00`. | A ShadowsocksX-NG private field for the service expiration time. |
+| `x_shadowsocksx_ng.traffic_reset_at` | An RFC 3339 date-time string. | A ShadowsocksX-NG private field for the traffic reset time. |
+
+Date fields are direct members of `x_shadowsocksx_ng` and require `schema_version: 1`; the namespace may contain only the version and dates, without a group tree. Root-level `expires_at` and `traffic_reset_at` are ignored. A missing or non-object namespace, or a missing or unsupported schema version, provides no date information. The standard traffic fields remain at the root.
+
+An omitted date field or `null` means no value is provided. The client parses these fields independently. An invalid value is ignored without discarding valid servers, groups, or other valid information. The client reads this information from the JSON body; it does not parse response headers such as `Subscription-Userinfo`.
+
+## Automatic updates: `auto_update`
+
+The optional `x_shadowsocksx_ng.auto_update` object declares the provider's automatic update mode and whether users may override it. It does not require dates or a group tree.
+
+| Field | Type | Meaning and constraints |
+| --- | --- | --- |
+| `auto_update.mode` | String | Required and case-sensitive. Accepts only `"off"` (disabled), `"daily"` (daily updates), or `"weekly"` (weekly updates). |
+| `auto_update.allow_user_override` | Boolean | Required. When `true`, `mode` is a default that users may override. When `false`, the provider's `mode` must be used. |
+
+Neither field has a default. For example, `mode: "off"` with `allow_user_override: true` disables automatic updates by default but allows users to enable them. With `allow_user_override: false`, it requires automatic updates to remain disabled. The protocol has no fields for custom intervals or fixed update times.
+
+### Missing and invalid values
+
+The entire `auto_update` object is invalid if either required field is missing, has the wrong type, or contains an unsupported `mode`. An empty object, `null`, an array, or a boolean is also invalid. The string `"true"` and the number `1` are not accepted as substitutes for the boolean `true`.
+
+Once a response passes base-document validation and is successfully applied, the client handles `auto_update` as follows:
+
+| Response content | Result |
+| --- | --- |
+| `schema_version: 1` with a complete, valid `auto_update` object | Accept the new value, replacing any previous value. |
+| `schema_version: 1` with `auto_update` omitted | Clear the previous value. |
+| `x_shadowsocksx_ng` omitted or set to `null` | Clear the previous value. |
+| `auto_update` present but invalid, including `null` | Ignore the new value and retain the previous value. |
+| A non-object, non-null namespace, or a missing, incorrectly typed, or unsupported `schema_version` | Ignore the new value and retain the previous value. |
+
+To withdraw `auto_update`, omit the field. Sending `null` or an empty object will retain the previous value. An invalid `auto_update` value does not prevent valid servers, groups, or dates from being parsed.
+
+## Group tree
+
+The group tree defines names, hierarchy, display order, and server references. All fields in this section belong inside `x_shadowsocksx_ng`; server configurations stay in the root-level `servers` array.
+
+| Field | Meaning and constraints |
+| --- | --- |
+| `root_group_id` | A non-empty string that must match the `id` of the root group in `groups`. |
+| `groups` | An array of group objects. Each `id` must be non-empty and unique; a UUID that remains stable across refreshes is recommended. A group ID must not conflict with a server ID. |
+| `groups[].name` | Group display name. Providing it is recommended; the client displays an empty name if it is omitted. |
+| `groups[].children` | An ordered array. Its order is the display order in the client. Each entry must be `{ "type": "group", "id": "group ID" }` or `{ "type": "server", "id": "server UUID" }`. |
+
+The groups must form an acyclic tree rooted at `root_group_id`: each group has at most one parent, and every group and server reference resolves to an object. Reference each server at most once, and place every group intended for display in the tree reachable from the root. Group and server IDs are stable identities; do not use names, array positions, or mutable configuration values as IDs.
+
+Group parsing and fallback rules:
+
+- If the extension version is missing or unsupported, the root group is missing, IDs conflict, a reference is invalid, a child type is unknown, a cycle exists, or a group has multiple parents, the client ignores the group tree and uses the flat standard `servers` list. Valid servers are not lost because of an invalid group tree.
+- A server in `servers` that is not referenced by a valid tree is still shown at the end of the root group, in the order it appears in the `servers` array. If the extension is invalid or incomplete, servers may still appear, but their grouping is not preserved.
+- Groups unreachable from the root are not shown. Do not rely on client behavior for unreachable groups or duplicate server references; providers should produce a valid tree without orphan groups or repeated server references.
+- A record without a server `id` cannot be referenced by the tree. Provide a stable ID for every server to preserve grouping.
+
+## Complete response example
+
+This response includes two servers, traffic usage and dates, a daily update default that users may override, and nested groups.
+
+```json
+{
+  "version": 1,
+  "servers": [
+    {
+      "id": "3c5e2af7-9f2c-4f42-bd1c-9e143d5f2d11",
+      "remarks": "Tokyo 1",
+      "server": "tokyo.example.com",
+      "server_port": 443,
+      "password": "example-secret-1",
+      "method": "chacha20-ietf-poly1305"
+    },
+    {
+      "id": "b9f08d65-8be7-4b09-bf94-4f2bb53e4199",
+      "remarks": "Osaka 1",
+      "server": "osaka.example.com",
+      "server_port": 443,
+      "password": "example-secret-2",
+      "method": "chacha20-ietf-poly1305"
+    }
+  ],
+  "bytes_used": 1073741824,
+  "bytes_remaining": 9663676416,
+  "x_shadowsocksx_ng": {
+    "schema_version": 1,
+    "expires_at": "2027-01-01T00:00:00Z",
+    "traffic_reset_at": "2026-11-01T00:00:00Z",
+    "auto_update": {
+      "mode": "daily",
+      "allow_user_override": true
+    },
+    "root_group_id": "f6ad0a41-2a1d-4db8-9da0-b6f4f3dc889d",
+    "groups": [
+      {
+        "id": "f6ad0a41-2a1d-4db8-9da0-b6f4f3dc889d",
+        "name": "My subscription",
+        "children": [
+          { "type": "group", "id": "a1e2b11c-2f53-4e39-bc36-95af6dbb5f1c" },
+          { "type": "server", "id": "3c5e2af7-9f2c-4f42-bd1c-9e143d5f2d11" }
+        ]
+      },
+      {
+        "id": "a1e2b11c-2f53-4e39-bc36-95af6dbb5f1c",
+        "name": "Japan",
+        "children": [
+          { "type": "server", "id": "b9f08d65-8be7-4b09-bf94-4f2bb53e4199" }
+        ]
+      }
+    ]
+  }
+}
+```
+
+## Provider checklist
+
+- Serve the response over HTTPS with HTTP status `200` and `Content-Type: application/json; charset=utf-8`.
+- Return valid JSON with `version: 1` at the root and complete server records in `servers`.
+- Assign each server a unique, stable UUID. Use exactly the same string in server records and group references.
+- Set `schema_version` to `1` when using private extensions. If a group tree is included, ensure the root exists, all references resolve, and the tree is ordered, single-parent, and acyclic.
+- Use the standard SIP-008 fields for traffic usage. Put expiration and reset dates inside `x_shadowsocksx_ng` as RFC 3339 strings.
+- If `auto_update` is included, provide both a valid `mode` and a boolean `allow_user_override`. Check that the override setting matches your intent. To withdraw the value, omit it instead of sending `null` or an empty object.
+- Check compatibility with a SIP-008 client that does not support `x_shadowsocksx_ng`: the flat `servers` array must still contain every server.
diff --git a/docs/subscription-provider-extension.zh.md b/docs/subscription-provider-extension.zh.md
new file mode 100644
index 000000000..f0b01dc71
--- /dev/null
+++ b/docs/subscription-provider-extension.zh.md
@@ -0,0 +1,176 @@
+# SIP-008 订阅扩展：供应方说明
+
+本文说明 ShadowsocksX-NG 当前支持的 SIP-008 订阅字段和私有扩展，供订阅服务提供方生成兼容响应时参考。内容以当前实现为准。
+
+[English](subscription-provider-extension.md)
+
+## 响应传输
+
+订阅端点必须满足以下条件：
+
+- 使用 HTTPS。客户端验证系统信任链，不接受明文 HTTP，也不放宽证书或 TLS 校验；HTTPS 到 HTTPS 的重定向可以跟随，降级到非 HTTPS 会被拒绝。
+- 成功响应状态码为 `200`。
+- 响应头使用 `Content-Type: application/json; charset=utf-8`。客户端不区分大小写并忽略空白，但服务端应按此格式发送；缺少该头或使用其他类型、字符集都会被拒绝。
+- 响应正文是一个合法的 JSON 对象，不是 JSON5、Base64 或 `ss://` 链接列表。
+
+SIP-008 订阅 URL 通常包含访问令牌。请使用不可猜测的令牌，并避免在服务端访问日志、错误追踪或分析系统中记录完整订阅 URL。订阅正文含服务器密码；HTTPS 负责传输保护，扩展字段本身不加密正文。
+
+## SIP-008 v1 基础对象
+
+根对象必须包含 `version: 1` 和 `servers` 数组。空数组有效。服务器项按 SIP-008 应提供 `id`、`remarks`、`server`、`server_port`、`password` 和 `method`；使用插件时再提供 `plugin`、`plugin_opts`。每个服务器项仍须是完整的 Shadowsocks 服务器记录；不能只在分组扩展里发送服务器配置。
+
+| 字段 | 供应方要求与建议 | 客户端处理 |
+| --- | --- | --- |
+| `version` | 必须是整数 `1`。 | 缺失或其他版本会拒绝整份文档。 |
+| `servers` | 必须是数组；每项使用下表所列的 SIP-008 服务器字段。 | 缺失或不是数组会拒绝整份文档。空数组有效。 |
+| `servers[].id` | SIP-008 服务器项必需字段。每台服务器提供唯一、规范格式的 UUID，并在同一逻辑服务器的后续刷新中保持不变。分组扩展依赖此字段引用服务器。 | 当前解析器容忍省略 `id`，但提供后必须是有效 UUID；重复 ID 会拒绝整份文档。无 ID 项不能被扩展树引用，会按扁平兼容路径处理。 |
+| `servers[].remarks` | SIP-008 服务器项必需字段，提供服务器显示名称字符串。 | 当前解析器容忍省略；缺省时名称为空。 |
+| `servers[].server` | 必须是非空字符串。 | 缺失或为空会拒绝整份文档。 |
+| `servers[].server_port` | 必须是 `1` 到 `65535` 范围内的整数。 | 缺失、非整数或越界会拒绝整份文档。 |
+| `servers[].password` | 必须是非空字符串。 | 缺失或为空会拒绝整份文档。 |
+| `servers[].method` | 必须是非空字符串。请提供客户端可用的 Shadowsocks 加密方法。 | 缺失或为空会拒绝整份文档；方法是否可用由代理运行时决定。 |
+| `servers[].plugin`、`servers[].plugin_opts` | 未使用插件时两项省略或留空；使用插件时按 SIP-008 提供插件名及对应选项。 | 客户端将值带入服务器配置，不会在订阅解析时校验插件选项语义。 |
+
+服务器 ID 表示逻辑身份，不是数组位置。改名、改地址、改端口或更新凭据时，如果仍是同一逻辑服务器，应保留原 ID；新增一台逻辑服务器时分配新 ID。UUID 应采用连字符分隔的规范形式，并在正文和扩展引用中保持完全相同的字符串。
+
+## 私有扩展与版本
+
+`x_shadowsocksx_ng` 是根对象中的私有扩展命名空间，当前支持 `schema_version: 1`。服务到期时间、流量重置时间、自动更新策略和分组树都放在该对象内。新增的项目私有字段也须归入这个命名空间，不直接放在根层或服务器对象中。
+
+这些字段不是 SIP-008 标准字段。普通 SIP-008 客户端不一定识别它们，因此根层的 `servers` 仍须包含全部服务器。SIP-008 对自定义字段的说明见 [SIP-008 Online Configuration Delivery](https://shadowsocks.org/doc/sip008.html)。
+
+| 字段 | 格式与含义 |
+| --- | --- |
+| `x_shadowsocksx_ng` | 根层的 JSON 对象，承载 ShadowsocksX-NG 私有扩展。 |
+| `x_shadowsocksx_ng.schema_version` | 必须是整数 `1`。缺失或不支持的版本不会采用其中的新扩展数据。 |
+
+时间资料、`auto_update` 和分组树可以单独提供，也可以组合使用。版本受支持时，各功能独立解析：分组树无效不会阻止有效更新策略生效，更新策略无效也不会丢弃有效分组或时间资料。`auto_update` 的缺失与无效值处理见下文。
+
+## 订阅资料
+
+以下流量字段来自 SIP-008。供应方应遵守 SIP-008 对数据量字段的约定；字段格式如下。
+
+| 字段 | 供应方格式 | 说明 |
+| --- | --- | --- |
+| `bytes_used` | JSON 非负整数，范围为 `0` 至 `18446744073709551615`。 | 用户已使用的字节数。不要发送字符串、负数、小数或指数形式。 |
+| `bytes_remaining` | JSON 非负整数，范围同上。没有流量上限时省略；有限额时同时提供 `bytes_used`。 | 用户剩余可用字节数。不要用私有字段重复表达同一流量含义。 |
+| `x_shadowsocksx_ng.expires_at` | RFC 3339 日期时间字符串，例如 `2027-01-01T00:00:00Z` 或 `2027-01-01T08:00:00+08:00`。 | ShadowsocksX-NG 私有字段，表示服务到期时间。 |
+| `x_shadowsocksx_ng.traffic_reset_at` | RFC 3339 日期时间字符串。 | ShadowsocksX-NG 私有字段，表示流量重置时间。 |
+
+时间字段直接放在 `x_shadowsocksx_ng` 中，要求 `schema_version: 1`；该对象可以只包含版本和时间字段，无需提供分组树。根层的 `expires_at`、`traffic_reset_at` 不予解析。命名空间缺失、不是对象，或版本缺失、不支持时，视为未提供时间资料。标准流量字段仍放在根层。
+
+日期字段缺失或为 `null` 表示未提供。客户端逐项解析这些资料；某一项格式错误只会忽略该项，不会丢弃有效服务器、分组或其他有效资料。客户端从 JSON 正文读取资料，不解析 HTTP `Subscription-Userinfo` 等响应头。
+
+## 自动更新 `auto_update`
+
+`x_shadowsocksx_ng.auto_update` 是可选对象，用于声明供应方的自动更新模式及是否允许用户覆盖。该对象与时间资料、分组树互不依赖。
+
+| 字段 | 类型 | 含义与约束 |
+| --- | --- | --- |
+| `auto_update.mode` | 字符串 | 必填，区分大小写。只接受 `"off"`（关闭）、`"daily"`（每天）或 `"weekly"`（每周）。 |
+| `auto_update.allow_user_override` | 布尔值 | 必填。`true` 表示 `mode` 是允许用户覆盖的默认值；`false` 表示必须采用供应方的 `mode`。 |
+
+两个字段均无缺省值。`mode: "off"` 与 `allow_user_override: true` 组合表示默认关闭，允许用户开启；与 `false` 组合表示强制关闭。协议不提供自定义更新间隔或固定更新时间字段。
+
+### 缺失与无效值
+
+缺少任意必填字段、字段类型错误或 `mode` 取值不受支持，都会使整个 `auto_update` 无效。`null`、空对象、数组、布尔值也都是无效值；字符串 `"true"` 和数字 `1` 不能代替布尔值 `true`。
+
+对于通过基础文档校验并成功应用的响应，客户端按下表处理供应方的 `auto_update`。
+
+| 响应内容 | 处理结果 |
+| --- | --- |
+| `schema_version: 1`，且 `auto_update` 完整有效 | 采用本次值，替换旧值。 |
+| `schema_version: 1`，但省略 `auto_update` | 清除旧值。 |
+| 省略整个 `x_shadowsocksx_ng`，或将其设为 `null` | 清除旧值。 |
+| `auto_update` 存在但无效，包括设为 `null` | 忽略本次值，保留旧值。 |
+| 命名空间不是对象且非 `null`，或 `schema_version` 缺失、类型错误、不受支持 | 忽略本次值，保留旧值。 |
+
+因此，撤回 `auto_update` 时应省略该字段，不能用 `null` 或空对象代替。无效的 `auto_update` 不影响有效服务器、分组或时间资料的解析。
+
+## 分组树
+
+分组树表达分组名称、层级、顺序和服务器引用。以下字段均位于 `x_shadowsocksx_ng` 中，服务器配置仍放在根层 `servers`。
+
+| 字段 | 含义和约束 |
+| --- | --- |
+| `root_group_id` | 非空字符串，必须对应 `groups` 中根分组的 `id`。 |
+| `groups` | 分组对象数组。每个 `id` 必须非空且唯一；建议使用不随刷新变化的 UUID。分组 ID 不得与服务器 ID 冲突。 |
+| `groups[].name` | 分组显示名称。建议始终提供；缺省时客户端显示空名称。 |
+| `groups[].children` | 有序数组，数组顺序就是客户端显示顺序。每项必须是 `{ "type": "group", "id": "分组 ID" }` 或 `{ "type": "server", "id": "服务器 UUID" }`。 |
+
+供应方应确保扩展构成从 `root_group_id` 出发的单父、无环树：每个分组最多有一个父分组，所有分组和服务器引用都能解析到相应对象。每个服务器最多引用一次；请将每个预期展示的分组放在根分组可到达的树中。分组与服务器 ID 都是稳定身份，不要把名称、数组下标或可变配置内容当作 ID。
+
+分组树的解析与回退规则如下：
+
+- 扩展版本缺失或不支持、根分组不存在、ID 冲突、引用无效、子项类型未知、出现环或分组被多个父分组引用时，分组树会被忽略，客户端改用标准 `servers` 扁平列表；有效服务器不会因此丢失。
+- 未被有效树引用但存在于 `servers` 的服务器仍会显示在根分组末尾，顺序沿用其在 `servers` 数组中的顺序。因此扩展失效或不完整时，服务器仍可能显示，但分组关系不会保留。
+- 树中不可从根到达的分组不会显示。请勿依赖客户端对不可达分组或重复服务器引用的处理；供应方应输出没有孤立分组、没有重复服务器引用的有效树。
+- 缺少服务器 `id` 的记录无法被树引用；为保证分组准确，请给所有服务器提供稳定 ID。
+
+## 完整响应示例
+
+此示例包含两台服务器、时间与流量资料、允许用户覆盖的每天更新策略，以及嵌套分组。
+
+```json
+{
+  "version": 1,
+  "servers": [
+    {
+      "id": "3c5e2af7-9f2c-4f42-bd1c-9e143d5f2d11",
+      "remarks": "Tokyo 1",
+      "server": "tokyo.example.com",
+      "server_port": 443,
+      "password": "example-secret-1",
+      "method": "chacha20-ietf-poly1305"
+    },
+    {
+      "id": "b9f08d65-8be7-4b09-bf94-4f2bb53e4199",
+      "remarks": "Osaka 1",
+      "server": "osaka.example.com",
+      "server_port": 443,
+      "password": "example-secret-2",
+      "method": "chacha20-ietf-poly1305"
+    }
+  ],
+  "bytes_used": 1073741824,
+  "bytes_remaining": 9663676416,
+  "x_shadowsocksx_ng": {
+    "schema_version": 1,
+    "expires_at": "2027-01-01T00:00:00Z",
+    "traffic_reset_at": "2026-11-01T00:00:00Z",
+    "auto_update": {
+      "mode": "daily",
+      "allow_user_override": true
+    },
+    "root_group_id": "f6ad0a41-2a1d-4db8-9da0-b6f4f3dc889d",
+    "groups": [
+      {
+        "id": "f6ad0a41-2a1d-4db8-9da0-b6f4f3dc889d",
+        "name": "我的订阅",
+        "children": [
+          { "type": "group", "id": "a1e2b11c-2f53-4e39-bc36-95af6dbb5f1c" },
+          { "type": "server", "id": "3c5e2af7-9f2c-4f42-bd1c-9e143d5f2d11" }
+        ]
+      },
+      {
+        "id": "a1e2b11c-2f53-4e39-bc36-95af6dbb5f1c",
+        "name": "日本",
+        "children": [
+          { "type": "server", "id": "b9f08d65-8be7-4b09-bf94-4f2bb53e4199" }
+        ]
+      }
+    ]
+  }
+}
+```
+
+## 提供方发布前检查
+
+- 使用 HTTPS，返回 HTTP `200` 和 `Content-Type: application/json; charset=utf-8`。
+- 提供合法 JSON，根级 `version` 为 `1`，`servers` 包含完整服务器记录。
+- 为每台服务器提供唯一且稳定的 UUID；服务器 ID 在 `servers` 和分组引用中逐字一致。
+- 若使用扩展，`schema_version` 为 `1`；若提供分组树，根分组须存在，所有引用有效，树有序、单父、无环。
+- 流量字段使用 SIP-008 标准字段；到期与重置日期放在 `x_shadowsocksx_ng` 下，使用本文规定的 RFC 3339 字符串。
+- 若提供 `auto_update`，同时提供有效的 `mode` 和布尔值 `allow_user_override`；确认是否允许用户覆盖，并检查撤回策略时没有误用 `null` 或空对象。
+- 以不支持 `x_shadowsocksx_ng` 的普通 SIP-008 客户端验证时，扁平 `servers` 列表仍包含全部服务器。
diff --git a/genstrings.py b/genstrings.py
deleted file mode 100644
index 338a60424..000000000
--- a/genstrings.py
+++ /dev/null
@@ -1,155 +0,0 @@
-#  Created by Johannes Schriewer on 2011-11-30. Modified by Roy Marmelstein 2015-08-05
-#  Copyright (c) 2011 planetmutlu.
-#  All rights reserved.
-#
-#  Redistribution and use in source and binary forms, with or without
-#  modification, are permitted provided that the following conditions
-#  are met:
-#
-#  - Redistributions of source code must retain the above copyright
-#    notice, this list of conditions and the following disclaimer.
-#  - Redistributions in binary form must reproduce the above copyright
-#    notice, this list of conditions and the following disclaimer in the
-#    documentation and/or other materials provided with the distribution.
-#
-#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-#  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
-#  TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-#  PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER
-#  OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-#  EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-#  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-#  PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-#  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-#  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-#  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-# This script is heavily copied from: https://github.com/dunkelstern/Cocoa-Localisation-Helper
-# Copied from https://github.com/marmelroy/Localize-Swift By QiuYuzhou
-
-import os, re, subprocess
-import fnmatch
-
-def fetch_files_recursive(directory, extension):
-    matches = []
-    for root, dirnames, filenames in os.walk(directory):
-      for filename in fnmatch.filter(filenames, '*' + extension):
-          matches.append(os.path.join(root, filename))
-    return matches
-
-
-# prepare regexes
-localizedStringComment = re.compile('NSLocalizedString\("([^"]*)",\s*"([^"]*)"\s*\)', re.DOTALL)
-localizedStringNil = re.compile('NSLocalizedString\("([^"]*)",\s*nil\s*\)', re.DOTALL)
-localized = re.compile('Localized\("([^"]*)"[^\n\r]*\)', re.DOTALL)
-localizedProperty = re.compile('"([^"]*)".localized', re.DOTALL)# Add By QiuYuzhou
-localizedSwift2 = re.compile('"([^"]*)".localized\(\)', re.DOTALL)
-localizedSwift2WithFormat = re.compile('"([^"]*)".localizedFormat\([^\n\r]*\)', re.DOTALL)
-
-# get string list
-uid = 0
-strings = []
-for file in fetch_files_recursive('.', '.swift'):
-    with open(file, 'r') as f:
-        content = f.read()
-        for result in localizedStringComment.finditer(content):
-            uid += 1
-            strings.append((result.group(1), result.group(2), file, uid))
-        for result in localizedStringNil.finditer(content):
-            uid += 1
-            strings.append((result.group(1), '', file, uid))
-        for result in localized.finditer(content):
-            uid += 1
-            strings.append((result.group(1), '', file, uid))
-        # Add By QiuYuzhou, Begin
-        for result in localizedProperty.finditer(content):
-            uid += 1
-            strings.append((result.group(1), '', file, uid))
-        # Add By QiuYuzhou, End
-        for result in localizedSwift2.finditer(content):
-            uid += 1
-            strings.append((result.group(1), '', file, uid))
-        for result in localizedSwift2WithFormat.finditer(content):
-            uid += 1
-            strings.append((result.group(1), '', file, uid))
-
-# prepare regexes
-localizedString = re.compile('"[^=]*=\s*"([^"]*)";')
-
-# Changed By QiuYuzhou, disable for *.xib
-# fetch files
-#for file in fetch_files_recursive('.', '.xib'):
-#    tempFile = file + '.strings'
-#    utf8tempFile = file + '.strings.utf8'
-#    subprocess.call('ibtool --export-strings-file "' + tempFile + '" "' + file + '" 2>/dev/null', shell=True)
-#    subprocess.call('iconv -s -f UTF-16 -t UTF-8 "' + tempFile + '" >"'+utf8tempFile+'" 2>/dev/null', shell=True)
-#
-#    f = open(utf8tempFile, 'r')
-#    for line in f:
-#        result = localizedString.match(line)
-#        if result:
-#            uid += 1
-#            strings.append((result.group(1), '', file, uid))
-#    f.close()
-#
-#    os.remove(utf8tempFile)
-#    os.remove(tempFile)
-
-# find duplicates
-duplicated = []
-filestrings = {}
-for string1 in strings:
-    dupmatch = 0
-    for string2 in strings:
-        if string1[3] == string2[3]:
-            continue
-        if string1[0] == string2[0]:
-            if string1[2] != string2[2]:
-                dupmatch = 1
-            break
-    if dupmatch == 1:
-        dupmatch = 0
-        for string2 in duplicated:
-            if string1[0] == string2[0]:
-                dupmatch = 1
-                break
-        if dupmatch == 0:
-            duplicated.append(string1)
-    else:
-        dupmatch = 0
-        if string1[2] in filestrings:
-            for fs in filestrings[string1[2]]:
-                if fs[0] == string1[0]:
-                    dupmatch = 1
-                    break
-        else:
-            filestrings[string1[2]] = []
-        if dupmatch == 0:
-            filestrings[string1[2]].append(string1)
-
-print '\n\n\n\n\n'
-print '/*\n * SHARED STRINGS\n */\n'
-
-# output filewise
-for key in filestrings.keys():
-    print '/*\n * ' + key + '\n */\n'
-
-    strings = filestrings[key]
-    for string in strings:
-        if string[1] == '':
-            print '"' + string[0] + '" = "' + string[0] + '";'
-            print
-        else:
-            print '/* ' + string[1] + ' */'
-            print '"' + string[0] + '" = "' + string[0] + '";'
-            print
-
-# output duplicates
-for string in duplicated:
-    if string[1] == '':
-        print '"' + string[0] + '" = "' + string[0] + '";'
-        print
-    else:
-        print '/* ' + string[1] + ' */'
-        print '"' + string[0] + '" = "' + string[0] + '";'
-        print
\ No newline at end of file
diff --git a/proxy_conf_helper/main.m b/proxy_conf_helper/main.m
deleted file mode 100644
index 1abffe51d..000000000
--- a/proxy_conf_helper/main.m
+++ /dev/null
@@ -1,224 +0,0 @@
-//
-//  main.m
-//  shadowsocks_sysconf
-//
-//  Created by clowwindy on 14-3-15.
-//  Copyright (c) 2014年 clowwindy. All rights reserved.
-//
-// Changed by QiuYuzhou
-
-
-#import <Foundation/Foundation.h>
-#import <SystemConfiguration/SystemConfiguration.h>
-#import "../ShadowsocksX-NG/proxy_conf_helper_version.h"
-
-// A library for parsing command line.
-// https://github.com/stephencelis/BRLOptionParser
-#import <BRLOptionParser/BRLOptionParser.h>
-
-
-int main(int argc, const char * argv[])
-{
-    NSString* mode;
-    NSString* pacURL;
-    NSString* portString;
-    NSString* socks5ListenAddress;
-    NSString* privoxyPortString;
-    NSString* privoxyListenAddress;
-    
-    BRLOptionParser *options = [BRLOptionParser new];
-    [options setBanner:@"Usage: %s [-v] [-m auto|global|off] [-u <url>] [-p <port>] [-l <socks5-listen-address>] [-r <port>] [-p <privoxy-listen-address>] [-x <exception>]", argv[0]];
-    
-    // Version
-    [options addOption:"version" flag:'v' description:@"Print the version number." block:^{
-        printf("%s", [kProxyConfHelperVersion UTF8String]);
-        exit(EXIT_SUCCESS);
-    }];
-    
-    // Help
-    __weak typeof(options) weakOptions = options;
-    [options addOption:"help" flag:'h' description:@"Show this message" block:^{
-        printf("%s", [[weakOptions description] UTF8String]);
-        exit(EXIT_SUCCESS);
-    }];
-    
-    // Mode
-    [options addOption:"mode" flag:'m' description:@"Proxy mode, may be: auto,global,off" argument:&mode];
-    
-    [options addOption:"pac-url" flag:'u' description:@"PAC file url for auto mode." argument:&pacURL];
-    [options addOption:"port" flag:'p' description:@"Listen port for global mode." argument:&portString];
-    [options addOption:"socks-listen-address" flag:'l' description:@"Listen socks5 address for global mode." argument:&socks5ListenAddress];
-    
-    [options addOption:"privoxy-port" flag:'r' description:@"Privoxy Port for global mode." argument:&privoxyPortString];
-    [options addOption:"privoxy-listen-address" flag:'s' description:@"Privoxy Listen Address for global mode." argument:&privoxyListenAddress];
-    
-    NSMutableSet* networkServiceKeys = [NSMutableSet set];
-    [options addOption:"network-service" flag:'n' description:@"Manual specify the network profile need to set proxy." blockWithArgument:^(NSString* value){
-        [networkServiceKeys addObject:value];
-    }];
-
-    NSMutableSet* proxyExceptions = [NSMutableSet set];
-    [options addOption:"proxy-exception" flag:'x' description:@"Bypass proxy settings for this Host / Domain" blockWithArgument:^(NSString *value) {
-        [proxyExceptions addObject:value];
-    }];
-    
-    NSError *error = nil;
-    if (![options parseArgc:argc argv:argv error:&error]) {
-        const char * message = error.localizedDescription.UTF8String;
-        fprintf(stderr, "%s: %s\n", argv[0], message);
-        exit(EXIT_FAILURE);
-    }
-    
-    if (mode) {
-        if ([@"auto" isEqualToString:mode]) {
-            if (!pacURL) {
-                return 1;
-            }
-        } else if ([@"global" isEqualToString:mode]) {
-            if (!portString) {
-                return 1;
-            }
-        } else if (![@"off" isEqualToString:mode]) {
-            return 1;
-        }
-    } else {
-        printf("%s", [kProxyConfHelperVersion UTF8String]);
-        return 0;
-    }
-    
-    NSInteger port = 0;
-    if (portString) {
-        port = [portString integerValue];
-        if (0 == port) {
-            return 1;
-        }
-    }
-    
-    NSInteger privoxyPort = 0;
-    if (privoxyPortString) {
-        privoxyPort = [privoxyPortString integerValue];
-        if (0 == privoxyPort) {
-            return 1;
-        }
-    }
-    
-    static AuthorizationRef authRef;
-    static AuthorizationFlags authFlags;
-    authFlags = kAuthorizationFlagDefaults
-    | kAuthorizationFlagExtendRights
-    | kAuthorizationFlagInteractionAllowed
-    | kAuthorizationFlagPreAuthorize;
-    OSStatus authErr = AuthorizationCreate(nil, kAuthorizationEmptyEnvironment, authFlags, &authRef);
-    if (authErr != noErr) {
-        authRef = nil;
-        NSLog(@"Error when create authorization");
-        return 1;
-    } else {
-        if (authRef == NULL) {
-            NSLog(@"No authorization has been granted to modify network configuration");
-            return 1;
-        }
-        
-        SCPreferencesRef prefRef = SCPreferencesCreateWithAuthorization(nil, CFSTR("Shadowsocks"), nil, authRef);
-        
-        NSDictionary *sets = (__bridge NSDictionary *)SCPreferencesGetValue(prefRef, kSCPrefNetworkServices);
-        
-        NSMutableDictionary *proxies = [[NSMutableDictionary alloc] init];
-        [proxies setObject:[NSNumber numberWithInt:0] forKey:(NSString *)kCFNetworkProxiesHTTPEnable];
-        [proxies setObject:[NSNumber numberWithInt:0] forKey:(NSString *)kCFNetworkProxiesHTTPSEnable];
-        [proxies setObject:[NSNumber numberWithInt:0] forKey:(NSString *)kCFNetworkProxiesProxyAutoConfigEnable];
-        [proxies setObject:[NSNumber numberWithInt:0] forKey:(NSString *)kCFNetworkProxiesSOCKSEnable];
-        [proxies setObject:@[] forKey:(NSString *)kCFNetworkProxiesExceptionsList];
-        
-        // 遍历系统中的网络设备列表，设置 AirPort 和 Ethernet 的代理
-        for (NSString *key in [sets allKeys]) {
-            NSMutableDictionary *dict = [sets objectForKey:key];
-            NSString *hardware = [dict valueForKeyPath:@"Interface.Hardware"];
-            //        NSLog(@"%@", hardware);
-            BOOL modify = NO;
-            if ([networkServiceKeys count] > 0) {
-                if ([networkServiceKeys containsObject:key]) {
-                    modify = YES;
-                }
-            } else if ([hardware isEqualToString:@"AirPort"]
-                       || [hardware isEqualToString:@"Wi-Fi"]
-                       || [hardware isEqualToString:@"Ethernet"]) {
-                modify = YES;
-            }
-            
-            if (modify) {
-                
-                NSString* prefPath = [NSString stringWithFormat:@"/%@/%@/%@", kSCPrefNetworkServices
-                                      , key, kSCEntNetProxies];
-                
-                if ([mode isEqualToString:@"auto"]) {
-                    
-                    [proxies setObject:pacURL forKey:(NSString *)kCFNetworkProxiesProxyAutoConfigURLString];
-                    [proxies setObject:[NSNumber numberWithInt:1] forKey:(NSString *)kCFNetworkProxiesProxyAutoConfigEnable];
-                    
-                    SCPreferencesPathSetValue(prefRef, (__bridge CFStringRef)prefPath
-                                              , (__bridge CFDictionaryRef)proxies);
-                } else if ([mode isEqualToString:@"global"]) {
-                    
-                    
-                    [proxies setObject:socks5ListenAddress forKey:(NSString *)
-                     kCFNetworkProxiesSOCKSProxy];
-                    [proxies setObject:[NSNumber numberWithInteger:port] forKey:(NSString*)
-                     kCFNetworkProxiesSOCKSPort];
-                    [proxies setObject:[NSNumber numberWithInt:1] forKey:(NSString*)
-                     kCFNetworkProxiesSOCKSEnable];
-                    [proxies setObject:[proxyExceptions allObjects] forKey:(NSString *)kCFNetworkProxiesExceptionsList];
-                    
-                    if (privoxyPort != 0) {
-                        [proxies setObject:privoxyListenAddress forKey:(NSString *)
-                         kCFNetworkProxiesHTTPProxy];
-                        [proxies setObject:[NSNumber numberWithInteger:privoxyPort] forKey:(NSString*)
-                         kCFNetworkProxiesHTTPPort];
-                        [proxies setObject:[NSNumber numberWithInt:1] forKey:(NSString*)
-                         kCFNetworkProxiesHTTPEnable];
-                        
-                        [proxies setObject:privoxyListenAddress forKey:(NSString *)
-                         kCFNetworkProxiesHTTPSProxy];
-                        [proxies setObject:[NSNumber numberWithInteger:privoxyPort] forKey:(NSString*)
-                         kCFNetworkProxiesHTTPSPort];
-                        [proxies setObject:[NSNumber numberWithInt:1] forKey:(NSString*)
-                         kCFNetworkProxiesHTTPSEnable];
-                    }
-                    
-                    SCPreferencesPathSetValue(prefRef, (__bridge CFStringRef)prefPath
-                                              , (__bridge CFDictionaryRef)proxies);
-                } else if ([mode isEqualToString:@"off"]) {
-                    if (pacURL != nil && portString != nil && socks5ListenAddress != nil) {
-                        // 取原来的配置，判断是否为shadowsocksX-NG设置的
-                        NSDictionary* oldProxies
-                            = (__bridge NSDictionary*)SCPreferencesPathGetValue(prefRef
-                                                                                , (__bridge CFStringRef)prefPath);
-                        
-                        if (([oldProxies[(NSString *)kCFNetworkProxiesProxyAutoConfigURLString] isEqualToString:pacURL]
-                             &&[oldProxies[(NSString *)kCFNetworkProxiesProxyAutoConfigEnable] isEqual:[NSNumber numberWithInt:1]])
-                            ||([oldProxies[(NSString*)kCFNetworkProxiesSOCKSProxy] isEqualToString:socks5ListenAddress]
-                               &&[oldProxies[(NSString*)kCFNetworkProxiesSOCKSPort] isEqualTo:[NSNumber numberWithInteger:port]]
-                               &&[oldProxies[(NSString*)kCFNetworkProxiesSOCKSEnable] isEqual:[NSNumber numberWithInt:1]])
-                            ) {
-                            SCPreferencesPathSetValue(prefRef, (__bridge CFStringRef)prefPath
-                                                      , (__bridge CFDictionaryRef)proxies);
-                        }
-                    } else {
-                        SCPreferencesPathSetValue(prefRef, (__bridge CFStringRef)prefPath
-                                                  , (__bridge CFDictionaryRef)proxies);
-                    }
-                }
-            }
-        }
-        
-        SCPreferencesCommitChanges(prefRef);
-        SCPreferencesApplyChanges(prefRef);
-        SCPreferencesSynchronize(prefRef);
-        
-        AuthorizationFree(authRef, kAuthorizationFlagDefaults);
-    }
-    
-    printf("pac proxy set to %s", [mode UTF8String]);
-    
-    return 0;
-}